net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2009  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/list.h>
  11 #include <linux/if_ether.h>
  12 #include <linux/ieee80211.h>
  13 #include <linux/nl80211.h>
  14 #include <linux/rtnetlink.h>
  15 #include <linux/netlink.h>
  16 #include <linux/etherdevice.h>
  17 #include <net/genetlink.h>
  18 #include <net/cfg80211.h>
  19 #include "core.h"
  20 #include "nl80211.h"
  21 #include "reg.h"
  22
  23 /* the netlink family */
  24 static struct genl_family nl80211_fam = {
  25         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  26         .name = "nl80211",      /* have users key off the name instead */
  27         .hdrsize = 0,           /* no private header */
  28         .version = 1,           /* no particular meaning now */
  29         .maxattr = NL80211_ATTR_MAX,
  30 };
  31
  32 /* internal helper: get rdev and dev */
  33 static int get_rdev_dev_by_info_ifindex(struct nlattr **attrs,
  34                                        struct cfg80211_registered_device **rdev,
  35                                        struct net_device **dev)
  36 {
  37         int ifindex;
  38
  39         if (!attrs[NL80211_ATTR_IFINDEX])
  40                 return -EINVAL;
  41
  42         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  43         *dev = dev_get_by_index(&init_net, ifindex);
  44         if (!*dev)
  45                 return -ENODEV;
  46
  47         *rdev = cfg80211_get_dev_from_ifindex(ifindex);
  48         if (IS_ERR(*rdev)) {
  49                 dev_put(*dev);
  50                 return PTR_ERR(*rdev);
  51         }
  52
  53         return 0;
  54 }
  55
  56 /* policy for the attributes */
  57 static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
  58         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  59         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  60                                       .len = 20-1 },
  61         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  62         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  63         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  64         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
  65         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
  66         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
  67         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
  68
  69         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  70         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  71         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  72
  73         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  74         [NL80211_ATTR_PREV_BSSID] = { .type = NLA_BINARY, .len = ETH_ALEN },
  75
  76         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  77                                     .len = WLAN_MAX_KEY_LEN },
  78         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  79         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  80         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
  81         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
  82
  83         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
  84         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
  85         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
  86                                        .len = IEEE80211_MAX_DATA_LEN },
  87         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
  88                                        .len = IEEE80211_MAX_DATA_LEN },
  89         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
  90         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
  91         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
  92         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
  93                                                .len = NL80211_MAX_SUPP_RATES },
  94         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
  95         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
  96         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
  97         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
  98                                 .len = IEEE80211_MAX_MESH_ID_LEN },
  99         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 100
 101         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 102         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 103
 104         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 105         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 106         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 107         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 108                                            .len = NL80211_MAX_SUPP_RATES },
 109
 110         [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
 111
 112         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 113                                          .len = NL80211_HT_CAPABILITY_LEN },
 114
 115         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 116         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 117                               .len = IEEE80211_MAX_DATA_LEN },
 118         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 119         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 120
 121         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 122                                 .len = IEEE80211_MAX_SSID_LEN },
 123         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 124         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 125         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 126         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 127         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 128         [NL80211_ATTR_STA_FLAGS2] = {
 129                 .len = sizeof(struct nl80211_sta_flag_update),
 130         },
 131         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 132         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 133         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 134         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 135 };
 136
 137 /* IE validation */
 138 static bool is_valid_ie_attr(const struct nlattr *attr)
 139 {
 140         const u8 *pos;
 141         int len;
 142
 143         if (!attr)
 144                 return true;
 145
 146         pos = nla_data(attr);
 147         len = nla_len(attr);
 148
 149         while (len) {
 150                 u8 elemlen;
 151
 152                 if (len < 2)
 153                         return false;
 154                 len -= 2;
 155
 156                 elemlen = pos[1];
 157                 if (elemlen > len)
 158                         return false;
 159
 160                 len -= elemlen;
 161                 pos += 2 + elemlen;
 162         }
 163
 164         return true;
 165 }
 166
 167 /* message building helper */
 168 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 169                                    int flags, u8 cmd)
 170 {
 171         /* since there is no private header just add the generic one */
 172         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 173 }
 174
 175 static int nl80211_msg_put_channel(struct sk_buff *msg,
 176                                    struct ieee80211_channel *chan)
 177 {
 178         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 179                     chan->center_freq);
 180
 181         if (chan->flags & IEEE80211_CHAN_DISABLED)
