net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2009  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/list.h>
  11 #include <linux/if_ether.h>
  12 #include <linux/ieee80211.h>
  13 #include <linux/nl80211.h>
  14 #include <linux/rtnetlink.h>
  15 #include <linux/netlink.h>
  16 #include <linux/etherdevice.h>
  17 #include <net/genetlink.h>
  18 #include <net/cfg80211.h>
  19 #include "core.h"
  20 #include "nl80211.h"
  21 #include "reg.h"
  22
  23 /* the netlink family */
  24 static struct genl_family nl80211_fam = {
  25         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  26         .name = "nl80211",      /* have users key off the name instead */
  27         .hdrsize = 0,           /* no private header */
  28         .version = 1,           /* no particular meaning now */
  29         .maxattr = NL80211_ATTR_MAX,
  30 };
  31
  32 /* internal helper: get rdev and dev */
  33 static int get_rdev_dev_by_info_ifindex(struct nlattr **attrs,
  34                                        struct cfg80211_registered_device **rdev,
  35                                        struct net_device **dev)
  36 {
  37         int ifindex;
  38
  39         if (!attrs[NL80211_ATTR_IFINDEX])
  40                 return -EINVAL;
  41
  42         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  43         *dev = dev_get_by_index(&init_net, ifindex);
  44         if (!*dev)
  45                 return -ENODEV;
  46
  47         *rdev = cfg80211_get_dev_from_ifindex(ifindex);
  48         if (IS_ERR(*rdev)) {
  49                 dev_put(*dev);
  50                 return PTR_ERR(*rdev);
  51         }
  52
  53         return 0;
  54 }
  55
  56 /* policy for the attributes */
  57 static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
  58         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  59         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  60                                       .len = 20-1 },
  61         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  62         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  63         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  64         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
  65         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
  66         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
  67         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
  68
  69         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  70         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  71         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  72
  73         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  74         [NL80211_ATTR_PREV_BSSID] = { .type = NLA_BINARY, .len = ETH_ALEN },
  75
  76         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  77                                     .len = WLAN_MAX_KEY_LEN },
  78         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  79         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  80         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
  81         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
  82
  83         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
  84         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
  85         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
  86                                        .len = IEEE80211_MAX_DATA_LEN },
  87         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
  88                                        .len = IEEE80211_MAX_DATA_LEN },
  89         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
  90         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
  91         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
  92         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
  93                                                .len = NL80211_MAX_SUPP_RATES },
  94         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
  95         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
  96         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
  97         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
  98                                 .len = IEEE80211_MAX_MESH_ID_LEN },
  99         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 100
 101         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 102         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 103
 104         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 105         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 106         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 107         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 108                                            .len = NL80211_MAX_SUPP_RATES },
 109
 110         [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
 111
 112         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 113                                          .len = NL80211_HT_CAPABILITY_LEN },
 114
 115         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 116         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 117                               .len = IEEE80211_MAX_DATA_LEN },
 118         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 119         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 120
 121         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 122                                 .len = IEEE80211_MAX_SSID_LEN },
 123         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 124         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 125         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 126         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 127         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 128         [NL80211_ATTR_STA_FLAGS2] = {
 129                 .len = sizeof(struct nl80211_sta_flag_update),
 130         },
 131         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 132         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 133         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 134         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 135 };
 136
 137 /* IE validation */
 138 static bool is_valid_ie_attr(const struct nlattr *attr)
 139 {
 140         const u8 *pos;
 141         int len;
 142
 143         if (!attr)
 144                 return true;
 145
 146         pos = nla_data(attr);
 147         len = nla_len(attr);
 148
 149         while (len) {
 150                 u8 elemlen;
 151
 152                 if (len < 2)
 153                         return false;
 154                 len -= 2;
 155
 156                 elemlen = pos[1];
 157                 if (elemlen > len)
 158                         return false;
 159
 160                 len -= elemlen;
 161                 pos += 2 + elemlen;
 162         }
 163
 164         return true;
 165 }
 166
 167 /* message building helper */
 168 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 169                                    int flags, u8 cmd)
 170 {
 171         /* since there is no private header just add the generic one */
 172         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 173 }
 174
 175 static int nl80211_msg_put_channel(struct sk_buff *msg,
 176                                    struct ieee80211_channel *chan)
 177 {
 178         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 179                     chan->center_freq);
 180
 181         if (chan->flags & IEEE80211_CHAN_DISABLED)
 182                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 183         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 184                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 185         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 186                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 187         if (chan->flags & IEEE80211_CHAN_RADAR)
 188                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 189
 190         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 191                     DBM_TO_MBM(chan->max_power));
 192
 193         return 0;
 194
 195  nla_put_failure:
 196         return -ENOBUFS;
 197 }
 198
 199 /* netlink command implementations */
 200
 201 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 202                               struct cfg80211_registered_device *dev)
 203 {
 204         void *hdr;
 205         struct nlattr *nl_bands, *nl_band;
 206         struct nlattr *nl_freqs, *nl_freq;
 207         struct nlattr *nl_rates, *nl_rate;
 208         struct nlattr *nl_modes;
 209         struct nlattr *nl_cmds;
 210         enum ieee80211_band band;
 211         struct ieee80211_channel *chan;
 212         struct ieee80211_rate *rate;
 213         int i;
 214         u16 ifmodes = dev->wiphy.interface_modes;
 215
 216         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 217         if (!hdr)
 218                 return -1;
 219
 220         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 221         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 222
 223         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 224                    dev->wiphy.retry_short);
 225         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 226                    dev->wiphy.retry_long);
 227         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 228                     dev->wiphy.frag_threshold);
 229         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 230                     dev->wiphy.rts_threshold);
 231
 232         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 233                    dev->wiphy.max_scan_ssids);
 234         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 235                     dev->wiphy.max_scan_ie_len);
 236
 237         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
 238                 sizeof(u32) * dev->wiphy.n_cipher_suites,
 239                 dev->wiphy.cipher_suites);
 240
 241         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
 242         if (!nl_modes)
 243                 goto nla_put_failure;
 244
 245         i = 0;
 246         while (ifmodes) {
 247                 if (ifmodes & 1)
 248                         NLA_PUT_FLAG(msg, i);
 249                 ifmodes >>= 1;
 250                 i++;
 251         }
 252
 253         nla_nest_end(msg, nl_modes);
 254
 255         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 256         if (!nl_bands)
 257                 goto nla_put_failure;
 258
 259         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 260                 if (!dev->wiphy.bands[band])
 261                         continue;
 262
 263                 nl_band = nla_nest_start(msg, band);
 264                 if (!nl_band)
 265                         goto nla_put_failure;
 266
 267                 /* add HT info */
 268                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 269                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 270                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 271                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 272                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 273                                 dev->wiphy.bands[band]->ht_cap.cap);
 274                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 275                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 276                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 277                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 278                 }
 279
 280                 /* add frequencies */
 281                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 282                 if (!nl_freqs)
 283                         goto nla_put_failure;
 284
 285                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 286                         nl_freq = nla_nest_start(msg, i);
 287                         if (!nl_freq)
 288                                 goto nla_put_failure;
 289
 290                         chan = &dev->wiphy.bands[band]->channels[i];
 291
 292                         if (nl80211_msg_put_channel(msg, chan))
 293                                 goto nla_put_failure;
 294
 295                         nla_nest_end(msg, nl_freq);
 296                 }
 297
 298                 nla_nest_end(msg, nl_freqs);
 299
 300                 /* add bitrates */
 301                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 302                 if (!nl_rates)
 303                         goto nla_put_failure;
 304
 305                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 306                         nl_rate = nla_nest_start(msg, i);
 307                         if (!nl_rate)
 308                                 goto nla_put_failure;
 309
 310                         rate = &dev->wiphy.bands[band]->bitrates[i];
 311                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 312                                     rate->bitrate);
 313                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 314                                 NLA_PUT_FLAG(msg,
 315                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 316
 317                         nla_nest_end(msg, nl_rate);
 318                 }
 319
 320                 nla_nest_end(msg, nl_rates);
 321
 322                 nla_nest_end(msg, nl_band);
 323         }
 324         nla_nest_end(msg, nl_bands);
 325
 326         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 327         if (!nl_cmds)
 328                 goto nla_put_failure;
 329
 330         i = 0;
 331 #define CMD(op, n)                                              \
 332          do {                                                   \
 333                 if (dev->ops->op) {                             \
 334                         i++;                                    \
 335                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 336                 }                                               \
 337         } while (0)
 338
 339         CMD(add_virtual_intf, NEW_INTERFACE);
 340         CMD(change_virtual_intf, SET_INTERFACE);
 341         CMD(add_key, NEW_KEY);
 342         CMD(add_beacon, NEW_BEACON);
 343         CMD(add_station, NEW_STATION);
 344         CMD(add_mpath, NEW_MPATH);
 345         CMD(set_mesh_params, SET_MESH_PARAMS);
 346         CMD(change_bss, SET_BSS);
 347         CMD(auth, AUTHENTICATE);
 348         CMD(assoc, ASSOCIATE);
 349         CMD(deauth, DEAUTHENTICATE);
 350         CMD(disassoc, DISASSOCIATE);
 351         CMD(join_ibss, JOIN_IBSS);
 352
 353 #undef CMD
 354
 355         if (dev->ops->connect || dev->ops->auth) {
 356                 i++;
 357                 NLA_PUT_U32(msg, i, NL80211_CMD_CONNECT);
 358         }
 359
 360         if (dev->ops->disconnect || dev->ops->deauth) {
 361                 i++;
 362                 NLA_PUT_U32(msg, i, NL80211_CMD_DISCONNECT);
 363         }
 364
 365         nla_nest_end(msg, nl_cmds);
 366
 367         return genlmsg_end(msg, hdr);
 368
 369  nla_put_failure:
 370         genlmsg_cancel(msg, hdr);
 371         return -EMSGSIZE;
 372 }
 373
 374 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 375 {
 376         int idx = 0;
 377         int start = cb->args[0];
 378         struct cfg80211_registered_device *dev;
 379
 380         mutex_lock(&cfg80211_mutex);
 381         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
 382                 if (++idx <= start)
 383                         continue;
 384                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
 385                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
 386                                        dev) < 0) {
 387                         idx--;
 388                         break;
 389                 }
 390         }
 391         mutex_unlock(&cfg80211_mutex);
 392
 393         cb->args[0] = idx;
 394
 395         return skb->len;
 396 }
 397
 398 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 399 {
 400         struct sk_buff *msg;
 401         struct cfg80211_registered_device *dev;
 402
 403         dev = cfg80211_get_dev_from_info(info);
 404         if (IS_ERR(dev))
 405                 return PTR_ERR(dev);
 406
 407         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 408         if (!msg)
 409                 goto out_err;
 410
 411         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
 412                 goto out_free;
 413
 414         cfg80211_unlock_rdev(dev);
 415
 416         return genlmsg_reply(msg, info);
 417
 418  out_free:
 419         nlmsg_free(msg);
 420  out_err:
 421         cfg80211_unlock_rdev(dev);
 422         return -ENOBUFS;
 423 }
 424
 425 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 426         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
 427         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
 428         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
 429         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
 430         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
 431 };
 432
 433 static int parse_txq_params(struct nlattr *tb[],
 434                             struct ieee80211_txq_params *txq_params)
 435 {
 436         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 437             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 438             !tb[NL80211_TXQ_ATTR_AIFS])
 439                 return -EINVAL;
 440
 441         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
 442         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 443         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 444         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 445         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 446
 447         return 0;
 448 }
 449
 450 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 451 {
 452         struct cfg80211_registered_device *rdev;
 453         int result = 0, rem_txq_params = 0;
 454         struct nlattr *nl_txq_params;
 455         u32 changed;
 456         u8 retry_short = 0, retry_long = 0;
 457         u32 frag_threshold = 0, rts_threshold = 0;
 458
 459         rtnl_lock();
 460
 461         mutex_lock(&cfg80211_mutex);
 462
 463         rdev = __cfg80211_rdev_from_info(info);
 464         if (IS_ERR(rdev)) {
 465                 mutex_unlock(&cfg80211_mutex);
 466                 result = PTR_ERR(rdev);
 467                 goto unlock;
 468         }
 469
 470         mutex_lock(&rdev->mtx);
 471
 472         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
 473                 result = cfg80211_dev_rename(
 474                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 475
 476         mutex_unlock(&cfg80211_mutex);
 477
 478         if (result)
 479                 goto bad_res;
 480
 481         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
 482                 struct ieee80211_txq_params txq_params;
 483                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
 484
 485                 if (!rdev->ops->set_txq_params) {
 486                         result = -EOPNOTSUPP;
 487                         goto bad_res;
 488                 }
 489
 490                 nla_for_each_nested(nl_txq_params,
 491                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
 492                                     rem_txq_params) {
 493                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
 494                                   nla_data(nl_txq_params),
 495                                   nla_len(nl_txq_params),
 496                                   txq_params_policy);
 497                         result = parse_txq_params(tb, &txq_params);
 498                         if (result)
 499                                 goto bad_res;
 500
 501                         result = rdev->ops->set_txq_params(&rdev->wiphy,
 502                                                            &txq_params);
 503                         if (result)
 504                                 goto bad_res;
 505                 }
 506         }
 507
 508         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
 509                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 510                 struct ieee80211_channel *chan;
 511                 struct ieee80211_sta_ht_cap *ht_cap;
 512                 u32 freq;
 513
 514                 if (!rdev->ops->set_channel) {
 515                         result = -EOPNOTSUPP;
 516                         goto bad_res;
 517                 }
 518
 519                 result = -EINVAL;
 520
 521                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 522                         channel_type = nla_get_u32(info->attrs[
 523                                            NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 524                         if (channel_type != NL80211_CHAN_NO_HT &&
 525                             channel_type != NL80211_CHAN_HT20 &&
 526                             channel_type != NL80211_CHAN_HT40PLUS &&
 527                             channel_type != NL80211_CHAN_HT40MINUS)
 528                                 goto bad_res;
 529                 }
 530
 531                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 532                 chan = ieee80211_get_channel(&rdev->wiphy, freq);
 533
 534                 /* Primary channel not allowed */
 535                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 536                         goto bad_res;
 537
 538                 if (channel_type == NL80211_CHAN_HT40MINUS &&
 539                     (chan->flags & IEEE80211_CHAN_NO_HT40MINUS))
 540                         goto bad_res;
 541                 else if (channel_type == NL80211_CHAN_HT40PLUS &&
 542                          (chan->flags & IEEE80211_CHAN_NO_HT40PLUS))
 543                         goto bad_res;
 544
 545                 /*
 546                  * At this point we know if that if HT40 was requested
 547                  * we are allowed to use it and the extension channel
 548                  * exists.
