SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2009  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/list.h>
  11 #include <linux/if_ether.h>
  12 #include <linux/ieee80211.h>
  13 #include <linux/nl80211.h>
  14 #include <linux/rtnetlink.h>
  15 #include <linux/netlink.h>
  16 #include <linux/etherdevice.h>
  17 #include <net/net_namespace.h>
  18 #include <net/genetlink.h>
  19 #include <net/cfg80211.h>
  20 #include <net/sock.h>
  21 #include "core.h"
  22 #include "nl80211.h"
  23 #include "reg.h"
  24
  25 /* the netlink family */
  26 static struct genl_family nl80211_fam = {
  27         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  28         .name = "nl80211",      /* have users key off the name instead */
  29         .hdrsize = 0,           /* no private header */
  30         .version = 1,           /* no particular meaning now */
  31         .maxattr = NL80211_ATTR_MAX,
  32         .netnsok = true,
  33 };
  34
  35 /* internal helper: get rdev and dev */
  36 static int get_rdev_dev_by_info_ifindex(struct genl_info *info,
  37                                        struct cfg80211_registered_device **rdev,
  38                                        struct net_device **dev)
  39 {
  40         struct nlattr **attrs = info->attrs;
  41         int ifindex;
  42
  43         if (!attrs[NL80211_ATTR_IFINDEX])
  44                 return -EINVAL;
  45
  46         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  47         *dev = dev_get_by_index(genl_info_net(info), ifindex);
  48         if (!*dev)
  49                 return -ENODEV;
  50
  51         *rdev = cfg80211_get_dev_from_ifindex(genl_info_net(info), ifindex);
  52         if (IS_ERR(*rdev)) {
  53                 dev_put(*dev);
  54                 return PTR_ERR(*rdev);
  55         }
  56
  57         return 0;
  58 }
  59
  60 /* policy for the attributes */
  61 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
  62         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  63         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  64                                       .len = 20-1 },
  65         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  66         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  67         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  68         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
  69         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
  70         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
  71         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
  72         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
  73
  74         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  75         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  76         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  77
  78         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  79         [NL80211_ATTR_PREV_BSSID] = { .type = NLA_BINARY, .len = ETH_ALEN },
  80
  81         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
  82         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  83                                     .len = WLAN_MAX_KEY_LEN },
  84         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  85         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  86         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
  87         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
  88
  89         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
  90         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
  91         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
  92                                        .len = IEEE80211_MAX_DATA_LEN },
  93         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
  94                                        .len = IEEE80211_MAX_DATA_LEN },
  95         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
  96         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
  97         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
  98         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
  99                                                .len = NL80211_MAX_SUPP_RATES },
 100         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 101         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 102         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 103         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 104                                 .len = IEEE80211_MAX_MESH_ID_LEN },
 105         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 106
 107         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 108         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 109
 110         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 111         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 112         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 113         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 114                                            .len = NL80211_MAX_SUPP_RATES },
 115
 116         [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
 117
 118         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 119                                          .len = NL80211_HT_CAPABILITY_LEN },
 120
 121         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 122         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 123                               .len = IEEE80211_MAX_DATA_LEN },
 124         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 125         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 126
 127         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 128                                 .len = IEEE80211_MAX_SSID_LEN },
 129         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 130         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 131         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 132         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 133         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 134         [NL80211_ATTR_STA_FLAGS2] = {
 135                 .len = sizeof(struct nl80211_sta_flag_update),
 136         },
 137         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 138         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 139         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 140         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 141         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 142         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 143         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 144                                  .len = WLAN_PMKID_LEN },
 145         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 146         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 147         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 148 };
 149
 150 /* policy for the attributes */
 151 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 152         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 153         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 154         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 155         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
 156         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 157         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 158 };
 159
 160 /* ifidx get helper */
 161 static int nl80211_get_ifidx(struct netlink_callback *cb)
 162 {
 163         int res;
 164
 165         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 166                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
 167                           nl80211_policy);
 168         if (res)
 169                 return res;
 170
 171         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 172                 return -EINVAL;
 173
 174         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 175         if (!res)
 176                 return -EINVAL;
 177         return res;
 178 }
 179
 180 /* IE validation */
 181 static bool is_valid_ie_attr(const struct nlattr *attr)
 182 {
 183         const u8 *pos;
 184         int len;
 185
 186         if (!attr)
 187                 return true;
 188
 189         pos = nla_data(attr);
 190         len = nla_len(attr);
 191
 192         while (len) {
 193                 u8 elemlen;
 194
 195                 if (len < 2)
 196                         return false;
 197                 len -= 2;
 198
 199                 elemlen = pos[1];
 200                 if (elemlen > len)
 201                         return false;
 202
 203                 len -= elemlen;
 204                 pos += 2 + elemlen;
 205         }
 206
 207         return true;
 208 }
 209
 210 /* message building helper */
 211 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 212                                    int flags, u8 cmd)
 213 {
 214         /* since there is no private header just add the generic one */
 215         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 216 }
 217
 218 static int nl80211_msg_put_channel(struct sk_buff *msg,
 219                                    struct ieee80211_channel *chan)
 220 {
 221         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 222                     chan->center_freq);
 223
 224         if (chan->flags & IEEE80211_CHAN_DISABLED)
 225                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 226         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 227                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 228         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 229                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 230         if (chan->flags & IEEE80211_CHAN_RADAR)
 231                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 232
 233         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 234                     DBM_TO_MBM(chan->max_power));
 235
 236         return 0;
 237
 238  nla_put_failure:
 239         return -ENOBUFS;
 240 }
 241
 242 /* netlink command implementations */
 243
 244 struct key_parse {
 245         struct key_params p;
 246         int idx;
 247         bool def, defmgmt;
 248 };
 249
 250 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 251 {
 252         struct nlattr *tb[NL80211_KEY_MAX + 1];
 253         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 254                                    nl80211_key_policy);
 255         if (err)
 256                 return err;
 257
 258         k->def = !!tb[NL80211_KEY_DEFAULT];
 259         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 260
 261         if (tb[NL80211_KEY_IDX])
 262                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 263
 264         if (tb[NL80211_KEY_DATA]) {
 265                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 266                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 267         }
 268
 269         if (tb[NL80211_KEY_SEQ]) {
 270                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 271                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 272         }
 273
 274         if (tb[NL80211_KEY_CIPHER])
 275                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 276
 277         return 0;
 278 }
 279
 280 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 281 {
 282         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 283                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 284                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 285         }
 286
 287         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 288                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 289                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 290         }
 291
 292         if (info->attrs[NL80211_ATTR_KEY_IDX])
 293                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 294
 295         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 296                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 297
 298         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 299         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 300
 301         return 0;
 302 }
 303
 304 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 305 {
 306         int err;
 307
 308         memset(k, 0, sizeof(*k));
 309         k->idx = -1;
 310
 311         if (info->attrs[NL80211_ATTR_KEY])
 312                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 313         else
 314                 err = nl80211_parse_key_old(info, k);
 315
 316         if (err)
 317                 return err;
 318
 319         if (k->def && k->defmgmt)
 320                 return -EINVAL;
 321
 322         if (k->idx != -1) {
 323                 if (k->defmgmt) {
 324                         if (k->idx < 4 || k->idx > 5)
 325                                 return -EINVAL;
 326                 } else if (k->def) {
 327                         if (k->idx < 0 || k->idx > 3)
 328                                 return -EINVAL;
 329                 } else {
 330                         if (k->idx < 0 || k->idx > 5)
 331                                 return -EINVAL;
 332                 }
 333         }
 334
 335         return 0;
 336 }
 337
 338 static struct cfg80211_cached_keys *
 339 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 340                        struct nlattr *keys)
 341 {
 342         struct key_parse parse;
 343         struct nlattr *key;
 344         struct cfg80211_cached_keys *result;
 345         int rem, err, def = 0;
 346
 347         result = kzalloc(sizeof(*result), GFP_KERNEL);
 348         if (!result)
 349                 return ERR_PTR(-ENOMEM);
 350
 351         result->def = -1;
 352         result->defmgmt = -1;
 353
 354         nla_for_each_nested(key, keys, rem) {
 355                 memset(&parse, 0, sizeof(parse));
 356                 parse.idx = -1;
 357
 358                 err = nl80211_parse_key_new(key, &parse);
 359                 if (err)
 360                         goto error;
 361                 err = -EINVAL;
 362                 if (!parse.p.key)
 363                         goto error;
 364                 if (parse.idx < 0 || parse.idx > 4)
 365                         goto error;
 366                 if (parse.def) {
 367                         if (def)
 368                                 goto error;
 369                         def = 1;
 370                         result->def = parse.idx;
 371                 } else if (parse.defmgmt)
 372                         goto error;
 373                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 374                                                      parse.idx, NULL);
 375                 if (err)
 376                         goto error;
 377                 result->params[parse.idx].cipher = parse.p.cipher;
 378                 result->params[parse.idx].key_len = parse.p.key_len;
 379                 result->params[parse.idx].key = result->data[parse.idx];
 380                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 381         }
 382
 383         return result;
 384  error:
 385         kfree(result);
 386         return ERR_PTR(err);
 387 }
 388
 389 static int nl80211_key_allowed(struct wireless_dev *wdev)
 390 {
 391         ASSERT_WDEV_LOCK(wdev);
 392
 393         if (!netif_running(wdev->netdev))
 394                 return -ENETDOWN;
 395
 396         switch (wdev->iftype) {
 397         case NL80211_IFTYPE_AP:
 398         case NL80211_IFTYPE_AP_VLAN:
 399                 break;
 400         case NL80211_IFTYPE_ADHOC:
 401                 if (!wdev->current_bss)
 402                         return -ENOLINK;
 403                 break;
 404         case NL80211_IFTYPE_STATION:
 405                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 406                         return -ENOLINK;
 407                 break;
 408         default:
 409                 return -EINVAL;
 410         }
 411
 412         return 0;
 413 }
 414
 415 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 416                               struct cfg80211_registered_device *dev)
 417 {
 418         void *hdr;
 419         struct nlattr *nl_bands, *nl_band;
 420         struct nlattr *nl_freqs, *nl_freq;
 421         struct nlattr *nl_rates, *nl_rate;
 422         struct nlattr *nl_modes;
 423         struct nlattr *nl_cmds;
 424         enum ieee80211_band band;
 425         struct ieee80211_channel *chan;
 426         struct ieee80211_rate *rate;
 427         int i;
 428         u16 ifmodes = dev->wiphy.interface_modes;
 429
 430         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 431         if (!hdr)
 432                 return -1;
 433
 434         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 435         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 436
 437         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
 438                     cfg80211_rdev_list_generation);
 439
 440         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 441                    dev->wiphy.retry_short);
 442         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 443                    dev->wiphy.retry_long);
 444         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 445                     dev->wiphy.frag_threshold);
 446         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 447                     dev->wiphy.rts_threshold);
 448         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
 449                     dev->wiphy.coverage_class);
 450
 451         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 452                    dev->wiphy.max_scan_ssids);
 453         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 454                     dev->wiphy.max_scan_ie_len);
 455
 456         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
 457                 sizeof(u32) * dev->wiphy.n_cipher_suites,
 458                 dev->wiphy.cipher_suites);
 459
 460         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
 461                    dev->wiphy.max_num_pmkids);
 462
 463         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
 464         if (!nl_modes)
 465                 goto nla_put_failure;
 466
 467         i = 0;
 468         while (ifmodes) {
 469                 if (ifmodes & 1)
 470                         NLA_PUT_FLAG(msg, i);
 471                 ifmodes >>= 1;
 472                 i++;
 473         }
 474
 475         nla_nest_end(msg, nl_modes);
 476
 477         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 478         if (!nl_bands)
 479                 goto nla_put_failure;
 480
 481         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 482                 if (!dev->wiphy.bands[band])
 483                         continue;
 484
 485                 nl_band = nla_nest_start(msg, band);
 486                 if (!nl_band)
 487                         goto nla_put_failure;
 488
 489                 /* add HT info */
 490                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 491                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 492                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 493                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 494                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 495                                 dev->wiphy.bands[band]->ht_cap.cap);
 496                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 497                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 498                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 499                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 500                 }
 501
 502                 /* add frequencies */
 503                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 504                 if (!nl_freqs)
 505                         goto nla_put_failure;
 506
 507                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 508                         nl_freq = nla_nest_start(msg, i);
 509                         if (!nl_freq)
 510                                 goto nla_put_failure;
 511
 512                         chan = &dev->wiphy.bands[band]->channels[i];
 513
 514                         if (nl80211_msg_put_channel(msg, chan))
 515                                 goto nla_put_failure;
 516
 517                         nla_nest_end(msg, nl_freq);
 518                 }
 519
 520                 nla_nest_end(msg, nl_freqs);
 521
 522                 /* add bitrates */
 523                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 524                 if (!nl_rates)
 525                         goto nla_put_failure;
 526
 527                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 528                         nl_rate = nla_nest_start(msg, i);
 529                         if (!nl_rate)
 530                                 goto nla_put_failure;
 531
 532                         rate = &dev->wiphy.bands[band]->bitrates[i];
 533                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 534                                     rate->bitrate);
 535                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 536                                 NLA_PUT_FLAG(msg,
 537                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 538
 539                         nla_nest_end(msg, nl_rate);
 540                 }
 541
 542                 nla_nest_end(msg, nl_rates);
 543
 544                 nla_nest_end(msg, nl_band);
 545         }
 546         nla_nest_end(msg, nl_bands);
 547
 548         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 549         if (!nl_cmds)
 550                 goto nla_put_failure;
 551
 552         i = 0;
 553 #define CMD(op, n)                                              \
 554          do {                                                   \
 555                 if (dev->ops->op) {                             \
 556                         i++;                                    \
 557                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 558                 }                                               \
 559         } while (0)
 560
 561         CMD(add_virtual_intf, NEW_INTERFACE);
 562         CMD(change_virtual_intf, SET_INTERFACE);
 563         CMD(add_key, NEW_KEY);
 564         CMD(add_beacon, NEW_BEACON);
 565         CMD(add_station, NEW_STATION);
 566         CMD(add_mpath, NEW_MPATH);
 567         CMD(set_mesh_params, SET_MESH_PARAMS);
 568         CMD(change_bss, SET_BSS);
 569         CMD(auth, AUTHENTICATE);
 570         CMD(assoc, ASSOCIATE);
 571         CMD(deauth, DEAUTHENTICATE);
 572         CMD(disassoc, DISASSOCIATE);
 573         CMD(join_ibss, JOIN_IBSS);
 574         CMD(set_pmksa, SET_PMKSA);
 575         CMD(del_pmksa, DEL_PMKSA);
 576         CMD(flush_pmksa, FLUSH_PMKSA);
 577         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
 578         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
 579         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
 580                 i++;
 581                 NLA_PUT_U32(msg, i, NL80211_CMD_SET_WIPHY_NETNS);
 582         }
 583
 584 #undef CMD
 585
 586         if (dev->ops->connect || dev->ops->auth) {
 587                 i++;
 588                 NLA_PUT_U32(msg, i, NL80211_CMD_CONNECT);
 589         }
 590
 591         if (dev->ops->disconnect || dev->ops->deauth) {
 592                 i++;
 593                 NLA_PUT_U32(msg, i, NL80211_CMD_DISCONNECT);
 594         }
 595
 596         nla_nest_end(msg, nl_cmds);
 597
 598         return genlmsg_end(msg, hdr);
 599
 600  nla_put_failure:
 601         genlmsg_cancel(msg, hdr);
 602         return -EMSGSIZE;
 603 }
 604
 605 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 606 {
 607         int idx = 0;
 608         int start = cb->args[0];
 609         struct cfg80211_registered_device *dev;
 610
 611         mutex_lock(&cfg80211_mutex);
 612         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
 613                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
 614                         continue;
 615                 if (++idx <= start)
 616                         continue;
 617                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
 618                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
 619                                        dev) < 0) {
 620                         idx--;
 621                         break;
 622                 }
 623         }
 624         mutex_unlock(&cfg80211_mutex);
 625
 626         cb->args[0] = idx;
 627
 628         return skb->len;
 629 }
 630
 631 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 632 {
 633         struct sk_buff *msg;
 634         struct cfg80211_registered_device *dev;
 635
 636         dev = cfg80211_get_dev_from_info(info);
 637         if (IS_ERR(dev))
 638                 return PTR_ERR(dev);
 639
 640         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 641         if (!msg)
 642                 goto out_err;
 643
 644         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
 645                 goto out_free;
 646
 647         cfg80211_unlock_rdev(dev);
 648
 649         return genlmsg_reply(msg, info);
 650
 651  out_free:
 652         nlmsg_free(msg);
 653  out_err:
 654         cfg80211_unlock_rdev(dev);
 655         return -ENOBUFS;
 656 }
 657
 658 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 659         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
 660         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
 661         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
 662         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
 663         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
 664 };
 665
 666 static int parse_txq_params(struct nlattr *tb[],
 667                             struct ieee80211_txq_params *txq_params)
 668 {
 669         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 670             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 671             !tb[NL80211_TXQ_ATTR_AIFS])
 672                 return -EINVAL;
 673
 674         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
 675         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 676         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 677         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 678         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 679
 680         return 0;
 681 }
 682
 683 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 684 {
 685         struct cfg80211_registered_device *rdev;
 686         int result = 0, rem_txq_params = 0;
 687         struct nlattr *nl_txq_params;
 688         u32 changed;
 689         u8 retry_short = 0, retry_long = 0;
 690         u32 frag_threshold = 0, rts_threshold = 0;
 691         u8 coverage_class = 0;
 692
 693         rtnl_lock();
 694
 695         mutex_lock(&cfg80211_mutex);
 696
 697         rdev = __cfg80211_rdev_from_info(info);
 698         if (IS_ERR(rdev)) {
 699                 mutex_unlock(&cfg80211_mutex);
 700                 result = PTR_ERR(rdev);
 701                 goto unlock;
 702         }
 703
 704         mutex_lock(&rdev->mtx);
 705
 706         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
 707                 result = cfg80211_dev_rename(
 708                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 709
 710         mutex_unlock(&cfg80211_mutex);
 711
 712         if (result)
 713                 goto bad_res;
 714
 715         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
 716                 struct ieee80211_txq_params txq_params;
 717                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
 718
 719                 if (!rdev->ops->set_txq_params) {
 720                         result = -EOPNOTSUPP;
 721                         goto bad_res;
 722                 }
 723
 724                 nla_for_each_nested(nl_txq_params,
 725                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
 726                                     rem_txq_params) {
 727                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
 728                                   nla_data(nl_txq_params),
 729                                   nla_len(nl_txq_params),
 730                                   txq_params_policy);
 731                         result = parse_txq_params(tb, &txq_params);
 732                         if (result)
 733                                 goto bad_res;
 734
 735                         result = rdev->ops->set_txq_params(&rdev->wiphy,
 736                                                            &txq_params);
 737                         if (result)
 738                                 goto bad_res;
 739                 }
 740         }
 741
 742         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
 743                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 744                 u32 freq;
 745
 746                 result = -EINVAL;
 747
 748                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 749                         channel_type = nla_get_u32(info->attrs[
 750                                            NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 751                         if (channel_type != NL80211_CHAN_NO_HT &&
 752                             channel_type != NL80211_CHAN_HT20 &&
 753                             channel_type != NL80211_CHAN_HT40PLUS &&
 754                             channel_type != NL80211_CHAN_HT40MINUS)
 755                                 goto bad_res;
 756                 }
 757
 758                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 759
 760                 mutex_lock(&rdev->devlist_mtx);
 761                 result = rdev_set_freq(rdev, NULL, freq, channel_type);
 762                 mutex_unlock(&rdev->devlist_mtx);
 763                 if (result)
 764                         goto bad_res;
 765         }
 766
 767         changed = 0;
 768
 769         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
 770                 retry_short = nla_get_u8(
 771                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
 772                 if (retry_short == 0) {
 773                         result = -EINVAL;
 774                         goto bad_res;
 775                 }
 776                 changed |= WIPHY_PARAM_RETRY_SHORT;
 777         }
 778
 779         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
 780                 retry_long = nla_get_u8(
 781                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
 782                 if (retry_long == 0) {
 783                         result = -EINVAL;
 784                         goto bad_res;
 785                 }
 786                 changed |= WIPHY_PARAM_RETRY_LONG;
 787         }
 788
 789         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
 790                 frag_threshold = nla_get_u32(
 791                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
 792                 if (frag_threshold < 256) {
 793                         result = -EINVAL;
 794                         goto bad_res;
 795                 }
 796                 if (frag_threshold != (u32) -1) {
 797                         /*
 798                          * Fragments (apart from the last one) are required to
 799                          * have even length. Make the fragmentation code
 800                          * simpler by stripping LSB should someone try to use
 801                          * odd threshold value.
