net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2009  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/list.h>
  11 #include <linux/if_ether.h>
  12 #include <linux/ieee80211.h>
  13 #include <linux/nl80211.h>
  14 #include <linux/rtnetlink.h>
  15 #include <linux/netlink.h>
  16 #include <linux/etherdevice.h>
  17 #include <net/net_namespace.h>
  18 #include <net/genetlink.h>
  19 #include <net/cfg80211.h>
  20 #include <net/sock.h>
  21 #include "core.h"
  22 #include "nl80211.h"
  23 #include "reg.h"
  24
  25 /* the netlink family */
  26 static struct genl_family nl80211_fam = {
  27         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  28         .name = "nl80211",      /* have users key off the name instead */
  29         .hdrsize = 0,           /* no private header */
  30         .version = 1,           /* no particular meaning now */
  31         .maxattr = NL80211_ATTR_MAX,
  32         .netnsok = true,
  33 };
  34
  35 /* internal helper: get rdev and dev */
  36 static int get_rdev_dev_by_info_ifindex(struct genl_info *info,
  37                                        struct cfg80211_registered_device **rdev,
  38                                        struct net_device **dev)
  39 {
  40         struct nlattr **attrs = info->attrs;
  41         int ifindex;
  42
  43         if (!attrs[NL80211_ATTR_IFINDEX])
  44                 return -EINVAL;
  45
  46         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  47         *dev = dev_get_by_index(genl_info_net(info), ifindex);
  48         if (!*dev)
  49                 return -ENODEV;
  50
  51         *rdev = cfg80211_get_dev_from_ifindex(genl_info_net(info), ifindex);
  52         if (IS_ERR(*rdev)) {
  53                 dev_put(*dev);
  54                 return PTR_ERR(*rdev);
  55         }
  56
  57         return 0;
  58 }
  59
  60 /* policy for the attributes */
  61 static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
  62         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  63         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  64                                       .len = 20-1 },
  65         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  66         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  67         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  68         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
  69         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
  70         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
  71         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
  72
  73         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  74         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  75         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  76
  77         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  78         [NL80211_ATTR_PREV_BSSID] = { .type = NLA_BINARY, .len = ETH_ALEN },
  79
  80         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
  81         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  82                                     .len = WLAN_MAX_KEY_LEN },
  83         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  84         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  85         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
  86         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
  87
  88         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
  89         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
  90         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
  91                                        .len = IEEE80211_MAX_DATA_LEN },
  92         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
  93                                        .len = IEEE80211_MAX_DATA_LEN },
  94         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
  95         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
  96         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
  97         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
  98                                                .len = NL80211_MAX_SUPP_RATES },
  99         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 100         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 101         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 102         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 103                                 .len = IEEE80211_MAX_MESH_ID_LEN },
 104         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 105
 106         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 107         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 108
 109         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 110         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 111         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 112         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 113                                            .len = NL80211_MAX_SUPP_RATES },
 114
 115         [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
 116
 117         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 118                                          .len = NL80211_HT_CAPABILITY_LEN },
 119
 120         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 121         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 122                               .len = IEEE80211_MAX_DATA_LEN },
 123         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 124         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 125
 126         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 127                                 .len = IEEE80211_MAX_SSID_LEN },
 128         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 129         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 130         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 131         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 132         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 133         [NL80211_ATTR_STA_FLAGS2] = {
 134                 .len = sizeof(struct nl80211_sta_flag_update),
 135         },
 136         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 137         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 138         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 139         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 140         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 141         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 142         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 143                                  .len = WLAN_PMKID_LEN },
 144 };
 145
 146 /* policy for the attributes */
 147 static struct nla_policy
 148 nl80211_key_policy[NL80211_KEY_MAX + 1] __read_mostly = {
 149         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 150         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 151         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 152         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
 153         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 154         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 155 };
 156
 157 /* ifidx get helper */
 158 static int nl80211_get_ifidx(struct netlink_callback *cb)
 159 {
 160         int res;
 161
 162         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 163                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
 164                           nl80211_policy);
 165         if (res)
 166                 return res;
 167
 168         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 169                 return -EINVAL;
 170
 171         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 172         if (!res)
 173                 return -EINVAL;
 174         return res;
 175 }
 176
 177 /* IE validation */
 178 static bool is_valid_ie_attr(const struct nlattr *attr)
 179 {
 180         const u8 *pos;
 181         int len;
 182
 183         if (!attr)
 184                 return true;
 185
 186         pos = nla_data(attr);
 187         len = nla_len(attr);
 188
 189         while (len) {
 190                 u8 elemlen;
 191
 192                 if (len < 2)
 193                         return false;
 194                 len -= 2;
 195
 196                 elemlen = pos[1];
 197                 if (elemlen > len)
 198                         return false;
 199
 200                 len -= elemlen;
 201                 pos += 2 + elemlen;
 202         }
 203
 204         return true;
 205 }
 206
 207 /* message building helper */
 208 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 209                                    int flags, u8 cmd)
 210 {
 211         /* since there is no private header just add the generic one */
 212         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 213 }
 214
 215 static int nl80211_msg_put_channel(struct sk_buff *msg,
 216                                    struct ieee80211_channel *chan)
 217 {
 218         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 219                     chan->center_freq);
 220
 221         if (chan->flags & IEEE80211_CHAN_DISABLED)
 222                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 223         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 224                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 225         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 226                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 227         if (chan->flags & IEEE80211_CHAN_RADAR)
 228                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 229
 230         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 231                     DBM_TO_MBM(chan->max_power));
 232
 233         return 0;
 234
 235  nla_put_failure:
 236         return -ENOBUFS;
 237 }
 238
 239 /* netlink command implementations */
 240
 241 struct key_parse {
 242         struct key_params p;
 243         int idx;
 244         bool def, defmgmt;
 245 };
 246
 247 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 248 {
 249         struct nlattr *tb[NL80211_KEY_MAX + 1];
 250         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 251                                    nl80211_key_policy);
 252         if (err)
 253                 return err;
 254
 255         k->def = !!tb[NL80211_KEY_DEFAULT];
 256         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 257
 258         if (tb[NL80211_KEY_IDX])
 259                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 260
 261         if (tb[NL80211_KEY_DATA]) {
 262                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 263                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 264         }
 265
 266         if (tb[NL80211_KEY_SEQ]) {
 267                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 268                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 269         }
 270
 271         if (tb[NL80211_KEY_CIPHER])
 272                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 273
 274         return 0;
 275 }
 276
 277 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 278 {
 279         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 280                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 281                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 282         }
 283
 284         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 285                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 286                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 287         }
 288
 289         if (info->attrs[NL80211_ATTR_KEY_IDX])
 290                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 291
 292         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 293                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 294
 295         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 296         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 297
 298         return 0;
 299 }
 300
 301 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 302 {
 303         int err;
 304
 305         memset(k, 0, sizeof(*k));
 306         k->idx = -1;
 307
 308         if (info->attrs[NL80211_ATTR_KEY])
 309                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 310         else
 311                 err = nl80211_parse_key_old(info, k);
 312
 313         if (err)
 314                 return err;
 315
 316         if (k->def && k->defmgmt)
 317                 return -EINVAL;
 318
 319         if (k->idx != -1) {
 320                 if (k->defmgmt) {
 321                         if (k->idx < 4 || k->idx > 5)
 322                                 return -EINVAL;
 323                 } else if (k->def) {
 324                         if (k->idx < 0 || k->idx > 3)
 325                                 return -EINVAL;
 326                 } else {
 327                         if (k->idx < 0 || k->idx > 5)
 328                                 return -EINVAL;
 329                 }
 330         }
 331
 332         return 0;
 333 }
 334
 335 static struct cfg80211_cached_keys *
 336 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 337                        struct nlattr *keys)
 338 {
 339         struct key_parse parse;
 340         struct nlattr *key;
 341         struct cfg80211_cached_keys *result;
 342         int rem, err, def = 0;
 343
 344         result = kzalloc(sizeof(*result), GFP_KERNEL);
 345         if (!result)
 346                 return ERR_PTR(-ENOMEM);
 347
 348         result->def = -1;
 349         result->defmgmt = -1;
 350
 351         nla_for_each_nested(key, keys, rem) {
 352                 memset(&parse, 0, sizeof(parse));
 353                 parse.idx = -1;
 354
 355                 err = nl80211_parse_key_new(key, &parse);
 356                 if (err)
 357                         goto error;
 358                 err = -EINVAL;
 359                 if (!parse.p.key)
 360                         goto error;
 361                 if (parse.idx < 0 || parse.idx > 4)
 362                         goto error;
 363                 if (parse.def) {
 364                         if (def)
 365                                 goto error;
 366                         def = 1;
 367                         result->def = parse.idx;
 368                 } else if (parse.defmgmt)
 369                         goto error;
 370                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 371                                                      parse.idx, NULL);
 372                 if (err)
 373                         goto error;
 374                 result->params[parse.idx].cipher = parse.p.cipher;
 375                 result->params[parse.idx].key_len = parse.p.key_len;
 376                 result->params[parse.idx].key = result->data[parse.idx];
 377                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 378         }
 379
 380         return result;
 381  error:
 382         kfree(result);
 383         return ERR_PTR(err);
 384 }
 385
 386 static int nl80211_key_allowed(struct wireless_dev *wdev)
 387 {
 388         ASSERT_WDEV_LOCK(wdev);
 389
 390         if (!netif_running(wdev->netdev))
 391                 return -ENETDOWN;
 392
 393         switch (wdev->iftype) {
 394         case NL80211_IFTYPE_AP:
 395         case NL80211_IFTYPE_AP_VLAN:
 396                 break;
 397         case NL80211_IFTYPE_ADHOC:
 398                 if (!wdev->current_bss)
 399                         return -ENOLINK;
 400                 break;
 401         case NL80211_IFTYPE_STATION:
 402                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 403                         return -ENOLINK;
 404                 break;
 405         default:
 406                 return -EINVAL;
 407         }
 408
 409         return 0;
 410 }
 411
 412 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 413                               struct cfg80211_registered_device *dev)
 414 {
 415         void *hdr;
 416         struct nlattr *nl_bands, *nl_band;
 417         struct nlattr *nl_freqs, *nl_freq;
 418         struct nlattr *nl_rates, *nl_rate;
 419         struct nlattr *nl_modes;
 420         struct nlattr *nl_cmds;
 421         enum ieee80211_band band;
 422         struct ieee80211_channel *chan;
 423         struct ieee80211_rate *rate;
 424         int i;
 425         u16 ifmodes = dev->wiphy.interface_modes;
 426
 427         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 428         if (!hdr)
 429                 return -1;
 430
 431         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 432         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 433
 434         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
 435                     cfg80211_rdev_list_generation);
 436
 437         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 438                    dev->wiphy.retry_short);
 439         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 440                    dev->wiphy.retry_long);
 441         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 442                     dev->wiphy.frag_threshold);
 443         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 444                     dev->wiphy.rts_threshold);
 445
 446         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 447                    dev->wiphy.max_scan_ssids);
 448         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 449                     dev->wiphy.max_scan_ie_len);
 450
 451         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
 452                 sizeof(u32) * dev->wiphy.n_cipher_suites,
 453                 dev->wiphy.cipher_suites);
 454
 455         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
 456                    dev->wiphy.max_num_pmkids);
 457
 458         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
 459         if (!nl_modes)
 460                 goto nla_put_failure;
 461
 462         i = 0;
 463         while (ifmodes) {
 464                 if (ifmodes & 1)
 465                         NLA_PUT_FLAG(msg, i);
 466                 ifmodes >>= 1;
 467                 i++;
 468         }
 469
 470         nla_nest_end(msg, nl_modes);
 471
 472         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 473         if (!nl_bands)
 474                 goto nla_put_failure;
 475
 476         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 477                 if (!dev->wiphy.bands[band])
 478                         continue;
 479
 480                 nl_band = nla_nest_start(msg, band);
 481                 if (!nl_band)
 482                         goto nla_put_failure;
 483
 484                 /* add HT info */
 485                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 486                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 487                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 488                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 489                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 490                                 dev->wiphy.bands[band]->ht_cap.cap);
 491                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 492                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 493                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 494                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 495                 }
 496
 497                 /* add frequencies */
 498                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 499                 if (!nl_freqs)
 500                         goto nla_put_failure;
 501
 502                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 503                         nl_freq = nla_nest_start(msg, i);
 504                         if (!nl_freq)
 505                                 goto nla_put_failure;
 506
 507                         chan = &dev->wiphy.bands[band]->channels[i];
 508
 509                         if (nl80211_msg_put_channel(msg, chan))
 510                                 goto nla_put_failure;
 511
 512                         nla_nest_end(msg, nl_freq);
 513                 }
 514
 515                 nla_nest_end(msg, nl_freqs);
 516
 517                 /* add bitrates */
 518                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 519                 if (!nl_rates)
 520                         goto nla_put_failure;
 521
 522                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 523                         nl_rate = nla_nest_start(msg, i);
 524                         if (!nl_rate)
 525                                 goto nla_put_failure;
 526
 527                         rate = &dev->wiphy.bands[band]->bitrates[i];
 528                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 529                                     rate->bitrate);
 530                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 531                                 NLA_PUT_FLAG(msg,
 532                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 533
 534                         nla_nest_end(msg, nl_rate);
 535                 }
 536
 537                 nla_nest_end(msg, nl_rates);
 538
 539                 nla_nest_end(msg, nl_band);
 540         }
 541         nla_nest_end(msg, nl_bands);
 542
 543         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 544         if (!nl_cmds)
 545                 goto nla_put_failure;
 546
 547         i = 0;
 548 #define CMD(op, n)                                              \
 549          do {                                                   \
 550                 if (dev->ops->op) {                             \
 551                         i++;                                    \
 552                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 553                 }                                               \
 554         } while (0)
 555
 556         CMD(add_virtual_intf, NEW_INTERFACE);
 557         CMD(change_virtual_intf, SET_INTERFACE);
 558         CMD(add_key, NEW_KEY);
 559         CMD(add_beacon, NEW_BEACON);
 560         CMD(add_station, NEW_STATION);
 561         CMD(add_mpath, NEW_MPATH);
 562         CMD(set_mesh_params, SET_MESH_PARAMS);
 563         CMD(change_bss, SET_BSS);
 564         CMD(auth, AUTHENTICATE);
 565         CMD(assoc, ASSOCIATE);
 566         CMD(deauth, DEAUTHENTICATE);
 567         CMD(disassoc, DISASSOCIATE);
 568         CMD(join_ibss, JOIN_IBSS);
 569         CMD(set_pmksa, SET_PMKSA);
 570         CMD(del_pmksa, DEL_PMKSA);
 571         CMD(flush_pmksa, FLUSH_PMKSA);
 572         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
 573                 i++;
 574                 NLA_PUT_U32(msg, i, NL80211_CMD_SET_WIPHY_NETNS);
 575         }
 576
 577 #undef CMD
 578
 579         if (dev->ops->connect || dev->ops->auth) {
 580                 i++;
 581                 NLA_PUT_U32(msg, i, NL80211_CMD_CONNECT);
 582         }
 583
 584         if (dev->ops->disconnect || dev->ops->deauth) {
 585                 i++;
 586                 NLA_PUT_U32(msg, i, NL80211_CMD_DISCONNECT);
 587         }
 588
 589         nla_nest_end(msg, nl_cmds);
 590
 591         return genlmsg_end(msg, hdr);
 592
 593  nla_put_failure:
 594         genlmsg_cancel(msg, hdr);
 595         return -EMSGSIZE;
 596 }
 597
 598 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 599 {
 600         int idx = 0;
 601         int start = cb->args[0];
 602         struct cfg80211_registered_device *dev;
 603
 604         mutex_lock(&cfg80211_mutex);
 605         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
 606                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
 607                         continue;
 608                 if (++idx <= start)
 609                         continue;
 610                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
 611                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
 612                                        dev) < 0) {
 613                         idx--;
 614                         break;
 615                 }
 616         }
 617         mutex_unlock(&cfg80211_mutex);
 618
 619         cb->args[0] = idx;
 620
 621         return skb->len;
 622 }
 623
 624 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 625 {
 626         struct sk_buff *msg;
 627         struct cfg80211_registered_device *dev;
 628
 629         dev = cfg80211_get_dev_from_info(info);
 630         if (IS_ERR(dev))
 631                 return PTR_ERR(dev);
 632
 633         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 634         if (!msg)
 635                 goto out_err;
 636
 637         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
 638                 goto out_free;
 639
 640         cfg80211_unlock_rdev(dev);
 641
 642         return genlmsg_reply(msg, info);
 643
 644  out_free:
 645         nlmsg_free(msg);
 646  out_err:
 647         cfg80211_unlock_rdev(dev);
 648         return -ENOBUFS;
 649 }
 650
 651 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 652         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
 653         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
 654         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
 655         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
 656         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
 657 };
 658
 659 static int parse_txq_params(struct nlattr *tb[],
 660                             struct ieee80211_txq_params *txq_params)
 661 {
 662         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 663             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 664             !tb[NL80211_TXQ_ATTR_AIFS])
 665                 return -EINVAL;
 666
 667         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
 668         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 669         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 670         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 671         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 672
 673         return 0;
 674 }
 675
 676 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 677 {
 678         struct cfg80211_registered_device *rdev;
 679         int result = 0, rem_txq_params = 0;
 680         struct nlattr *nl_txq_params;
 681         u32 changed;
 682         u8 retry_short = 0, retry_long = 0;
 683         u32 frag_threshold = 0, rts_threshold = 0;
 684
 685         rtnl_lock();
 686
 687         mutex_lock(&cfg80211_mutex);
 688
 689         rdev = __cfg80211_rdev_from_info(info);
 690         if (IS_ERR(rdev)) {
 691                 mutex_unlock(&cfg80211_mutex);
 692                 result = PTR_ERR(rdev);
 693                 goto unlock;
 694         }
 695
 696         mutex_lock(&rdev->mtx);
 697
 698         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
 699                 result = cfg80211_dev_rename(
 700                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 701
 702         mutex_unlock(&cfg80211_mutex);
 703
 704         if (result)
 705                 goto bad_res;
 706
 707         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
 708                 struct ieee80211_txq_params txq_params;
 709                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
 710
 711                 if (!rdev->ops->set_txq_params) {
 712                         result = -EOPNOTSUPP;
 713                         goto bad_res;
 714                 }
 715
 716                 nla_for_each_nested(nl_txq_params,
 717                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
 718                                     rem_txq_params) {
 719                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
 720                                   nla_data(nl_txq_params),
 721                                   nla_len(nl_txq_params),
 722                                   txq_params_policy);
 723                         result = parse_txq_params(tb, &txq_params);
 724                         if (result)
 725                                 goto bad_res;
 726
 727                         result = rdev->ops->set_txq_params(&rdev->wiphy,
 728                                                            &txq_params);
 729                         if (result)
 730                                 goto bad_res;
 731                 }
 732         }
 733
 734         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
 735                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 736                 u32 freq;
 737
 738                 result = -EINVAL;
 739
 740                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 741                         channel_type = nla_get_u32(info->attrs[
 742                                            NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 743                         if (channel_type != NL80211_CHAN_NO_HT &&
 744                             channel_type != NL80211_CHAN_HT20 &&
 745                             channel_type != NL80211_CHAN_HT40PLUS &&
 746                             channel_type != NL80211_CHAN_HT40MINUS)
 747                                 goto bad_res;
 748                 }
 749
 750                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 751
 752                 mutex_lock(&rdev->devlist_mtx);
 753                 result = rdev_set_freq(rdev, NULL, freq, channel_type);
 754                 mutex_unlock(&rdev->devlist_mtx);
 755                 if (result)
 756                         goto bad_res;
 757         }
 758
 759         changed = 0;
 760
 761         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
 762                 retry_short = nla_get_u8(
 763                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
 764                 if (retry_short == 0) {
 765                         result = -EINVAL;
 766                         goto bad_res;
 767                 }
 768                 changed |= WIPHY_PARAM_RETRY_SHORT;
 769         }
 770
 771         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
 772                 retry_long = nla_get_u8(
 773                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
 774                 if (retry_long == 0) {
 775                         result = -EINVAL;
 776                         goto bad_res;
 777                 }
 778                 changed |= WIPHY_PARAM_RETRY_LONG;
 779         }
 780
 781         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
 782                 frag_threshold = nla_get_u32(
 783                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
 784                 if (frag_threshold < 256) {
 785                         result = -EINVAL;
 786                         goto bad_res;
 787                 }
 788                 if (frag_threshold != (u32) -1) {
 789                         /*
 790                          * Fragments (apart from the last one) are required to
 791                          * have even length. Make the fragmentation code
 792                          * simpler by stripping LSB should someone try to use
 793                          * odd threshold value.