 549                  */
 550
 551                 ht_cap = &rdev->wiphy.bands[chan->band]->ht_cap;
 552
 553                 /* no HT capabilities or intolerant */
 554                 if (channel_type != NL80211_CHAN_NO_HT) {
 555                         if (!ht_cap->ht_supported)
 556                                 goto bad_res;
 557                         if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
 558                             (ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT))
 559                                 goto bad_res;
 560                 }
 561
 562                 result = rdev->ops->set_channel(&rdev->wiphy, chan,
 563                                                 channel_type);
 564                 if (result)
 565                         goto bad_res;
 566         }
 567
 568         changed = 0;
 569
 570         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
 571                 retry_short = nla_get_u8(
 572                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
 573                 if (retry_short == 0) {
 574                         result = -EINVAL;
 575                         goto bad_res;
 576                 }
 577                 changed |= WIPHY_PARAM_RETRY_SHORT;
 578         }
 579
 580         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
 581                 retry_long = nla_get_u8(
 582                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
 583                 if (retry_long == 0) {
 584                         result = -EINVAL;
 585                         goto bad_res;
 586                 }
 587                 changed |= WIPHY_PARAM_RETRY_LONG;
 588         }
 589
 590         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
 591                 frag_threshold = nla_get_u32(
 592                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
 593                 if (frag_threshold < 256) {
 594                         result = -EINVAL;
 595                         goto bad_res;
 596                 }
 597                 if (frag_threshold != (u32) -1) {
 598                         /*
 599                          * Fragments (apart from the last one) are required to
 600                          * have even length. Make the fragmentation code
 601                          * simpler by stripping LSB should someone try to use
 602                          * odd threshold value.
 603                          */
 604                         frag_threshold &= ~0x1;
 605                 }
 606                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
 607         }
 608
 609         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
 610                 rts_threshold = nla_get_u32(
 611                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
 612                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
 613         }
 614
 615         if (changed) {
 616                 u8 old_retry_short, old_retry_long;
 617                 u32 old_frag_threshold, old_rts_threshold;
 618
 619                 if (!rdev->ops->set_wiphy_params) {
 620                         result = -EOPNOTSUPP;
 621                         goto bad_res;
 622                 }
 623
 624                 old_retry_short = rdev->wiphy.retry_short;
 625                 old_retry_long = rdev->wiphy.retry_long;
 626                 old_frag_threshold = rdev->wiphy.frag_threshold;
 627                 old_rts_threshold = rdev->wiphy.rts_threshold;
 628
 629                 if (changed & WIPHY_PARAM_RETRY_SHORT)
 630                         rdev->wiphy.retry_short = retry_short;
 631                 if (changed & WIPHY_PARAM_RETRY_LONG)
 632                         rdev->wiphy.retry_long = retry_long;
 633                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
 634                         rdev->wiphy.frag_threshold = frag_threshold;
 635                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
 636                         rdev->wiphy.rts_threshold = rts_threshold;
 637
 638                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
 639                 if (result) {
 640                         rdev->wiphy.retry_short = old_retry_short;
 641                         rdev->wiphy.retry_long = old_retry_long;
 642                         rdev->wiphy.frag_threshold = old_frag_threshold;
 643                         rdev->wiphy.rts_threshold = old_rts_threshold;
 644                 }
 645         }
 646
 647  bad_res:
 648         mutex_unlock(&rdev->mtx);
 649  unlock:
 650         rtnl_unlock();
 651         return result;
 652 }
 653
 654
 655 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 656                               struct cfg80211_registered_device *rdev,
 657                               struct net_device *dev)
 658 {
 659         void *hdr;
 660
 661         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
 662         if (!hdr)
 663                 return -1;
 664
 665         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 666         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 667         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
 668         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
 669         return genlmsg_end(msg, hdr);
 670
 671  nla_put_failure:
 672         genlmsg_cancel(msg, hdr);
 673         return -EMSGSIZE;
 674 }
 675
 676 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
 677 {
 678         int wp_idx = 0;
 679         int if_idx = 0;
 680         int wp_start = cb->args[0];
 681         int if_start = cb->args[1];
 682         struct cfg80211_registered_device *dev;
 683         struct wireless_dev *wdev;
 684
 685         mutex_lock(&cfg80211_mutex);
 686         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
 687                 if (wp_idx < wp_start) {
 688                         wp_idx++;
 689                         continue;
 690                 }
 691                 if_idx = 0;
 692
 693                 mutex_lock(&dev->devlist_mtx);
 694                 list_for_each_entry(wdev, &dev->netdev_list, list) {
 695                         if (if_idx < if_start) {
 696                                 if_idx++;
 697                                 continue;
 698                         }
 699                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
 700                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
 701                                                dev, wdev->netdev) < 0) {
 702                                 mutex_unlock(&dev->devlist_mtx);
 703                                 goto out;
 704                         }
 705                         if_idx++;
 706                 }
 707                 mutex_unlock(&dev->devlist_mtx);
 708
 709                 wp_idx++;
 710         }
 711  out:
 712         mutex_unlock(&cfg80211_mutex);
 713
 714         cb->args[0] = wp_idx;
 715         cb->args[1] = if_idx;
 716
 717         return skb->len;
 718 }
 719
 720 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
 721 {
 722         struct sk_buff *msg;
 723         struct cfg80211_registered_device *dev;
 724         struct net_device *netdev;
 725         int err;
 726
 727         err = get_rdev_dev_by_info_ifindex(info->attrs, &dev, &netdev);
 728         if (err)
 729                 return err;
 730
 731         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 732         if (!msg)
 733                 goto out_err;
 734
 735         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
 736                                dev, netdev) < 0)
 737                 goto out_free;
 738
 739         dev_put(netdev);
 740         cfg80211_unlock_rdev(dev);
 741
 742         return genlmsg_reply(msg, info);
 743
 744  out_free:
 745         nlmsg_free(msg);
 746  out_err:
 747         dev_put(netdev);
 748         cfg80211_unlock_rdev(dev);
 749         return -ENOBUFS;
 750 }
 751
 752 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
 753         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
 754         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
 755         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
 756         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
 757         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
 758 };
 759
 760 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
 761 {
 762         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
 763         int flag;
 764
 765         *mntrflags = 0;
 766
 767         if (!nla)
 768                 return -EINVAL;
 769
 770         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
 771                              nla, mntr_flags_policy))
 772                 return -EINVAL;
 773
 774         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
 775                 if (flags[flag])
 776                         *mntrflags |= (1<<flag);
 777
 778         return 0;
 779 }
 780
 781 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 782 {
 783         struct cfg80211_registered_device *rdev;
 784         struct vif_params params;
 785         int err;
 786         enum nl80211_iftype otype, ntype;
 787         struct net_device *dev;
 788         u32 _flags, *flags = NULL;
 789         bool change = false;
 790
 791         memset(&params, 0, sizeof(params));
 792
 793         rtnl_lock();
 794
 795         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
 796         if (err)
 797                 goto unlock_rtnl;
 798
 799         otype = ntype = dev->ieee80211_ptr->iftype;
 800
 801         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 802                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 803                 if (otype != ntype)
 804                         change = true;
 805                 if (ntype > NL80211_IFTYPE_MAX) {
 806                         err = -EINVAL;
 807                         goto unlock;
 808                 }
 809         }
 810
 811         if (!rdev->ops->change_virtual_intf ||
 812             !(rdev->wiphy.interface_modes & (1 << ntype))) {
 813                 err = -EOPNOTSUPP;
 814                 goto unlock;
 815         }
 816
 817         if (info->attrs[NL80211_ATTR_MESH_ID]) {
 818                 if (ntype != NL80211_IFTYPE_MESH_POINT) {
 819                         err = -EINVAL;
 820                         goto unlock;
 821                 }
 822                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 823                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 824                 change = true;
 825         }
 826
 827         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
 828                 if (ntype != NL80211_IFTYPE_MONITOR) {
 829                         err = -EINVAL;
 830                         goto unlock;
 831                 }
 832                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
 833                                           &_flags);
 834                 if (err)
 835                         goto unlock;
 836
 837                 flags = &_flags;
 838                 change = true;
 839         }
 840
 841         if (change)
 842                 err = rdev->ops->change_virtual_intf(&rdev->wiphy, dev,
 843                                                     ntype, flags, &params);
 844         else
 845                 err = 0;
 846
 847         WARN_ON(!err && dev->ieee80211_ptr->iftype != ntype);
 848
 849         if (!err && (ntype != otype)) {
 850                 if (otype == NL80211_IFTYPE_ADHOC)
 851                         cfg80211_clear_ibss(dev, false);
 852         }
 853
 854  unlock:
 855         dev_put(dev);
 856         cfg80211_unlock_rdev(rdev);
 857  unlock_rtnl:
 858         rtnl_unlock();
 859         return err;
 860 }
 861
 862 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
 863 {
 864         struct cfg80211_registered_device *rdev;
 865         struct vif_params params;
 866         int err;
 867         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
 868         u32 flags;
 869
 870         memset(&params, 0, sizeof(params));
 871
 872         if (!info->attrs[NL80211_ATTR_IFNAME])
 873                 return -EINVAL;
 874
 875         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 876                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 877                 if (type > NL80211_IFTYPE_MAX)
 878                         return -EINVAL;
 879         }
 880
 881         rtnl_lock();
 882
 883         rdev = cfg80211_get_dev_from_info(info);
 884         if (IS_ERR(rdev)) {
 885                 err = PTR_ERR(rdev);
 886                 goto unlock_rtnl;
 887         }
 888
 889         if (!rdev->ops->add_virtual_intf ||
 890             !(rdev->wiphy.interface_modes & (1 << type))) {
 891                 err = -EOPNOTSUPP;
 892                 goto unlock;
 893         }
 894
 895         if (type == NL80211_IFTYPE_MESH_POINT &&
 896             info->attrs[NL80211_ATTR_MESH_ID]) {
 897                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 898                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 899         }
 900
 901         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
 902                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
 903                                   &flags);
 904         err = rdev->ops->add_virtual_intf(&rdev->wiphy,
 905                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
 906                 type, err ? NULL : &flags, &params);
 907
 908  unlock:
 909         cfg80211_unlock_rdev(rdev);
 910  unlock_rtnl:
 911         rtnl_unlock();
 912         return err;
 913 }
 914
 915 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
 916 {
 917         struct cfg80211_registered_device *rdev;
 918         int ifindex, err;
 919         struct net_device *dev;
 920
 921         rtnl_lock();
 922
 923         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
 924         if (err)
 925                 goto unlock_rtnl;
 926         ifindex = dev->ifindex;
 927         dev_put(dev);
 928
 929         if (!rdev->ops->del_virtual_intf) {
 930                 err = -EOPNOTSUPP;
 931                 goto out;
 932         }
 933
 934         err = rdev->ops->del_virtual_intf(&rdev->wiphy, ifindex);
 935
 936  out:
 937         cfg80211_unlock_rdev(rdev);
 938  unlock_rtnl:
 939         rtnl_unlock();
 940         return err;
 941 }
 942
 943 struct get_key_cookie {
 944         struct sk_buff *msg;
 945         int error;
 946 };
 947
 948 static void get_key_callback(void *c, struct key_params *params)
 949 {
 950         struct get_key_cookie *cookie = c;
 951
 952         if (params->key)
 953                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
 954                         params->key_len, params->key);
 955
 956         if (params->seq)
 957                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
 958                         params->seq_len, params->seq);
 959
 960         if (params->cipher)
 961                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
 962                             params->cipher);
 963
 964         return;
 965  nla_put_failure:
 966         cookie->error = 1;
 967 }
 968
 969 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
 970 {
 971         struct cfg80211_registered_device *rdev;
 972         int err;
 973         struct net_device *dev;
 974         u8 key_idx = 0;
 975         u8 *mac_addr = NULL;
 976         struct get_key_cookie cookie = {
 977                 .error = 0,
 978         };
 979         void *hdr;
 980         struct sk_buff *msg;
 981
 982         if (info->attrs[NL80211_ATTR_KEY_IDX])
 983                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 984
 985         if (key_idx > 5)
 986                 return -EINVAL;
 987
 988         if (info->attrs[NL80211_ATTR_MAC])
 989                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 990
 991         rtnl_lock();
 992
 993         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
 994         if (err)
 995                 goto unlock_rtnl;
 996
 997         if (!rdev->ops->get_key) {
 998                 err = -EOPNOTSUPP;
 999                 goto out;
1000         }
1001
1002         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1003         if (!msg) {
1004                 err = -ENOMEM;
1005                 goto out;
1006         }
1007
1008         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
1009                              NL80211_CMD_NEW_KEY);
1010
1011         if (IS_ERR(hdr)) {
1012                 err = PTR_ERR(hdr);
1013                 goto out;
1014         }
1015
1016         cookie.msg = msg;
1017
1018         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1019         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1020         if (mac_addr)
1021                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1022
1023         err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, mac_addr,
1024                                 &cookie, get_key_callback);
1025
1026         if (err)
1027                 goto out;
1028
1029         if (cookie.error)
1030                 goto nla_put_failure;
1031
1032         genlmsg_end(msg, hdr);
1033         err = genlmsg_reply(msg, info);
1034         goto out;
1035
1036  nla_put_failure:
1037         err = -ENOBUFS;
1038         nlmsg_free(msg);
1039  out:
1040         cfg80211_unlock_rdev(rdev);
1041         dev_put(dev);
1042  unlock_rtnl:
1043         rtnl_unlock();
1044
1045         return err;
1046 }
1047
1048 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1049 {
1050         struct cfg80211_registered_device *rdev;
1051         int err;
1052         struct net_device *dev;
1053         u8 key_idx;
1054         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
1055                     u8 key_index);
1056
1057         if (!info->attrs[NL80211_ATTR_KEY_IDX])
1058                 return -EINVAL;
1059
1060         key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1061
1062         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]) {
1063                 if (key_idx < 4 || key_idx > 5)
1064                         return -EINVAL;
1065         } else if (key_idx > 3)
1066                 return -EINVAL;
1067
1068         /* currently only support setting default key */
1069         if (!info->attrs[NL80211_ATTR_KEY_DEFAULT] &&
1070             !info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT])
1071                 return -EINVAL;
1072
1073         rtnl_lock();
1074
1075         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
1076         if (err)
1077                 goto unlock_rtnl;
1078
1079         if (info->attrs[NL80211_ATTR_KEY_DEFAULT])
1080                 func = rdev->ops->set_default_key;
1081         else
1082                 func = rdev->ops->set_default_mgmt_key;
1083
1084         if (!func) {
1085                 err = -EOPNOTSUPP;
1086                 goto out;
1087         }