 802                          */
 803                         frag_threshold &= ~0x1;
 804                 }
 805                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
 806         }
 807
 808         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
 809                 rts_threshold = nla_get_u32(
 810                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
 811                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
 812         }
 813
 814         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
 815                 coverage_class = nla_get_u8(
 816                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
 817                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
 818         }
 819
 820         if (changed) {
 821                 u8 old_retry_short, old_retry_long;
 822                 u32 old_frag_threshold, old_rts_threshold;
 823                 u8 old_coverage_class;
 824
 825                 if (!rdev->ops->set_wiphy_params) {
 826                         result = -EOPNOTSUPP;
 827                         goto bad_res;
 828                 }
 829
 830                 old_retry_short = rdev->wiphy.retry_short;
 831                 old_retry_long = rdev->wiphy.retry_long;
 832                 old_frag_threshold = rdev->wiphy.frag_threshold;
 833                 old_rts_threshold = rdev->wiphy.rts_threshold;
 834                 old_coverage_class = rdev->wiphy.coverage_class;
 835
 836                 if (changed & WIPHY_PARAM_RETRY_SHORT)
 837                         rdev->wiphy.retry_short = retry_short;
 838                 if (changed & WIPHY_PARAM_RETRY_LONG)
 839                         rdev->wiphy.retry_long = retry_long;
 840                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
 841                         rdev->wiphy.frag_threshold = frag_threshold;
 842                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
 843                         rdev->wiphy.rts_threshold = rts_threshold;
 844                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
 845                         rdev->wiphy.coverage_class = coverage_class;
 846
 847                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
 848                 if (result) {
 849                         rdev->wiphy.retry_short = old_retry_short;
 850                         rdev->wiphy.retry_long = old_retry_long;
 851                         rdev->wiphy.frag_threshold = old_frag_threshold;
 852                         rdev->wiphy.rts_threshold = old_rts_threshold;
 853                         rdev->wiphy.coverage_class = old_coverage_class;
 854                 }
 855         }
 856
 857  bad_res:
 858         mutex_unlock(&rdev->mtx);
 859  unlock:
 860         rtnl_unlock();
 861         return result;
 862 }
 863
 864
 865 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 866                               struct cfg80211_registered_device *rdev,
 867                               struct net_device *dev)
 868 {
 869         void *hdr;
 870
 871         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
 872         if (!hdr)
 873                 return -1;
 874
 875         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 876         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 877         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
 878         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
 879
 880         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
 881                     rdev->devlist_generation ^
 882                         (cfg80211_rdev_list_generation << 2));
 883
 884         return genlmsg_end(msg, hdr);
 885
 886  nla_put_failure:
 887         genlmsg_cancel(msg, hdr);
 888         return -EMSGSIZE;
 889 }
 890
 891 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
 892 {
 893         int wp_idx = 0;
 894         int if_idx = 0;
 895         int wp_start = cb->args[0];
 896         int if_start = cb->args[1];
 897         struct cfg80211_registered_device *rdev;
 898         struct wireless_dev *wdev;
 899
 900         mutex_lock(&cfg80211_mutex);
 901         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
 902                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
 903                         continue;
 904                 if (wp_idx < wp_start) {
 905                         wp_idx++;
 906                         continue;
 907                 }
 908                 if_idx = 0;
 909
 910                 mutex_lock(&rdev->devlist_mtx);
 911                 list_for_each_entry(wdev, &rdev->netdev_list, list) {
 912                         if (if_idx < if_start) {
 913                                 if_idx++;
 914                                 continue;
 915                         }
 916                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
 917                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
 918                                                rdev, wdev->netdev) < 0) {
 919                                 mutex_unlock(&rdev->devlist_mtx);
 920                                 goto out;
 921                         }
 922                         if_idx++;
 923                 }
 924                 mutex_unlock(&rdev->devlist_mtx);
 925
 926                 wp_idx++;
 927         }
 928  out:
 929         mutex_unlock(&cfg80211_mutex);
 930
 931         cb->args[0] = wp_idx;
 932         cb->args[1] = if_idx;
 933
 934         return skb->len;
 935 }
 936
 937 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
 938 {
 939         struct sk_buff *msg;
 940         struct cfg80211_registered_device *dev;
 941         struct net_device *netdev;
 942         int err;
 943
 944         err = get_rdev_dev_by_info_ifindex(info, &dev, &netdev);
 945         if (err)
 946                 return err;
 947
 948         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 949         if (!msg)
 950                 goto out_err;
 951
 952         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
 953                                dev, netdev) < 0)
 954                 goto out_free;
 955
 956         dev_put(netdev);
 957         cfg80211_unlock_rdev(dev);
 958
 959         return genlmsg_reply(msg, info);
 960
 961  out_free:
 962         nlmsg_free(msg);
 963  out_err:
 964         dev_put(netdev);
 965         cfg80211_unlock_rdev(dev);
 966         return -ENOBUFS;
 967 }
 968
 969 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
 970         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
 971         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
 972         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
 973         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
 974         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
 975 };
 976
 977 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
 978 {
 979         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
 980         int flag;
 981
 982         *mntrflags = 0;
 983
 984         if (!nla)
 985                 return -EINVAL;
 986
 987         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
 988                              nla, mntr_flags_policy))
 989                 return -EINVAL;
 990
 991         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
 992                 if (flags[flag])
 993                         *mntrflags |= (1<<flag);
 994
 995         return 0;
 996 }
 997
 998 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
 999                                struct net_device *netdev, u8 use_4addr,
1000                                enum nl80211_iftype iftype)
1001 {
1002         if (!use_4addr) {
1003                 if (netdev && netdev->br_port)
1004                         return -EBUSY;
1005                 return 0;
1006         }
1007
1008         switch (iftype) {
1009         case NL80211_IFTYPE_AP_VLAN:
1010                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
1011                         return 0;
1012                 break;
1013         case NL80211_IFTYPE_STATION:
1014                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
1015                         return 0;
1016                 break;
1017         default:
1018                 break;
1019         }
1020
1021         return -EOPNOTSUPP;
1022 }
1023
1024 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
1025 {
1026         struct cfg80211_registered_device *rdev;
1027         struct vif_params params;
1028         int err;
1029         enum nl80211_iftype otype, ntype;
1030         struct net_device *dev;
1031         u32 _flags, *flags = NULL;
1032         bool change = false;
1033
1034         memset(&params, 0, sizeof(params));
1035
1036         rtnl_lock();
1037
1038         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1039         if (err)
1040                 goto unlock_rtnl;
1041
1042         otype = ntype = dev->ieee80211_ptr->iftype;
1043
1044         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1045                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1046                 if (otype != ntype)
1047                         change = true;
1048                 if (ntype > NL80211_IFTYPE_MAX) {
1049                         err = -EINVAL;
1050                         goto unlock;
1051                 }
1052         }
1053
1054         if (info->attrs[NL80211_ATTR_MESH_ID]) {
1055                 if (ntype != NL80211_IFTYPE_MESH_POINT) {
1056                         err = -EINVAL;
1057                         goto unlock;
1058                 }
1059                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
1060                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1061                 change = true;
1062         }
1063
1064         if (info->attrs[NL80211_ATTR_4ADDR]) {
1065                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1066                 change = true;
1067                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
1068                 if (err)
1069                         goto unlock;
1070         } else {
1071                 params.use_4addr = -1;
1072         }
1073
1074         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
1075                 if (ntype != NL80211_IFTYPE_MONITOR) {
1076                         err = -EINVAL;
1077                         goto unlock;
1078                 }
1079                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
1080                                           &_flags);
1081                 if (err)
1082                         goto unlock;
1083
1084                 flags = &_flags;
1085                 change = true;
1086         }
1087
1088         if (change)
1089                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
1090         else
1091                 err = 0;
1092
1093         if (!err && params.use_4addr != -1)
1094                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
1095
1096  unlock:
1097         dev_put(dev);
1098         cfg80211_unlock_rdev(rdev);
1099  unlock_rtnl:
1100         rtnl_unlock();
1101         return err;
1102 }
1103
1104 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
1105 {
1106         struct cfg80211_registered_device *rdev;
1107         struct vif_params params;
1108         int err;
1109         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
1110         u32 flags;
1111
1112         memset(&params, 0, sizeof(params));
1113
1114         if (!info->attrs[NL80211_ATTR_IFNAME])
1115                 return -EINVAL;
1116
1117         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1118                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1119                 if (type > NL80211_IFTYPE_MAX)
1120                         return -EINVAL;
1121         }
1122
1123         rtnl_lock();
1124
1125         rdev = cfg80211_get_dev_from_info(info);
1126         if (IS_ERR(rdev)) {
1127                 err = PTR_ERR(rdev);
1128                 goto unlock_rtnl;
1129         }
1130
1131         if (!rdev->ops->add_virtual_intf ||
1132             !(rdev->wiphy.interface_modes & (1 << type))) {
1133                 err = -EOPNOTSUPP;
1134                 goto unlock;
1135         }
1136
1137         if (type == NL80211_IFTYPE_MESH_POINT &&
1138             info->attrs[NL80211_ATTR_MESH_ID]) {
1139                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
1140                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1141         }
1142
1143         if (info->attrs[NL80211_ATTR_4ADDR]) {
1144                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1145                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
1146                 if (err)
1147                         goto unlock;
1148         }
1149
1150         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
1151                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
1152                                   &flags);
1153         err = rdev->ops->add_virtual_intf(&rdev->wiphy,
1154                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
1155                 type, err ? NULL : &flags, &params);
1156
1157  unlock:
1158         cfg80211_unlock_rdev(rdev);
1159  unlock_rtnl:
1160         rtnl_unlock();
1161         return err;
1162 }
1163
1164 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
1165 {
1166         struct cfg80211_registered_device *rdev;
1167         int err;
1168         struct net_device *dev;
1169
1170         rtnl_lock();
1171
1172         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1173         if (err)
1174                 goto unlock_rtnl;
1175
1176         if (!rdev->ops->del_virtual_intf) {
1177                 err = -EOPNOTSUPP;
1178                 goto out;
1179         }
1180
1181         err = rdev->ops->del_virtual_intf(&rdev->wiphy, dev);
1182
1183  out:
1184         cfg80211_unlock_rdev(rdev);
1185         dev_put(dev);
1186  unlock_rtnl:
1187         rtnl_unlock();
1188         return err;
1189 }
1190
1191 struct get_key_cookie {
1192         struct sk_buff *msg;
1193         int error;
1194         int idx;
1195 };
1196
1197 static void get_key_callback(void *c, struct key_params *params)
1198 {
1199         struct nlattr *key;
1200         struct get_key_cookie *cookie = c;
1201
1202         if (params->key)
1203                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
1204                         params->key_len, params->key);
1205
1206         if (params->seq)
1207                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
1208                         params->seq_len, params->seq);
1209
1210         if (params->cipher)
1211                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
1212                             params->cipher);
1213
1214         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
1215         if (!key)
1216                 goto nla_put_failure;
1217
1218         if (params->key)
1219                 NLA_PUT(cookie->msg, NL80211_KEY_DATA,
1220                         params->key_len, params->key);
1221
1222         if (params->seq)
1223                 NLA_PUT(cookie->msg, NL80211_KEY_SEQ,
1224                         params->seq_len, params->seq);
1225
1226         if (params->cipher)
1227                 NLA_PUT_U32(cookie->msg, NL80211_KEY_CIPHER,
1228                             params->cipher);
1229
1230         NLA_PUT_U8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx);
1231
1232         nla_nest_end(cookie->msg, key);
1233
1234         return;
1235  nla_put_failure:
1236         cookie->error = 1;
1237 }
1238
1239 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
1240 {
1241         struct cfg80211_registered_device *rdev;
1242         int err;
1243         struct net_device *dev;
1244         u8 key_idx = 0;
1245         u8 *mac_addr = NULL;
1246         struct get_key_cookie cookie = {
1247                 .error = 0,
1248         };
1249         void *hdr;
1250         struct sk_buff *msg;
1251
1252         if (info->attrs[NL80211_ATTR_KEY_IDX])
1253                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1254
1255         if (key_idx > 5)
1256                 return -EINVAL;
1257
1258         if (info->attrs[NL80211_ATTR_MAC])
1259                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1260
1261         rtnl_lock();
1262
1263         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1264         if (err)
1265                 goto unlock_rtnl;
1266
1267         if (!rdev->ops->get_key) {
1268                 err = -EOPNOTSUPP;
1269                 goto out;
1270         }
1271
1272         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1273         if (!msg) {
1274                 err = -ENOMEM;
1275                 goto out;
1276         }
1277
1278         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
1279                              NL80211_CMD_NEW_KEY);
1280
1281         if (IS_ERR(hdr)) {
1282                 err = PTR_ERR(hdr);
1283                 goto free_msg;
1284         }
1285
1286         cookie.msg = msg;
1287         cookie.idx = key_idx;
1288
1289         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1290         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1291         if (mac_addr)
1292                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1293
1294         err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, mac_addr,
1295                                 &cookie, get_key_callback);
1296
1297         if (err)
1298                 goto free_msg;
1299
1300         if (cookie.error)
1301                 goto nla_put_failure;
1302
1303         genlmsg_end(msg, hdr);
1304         err = genlmsg_reply(msg, info);
1305         goto out;
1306
1307  nla_put_failure:
1308         err = -ENOBUFS;
1309  free_msg:
1310         nlmsg_free(msg);
1311  out:
1312         cfg80211_unlock_rdev(rdev);
1313         dev_put(dev);
1314  unlock_rtnl:
1315         rtnl_unlock();
1316
1317         return err;
1318 }
1319
1320 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1321 {
1322         struct cfg80211_registered_device *rdev;
1323         struct key_parse key;
1324         int err;
1325         struct net_device *dev;
1326         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
1327                     u8 key_index);
1328
1329         err = nl80211_parse_key(info, &key);
1330         if (err)
1331                 return err;
1332
1333         if (key.idx < 0)
1334                 return -EINVAL;
1335
1336         /* only support setting default key */
1337         if (!key.def && !key.defmgmt)
1338                 return -EINVAL;
1339
1340         rtnl_lock();
1341
1342         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1343         if (err)
1344                 goto unlock_rtnl;
1345
1346         if (key.def)
1347                 func = rdev->ops->set_default_key;
1348         else
1349                 func = rdev->ops->set_default_mgmt_key;
1350
1351         if (!func) {
1352                 err = -EOPNOTSUPP;
1353                 goto out;
1354         }
1355
1356         wdev_lock(dev->ieee80211_ptr);
1357         err = nl80211_key_allowed(dev->ieee80211_ptr);
1358         if (!err)
1359                 err = func(&rdev->wiphy, dev, key.idx);
1360
1361 #ifdef CONFIG_CFG80211_WEXT
1362         if (!err) {
1363                 if (func == rdev->ops->set_default_key)
1364                         dev->ieee80211_ptr->wext.default_key = key.idx;
1365                 else
1366                         dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
1367         }
1368 #endif
1369         wdev_unlock(dev->ieee80211_ptr);
1370
1371  out:
1372         cfg80211_unlock_rdev(rdev);
1373         dev_put(dev);
1374
1375  unlock_rtnl:
1376         rtnl_unlock();
1377
1378         return err;
1379 }
1380
1381 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1382 {
1383         struct cfg80211_registered_device *rdev;
1384         int err;
1385         struct net_device *dev;
1386         struct key_parse key;
1387         u8 *mac_addr = NULL;
1388
1389         err = nl80211_parse_key(info, &key);
1390         if (err)
1391                 return err;
1392
1393         if (!key.p.key)
1394                 return -EINVAL;
1395
1396         if (info->attrs[NL80211_ATTR_MAC])
1397                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1398
1399         rtnl_lock();
1400
1401         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1402         if (err)
1403                 goto unlock_rtnl;
1404
1405         if (!rdev->ops->add_key) {
1406                 err = -EOPNOTSUPP;
1407                 goto out;
1408         }
1409
1410         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx, mac_addr)) {
1411                 err = -EINVAL;
1412                 goto out;
1413         }
1414
1415         wdev_lock(dev->ieee80211_ptr);
1416         err = nl80211_key_allowed(dev->ieee80211_ptr);
1417         if (!err)
1418                 err = rdev->ops->add_key(&rdev->wiphy, dev, key.idx,
1419                                          mac_addr, &key.p);
1420         wdev_unlock(dev->ieee80211_ptr);
1421
1422  out:
1423         cfg80211_unlock_rdev(rdev);
1424         dev_put(dev);
1425  unlock_rtnl:
1426         rtnl_unlock();
1427
1428         return err;
1429 }
1430
1431 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1432 {
1433         struct cfg80211_registered_device *rdev;
1434         int err;
1435         struct net_device *dev;
1436         u8 *mac_addr = NULL;
1437         struct key_parse key;
1438
1439         err = nl80211_parse_key(info, &key);
1440         if (err)
1441                 return err;
1442
1443         if (info->attrs[NL80211_ATTR_MAC])
1444                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1445
1446         rtnl_lock();
1447
1448         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1449         if (err)
1450                 goto unlock_rtnl;
1451
1452         if (!rdev->ops->del_key) {
1453                 err = -EOPNOTSUPP;
1454                 goto out;
1455         }
1456
1457         wdev_lock(dev->ieee80211_ptr);
1458         err = nl80211_key_allowed(dev->ieee80211_ptr);
1459         if (!err)
1460                 err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx, mac_addr);
1461
1462 #ifdef CONFIG_CFG80211_WEXT
1463         if (!err) {
1464                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
1465                         dev->ieee80211_ptr->wext.default_key = -1;
1466                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
1467                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
1468         }
1469 #endif
1470         wdev_unlock(dev->ieee80211_ptr);
1471
1472  out:
1473         cfg80211_unlock_rdev(rdev);
1474         dev_put(dev);
1475
1476  unlock_rtnl:
1477         rtnl_unlock();
1478
1479         return err;
1480 }
1481
1482 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1483 {
1484         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1485                     struct beacon_parameters *info);
1486         struct cfg80211_registered_device *rdev;
1487         int err;
1488         struct net_device *dev;
1489         struct beacon_parameters params;
1490         int haveinfo = 0;
1491
1492         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
1493                 return -EINVAL;
1494
1495         rtnl_lock();
1496
1497         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1498         if (err)
1499                 goto unlock_rtnl;
1500
1501         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1502                 err = -EOPNOTSUPP;
1503                 goto out;
1504         }
1505
1506         switch (info->genlhdr->cmd) {
1507         case NL80211_CMD_NEW_BEACON:
1508                 /* these are required for NEW_BEACON */
1509                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1510                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1511                     !info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1512                         err = -EINVAL;
1513                         goto out;
1514                 }
1515
1516                 call = rdev->ops->add_beacon;
1517                 break;
1518         case NL80211_CMD_SET_BEACON:
1519                 call = rdev->ops->set_beacon;
1520                 break;
1521         default:
1522                 WARN_ON(1);
1523                 err = -EOPNOTSUPP;
1524                 goto out;
1525         }
1526
1527         if (!call) {
1528                 err = -EOPNOTSUPP;
1529                 goto out;
1530         }
1531
1532         memset(&params, 0, sizeof(params));
1533
1534         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1535                 params.interval =
1536                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1537                 haveinfo = 1;
1538         }
1539
1540         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1541                 params.dtim_period =
1542                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1543                 haveinfo = 1;
1544         }
1545
1546         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1547                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1548                 params.head_len =
1549                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1550                 haveinfo = 1;
1551         }
1552
1553         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1554                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1555                 params.tail_len =
1556                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1557                 haveinfo = 1;
1558         }
1559
1560         if (!haveinfo) {
1561                 err = -EINVAL;
1562                 goto out;
1563         }
1564
1565         err = call(&rdev->wiphy, dev, &params);
1566
1567  out:
1568         cfg80211_unlock_rdev(rdev);
1569         dev_put(dev);
1570  unlock_rtnl:
1571         rtnl_unlock();
1572
1573         return err;
1574 }
1575
1576 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1577 {
1578         struct cfg80211_registered_device *rdev;
1579         int err;
1580         struct net_device *dev;
1581
1582         rtnl_lock();
1583
1584         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1585         if (err)
1586                 goto unlock_rtnl;
1587
1588         if (!rdev->ops->del_beacon) {
1589                 err = -EOPNOTSUPP;
1590                 goto out;
1591         }
1592
1593         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1594                 err = -EOPNOTSUPP;
1595                 goto out;
1596         }
1597         err = rdev->ops->del_beacon(&rdev->wiphy, dev);
1598
1599  out:
1600         cfg80211_unlock_rdev(rdev);
1601         dev_put(dev);
1602  unlock_rtnl:
1603         rtnl_unlock();
1604
1605         return err;
1606 }
1607
1608 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1609         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1610         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1611         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1612         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
1613 };
1614
1615 static int parse_station_flags(struct genl_info *info,
1616                                struct station_parameters *params)
1617 {
1618         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1619         struct nlattr *nla;
1620         int flag;
1621
1622         /*
1623          * Try parsing the new attribute first so userspace
1624          * can specify both for older kernels.
