net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2009  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/list.h>
  11 #include <linux/if_ether.h>
  12 #include <linux/ieee80211.h>
  13 #include <linux/nl80211.h>
  14 #include <linux/rtnetlink.h>
  15 #include <linux/netlink.h>
  16 #include <linux/etherdevice.h>
  17 #include <net/genetlink.h>
  18 #include <net/cfg80211.h>
  19 #include "core.h"
  20 #include "nl80211.h"
  21 #include "reg.h"
  22
  23 /* the netlink family */
  24 static struct genl_family nl80211_fam = {
  25         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  26         .name = "nl80211",      /* have users key off the name instead */
  27         .hdrsize = 0,           /* no private header */
  28         .version = 1,           /* no particular meaning now */
  29         .maxattr = NL80211_ATTR_MAX,
  30 };
  31
  32 /* internal helper: get drv and dev */
  33 static int get_drv_dev_by_info_ifindex(struct nlattr **attrs,
  34                                        struct cfg80211_registered_device **drv,
  35                                        struct net_device **dev)
  36 {
  37         int ifindex;
  38
  39         if (!attrs[NL80211_ATTR_IFINDEX])
  40                 return -EINVAL;
  41
  42         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  43         *dev = dev_get_by_index(&init_net, ifindex);
  44         if (!*dev)
  45                 return -ENODEV;
  46
  47         *drv = cfg80211_get_dev_from_ifindex(ifindex);
  48         if (IS_ERR(*drv)) {
  49                 dev_put(*dev);
  50                 return PTR_ERR(*drv);
  51         }
  52
  53         return 0;
  54 }
  55
  56 /* policy for the attributes */
  57 static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
  58         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  59         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  60                                       .len = 20-1 },
  61         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  62         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  63         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  64         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
  65         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
  66         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
  67         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
  68
  69         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  70         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  71         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  72
  73         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  74
  75         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  76                                     .len = WLAN_MAX_KEY_LEN },
  77         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  78         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  79         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
  80         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
  81
  82         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
  83         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
  84         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
  85                                        .len = IEEE80211_MAX_DATA_LEN },
  86         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
  87                                        .len = IEEE80211_MAX_DATA_LEN },
  88         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
  89         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
  90         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
  91         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
  92                                                .len = NL80211_MAX_SUPP_RATES },
  93         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
  94         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
  95         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
  96         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
  97                                 .len = IEEE80211_MAX_MESH_ID_LEN },
  98         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
  99
 100         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 101         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 102
 103         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 104         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 105         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 106         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 107                                            .len = NL80211_MAX_SUPP_RATES },
 108
 109         [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
 110
 111         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 112                                          .len = NL80211_HT_CAPABILITY_LEN },
 113
 114         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 115         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 116                               .len = IEEE80211_MAX_DATA_LEN },
 117         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 118         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 119
 120         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 121                                 .len = IEEE80211_MAX_SSID_LEN },
 122         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 123         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 124         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 125         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 126         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 127         [NL80211_ATTR_STA_FLAGS2] = {
 128                 .len = sizeof(struct nl80211_sta_flag_update),
 129         },
 130         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 131 };
 132
 133 /* IE validation */
 134 static bool is_valid_ie_attr(const struct nlattr *attr)
 135 {
 136         const u8 *pos;
 137         int len;
 138
 139         if (!attr)
 140                 return true;
 141
 142         pos = nla_data(attr);
 143         len = nla_len(attr);
 144
 145         while (len) {
 146                 u8 elemlen;
 147
 148                 if (len < 2)
 149                         return false;
 150                 len -= 2;
 151
 152                 elemlen = pos[1];
 153                 if (elemlen > len)
 154                         return false;
 155
 156                 len -= elemlen;
 157                 pos += 2 + elemlen;
 158         }
 159
 160         return true;
 161 }
 162
 163 /* message building helper */
 164 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 165                                    int flags, u8 cmd)
 166 {
 167         /* since there is no private header just add the generic one */
 168         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 169 }
 170
 171 static int nl80211_msg_put_channel(struct sk_buff *msg,
 172                                    struct ieee80211_channel *chan)
 173 {
 174         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 175                     chan->center_freq);
 176
 177         if (chan->flags & IEEE80211_CHAN_DISABLED)
 178                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 179         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 180                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 181         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 182                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 183         if (chan->flags & IEEE80211_CHAN_RADAR)
 184                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 185
 186         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 187                     DBM_TO_MBM(chan->max_power));
 188
 189         return 0;
 190
 191  nla_put_failure:
 192         return -ENOBUFS;
 193 }
 194
 195 /* netlink command implementations */
 196
 197 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 198                               struct cfg80211_registered_device *dev)
 199 {
 200         void *hdr;
 201         struct nlattr *nl_bands, *nl_band;
 202         struct nlattr *nl_freqs, *nl_freq;
 203         struct nlattr *nl_rates, *nl_rate;
 204         struct nlattr *nl_modes;
 205         struct nlattr *nl_cmds;
 206         enum ieee80211_band band;
 207         struct ieee80211_channel *chan;
 208         struct ieee80211_rate *rate;
 209         int i;
 210         u16 ifmodes = dev->wiphy.interface_modes;
 211
 212         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 213         if (!hdr)
 214                 return -1;
 215
 216         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 217         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 218
 219         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 220                    dev->wiphy.retry_short);
 221         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 222                    dev->wiphy.retry_long);
 223         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 224                     dev->wiphy.frag_threshold);
 225         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 226                     dev->wiphy.rts_threshold);
 227
 228         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 229                    dev->wiphy.max_scan_ssids);
 230         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 231                     dev->wiphy.max_scan_ie_len);
 232
 233         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
 234                 sizeof(u32) * dev->wiphy.n_cipher_suites,
 235                 dev->wiphy.cipher_suites);
 236
 237         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
 238         if (!nl_modes)
 239                 goto nla_put_failure;
 240
 241         i = 0;
 242         while (ifmodes) {
 243                 if (ifmodes & 1)
 244                         NLA_PUT_FLAG(msg, i);
 245                 ifmodes >>= 1;
 246                 i++;
 247         }
 248
 249         nla_nest_end(msg, nl_modes);
 250
 251         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 252         if (!nl_bands)
 253                 goto nla_put_failure;
 254
 255         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 256                 if (!dev->wiphy.bands[band])
 257                         continue;
 258
 259                 nl_band = nla_nest_start(msg, band);
 260                 if (!nl_band)
 261                         goto nla_put_failure;
 262
 263                 /* add HT info */
 264                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 265                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 266                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 267                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 268                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 269                                 dev->wiphy.bands[band]->ht_cap.cap);
 270                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 271                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 272                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 273                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 274                 }
 275
 276                 /* add frequencies */
 277                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 278                 if (!nl_freqs)
 279                         goto nla_put_failure;
 280
 281                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 282                         nl_freq = nla_nest_start(msg, i);
 283                         if (!nl_freq)
 284                                 goto nla_put_failure;
 285
 286                         chan = &dev->wiphy.bands[band]->channels[i];
 287
 288                         if (nl80211_msg_put_channel(msg, chan))
 289                                 goto nla_put_failure;
 290
 291                         nla_nest_end(msg, nl_freq);
 292                 }
 293
 294                 nla_nest_end(msg, nl_freqs);
 295
 296                 /* add bitrates */
 297                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 298                 if (!nl_rates)
 299                         goto nla_put_failure;
 300
 301                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 302                         nl_rate = nla_nest_start(msg, i);
 303                         if (!nl_rate)
 304                                 goto nla_put_failure;
 305
 306                         rate = &dev->wiphy.bands[band]->bitrates[i];
 307                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 308                                     rate->bitrate);
 309                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 310                                 NLA_PUT_FLAG(msg,
 311                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 312
 313                         nla_nest_end(msg, nl_rate);
 314                 }
 315
 316                 nla_nest_end(msg, nl_rates);
 317
 318                 nla_nest_end(msg, nl_band);
 319         }
 320         nla_nest_end(msg, nl_bands);
 321
 322         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 323         if (!nl_cmds)
 324                 goto nla_put_failure;
 325
 326         i = 0;
 327 #define CMD(op, n)                                              \
 328          do {                                                   \
 329                 if (dev->ops->op) {                             \
 330                         i++;                                    \
 331                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 332                 }                                               \
 333         } while (0)
 334
 335         CMD(add_virtual_intf, NEW_INTERFACE);
 336         CMD(change_virtual_intf, SET_INTERFACE);
 337         CMD(add_key, NEW_KEY);
 338         CMD(add_beacon, NEW_BEACON);
 339         CMD(add_station, NEW_STATION);
 340         CMD(add_mpath, NEW_MPATH);
 341         CMD(set_mesh_params, SET_MESH_PARAMS);
 342         CMD(change_bss, SET_BSS);
 343         CMD(auth, AUTHENTICATE);
 344         CMD(assoc, ASSOCIATE);
 345         CMD(deauth, DEAUTHENTICATE);
 346         CMD(disassoc, DISASSOCIATE);
 347         CMD(join_ibss, JOIN_IBSS);
 348
 349 #undef CMD
 350         nla_nest_end(msg, nl_cmds);
 351
 352         return genlmsg_end(msg, hdr);
 353
 354  nla_put_failure:
 355         genlmsg_cancel(msg, hdr);
 356         return -EMSGSIZE;
 357 }
 358
 359 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 360 {
 361         int idx = 0;
 362         int start = cb->args[0];
 363         struct cfg80211_registered_device *dev;
 364
 365         mutex_lock(&cfg80211_mutex);
 366         list_for_each_entry(dev, &cfg80211_drv_list, list) {
 367                 if (++idx <= start)
 368                         continue;
 369                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
 370                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
 371                                        dev) < 0) {
 372                         idx--;
 373                         break;
 374                 }
 375         }
 376         mutex_unlock(&cfg80211_mutex);
 377
 378         cb->args[0] = idx;
 379
 380         return skb->len;
 381 }
 382
 383 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 384 {
 385         struct sk_buff *msg;
 386         struct cfg80211_registered_device *dev;
 387
 388         dev = cfg80211_get_dev_from_info(info);
 389         if (IS_ERR(dev))
 390                 return PTR_ERR(dev);
 391
 392         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 393         if (!msg)
 394                 goto out_err;
 395
 396         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
 397                 goto out_free;
 398
 399         cfg80211_put_dev(dev);
 400
 401         return genlmsg_unicast(msg, info->snd_pid);
 402
 403  out_free:
 404         nlmsg_free(msg);
 405  out_err:
 406         cfg80211_put_dev(dev);
 407         return -ENOBUFS;
 408 }
 409
 410 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 411         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
 412         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
 413         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
 414         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
 415         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
 416 };
 417
 418 static int parse_txq_params(struct nlattr *tb[],
 419                             struct ieee80211_txq_params *txq_params)
 420 {
 421         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 422             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 423             !tb[NL80211_TXQ_ATTR_AIFS])
 424                 return -EINVAL;
 425
 426         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
 427         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 428         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 429         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 430         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 431
 432         return 0;
 433 }
 434
 435 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 436 {
 437         struct cfg80211_registered_device *rdev;
 438         int result = 0, rem_txq_params = 0;
 439         struct nlattr *nl_txq_params;
 440         u32 changed;
 441         u8 retry_short = 0, retry_long = 0;
 442         u32 frag_threshold = 0, rts_threshold = 0;
 443
 444         rtnl_lock();
 445
 446         mutex_lock(&cfg80211_mutex);
 447
 448         rdev = __cfg80211_drv_from_info(info);
 449         if (IS_ERR(rdev)) {
 450                 mutex_unlock(&cfg80211_mutex);
 451                 result = PTR_ERR(rdev);
 452                 goto unlock;
 453         }
 454
 455         mutex_lock(&rdev->mtx);
 456
 457         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
 458                 result = cfg80211_dev_rename(
 459                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 460
 461         mutex_unlock(&cfg80211_mutex);
 462
 463         if (result)
 464                 goto bad_res;
 465
 466         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
 467                 struct ieee80211_txq_params txq_params;
 468                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
 469
 470                 if (!rdev->ops->set_txq_params) {
 471                         result = -EOPNOTSUPP;
 472                         goto bad_res;
 473                 }
 474
 475                 nla_for_each_nested(nl_txq_params,
 476                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
 477                                     rem_txq_params) {
 478                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
 479                                   nla_data(nl_txq_params),
 480                                   nla_len(nl_txq_params),
 481                                   txq_params_policy);
 482                         result = parse_txq_params(tb, &txq_params);
 483                         if (result)
 484                                 goto bad_res;
 485
 486                         result = rdev->ops->set_txq_params(&rdev->wiphy,
 487                                                            &txq_params);
 488                         if (result)
 489                                 goto bad_res;
 490                 }
 491         }
 492
 493         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
 494                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 495                 struct ieee80211_channel *chan;
 496                 struct ieee80211_sta_ht_cap *ht_cap;
 497                 u32 freq;
 498
 499                 if (!rdev->ops->set_channel) {
 500                         result = -EOPNOTSUPP;
 501                         goto bad_res;
 502                 }
 503
 504                 result = -EINVAL;
 505
 506                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 507                         channel_type = nla_get_u32(info->attrs[
 508                                            NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 509                         if (channel_type != NL80211_CHAN_NO_HT &&
 510                             channel_type != NL80211_CHAN_HT20 &&
 511                             channel_type != NL80211_CHAN_HT40PLUS &&
 512                             channel_type != NL80211_CHAN_HT40MINUS)
 513                                 goto bad_res;
 514                 }
 515
 516                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 517                 chan = ieee80211_get_channel(&rdev->wiphy, freq);
 518
 519                 /* Primary channel not allowed */
 520                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 521                         goto bad_res;
 522
 523                 if (channel_type == NL80211_CHAN_HT40MINUS &&
 524                     (chan->flags & IEEE80211_CHAN_NO_HT40MINUS))
 525                         goto bad_res;
 526                 else if (channel_type == NL80211_CHAN_HT40PLUS &&
 527                          (chan->flags & IEEE80211_CHAN_NO_HT40PLUS))
 528                         goto bad_res;
 529
 530                 /*
 531                  * At this point we know if that if HT40 was requested
 532                  * we are allowed to use it and the extension channel
 533                  * exists.
