net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006, 2007 Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/list.h>
  11 #include <linux/if_ether.h>
  12 #include <linux/ieee80211.h>
  13 #include <linux/nl80211.h>
  14 #include <linux/rtnetlink.h>
  15 #include <linux/netlink.h>
  16 #include <linux/etherdevice.h>
  17 #include <net/genetlink.h>
  18 #include <net/cfg80211.h>
  19 #include "core.h"
  20 #include "nl80211.h"
  21 #include "reg.h"
  22
  23 /* the netlink family */
  24 static struct genl_family nl80211_fam = {
  25         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  26         .name = "nl80211",      /* have users key off the name instead */
  27         .hdrsize = 0,           /* no private header */
  28         .version = 1,           /* no particular meaning now */
  29         .maxattr = NL80211_ATTR_MAX,
  30 };
  31
  32 /* internal helper: get drv and dev */
  33 static int get_drv_dev_by_info_ifindex(struct nlattr **attrs,
  34                                        struct cfg80211_registered_device **drv,
  35                                        struct net_device **dev)
  36 {
  37         int ifindex;
  38
  39         if (!attrs[NL80211_ATTR_IFINDEX])
  40                 return -EINVAL;
  41
  42         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  43         *dev = dev_get_by_index(&init_net, ifindex);
  44         if (!*dev)
  45                 return -ENODEV;
  46
  47         *drv = cfg80211_get_dev_from_ifindex(ifindex);
  48         if (IS_ERR(*drv)) {
  49                 dev_put(*dev);
  50                 return PTR_ERR(*drv);
  51         }
  52
  53         return 0;
  54 }
  55
  56 /* policy for the attributes */
  57 static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
  58         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  59         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  60                                       .len = BUS_ID_SIZE-1 },
  61         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  62         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  63         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  64
  65         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  66         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  67         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  68
  69         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  70
  71         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  72                                     .len = WLAN_MAX_KEY_LEN },
  73         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  74         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  75         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
  76
  77         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
  78         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
  79         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
  80                                        .len = IEEE80211_MAX_DATA_LEN },
  81         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
  82                                        .len = IEEE80211_MAX_DATA_LEN },
  83         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
  84         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
  85         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
  86         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
  87                                                .len = NL80211_MAX_SUPP_RATES },
  88         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
  89         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
  90         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
  91         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
  92                                 .len = IEEE80211_MAX_MESH_ID_LEN },
  93         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
  94
  95         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
  96         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
  97
  98         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
  99         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 100         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 101         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 102                                            .len = NL80211_MAX_SUPP_RATES },
 103
 104         [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
 105
 106         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 107                                          .len = NL80211_HT_CAPABILITY_LEN },
 108
 109         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 110         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 111                               .len = IEEE80211_MAX_DATA_LEN },
 112         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 113         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 114 };
 115
 116 /* message building helper */
 117 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 118                                    int flags, u8 cmd)
 119 {
 120         /* since there is no private header just add the generic one */
 121         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 122 }
 123
 124 /* netlink command implementations */
 125
 126 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 127                               struct cfg80211_registered_device *dev)
 128 {
 129         void *hdr;
 130         struct nlattr *nl_bands, *nl_band;
 131         struct nlattr *nl_freqs, *nl_freq;
 132         struct nlattr *nl_rates, *nl_rate;
 133         struct nlattr *nl_modes;
 134         enum ieee80211_band band;
 135         struct ieee80211_channel *chan;
 136         struct ieee80211_rate *rate;
 137         int i;
 138         u16 ifmodes = dev->wiphy.interface_modes;
 139
 140         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 141         if (!hdr)
 142                 return -1;
 143
 144         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 145         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 146         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 147                    dev->wiphy.max_scan_ssids);
 148
 149         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
 150         if (!nl_modes)
 151                 goto nla_put_failure;
 152
 153         i = 0;
 154         while (ifmodes) {
 155                 if (ifmodes & 1)
 156                         NLA_PUT_FLAG(msg, i);
 157                 ifmodes >>= 1;
 158                 i++;
 159         }
 160
 161         nla_nest_end(msg, nl_modes);
 162
 163         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 164         if (!nl_bands)
 165                 goto nla_put_failure;
 166
 167         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 168                 if (!dev->wiphy.bands[band])
 169                         continue;
 170
 171                 nl_band = nla_nest_start(msg, band);
 172                 if (!nl_band)
 173                         goto nla_put_failure;
 174
 175                 /* add HT info */
 176                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 177                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 178                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 179                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 180                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 181                                 dev->wiphy.bands[band]->ht_cap.cap);
 182                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 183                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 184                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 185                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 186                 }
 187
 188                 /* add frequencies */
 189                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 190                 if (!nl_freqs)
 191                         goto nla_put_failure;
 192
 193                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 194                         nl_freq = nla_nest_start(msg, i);
 195                         if (!nl_freq)
 196                                 goto nla_put_failure;
 197
 198                         chan = &dev->wiphy.bands[band]->channels[i];
 199                         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 200                                     chan->center_freq);
 201
 202                         if (chan->flags & IEEE80211_CHAN_DISABLED)
 203                                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 204                         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 205                                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 206                         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 207                                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 208                         if (chan->flags & IEEE80211_CHAN_RADAR)
 209                                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 210
 211                         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 212                                     DBM_TO_MBM(chan->max_power));
 213
 214                         nla_nest_end(msg, nl_freq);
 215                 }
 216
 217                 nla_nest_end(msg, nl_freqs);
 218
 219                 /* add bitrates */
 220                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 221                 if (!nl_rates)
 222                         goto nla_put_failure;
 223
 224                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 225                         nl_rate = nla_nest_start(msg, i);
 226                         if (!nl_rate)
 227                                 goto nla_put_failure;
 228
 229                         rate = &dev->wiphy.bands[band]->bitrates[i];
 230                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 231                                     rate->bitrate);
 232                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 233                                 NLA_PUT_FLAG(msg,
 234                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 235
 236                         nla_nest_end(msg, nl_rate);
 237                 }
 238
 239                 nla_nest_end(msg, nl_rates);
 240
 241                 nla_nest_end(msg, nl_band);
 242         }
 243         nla_nest_end(msg, nl_bands);
 244
 245         return genlmsg_end(msg, hdr);
 246
 247  nla_put_failure:
 248         genlmsg_cancel(msg, hdr);
 249         return -EMSGSIZE;
 250 }
 251
 252 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 253 {
 254         int idx = 0;
 255         int start = cb->args[0];
 256         struct cfg80211_registered_device *dev;
 257
 258         mutex_lock(&cfg80211_mutex);
 259         list_for_each_entry(dev, &cfg80211_drv_list, list) {
 260                 if (++idx <= start)
 261                         continue;
 262                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
 263                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
 264                                        dev) < 0) {
 265                         idx--;
 266                         break;
 267                 }
 268         }
 269         mutex_unlock(&cfg80211_mutex);
 270
 271         cb->args[0] = idx;
 272
 273         return skb->len;
 274 }
 275
 276 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 277 {
 278         struct sk_buff *msg;
 279         struct cfg80211_registered_device *dev;
 280
 281         dev = cfg80211_get_dev_from_info(info);
 282         if (IS_ERR(dev))
 283                 return PTR_ERR(dev);
 284
 285         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 286         if (!msg)
 287                 goto out_err;
 288
 289         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
 290                 goto out_free;
 291
 292         cfg80211_put_dev(dev);
 293
 294         return genlmsg_unicast(msg, info->snd_pid);
 295
 296  out_free:
 297         nlmsg_free(msg);
 298  out_err:
 299         cfg80211_put_dev(dev);
 300         return -ENOBUFS;
 301 }
 302
 303 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 304         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
 305         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
 306         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
 307         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
 308         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
 309 };
 310
 311 static int parse_txq_params(struct nlattr *tb[],
 312                             struct ieee80211_txq_params *txq_params)
 313 {
 314         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 315             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 316             !tb[NL80211_TXQ_ATTR_AIFS])
 317                 return -EINVAL;
 318
 319         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
 320         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 321         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 322         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 323         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 324
 325         return 0;
 326 }
 327
 328 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 329 {
 330         struct cfg80211_registered_device *rdev;
 331         int result = 0, rem_txq_params = 0;
 332         struct nlattr *nl_txq_params;
 333
 334         rdev = cfg80211_get_dev_from_info(info);
 335         if (IS_ERR(rdev))
 336                 return PTR_ERR(rdev);
