net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include "core.h"
  23 #include "nl80211.h"
  24 #include "reg.h"
  25
  26 /* the netlink family */
  27 static struct genl_family nl80211_fam = {
  28         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  29         .name = "nl80211",      /* have users key off the name instead */
  30         .hdrsize = 0,           /* no private header */
  31         .version = 1,           /* no particular meaning now */
  32         .maxattr = NL80211_ATTR_MAX,
  33         .netnsok = true,
  34 };
  35
  36 /* internal helper: get rdev and dev */
  37 static int get_rdev_dev_by_info_ifindex(struct genl_info *info,
  38                                        struct cfg80211_registered_device **rdev,
  39                                        struct net_device **dev)
  40 {
  41         struct nlattr **attrs = info->attrs;
  42         int ifindex;
  43
  44         if (!attrs[NL80211_ATTR_IFINDEX])
  45                 return -EINVAL;
  46
  47         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  48         *dev = dev_get_by_index(genl_info_net(info), ifindex);
  49         if (!*dev)
  50                 return -ENODEV;
  51
  52         *rdev = cfg80211_get_dev_from_ifindex(genl_info_net(info), ifindex);
  53         if (IS_ERR(*rdev)) {
  54                 dev_put(*dev);
  55                 return PTR_ERR(*rdev);
  56         }
  57
  58         return 0;
  59 }
  60
  61 /* policy for the attributes */
  62 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
  63         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  64         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  65                                       .len = 20-1 },
  66         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  67         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  68         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  69         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
  70         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
  71         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
  72         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
  73         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
  74
  75         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  76         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  77         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  78
  79         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  80         [NL80211_ATTR_PREV_BSSID] = { .type = NLA_BINARY, .len = ETH_ALEN },
  81
  82         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
  83         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  84                                     .len = WLAN_MAX_KEY_LEN },
  85         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  86         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  87         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
  88         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
  89
  90         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
  91         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
  92         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
  93                                        .len = IEEE80211_MAX_DATA_LEN },
  94         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
  95                                        .len = IEEE80211_MAX_DATA_LEN },
  96         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
  97         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
  98         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
  99         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 100                                                .len = NL80211_MAX_SUPP_RATES },
 101         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 102         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 103         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 104         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 105                                 .len = IEEE80211_MAX_MESH_ID_LEN },
 106         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 107
 108         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 109         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 110
 111         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 112         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 113         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 114         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 115                                            .len = NL80211_MAX_SUPP_RATES },
 116
 117         [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
 118
 119         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 120                                          .len = NL80211_HT_CAPABILITY_LEN },
 121
 122         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 123         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 124                               .len = IEEE80211_MAX_DATA_LEN },
 125         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 126         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 127
 128         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 129                                 .len = IEEE80211_MAX_SSID_LEN },
 130         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 131         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 132         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 133         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 134         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 135         [NL80211_ATTR_STA_FLAGS2] = {
 136                 .len = sizeof(struct nl80211_sta_flag_update),
 137         },
 138         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 139         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 140         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 141         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 142         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 143         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 144         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 145                                  .len = WLAN_PMKID_LEN },
 146         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 147         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 148         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 149         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 150                                  .len = IEEE80211_MAX_DATA_LEN },
 151         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 152         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 153         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 154         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 155         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 156
 157         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 158         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 159 };
 160
 161 /* policy for the attributes */
 162 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 163         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 164         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 165         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 166         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
 167         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 168         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 169 };
 170
 171 /* ifidx get helper */
 172 static int nl80211_get_ifidx(struct netlink_callback *cb)
 173 {
 174         int res;
 175
 176         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 177                           nl80211_fam.attrbuf, nl80211_fam.maxattr,
 178                           nl80211_policy);
 179         if (res)
 180                 return res;
 181
 182         if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
 183                 return -EINVAL;
 184
 185         res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
 186         if (!res)
 187                 return -EINVAL;
 188         return res;
 189 }
 190
 191 /* IE validation */
 192 static bool is_valid_ie_attr(const struct nlattr *attr)
 193 {
 194         const u8 *pos;
 195         int len;
 196
 197         if (!attr)
 198                 return true;
 199
 200         pos = nla_data(attr);
 201         len = nla_len(attr);
 202
 203         while (len) {
 204                 u8 elemlen;
 205
 206                 if (len < 2)
 207                         return false;
 208                 len -= 2;
 209
 210                 elemlen = pos[1];
 211                 if (elemlen > len)
 212                         return false;
 213
 214                 len -= elemlen;
 215                 pos += 2 + elemlen;
 216         }
 217
 218         return true;
 219 }
 220
 221 /* message building helper */
 222 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 223                                    int flags, u8 cmd)
 224 {
 225         /* since there is no private header just add the generic one */
 226         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 227 }
 228
 229 static int nl80211_msg_put_channel(struct sk_buff *msg,
 230                                    struct ieee80211_channel *chan)
 231 {
 232         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 233                     chan->center_freq);
 234
 235         if (chan->flags & IEEE80211_CHAN_DISABLED)
 236                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 237         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 238                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 239         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 240                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 241         if (chan->flags & IEEE80211_CHAN_RADAR)
 242                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 243
 244         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 245                     DBM_TO_MBM(chan->max_power));
 246
 247         return 0;
 248
 249  nla_put_failure:
 250         return -ENOBUFS;
 251 }
 252
 253 /* netlink command implementations */
 254
 255 struct key_parse {
 256         struct key_params p;
 257         int idx;
 258         bool def, defmgmt;
 259 };
 260
 261 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 262 {
 263         struct nlattr *tb[NL80211_KEY_MAX + 1];
 264         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 265                                    nl80211_key_policy);
 266         if (err)
 267                 return err;
 268
 269         k->def = !!tb[NL80211_KEY_DEFAULT];
 270         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 271
 272         if (tb[NL80211_KEY_IDX])
 273                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 274
 275         if (tb[NL80211_KEY_DATA]) {
 276                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 277                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 278         }
 279
 280         if (tb[NL80211_KEY_SEQ]) {
 281                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 282                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 283         }
 284
 285         if (tb[NL80211_KEY_CIPHER])
 286                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 287
 288         return 0;
 289 }
 290
 291 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 292 {
 293         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 294                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 295                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 296         }
 297
 298         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 299                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 300                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 301         }
 302
 303         if (info->attrs[NL80211_ATTR_KEY_IDX])
 304                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 305
 306         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 307                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 308
 309         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 310         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 311
 312         return 0;
 313 }
 314
 315 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 316 {
 317         int err;
 318
 319         memset(k, 0, sizeof(*k));
 320         k->idx = -1;
 321
 322         if (info->attrs[NL80211_ATTR_KEY])
 323                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 324         else
 325                 err = nl80211_parse_key_old(info, k);
 326
 327         if (err)
 328                 return err;
 329
 330         if (k->def && k->defmgmt)
 331                 return -EINVAL;
 332
 333         if (k->idx != -1) {
 334                 if (k->defmgmt) {
 335                         if (k->idx < 4 || k->idx > 5)
 336                                 return -EINVAL;
 337                 } else if (k->def) {
 338                         if (k->idx < 0 || k->idx > 3)
 339                                 return -EINVAL;
 340                 } else {
 341                         if (k->idx < 0 || k->idx > 5)
 342                                 return -EINVAL;
 343                 }
 344         }
 345
 346         return 0;
 347 }
 348
 349 static struct cfg80211_cached_keys *
 350 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 351                        struct nlattr *keys)
 352 {
 353         struct key_parse parse;
 354         struct nlattr *key;
 355         struct cfg80211_cached_keys *result;
 356         int rem, err, def = 0;
 357
 358         result = kzalloc(sizeof(*result), GFP_KERNEL);
 359         if (!result)
 360                 return ERR_PTR(-ENOMEM);
 361
 362         result->def = -1;
 363         result->defmgmt = -1;
 364
 365         nla_for_each_nested(key, keys, rem) {
 366                 memset(&parse, 0, sizeof(parse));
 367                 parse.idx = -1;
 368
 369                 err = nl80211_parse_key_new(key, &parse);
 370                 if (err)
 371                         goto error;
 372                 err = -EINVAL;
 373                 if (!parse.p.key)
 374                         goto error;
 375                 if (parse.idx < 0 || parse.idx > 4)
 376                         goto error;
 377                 if (parse.def) {
 378                         if (def)
 379                                 goto error;
 380                         def = 1;
 381                         result->def = parse.idx;
 382                 } else if (parse.defmgmt)
 383                         goto error;
 384                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 385                                                      parse.idx, NULL);
 386                 if (err)
 387                         goto error;
 388                 result->params[parse.idx].cipher = parse.p.cipher;
 389                 result->params[parse.idx].key_len = parse.p.key_len;
 390                 result->params[parse.idx].key = result->data[parse.idx];
 391                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 392         }
 393
 394         return result;
 395  error:
 396         kfree(result);
 397         return ERR_PTR(err);
 398 }
 399
 400 static int nl80211_key_allowed(struct wireless_dev *wdev)
 401 {
 402         ASSERT_WDEV_LOCK(wdev);
 403
 404         if (!netif_running(wdev->netdev))
 405                 return -ENETDOWN;
 406
 407         switch (wdev->iftype) {
 408         case NL80211_IFTYPE_AP:
 409         case NL80211_IFTYPE_AP_VLAN:
 410                 break;
 411         case NL80211_IFTYPE_ADHOC:
 412                 if (!wdev->current_bss)
 413                         return -ENOLINK;
 414                 break;
 415         case NL80211_IFTYPE_STATION:
 416                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 417                         return -ENOLINK;
 418                 break;
 419         default:
 420                 return -EINVAL;
 421         }
 422
 423         return 0;
 424 }
 425
 426 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 427                               struct cfg80211_registered_device *dev)
 428 {
 429         void *hdr;
 430         struct nlattr *nl_bands, *nl_band;
 431         struct nlattr *nl_freqs, *nl_freq;
 432         struct nlattr *nl_rates, *nl_rate;
 433         struct nlattr *nl_modes;
 434         struct nlattr *nl_cmds;
 435         enum ieee80211_band band;
 436         struct ieee80211_channel *chan;
 437         struct ieee80211_rate *rate;
 438         int i;
 439         u16 ifmodes = dev->wiphy.interface_modes;
 440
 441         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 442         if (!hdr)
 443                 return -1;
 444
 445         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 446         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 447
 448         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
 449                     cfg80211_rdev_list_generation);
 450
 451         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 452                    dev->wiphy.retry_short);
 453         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 454                    dev->wiphy.retry_long);
 455         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 456                     dev->wiphy.frag_threshold);
 457         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 458                     dev->wiphy.rts_threshold);
 459         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
 460                     dev->wiphy.coverage_class);
 461
 462         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 463                    dev->wiphy.max_scan_ssids);
 464         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 465                     dev->wiphy.max_scan_ie_len);
 466
 467         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
 468                 sizeof(u32) * dev->wiphy.n_cipher_suites,
 469                 dev->wiphy.cipher_suites);
 470
 471         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
 472                    dev->wiphy.max_num_pmkids);
 473
 474         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
 475         if (!nl_modes)
 476                 goto nla_put_failure;
 477
 478         i = 0;
 479         while (ifmodes) {
 480                 if (ifmodes & 1)
 481                         NLA_PUT_FLAG(msg, i);
 482                 ifmodes >>= 1;
 483                 i++;
 484         }
 485
 486         nla_nest_end(msg, nl_modes);
 487
 488         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 489         if (!nl_bands)
 490                 goto nla_put_failure;
 491
 492         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 493                 if (!dev->wiphy.bands[band])
 494                         continue;
 495
 496                 nl_band = nla_nest_start(msg, band);
 497                 if (!nl_band)
 498                         goto nla_put_failure;
 499
 500                 /* add HT info */
 501                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 502                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 503                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 504                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 505                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 506                                 dev->wiphy.bands[band]->ht_cap.cap);
 507                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 508                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 509                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 510                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 511                 }
 512
 513                 /* add frequencies */
 514                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 515                 if (!nl_freqs)
 516                         goto nla_put_failure;
 517
 518                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 519                         nl_freq = nla_nest_start(msg, i);
 520                         if (!nl_freq)
 521                                 goto nla_put_failure;
 522
 523                         chan = &dev->wiphy.bands[band]->channels[i];
 524
 525                         if (nl80211_msg_put_channel(msg, chan))
 526                                 goto nla_put_failure;
 527
 528                         nla_nest_end(msg, nl_freq);
 529                 }
 530
 531                 nla_nest_end(msg, nl_freqs);
 532
 533                 /* add bitrates */
 534                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 535                 if (!nl_rates)
 536                         goto nla_put_failure;
 537
 538                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 539                         nl_rate = nla_nest_start(msg, i);
 540                         if (!nl_rate)
 541                                 goto nla_put_failure;
 542
 543                         rate = &dev->wiphy.bands[band]->bitrates[i];
 544                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 545                                     rate->bitrate);
 546                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 547                                 NLA_PUT_FLAG(msg,
 548                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 549
 550                         nla_nest_end(msg, nl_rate);
 551                 }
 552
 553                 nla_nest_end(msg, nl_rates);
 554
 555                 nla_nest_end(msg, nl_band);
 556         }
 557         nla_nest_end(msg, nl_bands);
 558
 559         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 560         if (!nl_cmds)
 561                 goto nla_put_failure;
 562
 563         i = 0;
 564 #define CMD(op, n)                                              \
 565          do {                                                   \
 566                 if (dev->ops->op) {                             \
 567                         i++;                                    \
 568                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 569                 }                                               \
 570         } while (0)
 571
 572         CMD(add_virtual_intf, NEW_INTERFACE);
 573         CMD(change_virtual_intf, SET_INTERFACE);
 574         CMD(add_key, NEW_KEY);
 575         CMD(add_beacon, NEW_BEACON);
 576         CMD(add_station, NEW_STATION);
 577         CMD(add_mpath, NEW_MPATH);
 578         CMD(set_mesh_params, SET_MESH_PARAMS);
 579         CMD(change_bss, SET_BSS);
 580         CMD(auth, AUTHENTICATE);
 581         CMD(assoc, ASSOCIATE);
 582         CMD(deauth, DEAUTHENTICATE);
 583         CMD(disassoc, DISASSOCIATE);
 584         CMD(join_ibss, JOIN_IBSS);
 585         CMD(set_pmksa, SET_PMKSA);
 586         CMD(del_pmksa, DEL_PMKSA);
 587         CMD(flush_pmksa, FLUSH_PMKSA);
 588         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
 589         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
 590         CMD(action, ACTION);
 591         if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
 592                 i++;
 593                 NLA_PUT_U32(msg, i, NL80211_CMD_SET_WIPHY_NETNS);
 594         }
 595         CMD(set_channel, SET_CHANNEL);
 596
 597 #undef CMD
 598
 599         if (dev->ops->connect || dev->ops->auth) {
 600                 i++;
 601                 NLA_PUT_U32(msg, i, NL80211_CMD_CONNECT);
 602         }
 603
 604         if (dev->ops->disconnect || dev->ops->deauth) {
 605                 i++;
 606                 NLA_PUT_U32(msg, i, NL80211_CMD_DISCONNECT);
 607         }
 608
 609         nla_nest_end(msg, nl_cmds);
 610
 611         return genlmsg_end(msg, hdr);
 612
 613  nla_put_failure:
 614         genlmsg_cancel(msg, hdr);
 615         return -EMSGSIZE;
 616 }
 617
 618 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 619 {
 620         int idx = 0;
 621         int start = cb->args[0];
 622         struct cfg80211_registered_device *dev;
 623
 624         mutex_lock(&cfg80211_mutex);
 625         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
 626                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
 627                         continue;
 628                 if (++idx <= start)
 629                         continue;
 630                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
 631                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
 632                                        dev) < 0) {
 633                         idx--;
 634                         break;
 635                 }
 636         }
 637         mutex_unlock(&cfg80211_mutex);
 638
 639         cb->args[0] = idx;
 640
 641         return skb->len;
 642 }
 643
 644 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 645 {
 646         struct sk_buff *msg;
 647         struct cfg80211_registered_device *dev;
 648
 649         dev = cfg80211_get_dev_from_info(info);
 650         if (IS_ERR(dev))
 651                 return PTR_ERR(dev);
 652
 653         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 654         if (!msg)
 655                 goto out_err;
 656
 657         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
 658                 goto out_free;
 659
 660         cfg80211_unlock_rdev(dev);
 661
 662         return genlmsg_reply(msg, info);
 663
 664  out_free:
 665         nlmsg_free(msg);
 666  out_err:
 667         cfg80211_unlock_rdev(dev);
 668         return -ENOBUFS;
 669 }
 670
 671 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 672         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
 673         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
 674         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
 675         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
 676         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
 677 };
 678
 679 static int parse_txq_params(struct nlattr *tb[],
 680                             struct ieee80211_txq_params *txq_params)
 681 {
 682         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 683             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 684             !tb[NL80211_TXQ_ATTR_AIFS])
 685                 return -EINVAL;
 686
 687         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
 688         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 689         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 690         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 691         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 692
 693         return 0;
 694 }
 695
 696 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
 697 {
 698         /*
 699          * You can only set the channel explicitly for AP, mesh
 700          * and WDS type interfaces; all others have their channel
 701          * managed via their respective "establish a connection"
 702          * command (connect, join, ...)
 703          *
 704          * Monitors are special as they are normally slaved to
 705          * whatever else is going on, so they behave as though
 706          * you tried setting the wiphy channel itself.
 707          */
 708         return !wdev ||
 709                 wdev->iftype == NL80211_IFTYPE_AP ||
 710                 wdev->iftype == NL80211_IFTYPE_WDS ||
 711                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
 712                 wdev->iftype == NL80211_IFTYPE_MONITOR;
 713 }
 714
 715 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
 716                                  struct wireless_dev *wdev,
 717                                  struct genl_info *info)
 718 {
 719         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 720         u32 freq;
 721         int result;
 722
 723         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
 724                 return -EINVAL;
 725
 726         if (!nl80211_can_set_dev_channel(wdev))
 727                 return -EOPNOTSUPP;
 728
 729         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 730                 channel_type = nla_get_u32(info->attrs[
 731                                    NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 732                 if (channel_type != NL80211_CHAN_NO_HT &&
 733                     channel_type != NL80211_CHAN_HT20 &&
 734                     channel_type != NL80211_CHAN_HT40PLUS &&
 735                     channel_type != NL80211_CHAN_HT40MINUS)
 736                         return -EINVAL;
 737         }
 738
 739         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 740
 741         mutex_lock(&rdev->devlist_mtx);
 742         if (wdev) {
 743                 wdev_lock(wdev);
 744                 result = cfg80211_set_freq(rdev, wdev, freq, channel_type);
 745                 wdev_unlock(wdev);
 746         } else {
 747                 result = cfg80211_set_freq(rdev, NULL, freq, channel_type);
 748         }
 749         mutex_unlock(&rdev->devlist_mtx);
 750
 751         return result;
 752 }
 753
 754 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
 755 {
 756         struct cfg80211_registered_device *rdev;
 757         struct net_device *netdev;
 758         int result;
 759
 760         rtnl_lock();
 761
 762         result = get_rdev_dev_by_info_ifindex(info, &rdev, &netdev);
 763         if (result)
 764                 goto unlock;
 765
 766         result = __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
 767
 768  unlock:
 769         rtnl_unlock();
 770
 771         return result;
 772 }
 773
 774 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 775 {
 776         struct cfg80211_registered_device *rdev;
 777         struct net_device *netdev = NULL;
 778         struct wireless_dev *wdev;
 779         int result, rem_txq_params = 0;
 780         struct nlattr *nl_txq_params;
 781         u32 changed;
 782         u8 retry_short = 0, retry_long = 0;
 783         u32 frag_threshold = 0, rts_threshold = 0;
 784         u8 coverage_class = 0;
 785
 786         rtnl_lock();
 787
 788         /*
 789          * Try to find the wiphy and netdev. Normally this
 790          * function shouldn't need the netdev, but this is
 791          * done for backward compatibility -- previously
 792          * setting the channel was done per wiphy, but now
 793          * it is per netdev. Previous userland like hostapd
 794          * also passed a netdev to set_wiphy, so that it is
 795          * possible to let that go to the right netdev!
 796          */
 797         mutex_lock(&cfg80211_mutex);
 798
 799         if (info->attrs[NL80211_ATTR_IFINDEX]) {
 800                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
 801
 802                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
 803                 if (netdev && netdev->ieee80211_ptr) {
 804                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
 805                         mutex_lock(&rdev->mtx);
 806                 } else
 807                         netdev = NULL;
 808         }
 809
 810         if (!netdev) {
 811                 rdev = __cfg80211_rdev_from_info(info);
 812                 if (IS_ERR(rdev)) {
 813                         mutex_unlock(&cfg80211_mutex);
 814                         result = PTR_ERR(rdev);
 815                         goto unlock;
 816                 }
 817                 wdev = NULL;
 818                 netdev = NULL;
 819                 result = 0;
 820
 821                 mutex_lock(&rdev->mtx);
 822         } else if (netif_running(netdev) &&
 823                    nl80211_can_set_dev_channel(netdev->ieee80211_ptr))
 824                 wdev = netdev->ieee80211_ptr;
 825         else
 826                 wdev = NULL;
 827
 828         /*
 829          * end workaround code, by now the rdev is available
 830          * and locked, and wdev may or may not be NULL.