 794                          */
 795                         frag_threshold &= ~0x1;
 796                 }
 797                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
 798         }
 799
 800         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
 801                 rts_threshold = nla_get_u32(
 802                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
 803                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
 804         }
 805
 806         if (changed) {
 807                 u8 old_retry_short, old_retry_long;
 808                 u32 old_frag_threshold, old_rts_threshold;
 809
 810                 if (!rdev->ops->set_wiphy_params) {
 811                         result = -EOPNOTSUPP;
 812                         goto bad_res;
 813                 }
 814
 815                 old_retry_short = rdev->wiphy.retry_short;
 816                 old_retry_long = rdev->wiphy.retry_long;
 817                 old_frag_threshold = rdev->wiphy.frag_threshold;
 818                 old_rts_threshold = rdev->wiphy.rts_threshold;
 819
 820                 if (changed & WIPHY_PARAM_RETRY_SHORT)
 821                         rdev->wiphy.retry_short = retry_short;
 822                 if (changed & WIPHY_PARAM_RETRY_LONG)
 823                         rdev->wiphy.retry_long = retry_long;
 824                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
 825                         rdev->wiphy.frag_threshold = frag_threshold;
 826                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
 827                         rdev->wiphy.rts_threshold = rts_threshold;
 828
 829                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
 830                 if (result) {
 831                         rdev->wiphy.retry_short = old_retry_short;
 832                         rdev->wiphy.retry_long = old_retry_long;
 833                         rdev->wiphy.frag_threshold = old_frag_threshold;
 834                         rdev->wiphy.rts_threshold = old_rts_threshold;
 835                 }
 836         }
 837
 838  bad_res:
 839         mutex_unlock(&rdev->mtx);
 840  unlock:
 841         rtnl_unlock();
 842         return result;
 843 }
 844
 845
 846 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 847                               struct cfg80211_registered_device *rdev,
 848                               struct net_device *dev)
 849 {
 850         void *hdr;
 851
 852         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
 853         if (!hdr)
 854                 return -1;
 855
 856         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 857         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 858         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
 859         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
 860
 861         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
 862                     rdev->devlist_generation ^
 863                         (cfg80211_rdev_list_generation << 2));
 864
 865         return genlmsg_end(msg, hdr);
 866
 867  nla_put_failure:
 868         genlmsg_cancel(msg, hdr);
 869         return -EMSGSIZE;
 870 }
 871
 872 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
 873 {
 874         int wp_idx = 0;
 875         int if_idx = 0;
 876         int wp_start = cb->args[0];
 877         int if_start = cb->args[1];
 878         struct cfg80211_registered_device *rdev;
 879         struct wireless_dev *wdev;
 880
 881         mutex_lock(&cfg80211_mutex);
 882         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
 883                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
 884                         continue;
 885                 if (wp_idx < wp_start) {
 886                         wp_idx++;
 887                         continue;
 888                 }
 889                 if_idx = 0;
 890
 891                 mutex_lock(&rdev->devlist_mtx);
 892                 list_for_each_entry(wdev, &rdev->netdev_list, list) {
 893                         if (if_idx < if_start) {
 894                                 if_idx++;
 895                                 continue;
 896                         }
 897                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
 898                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
 899                                                rdev, wdev->netdev) < 0) {
 900                                 mutex_unlock(&rdev->devlist_mtx);
 901                                 goto out;
 902                         }
 903                         if_idx++;
 904                 }
 905                 mutex_unlock(&rdev->devlist_mtx);
 906
 907                 wp_idx++;
 908         }
 909  out:
 910         mutex_unlock(&cfg80211_mutex);
 911
 912         cb->args[0] = wp_idx;
 913         cb->args[1] = if_idx;
 914
 915         return skb->len;
 916 }
 917
 918 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
 919 {
 920         struct sk_buff *msg;
 921         struct cfg80211_registered_device *dev;
 922         struct net_device *netdev;
 923         int err;
 924
 925         err = get_rdev_dev_by_info_ifindex(info, &dev, &netdev);
 926         if (err)
 927                 return err;
 928
 929         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 930         if (!msg)
 931                 goto out_err;
 932
 933         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
 934                                dev, netdev) < 0)
 935                 goto out_free;
 936
 937         dev_put(netdev);
 938         cfg80211_unlock_rdev(dev);
 939
 940         return genlmsg_reply(msg, info);
 941
 942  out_free:
 943         nlmsg_free(msg);
 944  out_err:
 945         dev_put(netdev);
 946         cfg80211_unlock_rdev(dev);
 947         return -ENOBUFS;
 948 }
 949
 950 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
 951         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
 952         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
 953         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
 954         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
 955         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
 956 };
 957
 958 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
 959 {
 960         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
 961         int flag;
 962
 963         *mntrflags = 0;
 964
 965         if (!nla)
 966                 return -EINVAL;
 967
 968         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
 969                              nla, mntr_flags_policy))
 970                 return -EINVAL;
 971
 972         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
 973                 if (flags[flag])
 974                         *mntrflags |= (1<<flag);
 975
 976         return 0;
 977 }
 978
 979 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
 980                                struct net_device *netdev, u8 use_4addr,
 981                                enum nl80211_iftype iftype)
 982 {
 983         if (!use_4addr) {
 984                 if (netdev && netdev->br_port)
 985                         return -EBUSY;
 986                 return 0;
 987         }
 988
 989         switch (iftype) {
 990         case NL80211_IFTYPE_AP_VLAN:
 991                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
 992                         return 0;
 993                 break;
 994         case NL80211_IFTYPE_STATION:
 995                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
 996                         return 0;
 997                 break;
 998         default:
 999                 break;
1000         }
1001
1002         return -EOPNOTSUPP;
1003 }
1004
1005 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
1006 {
1007         struct cfg80211_registered_device *rdev;
1008         struct vif_params params;
1009         int err;
1010         enum nl80211_iftype otype, ntype;
1011         struct net_device *dev;
1012         u32 _flags, *flags = NULL;
1013         bool change = false;
1014
1015         memset(&params, 0, sizeof(params));
1016
1017         rtnl_lock();
1018
1019         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1020         if (err)
1021                 goto unlock_rtnl;
1022
1023         otype = ntype = dev->ieee80211_ptr->iftype;
1024
1025         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1026                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1027                 if (otype != ntype)
1028                         change = true;
1029                 if (ntype > NL80211_IFTYPE_MAX) {
1030                         err = -EINVAL;
1031                         goto unlock;
1032                 }
1033         }
1034
1035         if (info->attrs[NL80211_ATTR_MESH_ID]) {
1036                 if (ntype != NL80211_IFTYPE_MESH_POINT) {
1037                         err = -EINVAL;
1038                         goto unlock;
1039                 }
1040                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
1041                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1042                 change = true;
1043         }
1044
1045         if (info->attrs[NL80211_ATTR_4ADDR]) {
1046                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1047                 change = true;
1048                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
1049                 if (err)
1050                         goto unlock;
1051         } else {
1052                 params.use_4addr = -1;
1053         }
1054
1055         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
1056                 if (ntype != NL80211_IFTYPE_MONITOR) {
1057                         err = -EINVAL;
1058                         goto unlock;
1059                 }
1060                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
1061                                           &_flags);
1062                 if (err)
1063                         goto unlock;
1064
1065                 flags = &_flags;
1066                 change = true;
1067         }
1068
1069         if (change)
1070                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
1071         else
1072                 err = 0;
1073
1074         if (!err && params.use_4addr != -1)
1075                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
1076
1077  unlock:
1078         dev_put(dev);
1079         cfg80211_unlock_rdev(rdev);
1080  unlock_rtnl:
1081         rtnl_unlock();
1082         return err;
1083 }
1084
1085 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
1086 {
1087         struct cfg80211_registered_device *rdev;
1088         struct vif_params params;
1089         int err;
1090         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
1091         u32 flags;
1092
1093         memset(&params, 0, sizeof(params));
1094
1095         if (!info->attrs[NL80211_ATTR_IFNAME])
1096                 return -EINVAL;
1097
1098         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1099                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1100                 if (type > NL80211_IFTYPE_MAX)
1101                         return -EINVAL;
1102         }
1103
1104         rtnl_lock();
1105
1106         rdev = cfg80211_get_dev_from_info(info);
1107         if (IS_ERR(rdev)) {
1108                 err = PTR_ERR(rdev);
1109                 goto unlock_rtnl;
1110         }
1111
1112         if (!rdev->ops->add_virtual_intf ||
1113             !(rdev->wiphy.interface_modes & (1 << type))) {
1114                 err = -EOPNOTSUPP;
1115                 goto unlock;
1116         }
1117
1118         if (type == NL80211_IFTYPE_MESH_POINT &&
1119             info->attrs[NL80211_ATTR_MESH_ID]) {
1120                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
1121                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1122         }
1123
1124         if (info->attrs[NL80211_ATTR_4ADDR]) {
1125                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1126                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
1127                 if (err)
1128                         goto unlock;
1129         }
1130
1131         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
1132                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
1133                                   &flags);
1134         err = rdev->ops->add_virtual_intf(&rdev->wiphy,
1135                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
1136                 type, err ? NULL : &flags, &params);
1137
1138  unlock:
1139         cfg80211_unlock_rdev(rdev);
1140  unlock_rtnl:
1141         rtnl_unlock();
1142         return err;
1143 }
1144
1145 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
1146 {
1147         struct cfg80211_registered_device *rdev;
1148         int err;
1149         struct net_device *dev;
1150
1151         rtnl_lock();
1152
1153         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1154         if (err)
1155                 goto unlock_rtnl;
1156
1157         if (!rdev->ops->del_virtual_intf) {
1158                 err = -EOPNOTSUPP;
1159                 goto out;
1160         }
1161
1162         err = rdev->ops->del_virtual_intf(&rdev->wiphy, dev);
1163
1164  out:
1165         cfg80211_unlock_rdev(rdev);
1166         dev_put(dev);
1167  unlock_rtnl:
1168         rtnl_unlock();
1169         return err;
1170 }
1171
1172 struct get_key_cookie {
1173         struct sk_buff *msg;
1174         int error;
1175         int idx;
1176 };
1177
1178 static void get_key_callback(void *c, struct key_params *params)
1179 {
1180         struct nlattr *key;
1181         struct get_key_cookie *cookie = c;
1182
1183         if (params->key)
1184                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
1185                         params->key_len, params->key);
1186
1187         if (params->seq)
1188                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
1189                         params->seq_len, params->seq);
1190
1191         if (params->cipher)
1192                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
1193                             params->cipher);
1194
1195         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
1196         if (!key)
1197                 goto nla_put_failure;
1198
1199         if (params->key)
1200                 NLA_PUT(cookie->msg, NL80211_KEY_DATA,
1201                         params->key_len, params->key);
1202
1203         if (params->seq)
1204                 NLA_PUT(cookie->msg, NL80211_KEY_SEQ,
1205                         params->seq_len, params->seq);
1206
1207         if (params->cipher)
1208                 NLA_PUT_U32(cookie->msg, NL80211_KEY_CIPHER,
1209                             params->cipher);
1210
1211         NLA_PUT_U8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx);
1212
1213         nla_nest_end(cookie->msg, key);
1214
1215         return;
1216  nla_put_failure:
1217         cookie->error = 1;
1218 }
1219
1220 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
1221 {
1222         struct cfg80211_registered_device *rdev;
1223         int err;
1224         struct net_device *dev;
1225         u8 key_idx = 0;
1226         u8 *mac_addr = NULL;
1227         struct get_key_cookie cookie = {
1228                 .error = 0,
1229         };
1230         void *hdr;
1231         struct sk_buff *msg;
1232
1233         if (info->attrs[NL80211_ATTR_KEY_IDX])
1234                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1235
1236         if (key_idx > 5)
1237                 return -EINVAL;
1238
1239         if (info->attrs[NL80211_ATTR_MAC])
1240                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1241
1242         rtnl_lock();
1243
1244         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1245         if (err)
1246                 goto unlock_rtnl;
1247
1248         if (!rdev->ops->get_key) {
1249                 err = -EOPNOTSUPP;
1250                 goto out;
1251         }
1252
1253         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1254         if (!msg) {
1255                 err = -ENOMEM;
1256                 goto out;
1257         }
1258
1259         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
1260                              NL80211_CMD_NEW_KEY);
1261
1262         if (IS_ERR(hdr)) {
1263                 err = PTR_ERR(hdr);
1264                 goto free_msg;
1265         }
1266
1267         cookie.msg = msg;
1268         cookie.idx = key_idx;
1269
1270         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1271         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1272         if (mac_addr)
1273                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1274
1275         err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, mac_addr,
1276                                 &cookie, get_key_callback);
1277
1278         if (err)
1279                 goto free_msg;
1280
1281         if (cookie.error)
1282                 goto nla_put_failure;
1283
1284         genlmsg_end(msg, hdr);
1285         err = genlmsg_reply(msg, info);
1286         goto out;
1287
1288  nla_put_failure:
1289         err = -ENOBUFS;
1290  free_msg:
1291         nlmsg_free(msg);
1292  out:
1293         cfg80211_unlock_rdev(rdev);
1294         dev_put(dev);
1295  unlock_rtnl:
1296         rtnl_unlock();
1297
1298         return err;
1299 }
1300
1301 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1302 {
1303         struct cfg80211_registered_device *rdev;
1304         struct key_parse key;
1305         int err;
1306         struct net_device *dev;
1307         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
1308                     u8 key_index);
1309
1310         err = nl80211_parse_key(info, &key);
1311         if (err)