 534                  */
 535
 536                 ht_cap = &rdev->wiphy.bands[chan->band]->ht_cap;
 537
 538                 /* no HT capabilities or intolerant */
 539                 if (channel_type != NL80211_CHAN_NO_HT) {
 540                         if (!ht_cap->ht_supported)
 541                                 goto bad_res;
 542                         if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
 543                             (ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT))
 544                                 goto bad_res;
 545                 }
 546
 547                 result = rdev->ops->set_channel(&rdev->wiphy, chan,
 548                                                 channel_type);
 549                 if (result)
 550                         goto bad_res;
 551         }
 552
 553         changed = 0;
 554
 555         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
 556                 retry_short = nla_get_u8(
 557                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
 558                 if (retry_short == 0) {
 559                         result = -EINVAL;
 560                         goto bad_res;
 561                 }
 562                 changed |= WIPHY_PARAM_RETRY_SHORT;
 563         }
 564
 565         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
 566                 retry_long = nla_get_u8(
 567                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
 568                 if (retry_long == 0) {
 569                         result = -EINVAL;
 570                         goto bad_res;
 571                 }
 572                 changed |= WIPHY_PARAM_RETRY_LONG;
 573         }
 574
 575         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
 576                 frag_threshold = nla_get_u32(
 577                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
 578                 if (frag_threshold < 256) {
 579                         result = -EINVAL;
 580                         goto bad_res;
 581                 }
 582                 if (frag_threshold != (u32) -1) {
 583                         /*
 584                          * Fragments (apart from the last one) are required to
 585                          * have even length. Make the fragmentation code
 586                          * simpler by stripping LSB should someone try to use
 587                          * odd threshold value.
 588                          */
 589                         frag_threshold &= ~0x1;
 590                 }
 591                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
 592         }
 593
 594         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
 595                 rts_threshold = nla_get_u32(
 596                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
 597                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
 598         }
 599
 600         if (changed) {
 601                 u8 old_retry_short, old_retry_long;
 602                 u32 old_frag_threshold, old_rts_threshold;
 603
 604                 if (!rdev->ops->set_wiphy_params) {
 605                         result = -EOPNOTSUPP;
 606                         goto bad_res;
 607                 }
 608
 609                 old_retry_short = rdev->wiphy.retry_short;
 610                 old_retry_long = rdev->wiphy.retry_long;
 611                 old_frag_threshold = rdev->wiphy.frag_threshold;
 612                 old_rts_threshold = rdev->wiphy.rts_threshold;
 613
 614                 if (changed & WIPHY_PARAM_RETRY_SHORT)
 615                         rdev->wiphy.retry_short = retry_short;
 616                 if (changed & WIPHY_PARAM_RETRY_LONG)
 617                         rdev->wiphy.retry_long = retry_long;
 618                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
 619                         rdev->wiphy.frag_threshold = frag_threshold;
 620                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
 621                         rdev->wiphy.rts_threshold = rts_threshold;
 622
 623                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
 624                 if (result) {
 625                         rdev->wiphy.retry_short = old_retry_short;
 626                         rdev->wiphy.retry_long = old_retry_long;
 627                         rdev->wiphy.frag_threshold = old_frag_threshold;
 628                         rdev->wiphy.rts_threshold = old_rts_threshold;
 629                 }
 630         }
 631
 632  bad_res:
 633         mutex_unlock(&rdev->mtx);
 634  unlock:
 635         rtnl_unlock();
 636         return result;
 637 }
 638
 639
 640 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 641                               struct cfg80211_registered_device *rdev,
 642                               struct net_device *dev)
 643 {
 644         void *hdr;
 645
 646         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
 647         if (!hdr)
 648                 return -1;
 649
 650         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 651         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 652         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
 653         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
 654         return genlmsg_end(msg, hdr);
 655
 656  nla_put_failure:
 657         genlmsg_cancel(msg, hdr);
 658         return -EMSGSIZE;
 659 }
 660
 661 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
 662 {
 663         int wp_idx = 0;
 664         int if_idx = 0;
 665         int wp_start = cb->args[0];
 666         int if_start = cb->args[1];
 667         struct cfg80211_registered_device *dev;
 668         struct wireless_dev *wdev;
 669
 670         mutex_lock(&cfg80211_mutex);
 671         list_for_each_entry(dev, &cfg80211_drv_list, list) {
 672                 if (wp_idx < wp_start) {
 673                         wp_idx++;
 674                         continue;
 675                 }
 676                 if_idx = 0;
 677
 678                 mutex_lock(&dev->devlist_mtx);
 679                 list_for_each_entry(wdev, &dev->netdev_list, list) {
 680                         if (if_idx < if_start) {
 681                                 if_idx++;
 682                                 continue;
 683                         }
 684                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
 685                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
 686                                                dev, wdev->netdev) < 0) {
 687                                 mutex_unlock(&dev->devlist_mtx);
 688                                 goto out;
 689                         }
 690                         if_idx++;
 691                 }
 692                 mutex_unlock(&dev->devlist_mtx);
 693
 694                 wp_idx++;
 695         }
 696  out:
 697         mutex_unlock(&cfg80211_mutex);
 698
 699         cb->args[0] = wp_idx;
 700         cb->args[1] = if_idx;
 701
 702         return skb->len;
 703 }
 704
 705 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
 706 {
 707         struct sk_buff *msg;
 708         struct cfg80211_registered_device *dev;
 709         struct net_device *netdev;
 710         int err;
 711
 712         err = get_drv_dev_by_info_ifindex(info->attrs, &dev, &netdev);
 713         if (err)
 714                 return err;
 715
 716         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 717         if (!msg)
 718                 goto out_err;
 719
 720         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
 721                                dev, netdev) < 0)
 722                 goto out_free;
 723
 724         dev_put(netdev);
 725         cfg80211_put_dev(dev);
 726
 727         return genlmsg_unicast(msg, info->snd_pid);
 728
 729  out_free:
 730         nlmsg_free(msg);
 731  out_err:
 732         dev_put(netdev);
 733         cfg80211_put_dev(dev);
 734         return -ENOBUFS;
 735 }
 736
 737 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
 738         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
 739         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
 740         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
 741         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
 742         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
 743 };
 744
 745 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
 746 {
 747         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
 748         int flag;
 749
 750         *mntrflags = 0;
 751
 752         if (!nla)
 753                 return -EINVAL;
 754
 755         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
 756                              nla, mntr_flags_policy))
 757                 return -EINVAL;
 758
 759         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
 760                 if (flags[flag])
 761                         *mntrflags |= (1<<flag);
 762
 763         return 0;
 764 }
 765
 766 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 767 {
 768         struct cfg80211_registered_device *drv;
 769         struct vif_params params;
 770         int err, ifindex;
 771         enum nl80211_iftype otype, ntype;
 772         struct net_device *dev;
 773         u32 _flags, *flags = NULL;
 774         bool change = false;
 775
 776         memset(&params, 0, sizeof(params));
 777
 778         rtnl_lock();
 779
 780         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 781         if (err)
 782                 goto unlock_rtnl;
 783
 784         ifindex = dev->ifindex;
 785         otype = ntype = dev->ieee80211_ptr->iftype;
 786         dev_put(dev);
 787
 788         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 789                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 790                 if (otype != ntype)
 791                         change = true;
 792                 if (ntype > NL80211_IFTYPE_MAX) {
 793                         err = -EINVAL;
 794                         goto unlock;
 795                 }
 796         }
 797
 798         if (!drv->ops->change_virtual_intf ||
 799             !(drv->wiphy.interface_modes & (1 << ntype))) {
 800                 err = -EOPNOTSUPP;
 801                 goto unlock;
 802         }
 803
 804         if (info->attrs[NL80211_ATTR_MESH_ID]) {
 805                 if (ntype != NL80211_IFTYPE_MESH_POINT) {
 806                         err = -EINVAL;
 807                         goto unlock;
 808                 }
 809                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 810                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 811                 change = true;
 812         }
 813
 814         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
 815                 if (ntype != NL80211_IFTYPE_MONITOR) {
 816                         err = -EINVAL;
 817                         goto unlock;
 818                 }
 819                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
 820                                           &_flags);
 821                 if (err)
 822                         goto unlock;
 823
 824                 flags = &_flags;
 825                 change = true;
 826         }
 827
 828         if (change)
 829                 err = drv->ops->change_virtual_intf(&drv->wiphy, ifindex,
 830                                                     ntype, flags, &params);
 831         else
 832                 err = 0;
 833
 834         dev = __dev_get_by_index(&init_net, ifindex);
 835         WARN_ON(!dev || (!err && dev->ieee80211_ptr->iftype != ntype));
 836
 837         if (dev && !err && (ntype != otype)) {
 838                 if (otype == NL80211_IFTYPE_ADHOC)
 839                         cfg80211_clear_ibss(dev, false);
 840         }
 841
 842  unlock:
 843         cfg80211_put_dev(drv);
 844  unlock_rtnl:
 845         rtnl_unlock();
 846         return err;
 847 }
 848
 849 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
 850 {
 851         struct cfg80211_registered_device *drv;
 852         struct vif_params params;
 853         int err;
 854         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
 855         u32 flags;
 856
 857         memset(&params, 0, sizeof(params));
 858
 859         if (!info->attrs[NL80211_ATTR_IFNAME])
 860                 return -EINVAL;
 861
 862         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 863                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 864                 if (type > NL80211_IFTYPE_MAX)
 865                         return -EINVAL;
 866         }
 867
 868         rtnl_lock();
 869
 870         drv = cfg80211_get_dev_from_info(info);
 871         if (IS_ERR(drv)) {
 872                 err = PTR_ERR(drv);
 873                 goto unlock_rtnl;
 874         }
 875
 876         if (!drv->ops->add_virtual_intf ||
 877             !(drv->wiphy.interface_modes & (1 << type))) {
 878                 err = -EOPNOTSUPP;
 879                 goto unlock;
 880         }
 881
 882         if (type == NL80211_IFTYPE_MESH_POINT &&
 883             info->attrs[NL80211_ATTR_MESH_ID]) {
 884                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 885                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 886         }
 887
 888         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
 889                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
 890                                   &flags);
 891         err = drv->ops->add_virtual_intf(&drv->wiphy,
 892                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
 893                 type, err ? NULL : &flags, &params);
 894
 895  unlock:
 896         cfg80211_put_dev(drv);
 897  unlock_rtnl:
 898         rtnl_unlock();
 899         return err;
 900 }
 901
 902 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
 903 {
 904         struct cfg80211_registered_device *drv;
 905         int ifindex, err;
 906         struct net_device *dev;
 907
 908         rtnl_lock();
 909
 910         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 911         if (err)
 912                 goto unlock_rtnl;
 913         ifindex = dev->ifindex;
 914         dev_put(dev);
 915
 916         if (!drv->ops->del_virtual_intf) {
 917                 err = -EOPNOTSUPP;
 918                 goto out;
 919         }
 920
 921         err = drv->ops->del_virtual_intf(&drv->wiphy, ifindex);
 922
 923  out:
 924         cfg80211_put_dev(drv);
 925  unlock_rtnl:
 926         rtnl_unlock();
 927         return err;
 928 }
 929
 930 struct get_key_cookie {
 931         struct sk_buff *msg;
 932         int error;
 933 };
 934
 935 static void get_key_callback(void *c, struct key_params *params)
 936 {
 937         struct get_key_cookie *cookie = c;
 938
 939         if (params->key)
 940                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
 941                         params->key_len, params->key);
 942
 943         if (params->seq)
 944                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
 945                         params->seq_len, params->seq);
 946
 947         if (params->cipher)
 948                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
 949                             params->cipher);
 950
 951         return;
 952  nla_put_failure:
 953         cookie->error = 1;
 954 }
 955
 956 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
 957 {
 958         struct cfg80211_registered_device *drv;
 959         int err;
 960         struct net_device *dev;
 961         u8 key_idx = 0;
 962         u8 *mac_addr = NULL;
 963         struct get_key_cookie cookie = {
 964                 .error = 0,
 965         };
 966         void *hdr;
 967         struct sk_buff *msg;
 968
 969         if (info->attrs[NL80211_ATTR_KEY_IDX])
 970                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 971
 972         if (key_idx > 5)
 973                 return -EINVAL;
 974
 975         if (info->attrs[NL80211_ATTR_MAC])
 976                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 977
 978         rtnl_lock();
 979
 980         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 981         if (err)
 982                 goto unlock_rtnl;
 983
 984         if (!drv->ops->get_key) {
 985                 err = -EOPNOTSUPP;
 986                 goto out;
 987         }
 988
 989         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 990         if (!msg) {
 991                 err = -ENOMEM;
 992                 goto out;
 993         }
 994
 995         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
 996                              NL80211_CMD_NEW_KEY);
 997
 998         if (IS_ERR(hdr)) {
 999                 err = PTR_ERR(hdr);
1000                 goto out;
1001         }
1002
1003         cookie.msg = msg;
1004
1005         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1006         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1007         if (mac_addr)
1008                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1009
1010         err = drv->ops->get_key(&drv->wiphy, dev, key_idx, mac_addr,
1011                                 &cookie, get_key_callback);
1012
1013         if (err)
1014                 goto out;
1015
1016         if (cookie.error)
1017                 goto nla_put_failure;
1018
1019         genlmsg_end(msg, hdr);
1020         err = genlmsg_unicast(msg, info->snd_pid);
1021         goto out;
1022
1023  nla_put_failure:
1024         err = -ENOBUFS;
1025         nlmsg_free(msg);
1026  out:
1027         cfg80211_put_dev(drv);
1028         dev_put(dev);
1029  unlock_rtnl:
1030         rtnl_unlock();
1031
1032         return err;
1033 }
1034
1035 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1036 {
1037         struct cfg80211_registered_device *drv;
1038         int err;
1039         struct net_device *dev;
1040         u8 key_idx;
1041         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
1042                     u8 key_index);
1043
1044         if (!info->attrs[NL80211_ATTR_KEY_IDX])
1045                 return -EINVAL;
1046
1047         key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1048
1049         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]) {
1050                 if (key_idx < 4 || key_idx > 5)
1051                         return -EINVAL;
1052         } else if (key_idx > 3)
1053                 return -EINVAL;
1054
1055         /* currently only support setting default key */
1056         if (!info->attrs[NL80211_ATTR_KEY_DEFAULT] &&
1057             !info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT])
1058                 return -EINVAL;
1059
1060         rtnl_lock();
1061
1062         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1063         if (err)
1064                 goto unlock_rtnl;
1065
1066         if (info->attrs[NL80211_ATTR_KEY_DEFAULT])
1067                 func = drv->ops->set_default_key;
1068         else
1069                 func = drv->ops->set_default_mgmt_key;
1070
1071         if (!func) {