 831          */
 832
 833         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
 834                 result = cfg80211_dev_rename(
 835                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 836
 837         mutex_unlock(&cfg80211_mutex);
 838
 839         if (result)
 840                 goto bad_res;
 841
 842         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
 843                 struct ieee80211_txq_params txq_params;
 844                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
 845
 846                 if (!rdev->ops->set_txq_params) {
 847                         result = -EOPNOTSUPP;
 848                         goto bad_res;
 849                 }
 850
 851                 nla_for_each_nested(nl_txq_params,
 852                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
 853                                     rem_txq_params) {
 854                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
 855                                   nla_data(nl_txq_params),
 856                                   nla_len(nl_txq_params),
 857                                   txq_params_policy);
 858                         result = parse_txq_params(tb, &txq_params);
 859                         if (result)
 860                                 goto bad_res;
 861
 862                         result = rdev->ops->set_txq_params(&rdev->wiphy,
 863                                                            &txq_params);
 864                         if (result)
 865                                 goto bad_res;
 866                 }
 867         }
 868
 869         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
 870                 result = __nl80211_set_channel(rdev, wdev, info);
 871                 if (result)
 872                         goto bad_res;
 873         }
 874
 875         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
 876                 enum nl80211_tx_power_setting type;
 877                 int idx, mbm = 0;
 878
 879                 if (!rdev->ops->set_tx_power) {
 880                         result = -EOPNOTSUPP;
 881                         goto bad_res;
 882                 }
 883
 884                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
 885                 type = nla_get_u32(info->attrs[idx]);
 886
 887                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
 888                     (type != NL80211_TX_POWER_AUTOMATIC)) {
 889                         result = -EINVAL;
 890                         goto bad_res;
 891                 }
 892
 893                 if (type != NL80211_TX_POWER_AUTOMATIC) {
 894                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
 895                         mbm = nla_get_u32(info->attrs[idx]);
 896                 }
 897
 898                 result = rdev->ops->set_tx_power(&rdev->wiphy, type, mbm);
 899                 if (result)
 900                         goto bad_res;
 901         }
 902
 903         changed = 0;
 904
 905         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
 906                 retry_short = nla_get_u8(
 907                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
 908                 if (retry_short == 0) {
 909                         result = -EINVAL;
 910                         goto bad_res;
 911                 }
 912                 changed |= WIPHY_PARAM_RETRY_SHORT;
 913         }
 914
 915         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
 916                 retry_long = nla_get_u8(
 917                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
 918                 if (retry_long == 0) {
 919                         result = -EINVAL;
 920                         goto bad_res;
 921                 }
 922                 changed |= WIPHY_PARAM_RETRY_LONG;
 923         }
 924
 925         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
 926                 frag_threshold = nla_get_u32(
 927                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
 928                 if (frag_threshold < 256) {
 929                         result = -EINVAL;
 930                         goto bad_res;
 931                 }
 932                 if (frag_threshold != (u32) -1) {
 933                         /*
 934                          * Fragments (apart from the last one) are required to
 935                          * have even length. Make the fragmentation code
 936                          * simpler by stripping LSB should someone try to use
 937                          * odd threshold value.
 938                          */
 939                         frag_threshold &= ~0x1;
 940                 }
 941                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
 942         }
 943
 944         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
 945                 rts_threshold = nla_get_u32(
 946                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
 947                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
 948         }
 949
 950         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
 951                 coverage_class = nla_get_u8(
 952                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
 953                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
 954         }
 955
 956         if (changed) {
 957                 u8 old_retry_short, old_retry_long;
 958                 u32 old_frag_threshold, old_rts_threshold;
 959                 u8 old_coverage_class;
 960
 961                 if (!rdev->ops->set_wiphy_params) {
 962                         result = -EOPNOTSUPP;
 963                         goto bad_res;
 964                 }
 965
 966                 old_retry_short = rdev->wiphy.retry_short;
 967                 old_retry_long = rdev->wiphy.retry_long;
 968                 old_frag_threshold = rdev->wiphy.frag_threshold;
 969                 old_rts_threshold = rdev->wiphy.rts_threshold;
 970                 old_coverage_class = rdev->wiphy.coverage_class;
 971
 972                 if (changed & WIPHY_PARAM_RETRY_SHORT)
 973                         rdev->wiphy.retry_short = retry_short;
 974                 if (changed & WIPHY_PARAM_RETRY_LONG)
 975                         rdev->wiphy.retry_long = retry_long;
 976                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
 977                         rdev->wiphy.frag_threshold = frag_threshold;
 978                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
 979                         rdev->wiphy.rts_threshold = rts_threshold;
 980                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
 981                         rdev->wiphy.coverage_class = coverage_class;
 982
 983                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
 984                 if (result) {
 985                         rdev->wiphy.retry_short = old_retry_short;
 986                         rdev->wiphy.retry_long = old_retry_long;
 987                         rdev->wiphy.frag_threshold = old_frag_threshold;
 988                         rdev->wiphy.rts_threshold = old_rts_threshold;
 989                         rdev->wiphy.coverage_class = old_coverage_class;
 990                 }
 991         }
 992
 993  bad_res:
 994         mutex_unlock(&rdev->mtx);
 995         if (netdev)
 996                 dev_put(netdev);
 997  unlock:
 998         rtnl_unlock();
 999         return result;
1000 }
1001
1002
1003 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
1004                               struct cfg80211_registered_device *rdev,
1005                               struct net_device *dev)
1006 {
1007         void *hdr;
1008
1009         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
1010         if (!hdr)
1011                 return -1;
1012
1013         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1014         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
1015         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
1016         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
1017
1018         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION,
1019                     rdev->devlist_generation ^
1020                         (cfg80211_rdev_list_generation << 2));
1021
1022         return genlmsg_end(msg, hdr);
1023
1024  nla_put_failure:
1025         genlmsg_cancel(msg, hdr);
1026         return -EMSGSIZE;
1027 }
1028
1029 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
1030 {
1031         int wp_idx = 0;
1032         int if_idx = 0;
1033         int wp_start = cb->args[0];
1034         int if_start = cb->args[1];
1035         struct cfg80211_registered_device *rdev;
1036         struct wireless_dev *wdev;
1037
1038         mutex_lock(&cfg80211_mutex);
1039         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1040                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1041                         continue;
1042                 if (wp_idx < wp_start) {
1043                         wp_idx++;
1044                         continue;
1045                 }
1046                 if_idx = 0;
1047
1048                 mutex_lock(&rdev->devlist_mtx);
1049                 list_for_each_entry(wdev, &rdev->netdev_list, list) {
1050                         if (if_idx < if_start) {
1051                                 if_idx++;
1052                                 continue;
1053                         }
1054                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
1055                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
1056                                                rdev, wdev->netdev) < 0) {
1057                                 mutex_unlock(&rdev->devlist_mtx);
1058                                 goto out;
1059                         }
1060                         if_idx++;
1061                 }
1062                 mutex_unlock(&rdev->devlist_mtx);
1063
1064                 wp_idx++;
1065         }
1066  out:
1067         mutex_unlock(&cfg80211_mutex);
1068
1069         cb->args[0] = wp_idx;
1070         cb->args[1] = if_idx;
1071
1072         return skb->len;
1073 }
1074
1075 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
1076 {
1077         struct sk_buff *msg;
1078         struct cfg80211_registered_device *dev;
1079         struct net_device *netdev;
1080         int err;
1081
1082         err = get_rdev_dev_by_info_ifindex(info, &dev, &netdev);
1083         if (err)
1084                 return err;
1085
1086         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1087         if (!msg)
1088                 goto out_err;
1089
1090         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
1091                                dev, netdev) < 0)
1092                 goto out_free;
1093
1094         dev_put(netdev);
1095         cfg80211_unlock_rdev(dev);
1096
1097         return genlmsg_reply(msg, info);
1098
1099  out_free:
1100         nlmsg_free(msg);
1101  out_err:
1102         dev_put(netdev);
1103         cfg80211_unlock_rdev(dev);
1104         return -ENOBUFS;
1105 }
1106
1107 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
1108         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
1109         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
1110         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
1111         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
1112         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
1113 };
1114
1115 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
1116 {
1117         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
1118         int flag;
1119
1120         *mntrflags = 0;
1121
1122         if (!nla)
1123                 return -EINVAL;
1124
1125         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
1126                              nla, mntr_flags_policy))
1127                 return -EINVAL;
1128
1129         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
1130                 if (flags[flag])
1131                         *mntrflags |= (1<<flag);
1132
1133         return 0;
1134 }
1135
1136 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
1137                                struct net_device *netdev, u8 use_4addr,
1138                                enum nl80211_iftype iftype)
1139 {
1140         if (!use_4addr) {
1141                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
1142                         return -EBUSY;
1143                 return 0;
1144         }
1145
1146         switch (iftype) {
1147         case NL80211_IFTYPE_AP_VLAN:
1148                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
1149                         return 0;
1150                 break;
1151         case NL80211_IFTYPE_STATION:
1152                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
1153                         return 0;
1154                 break;
1155         default:
1156                 break;
1157         }
1158
1159         return -EOPNOTSUPP;
1160 }
1161
1162 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
1163 {
1164         struct cfg80211_registered_device *rdev;
1165         struct vif_params params;
1166         int err;
1167         enum nl80211_iftype otype, ntype;
1168         struct net_device *dev;
1169         u32 _flags, *flags = NULL;
1170         bool change = false;
1171
1172         memset(&params, 0, sizeof(params));
1173
1174         rtnl_lock();
1175
1176         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1177         if (err)
1178                 goto unlock_rtnl;
1179
1180         otype = ntype = dev->ieee80211_ptr->iftype;
1181
1182         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1183                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1184                 if (otype != ntype)
1185                         change = true;
1186                 if (ntype > NL80211_IFTYPE_MAX) {
1187                         err = -EINVAL;
1188                         goto unlock;
1189                 }
1190         }
1191
1192         if (info->attrs[NL80211_ATTR_MESH_ID]) {
1193                 if (ntype != NL80211_IFTYPE_MESH_POINT) {
1194                         err = -EINVAL;
1195                         goto unlock;
1196                 }
1197                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
1198                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1199                 change = true;
1200         }
1201
1202         if (info->attrs[NL80211_ATTR_4ADDR]) {
1203                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1204                 change = true;
1205                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
1206                 if (err)
1207                         goto unlock;
1208         } else {
1209                 params.use_4addr = -1;
1210         }
1211
1212         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
1213                 if (ntype != NL80211_IFTYPE_MONITOR) {
1214                         err = -EINVAL;
1215                         goto unlock;
1216                 }
1217                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
1218                                           &_flags);
1219                 if (err)
1220                         goto unlock;
1221
1222                 flags = &_flags;
1223                 change = true;
1224         }
1225
1226         if (change)
1227                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
1228         else
1229                 err = 0;
1230
1231         if (!err && params.use_4addr != -1)
1232                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
1233
1234  unlock:
1235         dev_put(dev);
1236         cfg80211_unlock_rdev(rdev);
1237  unlock_rtnl:
1238         rtnl_unlock();
1239         return err;
1240 }
1241
1242 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
1243 {
1244         struct cfg80211_registered_device *rdev;
1245         struct vif_params params;
1246         int err;
1247         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
1248         u32 flags;
1249
1250         memset(&params, 0, sizeof(params));
1251
1252         if (!info->attrs[NL80211_ATTR_IFNAME])
1253                 return -EINVAL;
1254
1255         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1256                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1257                 if (type > NL80211_IFTYPE_MAX)
1258                         return -EINVAL;
1259         }
1260
1261         rtnl_lock();
1262
1263         rdev = cfg80211_get_dev_from_info(info);
1264         if (IS_ERR(rdev)) {
1265                 err = PTR_ERR(rdev);
1266                 goto unlock_rtnl;
1267         }
1268
1269         if (!rdev->ops->add_virtual_intf ||
1270             !(rdev->wiphy.interface_modes & (1 << type))) {
1271                 err = -EOPNOTSUPP;
1272                 goto unlock;
1273         }
1274
1275         if (type == NL80211_IFTYPE_MESH_POINT &&
1276             info->attrs[NL80211_ATTR_MESH_ID]) {
1277                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
1278                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1279         }
1280
1281         if (info->attrs[NL80211_ATTR_4ADDR]) {
1282                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1283                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
1284                 if (err)
1285                         goto unlock;
1286         }
1287
1288         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
1289                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
1290                                   &flags);
1291         err = rdev->ops->add_virtual_intf(&rdev->wiphy,
1292                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
1293                 type, err ? NULL : &flags, &params);
1294
1295  unlock:
1296         cfg80211_unlock_rdev(rdev);
1297  unlock_rtnl:
1298         rtnl_unlock();
1299         return err;
1300 }
1301
1302 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
1303 {
1304         struct cfg80211_registered_device *rdev;
1305         int err;
1306         struct net_device *dev;
1307
1308         rtnl_lock();
1309
1310         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1311         if (err)
1312                 goto unlock_rtnl;
1313
1314         if (!rdev->ops->del_virtual_intf) {
1315                 err = -EOPNOTSUPP;
1316                 goto out;
1317         }
1318
1319         err = rdev->ops->del_virtual_intf(&rdev->wiphy, dev);
1320
1321  out:
1322         cfg80211_unlock_rdev(rdev);
1323         dev_put(dev);
1324  unlock_rtnl:
1325         rtnl_unlock();
1326         return err;
1327 }
1328
1329 struct get_key_cookie {
1330         struct sk_buff *msg;
1331         int error;
1332         int idx;
1333 };
1334
1335 static void get_key_callback(void *c, struct key_params *params)
1336 {
1337         struct nlattr *key;
1338         struct get_key_cookie *cookie = c;
1339
1340         if (params->key)
1341                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
1342                         params->key_len, params->key);
1343
1344         if (params->seq)
1345                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
1346                         params->seq_len, params->seq);
1347
1348         if (params->cipher)
1349                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
1350                             params->cipher);
1351
1352         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
1353         if (!key)
1354                 goto nla_put_failure;
1355
1356         if (params->key)
1357                 NLA_PUT(cookie->msg, NL80211_KEY_DATA,
1358                         params->key_len, params->key);
1359
1360         if (params->seq)
1361                 NLA_PUT(cookie->msg, NL80211_KEY_SEQ,
1362                         params->seq_len, params->seq);
1363
1364         if (params->cipher)
1365                 NLA_PUT_U32(cookie->msg, NL80211_KEY_CIPHER,
1366                             params->cipher);
1367
1368         NLA_PUT_U8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx);
1369
1370         nla_nest_end(cookie->msg, key);
1371
1372         return;
1373  nla_put_failure:
1374         cookie->error = 1;
1375 }
1376
1377 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
1378 {
1379         struct cfg80211_registered_device *rdev;
1380         int err;
1381         struct net_device *dev;
1382         u8 key_idx = 0;
1383         u8 *mac_addr = NULL;
1384         struct get_key_cookie cookie = {
1385                 .error = 0,
1386         };
1387         void *hdr;
1388         struct sk_buff *msg;
1389
1390         if (info->attrs[NL80211_ATTR_KEY_IDX])
1391                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1392
1393         if (key_idx > 5)
1394                 return -EINVAL;
1395
1396         if (info->attrs[NL80211_ATTR_MAC])
1397                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1398
1399         rtnl_lock();
1400
1401         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1402         if (err)
1403                 goto unlock_rtnl;
1404
1405         if (!rdev->ops->get_key) {
1406                 err = -EOPNOTSUPP;
1407                 goto out;
1408         }
1409
1410         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1411         if (!msg) {
1412                 err = -ENOMEM;
1413                 goto out;
1414         }
1415
1416         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
1417                              NL80211_CMD_NEW_KEY);
1418
1419         if (IS_ERR(hdr)) {
1420                 err = PTR_ERR(hdr);
1421                 goto free_msg;
1422         }
1423
1424         cookie.msg = msg;
1425         cookie.idx = key_idx;
1426
1427         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1428         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1429         if (mac_addr)
1430                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1431
1432         err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, mac_addr,
1433                                 &cookie, get_key_callback);
1434
1435         if (err)
1436                 goto free_msg;
1437
1438         if (cookie.error)
1439                 goto nla_put_failure;
1440
1441         genlmsg_end(msg, hdr);
1442         err = genlmsg_reply(msg, info);
1443         goto out;
1444
1445  nla_put_failure:
1446         err = -ENOBUFS;
1447  free_msg:
1448         nlmsg_free(msg);
1449  out:
1450         cfg80211_unlock_rdev(rdev);
1451         dev_put(dev);
1452  unlock_rtnl:
1453         rtnl_unlock();
1454
1455         return err;
1456 }
1457
1458 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1459 {
1460         struct cfg80211_registered_device *rdev;
1461         struct key_parse key;
1462         int err;
1463         struct net_device *dev;
1464         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
1465                     u8 key_index);
1466
1467         err = nl80211_parse_key(info, &key);
1468         if (err)
1469                 return err;
1470
1471         if (key.idx < 0)
1472                 return -EINVAL;
1473
1474         /* only support setting default key */
1475         if (!key.def && !key.defmgmt)
1476                 return -EINVAL;
1477
1478         rtnl_lock();
1479
1480         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1481         if (err)
1482                 goto unlock_rtnl;
1483
1484         if (key.def)
1485                 func = rdev->ops->set_default_key;
1486         else
1487                 func = rdev->ops->set_default_mgmt_key;
1488
1489         if (!func) {
1490                 err = -EOPNOTSUPP;
1491                 goto out;
1492         }
1493
1494         wdev_lock(dev->ieee80211_ptr);
1495         err = nl80211_key_allowed(dev->ieee80211_ptr);
1496         if (!err)
1497                 err = func(&rdev->wiphy, dev, key.idx);
1498
1499 #ifdef CONFIG_CFG80211_WEXT
1500         if (!err) {
1501                 if (func == rdev->ops->set_default_key)
1502                         dev->ieee80211_ptr->wext.default_key = key.idx;
1503                 else
1504                         dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
1505         }
1506 #endif
1507         wdev_unlock(dev->ieee80211_ptr);
1508
1509  out:
1510         cfg80211_unlock_rdev(rdev);
1511         dev_put(dev);
1512
1513  unlock_rtnl:
1514         rtnl_unlock();
1515
1516         return err;
1517 }
1518
1519 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1520 {
1521         struct cfg80211_registered_device *rdev;
1522         int err;
1523         struct net_device *dev;
1524         struct key_parse key;
1525         u8 *mac_addr = NULL;
1526
1527         err = nl80211_parse_key(info, &key);
1528         if (err)
1529                 return err;
1530
1531         if (!key.p.key)
1532                 return -EINVAL;
1533
1534         if (info->attrs[NL80211_ATTR_MAC])
1535                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1536
1537         rtnl_lock();
1538
1539         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1540         if (err)
1541                 goto unlock_rtnl;
1542
1543         if (!rdev->ops->add_key) {
1544                 err = -EOPNOTSUPP;
1545                 goto out;
1546         }
1547
1548         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx, mac_addr)) {
1549                 err = -EINVAL;
1550                 goto out;
1551         }
1552
1553         wdev_lock(dev->ieee80211_ptr);
1554         err = nl80211_key_allowed(dev->ieee80211_ptr);
1555         if (!err)
1556                 err = rdev->ops->add_key(&rdev->wiphy, dev, key.idx,
1557                                          mac_addr, &key.p);
1558         wdev_unlock(dev->ieee80211_ptr);
1559
1560  out:
1561         cfg80211_unlock_rdev(rdev);
1562         dev_put(dev);
1563  unlock_rtnl:
1564         rtnl_unlock();
1565
1566         return err;
1567 }
1568
1569 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1570 {
1571         struct cfg80211_registered_device *rdev;
1572         int err;
1573         struct net_device *dev;
1574         u8 *mac_addr = NULL;
1575         struct key_parse key;
1576
1577         err = nl80211_parse_key(info, &key);
1578         if (err)
1579                 return err;
1580
1581         if (info->attrs[NL80211_ATTR_MAC])
1582                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1583
1584         rtnl_lock();
1585
1586         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1587         if (err)
1588                 goto unlock_rtnl;
1589
1590         if (!rdev->ops->del_key) {
1591                 err = -EOPNOTSUPP;
1592                 goto out;
1593         }
1594
1595         wdev_lock(dev->ieee80211_ptr);
1596         err = nl80211_key_allowed(dev->ieee80211_ptr);
1597         if (!err)
1598                 err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx, mac_addr);
1599
1600 #ifdef CONFIG_CFG80211_WEXT
1601         if (!err) {
1602                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
1603                         dev->ieee80211_ptr->wext.default_key = -1;
1604                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
1605                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
1606         }
1607 #endif
1608         wdev_unlock(dev->ieee80211_ptr);
1609
1610  out:
1611         cfg80211_unlock_rdev(rdev);
1612         dev_put(dev);
1613
1614  unlock_rtnl:
1615         rtnl_unlock();
1616
1617         return err;
1618 }
1619
1620 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1621 {
1622         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1623                     struct beacon_parameters *info);
1624         struct cfg80211_registered_device *rdev;
1625         int err;
1626         struct net_device *dev;
1627         struct beacon_parameters params;
1628         int haveinfo = 0;
1629
1630         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
1631                 return -EINVAL;
1632
1633         rtnl_lock();
1634
1635         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1636         if (err)
1637                 goto unlock_rtnl;
1638
1639         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1640                 err = -EOPNOTSUPP;
1641                 goto out;
1642         }
1643
1644         switch (info->genlhdr->cmd) {
1645         case NL80211_CMD_NEW_BEACON:
1646                 /* these are required for NEW_BEACON */
1647                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1648                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1649                     !info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1650                         err = -EINVAL;
1651                         goto out;
1652                 }
1653
1654                 call = rdev->ops->add_beacon;
1655                 break;
1656         case NL80211_CMD_SET_BEACON:
1657                 call = rdev->ops->set_beacon;
1658                 break;
1659         default:
1660                 WARN_ON(1);
1661                 err = -EOPNOTSUPP;
1662                 goto out;
1663         }
1664
1665         if (!call) {
1666                 err = -EOPNOTSUPP;
1667                 goto out;
1668         }
1669
1670         memset(&params, 0, sizeof(params));
1671
1672         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1673                 params.interval =
1674                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1675                 haveinfo = 1;
1676         }
1677
1678         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1679                 params.dtim_period =
1680                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1681                 haveinfo = 1;
1682         }
1683
1684         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1685                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1686                 params.head_len =
1687                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1688                 haveinfo = 1;
1689         }
1690
1691         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1692                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1693                 params.tail_len =
1694                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1695                 haveinfo = 1;
1696         }
1697
1698         if (!haveinfo) {
1699                 err = -EINVAL;
1700                 goto out;
1701         }
1702
1703         err = call(&rdev->wiphy, dev, &params);
1704
1705  out:
1706         cfg80211_unlock_rdev(rdev);
1707         dev_put(dev);
1708  unlock_rtnl:
1709         rtnl_unlock();
1710
1711         return err;
1712 }
1713
1714 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1715 {
1716         struct cfg80211_registered_device *rdev;
1717         int err;
1718         struct net_device *dev;
1719
1720         rtnl_lock();
1721
1722         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1723         if (err)
1724                 goto unlock_rtnl;
1725
1726         if (!rdev->ops->del_beacon) {
1727                 err = -EOPNOTSUPP;
1728                 goto out;
1729         }
1730
1731         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1732                 err = -EOPNOTSUPP;
1733                 goto out;
1734         }
1735         err = rdev->ops->del_beacon(&rdev->wiphy, dev);
1736
1737  out:
1738         cfg80211_unlock_rdev(rdev);
1739         dev_put(dev);
1740  unlock_rtnl:
1741         rtnl_unlock();
1742
1743         return err;
1744 }
1745
1746 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1747         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1748         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1749         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1750         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
1751 };
1752
1753 static int parse_station_flags(struct genl_info *info,
1754                                struct station_parameters *params)
1755 {
1756         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1757         struct nlattr *nla;
1758         int flag;
1759
1760         /*
1761          * Try parsing the new attribute first so userspace
1762          * can specify both for older kernels.