1088
1089         err = func(&rdev->wiphy, dev, key_idx);
1090 #ifdef CONFIG_WIRELESS_EXT
1091         if (!err) {
1092                 if (func == rdev->ops->set_default_key)
1093                         dev->ieee80211_ptr->wext.default_key = key_idx;
1094                 else
1095                         dev->ieee80211_ptr->wext.default_mgmt_key = key_idx;
1096         }
1097 #endif
1098
1099  out:
1100         cfg80211_unlock_rdev(rdev);
1101         dev_put(dev);
1102
1103  unlock_rtnl:
1104         rtnl_unlock();
1105
1106         return err;
1107 }
1108
1109 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1110 {
1111         struct cfg80211_registered_device *rdev;
1112         int err, i;
1113         struct net_device *dev;
1114         struct key_params params;
1115         u8 key_idx = 0;
1116         u8 *mac_addr = NULL;
1117
1118         memset(&params, 0, sizeof(params));
1119
1120         if (!info->attrs[NL80211_ATTR_KEY_CIPHER])
1121                 return -EINVAL;
1122
1123         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1124                 params.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1125                 params.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1126         }
1127
1128         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
1129                 params.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
1130                 params.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
1131         }
1132
1133         if (info->attrs[NL80211_ATTR_KEY_IDX])
1134                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1135
1136         params.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1137
1138         if (info->attrs[NL80211_ATTR_MAC])
1139                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1140
1141         if (cfg80211_validate_key_settings(&params, key_idx, mac_addr))
1142                 return -EINVAL;
1143
1144         rtnl_lock();
1145
1146         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
1147         if (err)
1148                 goto unlock_rtnl;
1149
1150         for (i = 0; i < rdev->wiphy.n_cipher_suites; i++)
1151                 if (params.cipher == rdev->wiphy.cipher_suites[i])
1152                         break;
1153         if (i == rdev->wiphy.n_cipher_suites) {
1154                 err = -EINVAL;
1155                 goto out;
1156         }
1157
1158         if (!rdev->ops->add_key) {
1159                 err = -EOPNOTSUPP;
1160                 goto out;
1161         }
1162
1163         err = rdev->ops->add_key(&rdev->wiphy, dev, key_idx, mac_addr, &params);
1164
1165  out:
1166         cfg80211_unlock_rdev(rdev);
1167         dev_put(dev);
1168  unlock_rtnl:
1169         rtnl_unlock();
1170
1171         return err;
1172 }
1173
1174 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1175 {
1176         struct cfg80211_registered_device *rdev;
1177         int err;
1178         struct net_device *dev;
1179         u8 key_idx = 0;
1180         u8 *mac_addr = NULL;
1181
1182         if (info->attrs[NL80211_ATTR_KEY_IDX])
1183                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1184
1185         if (key_idx > 5)
1186                 return -EINVAL;
1187
1188         if (info->attrs[NL80211_ATTR_MAC])
1189                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1190
1191         rtnl_lock();
1192
1193         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
1194         if (err)
1195                 goto unlock_rtnl;
1196
1197         if (!rdev->ops->del_key) {
1198                 err = -EOPNOTSUPP;
1199                 goto out;
1200         }
1201
1202         err = rdev->ops->del_key(&rdev->wiphy, dev, key_idx, mac_addr);
1203
1204 #ifdef CONFIG_WIRELESS_EXT
1205         if (!err) {
1206                 if (key_idx == dev->ieee80211_ptr->wext.default_key)
1207                         dev->ieee80211_ptr->wext.default_key = -1;
1208                 else if (key_idx == dev->ieee80211_ptr->wext.default_mgmt_key)
1209                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
1210         }
1211 #endif
1212
1213  out:
1214         cfg80211_unlock_rdev(rdev);
1215         dev_put(dev);
1216
1217  unlock_rtnl:
1218         rtnl_unlock();
1219
1220         return err;
1221 }
1222
1223 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1224 {
1225         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1226                     struct beacon_parameters *info);
1227         struct cfg80211_registered_device *rdev;
1228         int err;
1229         struct net_device *dev;
1230         struct beacon_parameters params;
1231         int haveinfo = 0;
1232
1233         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
1234                 return -EINVAL;
1235
1236         rtnl_lock();
1237
1238         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
1239         if (err)
1240                 goto unlock_rtnl;
1241
1242         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1243                 err = -EOPNOTSUPP;
1244                 goto out;
1245         }
1246
1247         switch (info->genlhdr->cmd) {
1248         case NL80211_CMD_NEW_BEACON:
1249                 /* these are required for NEW_BEACON */
1250                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1251                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1252                     !info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1253                         err = -EINVAL;
1254                         goto out;
1255                 }
1256
1257                 call = rdev->ops->add_beacon;
1258                 break;
1259         case NL80211_CMD_SET_BEACON:
1260                 call = rdev->ops->set_beacon;
1261                 break;
1262         default:
1263                 WARN_ON(1);
1264                 err = -EOPNOTSUPP;
1265                 goto out;
1266         }
1267
1268         if (!call) {
1269                 err = -EOPNOTSUPP;
1270                 goto out;
1271         }
1272
1273         memset(&params, 0, sizeof(params));
1274
1275         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1276                 params.interval =
1277                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1278                 haveinfo = 1;
1279         }
1280
1281         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1282                 params.dtim_period =
1283                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1284                 haveinfo = 1;
1285         }
1286
1287         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1288                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1289                 params.head_len =
1290                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1291                 haveinfo = 1;
1292         }
1293
1294         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1295                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1296                 params.tail_len =
1297                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1298                 haveinfo = 1;
1299         }
1300
1301         if (!haveinfo) {
1302                 err = -EINVAL;
1303                 goto out;
1304         }
1305
1306         err = call(&rdev->wiphy, dev, &params);
1307
1308  out:
1309         cfg80211_unlock_rdev(rdev);
1310         dev_put(dev);
1311  unlock_rtnl:
1312         rtnl_unlock();
1313
1314         return err;
1315 }
1316
1317 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1318 {
1319         struct cfg80211_registered_device *rdev;
1320         int err;
1321         struct net_device *dev;
1322
1323         rtnl_lock();
1324
1325         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
1326         if (err)
1327                 goto unlock_rtnl;
1328
1329         if (!rdev->ops->del_beacon) {
1330                 err = -EOPNOTSUPP;
1331                 goto out;
1332         }
1333
1334         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1335                 err = -EOPNOTSUPP;
1336                 goto out;
1337         }
1338         err = rdev->ops->del_beacon(&rdev->wiphy, dev);
1339
1340  out:
1341         cfg80211_unlock_rdev(rdev);
1342         dev_put(dev);
1343  unlock_rtnl:
1344         rtnl_unlock();
1345
1346         return err;
1347 }
1348
1349 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1350         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1351         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1352         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1353         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
1354 };
1355
1356 static int parse_station_flags(struct genl_info *info,
1357                                struct station_parameters *params)
1358 {
1359         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1360         struct nlattr *nla;
1361         int flag;
1362
1363         /*
1364          * Try parsing the new attribute first so userspace
1365          * can specify both for older kernels.
1366          */
1367         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
1368         if (nla) {
1369                 struct nl80211_sta_flag_update *sta_flags;
1370
1371                 sta_flags = nla_data(nla);
1372                 params->sta_flags_mask = sta_flags->mask;
1373                 params->sta_flags_set = sta_flags->set;
1374                 if ((params->sta_flags_mask |
1375                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
1376                         return -EINVAL;
1377                 return 0;
1378         }
1379
1380         /* if present, parse the old attribute */
1381
1382         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
1383         if (!nla)
1384                 return 0;
1385
1386         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1387                              nla, sta_flags_policy))
1388                 return -EINVAL;
1389
1390         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
1391         params->sta_flags_mask &= ~1;
1392
1393         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1394                 if (flags[flag])
1395                         params->sta_flags_set |= (1<<flag);
1396
1397         return 0;
1398 }
1399
1400 static u16 nl80211_calculate_bitrate(struct rate_info *rate)
1401 {
1402         int modulation, streams, bitrate;
1403
1404         if (!(rate->flags & RATE_INFO_FLAGS_MCS))
1405                 return rate->legacy;
1406
1407         /* the formula below does only work for MCS values smaller than 32 */
1408         if (rate->mcs >= 32)
1409                 return 0;
1410
1411         modulation = rate->mcs & 7;
1412         streams = (rate->mcs >> 3) + 1;
1413
1414         bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
1415                         13500000 : 6500000;
1416
1417         if (modulation < 4)
1418                 bitrate *= (modulation + 1);
1419         else if (modulation == 4)
1420                 bitrate *= (modulation + 2);
1421         else
1422                 bitrate *= (modulation + 3);
1423
1424         bitrate *= streams;
1425
1426         if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
1427                 bitrate = (bitrate / 9) * 10;
1428
1429         /* do NOT round down here */
1430         return (bitrate + 50000) / 100000;
1431 }
1432
1433 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1434                                 int flags, struct net_device *dev,
1435                                 u8 *mac_addr, struct station_info *sinfo)
1436 {
1437         void *hdr;
1438         struct nlattr *sinfoattr, *txrate;
1439         u16 bitrate;
1440
1441         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1442         if (!hdr)
1443                 return -1;
1444
1445         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1446         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1447
1448         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1449         if (!sinfoattr)
1450                 goto nla_put_failure;
1451         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1452                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1453                             sinfo->inactive_time);
1454         if (sinfo->filled & STATION_INFO_RX_BYTES)
1455                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1456                             sinfo->rx_bytes);
1457         if (sinfo->filled & STATION_INFO_TX_BYTES)
1458                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1459                             sinfo->tx_bytes);
1460         if (sinfo->filled & STATION_INFO_LLID)
1461                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1462                             sinfo->llid);
1463         if (sinfo->filled & STATION_INFO_PLID)
1464                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1465                             sinfo->plid);
1466         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1467                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1468                             sinfo->plink_state);
1469         if (sinfo->filled & STATION_INFO_SIGNAL)
1470                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1471                            sinfo->signal);
1472         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1473                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1474                 if (!txrate)
1475                         goto nla_put_failure;
1476
1477                 /* nl80211_calculate_bitrate will return 0 for mcs >= 32 */
1478                 bitrate = nl80211_calculate_bitrate(&sinfo->txrate);
1479                 if (bitrate > 0)
1480                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1481
1482                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1483                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1484                                     sinfo->txrate.mcs);
1485                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1486                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1487                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1488                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1489
1490                 nla_nest_end(msg, txrate);
1491         }
1492         if (sinfo->filled & STATION_INFO_RX_PACKETS)
1493                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
1494                             sinfo->rx_packets);
1495         if (sinfo->filled & STATION_INFO_TX_PACKETS)
1496                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
1497                             sinfo->tx_packets);
1498         nla_nest_end(msg, sinfoattr);
1499
1500         return genlmsg_end(msg, hdr);
1501
1502  nla_put_failure:
1503         genlmsg_cancel(msg, hdr);
1504         return -EMSGSIZE;
1505 }
1506
1507 static int nl80211_dump_station(struct sk_buff *skb,
1508                                 struct netlink_callback *cb)
1509 {
1510         struct station_info sinfo;
1511         struct cfg80211_registered_device *dev;
1512         struct net_device *netdev;
1513         u8 mac_addr[ETH_ALEN];
1514         int ifidx = cb->args[0];
1515         int sta_idx = cb->args[1];
1516         int err;
1517
1518         if (!ifidx) {
1519                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1520                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1521                                   nl80211_policy);
1522                 if (err)
1523                         return err;
1524
1525                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1526                         return -EINVAL;
1527
1528                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1529                 if (!ifidx)
1530                         return -EINVAL;
1531         }
1532
1533         rtnl_lock();
1534
1535         netdev = __dev_get_by_index(&init_net, ifidx);
1536         if (!netdev) {
1537                 err = -ENODEV;
1538                 goto out_rtnl;
1539         }
1540
1541         dev = cfg80211_get_dev_from_ifindex(ifidx);
1542         if (IS_ERR(dev)) {
1543                 err = PTR_ERR(dev);
1544                 goto out_rtnl;
1545         }
1546
1547         if (!dev->ops->dump_station) {
1548                 err = -EOPNOTSUPP;
1549                 goto out_err;
1550         }
1551
1552         while (1) {
1553                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1554                                              mac_addr, &sinfo);
1555                 if (err == -ENOENT)
1556                         break;
1557                 if (err)
1558                         goto out_err;
1559
1560                 if (nl80211_send_station(skb,
1561                                 NETLINK_CB(cb->skb).pid,
1562                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
1563                                 netdev, mac_addr,
1564                                 &sinfo) < 0)
1565                         goto out;
1566
1567                 sta_idx++;
1568         }
1569
1570
1571  out:
1572         cb->args[1] = sta_idx;
1573         err = skb->len;
1574  out_err:
1575         cfg80211_unlock_rdev(dev);
1576  out_rtnl:
1577         rtnl_unlock();
1578
1579         return err;
1580 }
1581
1582 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1583 {
1584         struct cfg80211_registered_device *rdev;
1585         int err;
1586         struct net_device *dev;
1587         struct station_info sinfo;
1588         struct sk_buff *msg;
1589         u8 *mac_addr = NULL;
1590
1591         memset(&sinfo, 0, sizeof(sinfo));
1592
1593         if (!info->attrs[NL80211_ATTR_MAC])
1594                 return -EINVAL;
1595
1596         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1597
1598         rtnl_lock();
1599
1600         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
1601         if (err)
1602                 goto out_rtnl;
1603
1604         if (!rdev->ops->get_station) {
1605                 err = -EOPNOTSUPP;
1606                 goto out;
1607         }
1608
1609         err = rdev->ops->get_station(&rdev->wiphy, dev, mac_addr, &sinfo);
1610         if (err)
1611                 goto out;
1612
1613         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1614         if (!msg)
1615                 goto out;
1616
1617         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1618                                  dev, mac_addr, &sinfo) < 0)
1619                 goto out_free;
1620
1621         err = genlmsg_reply(msg, info);
1622         goto out;
1623
1624  out_free:
1625         nlmsg_free(msg);
1626  out:
1627         cfg80211_unlock_rdev(rdev);
1628         dev_put(dev);
1629  out_rtnl:
1630         rtnl_unlock();
1631
1632         return err;
1633 }
1634
1635 /*
1636  * Get vlan interface making sure it is on the right wiphy.