1072                 err = -EOPNOTSUPP;
1073                 goto out;
1074         }
1075
1076         err = func(&drv->wiphy, dev, key_idx);
1077 #ifdef CONFIG_WIRELESS_EXT
1078         if (!err) {
1079                 if (func == drv->ops->set_default_key)
1080                         dev->ieee80211_ptr->wext.default_key = key_idx;
1081                 else
1082                         dev->ieee80211_ptr->wext.default_mgmt_key = key_idx;
1083         }
1084 #endif
1085
1086  out:
1087         cfg80211_put_dev(drv);
1088         dev_put(dev);
1089
1090  unlock_rtnl:
1091         rtnl_unlock();
1092
1093         return err;
1094 }
1095
1096 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1097 {
1098         struct cfg80211_registered_device *drv;
1099         int err, i;
1100         struct net_device *dev;
1101         struct key_params params;
1102         u8 key_idx = 0;
1103         u8 *mac_addr = NULL;
1104
1105         memset(&params, 0, sizeof(params));
1106
1107         if (!info->attrs[NL80211_ATTR_KEY_CIPHER])
1108                 return -EINVAL;
1109
1110         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1111                 params.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1112                 params.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1113         }
1114
1115         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
1116                 params.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
1117                 params.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
1118         }
1119
1120         if (info->attrs[NL80211_ATTR_KEY_IDX])
1121                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1122
1123         params.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1124
1125         if (info->attrs[NL80211_ATTR_MAC])
1126                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1127
1128         if (cfg80211_validate_key_settings(&params, key_idx, mac_addr))
1129                 return -EINVAL;
1130
1131         rtnl_lock();
1132
1133         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1134         if (err)
1135                 goto unlock_rtnl;
1136
1137         for (i = 0; i < drv->wiphy.n_cipher_suites; i++)
1138                 if (params.cipher == drv->wiphy.cipher_suites[i])
1139                         break;
1140         if (i == drv->wiphy.n_cipher_suites) {
1141                 err = -EINVAL;
1142                 goto out;
1143         }
1144
1145         if (!drv->ops->add_key) {
1146                 err = -EOPNOTSUPP;
1147                 goto out;
1148         }
1149
1150         err = drv->ops->add_key(&drv->wiphy, dev, key_idx, mac_addr, &params);
1151
1152  out:
1153         cfg80211_put_dev(drv);
1154         dev_put(dev);
1155  unlock_rtnl:
1156         rtnl_unlock();
1157
1158         return err;
1159 }
1160
1161 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1162 {
1163         struct cfg80211_registered_device *drv;
1164         int err;
1165         struct net_device *dev;
1166         u8 key_idx = 0;
1167         u8 *mac_addr = NULL;
1168
1169         if (info->attrs[NL80211_ATTR_KEY_IDX])
1170                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1171
1172         if (key_idx > 5)
1173                 return -EINVAL;
1174
1175         if (info->attrs[NL80211_ATTR_MAC])
1176                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1177
1178         rtnl_lock();
1179
1180         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1181         if (err)
1182                 goto unlock_rtnl;
1183
1184         if (!drv->ops->del_key) {
1185                 err = -EOPNOTSUPP;
1186                 goto out;
1187         }
1188
1189         err = drv->ops->del_key(&drv->wiphy, dev, key_idx, mac_addr);
1190
1191 #ifdef CONFIG_WIRELESS_EXT
1192         if (!err) {
1193                 if (key_idx == dev->ieee80211_ptr->wext.default_key)
1194                         dev->ieee80211_ptr->wext.default_key = -1;
1195                 else if (key_idx == dev->ieee80211_ptr->wext.default_mgmt_key)
1196                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
1197         }
1198 #endif
1199
1200  out:
1201         cfg80211_put_dev(drv);
1202         dev_put(dev);
1203
1204  unlock_rtnl:
1205         rtnl_unlock();
1206
1207         return err;
1208 }
1209
1210 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1211 {
1212         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1213                     struct beacon_parameters *info);
1214         struct cfg80211_registered_device *drv;
1215         int err;
1216         struct net_device *dev;
1217         struct beacon_parameters params;
1218         int haveinfo = 0;
1219
1220         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
1221                 return -EINVAL;
1222
1223         rtnl_lock();
1224
1225         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1226         if (err)
1227                 goto unlock_rtnl;
1228
1229         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1230                 err = -EOPNOTSUPP;
1231                 goto out;
1232         }
1233
1234         switch (info->genlhdr->cmd) {
1235         case NL80211_CMD_NEW_BEACON:
1236                 /* these are required for NEW_BEACON */
1237                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1238                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1239                     !info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1240                         err = -EINVAL;
1241                         goto out;
1242                 }
1243
1244                 call = drv->ops->add_beacon;
1245                 break;
1246         case NL80211_CMD_SET_BEACON:
1247                 call = drv->ops->set_beacon;
1248                 break;
1249         default:
1250                 WARN_ON(1);
1251                 err = -EOPNOTSUPP;
1252                 goto out;
1253         }
1254
1255         if (!call) {
1256                 err = -EOPNOTSUPP;
1257                 goto out;
1258         }
1259
1260         memset(&params, 0, sizeof(params));
1261
1262         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1263                 params.interval =
1264                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1265                 haveinfo = 1;
1266         }
1267
1268         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1269                 params.dtim_period =
1270                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1271                 haveinfo = 1;
1272         }
1273
1274         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1275                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1276                 params.head_len =
1277                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1278                 haveinfo = 1;
1279         }
1280
1281         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1282                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1283                 params.tail_len =
1284                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1285                 haveinfo = 1;
1286         }
1287
1288         if (!haveinfo) {
1289                 err = -EINVAL;
1290                 goto out;
1291         }
1292
1293         err = call(&drv->wiphy, dev, &params);
1294
1295  out:
1296         cfg80211_put_dev(drv);
1297         dev_put(dev);
1298  unlock_rtnl:
1299         rtnl_unlock();
1300
1301         return err;
1302 }
1303
1304 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1305 {
1306         struct cfg80211_registered_device *drv;
1307         int err;
1308         struct net_device *dev;
1309
1310         rtnl_lock();
1311
1312         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1313         if (err)
1314                 goto unlock_rtnl;
1315
1316         if (!drv->ops->del_beacon) {
1317                 err = -EOPNOTSUPP;
1318                 goto out;
1319         }
1320
1321         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1322                 err = -EOPNOTSUPP;
1323                 goto out;
1324         }
1325         err = drv->ops->del_beacon(&drv->wiphy, dev);
1326
1327  out:
1328         cfg80211_put_dev(drv);
1329         dev_put(dev);
1330  unlock_rtnl:
1331         rtnl_unlock();
1332
1333         return err;
1334 }
1335
1336 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1337         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1338         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1339         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1340         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
1341 };
1342
1343 static int parse_station_flags(struct genl_info *info,
1344                                struct station_parameters *params)
1345 {
1346         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1347         struct nlattr *nla;
1348         int flag;
1349
1350         /*
1351          * Try parsing the new attribute first so userspace
1352          * can specify both for older kernels.
1353          */
1354         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
1355         if (nla) {
1356                 struct nl80211_sta_flag_update *sta_flags;
1357
1358                 sta_flags = nla_data(nla);
1359                 params->sta_flags_mask = sta_flags->mask;
1360                 params->sta_flags_set = sta_flags->set;
1361                 if ((params->sta_flags_mask |
1362                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
1363                         return -EINVAL;
1364                 return 0;
1365         }
1366
1367         /* if present, parse the old attribute */
1368
1369         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
1370         if (!nla)
1371                 return 0;
1372
1373         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1374                              nla, sta_flags_policy))
1375                 return -EINVAL;
1376
1377         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
1378         params->sta_flags_mask &= ~1;
1379
1380         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1381                 if (flags[flag])
1382                         params->sta_flags_set |= (1<<flag);
1383
1384         return 0;
1385 }
1386
1387 static u16 nl80211_calculate_bitrate(struct rate_info *rate)
1388 {
1389         int modulation, streams, bitrate;
1390
1391         if (!(rate->flags & RATE_INFO_FLAGS_MCS))
1392                 return rate->legacy;
1393
1394         /* the formula below does only work for MCS values smaller than 32 */
1395         if (rate->mcs >= 32)
1396                 return 0;
1397
1398         modulation = rate->mcs & 7;
1399         streams = (rate->mcs >> 3) + 1;
1400
1401         bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
1402                         13500000 : 6500000;
1403
1404         if (modulation < 4)
1405                 bitrate *= (modulation + 1);
1406         else if (modulation == 4)
1407                 bitrate *= (modulation + 2);
1408         else
1409                 bitrate *= (modulation + 3);
1410
1411         bitrate *= streams;
1412
1413         if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
1414                 bitrate = (bitrate / 9) * 10;
1415
1416         /* do NOT round down here */
1417         return (bitrate + 50000) / 100000;
1418 }
1419
1420 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1421                                 int flags, struct net_device *dev,
1422                                 u8 *mac_addr, struct station_info *sinfo)
1423 {
1424         void *hdr;
1425         struct nlattr *sinfoattr, *txrate;
1426         u16 bitrate;
1427
1428         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1429         if (!hdr)
1430                 return -1;
1431
1432         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1433         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1434
1435         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1436         if (!sinfoattr)
1437                 goto nla_put_failure;
1438         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1439                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1440                             sinfo->inactive_time);
1441         if (sinfo->filled & STATION_INFO_RX_BYTES)
1442                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1443                             sinfo->rx_bytes);
1444         if (sinfo->filled & STATION_INFO_TX_BYTES)
1445                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1446                             sinfo->tx_bytes);
1447         if (sinfo->filled & STATION_INFO_LLID)
1448                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1449                             sinfo->llid);
1450         if (sinfo->filled & STATION_INFO_PLID)
1451                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1452                             sinfo->plid);
1453         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1454                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1455                             sinfo->plink_state);
1456         if (sinfo->filled & STATION_INFO_SIGNAL)
1457                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1458                            sinfo->signal);
1459         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1460                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1461                 if (!txrate)
1462                         goto nla_put_failure;
1463
1464                 /* nl80211_calculate_bitrate will return 0 for mcs >= 32 */
1465                 bitrate = nl80211_calculate_bitrate(&sinfo->txrate);
1466                 if (bitrate > 0)
1467                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1468
1469                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1470                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1471                                     sinfo->txrate.mcs);
1472                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1473                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1474                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1475                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1476
1477                 nla_nest_end(msg, txrate);
1478         }
1479         if (sinfo->filled & STATION_INFO_RX_PACKETS)
1480                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
1481                             sinfo->rx_packets);
1482         if (sinfo->filled & STATION_INFO_TX_PACKETS)
1483                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
1484                             sinfo->tx_packets);
1485         nla_nest_end(msg, sinfoattr);
1486
1487         return genlmsg_end(msg, hdr);
1488
1489  nla_put_failure:
1490         genlmsg_cancel(msg, hdr);
1491         return -EMSGSIZE;
1492 }
1493
1494 static int nl80211_dump_station(struct sk_buff *skb,
1495                                 struct netlink_callback *cb)
1496 {
1497         struct station_info sinfo;
1498         struct cfg80211_registered_device *dev;
1499         struct net_device *netdev;
1500         u8 mac_addr[ETH_ALEN];
1501         int ifidx = cb->args[0];
1502         int sta_idx = cb->args[1];
1503         int err;
1504
1505         if (!ifidx) {
1506                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1507                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1508                                   nl80211_policy);
1509                 if (err)
1510                         return err;
1511
1512                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1513                         return -EINVAL;
1514
1515                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1516                 if (!ifidx)
1517                         return -EINVAL;
1518         }
1519
1520         rtnl_lock();
1521
1522         netdev = __dev_get_by_index(&init_net, ifidx);
1523         if (!netdev) {
1524                 err = -ENODEV;
1525                 goto out_rtnl;
1526         }
1527
1528         dev = cfg80211_get_dev_from_ifindex(ifidx);
1529         if (IS_ERR(dev)) {
1530                 err = PTR_ERR(dev);
1531                 goto out_rtnl;
1532         }
1533
1534         if (!dev->ops->dump_station) {
1535                 err = -EOPNOTSUPP;
1536                 goto out_err;
1537         }
1538
1539         while (1) {
1540                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1541                                              mac_addr, &sinfo);
1542                 if (err == -ENOENT)
1543                         break;
1544                 if (err)
1545                         goto out_err;
1546
1547                 if (nl80211_send_station(skb,
1548                                 NETLINK_CB(cb->skb).pid,
1549                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
1550                                 netdev, mac_addr,
1551                                 &sinfo) < 0)
1552                         goto out;
1553
1554                 sta_idx++;
1555         }
1556
1557
1558  out:
1559         cb->args[1] = sta_idx;
1560         err = skb->len;
1561  out_err:
1562         cfg80211_put_dev(dev);
1563  out_rtnl:
1564         rtnl_unlock();
1565
1566         return err;
1567 }
1568
1569 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1570 {
1571         struct cfg80211_registered_device *drv;
1572         int err;
1573         struct net_device *dev;
1574         struct station_info sinfo;
1575         struct sk_buff *msg;
1576         u8 *mac_addr = NULL;
1577
1578         memset(&sinfo, 0, sizeof(sinfo));
1579
1580         if (!info->attrs[NL80211_ATTR_MAC])
1581                 return -EINVAL;
1582
1583         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1584
1585         rtnl_lock();
1586
1587         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1588         if (err)
1589                 goto out_rtnl;
1590
1591         if (!drv->ops->get_station) {
1592                 err = -EOPNOTSUPP;
1593                 goto out;
1594         }
1595
1596         err = drv->ops->get_station(&drv->wiphy, dev, mac_addr, &sinfo);
1597         if (err)
1598                 goto out;
1599
1600         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1601         if (!msg)
1602                 goto out;
1603
1604         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1605                                  dev, mac_addr, &sinfo) < 0)
1606                 goto out_free;
1607
1608         err = genlmsg_unicast(msg, info->snd_pid);
1609         goto out;
1610
1611  out_free:
1612         nlmsg_free(msg);
1613  out:
1614         cfg80211_put_dev(drv);
1615         dev_put(dev);
1616  out_rtnl:
1617         rtnl_unlock();
1618
1619         return err;
1620 }
1621
1622 /*
1623  * Get vlan interface making sure it is on the right wiphy.