1763          */
1764         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
1765         if (nla) {
1766                 struct nl80211_sta_flag_update *sta_flags;
1767
1768                 sta_flags = nla_data(nla);
1769                 params->sta_flags_mask = sta_flags->mask;
1770                 params->sta_flags_set = sta_flags->set;
1771                 if ((params->sta_flags_mask |
1772                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
1773                         return -EINVAL;
1774                 return 0;
1775         }
1776
1777         /* if present, parse the old attribute */
1778
1779         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
1780         if (!nla)
1781                 return 0;
1782
1783         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1784                              nla, sta_flags_policy))
1785                 return -EINVAL;
1786
1787         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
1788         params->sta_flags_mask &= ~1;
1789
1790         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1791                 if (flags[flag])
1792                         params->sta_flags_set |= (1<<flag);
1793
1794         return 0;
1795 }
1796
1797 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1798                                 int flags, struct net_device *dev,
1799                                 const u8 *mac_addr, struct station_info *sinfo)
1800 {
1801         void *hdr;
1802         struct nlattr *sinfoattr, *txrate;
1803         u16 bitrate;
1804
1805         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1806         if (!hdr)
1807                 return -1;
1808
1809         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1810         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1811
1812         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, sinfo->generation);
1813
1814         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1815         if (!sinfoattr)
1816                 goto nla_put_failure;
1817         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1818                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1819                             sinfo->inactive_time);
1820         if (sinfo->filled & STATION_INFO_RX_BYTES)
1821                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1822                             sinfo->rx_bytes);
1823         if (sinfo->filled & STATION_INFO_TX_BYTES)
1824                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1825                             sinfo->tx_bytes);
1826         if (sinfo->filled & STATION_INFO_LLID)
1827                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1828                             sinfo->llid);
1829         if (sinfo->filled & STATION_INFO_PLID)
1830                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1831                             sinfo->plid);
1832         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1833                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1834                             sinfo->plink_state);
1835         if (sinfo->filled & STATION_INFO_SIGNAL)
1836                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1837                            sinfo->signal);
1838         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1839                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1840                 if (!txrate)
1841                         goto nla_put_failure;
1842
1843                 /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
1844                 bitrate = cfg80211_calculate_bitrate(&sinfo->txrate);
1845                 if (bitrate > 0)
1846                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1847
1848                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1849                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1850                                     sinfo->txrate.mcs);
1851                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1852                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1853                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1854                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1855
1856                 nla_nest_end(msg, txrate);
1857         }
1858         if (sinfo->filled & STATION_INFO_RX_PACKETS)
1859                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
1860                             sinfo->rx_packets);
1861         if (sinfo->filled & STATION_INFO_TX_PACKETS)
1862                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
1863                             sinfo->tx_packets);
1864         nla_nest_end(msg, sinfoattr);
1865
1866         return genlmsg_end(msg, hdr);
1867
1868  nla_put_failure:
1869         genlmsg_cancel(msg, hdr);
1870         return -EMSGSIZE;
1871 }
1872
1873 static int nl80211_dump_station(struct sk_buff *skb,
1874                                 struct netlink_callback *cb)
1875 {
1876         struct station_info sinfo;
1877         struct cfg80211_registered_device *dev;
1878         struct net_device *netdev;
1879         u8 mac_addr[ETH_ALEN];
1880         int ifidx = cb->args[0];
1881         int sta_idx = cb->args[1];
1882         int err;
1883
1884         if (!ifidx)
1885                 ifidx = nl80211_get_ifidx(cb);
1886         if (ifidx < 0)
1887                 return ifidx;
1888
1889         rtnl_lock();
1890
1891         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1892         if (!netdev) {
1893                 err = -ENODEV;
1894                 goto out_rtnl;
1895         }
1896
1897         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
1898         if (IS_ERR(dev)) {
1899                 err = PTR_ERR(dev);
1900                 goto out_rtnl;
1901         }
1902
1903         if (!dev->ops->dump_station) {
1904                 err = -EOPNOTSUPP;
1905                 goto out_err;
1906         }
1907
1908         while (1) {
1909                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1910                                              mac_addr, &sinfo);
1911                 if (err == -ENOENT)
1912                         break;
1913                 if (err)
1914                         goto out_err;
1915
1916                 if (nl80211_send_station(skb,
1917                                 NETLINK_CB(cb->skb).pid,
1918                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
1919                                 netdev, mac_addr,
1920                                 &sinfo) < 0)
1921                         goto out;
1922
1923                 sta_idx++;
1924         }
1925
1926
1927  out:
1928         cb->args[1] = sta_idx;
1929         err = skb->len;
1930  out_err:
1931         cfg80211_unlock_rdev(dev);
1932  out_rtnl:
1933         rtnl_unlock();
1934
1935         return err;
1936 }
1937
1938 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1939 {
1940         struct cfg80211_registered_device *rdev;
1941         int err;
1942         struct net_device *dev;
1943         struct station_info sinfo;
1944         struct sk_buff *msg;
1945         u8 *mac_addr = NULL;
1946
1947         memset(&sinfo, 0, sizeof(sinfo));
1948
1949         if (!info->attrs[NL80211_ATTR_MAC])
1950                 return -EINVAL;
1951
1952         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1953
1954         rtnl_lock();
1955
1956         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
1957         if (err)
1958                 goto out_rtnl;
1959
1960         if (!rdev->ops->get_station) {
1961                 err = -EOPNOTSUPP;
1962                 goto out;
1963         }
1964
1965         err = rdev->ops->get_station(&rdev->wiphy, dev, mac_addr, &sinfo);
1966         if (err)
1967                 goto out;
1968
1969         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1970         if (!msg)
1971                 goto out;
1972
1973         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1974                                  dev, mac_addr, &sinfo) < 0)
1975                 goto out_free;
1976
1977         err = genlmsg_reply(msg, info);
1978         goto out;
1979
1980  out_free:
1981         nlmsg_free(msg);
1982  out:
1983         cfg80211_unlock_rdev(rdev);
1984         dev_put(dev);
1985  out_rtnl:
1986         rtnl_unlock();
1987
1988         return err;
1989 }
1990
1991 /*
1992  * Get vlan interface making sure it is running and on the right wiphy.
1993  */
1994 static int get_vlan(struct genl_info *info,
1995                     struct cfg80211_registered_device *rdev,
1996                     struct net_device **vlan)
1997 {
1998         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
1999         *vlan = NULL;
2000
2001         if (vlanattr) {
2002                 *vlan = dev_get_by_index(genl_info_net(info),
2003                                          nla_get_u32(vlanattr));
2004                 if (!*vlan)
2005                         return -ENODEV;
2006                 if (!(*vlan)->ieee80211_ptr)
2007                         return -EINVAL;
2008                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
2009                         return -EINVAL;
2010                 if (!netif_running(*vlan))
2011                         return -ENETDOWN;
2012         }
2013         return 0;
2014 }
2015
2016 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
2017 {
2018         struct cfg80211_registered_device *rdev;
2019         int err;
2020         struct net_device *dev;
2021         struct station_parameters params;
2022         u8 *mac_addr = NULL;
2023
2024         memset(&params, 0, sizeof(params));
2025
2026         params.listen_interval = -1;
2027
2028         if (info->attrs[NL80211_ATTR_STA_AID])
2029                 return -EINVAL;
2030
2031         if (!info->attrs[NL80211_ATTR_MAC])
2032                 return -EINVAL;
2033
2034         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2035
2036         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
2037                 params.supported_rates =
2038                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2039                 params.supported_rates_len =
2040                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2041         }
2042
2043         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2044                 params.listen_interval =
2045                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2046
2047         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2048                 params.ht_capa =
2049                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2050
2051         if (parse_station_flags(info, &params))
2052                 return -EINVAL;
2053
2054         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
2055                 params.plink_action =
2056                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
2057
2058         rtnl_lock();
2059
2060         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2061         if (err)
2062                 goto out_rtnl;
2063
2064         err = get_vlan(info, rdev, &params.vlan);
2065         if (err)
2066                 goto out;
2067
2068         /* validate settings */
2069         err = 0;
2070
2071         switch (dev->ieee80211_ptr->iftype) {
2072         case NL80211_IFTYPE_AP:
2073         case NL80211_IFTYPE_AP_VLAN:
2074                 /* disallow mesh-specific things */
2075                 if (params.plink_action)
2076                         err = -EINVAL;
2077                 break;
2078         case NL80211_IFTYPE_STATION:
2079                 /* disallow everything but AUTHORIZED flag */
2080                 if (params.plink_action)
2081                         err = -EINVAL;
2082                 if (params.vlan)
2083                         err = -EINVAL;
2084                 if (params.supported_rates)
2085                         err = -EINVAL;
2086                 if (params.ht_capa)
2087                         err = -EINVAL;
2088                 if (params.listen_interval >= 0)
2089                         err = -EINVAL;
2090                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
2091                         err = -EINVAL;
2092                 break;
2093         case NL80211_IFTYPE_MESH_POINT:
2094                 /* disallow things mesh doesn't support */
2095                 if (params.vlan)
2096                         err = -EINVAL;
2097                 if (params.ht_capa)
2098                         err = -EINVAL;
2099                 if (params.listen_interval >= 0)
2100                         err = -EINVAL;
2101                 if (params.supported_rates)
2102                         err = -EINVAL;
2103                 if (params.sta_flags_mask)
2104                         err = -EINVAL;
2105                 break;
2106         default:
2107                 err = -EINVAL;
2108         }
2109
2110         if (err)
2111                 goto out;
2112
2113         if (!rdev->ops->change_station) {
2114                 err = -EOPNOTSUPP;
2115                 goto out;
2116         }
2117
2118         err = rdev->ops->change_station(&rdev->wiphy, dev, mac_addr, &params);
2119
2120  out:
2121         if (params.vlan)
2122                 dev_put(params.vlan);
2123         cfg80211_unlock_rdev(rdev);
2124         dev_put(dev);
2125  out_rtnl:
2126         rtnl_unlock();
2127
2128         return err;
2129 }
2130
2131 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
2132 {
2133         struct cfg80211_registered_device *rdev;
2134         int err;
2135         struct net_device *dev;
2136         struct station_parameters params;
2137         u8 *mac_addr = NULL;
2138
2139         memset(&params, 0, sizeof(params));
2140
2141         if (!info->attrs[NL80211_ATTR_MAC])
2142                 return -EINVAL;
2143
2144         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
2145                 return -EINVAL;
2146
2147         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
2148                 return -EINVAL;
2149
2150         if (!info->attrs[NL80211_ATTR_STA_AID])
2151                 return -EINVAL;
2152
2153         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2154         params.supported_rates =
2155                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2156         params.supported_rates_len =
2157                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
2158         params.listen_interval =
2159                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
2160
2161         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
2162         if (!params.aid || params.aid > IEEE80211_MAX_AID)
2163                 return -EINVAL;
2164
2165         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
2166                 params.ht_capa =
2167                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2168
2169         if (parse_station_flags(info, &params))
2170                 return -EINVAL;
2171
2172         rtnl_lock();
2173
2174         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2175         if (err)
2176                 goto out_rtnl;
2177
2178         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2179             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN) {
2180                 err = -EINVAL;
2181                 goto out;
2182         }
2183
2184         err = get_vlan(info, rdev, &params.vlan);
2185         if (err)
2186                 goto out;
2187
2188         /* validate settings */
2189         err = 0;
2190
2191         if (!rdev->ops->add_station) {
2192                 err = -EOPNOTSUPP;
2193                 goto out;
2194         }
2195
2196         if (!netif_running(dev)) {
2197                 err = -ENETDOWN;
2198                 goto out;
2199         }
2200
2201         err = rdev->ops->add_station(&rdev->wiphy, dev, mac_addr, &params);
2202
2203  out:
2204         if (params.vlan)
2205                 dev_put(params.vlan);
2206         cfg80211_unlock_rdev(rdev);
2207         dev_put(dev);
2208  out_rtnl:
2209         rtnl_unlock();
2210
2211         return err;
2212 }
2213
2214 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
2215 {
2216         struct cfg80211_registered_device *rdev;
2217         int err;
2218         struct net_device *dev;
2219         u8 *mac_addr = NULL;
2220
2221         if (info->attrs[NL80211_ATTR_MAC])
2222                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2223
2224         rtnl_lock();
2225
2226         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2227         if (err)
2228                 goto out_rtnl;
2229
2230         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2231             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2232             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2233                 err = -EINVAL;
2234                 goto out;
2235         }
2236
2237         if (!rdev->ops->del_station) {
2238                 err = -EOPNOTSUPP;
2239                 goto out;
2240         }
2241
2242         err = rdev->ops->del_station(&rdev->wiphy, dev, mac_addr);
2243
2244  out:
2245         cfg80211_unlock_rdev(rdev);
2246         dev_put(dev);
2247  out_rtnl:
2248         rtnl_unlock();
2249
2250         return err;
2251 }
2252
2253 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
2254                                 int flags, struct net_device *dev,
2255                                 u8 *dst, u8 *next_hop,
2256                                 struct mpath_info *pinfo)
2257 {
2258         void *hdr;
2259         struct nlattr *pinfoattr;
2260
2261         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2262         if (!hdr)
2263                 return -1;
2264
2265         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2266         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
2267         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
2268
2269         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, pinfo->generation);
2270
2271         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
2272         if (!pinfoattr)
2273                 goto nla_put_failure;
2274         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
2275                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
2276                             pinfo->frame_qlen);
2277         if (pinfo->filled & MPATH_INFO_SN)
2278                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_SN,
2279                             pinfo->sn);
2280         if (pinfo->filled & MPATH_INFO_METRIC)
2281                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
2282                             pinfo->metric);
2283         if (pinfo->filled & MPATH_INFO_EXPTIME)
2284                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
2285                             pinfo->exptime);
2286         if (pinfo->filled & MPATH_INFO_FLAGS)
2287                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
2288                             pinfo->flags);
2289         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
2290                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
2291                             pinfo->discovery_timeout);
2292         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
2293                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
2294                             pinfo->discovery_retries);
2295
2296         nla_nest_end(msg, pinfoattr);
2297
2298         return genlmsg_end(msg, hdr);
2299
2300  nla_put_failure:
2301         genlmsg_cancel(msg, hdr);
2302         return -EMSGSIZE;
2303 }
2304
2305 static int nl80211_dump_mpath(struct sk_buff *skb,
2306                               struct netlink_callback *cb)
2307 {
2308         struct mpath_info pinfo;
2309         struct cfg80211_registered_device *dev;
2310         struct net_device *netdev;
2311         u8 dst[ETH_ALEN];
2312         u8 next_hop[ETH_ALEN];
2313         int ifidx = cb->args[0];
2314         int path_idx = cb->args[1];
2315         int err;
2316
2317         if (!ifidx)
2318                 ifidx = nl80211_get_ifidx(cb);
2319         if (ifidx < 0)
2320                 return ifidx;
2321
2322         rtnl_lock();
2323
2324         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
2325         if (!netdev) {
2326                 err = -ENODEV;
2327                 goto out_rtnl;
2328         }
2329
2330         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
2331         if (IS_ERR(dev)) {
2332                 err = PTR_ERR(dev);
2333                 goto out_rtnl;
2334         }
2335
2336         if (!dev->ops->dump_mpath) {
2337                 err = -EOPNOTSUPP;
2338                 goto out_err;
2339         }
2340
2341         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2342                 err = -EOPNOTSUPP;
2343                 goto out_err;
2344         }
2345
2346         while (1) {
2347                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
2348                                            dst, next_hop, &pinfo);
2349                 if (err == -ENOENT)
2350                         break;
2351                 if (err)
2352                         goto out_err;
2353
2354                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
2355                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
2356                                        netdev, dst, next_hop,
2357                                        &pinfo) < 0)
2358                         goto out;
2359
2360                 path_idx++;
2361         }
2362
2363
2364  out:
2365         cb->args[1] = path_idx;
2366         err = skb->len;
2367  out_err:
2368         cfg80211_unlock_rdev(dev);
2369  out_rtnl:
2370         rtnl_unlock();
2371
2372         return err;
2373 }
2374
2375 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
2376 {
2377         struct cfg80211_registered_device *rdev;
2378         int err;
2379         struct net_device *dev;
2380         struct mpath_info pinfo;
2381         struct sk_buff *msg;
2382         u8 *dst = NULL;
2383         u8 next_hop[ETH_ALEN];
2384
2385         memset(&pinfo, 0, sizeof(pinfo));
2386
2387         if (!info->attrs[NL80211_ATTR_MAC])
2388                 return -EINVAL;
2389
2390         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2391
2392         rtnl_lock();
2393
2394         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2395         if (err)
2396                 goto out_rtnl;
2397
2398         if (!rdev->ops->get_mpath) {
2399                 err = -EOPNOTSUPP;
2400                 goto out;
2401         }
2402
2403         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2404                 err = -EOPNOTSUPP;
2405                 goto out;
2406         }
2407
2408         err = rdev->ops->get_mpath(&rdev->wiphy, dev, dst, next_hop, &pinfo);
2409         if (err)
2410                 goto out;
2411
2412         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2413         if (!msg)
2414                 goto out;
2415
2416         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2417                                  dev, dst, next_hop, &pinfo) < 0)
2418                 goto out_free;
2419
2420         err = genlmsg_reply(msg, info);
2421         goto out;
2422
2423  out_free:
2424         nlmsg_free(msg);
2425  out:
2426         cfg80211_unlock_rdev(rdev);
2427         dev_put(dev);
2428  out_rtnl:
2429         rtnl_unlock();
2430
2431         return err;
2432 }
2433
2434 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2435 {
2436         struct cfg80211_registered_device *rdev;
2437         int err;
2438         struct net_device *dev;
2439         u8 *dst = NULL;
2440         u8 *next_hop = NULL;
2441
2442         if (!info->attrs[NL80211_ATTR_MAC])
2443                 return -EINVAL;
2444
2445         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2446                 return -EINVAL;
2447
2448         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2449         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2450
2451         rtnl_lock();
2452
2453         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2454         if (err)
2455                 goto out_rtnl;
2456
2457         if (!rdev->ops->change_mpath) {
2458                 err = -EOPNOTSUPP;
2459                 goto out;
2460         }
2461
2462         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2463                 err = -EOPNOTSUPP;
2464                 goto out;
2465         }
2466
2467         if (!netif_running(dev)) {
2468                 err = -ENETDOWN;
2469                 goto out;
2470         }
2471
2472         err = rdev->ops->change_mpath(&rdev->wiphy, dev, dst, next_hop);
2473
2474  out:
2475         cfg80211_unlock_rdev(rdev);
2476         dev_put(dev);
2477  out_rtnl:
2478         rtnl_unlock();
2479
2480         return err;
2481 }
2482 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2483 {
2484         struct cfg80211_registered_device *rdev;
2485         int err;
2486         struct net_device *dev;
2487         u8 *dst = NULL;
2488         u8 *next_hop = NULL;
2489
2490         if (!info->attrs[NL80211_ATTR_MAC])
2491                 return -EINVAL;
2492
2493         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2494                 return -EINVAL;
2495
2496         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2497         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2498
2499         rtnl_lock();
2500
2501         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2502         if (err)
2503                 goto out_rtnl;
2504
2505         if (!rdev->ops->add_mpath) {
2506                 err = -EOPNOTSUPP;
2507                 goto out;
2508         }
2509
2510         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2511                 err = -EOPNOTSUPP;
2512                 goto out;
2513         }
2514
2515         if (!netif_running(dev)) {
2516                 err = -ENETDOWN;
2517                 goto out;
2518         }
2519
2520         err = rdev->ops->add_mpath(&rdev->wiphy, dev, dst, next_hop);
2521
2522  out:
2523         cfg80211_unlock_rdev(rdev);
2524         dev_put(dev);
2525  out_rtnl:
2526         rtnl_unlock();
2527
2528         return err;
2529 }
2530
2531 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2532 {
2533         struct cfg80211_registered_device *rdev;
2534         int err;
2535         struct net_device *dev;
2536         u8 *dst = NULL;
2537
2538         if (info->attrs[NL80211_ATTR_MAC])
2539                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2540
2541         rtnl_lock();
2542
2543         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2544         if (err)
2545                 goto out_rtnl;
2546
2547         if (!rdev->ops->del_mpath) {
2548                 err = -EOPNOTSUPP;
2549                 goto out;
2550         }
2551
2552         err = rdev->ops->del_mpath(&rdev->wiphy, dev, dst);
2553
2554  out:
2555         cfg80211_unlock_rdev(rdev);
2556         dev_put(dev);
2557  out_rtnl:
2558         rtnl_unlock();
2559
2560         return err;
2561 }
2562
2563 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2564 {
2565         struct cfg80211_registered_device *rdev;
2566         int err;
2567         struct net_device *dev;
2568         struct bss_parameters params;
2569
2570         memset(&params, 0, sizeof(params));
2571         /* default to not changing parameters */
2572         params.use_cts_prot = -1;
2573         params.use_short_preamble = -1;
2574         params.use_short_slot_time = -1;
2575         params.ap_isolate = -1;
2576
2577         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2578                 params.use_cts_prot =
2579                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2580         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2581                 params.use_short_preamble =
2582                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2583         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2584                 params.use_short_slot_time =
2585                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2586         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2587                 params.basic_rates =
2588                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2589                 params.basic_rates_len =
2590                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2591         }
2592         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
2593                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
2594
2595         rtnl_lock();
2596
2597         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2598         if (err)
2599                 goto out_rtnl;
2600
2601         if (!rdev->ops->change_bss) {
2602                 err = -EOPNOTSUPP;
2603                 goto out;
2604         }
2605
2606         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
2607                 err = -EOPNOTSUPP;
2608                 goto out;
2609         }
2610
2611         err = rdev->ops->change_bss(&rdev->wiphy, dev, &params);
2612
2613  out:
2614         cfg80211_unlock_rdev(rdev);
2615         dev_put(dev);
2616  out_rtnl:
2617         rtnl_unlock();
2618
2619         return err;
2620 }
2621
2622 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2623         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2624         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2625         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2626         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2627         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2628         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2629 };
2630
2631 static int parse_reg_rule(struct nlattr *tb[],
2632         struct ieee80211_reg_rule *reg_rule)
2633 {
2634         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2635         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2636
2637         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2638                 return -EINVAL;
2639         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2640                 return -EINVAL;
2641         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2642                 return -EINVAL;
2643         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2644                 return -EINVAL;
2645         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2646                 return -EINVAL;
2647
2648         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2649
2650         freq_range->start_freq_khz =
2651                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2652         freq_range->end_freq_khz =
2653                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2654         freq_range->max_bandwidth_khz =
2655                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2656
2657         power_rule->max_eirp =
2658                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2659
2660         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2661                 power_rule->max_antenna_gain =
2662                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2663
2664         return 0;
2665 }
2666
2667 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2668 {
2669         int r;
2670         char *data = NULL;
2671
2672         /*
2673          * You should only get this when cfg80211 hasn't yet initialized
2674          * completely when built-in to the kernel right between the time
2675          * window between nl80211_init() and regulatory_init(), if that is
2676          * even possible.