1312                 return err;
1313
1314         if (key.idx < 0)
1315                 return -EINVAL;
1316
1317         /* only support setting default key */
1318         if (!key.def && !key.defmgmt)
1319                 return -EINVAL;
1320
1321         rtnl_lock();
1322
1323         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1324         if (err)
1325                 goto unlock_rtnl;
1326
1327         if (key.def)
1328                 func = rdev->ops->set_default_key;
1329         else
1330                 func = rdev->ops->set_default_mgmt_key;
1331
1332         if (!func) {
1333                 err = -EOPNOTSUPP;
1334                 goto out;
1335         }
1336
1337         wdev_lock(dev->ieee80211_ptr);
1338         err = nl80211_key_allowed(dev->ieee80211_ptr);
1339         if (!err)
1340                 err = func(&rdev->wiphy, dev, key.idx);
1341
1342 #ifdef CONFIG_CFG80211_WEXT
1343         if (!err) {
1344                 if (func == rdev->ops->set_default_key)
1345                         dev->ieee80211_ptr->wext.default_key = key.idx;
1346                 else
1347                         dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
1348         }
1349 #endif
1350         wdev_unlock(dev->ieee80211_ptr);
1351
1352  out:
1353         cfg80211_unlock_rdev(rdev);
1354         dev_put(dev);
1355
1356  unlock_rtnl:
1357         rtnl_unlock();
1358
1359         return err;
1360 }
1361
1362 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1363 {
1364         struct cfg80211_registered_device *rdev;
1365         int err;
1366         struct net_device *dev;
1367         struct key_parse key;
1368         u8 *mac_addr = NULL;
1369
1370         err = nl80211_parse_key(info, &key);
1371         if (err)
1372                 return err;
1373
1374         if (!key.p.key)
1375                 return -EINVAL;
1376
1377         if (info->attrs[NL80211_ATTR_MAC])
1378                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1379
1380         rtnl_lock();
1381
1382         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1383         if (err)
1384                 goto unlock_rtnl;
1385
1386         if (!rdev->ops->add_key) {
1387                 err = -EOPNOTSUPP;
1388                 goto out;
1389         }
1390
1391         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx, mac_addr)) {
1392                 err = -EINVAL;
1393                 goto out;
1394         }
1395
1396         wdev_lock(dev->ieee80211_ptr);
1397         err = nl80211_key_allowed(dev->ieee80211_ptr);
1398         if (!err)
1399                 err = rdev->ops->add_key(&rdev->wiphy, dev, key.idx,
1400                                          mac_addr, &key.p);
1401         wdev_unlock(dev->ieee80211_ptr);
1402
1403  out:
1404         cfg80211_unlock_rdev(rdev);
1405         dev_put(dev);
1406  unlock_rtnl:
1407         rtnl_unlock();
1408
1409         return err;
1410 }
1411
1412 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1413 {
1414         struct cfg80211_registered_device *rdev;
1415         int err;
1416         struct net_device *dev;
1417         u8 *mac_addr = NULL;
1418         struct key_parse key;
1419
1420         err = nl80211_parse_key(info, &key);
1421         if (err)
1422                 return err;
1423
1424         if (info->attrs[NL80211_ATTR_MAC])
1425                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1426
1427         rtnl_lock();
1428
1429         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1430         if (err)
1431                 goto unlock_rtnl;
1432
1433         if (!rdev->ops->del_key) {
1434                 err = -EOPNOTSUPP;
1435                 goto out;
1436         }
1437
1438         wdev_lock(dev->ieee80211_ptr);
1439         err = nl80211_key_allowed(dev->ieee80211_ptr);
1440         if (!err)
1441                 err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx, mac_addr);
1442
1443 #ifdef CONFIG_CFG80211_WEXT
1444         if (!err) {
1445                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
1446                         dev->ieee80211_ptr->wext.default_key = -1;
1447                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
1448                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
1449         }
1450 #endif
1451         wdev_unlock(dev->ieee80211_ptr);
1452
1453  out:
1454         cfg80211_unlock_rdev(rdev);
1455         dev_put(dev);
1456
1457  unlock_rtnl:
1458         rtnl_unlock();
1459
1460         return err;
1461 }
1462
1463 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1464 {
1465         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1466                     struct beacon_parameters *info);
1467         struct cfg80211_registered_device *rdev;
1468         int err;
1469         struct net_device *dev;
1470         struct beacon_parameters params;
1471         int haveinfo = 0;
1472
1473         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
1474                 return -EINVAL;
1475
1476         rtnl_lock();
1477
1478         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1479         if (err)
1480                 goto unlock_rtnl;
1481
1482         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1483                 err = -EOPNOTSUPP;
1484                 goto out;
1485         }
1486
1487         switch (info->genlhdr->cmd) {
1488         case NL80211_CMD_NEW_BEACON:
1489                 /* these are required for NEW_BEACON */
1490                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1491                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1492                     !info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1493                         err = -EINVAL;
1494                         goto out;
1495                 }
1496
1497                 call = rdev->ops->add_beacon;
1498                 break;
1499         case NL80211_CMD_SET_BEACON:
1500                 call = rdev->ops->set_beacon;
1501                 break;
1502         default:
1503                 WARN_ON(1);
1504                 err = -EOPNOTSUPP;
1505                 goto out;
1506         }
1507
1508         if (!call) {
1509                 err = -EOPNOTSUPP;
1510                 goto out;
1511         }
1512
1513         memset(&params, 0, sizeof(params));
1514
1515         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1516                 params.interval =
1517                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1518                 haveinfo = 1;
1519         }
1520
1521         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1522                 params.dtim_period =
1523                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1524                 haveinfo = 1;
1525         }
1526
1527         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1528                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1529                 params.head_len =
1530                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1531                 haveinfo = 1;
1532         }
1533
1534         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1535                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1536                 params.tail_len =
1537                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1538                 haveinfo = 1;
1539         }
1540
1541         if (!haveinfo) {
1542                 err = -EINVAL;
1543                 goto out;
1544         }
1545
1546         err = call(&rdev->wiphy, dev, &params);
1547
1548  out:
1549         cfg80211_unlock_rdev(rdev);
1550         dev_put(dev);
1551  unlock_rtnl:
1552         rtnl_unlock();
1553
1554         return err;
1555 }
1556
1557 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1558 {
1559         struct cfg80211_registered_device *rdev;
1560         int err;
1561         struct net_device *dev;
1562
1563         rtnl_lock();
1564
1565         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1566         if (err)
1567                 goto unlock_rtnl;
1568
1569         if (!rdev->ops->del_beacon) {
1570                 err = -EOPNOTSUPP;
1571                 goto out;
1572         }
1573
1574         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1575                 err = -EOPNOTSUPP;
1576                 goto out;
1577         }
1578         err = rdev->ops->del_beacon(&rdev->wiphy, dev);
1579
1580  out:
1581         cfg80211_unlock_rdev(rdev);
1582         dev_put(dev);
1583  unlock_rtnl:
1584         rtnl_unlock();
1585
1586         return err;
1587 }
1588
1589 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1590         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1591         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1592         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1593         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
1594 };
1595
1596 static int parse_station_flags(struct genl_info *info,
1597                                struct station_parameters *params)
1598 {
1599         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1600         struct nlattr *nla;
1601         int flag;
1602
1603         /*
1604          * Try parsing the new attribute first so userspace
1605          * can specify both for older kernels.
1606          */
1607         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
1608         if (nla) {
1609                 struct nl80211_sta_flag_update *sta_flags;
1610
1611                 sta_flags = nla_data(nla);
1612                 params->sta_flags_mask = sta_flags->mask;
1613                 params->sta_flags_set = sta_flags->set;
1614                 if ((params->sta_flags_mask |
1615                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
1616                         return -EINVAL;
1617                 return 0;
1618         }
1619
1620         /* if present, parse the old attribute */
1621
1622         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
1623         if (!nla)
1624                 return 0;
1625
1626         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1627                              nla, sta_flags_policy))
1628                 return -EINVAL;
1629
1630         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
1631         params->sta_flags_mask &= ~1;
1632
1633         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1634                 if (flags[flag])
1635                         params->sta_flags_set |= (1<<flag);
1636
1637         return 0;
1638 }
1639
1640 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1641                                 int flags, struct net_device *dev,
1642                                 u8 *mac_addr, struct station_info *sinfo)
1643 {
1644         void *hdr;
1645         struct nlattr *sinfoattr, *txrate;
1646         u16 bitrate;
1647
1648         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1649         if (!hdr)
1650                 return -1;
1651
1652         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1653         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1654
1655         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, sinfo->generation);
1656
1657         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1658         if (!sinfoattr)
1659                 goto nla_put_failure;
1660         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1661                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1662                             sinfo->inactive_time);
1663         if (sinfo->filled & STATION_INFO_RX_BYTES)
1664                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1665                             sinfo->rx_bytes);
1666         if (sinfo->filled & STATION_INFO_TX_BYTES)
1667                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1668                             sinfo->tx_bytes);
1669         if (sinfo->filled & STATION_INFO_LLID)
1670                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1671                             sinfo->llid);
1672         if (sinfo->filled & STATION_INFO_PLID)
1673                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1674                             sinfo->plid);
1675         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1676                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1677                             sinfo->plink_state);
1678         if (sinfo->filled & STATION_INFO_SIGNAL)
1679                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1680                            sinfo->signal);
1681         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1682                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1683                 if (!txrate)
1684                         goto nla_put_failure;
1685
1686                 /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
1687                 bitrate = cfg80211_calculate_bitrate(&sinfo->txrate);
1688                 if (bitrate > 0)
1689                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1690
1691                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1692                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1693                                     sinfo->txrate.mcs);
1694                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1695                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1696                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1697                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1698
1699                 nla_nest_end(msg, txrate);
1700         }
1701         if (sinfo->filled & STATION_INFO_RX_PACKETS)
1702                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
1703                             sinfo->rx_packets);
1704         if (sinfo->filled & STATION_INFO_TX_PACKETS)
1705                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
1706                             sinfo->tx_packets);
1707         nla_nest_end(msg, sinfoattr);
1708
1709         return genlmsg_end(msg, hdr);
1710
1711  nla_put_failure:
1712         genlmsg_cancel(msg, hdr);
1713         return -EMSGSIZE;
1714 }
1715
1716 static int nl80211_dump_station(struct sk_buff *skb,
1717                                 struct netlink_callback *cb)
1718 {
1719         struct station_info sinfo;
1720         struct cfg80211_registered_device *dev;
1721         struct net_device *netdev;
1722         u8 mac_addr[ETH_ALEN];
1723         int ifidx = cb->args[0];
1724         int sta_idx = cb->args[1];
1725         int err;
1726
1727         if (!ifidx)
1728                 ifidx = nl80211_get_ifidx(cb);
1729         if (ifidx < 0)
1730                 return ifidx;
1731
1732         rtnl_lock();
1733
1734         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1735         if (!netdev) {
1736                 err = -ENODEV;
1737                 goto out_rtnl;
1738         }
1739
1740         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
1741         if (IS_ERR(dev)) {
1742                 err = PTR_ERR(dev);
1743                 goto out_rtnl;
1744         }
1745
1746         if (!dev->ops->dump_station) {
1747                 err = -EOPNOTSUPP;
1748                 goto out_err;
1749         }
1750
1751         while (1) {
1752                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1753                                              mac_addr, &sinfo);
1754                 if (err == -ENOENT)
1755                         break;
1756                 if (err)
1757                         goto out_err;
1758
1759                 if (nl80211_send_station(skb,
1760                                 NETLINK_CB(cb->skb).pid,
1761                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
1762                                 netdev, mac_addr,
1763                                 &sinfo) < 0)
1764                         goto out;
1765
1766                 sta_idx++;
1767         }
1768
1769
1770  out:
1771         cb->args[1] = sta_idx;
1772         err = skb->len;
1773  out_err:
1774         cfg80211_unlock_rdev(dev);
1775  out_rtnl:
1776         rtnl_unlock();
1777
1778         return err;
1779 }
1780
1781 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1782 {
1783         struct cfg80211_registered_device *rdev;
1784         int err;
1785         struct net_device *dev;
1786         struct station_info sinfo;
1787         struct sk_buff *msg;
1788         u8 *mac_addr = NULL;
1789
1790         memset(&sinfo, 0, sizeof(sinfo));
1791
1792         if (!info->attrs[NL80211_ATTR_MAC])
1793                 return -EINVAL;
1794
1795         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1796
1797         rtnl_lock();
1798
1799         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1800         if (err)
1801                 goto out_rtnl;
1802
1803         if (!rdev->ops->get_station) {
1804                 err = -EOPNOTSUPP;
1805                 goto out;
1806         }
1807
1808         err = rdev->ops->get_station(&rdev->wiphy, dev, mac_addr, &sinfo);
1809         if (err)
1810                 goto out;
1811
1812         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1813         if (!msg)
1814                 goto out;
1815
1816         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1817                                  dev, mac_addr, &sinfo) < 0)
1818                 goto out_free;
1819
1820         err = genlmsg_reply(msg, info);
1821         goto out;
1822
1823  out_free:
1824         nlmsg_free(msg);
1825  out:
1826         cfg80211_unlock_rdev(rdev);
1827         dev_put(dev);
1828  out_rtnl:
1829         rtnl_unlock();
1830
1831         return err;
1832 }
1833
1834 /*
1835  * Get vlan interface making sure it is running and on the right wiphy.