1624  */
1625 static int get_vlan(struct nlattr *vlanattr,
1626                     struct cfg80211_registered_device *rdev,
1627                     struct net_device **vlan)
1628 {
1629         *vlan = NULL;
1630
1631         if (vlanattr) {
1632                 *vlan = dev_get_by_index(&init_net, nla_get_u32(vlanattr));
1633                 if (!*vlan)
1634                         return -ENODEV;
1635                 if (!(*vlan)->ieee80211_ptr)
1636                         return -EINVAL;
1637                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
1638                         return -EINVAL;
1639         }
1640         return 0;
1641 }
1642
1643 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
1644 {
1645         struct cfg80211_registered_device *drv;
1646         int err;
1647         struct net_device *dev;
1648         struct station_parameters params;
1649         u8 *mac_addr = NULL;
1650
1651         memset(&params, 0, sizeof(params));
1652
1653         params.listen_interval = -1;
1654
1655         if (info->attrs[NL80211_ATTR_STA_AID])
1656                 return -EINVAL;
1657
1658         if (!info->attrs[NL80211_ATTR_MAC])
1659                 return -EINVAL;
1660
1661         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1662
1663         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
1664                 params.supported_rates =
1665                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1666                 params.supported_rates_len =
1667                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1668         }
1669
1670         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1671                 params.listen_interval =
1672                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1673
1674         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1675                 params.ht_capa =
1676                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1677
1678         if (parse_station_flags(info, &params))
1679                 return -EINVAL;
1680
1681         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
1682                 params.plink_action =
1683                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
1684
1685         rtnl_lock();
1686
1687         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1688         if (err)
1689                 goto out_rtnl;
1690
1691         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1692         if (err)
1693                 goto out;
1694
1695         /* validate settings */
1696         err = 0;
1697
1698         switch (dev->ieee80211_ptr->iftype) {
1699         case NL80211_IFTYPE_AP:
1700         case NL80211_IFTYPE_AP_VLAN:
1701                 /* disallow mesh-specific things */
1702                 if (params.plink_action)
1703                         err = -EINVAL;
1704                 break;
1705         case NL80211_IFTYPE_STATION:
1706                 /* disallow everything but AUTHORIZED flag */
1707                 if (params.plink_action)
1708                         err = -EINVAL;
1709                 if (params.vlan)
1710                         err = -EINVAL;
1711                 if (params.supported_rates)
1712                         err = -EINVAL;
1713                 if (params.ht_capa)
1714                         err = -EINVAL;
1715                 if (params.listen_interval >= 0)
1716                         err = -EINVAL;
1717                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
1718                         err = -EINVAL;
1719                 break;
1720         case NL80211_IFTYPE_MESH_POINT:
1721                 /* disallow things mesh doesn't support */
1722                 if (params.vlan)
1723                         err = -EINVAL;
1724                 if (params.ht_capa)
1725                         err = -EINVAL;
1726                 if (params.listen_interval >= 0)
1727                         err = -EINVAL;
1728                 if (params.supported_rates)
1729                         err = -EINVAL;
1730                 if (params.sta_flags_mask)
1731                         err = -EINVAL;
1732                 break;
1733         default:
1734                 err = -EINVAL;
1735         }
1736
1737         if (err)
1738                 goto out;
1739
1740         if (!drv->ops->change_station) {
1741                 err = -EOPNOTSUPP;
1742                 goto out;
1743         }
1744
1745         err = drv->ops->change_station(&drv->wiphy, dev, mac_addr, &params);
1746
1747  out:
1748         if (params.vlan)
1749                 dev_put(params.vlan);
1750         cfg80211_put_dev(drv);
1751         dev_put(dev);
1752  out_rtnl:
1753         rtnl_unlock();
1754
1755         return err;
1756 }
1757
1758 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
1759 {
1760         struct cfg80211_registered_device *drv;
1761         int err;
1762         struct net_device *dev;
1763         struct station_parameters params;
1764         u8 *mac_addr = NULL;
1765
1766         memset(&params, 0, sizeof(params));
1767
1768         if (!info->attrs[NL80211_ATTR_MAC])
1769                 return -EINVAL;
1770
1771         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1772                 return -EINVAL;
1773
1774         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
1775                 return -EINVAL;
1776
1777         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1778         params.supported_rates =
1779                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1780         params.supported_rates_len =
1781                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1782         params.listen_interval =
1783                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1784
1785         if (info->attrs[NL80211_ATTR_STA_AID]) {
1786                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
1787                 if (!params.aid || params.aid > IEEE80211_MAX_AID)
1788                         return -EINVAL;
1789         }
1790
1791         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1792                 params.ht_capa =
1793                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1794
1795         if (parse_station_flags(info, &params))
1796                 return -EINVAL;
1797
1798         rtnl_lock();
1799
1800         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1801         if (err)
1802                 goto out_rtnl;
1803
1804         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1805         if (err)
1806                 goto out;
1807
1808         /* validate settings */
1809         err = 0;
1810
1811         switch (dev->ieee80211_ptr->iftype) {
1812         case NL80211_IFTYPE_AP:
1813         case NL80211_IFTYPE_AP_VLAN:
1814                 /* all ok but must have AID */
1815                 if (!params.aid)
1816                         err = -EINVAL;
1817                 break;
1818         case NL80211_IFTYPE_MESH_POINT:
1819                 /* disallow things mesh doesn't support */
1820                 if (params.vlan)
1821                         err = -EINVAL;
1822                 if (params.aid)
1823                         err = -EINVAL;
1824                 if (params.ht_capa)
1825                         err = -EINVAL;
1826                 if (params.listen_interval >= 0)
1827                         err = -EINVAL;
1828                 if (params.supported_rates)
1829                         err = -EINVAL;
1830                 if (params.sta_flags_mask)
1831                         err = -EINVAL;
1832                 break;
1833         default:
1834                 err = -EINVAL;
1835         }
1836
1837         if (err)
1838                 goto out;
1839
1840         if (!drv->ops->add_station) {
1841                 err = -EOPNOTSUPP;
1842                 goto out;
1843         }
1844
1845         if (!netif_running(dev)) {
1846                 err = -ENETDOWN;
1847                 goto out;
1848         }
1849
1850         err = drv->ops->add_station(&drv->wiphy, dev, mac_addr, &params);
1851
1852  out:
1853         if (params.vlan)
1854                 dev_put(params.vlan);
1855         cfg80211_put_dev(drv);
1856         dev_put(dev);
1857  out_rtnl:
1858         rtnl_unlock();
1859
1860         return err;
1861 }
1862
1863 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
1864 {
1865         struct cfg80211_registered_device *drv;
1866         int err;
1867         struct net_device *dev;
1868         u8 *mac_addr = NULL;
1869
1870         if (info->attrs[NL80211_ATTR_MAC])
1871                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1872
1873         rtnl_lock();
1874
1875         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1876         if (err)
1877                 goto out_rtnl;
1878
1879         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1880             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
1881             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1882                 err = -EINVAL;
1883                 goto out;
1884         }
1885
1886         if (!drv->ops->del_station) {
1887                 err = -EOPNOTSUPP;
1888                 goto out;
1889         }
1890
1891         err = drv->ops->del_station(&drv->wiphy, dev, mac_addr);
1892
1893  out:
1894         cfg80211_put_dev(drv);
1895         dev_put(dev);
1896  out_rtnl:
1897         rtnl_unlock();
1898
1899         return err;
1900 }
1901
1902 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
1903                                 int flags, struct net_device *dev,
1904                                 u8 *dst, u8 *next_hop,
1905                                 struct mpath_info *pinfo)
1906 {
1907         void *hdr;
1908         struct nlattr *pinfoattr;
1909
1910         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1911         if (!hdr)
1912                 return -1;
1913
1914         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1915         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
1916         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
1917
1918         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
1919         if (!pinfoattr)
1920                 goto nla_put_failure;
1921         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
1922                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
1923                             pinfo->frame_qlen);
1924         if (pinfo->filled & MPATH_INFO_DSN)
1925                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DSN,
1926                             pinfo->dsn);
1927         if (pinfo->filled & MPATH_INFO_METRIC)
1928                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
1929                             pinfo->metric);
1930         if (pinfo->filled & MPATH_INFO_EXPTIME)
1931                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
1932                             pinfo->exptime);
1933         if (pinfo->filled & MPATH_INFO_FLAGS)
1934                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
1935                             pinfo->flags);
1936         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
1937                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
1938                             pinfo->discovery_timeout);
1939         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
1940                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
1941                             pinfo->discovery_retries);
1942
1943         nla_nest_end(msg, pinfoattr);
1944
1945         return genlmsg_end(msg, hdr);
1946
1947  nla_put_failure:
1948         genlmsg_cancel(msg, hdr);
1949         return -EMSGSIZE;
1950 }
1951
1952 static int nl80211_dump_mpath(struct sk_buff *skb,
1953                               struct netlink_callback *cb)
1954 {
1955         struct mpath_info pinfo;
1956         struct cfg80211_registered_device *dev;
1957         struct net_device *netdev;
1958         u8 dst[ETH_ALEN];
1959         u8 next_hop[ETH_ALEN];
1960         int ifidx = cb->args[0];
1961         int path_idx = cb->args[1];
1962         int err;
1963
1964         if (!ifidx) {
1965                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1966                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1967                                   nl80211_policy);
1968                 if (err)
1969                         return err;
1970
1971                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1972                         return -EINVAL;
1973
1974                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1975                 if (!ifidx)
1976                         return -EINVAL;
1977         }
1978
1979         rtnl_lock();
1980
1981         netdev = __dev_get_by_index(&init_net, ifidx);
1982         if (!netdev) {
1983                 err = -ENODEV;
1984                 goto out_rtnl;
1985         }
1986
1987         dev = cfg80211_get_dev_from_ifindex(ifidx);
1988         if (IS_ERR(dev)) {
1989                 err = PTR_ERR(dev);
1990                 goto out_rtnl;
1991         }
1992
1993         if (!dev->ops->dump_mpath) {
1994                 err = -EOPNOTSUPP;
1995                 goto out_err;
1996         }
1997
1998         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1999                 err = -EOPNOTSUPP;
2000                 goto out;
2001         }
2002
2003         while (1) {
2004                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
2005                                            dst, next_hop, &pinfo);
2006                 if (err == -ENOENT)
2007                         break;
2008                 if (err)
2009                         goto out_err;
2010
2011                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
2012                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
2013                                        netdev, dst, next_hop,
2014                                        &pinfo) < 0)
2015                         goto out;
2016
2017                 path_idx++;
2018         }
2019
2020
2021  out:
2022         cb->args[1] = path_idx;
2023         err = skb->len;
2024  out_err:
2025         cfg80211_put_dev(dev);
2026  out_rtnl:
2027         rtnl_unlock();
2028
2029         return err;
2030 }
2031
2032 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
2033 {
2034         struct cfg80211_registered_device *drv;
2035         int err;
2036         struct net_device *dev;
2037         struct mpath_info pinfo;
2038         struct sk_buff *msg;
2039         u8 *dst = NULL;
2040         u8 next_hop[ETH_ALEN];
2041
2042         memset(&pinfo, 0, sizeof(pinfo));
2043
2044         if (!info->attrs[NL80211_ATTR_MAC])
2045                 return -EINVAL;
2046
2047         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2048
2049         rtnl_lock();
2050
2051         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2052         if (err)
2053                 goto out_rtnl;
2054
2055         if (!drv->ops->get_mpath) {
2056                 err = -EOPNOTSUPP;
2057                 goto out;
2058         }
2059
2060         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2061                 err = -EOPNOTSUPP;
2062                 goto out;
2063         }
2064
2065         err = drv->ops->get_mpath(&drv->wiphy, dev, dst, next_hop, &pinfo);
2066         if (err)
2067                 goto out;
2068
2069         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2070         if (!msg)
2071                 goto out;
2072
2073         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2074                                  dev, dst, next_hop, &pinfo) < 0)
2075                 goto out_free;
2076
2077         err = genlmsg_unicast(msg, info->snd_pid);
2078         goto out;
2079
2080  out_free:
2081         nlmsg_free(msg);
2082  out:
2083         cfg80211_put_dev(drv);
2084         dev_put(dev);
2085  out_rtnl:
2086         rtnl_unlock();
2087
2088         return err;
2089 }
2090
2091 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2092 {
2093         struct cfg80211_registered_device *drv;
2094         int err;
2095         struct net_device *dev;
2096         u8 *dst = NULL;
2097         u8 *next_hop = NULL;
2098
2099         if (!info->attrs[NL80211_ATTR_MAC])
2100                 return -EINVAL;
2101
2102         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2103                 return -EINVAL;
2104
2105         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2106         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2107
2108         rtnl_lock();
2109
2110         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2111         if (err)
2112                 goto out_rtnl;
2113
2114         if (!drv->ops->change_mpath) {
2115                 err = -EOPNOTSUPP;
2116                 goto out;
2117         }
2118
2119         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2120                 err = -EOPNOTSUPP;
2121                 goto out;
2122         }
2123
2124         if (!netif_running(dev)) {
2125                 err = -ENETDOWN;
2126                 goto out;