2677          */
2678         mutex_lock(&cfg80211_mutex);
2679         if (unlikely(!cfg80211_regdomain)) {
2680                 mutex_unlock(&cfg80211_mutex);
2681                 return -EINPROGRESS;
2682         }
2683         mutex_unlock(&cfg80211_mutex);
2684
2685         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2686                 return -EINVAL;
2687
2688         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2689
2690         r = regulatory_hint_user(data);
2691
2692         return r;
2693 }
2694
2695 static int nl80211_get_mesh_params(struct sk_buff *skb,
2696         struct genl_info *info)
2697 {
2698         struct cfg80211_registered_device *rdev;
2699         struct mesh_config cur_params;
2700         int err;
2701         struct net_device *dev;
2702         void *hdr;
2703         struct nlattr *pinfoattr;
2704         struct sk_buff *msg;
2705
2706         rtnl_lock();
2707
2708         /* Look up our device */
2709         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2710         if (err)
2711                 goto out_rtnl;
2712
2713         if (!rdev->ops->get_mesh_params) {
2714                 err = -EOPNOTSUPP;
2715                 goto out;
2716         }
2717
2718         /* Get the mesh params */
2719         err = rdev->ops->get_mesh_params(&rdev->wiphy, dev, &cur_params);
2720         if (err)
2721                 goto out;
2722
2723         /* Draw up a netlink message to send back */
2724         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2725         if (!msg) {
2726                 err = -ENOBUFS;
2727                 goto out;
2728         }
2729         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2730                              NL80211_CMD_GET_MESH_PARAMS);
2731         if (!hdr)
2732                 goto nla_put_failure;
2733         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
2734         if (!pinfoattr)
2735                 goto nla_put_failure;
2736         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2737         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2738                         cur_params.dot11MeshRetryTimeout);
2739         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2740                         cur_params.dot11MeshConfirmTimeout);
2741         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2742                         cur_params.dot11MeshHoldingTimeout);
2743         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2744                         cur_params.dot11MeshMaxPeerLinks);
2745         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2746                         cur_params.dot11MeshMaxRetries);
2747         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2748                         cur_params.dot11MeshTTL);
2749         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2750                         cur_params.auto_open_plinks);
2751         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2752                         cur_params.dot11MeshHWMPmaxPREQretries);
2753         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2754                         cur_params.path_refresh_time);
2755         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2756                         cur_params.min_discovery_timeout);
2757         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2758                         cur_params.dot11MeshHWMPactivePathTimeout);
2759         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2760                         cur_params.dot11MeshHWMPpreqMinInterval);
2761         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2762                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2763         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
2764                         cur_params.dot11MeshHWMPRootMode);
2765         nla_nest_end(msg, pinfoattr);
2766         genlmsg_end(msg, hdr);
2767         err = genlmsg_reply(msg, info);
2768         goto out;
2769
2770  nla_put_failure:
2771         genlmsg_cancel(msg, hdr);
2772         err = -EMSGSIZE;
2773  out:
2774         /* Cleanup */
2775         cfg80211_unlock_rdev(rdev);
2776         dev_put(dev);
2777  out_rtnl:
2778         rtnl_unlock();
2779
2780         return err;
2781 }
2782
2783 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2784 do {\
2785         if (table[attr_num]) {\
2786                 cfg.param = nla_fn(table[attr_num]); \
2787                 mask |= (1 << (attr_num - 1)); \
2788         } \
2789 } while (0);\
2790
2791 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
2792         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2793         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2794         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2795         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2796         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2797         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2798         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2799
2800         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2801         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2802         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2803         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2804         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2805         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2806 };
2807
2808 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2809 {
2810         int err;
2811         u32 mask;
2812         struct cfg80211_registered_device *rdev;
2813         struct net_device *dev;
2814         struct mesh_config cfg;
2815         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2816         struct nlattr *parent_attr;
2817
2818         parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
2819         if (!parent_attr)
2820                 return -EINVAL;
2821         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2822                         parent_attr, nl80211_meshconf_params_policy))
2823                 return -EINVAL;
2824
2825         rtnl_lock();
2826
2827         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
2828         if (err)
2829                 goto out_rtnl;
2830
2831         if (!rdev->ops->set_mesh_params) {
2832                 err = -EOPNOTSUPP;
2833                 goto out;
2834         }
2835
2836         /* This makes sure that there aren't more than 32 mesh config
2837          * parameters (otherwise our bitfield scheme would not work.) */
2838         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2839
2840         /* Fill in the params struct */
2841         mask = 0;
2842         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2843                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2844         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2845                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2846         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2847                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2848         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2849                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2850         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2851                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2852         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2853                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2854         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2855                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2856         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2857                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2858                         nla_get_u8);
2859         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2860                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2861         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2862                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2863                         nla_get_u16);
2864         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2865                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2866                         nla_get_u32);
2867         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2868                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2869                         nla_get_u16);
2870         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2871                         dot11MeshHWMPnetDiameterTraversalTime,
2872                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2873                         nla_get_u16);
2874         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2875                         dot11MeshHWMPRootMode, mask,
2876                         NL80211_MESHCONF_HWMP_ROOTMODE,
2877                         nla_get_u8);
2878
2879         /* Apply changes */
2880         err = rdev->ops->set_mesh_params(&rdev->wiphy, dev, &cfg, mask);
2881
2882  out:
2883         /* cleanup */
2884         cfg80211_unlock_rdev(rdev);
2885         dev_put(dev);
2886  out_rtnl:
2887         rtnl_unlock();
2888
2889         return err;
2890 }
2891
2892 #undef FILL_IN_MESH_PARAM_IF_SET
2893
2894 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2895 {
2896         struct sk_buff *msg;
2897         void *hdr = NULL;
2898         struct nlattr *nl_reg_rules;
2899         unsigned int i;
2900         int err = -EINVAL;
2901
2902         mutex_lock(&cfg80211_mutex);
2903
2904         if (!cfg80211_regdomain)
2905                 goto out;
2906
2907         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2908         if (!msg) {
2909                 err = -ENOBUFS;
2910                 goto out;
2911         }
2912
2913         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2914                              NL80211_CMD_GET_REG);
2915         if (!hdr)
2916                 goto nla_put_failure;
2917
2918         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2919                 cfg80211_regdomain->alpha2);
2920
2921         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2922         if (!nl_reg_rules)
2923                 goto nla_put_failure;
2924
2925         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2926                 struct nlattr *nl_reg_rule;
2927                 const struct ieee80211_reg_rule *reg_rule;
2928                 const struct ieee80211_freq_range *freq_range;
2929                 const struct ieee80211_power_rule *power_rule;
2930
2931                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2932                 freq_range = &reg_rule->freq_range;
2933                 power_rule = &reg_rule->power_rule;
2934
2935                 nl_reg_rule = nla_nest_start(msg, i);
2936                 if (!nl_reg_rule)
2937                         goto nla_put_failure;
2938
2939                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2940                         reg_rule->flags);
2941                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2942                         freq_range->start_freq_khz);
2943                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2944                         freq_range->end_freq_khz);
2945                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2946                         freq_range->max_bandwidth_khz);
2947                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2948                         power_rule->max_antenna_gain);
2949                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2950                         power_rule->max_eirp);
2951
2952                 nla_nest_end(msg, nl_reg_rule);
2953         }
2954
2955         nla_nest_end(msg, nl_reg_rules);
2956
2957         genlmsg_end(msg, hdr);
2958         err = genlmsg_reply(msg, info);
2959         goto out;
2960
2961 nla_put_failure:
2962         genlmsg_cancel(msg, hdr);
2963         err = -EMSGSIZE;
2964 out:
2965         mutex_unlock(&cfg80211_mutex);
2966         return err;
2967 }
2968
2969 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2970 {
2971         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2972         struct nlattr *nl_reg_rule;
2973         char *alpha2 = NULL;
2974         int rem_reg_rules = 0, r = 0;
2975         u32 num_rules = 0, rule_idx = 0, size_of_regd;
2976         struct ieee80211_regdomain *rd = NULL;
2977
2978         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2979                 return -EINVAL;
2980
2981         if (!info->attrs[NL80211_ATTR_REG_RULES])
2982                 return -EINVAL;
2983
2984         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2985
2986         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2987                         rem_reg_rules) {
2988                 num_rules++;
2989                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2990                         return -EINVAL;
2991         }
2992
2993         mutex_lock(&cfg80211_mutex);
2994
2995         if (!reg_is_valid_request(alpha2)) {
2996                 r = -EINVAL;
2997                 goto bad_reg;
2998         }
2999
3000         size_of_regd = sizeof(struct ieee80211_regdomain) +
3001                 (num_rules * sizeof(struct ieee80211_reg_rule));
3002
3003         rd = kzalloc(size_of_regd, GFP_KERNEL);
3004         if (!rd) {
3005                 r = -ENOMEM;
3006                 goto bad_reg;
3007         }
3008
3009         rd->n_reg_rules = num_rules;
3010         rd->alpha2[0] = alpha2[0];
3011         rd->alpha2[1] = alpha2[1];
3012
3013         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
3014                         rem_reg_rules) {
3015                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
3016                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
3017                         reg_rule_policy);
3018                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
3019                 if (r)
3020                         goto bad_reg;
3021
3022                 rule_idx++;
3023
3024                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
3025                         r = -EINVAL;
3026                         goto bad_reg;
3027                 }
3028         }
3029
3030         BUG_ON(rule_idx != num_rules);
3031
3032         r = set_regdom(rd);
3033
3034         mutex_unlock(&cfg80211_mutex);
3035
3036         return r;
3037
3038  bad_reg:
3039         mutex_unlock(&cfg80211_mutex);
3040         kfree(rd);
3041         return r;
3042 }
3043
3044 static int validate_scan_freqs(struct nlattr *freqs)
3045 {
3046         struct nlattr *attr1, *attr2;
3047         int n_channels = 0, tmp1, tmp2;
3048
3049         nla_for_each_nested(attr1, freqs, tmp1) {
3050                 n_channels++;
3051                 /*
3052                  * Some hardware has a limited channel list for
3053                  * scanning, and it is pretty much nonsensical
3054                  * to scan for a channel twice, so disallow that
3055                  * and don't require drivers to check that the
3056                  * channel list they get isn't longer than what
3057                  * they can scan, as long as they can scan all
3058                  * the channels they registered at once.