1637  */
1638 static int get_vlan(struct nlattr *vlanattr,
1639                     struct cfg80211_registered_device *rdev,
1640                     struct net_device **vlan)
1641 {
1642         *vlan = NULL;
1643
1644         if (vlanattr) {
1645                 *vlan = dev_get_by_index(&init_net, nla_get_u32(vlanattr));
1646                 if (!*vlan)
1647                         return -ENODEV;
1648                 if (!(*vlan)->ieee80211_ptr)
1649                         return -EINVAL;
1650                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
1651                         return -EINVAL;
1652         }
1653         return 0;
1654 }
1655
1656 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
1657 {
1658         struct cfg80211_registered_device *rdev;
1659         int err;
1660         struct net_device *dev;
1661         struct station_parameters params;
1662         u8 *mac_addr = NULL;
1663
1664         memset(&params, 0, sizeof(params));
1665
1666         params.listen_interval = -1;
1667
1668         if (info->attrs[NL80211_ATTR_STA_AID])
1669                 return -EINVAL;
1670
1671         if (!info->attrs[NL80211_ATTR_MAC])
1672                 return -EINVAL;
1673
1674         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1675
1676         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
1677                 params.supported_rates =
1678                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1679                 params.supported_rates_len =
1680                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1681         }
1682
1683         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1684                 params.listen_interval =
1685                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1686
1687         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1688                 params.ht_capa =
1689                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1690
1691         if (parse_station_flags(info, &params))
1692                 return -EINVAL;
1693
1694         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
1695                 params.plink_action =
1696                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
1697
1698         rtnl_lock();
1699
1700         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
1701         if (err)
1702                 goto out_rtnl;
1703
1704         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], rdev, &params.vlan);
1705         if (err)
1706                 goto out;
1707
1708         /* validate settings */
1709         err = 0;
1710
1711         switch (dev->ieee80211_ptr->iftype) {
1712         case NL80211_IFTYPE_AP:
1713         case NL80211_IFTYPE_AP_VLAN:
1714                 /* disallow mesh-specific things */
1715                 if (params.plink_action)
1716                         err = -EINVAL;
1717                 break;
1718         case NL80211_IFTYPE_STATION:
1719                 /* disallow everything but AUTHORIZED flag */
1720                 if (params.plink_action)
1721                         err = -EINVAL;
1722                 if (params.vlan)
1723                         err = -EINVAL;
1724                 if (params.supported_rates)
1725                         err = -EINVAL;
1726                 if (params.ht_capa)
1727                         err = -EINVAL;
1728                 if (params.listen_interval >= 0)
1729                         err = -EINVAL;
1730                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
1731                         err = -EINVAL;
1732                 break;
1733         case NL80211_IFTYPE_MESH_POINT:
1734                 /* disallow things mesh doesn't support */
1735                 if (params.vlan)
1736                         err = -EINVAL;
1737                 if (params.ht_capa)
1738                         err = -EINVAL;
1739                 if (params.listen_interval >= 0)
1740                         err = -EINVAL;
1741                 if (params.supported_rates)
1742                         err = -EINVAL;
1743                 if (params.sta_flags_mask)
1744                         err = -EINVAL;
1745                 break;
1746         default:
1747                 err = -EINVAL;
1748         }
1749
1750         if (err)
1751                 goto out;
1752
1753         if (!rdev->ops->change_station) {
1754                 err = -EOPNOTSUPP;
1755                 goto out;
1756         }
1757
1758         err = rdev->ops->change_station(&rdev->wiphy, dev, mac_addr, &params);
1759
1760  out:
1761         if (params.vlan)
1762                 dev_put(params.vlan);
1763         cfg80211_unlock_rdev(rdev);
1764         dev_put(dev);
1765  out_rtnl:
1766         rtnl_unlock();
1767
1768         return err;
1769 }
1770
1771 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
1772 {
1773         struct cfg80211_registered_device *rdev;
1774         int err;
1775         struct net_device *dev;
1776         struct station_parameters params;
1777         u8 *mac_addr = NULL;
1778
1779         memset(&params, 0, sizeof(params));
1780
1781         if (!info->attrs[NL80211_ATTR_MAC])
1782                 return -EINVAL;
1783
1784         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1785                 return -EINVAL;
1786
1787         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
1788                 return -EINVAL;
1789
1790         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1791         params.supported_rates =
1792                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1793         params.supported_rates_len =
1794                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1795         params.listen_interval =
1796                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1797
1798         if (info->attrs[NL80211_ATTR_STA_AID]) {
1799                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
1800                 if (!params.aid || params.aid > IEEE80211_MAX_AID)
1801                         return -EINVAL;
1802         }
1803
1804         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1805                 params.ht_capa =
1806                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1807
1808         if (parse_station_flags(info, &params))
1809                 return -EINVAL;
1810
1811         rtnl_lock();
1812
1813         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
1814         if (err)
1815                 goto out_rtnl;
1816
1817         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], rdev, &params.vlan);
1818         if (err)
1819                 goto out;
1820
1821         /* validate settings */
1822         err = 0;
1823
1824         switch (dev->ieee80211_ptr->iftype) {
1825         case NL80211_IFTYPE_AP:
1826         case NL80211_IFTYPE_AP_VLAN:
1827                 /* all ok but must have AID */
1828                 if (!params.aid)
1829                         err = -EINVAL;
1830                 break;
1831         case NL80211_IFTYPE_MESH_POINT:
1832                 /* disallow things mesh doesn't support */
1833                 if (params.vlan)
1834                         err = -EINVAL;
1835                 if (params.aid)
1836                         err = -EINVAL;
1837                 if (params.ht_capa)
1838                         err = -EINVAL;
1839                 if (params.listen_interval >= 0)
1840                         err = -EINVAL;
1841                 if (params.supported_rates)
1842                         err = -EINVAL;
1843                 if (params.sta_flags_mask)
1844                         err = -EINVAL;
1845                 break;
1846         default:
1847                 err = -EINVAL;
1848         }
1849
1850         if (err)
1851                 goto out;
1852
1853         if (!rdev->ops->add_station) {
1854                 err = -EOPNOTSUPP;
1855                 goto out;
1856         }
1857
1858         if (!netif_running(dev)) {
1859                 err = -ENETDOWN;
1860                 goto out;
1861         }
1862
1863         err = rdev->ops->add_station(&rdev->wiphy, dev, mac_addr, &params);
1864
1865  out:
1866         if (params.vlan)
1867                 dev_put(params.vlan);
1868         cfg80211_unlock_rdev(rdev);
1869         dev_put(dev);
1870  out_rtnl:
1871         rtnl_unlock();
1872
1873         return err;
1874 }
1875
1876 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
1877 {
1878         struct cfg80211_registered_device *rdev;
1879         int err;
1880         struct net_device *dev;
1881         u8 *mac_addr = NULL;
1882
1883         if (info->attrs[NL80211_ATTR_MAC])
1884                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1885
1886         rtnl_lock();
1887
1888         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
1889         if (err)
1890                 goto out_rtnl;
1891
1892         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1893             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
1894             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1895                 err = -EINVAL;
1896                 goto out;
1897         }
1898
1899         if (!rdev->ops->del_station) {
1900                 err = -EOPNOTSUPP;
1901                 goto out;
1902         }
1903
1904         err = rdev->ops->del_station(&rdev->wiphy, dev, mac_addr);
1905
1906  out:
1907         cfg80211_unlock_rdev(rdev);
1908         dev_put(dev);
1909  out_rtnl:
1910         rtnl_unlock();
1911
1912         return err;
1913 }
1914
1915 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
1916                                 int flags, struct net_device *dev,
1917                                 u8 *dst, u8 *next_hop,
1918                                 struct mpath_info *pinfo)
1919 {
1920         void *hdr;
1921         struct nlattr *pinfoattr;
1922
1923         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1924         if (!hdr)
1925                 return -1;
1926
1927         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1928         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
1929         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
1930
1931         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
1932         if (!pinfoattr)
1933                 goto nla_put_failure;
1934         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
1935                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
1936                             pinfo->frame_qlen);
1937         if (pinfo->filled & MPATH_INFO_DSN)
1938                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DSN,
1939                             pinfo->dsn);
1940         if (pinfo->filled & MPATH_INFO_METRIC)
1941                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
1942                             pinfo->metric);
1943         if (pinfo->filled & MPATH_INFO_EXPTIME)
1944                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
1945                             pinfo->exptime);
1946         if (pinfo->filled & MPATH_INFO_FLAGS)
1947                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
1948                             pinfo->flags);
1949         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
1950                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
1951                             pinfo->discovery_timeout);
1952         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
1953                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
1954                             pinfo->discovery_retries);
1955
1956         nla_nest_end(msg, pinfoattr);
1957
1958         return genlmsg_end(msg, hdr);
1959
1960  nla_put_failure:
1961         genlmsg_cancel(msg, hdr);
1962         return -EMSGSIZE;
1963 }
1964
1965 static int nl80211_dump_mpath(struct sk_buff *skb,
1966                               struct netlink_callback *cb)
1967 {
1968         struct mpath_info pinfo;
1969         struct cfg80211_registered_device *dev;
1970         struct net_device *netdev;
1971         u8 dst[ETH_ALEN];
1972         u8 next_hop[ETH_ALEN];
1973         int ifidx = cb->args[0];
1974         int path_idx = cb->args[1];
1975         int err;
1976
1977         if (!ifidx) {
1978                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1979                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1980                                   nl80211_policy);
1981                 if (err)
1982                         return err;
1983
1984                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1985                         return -EINVAL;
1986
1987                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1988                 if (!ifidx)
1989                         return -EINVAL;
1990         }
1991
1992         rtnl_lock();
1993
1994         netdev = __dev_get_by_index(&init_net, ifidx);
1995         if (!netdev) {
1996                 err = -ENODEV;
1997                 goto out_rtnl;
1998         }
1999
2000         dev = cfg80211_get_dev_from_ifindex(ifidx);
2001         if (IS_ERR(dev)) {
2002                 err = PTR_ERR(dev);
2003                 goto out_rtnl;
2004         }
2005
2006         if (!dev->ops->dump_mpath) {
2007                 err = -EOPNOTSUPP;
2008                 goto out_err;
2009         }
2010
2011         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2012                 err = -EOPNOTSUPP;
2013                 goto out;
2014         }
2015
2016         while (1) {
2017                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
2018                                            dst, next_hop, &pinfo);
2019                 if (err == -ENOENT)
2020                         break;
2021                 if (err)
2022                         goto out_err;
2023
2024                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
2025                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
2026                                        netdev, dst, next_hop,
2027                                        &pinfo) < 0)
2028                         goto out;
2029
2030                 path_idx++;
2031         }
2032
2033
2034  out:
2035         cb->args[1] = path_idx;
2036         err = skb->len;
2037  out_err:
2038         cfg80211_unlock_rdev(dev);
2039  out_rtnl:
2040         rtnl_unlock();
2041
2042         return err;
2043 }
2044
2045 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
2046 {
2047         struct cfg80211_registered_device *rdev;
2048         int err;
2049         struct net_device *dev;
2050         struct mpath_info pinfo;
2051         struct sk_buff *msg;
2052         u8 *dst = NULL;
2053         u8 next_hop[ETH_ALEN];
2054
2055         memset(&pinfo, 0, sizeof(pinfo));
2056
2057         if (!info->attrs[NL80211_ATTR_MAC])
2058                 return -EINVAL;
2059
2060         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2061
2062         rtnl_lock();
2063
2064         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
2065         if (err)
2066                 goto out_rtnl;
2067
2068         if (!rdev->ops->get_mpath) {
2069                 err = -EOPNOTSUPP;
2070                 goto out;
2071         }
2072
2073         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2074                 err = -EOPNOTSUPP;
2075                 goto out;
2076         }
2077
2078         err = rdev->ops->get_mpath(&rdev->wiphy, dev, dst, next_hop, &pinfo);
2079         if (err)
2080                 goto out;
2081
2082         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2083         if (!msg)
2084                 goto out;
2085
2086         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2087                                  dev, dst, next_hop, &pinfo) < 0)
2088                 goto out_free;
2089
2090         err = genlmsg_reply(msg, info);
2091         goto out;
2092
2093  out_free:
2094         nlmsg_free(msg);
2095  out:
2096         cfg80211_unlock_rdev(rdev);
2097         dev_put(dev);
2098  out_rtnl:
2099         rtnl_unlock();
2100
2101         return err;
2102 }
2103
2104 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2105 {
2106         struct cfg80211_registered_device *rdev;
2107         int err;
2108         struct net_device *dev;
2109         u8 *dst = NULL;
2110         u8 *next_hop = NULL;
2111
2112         if (!info->attrs[NL80211_ATTR_MAC])
2113                 return -EINVAL;
2114
2115         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2116                 return -EINVAL;
2117
2118         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2119         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2120
2121         rtnl_lock();
2122
2123         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
2124         if (err)
2125                 goto out_rtnl;
2126
2127         if (!rdev->ops->change_mpath) {
2128                 err = -EOPNOTSUPP;
2129                 goto out;
2130         }
2131
2132         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2133                 err = -EOPNOTSUPP;
2134                 goto out;
2135         }
2136
2137         if (!netif_running(dev)) {
2138                 err = -ENETDOWN;
2139                 goto out;
2140         }
2141
2142         err = rdev->ops->change_mpath(&rdev->wiphy, dev, dst, next_hop);
2143
2144  out:
2145         cfg80211_unlock_rdev(rdev);
2146         dev_put(dev);
2147  out_rtnl:
2148         rtnl_unlock();
2149
2150         return err;
2151 }
2152 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2153 {
2154         struct cfg80211_registered_device *rdev;
2155         int err;
2156         struct net_device *dev;
2157         u8 *dst = NULL;
2158         u8 *next_hop = NULL;
2159
2160         if (!info->attrs[NL80211_ATTR_MAC])
2161                 return -EINVAL;
2162
2163         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2164                 return -EINVAL;
2165
2166         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2167         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2168
2169         rtnl_lock();
2170
2171         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
2172         if (err)
2173                 goto out_rtnl;
2174
2175         if (!rdev->ops->add_mpath) {
2176                 err = -EOPNOTSUPP;
2177                 goto out;
2178         }
2179
2180         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2181                 err = -EOPNOTSUPP;
2182                 goto out;
2183         }
2184
2185         if (!netif_running(dev)) {
2186                 err = -ENETDOWN;
2187                 goto out;
2188         }
2189
2190         err = rdev->ops->add_mpath(&rdev->wiphy, dev, dst, next_hop);
2191
2192  out:
2193         cfg80211_unlock_rdev(rdev);
2194         dev_put(dev);
2195  out_rtnl:
2196         rtnl_unlock();
2197
2198         return err;
2199 }
2200
2201 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2202 {
2203         struct cfg80211_registered_device *rdev;
2204         int err;
2205         struct net_device *dev;
2206         u8 *dst = NULL;
2207
2208         if (info->attrs[NL80211_ATTR_MAC])
2209                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2210
2211         rtnl_lock();
2212
2213         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
2214         if (err)
2215                 goto out_rtnl;
2216
2217         if (!rdev->ops->del_mpath) {
2218                 err = -EOPNOTSUPP;
2219                 goto out;
2220         }
2221
2222         err = rdev->ops->del_mpath(&rdev->wiphy, dev, dst);
2223
2224  out:
2225         cfg80211_unlock_rdev(rdev);
2226         dev_put(dev);
2227  out_rtnl:
2228         rtnl_unlock();
2229
2230         return err;
2231 }
2232
2233 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2234 {
2235         struct cfg80211_registered_device *rdev;
2236         int err;
2237         struct net_device *dev;
2238         struct bss_parameters params;
2239
2240         memset(&params, 0, sizeof(params));
2241         /* default to not changing parameters */
2242         params.use_cts_prot = -1;
2243         params.use_short_preamble = -1;
2244         params.use_short_slot_time = -1;
2245
2246         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2247                 params.use_cts_prot =
2248                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2249         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2250                 params.use_short_preamble =
2251                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2252         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2253                 params.use_short_slot_time =
2254                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2255         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2256                 params.basic_rates =
2257                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2258                 params.basic_rates_len =
2259                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2260         }
2261
2262         rtnl_lock();
2263
2264         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
2265         if (err)
2266                 goto out_rtnl;
2267
2268         if (!rdev->ops->change_bss) {
2269                 err = -EOPNOTSUPP;
2270                 goto out;
2271         }
2272
2273         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
2274                 err = -EOPNOTSUPP;
2275                 goto out;
2276         }
2277
2278         err = rdev->ops->change_bss(&rdev->wiphy, dev, &params);
2279
2280  out:
2281         cfg80211_unlock_rdev(rdev);
2282         dev_put(dev);
2283  out_rtnl:
2284         rtnl_unlock();
2285
2286         return err;
2287 }
2288
2289 static const struct nla_policy
2290         reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2291         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2292         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2293         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2294         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2295         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2296         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2297 };
2298
2299 static int parse_reg_rule(struct nlattr *tb[],
2300         struct ieee80211_reg_rule *reg_rule)
2301 {
2302         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2303         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2304
2305         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2306                 return -EINVAL;
2307         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2308                 return -EINVAL;
2309         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2310                 return -EINVAL;
2311         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2312                 return -EINVAL;
2313         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2314                 return -EINVAL;
2315
2316         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2317
2318         freq_range->start_freq_khz =
2319                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2320         freq_range->end_freq_khz =
2321                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2322         freq_range->max_bandwidth_khz =
2323                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2324
2325         power_rule->max_eirp =
2326                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2327
2328         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2329                 power_rule->max_antenna_gain =
2330                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2331
2332         return 0;
2333 }
2334
2335 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2336 {
2337         int r;
2338         char *data = NULL;
2339
2340         /*
2341          * You should only get this when cfg80211 hasn't yet initialized
2342          * completely when built-in to the kernel right between the time
2343          * window between nl80211_init() and regulatory_init(), if that is
2344          * even possible.