 337
 338         if (info->attrs[NL80211_ATTR_WIPHY_NAME]) {
 339                 result = cfg80211_dev_rename(
 340                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 341                 if (result)
 342                         goto bad_res;
 343         }
 344
 345         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
 346                 struct ieee80211_txq_params txq_params;
 347                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
 348
 349                 if (!rdev->ops->set_txq_params) {
 350                         result = -EOPNOTSUPP;
 351                         goto bad_res;
 352                 }
 353
 354                 nla_for_each_nested(nl_txq_params,
 355                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
 356                                     rem_txq_params) {
 357                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
 358                                   nla_data(nl_txq_params),
 359                                   nla_len(nl_txq_params),
 360                                   txq_params_policy);
 361                         result = parse_txq_params(tb, &txq_params);
 362                         if (result)
 363                                 goto bad_res;
 364
 365                         result = rdev->ops->set_txq_params(&rdev->wiphy,
 366                                                            &txq_params);
 367                         if (result)
 368                                 goto bad_res;
 369                 }
 370         }
 371
 372         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
 373                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 374                 struct ieee80211_channel *chan;
 375                 struct ieee80211_sta_ht_cap *ht_cap;
 376                 u32 freq, sec_freq;
 377
 378                 if (!rdev->ops->set_channel) {
 379                         result = -EOPNOTSUPP;
 380                         goto bad_res;
 381                 }
 382
 383                 result = -EINVAL;
 384
 385                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 386                         channel_type = nla_get_u32(info->attrs[
 387                                            NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 388                         if (channel_type != NL80211_CHAN_NO_HT &&
 389                             channel_type != NL80211_CHAN_HT20 &&
 390                             channel_type != NL80211_CHAN_HT40PLUS &&
 391                             channel_type != NL80211_CHAN_HT40MINUS)
 392                                 goto bad_res;
 393                 }
 394
 395                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 396                 chan = ieee80211_get_channel(&rdev->wiphy, freq);
 397
 398                 /* Primary channel not allowed */
 399                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 400                         goto bad_res;
 401
 402                 if (channel_type == NL80211_CHAN_HT40MINUS)
 403                         sec_freq = freq - 20;
 404                 else if (channel_type == NL80211_CHAN_HT40PLUS)
 405                         sec_freq = freq + 20;
 406                 else
 407                         sec_freq = 0;
 408
 409                 ht_cap = &rdev->wiphy.bands[chan->band]->ht_cap;
 410
 411                 /* no HT capabilities */
 412                 if (channel_type != NL80211_CHAN_NO_HT &&
 413                     !ht_cap->ht_supported)
 414                         goto bad_res;
 415
 416                 if (sec_freq) {
 417                         struct ieee80211_channel *schan;
 418
 419                         /* no 40 MHz capabilities */
 420                         if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
 421                             (ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT))
 422                                 goto bad_res;
 423
 424                         schan = ieee80211_get_channel(&rdev->wiphy, sec_freq);
 425
 426                         /* Secondary channel not allowed */
 427                         if (!schan || schan->flags & IEEE80211_CHAN_DISABLED)
 428                                 goto bad_res;
 429                 }
 430
 431                 result = rdev->ops->set_channel(&rdev->wiphy, chan,
 432                                                 channel_type);
 433                 if (result)
 434                         goto bad_res;
 435         }
 436
 437
 438  bad_res:
 439         cfg80211_put_dev(rdev);
 440         return result;
 441 }
 442
 443
 444 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 445                               struct net_device *dev)
 446 {
 447         void *hdr;
 448
 449         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
 450         if (!hdr)
 451                 return -1;
 452
 453         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 454         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
 455         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
 456         return genlmsg_end(msg, hdr);
 457
 458  nla_put_failure:
 459         genlmsg_cancel(msg, hdr);
 460         return -EMSGSIZE;
 461 }
 462
 463 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
 464 {
 465         int wp_idx = 0;
 466         int if_idx = 0;
 467         int wp_start = cb->args[0];
 468         int if_start = cb->args[1];
 469         struct cfg80211_registered_device *dev;
 470         struct wireless_dev *wdev;
 471
 472         mutex_lock(&cfg80211_mutex);
 473         list_for_each_entry(dev, &cfg80211_drv_list, list) {
 474                 if (wp_idx < wp_start) {
 475                         wp_idx++;
 476                         continue;
 477                 }
 478                 if_idx = 0;
 479
 480                 mutex_lock(&dev->devlist_mtx);
 481                 list_for_each_entry(wdev, &dev->netdev_list, list) {
 482                         if (if_idx < if_start) {
 483                                 if_idx++;
 484                                 continue;
 485                         }
 486                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
 487                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
 488                                                wdev->netdev) < 0) {
 489                                 mutex_unlock(&dev->devlist_mtx);
 490                                 goto out;
 491                         }
 492                         if_idx++;
 493                 }
 494                 mutex_unlock(&dev->devlist_mtx);
 495
 496                 wp_idx++;
 497         }
 498  out:
 499         mutex_unlock(&cfg80211_mutex);
 500
 501         cb->args[0] = wp_idx;
 502         cb->args[1] = if_idx;
 503
 504         return skb->len;
 505 }
 506
 507 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
 508 {
 509         struct sk_buff *msg;
 510         struct cfg80211_registered_device *dev;
 511         struct net_device *netdev;
 512         int err;
 513
 514         err = get_drv_dev_by_info_ifindex(info->attrs, &dev, &netdev);
 515         if (err)
 516                 return err;
 517
 518         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 519         if (!msg)
 520                 goto out_err;
 521
 522         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0, netdev) < 0)
 523                 goto out_free;
 524
 525         dev_put(netdev);
 526         cfg80211_put_dev(dev);
 527
 528         return genlmsg_unicast(msg, info->snd_pid);
 529
 530  out_free:
 531         nlmsg_free(msg);
 532  out_err:
 533         dev_put(netdev);
 534         cfg80211_put_dev(dev);
 535         return -ENOBUFS;
 536 }
 537
 538 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
 539         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
 540         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
 541         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
 542         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
 543         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
 544 };
 545
 546 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
 547 {
 548         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
 549         int flag;
 550
 551         *mntrflags = 0;
 552
 553         if (!nla)
 554                 return -EINVAL;
 555
 556         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
 557                              nla, mntr_flags_policy))
 558                 return -EINVAL;
 559
 560         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
 561                 if (flags[flag])
 562                         *mntrflags |= (1<<flag);
 563
 564         return 0;
 565 }
 566
 567 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 568 {
 569         struct cfg80211_registered_device *drv;
 570         struct vif_params params;
 571         int err, ifindex;
 572         enum nl80211_iftype type;
 573         struct net_device *dev;
 574         u32 _flags, *flags = NULL;
 575
 576         memset(&params, 0, sizeof(params));
 577
 578         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 579         if (err)
 580                 return err;
 581         ifindex = dev->ifindex;
 582         type = dev->ieee80211_ptr->iftype;
 583         dev_put(dev);
 584
 585         err = -EINVAL;
 586         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 587                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 588                 if (type > NL80211_IFTYPE_MAX)
 589                         goto unlock;
 590         }
 591
 592         if (!drv->ops->change_virtual_intf ||
 593             !(drv->wiphy.interface_modes & (1 << type))) {
 594                 err = -EOPNOTSUPP;
 595                 goto unlock;
 596         }
 597
 598         if (info->attrs[NL80211_ATTR_MESH_ID]) {
 599                 if (type != NL80211_IFTYPE_MESH_POINT) {
 600                         err = -EINVAL;
 601                         goto unlock;
 602                 }
 603                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 604                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 605         }
 606
 607         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
 608                 if (type != NL80211_IFTYPE_MONITOR) {
 609                         err = -EINVAL;
 610                         goto unlock;
 611                 }
 612                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
 613                                           &_flags);
 614                 if (!err)
 615                         flags = &_flags;
 616         }
 617         rtnl_lock();
 618         err = drv->ops->change_virtual_intf(&drv->wiphy, ifindex,
 619                                             type, flags, &params);
 620
 621         dev = __dev_get_by_index(&init_net, ifindex);
 622         WARN_ON(!dev || (!err && dev->ieee80211_ptr->iftype != type));
 623
 624         rtnl_unlock();
 625
 626  unlock:
 627         cfg80211_put_dev(drv);
 628         return err;
 629 }
 630
 631 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
 632 {
 633         struct cfg80211_registered_device *drv;
 634         struct vif_params params;
 635         int err;
 636         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
 637         u32 flags;
 638
 639         memset(&params, 0, sizeof(params));
 640
 641         if (!info->attrs[NL80211_ATTR_IFNAME])
 642                 return -EINVAL;
 643
 644         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 645                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 646                 if (type > NL80211_IFTYPE_MAX)
 647                         return -EINVAL;
 648         }
 649
 650         drv = cfg80211_get_dev_from_info(info);
 651         if (IS_ERR(drv))
 652                 return PTR_ERR(drv);
 653
 654         if (!drv->ops->add_virtual_intf ||
 655             !(drv->wiphy.interface_modes & (1 << type))) {
 656                 err = -EOPNOTSUPP;
 657                 goto unlock;
 658         }
 659
 660         if (type == NL80211_IFTYPE_MESH_POINT &&
 661             info->attrs[NL80211_ATTR_MESH_ID]) {
 662                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 663                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 664         }
 665
 666         rtnl_lock();
 667         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
 668                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
 669                                   &flags);
 670         err = drv->ops->add_virtual_intf(&drv->wiphy,
 671                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
 672                 type, err ? NULL : &flags, &params);
 673         rtnl_unlock();
 674
 675
 676  unlock:
 677         cfg80211_put_dev(drv);
 678         return err;
 679 }
 680
 681 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
 682 {
 683         struct cfg80211_registered_device *drv;
 684         int ifindex, err;
 685         struct net_device *dev;
 686
 687         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 688         if (err)
 689                 return err;
 690         ifindex = dev->ifindex;
 691         dev_put(dev);
 692
 693         if (!drv->ops->del_virtual_intf) {
 694                 err = -EOPNOTSUPP;
 695                 goto out;
 696         }
 697
 698         rtnl_lock();
 699         err = drv->ops->del_virtual_intf(&drv->wiphy, ifindex);
 700         rtnl_unlock();
 701
 702  out:
 703         cfg80211_put_dev(drv);
 704         return err;
 705 }
 706
 707 struct get_key_cookie {
 708         struct sk_buff *msg;
 709         int error;
 710 };
 711
 712 static void get_key_callback(void *c, struct key_params *params)
 713 {