1625          */
1626         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
1627         if (nla) {
1628                 struct nl80211_sta_flag_update *sta_flags;
1629
1630                 sta_flags = nla_data(nla);
1631                 params->sta_flags_mask = sta_flags->mask;
1632                 params->sta_flags_set = sta_flags->set;
1633                 if ((params->sta_flags_mask |
1634                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
1635                         return -EINVAL;
1636                 return 0;
1637         }
1638
1639         /* if present, parse the old attribute */
1640
1641         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
1642         if (!nla)
1643                 return 0;
1644
1645         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1646                              nla, sta_flags_policy))
1647                 return -EINVAL;
1648
1649         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
1650         params->sta_flags_mask &= ~1;
1651
1652         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1653                 if (flags[flag])
1654                         params->sta_flags_set |= (1<<flag);
1655
1656         return 0;
1657 }
1658
1659 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1660                                 int flags, struct net_device *dev,
1661                                 const u8 *mac_addr, struct station_info *sinfo)
1662 {
1663         void *hdr;
1664         struct nlattr *sinfoattr, *txrate;
1665         u16 bitrate;
1666
1667         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1668         if (!hdr)
1669                 return -1;
1670
1671         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1672         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1673
1674         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, sinfo->generation);
1675
1676         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1677         if (!sinfoattr)
1678                 goto nla_put_failure;
1679         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1680                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1681                             sinfo->inactive_time);
1682         if (sinfo->filled & STATION_INFO_RX_BYTES)
1683                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1684                             sinfo->rx_bytes);
1685         if (sinfo->filled & STATION_INFO_TX_BYTES)
1686                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1687                             sinfo->tx_bytes);
1688         if (sinfo->filled & STATION_INFO_LLID)
1689                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1690                             sinfo->llid);
1691         if (sinfo->filled & STATION_INFO_PLID)
1692                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1693                             sinfo->plid);
1694         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1695                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1696                             sinfo->plink_state);
1697         if (sinfo->filled & STATION_INFO_SIGNAL)
1698                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1699                            sinfo->signal);
1700         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1701                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1702                 if (!txrate)
1703                         goto nla_put_failure;
1704
1705                 /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
1706                 bitrate = cfg80211_calculate_bitrate(&sinfo->txrate);
1707                 if (bitrate > 0)
1708                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1709
1710                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1711                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1712                                     sinfo->txrate.mcs);
1713                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1714                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1715                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1716                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1717
1718                 nla_nest_end(msg, txrate);
1719         }
1720         if (sinfo->filled & STATION_INFO_RX_PACKETS)
1721                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
1722                             sinfo->rx_packets);
1723         if (sinfo->filled & STATION_INFO_TX_PACKETS)
1724                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
1725                             sinfo->tx_packets);
1726         nla_nest_end(msg, sinfoattr);
1727
1728         return genlmsg_end(msg, hdr);
1729
1730  nla_put_failure:
1731         genlmsg_cancel(msg, hdr);
1732         return -EMSGSIZE;
1733 }
1734
1735 static int nl80211_dump_station(struct sk_buff *skb,
1736                                 struct netlink_callback *cb)
1737 {
1738         struct station_info sinfo;
1739         struct cfg80211_registered_device *dev;
1740         struct net_device *netdev;
1741         u8 mac_addr[ETH_ALEN];
1742         int ifidx = cb->args[0];
1743         int sta_idx = cb->args[1];
1744         int err;
1745
1746         if (!ifidx)
1747                 ifidx = nl80211_get_ifidx(cb);
1748         if (ifidx < 0)
1749                 return ifidx;
1750
1751         rtnl_lock();
1752
1753         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1754         if (!netdev) {
1755                 err = -ENODEV;
1756                 goto out_rtnl;
1757         }
1758
1759         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
1760         if (IS_ERR(dev)) {
1761                 err = PTR_ERR(dev);
1762                 goto out_rtnl;
1763         }
1764
1765         if (!dev->ops->dump_station) {
1766                 err = -EOPNOTSUPP;
1767                 goto out_err;
1768         }
1769
1770         while (1) {
1771                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1772                                              mac_addr, &sinfo);
1773                 if (err == -ENOENT)
1774                         break;
1775                 if (err)
1776                         goto out_err;
1777
1778                 if (nl80211_send_station(skb,
1779                                 NETLINK_CB(cb->skb).pid,
1780                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
1781                                 netdev, mac_addr,
1782                                 &sinfo) < 0)
1783                         goto out;
1784
1785                 sta_idx++;
1786         }
1787
1788
1789  out:
1790         cb->args[1] = sta_idx;
1791         err = skb->len;
1792  out_err:
1793         cfg80211_unlock_rdev(dev);
1794  out_rtnl:
1795         rtnl_unlock();
1796
1797         return err;
1798 }
1799
1800 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1801 {
1802         struct cfg80211_registered_device *rdev;
1803         int err;
1804         struct net_device *dev;
1805         struct station_info sinfo;
1806         struct sk_buff *msg;
1807         u8 *mac_addr = NULL;
1808
1809         memset(&sinfo, 0, sizeof(sinfo));
1810
1811         if (!info->attrs[NL80211_ATTR_MAC])
1812                 return -EINVAL;
1813
1814         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1815
1816         rtnl_lock();
1817
1818         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1819         if (err)
1820                 goto out_rtnl;
1821
1822         if (!rdev->ops->get_station) {
1823                 err = -EOPNOTSUPP;
1824                 goto out;
1825         }
1826
1827         err = rdev->ops->get_station(&rdev->wiphy, dev, mac_addr, &sinfo);
1828         if (err)
1829                 goto out;
1830
1831         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1832         if (!msg)
1833                 goto out;
1834
1835         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1836                                  dev, mac_addr, &sinfo) < 0)
1837                 goto out_free;
1838
1839         err = genlmsg_reply(msg, info);
1840         goto out;
1841
1842  out_free:
1843         nlmsg_free(msg);
1844  out:
1845         cfg80211_unlock_rdev(rdev);
1846         dev_put(dev);
1847  out_rtnl:
1848         rtnl_unlock();
1849
1850         return err;
1851 }
1852
1853 /*
1854  * Get vlan interface making sure it is running and on the right wiphy.
1855  */
1856 static int get_vlan(struct genl_info *info,
1857                     struct cfg80211_registered_device *rdev,
1858                     struct net_device **vlan)
1859 {
1860         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
1861         *vlan = NULL;
1862
1863         if (vlanattr) {
1864                 *vlan = dev_get_by_index(genl_info_net(info),
1865                                          nla_get_u32(vlanattr));
1866                 if (!*vlan)
1867                         return -ENODEV;
1868                 if (!(*vlan)->ieee80211_ptr)
1869                         return -EINVAL;
1870                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
1871                         return -EINVAL;
1872                 if (!netif_running(*vlan))
1873                         return -ENETDOWN;
1874         }
1875         return 0;
1876 }
1877
1878 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
1879 {
1880         struct cfg80211_registered_device *rdev;
1881         int err;
1882         struct net_device *dev;
1883         struct station_parameters params;
1884         u8 *mac_addr = NULL;
1885
1886         memset(&params, 0, sizeof(params));
1887
1888         params.listen_interval = -1;
1889
1890         if (info->attrs[NL80211_ATTR_STA_AID])
1891                 return -EINVAL;
1892
1893         if (!info->attrs[NL80211_ATTR_MAC])
1894                 return -EINVAL;
1895
1896         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1897
1898         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
1899                 params.supported_rates =
1900                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1901                 params.supported_rates_len =
1902                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1903         }
1904
1905         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1906                 params.listen_interval =
1907                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1908
1909         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1910                 params.ht_capa =
1911                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1912
1913         if (parse_station_flags(info, &params))
1914                 return -EINVAL;
1915
1916         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
1917                 params.plink_action =
1918                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
1919
1920         rtnl_lock();
1921
1922         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1923         if (err)
1924                 goto out_rtnl;
1925
1926         err = get_vlan(info, rdev, &params.vlan);
1927         if (err)
1928                 goto out;
1929
1930         /* validate settings */
1931         err = 0;
1932
1933         switch (dev->ieee80211_ptr->iftype) {
1934         case NL80211_IFTYPE_AP:
1935         case NL80211_IFTYPE_AP_VLAN:
1936                 /* disallow mesh-specific things */
1937                 if (params.plink_action)
1938                         err = -EINVAL;
1939                 break;
1940         case NL80211_IFTYPE_STATION:
1941                 /* disallow everything but AUTHORIZED flag */
1942                 if (params.plink_action)
1943                         err = -EINVAL;
1944                 if (params.vlan)
1945                         err = -EINVAL;
1946                 if (params.supported_rates)
1947                         err = -EINVAL;
1948                 if (params.ht_capa)
1949                         err = -EINVAL;
1950                 if (params.listen_interval >= 0)
1951                         err = -EINVAL;
1952                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
1953                         err = -EINVAL;
1954                 break;
1955         case NL80211_IFTYPE_MESH_POINT:
1956                 /* disallow things mesh doesn't support */
1957                 if (params.vlan)
1958                         err = -EINVAL;
1959                 if (params.ht_capa)
1960                         err = -EINVAL;
1961                 if (params.listen_interval >= 0)
1962                         err = -EINVAL;
1963                 if (params.supported_rates)
1964                         err = -EINVAL;
1965                 if (params.sta_flags_mask)
1966                         err = -EINVAL;
1967                 break;
1968         default:
1969                 err = -EINVAL;
1970         }
1971
1972         if (err)
1973                 goto out;
1974
1975         if (!rdev->ops->change_station) {
1976                 err = -EOPNOTSUPP;
1977                 goto out;
1978         }
1979
1980         err = rdev->ops->change_station(&rdev->wiphy, dev, mac_addr, &params);
1981
1982  out:
1983         if (params.vlan)
1984                 dev_put(params.vlan);
1985         cfg80211_unlock_rdev(rdev);
1986         dev_put(dev);
1987  out_rtnl:
1988         rtnl_unlock();
1989
1990         return err;
1991 }
1992
1993 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
1994 {
1995         struct cfg80211_registered_device *rdev;
1996         int err;
1997         struct net_device *dev;
1998         struct station_parameters params;
1999         u8 *mac_addr = NULL;
2000
2001         memset(&params, 0, sizeof(params));
2002
2003         if (!info->attrs[NL80211_ATTR_MAC])
2004                 return -EINVAL;
2005
2006         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2007                 return -EINVAL;
2008
2009         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
2010                 return -EINVAL;
2011
2012         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2013         params.supported_rates =
2014                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2015         params.supported_rates_len =
2016                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2017         params.listen_interval =
2018                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2019
2020         if (info->attrs[NL80211_ATTR_STA_AID]) {
2021                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
2022                 if (!params.aid || params.aid > IEEE80211_MAX_AID)
2023                         return -EINVAL;
2024         }
2025
2026         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2027                 params.ht_capa =
2028                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2029
2030         if (parse_station_flags(info, &params))
2031                 return -EINVAL;
2032
2033         rtnl_lock();
2034
2035         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2036         if (err)
2037                 goto out_rtnl;
2038
2039         err = get_vlan(info, rdev, &params.vlan);
2040         if (err)
2041                 goto out;
2042
2043         /* validate settings */
2044         err = 0;
2045
2046         switch (dev->ieee80211_ptr->iftype) {
2047         case NL80211_IFTYPE_AP:
2048         case NL80211_IFTYPE_AP_VLAN:
2049                 /* all ok but must have AID */
2050                 if (!params.aid)
2051                         err = -EINVAL;
2052                 break;
2053         case NL80211_IFTYPE_MESH_POINT:
2054                 /* disallow things mesh doesn't support */
2055                 if (params.vlan)
2056                         err = -EINVAL;
2057                 if (params.aid)
2058                         err = -EINVAL;
2059                 if (params.ht_capa)
2060                         err = -EINVAL;
2061                 if (params.listen_interval >= 0)
2062                         err = -EINVAL;
2063                 if (params.supported_rates)
2064                         err = -EINVAL;
2065                 if (params.sta_flags_mask)
2066                         err = -EINVAL;
2067                 break;
2068         default:
2069                 err = -EINVAL;
2070         }
2071
2072         if (err)
2073                 goto out;
2074
2075         if (!rdev->ops->add_station) {
2076                 err = -EOPNOTSUPP;
2077                 goto out;
2078         }
2079
2080         if (!netif_running(dev)) {
2081                 err = -ENETDOWN;
2082                 goto out;
2083         }
2084
2085         err = rdev->ops->add_station(&rdev->wiphy, dev, mac_addr, &params);
2086
2087  out:
2088         if (params.vlan)
2089                 dev_put(params.vlan);
2090         cfg80211_unlock_rdev(rdev);
2091         dev_put(dev);
2092  out_rtnl:
2093         rtnl_unlock();
2094
2095         return err;
2096 }
2097
2098 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
2099 {
2100         struct cfg80211_registered_device *rdev;
2101         int err;
2102         struct net_device *dev;
2103         u8 *mac_addr = NULL;
2104
2105         if (info->attrs[NL80211_ATTR_MAC])
2106                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2107
2108         rtnl_lock();
2109
2110         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2111         if (err)
2112                 goto out_rtnl;
2113
2114         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2115             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2116             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2117                 err = -EINVAL;
2118                 goto out;
2119         }
2120
2121         if (!rdev->ops->del_station) {
2122                 err = -EOPNOTSUPP;
2123                 goto out;
2124         }
2125
2126         err = rdev->ops->del_station(&rdev->wiphy, dev, mac_addr);
2127
2128  out:
2129         cfg80211_unlock_rdev(rdev);
2130         dev_put(dev);
2131  out_rtnl:
2132         rtnl_unlock();
2133
2134         return err;
2135 }
2136
2137 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
2138                                 int flags, struct net_device *dev,
2139                                 u8 *dst, u8 *next_hop,
2140                                 struct mpath_info *pinfo)
2141 {
2142         void *hdr;
2143         struct nlattr *pinfoattr;
2144
2145         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2146         if (!hdr)
2147                 return -1;
2148
2149         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2150         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
2151         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
2152
2153         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, pinfo->generation);
2154
2155         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
2156         if (!pinfoattr)
2157                 goto nla_put_failure;
2158         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
2159                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
2160                             pinfo->frame_qlen);
2161         if (pinfo->filled & MPATH_INFO_SN)
2162                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_SN,
2163                             pinfo->sn);
2164         if (pinfo->filled & MPATH_INFO_METRIC)
2165                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
2166                             pinfo->metric);
2167         if (pinfo->filled & MPATH_INFO_EXPTIME)
2168                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
2169                             pinfo->exptime);
2170         if (pinfo->filled & MPATH_INFO_FLAGS)
2171                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
2172                             pinfo->flags);
2173         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
2174                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
2175                             pinfo->discovery_timeout);
2176         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
2177                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
2178                             pinfo->discovery_retries);
2179
2180         nla_nest_end(msg, pinfoattr);
2181
2182         return genlmsg_end(msg, hdr);
2183
2184  nla_put_failure:
2185         genlmsg_cancel(msg, hdr);
2186         return -EMSGSIZE;
2187 }
2188
2189 static int nl80211_dump_mpath(struct sk_buff *skb,
2190                               struct netlink_callback *cb)
2191 {
2192         struct mpath_info pinfo;
2193         struct cfg80211_registered_device *dev;
2194         struct net_device *netdev;
2195         u8 dst[ETH_ALEN];
2196         u8 next_hop[ETH_ALEN];
2197         int ifidx = cb->args[0];
2198         int path_idx = cb->args[1];
2199         int err;
2200
2201         if (!ifidx)
2202                 ifidx = nl80211_get_ifidx(cb);
2203         if (ifidx < 0)
2204                 return ifidx;
2205
2206         rtnl_lock();
2207
2208         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
2209         if (!netdev) {
2210                 err = -ENODEV;
2211                 goto out_rtnl;
2212         }
2213
2214         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
2215         if (IS_ERR(dev)) {
2216                 err = PTR_ERR(dev);
2217                 goto out_rtnl;
2218         }
2219
2220         if (!dev->ops->dump_mpath) {
2221                 err = -EOPNOTSUPP;
2222                 goto out_err;
2223         }
2224
2225         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2226                 err = -EOPNOTSUPP;
2227                 goto out_err;
2228         }
2229
2230         while (1) {
2231                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
2232                                            dst, next_hop, &pinfo);
2233                 if (err == -ENOENT)
2234                         break;
2235                 if (err)
2236                         goto out_err;
2237
2238                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
2239                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
2240                                        netdev, dst, next_hop,
2241                                        &pinfo) < 0)
2242                         goto out;
2243
2244                 path_idx++;
2245         }
2246
2247
2248  out:
2249         cb->args[1] = path_idx;
2250         err = skb->len;
2251  out_err:
2252         cfg80211_unlock_rdev(dev);
2253  out_rtnl:
2254         rtnl_unlock();
2255
2256         return err;
2257 }
2258
2259 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
2260 {
2261         struct cfg80211_registered_device *rdev;
2262         int err;
2263         struct net_device *dev;
2264         struct mpath_info pinfo;
2265         struct sk_buff *msg;
2266         u8 *dst = NULL;
2267         u8 next_hop[ETH_ALEN];
2268
2269         memset(&pinfo, 0, sizeof(pinfo));
2270
2271         if (!info->attrs[NL80211_ATTR_MAC])
2272                 return -EINVAL;
2273
2274         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2275
2276         rtnl_lock();
2277
2278         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2279         if (err)
2280                 goto out_rtnl;
2281
2282         if (!rdev->ops->get_mpath) {
2283                 err = -EOPNOTSUPP;
2284                 goto out;
2285         }
2286
2287         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2288                 err = -EOPNOTSUPP;
2289                 goto out;
2290         }
2291
2292         err = rdev->ops->get_mpath(&rdev->wiphy, dev, dst, next_hop, &pinfo);
2293         if (err)
2294                 goto out;
2295
2296         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2297         if (!msg)