2345          */
2346         mutex_lock(&cfg80211_mutex);
2347         if (unlikely(!cfg80211_regdomain)) {
2348                 mutex_unlock(&cfg80211_mutex);
2349                 return -EINPROGRESS;
2350         }
2351         mutex_unlock(&cfg80211_mutex);
2352
2353         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2354                 return -EINVAL;
2355
2356         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2357
2358 #ifdef CONFIG_WIRELESS_OLD_REGULATORY
2359         /* We ignore world regdom requests with the old regdom setup */
2360         if (is_world_regdom(data))
2361                 return -EINVAL;
2362 #endif
2363
2364         r = regulatory_hint_user(data);
2365
2366         return r;
2367 }
2368
2369 static int nl80211_get_mesh_params(struct sk_buff *skb,
2370         struct genl_info *info)
2371 {
2372         struct cfg80211_registered_device *rdev;
2373         struct mesh_config cur_params;
2374         int err;
2375         struct net_device *dev;
2376         void *hdr;
2377         struct nlattr *pinfoattr;
2378         struct sk_buff *msg;
2379
2380         rtnl_lock();
2381
2382         /* Look up our device */
2383         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
2384         if (err)
2385                 goto out_rtnl;
2386
2387         if (!rdev->ops->get_mesh_params) {
2388                 err = -EOPNOTSUPP;
2389                 goto out;
2390         }
2391
2392         /* Get the mesh params */
2393         err = rdev->ops->get_mesh_params(&rdev->wiphy, dev, &cur_params);
2394         if (err)
2395                 goto out;
2396
2397         /* Draw up a netlink message to send back */
2398         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2399         if (!msg) {
2400                 err = -ENOBUFS;
2401                 goto out;
2402         }
2403         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2404                              NL80211_CMD_GET_MESH_PARAMS);
2405         if (!hdr)
2406                 goto nla_put_failure;
2407         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
2408         if (!pinfoattr)
2409                 goto nla_put_failure;
2410         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2411         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2412                         cur_params.dot11MeshRetryTimeout);
2413         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2414                         cur_params.dot11MeshConfirmTimeout);
2415         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2416                         cur_params.dot11MeshHoldingTimeout);
2417         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2418                         cur_params.dot11MeshMaxPeerLinks);
2419         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2420                         cur_params.dot11MeshMaxRetries);
2421         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2422                         cur_params.dot11MeshTTL);
2423         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2424                         cur_params.auto_open_plinks);
2425         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2426                         cur_params.dot11MeshHWMPmaxPREQretries);
2427         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2428                         cur_params.path_refresh_time);
2429         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2430                         cur_params.min_discovery_timeout);
2431         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2432                         cur_params.dot11MeshHWMPactivePathTimeout);
2433         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2434                         cur_params.dot11MeshHWMPpreqMinInterval);
2435         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2436                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2437         nla_nest_end(msg, pinfoattr);
2438         genlmsg_end(msg, hdr);
2439         err = genlmsg_reply(msg, info);
2440         goto out;
2441
2442  nla_put_failure:
2443         genlmsg_cancel(msg, hdr);
2444         err = -EMSGSIZE;
2445  out:
2446         /* Cleanup */
2447         cfg80211_unlock_rdev(rdev);
2448         dev_put(dev);
2449  out_rtnl:
2450         rtnl_unlock();
2451
2452         return err;
2453 }
2454
2455 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2456 do {\
2457         if (table[attr_num]) {\
2458                 cfg.param = nla_fn(table[attr_num]); \
2459                 mask |= (1 << (attr_num - 1)); \
2460         } \
2461 } while (0);\
2462
2463 static struct nla_policy
2464 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] __read_mostly = {
2465         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2466         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2467         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2468         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2469         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2470         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2471         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2472
2473         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2474         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2475         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2476         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2477         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2478         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2479 };
2480
2481 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2482 {
2483         int err;
2484         u32 mask;
2485         struct cfg80211_registered_device *rdev;
2486         struct net_device *dev;
2487         struct mesh_config cfg;
2488         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2489         struct nlattr *parent_attr;
2490
2491         parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
2492         if (!parent_attr)
2493                 return -EINVAL;
2494         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2495                         parent_attr, nl80211_meshconf_params_policy))
2496                 return -EINVAL;
2497
2498         rtnl_lock();
2499
2500         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
2501         if (err)
2502                 goto out_rtnl;
2503
2504         if (!rdev->ops->set_mesh_params) {
2505                 err = -EOPNOTSUPP;
2506                 goto out;
2507         }
2508
2509         /* This makes sure that there aren't more than 32 mesh config
2510          * parameters (otherwise our bitfield scheme would not work.) */
2511         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2512
2513         /* Fill in the params struct */
2514         mask = 0;
2515         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2516                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2517         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2518                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2519         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2520                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2521         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2522                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2523         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2524                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2525         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2526                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2527         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2528                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2529         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2530                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2531                         nla_get_u8);
2532         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2533                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2534         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2535                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2536                         nla_get_u16);
2537         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2538                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2539                         nla_get_u32);
2540         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2541                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2542                         nla_get_u16);
2543         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2544                         dot11MeshHWMPnetDiameterTraversalTime,
2545                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2546                         nla_get_u16);
2547
2548         /* Apply changes */
2549         err = rdev->ops->set_mesh_params(&rdev->wiphy, dev, &cfg, mask);
2550
2551  out:
2552         /* cleanup */
2553         cfg80211_unlock_rdev(rdev);
2554         dev_put(dev);
2555  out_rtnl:
2556         rtnl_unlock();
2557
2558         return err;
2559 }
2560
2561 #undef FILL_IN_MESH_PARAM_IF_SET
2562
2563 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2564 {
2565         struct sk_buff *msg;
2566         void *hdr = NULL;
2567         struct nlattr *nl_reg_rules;
2568         unsigned int i;
2569         int err = -EINVAL;
2570
2571         mutex_lock(&cfg80211_mutex);
2572
2573         if (!cfg80211_regdomain)
2574                 goto out;
2575
2576         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2577         if (!msg) {
2578                 err = -ENOBUFS;
2579                 goto out;
2580         }
2581
2582         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2583                              NL80211_CMD_GET_REG);
2584         if (!hdr)
2585                 goto nla_put_failure;
2586
2587         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2588                 cfg80211_regdomain->alpha2);
2589
2590         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2591         if (!nl_reg_rules)
2592                 goto nla_put_failure;
2593
2594         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2595                 struct nlattr *nl_reg_rule;
2596                 const struct ieee80211_reg_rule *reg_rule;
2597                 const struct ieee80211_freq_range *freq_range;
2598                 const struct ieee80211_power_rule *power_rule;
2599
2600                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2601                 freq_range = &reg_rule->freq_range;
2602                 power_rule = &reg_rule->power_rule;
2603
2604                 nl_reg_rule = nla_nest_start(msg, i);
2605                 if (!nl_reg_rule)
2606                         goto nla_put_failure;
2607
2608                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2609                         reg_rule->flags);
2610                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2611                         freq_range->start_freq_khz);
2612                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2613                         freq_range->end_freq_khz);
2614                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2615                         freq_range->max_bandwidth_khz);
2616                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2617                         power_rule->max_antenna_gain);
2618                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2619                         power_rule->max_eirp);
2620
2621                 nla_nest_end(msg, nl_reg_rule);
2622         }
2623
2624         nla_nest_end(msg, nl_reg_rules);
2625
2626         genlmsg_end(msg, hdr);
2627         err = genlmsg_reply(msg, info);
2628         goto out;
2629
2630 nla_put_failure:
2631         genlmsg_cancel(msg, hdr);
2632         err = -EMSGSIZE;
2633 out:
2634         mutex_unlock(&cfg80211_mutex);
2635         return err;
2636 }
2637
2638 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2639 {
2640         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2641         struct nlattr *nl_reg_rule;
2642         char *alpha2 = NULL;
2643         int rem_reg_rules = 0, r = 0;
2644         u32 num_rules = 0, rule_idx = 0, size_of_regd;
2645         struct ieee80211_regdomain *rd = NULL;
2646
2647         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2648                 return -EINVAL;
2649
2650         if (!info->attrs[NL80211_ATTR_REG_RULES])
2651                 return -EINVAL;
2652
2653         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2654
2655         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2656                         rem_reg_rules) {
2657                 num_rules++;
2658                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2659                         return -EINVAL;
2660         }
2661
2662         mutex_lock(&cfg80211_mutex);
2663
2664         if (!reg_is_valid_request(alpha2)) {
2665                 r = -EINVAL;
2666                 goto bad_reg;
2667         }
2668
2669         size_of_regd = sizeof(struct ieee80211_regdomain) +
2670                 (num_rules * sizeof(struct ieee80211_reg_rule));
2671
2672         rd = kzalloc(size_of_regd, GFP_KERNEL);
2673         if (!rd) {
2674                 r = -ENOMEM;
2675                 goto bad_reg;
2676         }
2677
2678         rd->n_reg_rules = num_rules;
2679         rd->alpha2[0] = alpha2[0];
2680         rd->alpha2[1] = alpha2[1];
2681
2682         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2683                         rem_reg_rules) {
2684                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2685                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2686                         reg_rule_policy);
2687                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2688                 if (r)
2689                         goto bad_reg;
2690
2691                 rule_idx++;
2692
2693                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
2694                         r = -EINVAL;
2695                         goto bad_reg;
2696                 }
2697         }
2698
2699         BUG_ON(rule_idx != num_rules);
2700
2701         r = set_regdom(rd);
2702
2703         mutex_unlock(&cfg80211_mutex);
2704
2705         return r;
2706
2707  bad_reg:
2708         mutex_unlock(&cfg80211_mutex);
2709         kfree(rd);
2710         return r;
2711 }
2712
2713 static int validate_scan_freqs(struct nlattr *freqs)
2714 {
2715         struct nlattr *attr1, *attr2;
2716         int n_channels = 0, tmp1, tmp2;
2717
2718         nla_for_each_nested(attr1, freqs, tmp1) {
2719                 n_channels++;
2720                 /*
2721                  * Some hardware has a limited channel list for
2722                  * scanning, and it is pretty much nonsensical
2723                  * to scan for a channel twice, so disallow that
2724                  * and don't require drivers to check that the
2725                  * channel list they get isn't longer than what
2726                  * they can scan, as long as they can scan all
2727                  * the channels they registered at once.
2728                  */
2729                 nla_for_each_nested(attr2, freqs, tmp2)
2730                         if (attr1 != attr2 &&
2731                             nla_get_u32(attr1) == nla_get_u32(attr2))
2732                                 return 0;
2733         }
2734
2735         return n_channels;
2736 }
2737
2738 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
2739 {
2740         struct cfg80211_registered_device *rdev;
2741         struct net_device *dev;
2742         struct cfg80211_scan_request *request;
2743         struct cfg80211_ssid *ssid;
2744         struct ieee80211_channel *channel;
2745         struct nlattr *attr;
2746         struct wiphy *wiphy;
2747         int err, tmp, n_ssids = 0, n_channels, i;
2748         enum ieee80211_band band;
2749         size_t ie_len;
2750
2751         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2752                 return -EINVAL;
2753
2754         rtnl_lock();
2755
2756         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
2757         if (err)
2758                 goto out_rtnl;
2759
2760         wiphy = &rdev->wiphy;
2761
2762         if (!rdev->ops->scan) {
2763                 err = -EOPNOTSUPP;
2764                 goto out;
2765         }
2766
2767         if (!netif_running(dev)) {
2768                 err = -ENETDOWN;
2769                 goto out;
2770         }
2771
2772         if (rdev->scan_req) {
2773                 err = -EBUSY;
2774                 goto out;
2775         }
2776
2777         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2778                 n_channels = validate_scan_freqs(
2779                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
2780                 if (!n_channels) {
2781                         err = -EINVAL;
2782                         goto out;
2783                 }
2784         } else {
2785                 n_channels = 0;
2786
2787                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
2788                         if (wiphy->bands[band])
2789                                 n_channels += wiphy->bands[band]->n_channels;
2790         }
2791
2792         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
2793                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
2794                         n_ssids++;
2795
2796         if (n_ssids > wiphy->max_scan_ssids) {
2797                 err = -EINVAL;
2798                 goto out;
2799         }
2800
2801         if (info->attrs[NL80211_ATTR_IE])
2802                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2803         else
2804                 ie_len = 0;
2805
2806         if (ie_len > wiphy->max_scan_ie_len) {
2807                 err = -EINVAL;
2808                 goto out;
2809         }
2810
2811         request = kzalloc(sizeof(*request)
2812                         + sizeof(*ssid) * n_ssids
2813                         + sizeof(channel) * n_channels
2814                         + ie_len, GFP_KERNEL);
2815         if (!request) {
2816                 err = -ENOMEM;
2817                 goto out;
2818         }
2819
2820         request->channels = (void *)((char *)request + sizeof(*request));
2821         request->n_channels = n_channels;
2822         if (n_ssids)
2823                 request->ssids = (void *)(request->channels + n_channels);
2824         request->n_ssids = n_ssids;
2825         if (ie_len) {
2826                 if (request->ssids)
2827                         request->ie = (void *)(request->ssids + n_ssids);
2828                 else
2829                         request->ie = (void *)(request->channels + n_channels);
2830         }
2831
2832         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2833                 /* user specified, bail out if channel not found */
2834                 request->n_channels = n_channels;
2835                 i = 0;
2836                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
2837                         request->channels[i] = ieee80211_get_channel(wiphy, nla_get_u32(attr));
2838                         if (!request->channels[i]) {
2839                                 err = -EINVAL;
2840                                 goto out_free;
2841                         }
2842                         i++;
2843                 }
2844         } else {
2845                 /* all channels */
2846                 i = 0;
2847                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
2848                         int j;
2849                         if (!wiphy->bands[band])
2850                                 continue;
2851                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
2852                                 request->channels[i] = &wiphy->bands[band]->channels[j];
2853                                 i++;
2854                         }
2855                 }
2856         }
2857
2858         i = 0;
2859         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
2860                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
2861                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
2862                                 err = -EINVAL;
2863                                 goto out_free;
2864                         }
2865                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
2866                         request->ssids[i].ssid_len = nla_len(attr);
2867                         i++;
2868                 }
2869         }
2870
2871         if (info->attrs[NL80211_ATTR_IE]) {
2872                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2873                 memcpy((void *)request->ie,
2874                        nla_data(info->attrs[NL80211_ATTR_IE]),
2875                        request->ie_len);
2876         }
2877
2878         request->ifidx = dev->ifindex;
2879         request->wiphy = &rdev->wiphy;
2880
2881         rdev->scan_req = request;
2882         err = rdev->ops->scan(&rdev->wiphy, dev, request);
2883
2884         if (!err)
2885                 nl80211_send_scan_start(rdev, dev);
2886
2887  out_free:
2888         if (err) {
2889                 rdev->scan_req = NULL;
2890                 kfree(request);
2891         }
2892  out:
2893         cfg80211_unlock_rdev(rdev);
2894         dev_put(dev);