2127         }
2128
2129         err = drv->ops->change_mpath(&drv->wiphy, dev, dst, next_hop);
2130
2131  out:
2132         cfg80211_put_dev(drv);
2133         dev_put(dev);
2134  out_rtnl:
2135         rtnl_unlock();
2136
2137         return err;
2138 }
2139 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2140 {
2141         struct cfg80211_registered_device *drv;
2142         int err;
2143         struct net_device *dev;
2144         u8 *dst = NULL;
2145         u8 *next_hop = NULL;
2146
2147         if (!info->attrs[NL80211_ATTR_MAC])
2148                 return -EINVAL;
2149
2150         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2151                 return -EINVAL;
2152
2153         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2154         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2155
2156         rtnl_lock();
2157
2158         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2159         if (err)
2160                 goto out_rtnl;
2161
2162         if (!drv->ops->add_mpath) {
2163                 err = -EOPNOTSUPP;
2164                 goto out;
2165         }
2166
2167         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2168                 err = -EOPNOTSUPP;
2169                 goto out;
2170         }
2171
2172         if (!netif_running(dev)) {
2173                 err = -ENETDOWN;
2174                 goto out;
2175         }
2176
2177         err = drv->ops->add_mpath(&drv->wiphy, dev, dst, next_hop);
2178
2179  out:
2180         cfg80211_put_dev(drv);
2181         dev_put(dev);
2182  out_rtnl:
2183         rtnl_unlock();
2184
2185         return err;
2186 }
2187
2188 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2189 {
2190         struct cfg80211_registered_device *drv;
2191         int err;
2192         struct net_device *dev;
2193         u8 *dst = NULL;
2194
2195         if (info->attrs[NL80211_ATTR_MAC])
2196                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2197
2198         rtnl_lock();
2199
2200         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2201         if (err)
2202                 goto out_rtnl;
2203
2204         if (!drv->ops->del_mpath) {
2205                 err = -EOPNOTSUPP;
2206                 goto out;
2207         }
2208
2209         err = drv->ops->del_mpath(&drv->wiphy, dev, dst);
2210
2211  out:
2212         cfg80211_put_dev(drv);
2213         dev_put(dev);
2214  out_rtnl:
2215         rtnl_unlock();
2216
2217         return err;
2218 }
2219
2220 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2221 {
2222         struct cfg80211_registered_device *drv;
2223         int err;
2224         struct net_device *dev;
2225         struct bss_parameters params;
2226
2227         memset(&params, 0, sizeof(params));
2228         /* default to not changing parameters */
2229         params.use_cts_prot = -1;
2230         params.use_short_preamble = -1;
2231         params.use_short_slot_time = -1;
2232
2233         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2234                 params.use_cts_prot =
2235                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2236         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2237                 params.use_short_preamble =
2238                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2239         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2240                 params.use_short_slot_time =
2241                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2242         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2243                 params.basic_rates =
2244                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2245                 params.basic_rates_len =
2246                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2247         }
2248
2249         rtnl_lock();
2250
2251         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2252         if (err)
2253                 goto out_rtnl;
2254
2255         if (!drv->ops->change_bss) {
2256                 err = -EOPNOTSUPP;
2257                 goto out;
2258         }
2259
2260         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
2261                 err = -EOPNOTSUPP;
2262                 goto out;
2263         }
2264
2265         err = drv->ops->change_bss(&drv->wiphy, dev, &params);
2266
2267  out:
2268         cfg80211_put_dev(drv);
2269         dev_put(dev);
2270  out_rtnl:
2271         rtnl_unlock();
2272
2273         return err;
2274 }
2275
2276 static const struct nla_policy
2277         reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2278         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2279         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2280         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2281         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2282         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2283         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2284 };
2285
2286 static int parse_reg_rule(struct nlattr *tb[],
2287         struct ieee80211_reg_rule *reg_rule)
2288 {
2289         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2290         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2291
2292         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2293                 return -EINVAL;
2294         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2295                 return -EINVAL;
2296         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2297                 return -EINVAL;
2298         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2299                 return -EINVAL;
2300         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2301                 return -EINVAL;
2302
2303         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2304
2305         freq_range->start_freq_khz =
2306                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2307         freq_range->end_freq_khz =
2308                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2309         freq_range->max_bandwidth_khz =
2310                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2311
2312         power_rule->max_eirp =
2313                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2314
2315         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2316                 power_rule->max_antenna_gain =
2317                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2318
2319         return 0;
2320 }
2321
2322 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2323 {
2324         int r;
2325         char *data = NULL;
2326
2327         /*
2328          * You should only get this when cfg80211 hasn't yet initialized
2329          * completely when built-in to the kernel right between the time
2330          * window between nl80211_init() and regulatory_init(), if that is
2331          * even possible.
2332          */
2333         mutex_lock(&cfg80211_mutex);
2334         if (unlikely(!cfg80211_regdomain)) {
2335                 mutex_unlock(&cfg80211_mutex);
2336                 return -EINPROGRESS;
2337         }
2338         mutex_unlock(&cfg80211_mutex);
2339
2340         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2341                 return -EINVAL;
2342
2343         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2344
2345 #ifdef CONFIG_WIRELESS_OLD_REGULATORY
2346         /* We ignore world regdom requests with the old regdom setup */
2347         if (is_world_regdom(data))
2348                 return -EINVAL;
2349 #endif
2350
2351         r = regulatory_hint_user(data);
2352
2353         return r;
2354 }
2355
2356 static int nl80211_get_mesh_params(struct sk_buff *skb,
2357         struct genl_info *info)
2358 {
2359         struct cfg80211_registered_device *drv;
2360         struct mesh_config cur_params;
2361         int err;
2362         struct net_device *dev;
2363         void *hdr;
2364         struct nlattr *pinfoattr;
2365         struct sk_buff *msg;
2366
2367         rtnl_lock();
2368
2369         /* Look up our device */
2370         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2371         if (err)
2372                 goto out_rtnl;
2373
2374         if (!drv->ops->get_mesh_params) {
2375                 err = -EOPNOTSUPP;
2376                 goto out;
2377         }
2378
2379         /* Get the mesh params */
2380         err = drv->ops->get_mesh_params(&drv->wiphy, dev, &cur_params);
2381         if (err)
2382                 goto out;
2383
2384         /* Draw up a netlink message to send back */
2385         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2386         if (!msg) {
2387                 err = -ENOBUFS;
2388                 goto out;
2389         }
2390         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2391                              NL80211_CMD_GET_MESH_PARAMS);
2392         if (!hdr)
2393                 goto nla_put_failure;
2394         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
2395         if (!pinfoattr)
2396                 goto nla_put_failure;
2397         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2398         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2399                         cur_params.dot11MeshRetryTimeout);
2400         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2401                         cur_params.dot11MeshConfirmTimeout);
2402         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2403                         cur_params.dot11MeshHoldingTimeout);
2404         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2405                         cur_params.dot11MeshMaxPeerLinks);
2406         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2407                         cur_params.dot11MeshMaxRetries);
2408         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2409                         cur_params.dot11MeshTTL);
2410         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2411                         cur_params.auto_open_plinks);
2412         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2413                         cur_params.dot11MeshHWMPmaxPREQretries);
2414         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2415                         cur_params.path_refresh_time);
2416         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2417                         cur_params.min_discovery_timeout);
2418         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2419                         cur_params.dot11MeshHWMPactivePathTimeout);
2420         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2421                         cur_params.dot11MeshHWMPpreqMinInterval);
2422         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2423                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2424         nla_nest_end(msg, pinfoattr);
2425         genlmsg_end(msg, hdr);
2426         err = genlmsg_unicast(msg, info->snd_pid);
2427         goto out;
2428
2429  nla_put_failure:
2430         genlmsg_cancel(msg, hdr);
2431         err = -EMSGSIZE;
2432  out:
2433         /* Cleanup */
2434         cfg80211_put_dev(drv);
2435         dev_put(dev);
2436  out_rtnl:
2437         rtnl_unlock();
2438
2439         return err;
2440 }
2441
2442 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2443 do {\
2444         if (table[attr_num]) {\
2445                 cfg.param = nla_fn(table[attr_num]); \
2446                 mask |= (1 << (attr_num - 1)); \
2447         } \
2448 } while (0);\
2449
2450 static struct nla_policy
2451 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] __read_mostly = {
2452         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2453         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2454         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2455         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2456         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2457         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2458         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2459
2460         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2461         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2462         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2463         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2464         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2465         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2466 };
2467
2468 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2469 {
2470         int err;
2471         u32 mask;
2472         struct cfg80211_registered_device *drv;
2473         struct net_device *dev;
2474         struct mesh_config cfg;
2475         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2476         struct nlattr *parent_attr;
2477
2478         parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
2479         if (!parent_attr)
2480                 return -EINVAL;
2481         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2482                         parent_attr, nl80211_meshconf_params_policy))
2483                 return -EINVAL;
2484
2485         rtnl_lock();
2486
2487         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2488         if (err)
2489                 goto out_rtnl;
2490
2491         if (!drv->ops->set_mesh_params) {
2492                 err = -EOPNOTSUPP;
2493                 goto out;
2494         }
2495
2496         /* This makes sure that there aren't more than 32 mesh config
2497          * parameters (otherwise our bitfield scheme would not work.) */
2498         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2499
2500         /* Fill in the params struct */
2501         mask = 0;
2502         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2503                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2504         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2505                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2506         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2507                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2508         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2509                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2510         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2511                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2512         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2513                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2514         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2515                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2516         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2517                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2518                         nla_get_u8);
2519         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2520                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2521         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2522                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2523                         nla_get_u16);
2524         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2525                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2526                         nla_get_u32);
2527         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2528                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2529                         nla_get_u16);
2530         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2531                         dot11MeshHWMPnetDiameterTraversalTime,
2532                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2533                         nla_get_u16);
2534
2535         /* Apply changes */
2536         err = drv->ops->set_mesh_params(&drv->wiphy, dev, &cfg, mask);
2537
2538  out:
2539         /* cleanup */
2540         cfg80211_put_dev(drv);
2541         dev_put(dev);
2542  out_rtnl:
2543         rtnl_unlock();
2544
2545         return err;
2546 }
2547
2548 #undef FILL_IN_MESH_PARAM_IF_SET
2549
2550 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2551 {
2552         struct sk_buff *msg;
2553         void *hdr = NULL;
2554         struct nlattr *nl_reg_rules;
2555         unsigned int i;
2556         int err = -EINVAL;
2557
2558         mutex_lock(&cfg80211_mutex);
2559
2560         if (!cfg80211_regdomain)
2561                 goto out;
2562
2563         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2564         if (!msg) {
2565                 err = -ENOBUFS;
2566                 goto out;
2567         }
2568
2569         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2570                              NL80211_CMD_GET_REG);
2571         if (!hdr)
2572                 goto nla_put_failure;
2573
2574         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2575                 cfg80211_regdomain->alpha2);
2576
2577         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2578         if (!nl_reg_rules)
2579                 goto nla_put_failure;
2580