 714         struct get_key_cookie *cookie = c;
 715
 716         if (params->key)
 717                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
 718                         params->key_len, params->key);
 719
 720         if (params->seq)
 721                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
 722                         params->seq_len, params->seq);
 723
 724         if (params->cipher)
 725                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
 726                             params->cipher);
 727
 728         return;
 729  nla_put_failure:
 730         cookie->error = 1;
 731 }
 732
 733 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
 734 {
 735         struct cfg80211_registered_device *drv;
 736         int err;
 737         struct net_device *dev;
 738         u8 key_idx = 0;
 739         u8 *mac_addr = NULL;
 740         struct get_key_cookie cookie = {
 741                 .error = 0,
 742         };
 743         void *hdr;
 744         struct sk_buff *msg;
 745
 746         if (info->attrs[NL80211_ATTR_KEY_IDX])
 747                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 748
 749         if (key_idx > 5)
 750                 return -EINVAL;
 751
 752         if (info->attrs[NL80211_ATTR_MAC])
 753                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 754
 755         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 756         if (err)
 757                 return err;
 758
 759         if (!drv->ops->get_key) {
 760                 err = -EOPNOTSUPP;
 761                 goto out;
 762         }
 763
 764         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 765         if (!msg) {
 766                 err = -ENOMEM;
 767                 goto out;
 768         }
 769
 770         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
 771                              NL80211_CMD_NEW_KEY);
 772
 773         if (IS_ERR(hdr)) {
 774                 err = PTR_ERR(hdr);
 775                 goto out;
 776         }
 777
 778         cookie.msg = msg;
 779
 780         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 781         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
 782         if (mac_addr)
 783                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
 784
 785         rtnl_lock();
 786         err = drv->ops->get_key(&drv->wiphy, dev, key_idx, mac_addr,
 787                                 &cookie, get_key_callback);
 788         rtnl_unlock();
 789
 790         if (err)
 791                 goto out;
 792
 793         if (cookie.error)
 794                 goto nla_put_failure;
 795
 796         genlmsg_end(msg, hdr);
 797         err = genlmsg_unicast(msg, info->snd_pid);
 798         goto out;
 799
 800  nla_put_failure:
 801         err = -ENOBUFS;
 802         nlmsg_free(msg);
 803  out:
 804         cfg80211_put_dev(drv);
 805         dev_put(dev);
 806         return err;
 807 }
 808
 809 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
 810 {
 811         struct cfg80211_registered_device *drv;
 812         int err;
 813         struct net_device *dev;
 814         u8 key_idx;
 815         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
 816                     u8 key_index);
 817
 818         if (!info->attrs[NL80211_ATTR_KEY_IDX])
 819                 return -EINVAL;
 820
 821         key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 822
 823         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]) {
 824                 if (key_idx < 4 || key_idx > 5)
 825                         return -EINVAL;
 826         } else if (key_idx > 3)
 827                 return -EINVAL;
 828
 829         /* currently only support setting default key */
 830         if (!info->attrs[NL80211_ATTR_KEY_DEFAULT] &&
 831             !info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT])
 832                 return -EINVAL;
 833
 834         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 835         if (err)
 836                 return err;
 837
 838         if (info->attrs[NL80211_ATTR_KEY_DEFAULT])
 839                 func = drv->ops->set_default_key;
 840         else
 841                 func = drv->ops->set_default_mgmt_key;
 842
 843         if (!func) {
 844                 err = -EOPNOTSUPP;
 845                 goto out;
 846         }
 847
 848         rtnl_lock();
 849         err = func(&drv->wiphy, dev, key_idx);
 850         rtnl_unlock();
 851
 852  out:
 853         cfg80211_put_dev(drv);
 854         dev_put(dev);
 855         return err;
 856 }
 857
 858 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
 859 {
 860         struct cfg80211_registered_device *drv;
 861         int err;
 862         struct net_device *dev;
 863         struct key_params params;
 864         u8 key_idx = 0;
 865         u8 *mac_addr = NULL;
 866
 867         memset(&params, 0, sizeof(params));
 868
 869         if (!info->attrs[NL80211_ATTR_KEY_CIPHER])
 870                 return -EINVAL;
 871
 872         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 873                 params.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 874                 params.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 875         }
 876
 877         if (info->attrs[NL80211_ATTR_KEY_IDX])
 878                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 879
 880         params.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 881
 882         if (info->attrs[NL80211_ATTR_MAC])
 883                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 884
 885         if (key_idx > 5)
 886                 return -EINVAL;
 887
 888         /*
 889          * Disallow pairwise keys with non-zero index unless it's WEP
 890          * (because current deployments use pairwise WEP keys with
 891          * non-zero indizes but 802.11i clearly specifies to use zero)
 892          */
 893         if (mac_addr && key_idx &&
 894             params.cipher != WLAN_CIPHER_SUITE_WEP40 &&
 895             params.cipher != WLAN_CIPHER_SUITE_WEP104)
 896                 return -EINVAL;
 897
 898         /* TODO: add definitions for the lengths to linux/ieee80211.h */
 899         switch (params.cipher) {
 900         case WLAN_CIPHER_SUITE_WEP40:
 901                 if (params.key_len != 5)
 902                         return -EINVAL;
 903                 break;
 904         case WLAN_CIPHER_SUITE_TKIP:
 905                 if (params.key_len != 32)
 906                         return -EINVAL;
 907                 break;
 908         case WLAN_CIPHER_SUITE_CCMP:
 909                 if (params.key_len != 16)
 910                         return -EINVAL;
 911                 break;
 912         case WLAN_CIPHER_SUITE_WEP104:
 913                 if (params.key_len != 13)
 914                         return -EINVAL;
 915                 break;
 916         case WLAN_CIPHER_SUITE_AES_CMAC:
 917                 if (params.key_len != 16)
 918                         return -EINVAL;
 919                 break;
 920         default:
 921                 return -EINVAL;
 922         }
 923
 924         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 925         if (err)
 926                 return err;
 927
 928         if (!drv->ops->add_key) {
 929                 err = -EOPNOTSUPP;
 930                 goto out;
 931         }
 932
 933         rtnl_lock();
 934         err = drv->ops->add_key(&drv->wiphy, dev, key_idx, mac_addr, &params);
 935         rtnl_unlock();
 936
 937  out:
 938         cfg80211_put_dev(drv);
 939         dev_put(dev);
 940         return err;
 941 }
 942
 943 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
 944 {
 945         struct cfg80211_registered_device *drv;
 946         int err;
 947         struct net_device *dev;
 948         u8 key_idx = 0;
 949         u8 *mac_addr = NULL;
 950
 951         if (info->attrs[NL80211_ATTR_KEY_IDX])
 952                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 953
 954         if (key_idx > 5)
 955                 return -EINVAL;
 956
 957         if (info->attrs[NL80211_ATTR_MAC])
 958                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 959
 960         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 961         if (err)
 962                 return err;
 963
 964         if (!drv->ops->del_key) {
 965                 err = -EOPNOTSUPP;
 966                 goto out;
 967         }
 968
 969         rtnl_lock();
 970         err = drv->ops->del_key(&drv->wiphy, dev, key_idx, mac_addr);
 971         rtnl_unlock();
 972
 973  out:
 974         cfg80211_put_dev(drv);
 975         dev_put(dev);
 976         return err;
 977 }
 978
 979 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
 980 {
 981         int (*call)(struct wiphy *wiphy, struct net_device *dev,
 982                     struct beacon_parameters *info);
 983         struct cfg80211_registered_device *drv;
 984         int err;
 985         struct net_device *dev;
 986         struct beacon_parameters params;
 987         int haveinfo = 0;
 988
 989         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 990         if (err)
 991                 return err;
 992
 993         switch (info->genlhdr->cmd) {
 994         case NL80211_CMD_NEW_BEACON:
 995                 /* these are required for NEW_BEACON */
 996                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
 997                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
 998                     !info->attrs[NL80211_ATTR_BEACON_HEAD]) {
 999                         err = -EINVAL;
1000                         goto out;
1001                 }
1002
1003                 call = drv->ops->add_beacon;
1004                 break;
1005         case NL80211_CMD_SET_BEACON:
1006                 call = drv->ops->set_beacon;
1007                 break;
1008         default:
1009                 WARN_ON(1);
1010                 err = -EOPNOTSUPP;
1011                 goto out;
1012         }
1013
1014         if (!call) {
1015                 err = -EOPNOTSUPP;
1016                 goto out;
1017         }
1018
1019         memset(&params, 0, sizeof(params));
1020
1021         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1022                 params.interval =
1023                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1024                 haveinfo = 1;
1025         }
1026
1027         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1028                 params.dtim_period =
1029                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1030                 haveinfo = 1;
1031         }
1032
1033         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1034                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1035                 params.head_len =
1036                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1037                 haveinfo = 1;
1038         }
1039
1040         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1041                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1042                 params.tail_len =
1043                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1044                 haveinfo = 1;
1045         }
1046
1047         if (!haveinfo) {
1048                 err = -EINVAL;
1049                 goto out;
1050         }
1051
1052         rtnl_lock();
1053         err = call(&drv->wiphy, dev, &params);
1054         rtnl_unlock();
1055
1056  out:
1057         cfg80211_put_dev(drv);
1058         dev_put(dev);
1059         return err;
1060 }
1061
1062 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1063 {
1064         struct cfg80211_registered_device *drv;
1065         int err;
1066         struct net_device *dev;
1067
1068         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1069         if (err)
1070                 return err;
1071
1072         if (!drv->ops->del_beacon) {
1073                 err = -EOPNOTSUPP;
1074                 goto out;
1075         }
1076
1077         rtnl_lock();
1078         err = drv->ops->del_beacon(&drv->wiphy, dev);
1079         rtnl_unlock();
1080
1081  out:
1082         cfg80211_put_dev(drv);
1083         dev_put(dev);
1084         return err;
1085 }
1086
1087 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1088         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1089         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1090         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1091 };
1092
1093 static int parse_station_flags(struct nlattr *nla, u32 *staflags)
1094 {
1095         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1096         int flag;
1097
1098         *staflags = 0;
1099
1100         if (!nla)
1101                 return 0;
1102
1103         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1104                              nla, sta_flags_policy))
1105                 return -EINVAL;
1106
1107         *staflags = STATION_FLAG_CHANGED;
1108
1109         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1110                 if (flags[flag])
1111                         *staflags |= (1<<flag);
1112
1113         return 0;
1114 }
1115
1116 static u16 nl80211_calculate_bitrate(struct rate_info *rate)
1117 {
1118         int modulation, streams, bitrate;
1119
1120         if (!(rate->flags & RATE_INFO_FLAGS_MCS))
1121                 return rate->legacy;
1122
1123         /* the formula below does only work for MCS values smaller than 32 */
1124         if (rate->mcs >= 32)
1125                 return 0;
1126
1127         modulation = rate->mcs & 7;
1128         streams = (rate->mcs >> 3) + 1;
1129
1130         bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
1131                         13500000 : 6500000;
1132
1133         if (modulation < 4)
1134                 bitrate *= (modulation + 1);