2895  out_rtnl:
2896         rtnl_unlock();
2897
2898         return err;
2899 }
2900
2901 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
2902                             struct cfg80211_registered_device *rdev,
2903                             struct net_device *dev,
2904                             struct cfg80211_bss *res)
2905 {
2906         void *hdr;
2907         struct nlattr *bss;
2908
2909         hdr = nl80211hdr_put(msg, pid, seq, flags,
2910                              NL80211_CMD_NEW_SCAN_RESULTS);
2911         if (!hdr)
2912                 return -1;
2913
2914         NLA_PUT_U32(msg, NL80211_ATTR_SCAN_GENERATION,
2915                     rdev->bss_generation);
2916         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2917
2918         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
2919         if (!bss)
2920                 goto nla_put_failure;
2921         if (!is_zero_ether_addr(res->bssid))
2922                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
2923         if (res->information_elements && res->len_information_elements)
2924                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
2925                         res->len_information_elements,
2926                         res->information_elements);
2927         if (res->tsf)
2928                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
2929         if (res->beacon_interval)
2930                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
2931         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
2932         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
2933
2934         switch (rdev->wiphy.signal_type) {
2935         case CFG80211_SIGNAL_TYPE_MBM:
2936                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
2937                 break;
2938         case CFG80211_SIGNAL_TYPE_UNSPEC:
2939                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
2940                 break;
2941         default:
2942                 break;
2943         }
2944
2945         nla_nest_end(msg, bss);
2946
2947         return genlmsg_end(msg, hdr);
2948
2949  nla_put_failure:
2950         genlmsg_cancel(msg, hdr);
2951         return -EMSGSIZE;
2952 }
2953
2954 static int nl80211_dump_scan(struct sk_buff *skb,
2955                              struct netlink_callback *cb)
2956 {
2957         struct cfg80211_registered_device *dev;
2958         struct net_device *netdev;
2959         struct cfg80211_internal_bss *scan;
2960         int ifidx = cb->args[0];
2961         int start = cb->args[1], idx = 0;
2962         int err;
2963
2964         if (!ifidx) {
2965                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
2966                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
2967                                   nl80211_policy);
2968                 if (err)
2969                         return err;
2970
2971                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
2972                         return -EINVAL;
2973
2974                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
2975                 if (!ifidx)
2976                         return -EINVAL;
2977                 cb->args[0] = ifidx;
2978         }
2979
2980         netdev = dev_get_by_index(&init_net, ifidx);
2981         if (!netdev)
2982                 return -ENODEV;
2983
2984         dev = cfg80211_get_dev_from_ifindex(ifidx);
2985         if (IS_ERR(dev)) {
2986                 err = PTR_ERR(dev);
2987                 goto out_put_netdev;
2988         }
2989
2990         spin_lock_bh(&dev->bss_lock);
2991         cfg80211_bss_expire(dev);
2992
2993         list_for_each_entry(scan, &dev->bss_list, list) {
2994                 if (++idx <= start)
2995                         continue;
2996                 if (nl80211_send_bss(skb,
2997                                 NETLINK_CB(cb->skb).pid,
2998                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2999                                 dev, netdev, &scan->pub) < 0) {
3000                         idx--;
3001                         goto out;
3002                 }
3003         }
3004
3005  out:
3006         spin_unlock_bh(&dev->bss_lock);
3007
3008         cb->args[1] = idx;
3009         err = skb->len;
3010         cfg80211_unlock_rdev(dev);
3011  out_put_netdev:
3012         dev_put(netdev);
3013
3014         return err;
3015 }
3016
3017 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
3018 {
3019         return auth_type <= NL80211_AUTHTYPE_MAX;
3020 }
3021
3022 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
3023 {
3024         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
3025                                   NL80211_WPA_VERSION_2));
3026 }
3027
3028 static bool nl80211_valid_akm_suite(u32 akm)
3029 {
3030         return akm == WLAN_AKM_SUITE_8021X ||
3031                 akm == WLAN_AKM_SUITE_PSK;
3032 }
3033
3034 static bool nl80211_valid_cipher_suite(u32 cipher)
3035 {
3036         return cipher == WLAN_CIPHER_SUITE_WEP40 ||
3037                 cipher == WLAN_CIPHER_SUITE_WEP104 ||
3038                 cipher == WLAN_CIPHER_SUITE_TKIP ||
3039                 cipher == WLAN_CIPHER_SUITE_CCMP ||
3040                 cipher == WLAN_CIPHER_SUITE_AES_CMAC;
3041 }
3042
3043
3044 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
3045 {
3046         struct cfg80211_registered_device *rdev;
3047         struct net_device *dev;
3048         struct ieee80211_channel *chan;
3049         const u8 *bssid, *ssid, *ie = NULL;
3050         int err, ssid_len, ie_len = 0;
3051         enum nl80211_auth_type auth_type;
3052
3053         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3054                 return -EINVAL;
3055
3056         if (!info->attrs[NL80211_ATTR_MAC])
3057                 return -EINVAL;
3058
3059         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
3060                 return -EINVAL;
3061
3062         if (!info->attrs[NL80211_ATTR_SSID])
3063                 return -EINVAL;
3064
3065         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
3066                 return -EINVAL;
3067
3068         rtnl_lock();
3069
3070         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
3071         if (err)
3072                 goto unlock_rtnl;
3073
3074         if (!rdev->ops->auth) {
3075                 err = -EOPNOTSUPP;
3076                 goto out;
3077         }
3078
3079         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3080                 err = -EOPNOTSUPP;
3081                 goto out;
3082         }
3083
3084         if (!netif_running(dev)) {
3085                 err = -ENETDOWN;
3086                 goto out;
3087         }
3088
3089         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3090         chan = ieee80211_get_channel(&rdev->wiphy,
3091                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3092         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED)) {
3093                 err = -EINVAL;
3094                 goto out;
3095         }
3096
3097         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3098         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3099
3100         if (info->attrs[NL80211_ATTR_IE]) {
3101                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3102                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3103         }
3104
3105         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
3106         if (!nl80211_valid_auth_type(auth_type)) {
3107                 err = -EINVAL;
3108                 goto out;
3109         }
3110
3111         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
3112                                  ssid, ssid_len, ie, ie_len);
3113
3114 out:
3115         cfg80211_unlock_rdev(rdev);
3116         dev_put(dev);
3117 unlock_rtnl:
3118         rtnl_unlock();
3119         return err;
3120 }
3121
3122 static int nl80211_crypto_settings(struct genl_info *info,
3123                                    struct cfg80211_crypto_settings *settings,
3124                                    int cipher_limit)
3125 {
3126         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
3127
3128         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
3129                 void *data;
3130                 int len, i;
3131
3132                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3133                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3134                 settings->n_ciphers_pairwise = len / sizeof(u32);
3135
3136                 if (len % sizeof(u32))
3137                         return -EINVAL;
3138
3139                 if (settings->n_ciphers_pairwise > cipher_limit)
3140                         return -EINVAL;
3141
3142                 memcpy(settings->ciphers_pairwise, data, len);
3143
3144                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3145                         if (!nl80211_valid_cipher_suite(
3146                                         settings->ciphers_pairwise[i]))
3147                                 return -EINVAL;
3148         }
3149
3150         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
3151                 settings->cipher_group =
3152                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
3153                 if (!nl80211_valid_cipher_suite(settings->cipher_group))
3154                         return -EINVAL;
3155         }
3156
3157         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
3158                 settings->wpa_versions =
3159                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
3160                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
3161                         return -EINVAL;
3162         }
3163
3164         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
3165                 void *data;
3166                 int len, i;
3167
3168                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
3169                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
3170                 settings->n_akm_suites = len / sizeof(u32);
3171
3172                 if (len % sizeof(u32))
3173                         return -EINVAL;
3174
3175                 memcpy(settings->akm_suites, data, len);
3176
3177                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3178                         if (!nl80211_valid_akm_suite(settings->akm_suites[i]))
3179                                 return -EINVAL;
3180         }
3181
3182         return 0;
3183 }
3184
3185 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
3186 {
3187         struct cfg80211_registered_device *rdev;
3188         struct net_device *dev;
3189         struct cfg80211_crypto_settings crypto;
3190         struct ieee80211_channel *chan;
3191         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
3192         int err, ssid_len, ie_len = 0;
3193         bool use_mfp = false;
3194
3195         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3196                 return -EINVAL;
3197
3198         if (!info->attrs[NL80211_ATTR_MAC] ||
3199             !info->attrs[NL80211_ATTR_SSID] ||
3200             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
3201                 return -EINVAL;
3202
3203         rtnl_lock();
3204
3205         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
3206         if (err)
3207                 goto unlock_rtnl;
3208
3209         if (!rdev->ops->assoc) {
3210                 err = -EOPNOTSUPP;
3211                 goto out;
3212         }
3213
3214         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3215                 err = -EOPNOTSUPP;
3216                 goto out;
3217         }
3218
3219         if (!netif_running(dev)) {
3220                 err = -ENETDOWN;
3221                 goto out;
3222         }
3223
3224         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3225
3226         chan = ieee80211_get_channel(&rdev->wiphy,
3227                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3228         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED)) {
3229                 err = -EINVAL;
3230                 goto out;
3231         }
3232
3233         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3234         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3235
3236         if (info->attrs[NL80211_ATTR_IE]) {
3237                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3238                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3239         }
3240
3241         if (info->attrs[NL80211_ATTR_USE_MFP]) {
3242                 enum nl80211_mfp mfp =
3243                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
3244                 if (mfp == NL80211_MFP_REQUIRED)
3245                         use_mfp = true;
3246                 else if (mfp != NL80211_MFP_NO) {
3247                         err = -EINVAL;
3248                         goto out;
3249                 }
3250         }
3251
3252         if (info->attrs[NL80211_ATTR_PREV_BSSID])
3253                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
3254
3255         err = nl80211_crypto_settings(info, &crypto, 1);
3256         if (!err)
3257                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
3258                                           ssid, ssid_len, ie, ie_len, use_mfp,
3259                                           &crypto);
3260
3261 out:
3262         cfg80211_unlock_rdev(rdev);
3263         dev_put(dev);
3264 unlock_rtnl:
3265         rtnl_unlock();
3266         return err;
3267 }
3268
3269 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
3270 {
3271         struct cfg80211_registered_device *rdev;
3272         struct net_device *dev;
3273         const u8 *ie = NULL, *bssid;
3274         int err, ie_len = 0;
3275         u16 reason_code;
3276
3277         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3278                 return -EINVAL;
3279
3280         if (!info->attrs[NL80211_ATTR_MAC])
3281                 return -EINVAL;
3282
3283         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3284                 return -EINVAL;
3285
3286         rtnl_lock();
3287
3288         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
3289         if (err)
3290                 goto unlock_rtnl;
3291
3292         if (!rdev->ops->deauth) {
3293                 err = -EOPNOTSUPP;
3294                 goto out;
3295         }
3296
3297         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3298                 err = -EOPNOTSUPP;
3299                 goto out;
3300         }
3301
3302         if (!netif_running(dev)) {
3303                 err = -ENETDOWN;
3304                 goto out;
3305         }
3306
3307         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3308
3309         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3310         if (reason_code == 0) {
3311                 /* Reason Code 0 is reserved */
3312                 err = -EINVAL;
3313                 goto out;
3314         }
3315
3316         if (info->attrs[NL80211_ATTR_IE]) {
3317                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3318                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3319         }
3320
3321         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code);
3322
3323 out:
3324         cfg80211_unlock_rdev(rdev);
3325         dev_put(dev);
3326 unlock_rtnl:
3327         rtnl_unlock();
3328         return err;
3329 }
3330
3331 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
3332 {
3333         struct cfg80211_registered_device *rdev;
3334         struct net_device *dev;
3335         const u8 *ie = NULL, *bssid;
3336         int err, ie_len = 0;
3337         u16 reason_code;
3338
3339         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3340                 return -EINVAL;
3341
3342         if (!info->attrs[NL80211_ATTR_MAC])
3343                 return -EINVAL;
3344
3345         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3346                 return -EINVAL;
3347
3348         rtnl_lock();
3349
3350         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
3351         if (err)
3352                 goto unlock_rtnl;
3353
3354         if (!rdev->ops->disassoc) {
3355                 err = -EOPNOTSUPP;
3356                 goto out;
3357         }
3358
3359         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3360                 err = -EOPNOTSUPP;
3361                 goto out;
3362         }
3363
3364         if (!netif_running(dev)) {
3365                 err = -ENETDOWN;
3366                 goto out;
3367         }
3368
3369         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3370
3371         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3372         if (reason_code == 0) {
3373                 /* Reason Code 0 is reserved */
3374                 err = -EINVAL;
3375                 goto out;
3376         }
3377
3378         if (info->attrs[NL80211_ATTR_IE]) {
3379                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3380                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3381         }
3382
3383         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code);
3384
3385 out:
3386         cfg80211_unlock_rdev(rdev);
3387         dev_put(dev);
3388 unlock_rtnl:
3389         rtnl_unlock();
3390         return err;
3391 }
3392
3393 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
3394 {
3395         struct cfg80211_registered_device *rdev;
3396         struct net_device *dev;
3397         struct cfg80211_ibss_params ibss;
3398         struct wiphy *wiphy;
3399         int err;
3400
3401         memset(&ibss, 0, sizeof(ibss));
3402
3403         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3404                 return -EINVAL;
3405
3406         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
3407             !info->attrs[NL80211_ATTR_SSID] ||
3408             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3409                 return -EINVAL;
3410
3411         ibss.beacon_interval = 100;
3412
3413         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
3414                 ibss.beacon_interval =
3415                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3416                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
3417                         return -EINVAL;
3418         }
3419
3420         rtnl_lock();
3421
3422         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
3423         if (err)
3424                 goto unlock_rtnl;
3425
3426         if (!rdev->ops->join_ibss) {
3427                 err = -EOPNOTSUPP;
3428                 goto out;
3429         }
3430
3431         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3432                 err = -EOPNOTSUPP;
3433                 goto out;
3434         }
3435
3436         if (!netif_running(dev)) {
3437                 err = -ENETDOWN;
3438                 goto out;
3439         }
3440
3441         wiphy = &rdev->wiphy;
3442
3443         if (info->attrs[NL80211_ATTR_MAC])
3444                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3445         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3446         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3447
3448         if (info->attrs[NL80211_ATTR_IE]) {
3449                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3450                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3451         }
3452
3453         ibss.channel = ieee80211_get_channel(wiphy,
3454                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3455         if (!ibss.channel ||
3456             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
3457             ibss.channel->flags & IEEE80211_CHAN_DISABLED) {
3458                 err = -EINVAL;
3459                 goto out;
3460         }
3461
3462         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
3463
3464         err = cfg80211_join_ibss(rdev, dev, &ibss);
3465
3466 out:
3467         cfg80211_unlock_rdev(rdev);
3468         dev_put(dev);
3469 unlock_rtnl:
3470         rtnl_unlock();
3471         return err;
3472 }
3473
3474 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
3475 {
3476         struct cfg80211_registered_device *rdev;
3477         struct net_device *dev;
3478         int err;
3479
3480         rtnl_lock();
3481
3482         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
3483         if (err)
3484                 goto unlock_rtnl;
3485
3486         if (!rdev->ops->leave_ibss) {
3487                 err = -EOPNOTSUPP;
3488                 goto out;
3489         }
3490
3491         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3492                 err = -EOPNOTSUPP;
3493                 goto out;
3494         }
3495
3496         if (!netif_running(dev)) {
3497                 err = -ENETDOWN;
3498                 goto out;
3499         }
3500
3501         err = cfg80211_leave_ibss(rdev, dev, false);
3502
3503 out:
3504         cfg80211_unlock_rdev(rdev);
3505         dev_put(dev);
3506 unlock_rtnl:
3507         rtnl_unlock();
3508         return err;
3509 }
3510
3511 #ifdef CONFIG_NL80211_TESTMODE
3512 static struct genl_multicast_group nl80211_testmode_mcgrp = {
3513         .name = "testmode",
3514 };
3515
3516 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
3517 {
3518         struct cfg80211_registered_device *rdev;
3519         int err;
3520
3521         if (!info->attrs[NL80211_ATTR_TESTDATA])
3522                 return -EINVAL;
3523