1836  */
1837 static int get_vlan(struct genl_info *info,
1838                     struct cfg80211_registered_device *rdev,
1839                     struct net_device **vlan)
1840 {
1841         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
1842         *vlan = NULL;
1843
1844         if (vlanattr) {
1845                 *vlan = dev_get_by_index(genl_info_net(info),
1846                                          nla_get_u32(vlanattr));
1847                 if (!*vlan)
1848                         return -ENODEV;
1849                 if (!(*vlan)->ieee80211_ptr)
1850                         return -EINVAL;
1851                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
1852                         return -EINVAL;
1853                 if (!netif_running(*vlan))
1854                         return -ENETDOWN;
1855         }
1856         return 0;
1857 }
1858
1859 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
1860 {
1861         struct cfg80211_registered_device *rdev;
1862         int err;
1863         struct net_device *dev;
1864         struct station_parameters params;
1865         u8 *mac_addr = NULL;
1866
1867         memset(&params, 0, sizeof(params));
1868
1869         params.listen_interval = -1;
1870
1871         if (info->attrs[NL80211_ATTR_STA_AID])
1872                 return -EINVAL;
1873
1874         if (!info->attrs[NL80211_ATTR_MAC])
1875                 return -EINVAL;
1876
1877         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1878
1879         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
1880                 params.supported_rates =
1881                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1882                 params.supported_rates_len =
1883                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1884         }
1885
1886         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1887                 params.listen_interval =
1888                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1889
1890         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1891                 params.ht_capa =
1892                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1893
1894         if (parse_station_flags(info, &params))
1895                 return -EINVAL;
1896
1897         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
1898                 params.plink_action =
1899                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
1900
1901         rtnl_lock();
1902
1903         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1904         if (err)
1905                 goto out_rtnl;
1906
1907         err = get_vlan(info, rdev, &params.vlan);
1908         if (err)
1909                 goto out;
1910
1911         /* validate settings */
1912         err = 0;
1913
1914         switch (dev->ieee80211_ptr->iftype) {
1915         case NL80211_IFTYPE_AP:
1916         case NL80211_IFTYPE_AP_VLAN:
1917                 /* disallow mesh-specific things */
1918                 if (params.plink_action)
1919                         err = -EINVAL;
1920                 break;
1921         case NL80211_IFTYPE_STATION:
1922                 /* disallow everything but AUTHORIZED flag */
1923                 if (params.plink_action)
1924                         err = -EINVAL;
1925                 if (params.vlan)
1926                         err = -EINVAL;
1927                 if (params.supported_rates)
1928                         err = -EINVAL;
1929                 if (params.ht_capa)
1930                         err = -EINVAL;
1931                 if (params.listen_interval >= 0)
1932                         err = -EINVAL;
1933                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
1934                         err = -EINVAL;
1935                 break;
1936         case NL80211_IFTYPE_MESH_POINT:
1937                 /* disallow things mesh doesn't support */
1938                 if (params.vlan)
1939                         err = -EINVAL;
1940                 if (params.ht_capa)
1941                         err = -EINVAL;
1942                 if (params.listen_interval >= 0)
1943                         err = -EINVAL;
1944                 if (params.supported_rates)
1945                         err = -EINVAL;
1946                 if (params.sta_flags_mask)
1947                         err = -EINVAL;
1948                 break;
1949         default:
1950                 err = -EINVAL;
1951         }
1952
1953         if (err)
1954                 goto out;
1955
1956         if (!rdev->ops->change_station) {
1957                 err = -EOPNOTSUPP;
1958                 goto out;
1959         }
1960
1961         err = rdev->ops->change_station(&rdev->wiphy, dev, mac_addr, &params);
1962
1963  out:
1964         if (params.vlan)
1965                 dev_put(params.vlan);
1966         cfg80211_unlock_rdev(rdev);
1967         dev_put(dev);
1968  out_rtnl:
1969         rtnl_unlock();
1970
1971         return err;
1972 }
1973
1974 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
1975 {
1976         struct cfg80211_registered_device *rdev;
1977         int err;
1978         struct net_device *dev;
1979         struct station_parameters params;
1980         u8 *mac_addr = NULL;
1981
1982         memset(&params, 0, sizeof(params));
1983
1984         if (!info->attrs[NL80211_ATTR_MAC])
1985                 return -EINVAL;
1986
1987         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1988                 return -EINVAL;
1989
1990         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
1991                 return -EINVAL;
1992
1993         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1994         params.supported_rates =
1995                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1996         params.supported_rates_len =
1997                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1998         params.listen_interval =
1999                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2000
2001         if (info->attrs[NL80211_ATTR_STA_AID]) {
2002                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
2003                 if (!params.aid || params.aid > IEEE80211_MAX_AID)
2004                         return -EINVAL;
2005         }
2006
2007         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2008                 params.ht_capa =
2009                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2010
2011         if (parse_station_flags(info, &params))
2012                 return -EINVAL;
2013
2014         rtnl_lock();
2015
2016         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2017         if (err)
2018                 goto out_rtnl;
2019
2020         err = get_vlan(info, rdev, &params.vlan);
2021         if (err)
2022                 goto out;
2023
2024         /* validate settings */
2025         err = 0;
2026
2027         switch (dev->ieee80211_ptr->iftype) {
2028         case NL80211_IFTYPE_AP:
2029         case NL80211_IFTYPE_AP_VLAN:
2030                 /* all ok but must have AID */
2031                 if (!params.aid)
2032                         err = -EINVAL;
2033                 break;
2034         case NL80211_IFTYPE_MESH_POINT:
2035                 /* disallow things mesh doesn't support */
2036                 if (params.vlan)
2037                         err = -EINVAL;
2038                 if (params.aid)
2039                         err = -EINVAL;
2040                 if (params.ht_capa)
2041                         err = -EINVAL;
2042                 if (params.listen_interval >= 0)
2043                         err = -EINVAL;
2044                 if (params.supported_rates)
2045                         err = -EINVAL;
2046                 if (params.sta_flags_mask)
2047                         err = -EINVAL;
2048                 break;
2049         default:
2050                 err = -EINVAL;
2051         }
2052
2053         if (err)
2054                 goto out;
2055
2056         if (!rdev->ops->add_station) {
2057                 err = -EOPNOTSUPP;
2058                 goto out;
2059         }
2060
2061         if (!netif_running(dev)) {
2062                 err = -ENETDOWN;
2063                 goto out;
2064         }
2065
2066         err = rdev->ops->add_station(&rdev->wiphy, dev, mac_addr, &params);
2067
2068  out:
2069         if (params.vlan)
2070                 dev_put(params.vlan);
2071         cfg80211_unlock_rdev(rdev);
2072         dev_put(dev);
2073  out_rtnl:
2074         rtnl_unlock();
2075
2076         return err;
2077 }
2078
2079 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
2080 {
2081         struct cfg80211_registered_device *rdev;
2082         int err;
2083         struct net_device *dev;
2084         u8 *mac_addr = NULL;
2085
2086         if (info->attrs[NL80211_ATTR_MAC])
2087                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2088
2089         rtnl_lock();
2090
2091         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2092         if (err)
2093                 goto out_rtnl;
2094
2095         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2096             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2097             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2098                 err = -EINVAL;
2099                 goto out;
2100         }
2101
2102         if (!rdev->ops->del_station) {
2103                 err = -EOPNOTSUPP;
2104                 goto out;
2105         }
2106
2107         err = rdev->ops->del_station(&rdev->wiphy, dev, mac_addr);
2108
2109  out:
2110         cfg80211_unlock_rdev(rdev);
2111         dev_put(dev);
2112  out_rtnl:
2113         rtnl_unlock();
2114
2115         return err;
2116 }
2117
2118 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
2119                                 int flags, struct net_device *dev,
2120                                 u8 *dst, u8 *next_hop,
2121                                 struct mpath_info *pinfo)
2122 {
2123         void *hdr;
2124         struct nlattr *pinfoattr;
2125
2126         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2127         if (!hdr)
2128                 return -1;
2129
2130         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2131         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
2132         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
2133
2134         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, pinfo->generation);
2135
2136         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
2137         if (!pinfoattr)
2138                 goto nla_put_failure;
2139         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
2140                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
2141                             pinfo->frame_qlen);
2142         if (pinfo->filled & MPATH_INFO_SN)
2143                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_SN,
2144                             pinfo->sn);
2145         if (pinfo->filled & MPATH_INFO_METRIC)
2146                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
2147                             pinfo->metric);
2148         if (pinfo->filled & MPATH_INFO_EXPTIME)
2149                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
2150                             pinfo->exptime);
2151         if (pinfo->filled & MPATH_INFO_FLAGS)
2152                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
2153                             pinfo->flags);
2154         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
2155                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
2156                             pinfo->discovery_timeout);
2157         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
2158                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
2159                             pinfo->discovery_retries);
2160
2161         nla_nest_end(msg, pinfoattr);
2162
2163         return genlmsg_end(msg, hdr);
2164
2165  nla_put_failure:
2166         genlmsg_cancel(msg, hdr);
2167         return -EMSGSIZE;
2168 }
2169
2170 static int nl80211_dump_mpath(struct sk_buff *skb,
2171                               struct netlink_callback *cb)
2172 {
2173         struct mpath_info pinfo;
2174         struct cfg80211_registered_device *dev;
2175         struct net_device *netdev;
2176         u8 dst[ETH_ALEN];
2177         u8 next_hop[ETH_ALEN];
2178         int ifidx = cb->args[0];
2179         int path_idx = cb->args[1];
2180         int err;
2181
2182         if (!ifidx)
2183                 ifidx = nl80211_get_ifidx(cb);
2184         if (ifidx < 0)
2185                 return ifidx;
2186
2187         rtnl_lock();
2188
2189         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
2190         if (!netdev) {
2191                 err = -ENODEV;
2192                 goto out_rtnl;
2193         }
2194
2195         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
2196         if (IS_ERR(dev)) {
2197                 err = PTR_ERR(dev);
2198                 goto out_rtnl;
2199         }
2200
2201         if (!dev->ops->dump_mpath) {
2202                 err = -EOPNOTSUPP;
2203                 goto out_err;
2204         }
2205
2206         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2207                 err = -EOPNOTSUPP;
2208                 goto out_err;
2209         }
2210
2211         while (1) {
2212                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
2213                                            dst, next_hop, &pinfo);
2214                 if (err == -ENOENT)
2215                         break;
2216                 if (err)
2217                         goto out_err;
2218
2219                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
2220                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
2221                                        netdev, dst, next_hop,
2222                                        &pinfo) < 0)
2223                         goto out;
2224
2225                 path_idx++;
2226         }
2227
2228
2229  out:
2230         cb->args[1] = path_idx;
2231         err = skb->len;
2232  out_err:
2233         cfg80211_unlock_rdev(dev);
2234  out_rtnl:
2235         rtnl_unlock();
2236
2237         return err;
2238 }
2239
2240 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
2241 {
2242         struct cfg80211_registered_device *rdev;
2243         int err;
2244         struct net_device *dev;
2245         struct mpath_info pinfo;
2246         struct sk_buff *msg;
2247         u8 *dst = NULL;
2248         u8 next_hop[ETH_ALEN];
2249
2250         memset(&pinfo, 0, sizeof(pinfo));
2251
2252         if (!info->attrs[NL80211_ATTR_MAC])
2253                 return -EINVAL;
2254
2255         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2256
2257         rtnl_lock();
2258
2259         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2260         if (err)
2261                 goto out_rtnl;
2262
2263         if (!rdev->ops->get_mpath) {
2264                 err = -EOPNOTSUPP;
2265                 goto out;
2266         }
2267
2268         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2269                 err = -EOPNOTSUPP;
2270                 goto out;
2271         }
2272
2273         err = rdev->ops->get_mpath(&rdev->wiphy, dev, dst, next_hop, &pinfo);
2274         if (err)
2275                 goto out;
2276
2277         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2278         if (!msg)
2279                 goto out;
2280
2281         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2282                                  dev, dst, next_hop, &pinfo) < 0)
2283                 goto out_free;
2284
2285         err = genlmsg_reply(msg, info);
2286         goto out;
2287
2288  out_free:
2289         nlmsg_free(msg);
2290  out:
2291         cfg80211_unlock_rdev(rdev);
2292         dev_put(dev);
2293  out_rtnl:
2294         rtnl_unlock();
2295
2296         return err;
2297 }
2298
2299 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2300 {
2301         struct cfg80211_registered_device *rdev;
2302         int err;
2303         struct net_device *dev;
2304         u8 *dst = NULL;
2305         u8 *next_hop = NULL;
2306
2307         if (!info->attrs[NL80211_ATTR_MAC])
2308                 return -EINVAL;
2309
2310         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2311                 return -EINVAL;
2312
2313         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2314         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2315
2316         rtnl_lock();
2317
2318         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2319         if (err)
2320                 goto out_rtnl;
2321
2322         if (!rdev->ops->change_mpath) {
2323                 err = -EOPNOTSUPP;
2324                 goto out;
2325         }
2326
2327         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2328                 err = -EOPNOTSUPP;
2329                 goto out;
2330         }
2331
2332         if (!netif_running(dev)) {
2333                 err = -ENETDOWN;
2334                 goto out;
2335         }
2336
2337         err = rdev->ops->change_mpath(&rdev->wiphy, dev, dst, next_hop);
2338
2339  out:
2340         cfg80211_unlock_rdev(rdev);
2341         dev_put(dev);
2342  out_rtnl:
2343         rtnl_unlock();
2344
2345         return err;
2346 }
2347 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2348 {
2349         struct cfg80211_registered_device *rdev;
2350         int err;
2351         struct net_device *dev;
2352         u8 *dst = NULL;
2353         u8 *next_hop = NULL;
2354
2355         if (!info->attrs[NL80211_ATTR_MAC])
2356                 return -EINVAL;
2357
2358         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2359                 return -EINVAL;
2360
2361         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2362         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2363
2364         rtnl_lock();
2365
2366         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2367         if (err)
2368                 goto out_rtnl;
2369
2370         if (!rdev->ops->add_mpath) {
2371                 err = -EOPNOTSUPP;
2372                 goto out;
2373         }
2374
2375         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2376                 err = -EOPNOTSUPP;
2377                 goto out;
2378         }
2379
2380         if (!netif_running(dev)) {
2381                 err = -ENETDOWN;
2382                 goto out;
2383         }
2384
2385         err = rdev->ops->add_mpath(&rdev->wiphy, dev, dst, next_hop);
2386
2387  out:
2388         cfg80211_unlock_rdev(rdev);
2389         dev_put(dev);
2390  out_rtnl:
2391         rtnl_unlock();
2392
2393         return err;
2394 }
2395
2396 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2397 {
2398         struct cfg80211_registered_device *rdev;
2399         int err;
2400         struct net_device *dev;
2401         u8 *dst = NULL;
2402
2403         if (info->attrs[NL80211_ATTR_MAC])
2404                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2405
2406         rtnl_lock();
2407
2408         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2409         if (err)
2410                 goto out_rtnl;
2411
2412         if (!rdev->ops->del_mpath) {
2413                 err = -EOPNOTSUPP;
2414                 goto out;
2415         }
2416
2417         err = rdev->ops->del_mpath(&rdev->wiphy, dev, dst);
2418
2419  out:
2420         cfg80211_unlock_rdev(rdev);
2421         dev_put(dev);
2422  out_rtnl:
2423         rtnl_unlock();
2424
2425         return err;
2426 }
2427
2428 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2429 {
2430         struct cfg80211_registered_device *rdev;
2431         int err;
2432         struct net_device *dev;
2433         struct bss_parameters params;
2434
2435         memset(&params, 0, sizeof(params));
2436         /* default to not changing parameters */
2437         params.use_cts_prot = -1;
2438         params.use_short_preamble = -1;
2439         params.use_short_slot_time = -1;
2440
2441         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2442                 params.use_cts_prot =
2443                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2444         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2445                 params.use_short_preamble =
2446                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2447         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2448                 params.use_short_slot_time =
2449                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2450         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2451                 params.basic_rates =
2452                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2453                 params.basic_rates_len =
2454                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2455         }
2456
2457         rtnl_lock();
2458
2459         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2460         if (err)
2461                 goto out_rtnl;
2462
2463         if (!rdev->ops->change_bss) {
2464                 err = -EOPNOTSUPP;
2465                 goto out;
2466         }
2467
2468         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
2469                 err = -EOPNOTSUPP;
2470                 goto out;
2471         }
2472
2473         err = rdev->ops->change_bss(&rdev->wiphy, dev, &params);
2474
2475  out:
2476         cfg80211_unlock_rdev(rdev);
2477         dev_put(dev);
2478  out_rtnl:
2479         rtnl_unlock();
2480
2481         return err;
2482 }
2483
2484 static const struct nla_policy
2485         reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2486         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2487         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2488         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2489         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2490         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2491         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2492 };
2493
2494 static int parse_reg_rule(struct nlattr *tb[],
2495         struct ieee80211_reg_rule *reg_rule)
2496 {
2497         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2498         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2499
2500         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2501                 return -EINVAL;
2502         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2503                 return -EINVAL;
2504         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2505                 return -EINVAL;
2506         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2507                 return -EINVAL;
2508         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2509                 return -EINVAL;
2510
2511         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2512
2513         freq_range->start_freq_khz =
2514                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2515         freq_range->end_freq_khz =
2516                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2517         freq_range->max_bandwidth_khz =
2518                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2519
2520         power_rule->max_eirp =
2521                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2522
2523         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2524                 power_rule->max_antenna_gain =
2525                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2526
2527         return 0;
2528 }
2529
2530 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2531 {
2532         int r;
2533         char *data = NULL;
2534
2535         /*
2536          * You should only get this when cfg80211 hasn't yet initialized
2537          * completely when built-in to the kernel right between the time
2538          * window between nl80211_init() and regulatory_init(), if that is
2539          * even possible.