1135         else if (modulation == 4)
1136                 bitrate *= (modulation + 2);
1137         else
1138                 bitrate *= (modulation + 3);
1139
1140         bitrate *= streams;
1141
1142         if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
1143                 bitrate = (bitrate / 9) * 10;
1144
1145         /* do NOT round down here */
1146         return (bitrate + 50000) / 100000;
1147 }
1148
1149 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1150                                 int flags, struct net_device *dev,
1151                                 u8 *mac_addr, struct station_info *sinfo)
1152 {
1153         void *hdr;
1154         struct nlattr *sinfoattr, *txrate;
1155         u16 bitrate;
1156
1157         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1158         if (!hdr)
1159                 return -1;
1160
1161         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1162         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1163
1164         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1165         if (!sinfoattr)
1166                 goto nla_put_failure;
1167         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1168                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1169                             sinfo->inactive_time);
1170         if (sinfo->filled & STATION_INFO_RX_BYTES)
1171                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1172                             sinfo->rx_bytes);
1173         if (sinfo->filled & STATION_INFO_TX_BYTES)
1174                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1175                             sinfo->tx_bytes);
1176         if (sinfo->filled & STATION_INFO_LLID)
1177                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1178                             sinfo->llid);
1179         if (sinfo->filled & STATION_INFO_PLID)
1180                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1181                             sinfo->plid);
1182         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1183                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1184                             sinfo->plink_state);
1185         if (sinfo->filled & STATION_INFO_SIGNAL)
1186                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1187                            sinfo->signal);
1188         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1189                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1190                 if (!txrate)
1191                         goto nla_put_failure;
1192
1193                 /* nl80211_calculate_bitrate will return 0 for mcs >= 32 */
1194                 bitrate = nl80211_calculate_bitrate(&sinfo->txrate);
1195                 if (bitrate > 0)
1196                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1197
1198                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1199                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1200                                     sinfo->txrate.mcs);
1201                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1202                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1203                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1204                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1205
1206                 nla_nest_end(msg, txrate);
1207         }
1208         if (sinfo->filled & STATION_INFO_RX_PACKETS)
1209                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
1210                             sinfo->rx_packets);
1211         if (sinfo->filled & STATION_INFO_TX_PACKETS)
1212                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
1213                             sinfo->tx_packets);
1214         nla_nest_end(msg, sinfoattr);
1215
1216         return genlmsg_end(msg, hdr);
1217
1218  nla_put_failure:
1219         genlmsg_cancel(msg, hdr);
1220         return -EMSGSIZE;
1221 }
1222
1223 static int nl80211_dump_station(struct sk_buff *skb,
1224                                 struct netlink_callback *cb)
1225 {
1226         struct station_info sinfo;
1227         struct cfg80211_registered_device *dev;
1228         struct net_device *netdev;
1229         u8 mac_addr[ETH_ALEN];
1230         int ifidx = cb->args[0];
1231         int sta_idx = cb->args[1];
1232         int err;
1233
1234         if (!ifidx) {
1235                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1236                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1237                                   nl80211_policy);
1238                 if (err)
1239                         return err;
1240
1241                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1242                         return -EINVAL;
1243
1244                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1245                 if (!ifidx)
1246                         return -EINVAL;
1247         }
1248
1249         netdev = dev_get_by_index(&init_net, ifidx);
1250         if (!netdev)
1251                 return -ENODEV;
1252
1253         dev = cfg80211_get_dev_from_ifindex(ifidx);
1254         if (IS_ERR(dev)) {
1255                 err = PTR_ERR(dev);
1256                 goto out_put_netdev;
1257         }
1258
1259         if (!dev->ops->dump_station) {
1260                 err = -ENOSYS;
1261                 goto out_err;
1262         }
1263
1264         rtnl_lock();
1265
1266         while (1) {
1267                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1268                                              mac_addr, &sinfo);
1269                 if (err == -ENOENT)
1270                         break;
1271                 if (err)
1272                         goto out_err_rtnl;
1273
1274                 if (nl80211_send_station(skb,
1275                                 NETLINK_CB(cb->skb).pid,
1276                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
1277                                 netdev, mac_addr,
1278                                 &sinfo) < 0)
1279                         goto out;
1280
1281                 sta_idx++;
1282         }
1283
1284
1285  out:
1286         cb->args[1] = sta_idx;
1287         err = skb->len;
1288  out_err_rtnl:
1289         rtnl_unlock();
1290  out_err:
1291         cfg80211_put_dev(dev);
1292  out_put_netdev:
1293         dev_put(netdev);
1294
1295         return err;
1296 }
1297
1298 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1299 {
1300         struct cfg80211_registered_device *drv;
1301         int err;
1302         struct net_device *dev;
1303         struct station_info sinfo;
1304         struct sk_buff *msg;
1305         u8 *mac_addr = NULL;
1306
1307         memset(&sinfo, 0, sizeof(sinfo));
1308
1309         if (!info->attrs[NL80211_ATTR_MAC])
1310                 return -EINVAL;
1311
1312         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1313
1314         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1315         if (err)
1316                 return err;
1317
1318         if (!drv->ops->get_station) {
1319                 err = -EOPNOTSUPP;
1320                 goto out;
1321         }
1322
1323         rtnl_lock();
1324         err = drv->ops->get_station(&drv->wiphy, dev, mac_addr, &sinfo);
1325         rtnl_unlock();
1326
1327         if (err)
1328                 goto out;
1329
1330         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1331         if (!msg)
1332                 goto out;
1333
1334         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1335                                  dev, mac_addr, &sinfo) < 0)
1336                 goto out_free;
1337
1338         err = genlmsg_unicast(msg, info->snd_pid);
1339         goto out;
1340
1341  out_free:
1342         nlmsg_free(msg);
1343
1344  out:
1345         cfg80211_put_dev(drv);
1346         dev_put(dev);
1347         return err;
1348 }
1349
1350 /*
1351  * Get vlan interface making sure it is on the right wiphy.
1352  */
1353 static int get_vlan(struct nlattr *vlanattr,
1354                     struct cfg80211_registered_device *rdev,
1355                     struct net_device **vlan)
1356 {
1357         *vlan = NULL;
1358
1359         if (vlanattr) {
1360                 *vlan = dev_get_by_index(&init_net, nla_get_u32(vlanattr));
1361                 if (!*vlan)
1362                         return -ENODEV;
1363                 if (!(*vlan)->ieee80211_ptr)
1364                         return -EINVAL;
1365                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
1366                         return -EINVAL;
1367         }
1368         return 0;
1369 }
1370
1371 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
1372 {
1373         struct cfg80211_registered_device *drv;
1374         int err;
1375         struct net_device *dev;
1376         struct station_parameters params;
1377         u8 *mac_addr = NULL;
1378
1379         memset(&params, 0, sizeof(params));
1380
1381         params.listen_interval = -1;
1382
1383         if (info->attrs[NL80211_ATTR_STA_AID])
1384                 return -EINVAL;
1385
1386         if (!info->attrs[NL80211_ATTR_MAC])
1387                 return -EINVAL;
1388
1389         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1390
1391         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
1392                 params.supported_rates =
1393                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1394                 params.supported_rates_len =
1395                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1396         }
1397
1398         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1399                 params.listen_interval =
1400                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1401
1402         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1403                 params.ht_capa =
1404                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1405
1406         if (parse_station_flags(info->attrs[NL80211_ATTR_STA_FLAGS],
1407                                 &params.station_flags))
1408                 return -EINVAL;
1409
1410         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
1411                 params.plink_action =
1412                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
1413
1414         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1415         if (err)
1416                 return err;
1417
1418         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1419         if (err)
1420                 goto out;
1421
1422         if (!drv->ops->change_station) {
1423                 err = -EOPNOTSUPP;
1424                 goto out;
1425         }
1426
1427         rtnl_lock();
1428         err = drv->ops->change_station(&drv->wiphy, dev, mac_addr, &params);
1429         rtnl_unlock();
1430
1431  out:
1432         if (params.vlan)
1433                 dev_put(params.vlan);
1434         cfg80211_put_dev(drv);
1435         dev_put(dev);
1436         return err;
1437 }
1438
1439 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
1440 {
1441         struct cfg80211_registered_device *drv;
1442         int err;
1443         struct net_device *dev;
1444         struct station_parameters params;
1445         u8 *mac_addr = NULL;
1446
1447         memset(&params, 0, sizeof(params));
1448
1449         if (!info->attrs[NL80211_ATTR_MAC])
1450                 return -EINVAL;
1451
1452         if (!info->attrs[NL80211_ATTR_STA_AID])
1453                 return -EINVAL;
1454
1455         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1456                 return -EINVAL;
1457
1458         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
1459                 return -EINVAL;
1460
1461         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1462         params.supported_rates =
1463                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1464         params.supported_rates_len =
1465                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1466         params.listen_interval =
1467                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1468         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
1469         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1470                 params.ht_capa =
1471                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1472
1473         if (parse_station_flags(info->attrs[NL80211_ATTR_STA_FLAGS],
1474                                 &params.station_flags))
1475                 return -EINVAL;
1476
1477         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1478         if (err)
1479                 return err;
1480
1481         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1482         if (err)
1483                 goto out;
1484
1485         if (!drv->ops->add_station) {
1486                 err = -EOPNOTSUPP;
1487                 goto out;
1488         }
1489
1490         rtnl_lock();
1491         err = drv->ops->add_station(&drv->wiphy, dev, mac_addr, &params);
1492         rtnl_unlock();
1493
1494  out:
1495         if (params.vlan)
1496                 dev_put(params.vlan);
1497         cfg80211_put_dev(drv);
1498         dev_put(dev);
1499         return err;
1500 }
1501
1502 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
1503 {
1504         struct cfg80211_registered_device *drv;
1505         int err;
1506         struct net_device *dev;
1507         u8 *mac_addr = NULL;
1508
1509         if (info->attrs[NL80211_ATTR_MAC])
1510                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1511
1512         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1513         if (err)
1514                 return err;
1515
1516         if (!drv->ops->del_station) {