2298                 goto out;
2299
2300         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2301                                  dev, dst, next_hop, &pinfo) < 0)
2302                 goto out_free;
2303
2304         err = genlmsg_reply(msg, info);
2305         goto out;
2306
2307  out_free:
2308         nlmsg_free(msg);
2309  out:
2310         cfg80211_unlock_rdev(rdev);
2311         dev_put(dev);
2312  out_rtnl:
2313         rtnl_unlock();
2314
2315         return err;
2316 }
2317
2318 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2319 {
2320         struct cfg80211_registered_device *rdev;
2321         int err;
2322         struct net_device *dev;
2323         u8 *dst = NULL;
2324         u8 *next_hop = NULL;
2325
2326         if (!info->attrs[NL80211_ATTR_MAC])
2327                 return -EINVAL;
2328
2329         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2330                 return -EINVAL;
2331
2332         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2333         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2334
2335         rtnl_lock();
2336
2337         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2338         if (err)
2339                 goto out_rtnl;
2340
2341         if (!rdev->ops->change_mpath) {
2342                 err = -EOPNOTSUPP;
2343                 goto out;
2344         }
2345
2346         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2347                 err = -EOPNOTSUPP;
2348                 goto out;
2349         }
2350
2351         if (!netif_running(dev)) {
2352                 err = -ENETDOWN;
2353                 goto out;
2354         }
2355
2356         err = rdev->ops->change_mpath(&rdev->wiphy, dev, dst, next_hop);
2357
2358  out:
2359         cfg80211_unlock_rdev(rdev);
2360         dev_put(dev);
2361  out_rtnl:
2362         rtnl_unlock();
2363
2364         return err;
2365 }
2366 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2367 {
2368         struct cfg80211_registered_device *rdev;
2369         int err;
2370         struct net_device *dev;
2371         u8 *dst = NULL;
2372         u8 *next_hop = NULL;
2373
2374         if (!info->attrs[NL80211_ATTR_MAC])
2375                 return -EINVAL;
2376
2377         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2378                 return -EINVAL;
2379
2380         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2381         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2382
2383         rtnl_lock();
2384
2385         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2386         if (err)
2387                 goto out_rtnl;
2388
2389         if (!rdev->ops->add_mpath) {
2390                 err = -EOPNOTSUPP;
2391                 goto out;
2392         }
2393
2394         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2395                 err = -EOPNOTSUPP;
2396                 goto out;
2397         }
2398
2399         if (!netif_running(dev)) {
2400                 err = -ENETDOWN;
2401                 goto out;
2402         }
2403
2404         err = rdev->ops->add_mpath(&rdev->wiphy, dev, dst, next_hop);
2405
2406  out:
2407         cfg80211_unlock_rdev(rdev);
2408         dev_put(dev);
2409  out_rtnl:
2410         rtnl_unlock();
2411
2412         return err;
2413 }
2414
2415 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2416 {
2417         struct cfg80211_registered_device *rdev;
2418         int err;
2419         struct net_device *dev;
2420         u8 *dst = NULL;
2421
2422         if (info->attrs[NL80211_ATTR_MAC])
2423                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2424
2425         rtnl_lock();
2426
2427         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2428         if (err)
2429                 goto out_rtnl;
2430
2431         if (!rdev->ops->del_mpath) {
2432                 err = -EOPNOTSUPP;
2433                 goto out;
2434         }
2435
2436         err = rdev->ops->del_mpath(&rdev->wiphy, dev, dst);
2437
2438  out:
2439         cfg80211_unlock_rdev(rdev);
2440         dev_put(dev);
2441  out_rtnl:
2442         rtnl_unlock();
2443
2444         return err;
2445 }
2446
2447 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2448 {
2449         struct cfg80211_registered_device *rdev;
2450         int err;
2451         struct net_device *dev;
2452         struct bss_parameters params;
2453
2454         memset(&params, 0, sizeof(params));
2455         /* default to not changing parameters */
2456         params.use_cts_prot = -1;
2457         params.use_short_preamble = -1;
2458         params.use_short_slot_time = -1;
2459
2460         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2461                 params.use_cts_prot =
2462                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2463         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2464                 params.use_short_preamble =
2465                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2466         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2467                 params.use_short_slot_time =
2468                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2469         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2470                 params.basic_rates =
2471                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2472                 params.basic_rates_len =
2473                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2474         }
2475
2476         rtnl_lock();
2477
2478         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2479         if (err)
2480                 goto out_rtnl;
2481
2482         if (!rdev->ops->change_bss) {
2483                 err = -EOPNOTSUPP;
2484                 goto out;
2485         }
2486
2487         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
2488                 err = -EOPNOTSUPP;
2489                 goto out;
2490         }
2491
2492         err = rdev->ops->change_bss(&rdev->wiphy, dev, &params);
2493
2494  out:
2495         cfg80211_unlock_rdev(rdev);
2496         dev_put(dev);
2497  out_rtnl:
2498         rtnl_unlock();
2499
2500         return err;
2501 }
2502
2503 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2504         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2505         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2506         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2507         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2508         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2509         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2510 };
2511
2512 static int parse_reg_rule(struct nlattr *tb[],
2513         struct ieee80211_reg_rule *reg_rule)
2514 {
2515         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2516         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2517
2518         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2519                 return -EINVAL;
2520         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2521                 return -EINVAL;
2522         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2523                 return -EINVAL;
2524         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2525                 return -EINVAL;
2526         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2527                 return -EINVAL;
2528
2529         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2530
2531         freq_range->start_freq_khz =
2532                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2533         freq_range->end_freq_khz =
2534                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2535         freq_range->max_bandwidth_khz =
2536                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2537
2538         power_rule->max_eirp =
2539                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2540
2541         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2542                 power_rule->max_antenna_gain =
2543                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2544
2545         return 0;
2546 }
2547
2548 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2549 {
2550         int r;
2551         char *data = NULL;
2552
2553         /*
2554          * You should only get this when cfg80211 hasn't yet initialized
2555          * completely when built-in to the kernel right between the time
2556          * window between nl80211_init() and regulatory_init(), if that is
2557          * even possible.
2558          */
2559         mutex_lock(&cfg80211_mutex);
2560         if (unlikely(!cfg80211_regdomain)) {
2561                 mutex_unlock(&cfg80211_mutex);
2562                 return -EINPROGRESS;
2563         }
2564         mutex_unlock(&cfg80211_mutex);
2565
2566         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2567                 return -EINVAL;
2568
2569         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2570
2571         r = regulatory_hint_user(data);
2572
2573         return r;
2574 }
2575
2576 static int nl80211_get_mesh_params(struct sk_buff *skb,
2577         struct genl_info *info)
2578 {
2579         struct cfg80211_registered_device *rdev;
2580         struct mesh_config cur_params;
2581         int err;
2582         struct net_device *dev;
2583         void *hdr;
2584         struct nlattr *pinfoattr;
2585         struct sk_buff *msg;
2586
2587         rtnl_lock();
2588
2589         /* Look up our device */
2590         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2591         if (err)
2592                 goto out_rtnl;
2593
2594         if (!rdev->ops->get_mesh_params) {
2595                 err = -EOPNOTSUPP;
2596                 goto out;
2597         }
2598
2599         /* Get the mesh params */
2600         err = rdev->ops->get_mesh_params(&rdev->wiphy, dev, &cur_params);
2601         if (err)
2602                 goto out;
2603
2604         /* Draw up a netlink message to send back */
2605         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2606         if (!msg) {
2607                 err = -ENOBUFS;
2608                 goto out;
2609         }
2610         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2611                              NL80211_CMD_GET_MESH_PARAMS);
2612         if (!hdr)
2613                 goto nla_put_failure;
2614         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
2615         if (!pinfoattr)
2616                 goto nla_put_failure;
2617         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2618         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2619                         cur_params.dot11MeshRetryTimeout);
2620         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2621                         cur_params.dot11MeshConfirmTimeout);
2622         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2623                         cur_params.dot11MeshHoldingTimeout);
2624         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2625                         cur_params.dot11MeshMaxPeerLinks);
2626         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2627                         cur_params.dot11MeshMaxRetries);
2628         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2629                         cur_params.dot11MeshTTL);
2630         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2631                         cur_params.auto_open_plinks);
2632         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2633                         cur_params.dot11MeshHWMPmaxPREQretries);
2634         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2635                         cur_params.path_refresh_time);
2636         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2637                         cur_params.min_discovery_timeout);
2638         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2639                         cur_params.dot11MeshHWMPactivePathTimeout);
2640         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2641                         cur_params.dot11MeshHWMPpreqMinInterval);
2642         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2643                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2644         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
2645                         cur_params.dot11MeshHWMPRootMode);
2646         nla_nest_end(msg, pinfoattr);
2647         genlmsg_end(msg, hdr);
2648         err = genlmsg_reply(msg, info);
2649         goto out;
2650
2651  nla_put_failure:
2652         genlmsg_cancel(msg, hdr);
2653         err = -EMSGSIZE;
2654  out:
2655         /* Cleanup */
2656         cfg80211_unlock_rdev(rdev);
2657         dev_put(dev);
2658  out_rtnl:
2659         rtnl_unlock();
2660
2661         return err;
2662 }
2663
2664 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2665 do {\
2666         if (table[attr_num]) {\
2667                 cfg.param = nla_fn(table[attr_num]); \
2668                 mask |= (1 << (attr_num - 1)); \
2669         } \
2670 } while (0);\
2671
2672 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
2673         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2674         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2675         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2676         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2677         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2678         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2679         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2680
2681         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2682         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2683         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2684         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2685         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2686         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2687 };
2688
2689 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2690 {
2691         int err;
2692         u32 mask;
2693         struct cfg80211_registered_device *rdev;
2694         struct net_device *dev;
2695         struct mesh_config cfg;
2696         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2697         struct nlattr *parent_attr;
2698
2699         parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
2700         if (!parent_attr)
2701                 return -EINVAL;
2702         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2703                         parent_attr, nl80211_meshconf_params_policy))
2704                 return -EINVAL;
2705
2706         rtnl_lock();
2707
2708         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2709         if (err)
2710                 goto out_rtnl;
2711
2712         if (!rdev->ops->set_mesh_params) {
2713                 err = -EOPNOTSUPP;
2714                 goto out;
2715         }
2716
2717         /* This makes sure that there aren't more than 32 mesh config
2718          * parameters (otherwise our bitfield scheme would not work.) */
2719         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2720
2721         /* Fill in the params struct */
2722         mask = 0;
2723         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2724                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2725         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2726                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2727         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2728                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2729         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2730                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2731         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2732                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2733         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2734                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2735         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2736                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2737         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2738                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2739                         nla_get_u8);
2740         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2741                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2742         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2743                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2744                         nla_get_u16);
2745         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2746                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2747                         nla_get_u32);
2748         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2749                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2750                         nla_get_u16);
2751         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2752                         dot11MeshHWMPnetDiameterTraversalTime,
2753                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2754                         nla_get_u16);
2755         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2756                         dot11MeshHWMPRootMode, mask,
2757                         NL80211_MESHCONF_HWMP_ROOTMODE,
2758                         nla_get_u8);
2759
2760         /* Apply changes */
2761         err = rdev->ops->set_mesh_params(&rdev->wiphy, dev, &cfg, mask);
2762
2763  out:
2764         /* cleanup */
2765         cfg80211_unlock_rdev(rdev);
2766         dev_put(dev);
2767  out_rtnl:
2768         rtnl_unlock();
2769
2770         return err;
2771 }
2772
2773 #undef FILL_IN_MESH_PARAM_IF_SET
2774
2775 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2776 {
2777         struct sk_buff *msg;
2778         void *hdr = NULL;
2779         struct nlattr *nl_reg_rules;
2780         unsigned int i;
2781         int err = -EINVAL;
2782
2783         mutex_lock(&cfg80211_mutex);
2784
2785         if (!cfg80211_regdomain)
2786                 goto out;
2787
2788         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2789         if (!msg) {
2790                 err = -ENOBUFS;
2791                 goto out;
2792         }
2793
2794         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2795                              NL80211_CMD_GET_REG);
2796         if (!hdr)
2797                 goto nla_put_failure;
2798
2799         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2800                 cfg80211_regdomain->alpha2);
2801
2802         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2803         if (!nl_reg_rules)
2804                 goto nla_put_failure;
2805
2806         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2807                 struct nlattr *nl_reg_rule;
2808                 const struct ieee80211_reg_rule *reg_rule;
2809                 const struct ieee80211_freq_range *freq_range;
2810                 const struct ieee80211_power_rule *power_rule;
2811
2812                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2813                 freq_range = &reg_rule->freq_range;
2814                 power_rule = &reg_rule->power_rule;
2815
2816                 nl_reg_rule = nla_nest_start(msg, i);
2817                 if (!nl_reg_rule)
2818                         goto nla_put_failure;
2819
2820                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2821                         reg_rule->flags);
2822                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2823                         freq_range->start_freq_khz);
2824                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2825                         freq_range->end_freq_khz);
2826                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2827                         freq_range->max_bandwidth_khz);
2828                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2829                         power_rule->max_antenna_gain);
2830                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2831                         power_rule->max_eirp);
2832
2833                 nla_nest_end(msg, nl_reg_rule);
2834         }
2835
2836         nla_nest_end(msg, nl_reg_rules);
2837
2838         genlmsg_end(msg, hdr);
2839         err = genlmsg_reply(msg, info);
2840         goto out;
2841
2842 nla_put_failure:
2843         genlmsg_cancel(msg, hdr);
2844         err = -EMSGSIZE;
2845 out:
2846         mutex_unlock(&cfg80211_mutex);
2847         return err;
2848 }
2849
2850 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2851 {
2852         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2853         struct nlattr *nl_reg_rule;
2854         char *alpha2 = NULL;
2855         int rem_reg_rules = 0, r = 0;
2856         u32 num_rules = 0, rule_idx = 0, size_of_regd;
2857         struct ieee80211_regdomain *rd = NULL;
2858
2859         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2860                 return -EINVAL;
2861
2862         if (!info->attrs[NL80211_ATTR_REG_RULES])
2863                 return -EINVAL;
2864
2865         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2866
2867         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2868                         rem_reg_rules) {
2869                 num_rules++;
2870                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2871                         return -EINVAL;
2872         }
2873
2874         mutex_lock(&cfg80211_mutex);
2875
2876         if (!reg_is_valid_request(alpha2)) {
2877                 r = -EINVAL;
2878                 goto bad_reg;
2879         }
2880
2881         size_of_regd = sizeof(struct ieee80211_regdomain) +
2882                 (num_rules * sizeof(struct ieee80211_reg_rule));
2883
2884         rd = kzalloc(size_of_regd, GFP_KERNEL);
2885         if (!rd) {
2886                 r = -ENOMEM;
2887                 goto bad_reg;
2888         }
2889
2890         rd->n_reg_rules = num_rules;
2891         rd->alpha2[0] = alpha2[0];
2892         rd->alpha2[1] = alpha2[1];
2893
2894         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2895                         rem_reg_rules) {
2896                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2897                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2898                         reg_rule_policy);
2899                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2900                 if (r)
2901                         goto bad_reg;
2902
2903                 rule_idx++;
2904
2905                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
2906                         r = -EINVAL;
2907                         goto bad_reg;
2908                 }
2909         }
2910
2911         BUG_ON(rule_idx != num_rules);
2912
2913         r = set_regdom(rd);
2914
2915         mutex_unlock(&cfg80211_mutex);
2916
2917         return r;
2918
2919  bad_reg:
2920         mutex_unlock(&cfg80211_mutex);
2921         kfree(rd);
2922         return r;
2923 }
2924
2925 static int validate_scan_freqs(struct nlattr *freqs)
2926 {
2927         struct nlattr *attr1, *attr2;
2928         int n_channels = 0, tmp1, tmp2;
2929
2930         nla_for_each_nested(attr1, freqs, tmp1) {
2931                 n_channels++;
2932                 /*
2933                  * Some hardware has a limited channel list for
2934                  * scanning, and it is pretty much nonsensical
2935                  * to scan for a channel twice, so disallow that
2936                  * and don't require drivers to check that the
2937                  * channel list they get isn't longer than what
2938                  * they can scan, as long as they can scan all
2939                  * the channels they registered at once.