3059                  */
3060                 nla_for_each_nested(attr2, freqs, tmp2)
3061                         if (attr1 != attr2 &&
3062                             nla_get_u32(attr1) == nla_get_u32(attr2))
3063                                 return 0;
3064         }
3065
3066         return n_channels;
3067 }
3068
3069 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
3070 {
3071         struct cfg80211_registered_device *rdev;
3072         struct net_device *dev;
3073         struct cfg80211_scan_request *request;
3074         struct cfg80211_ssid *ssid;
3075         struct ieee80211_channel *channel;
3076         struct nlattr *attr;
3077         struct wiphy *wiphy;
3078         int err, tmp, n_ssids = 0, n_channels, i;
3079         enum ieee80211_band band;
3080         size_t ie_len;
3081
3082         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3083                 return -EINVAL;
3084
3085         rtnl_lock();
3086
3087         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3088         if (err)
3089                 goto out_rtnl;
3090
3091         wiphy = &rdev->wiphy;
3092
3093         if (!rdev->ops->scan) {
3094                 err = -EOPNOTSUPP;
3095                 goto out;
3096         }
3097
3098         if (!netif_running(dev)) {
3099                 err = -ENETDOWN;
3100                 goto out;
3101         }
3102
3103         if (rdev->scan_req) {
3104                 err = -EBUSY;
3105                 goto out;
3106         }
3107
3108         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3109                 n_channels = validate_scan_freqs(
3110                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
3111                 if (!n_channels) {
3112                         err = -EINVAL;
3113                         goto out;
3114                 }
3115         } else {
3116                 n_channels = 0;
3117
3118                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
3119                         if (wiphy->bands[band])
3120                                 n_channels += wiphy->bands[band]->n_channels;
3121         }
3122
3123         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
3124                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
3125                         n_ssids++;
3126
3127         if (n_ssids > wiphy->max_scan_ssids) {
3128                 err = -EINVAL;
3129                 goto out;
3130         }
3131
3132         if (info->attrs[NL80211_ATTR_IE])
3133                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3134         else
3135                 ie_len = 0;
3136
3137         if (ie_len > wiphy->max_scan_ie_len) {
3138                 err = -EINVAL;
3139                 goto out;
3140         }
3141
3142         request = kzalloc(sizeof(*request)
3143                         + sizeof(*ssid) * n_ssids
3144                         + sizeof(channel) * n_channels
3145                         + ie_len, GFP_KERNEL);
3146         if (!request) {
3147                 err = -ENOMEM;
3148                 goto out;
3149         }
3150
3151         if (n_ssids)
3152                 request->ssids = (void *)&request->channels[n_channels];
3153         request->n_ssids = n_ssids;
3154         if (ie_len) {
3155                 if (request->ssids)
3156                         request->ie = (void *)(request->ssids + n_ssids);
3157                 else
3158                         request->ie = (void *)(request->channels + n_channels);
3159         }
3160
3161         i = 0;
3162         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3163                 /* user specified, bail out if channel not found */
3164                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
3165                         struct ieee80211_channel *chan;
3166
3167                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
3168
3169                         if (!chan) {
3170                                 err = -EINVAL;
3171                                 goto out_free;
3172                         }
3173
3174                         /* ignore disabled channels */
3175                         if (chan->flags & IEEE80211_CHAN_DISABLED)
3176                                 continue;
3177
3178                         request->channels[i] = chan;
3179                         i++;
3180                 }
3181         } else {
3182                 /* all channels */
3183                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3184                         int j;
3185                         if (!wiphy->bands[band])
3186                                 continue;
3187                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3188                                 struct ieee80211_channel *chan;
3189
3190                                 chan = &wiphy->bands[band]->channels[j];
3191
3192                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
3193                                         continue;
3194
3195                                 request->channels[i] = chan;
3196                                 i++;
3197                         }
3198                 }
3199         }
3200
3201         if (!i) {
3202                 err = -EINVAL;
3203                 goto out_free;
3204         }
3205
3206         request->n_channels = i;
3207
3208         i = 0;
3209         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3210                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
3211                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
3212                                 err = -EINVAL;
3213                                 goto out_free;
3214                         }
3215                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
3216                         request->ssids[i].ssid_len = nla_len(attr);
3217                         i++;
3218                 }
3219         }
3220
3221         if (info->attrs[NL80211_ATTR_IE]) {
3222                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3223                 memcpy((void *)request->ie,
3224                        nla_data(info->attrs[NL80211_ATTR_IE]),
3225                        request->ie_len);
3226         }
3227
3228         request->dev = dev;
3229         request->wiphy = &rdev->wiphy;
3230
3231         rdev->scan_req = request;
3232         err = rdev->ops->scan(&rdev->wiphy, dev, request);
3233
3234         if (!err) {
3235                 nl80211_send_scan_start(rdev, dev);
3236                 dev_hold(dev);
3237         }
3238
3239  out_free:
3240         if (err) {
3241                 rdev->scan_req = NULL;
3242                 kfree(request);
3243         }
3244  out:
3245         cfg80211_unlock_rdev(rdev);
3246         dev_put(dev);
3247  out_rtnl:
3248         rtnl_unlock();
3249
3250         return err;
3251 }
3252
3253 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
3254                             struct cfg80211_registered_device *rdev,
3255                             struct wireless_dev *wdev,
3256                             struct cfg80211_internal_bss *intbss)
3257 {
3258         struct cfg80211_bss *res = &intbss->pub;
3259         void *hdr;
3260         struct nlattr *bss;
3261         int i;
3262
3263         ASSERT_WDEV_LOCK(wdev);
3264
3265         hdr = nl80211hdr_put(msg, pid, seq, flags,
3266                              NL80211_CMD_NEW_SCAN_RESULTS);
3267         if (!hdr)
3268                 return -1;
3269
3270         NLA_PUT_U32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation);
3271         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex);
3272
3273         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
3274         if (!bss)
3275                 goto nla_put_failure;
3276         if (!is_zero_ether_addr(res->bssid))
3277                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
3278         if (res->information_elements && res->len_information_elements)
3279                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
3280                         res->len_information_elements,
3281                         res->information_elements);
3282         if (res->beacon_ies && res->len_beacon_ies &&
3283             res->beacon_ies != res->information_elements)
3284                 NLA_PUT(msg, NL80211_BSS_BEACON_IES,
3285                         res->len_beacon_ies, res->beacon_ies);
3286         if (res->tsf)
3287                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
3288         if (res->beacon_interval)
3289                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
3290         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
3291         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
3292         NLA_PUT_U32(msg, NL80211_BSS_SEEN_MS_AGO,
3293                 jiffies_to_msecs(jiffies - intbss->ts));
3294
3295         switch (rdev->wiphy.signal_type) {
3296         case CFG80211_SIGNAL_TYPE_MBM:
3297                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
3298                 break;
3299         case CFG80211_SIGNAL_TYPE_UNSPEC:
3300                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
3301                 break;
3302         default:
3303                 break;
3304         }
3305
3306         switch (wdev->iftype) {
3307         case NL80211_IFTYPE_STATION:
3308                 if (intbss == wdev->current_bss)
3309                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3310                                     NL80211_BSS_STATUS_ASSOCIATED);
3311                 else for (i = 0; i < MAX_AUTH_BSSES; i++) {
3312                         if (intbss != wdev->auth_bsses[i])
3313                                 continue;
3314                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3315                                     NL80211_BSS_STATUS_AUTHENTICATED);
3316                         break;
3317                 }
3318                 break;
3319         case NL80211_IFTYPE_ADHOC:
3320                 if (intbss == wdev->current_bss)
3321                         NLA_PUT_U32(msg, NL80211_BSS_STATUS,
3322                                     NL80211_BSS_STATUS_IBSS_JOINED);
3323                 break;
3324         default:
3325                 break;
3326         }
3327
3328         nla_nest_end(msg, bss);
3329
3330         return genlmsg_end(msg, hdr);
3331
3332  nla_put_failure:
3333         genlmsg_cancel(msg, hdr);
3334         return -EMSGSIZE;
3335 }
3336
3337 static int nl80211_dump_scan(struct sk_buff *skb,
3338                              struct netlink_callback *cb)
3339 {
3340         struct cfg80211_registered_device *rdev;
3341         struct net_device *dev;
3342         struct cfg80211_internal_bss *scan;
3343         struct wireless_dev *wdev;
3344         int ifidx = cb->args[0];
3345         int start = cb->args[1], idx = 0;
3346         int err;
3347
3348         if (!ifidx)
3349                 ifidx = nl80211_get_ifidx(cb);
3350         if (ifidx < 0)
3351                 return ifidx;
3352         cb->args[0] = ifidx;
3353
3354         dev = dev_get_by_index(sock_net(skb->sk), ifidx);
3355         if (!dev)
3356                 return -ENODEV;
3357
3358         rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
3359         if (IS_ERR(rdev)) {
3360                 err = PTR_ERR(rdev);
3361                 goto out_put_netdev;
3362         }
3363
3364         wdev = dev->ieee80211_ptr;
3365
3366         wdev_lock(wdev);
3367         spin_lock_bh(&rdev->bss_lock);
3368         cfg80211_bss_expire(rdev);
3369
3370         list_for_each_entry(scan, &rdev->bss_list, list) {
3371                 if (++idx <= start)
3372                         continue;
3373                 if (nl80211_send_bss(skb,
3374                                 NETLINK_CB(cb->skb).pid,
3375                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3376                                 rdev, wdev, scan) < 0) {
3377                         idx--;
3378                         goto out;
3379                 }
3380         }
3381
3382  out:
3383         spin_unlock_bh(&rdev->bss_lock);
3384         wdev_unlock(wdev);
3385
3386         cb->args[1] = idx;
3387         err = skb->len;
3388         cfg80211_unlock_rdev(rdev);
3389  out_put_netdev:
3390         dev_put(dev);
3391
3392         return err;
3393 }
3394
3395 static int nl80211_send_survey(struct sk_buff *msg, u32 pid, u32 seq,
3396                                 int flags, struct net_device *dev,
3397                                 struct survey_info *survey)
3398 {
3399         void *hdr;
3400         struct nlattr *infoattr;
3401
3402         /* Survey without a channel doesn't make sense */
3403         if (!survey->channel)
3404                 return -EINVAL;
3405
3406         hdr = nl80211hdr_put(msg, pid, seq, flags,
3407                              NL80211_CMD_NEW_SURVEY_RESULTS);
3408         if (!hdr)
3409                 return -ENOMEM;
3410
3411         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
3412
3413         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
3414         if (!infoattr)
3415                 goto nla_put_failure;
3416
3417         NLA_PUT_U32(msg, NL80211_SURVEY_INFO_FREQUENCY,
3418                     survey->channel->center_freq);
3419         if (survey->filled & SURVEY_INFO_NOISE_DBM)
3420                 NLA_PUT_U8(msg, NL80211_SURVEY_INFO_NOISE,
3421                             survey->noise);
3422
3423         nla_nest_end(msg, infoattr);
3424
3425         return genlmsg_end(msg, hdr);
3426
3427  nla_put_failure:
3428         genlmsg_cancel(msg, hdr);
3429         return -EMSGSIZE;
3430 }
3431
3432 static int nl80211_dump_survey(struct sk_buff *skb,
3433                         struct netlink_callback *cb)
3434 {
3435         struct survey_info survey;
3436         struct cfg80211_registered_device *dev;
3437         struct net_device *netdev;
3438         int ifidx = cb->args[0];
3439         int survey_idx = cb->args[1];
3440         int res;
3441
3442         if (!ifidx)
3443                 ifidx = nl80211_get_ifidx(cb);
3444         if (ifidx < 0)
3445                 return ifidx;
3446         cb->args[0] = ifidx;
3447
3448         rtnl_lock();
3449
3450         netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
3451         if (!netdev) {
3452                 res = -ENODEV;
3453                 goto out_rtnl;
3454         }
3455
3456         dev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
3457         if (IS_ERR(dev)) {
3458                 res = PTR_ERR(dev);
3459                 goto out_rtnl;
3460         }
3461
3462         if (!dev->ops->dump_survey) {
3463                 res = -EOPNOTSUPP;
3464                 goto out_err;
3465         }
3466
3467         while (1) {
3468                 res = dev->ops->dump_survey(&dev->wiphy, netdev, survey_idx,
3469                                             &survey);
3470                 if (res == -ENOENT)
3471                         break;
3472                 if (res)
3473                         goto out_err;
3474
3475                 if (nl80211_send_survey(skb,
3476                                 NETLINK_CB(cb->skb).pid,
3477                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3478                                 netdev,
3479                                 &survey) < 0)
3480                         goto out;
3481                 survey_idx++;
3482         }
3483
3484  out:
3485         cb->args[1] = survey_idx;
3486         res = skb->len;
3487  out_err:
3488         cfg80211_unlock_rdev(dev);
3489  out_rtnl:
3490         rtnl_unlock();
3491
3492         return res;
3493 }
3494
3495 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
3496 {
3497         return auth_type <= NL80211_AUTHTYPE_MAX;
3498 }
3499
3500 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
3501 {
3502         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
3503                                   NL80211_WPA_VERSION_2));
3504 }
3505
3506 static bool nl80211_valid_akm_suite(u32 akm)
3507 {
3508         return akm == WLAN_AKM_SUITE_8021X ||
3509                 akm == WLAN_AKM_SUITE_PSK;
3510 }
3511
3512 static bool nl80211_valid_cipher_suite(u32 cipher)
3513 {
3514         return cipher == WLAN_CIPHER_SUITE_WEP40 ||
3515                 cipher == WLAN_CIPHER_SUITE_WEP104 ||
3516                 cipher == WLAN_CIPHER_SUITE_TKIP ||
3517                 cipher == WLAN_CIPHER_SUITE_CCMP ||
3518                 cipher == WLAN_CIPHER_SUITE_AES_CMAC;
3519 }
3520
3521
3522 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
3523 {
3524         struct cfg80211_registered_device *rdev;
3525         struct net_device *dev;
3526         struct ieee80211_channel *chan;
3527         const u8 *bssid, *ssid, *ie = NULL;
3528         int err, ssid_len, ie_len = 0;
3529         enum nl80211_auth_type auth_type;
3530         struct key_parse key;
3531         bool local_state_change;
3532
3533         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3534                 return -EINVAL;
3535
3536         if (!info->attrs[NL80211_ATTR_MAC])
3537                 return -EINVAL;
3538
3539         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
3540                 return -EINVAL;
3541
3542         if (!info->attrs[NL80211_ATTR_SSID])
3543                 return -EINVAL;
3544
3545         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
3546                 return -EINVAL;
3547
3548         err = nl80211_parse_key(info, &key);
3549         if (err)
3550                 return err;
3551
3552         if (key.idx >= 0) {
3553                 if (!key.p.key || !key.p.key_len)
3554                         return -EINVAL;
3555                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
3556                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
3557                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
3558                      key.p.key_len != WLAN_KEY_LEN_WEP104))
3559                         return -EINVAL;
3560                 if (key.idx > 4)
3561                         return -EINVAL;
3562         } else {
3563                 key.p.key_len = 0;
3564                 key.p.key = NULL;
3565         }
3566
3567         rtnl_lock();
3568
3569         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3570         if (err)
3571                 goto unlock_rtnl;
3572
3573         if (!rdev->ops->auth) {
3574                 err = -EOPNOTSUPP;
3575                 goto out;
3576         }
3577
3578         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3579                 err = -EOPNOTSUPP;
3580                 goto out;
3581         }
3582
3583         if (!netif_running(dev)) {
3584                 err = -ENETDOWN;
3585                 goto out;
3586         }
3587
3588         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3589         chan = ieee80211_get_channel(&rdev->wiphy,
3590                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3591         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED)) {
3592                 err = -EINVAL;
3593                 goto out;
3594         }
3595
3596         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3597         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3598
3599         if (info->attrs[NL80211_ATTR_IE]) {
3600                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3601                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3602         }
3603
3604         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
3605         if (!nl80211_valid_auth_type(auth_type)) {
3606                 err = -EINVAL;
3607                 goto out;
3608         }
3609
3610         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
3611
3612         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
3613                                  ssid, ssid_len, ie, ie_len,
3614                                  key.p.key, key.p.key_len, key.idx,
3615                                  local_state_change);
3616
3617 out:
3618         cfg80211_unlock_rdev(rdev);
3619         dev_put(dev);
3620 unlock_rtnl:
3621         rtnl_unlock();
3622         return err;
3623 }
3624
3625 static int nl80211_crypto_settings(struct genl_info *info,
3626                                    struct cfg80211_crypto_settings *settings,
3627                                    int cipher_limit)
3628 {
3629         memset(settings, 0, sizeof(*settings));
3630
3631         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
3632
3633         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
3634                 void *data;
3635                 int len, i;
3636
3637                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3638                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3639                 settings->n_ciphers_pairwise = len / sizeof(u32);
3640
3641                 if (len % sizeof(u32))
3642                         return -EINVAL;
3643
3644                 if (settings->n_ciphers_pairwise > cipher_limit)
3645                         return -EINVAL;
3646
3647                 memcpy(settings->ciphers_pairwise, data, len);
3648
3649                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3650                         if (!nl80211_valid_cipher_suite(
3651                                         settings->ciphers_pairwise[i]))
3652                                 return -EINVAL;
3653         }
3654
3655         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
3656                 settings->cipher_group =
3657                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
3658                 if (!nl80211_valid_cipher_suite(settings->cipher_group))
3659                         return -EINVAL;
3660         }
3661
3662         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
3663                 settings->wpa_versions =
3664                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
3665                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
3666                         return -EINVAL;
3667         }
3668
3669         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
3670                 void *data;
3671                 int len, i;
3672
3673                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
3674                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
3675                 settings->n_akm_suites = len / sizeof(u32);
3676
3677                 if (len % sizeof(u32))
3678                         return -EINVAL;
3679
3680                 memcpy(settings->akm_suites, data, len);
3681
3682                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3683                         if (!nl80211_valid_akm_suite(settings->akm_suites[i]))
3684                                 return -EINVAL;
3685         }
3686
3687         return 0;
3688 }
3689
3690 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
3691 {
3692         struct cfg80211_registered_device *rdev;
3693         struct net_device *dev;
3694         struct cfg80211_crypto_settings crypto;
3695         struct ieee80211_channel *chan;
3696         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
3697         int err, ssid_len, ie_len = 0;
3698         bool use_mfp = false;
3699
3700         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3701                 return -EINVAL;
3702
3703         if (!info->attrs[NL80211_ATTR_MAC] ||
3704             !info->attrs[NL80211_ATTR_SSID] ||
3705             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
3706                 return -EINVAL;
3707
3708         rtnl_lock();
3709
3710         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3711         if (err)
3712                 goto unlock_rtnl;
3713
3714         if (!rdev->ops->assoc) {
3715                 err = -EOPNOTSUPP;
3716                 goto out;
3717         }
3718
3719         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3720                 err = -EOPNOTSUPP;
3721                 goto out;
3722         }
3723
3724         if (!netif_running(dev)) {
3725                 err = -ENETDOWN;
3726                 goto out;
3727         }
3728
3729         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3730
3731         chan = ieee80211_get_channel(&rdev->wiphy,
3732                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3733         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED)) {
3734                 err = -EINVAL;
3735                 goto out;
3736         }
3737
3738         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3739         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3740
3741         if (info->attrs[NL80211_ATTR_IE]) {
3742                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3743                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3744         }
3745
3746         if (info->attrs[NL80211_ATTR_USE_MFP]) {
3747                 enum nl80211_mfp mfp =
3748                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
3749                 if (mfp == NL80211_MFP_REQUIRED)
3750                         use_mfp = true;
3751                 else if (mfp != NL80211_MFP_NO) {
3752                         err = -EINVAL;
3753                         goto out;
3754                 }
3755         }
3756
3757         if (info->attrs[NL80211_ATTR_PREV_BSSID])
3758                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
3759
3760         err = nl80211_crypto_settings(info, &crypto, 1);
3761         if (!err)
3762                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
3763                                           ssid, ssid_len, ie, ie_len, use_mfp,
3764                                           &crypto);
3765
3766 out:
3767         cfg80211_unlock_rdev(rdev);
3768         dev_put(dev);
3769 unlock_rtnl:
3770         rtnl_unlock();
3771         return err;
3772 }
3773
3774 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
3775 {
3776         struct cfg80211_registered_device *rdev;
3777         struct net_device *dev;
3778         const u8 *ie = NULL, *bssid;
3779         int err, ie_len = 0;
3780         u16 reason_code;
3781         bool local_state_change;
3782
3783         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3784                 return -EINVAL;
3785
3786         if (!info->attrs[NL80211_ATTR_MAC])
3787                 return -EINVAL;
3788
3789         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3790                 return -EINVAL;
3791
3792         rtnl_lock();
3793
3794         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3795         if (err)
3796                 goto unlock_rtnl;
3797
3798         if (!rdev->ops->deauth) {
3799                 err = -EOPNOTSUPP;
3800                 goto out;
3801         }
3802
3803         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3804                 err = -EOPNOTSUPP;
3805                 goto out;
3806         }
3807
3808         if (!netif_running(dev)) {
3809                 err = -ENETDOWN;
3810                 goto out;
3811         }
3812
3813         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3814
3815         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3816         if (reason_code == 0) {
3817                 /* Reason Code 0 is reserved */
3818                 err = -EINVAL;
3819                 goto out;
3820         }
3821
3822         if (info->attrs[NL80211_ATTR_IE]) {
3823                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3824                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3825         }
3826
3827         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
3828
3829         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
3830                                    local_state_change);
3831
3832 out:
3833         cfg80211_unlock_rdev(rdev);
3834         dev_put(dev);
3835 unlock_rtnl:
3836         rtnl_unlock();
3837         return err;
3838 }
3839
3840 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
3841 {
3842         struct cfg80211_registered_device *rdev;
3843         struct net_device *dev;
3844         const u8 *ie = NULL, *bssid;
3845         int err, ie_len = 0;
3846         u16 reason_code;
3847         bool local_state_change;
3848
3849         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3850                 return -EINVAL;
3851
3852         if (!info->attrs[NL80211_ATTR_MAC])
3853                 return -EINVAL;
3854
3855         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3856                 return -EINVAL;
3857
3858         rtnl_lock();
3859
3860         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3861         if (err)
3862                 goto unlock_rtnl;
3863
3864         if (!rdev->ops->disassoc) {
3865                 err = -EOPNOTSUPP;
3866                 goto out;
3867         }
3868
3869         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3870                 err = -EOPNOTSUPP;
3871                 goto out;
3872         }
3873
3874         if (!netif_running(dev)) {
3875                 err = -ENETDOWN;
3876                 goto out;
3877         }
3878
3879         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3880
3881         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3882         if (reason_code == 0) {
3883                 /* Reason Code 0 is reserved */
3884                 err = -EINVAL;
3885                 goto out;
3886         }
3887
3888         if (info->attrs[NL80211_ATTR_IE]) {
3889                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3890                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3891         }
3892
3893         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
3894
3895         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
3896                                      local_state_change);
3897
3898 out:
3899         cfg80211_unlock_rdev(rdev);
3900         dev_put(dev);
3901 unlock_rtnl:
3902         rtnl_unlock();
3903         return err;
3904 }
3905
3906 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
3907 {
3908         struct cfg80211_registered_device *rdev;
3909         struct net_device *dev;
3910         struct cfg80211_ibss_params ibss;
3911         struct wiphy *wiphy;
3912         struct cfg80211_cached_keys *connkeys = NULL;
3913         int err;
3914
3915         memset(&ibss, 0, sizeof(ibss));
3916
3917         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3918                 return -EINVAL;
3919
3920         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
3921             !info->attrs[NL80211_ATTR_SSID] ||
3922             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3923                 return -EINVAL;
3924
3925         ibss.beacon_interval = 100;
3926
3927         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
3928                 ibss.beacon_interval =
3929                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3930                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
3931                         return -EINVAL;
3932         }
3933
3934         rtnl_lock();
3935
3936         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
3937         if (err)
3938                 goto unlock_rtnl;
3939
3940         if (!rdev->ops->join_ibss) {
3941                 err = -EOPNOTSUPP;
3942                 goto out;
3943         }
3944
3945         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3946                 err = -EOPNOTSUPP;
3947                 goto out;
3948         }
3949
3950         if (!netif_running(dev)) {
3951                 err = -ENETDOWN;
3952                 goto out;
3953         }
3954
3955         wiphy = &rdev->wiphy;
3956
3957         if (info->attrs[NL80211_ATTR_MAC])
3958                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3959         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3960         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3961
3962         if (info->attrs[NL80211_ATTR_IE]) {
3963                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3964                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3965         }
3966
3967         ibss.channel = ieee80211_get_channel(wiphy,
3968                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3969         if (!ibss.channel ||
3970             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
3971             ibss.channel->flags & IEEE80211_CHAN_DISABLED) {
3972                 err = -EINVAL;
3973                 goto out;
3974         }
3975
3976         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
3977         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3978
3979         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
3980                 connkeys = nl80211_parse_connkeys(rdev,
3981                                         info->attrs[NL80211_ATTR_KEYS]);
3982                 if (IS_ERR(connkeys)) {
3983                         err = PTR_ERR(connkeys);
3984                         connkeys = NULL;
3985                         goto out;
3986                 }
3987         }
3988
3989         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
3990                 u8 *rates =
3991                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
3992                 int n_rates =
3993                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
3994                 struct ieee80211_supported_band *sband =
3995                         wiphy->bands[ibss.channel->band];
3996                 int i, j;
3997
3998                 if (n_rates == 0) {
3999                         err = -EINVAL;
4000                         goto out;
4001                 }
4002
4003                 for (i = 0; i < n_rates; i++) {
4004                         int rate = (rates[i] & 0x7f) * 5;
4005                         bool found = false;
4006
4007                         for (j = 0; j < sband->n_bitrates; j++) {
4008                                 if (sband->bitrates[j].bitrate == rate) {
4009                                         found = true;
4010                                         ibss.basic_rates |= BIT(j);
4011                                         break;
4012                                 }
4013                         }
4014                         if (!found) {
4015                                 err = -EINVAL;
4016                                 goto out;
4017                         }
4018                 }
4019         } else {
4020                 /*
4021                 * If no rates were explicitly configured,
4022                 * use the mandatory rate set for 11b or
4023                 * 11a for maximum compatibility.