1517                 err = -EOPNOTSUPP;
1518                 goto out;
1519         }
1520
1521         rtnl_lock();
1522         err = drv->ops->del_station(&drv->wiphy, dev, mac_addr);
1523         rtnl_unlock();
1524
1525  out:
1526         cfg80211_put_dev(drv);
1527         dev_put(dev);
1528         return err;
1529 }
1530
1531 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
1532                                 int flags, struct net_device *dev,
1533                                 u8 *dst, u8 *next_hop,
1534                                 struct mpath_info *pinfo)
1535 {
1536         void *hdr;
1537         struct nlattr *pinfoattr;
1538
1539         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1540         if (!hdr)
1541                 return -1;
1542
1543         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1544         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
1545         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
1546
1547         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
1548         if (!pinfoattr)
1549                 goto nla_put_failure;
1550         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
1551                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
1552                             pinfo->frame_qlen);
1553         if (pinfo->filled & MPATH_INFO_DSN)
1554                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DSN,
1555                             pinfo->dsn);
1556         if (pinfo->filled & MPATH_INFO_METRIC)
1557                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
1558                             pinfo->metric);
1559         if (pinfo->filled & MPATH_INFO_EXPTIME)
1560                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
1561                             pinfo->exptime);
1562         if (pinfo->filled & MPATH_INFO_FLAGS)
1563                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
1564                             pinfo->flags);
1565         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
1566                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
1567                             pinfo->discovery_timeout);
1568         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
1569                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
1570                             pinfo->discovery_retries);
1571
1572         nla_nest_end(msg, pinfoattr);
1573
1574         return genlmsg_end(msg, hdr);
1575
1576  nla_put_failure:
1577         genlmsg_cancel(msg, hdr);
1578         return -EMSGSIZE;
1579 }
1580
1581 static int nl80211_dump_mpath(struct sk_buff *skb,
1582                               struct netlink_callback *cb)
1583 {
1584         struct mpath_info pinfo;
1585         struct cfg80211_registered_device *dev;
1586         struct net_device *netdev;
1587         u8 dst[ETH_ALEN];
1588         u8 next_hop[ETH_ALEN];
1589         int ifidx = cb->args[0];
1590         int path_idx = cb->args[1];
1591         int err;
1592
1593         if (!ifidx) {
1594                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1595                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1596                                   nl80211_policy);
1597                 if (err)
1598                         return err;
1599
1600                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1601                         return -EINVAL;
1602
1603                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1604                 if (!ifidx)
1605                         return -EINVAL;
1606         }
1607
1608         netdev = dev_get_by_index(&init_net, ifidx);
1609         if (!netdev)
1610                 return -ENODEV;
1611
1612         dev = cfg80211_get_dev_from_ifindex(ifidx);
1613         if (IS_ERR(dev)) {
1614                 err = PTR_ERR(dev);
1615                 goto out_put_netdev;
1616         }
1617
1618         if (!dev->ops->dump_mpath) {
1619                 err = -ENOSYS;
1620                 goto out_err;
1621         }
1622
1623         rtnl_lock();
1624
1625         while (1) {
1626                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
1627                                            dst, next_hop, &pinfo);
1628                 if (err == -ENOENT)
1629                         break;
1630                 if (err)
1631                         goto out_err_rtnl;
1632
1633                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
1634                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
1635                                        netdev, dst, next_hop,
1636                                        &pinfo) < 0)
1637                         goto out;
1638
1639                 path_idx++;
1640         }
1641
1642
1643  out:
1644         cb->args[1] = path_idx;
1645         err = skb->len;
1646  out_err_rtnl:
1647         rtnl_unlock();
1648  out_err:
1649         cfg80211_put_dev(dev);
1650  out_put_netdev:
1651         dev_put(netdev);
1652
1653         return err;
1654 }
1655
1656 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
1657 {
1658         struct cfg80211_registered_device *drv;
1659         int err;
1660         struct net_device *dev;
1661         struct mpath_info pinfo;
1662         struct sk_buff *msg;
1663         u8 *dst = NULL;
1664         u8 next_hop[ETH_ALEN];
1665
1666         memset(&pinfo, 0, sizeof(pinfo));
1667
1668         if (!info->attrs[NL80211_ATTR_MAC])
1669                 return -EINVAL;
1670
1671         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1672
1673         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1674         if (err)
1675                 return err;
1676
1677         if (!drv->ops->get_mpath) {
1678                 err = -EOPNOTSUPP;
1679                 goto out;
1680         }
1681
1682         rtnl_lock();
1683         err = drv->ops->get_mpath(&drv->wiphy, dev, dst, next_hop, &pinfo);
1684         rtnl_unlock();
1685
1686         if (err)
1687                 goto out;
1688
1689         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1690         if (!msg)
1691                 goto out;
1692
1693         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
1694                                  dev, dst, next_hop, &pinfo) < 0)
1695                 goto out_free;
1696
1697         err = genlmsg_unicast(msg, info->snd_pid);
1698         goto out;
1699
1700  out_free:
1701         nlmsg_free(msg);
1702
1703  out:
1704         cfg80211_put_dev(drv);
1705         dev_put(dev);
1706         return err;
1707 }
1708
1709 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
1710 {
1711         struct cfg80211_registered_device *drv;
1712         int err;
1713         struct net_device *dev;
1714         u8 *dst = NULL;
1715         u8 *next_hop = NULL;
1716
1717         if (!info->attrs[NL80211_ATTR_MAC])
1718                 return -EINVAL;
1719
1720         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
1721                 return -EINVAL;
1722
1723         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1724         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
1725
1726         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1727         if (err)
1728                 return err;
1729
1730         if (!drv->ops->change_mpath) {
1731                 err = -EOPNOTSUPP;
1732                 goto out;
1733         }
1734
1735         rtnl_lock();
1736         err = drv->ops->change_mpath(&drv->wiphy, dev, dst, next_hop);
1737         rtnl_unlock();
1738
1739  out:
1740         cfg80211_put_dev(drv);
1741         dev_put(dev);
1742         return err;
1743 }
1744 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
1745 {
1746         struct cfg80211_registered_device *drv;
1747         int err;
1748         struct net_device *dev;
1749         u8 *dst = NULL;
1750         u8 *next_hop = NULL;
1751
1752         if (!info->attrs[NL80211_ATTR_MAC])
1753                 return -EINVAL;
1754
1755         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
1756                 return -EINVAL;
1757
1758         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1759         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
1760
1761         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1762         if (err)
1763                 return err;
1764
1765         if (!drv->ops->add_mpath) {
1766                 err = -EOPNOTSUPP;
1767                 goto out;
1768         }
1769
1770         rtnl_lock();
1771         err = drv->ops->add_mpath(&drv->wiphy, dev, dst, next_hop);
1772         rtnl_unlock();
1773
1774  out:
1775         cfg80211_put_dev(drv);
1776         dev_put(dev);
1777         return err;
1778 }
1779
1780 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
1781 {
1782         struct cfg80211_registered_device *drv;
1783         int err;
1784         struct net_device *dev;
1785         u8 *dst = NULL;
1786
1787         if (info->attrs[NL80211_ATTR_MAC])
1788                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1789
1790         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1791         if (err)
1792                 return err;
1793
1794         if (!drv->ops->del_mpath) {
1795                 err = -EOPNOTSUPP;
1796                 goto out;
1797         }
1798
1799         rtnl_lock();
1800         err = drv->ops->del_mpath(&drv->wiphy, dev, dst);
1801         rtnl_unlock();
1802
1803  out:
1804         cfg80211_put_dev(drv);
1805         dev_put(dev);
1806         return err;
1807 }
1808
1809 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
1810 {
1811         struct cfg80211_registered_device *drv;
1812         int err;
1813         struct net_device *dev;
1814         struct bss_parameters params;
1815
1816         memset(&params, 0, sizeof(params));
1817         /* default to not changing parameters */
1818         params.use_cts_prot = -1;
1819         params.use_short_preamble = -1;
1820         params.use_short_slot_time = -1;
1821
1822         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
1823                 params.use_cts_prot =
1824                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
1825         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
1826                 params.use_short_preamble =
1827                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
1828         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
1829                 params.use_short_slot_time =
1830                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
1831         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
1832                 params.basic_rates =
1833                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
1834                 params.basic_rates_len =
1835                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
1836         }
1837
1838         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1839         if (err)
1840                 return err;
1841
1842         if (!drv->ops->change_bss) {
1843                 err = -EOPNOTSUPP;
1844                 goto out;
1845         }
1846
1847         rtnl_lock();
1848         err = drv->ops->change_bss(&drv->wiphy, dev, &params);
1849         rtnl_unlock();
1850
1851  out:
1852         cfg80211_put_dev(drv);
1853         dev_put(dev);
1854         return err;
1855 }
1856
1857 static const struct nla_policy
1858         reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
1859         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
1860         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
1861         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
1862         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
1863         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
1864         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
1865 };
1866
1867 static int parse_reg_rule(struct nlattr *tb[],
1868         struct ieee80211_reg_rule *reg_rule)
1869 {
1870         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
1871         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
1872
1873         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
1874                 return -EINVAL;
1875         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
1876                 return -EINVAL;
1877         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
1878                 return -EINVAL;
1879         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
1880                 return -EINVAL;
1881         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
1882                 return -EINVAL;
1883
1884         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
1885
1886         freq_range->start_freq_khz =
1887                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
1888         freq_range->end_freq_khz =
1889                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
1890         freq_range->max_bandwidth_khz =
1891                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
1892
1893         power_rule->max_eirp =
1894                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
1895
1896         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
1897                 power_rule->max_antenna_gain =
1898                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
1899
1900         return 0;
1901 }
1902
1903 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
1904 {
1905         int r;
1906         char *data = NULL;
1907
1908         /*
1909          * You should only get this when cfg80211 hasn't yet initialized
1910          * completely when built-in to the kernel right between the time
1911          * window between nl80211_init() and regulatory_init(), if that is
1912          * even possible.