2940                  */
2941                 nla_for_each_nested(attr2, freqs, tmp2)
2942                         if (attr1 != attr2 &&
2943                             nla_get_u32(attr1) == nla_get_u32(attr2))
2944                                 return 0;
2945         }
2946
2947         return n_channels;
2948 }
2949
2950 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
2951 {
2952         struct cfg80211_registered_device *rdev;
2953         struct net_device *dev;
2954         struct cfg80211_scan_request *request;
2955         struct cfg80211_ssid *ssid;
2956         struct ieee80211_channel *channel;
2957         struct nlattr *attr;
2958         struct wiphy *wiphy;
2959         int err, tmp, n_ssids = 0, n_channels, i;
2960         enum ieee80211_band band;
2961         size_t ie_len;
2962
2963         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2964                 return -EINVAL;
2965
2966         rtnl_lock();
2967
2968         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2969         if (err)
2970                 goto out_rtnl;
2971
2972         wiphy = &rdev->wiphy;
2973
2974         if (!rdev->ops->scan) {
2975                 err = -EOPNOTSUPP;
2976                 goto out;
2977         }
2978
2979         if (!netif_running(dev)) {
2980                 err = -ENETDOWN;
2981                 goto out;
2982         }
2983
2984         if (rdev->scan_req) {
2985                 err = -EBUSY;
2986                 goto out;
2987         }
2988
2989         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2990                 n_channels = validate_scan_freqs(
2991                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
2992                 if (!n_channels) {
2993                         err = -EINVAL;
2994                         goto out;
2995                 }
2996         } else {
2997                 n_channels = 0;
2998
2999                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
3000                         if (wiphy->bands[band])
3001                                 n_channels += wiphy->bands[band]->n_channels;
3002         }
3003
3004         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
3005                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
3006                         n_ssids++;
3007
3008         if (n_ssids > wiphy->max_scan_ssids) {
3009                 err = -EINVAL;
3010                 goto out;
3011         }
3012
3013         if (info->attrs[NL80211_ATTR_IE])
3014                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3015         else
3016                 ie_len = 0;
3017
3018         if (ie_len > wiphy->max_scan_ie_len) {
3019                 err = -EINVAL;
3020                 goto out;
3021         }
3022
3023         request = kzalloc(sizeof(*request)
3024                         + sizeof(*ssid) * n_ssids
3025                         + sizeof(channel) * n_channels
3026                         + ie_len, GFP_KERNEL);
3027         if (!request) {
3028                 err = -ENOMEM;
3029                 goto out;
3030         }
3031
3032         if (n_ssids)
3033                 request->ssids = (void *)&request->channels[n_channels];
3034         request->n_ssids = n_ssids;
3035         if (ie_len) {
3036                 if (request->ssids)
3037                         request->ie = (void *)(request->ssids + n_ssids);
3038                 else
3039                         request->ie = (void *)(request->channels + n_channels);
3040         }
3041
3042         i = 0;
3043         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3044                 /* user specified, bail out if channel not found */
3045                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
3046                         struct ieee80211_channel *chan;
3047
3048                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
3049
3050                         if (!chan) {
3051                                 err = -EINVAL;
3052                                 goto out_free;
3053                         }
3054
3055                         /* ignore disabled channels */
3056                         if (chan->flags & IEEE80211_CHAN_DISABLED)
3057                                 continue;
3058
3059                         request->channels[i] = chan;
3060                         i++;
3061                 }
3062         } else {
3063                 /* all channels */
3064                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3065                         int j;
3066                         if (!wiphy->bands[band])
3067                                 continue;
3068                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3069                                 struct ieee80211_channel *chan;
3070
3071                                 chan = &wiphy->bands[band]->channels[j];
3072
3073                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
3074                                         continue;
3075
3076                                 request->channels[i] = chan;
3077                                 i++;
3078                         }
3079                 }
3080         }
3081
3082         if (!i) {
3083                 err = -EINVAL;
3084                 goto out_free;
3085         }
3086
3087         request->n_channels = i;
3088
3089         i = 0;
3090         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3091                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
3092                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
3093                                 err = -EINVAL;
3094                                 goto out_free;
3095                         }
3096                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
3097                         request->ssids[i].ssid_len = nla_len(attr);
3098                         i++;
3099                 }
3100         }
3101
3102         if (info->attrs[NL80211_ATTR_IE]) {
3103                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3104                 memcpy((void *)request->ie,
3105                        nla_data(info->attrs[NL80211_ATTR_IE]),
3106                        request->ie_len);
3107         }
3108
3109         request->dev = dev;
3110         request->wiphy = &rdev->wiphy;
3111
3112         rdev->scan_req = request;
3113         err = rdev->ops->scan(&rdev->wiphy, dev, request);
3114
3115         if (!err) {
3116                 nl80211_send_scan_start(rdev, dev);
3117                 dev_hold(dev);
3118         }
3119
3120  out_free:
3121         if (err) {
3122                 rdev->scan_req = NULL;
3123                 kfree(request);
3124         }
3125  out:
3126         cfg80211_unlock_rdev(rdev);
3127         dev_put(dev);
3128  out_rtnl:
3129         rtnl_unlock();
3130
3131         return err;
3132 }
3133
3134 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
3135                             struct cfg80211_registered_device *rdev,
3136                             struct wireless_dev *wdev,
3137                             struct cfg80211_internal_bss *intbss)
3138 {
3139         struct cfg80211_bss *res = &intbss->pub;
3140         void *hdr;
3141         struct nlattr *bss;
3142         int i;
3143
3144         ASSERT_WDEV_LOCK(wdev);
3145
3146         hdr = nl80211hdr_put(msg, pid, seq, flags,
3147                              NL80211_CMD_NEW_SCAN_RESULTS);
3148         if (!hdr)
3149                 return -1;
3150
3151         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation);
3152         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex);
3153
3154         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
3155         if (!bss)
3156                 goto nla_put_failure;
3157         if (!is_zero_ether_addr(res->bssid))
3158                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
3159         if (res->information_elements && res->len_information_elements)
3160                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
3161                         res->len_information_elements,
3162                         res->information_elements);
3163         if (res->beacon_ies && res->len_beacon_ies &&
3164             res->beacon_ies != res->information_elements)
3165                 NLA_PUT(msg, NL80211_BSS_BEACON_IES,
3166                         res->len_beacon_ies, res->beacon_ies);
3167         if (res->tsf)
3168                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
3169         if (res->beacon_interval)
3170                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
3171         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
3172         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
3173         NLA_PUT_U32(msg, NL80211_BSS_SEEN_MS_AGO,
3174                 jiffies_to_msecs(jiffies - intbss->ts));
3175
3176         switch (rdev->wiphy.signal_type) {
3177         case CFG80211_SIGNAL_TYPE_MBM:
3178                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
3179                 break;
3180         case CFG80211_SIGNAL_TYPE_UNSPEC:
3181                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
3182                 break;
3183         default:
3184                 break;
3185         }
3186
3187         switch (wdev->iftype) {
3188         case NL80211_IFTYPE_STATION:
3189                 if (intbss == wdev->current_bss)
3190                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3191                                     NL80211_BSS_STATUS_ASSOCIATED);
3192                 else for (i = 0; i < MAX_AUTH_BSSES; i++) {
3193                         if (intbss != wdev->auth_bsses[i])
3194                                 continue;
3195                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3196                                     NL80211_BSS_STATUS_AUTHENTICATED);
3197                         break;
3198                 }
3199                 break;
3200         case NL80211_IFTYPE_ADHOC:
3201                 if (intbss == wdev->current_bss)
3202                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3203                                     NL80211_BSS_STATUS_IBSS_JOINED);
3204                 break;
3205         default:
3206                 break;
3207         }
3208
3209         nla_nest_end(msg, bss);
3210
3211         return genlmsg_end(msg, hdr);
3212
3213  nla_put_failure:
3214         genlmsg_cancel(msg, hdr);
3215         return -EMSGSIZE;
3216 }
3217
3218 static int nl80211_dump_scan(struct sk_buff *skb,
3219                              struct netlink_callback *cb)
3220 {
3221         struct cfg80211_registered_device *rdev;
3222         struct net_device *dev;
3223         struct cfg80211_internal_bss *scan;
3224         struct wireless_dev *wdev;
3225         int ifidx = cb->args[0];
3226         int start = cb->args[1], idx = 0;
3227         int err;
3228
3229         if (!ifidx)
3230                 ifidx = nl80211_get_ifidx(cb);
3231         if (ifidx < 0)
3232                 return ifidx;
3233         cb->args[0] = ifidx;
3234
3235         dev = dev_get_by_index(sock_net(skb->sk), ifidx);
3236         if (!dev)
3237                 return -ENODEV;
3238
3239         rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
3240         if (IS_ERR(rdev)) {
3241                 err = PTR_ERR(rdev);
3242                 goto out_put_netdev;
3243         }
3244
3245         wdev = dev->ieee80211_ptr;
3246
3247         wdev_lock(wdev);
3248         spin_lock_bh(&rdev->bss_lock);
3249         cfg80211_bss_expire(rdev);
3250
3251         list_for_each_entry(scan, &rdev->bss_list, list) {
3252                 if (++idx <= start)
3253                         continue;
3254                 if (nl80211_send_bss(skb,
3255                                 NETLINK_CB(cb->skb).pid,
3256                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3257                                 rdev, wdev, scan) < 0) {
3258                         idx--;
3259                         goto out;
3260                 }
3261         }
3262
3263  out:
3264         spin_unlock_bh(&rdev->bss_lock);
3265         wdev_unlock(wdev);
3266
3267         cb->args[1] = idx;
3268         err = skb->len;
3269         cfg80211_unlock_rdev(rdev);
3270  out_put_netdev:
3271         dev_put(dev);
3272
3273         return err;
3274 }
3275
3276 static int nl80211_send_survey(struct sk_buff *msg, u32 pid, u32 seq,
3277                                 int flags, struct net_device *dev,
3278                                 struct survey_info *survey)
3279 {
3280         void *hdr;
3281         struct nlattr *infoattr;
3282
3283         /* Survey without a channel doesn't make sense */
3284         if (!survey->channel)
3285                 return -EINVAL;
3286
3287         hdr = nl80211hdr_put(msg, pid, seq, flags,
3288                              NL80211_CMD_NEW_SURVEY_RESULTS);
3289         if (!hdr)
3290                 return -ENOMEM;
3291
3292         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
3293
3294         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
3295         if (!infoattr)
3296                 goto nla_put_failure;
3297
3298         NLA_PUT_U32(msg, NL80211_SURVEY_INFO_FREQUENCY,
3299                     survey->channel->center_freq);
3300         if (survey->filled & SURVEY_INFO_NOISE_DBM)
3301                 NLA_PUT_U8(msg, NL80211_SURVEY_INFO_NOISE,
3302                             survey->noise);
3303
3304         nla_nest_end(msg, infoattr);
3305
3306         return genlmsg_end(msg, hdr);
3307
3308  nla_put_failure:
3309         genlmsg_cancel(msg, hdr);
3310         return -EMSGSIZE;
3311 }
3312
3313 static int nl80211_dump_survey(struct sk_buff *skb,
3314                         struct netlink_callback *cb)
3315 {
3316         struct survey_info survey;
3317         struct cfg80211_registered_device *dev;
3318         struct net_device *netdev;
3319         int ifidx = cb->args[0];
3320         int survey_idx = cb->args[1];
3321         int res;
3322
3323         if (!ifidx)
3324                 ifidx = nl80211_get_ifidx(cb);
3325         if (ifidx < 0)
3326                 return ifidx;
3327         cb->args[0] = ifidx;
3328
3329         rtnl_lock();
3330
3331         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
3332         if (!netdev) {
3333                 res = -ENODEV;
3334                 goto out_rtnl;
3335         }
3336
3337         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
3338         if (IS_ERR(dev)) {
3339                 res = PTR_ERR(dev);
3340                 goto out_rtnl;
3341         }
3342
3343         if (!dev->ops->dump_survey) {
3344                 res = -EOPNOTSUPP;
3345                 goto out_err;
3346         }
3347
3348         while (1) {
3349                 res = dev->ops->dump_survey(&dev->wiphy, netdev, survey_idx,
3350                                             &survey);
3351                 if (res == -ENOENT)
3352                         break;
3353                 if (res)
3354                         goto out_err;
3355
3356                 if (nl80211_send_survey(skb,
3357                                 NETLINK_CB(cb->skb).pid,
3358                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3359                                 netdev,
3360                                 &survey) < 0)
3361                         goto out;
3362                 survey_idx++;
3363         }
3364
3365  out:
3366         cb->args[1] = survey_idx;
3367         res = skb->len;
3368  out_err:
3369         cfg80211_unlock_rdev(dev);
3370  out_rtnl:
3371         rtnl_unlock();
3372
3373         return res;
3374 }
3375
3376 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
3377 {
3378         return auth_type <= NL80211_AUTHTYPE_MAX;
3379 }
3380
3381 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
3382 {
3383         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
3384                                   NL80211_WPA_VERSION_2));
3385 }
3386
3387 static bool nl80211_valid_akm_suite(u32 akm)
3388 {
3389         return akm == WLAN_AKM_SUITE_8021X ||
3390                 akm == WLAN_AKM_SUITE_PSK;
3391 }
3392
3393 static bool nl80211_valid_cipher_suite(u32 cipher)
3394 {
3395         return cipher == WLAN_CIPHER_SUITE_WEP40 ||
3396                 cipher == WLAN_CIPHER_SUITE_WEP104 ||
3397                 cipher == WLAN_CIPHER_SUITE_TKIP ||
3398                 cipher == WLAN_CIPHER_SUITE_CCMP ||
3399                 cipher == WLAN_CIPHER_SUITE_AES_CMAC;
3400 }
3401
3402
3403 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
3404 {
3405         struct cfg80211_registered_device *rdev;
3406         struct net_device *dev;
3407         struct ieee80211_channel *chan;
3408         const u8 *bssid, *ssid, *ie = NULL;
3409         int err, ssid_len, ie_len = 0;
3410         enum nl80211_auth_type auth_type;
3411         struct key_parse key;
3412
3413         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3414                 return -EINVAL;
3415
3416         if (!info->attrs[NL80211_ATTR_MAC])
3417                 return -EINVAL;
3418
3419         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
3420                 return -EINVAL;
3421
3422         if (!info->attrs[NL80211_ATTR_SSID])
3423                 return -EINVAL;
3424
3425         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
3426                 return -EINVAL;
3427
3428         err = nl80211_parse_key(info, &key);
3429         if (err)
3430                 return err;
3431
3432         if (key.idx >= 0) {
3433                 if (!key.p.key || !key.p.key_len)
3434                         return -EINVAL;
3435                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
3436                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
3437                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
3438                      key.p.key_len != WLAN_KEY_LEN_WEP104))
3439                         return -EINVAL;
3440                 if (key.idx > 4)
3441                         return -EINVAL;
3442         } else {
3443                 key.p.key_len = 0;
3444                 key.p.key = NULL;
3445         }
3446
3447         rtnl_lock();
3448
3449         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3450         if (err)
3451                 goto unlock_rtnl;
3452
3453         if (!rdev->ops->auth) {
3454                 err = -EOPNOTSUPP;
3455                 goto out;
3456         }
3457
3458         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3459                 err = -EOPNOTSUPP;
3460                 goto out;
3461         }
3462
3463         if (!netif_running(dev)) {
3464                 err = -ENETDOWN;
3465                 goto out;
3466         }
3467
3468         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3469         chan = ieee80211_get_channel(&rdev->wiphy,
3470                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3471         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED)) {
3472                 err = -EINVAL;
3473                 goto out;
3474         }
3475
3476         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3477         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3478
3479         if (info->attrs[NL80211_ATTR_IE]) {
3480                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3481                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3482         }
3483
3484         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
3485         if (!nl80211_valid_auth_type(auth_type)) {
3486                 err = -EINVAL;
3487                 goto out;
3488         }
3489
3490         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
3491                                  ssid, ssid_len, ie, ie_len,
3492                                  key.p.key, key.p.key_len, key.idx);
3493
3494 out:
3495         cfg80211_unlock_rdev(rdev);
3496         dev_put(dev);
3497 unlock_rtnl:
3498         rtnl_unlock();
3499         return err;
3500 }
3501
3502 static int nl80211_crypto_settings(struct genl_info *info,
3503                                    struct cfg80211_crypto_settings *settings,
3504                                    int cipher_limit)
3505 {
3506         memset(settings, 0, sizeof(*settings));
3507
3508         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
3509
3510         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
3511                 void *data;
3512                 int len, i;
3513
3514                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3515                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3516                 settings->n_ciphers_pairwise = len / sizeof(u32);
3517
3518                 if (len % sizeof(u32))
3519                         return -EINVAL;
3520
3521                 if (settings->n_ciphers_pairwise > cipher_limit)
3522                         return -EINVAL;
3523
3524                 memcpy(settings->ciphers_pairwise, data, len);
3525
3526                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3527                         if (!nl80211_valid_cipher_suite(
3528                                         settings->ciphers_pairwise[i]))
3529                                 return -EINVAL;
3530         }
3531
3532         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
3533                 settings->cipher_group =
3534                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
3535                 if (!nl80211_valid_cipher_suite(settings->cipher_group))
3536                         return -EINVAL;
3537         }
3538
3539         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
3540                 settings->wpa_versions =
3541                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
3542                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
3543                         return -EINVAL;
3544         }
3545
3546         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
3547                 void *data;
3548                 int len, i;
3549
3550                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
3551                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
3552                 settings->n_akm_suites = len / sizeof(u32);
3553
3554                 if (len % sizeof(u32))
3555                         return -EINVAL;
3556
3557                 memcpy(settings->akm_suites, data, len);
3558
3559                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3560                         if (!nl80211_valid_akm_suite(settings->akm_suites[i]))
3561                                 return -EINVAL;
3562         }
3563
3564         return 0;
3565 }
3566
3567 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
3568 {
3569         struct cfg80211_registered_device *rdev;
3570         struct net_device *dev;
3571         struct wireless_dev *wdev;
3572         struct cfg80211_crypto_settings crypto;
3573         struct ieee80211_channel *chan, *fixedchan;
3574         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
3575         int err, ssid_len, ie_len = 0;
3576         bool use_mfp = false;
3577
3578         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3579                 return -EINVAL;
3580
3581         if (!info->attrs[NL80211_ATTR_MAC] ||
3582             !info->attrs[NL80211_ATTR_SSID] ||
3583             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
3584                 return -EINVAL;
3585
3586         rtnl_lock();
3587
3588         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3589         if (err)
3590                 goto unlock_rtnl;
3591
3592         if (!rdev->ops->assoc) {
3593                 err = -EOPNOTSUPP;
3594                 goto out;
3595         }
3596
3597         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3598                 err = -EOPNOTSUPP;