2540          */
2541         mutex_lock(&cfg80211_mutex);
2542         if (unlikely(!cfg80211_regdomain)) {
2543                 mutex_unlock(&cfg80211_mutex);
2544                 return -EINPROGRESS;
2545         }
2546         mutex_unlock(&cfg80211_mutex);
2547
2548         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2549                 return -EINVAL;
2550
2551         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2552
2553 #ifdef CONFIG_WIRELESS_OLD_REGULATORY
2554         /* We ignore world regdom requests with the old regdom setup */
2555         if (is_world_regdom(data))
2556                 return -EINVAL;
2557 #endif
2558
2559         r = regulatory_hint_user(data);
2560
2561         return r;
2562 }
2563
2564 static int nl80211_get_mesh_params(struct sk_buff *skb,
2565         struct genl_info *info)
2566 {
2567         struct cfg80211_registered_device *rdev;
2568         struct mesh_config cur_params;
2569         int err;
2570         struct net_device *dev;
2571         void *hdr;
2572         struct nlattr *pinfoattr;
2573         struct sk_buff *msg;
2574
2575         rtnl_lock();
2576
2577         /* Look up our device */
2578         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2579         if (err)
2580                 goto out_rtnl;
2581
2582         if (!rdev->ops->get_mesh_params) {
2583                 err = -EOPNOTSUPP;
2584                 goto out;
2585         }
2586
2587         /* Get the mesh params */
2588         err = rdev->ops->get_mesh_params(&rdev->wiphy, dev, &cur_params);
2589         if (err)
2590                 goto out;
2591
2592         /* Draw up a netlink message to send back */
2593         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2594         if (!msg) {
2595                 err = -ENOBUFS;
2596                 goto out;
2597         }
2598         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2599                              NL80211_CMD_GET_MESH_PARAMS);
2600         if (!hdr)
2601                 goto nla_put_failure;
2602         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
2603         if (!pinfoattr)
2604                 goto nla_put_failure;
2605         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2606         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2607                         cur_params.dot11MeshRetryTimeout);
2608         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2609                         cur_params.dot11MeshConfirmTimeout);
2610         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2611                         cur_params.dot11MeshHoldingTimeout);
2612         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2613                         cur_params.dot11MeshMaxPeerLinks);
2614         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2615                         cur_params.dot11MeshMaxRetries);
2616         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2617                         cur_params.dot11MeshTTL);
2618         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2619                         cur_params.auto_open_plinks);
2620         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2621                         cur_params.dot11MeshHWMPmaxPREQretries);
2622         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2623                         cur_params.path_refresh_time);
2624         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2625                         cur_params.min_discovery_timeout);
2626         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2627                         cur_params.dot11MeshHWMPactivePathTimeout);
2628         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2629                         cur_params.dot11MeshHWMPpreqMinInterval);
2630         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2631                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2632         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
2633                         cur_params.dot11MeshHWMPRootMode);
2634         nla_nest_end(msg, pinfoattr);
2635         genlmsg_end(msg, hdr);
2636         err = genlmsg_reply(msg, info);
2637         goto out;
2638
2639  nla_put_failure:
2640         genlmsg_cancel(msg, hdr);
2641         err = -EMSGSIZE;
2642  out:
2643         /* Cleanup */
2644         cfg80211_unlock_rdev(rdev);
2645         dev_put(dev);
2646  out_rtnl:
2647         rtnl_unlock();
2648
2649         return err;
2650 }
2651
2652 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2653 do {\
2654         if (table[attr_num]) {\
2655                 cfg.param = nla_fn(table[attr_num]); \
2656                 mask |= (1 << (attr_num - 1)); \
2657         } \
2658 } while (0);\
2659
2660 static struct nla_policy
2661 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] __read_mostly = {
2662         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2663         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2664         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2665         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2666         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2667         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2668         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2669
2670         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2671         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2672         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2673         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2674         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2675         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2676 };
2677
2678 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2679 {
2680         int err;
2681         u32 mask;
2682         struct cfg80211_registered_device *rdev;
2683         struct net_device *dev;
2684         struct mesh_config cfg;
2685         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2686         struct nlattr *parent_attr;
2687
2688         parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
2689         if (!parent_attr)
2690                 return -EINVAL;
2691         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2692                         parent_attr, nl80211_meshconf_params_policy))
2693                 return -EINVAL;
2694
2695         rtnl_lock();
2696
2697         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2698         if (err)
2699                 goto out_rtnl;
2700
2701         if (!rdev->ops->set_mesh_params) {
2702                 err = -EOPNOTSUPP;
2703                 goto out;
2704         }
2705
2706         /* This makes sure that there aren't more than 32 mesh config
2707          * parameters (otherwise our bitfield scheme would not work.) */
2708         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2709
2710         /* Fill in the params struct */
2711         mask = 0;
2712         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2713                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2714         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2715                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2716         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2717                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2718         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2719                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2720         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2721                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2722         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2723                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2724         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2725                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2726         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2727                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2728                         nla_get_u8);
2729         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2730                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2731         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2732                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2733                         nla_get_u16);
2734         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2735                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2736                         nla_get_u32);
2737         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2738                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2739                         nla_get_u16);
2740         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2741                         dot11MeshHWMPnetDiameterTraversalTime,
2742                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2743                         nla_get_u16);
2744         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2745                         dot11MeshHWMPRootMode, mask,
2746                         NL80211_MESHCONF_HWMP_ROOTMODE,
2747                         nla_get_u8);
2748
2749         /* Apply changes */
2750         err = rdev->ops->set_mesh_params(&rdev->wiphy, dev, &cfg, mask);
2751
2752  out:
2753         /* cleanup */
2754         cfg80211_unlock_rdev(rdev);
2755         dev_put(dev);
2756  out_rtnl:
2757         rtnl_unlock();
2758
2759         return err;
2760 }
2761
2762 #undef FILL_IN_MESH_PARAM_IF_SET
2763
2764 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2765 {
2766         struct sk_buff *msg;
2767         void *hdr = NULL;
2768         struct nlattr *nl_reg_rules;
2769         unsigned int i;
2770         int err = -EINVAL;
2771
2772         mutex_lock(&cfg80211_mutex);
2773
2774         if (!cfg80211_regdomain)
2775                 goto out;
2776
2777         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2778         if (!msg) {
2779                 err = -ENOBUFS;
2780                 goto out;
2781         }
2782
2783         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2784                              NL80211_CMD_GET_REG);
2785         if (!hdr)
2786                 goto nla_put_failure;
2787
2788         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2789                 cfg80211_regdomain->alpha2);
2790
2791         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2792         if (!nl_reg_rules)
2793                 goto nla_put_failure;
2794
2795         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2796                 struct nlattr *nl_reg_rule;
2797                 const struct ieee80211_reg_rule *reg_rule;
2798                 const struct ieee80211_freq_range *freq_range;
2799                 const struct ieee80211_power_rule *power_rule;
2800
2801                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2802                 freq_range = &reg_rule->freq_range;
2803                 power_rule = &reg_rule->power_rule;
2804
2805                 nl_reg_rule = nla_nest_start(msg, i);
2806                 if (!nl_reg_rule)
2807                         goto nla_put_failure;
2808
2809                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2810                         reg_rule->flags);
2811                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2812                         freq_range->start_freq_khz);
2813                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2814                         freq_range->end_freq_khz);
2815                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2816                         freq_range->max_bandwidth_khz);
2817                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2818                         power_rule->max_antenna_gain);
2819                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2820                         power_rule->max_eirp);
2821
2822                 nla_nest_end(msg, nl_reg_rule);
2823         }
2824
2825         nla_nest_end(msg, nl_reg_rules);
2826
2827         genlmsg_end(msg, hdr);
2828         err = genlmsg_reply(msg, info);
2829         goto out;
2830
2831 nla_put_failure:
2832         genlmsg_cancel(msg, hdr);
2833         err = -EMSGSIZE;
2834 out:
2835         mutex_unlock(&cfg80211_mutex);
2836         return err;
2837 }
2838
2839 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2840 {
2841         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2842         struct nlattr *nl_reg_rule;
2843         char *alpha2 = NULL;
2844         int rem_reg_rules = 0, r = 0;
2845         u32 num_rules = 0, rule_idx = 0, size_of_regd;
2846         struct ieee80211_regdomain *rd = NULL;
2847
2848         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2849                 return -EINVAL;
2850
2851         if (!info->attrs[NL80211_ATTR_REG_RULES])
2852                 return -EINVAL;
2853
2854         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2855
2856         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2857                         rem_reg_rules) {
2858                 num_rules++;
2859                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2860                         return -EINVAL;
2861         }
2862
2863         mutex_lock(&cfg80211_mutex);
2864
2865         if (!reg_is_valid_request(alpha2)) {
2866                 r = -EINVAL;
2867                 goto bad_reg;
2868         }
2869
2870         size_of_regd = sizeof(struct ieee80211_regdomain) +
2871                 (num_rules * sizeof(struct ieee80211_reg_rule));
2872
2873         rd = kzalloc(size_of_regd, GFP_KERNEL);
2874         if (!rd) {
2875                 r = -ENOMEM;
2876                 goto bad_reg;
2877         }
2878
2879         rd->n_reg_rules = num_rules;
2880         rd->alpha2[0] = alpha2[0];
2881         rd->alpha2[1] = alpha2[1];
2882
2883         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2884                         rem_reg_rules) {
2885                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2886                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2887                         reg_rule_policy);
2888                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2889                 if (r)
2890                         goto bad_reg;
2891
2892                 rule_idx++;
2893
2894                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
2895                         r = -EINVAL;
2896                         goto bad_reg;
2897                 }
2898         }
2899
2900         BUG_ON(rule_idx != num_rules);
2901
2902         r = set_regdom(rd);
2903
2904         mutex_unlock(&cfg80211_mutex);
2905
2906         return r;
2907
2908  bad_reg:
2909         mutex_unlock(&cfg80211_mutex);
2910         kfree(rd);
2911         return r;
2912 }
2913
2914 static int validate_scan_freqs(struct nlattr *freqs)
2915 {
2916         struct nlattr *attr1, *attr2;
2917         int n_channels = 0, tmp1, tmp2;
2918
2919         nla_for_each_nested(attr1, freqs, tmp1) {
2920                 n_channels++;
2921                 /*
2922                  * Some hardware has a limited channel list for
2923                  * scanning, and it is pretty much nonsensical
2924                  * to scan for a channel twice, so disallow that
2925                  * and don't require drivers to check that the
2926                  * channel list they get isn't longer than what
2927                  * they can scan, as long as they can scan all
2928                  * the channels they registered at once.
2929                  */
2930                 nla_for_each_nested(attr2, freqs, tmp2)
2931                         if (attr1 != attr2 &&
2932                             nla_get_u32(attr1) == nla_get_u32(attr2))
2933                                 return 0;
2934         }
2935
2936         return n_channels;
2937 }
2938
2939 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
2940 {
2941         struct cfg80211_registered_device *rdev;
2942         struct net_device *dev;
2943         struct cfg80211_scan_request *request;
2944         struct cfg80211_ssid *ssid;
2945         struct ieee80211_channel *channel;
2946         struct nlattr *attr;
2947         struct wiphy *wiphy;
2948         int err, tmp, n_ssids = 0, n_channels, i;
2949         enum ieee80211_band band;
2950         size_t ie_len;
2951
2952         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2953                 return -EINVAL;
2954
2955         rtnl_lock();
2956
2957         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2958         if (err)
2959                 goto out_rtnl;
2960
2961         wiphy = &rdev->wiphy;
2962
2963         if (!rdev->ops->scan) {
2964                 err = -EOPNOTSUPP;
2965                 goto out;
2966         }
2967
2968         if (!netif_running(dev)) {
2969                 err = -ENETDOWN;
2970                 goto out;
2971         }
2972
2973         if (rdev->scan_req) {
2974                 err = -EBUSY;
2975                 goto out;
2976         }
2977
2978         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2979                 n_channels = validate_scan_freqs(
2980                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
2981                 if (!n_channels) {
2982                         err = -EINVAL;
2983                         goto out;
2984                 }
2985         } else {
2986                 n_channels = 0;
2987
2988                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
2989                         if (wiphy->bands[band])
2990                                 n_channels += wiphy->bands[band]->n_channels;
2991         }
2992
2993         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
2994                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
2995                         n_ssids++;
2996
2997         if (n_ssids > wiphy->max_scan_ssids) {
2998                 err = -EINVAL;
2999                 goto out;
3000         }
3001
3002         if (info->attrs[NL80211_ATTR_IE])
3003                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3004         else
3005                 ie_len = 0;
3006
3007         if (ie_len > wiphy->max_scan_ie_len) {
3008                 err = -EINVAL;
3009                 goto out;
3010         }
3011
3012         request = kzalloc(sizeof(*request)
3013                         + sizeof(*ssid) * n_ssids
3014                         + sizeof(channel) * n_channels
3015                         + ie_len, GFP_KERNEL);
3016         if (!request) {
3017                 err = -ENOMEM;
3018                 goto out;
3019         }
3020
3021         if (n_ssids)
3022                 request->ssids = (void *)&request->channels[n_channels];
3023         request->n_ssids = n_ssids;
3024         if (ie_len) {
3025                 if (request->ssids)
3026                         request->ie = (void *)(request->ssids + n_ssids);
3027                 else
3028                         request->ie = (void *)(request->channels + n_channels);
3029         }
3030
3031         i = 0;
3032         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3033                 /* user specified, bail out if channel not found */
3034                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
3035                         struct ieee80211_channel *chan;
3036
3037                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
3038
3039                         if (!chan) {
3040                                 err = -EINVAL;
3041                                 goto out_free;
3042                         }
3043
3044                         /* ignore disabled channels */
3045                         if (chan->flags & IEEE80211_CHAN_DISABLED)
3046                                 continue;
3047
3048                         request->channels[i] = chan;
3049                         i++;
3050                 }
3051         } else {
3052                 /* all channels */
3053                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3054                         int j;
3055                         if (!wiphy->bands[band])
3056                                 continue;
3057                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3058                                 struct ieee80211_channel *chan;
3059
3060                                 chan = &wiphy->bands[band]->channels[j];
3061
3062                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
3063                                         continue;
3064
3065                                 request->channels[i] = chan;
3066                                 i++;
3067                         }
3068                 }
3069         }
3070
3071         if (!i) {
3072                 err = -EINVAL;
3073                 goto out_free;
3074         }
3075
3076         request->n_channels = i;
3077
3078         i = 0;
3079         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3080                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
3081                         request->ssids[i].ssid_len = nla_len(attr);
3082                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
3083                                 err = -EINVAL;
3084                                 goto out_free;
3085                         }
3086                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
3087                         i++;
3088                 }
3089         }
3090
3091         if (info->attrs[NL80211_ATTR_IE]) {
3092                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3093                 memcpy((void *)request->ie,
3094                        nla_data(info->attrs[NL80211_ATTR_IE]),
3095                        request->ie_len);
3096         }
3097
3098         request->dev = dev;
3099         request->wiphy = &rdev->wiphy;
3100
3101         rdev->scan_req = request;
3102         err = rdev->ops->scan(&rdev->wiphy, dev, request);
3103
3104         if (!err) {
3105                 nl80211_send_scan_start(rdev, dev);
3106                 dev_hold(dev);
3107         }
3108
3109  out_free:
3110         if (err) {
3111                 rdev->scan_req = NULL;
3112                 kfree(request);
3113         }
3114  out:
3115         cfg80211_unlock_rdev(rdev);
3116         dev_put(dev);
3117  out_rtnl:
3118         rtnl_unlock();
3119
3120         return err;
3121 }
3122
3123 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
3124                             struct cfg80211_registered_device *rdev,
3125                             struct wireless_dev *wdev,
3126                             struct cfg80211_internal_bss *intbss)
3127 {
3128         struct cfg80211_bss *res = &intbss->pub;
3129         void *hdr;
3130         struct nlattr *bss;
3131         int i;
3132
3133         ASSERT_WDEV_LOCK(wdev);
3134
3135         hdr = nl80211hdr_put(msg, pid, seq, flags,
3136                              NL80211_CMD_NEW_SCAN_RESULTS);
3137         if (!hdr)
3138                 return -1;
3139
3140         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation);
3141         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex);
3142
3143         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
3144         if (!bss)
3145                 goto nla_put_failure;
3146         if (!is_zero_ether_addr(res->bssid))
3147                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