1913          */
1914         mutex_lock(&cfg80211_mutex);
1915         if (unlikely(!cfg80211_regdomain)) {
1916                 mutex_unlock(&cfg80211_mutex);
1917                 return -EINPROGRESS;
1918         }
1919         mutex_unlock(&cfg80211_mutex);
1920
1921         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
1922                 return -EINVAL;
1923
1924         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
1925
1926 #ifdef CONFIG_WIRELESS_OLD_REGULATORY
1927         /* We ignore world regdom requests with the old regdom setup */
1928         if (is_world_regdom(data))
1929                 return -EINVAL;
1930 #endif
1931
1932         r = regulatory_hint_user(data);
1933
1934         return r;
1935 }
1936
1937 static int nl80211_get_mesh_params(struct sk_buff *skb,
1938         struct genl_info *info)
1939 {
1940         struct cfg80211_registered_device *drv;
1941         struct mesh_config cur_params;
1942         int err;
1943         struct net_device *dev;
1944         void *hdr;
1945         struct nlattr *pinfoattr;
1946         struct sk_buff *msg;
1947
1948         /* Look up our device */
1949         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1950         if (err)
1951                 return err;
1952
1953         if (!drv->ops->get_mesh_params) {
1954                 err = -EOPNOTSUPP;
1955                 goto out;
1956         }
1957
1958         /* Get the mesh params */
1959         rtnl_lock();
1960         err = drv->ops->get_mesh_params(&drv->wiphy, dev, &cur_params);
1961         rtnl_unlock();
1962         if (err)
1963                 goto out;
1964
1965         /* Draw up a netlink message to send back */
1966         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1967         if (!msg) {
1968                 err = -ENOBUFS;
1969                 goto out;
1970         }
1971         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
1972                              NL80211_CMD_GET_MESH_PARAMS);
1973         if (!hdr)
1974                 goto nla_put_failure;
1975         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
1976         if (!pinfoattr)
1977                 goto nla_put_failure;
1978         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1979         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
1980                         cur_params.dot11MeshRetryTimeout);
1981         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
1982                         cur_params.dot11MeshConfirmTimeout);
1983         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
1984                         cur_params.dot11MeshHoldingTimeout);
1985         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
1986                         cur_params.dot11MeshMaxPeerLinks);
1987         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
1988                         cur_params.dot11MeshMaxRetries);
1989         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
1990                         cur_params.dot11MeshTTL);
1991         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
1992                         cur_params.auto_open_plinks);
1993         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
1994                         cur_params.dot11MeshHWMPmaxPREQretries);
1995         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
1996                         cur_params.path_refresh_time);
1997         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
1998                         cur_params.min_discovery_timeout);
1999         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2000                         cur_params.dot11MeshHWMPactivePathTimeout);
2001         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2002                         cur_params.dot11MeshHWMPpreqMinInterval);
2003         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2004                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2005         nla_nest_end(msg, pinfoattr);
2006         genlmsg_end(msg, hdr);
2007         err = genlmsg_unicast(msg, info->snd_pid);
2008         goto out;
2009
2010 nla_put_failure:
2011         genlmsg_cancel(msg, hdr);
2012         err = -EMSGSIZE;
2013 out:
2014         /* Cleanup */
2015         cfg80211_put_dev(drv);
2016         dev_put(dev);
2017         return err;
2018 }
2019
2020 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2021 do {\
2022         if (table[attr_num]) {\
2023                 cfg.param = nla_fn(table[attr_num]); \
2024                 mask |= (1 << (attr_num - 1)); \
2025         } \
2026 } while (0);\
2027
2028 static struct nla_policy
2029 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] __read_mostly = {
2030         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2031         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2032         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2033         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2034         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2035         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2036         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2037
2038         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2039         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2040         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2041         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2042         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2043         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2044 };
2045
2046 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2047 {
2048         int err;
2049         u32 mask;
2050         struct cfg80211_registered_device *drv;
2051         struct net_device *dev;
2052         struct mesh_config cfg;
2053         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2054         struct nlattr *parent_attr;
2055
2056         parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
2057         if (!parent_attr)
2058                 return -EINVAL;
2059         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2060                         parent_attr, nl80211_meshconf_params_policy))
2061                 return -EINVAL;
2062
2063         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2064         if (err)
2065                 return err;
2066
2067         if (!drv->ops->set_mesh_params) {
2068                 err = -EOPNOTSUPP;
2069                 goto out;
2070         }
2071
2072         /* This makes sure that there aren't more than 32 mesh config
2073          * parameters (otherwise our bitfield scheme would not work.) */
2074         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2075
2076         /* Fill in the params struct */
2077         mask = 0;
2078         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2079                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2080         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2081                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2082         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2083                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2084         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2085                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2086         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2087                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2088         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2089                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2090         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2091                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2092         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2093                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2094                         nla_get_u8);
2095         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2096                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2097         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2098                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2099                         nla_get_u16);
2100         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2101                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2102                         nla_get_u32);
2103         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2104                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2105                         nla_get_u16);
2106         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2107                         dot11MeshHWMPnetDiameterTraversalTime,
2108                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2109                         nla_get_u16);
2110
2111         /* Apply changes */
2112         rtnl_lock();
2113         err = drv->ops->set_mesh_params(&drv->wiphy, dev, &cfg, mask);
2114         rtnl_unlock();
2115
2116  out:
2117         /* cleanup */
2118         cfg80211_put_dev(drv);
2119         dev_put(dev);
2120         return err;
2121 }
2122
2123 #undef FILL_IN_MESH_PARAM_IF_SET
2124
2125 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2126 {
2127         struct sk_buff *msg;
2128         void *hdr = NULL;
2129         struct nlattr *nl_reg_rules;
2130         unsigned int i;
2131         int err = -EINVAL;
2132
2133         mutex_lock(&cfg80211_mutex);
2134
2135         if (!cfg80211_regdomain)
2136                 goto out;
2137
2138         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2139         if (!msg) {
2140                 err = -ENOBUFS;
2141                 goto out;
2142         }
2143
2144         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2145                              NL80211_CMD_GET_REG);
2146         if (!hdr)
2147                 goto nla_put_failure;
2148
2149         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2150                 cfg80211_regdomain->alpha2);
2151
2152         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2153         if (!nl_reg_rules)
2154                 goto nla_put_failure;
2155
2156         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2157                 struct nlattr *nl_reg_rule;
2158                 const struct ieee80211_reg_rule *reg_rule;
2159                 const struct ieee80211_freq_range *freq_range;
2160                 const struct ieee80211_power_rule *power_rule;
2161
2162                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2163                 freq_range = &reg_rule->freq_range;
2164                 power_rule = &reg_rule->power_rule;
2165
2166                 nl_reg_rule = nla_nest_start(msg, i);
2167                 if (!nl_reg_rule)
2168                         goto nla_put_failure;
2169
2170                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2171                         reg_rule->flags);
2172                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2173                         freq_range->start_freq_khz);
2174                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2175                         freq_range->end_freq_khz);
2176                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2177                         freq_range->max_bandwidth_khz);
2178                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2179                         power_rule->max_antenna_gain);
2180                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2181                         power_rule->max_eirp);
2182
2183                 nla_nest_end(msg, nl_reg_rule);
2184         }
2185
2186         nla_nest_end(msg, nl_reg_rules);
2187
2188         genlmsg_end(msg, hdr);
2189         err = genlmsg_unicast(msg, info->snd_pid);
2190         goto out;
2191
2192 nla_put_failure:
2193         genlmsg_cancel(msg, hdr);
2194         err = -EMSGSIZE;
2195 out:
2196         mutex_unlock(&cfg80211_mutex);
2197         return err;
2198 }
2199
2200 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2201 {
2202         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2203         struct nlattr *nl_reg_rule;
2204         char *alpha2 = NULL;
2205         int rem_reg_rules = 0, r = 0;
2206         u32 num_rules = 0, rule_idx = 0, size_of_regd;
2207         struct ieee80211_regdomain *rd = NULL;
2208
2209         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2210                 return -EINVAL;
2211
2212         if (!info->attrs[NL80211_ATTR_REG_RULES])
2213                 return -EINVAL;
2214
2215         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2216
2217         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2218                         rem_reg_rules) {
2219                 num_rules++;