3524         rtnl_lock();
3525
3526         rdev = cfg80211_get_dev_from_info(info);
3527         if (IS_ERR(rdev)) {
3528                 err = PTR_ERR(rdev);
3529                 goto unlock_rtnl;
3530         }
3531
3532         err = -EOPNOTSUPP;
3533         if (rdev->ops->testmode_cmd) {
3534                 rdev->testmode_info = info;
3535                 err = rdev->ops->testmode_cmd(&rdev->wiphy,
3536                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
3537                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
3538                 rdev->testmode_info = NULL;
3539         }
3540
3541         cfg80211_unlock_rdev(rdev);
3542
3543  unlock_rtnl:
3544         rtnl_unlock();
3545         return err;
3546 }
3547
3548 static struct sk_buff *
3549 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
3550                               int approxlen, u32 pid, u32 seq, gfp_t gfp)
3551 {
3552         struct sk_buff *skb;
3553         void *hdr;
3554         struct nlattr *data;
3555
3556         skb = nlmsg_new(approxlen + 100, gfp);
3557         if (!skb)
3558                 return NULL;
3559
3560         hdr = nl80211hdr_put(skb, pid, seq, 0, NL80211_CMD_TESTMODE);
3561         if (!hdr) {
3562                 kfree_skb(skb);
3563                 return NULL;
3564         }
3565
3566         NLA_PUT_U32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3567         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
3568
3569         ((void **)skb->cb)[0] = rdev;
3570         ((void **)skb->cb)[1] = hdr;
3571         ((void **)skb->cb)[2] = data;
3572
3573         return skb;
3574
3575  nla_put_failure:
3576         kfree_skb(skb);
3577         return NULL;
3578 }
3579
3580 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
3581                                                   int approxlen)
3582 {
3583         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
3584
3585         if (WARN_ON(!rdev->testmode_info))
3586                 return NULL;
3587
3588         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
3589                                 rdev->testmode_info->snd_pid,
3590                                 rdev->testmode_info->snd_seq,
3591                                 GFP_KERNEL);
3592 }
3593 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
3594
3595 int cfg80211_testmode_reply(struct sk_buff *skb)
3596 {
3597         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
3598         void *hdr = ((void **)skb->cb)[1];
3599         struct nlattr *data = ((void **)skb->cb)[2];
3600
3601         if (WARN_ON(!rdev->testmode_info)) {
3602                 kfree_skb(skb);
3603                 return -EINVAL;
3604         }
3605
3606         nla_nest_end(skb, data);
3607         genlmsg_end(skb, hdr);
3608         return genlmsg_reply(skb, rdev->testmode_info);
3609 }
3610 EXPORT_SYMBOL(cfg80211_testmode_reply);
3611
3612 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
3613                                                   int approxlen, gfp_t gfp)
3614 {
3615         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
3616
3617         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
3618 }
3619 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
3620
3621 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
3622 {
3623         void *hdr = ((void **)skb->cb)[1];
3624         struct nlattr *data = ((void **)skb->cb)[2];
3625
3626         nla_nest_end(skb, data);
3627         genlmsg_end(skb, hdr);
3628         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
3629 }
3630 EXPORT_SYMBOL(cfg80211_testmode_event);
3631 #endif
3632
3633 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
3634 {
3635         struct cfg80211_registered_device *rdev;
3636         struct net_device *dev;
3637         struct cfg80211_connect_params connect;
3638         struct wiphy *wiphy;
3639         int err;
3640
3641         memset(&connect, 0, sizeof(connect));
3642
3643         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3644                 return -EINVAL;
3645
3646         if (!info->attrs[NL80211_ATTR_SSID] ||
3647             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3648                 return -EINVAL;
3649
3650         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3651                 connect.auth_type =
3652                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
3653                 if (!nl80211_valid_auth_type(connect.auth_type))
3654                         return -EINVAL;
3655         } else
3656                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3657
3658         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
3659
3660         err = nl80211_crypto_settings(info, &connect.crypto,
3661                                       NL80211_MAX_NR_CIPHER_SUITES);
3662         if (err)
3663                 return err;
3664         rtnl_lock();
3665
3666         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
3667         if (err)
3668                 goto unlock_rtnl;
3669
3670         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3671                 err = -EOPNOTSUPP;
3672                 goto out;
3673         }
3674
3675         if (!netif_running(dev)) {
3676                 err = -ENETDOWN;
3677                 goto out;
3678         }
3679
3680         wiphy = &rdev->wiphy;
3681
3682         connect.bssid = NULL;
3683         connect.channel = NULL;
3684         connect.auth_type = NL80211_AUTHTYPE_OPEN_SYSTEM;
3685
3686         if (info->attrs[NL80211_ATTR_MAC])
3687                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3688         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3689         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3690
3691         if (info->attrs[NL80211_ATTR_IE]) {
3692                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3693                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3694         }
3695
3696         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3697                 connect.channel =
3698                         ieee80211_get_channel(wiphy,
3699                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3700                 if (!connect.channel ||
3701                     connect.channel->flags & IEEE80211_CHAN_DISABLED) {
3702                         err = -EINVAL;
3703                         goto out;
3704                 }
3705         }
3706
3707         err = cfg80211_connect(rdev, dev, &connect);
3708
3709 out:
3710         cfg80211_unlock_rdev(rdev);
3711         dev_put(dev);
3712 unlock_rtnl:
3713         rtnl_unlock();
3714         return err;
3715 }
3716
3717 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
3718 {
3719         struct cfg80211_registered_device *rdev;
3720         struct net_device *dev;
3721         int err;
3722         u16 reason;
3723
3724         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3725                 reason = WLAN_REASON_DEAUTH_LEAVING;
3726         else
3727                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3728
3729         if (reason == 0)
3730                 return -EINVAL;
3731
3732         rtnl_lock();
3733
3734         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
3735         if (err)
3736                 goto unlock_rtnl;
3737
3738         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3739                 err = -EOPNOTSUPP;
3740                 goto out;
3741         }
3742
3743         if (!netif_running(dev)) {
3744                 err = -ENETDOWN;
3745                 goto out;
3746         }
3747
3748         err = cfg80211_disconnect(rdev, dev, reason, true);
3749
3750 out:
3751         cfg80211_unlock_rdev(rdev);
3752         dev_put(dev);
3753 unlock_rtnl:
3754         rtnl_unlock();
3755         return err;
3756 }
3757
3758 static struct genl_ops nl80211_ops[] = {
3759         {
3760                 .cmd = NL80211_CMD_GET_WIPHY,
3761                 .doit = nl80211_get_wiphy,
3762                 .dumpit = nl80211_dump_wiphy,
3763                 .policy = nl80211_policy,
3764                 /* can be retrieved by unprivileged users */
3765         },
3766         {
3767                 .cmd = NL80211_CMD_SET_WIPHY,
3768                 .doit = nl80211_set_wiphy,
3769                 .policy = nl80211_policy,
3770                 .flags = GENL_ADMIN_PERM,
3771         },
3772         {
3773                 .cmd = NL80211_CMD_GET_INTERFACE,
3774                 .doit = nl80211_get_interface,
3775                 .dumpit = nl80211_dump_interface,
3776                 .policy = nl80211_policy,
3777                 /* can be retrieved by unprivileged users */
3778         },
3779         {
3780                 .cmd = NL80211_CMD_SET_INTERFACE,
3781                 .doit = nl80211_set_interface,
3782                 .policy = nl80211_policy,
3783                 .flags = GENL_ADMIN_PERM,
3784         },
3785         {
3786                 .cmd = NL80211_CMD_NEW_INTERFACE,
3787                 .doit = nl80211_new_interface,
3788                 .policy = nl80211_policy,
3789                 .flags = GENL_ADMIN_PERM,
3790         },
3791         {
3792                 .cmd = NL80211_CMD_DEL_INTERFACE,
3793                 .doit = nl80211_del_interface,
3794                 .policy = nl80211_policy,
3795                 .flags = GENL_ADMIN_PERM,
3796         },
3797         {
3798                 .cmd = NL80211_CMD_GET_KEY,
3799                 .doit = nl80211_get_key,
3800                 .policy = nl80211_policy,
3801                 .flags = GENL_ADMIN_PERM,
3802         },
3803         {
3804                 .cmd = NL80211_CMD_SET_KEY,
3805                 .doit = nl80211_set_key,
3806                 .policy = nl80211_policy,
3807                 .flags = GENL_ADMIN_PERM,
3808         },
3809         {
3810                 .cmd = NL80211_CMD_NEW_KEY,
3811                 .doit = nl80211_new_key,
3812                 .policy = nl80211_policy,
3813                 .flags = GENL_ADMIN_PERM,
3814         },
3815         {
3816                 .cmd = NL80211_CMD_DEL_KEY,
3817                 .doit = nl80211_del_key,
3818                 .policy = nl80211_policy,
3819                 .flags = GENL_ADMIN_PERM,
3820         },
3821         {
3822                 .cmd = NL80211_CMD_SET_BEACON,
3823                 .policy = nl80211_policy,
3824                 .flags = GENL_ADMIN_PERM,
3825                 .doit = nl80211_addset_beacon,
3826         },
3827         {
3828                 .cmd = NL80211_CMD_NEW_BEACON,
3829                 .policy = nl80211_policy,
3830                 .flags = GENL_ADMIN_PERM,
3831                 .doit = nl80211_addset_beacon,
3832         },
3833         {
3834                 .cmd = NL80211_CMD_DEL_BEACON,
3835                 .policy = nl80211_policy,
3836                 .flags = GENL_ADMIN_PERM,
3837                 .doit = nl80211_del_beacon,
3838         },
3839         {
3840                 .cmd = NL80211_CMD_GET_STATION,
3841                 .doit = nl80211_get_station,
3842                 .dumpit = nl80211_dump_station,
3843                 .policy = nl80211_policy,
3844         },
3845         {
3846                 .cmd = NL80211_CMD_SET_STATION,
3847                 .doit = nl80211_set_station,
3848                 .policy = nl80211_policy,
3849                 .flags = GENL_ADMIN_PERM,
3850         },
3851         {
3852                 .cmd = NL80211_CMD_NEW_STATION,
3853                 .doit = nl80211_new_station,
3854                 .policy = nl80211_policy,
3855                 .flags = GENL_ADMIN_PERM,
3856         },
3857         {
3858                 .cmd = NL80211_CMD_DEL_STATION,
3859                 .doit = nl80211_del_station,
3860                 .policy = nl80211_policy,
3861                 .flags = GENL_ADMIN_PERM,
3862         },
3863         {
3864                 .cmd = NL80211_CMD_GET_MPATH,
3865                 .doit = nl80211_get_mpath,
3866                 .dumpit = nl80211_dump_mpath,
3867                 .policy = nl80211_policy,
3868                 .flags = GENL_ADMIN_PERM,
3869         },
3870         {
3871                 .cmd = NL80211_CMD_SET_MPATH,
3872                 .doit = nl80211_set_mpath,
3873                 .policy = nl80211_policy,
3874                 .flags = GENL_ADMIN_PERM,
3875         },
3876         {
3877                 .cmd = NL80211_CMD_NEW_MPATH,
3878                 .doit = nl80211_new_mpath,
3879                 .policy = nl80211_policy,
3880                 .flags = GENL_ADMIN_PERM,
3881         },
3882         {
3883                 .cmd = NL80211_CMD_DEL_MPATH,
3884                 .doit = nl80211_del_mpath,
3885                 .policy = nl80211_policy,
3886                 .flags = GENL_ADMIN_PERM,
3887         },
3888         {
3889                 .cmd = NL80211_CMD_SET_BSS,
3890                 .doit = nl80211_set_bss,
3891                 .policy = nl80211_policy,
3892                 .flags = GENL_ADMIN_PERM,
3893         },
3894         {
3895                 .cmd = NL80211_CMD_GET_REG,
3896                 .doit = nl80211_get_reg,
3897                 .policy = nl80211_policy,
3898                 /* can be retrieved by unprivileged users */
3899         },
3900         {
3901                 .cmd = NL80211_CMD_SET_REG,
3902                 .doit = nl80211_set_reg,
3903                 .policy = nl80211_policy,
3904                 .flags = GENL_ADMIN_PERM,
3905         },
3906         {
3907                 .cmd = NL80211_CMD_REQ_SET_REG,
3908                 .doit = nl80211_req_set_reg,
3909                 .policy = nl80211_policy,
3910                 .flags = GENL_ADMIN_PERM,
3911         },
3912         {
3913                 .cmd = NL80211_CMD_GET_MESH_PARAMS,
3914                 .doit = nl80211_get_mesh_params,
3915                 .policy = nl80211_policy,
3916                 /* can be retrieved by unprivileged users */
3917         },
3918         {
3919                 .cmd = NL80211_CMD_SET_MESH_PARAMS,
3920                 .doit = nl80211_set_mesh_params,
3921                 .policy = nl80211_policy,
3922                 .flags = GENL_ADMIN_PERM,
3923         },
3924         {
3925                 .cmd = NL80211_CMD_TRIGGER_SCAN,
3926                 .doit = nl80211_trigger_scan,
3927                 .policy = nl80211_policy,
3928                 .flags = GENL_ADMIN_PERM,
3929         },
3930         {
3931                 .cmd = NL80211_CMD_GET_SCAN,
3932                 .policy = nl80211_policy,
3933                 .dumpit = nl80211_dump_scan,
3934         },
3935         {
3936                 .cmd = NL80211_CMD_AUTHENTICATE,
3937                 .doit = nl80211_authenticate,
3938                 .policy = nl80211_policy,
3939                 .flags = GENL_ADMIN_PERM,
3940         },
3941         {
3942                 .cmd = NL80211_CMD_ASSOCIATE,
3943                 .doit = nl80211_associate,
3944                 .policy = nl80211_policy,
3945                 .flags = GENL_ADMIN_PERM,
3946         },
3947         {
3948                 .cmd = NL80211_CMD_DEAUTHENTICATE,
3949                 .doit = nl80211_deauthenticate,
3950                 .policy = nl80211_policy,
3951                 .flags = GENL_ADMIN_PERM,
3952         },
3953         {
3954                 .cmd = NL80211_CMD_DISASSOCIATE,
3955                 .doit = nl80211_disassociate,
3956                 .policy = nl80211_policy,
3957                 .flags = GENL_ADMIN_PERM,
3958         },
3959         {
3960                 .cmd = NL80211_CMD_JOIN_IBSS,
3961                 .doit = nl80211_join_ibss,
3962                 .policy = nl80211_policy,
3963                 .flags = GENL_ADMIN_PERM,
3964         },
3965         {
3966                 .cmd = NL80211_CMD_LEAVE_IBSS,
3967                 .doit = nl80211_leave_ibss,
3968                 .policy = nl80211_policy,
3969                 .flags = GENL_ADMIN_PERM,
3970         },
3971 #ifdef CONFIG_NL80211_TESTMODE
3972         {
3973                 .cmd = NL80211_CMD_TESTMODE,
3974                 .doit = nl80211_testmode_do,
3975                 .policy = nl80211_policy,
3976                 .flags = GENL_ADMIN_PERM,
3977         },
3978 #endif
3979         {
3980                 .cmd = NL80211_CMD_CONNECT,
3981                 .doit = nl80211_connect,
3982                 .policy = nl80211_policy,
3983                 .flags = GENL_ADMIN_PERM,
3984         },
3985         {
3986                 .cmd = NL80211_CMD_DISCONNECT,
3987                 .doit = nl80211_disconnect,
3988                 .policy = nl80211_policy,
3989                 .flags = GENL_ADMIN_PERM,
3990         },
3991 };
3992 static struct genl_multicast_group nl80211_mlme_mcgrp = {
3993         .name = "mlme",
3994 };
3995
3996 /* multicast groups */
3997 static struct genl_multicast_group nl80211_config_mcgrp = {
3998         .name = "config",
3999 };
4000 static struct genl_multicast_group nl80211_scan_mcgrp = {
4001         .name = "scan",
4002 };
4003 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
4004         .name = "regulatory",
4005 };
4006
4007 /* notification functions */
4008
4009 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
4010 {
4011         struct sk_buff *msg;
4012
4013         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4014         if (!msg)
4015                 return;
4016
4017         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
4018                 nlmsg_free(msg);
4019                 return;
4020         }
4021
4022         genlmsg_multicast(msg, 0, nl80211_config_mcgrp.id, GFP_KERNEL);
4023 }
4024
4025 static int nl80211_add_scan_req(struct sk_buff *msg,
4026                                 struct cfg80211_registered_device *rdev)
4027 {
4028         struct cfg80211_scan_request *req = rdev->scan_req;
4029         struct nlattr *nest;
4030         int i;
4031
4032         ASSERT_RDEV_LOCK(rdev);
4033
4034         if (WARN_ON(!req))
4035                 return 0;
4036
4037         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
4038         if (!nest)
4039                 goto nla_put_failure;
4040         for (i = 0; i < req->n_ssids; i++)
4041                 NLA_PUT(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid);
4042         nla_nest_end(msg, nest);
4043
4044         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
4045         if (!nest)
4046                 goto nla_put_failure;
4047         for (i = 0; i < req->n_channels; i++)
4048                 NLA_PUT_U32(msg, i, req->channels[i]->center_freq);
4049         nla_nest_end(msg, nest);
4050
4051         if (req->ie)
4052                 NLA_PUT(msg, NL80211_ATTR_IE, req->ie_len, req->ie);
4053
4054         return 0;
4055  nla_put_failure:
4056         return -ENOBUFS;
4057 }
4058
4059 static int nl80211_send_scan_msg(struct sk_buff *msg,
4060                                  struct cfg80211_registered_device *rdev,
4061                                  struct net_device *netdev,
4062                                  u32 pid, u32 seq, int flags,
4063                                  u32 cmd)
4064 {
4065         void *hdr;
4066
4067         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
4068         if (!hdr)
4069                 return -1;
4070
4071         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4072         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4073
4074         /* ignore errors and send incomplete event anyway */
4075         nl80211_add_scan_req(msg, rdev);
4076
4077         return genlmsg_end(msg, hdr);
4078
4079  nla_put_failure:
4080         genlmsg_cancel(msg, hdr);
4081         return -EMSGSIZE;
4082 }
4083
4084 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
4085                              struct net_device *netdev)
4086 {
4087         struct sk_buff *msg;
4088
4089         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
4090         if (!msg)
4091                 return;
4092
4093         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
4094                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
4095                 nlmsg_free(msg);
4096                 return;
4097         }
4098
4099         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
4100 }
4101
4102 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
4103                             struct net_device *netdev)
4104 {
4105         struct sk_buff *msg;
4106
4107         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4108         if (!msg)
4109                 return;
4110
4111         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
4112                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
4113                 nlmsg_free(msg);
4114                 return;
4115         }
4116
4117         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
4118 }
4119
4120 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
4121                                struct net_device *netdev)
4122 {
4123         struct sk_buff *msg;
4124
4125         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4126         if (!msg)
4127                 return;
4128
4129         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
4130                                   NL80211_CMD_SCAN_ABORTED) < 0) {
4131                 nlmsg_free(msg);
4132                 return;
4133         }
4134
4135         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
4136 }
4137
4138 /*
4139  * This can happen on global regulatory changes or device specific settings
4140  * based on custom world regulatory domains.