2581         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2582                 struct nlattr *nl_reg_rule;
2583                 const struct ieee80211_reg_rule *reg_rule;
2584                 const struct ieee80211_freq_range *freq_range;
2585                 const struct ieee80211_power_rule *power_rule;
2586
2587                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2588                 freq_range = &reg_rule->freq_range;
2589                 power_rule = &reg_rule->power_rule;
2590
2591                 nl_reg_rule = nla_nest_start(msg, i);
2592                 if (!nl_reg_rule)
2593                         goto nla_put_failure;
2594
2595                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2596                         reg_rule->flags);
2597                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2598                         freq_range->start_freq_khz);
2599                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2600                         freq_range->end_freq_khz);
2601                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2602                         freq_range->max_bandwidth_khz);
2603                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2604                         power_rule->max_antenna_gain);
2605                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2606                         power_rule->max_eirp);
2607
2608                 nla_nest_end(msg, nl_reg_rule);
2609         }
2610
2611         nla_nest_end(msg, nl_reg_rules);
2612
2613         genlmsg_end(msg, hdr);
2614         err = genlmsg_unicast(msg, info->snd_pid);
2615         goto out;
2616
2617 nla_put_failure:
2618         genlmsg_cancel(msg, hdr);
2619         err = -EMSGSIZE;
2620 out:
2621         mutex_unlock(&cfg80211_mutex);
2622         return err;
2623 }
2624
2625 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2626 {
2627         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2628         struct nlattr *nl_reg_rule;
2629         char *alpha2 = NULL;
2630         int rem_reg_rules = 0, r = 0;
2631         u32 num_rules = 0, rule_idx = 0, size_of_regd;
2632         struct ieee80211_regdomain *rd = NULL;
2633
2634         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2635                 return -EINVAL;
2636
2637         if (!info->attrs[NL80211_ATTR_REG_RULES])
2638                 return -EINVAL;
2639
2640         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2641
2642         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2643                         rem_reg_rules) {
2644                 num_rules++;
2645                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2646                         return -EINVAL;
2647         }
2648
2649         mutex_lock(&cfg80211_mutex);
2650
2651         if (!reg_is_valid_request(alpha2)) {
2652                 r = -EINVAL;
2653                 goto bad_reg;
2654         }
2655
2656         size_of_regd = sizeof(struct ieee80211_regdomain) +
2657                 (num_rules * sizeof(struct ieee80211_reg_rule));
2658
2659         rd = kzalloc(size_of_regd, GFP_KERNEL);
2660         if (!rd) {
2661                 r = -ENOMEM;
2662                 goto bad_reg;
2663         }
2664
2665         rd->n_reg_rules = num_rules;
2666         rd->alpha2[0] = alpha2[0];
2667         rd->alpha2[1] = alpha2[1];
2668
2669         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2670                         rem_reg_rules) {
2671                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2672                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2673                         reg_rule_policy);
2674                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2675                 if (r)
2676                         goto bad_reg;
2677
2678                 rule_idx++;
2679
2680                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
2681                         r = -EINVAL;
2682                         goto bad_reg;
2683                 }
2684         }
2685
2686         BUG_ON(rule_idx != num_rules);
2687
2688         r = set_regdom(rd);
2689
2690         mutex_unlock(&cfg80211_mutex);
2691
2692         return r;
2693
2694  bad_reg:
2695         mutex_unlock(&cfg80211_mutex);
2696         kfree(rd);
2697         return r;
2698 }
2699
2700 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
2701 {
2702         struct cfg80211_registered_device *drv;
2703         struct net_device *dev;
2704         struct cfg80211_scan_request *request;
2705         struct cfg80211_ssid *ssid;
2706         struct ieee80211_channel *channel;
2707         struct nlattr *attr;
2708         struct wiphy *wiphy;
2709         int err, tmp, n_ssids = 0, n_channels = 0, i;
2710         enum ieee80211_band band;
2711         size_t ie_len;
2712
2713         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2714                 return -EINVAL;
2715
2716         rtnl_lock();
2717
2718         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2719         if (err)
2720                 goto out_rtnl;
2721
2722         wiphy = &drv->wiphy;
2723
2724         if (!drv->ops->scan) {
2725                 err = -EOPNOTSUPP;
2726                 goto out;
2727         }
2728
2729         if (!netif_running(dev)) {
2730                 err = -ENETDOWN;
2731                 goto out;
2732         }
2733
2734         if (drv->scan_req) {
2735                 err = -EBUSY;
2736                 goto out;
2737         }
2738
2739         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2740                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp)
2741                         n_channels++;
2742                 if (!n_channels) {
2743                         err = -EINVAL;
2744                         goto out;
2745                 }
2746         } else {
2747                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
2748                         if (wiphy->bands[band])
2749                                 n_channels += wiphy->bands[band]->n_channels;
2750         }
2751
2752         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
2753                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
2754                         n_ssids++;
2755
2756         if (n_ssids > wiphy->max_scan_ssids) {
2757                 err = -EINVAL;
2758                 goto out;
2759         }
2760
2761         if (info->attrs[NL80211_ATTR_IE])
2762                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2763         else
2764                 ie_len = 0;
2765
2766         if (ie_len > wiphy->max_scan_ie_len) {
2767                 err = -EINVAL;
2768                 goto out;
2769         }
2770
2771         request = kzalloc(sizeof(*request)
2772                         + sizeof(*ssid) * n_ssids
2773                         + sizeof(channel) * n_channels
2774                         + ie_len, GFP_KERNEL);
2775         if (!request) {
2776                 err = -ENOMEM;
2777                 goto out;
2778         }
2779
2780         request->channels = (void *)((char *)request + sizeof(*request));
2781         request->n_channels = n_channels;
2782         if (n_ssids)
2783                 request->ssids = (void *)(request->channels + n_channels);
2784         request->n_ssids = n_ssids;
2785         if (ie_len) {
2786                 if (request->ssids)
2787                         request->ie = (void *)(request->ssids + n_ssids);
2788                 else
2789                         request->ie = (void *)(request->channels + n_channels);
2790         }
2791
2792         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2793                 /* user specified, bail out if channel not found */
2794                 request->n_channels = n_channels;
2795                 i = 0;
2796                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
2797                         request->channels[i] = ieee80211_get_channel(wiphy, nla_get_u32(attr));
2798                         if (!request->channels[i]) {
2799                                 err = -EINVAL;
2800                                 goto out_free;
2801                         }
2802                         i++;
2803                 }
2804         } else {
2805                 /* all channels */
2806                 i = 0;
2807                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
2808                         int j;
2809                         if (!wiphy->bands[band])
2810                                 continue;
2811                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
2812                                 request->channels[i] = &wiphy->bands[band]->channels[j];
2813                                 i++;
2814                         }
2815                 }
2816         }
2817
2818         i = 0;
2819         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
2820                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
2821                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
2822                                 err = -EINVAL;
2823                                 goto out_free;
2824                         }
2825                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
2826                         request->ssids[i].ssid_len = nla_len(attr);
2827                         i++;
2828                 }
2829         }
2830
2831         if (info->attrs[NL80211_ATTR_IE]) {
2832                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2833                 memcpy((void *)request->ie,
2834                        nla_data(info->attrs[NL80211_ATTR_IE]),
2835                        request->ie_len);
2836         }
2837
2838         request->ifidx = dev->ifindex;
2839         request->wiphy = &drv->wiphy;
2840
2841         drv->scan_req = request;
2842         err = drv->ops->scan(&drv->wiphy, dev, request);
2843
2844  out_free:
2845         if (err) {
2846                 drv->scan_req = NULL;
2847                 kfree(request);
2848         }
2849  out:
2850         cfg80211_put_dev(drv);
2851         dev_put(dev);
2852  out_rtnl:
2853         rtnl_unlock();
2854
2855         return err;
2856 }
2857
2858 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
2859                             struct cfg80211_registered_device *rdev,
2860                             struct net_device *dev,
2861                             struct cfg80211_bss *res)
2862 {
2863         void *hdr;
2864         struct nlattr *bss;
2865
2866         hdr = nl80211hdr_put(msg, pid, seq, flags,
2867                              NL80211_CMD_NEW_SCAN_RESULTS);
2868         if (!hdr)
2869                 return -1;
2870
2871         NLA_PUT_U32(msg, NL80211_ATTR_SCAN_GENERATION,
2872                     rdev->bss_generation);
2873         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2874
2875         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
2876         if (!bss)
2877                 goto nla_put_failure;
2878         if (!is_zero_ether_addr(res->bssid))
2879                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
2880         if (res->information_elements && res->len_information_elements)
2881                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
2882                         res->len_information_elements,
2883                         res->information_elements);
2884         if (res->tsf)
2885                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
2886         if (res->beacon_interval)
2887                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
2888         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
2889         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
2890
2891         switch (rdev->wiphy.signal_type) {
2892         case CFG80211_SIGNAL_TYPE_MBM:
2893                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
2894                 break;
2895         case CFG80211_SIGNAL_TYPE_UNSPEC:
2896                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
2897                 break;
2898         default:
2899                 break;
2900         }
2901
2902         nla_nest_end(msg, bss);
2903
2904         return genlmsg_end(msg, hdr);
2905
2906  nla_put_failure:
2907         genlmsg_cancel(msg, hdr);
2908         return -EMSGSIZE;
2909 }
2910
2911 static int nl80211_dump_scan(struct sk_buff *skb,
2912                              struct netlink_callback *cb)
2913 {
2914         struct cfg80211_registered_device *dev;
2915         struct net_device *netdev;
2916         struct cfg80211_internal_bss *scan;
2917         int ifidx = cb->args[0];
2918         int start = cb->args[1], idx = 0;
2919         int err;
2920
2921         if (!ifidx) {
2922                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
2923                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
2924                                   nl80211_policy);
2925                 if (err)
2926                         return err;
2927
2928                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
2929                         return -EINVAL;
2930
2931                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
2932                 if (!ifidx)
2933                         return -EINVAL;
2934                 cb->args[0] = ifidx;
2935         }
2936
2937         netdev = dev_get_by_index(&init_net, ifidx);
2938         if (!netdev)
2939                 return -ENODEV;
2940
2941         dev = cfg80211_get_dev_from_ifindex(ifidx);
2942         if (IS_ERR(dev)) {
2943                 err = PTR_ERR(dev);
2944                 goto out_put_netdev;
2945         }
2946
2947         spin_lock_bh(&dev->bss_lock);
2948         cfg80211_bss_expire(dev);
2949
2950         list_for_each_entry(scan, &dev->bss_list, list) {
2951                 if (++idx <= start)
2952                         continue;
2953                 if (nl80211_send_bss(skb,
2954                                 NETLINK_CB(cb->skb).pid,
2955                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2956                                 dev, netdev, &scan->pub) < 0) {
2957                         idx--;
2958                         goto out;
2959                 }
2960         }
2961
2962  out:
2963         spin_unlock_bh(&dev->bss_lock);
2964
2965         cb->args[1] = idx;
2966         err = skb->len;
2967         cfg80211_put_dev(dev);
2968  out_put_netdev:
2969         dev_put(netdev);
2970
2971         return err;
2972 }
2973
2974 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
2975 {
2976         return auth_type == NL80211_AUTHTYPE_OPEN_SYSTEM ||
2977                 auth_type == NL80211_AUTHTYPE_SHARED_KEY ||
2978                 auth_type == NL80211_AUTHTYPE_FT ||
2979                 auth_type == NL80211_AUTHTYPE_NETWORK_EAP;
2980 }
2981
2982 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
2983 {
2984         struct cfg80211_registered_device *drv;
2985         struct net_device *dev;
2986         struct cfg80211_auth_request req;
2987         struct wiphy *wiphy;
2988         int err;
2989
2990         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2991                 return -EINVAL;
2992
2993         if (!info->attrs[NL80211_ATTR_MAC])
2994                 return -EINVAL;
2995
2996         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
2997                 return -EINVAL;
2998
2999         rtnl_lock();
3000
3001         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3002         if (err)
3003                 goto unlock_rtnl;
3004
3005         if (!drv->ops->auth) {
3006                 err = -EOPNOTSUPP;
3007                 goto out;
3008         }
3009
3010         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3011                 err = -EOPNOTSUPP;
3012                 goto out;
3013         }
3014
3015         if (!netif_running(dev)) {
3016                 err = -ENETDOWN;
3017                 goto out;
3018         }
3019
3020         wiphy = &drv->wiphy;
3021         memset(&req, 0, sizeof(req));
3022
3023         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3024
3025         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3026                 req.chan = ieee80211_get_channel(
3027                         wiphy,
3028                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3029                 if (!req.chan) {
3030                         err = -EINVAL;
3031                         goto out;
3032                 }
3033         }
3034
3035         if (info->attrs[NL80211_ATTR_SSID]) {
3036                 req.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3037                 req.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3038         }
3039
3040         if (info->attrs[NL80211_ATTR_IE]) {
3041                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3042                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3043         }
3044
3045         req.auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
3046         if (!nl80211_valid_auth_type(req.auth_type)) {
3047                 err = -EINVAL;
3048                 goto out;
3049         }
3050
3051         err = drv->ops->auth(&drv->wiphy, dev, &req);