4024                 */
4025                 struct ieee80211_supported_band *sband =
4026                         wiphy->bands[ibss.channel->band];
4027                 int j;
4028                 u32 flag = ibss.channel->band == IEEE80211_BAND_5GHZ ?
4029                         IEEE80211_RATE_MANDATORY_A :
4030                         IEEE80211_RATE_MANDATORY_B;
4031
4032                 for (j = 0; j < sband->n_bitrates; j++) {
4033                         if (sband->bitrates[j].flags & flag)
4034                                 ibss.basic_rates |= BIT(j);
4035                 }
4036         }
4037
4038         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
4039
4040 out:
4041         cfg80211_unlock_rdev(rdev);
4042         dev_put(dev);
4043 unlock_rtnl:
4044         if (err)
4045                 kfree(connkeys);
4046         rtnl_unlock();
4047         return err;
4048 }
4049
4050 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
4051 {
4052         struct cfg80211_registered_device *rdev;
4053         struct net_device *dev;
4054         int err;
4055
4056         rtnl_lock();
4057
4058         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4059         if (err)
4060                 goto unlock_rtnl;
4061
4062         if (!rdev->ops->leave_ibss) {
4063                 err = -EOPNOTSUPP;
4064                 goto out;
4065         }
4066
4067         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
4068                 err = -EOPNOTSUPP;
4069                 goto out;
4070         }
4071
4072         if (!netif_running(dev)) {
4073                 err = -ENETDOWN;
4074                 goto out;
4075         }
4076
4077         err = cfg80211_leave_ibss(rdev, dev, false);
4078
4079 out:
4080         cfg80211_unlock_rdev(rdev);
4081         dev_put(dev);
4082 unlock_rtnl:
4083         rtnl_unlock();
4084         return err;
4085 }
4086
4087 #ifdef CONFIG_NL80211_TESTMODE
4088 static struct genl_multicast_group nl80211_testmode_mcgrp = {
4089         .name = "testmode",
4090 };
4091
4092 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
4093 {
4094         struct cfg80211_registered_device *rdev;
4095         int err;
4096
4097         if (!info->attrs[NL80211_ATTR_TESTDATA])
4098                 return -EINVAL;
4099
4100         rtnl_lock();
4101
4102         rdev = cfg80211_get_dev_from_info(info);
4103         if (IS_ERR(rdev)) {
4104                 err = PTR_ERR(rdev);
4105                 goto unlock_rtnl;
4106         }
4107
4108         err = -EOPNOTSUPP;
4109         if (rdev->ops->testmode_cmd) {
4110                 rdev->testmode_info = info;
4111                 err = rdev->ops->testmode_cmd(&rdev->wiphy,
4112                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
4113                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
4114                 rdev->testmode_info = NULL;
4115         }
4116
4117         cfg80211_unlock_rdev(rdev);
4118
4119  unlock_rtnl:
4120         rtnl_unlock();
4121         return err;
4122 }
4123
4124 static struct sk_buff *
4125 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
4126                               int approxlen, u32 pid, u32 seq, gfp_t gfp)
4127 {
4128         struct sk_buff *skb;
4129         void *hdr;
4130         struct nlattr *data;
4131
4132         skb = nlmsg_new(approxlen + 100, gfp);
4133         if (!skb)
4134                 return NULL;
4135
4136         hdr = nl80211hdr_put(skb, pid, seq, 0, NL80211_CMD_TESTMODE);
4137         if (!hdr) {
4138                 kfree_skb(skb);
4139                 return NULL;
4140         }
4141
4142         NLA_PUT_U32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4143         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
4144
4145         ((void **)skb->cb)[0] = rdev;
4146         ((void **)skb->cb)[1] = hdr;
4147         ((void **)skb->cb)[2] = data;
4148
4149         return skb;
4150
4151  nla_put_failure:
4152         kfree_skb(skb);
4153         return NULL;
4154 }
4155
4156 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
4157                                                   int approxlen)
4158 {
4159         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
4160
4161         if (WARN_ON(!rdev->testmode_info))
4162                 return NULL;
4163
4164         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
4165                                 rdev->testmode_info->snd_pid,
4166                                 rdev->testmode_info->snd_seq,
4167                                 GFP_KERNEL);
4168 }
4169 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
4170
4171 int cfg80211_testmode_reply(struct sk_buff *skb)
4172 {
4173         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
4174         void *hdr = ((void **)skb->cb)[1];
4175         struct nlattr *data = ((void **)skb->cb)[2];
4176
4177         if (WARN_ON(!rdev->testmode_info)) {
4178                 kfree_skb(skb);
4179                 return -EINVAL;
4180         }
4181
4182         nla_nest_end(skb, data);
4183         genlmsg_end(skb, hdr);
4184         return genlmsg_reply(skb, rdev->testmode_info);
4185 }
4186 EXPORT_SYMBOL(cfg80211_testmode_reply);
4187
4188 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
4189                                                   int approxlen, gfp_t gfp)
4190 {
4191         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
4192
4193         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
4194 }
4195 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
4196
4197 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
4198 {
4199         void *hdr = ((void **)skb->cb)[1];
4200         struct nlattr *data = ((void **)skb->cb)[2];
4201
4202         nla_nest_end(skb, data);
4203         genlmsg_end(skb, hdr);
4204         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
4205 }
4206 EXPORT_SYMBOL(cfg80211_testmode_event);
4207 #endif
4208
4209 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
4210 {
4211         struct cfg80211_registered_device *rdev;
4212         struct net_device *dev;
4213         struct cfg80211_connect_params connect;
4214         struct wiphy *wiphy;
4215         struct cfg80211_cached_keys *connkeys = NULL;
4216         int err;
4217
4218         memset(&connect, 0, sizeof(connect));
4219
4220         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4221                 return -EINVAL;
4222
4223         if (!info->attrs[NL80211_ATTR_SSID] ||
4224             !nla_len(info->attrs[NL80211_ATTR_SSID]))
4225                 return -EINVAL;
4226
4227         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
4228                 connect.auth_type =
4229                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
4230                 if (!nl80211_valid_auth_type(connect.auth_type))
4231                         return -EINVAL;
4232         } else
4233                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
4234
4235         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
4236
4237         err = nl80211_crypto_settings(info, &connect.crypto,
4238                                       NL80211_MAX_NR_CIPHER_SUITES);
4239         if (err)
4240                 return err;
4241         rtnl_lock();
4242
4243         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4244         if (err)
4245                 goto unlock_rtnl;
4246
4247         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4248                 err = -EOPNOTSUPP;
4249                 goto out;
4250         }
4251
4252         if (!netif_running(dev)) {
4253                 err = -ENETDOWN;
4254                 goto out;
4255         }
4256
4257         wiphy = &rdev->wiphy;
4258
4259         if (info->attrs[NL80211_ATTR_MAC])
4260                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4261         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4262         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4263
4264         if (info->attrs[NL80211_ATTR_IE]) {
4265                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4266                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4267         }
4268
4269         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4270                 connect.channel =
4271                         ieee80211_get_channel(wiphy,
4272                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4273                 if (!connect.channel ||
4274                     connect.channel->flags & IEEE80211_CHAN_DISABLED) {
4275                         err = -EINVAL;
4276                         goto out;
4277                 }
4278         }
4279
4280         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
4281                 connkeys = nl80211_parse_connkeys(rdev,
4282                                         info->attrs[NL80211_ATTR_KEYS]);
4283                 if (IS_ERR(connkeys)) {
4284                         err = PTR_ERR(connkeys);
4285                         connkeys = NULL;
4286                         goto out;
4287                 }
4288         }
4289
4290         err = cfg80211_connect(rdev, dev, &connect, connkeys);
4291
4292 out:
4293         cfg80211_unlock_rdev(rdev);
4294         dev_put(dev);
4295 unlock_rtnl:
4296         if (err)
4297                 kfree(connkeys);
4298         rtnl_unlock();
4299         return err;
4300 }
4301
4302 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
4303 {
4304         struct cfg80211_registered_device *rdev;
4305         struct net_device *dev;
4306         int err;
4307         u16 reason;
4308
4309         if (!info->attrs[NL80211_ATTR_REASON_CODE])
4310                 reason = WLAN_REASON_DEAUTH_LEAVING;
4311         else
4312                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4313
4314         if (reason == 0)
4315                 return -EINVAL;
4316
4317         rtnl_lock();
4318
4319         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4320         if (err)
4321                 goto unlock_rtnl;
4322
4323         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4324                 err = -EOPNOTSUPP;
4325                 goto out;
4326         }
4327
4328         if (!netif_running(dev)) {
4329                 err = -ENETDOWN;
4330                 goto out;
4331         }
4332
4333         err = cfg80211_disconnect(rdev, dev, reason, true);
4334
4335 out:
4336         cfg80211_unlock_rdev(rdev);
4337         dev_put(dev);
4338 unlock_rtnl:
4339         rtnl_unlock();
4340         return err;
4341 }
4342
4343 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
4344 {
4345         struct cfg80211_registered_device *rdev;
4346         struct net *net;
4347         int err;
4348         u32 pid;
4349
4350         if (!info->attrs[NL80211_ATTR_PID])
4351                 return -EINVAL;
4352
4353         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
4354
4355         rtnl_lock();
4356
4357         rdev = cfg80211_get_dev_from_info(info);
4358         if (IS_ERR(rdev)) {
4359                 err = PTR_ERR(rdev);
4360                 goto out_rtnl;
4361         }
4362
4363         net = get_net_ns_by_pid(pid);
4364         if (IS_ERR(net)) {
4365                 err = PTR_ERR(net);
4366                 goto out;
4367         }
4368
4369         err = 0;
4370
4371         /* check if anything to do */
4372         if (net_eq(wiphy_net(&rdev->wiphy), net))
4373                 goto out_put_net;
4374
4375         err = cfg80211_switch_netns(rdev, net);
4376  out_put_net:
4377         put_net(net);
4378  out:
4379         cfg80211_unlock_rdev(rdev);
4380  out_rtnl:
4381         rtnl_unlock();
4382         return err;
4383 }
4384
4385 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
4386 {
4387         struct cfg80211_registered_device *rdev;
4388         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
4389                         struct cfg80211_pmksa *pmksa) = NULL;
4390         int err;
4391         struct net_device *dev;
4392         struct cfg80211_pmksa pmksa;
4393
4394         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
4395
4396         if (!info->attrs[NL80211_ATTR_MAC])
4397                 return -EINVAL;
4398
4399         if (!info->attrs[NL80211_ATTR_PMKID])
4400                 return -EINVAL;
4401
4402         rtnl_lock();
4403
4404         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4405         if (err)
4406                 goto out_rtnl;
4407
4408         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
4409         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4410
4411         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4412                 err = -EOPNOTSUPP;
4413                 goto out;
4414         }
4415
4416         switch (info->genlhdr->cmd) {
4417         case NL80211_CMD_SET_PMKSA:
4418                 rdev_ops = rdev->ops->set_pmksa;
4419                 break;
4420         case NL80211_CMD_DEL_PMKSA:
4421                 rdev_ops = rdev->ops->del_pmksa;
4422                 break;
4423         default:
4424                 WARN_ON(1);
4425                 break;
4426         }
4427
4428         if (!rdev_ops) {
4429                 err = -EOPNOTSUPP;
4430                 goto out;
4431         }
4432
4433         err = rdev_ops(&rdev->wiphy, dev, &pmksa);
4434
4435  out:
4436         cfg80211_unlock_rdev(rdev);
4437         dev_put(dev);
4438  out_rtnl:
4439         rtnl_unlock();
4440
4441         return err;
4442 }
4443
4444 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
4445 {
4446         struct cfg80211_registered_device *rdev;
4447         int err;
4448         struct net_device *dev;
4449
4450         rtnl_lock();
4451
4452         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4453         if (err)
4454                 goto out_rtnl;
4455
4456         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
4457                 err = -EOPNOTSUPP;
4458                 goto out;
4459         }
4460
4461         if (!rdev->ops->flush_pmksa) {
4462                 err = -EOPNOTSUPP;
4463                 goto out;
4464         }
4465
4466         err = rdev->ops->flush_pmksa(&rdev->wiphy, dev);
4467
4468  out:
4469         cfg80211_unlock_rdev(rdev);
4470         dev_put(dev);
4471  out_rtnl:
4472         rtnl_unlock();
4473
4474         return err;
4475
4476 }
4477
4478 static int nl80211_remain_on_channel(struct sk_buff *skb,
4479                                      struct genl_info *info)
4480 {
4481         struct cfg80211_registered_device *rdev;
4482         struct net_device *dev;
4483         struct ieee80211_channel *chan;
4484         struct sk_buff *msg;
4485         void *hdr;
4486         u64 cookie;
4487         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
4488         u32 freq, duration;
4489         int err;
4490
4491         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
4492             !info->attrs[NL80211_ATTR_DURATION])
4493                 return -EINVAL;
4494
4495         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
4496
4497         /*
4498          * We should be on that channel for at least one jiffie,
4499          * and more than 5 seconds seems excessive.
4500          */
4501         if (!duration || !msecs_to_jiffies(duration) || duration > 5000)
4502                 return -EINVAL;
4503
4504         rtnl_lock();
4505
4506         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4507         if (err)
4508                 goto unlock_rtnl;
4509
4510         if (!rdev->ops->remain_on_channel) {
4511                 err = -EOPNOTSUPP;
4512                 goto out;
4513         }
4514
4515         if (!netif_running(dev)) {
4516                 err = -ENETDOWN;
4517                 goto out;
4518         }
4519
4520         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
4521                 channel_type = nla_get_u32(
4522                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
4523                 if (channel_type != NL80211_CHAN_NO_HT &&
4524                     channel_type != NL80211_CHAN_HT20 &&
4525                     channel_type != NL80211_CHAN_HT40PLUS &&
4526                     channel_type != NL80211_CHAN_HT40MINUS) {
4527                         err = -EINVAL;
4528                         goto out;
4529                 }
4530         }
4531
4532         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
4533         chan = rdev_freq_to_chan(rdev, freq, channel_type);
4534         if (chan == NULL) {
4535                 err = -EINVAL;
4536                 goto out;
4537         }
4538
4539         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4540         if (!msg) {
4541                 err = -ENOMEM;
4542                 goto out;
4543         }
4544
4545         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4546                              NL80211_CMD_REMAIN_ON_CHANNEL);
4547
4548         if (IS_ERR(hdr)) {
4549                 err = PTR_ERR(hdr);
4550                 goto free_msg;
4551         }
4552
4553         err = rdev->ops->remain_on_channel(&rdev->wiphy, dev, chan,
4554                                            channel_type, duration, &cookie);
4555
4556         if (err)
4557                 goto free_msg;
4558
4559         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
4560
4561         genlmsg_end(msg, hdr);
4562         err = genlmsg_reply(msg, info);
4563         goto out;
4564
4565  nla_put_failure:
4566         err = -ENOBUFS;
4567  free_msg:
4568         nlmsg_free(msg);
4569  out:
4570         cfg80211_unlock_rdev(rdev);
4571         dev_put(dev);
4572  unlock_rtnl:
4573         rtnl_unlock();
4574         return err;
4575 }
4576
4577 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
4578                                             struct genl_info *info)
4579 {
4580         struct cfg80211_registered_device *rdev;
4581         struct net_device *dev;
4582         u64 cookie;
4583         int err;
4584
4585         if (!info->attrs[NL80211_ATTR_COOKIE])
4586                 return -EINVAL;
4587
4588         rtnl_lock();
4589
4590         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4591         if (err)
4592                 goto unlock_rtnl;
4593
4594         if (!rdev->ops->cancel_remain_on_channel) {
4595                 err = -EOPNOTSUPP;
4596                 goto out;
4597         }
4598
4599         if (!netif_running(dev)) {
4600                 err = -ENETDOWN;
4601                 goto out;
4602         }
4603
4604         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
4605
4606         err = rdev->ops->cancel_remain_on_channel(&rdev->wiphy, dev, cookie);
4607
4608  out:
4609         cfg80211_unlock_rdev(rdev);
4610         dev_put(dev);
4611  unlock_rtnl:
4612         rtnl_unlock();
4613         return err;
4614 }
4615
4616 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
4617                            u8 *rates, u8 rates_len)
4618 {
4619         u8 i;
4620         u32 mask = 0;
4621
4622         for (i = 0; i < rates_len; i++) {
4623                 int rate = (rates[i] & 0x7f) * 5;
4624                 int ridx;
4625                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
4626                         struct ieee80211_rate *srate =
4627                                 &sband->bitrates[ridx];
4628                         if (rate == srate->bitrate) {
4629                                 mask |= 1 << ridx;
4630                                 break;
4631                         }
4632                 }
4633                 if (ridx == sband->n_bitrates)
4634                         return 0; /* rate not found */
4635         }
4636
4637         return mask;
4638 }
4639
4640 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
4641         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
4642                                     .len = NL80211_MAX_SUPP_RATES },
4643 };
4644
4645 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
4646                                        struct genl_info *info)
4647 {
4648         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
4649         struct cfg80211_registered_device *rdev;
4650         struct cfg80211_bitrate_mask mask;
4651         int err, rem, i;
4652         struct net_device *dev;
4653         struct nlattr *tx_rates;
4654         struct ieee80211_supported_band *sband;
4655
4656         if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
4657                 return -EINVAL;
4658
4659         rtnl_lock();
4660
4661         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4662         if (err)
4663                 goto unlock_rtnl;
4664
4665         if (!rdev->ops->set_bitrate_mask) {
4666                 err = -EOPNOTSUPP;
4667                 goto unlock;
4668         }
4669
4670         memset(&mask, 0, sizeof(mask));
4671         /* Default to all rates enabled */
4672         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
4673                 sband = rdev->wiphy.bands[i];
4674                 mask.control[i].legacy =
4675                         sband ? (1 << sband->n_bitrates) - 1 : 0;
4676         }
4677
4678         /*
4679          * The nested attribute uses enum nl80211_band as the index. This maps
4680          * directly to the enum ieee80211_band values used in cfg80211.