2220                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2221                         goto bad_reg;
2222         }
2223
2224         if (!reg_is_valid_request(alpha2))
2225                 return -EINVAL;
2226
2227         size_of_regd = sizeof(struct ieee80211_regdomain) +
2228                 (num_rules * sizeof(struct ieee80211_reg_rule));
2229
2230         rd = kzalloc(size_of_regd, GFP_KERNEL);
2231         if (!rd)
2232                 return -ENOMEM;
2233
2234         rd->n_reg_rules = num_rules;
2235         rd->alpha2[0] = alpha2[0];
2236         rd->alpha2[1] = alpha2[1];
2237
2238         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2239                         rem_reg_rules) {
2240                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2241                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2242                         reg_rule_policy);
2243                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2244                 if (r)
2245                         goto bad_reg;
2246
2247                 rule_idx++;
2248
2249                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES)
2250                         goto bad_reg;
2251         }
2252
2253         BUG_ON(rule_idx != num_rules);
2254
2255         mutex_lock(&cfg80211_mutex);
2256         r = set_regdom(rd);
2257         mutex_unlock(&cfg80211_mutex);
2258         return r;
2259
2260  bad_reg:
2261         kfree(rd);
2262         return -EINVAL;
2263 }
2264
2265 static int nl80211_set_mgmt_extra_ie(struct sk_buff *skb,
2266                                      struct genl_info *info)
2267 {
2268         struct cfg80211_registered_device *drv;
2269         int err;
2270         struct net_device *dev;
2271         struct mgmt_extra_ie_params params;
2272
2273         memset(&params, 0, sizeof(params));
2274
2275         if (!info->attrs[NL80211_ATTR_MGMT_SUBTYPE])
2276                 return -EINVAL;
2277         params.subtype = nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
2278         if (params.subtype > 15)
2279                 return -EINVAL; /* FC Subtype field is 4 bits (0..15) */
2280
2281         if (info->attrs[NL80211_ATTR_IE]) {
2282                 params.ies = nla_data(info->attrs[NL80211_ATTR_IE]);
2283                 params.ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2284         }
2285
2286         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2287         if (err)
2288                 return err;
2289
2290         if (drv->ops->set_mgmt_extra_ie) {
2291                 rtnl_lock();
2292                 err = drv->ops->set_mgmt_extra_ie(&drv->wiphy, dev, &params);
2293                 rtnl_unlock();
2294         } else
2295                 err = -EOPNOTSUPP;
2296
2297         cfg80211_put_dev(drv);
2298         dev_put(dev);
2299         return err;
2300 }
2301
2302 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
2303 {
2304         struct cfg80211_registered_device *drv;
2305         struct net_device *dev;
2306         struct cfg80211_scan_request *request;
2307         struct cfg80211_ssid *ssid;
2308         struct ieee80211_channel *channel;
2309         struct nlattr *attr;
2310         struct wiphy *wiphy;
2311         int err, tmp, n_ssids = 0, n_channels = 0, i;
2312         enum ieee80211_band band;
2313         size_t ie_len;
2314
2315         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2316         if (err)
2317                 return err;
2318
2319         wiphy = &drv->wiphy;
2320
2321         if (!drv->ops->scan) {
2322                 err = -EOPNOTSUPP;
2323                 goto out;
2324         }
2325
2326         rtnl_lock();
2327
2328         if (drv->scan_req) {
2329                 err = -EBUSY;
2330                 goto out_unlock;
2331         }
2332
2333         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2334                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp)
2335                         n_channels++;
2336                 if (!n_channels) {
2337                         err = -EINVAL;
2338                         goto out_unlock;
2339                 }
2340         } else {
2341                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
2342                         if (wiphy->bands[band])
2343                                 n_channels += wiphy->bands[band]->n_channels;
2344         }
2345
2346         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
2347                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
2348                         n_ssids++;
2349
2350         if (n_ssids > wiphy->max_scan_ssids) {
2351                 err = -EINVAL;
2352                 goto out_unlock;
2353         }
2354
2355         if (info->attrs[NL80211_ATTR_IE])
2356                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2357         else
2358                 ie_len = 0;
2359
2360         request = kzalloc(sizeof(*request)
2361                         + sizeof(*ssid) * n_ssids
2362                         + sizeof(channel) * n_channels
2363                         + ie_len, GFP_KERNEL);
2364         if (!request) {
2365                 err = -ENOMEM;
2366                 goto out_unlock;
2367         }
2368
2369         request->channels = (void *)((char *)request + sizeof(*request));
2370         request->n_channels = n_channels;
2371         if (n_ssids)
2372                 request->ssids = (void *)(request->channels + n_channels);
2373         request->n_ssids = n_ssids;
2374         if (ie_len) {
2375                 if (request->ssids)
2376                         request->ie = (void *)(request->ssids + n_ssids);
2377                 else
2378                         request->ie = (void *)(request->channels + n_channels);
2379         }
2380
2381         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2382                 /* user specified, bail out if channel not found */
2383                 request->n_channels = n_channels;
2384                 i = 0;
2385                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
2386                         request->channels[i] = ieee80211_get_channel(wiphy, nla_get_u32(attr));
2387                         if (!request->channels[i]) {
2388                                 err = -EINVAL;
2389                                 goto out_free;
2390                         }
2391                         i++;
2392                 }
2393         } else {
2394                 /* all channels */
2395                 i = 0;
2396                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
2397                         int j;
2398                         if (!wiphy->bands[band])
2399                                 continue;
2400                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
2401                                 request->channels[i] = &wiphy->bands[band]->channels[j];
2402                                 i++;
2403                         }
2404                 }
2405         }
2406
2407         i = 0;
2408         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
2409                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
2410                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
2411                                 err = -EINVAL;
2412                                 goto out_free;
2413                         }
2414                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
2415                         request->ssids[i].ssid_len = nla_len(attr);
2416                         i++;
2417                 }
2418         }
2419
2420         if (info->attrs[NL80211_ATTR_IE]) {
2421                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2422                 memcpy(request->ie, nla_data(info->attrs[NL80211_ATTR_IE]),
2423                        request->ie_len);
2424         }
2425
2426         request->ifidx = dev->ifindex;
2427         request->wiphy = &drv->wiphy;
2428
2429         drv->scan_req = request;
2430         err = drv->ops->scan(&drv->wiphy, dev, request);
2431
2432  out_free:
2433         if (err) {
2434                 drv->scan_req = NULL;
2435                 kfree(request);
2436         }
2437  out_unlock:
2438         rtnl_unlock();
2439  out:
2440         cfg80211_put_dev(drv);
2441         dev_put(dev);
2442         return err;
2443 }
2444
2445 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
2446                             struct cfg80211_registered_device *rdev,
2447                             struct net_device *dev,
2448                             struct cfg80211_bss *res)
2449 {
2450         void *hdr;
2451         struct nlattr *bss;
2452
2453         hdr = nl80211hdr_put(msg, pid, seq, flags,
2454                              NL80211_CMD_NEW_SCAN_RESULTS);
2455         if (!hdr)
2456                 return -1;
2457
2458         NLA_PUT_U32(msg, NL80211_ATTR_SCAN_GENERATION,
2459                     rdev->bss_generation);
2460         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2461
2462         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
2463         if (!bss)
2464                 goto nla_put_failure;
2465         if (!is_zero_ether_addr(res->bssid))
2466                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
2467         if (res->information_elements && res->len_information_elements)
2468                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
2469                         res->len_information_elements,
2470                         res->information_elements);
2471         if (res->tsf)
2472                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
2473         if (res->beacon_interval)
2474                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
2475         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
2476         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
2477
2478         switch (rdev->wiphy.signal_type) {
2479         case CFG80211_SIGNAL_TYPE_MBM:
2480                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
2481                 break;
2482         case CFG80211_SIGNAL_TYPE_UNSPEC:
2483                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
2484                 break;
2485         default:
2486                 break;
2487         }
2488
2489         nla_nest_end(msg, bss);
2490
2491         return genlmsg_end(msg, hdr);
2492
2493  nla_put_failure:
2494         genlmsg_cancel(msg, hdr);
2495         return -EMSGSIZE;
2496 }
2497
2498 static int nl80211_dump_scan(struct sk_buff *skb,
2499                              struct netlink_callback *cb)
2500 {
2501         struct cfg80211_registered_device *dev;
2502         struct net_device *netdev;
2503         struct cfg80211_internal_bss *scan;
2504         int ifidx = cb->args[0];
2505         int start = cb->args[1], idx = 0;
2506         int err;
2507
2508         if (!ifidx) {
2509                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
2510                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
2511                                   nl80211_policy);
2512                 if (err)
2513                         return err;
2514
2515                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
2516                         return -EINVAL;
2517
2518                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
2519                 if (!ifidx)
2520                         return -EINVAL;
2521                 cb->args[0] = ifidx;
2522         }
2523
2524         netdev = dev_get_by_index(&init_net, ifidx);
2525         if (!netdev)
2526                 return -ENODEV;
2527
2528         dev = cfg80211_get_dev_from_ifindex(ifidx);
2529         if (IS_ERR(dev)) {
2530                 err = PTR_ERR(dev);
2531                 goto out_put_netdev;
2532         }
2533
2534         spin_lock_bh(&dev->bss_lock);
2535         cfg80211_bss_expire(dev);
2536
2537         list_for_each_entry(scan, &dev->bss_list, list) {
2538                 if (++idx <= start)
2539                         continue;
2540                 if (nl80211_send_bss(skb,
2541                                 NETLINK_CB(cb->skb).pid,
2542                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2543                                 dev, netdev, &scan->pub) < 0) {
2544                         idx--;
2545                         goto out;
2546                 }
2547         }
2548
2549  out:
2550         spin_unlock_bh(&dev->bss_lock);
2551
2552         cb->args[1] = idx;
2553         err = skb->len;
2554         cfg80211_put_dev(dev);
2555  out_put_netdev:
2556         dev_put(netdev);
2557
2558         return err;
2559 }
2560
2561 static struct genl_ops nl80211_ops[] = {
2562         {
2563                 .cmd = NL80211_CMD_GET_WIPHY,
2564                 .doit = nl80211_get_wiphy,
2565                 .dumpit = nl80211_dump_wiphy,