3052
3053 out:
3054         cfg80211_put_dev(drv);
3055         dev_put(dev);
3056 unlock_rtnl:
3057         rtnl_unlock();
3058         return err;
3059 }
3060
3061 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
3062 {
3063         struct cfg80211_registered_device *drv;
3064         struct net_device *dev;
3065         struct cfg80211_assoc_request req;
3066         struct wiphy *wiphy;
3067         int err;
3068
3069         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3070                 return -EINVAL;
3071
3072         if (!info->attrs[NL80211_ATTR_MAC] ||
3073             !info->attrs[NL80211_ATTR_SSID])
3074                 return -EINVAL;
3075
3076         rtnl_lock();
3077
3078         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3079         if (err)
3080                 goto unlock_rtnl;
3081
3082         if (!drv->ops->assoc) {
3083                 err = -EOPNOTSUPP;
3084                 goto out;
3085         }
3086
3087         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3088                 err = -EOPNOTSUPP;
3089                 goto out;
3090         }
3091
3092         if (!netif_running(dev)) {
3093                 err = -ENETDOWN;
3094                 goto out;
3095         }
3096
3097         wiphy = &drv->wiphy;
3098         memset(&req, 0, sizeof(req));
3099
3100         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3101
3102         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3103                 req.chan = ieee80211_get_channel(
3104                         wiphy,
3105                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3106                 if (!req.chan) {
3107                         err = -EINVAL;
3108                         goto out;
3109                 }
3110         }
3111
3112         req.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3113         req.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3114
3115         if (info->attrs[NL80211_ATTR_IE]) {
3116                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3117                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3118         }
3119
3120         if (info->attrs[NL80211_ATTR_USE_MFP]) {
3121                 enum nl80211_mfp use_mfp =
3122                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
3123                 if (use_mfp == NL80211_MFP_REQUIRED)
3124                         req.use_mfp = true;
3125                 else if (use_mfp != NL80211_MFP_NO) {
3126                         err = -EINVAL;
3127                         goto out;
3128                 }
3129         }
3130
3131         req.control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
3132
3133         err = drv->ops->assoc(&drv->wiphy, dev, &req);
3134
3135 out:
3136         cfg80211_put_dev(drv);
3137         dev_put(dev);
3138 unlock_rtnl:
3139         rtnl_unlock();
3140         return err;
3141 }
3142
3143 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
3144 {
3145         struct cfg80211_registered_device *drv;
3146         struct net_device *dev;
3147         struct cfg80211_deauth_request req;
3148         struct wiphy *wiphy;
3149         int err;
3150
3151         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3152                 return -EINVAL;
3153
3154         if (!info->attrs[NL80211_ATTR_MAC])
3155                 return -EINVAL;
3156
3157         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3158                 return -EINVAL;
3159
3160         rtnl_lock();
3161
3162         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3163         if (err)
3164                 goto unlock_rtnl;
3165
3166         if (!drv->ops->deauth) {
3167                 err = -EOPNOTSUPP;
3168                 goto out;
3169         }
3170
3171         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3172                 err = -EOPNOTSUPP;
3173                 goto out;
3174         }
3175
3176         if (!netif_running(dev)) {
3177                 err = -ENETDOWN;
3178                 goto out;
3179         }
3180
3181         wiphy = &drv->wiphy;
3182         memset(&req, 0, sizeof(req));
3183
3184         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3185
3186         req.reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3187         if (req.reason_code == 0) {
3188                 /* Reason Code 0 is reserved */
3189                 err = -EINVAL;
3190                 goto out;
3191         }
3192
3193         if (info->attrs[NL80211_ATTR_IE]) {
3194                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3195                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3196         }
3197
3198         err = drv->ops->deauth(&drv->wiphy, dev, &req);
3199
3200 out:
3201         cfg80211_put_dev(drv);
3202         dev_put(dev);
3203 unlock_rtnl:
3204         rtnl_unlock();
3205         return err;
3206 }
3207
3208 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
3209 {
3210         struct cfg80211_registered_device *drv;
3211         struct net_device *dev;
3212         struct cfg80211_disassoc_request req;
3213         struct wiphy *wiphy;
3214         int err;
3215
3216         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3217                 return -EINVAL;
3218
3219         if (!info->attrs[NL80211_ATTR_MAC])
3220                 return -EINVAL;
3221
3222         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3223                 return -EINVAL;
3224
3225         rtnl_lock();
3226
3227         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3228         if (err)
3229                 goto unlock_rtnl;
3230
3231         if (!drv->ops->disassoc) {
3232                 err = -EOPNOTSUPP;
3233                 goto out;
3234         }
3235
3236         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3237                 err = -EOPNOTSUPP;
3238                 goto out;
3239         }
3240
3241         if (!netif_running(dev)) {
3242                 err = -ENETDOWN;
3243                 goto out;
3244         }
3245
3246         wiphy = &drv->wiphy;
3247         memset(&req, 0, sizeof(req));
3248
3249         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3250
3251         req.reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3252         if (req.reason_code == 0) {
3253                 /* Reason Code 0 is reserved */
3254                 err = -EINVAL;
3255                 goto out;
3256         }
3257
3258         if (info->attrs[NL80211_ATTR_IE]) {
3259                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3260                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3261         }
3262
3263         err = drv->ops->disassoc(&drv->wiphy, dev, &req);
3264
3265 out:
3266         cfg80211_put_dev(drv);
3267         dev_put(dev);
3268 unlock_rtnl:
3269         rtnl_unlock();
3270         return err;
3271 }
3272
3273 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
3274 {
3275         struct cfg80211_registered_device *drv;
3276         struct net_device *dev;
3277         struct cfg80211_ibss_params ibss;
3278         struct wiphy *wiphy;
3279         int err;
3280
3281         memset(&ibss, 0, sizeof(ibss));
3282
3283         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3284                 return -EINVAL;
3285
3286         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
3287             !info->attrs[NL80211_ATTR_SSID] ||
3288             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3289                 return -EINVAL;
3290
3291         ibss.beacon_interval = 100;
3292
3293         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
3294                 ibss.beacon_interval =
3295                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3296                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
3297                         return -EINVAL;
3298         }
3299
3300         rtnl_lock();
3301
3302         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3303         if (err)
3304                 goto unlock_rtnl;
3305
3306         if (!drv->ops->join_ibss) {
3307                 err = -EOPNOTSUPP;
3308                 goto out;
3309         }
3310
3311         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3312                 err = -EOPNOTSUPP;
3313                 goto out;
3314         }
3315
3316         if (!netif_running(dev)) {
3317                 err = -ENETDOWN;
3318                 goto out;
3319         }
3320
3321         wiphy = &drv->wiphy;
3322
3323         if (info->attrs[NL80211_ATTR_MAC])
3324                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3325         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3326         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3327
3328         if (info->attrs[NL80211_ATTR_IE]) {
3329                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3330                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3331         }
3332
3333         ibss.channel = ieee80211_get_channel(wiphy,
3334                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3335         if (!ibss.channel ||
3336             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
3337             ibss.channel->flags & IEEE80211_CHAN_DISABLED) {
3338                 err = -EINVAL;
3339                 goto out;
3340         }
3341
3342         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
3343
3344         err = cfg80211_join_ibss(drv, dev, &ibss);
3345
3346 out:
3347         cfg80211_put_dev(drv);
3348         dev_put(dev);
3349 unlock_rtnl:
3350         rtnl_unlock();
3351         return err;
3352 }
3353
3354 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
3355 {
3356         struct cfg80211_registered_device *drv;
3357         struct net_device *dev;
3358         int err;
3359
3360         rtnl_lock();
3361
3362         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3363         if (err)
3364                 goto unlock_rtnl;
3365
3366         if (!drv->ops->leave_ibss) {
3367                 err = -EOPNOTSUPP;
3368                 goto out;
3369         }
3370
3371         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3372                 err = -EOPNOTSUPP;
3373                 goto out;
3374         }
3375
3376         if (!netif_running(dev)) {
3377                 err = -ENETDOWN;
3378                 goto out;
3379         }
3380
3381         err = cfg80211_leave_ibss(drv, dev, false);
3382
3383 out:
3384         cfg80211_put_dev(drv);
3385         dev_put(dev);
3386 unlock_rtnl:
3387         rtnl_unlock();
3388         return err;
3389 }
3390
3391 static struct genl_ops nl80211_ops[] = {
3392         {
3393                 .cmd = NL80211_CMD_GET_WIPHY,
3394                 .doit = nl80211_get_wiphy,
3395                 .dumpit = nl80211_dump_wiphy,
3396                 .policy = nl80211_policy,
3397                 /* can be retrieved by unprivileged users */
3398         },
3399         {
3400                 .cmd = NL80211_CMD_SET_WIPHY,
3401                 .doit = nl80211_set_wiphy,
3402                 .policy = nl80211_policy,
3403                 .flags = GENL_ADMIN_PERM,
3404         },
3405         {
3406                 .cmd = NL80211_CMD_GET_INTERFACE,
3407                 .doit = nl80211_get_interface,
3408                 .dumpit = nl80211_dump_interface,
3409                 .policy = nl80211_policy,
3410                 /* can be retrieved by unprivileged users */
3411         },
3412         {
3413                 .cmd = NL80211_CMD_SET_INTERFACE,
3414                 .doit = nl80211_set_interface,
3415                 .policy = nl80211_policy,
3416                 .flags = GENL_ADMIN_PERM,
3417         },
3418         {
3419                 .cmd = NL80211_CMD_NEW_INTERFACE,
3420                 .doit = nl80211_new_interface,
3421                 .policy = nl80211_policy,
3422                 .flags = GENL_ADMIN_PERM,
3423         },
3424         {
3425                 .cmd = NL80211_CMD_DEL_INTERFACE,
3426                 .doit = nl80211_del_interface,
3427                 .policy = nl80211_policy,
3428                 .flags = GENL_ADMIN_PERM,
3429         },
3430         {
3431                 .cmd = NL80211_CMD_GET_KEY,
3432                 .doit = nl80211_get_key,
3433                 .policy = nl80211_policy,
3434                 .flags = GENL_ADMIN_PERM,
3435         },
3436         {
3437                 .cmd = NL80211_CMD_SET_KEY,
3438                 .doit = nl80211_set_key,
3439                 .policy = nl80211_policy,
3440                 .flags = GENL_ADMIN_PERM,
3441         },
3442         {
3443                 .cmd = NL80211_CMD_NEW_KEY,
3444                 .doit = nl80211_new_key,
3445                 .policy = nl80211_policy,
3446                 .flags = GENL_ADMIN_PERM,
3447         },
3448         {
3449                 .cmd = NL80211_CMD_DEL_KEY,
3450                 .doit = nl80211_del_key,
3451                 .policy = nl80211_policy,
3452                 .flags = GENL_ADMIN_PERM,
3453         },
3454         {
3455                 .cmd = NL80211_CMD_SET_BEACON,
3456                 .policy = nl80211_policy,
3457                 .flags = GENL_ADMIN_PERM,
3458                 .doit = nl80211_addset_beacon,
3459         },
3460         {
3461                 .cmd = NL80211_CMD_NEW_BEACON,
3462                 .policy = nl80211_policy,
3463                 .flags = GENL_ADMIN_PERM,
3464                 .doit = nl80211_addset_beacon,
3465         },
3466         {
3467                 .cmd = NL80211_CMD_DEL_BEACON,
3468                 .policy = nl80211_policy,
3469                 .flags = GENL_ADMIN_PERM,
3470                 .doit = nl80211_del_beacon,
3471         },
3472         {
3473                 .cmd = NL80211_CMD_GET_STATION,
3474                 .doit = nl80211_get_station,
3475                 .dumpit = nl80211_dump_station,
3476                 .policy = nl80211_policy,
3477         },
3478         {
3479                 .cmd = NL80211_CMD_SET_STATION,
3480                 .doit = nl80211_set_station,
3481                 .policy = nl80211_policy,
3482                 .flags = GENL_ADMIN_PERM,
3483         },
3484         {
3485                 .cmd = NL80211_CMD_NEW_STATION,
3486                 .doit = nl80211_new_station,
3487                 .policy = nl80211_policy,
3488                 .flags = GENL_ADMIN_PERM,
3489         },
3490         {
3491                 .cmd = NL80211_CMD_DEL_STATION,
3492                 .doit = nl80211_del_station,
3493                 .policy = nl80211_policy,
3494                 .flags = GENL_ADMIN_PERM,
3495         },
3496         {
3497                 .cmd = NL80211_CMD_GET_MPATH,
3498                 .doit = nl80211_get_mpath,
3499                 .dumpit = nl80211_dump_mpath,
3500                 .policy = nl80211_policy,
3501                 .flags = GENL_ADMIN_PERM,
3502         },
3503         {
3504                 .cmd = NL80211_CMD_SET_MPATH,
3505                 .doit = nl80211_set_mpath,
3506                 .policy = nl80211_policy,
3507                 .flags = GENL_ADMIN_PERM,
3508         },
3509         {
3510                 .cmd = NL80211_CMD_NEW_MPATH,
3511                 .doit = nl80211_new_mpath,
3512                 .policy = nl80211_policy,
3513                 .flags = GENL_ADMIN_PERM,
3514         },
3515         {
3516                 .cmd = NL80211_CMD_DEL_MPATH,
3517                 .doit = nl80211_del_mpath,
3518                 .policy = nl80211_policy,
3519                 .flags = GENL_ADMIN_PERM,
3520         },
3521         {
3522                 .cmd = NL80211_CMD_SET_BSS,
3523                 .doit = nl80211_set_bss,
3524                 .policy = nl80211_policy,
3525                 .flags = GENL_ADMIN_PERM,
3526         },
3527         {
3528                 .cmd = NL80211_CMD_GET_REG,
3529                 .doit = nl80211_get_reg,
3530                 .policy = nl80211_policy,
3531                 /* can be retrieved by unprivileged users */
3532         },
3533         {
3534                 .cmd = NL80211_CMD_SET_REG,
3535                 .doit = nl80211_set_reg,
3536                 .policy = nl80211_policy,
3537                 .flags = GENL_ADMIN_PERM,
3538         },
3539         {
3540                 .cmd = NL80211_CMD_REQ_SET_REG,
3541                 .doit = nl80211_req_set_reg,
3542                 .policy = nl80211_policy,
3543                 .flags = GENL_ADMIN_PERM,
3544         },
3545         {
3546                 .cmd = NL80211_CMD_GET_MESH_PARAMS,
3547                 .doit = nl80211_get_mesh_params,
3548                 .policy = nl80211_policy,
3549                 /* can be retrieved by unprivileged users */
3550         },
3551         {
3552                 .cmd = NL80211_CMD_SET_MESH_PARAMS,
3553                 .doit = nl80211_set_mesh_params,
3554                 .policy = nl80211_policy,
3555                 .flags = GENL_ADMIN_PERM,
3556         },
3557         {
3558                 .cmd = NL80211_CMD_TRIGGER_SCAN,
3559                 .doit = nl80211_trigger_scan,
3560                 .policy = nl80211_policy,
3561                 .flags = GENL_ADMIN_PERM,
3562         },