4681          */
4682         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
4683         {
4684                 enum ieee80211_band band = nla_type(tx_rates);
4685                 if (band < 0 || band >= IEEE80211_NUM_BANDS) {
4686                         err = -EINVAL;
4687                         goto unlock;
4688                 }
4689                 sband = rdev->wiphy.bands[band];
4690                 if (sband == NULL) {
4691                         err = -EINVAL;
4692                         goto unlock;
4693                 }
4694                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
4695                           nla_len(tx_rates), nl80211_txattr_policy);
4696                 if (tb[NL80211_TXRATE_LEGACY]) {
4697                         mask.control[band].legacy = rateset_to_mask(
4698                                 sband,
4699                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
4700                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
4701                         if (mask.control[band].legacy == 0) {
4702                                 err = -EINVAL;
4703                                 goto unlock;
4704                         }
4705                 }
4706         }
4707
4708         err = rdev->ops->set_bitrate_mask(&rdev->wiphy, dev, NULL, &mask);
4709
4710  unlock:
4711         dev_put(dev);
4712         cfg80211_unlock_rdev(rdev);
4713  unlock_rtnl:
4714         rtnl_unlock();
4715         return err;
4716 }
4717
4718 static int nl80211_register_action(struct sk_buff *skb, struct genl_info *info)
4719 {
4720         struct cfg80211_registered_device *rdev;
4721         struct net_device *dev;
4722         int err;
4723
4724         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
4725                 return -EINVAL;
4726
4727         if (nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]) < 1)
4728                 return -EINVAL;
4729
4730         rtnl_lock();
4731
4732         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4733         if (err)
4734                 goto unlock_rtnl;
4735
4736         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4737             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
4738                 err = -EOPNOTSUPP;
4739                 goto out;
4740         }
4741
4742         /* not much point in registering if we can't reply */
4743         if (!rdev->ops->action) {
4744                 err = -EOPNOTSUPP;
4745                 goto out;
4746         }
4747
4748         err = cfg80211_mlme_register_action(dev->ieee80211_ptr, info->snd_pid,
4749                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
4750                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
4751  out:
4752         cfg80211_unlock_rdev(rdev);
4753         dev_put(dev);
4754  unlock_rtnl:
4755         rtnl_unlock();
4756         return err;
4757 }
4758
4759 static int nl80211_action(struct sk_buff *skb, struct genl_info *info)
4760 {
4761         struct cfg80211_registered_device *rdev;
4762         struct net_device *dev;
4763         struct ieee80211_channel *chan;
4764         enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
4765         bool channel_type_valid = false;
4766         u32 freq;
4767         int err;
4768         void *hdr;
4769         u64 cookie;
4770         struct sk_buff *msg;
4771
4772         if (!info->attrs[NL80211_ATTR_FRAME] ||
4773             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
4774                 return -EINVAL;
4775
4776         rtnl_lock();
4777
4778         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4779         if (err)
4780                 goto unlock_rtnl;
4781
4782         if (!rdev->ops->action) {
4783                 err = -EOPNOTSUPP;
4784                 goto out;
4785         }
4786
4787         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4788             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
4789                 err = -EOPNOTSUPP;
4790                 goto out;
4791         }
4792
4793         if (!netif_running(dev)) {
4794                 err = -ENETDOWN;
4795                 goto out;
4796         }
4797
4798         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
4799                 channel_type = nla_get_u32(
4800                         info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
4801                 if (channel_type != NL80211_CHAN_NO_HT &&
4802                     channel_type != NL80211_CHAN_HT20 &&
4803                     channel_type != NL80211_CHAN_HT40PLUS &&
4804                     channel_type != NL80211_CHAN_HT40MINUS) {
4805                         err = -EINVAL;
4806                         goto out;
4807                 }
4808                 channel_type_valid = true;
4809         }
4810
4811         freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
4812         chan = rdev_freq_to_chan(rdev, freq, channel_type);
4813         if (chan == NULL) {
4814                 err = -EINVAL;
4815                 goto out;
4816         }
4817
4818         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4819         if (!msg) {
4820                 err = -ENOMEM;
4821                 goto out;
4822         }
4823
4824         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4825                              NL80211_CMD_ACTION);
4826
4827         if (IS_ERR(hdr)) {
4828                 err = PTR_ERR(hdr);
4829                 goto free_msg;
4830         }
4831         err = cfg80211_mlme_action(rdev, dev, chan, channel_type,
4832                                    channel_type_valid,
4833                                    nla_data(info->attrs[NL80211_ATTR_FRAME]),
4834                                    nla_len(info->attrs[NL80211_ATTR_FRAME]),
4835                                    &cookie);
4836         if (err)
4837                 goto free_msg;
4838
4839         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
4840
4841         genlmsg_end(msg, hdr);
4842         err = genlmsg_reply(msg, info);
4843         goto out;
4844
4845  nla_put_failure:
4846         err = -ENOBUFS;
4847  free_msg:
4848         nlmsg_free(msg);
4849  out:
4850         cfg80211_unlock_rdev(rdev);
4851         dev_put(dev);
4852 unlock_rtnl:
4853         rtnl_unlock();
4854         return err;
4855 }
4856
4857 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
4858 {
4859         struct cfg80211_registered_device *rdev;
4860         struct wireless_dev *wdev;
4861         struct net_device *dev;
4862         u8 ps_state;
4863         bool state;
4864         int err;
4865
4866         if (!info->attrs[NL80211_ATTR_PS_STATE]) {
4867                 err = -EINVAL;
4868                 goto out;
4869         }
4870
4871         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
4872
4873         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED) {
4874                 err = -EINVAL;
4875                 goto out;
4876         }
4877
4878         rtnl_lock();
4879
4880         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4881         if (err)
4882                 goto unlock_rdev;
4883
4884         wdev = dev->ieee80211_ptr;
4885
4886         if (!rdev->ops->set_power_mgmt) {
4887                 err = -EOPNOTSUPP;
4888                 goto unlock_rdev;
4889         }
4890
4891         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
4892
4893         if (state == wdev->ps)
4894                 goto unlock_rdev;
4895
4896         wdev->ps = state;
4897
4898         if (rdev->ops->set_power_mgmt(wdev->wiphy, dev, wdev->ps,
4899                                       wdev->ps_timeout))
4900                 /* assume this means it's off */
4901                 wdev->ps = false;
4902
4903 unlock_rdev:
4904         cfg80211_unlock_rdev(rdev);
4905         dev_put(dev);
4906         rtnl_unlock();
4907
4908 out:
4909         return err;
4910 }
4911
4912 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
4913 {
4914         struct cfg80211_registered_device *rdev;
4915         enum nl80211_ps_state ps_state;
4916         struct wireless_dev *wdev;
4917         struct net_device *dev;
4918         struct sk_buff *msg;
4919         void *hdr;
4920         int err;
4921
4922         rtnl_lock();
4923
4924         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4925         if (err)
4926                 goto unlock_rtnl;
4927
4928         wdev = dev->ieee80211_ptr;
4929
4930         if (!rdev->ops->set_power_mgmt) {
4931                 err = -EOPNOTSUPP;
4932                 goto out;
4933         }
4934
4935         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4936         if (!msg) {
4937                 err = -ENOMEM;
4938                 goto out;
4939         }
4940
4941         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
4942                              NL80211_CMD_GET_POWER_SAVE);
4943         if (!hdr) {
4944                 err = -ENOMEM;
4945                 goto free_msg;
4946         }
4947
4948         if (wdev->ps)
4949                 ps_state = NL80211_PS_ENABLED;
4950         else
4951                 ps_state = NL80211_PS_DISABLED;
4952
4953         NLA_PUT_U32(msg, NL80211_ATTR_PS_STATE, ps_state);
4954
4955         genlmsg_end(msg, hdr);
4956         err = genlmsg_reply(msg, info);
4957         goto out;
4958
4959 nla_put_failure:
4960         err = -ENOBUFS;
4961
4962 free_msg:
4963         nlmsg_free(msg);
4964
4965 out:
4966         cfg80211_unlock_rdev(rdev);
4967         dev_put(dev);
4968
4969 unlock_rtnl:
4970         rtnl_unlock();
4971
4972         return err;
4973 }
4974
4975 static struct nla_policy
4976 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
4977         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
4978         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
4979         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
4980 };
4981
4982 static int nl80211_set_cqm_rssi(struct genl_info *info,
4983                                 s32 threshold, u32 hysteresis)
4984 {
4985         struct cfg80211_registered_device *rdev;
4986         struct wireless_dev *wdev;
4987         struct net_device *dev;
4988         int err;
4989
4990         if (threshold > 0)
4991                 return -EINVAL;
4992
4993         rtnl_lock();
4994
4995         err = get_rdev_dev_by_info_ifindex(info, &rdev, &dev);
4996         if (err)
4997                 goto unlock_rdev;
4998
4999         wdev = dev->ieee80211_ptr;
5000
5001         if (!rdev->ops->set_cqm_rssi_config) {
5002                 err = -EOPNOTSUPP;
5003                 goto unlock_rdev;
5004         }
5005
5006         if (wdev->iftype != NL80211_IFTYPE_STATION) {
5007                 err = -EOPNOTSUPP;
5008                 goto unlock_rdev;
5009         }
5010
5011         err = rdev->ops->set_cqm_rssi_config(wdev->wiphy, dev,
5012                                              threshold, hysteresis);
5013
5014 unlock_rdev:
5015         cfg80211_unlock_rdev(rdev);
5016         dev_put(dev);
5017         rtnl_unlock();
5018
5019         return err;
5020 }
5021
5022 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
5023 {
5024         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
5025         struct nlattr *cqm;
5026         int err;
5027
5028         cqm = info->attrs[NL80211_ATTR_CQM];
5029         if (!cqm) {
5030                 err = -EINVAL;
5031                 goto out;
5032         }
5033
5034         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
5035                                nl80211_attr_cqm_policy);
5036         if (err)
5037                 goto out;
5038
5039         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
5040             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
5041                 s32 threshold;
5042                 u32 hysteresis;
5043                 threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
5044                 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
5045                 err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
5046         } else
5047                 err = -EINVAL;
5048
5049 out:
5050         return err;
5051 }
5052
5053 static struct genl_ops nl80211_ops[] = {
5054         {
5055                 .cmd = NL80211_CMD_GET_WIPHY,
5056                 .doit = nl80211_get_wiphy,
5057                 .dumpit = nl80211_dump_wiphy,
5058                 .policy = nl80211_policy,
5059                 /* can be retrieved by unprivileged users */
5060         },
5061         {
5062                 .cmd = NL80211_CMD_SET_WIPHY,
5063                 .doit = nl80211_set_wiphy,
5064                 .policy = nl80211_policy,
5065                 .flags = GENL_ADMIN_PERM,
5066         },
5067         {
5068                 .cmd = NL80211_CMD_GET_INTERFACE,
5069                 .doit = nl80211_get_interface,
5070                 .dumpit = nl80211_dump_interface,
5071                 .policy = nl80211_policy,
5072                 /* can be retrieved by unprivileged users */
5073         },
5074         {
5075                 .cmd = NL80211_CMD_SET_INTERFACE,
5076                 .doit = nl80211_set_interface,
5077                 .policy = nl80211_policy,
5078                 .flags = GENL_ADMIN_PERM,
5079         },
5080         {
5081                 .cmd = NL80211_CMD_NEW_INTERFACE,
5082                 .doit = nl80211_new_interface,
5083                 .policy = nl80211_policy,
5084                 .flags = GENL_ADMIN_PERM,
5085         },
5086         {
5087                 .cmd = NL80211_CMD_DEL_INTERFACE,
5088                 .doit = nl80211_del_interface,
5089                 .policy = nl80211_policy,
5090                 .flags = GENL_ADMIN_PERM,
5091         },
5092         {
5093                 .cmd = NL80211_CMD_GET_KEY,
5094                 .doit = nl80211_get_key,
5095                 .policy = nl80211_policy,
5096                 .flags = GENL_ADMIN_PERM,
5097         },
5098         {
5099                 .cmd = NL80211_CMD_SET_KEY,
5100                 .doit = nl80211_set_key,
5101                 .policy = nl80211_policy,
5102                 .flags = GENL_ADMIN_PERM,
5103         },
5104         {
5105                 .cmd = NL80211_CMD_NEW_KEY,
5106                 .doit = nl80211_new_key,
5107                 .policy = nl80211_policy,
5108                 .flags = GENL_ADMIN_PERM,
5109         },
5110         {
5111                 .cmd = NL80211_CMD_DEL_KEY,
5112                 .doit = nl80211_del_key,
5113                 .policy = nl80211_policy,
5114                 .flags = GENL_ADMIN_PERM,
5115         },
5116         {
5117                 .cmd = NL80211_CMD_SET_BEACON,
5118                 .policy = nl80211_policy,
5119                 .flags = GENL_ADMIN_PERM,
5120                 .doit = nl80211_addset_beacon,
5121         },
5122         {
5123                 .cmd = NL80211_CMD_NEW_BEACON,
5124                 .policy = nl80211_policy,
5125                 .flags = GENL_ADMIN_PERM,
5126                 .doit = nl80211_addset_beacon,
5127         },
5128         {
5129                 .cmd = NL80211_CMD_DEL_BEACON,
5130                 .policy = nl80211_policy,
5131                 .flags = GENL_ADMIN_PERM,
5132                 .doit = nl80211_del_beacon,
5133         },
5134         {
5135                 .cmd = NL80211_CMD_GET_STATION,
5136                 .doit = nl80211_get_station,
5137                 .dumpit = nl80211_dump_station,
5138                 .policy = nl80211_policy,
5139         },
5140         {
5141                 .cmd = NL80211_CMD_SET_STATION,
5142                 .doit = nl80211_set_station,
5143                 .policy = nl80211_policy,
5144                 .flags = GENL_ADMIN_PERM,
5145         },
5146         {
5147                 .cmd = NL80211_CMD_NEW_STATION,
5148                 .doit = nl80211_new_station,
5149                 .policy = nl80211_policy,
5150                 .flags = GENL_ADMIN_PERM,
5151         },
5152         {
5153                 .cmd = NL80211_CMD_DEL_STATION,
5154                 .doit = nl80211_del_station,
5155                 .policy = nl80211_policy,
5156                 .flags = GENL_ADMIN_PERM,
5157         },
5158         {
5159                 .cmd = NL80211_CMD_GET_MPATH,
5160                 .doit = nl80211_get_mpath,
5161                 .dumpit = nl80211_dump_mpath,
5162                 .policy = nl80211_policy,
5163                 .flags = GENL_ADMIN_PERM,
5164         },
5165         {
5166                 .cmd = NL80211_CMD_SET_MPATH,
5167                 .doit = nl80211_set_mpath,
5168                 .policy = nl80211_policy,
5169                 .flags = GENL_ADMIN_PERM,
5170         },
5171         {
5172                 .cmd = NL80211_CMD_NEW_MPATH,
5173                 .doit = nl80211_new_mpath,
5174                 .policy = nl80211_policy,
5175                 .flags = GENL_ADMIN_PERM,
5176         },
5177         {
5178                 .cmd = NL80211_CMD_DEL_MPATH,
5179                 .doit = nl80211_del_mpath,
5180                 .policy = nl80211_policy,
5181                 .flags = GENL_ADMIN_PERM,
5182         },
5183         {
5184                 .cmd = NL80211_CMD_SET_BSS,
5185                 .doit = nl80211_set_bss,
5186                 .policy = nl80211_policy,
5187                 .flags = GENL_ADMIN_PERM,
5188         },
5189         {
5190                 .cmd = NL80211_CMD_GET_REG,
5191                 .doit = nl80211_get_reg,
5192                 .policy = nl80211_policy,
5193                 /* can be retrieved by unprivileged users */
5194         },
5195         {
5196                 .cmd = NL80211_CMD_SET_REG,
5197                 .doit = nl80211_set_reg,
5198                 .policy = nl80211_policy,
5199                 .flags = GENL_ADMIN_PERM,
5200         },
5201         {
5202                 .cmd = NL80211_CMD_REQ_SET_REG,
5203                 .doit = nl80211_req_set_reg,
5204                 .policy = nl80211_policy,
5205                 .flags = GENL_ADMIN_PERM,
5206         },
5207         {
5208                 .cmd = NL80211_CMD_GET_MESH_PARAMS,
5209                 .doit = nl80211_get_mesh_params,
5210                 .policy = nl80211_policy,
5211                 /* can be retrieved by unprivileged users */
5212         },
5213         {
5214                 .cmd = NL80211_CMD_SET_MESH_PARAMS,
5215                 .doit = nl80211_set_mesh_params,
5216                 .policy = nl80211_policy,
5217                 .flags = GENL_ADMIN_PERM,
5218         },
5219         {
5220                 .cmd = NL80211_CMD_TRIGGER_SCAN,
5221                 .doit = nl80211_trigger_scan,
5222                 .policy = nl80211_policy,
5223                 .flags = GENL_ADMIN_PERM,
5224         },
5225         {
5226                 .cmd = NL80211_CMD_GET_SCAN,
5227                 .policy = nl80211_policy,
5228                 .dumpit = nl80211_dump_scan,
5229         },
5230         {
5231                 .cmd = NL80211_CMD_AUTHENTICATE,
5232                 .doit = nl80211_authenticate,
5233                 .policy = nl80211_policy,
5234                 .flags = GENL_ADMIN_PERM,
5235         },
5236         {
5237                 .cmd = NL80211_CMD_ASSOCIATE,
5238                 .doit = nl80211_associate,
5239                 .policy = nl80211_policy,
5240                 .flags = GENL_ADMIN_PERM,
5241         },
5242         {
5243                 .cmd = NL80211_CMD_DEAUTHENTICATE,
5244                 .doit = nl80211_deauthenticate,
5245                 .policy = nl80211_policy,
5246                 .flags = GENL_ADMIN_PERM,
5247         },
5248         {
5249                 .cmd = NL80211_CMD_DISASSOCIATE,
5250                 .doit = nl80211_disassociate,
5251                 .policy = nl80211_policy,
5252                 .flags = GENL_ADMIN_PERM,
5253         },
5254         {
5255                 .cmd = NL80211_CMD_JOIN_IBSS,
5256                 .doit = nl80211_join_ibss,
5257                 .policy = nl80211_policy,
5258                 .flags = GENL_ADMIN_PERM,
5259         },
5260         {
5261                 .cmd = NL80211_CMD_LEAVE_IBSS,
5262                 .doit = nl80211_leave_ibss,
5263                 .policy = nl80211_policy,
5264                 .flags = GENL_ADMIN_PERM,
5265         },
5266 #ifdef CONFIG_NL80211_TESTMODE
5267         {
5268                 .cmd = NL80211_CMD_TESTMODE,
5269                 .doit = nl80211_testmode_do,
5270                 .policy = nl80211_policy,
5271                 .flags = GENL_ADMIN_PERM,
5272         },
5273 #endif
5274         {
5275                 .cmd = NL80211_CMD_CONNECT,
5276                 .doit = nl80211_connect,
5277                 .policy = nl80211_policy,
5278                 .flags = GENL_ADMIN_PERM,
5279         },
5280         {
5281                 .cmd = NL80211_CMD_DISCONNECT,
5282                 .doit = nl80211_disconnect,
5283                 .policy = nl80211_policy,
5284                 .flags = GENL_ADMIN_PERM,
5285         },
5286         {
5287                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
5288                 .doit = nl80211_wiphy_netns,
5289                 .policy = nl80211_policy,
5290                 .flags = GENL_ADMIN_PERM,
5291         },
5292         {
5293                 .cmd = NL80211_CMD_GET_SURVEY,
5294                 .policy = nl80211_policy,
5295                 .dumpit = nl80211_dump_survey,
5296         },
5297         {
5298                 .cmd = NL80211_CMD_SET_PMKSA,
5299                 .doit = nl80211_setdel_pmksa,
5300                 .policy = nl80211_policy,
5301                 .flags = GENL_ADMIN_PERM,
5302         },
5303         {
5304                 .cmd = NL80211_CMD_DEL_PMKSA,
5305                 .doit = nl80211_setdel_pmksa,
5306                 .policy = nl80211_policy,
5307                 .flags = GENL_ADMIN_PERM,
5308         },
5309         {
5310                 .cmd = NL80211_CMD_FLUSH_PMKSA,
5311                 .doit = nl80211_flush_pmksa,
5312                 .policy = nl80211_policy,
5313                 .flags = GENL_ADMIN_PERM,
5314         },
5315         {
5316                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
5317                 .doit = nl80211_remain_on_channel,
5318                 .policy = nl80211_policy,
5319                 .flags = GENL_ADMIN_PERM,
5320         },
5321         {
5322                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
5323                 .doit = nl80211_cancel_remain_on_channel,
5324                 .policy = nl80211_policy,
5325                 .flags = GENL_ADMIN_PERM,
5326         },
5327         {
5328                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
5329                 .doit = nl80211_set_tx_bitrate_mask,
5330                 .policy = nl80211_policy,
5331                 .flags = GENL_ADMIN_PERM,
5332         },
5333         {
5334                 .cmd = NL80211_CMD_REGISTER_ACTION,
5335                 .doit = nl80211_register_action,
5336                 .policy = nl80211_policy,
5337                 .flags = GENL_ADMIN_PERM,
5338         },
5339         {
5340                 .cmd = NL80211_CMD_ACTION,
5341                 .doit = nl80211_action,
5342                 .policy = nl80211_policy,
5343                 .flags = GENL_ADMIN_PERM,
5344         },
5345         {
5346                 .cmd = NL80211_CMD_SET_POWER_SAVE,
5347                 .doit = nl80211_set_power_save,
5348                 .policy = nl80211_policy,
5349                 .flags = GENL_ADMIN_PERM,
5350         },
5351         {
5352                 .cmd = NL80211_CMD_GET_POWER_SAVE,
5353                 .doit = nl80211_get_power_save,
5354                 .policy = nl80211_policy,
5355                 /* can be retrieved by unprivileged users */
5356         },
5357         {
5358                 .cmd = NL80211_CMD_SET_CQM,
5359                 .doit = nl80211_set_cqm,
5360                 .policy = nl80211_policy,
5361                 .flags = GENL_ADMIN_PERM,
5362         },
5363         {
5364                 .cmd = NL80211_CMD_SET_CHANNEL,
5365                 .doit = nl80211_set_channel,
5366                 .policy = nl80211_policy,
5367                 .flags = GENL_ADMIN_PERM,
5368         },
5369 };
5370
5371 static struct genl_multicast_group nl80211_mlme_mcgrp = {
5372         .name = "mlme",
5373 };
5374
5375 /* multicast groups */
5376 static struct genl_multicast_group nl80211_config_mcgrp = {
5377         .name = "config",
5378 };
5379 static struct genl_multicast_group nl80211_scan_mcgrp = {
5380         .name = "scan",
5381 };
5382 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
5383         .name = "regulatory",
5384 };
5385
5386 /* notification functions */
5387
5388 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
5389 {
5390         struct sk_buff *msg;
5391
5392         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5393         if (!msg)
5394                 return;
5395
5396         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
5397                 nlmsg_free(msg);
5398                 return;
5399         }
5400
5401         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5402                                 nl80211_config_mcgrp.id, GFP_KERNEL);
5403 }
5404
5405 static int nl80211_add_scan_req(struct sk_buff *msg,
5406                                 struct cfg80211_registered_device *rdev)
5407 {
5408         struct cfg80211_scan_request *req = rdev->scan_req;
5409         struct nlattr *nest;
5410         int i;
5411
5412         ASSERT_RDEV_LOCK(rdev);
5413
5414         if (WARN_ON(!req))
5415                 return 0;
5416
5417         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
5418         if (!nest)
5419                 goto nla_put_failure;
5420         for (i = 0; i < req->n_ssids; i++)
5421                 NLA_PUT(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid);
5422         nla_nest_end(msg, nest);
5423
5424         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
5425         if (!nest)
5426                 goto nla_put_failure;
5427         for (i = 0; i < req->n_channels; i++)
5428                 NLA_PUT_U32(msg, i, req->channels[i]->center_freq);
5429         nla_nest_end(msg, nest);
5430
5431         if (req->ie)
5432                 NLA_PUT(msg, NL80211_ATTR_IE, req->ie_len, req->ie);
5433
5434         return 0;
5435  nla_put_failure:
5436         return -ENOBUFS;
5437 }
5438
5439 static int nl80211_send_scan_msg(struct sk_buff *msg,
5440                                  struct cfg80211_registered_device *rdev,
5441                                  struct net_device *netdev,
5442                                  u32 pid, u32 seq, int flags,
5443                                  u32 cmd)
5444 {
5445         void *hdr;
5446
5447         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
5448         if (!hdr)
5449                 return -1;
5450
5451         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5452         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5453
5454         /* ignore errors and send incomplete event anyway */
5455         nl80211_add_scan_req(msg, rdev);
5456
5457         return genlmsg_end(msg, hdr);
5458
5459  nla_put_failure:
5460         genlmsg_cancel(msg, hdr);
5461         return -EMSGSIZE;
5462 }
5463
5464 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
5465                              struct net_device *netdev)
5466 {
5467         struct sk_buff *msg;
5468
5469         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5470         if (!msg)
5471                 return;
5472
5473         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
5474                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
5475                 nlmsg_free(msg);
5476                 return;
5477         }
5478
5479         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5480                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
5481 }
5482
5483 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
5484                             struct net_device *netdev)
5485 {
5486         struct sk_buff *msg;
5487
5488         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5489         if (!msg)
5490                 return;
5491
5492         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
5493                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
5494                 nlmsg_free(msg);
5495                 return;
5496         }
5497
5498         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5499                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
5500 }
5501
5502 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
5503                                struct net_device *netdev)
5504 {
5505         struct sk_buff *msg;
5506
5507         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5508         if (!msg)
5509                 return;
5510
5511         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
5512                                   NL80211_CMD_SCAN_ABORTED) < 0) {
5513                 nlmsg_free(msg);
5514                 return;
5515         }
5516
5517         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5518                                 nl80211_scan_mcgrp.id, GFP_KERNEL);
5519 }
5520
5521 /*
5522  * This can happen on global regulatory changes or device specific settings
5523  * based on custom world regulatory domains.