3148         if (res->information_elements && res->len_information_elements)
3149                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
3150                         res->len_information_elements,
3151                         res->information_elements);
3152         if (res->tsf)
3153                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
3154         if (res->beacon_interval)
3155                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
3156         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
3157         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
3158         NLA_PUT_U32(msg, NL80211_BSS_SEEN_MS_AGO,
3159                 jiffies_to_msecs(jiffies - intbss->ts));
3160
3161         switch (rdev->wiphy.signal_type) {
3162         case CFG80211_SIGNAL_TYPE_MBM:
3163                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
3164                 break;
3165         case CFG80211_SIGNAL_TYPE_UNSPEC:
3166                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
3167                 break;
3168         default:
3169                 break;
3170         }
3171
3172         switch (wdev->iftype) {
3173         case NL80211_IFTYPE_STATION:
3174                 if (intbss == wdev->current_bss)
3175                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3176                                     NL80211_BSS_STATUS_ASSOCIATED);
3177                 else for (i = 0; i < MAX_AUTH_BSSES; i++) {
3178                         if (intbss != wdev->auth_bsses[i])
3179                                 continue;
3180                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3181                                     NL80211_BSS_STATUS_AUTHENTICATED);
3182                         break;
3183                 }
3184                 break;
3185         case NL80211_IFTYPE_ADHOC:
3186                 if (intbss == wdev->current_bss)
3187                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3188                                     NL80211_BSS_STATUS_IBSS_JOINED);
3189                 break;
3190         default:
3191                 break;
3192         }
3193
3194         nla_nest_end(msg, bss);
3195
3196         return genlmsg_end(msg, hdr);
3197
3198  nla_put_failure:
3199         genlmsg_cancel(msg, hdr);
3200         return -EMSGSIZE;
3201 }
3202
3203 static int nl80211_dump_scan(struct sk_buff *skb,
3204                              struct netlink_callback *cb)
3205 {
3206         struct cfg80211_registered_device *rdev;
3207         struct net_device *dev;
3208         struct cfg80211_internal_bss *scan;
3209         struct wireless_dev *wdev;
3210         int ifidx = cb->args[0];
3211         int start = cb->args[1], idx = 0;
3212         int err;
3213
3214         if (!ifidx)
3215                 ifidx = nl80211_get_ifidx(cb);
3216         if (ifidx < 0)
3217                 return ifidx;
3218         cb->args[0] = ifidx;
3219
3220         dev = dev_get_by_index(sock_net(skb->sk), ifidx);
3221         if (!dev)
3222                 return -ENODEV;
3223
3224         rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
3225         if (IS_ERR(rdev)) {
3226                 err = PTR_ERR(rdev);
3227                 goto out_put_netdev;
3228         }
3229
3230         wdev = dev->ieee80211_ptr;
3231
3232         wdev_lock(wdev);
3233         spin_lock_bh(&rdev->bss_lock);
3234         cfg80211_bss_expire(rdev);
3235
3236         list_for_each_entry(scan, &rdev->bss_list, list) {
3237                 if (++idx <= start)
3238                         continue;
3239                 if (nl80211_send_bss(skb,
3240                                 NETLINK_CB(cb->skb).pid,
3241                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3242                                 rdev, wdev, scan) < 0) {
3243                         idx--;
3244                         goto out;
3245                 }
3246         }
3247
3248  out:
3249         spin_unlock_bh(&rdev->bss_lock);
3250         wdev_unlock(wdev);
3251
3252         cb->args[1] = idx;
3253         err = skb->len;
3254         cfg80211_unlock_rdev(rdev);
3255  out_put_netdev:
3256         dev_put(dev);
3257
3258         return err;
3259 }
3260
3261 static int nl80211_send_survey(struct sk_buff *msg, u32 pid, u32 seq,
3262                                 int flags, struct net_device *dev,
3263                                 struct survey_info *survey)
3264 {
3265         void *hdr;
3266         struct nlattr *infoattr;
3267
3268         /* Survey without a channel doesn't make sense */
3269         if (!survey->channel)
3270                 return -EINVAL;
3271
3272         hdr = nl80211hdr_put(msg, pid, seq, flags,
3273                              NL80211_CMD_NEW_SURVEY_RESULTS);
3274         if (!hdr)
3275                 return -ENOMEM;
3276
3277         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
3278
3279         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
3280         if (!infoattr)
3281                 goto nla_put_failure;
3282
3283         NLA_PUT_U32(msg, NL80211_SURVEY_INFO_FREQUENCY,
3284                     survey->channel->center_freq);
3285         if (survey->filled & SURVEY_INFO_NOISE_DBM)
3286                 NLA_PUT_U8(msg, NL80211_SURVEY_INFO_NOISE,
3287                             survey->noise);
3288
3289         nla_nest_end(msg, infoattr);
3290
3291         return genlmsg_end(msg, hdr);
3292
3293  nla_put_failure:
3294         genlmsg_cancel(msg, hdr);
3295         return -EMSGSIZE;
3296 }
3297
3298 static int nl80211_dump_survey(struct sk_buff *skb,
3299                         struct netlink_callback *cb)
3300 {
3301         struct survey_info survey;
3302         struct cfg80211_registered_device *dev;
3303         struct net_device *netdev;
3304         int ifidx = cb->args[0];
3305         int survey_idx = cb->args[1];
3306         int res;
3307
3308         if (!ifidx)
3309                 ifidx = nl80211_get_ifidx(cb);
3310         if (ifidx < 0)
3311                 return ifidx;
3312         cb->args[0] = ifidx;
3313
3314         rtnl_lock();
3315
3316         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
3317         if (!netdev) {
3318                 res = -ENODEV;
3319                 goto out_rtnl;
3320         }
3321
3322         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
3323         if (IS_ERR(dev)) {
3324                 res = PTR_ERR(dev);
3325                 goto out_rtnl;
3326         }
3327
3328         if (!dev->ops->dump_survey) {
3329                 res = -EOPNOTSUPP;
3330                 goto out_err;
3331         }
3332
3333         while (1) {
3334                 res = dev->ops->dump_survey(&dev->wiphy, netdev, survey_idx,
3335                                             &survey);
3336                 if (res == -ENOENT)
3337                         break;
3338                 if (res)
3339                         goto out_err;
3340
3341                 if (nl80211_send_survey(skb,
3342                                 NETLINK_CB(cb->skb).pid,
3343                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3344                                 netdev,
3345                                 &survey) < 0)
3346                         goto out;
3347                 survey_idx++;
3348         }
3349
3350  out:
3351         cb->args[1] = survey_idx;
3352         res = skb->len;
3353  out_err:
3354         cfg80211_unlock_rdev(dev);
3355  out_rtnl:
3356         rtnl_unlock();
3357
3358         return res;
3359 }
3360
3361 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
3362 {
3363         return auth_type <= NL80211_AUTHTYPE_MAX;
3364 }
3365
3366 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
3367 {
3368         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
3369                                   NL80211_WPA_VERSION_2));
3370 }
3371
3372 static bool nl80211_valid_akm_suite(u32 akm)
3373 {
3374         return akm == WLAN_AKM_SUITE_8021X ||
3375                 akm == WLAN_AKM_SUITE_PSK;
3376 }
3377
3378 static bool nl80211_valid_cipher_suite(u32 cipher)
3379 {
3380         return cipher == WLAN_CIPHER_SUITE_WEP40 ||
3381                 cipher == WLAN_CIPHER_SUITE_WEP104 ||
3382                 cipher == WLAN_CIPHER_SUITE_TKIP ||
3383                 cipher == WLAN_CIPHER_SUITE_CCMP ||
3384                 cipher == WLAN_CIPHER_SUITE_AES_CMAC;
3385 }
3386
3387
3388 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
3389 {
3390         struct cfg80211_registered_device *rdev;
3391         struct net_device *dev;
3392         struct ieee80211_channel *chan;
3393         const u8 *bssid, *ssid, *ie = NULL;
3394         int err, ssid_len, ie_len = 0;
3395         enum nl80211_auth_type auth_type;
3396         struct key_parse key;
3397
3398         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3399                 return -EINVAL;
3400
3401         if (!info->attrs[NL80211_ATTR_MAC])
3402                 return -EINVAL;
3403
3404         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
3405                 return -EINVAL;
3406
3407         if (!info->attrs[NL80211_ATTR_SSID])
3408                 return -EINVAL;
3409
3410         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
3411                 return -EINVAL;
3412
3413         err = nl80211_parse_key(info, &key);
3414         if (err)
3415                 return err;
3416
3417         if (key.idx >= 0) {
3418                 if (!key.p.key || !key.p.key_len)
3419                         return -EINVAL;
3420                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
3421                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
3422                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
3423                      key.p.key_len != WLAN_KEY_LEN_WEP104))
3424                         return -EINVAL;
3425                 if (key.idx > 4)
3426                         return -EINVAL;
3427         } else {
3428                 key.p.key_len = 0;
3429                 key.p.key = NULL;
3430         }
3431
3432         rtnl_lock();
3433
3434         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3435         if (err)
3436                 goto unlock_rtnl;
3437
3438         if (!rdev->ops->auth) {
3439                 err = -EOPNOTSUPP;
3440                 goto out;
3441         }
3442
3443         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3444                 err = -EOPNOTSUPP;
3445                 goto out;
3446         }
3447
3448         if (!netif_running(dev)) {
3449                 err = -ENETDOWN;
3450                 goto out;
3451         }
3452
3453         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3454         chan = ieee80211_get_channel(&rdev->wiphy,
3455                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3456         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED)) {
3457                 err = -EINVAL;
3458                 goto out;
3459         }
3460
3461         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3462         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3463
3464         if (info->attrs[NL80211_ATTR_IE]) {
3465                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3466                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3467         }
3468
3469         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
3470         if (!nl80211_valid_auth_type(auth_type)) {
3471                 err = -EINVAL;
3472                 goto out;
3473         }
3474
3475         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
3476                                  ssid, ssid_len, ie, ie_len,
3477                                  key.p.key, key.p.key_len, key.idx);
3478
3479 out:
3480         cfg80211_unlock_rdev(rdev);
3481         dev_put(dev);
3482 unlock_rtnl:
3483         rtnl_unlock();
3484         return err;
3485 }
3486
3487 static int nl80211_crypto_settings(struct genl_info *info,
3488                                    struct cfg80211_crypto_settings *settings,
3489                                    int cipher_limit)
3490 {
3491         memset(settings, 0, sizeof(*settings));
3492
3493         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
3494
3495         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
3496                 void *data;
3497                 int len, i;
3498
3499                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3500                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3501                 settings->n_ciphers_pairwise = len / sizeof(u32);
3502
3503                 if (len % sizeof(u32))
3504                         return -EINVAL;
3505
3506                 if (settings->n_ciphers_pairwise > cipher_limit)
3507                         return -EINVAL;
3508
3509                 memcpy(settings->ciphers_pairwise, data, len);
3510
3511                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3512                         if (!nl80211_valid_cipher_suite(
3513                                         settings->ciphers_pairwise[i]))
3514                                 return -EINVAL;
3515         }
3516
3517         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
3518                 settings->cipher_group =
3519                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
3520                 if (!nl80211_valid_cipher_suite(settings->cipher_group))
3521                         return -EINVAL;
3522         }
3523
3524         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
3525                 settings->wpa_versions =
3526                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
3527                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
3528                         return -EINVAL;
3529         }
3530
3531         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
3532                 void *data;
3533                 int len, i;
3534
3535                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
3536                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
3537                 settings->n_akm_suites = len / sizeof(u32);
3538
3539                 if (len % sizeof(u32))
3540                         return -EINVAL;
3541
3542                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
3543                         return -EINVAL;
3544
3545                 memcpy(settings->akm_suites, data, len);
3546
3547                 for (i = 0; i < settings->n_akm_suites; i++)
3548                         if (!nl80211_valid_akm_suite(settings->akm_suites[i]))
3549                                 return -EINVAL;
3550         }
3551
3552         return 0;
3553 }
3554
3555 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
3556 {
3557         struct cfg80211_registered_device *rdev;
3558         struct net_device *dev;
3559         struct cfg80211_crypto_settings crypto;
3560         struct ieee80211_channel *chan, *fixedchan;
3561         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
3562         int err, ssid_len, ie_len = 0;
3563         bool use_mfp = false;
3564
3565         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3566                 return -EINVAL;
3567
3568         if (!info->attrs[NL80211_ATTR_MAC] ||
3569             !info->attrs[NL80211_ATTR_SSID] ||
3570             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
3571                 return -EINVAL;
3572
3573         rtnl_lock();
3574
3575         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3576         if (err)
3577                 goto unlock_rtnl;
3578
3579         if (!rdev->ops->assoc) {
3580                 err = -EOPNOTSUPP;
3581                 goto out;
3582         }
3583
3584         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3585                 err = -EOPNOTSUPP;
3586                 goto out;
3587         }
3588
3589         if (!netif_running(dev)) {
3590                 err = -ENETDOWN;
3591                 goto out;
3592         }
3593
3594         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3595
3596         chan = ieee80211_get_channel(&rdev->wiphy,
3597                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3598         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED)) {
3599                 err = -EINVAL;
3600                 goto out;
3601         }
3602
3603         mutex_lock(&rdev->devlist_mtx);
3604         fixedchan = rdev_fixed_channel(rdev, NULL);
3605         if (fixedchan && chan != fixedchan) {
3606                 err = -EBUSY;
3607                 mutex_unlock(&rdev->devlist_mtx);
3608                 goto out;
3609         }
3610         mutex_unlock(&rdev->devlist_mtx);
3611
3612         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3613         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3614
3615         if (info->attrs[NL80211_ATTR_IE]) {
3616                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3617                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3618         }
3619
3620         if (info->attrs[NL80211_ATTR_USE_MFP]) {
3621                 enum nl80211_mfp mfp =
3622                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
3623                 if (mfp == NL80211_MFP_REQUIRED)
3624                         use_mfp = true;
3625                 else if (mfp != NL80211_MFP_NO) {
3626                         err = -EINVAL;
3627                         goto out;
3628                 }
3629         }
3630
3631         if (info->attrs[NL80211_ATTR_PREV_BSSID])
3632                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
3633
3634         err = nl80211_crypto_settings(info, &crypto, 1);
3635         if (!err)
3636                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
3637                                           ssid, ssid_len, ie, ie_len, use_mfp,
3638                                           &crypto);
3639
3640 out:
3641         cfg80211_unlock_rdev(rdev);
3642         dev_put(dev);
3643 unlock_rtnl:
3644         rtnl_unlock();
3645         return err;
3646 }
3647
3648 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
3649 {
3650         struct cfg80211_registered_device *rdev;
3651         struct net_device *dev;
3652         const u8 *ie = NULL, *bssid;
3653         int err, ie_len = 0;
3654         u16 reason_code;
3655
3656         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3657                 return -EINVAL;
3658
3659         if (!info->attrs[NL80211_ATTR_MAC])
3660                 return -EINVAL;
3661
3662         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3663                 return -EINVAL;
3664
3665         rtnl_lock();
3666
3667         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3668         if (err)
3669                 goto unlock_rtnl;
3670
3671         if (!rdev->ops->deauth) {
3672                 err = -EOPNOTSUPP;
3673                 goto out;
3674         }
3675
3676         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3677                 err = -EOPNOTSUPP;
3678                 goto out;
3679         }
3680
3681         if (!netif_running(dev)) {
3682                 err = -ENETDOWN;
3683                 goto out;
3684         }
3685
3686         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3687
3688         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3689         if (reason_code == 0) {
3690                 /* Reason Code 0 is reserved */
3691                 err = -EINVAL;
3692                 goto out;
3693         }
3694
3695         if (info->attrs[NL80211_ATTR_IE]) {
3696                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3697                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3698         }
3699
3700         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code);
3701
3702 out:
3703         cfg80211_unlock_rdev(rdev);
3704         dev_put(dev);
3705 unlock_rtnl:
3706         rtnl_unlock();
3707         return err;
3708 }
3709
3710 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
3711 {
3712         struct cfg80211_registered_device *rdev;
3713         struct net_device *dev;
3714         const u8 *ie = NULL, *bssid;
3715         int err, ie_len = 0;
3716         u16 reason_code;
3717
3718         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3719                 return -EINVAL;
3720
3721         if (!info->attrs[NL80211_ATTR_MAC])
3722                 return -EINVAL;
3723
3724         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3725                 return -EINVAL;
3726
3727         rtnl_lock();
3728
3729         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3730         if (err)
3731                 goto unlock_rtnl;
3732
3733         if (!rdev->ops->disassoc) {
3734                 err = -EOPNOTSUPP;
3735                 goto out;
3736         }
3737
3738         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3739                 err = -EOPNOTSUPP;
3740                 goto out;
3741         }
3742
3743         if (!netif_running(dev)) {
3744                 err = -ENETDOWN;
3745                 goto out;
3746         }
3747
3748         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3749
3750         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3751         if (reason_code == 0) {
3752                 /* Reason Code 0 is reserved */
3753                 err = -EINVAL;
3754                 goto out;
3755         }
3756
3757         if (info->attrs[NL80211_ATTR_IE]) {
3758                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3759                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3760         }
3761
3762         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code);
3763
3764 out:
3765         cfg80211_unlock_rdev(rdev);
3766         dev_put(dev);
3767 unlock_rtnl:
3768         rtnl_unlock();
3769         return err;
3770 }
3771
3772 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
3773 {
3774         struct cfg80211_registered_device *rdev;
3775         struct net_device *dev;
3776         struct cfg80211_ibss_params ibss;
3777         struct wiphy *wiphy;
3778         struct cfg80211_cached_keys *connkeys = NULL;
3779         int err;
3780
3781         memset(&ibss, 0, sizeof(ibss));
3782
3783         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3784                 return -EINVAL;
3785
3786         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
3787             !info->attrs[NL80211_ATTR_SSID] ||
3788             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3789                 return -EINVAL;
3790
3791         ibss.beacon_interval = 100;
3792
3793         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
3794                 ibss.beacon_interval =
3795                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3796                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
3797                         return -EINVAL;
3798         }
3799
3800         rtnl_lock();
3801
3802         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3803         if (err)
3804                 goto unlock_rtnl;
3805
3806         if (!rdev->ops->join_ibss) {
3807                 err = -EOPNOTSUPP;
3808                 goto out;
3809         }
3810
3811         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3812                 err = -EOPNOTSUPP;
3813                 goto out;
3814         }
3815
3816         if (!netif_running(dev)) {
3817                 err = -ENETDOWN;
3818                 goto out;