3599                 goto out;
3600         }
3601
3602         if (!netif_running(dev)) {
3603                 err = -ENETDOWN;
3604                 goto out;
3605         }
3606
3607         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3608
3609         chan = ieee80211_get_channel(&rdev->wiphy,
3610                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3611         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED)) {
3612                 err = -EINVAL;
3613                 goto out;
3614         }
3615
3616         mutex_lock(&rdev->devlist_mtx);
3617         wdev = dev->ieee80211_ptr;
3618         fixedchan = rdev_fixed_channel(rdev, wdev);
3619         if (fixedchan && chan != fixedchan) {
3620                 err = -EBUSY;
3621                 mutex_unlock(&rdev->devlist_mtx);
3622                 goto out;
3623         }
3624         mutex_unlock(&rdev->devlist_mtx);
3625
3626         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3627         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3628
3629         if (info->attrs[NL80211_ATTR_IE]) {
3630                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3631                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3632         }
3633
3634         if (info->attrs[NL80211_ATTR_USE_MFP]) {
3635                 enum nl80211_mfp mfp =
3636                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
3637                 if (mfp == NL80211_MFP_REQUIRED)
3638                         use_mfp = true;
3639                 else if (mfp != NL80211_MFP_NO) {
3640                         err = -EINVAL;
3641                         goto out;
3642                 }
3643         }
3644
3645         if (info->attrs[NL80211_ATTR_PREV_BSSID])
3646                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
3647
3648         err = nl80211_crypto_settings(info, &crypto, 1);
3649         if (!err)
3650                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
3651                                           ssid, ssid_len, ie, ie_len, use_mfp,
3652                                           &crypto);
3653
3654 out:
3655         cfg80211_unlock_rdev(rdev);
3656         dev_put(dev);
3657 unlock_rtnl:
3658         rtnl_unlock();
3659         return err;
3660 }
3661
3662 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
3663 {
3664         struct cfg80211_registered_device *rdev;
3665         struct net_device *dev;
3666         const u8 *ie = NULL, *bssid;
3667         int err, ie_len = 0;
3668         u16 reason_code;
3669
3670         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3671                 return -EINVAL;
3672
3673         if (!info->attrs[NL80211_ATTR_MAC])
3674                 return -EINVAL;
3675
3676         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3677                 return -EINVAL;
3678
3679         rtnl_lock();
3680
3681         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3682         if (err)
3683                 goto unlock_rtnl;
3684
3685         if (!rdev->ops->deauth) {
3686                 err = -EOPNOTSUPP;
3687                 goto out;
3688         }
3689
3690         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3691                 err = -EOPNOTSUPP;
3692                 goto out;
3693         }
3694
3695         if (!netif_running(dev)) {
3696                 err = -ENETDOWN;
3697                 goto out;
3698         }
3699
3700         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3701
3702         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3703         if (reason_code == 0) {
3704                 /* Reason Code 0 is reserved */
3705                 err = -EINVAL;
3706                 goto out;
3707         }
3708
3709         if (info->attrs[NL80211_ATTR_IE]) {
3710                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3711                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3712         }
3713
3714         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code);
3715
3716 out:
3717         cfg80211_unlock_rdev(rdev);
3718         dev_put(dev);
3719 unlock_rtnl:
3720         rtnl_unlock();
3721         return err;
3722 }
3723
3724 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
3725 {
3726         struct cfg80211_registered_device *rdev;
3727         struct net_device *dev;
3728         const u8 *ie = NULL, *bssid;
3729         int err, ie_len = 0;
3730         u16 reason_code;
3731
3732         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3733                 return -EINVAL;
3734
3735         if (!info->attrs[NL80211_ATTR_MAC])
3736                 return -EINVAL;
3737
3738         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3739                 return -EINVAL;
3740
3741         rtnl_lock();
3742
3743         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3744         if (err)
3745                 goto unlock_rtnl;
3746
3747         if (!rdev->ops->disassoc) {
3748                 err = -EOPNOTSUPP;
3749                 goto out;
3750         }
3751
3752         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3753                 err = -EOPNOTSUPP;
3754                 goto out;
3755         }
3756
3757         if (!netif_running(dev)) {
3758                 err = -ENETDOWN;
3759                 goto out;
3760         }
3761
3762         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3763
3764         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3765         if (reason_code == 0) {
3766                 /* Reason Code 0 is reserved */
3767                 err = -EINVAL;
3768                 goto out;
3769         }
3770
3771         if (info->attrs[NL80211_ATTR_IE]) {
3772                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3773                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3774         }
3775
3776         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code);
3777
3778 out:
3779         cfg80211_unlock_rdev(rdev);
3780         dev_put(dev);
3781 unlock_rtnl:
3782         rtnl_unlock();
3783         return err;
3784 }
3785
3786 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
3787 {
3788         struct cfg80211_registered_device *rdev;
3789         struct net_device *dev;
3790         struct cfg80211_ibss_params ibss;
3791         struct wiphy *wiphy;
3792         struct cfg80211_cached_keys *connkeys = NULL;
3793         int err;
3794
3795         memset(&ibss, 0, sizeof(ibss));
3796
3797         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3798                 return -EINVAL;
3799
3800         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
3801             !info->attrs[NL80211_ATTR_SSID] ||
3802             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3803                 return -EINVAL;
3804
3805         ibss.beacon_interval = 100;
3806
3807         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
3808                 ibss.beacon_interval =
3809                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3810                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
3811                         return -EINVAL;
3812         }
3813
3814         rtnl_lock();
3815
3816         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3817         if (err)
3818                 goto unlock_rtnl;
3819
3820         if (!rdev->ops->join_ibss) {
3821                 err = -EOPNOTSUPP;
3822                 goto out;
3823         }
3824
3825         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3826                 err = -EOPNOTSUPP;
3827                 goto out;
3828         }
3829
3830         if (!netif_running(dev)) {
3831                 err = -ENETDOWN;
3832                 goto out;
3833         }
3834
3835         wiphy = &rdev->wiphy;
3836
3837         if (info->attrs[NL80211_ATTR_MAC])
3838                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3839         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3840         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3841
3842         if (info->attrs[NL80211_ATTR_IE]) {
3843                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3844                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3845         }
3846
3847         ibss.channel = ieee80211_get_channel(wiphy,
3848                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3849         if (!ibss.channel ||
3850             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
3851             ibss.channel->flags & IEEE80211_CHAN_DISABLED) {
3852                 err = -EINVAL;
3853                 goto out;
3854         }
3855
3856         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
3857         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3858
3859         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
3860                 connkeys = nl80211_parse_connkeys(rdev,
3861                                         info->attrs[NL80211_ATTR_KEYS]);
3862                 if (IS_ERR(connkeys)) {
3863                         err = PTR_ERR(connkeys);
3864                         connkeys = NULL;
3865                         goto out;
3866                 }
3867         }
3868
3869         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
3870
3871 out:
3872         cfg80211_unlock_rdev(rdev);
3873         dev_put(dev);
3874 unlock_rtnl:
3875         if (err)
3876                 kfree(connkeys);
3877         rtnl_unlock();
3878         return err;
3879 }
3880
3881 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
3882 {
3883         struct cfg80211_registered_device *rdev;
3884         struct net_device *dev;
3885         int err;
3886
3887         rtnl_lock();
3888
3889         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3890         if (err)
3891                 goto unlock_rtnl;
3892
3893         if (!rdev->ops->leave_ibss) {
3894                 err = -EOPNOTSUPP;
3895                 goto out;
3896         }
3897
3898         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3899                 err = -EOPNOTSUPP;
3900                 goto out;
3901         }
3902
3903         if (!netif_running(dev)) {
3904                 err = -ENETDOWN;
3905                 goto out;
3906         }
3907
3908         err = cfg80211_leave_ibss(rdev, dev, false);
3909
3910 out:
3911         cfg80211_unlock_rdev(rdev);
3912         dev_put(dev);
3913 unlock_rtnl:
3914         rtnl_unlock();
3915         return err;
3916 }
3917
3918 #ifdef CONFIG_NL80211_TESTMODE
3919 static struct genl_multicast_group nl80211_testmode_mcgrp = {
3920         .name = "testmode",
3921 };
3922
3923 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
3924 {
3925         struct cfg80211_registered_device *rdev;
3926         int err;
3927
3928         if (!info->attrs[NL80211_ATTR_TESTDATA])
3929                 return -EINVAL;
3930
3931         rtnl_lock();
3932
3933         rdev = cfg80211_get_dev_from_info(info);
3934         if (IS_ERR(rdev)) {
3935                 err = PTR_ERR(rdev);
3936                 goto unlock_rtnl;
3937         }
3938
3939         err = -EOPNOTSUPP;
3940         if (rdev->ops->testmode_cmd) {
3941                 rdev->testmode_info = info;
3942                 err = rdev->ops->testmode_cmd(&rdev->wiphy,
3943                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
3944                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
3945                 rdev->testmode_info = NULL;
3946         }
3947
3948         cfg80211_unlock_rdev(rdev);
3949
3950  unlock_rtnl:
3951         rtnl_unlock();
3952         return err;
3953 }
3954
3955 static struct sk_buff *
3956 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
3957                               int approxlen, u32 pid, u32 seq, gfp_t gfp)
3958 {
3959         struct sk_buff *skb;
3960         void *hdr;
3961         struct nlattr *data;
3962
3963         skb = nlmsg_new(approxlen + 100, gfp);
3964         if (!skb)
3965                 return NULL;
3966
3967         hdr = nl80211hdr_put(skb, pid, seq, 0, NL80211_CMD_TESTMODE);
3968         if (!hdr) {
3969                 kfree_skb(skb);
3970                 return NULL;
3971         }
3972
3973         NLA_PUT_U32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3974         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
3975
3976         ((void **)skb->cb)[0] = rdev;
3977         ((void **)skb->cb)[1] = hdr;
3978         ((void **)skb->cb)[2] = data;
3979
3980         return skb;
3981
3982  nla_put_failure:
3983         kfree_skb(skb);
3984         return NULL;
3985 }
3986
3987 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
3988                                                   int approxlen)
3989 {
3990         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
3991
3992         if (WARN_ON(!rdev->testmode_info))
3993                 return NULL;
3994
3995         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
3996                                 rdev->testmode_info->snd_pid,
3997                                 rdev->testmode_info->snd_seq,
3998                                 GFP_KERNEL);
3999 }
4000 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
4001
4002 int cfg80211_testmode_reply(struct sk_buff *skb)
4003 {
4004         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
4005         void *hdr = ((void **)skb->cb)[1];
4006         struct nlattr *data = ((void **)skb->cb)[2];
4007
4008         if (WARN_ON(!rdev->testmode_info)) {
4009                 kfree_skb(skb);
4010                 return -EINVAL;
4011         }
4012
4013         nla_nest_end(skb, data);
4014         genlmsg_end(skb, hdr);
4015         return genlmsg_reply(skb, rdev->testmode_info);
4016 }
4017 EXPORT_SYMBOL(cfg80211_testmode_reply);
4018
4019 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
4020                                                   int approxlen, gfp_t gfp)
4021 {
4022         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
4023
4024         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
4025 }
4026 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
4027
4028 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
4029 {
4030         void *hdr = ((void **)skb->cb)[1];
4031         struct nlattr *data = ((void **)skb->cb)[2];
4032
4033         nla_nest_end(skb, data);
4034         genlmsg_end(skb, hdr);
4035         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
4036 }
4037 EXPORT_SYMBOL(cfg80211_testmode_event);
4038 #endif
4039
4040 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
4041 {
4042         struct cfg80211_registered_device *rdev;
4043         struct net_device *dev;
4044         struct cfg80211_connect_params connect;
4045         struct wiphy *wiphy;
4046         struct cfg80211_cached_keys *connkeys = NULL;
4047         int err;
4048
4049         memset(&connect, 0, sizeof(connect));
4050
4051         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4052                 return -EINVAL;
4053
4054         if (!info->attrs[NL80211_ATTR_SSID] ||
4055             !nla_len(info->attrs[NL80211_ATTR_SSID]))
4056                 return -EINVAL;
4057
4058         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
4059                 connect.auth_type =
4060                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
4061                 if (!nl80211_valid_auth_type(connect.auth_type))
4062                         return -EINVAL;
4063         } else
4064                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
4065
4066         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
4067
4068         err = nl80211_crypto_settings(info, &connect.crypto,
4069                                       NL80211_MAX_NR_CIPHER_SUITES);
4070         if (err)
4071                 return err;
4072         rtnl_lock();
4073
4074         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4075         if (err)
4076                 goto unlock_rtnl;
4077
4078         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4079                 err = -EOPNOTSUPP;
4080                 goto out;
4081         }
4082
4083         if (!netif_running(dev)) {
4084                 err = -ENETDOWN;
4085                 goto out;
4086         }
4087
4088         wiphy = &rdev->wiphy;
4089
4090         if (info->attrs[NL80211_ATTR_MAC])
4091                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4092         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4093         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4094
4095         if (info->attrs[NL80211_ATTR_IE]) {
4096                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4097                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4098         }
4099
4100         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4101                 connect.channel =
4102                         ieee80211_get_channel(wiphy,
4103                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4104                 if (!connect.channel ||
4105                     connect.channel->flags & IEEE80211_CHAN_DISABLED) {
4106                         err = -EINVAL;
4107                         goto out;
4108                 }
4109         }
4110
4111         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
4112                 connkeys = nl80211_parse_connkeys(rdev,
4113                                         info->attrs[NL80211_ATTR_KEYS]);
4114                 if (IS_ERR(connkeys)) {
4115                         err = PTR_ERR(connkeys);
4116                         connkeys = NULL;
4117                         goto out;
4118                 }
4119         }
4120
4121         err = cfg80211_connect(rdev, dev, &connect, connkeys);
4122
4123 out:
4124         cfg80211_unlock_rdev(rdev);
4125         dev_put(dev);
4126 unlock_rtnl:
4127         if (err)
4128                 kfree(connkeys);
4129         rtnl_unlock();
4130         return err;
4131 }
4132
4133 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
4134 {
4135         struct cfg80211_registered_device *rdev;
4136         struct net_device *dev;
4137         int err;
4138         u16 reason;
4139
4140         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4141                 reason = WLAN_REASON_DEAUTH_LEAVING;
4142         else
4143                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4144
4145         if (reason == 0)
4146                 return -EINVAL;
4147
4148         rtnl_lock();
4149
4150         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4151         if (err)
4152                 goto unlock_rtnl;
4153
4154         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4155                 err = -EOPNOTSUPP;
4156                 goto out;
4157         }
4158
4159         if (!netif_running(dev)) {
4160                 err = -ENETDOWN;
4161                 goto out;
4162         }
4163
4164         err = cfg80211_disconnect(rdev, dev, reason, true);
4165
4166 out:
4167         cfg80211_unlock_rdev(rdev);
4168         dev_put(dev);
4169 unlock_rtnl:
4170         rtnl_unlock();
4171         return err;
4172 }
4173
4174 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
4175 {
4176         struct cfg80211_registered_device *rdev;
4177         struct net *net;
4178         int err;
4179         u32 pid;
4180
4181         if (!info->attrs[NL80211_ATTR_PID])
4182                 return -EINVAL;
4183
4184         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
4185
4186         rtnl_lock();
4187
4188         rdev = cfg80211_get_dev_from_info(info);
4189         if (IS_ERR(rdev)) {
4190                 err = PTR_ERR(rdev);
4191                 goto out_rtnl;
4192         }
4193
4194         net = get_net_ns_by_pid(pid);
4195         if (IS_ERR(net)) {
4196                 err = PTR_ERR(net);
4197                 goto out;
4198         }
4199
4200         err = 0;
4201
4202         /* check if anything to do */
4203         if (net_eq(wiphy_net(&rdev->wiphy), net))
4204                 goto out_put_net;
4205
4206         err = cfg80211_switch_netns(rdev, net);
4207  out_put_net:
4208         put_net(net);
4209  out:
4210         cfg80211_unlock_rdev(rdev);
4211  out_rtnl:
4212         rtnl_unlock();
4213         return err;
4214 }
4215
4216 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
4217 {
4218         struct cfg80211_registered_device *rdev;
4219         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
4220                         struct cfg80211_pmksa *pmksa) = NULL;
4221         int err;
4222         struct net_device *dev;
4223         struct cfg80211_pmksa pmksa;
4224
4225         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
4226
4227         if (!info->attrs[NL80211_ATTR_MAC])
4228                 return -EINVAL;
4229
4230         if (!info->attrs[NL80211_ATTR_PMKID])
4231                 return -EINVAL;
4232
4233         rtnl_lock();
4234
4235         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4236         if (err)
4237                 goto out_rtnl;
4238
4239         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
4240         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4241
4242         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4243                 err = -EOPNOTSUPP;
4244                 goto out;
4245         }
4246
4247         switch (info->genlhdr->cmd) {
4248         case NL80211_CMD_SET_PMKSA:
4249                 rdev_ops = rdev->ops->set_pmksa;
4250                 break;
4251         case NL80211_CMD_DEL_PMKSA:
4252                 rdev_ops = rdev->ops->del_pmksa;
4253                 break;
4254         default:
4255                 WARN_ON(1);
4256                 break;
4257         }
4258
4259         if (!rdev_ops) {
4260                 err = -EOPNOTSUPP;
4261                 goto out;
4262         }
4263
4264         err = rdev_ops(&rdev->wiphy, dev, &pmksa);
4265
4266  out:
4267         cfg80211_unlock_rdev(rdev);
4268         dev_put(dev);
4269  out_rtnl:
4270         rtnl_unlock();
4271
4272         return err;
4273 }
4274
4275 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
4276 {
4277         struct cfg80211_registered_device *rdev;
4278         int err;
4279         struct net_device *dev;
4280
4281         rtnl_lock();
4282
4283         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4284         if (err)
4285                 goto out_rtnl;
4286
4287         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4288                 err = -EOPNOTSUPP;
4289                 goto out;
4290         }
4291
4292         if (!rdev->ops->flush_pmksa) {
4293                 err = -EOPNOTSUPP;
4294                 goto out;
4295         }
4296
4297         err = rdev->ops->flush_pmksa(&rdev->wiphy, dev);
4298
4299  out:
4300         cfg80211_unlock_rdev(rdev);
4301         dev_put(dev);
4302  out_rtnl:
4303         rtnl_unlock();
4304
4305         return err;
4306
4307 }
4308
4309 static int nl80211_remain_on_channel(struct sk_buff *skb,
4310                                      struct genl_info *info)
4311 {
4312         struct cfg80211_registered_device *rdev;
4313         struct net_device *dev;
4314         struct ieee80211_channel *chan;
4315         struct sk_buff *msg;
4316         void *hdr;
4317         u64 cookie;
4318         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
4319         u32 freq, duration;
4320         int err;
4321
4322         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
4323             !info->attrs[NL80211_ATTR_DURATION])
4324                 return -EINVAL;
4325
4326         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
4327
4328         /*
4329          * We should be on that channel for at least one jiffie,
4330          * and more than 5 seconds seems excessive.