2566                 .policy = nl80211_policy,
2567                 /* can be retrieved by unprivileged users */
2568         },
2569         {
2570                 .cmd = NL80211_CMD_SET_WIPHY,
2571                 .doit = nl80211_set_wiphy,
2572                 .policy = nl80211_policy,
2573                 .flags = GENL_ADMIN_PERM,
2574         },
2575         {
2576                 .cmd = NL80211_CMD_GET_INTERFACE,
2577                 .doit = nl80211_get_interface,
2578                 .dumpit = nl80211_dump_interface,
2579                 .policy = nl80211_policy,
2580                 /* can be retrieved by unprivileged users */
2581         },
2582         {
2583                 .cmd = NL80211_CMD_SET_INTERFACE,
2584                 .doit = nl80211_set_interface,
2585                 .policy = nl80211_policy,
2586                 .flags = GENL_ADMIN_PERM,
2587         },
2588         {
2589                 .cmd = NL80211_CMD_NEW_INTERFACE,
2590                 .doit = nl80211_new_interface,
2591                 .policy = nl80211_policy,
2592                 .flags = GENL_ADMIN_PERM,
2593         },
2594         {
2595                 .cmd = NL80211_CMD_DEL_INTERFACE,
2596                 .doit = nl80211_del_interface,
2597                 .policy = nl80211_policy,
2598                 .flags = GENL_ADMIN_PERM,
2599         },
2600         {
2601                 .cmd = NL80211_CMD_GET_KEY,
2602                 .doit = nl80211_get_key,
2603                 .policy = nl80211_policy,
2604                 .flags = GENL_ADMIN_PERM,
2605         },
2606         {
2607                 .cmd = NL80211_CMD_SET_KEY,
2608                 .doit = nl80211_set_key,
2609                 .policy = nl80211_policy,
2610                 .flags = GENL_ADMIN_PERM,
2611         },
2612         {
2613                 .cmd = NL80211_CMD_NEW_KEY,
2614                 .doit = nl80211_new_key,
2615                 .policy = nl80211_policy,
2616                 .flags = GENL_ADMIN_PERM,
2617         },
2618         {
2619                 .cmd = NL80211_CMD_DEL_KEY,
2620                 .doit = nl80211_del_key,
2621                 .policy = nl80211_policy,
2622                 .flags = GENL_ADMIN_PERM,
2623         },
2624         {
2625                 .cmd = NL80211_CMD_SET_BEACON,
2626                 .policy = nl80211_policy,
2627                 .flags = GENL_ADMIN_PERM,
2628                 .doit = nl80211_addset_beacon,
2629         },
2630         {
2631                 .cmd = NL80211_CMD_NEW_BEACON,
2632                 .policy = nl80211_policy,
2633                 .flags = GENL_ADMIN_PERM,
2634                 .doit = nl80211_addset_beacon,
2635         },
2636         {
2637                 .cmd = NL80211_CMD_DEL_BEACON,
2638                 .policy = nl80211_policy,
2639                 .flags = GENL_ADMIN_PERM,
2640                 .doit = nl80211_del_beacon,
2641         },
2642         {
2643                 .cmd = NL80211_CMD_GET_STATION,
2644                 .doit = nl80211_get_station,
2645                 .dumpit = nl80211_dump_station,
2646                 .policy = nl80211_policy,
2647         },
2648         {
2649                 .cmd = NL80211_CMD_SET_STATION,
2650                 .doit = nl80211_set_station,
2651                 .policy = nl80211_policy,
2652                 .flags = GENL_ADMIN_PERM,
2653         },
2654         {
2655                 .cmd = NL80211_CMD_NEW_STATION,
2656                 .doit = nl80211_new_station,
2657                 .policy = nl80211_policy,
2658                 .flags = GENL_ADMIN_PERM,
2659         },
2660         {
2661                 .cmd = NL80211_CMD_DEL_STATION,
2662                 .doit = nl80211_del_station,
2663                 .policy = nl80211_policy,
2664                 .flags = GENL_ADMIN_PERM,
2665         },
2666         {
2667                 .cmd = NL80211_CMD_GET_MPATH,
2668                 .doit = nl80211_get_mpath,
2669                 .dumpit = nl80211_dump_mpath,
2670                 .policy = nl80211_policy,
2671                 .flags = GENL_ADMIN_PERM,
2672         },
2673         {
2674                 .cmd = NL80211_CMD_SET_MPATH,
2675                 .doit = nl80211_set_mpath,
2676                 .policy = nl80211_policy,
2677                 .flags = GENL_ADMIN_PERM,
2678         },
2679         {
2680                 .cmd = NL80211_CMD_NEW_MPATH,
2681                 .doit = nl80211_new_mpath,
2682                 .policy = nl80211_policy,
2683                 .flags = GENL_ADMIN_PERM,
2684         },
2685         {
2686                 .cmd = NL80211_CMD_DEL_MPATH,
2687                 .doit = nl80211_del_mpath,
2688                 .policy = nl80211_policy,
2689                 .flags = GENL_ADMIN_PERM,
2690         },
2691         {
2692                 .cmd = NL80211_CMD_SET_BSS,
2693                 .doit = nl80211_set_bss,
2694                 .policy = nl80211_policy,
2695                 .flags = GENL_ADMIN_PERM,
2696         },
2697         {
2698                 .cmd = NL80211_CMD_GET_REG,
2699                 .doit = nl80211_get_reg,
2700                 .policy = nl80211_policy,
2701                 /* can be retrieved by unprivileged users */
2702         },
2703         {
2704                 .cmd = NL80211_CMD_SET_REG,
2705                 .doit = nl80211_set_reg,
2706                 .policy = nl80211_policy,
2707                 .flags = GENL_ADMIN_PERM,
2708         },
2709         {
2710                 .cmd = NL80211_CMD_REQ_SET_REG,
2711                 .doit = nl80211_req_set_reg,
2712                 .policy = nl80211_policy,
2713                 .flags = GENL_ADMIN_PERM,
2714         },
2715         {
2716                 .cmd = NL80211_CMD_GET_MESH_PARAMS,
2717                 .doit = nl80211_get_mesh_params,
2718                 .policy = nl80211_policy,
2719                 /* can be retrieved by unprivileged users */
2720         },
2721         {
2722                 .cmd = NL80211_CMD_SET_MESH_PARAMS,
2723                 .doit = nl80211_set_mesh_params,
2724                 .policy = nl80211_policy,
2725                 .flags = GENL_ADMIN_PERM,
2726         },
2727         {
2728                 .cmd = NL80211_CMD_SET_MGMT_EXTRA_IE,
2729                 .doit = nl80211_set_mgmt_extra_ie,
2730                 .policy = nl80211_policy,
2731                 .flags = GENL_ADMIN_PERM,
2732         },
2733         {
2734                 .cmd = NL80211_CMD_TRIGGER_SCAN,
2735                 .doit = nl80211_trigger_scan,
2736                 .policy = nl80211_policy,
2737                 .flags = GENL_ADMIN_PERM,
2738         },
2739         {
2740                 .cmd = NL80211_CMD_GET_SCAN,
2741                 .policy = nl80211_policy,
2742                 .dumpit = nl80211_dump_scan,
2743         },
2744 };
2745
2746 /* multicast groups */
2747 static struct genl_multicast_group nl80211_config_mcgrp = {
2748         .name = "config",
2749 };
2750 static struct genl_multicast_group nl80211_scan_mcgrp = {
2751         .name = "scan",
2752 };
2753 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
2754         .name = "regulatory",
2755 };
2756
2757 /* notification functions */
2758
2759 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
2760 {
2761         struct sk_buff *msg;
2762
2763         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2764         if (!msg)
2765                 return;
2766
2767         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
2768                 nlmsg_free(msg);
2769                 return;
2770         }
2771
2772         genlmsg_multicast(msg, 0, nl80211_config_mcgrp.id, GFP_KERNEL);
2773 }
2774
2775 static int nl80211_send_scan_donemsg(struct sk_buff *msg,
2776                                     struct cfg80211_registered_device *rdev,
2777                                     struct net_device *netdev,
2778                                     u32 pid, u32 seq, int flags,
2779                                     u32 cmd)
2780 {
2781         void *hdr;
2782
2783         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
2784         if (!hdr)
2785                 return -1;
2786
2787         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
2788         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
2789
2790         /* XXX: we should probably bounce back the request? */
2791
2792         return genlmsg_end(msg, hdr);
2793
2794  nla_put_failure:
2795         genlmsg_cancel(msg, hdr);
2796         return -EMSGSIZE;
2797 }
2798
2799 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
2800                             struct net_device *netdev)
2801 {
2802         struct sk_buff *msg;
2803
2804         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2805         if (!msg)
2806                 return;
2807
2808         if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
2809                                       NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
2810                 nlmsg_free(msg);
2811                 return;
2812         }
2813
2814         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
2815 }
2816
2817 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
2818                                struct net_device *netdev)
2819 {
2820         struct sk_buff *msg;
2821
2822         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2823         if (!msg)
2824                 return;
2825
2826         if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
2827                                       NL80211_CMD_SCAN_ABORTED) < 0) {
2828                 nlmsg_free(msg);
2829                 return;
2830         }
2831
2832         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
2833 }
2834
2835 /*
2836  * This can happen on global regulatory changes or device specific settings
2837  * based on custom world regulatory domains.
2838  */
2839 void nl80211_send_reg_change_event(struct regulatory_request *request)
2840 {
2841         struct sk_buff *msg;
2842         void *hdr;
2843
2844         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2845         if (!msg)
2846                 return;
2847
2848         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
2849         if (!hdr) {
2850                 nlmsg_free(msg);
2851                 return;
2852         }
2853
2854         /* Userspace can always count this one always being set */
2855         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
2856
2857         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
2858                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
2859                            NL80211_REGDOM_TYPE_WORLD);
2860         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
2861                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
2862                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
2863         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
2864                  request->intersect)
2865                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
2866                            NL80211_REGDOM_TYPE_INTERSECTION);
2867         else {
2868                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
2869                            NL80211_REGDOM_TYPE_COUNTRY);
2870                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
2871         }
2872
2873         if (wiphy_idx_valid(request->wiphy_idx))
2874                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
2875
2876         if (genlmsg_end(msg, hdr) < 0) {
2877                 nlmsg_free(msg);
2878                 return;
2879         }
2880
2881         genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_KERNEL);
2882
2883         return;
2884
2885 nla_put_failure:
2886         genlmsg_cancel(msg, hdr);
2887         nlmsg_free(msg);
2888 }
2889
2890 /* initialisation/exit functions */
2891
2892 int nl80211_init(void)
2893 {
2894         int err, i;
2895
2896         err = genl_register_family(&nl80211_fam);
2897         if (err)
2898                 return err;
2899
2900         for (i = 0; i < ARRAY_SIZE(nl80211_ops); i++) {
2901                 err = genl_register_ops(&nl80211_fam, &nl80211_ops[i]);
2902                 if (err)
2903                         goto err_out;
2904         }
2905
2906         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
2907         if (err)
2908                 goto err_out;
2909
2910         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
2911         if (err)
2912                 goto err_out;
2913
2914         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
2915         if (err)
2916                 goto err_out;
2917
2918         return 0;
2919  err_out:
2920         genl_unregister_family(&nl80211_fam);
2921         return err;
2922 }
2923
2924 void nl80211_exit(void)
2925 {
2926         genl_unregister_family(&nl80211_fam);
2927 }