3819         }
3820
3821         wiphy = &rdev->wiphy;
3822
3823         if (info->attrs[NL80211_ATTR_MAC])
3824                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3825         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3826         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3827
3828         if (info->attrs[NL80211_ATTR_IE]) {
3829                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3830                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3831         }
3832
3833         ibss.channel = ieee80211_get_channel(wiphy,
3834                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3835         if (!ibss.channel ||
3836             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
3837             ibss.channel->flags & IEEE80211_CHAN_DISABLED) {
3838                 err = -EINVAL;
3839                 goto out;
3840         }
3841
3842         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
3843         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3844
3845         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
3846                 connkeys = nl80211_parse_connkeys(rdev,
3847                                         info->attrs[NL80211_ATTR_KEYS]);
3848                 if (IS_ERR(connkeys)) {
3849                         err = PTR_ERR(connkeys);
3850                         connkeys = NULL;
3851                         goto out;
3852                 }
3853         }
3854
3855         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
3856
3857 out:
3858         cfg80211_unlock_rdev(rdev);
3859         dev_put(dev);
3860 unlock_rtnl:
3861         if (err)
3862                 kfree(connkeys);
3863         rtnl_unlock();
3864         return err;
3865 }
3866
3867 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
3868 {
3869         struct cfg80211_registered_device *rdev;
3870         struct net_device *dev;
3871         int err;
3872
3873         rtnl_lock();
3874
3875         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3876         if (err)
3877                 goto unlock_rtnl;
3878
3879         if (!rdev->ops->leave_ibss) {
3880                 err = -EOPNOTSUPP;
3881                 goto out;
3882         }
3883
3884         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3885                 err = -EOPNOTSUPP;
3886                 goto out;
3887         }
3888
3889         if (!netif_running(dev)) {
3890                 err = -ENETDOWN;
3891                 goto out;
3892         }
3893
3894         err = cfg80211_leave_ibss(rdev, dev, false);
3895
3896 out:
3897         cfg80211_unlock_rdev(rdev);
3898         dev_put(dev);
3899 unlock_rtnl:
3900         rtnl_unlock();
3901         return err;
3902 }
3903
3904 #ifdef CONFIG_NL80211_TESTMODE
3905 static struct genl_multicast_group nl80211_testmode_mcgrp = {
3906         .name = "testmode",
3907 };
3908
3909 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
3910 {
3911         struct cfg80211_registered_device *rdev;
3912         int err;
3913
3914         if (!info->attrs[NL80211_ATTR_TESTDATA])
3915                 return -EINVAL;
3916
3917         rtnl_lock();
3918
3919         rdev = cfg80211_get_dev_from_info(info);
3920         if (IS_ERR(rdev)) {
3921                 err = PTR_ERR(rdev);
3922                 goto unlock_rtnl;
3923         }
3924
3925         err = -EOPNOTSUPP;
3926         if (rdev->ops->testmode_cmd) {
3927                 rdev->testmode_info = info;
3928                 err = rdev->ops->testmode_cmd(&rdev->wiphy,
3929                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
3930                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
3931                 rdev->testmode_info = NULL;
3932         }
3933
3934         cfg80211_unlock_rdev(rdev);
3935
3936  unlock_rtnl:
3937         rtnl_unlock();
3938         return err;
3939 }
3940
3941 static struct sk_buff *
3942 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
3943                               int approxlen, u32 pid, u32 seq, gfp_t gfp)
3944 {
3945         struct sk_buff *skb;
3946         void *hdr;
3947         struct nlattr *data;
3948
3949         skb = nlmsg_new(approxlen + 100, gfp);
3950         if (!skb)
3951                 return NULL;
3952
3953         hdr = nl80211hdr_put(skb, pid, seq, 0, NL80211_CMD_TESTMODE);
3954         if (!hdr) {
3955                 kfree_skb(skb);
3956                 return NULL;
3957         }
3958
3959         NLA_PUT_U32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3960         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
3961
3962         ((void **)skb->cb)[0] = rdev;
3963         ((void **)skb->cb)[1] = hdr;
3964         ((void **)skb->cb)[2] = data;
3965
3966         return skb;
3967
3968  nla_put_failure:
3969         kfree_skb(skb);
3970         return NULL;
3971 }
3972
3973 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
3974                                                   int approxlen)
3975 {
3976         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
3977
3978         if (WARN_ON(!rdev->testmode_info))
3979                 return NULL;
3980
3981         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
3982                                 rdev->testmode_info->snd_pid,
3983                                 rdev->testmode_info->snd_seq,
3984                                 GFP_KERNEL);
3985 }
3986 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
3987
3988 int cfg80211_testmode_reply(struct sk_buff *skb)
3989 {
3990         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
3991         void *hdr = ((void **)skb->cb)[1];
3992         struct nlattr *data = ((void **)skb->cb)[2];
3993
3994         if (WARN_ON(!rdev->testmode_info)) {
3995                 kfree_skb(skb);
3996                 return -EINVAL;
3997         }
3998
3999         nla_nest_end(skb, data);
4000         genlmsg_end(skb, hdr);
4001         return genlmsg_reply(skb, rdev->testmode_info);
4002 }
4003 EXPORT_SYMBOL(cfg80211_testmode_reply);
4004
4005 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
4006                                                   int approxlen, gfp_t gfp)
4007 {
4008         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
4009
4010         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
4011 }
4012 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
4013
4014 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
4015 {
4016         void *hdr = ((void **)skb->cb)[1];
4017         struct nlattr *data = ((void **)skb->cb)[2];
4018
4019         nla_nest_end(skb, data);
4020         genlmsg_end(skb, hdr);
4021         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
4022 }
4023 EXPORT_SYMBOL(cfg80211_testmode_event);
4024 #endif
4025
4026 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
4027 {
4028         struct cfg80211_registered_device *rdev;
4029         struct net_device *dev;
4030         struct cfg80211_connect_params connect;
4031         struct wiphy *wiphy;
4032         struct cfg80211_cached_keys *connkeys = NULL;
4033         int err;
4034
4035         memset(&connect, 0, sizeof(connect));
4036
4037         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4038                 return -EINVAL;
4039
4040         if (!info->attrs[NL80211_ATTR_SSID] ||
4041             !nla_len(info->attrs[NL80211_ATTR_SSID]))
4042                 return -EINVAL;
4043
4044         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
4045                 connect.auth_type =
4046                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
4047                 if (!nl80211_valid_auth_type(connect.auth_type))
4048                         return -EINVAL;
4049         } else
4050                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
4051
4052         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
4053
4054         err = nl80211_crypto_settings(info, &connect.crypto,
4055                                       NL80211_MAX_NR_CIPHER_SUITES);
4056         if (err)
4057                 return err;
4058         rtnl_lock();
4059
4060         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4061         if (err)
4062                 goto unlock_rtnl;
4063
4064         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4065                 err = -EOPNOTSUPP;
4066                 goto out;
4067         }
4068
4069         if (!netif_running(dev)) {
4070                 err = -ENETDOWN;
4071                 goto out;
4072         }
4073
4074         wiphy = &rdev->wiphy;
4075
4076         if (info->attrs[NL80211_ATTR_MAC])
4077                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4078         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4079         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4080
4081         if (info->attrs[NL80211_ATTR_IE]) {
4082                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4083                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4084         }
4085
4086         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4087                 connect.channel =
4088                         ieee80211_get_channel(wiphy,
4089                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4090                 if (!connect.channel ||
4091                     connect.channel->flags & IEEE80211_CHAN_DISABLED) {
4092                         err = -EINVAL;
4093                         goto out;
4094                 }
4095         }
4096
4097         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
4098                 connkeys = nl80211_parse_connkeys(rdev,
4099                                         info->attrs[NL80211_ATTR_KEYS]);
4100                 if (IS_ERR(connkeys)) {
4101                         err = PTR_ERR(connkeys);
4102                         connkeys = NULL;
4103                         goto out;
4104                 }
4105         }
4106
4107         err = cfg80211_connect(rdev, dev, &connect, connkeys);
4108
4109 out:
4110         cfg80211_unlock_rdev(rdev);
4111         dev_put(dev);
4112 unlock_rtnl:
4113         if (err)
4114                 kfree(connkeys);
4115         rtnl_unlock();
4116         return err;
4117 }
4118
4119 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
4120 {
4121         struct cfg80211_registered_device *rdev;
4122         struct net_device *dev;
4123         int err;
4124         u16 reason;
4125
4126         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4127                 reason = WLAN_REASON_DEAUTH_LEAVING;
4128         else
4129                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4130
4131         if (reason == 0)
4132                 return -EINVAL;
4133
4134         rtnl_lock();
4135
4136         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4137         if (err)
4138                 goto unlock_rtnl;
4139
4140         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4141                 err = -EOPNOTSUPP;
4142                 goto out;
4143         }
4144
4145         if (!netif_running(dev)) {
4146                 err = -ENETDOWN;
4147                 goto out;
4148         }
4149
4150         err = cfg80211_disconnect(rdev, dev, reason, true);
4151
4152 out:
4153         cfg80211_unlock_rdev(rdev);
4154         dev_put(dev);
4155 unlock_rtnl:
4156         rtnl_unlock();
4157         return err;
4158 }
4159
4160 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
4161 {
4162         struct cfg80211_registered_device *rdev;
4163         struct net *net;
4164         int err;
4165         u32 pid;
4166
4167         if (!info->attrs[NL80211_ATTR_PID])
4168                 return -EINVAL;
4169
4170         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
4171
4172         rtnl_lock();
4173
4174         rdev = cfg80211_get_dev_from_info(info);
4175         if (IS_ERR(rdev)) {
4176                 err = PTR_ERR(rdev);
4177                 goto out_rtnl;
4178         }
4179
4180         net = get_net_ns_by_pid(pid);
4181         if (IS_ERR(net)) {
4182                 err = PTR_ERR(net);
4183                 goto out;
4184         }
4185
4186         err = 0;
4187
4188         /* check if anything to do */
4189         if (net_eq(wiphy_net(&rdev->wiphy), net))
4190                 goto out_put_net;
4191
4192         err = cfg80211_switch_netns(rdev, net);
4193  out_put_net:
4194         put_net(net);
4195  out:
4196         cfg80211_unlock_rdev(rdev);
4197  out_rtnl:
4198         rtnl_unlock();
4199         return err;
4200 }
4201
4202 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
4203 {
4204         struct cfg80211_registered_device *rdev;
4205         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
4206                         struct cfg80211_pmksa *pmksa) = NULL;
4207         int err;
4208         struct net_device *dev;
4209         struct cfg80211_pmksa pmksa;
4210
4211         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
4212
4213         if (!info->attrs[NL80211_ATTR_MAC])
4214                 return -EINVAL;
4215
4216         if (!info->attrs[NL80211_ATTR_PMKID])
4217                 return -EINVAL;
4218
4219         rtnl_lock();
4220
4221         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4222         if (err)
4223                 goto out_rtnl;
4224
4225         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
4226         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4227
4228         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4229                 err = -EOPNOTSUPP;
4230                 goto out;
4231         }
4232
4233         switch (info->genlhdr->cmd) {
4234         case NL80211_CMD_SET_PMKSA:
4235                 rdev_ops = rdev->ops->set_pmksa;
4236                 break;
4237         case NL80211_CMD_DEL_PMKSA:
4238                 rdev_ops = rdev->ops->del_pmksa;
4239                 break;
4240         default:
4241                 WARN_ON(1);
4242                 break;
4243         }
4244
4245         if (!rdev_ops) {
4246                 err = -EOPNOTSUPP;
4247                 goto out;
4248         }
4249
4250         err = rdev_ops(&rdev->wiphy, dev, &pmksa);
4251
4252  out:
4253         cfg80211_unlock_rdev(rdev);
4254         dev_put(dev);
4255  out_rtnl:
4256         rtnl_unlock();
4257
4258         return err;
4259 }
4260
4261 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
4262 {
4263         struct cfg80211_registered_device *rdev;
4264         int err;
4265         struct net_device *dev;
4266
4267         rtnl_lock();
4268
4269         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4270         if (err)
4271                 goto out_rtnl;
4272
4273         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4274                 err = -EOPNOTSUPP;
4275                 goto out;
4276         }
4277
4278         if (!rdev->ops->flush_pmksa) {
4279                 err = -EOPNOTSUPP;
4280                 goto out;
4281         }
4282
4283         err = rdev->ops->flush_pmksa(&rdev->wiphy, dev);
4284
4285  out:
4286         cfg80211_unlock_rdev(rdev);
4287         dev_put(dev);
4288  out_rtnl:
4289         rtnl_unlock();
4290
4291         return err;
4292
4293 }
4294
4295 static struct genl_ops nl80211_ops[] = {
4296         {
4297                 .cmd = NL80211_CMD_GET_WIPHY,
4298                 .doit = nl80211_get_wiphy,
4299                 .dumpit = nl80211_dump_wiphy,
4300                 .policy = nl80211_policy,
4301                 /* can be retrieved by unprivileged users */
4302         },
4303         {
4304                 .cmd = NL80211_CMD_SET_WIPHY,
4305                 .doit = nl80211_set_wiphy,
4306                 .policy = nl80211_policy,
4307                 .flags = GENL_ADMIN_PERM,
4308         },
4309         {
4310                 .cmd = NL80211_CMD_GET_INTERFACE,
4311                 .doit = nl80211_get_interface,
4312                 .dumpit = nl80211_dump_interface,
4313                 .policy = nl80211_policy,
4314                 /* can be retrieved by unprivileged users */
4315         },
4316         {
4317                 .cmd = NL80211_CMD_SET_INTERFACE,
4318                 .doit = nl80211_set_interface,
4319                 .policy = nl80211_policy,
4320                 .flags = GENL_ADMIN_PERM,
4321         },
4322         {
4323                 .cmd = NL80211_CMD_NEW_INTERFACE,
4324                 .doit = nl80211_new_interface,
4325                 .policy = nl80211_policy,
4326                 .flags = GENL_ADMIN_PERM,
4327         },
4328         {
4329                 .cmd = NL80211_CMD_DEL_INTERFACE,
4330                 .doit = nl80211_del_interface,
4331                 .policy = nl80211_policy,
4332                 .flags = GENL_ADMIN_PERM,
4333         },
4334         {
4335                 .cmd = NL80211_CMD_GET_KEY,
4336                 .doit = nl80211_get_key,
4337                 .policy = nl80211_policy,
4338                 .flags = GENL_ADMIN_PERM,
4339         },
4340         {
4341                 .cmd = NL80211_CMD_SET_KEY,
4342                 .doit = nl80211_set_key,
4343                 .policy = nl80211_policy,
4344                 .flags = GENL_ADMIN_PERM,
4345         },
4346         {
4347                 .cmd = NL80211_CMD_NEW_KEY,
4348                 .doit = nl80211_new_key,
4349                 .policy = nl80211_policy,
4350                 .flags = GENL_ADMIN_PERM,
4351         },
4352         {
4353                 .cmd = NL80211_CMD_DEL_KEY,
4354                 .doit = nl80211_del_key,
4355                 .policy = nl80211_policy,
4356                 .flags = GENL_ADMIN_PERM,
4357         },
4358         {
4359                 .cmd = NL80211_CMD_SET_BEACON,
4360                 .policy = nl80211_policy,
4361                 .flags = GENL_ADMIN_PERM,
4362                 .doit = nl80211_addset_beacon,
4363         },
4364         {
4365                 .cmd = NL80211_CMD_NEW_BEACON,
4366                 .policy = nl80211_policy,
4367                 .flags = GENL_ADMIN_PERM,
4368                 .doit = nl80211_addset_beacon,
4369         },
4370         {
4371                 .cmd = NL80211_CMD_DEL_BEACON,
4372                 .policy = nl80211_policy,
4373                 .flags = GENL_ADMIN_PERM,
4374                 .doit = nl80211_del_beacon,
4375         },
4376         {
4377                 .cmd = NL80211_CMD_GET_STATION,
4378                 .doit = nl80211_get_station,
4379                 .dumpit = nl80211_dump_station,
4380                 .policy = nl80211_policy,
4381         },
4382         {
4383                 .cmd = NL80211_CMD_SET_STATION,
4384                 .doit = nl80211_set_station,
4385                 .policy = nl80211_policy,
4386                 .flags = GENL_ADMIN_PERM,
4387         },
4388         {
4389                 .cmd = NL80211_CMD_NEW_STATION,
4390                 .doit = nl80211_new_station,
4391                 .policy = nl80211_policy,
4392                 .flags = GENL_ADMIN_PERM,
4393         },
4394         {
4395                 .cmd = NL80211_CMD_DEL_STATION,
4396                 .doit = nl80211_del_station,
4397                 .policy = nl80211_policy,
4398                 .flags = GENL_ADMIN_PERM,
4399         },
4400         {
4401                 .cmd = NL80211_CMD_GET_MPATH,
4402                 .doit = nl80211_get_mpath,
4403                 .dumpit = nl80211_dump_mpath,
4404                 .policy = nl80211_policy,
4405                 .flags = GENL_ADMIN_PERM,
4406         },
4407         {
4408                 .cmd = NL80211_CMD_SET_MPATH,
4409                 .doit = nl80211_set_mpath,
4410                 .policy = nl80211_policy,
4411                 .flags = GENL_ADMIN_PERM,
4412         },
4413         {
4414                 .cmd = NL80211_CMD_NEW_MPATH,
4415                 .doit = nl80211_new_mpath,
4416                 .policy = nl80211_policy,
4417                 .flags = GENL_ADMIN_PERM,
4418         },
4419         {
4420                 .cmd = NL80211_CMD_DEL_MPATH,
4421                 .doit = nl80211_del_mpath,
4422                 .policy = nl80211_policy,
4423                 .flags = GENL_ADMIN_PERM,
4424         },
4425         {
4426                 .cmd = NL80211_CMD_SET_BSS,
4427                 .doit = nl80211_set_bss,
4428                 .policy = nl80211_policy,
4429                 .flags = GENL_ADMIN_PERM,
4430         },
4431         {
4432                 .cmd = NL80211_CMD_GET_REG,
4433                 .doit = nl80211_get_reg,
4434                 .policy = nl80211_policy,
4435                 /* can be retrieved by unprivileged users */
4436         },
4437         {
4438                 .cmd = NL80211_CMD_SET_REG,
4439                 .doit = nl80211_set_reg,
4440                 .policy = nl80211_policy,
4441                 .flags = GENL_ADMIN_PERM,
4442         },
4443         {
4444                 .cmd = NL80211_CMD_REQ_SET_REG,
4445                 .doit = nl80211_req_set_reg,
4446                 .policy = nl80211_policy,
4447                 .flags = GENL_ADMIN_PERM,
4448         },
4449         {
4450                 .cmd = NL80211_CMD_GET_MESH_PARAMS,
4451                 .doit = nl80211_get_mesh_params,
4452                 .policy = nl80211_policy,
4453                 /* can be retrieved by unprivileged users */
4454         },
4455         {
4456                 .cmd = NL80211_CMD_SET_MESH_PARAMS,
4457                 .doit = nl80211_set_mesh_params,
4458                 .policy = nl80211_policy,
4459                 .flags = GENL_ADMIN_PERM,
4460         },
4461         {
4462                 .cmd = NL80211_CMD_TRIGGER_SCAN,
4463                 .doit = nl80211_trigger_scan,
4464                 .policy = nl80211_policy,
4465                 .flags = GENL_ADMIN_PERM,
4466         },
4467         {
4468                 .cmd = NL80211_CMD_GET_SCAN,
4469                 .policy = nl80211_policy,
4470                 .dumpit = nl80211_dump_scan,
4471         },
4472         {
4473                 .cmd = NL80211_CMD_AUTHENTICATE,
4474                 .doit = nl80211_authenticate,
4475                 .policy = nl80211_policy,
4476                 .flags = GENL_ADMIN_PERM,
4477         },
4478         {
4479                 .cmd = NL80211_CMD_ASSOCIATE,
4480                 .doit = nl80211_associate,
4481                 .policy = nl80211_policy,
4482                 .flags = GENL_ADMIN_PERM,
4483         },
4484         {
4485                 .cmd = NL80211_CMD_DEAUTHENTICATE,
4486                 .doit = nl80211_deauthenticate,
4487                 .policy = nl80211_policy,
4488                 .flags = GENL_ADMIN_PERM,
4489         },
4490         {
4491                 .cmd = NL80211_CMD_DISASSOCIATE,
4492                 .doit = nl80211_disassociate,
4493                 .policy = nl80211_policy,
4494                 .flags = GENL_ADMIN_PERM,
4495         },
4496         {
4497                 .cmd = NL80211_CMD_JOIN_IBSS,
4498                 .doit = nl80211_join_ibss,
4499                 .policy = nl80211_policy,
4500                 .flags = GENL_ADMIN_PERM,
4501         },
4502         {
4503                 .cmd = NL80211_CMD_LEAVE_IBSS,
4504                 .doit = nl80211_leave_ibss,
4505                 .policy = nl80211_policy,
4506                 .flags = GENL_ADMIN_PERM,
4507         },
4508 #ifdef CONFIG_NL80211_TESTMODE
4509         {
4510                 .cmd = NL80211_CMD_TESTMODE,
4511                 .doit = nl80211_testmode_do,
4512                 .policy = nl80211_policy,
4513                 .flags = GENL_ADMIN_PERM,
4514         },