4331          */
4332         if (!duration || !msecs_to_jiffies(duration) || duration > 5000)
4333                 return -EINVAL;
4334
4335         rtnl_lock();
4336
4337         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4338         if (err)
4339                 goto unlock_rtnl;
4340
4341         if (!rdev->ops->remain_on_channel) {
4342                 err = -EOPNOTSUPP;
4343                 goto out;
4344         }
4345
4346         if (!netif_running(dev)) {
4347                 err = -ENETDOWN;
4348                 goto out;
4349         }
4350
4351         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
4352                 channel_type = nla_get_u32(
4353                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
4354                 if (channel_type != NL80211_CHAN_NO_HT &&
4355                     channel_type != NL80211_CHAN_HT20 &&
4356                     channel_type != NL80211_CHAN_HT40PLUS &&
4357                     channel_type != NL80211_CHAN_HT40MINUS)
4358                         err = -EINVAL;
4359                         goto out;
4360         }
4361
4362         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
4363         chan = rdev_freq_to_chan(rdev, freq, channel_type);
4364         if (chan == NULL) {
4365                 err = -EINVAL;
4366                 goto out;
4367         }
4368
4369         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4370         if (!msg) {
4371                 err = -ENOMEM;
4372                 goto out;
4373         }
4374
4375         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4376                              NL80211_CMD_REMAIN_ON_CHANNEL);
4377
4378         if (IS_ERR(hdr)) {
4379                 err = PTR_ERR(hdr);
4380                 goto free_msg;
4381         }
4382
4383         err = rdev->ops->remain_on_channel(&rdev->wiphy, dev, chan,
4384                                            channel_type, duration, &cookie);
4385
4386         if (err)
4387                 goto free_msg;
4388
4389         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
4390
4391         genlmsg_end(msg, hdr);
4392         err = genlmsg_reply(msg, info);
4393         goto out;
4394
4395  nla_put_failure:
4396         err = -ENOBUFS;
4397  free_msg:
4398         nlmsg_free(msg);
4399  out:
4400         cfg80211_unlock_rdev(rdev);
4401         dev_put(dev);
4402  unlock_rtnl:
4403         rtnl_unlock();
4404         return err;
4405 }
4406
4407 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
4408                                             struct genl_info *info)
4409 {
4410         struct cfg80211_registered_device *rdev;
4411         struct net_device *dev;
4412         u64 cookie;
4413         int err;
4414
4415         if (!info->attrs[NL80211_ATTR_COOKIE])
4416                 return -EINVAL;
4417
4418         rtnl_lock();
4419
4420         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4421         if (err)
4422                 goto unlock_rtnl;
4423
4424         if (!rdev->ops->cancel_remain_on_channel) {
4425                 err = -EOPNOTSUPP;
4426                 goto out;
4427         }
4428
4429         if (!netif_running(dev)) {
4430                 err = -ENETDOWN;
4431                 goto out;
4432         }
4433
4434         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
4435
4436         err = rdev->ops->cancel_remain_on_channel(&rdev->wiphy, dev, cookie);
4437
4438  out:
4439         cfg80211_unlock_rdev(rdev);
4440         dev_put(dev);
4441  unlock_rtnl:
4442         rtnl_unlock();
4443         return err;
4444 }
4445
4446 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
4447                            u8 *rates, u8 rates_len)
4448 {
4449         u8 i;
4450         u32 mask = 0;
4451
4452         for (i = 0; i < rates_len; i++) {
4453                 int rate = (rates[i] & 0x7f) * 5;
4454                 int ridx;
4455                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
4456                         struct ieee80211_rate *srate =
4457                                 &sband->bitrates[ridx];
4458                         if (rate == srate->bitrate) {
4459                                 mask |= 1 << ridx;
4460                                 break;
4461                         }
4462                 }
4463                 if (ridx == sband->n_bitrates)
4464                         return 0; /* rate not found */
4465         }
4466
4467         return mask;
4468 }
4469
4470 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
4471         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
4472                                     .len = NL80211_MAX_SUPP_RATES },
4473 };
4474
4475 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
4476                                        struct genl_info *info)
4477 {
4478         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
4479         struct cfg80211_registered_device *rdev;
4480         struct cfg80211_bitrate_mask mask;
4481         int err, rem, i;
4482         struct net_device *dev;
4483         struct nlattr *tx_rates;
4484         struct ieee80211_supported_band *sband;
4485
4486         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
4487                 return -EINVAL;
4488
4489         rtnl_lock();
4490
4491         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4492         if (err)
4493                 goto unlock_rtnl;
4494
4495         if (!rdev->ops->set_bitrate_mask) {
4496                 err = -EOPNOTSUPP;
4497                 goto unlock;
4498         }
4499
4500         memset(&mask, 0, sizeof(mask));
4501         /* Default to all rates enabled */
4502         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
4503                 sband = rdev->wiphy.bands[i];
4504                 mask.control[i].legacy =
4505                         sband ? (1 << sband->n_bitrates) - 1 : 0;
4506         }
4507
4508         /*
4509          * The nested attribute uses enum nl80211_band as the index. This maps
4510          * directly to the enum ieee80211_band values used in cfg80211.
4511          */
4512         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
4513         {
4514                 enum ieee80211_band band = nla_type(tx_rates);
4515                 if (band < 0 || band >= IEEE80211_NUM_BANDS) {
4516                         err = -EINVAL;
4517                         goto unlock;
4518                 }
4519                 sband = rdev->wiphy.bands[band];
4520                 if (sband == NULL) {
4521                         err = -EINVAL;
4522                         goto unlock;
4523                 }
4524                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
4525                           nla_len(tx_rates), nl80211_txattr_policy);
4526                 if (tb[NL80211_TXRATE_LEGACY]) {
4527                         mask.control[band].legacy = rateset_to_mask(
4528                                 sband,
4529                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
4530                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
4531                         if (mask.control[band].legacy == 0) {
4532                                 err = -EINVAL;
4533                                 goto unlock;
4534                         }
4535                 }
4536         }
4537
4538         err = rdev->ops->set_bitrate_mask(&rdev->wiphy, dev, NULL, &mask);
4539
4540  unlock:
4541         dev_put(dev);
4542         cfg80211_unlock_rdev(rdev);
4543  unlock_rtnl:
4544         rtnl_unlock();
4545         return err;
4546 }
4547
4548 static struct genl_ops nl80211_ops[] = {
4549         {
4550                 .cmd = NL80211_CMD_GET_WIPHY,
4551                 .doit = nl80211_get_wiphy,
4552                 .dumpit = nl80211_dump_wiphy,
4553                 .policy = nl80211_policy,
4554                 /* can be retrieved by unprivileged users */
4555         },
4556         {
4557                 .cmd = NL80211_CMD_SET_WIPHY,
4558                 .doit = nl80211_set_wiphy,
4559                 .policy = nl80211_policy,
4560                 .flags = GENL_ADMIN_PERM,
4561         },
4562         {
4563                 .cmd = NL80211_CMD_GET_INTERFACE,
4564                 .doit = nl80211_get_interface,
4565                 .dumpit = nl80211_dump_interface,
4566                 .policy = nl80211_policy,
4567                 /* can be retrieved by unprivileged users */
4568         },
4569         {
4570                 .cmd = NL80211_CMD_SET_INTERFACE,
4571                 .doit = nl80211_set_interface,
4572                 .policy = nl80211_policy,
4573                 .flags = GENL_ADMIN_PERM,
4574         },
4575         {
4576                 .cmd = NL80211_CMD_NEW_INTERFACE,
4577                 .doit = nl80211_new_interface,
4578                 .policy = nl80211_policy,
4579                 .flags = GENL_ADMIN_PERM,
4580         },
4581         {
4582                 .cmd = NL80211_CMD_DEL_INTERFACE,
4583                 .doit = nl80211_del_interface,
4584                 .policy = nl80211_policy,
4585                 .flags = GENL_ADMIN_PERM,
4586         },
4587         {
4588                 .cmd = NL80211_CMD_GET_KEY,
4589                 .doit = nl80211_get_key,
4590                 .policy = nl80211_policy,
4591                 .flags = GENL_ADMIN_PERM,
4592         },
4593         {
4594                 .cmd = NL80211_CMD_SET_KEY,
4595                 .doit = nl80211_set_key,
4596                 .policy = nl80211_policy,
4597                 .flags = GENL_ADMIN_PERM,
4598         },
4599         {
4600                 .cmd = NL80211_CMD_NEW_KEY,
4601                 .doit = nl80211_new_key,
4602                 .policy = nl80211_policy,
4603                 .flags = GENL_ADMIN_PERM,
4604         },
4605         {
4606                 .cmd = NL80211_CMD_DEL_KEY,
4607                 .doit = nl80211_del_key,
4608                 .policy = nl80211_policy,
4609                 .flags = GENL_ADMIN_PERM,
4610         },
4611         {
4612                 .cmd = NL80211_CMD_SET_BEACON,
4613                 .policy = nl80211_policy,
4614                 .flags = GENL_ADMIN_PERM,
4615                 .doit = nl80211_addset_beacon,
4616         },
4617         {
4618                 .cmd = NL80211_CMD_NEW_BEACON,
4619                 .policy = nl80211_policy,
4620                 .flags = GENL_ADMIN_PERM,
4621                 .doit = nl80211_addset_beacon,
4622         },
4623         {
4624                 .cmd = NL80211_CMD_DEL_BEACON,
4625                 .policy = nl80211_policy,
4626                 .flags = GENL_ADMIN_PERM,
4627                 .doit = nl80211_del_beacon,
4628         },
4629         {
4630                 .cmd = NL80211_CMD_GET_STATION,
4631                 .doit = nl80211_get_station,
4632                 .dumpit = nl80211_dump_station,
4633                 .policy = nl80211_policy,
4634         },
4635         {
4636                 .cmd = NL80211_CMD_SET_STATION,
4637                 .doit = nl80211_set_station,
4638                 .policy = nl80211_policy,
4639                 .flags = GENL_ADMIN_PERM,
4640         },
4641         {
4642                 .cmd = NL80211_CMD_NEW_STATION,
4643                 .doit = nl80211_new_station,
4644                 .policy = nl80211_policy,
4645                 .flags = GENL_ADMIN_PERM,
4646         },
4647         {
4648                 .cmd = NL80211_CMD_DEL_STATION,
4649                 .doit = nl80211_del_station,
4650                 .policy = nl80211_policy,
4651                 .flags = GENL_ADMIN_PERM,
4652         },
4653         {
4654                 .cmd = NL80211_CMD_GET_MPATH,
4655                 .doit = nl80211_get_mpath,
4656                 .dumpit = nl80211_dump_mpath,
4657                 .policy = nl80211_policy,
4658                 .flags = GENL_ADMIN_PERM,
4659         },
4660         {
4661                 .cmd = NL80211_CMD_SET_MPATH,
4662                 .doit = nl80211_set_mpath,
4663                 .policy = nl80211_policy,
4664                 .flags = GENL_ADMIN_PERM,
4665         },
4666         {
4667                 .cmd = NL80211_CMD_NEW_MPATH,
4668                 .doit = nl80211_new_mpath,
4669                 .policy = nl80211_policy,
4670                 .flags = GENL_ADMIN_PERM,
4671         },
4672         {
4673                 .cmd = NL80211_CMD_DEL_MPATH,
4674                 .doit = nl80211_del_mpath,
4675                 .policy = nl80211_policy,
4676                 .flags = GENL_ADMIN_PERM,
4677         },
4678         {
4679                 .cmd = NL80211_CMD_SET_BSS,
4680                 .doit = nl80211_set_bss,
4681                 .policy = nl80211_policy,
4682                 .flags = GENL_ADMIN_PERM,
4683         },
4684         {
4685                 .cmd = NL80211_CMD_GET_REG,
4686                 .doit = nl80211_get_reg,
4687                 .policy = nl80211_policy,
4688                 /* can be retrieved by unprivileged users */
4689         },
4690         {
4691                 .cmd = NL80211_CMD_SET_REG,
4692                 .doit = nl80211_set_reg,
4693                 .policy = nl80211_policy,
4694                 .flags = GENL_ADMIN_PERM,
4695         },
4696         {
4697                 .cmd = NL80211_CMD_REQ_SET_REG,
4698                 .doit = nl80211_req_set_reg,
4699                 .policy = nl80211_policy,
4700                 .flags = GENL_ADMIN_PERM,
4701         },
4702         {
4703                 .cmd = NL80211_CMD_GET_MESH_PARAMS,
4704                 .doit = nl80211_get_mesh_params,
4705                 .policy = nl80211_policy,
4706                 /* can be retrieved by unprivileged users */
4707         },
4708         {
4709                 .cmd = NL80211_CMD_SET_MESH_PARAMS,
4710                 .doit = nl80211_set_mesh_params,
4711                 .policy = nl80211_policy,
4712                 .flags = GENL_ADMIN_PERM,
4713         },
4714         {
4715                 .cmd = NL80211_CMD_TRIGGER_SCAN,
4716                 .doit = nl80211_trigger_scan,
4717                 .policy = nl80211_policy,
4718                 .flags = GENL_ADMIN_PERM,
4719         },
4720         {
4721                 .cmd = NL80211_CMD_GET_SCAN,
4722                 .policy = nl80211_policy,
4723                 .dumpit = nl80211_dump_scan,
4724         },
4725         {
4726                 .cmd = NL80211_CMD_AUTHENTICATE,
4727                 .doit = nl80211_authenticate,
4728                 .policy = nl80211_policy,
4729                 .flags = GENL_ADMIN_PERM,
4730         },
4731         {
4732                 .cmd = NL80211_CMD_ASSOCIATE,
4733                 .doit = nl80211_associate,
4734                 .policy = nl80211_policy,
4735                 .flags = GENL_ADMIN_PERM,
4736         },
4737         {
4738                 .cmd = NL80211_CMD_DEAUTHENTICATE,
4739                 .doit = nl80211_deauthenticate,
4740                 .policy = nl80211_policy,
4741                 .flags = GENL_ADMIN_PERM,
4742         },
4743         {
4744                 .cmd = NL80211_CMD_DISASSOCIATE,
4745                 .doit = nl80211_disassociate,
4746                 .policy = nl80211_policy,
4747                 .flags = GENL_ADMIN_PERM,
4748         },
4749         {
4750                 .cmd = NL80211_CMD_JOIN_IBSS,
4751                 .doit = nl80211_join_ibss,
4752                 .policy = nl80211_policy,
4753                 .flags = GENL_ADMIN_PERM,
4754         },
4755         {
4756                 .cmd = NL80211_CMD_LEAVE_IBSS,
4757                 .doit = nl80211_leave_ibss,
4758                 .policy = nl80211_policy,
4759                 .flags = GENL_ADMIN_PERM,
4760         },
4761 #ifdef CONFIG_NL80211_TESTMODE
4762         {
4763                 .cmd = NL80211_CMD_TESTMODE,
4764                 .doit = nl80211_testmode_do,
4765                 .policy = nl80211_policy,
4766                 .flags = GENL_ADMIN_PERM,
4767         },
4768 #endif
4769         {
4770                 .cmd = NL80211_CMD_CONNECT,
4771                 .doit = nl80211_connect,
4772                 .policy = nl80211_policy,
4773                 .flags = GENL_ADMIN_PERM,
4774         },
4775         {
4776                 .cmd = NL80211_CMD_DISCONNECT,
4777                 .doit = nl80211_disconnect,
4778                 .policy = nl80211_policy,
4779                 .flags = GENL_ADMIN_PERM,
4780         },
4781         {
4782                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
4783                 .doit = nl80211_wiphy_netns,
4784                 .policy = nl80211_policy,
4785                 .flags = GENL_ADMIN_PERM,
4786         },
4787         {
4788                 .cmd = NL80211_CMD_GET_SURVEY,
4789                 .policy = nl80211_policy,
4790                 .dumpit = nl80211_dump_survey,
4791         },
4792         {
4793                 .cmd = NL80211_CMD_SET_PMKSA,
4794                 .doit = nl80211_setdel_pmksa,
4795                 .policy = nl80211_policy,
4796                 .flags = GENL_ADMIN_PERM,
4797         },
4798         {
4799                 .cmd = NL80211_CMD_DEL_PMKSA,
4800                 .doit = nl80211_setdel_pmksa,
4801                 .policy = nl80211_policy,
4802                 .flags = GENL_ADMIN_PERM,
4803         },
4804         {
4805                 .cmd = NL80211_CMD_FLUSH_PMKSA,
4806                 .doit = nl80211_flush_pmksa,
4807                 .policy = nl80211_policy,
4808                 .flags = GENL_ADMIN_PERM,
4809         },
4810         {
4811                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
4812                 .doit = nl80211_remain_on_channel,
4813                 .policy = nl80211_policy,
4814                 .flags = GENL_ADMIN_PERM,
4815         },
4816         {
4817                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
4818                 .doit = nl80211_cancel_remain_on_channel,
4819                 .policy = nl80211_policy,
4820                 .flags = GENL_ADMIN_PERM,
4821         },
4822         {
4823                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
4824                 .doit = nl80211_set_tx_bitrate_mask,
4825                 .policy = nl80211_policy,
4826                 .flags = GENL_ADMIN_PERM,
4827         },
4828 };
4829
4830 static struct genl_multicast_group nl80211_mlme_mcgrp = {
4831         .name = "mlme",
4832 };
4833
4834 /* multicast groups */
4835 static struct genl_multicast_group nl80211_config_mcgrp = {
4836         .name = "config",
4837 };
4838 static struct genl_multicast_group nl80211_scan_mcgrp = {
4839         .name = "scan",
4840 };
4841 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
4842         .name = "regulatory",
4843 };
4844
4845 /* notification functions */
4846
4847 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
4848 {
4849         struct sk_buff *msg;
4850
4851         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4852         if (!msg)
4853                 return;
4854
4855         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
4856                 nlmsg_free(msg);
4857                 return;
4858         }
4859
4860         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4861                                 nl80211_config_mcgrp.id, GFP_KERNEL);
4862 }
4863
4864 static int nl80211_add_scan_req(struct sk_buff *msg,
4865                                 struct cfg80211_registered_device *rdev)
4866 {
4867         struct cfg80211_scan_request *req = rdev->scan_req;
4868         struct nlattr *nest;
4869         int i;
4870
4871         ASSERT_RDEV_LOCK(rdev);
4872
4873         if (WARN_ON(!req))
4874                 return 0;
4875
4876         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
4877         if (!nest)
4878                 goto nla_put_failure;
4879         for (i = 0; i < req->n_ssids; i++)
4880                 NLA_PUT(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid);
4881         nla_nest_end(msg, nest);
4882
4883         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
4884         if (!nest)
4885                 goto nla_put_failure;
4886         for (i = 0; i < req->n_channels; i++)
4887                 NLA_PUT_U32(msg, i, req->channels[i]->center_freq);
4888         nla_nest_end(msg, nest);
4889
4890         if (req->ie)
4891                 NLA_PUT(msg, NL80211_ATTR_IE, req->ie_len, req->ie);
4892
4893         return 0;
4894  nla_put_failure:
4895         return -ENOBUFS;
4896 }
4897
4898 static int nl80211_send_scan_msg(struct sk_buff *msg,
4899                                  struct cfg80211_registered_device *rdev,
4900                                  struct net_device *netdev,
4901                                  u32 pid, u32 seq, int flags,
4902                                  u32 cmd)
4903 {
4904         void *hdr;
4905
4906         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
4907         if (!hdr)
4908                 return -1;
4909
4910         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4911         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4912
4913         /* ignore errors and send incomplete event anyway */
4914         nl80211_add_scan_req(msg, rdev);
4915
4916         return genlmsg_end(msg, hdr);
4917
4918  nla_put_failure:
4919         genlmsg_cancel(msg, hdr);
4920         return -EMSGSIZE;
4921 }
4922
4923 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
4924                              struct net_device *netdev)
4925 {
4926         struct sk_buff *msg;
4927
4928         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
4929         if (!msg)
4930                 return;
4931
4932         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
4933                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
4934                 nlmsg_free(msg);
4935                 return;
4936         }
4937
4938         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4939                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
4940 }
4941
4942 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
4943                             struct net_device *netdev)
4944 {
4945         struct sk_buff *msg;
4946
4947         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4948         if (!msg)
4949                 return;
4950
4951         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
4952                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
4953                 nlmsg_free(msg);
4954                 return;
4955         }
4956
4957         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4958                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
4959 }
4960
4961 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
4962                                struct net_device *netdev)
4963 {
4964         struct sk_buff *msg;
4965
4966         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4967         if (!msg)
4968                 return;
4969
4970         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
4971                                   NL80211_CMD_SCAN_ABORTED) < 0) {
4972                 nlmsg_free(msg);
4973                 return;
4974         }
4975
4976         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4977                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
4978 }
4979
4980 /*
4981  * This can happen on global regulatory changes or device specific settings
4982  * based on custom world regulatory domains.