5524  */
5525 void nl80211_send_reg_change_event(struct regulatory_request *request)
5526 {
5527         struct sk_buff *msg;
5528         void *hdr;
5529
5530         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5531         if (!msg)
5532                 return;
5533
5534         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
5535         if (!hdr) {
5536                 nlmsg_free(msg);
5537                 return;
5538         }
5539
5540         /* Userspace can always count this one always being set */
5541         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
5542
5543         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
5544                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5545                            NL80211_REGDOM_TYPE_WORLD);
5546         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
5547                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5548                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
5549         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
5550                  request->intersect)
5551                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5552                            NL80211_REGDOM_TYPE_INTERSECTION);
5553         else {
5554                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
5555                            NL80211_REGDOM_TYPE_COUNTRY);
5556                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
5557         }
5558
5559         if (wiphy_idx_valid(request->wiphy_idx))
5560                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
5561
5562         if (genlmsg_end(msg, hdr) < 0) {
5563                 nlmsg_free(msg);
5564                 return;
5565         }
5566
5567         rcu_read_lock();
5568         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
5569                                 GFP_ATOMIC);
5570         rcu_read_unlock();
5571
5572         return;
5573
5574 nla_put_failure:
5575         genlmsg_cancel(msg, hdr);
5576         nlmsg_free(msg);
5577 }
5578
5579 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
5580                                     struct net_device *netdev,
5581                                     const u8 *buf, size_t len,
5582                                     enum nl80211_commands cmd, gfp_t gfp)
5583 {
5584         struct sk_buff *msg;
5585         void *hdr;
5586
5587         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5588         if (!msg)
5589                 return;
5590
5591         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
5592         if (!hdr) {
5593                 nlmsg_free(msg);
5594                 return;
5595         }
5596
5597         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5598         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5599         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
5600
5601         if (genlmsg_end(msg, hdr) < 0) {
5602                 nlmsg_free(msg);
5603                 return;
5604         }
5605
5606         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5607                                 nl80211_mlme_mcgrp.id, gfp);
5608         return;
5609
5610  nla_put_failure:
5611         genlmsg_cancel(msg, hdr);
5612         nlmsg_free(msg);
5613 }
5614
5615 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
5616                           struct net_device *netdev, const u8 *buf,
5617                           size_t len, gfp_t gfp)
5618 {
5619         nl80211_send_mlme_event(rdev, netdev, buf, len,
5620                                 NL80211_CMD_AUTHENTICATE, gfp);
5621 }
5622
5623 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
5624                            struct net_device *netdev, const u8 *buf,
5625                            size_t len, gfp_t gfp)
5626 {
5627         nl80211_send_mlme_event(rdev, netdev, buf, len,
5628                                 NL80211_CMD_ASSOCIATE, gfp);
5629 }
5630
5631 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
5632                          struct net_device *netdev, const u8 *buf,
5633                          size_t len, gfp_t gfp)
5634 {
5635         nl80211_send_mlme_event(rdev, netdev, buf, len,
5636                                 NL80211_CMD_DEAUTHENTICATE, gfp);
5637 }
5638
5639 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
5640                            struct net_device *netdev, const u8 *buf,
5641                            size_t len, gfp_t gfp)
5642 {
5643         nl80211_send_mlme_event(rdev, netdev, buf, len,
5644                                 NL80211_CMD_DISASSOCIATE, gfp);
5645 }
5646
5647 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
5648                                       struct net_device *netdev, int cmd,
5649                                       const u8 *addr, gfp_t gfp)
5650 {
5651         struct sk_buff *msg;
5652         void *hdr;
5653
5654         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5655         if (!msg)
5656                 return;
5657
5658         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
5659         if (!hdr) {
5660                 nlmsg_free(msg);
5661                 return;
5662         }
5663
5664         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5665         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5666         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
5667         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
5668
5669         if (genlmsg_end(msg, hdr) < 0) {
5670                 nlmsg_free(msg);
5671                 return;
5672         }
5673
5674         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5675                                 nl80211_mlme_mcgrp.id, gfp);
5676         return;
5677
5678  nla_put_failure:
5679         genlmsg_cancel(msg, hdr);
5680         nlmsg_free(msg);
5681 }
5682
5683 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
5684                                struct net_device *netdev, const u8 *addr,
5685                                gfp_t gfp)
5686 {
5687         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
5688                                   addr, gfp);
5689 }
5690
5691 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
5692                                 struct net_device *netdev, const u8 *addr,
5693                                 gfp_t gfp)
5694 {
5695         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
5696                                   addr, gfp);
5697 }
5698
5699 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
5700                                  struct net_device *netdev, const u8 *bssid,
5701                                  const u8 *req_ie, size_t req_ie_len,
5702                                  const u8 *resp_ie, size_t resp_ie_len,
5703                                  u16 status, gfp_t gfp)
5704 {
5705         struct sk_buff *msg;
5706         void *hdr;
5707
5708         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5709         if (!msg)
5710                 return;
5711
5712         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
5713         if (!hdr) {
5714                 nlmsg_free(msg);
5715                 return;
5716         }
5717
5718         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5719         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5720         if (bssid)
5721                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5722         NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status);
5723         if (req_ie)
5724                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
5725         if (resp_ie)
5726                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
5727
5728         if (genlmsg_end(msg, hdr) < 0) {
5729                 nlmsg_free(msg);
5730                 return;
5731         }
5732
5733         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5734                                 nl80211_mlme_mcgrp.id, gfp);
5735         return;
5736
5737  nla_put_failure:
5738         genlmsg_cancel(msg, hdr);
5739         nlmsg_free(msg);
5740
5741 }
5742
5743 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
5744                          struct net_device *netdev, const u8 *bssid,
5745                          const u8 *req_ie, size_t req_ie_len,
5746                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
5747 {
5748         struct sk_buff *msg;
5749         void *hdr;
5750
5751         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
5752         if (!msg)
5753                 return;
5754
5755         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
5756         if (!hdr) {
5757                 nlmsg_free(msg);
5758                 return;
5759         }
5760
5761         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5762         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5763         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5764         if (req_ie)
5765                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
5766         if (resp_ie)
5767                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
5768
5769         if (genlmsg_end(msg, hdr) < 0) {
5770                 nlmsg_free(msg);
5771                 return;
5772         }
5773
5774         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5775                                 nl80211_mlme_mcgrp.id, gfp);
5776         return;
5777
5778  nla_put_failure:
5779         genlmsg_cancel(msg, hdr);
5780         nlmsg_free(msg);
5781
5782 }
5783
5784 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
5785                                struct net_device *netdev, u16 reason,
5786                                const u8 *ie, size_t ie_len, bool from_ap)
5787 {
5788         struct sk_buff *msg;
5789         void *hdr;
5790
5791         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
5792         if (!msg)
5793                 return;
5794
5795         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
5796         if (!hdr) {
5797                 nlmsg_free(msg);
5798                 return;
5799         }
5800
5801         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5802         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5803         if (from_ap && reason)
5804                 NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason);
5805         if (from_ap)
5806                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISCONNECTED_BY_AP);
5807         if (ie)
5808                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len, ie);
5809
5810         if (genlmsg_end(msg, hdr) < 0) {
5811                 nlmsg_free(msg);
5812                 return;
5813         }
5814
5815         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5816                                 nl80211_mlme_mcgrp.id, GFP_KERNEL);
5817         return;
5818
5819  nla_put_failure:
5820         genlmsg_cancel(msg, hdr);
5821         nlmsg_free(msg);
5822
5823 }
5824
5825 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
5826                              struct net_device *netdev, const u8 *bssid,
5827                              gfp_t gfp)
5828 {
5829         struct sk_buff *msg;
5830         void *hdr;
5831
5832         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5833         if (!msg)
5834                 return;
5835
5836         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
5837         if (!hdr) {
5838                 nlmsg_free(msg);
5839                 return;
5840         }
5841
5842         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5843         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5844         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
5845
5846         if (genlmsg_end(msg, hdr) < 0) {
5847                 nlmsg_free(msg);
5848                 return;
5849         }
5850
5851         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5852                                 nl80211_mlme_mcgrp.id, gfp);
5853         return;
5854
5855  nla_put_failure:
5856         genlmsg_cancel(msg, hdr);
5857         nlmsg_free(msg);
5858 }
5859
5860 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
5861                                  struct net_device *netdev, const u8 *addr,
5862                                  enum nl80211_key_type key_type, int key_id,
5863                                  const u8 *tsc, gfp_t gfp)
5864 {
5865         struct sk_buff *msg;
5866         void *hdr;
5867
5868         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5869         if (!msg)
5870                 return;
5871
5872         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
5873         if (!hdr) {
5874                 nlmsg_free(msg);
5875                 return;
5876         }
5877
5878         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5879         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5880         if (addr)
5881                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
5882         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
5883         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
5884         if (tsc)
5885                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
5886
5887         if (genlmsg_end(msg, hdr) < 0) {
5888                 nlmsg_free(msg);
5889                 return;
5890         }
5891
5892         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5893                                 nl80211_mlme_mcgrp.id, gfp);
5894         return;
5895
5896  nla_put_failure:
5897         genlmsg_cancel(msg, hdr);
5898         nlmsg_free(msg);
5899 }
5900
5901 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
5902                                     struct ieee80211_channel *channel_before,
5903                                     struct ieee80211_channel *channel_after)
5904 {
5905         struct sk_buff *msg;
5906         void *hdr;
5907         struct nlattr *nl_freq;
5908
5909         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
5910         if (!msg)
5911                 return;
5912
5913         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
5914         if (!hdr) {
5915                 nlmsg_free(msg);
5916                 return;
5917         }
5918
5919         /*
5920          * Since we are applying the beacon hint to a wiphy we know its
5921          * wiphy_idx is valid
5922          */
5923         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
5924
5925         /* Before */
5926         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
5927         if (!nl_freq)
5928                 goto nla_put_failure;
5929         if (nl80211_msg_put_channel(msg, channel_before))
5930                 goto nla_put_failure;
5931         nla_nest_end(msg, nl_freq);
5932
5933         /* After */
5934         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
5935         if (!nl_freq)
5936                 goto nla_put_failure;
5937         if (nl80211_msg_put_channel(msg, channel_after))
5938                 goto nla_put_failure;
5939         nla_nest_end(msg, nl_freq);
5940
5941         if (genlmsg_end(msg, hdr) < 0) {
5942                 nlmsg_free(msg);
5943                 return;
5944         }
5945
5946         rcu_read_lock();
5947         genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
5948                                 GFP_ATOMIC);
5949         rcu_read_unlock();
5950
5951         return;
5952
5953 nla_put_failure:
5954         genlmsg_cancel(msg, hdr);
5955         nlmsg_free(msg);
5956 }
5957
5958 static void nl80211_send_remain_on_chan_event(
5959         int cmd, struct cfg80211_registered_device *rdev,
5960         struct net_device *netdev, u64 cookie,
5961         struct ieee80211_channel *chan,
5962         enum nl80211_channel_type channel_type,
5963         unsigned int duration, gfp_t gfp)
5964 {
5965         struct sk_buff *msg;
5966         void *hdr;
5967
5968         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
5969         if (!msg)
5970                 return;
5971
5972         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
5973         if (!hdr) {
5974                 nlmsg_free(msg);
5975                 return;
5976         }
5977
5978         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
5979         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
5980         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq);
5981         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, channel_type);
5982         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
5983
5984         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL)
5985                 NLA_PUT_U32(msg, NL80211_ATTR_DURATION, duration);
5986
5987         if (genlmsg_end(msg, hdr) < 0) {
5988                 nlmsg_free(msg);
5989                 return;
5990         }
5991
5992         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
5993                                 nl80211_mlme_mcgrp.id, gfp);
5994         return;
5995
5996  nla_put_failure:
5997         genlmsg_cancel(msg, hdr);
5998         nlmsg_free(msg);
5999 }
6000
6001 void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
6002                                     struct net_device *netdev, u64 cookie,
6003                                     struct ieee80211_channel *chan,
6004                                     enum nl80211_channel_type channel_type,
6005                                     unsigned int duration, gfp_t gfp)
6006 {
6007         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
6008                                           rdev, netdev, cookie, chan,
6009                                           channel_type, duration, gfp);
6010 }
6011
6012 void nl80211_send_remain_on_channel_cancel(
6013         struct cfg80211_registered_device *rdev, struct net_device *netdev,
6014         u64 cookie, struct ieee80211_channel *chan,
6015         enum nl80211_channel_type channel_type, gfp_t gfp)
6016 {
6017         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
6018                                           rdev, netdev, cookie, chan,
6019                                           channel_type, 0, gfp);
6020 }
6021
6022 void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
6023                             struct net_device *dev, const u8 *mac_addr,
6024                             struct station_info *sinfo, gfp_t gfp)
6025 {
6026         struct sk_buff *msg;
6027
6028         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
6029         if (!msg)
6030                 return;
6031
6032         if (nl80211_send_station(msg, 0, 0, 0, dev, mac_addr, sinfo) < 0) {
6033                 nlmsg_free(msg);
6034                 return;
6035         }
6036
6037         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6038                                 nl80211_mlme_mcgrp.id, gfp);
6039 }
6040
6041 int nl80211_send_action(struct cfg80211_registered_device *rdev,
6042                         struct net_device *netdev, u32 nlpid,
6043                         int freq, const u8 *buf, size_t len, gfp_t gfp)
6044 {
6045         struct sk_buff *msg;
6046         void *hdr;
6047         int err;
6048
6049         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6050         if (!msg)
6051                 return -ENOMEM;
6052
6053         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ACTION);
6054         if (!hdr) {
6055                 nlmsg_free(msg);
6056                 return -ENOMEM;
6057         }
6058
6059         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6060         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6061         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
6062         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
6063
6064         err = genlmsg_end(msg, hdr);
6065         if (err < 0) {
6066                 nlmsg_free(msg);
6067                 return err;
6068         }
6069
6070         err = genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlpid);
6071         if (err < 0)
6072                 return err;
6073         return 0;
6074
6075  nla_put_failure:
6076         genlmsg_cancel(msg, hdr);
6077         nlmsg_free(msg);
6078         return -ENOBUFS;
6079 }
6080
6081 void nl80211_send_action_tx_status(struct cfg80211_registered_device *rdev,
6082                                    struct net_device *netdev, u64 cookie,
6083                                    const u8 *buf, size_t len, bool ack,
6084                                    gfp_t gfp)
6085 {
6086         struct sk_buff *msg;
6087         void *hdr;
6088
6089         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
6090         if (!msg)
6091                 return;
6092
6093         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ACTION_TX_STATUS);
6094         if (!hdr) {
6095                 nlmsg_free(msg);
6096                 return;
6097         }
6098
6099         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6100         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6101         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
6102         NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, cookie);
6103         if (ack)
6104                 NLA_PUT_FLAG(msg, NL80211_ATTR_ACK);
6105
6106         if (genlmsg_end(msg, hdr) < 0) {
6107                 nlmsg_free(msg);
6108                 return;
6109         }
6110
6111         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
6112         return;
6113
6114  nla_put_failure:
6115         genlmsg_cancel(msg, hdr);
6116         nlmsg_free(msg);
6117 }
6118
6119 void
6120 nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
6121                              struct net_device *netdev,
6122                              enum nl80211_cqm_rssi_threshold_event rssi_event,
6123                              gfp_t gfp)
6124 {
6125         struct sk_buff *msg;
6126         struct nlattr *pinfoattr;
6127         void *hdr;
6128
6129         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
6130         if (!msg)
6131                 return;
6132
6133         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
6134         if (!hdr) {
6135                 nlmsg_free(msg);
6136                 return;
6137         }
6138
6139         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
6140         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
6141
6142         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
6143         if (!pinfoattr)
6144                 goto nla_put_failure;
6145
6146         NLA_PUT_U32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
6147                     rssi_event);
6148
6149         nla_nest_end(msg, pinfoattr);
6150
6151         if (genlmsg_end(msg, hdr) < 0) {
6152                 nlmsg_free(msg);
6153                 return;
6154         }
6155
6156         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
6157                                 nl80211_mlme_mcgrp.id, gfp);
6158         return;
6159
6160  nla_put_failure:
6161         genlmsg_cancel(msg, hdr);
6162         nlmsg_free(msg);
6163 }
6164
6165 static int nl80211_netlink_notify(struct notifier_block * nb,
6166                                   unsigned long state,
6167                                   void *_notify)
6168 {
6169         struct netlink_notify *notify = _notify;
6170         struct cfg80211_registered_device *rdev;
6171         struct wireless_dev *wdev;
6172
6173         if (state != NETLINK_URELEASE)
6174                 return NOTIFY_DONE;
6175
6176         rcu_read_lock();
6177
6178         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list)
6179                 list_for_each_entry_rcu(wdev, &rdev->netdev_list, list)
6180                         cfg80211_mlme_unregister_actions(wdev, notify->pid);
6181
6182         rcu_read_unlock();
6183
6184         return NOTIFY_DONE;
6185 }
6186
6187 static struct notifier_block nl80211_netlink_notifier = {
6188         .notifier_call = nl80211_netlink_notify,
6189 };
6190
6191 /* initialisation/exit functions */
6192
6193 int nl80211_init(void)
6194 {
6195         int err;
6196
6197         err = genl_register_family_with_ops(&nl80211_fam,
6198                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
6199         if (err)
6200                 return err;
6201
6202         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
6203         if (err)
6204                 goto err_out;
6205
6206         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
6207         if (err)
6208                 goto err_out;
6209
6210         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
6211         if (err)
6212                 goto err_out;
6213
6214         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
6215         if (err)
6216                 goto err_out;
6217
6218 #ifdef CONFIG_NL80211_TESTMODE
6219         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
6220         if (err)
6221                 goto err_out;
6222 #endif
6223
6224         err = netlink_register_notifier(&nl80211_netlink_notifier);
6225         if (err)
6226                 goto err_out;
6227
6228         return 0;
6229  err_out:
6230         genl_unregister_family(&nl80211_fam);
6231         return err;
6232 }
6233
6234 void nl80211_exit(void)
6235 {
6236         netlink_unregister_notifier(&nl80211_netlink_notifier);
6237         genl_unregister_family(&nl80211_fam);
6238 }