4515 #endif
4516         {
4517                 .cmd = NL80211_CMD_CONNECT,
4518                 .doit = nl80211_connect,
4519                 .policy = nl80211_policy,
4520                 .flags = GENL_ADMIN_PERM,
4521         },
4522         {
4523                 .cmd = NL80211_CMD_DISCONNECT,
4524                 .doit = nl80211_disconnect,
4525                 .policy = nl80211_policy,
4526                 .flags = GENL_ADMIN_PERM,
4527         },
4528         {
4529                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
4530                 .doit = nl80211_wiphy_netns,
4531                 .policy = nl80211_policy,
4532                 .flags = GENL_ADMIN_PERM,
4533         },
4534         {
4535                 .cmd = NL80211_CMD_GET_SURVEY,
4536                 .policy = nl80211_policy,
4537                 .dumpit = nl80211_dump_survey,
4538         },
4539         {
4540                 .cmd = NL80211_CMD_SET_PMKSA,
4541                 .doit = nl80211_setdel_pmksa,
4542                 .policy = nl80211_policy,
4543                 .flags = GENL_ADMIN_PERM,
4544         },
4545         {
4546                 .cmd = NL80211_CMD_DEL_PMKSA,
4547                 .doit = nl80211_setdel_pmksa,
4548                 .policy = nl80211_policy,
4549                 .flags = GENL_ADMIN_PERM,
4550         },
4551         {
4552                 .cmd = NL80211_CMD_FLUSH_PMKSA,
4553                 .doit = nl80211_flush_pmksa,
4554                 .policy = nl80211_policy,
4555                 .flags = GENL_ADMIN_PERM,
4556         },
4557
4558 };
4559 static struct genl_multicast_group nl80211_mlme_mcgrp = {
4560         .name = "mlme",
4561 };
4562
4563 /* multicast groups */
4564 static struct genl_multicast_group nl80211_config_mcgrp = {
4565         .name = "config",
4566 };
4567 static struct genl_multicast_group nl80211_scan_mcgrp = {
4568         .name = "scan",
4569 };
4570 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
4571         .name = "regulatory",
4572 };
4573
4574 /* notification functions */
4575
4576 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
4577 {
4578         struct sk_buff *msg;
4579
4580         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4581         if (!msg)
4582                 return;
4583
4584         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
4585                 nlmsg_free(msg);
4586                 return;
4587         }
4588
4589         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4590                                 nl80211_config_mcgrp.id, GFP_KERNEL);
4591 }
4592
4593 static int nl80211_add_scan_req(struct sk_buff *msg,
4594                                 struct cfg80211_registered_device *rdev)
4595 {
4596         struct cfg80211_scan_request *req = rdev->scan_req;
4597         struct nlattr *nest;
4598         int i;
4599
4600         ASSERT_RDEV_LOCK(rdev);
4601
4602         if (WARN_ON(!req))
4603                 return 0;
4604
4605         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
4606         if (!nest)
4607                 goto nla_put_failure;
4608         for (i = 0; i < req->n_ssids; i++)
4609                 NLA_PUT(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid);
4610         nla_nest_end(msg, nest);
4611
4612         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
4613         if (!nest)
4614                 goto nla_put_failure;
4615         for (i = 0; i < req->n_channels; i++)
4616                 NLA_PUT_U32(msg, i, req->channels[i]->center_freq);
4617         nla_nest_end(msg, nest);
4618
4619         if (req->ie)
4620                 NLA_PUT(msg, NL80211_ATTR_IE, req->ie_len, req->ie);
4621
4622         return 0;
4623  nla_put_failure:
4624         return -ENOBUFS;
4625 }
4626
4627 static int nl80211_send_scan_msg(struct sk_buff *msg,
4628                                  struct cfg80211_registered_device *rdev,
4629                                  struct net_device *netdev,
4630                                  u32 pid, u32 seq, int flags,
4631                                  u32 cmd)
4632 {
4633         void *hdr;
4634
4635         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
4636         if (!hdr)
4637                 return -1;
4638
4639         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4640         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4641
4642         /* ignore errors and send incomplete event anyway */
4643         nl80211_add_scan_req(msg, rdev);
4644
4645         return genlmsg_end(msg, hdr);
4646
4647  nla_put_failure:
4648         genlmsg_cancel(msg, hdr);
4649         return -EMSGSIZE;
4650 }
4651
4652 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
4653                              struct net_device *netdev)
4654 {
4655         struct sk_buff *msg;
4656
4657         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
4658         if (!msg)
4659                 return;
4660
4661         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
4662                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
4663                 nlmsg_free(msg);
4664                 return;
4665         }
4666
4667         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4668                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
4669 }
4670
4671 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
4672                             struct net_device *netdev)
4673 {
4674         struct sk_buff *msg;
4675
4676         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4677         if (!msg)
4678                 return;
4679
4680         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
4681                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
4682                 nlmsg_free(msg);
4683                 return;
4684         }
4685
4686         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4687                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
4688 }
4689
4690 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
4691                                struct net_device *netdev)
4692 {
4693         struct sk_buff *msg;
4694
4695         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4696         if (!msg)
4697                 return;
4698
4699         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
4700                                   NL80211_CMD_SCAN_ABORTED) < 0) {
4701                 nlmsg_free(msg);
4702                 return;
4703         }
4704
4705         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4706                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
4707 }
4708
4709 /*
4710  * This can happen on global regulatory changes or device specific settings
4711  * based on custom world regulatory domains.
4712  */
4713 void nl80211_send_reg_change_event(struct regulatory_request *request)
4714 {
4715         struct sk_buff *msg;
4716         void *hdr;
4717
4718         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4719         if (!msg)
4720                 return;
4721
4722         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
4723         if (!hdr) {
4724                 nlmsg_free(msg);
4725                 return;
4726         }
4727
4728         /* Userspace can always count this one always being set */
4729         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
4730
4731         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
4732                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
4733                            NL80211_REGDOM_TYPE_WORLD);
4734         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
4735                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
4736                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
4737         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
4738                  request->intersect)
4739                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
4740                            NL80211_REGDOM_TYPE_INTERSECTION);
4741         else {
4742                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
4743                            NL80211_REGDOM_TYPE_COUNTRY);
4744                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
4745         }
4746
4747         if (wiphy_idx_valid(request->wiphy_idx))
4748                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
4749
4750         if (genlmsg_end(msg, hdr) < 0) {
4751                 nlmsg_free(msg);
4752                 return;
4753         }
4754
4755         rcu_read_lock();
4756         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
4757                                 GFP_ATOMIC);
4758         rcu_read_unlock();
4759
4760         return;
4761
4762 nla_put_failure:
4763         genlmsg_cancel(msg, hdr);
4764         nlmsg_free(msg);
4765 }
4766
4767 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
4768                                     struct net_device *netdev,
4769                                     const u8 *buf, size_t len,
4770                                     enum nl80211_commands cmd, gfp_t gfp)
4771 {
4772         struct sk_buff *msg;
4773         void *hdr;
4774
4775         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
4776         if (!msg)
4777                 return;
4778
4779         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
4780         if (!hdr) {
4781                 nlmsg_free(msg);
4782                 return;
4783         }
4784
4785         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4786         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4787         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
4788
4789         if (genlmsg_end(msg, hdr) < 0) {
4790                 nlmsg_free(msg);
4791                 return;
4792         }
4793
4794         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4795                                 nl80211_mlme_mcgrp.id, gfp);
4796         return;
4797
4798  nla_put_failure:
4799         genlmsg_cancel(msg, hdr);
4800         nlmsg_free(msg);
4801 }
4802
4803 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
4804                           struct net_device *netdev, const u8 *buf,
4805                           size_t len, gfp_t gfp)
4806 {
4807         nl80211_send_mlme_event(rdev, netdev, buf, len,
4808                                 NL80211_CMD_AUTHENTICATE, gfp);
4809 }
4810
4811 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
4812                            struct net_device *netdev, const u8 *buf,
4813                            size_t len, gfp_t gfp)
4814 {
4815         nl80211_send_mlme_event(rdev, netdev, buf, len,
4816                                 NL80211_CMD_ASSOCIATE, gfp);
4817 }
4818
4819 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
4820                          struct net_device *netdev, const u8 *buf,
4821                          size_t len, gfp_t gfp)
4822 {
4823         nl80211_send_mlme_event(rdev, netdev, buf, len,
4824                                 NL80211_CMD_DEAUTHENTICATE, gfp);
4825 }
4826
4827 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
4828                            struct net_device *netdev, const u8 *buf,
4829                            size_t len, gfp_t gfp)
4830 {
4831         nl80211_send_mlme_event(rdev, netdev, buf, len,
4832                                 NL80211_CMD_DISASSOCIATE, gfp);
4833 }
4834
4835 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
4836                                       struct net_device *netdev, int cmd,
4837                                       const u8 *addr, gfp_t gfp)
4838 {
4839         struct sk_buff *msg;
4840         void *hdr;
4841
4842         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
4843         if (!msg)
4844                 return;
4845
4846         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
4847         if (!hdr) {
4848                 nlmsg_free(msg);
4849                 return;
4850         }
4851
4852         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4853         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4854         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
4855         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
4856
4857         if (genlmsg_end(msg, hdr) < 0) {
4858                 nlmsg_free(msg);
4859                 return;
4860         }
4861
4862         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4863                                 nl80211_mlme_mcgrp.id, gfp);
4864         return;
4865
4866  nla_put_failure:
4867         genlmsg_cancel(msg, hdr);
4868         nlmsg_free(msg);
4869 }
4870
4871 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
4872                                struct net_device *netdev, const u8 *addr,
4873                                gfp_t gfp)
4874 {
4875         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
4876                                   addr, gfp);
4877 }
4878
4879 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
4880                                 struct net_device *netdev, const u8 *addr,
4881                                 gfp_t gfp)
4882 {
4883         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
4884                                   addr, gfp);
4885 }
4886
4887 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
4888                                  struct net_device *netdev, const u8 *bssid,
4889                                  const u8 *req_ie, size_t req_ie_len,
4890                                  const u8 *resp_ie, size_t resp_ie_len,
4891                                  u16 status, gfp_t gfp)
4892 {
4893         struct sk_buff *msg;
4894         void *hdr;
4895
4896         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
4897         if (!msg)
4898                 return;
4899
4900         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
4901         if (!hdr) {
4902                 nlmsg_free(msg);
4903                 return;
4904         }
4905
4906         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4907         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4908         if (bssid)
4909                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
4910         NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status);
4911         if (req_ie)
4912                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
4913         if (resp_ie)
4914                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
4915
4916         if (genlmsg_end(msg, hdr) < 0) {
4917                 nlmsg_free(msg);
4918                 return;
4919         }
4920
4921         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4922                                 nl80211_mlme_mcgrp.id, gfp);
4923         return;
4924
4925  nla_put_failure:
4926         genlmsg_cancel(msg, hdr);
4927         nlmsg_free(msg);
4928
4929 }
4930
4931 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
4932                          struct net_device *netdev, const u8 *bssid,
4933                          const u8 *req_ie, size_t req_ie_len,
4934                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
4935 {
4936         struct sk_buff *msg;
4937         void *hdr;
4938
4939         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
4940         if (!msg)
4941                 return;
4942
4943         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
4944         if (!hdr) {
4945                 nlmsg_free(msg);
4946                 return;
4947         }
4948
4949         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4950         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4951         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
4952         if (req_ie)
4953                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
4954         if (resp_ie)
4955                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
4956
4957         if (genlmsg_end(msg, hdr) < 0) {
4958                 nlmsg_free(msg);
4959                 return;
4960         }
4961
4962         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
4963                                 nl80211_mlme_mcgrp.id, gfp);
4964         return;
4965
4966  nla_put_failure:
4967         genlmsg_cancel(msg, hdr);
4968         nlmsg_free(msg);
4969
4970 }
4971
4972 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
4973                                struct net_device *netdev, u16 reason,
4974                                const u8 *ie, size_t ie_len, bool from_ap)
4975 {
4976         struct sk_buff *msg;
4977         void *hdr;
4978
4979         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
4980         if (!msg)
4981                 return;
4982
4983         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
4984         if (!hdr) {
4985                 nlmsg_free(msg);
4986                 return;
4987         }
4988
4989         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4990         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4991         if (from_ap && reason)
4992                 NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason);
4993         if (from_ap)
4994                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISCONNECTED_BY_AP);
4995         if (ie)
4996                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len, ie);
4997
4998         if (genlmsg_end(msg, hdr) < 0) {
4999                 nlmsg_free(msg);
5000                 return;
5001         }
5002
5003         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5004                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
5005         return;
5006
5007  nla_put_failure:
5008         genlmsg_cancel(msg, hdr);
5009         nlmsg_free(msg);
5010
5011 }
5012
5013 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
5014                              struct net_device *netdev, const u8 *bssid,
5015                              gfp_t gfp)
5016 {
5017         struct sk_buff *msg;
5018         void *hdr;
5019
5020         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5021         if (!msg)
5022                 return;
5023
5024         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
5025         if (!hdr) {
5026                 nlmsg_free(msg);
5027                 return;
5028         }
5029
5030         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5031         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5032         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5033
5034         if (genlmsg_end(msg, hdr) < 0) {
5035                 nlmsg_free(msg);
5036                 return;
5037         }
5038
5039         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5040                                 nl80211_mlme_mcgrp.id, gfp);
5041         return;
5042
5043  nla_put_failure:
5044         genlmsg_cancel(msg, hdr);
5045         nlmsg_free(msg);
5046 }
5047
5048 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
5049                                  struct net_device *netdev, const u8 *addr,
5050                                  enum nl80211_key_type key_type, int key_id,
5051                                  const u8 *tsc, gfp_t gfp)
5052 {
5053         struct sk_buff *msg;
5054         void *hdr;
5055
5056         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5057         if (!msg)
5058                 return;
5059
5060         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
5061         if (!hdr) {
5062                 nlmsg_free(msg);
5063                 return;
5064         }
5065
5066         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5067         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5068         if (addr)
5069                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
5070         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
5071         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
5072         if (tsc)
5073                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
5074
5075         if (genlmsg_end(msg, hdr) < 0) {
5076                 nlmsg_free(msg);
5077                 return;
5078         }
5079
5080         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5081                                 nl80211_mlme_mcgrp.id, gfp);
5082         return;
5083
5084  nla_put_failure:
5085         genlmsg_cancel(msg, hdr);
5086         nlmsg_free(msg);
5087 }
5088
5089 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
5090                                     struct ieee80211_channel *channel_before,
5091                                     struct ieee80211_channel *channel_after)
5092 {
5093         struct sk_buff *msg;
5094         void *hdr;
5095         struct nlattr *nl_freq;
5096
5097         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
5098         if (!msg)
5099                 return;
5100
5101         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
5102         if (!hdr) {
5103                 nlmsg_free(msg);
5104                 return;
5105         }
5106
5107         /*
5108          * Since we are applying the beacon hint to a wiphy we know its
5109          * wiphy_idx is valid
5110          */
5111         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
5112
5113         /* Before */
5114         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
5115         if (!nl_freq)
5116                 goto nla_put_failure;
5117         if (nl80211_msg_put_channel(msg, channel_before))
5118                 goto nla_put_failure;
5119         nla_nest_end(msg, nl_freq);
5120
5121         /* After */
5122         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
5123         if (!nl_freq)
5124                 goto nla_put_failure;
5125         if (nl80211_msg_put_channel(msg, channel_after))
5126                 goto nla_put_failure;
5127         nla_nest_end(msg, nl_freq);
5128
5129         if (genlmsg_end(msg, hdr) < 0) {
5130                 nlmsg_free(msg);
5131                 return;
5132         }
5133
5134         rcu_read_lock();
5135         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
5136                                 GFP_ATOMIC);
5137         rcu_read_unlock();
5138
5139         return;
5140
5141 nla_put_failure:
5142         genlmsg_cancel(msg, hdr);
5143         nlmsg_free(msg);
5144 }
5145
5146 /* initialisation/exit functions */
5147
5148 int nl80211_init(void)
5149 {
5150         int err;
5151
5152         err = genl_register_family_with_ops(&nl80211_fam,
5153                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
5154         if (err)
5155                 return err;
5156
5157         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
5158         if (err)
5159                 goto err_out;
5160
5161         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
5162         if (err)
5163                 goto err_out;
5164
5165         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
5166         if (err)
5167                 goto err_out;
5168
5169         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
5170         if (err)
5171                 goto err_out;
5172
5173 #ifdef CONFIG_NL80211_TESTMODE
5174         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
5175         if (err)
5176                 goto err_out;
5177 #endif
5178
5179         return 0;
5180  err_out:
5181         genl_unregister_family(&nl80211_fam);
5182         return err;
5183 }
5184
5185 void nl80211_exit(void)
5186 {
5187         genl_unregister_family(&nl80211_fam);
5188 }