3563         {
3564                 .cmd = NL80211_CMD_GET_SCAN,
3565                 .policy = nl80211_policy,
3566                 .dumpit = nl80211_dump_scan,
3567         },
3568         {
3569                 .cmd = NL80211_CMD_AUTHENTICATE,
3570                 .doit = nl80211_authenticate,
3571                 .policy = nl80211_policy,
3572                 .flags = GENL_ADMIN_PERM,
3573         },
3574         {
3575                 .cmd = NL80211_CMD_ASSOCIATE,
3576                 .doit = nl80211_associate,
3577                 .policy = nl80211_policy,
3578                 .flags = GENL_ADMIN_PERM,
3579         },
3580         {
3581                 .cmd = NL80211_CMD_DEAUTHENTICATE,
3582                 .doit = nl80211_deauthenticate,
3583                 .policy = nl80211_policy,
3584                 .flags = GENL_ADMIN_PERM,
3585         },
3586         {
3587                 .cmd = NL80211_CMD_DISASSOCIATE,
3588                 .doit = nl80211_disassociate,
3589                 .policy = nl80211_policy,
3590                 .flags = GENL_ADMIN_PERM,
3591         },
3592         {
3593                 .cmd = NL80211_CMD_JOIN_IBSS,
3594                 .doit = nl80211_join_ibss,
3595                 .policy = nl80211_policy,
3596                 .flags = GENL_ADMIN_PERM,
3597         },
3598         {
3599                 .cmd = NL80211_CMD_LEAVE_IBSS,
3600                 .doit = nl80211_leave_ibss,
3601                 .policy = nl80211_policy,
3602                 .flags = GENL_ADMIN_PERM,
3603         },
3604 };
3605 static struct genl_multicast_group nl80211_mlme_mcgrp = {
3606         .name = "mlme",
3607 };
3608
3609 /* multicast groups */
3610 static struct genl_multicast_group nl80211_config_mcgrp = {
3611         .name = "config",
3612 };
3613 static struct genl_multicast_group nl80211_scan_mcgrp = {
3614         .name = "scan",
3615 };
3616 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
3617         .name = "regulatory",
3618 };
3619
3620 /* notification functions */
3621
3622 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
3623 {
3624         struct sk_buff *msg;
3625
3626         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3627         if (!msg)
3628                 return;
3629
3630         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
3631                 nlmsg_free(msg);
3632                 return;
3633         }
3634
3635         genlmsg_multicast(msg, 0, nl80211_config_mcgrp.id, GFP_KERNEL);
3636 }
3637
3638 static int nl80211_add_scan_req(struct sk_buff *msg,
3639                                 struct cfg80211_registered_device *rdev)
3640 {
3641         struct cfg80211_scan_request *req = rdev->scan_req;
3642         struct nlattr *nest;
3643         int i;
3644
3645         if (WARN_ON(!req))
3646                 return 0;
3647
3648         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
3649         if (!nest)
3650                 goto nla_put_failure;
3651         for (i = 0; i < req->n_ssids; i++)
3652                 NLA_PUT(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid);
3653         nla_nest_end(msg, nest);
3654
3655         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
3656         if (!nest)
3657                 goto nla_put_failure;
3658         for (i = 0; i < req->n_channels; i++)
3659                 NLA_PUT_U32(msg, i, req->channels[i]->center_freq);
3660         nla_nest_end(msg, nest);
3661
3662         if (req->ie)
3663                 NLA_PUT(msg, NL80211_ATTR_IE, req->ie_len, req->ie);
3664
3665         return 0;
3666  nla_put_failure:
3667         return -ENOBUFS;
3668 }
3669
3670 static int nl80211_send_scan_donemsg(struct sk_buff *msg,
3671                                      struct cfg80211_registered_device *rdev,
3672                                      struct net_device *netdev,
3673                                      u32 pid, u32 seq, int flags,
3674                                      u32 cmd)
3675 {
3676         void *hdr;
3677
3678         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
3679         if (!hdr)
3680                 return -1;
3681
3682         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3683         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3684
3685         /* ignore errors and send incomplete event anyway */
3686         nl80211_add_scan_req(msg, rdev);
3687
3688         return genlmsg_end(msg, hdr);
3689
3690  nla_put_failure:
3691         genlmsg_cancel(msg, hdr);
3692         return -EMSGSIZE;
3693 }
3694
3695 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
3696                             struct net_device *netdev)
3697 {
3698         struct sk_buff *msg;
3699
3700         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3701         if (!msg)
3702                 return;
3703
3704         if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
3705                                       NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
3706                 nlmsg_free(msg);
3707                 return;
3708         }
3709
3710         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
3711 }
3712
3713 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
3714                                struct net_device *netdev)
3715 {
3716         struct sk_buff *msg;
3717
3718         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3719         if (!msg)
3720                 return;
3721
3722         if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
3723                                       NL80211_CMD_SCAN_ABORTED) < 0) {
3724                 nlmsg_free(msg);
3725                 return;
3726         }
3727
3728         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
3729 }
3730
3731 /*
3732  * This can happen on global regulatory changes or device specific settings
3733  * based on custom world regulatory domains.
3734  */
3735 void nl80211_send_reg_change_event(struct regulatory_request *request)
3736 {
3737         struct sk_buff *msg;
3738         void *hdr;
3739
3740         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3741         if (!msg)
3742                 return;
3743
3744         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
3745         if (!hdr) {
3746                 nlmsg_free(msg);
3747                 return;
3748         }
3749
3750         /* Userspace can always count this one always being set */
3751         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
3752
3753         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
3754                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3755                            NL80211_REGDOM_TYPE_WORLD);
3756         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
3757                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3758                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
3759         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
3760                  request->intersect)
3761                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3762                            NL80211_REGDOM_TYPE_INTERSECTION);
3763         else {
3764                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3765                            NL80211_REGDOM_TYPE_COUNTRY);
3766                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
3767         }
3768
3769         if (wiphy_idx_valid(request->wiphy_idx))
3770                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
3771
3772         if (genlmsg_end(msg, hdr) < 0) {
3773                 nlmsg_free(msg);
3774                 return;
3775         }
3776
3777         genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_KERNEL);
3778
3779         return;
3780
3781 nla_put_failure:
3782         genlmsg_cancel(msg, hdr);
3783         nlmsg_free(msg);
3784 }
3785
3786 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
3787                                     struct net_device *netdev,
3788                                     const u8 *buf, size_t len,
3789                                     enum nl80211_commands cmd)
3790 {
3791         struct sk_buff *msg;
3792         void *hdr;
3793
3794         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
3795         if (!msg)
3796                 return;
3797
3798         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
3799         if (!hdr) {
3800                 nlmsg_free(msg);
3801                 return;
3802         }
3803
3804         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3805         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3806         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
3807
3808         if (genlmsg_end(msg, hdr) < 0) {
3809                 nlmsg_free(msg);
3810                 return;
3811         }
3812
3813         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_ATOMIC);
3814         return;
3815
3816  nla_put_failure:
3817         genlmsg_cancel(msg, hdr);
3818         nlmsg_free(msg);
3819 }
3820
3821 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
3822                           struct net_device *netdev, const u8 *buf, size_t len)
3823 {
3824         nl80211_send_mlme_event(rdev, netdev, buf, len,
3825                                 NL80211_CMD_AUTHENTICATE);
3826 }
3827
3828 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
3829                            struct net_device *netdev, const u8 *buf,
3830                            size_t len)
3831 {
3832         nl80211_send_mlme_event(rdev, netdev, buf, len, NL80211_CMD_ASSOCIATE);
3833 }
3834
3835 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
3836                          struct net_device *netdev, const u8 *buf, size_t len)
3837 {
3838         nl80211_send_mlme_event(rdev, netdev, buf, len,
3839                                 NL80211_CMD_DEAUTHENTICATE);
3840 }
3841
3842 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
3843                            struct net_device *netdev, const u8 *buf,
3844                            size_t len)
3845 {
3846         nl80211_send_mlme_event(rdev, netdev, buf, len,
3847                                 NL80211_CMD_DISASSOCIATE);
3848 }
3849
3850 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
3851                                       struct net_device *netdev, int cmd,
3852                                       const u8 *addr)
3853 {
3854         struct sk_buff *msg;
3855         void *hdr;
3856
3857         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
3858         if (!msg)
3859                 return;
3860
3861         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
3862         if (!hdr) {
3863                 nlmsg_free(msg);
3864                 return;
3865         }
3866
3867         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3868         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3869         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
3870         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3871
3872         if (genlmsg_end(msg, hdr) < 0) {
3873                 nlmsg_free(msg);
3874                 return;
3875         }
3876
3877         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_ATOMIC);
3878         return;
3879
3880  nla_put_failure:
3881         genlmsg_cancel(msg, hdr);
3882         nlmsg_free(msg);
3883 }
3884
3885 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
3886                                struct net_device *netdev, const u8 *addr)
3887 {
3888         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
3889                                   addr);
3890 }
3891
3892 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
3893                                 struct net_device *netdev, const u8 *addr)
3894 {
3895         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE, addr);
3896 }
3897
3898 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
3899                              struct net_device *netdev, const u8 *bssid,
3900                              gfp_t gfp)
3901 {
3902         struct sk_buff *msg;
3903         void *hdr;
3904
3905         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
3906         if (!msg)
3907                 return;
3908
3909         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
3910         if (!hdr) {
3911                 nlmsg_free(msg);
3912                 return;
3913         }
3914
3915         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3916         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3917         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
3918
3919         if (genlmsg_end(msg, hdr) < 0) {
3920                 nlmsg_free(msg);
3921                 return;
3922         }
3923
3924         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
3925         return;
3926
3927  nla_put_failure:
3928         genlmsg_cancel(msg, hdr);
3929         nlmsg_free(msg);
3930 }
3931
3932 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
3933                                  struct net_device *netdev, const u8 *addr,
3934                                  enum nl80211_key_type key_type, int key_id,
3935                                  const u8 *tsc)
3936 {
3937         struct sk_buff *msg;
3938         void *hdr;
3939
3940         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
3941         if (!msg)
3942                 return;
3943
3944         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
3945         if (!hdr) {
3946                 nlmsg_free(msg);
3947                 return;
3948         }
3949
3950         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3951         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3952         if (addr)
3953                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3954         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
3955         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
3956         if (tsc)
3957                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
3958
3959         if (genlmsg_end(msg, hdr) < 0) {
3960                 nlmsg_free(msg);
3961                 return;
3962         }
3963
3964         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_ATOMIC);
3965         return;
3966
3967  nla_put_failure:
3968         genlmsg_cancel(msg, hdr);
3969         nlmsg_free(msg);
3970 }
3971
3972 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
3973                                     struct ieee80211_channel *channel_before,
3974                                     struct ieee80211_channel *channel_after)
3975 {
3976         struct sk_buff *msg;
3977         void *hdr;
3978         struct nlattr *nl_freq;
3979
3980         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
3981         if (!msg)
3982                 return;
3983
3984         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
3985         if (!hdr) {
3986                 nlmsg_free(msg);
3987                 return;
3988         }
3989
3990         /*
3991          * Since we are applying the beacon hint to a wiphy we know its
3992          * wiphy_idx is valid
3993          */
3994         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
3995
3996         /* Before */
3997         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
3998         if (!nl_freq)
3999                 goto nla_put_failure;
4000         if (nl80211_msg_put_channel(msg, channel_before))
4001                 goto nla_put_failure;
4002         nla_nest_end(msg, nl_freq);
4003
4004         /* After */
4005         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
4006         if (!nl_freq)
4007                 goto nla_put_failure;
4008         if (nl80211_msg_put_channel(msg, channel_after))
4009                 goto nla_put_failure;
4010         nla_nest_end(msg, nl_freq);
4011
4012         if (genlmsg_end(msg, hdr) < 0) {
4013                 nlmsg_free(msg);
4014                 return;
4015         }
4016
4017         genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_ATOMIC);
4018
4019         return;
4020
4021 nla_put_failure:
4022         genlmsg_cancel(msg, hdr);
4023         nlmsg_free(msg);
4024 }
4025
4026 /* initialisation/exit functions */
4027
4028 int nl80211_init(void)
4029 {
4030         int err;
4031
4032         err = genl_register_family_with_ops(&nl80211_fam,
4033                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
4034         if (err)
4035                 return err;
4036
4037         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
4038         if (err)
4039                 goto err_out;
4040
4041         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
4042         if (err)
4043                 goto err_out;
4044
4045         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
4046         if (err)
4047                 goto err_out;
4048
4049         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
4050         if (err)
4051                 goto err_out;
4052
4053         return 0;
4054  err_out:
4055         genl_unregister_family(&nl80211_fam);
4056         return err;
4057 }
4058
4059 void nl80211_exit(void)
4060 {
4061         genl_unregister_family(&nl80211_fam);
4062 }