4983  */
4984 void nl80211_send_reg_change_event(struct regulatory_request *request)
4985 {
4986         struct sk_buff *msg;
4987         void *hdr;
4988
4989         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4990         if (!msg)
4991                 return;
4992
4993         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
4994         if (!hdr) {
4995                 nlmsg_free(msg);
4996                 return;
4997         }
4998
4999         /* Userspace can always count this one always being set */
5000         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
5001
5002         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
5003                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5004                            NL80211_REGDOM_TYPE_WORLD);
5005         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
5006                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5007                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
5008         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
5009                  request->intersect)
5010                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5011                            NL80211_REGDOM_TYPE_INTERSECTION);
5012         else {
5013                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5014                            NL80211_REGDOM_TYPE_COUNTRY);
5015                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
5016         }
5017
5018         if (wiphy_idx_valid(request->wiphy_idx))
5019                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
5020
5021         if (genlmsg_end(msg, hdr) < 0) {
5022                 nlmsg_free(msg);
5023                 return;
5024         }
5025
5026         rcu_read_lock();
5027         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
5028                                 GFP_ATOMIC);
5029         rcu_read_unlock();
5030
5031         return;
5032
5033 nla_put_failure:
5034         genlmsg_cancel(msg, hdr);
5035         nlmsg_free(msg);
5036 }
5037
5038 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
5039                                     struct net_device *netdev,
5040                                     const u8 *buf, size_t len,
5041                                     enum nl80211_commands cmd, gfp_t gfp)
5042 {
5043         struct sk_buff *msg;
5044         void *hdr;
5045
5046         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5047         if (!msg)
5048                 return;
5049
5050         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
5051         if (!hdr) {
5052                 nlmsg_free(msg);
5053                 return;
5054         }
5055
5056         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5057         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5058         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
5059
5060         if (genlmsg_end(msg, hdr) < 0) {
5061                 nlmsg_free(msg);
5062                 return;
5063         }
5064
5065         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5066                                 nl80211_mlme_mcgrp.id, gfp);
5067         return;
5068
5069  nla_put_failure:
5070         genlmsg_cancel(msg, hdr);
5071         nlmsg_free(msg);
5072 }
5073
5074 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
5075                           struct net_device *netdev, const u8 *buf,
5076                           size_t len, gfp_t gfp)
5077 {
5078         nl80211_send_mlme_event(rdev, netdev, buf, len,
5079                                 NL80211_CMD_AUTHENTICATE, gfp);
5080 }
5081
5082 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
5083                            struct net_device *netdev, const u8 *buf,
5084                            size_t len, gfp_t gfp)
5085 {
5086         nl80211_send_mlme_event(rdev, netdev, buf, len,
5087                                 NL80211_CMD_ASSOCIATE, gfp);
5088 }
5089
5090 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
5091                          struct net_device *netdev, const u8 *buf,
5092                          size_t len, gfp_t gfp)
5093 {
5094         nl80211_send_mlme_event(rdev, netdev, buf, len,
5095                                 NL80211_CMD_DEAUTHENTICATE, gfp);
5096 }
5097
5098 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
5099                            struct net_device *netdev, const u8 *buf,
5100                            size_t len, gfp_t gfp)
5101 {
5102         nl80211_send_mlme_event(rdev, netdev, buf, len,
5103                                 NL80211_CMD_DISASSOCIATE, gfp);
5104 }
5105
5106 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
5107                                       struct net_device *netdev, int cmd,
5108                                       const u8 *addr, gfp_t gfp)
5109 {
5110         struct sk_buff *msg;
5111         void *hdr;
5112
5113         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5114         if (!msg)
5115                 return;
5116
5117         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
5118         if (!hdr) {
5119                 nlmsg_free(msg);
5120                 return;
5121         }
5122
5123         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5124         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5125         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
5126         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
5127
5128         if (genlmsg_end(msg, hdr) < 0) {
5129                 nlmsg_free(msg);
5130                 return;
5131         }
5132
5133         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5134                                 nl80211_mlme_mcgrp.id, gfp);
5135         return;
5136
5137  nla_put_failure:
5138         genlmsg_cancel(msg, hdr);
5139         nlmsg_free(msg);
5140 }
5141
5142 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
5143                                struct net_device *netdev, const u8 *addr,
5144                                gfp_t gfp)
5145 {
5146         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
5147                                   addr, gfp);
5148 }
5149
5150 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
5151                                 struct net_device *netdev, const u8 *addr,
5152                                 gfp_t gfp)
5153 {
5154         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
5155                                   addr, gfp);
5156 }
5157
5158 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
5159                                  struct net_device *netdev, const u8 *bssid,
5160                                  const u8 *req_ie, size_t req_ie_len,
5161                                  const u8 *resp_ie, size_t resp_ie_len,
5162                                  u16 status, gfp_t gfp)
5163 {
5164         struct sk_buff *msg;
5165         void *hdr;
5166
5167         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5168         if (!msg)
5169                 return;
5170
5171         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
5172         if (!hdr) {
5173                 nlmsg_free(msg);
5174                 return;
5175         }
5176
5177         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5178         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5179         if (bssid)
5180                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5181         NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status);
5182         if (req_ie)
5183                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
5184         if (resp_ie)
5185                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
5186
5187         if (genlmsg_end(msg, hdr) < 0) {
5188                 nlmsg_free(msg);
5189                 return;
5190         }
5191
5192         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5193                                 nl80211_mlme_mcgrp.id, gfp);
5194         return;
5195
5196  nla_put_failure:
5197         genlmsg_cancel(msg, hdr);
5198         nlmsg_free(msg);
5199
5200 }
5201
5202 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
5203                          struct net_device *netdev, const u8 *bssid,
5204                          const u8 *req_ie, size_t req_ie_len,
5205                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
5206 {
5207         struct sk_buff *msg;
5208         void *hdr;
5209
5210         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5211         if (!msg)
5212                 return;
5213
5214         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
5215         if (!hdr) {
5216                 nlmsg_free(msg);
5217                 return;
5218         }
5219
5220         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5221         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5222         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5223         if (req_ie)
5224                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
5225         if (resp_ie)
5226                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
5227
5228         if (genlmsg_end(msg, hdr) < 0) {
5229                 nlmsg_free(msg);
5230                 return;
5231         }
5232
5233         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5234                                 nl80211_mlme_mcgrp.id, gfp);
5235         return;
5236
5237  nla_put_failure:
5238         genlmsg_cancel(msg, hdr);
5239         nlmsg_free(msg);
5240
5241 }
5242
5243 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
5244                                struct net_device *netdev, u16 reason,
5245                                const u8 *ie, size_t ie_len, bool from_ap)
5246 {
5247         struct sk_buff *msg;
5248         void *hdr;
5249
5250         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5251         if (!msg)
5252                 return;
5253
5254         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
5255         if (!hdr) {
5256                 nlmsg_free(msg);
5257                 return;
5258         }
5259
5260         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5261         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5262         if (from_ap && reason)
5263                 NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason);
5264         if (from_ap)
5265                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISCONNECTED_BY_AP);
5266         if (ie)
5267                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len, ie);
5268
5269         if (genlmsg_end(msg, hdr) < 0) {
5270                 nlmsg_free(msg);
5271                 return;
5272         }
5273
5274         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5275                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
5276         return;
5277
5278  nla_put_failure:
5279         genlmsg_cancel(msg, hdr);
5280         nlmsg_free(msg);
5281
5282 }
5283
5284 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
5285                              struct net_device *netdev, const u8 *bssid,
5286                              gfp_t gfp)
5287 {
5288         struct sk_buff *msg;
5289         void *hdr;
5290
5291         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5292         if (!msg)
5293                 return;
5294
5295         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
5296         if (!hdr) {
5297                 nlmsg_free(msg);
5298                 return;
5299         }
5300
5301         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5302         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5303         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5304
5305         if (genlmsg_end(msg, hdr) < 0) {
5306                 nlmsg_free(msg);
5307                 return;
5308         }
5309
5310         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5311                                 nl80211_mlme_mcgrp.id, gfp);
5312         return;
5313
5314  nla_put_failure:
5315         genlmsg_cancel(msg, hdr);
5316         nlmsg_free(msg);
5317 }
5318
5319 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
5320                                  struct net_device *netdev, const u8 *addr,
5321                                  enum nl80211_key_type key_type, int key_id,
5322                                  const u8 *tsc, gfp_t gfp)
5323 {
5324         struct sk_buff *msg;
5325         void *hdr;
5326
5327         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5328         if (!msg)
5329                 return;
5330
5331         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
5332         if (!hdr) {
5333                 nlmsg_free(msg);
5334                 return;
5335         }
5336
5337         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5338         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5339         if (addr)
5340                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
5341         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
5342         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
5343         if (tsc)
5344                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
5345
5346         if (genlmsg_end(msg, hdr) < 0) {
5347                 nlmsg_free(msg);
5348                 return;
5349         }
5350
5351         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5352                                 nl80211_mlme_mcgrp.id, gfp);
5353         return;
5354
5355  nla_put_failure:
5356         genlmsg_cancel(msg, hdr);
5357         nlmsg_free(msg);
5358 }
5359
5360 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
5361                                     struct ieee80211_channel *channel_before,
5362                                     struct ieee80211_channel *channel_after)
5363 {
5364         struct sk_buff *msg;
5365         void *hdr;
5366         struct nlattr *nl_freq;
5367
5368         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
5369         if (!msg)
5370                 return;
5371
5372         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
5373         if (!hdr) {
5374                 nlmsg_free(msg);
5375                 return;
5376         }
5377
5378         /*
5379          * Since we are applying the beacon hint to a wiphy we know its
5380          * wiphy_idx is valid
5381          */
5382         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
5383
5384         /* Before */
5385         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
5386         if (!nl_freq)
5387                 goto nla_put_failure;
5388         if (nl80211_msg_put_channel(msg, channel_before))
5389                 goto nla_put_failure;
5390         nla_nest_end(msg, nl_freq);
5391
5392         /* After */
5393         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
5394         if (!nl_freq)
5395                 goto nla_put_failure;
5396         if (nl80211_msg_put_channel(msg, channel_after))
5397                 goto nla_put_failure;
5398         nla_nest_end(msg, nl_freq);
5399
5400         if (genlmsg_end(msg, hdr) < 0) {
5401                 nlmsg_free(msg);
5402                 return;
5403         }
5404
5405         rcu_read_lock();
5406         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
5407                                 GFP_ATOMIC);
5408         rcu_read_unlock();
5409
5410         return;
5411
5412 nla_put_failure:
5413         genlmsg_cancel(msg, hdr);
5414         nlmsg_free(msg);
5415 }
5416
5417 static void nl80211_send_remain_on_chan_event(
5418         int cmd, struct cfg80211_registered_device *rdev,
5419         struct net_device *netdev, u64 cookie,
5420         struct ieee80211_channel *chan,
5421         enum nl80211_channel_type channel_type,
5422         unsigned int duration, gfp_t gfp)
5423 {
5424         struct sk_buff *msg;
5425         void *hdr;
5426
5427         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5428         if (!msg)
5429                 return;
5430
5431         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
5432         if (!hdr) {
5433                 nlmsg_free(msg);
5434                 return;
5435         }
5436
5437         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5438         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5439         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq);
5440         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, channel_type);
5441         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
5442
5443         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL)
5444                 NLA_PUT_U32(msg, NL80211_ATTR_DURATION, duration);
5445
5446         if (genlmsg_end(msg, hdr) < 0) {
5447                 nlmsg_free(msg);
5448                 return;
5449         }
5450
5451         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5452                                 nl80211_mlme_mcgrp.id, gfp);
5453         return;
5454
5455  nla_put_failure:
5456         genlmsg_cancel(msg, hdr);
5457         nlmsg_free(msg);
5458 }
5459
5460 void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
5461                                     struct net_device *netdev, u64 cookie,
5462                                     struct ieee80211_channel *chan,
5463                                     enum nl80211_channel_type channel_type,
5464                                     unsigned int duration, gfp_t gfp)
5465 {
5466         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
5467                                           rdev, netdev, cookie, chan,
5468                                           channel_type, duration, gfp);
5469 }
5470
5471 void nl80211_send_remain_on_channel_cancel(
5472         struct cfg80211_registered_device *rdev, struct net_device *netdev,
5473         u64 cookie, struct ieee80211_channel *chan,
5474         enum nl80211_channel_type channel_type, gfp_t gfp)
5475 {
5476         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
5477                                           rdev, netdev, cookie, chan,
5478                                           channel_type, 0, gfp);
5479 }
5480
5481 void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
5482                             struct net_device *dev, const u8 *mac_addr,
5483                             struct station_info *sinfo, gfp_t gfp)
5484 {
5485         struct sk_buff *msg;
5486
5487         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5488         if (!msg)
5489                 return;
5490
5491         if (nl80211_send_station(msg, 0, 0, 0, dev, mac_addr, sinfo) < 0) {
5492                 nlmsg_free(msg);
5493                 return;
5494         }
5495
5496         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5497                                 nl80211_mlme_mcgrp.id, gfp);
5498 }
5499
5500 /* initialisation/exit functions */
5501
5502 int nl80211_init(void)
5503 {
5504         int err;
5505
5506         err = genl_register_family_with_ops(&nl80211_fam,
5507                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
5508         if (err)
5509                 return err;
5510
5511         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
5512         if (err)
5513                 goto err_out;
5514
5515         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
5516         if (err)
5517                 goto err_out;
5518
5519         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
5520         if (err)
5521                 goto err_out;
5522
5523         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
5524         if (err)
5525                 goto err_out;
5526
5527 #ifdef CONFIG_NL80211_TESTMODE
5528         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
5529         if (err)
5530                 goto err_out;
5531 #endif
5532
5533         return 0;
5534  err_out:
5535         genl_unregister_family(&nl80211_fam);
5536         return err;
5537 }
5538
5539 void nl80211_exit(void)
5540 {
5541         genl_unregister_family(&nl80211_fam);
5542 }