4141  */
4142 void nl80211_send_reg_change_event(struct regulatory_request *request)
4143 {
4144         struct sk_buff *msg;
4145         void *hdr;
4146
4147         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4148         if (!msg)
4149                 return;
4150
4151         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
4152         if (!hdr) {
4153                 nlmsg_free(msg);
4154                 return;
4155         }
4156
4157         /* Userspace can always count this one always being set */
4158         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
4159
4160         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
4161                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
4162                            NL80211_REGDOM_TYPE_WORLD);
4163         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
4164                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
4165                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
4166         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
4167                  request->intersect)
4168                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
4169                            NL80211_REGDOM_TYPE_INTERSECTION);
4170         else {
4171                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
4172                            NL80211_REGDOM_TYPE_COUNTRY);
4173                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
4174         }
4175
4176         if (wiphy_idx_valid(request->wiphy_idx))
4177                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
4178
4179         if (genlmsg_end(msg, hdr) < 0) {
4180                 nlmsg_free(msg);
4181                 return;
4182         }
4183
4184         genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_KERNEL);
4185
4186         return;
4187
4188 nla_put_failure:
4189         genlmsg_cancel(msg, hdr);
4190         nlmsg_free(msg);
4191 }
4192
4193 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
4194                                     struct net_device *netdev,
4195                                     const u8 *buf, size_t len,
4196                                     enum nl80211_commands cmd, gfp_t gfp)
4197 {
4198         struct sk_buff *msg;
4199         void *hdr;
4200
4201         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
4202         if (!msg)
4203                 return;
4204
4205         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
4206         if (!hdr) {
4207                 nlmsg_free(msg);
4208                 return;
4209         }
4210
4211         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4212         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4213         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
4214
4215         if (genlmsg_end(msg, hdr) < 0) {
4216                 nlmsg_free(msg);
4217                 return;
4218         }
4219
4220         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
4221         return;
4222
4223  nla_put_failure:
4224         genlmsg_cancel(msg, hdr);
4225         nlmsg_free(msg);
4226 }
4227
4228 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
4229                           struct net_device *netdev, const u8 *buf,
4230                           size_t len, gfp_t gfp)
4231 {
4232         nl80211_send_mlme_event(rdev, netdev, buf, len,
4233                                 NL80211_CMD_AUTHENTICATE, gfp);
4234 }
4235
4236 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
4237                            struct net_device *netdev, const u8 *buf,
4238                            size_t len, gfp_t gfp)
4239 {
4240         nl80211_send_mlme_event(rdev, netdev, buf, len,
4241                                 NL80211_CMD_ASSOCIATE, gfp);
4242 }
4243
4244 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
4245                          struct net_device *netdev, const u8 *buf,
4246                          size_t len, gfp_t gfp)
4247 {
4248         nl80211_send_mlme_event(rdev, netdev, buf, len,
4249                                 NL80211_CMD_DEAUTHENTICATE, gfp);
4250 }
4251
4252 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
4253                            struct net_device *netdev, const u8 *buf,
4254                            size_t len, gfp_t gfp)
4255 {
4256         nl80211_send_mlme_event(rdev, netdev, buf, len,
4257                                 NL80211_CMD_DISASSOCIATE, gfp);
4258 }
4259
4260 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
4261                                       struct net_device *netdev, int cmd,
4262                                       const u8 *addr, gfp_t gfp)
4263 {
4264         struct sk_buff *msg;
4265         void *hdr;
4266
4267         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
4268         if (!msg)
4269                 return;
4270
4271         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
4272         if (!hdr) {
4273                 nlmsg_free(msg);
4274                 return;
4275         }
4276
4277         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4278         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4279         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
4280         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
4281
4282         if (genlmsg_end(msg, hdr) < 0) {
4283                 nlmsg_free(msg);
4284                 return;
4285         }
4286
4287         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
4288         return;
4289
4290  nla_put_failure:
4291         genlmsg_cancel(msg, hdr);
4292         nlmsg_free(msg);
4293 }
4294
4295 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
4296                                struct net_device *netdev, const u8 *addr,
4297                                gfp_t gfp)
4298 {
4299         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
4300                                   addr, gfp);
4301 }
4302
4303 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
4304                                 struct net_device *netdev, const u8 *addr,
4305                                 gfp_t gfp)
4306 {
4307         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
4308                                   addr, gfp);
4309 }
4310
4311 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
4312                                  struct net_device *netdev, const u8 *bssid,
4313                                  const u8 *req_ie, size_t req_ie_len,
4314                                  const u8 *resp_ie, size_t resp_ie_len,
4315                                  u16 status, gfp_t gfp)
4316 {
4317         struct sk_buff *msg;
4318         void *hdr;
4319
4320         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
4321         if (!msg)
4322                 return;
4323
4324         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
4325         if (!hdr) {
4326                 nlmsg_free(msg);
4327                 return;
4328         }
4329
4330         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4331         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4332         if (bssid)
4333                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
4334         NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status);
4335         if (req_ie)
4336                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
4337         if (resp_ie)
4338                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
4339
4340         if (genlmsg_end(msg, hdr) < 0) {
4341                 nlmsg_free(msg);
4342                 return;
4343         }
4344
4345         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
4346         return;
4347
4348  nla_put_failure:
4349         genlmsg_cancel(msg, hdr);
4350         nlmsg_free(msg);
4351
4352 }
4353
4354 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
4355                          struct net_device *netdev, const u8 *bssid,
4356                          const u8 *req_ie, size_t req_ie_len,
4357                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
4358 {
4359         struct sk_buff *msg;
4360         void *hdr;
4361
4362         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
4363         if (!msg)
4364                 return;
4365
4366         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
4367         if (!hdr) {
4368                 nlmsg_free(msg);
4369                 return;
4370         }
4371
4372         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4373         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4374         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
4375         if (req_ie)
4376                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
4377         if (resp_ie)
4378                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
4379
4380         if (genlmsg_end(msg, hdr) < 0) {
4381                 nlmsg_free(msg);
4382                 return;
4383         }
4384
4385         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
4386         return;
4387
4388  nla_put_failure:
4389         genlmsg_cancel(msg, hdr);
4390         nlmsg_free(msg);
4391
4392 }
4393
4394 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
4395                                struct net_device *netdev, u16 reason,
4396                                const u8 *ie, size_t ie_len, bool from_ap)
4397 {
4398         struct sk_buff *msg;
4399         void *hdr;
4400
4401         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
4402         if (!msg)
4403                 return;
4404
4405         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
4406         if (!hdr) {
4407                 nlmsg_free(msg);
4408                 return;
4409         }
4410
4411         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4412         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4413         if (from_ap && reason)
4414                 NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason);
4415         if (from_ap)
4416                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISCONNECTED_BY_AP);
4417         if (ie)
4418                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len, ie);
4419
4420         if (genlmsg_end(msg, hdr) < 0) {
4421                 nlmsg_free(msg);
4422                 return;
4423         }
4424
4425         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_KERNEL);
4426         return;
4427
4428  nla_put_failure:
4429         genlmsg_cancel(msg, hdr);
4430         nlmsg_free(msg);
4431
4432 }
4433
4434 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
4435                              struct net_device *netdev, const u8 *bssid,
4436                              gfp_t gfp)
4437 {
4438         struct sk_buff *msg;
4439         void *hdr;
4440
4441         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
4442         if (!msg)
4443                 return;
4444
4445         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
4446         if (!hdr) {
4447                 nlmsg_free(msg);
4448                 return;
4449         }
4450
4451         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4452         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4453         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
4454
4455         if (genlmsg_end(msg, hdr) < 0) {
4456                 nlmsg_free(msg);
4457                 return;
4458         }
4459
4460         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
4461         return;
4462
4463  nla_put_failure:
4464         genlmsg_cancel(msg, hdr);
4465         nlmsg_free(msg);
4466 }
4467
4468 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
4469                                  struct net_device *netdev, const u8 *addr,
4470                                  enum nl80211_key_type key_type, int key_id,
4471                                  const u8 *tsc, gfp_t gfp)
4472 {
4473         struct sk_buff *msg;
4474         void *hdr;
4475
4476         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
4477         if (!msg)
4478                 return;
4479
4480         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
4481         if (!hdr) {
4482                 nlmsg_free(msg);
4483                 return;
4484         }
4485
4486         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4487         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4488         if (addr)
4489                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
4490         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
4491         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
4492         if (tsc)
4493                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
4494
4495         if (genlmsg_end(msg, hdr) < 0) {
4496                 nlmsg_free(msg);
4497                 return;
4498         }
4499
4500         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
4501         return;
4502
4503  nla_put_failure:
4504         genlmsg_cancel(msg, hdr);
4505         nlmsg_free(msg);
4506 }
4507
4508 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
4509                                     struct ieee80211_channel *channel_before,
4510                                     struct ieee80211_channel *channel_after)
4511 {
4512         struct sk_buff *msg;
4513         void *hdr;
4514         struct nlattr *nl_freq;
4515
4516         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
4517         if (!msg)
4518                 return;
4519
4520         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
4521         if (!hdr) {
4522                 nlmsg_free(msg);
4523                 return;
4524         }
4525
4526         /*
4527          * Since we are applying the beacon hint to a wiphy we know its
4528          * wiphy_idx is valid
4529          */
4530         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
4531
4532         /* Before */
4533         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
4534         if (!nl_freq)
4535                 goto nla_put_failure;
4536         if (nl80211_msg_put_channel(msg, channel_before))
4537                 goto nla_put_failure;
4538         nla_nest_end(msg, nl_freq);
4539
4540         /* After */
4541         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
4542         if (!nl_freq)
4543                 goto nla_put_failure;
4544         if (nl80211_msg_put_channel(msg, channel_after))
4545                 goto nla_put_failure;
4546         nla_nest_end(msg, nl_freq);
4547
4548         if (genlmsg_end(msg, hdr) < 0) {
4549                 nlmsg_free(msg);
4550                 return;
4551         }
4552
4553         genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_ATOMIC);
4554
4555         return;
4556
4557 nla_put_failure:
4558         genlmsg_cancel(msg, hdr);
4559         nlmsg_free(msg);
4560 }
4561
4562 /* initialisation/exit functions */
4563
4564 int nl80211_init(void)
4565 {
4566         int err;
4567
4568         err = genl_register_family_with_ops(&nl80211_fam,
4569                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
4570         if (err)
4571                 return err;
4572
4573         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
4574         if (err)
4575                 goto err_out;
4576
4577         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
4578         if (err)
4579                 goto err_out;
4580
4581         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
4582         if (err)
4583                 goto err_out;
4584
4585         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
4586         if (err)
4587                 goto err_out;
4588
4589 #ifdef CONFIG_NL80211_TESTMODE
4590         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
4591         if (err)
4592                 goto err_out;
4593 #endif
4594
4595         return 0;
4596  err_out:
4597         genl_unregister_family(&nl80211_fam);
4598         return err;
4599 }
4600
4601 void nl80211_exit(void)
4602 {
4603         genl_unregister_family(&nl80211_fam);
4604 }