 182                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 183         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 184                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 185         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 186                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 187         if (chan->flags & IEEE80211_CHAN_RADAR)
 188                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 189
 190         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 191                     DBM_TO_MBM(chan->max_power));
 192
 193         return 0;
 194
 195  nla_put_failure:
 196         return -ENOBUFS;
 197 }
 198
 199 /* netlink command implementations */
 200
 201 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 202                               struct cfg80211_registered_device *dev)
 203 {
 204         void *hdr;
 205         struct nlattr *nl_bands, *nl_band;
 206         struct nlattr *nl_freqs, *nl_freq;
 207         struct nlattr *nl_rates, *nl_rate;
 208         struct nlattr *nl_modes;
 209         struct nlattr *nl_cmds;
 210         enum ieee80211_band band;
 211         struct ieee80211_channel *chan;
 212         struct ieee80211_rate *rate;
 213         int i;
 214         u16 ifmodes = dev->wiphy.interface_modes;
 215
 216         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 217         if (!hdr)
 218                 return -1;
 219
 220         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 221         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 222
 223         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 224                    dev->wiphy.retry_short);
 225         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 226                    dev->wiphy.retry_long);
 227         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 228                     dev->wiphy.frag_threshold);
 229         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 230                     dev->wiphy.rts_threshold);
 231
 232         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 233                    dev->wiphy.max_scan_ssids);
 234         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 235                     dev->wiphy.max_scan_ie_len);
 236
 237         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
 238                 sizeof(u32) * dev->wiphy.n_cipher_suites,
 239                 dev->wiphy.cipher_suites);
 240
 241         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
 242         if (!nl_modes)
 243                 goto nla_put_failure;
 244
 245         i = 0;
 246         while (ifmodes) {
 247                 if (ifmodes & 1)
 248                         NLA_PUT_FLAG(msg, i);
 249                 ifmodes >>= 1;
 250                 i++;
 251         }
 252
 253         nla_nest_end(msg, nl_modes);
 254
 255         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 256         if (!nl_bands)
 257                 goto nla_put_failure;
 258
 259         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 260                 if (!dev->wiphy.bands[band])
 261                         continue;
 262
 263                 nl_band = nla_nest_start(msg, band);
 264                 if (!nl_band)
 265                         goto nla_put_failure;
 266
 267                 /* add HT info */
 268                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 269                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 270                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 271                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 272                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 273                                 dev->wiphy.bands[band]->ht_cap.cap);
 274                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 275                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 276                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 277                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 278                 }
 279
 280                 /* add frequencies */
 281                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 282                 if (!nl_freqs)
 283                         goto nla_put_failure;
 284
 285                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 286                         nl_freq = nla_nest_start(msg, i);
 287                         if (!nl_freq)
 288                                 goto nla_put_failure;
 289
 290                         chan = &dev->wiphy.bands[band]->channels[i];
 291
 292                         if (nl80211_msg_put_channel(msg, chan))
 293                                 goto nla_put_failure;
 294
 295                         nla_nest_end(msg, nl_freq);
 296                 }
 297
 298                 nla_nest_end(msg, nl_freqs);
 299
 300                 /* add bitrates */
 301                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 302                 if (!nl_rates)
 303                         goto nla_put_failure;
 304
 305                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 306                         nl_rate = nla_nest_start(msg, i);
 307                         if (!nl_rate)
 308                                 goto nla_put_failure;
 309
 310                         rate = &dev->wiphy.bands[band]->bitrates[i];
 311                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 312                                     rate->bitrate);
 313                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 314                                 NLA_PUT_FLAG(msg,
 315                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 316
 317                         nla_nest_end(msg, nl_rate);
 318                 }
 319
 320                 nla_nest_end(msg, nl_rates);
 321
 322                 nla_nest_end(msg, nl_band);
 323         }
 324         nla_nest_end(msg, nl_bands);
 325
 326         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 327         if (!nl_cmds)
 328                 goto nla_put_failure;
 329
 330         i = 0;
 331 #define CMD(op, n)                                              \
 332          do {                                                   \
 333                 if (dev->ops->op) {                             \
 334                         i++;                                    \
 335                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 336                 }                                               \
 337         } while (0)
 338
 339         CMD(add_virtual_intf, NEW_INTERFACE);
 340         CMD(change_virtual_intf, SET_INTERFACE);
 341         CMD(add_key, NEW_KEY);
 342         CMD(add_beacon, NEW_BEACON);
 343         CMD(add_station, NEW_STATION);
 344         CMD(add_mpath, NEW_MPATH);
 345         CMD(set_mesh_params, SET_MESH_PARAMS);
 346         CMD(change_bss, SET_BSS);
 347         CMD(auth, AUTHENTICATE);
 348         CMD(assoc, ASSOCIATE);
 349         CMD(deauth, DEAUTHENTICATE);
 350         CMD(disassoc, DISASSOCIATE);
 351         CMD(join_ibss, JOIN_IBSS);
 352
 353 #undef CMD
 354
 355         if (dev->ops->connect || dev->ops->auth) {
 356                 i++;
 357                 NLA_PUT_U32(msg, i, NL80211_CMD_CONNECT);
 358         }
 359
 360         if (dev->ops->disconnect || dev->ops->deauth) {
 361                 i++;
 362                 NLA_PUT_U32(msg, i, NL80211_CMD_DISCONNECT);
 363         }
 364
 365         nla_nest_end(msg, nl_cmds);
 366
 367         return genlmsg_end(msg, hdr);
 368
 369  nla_put_failure:
 370         genlmsg_cancel(msg, hdr);
 371         return -EMSGSIZE;
 372 }
 373
 374 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 375 {
 376         int idx = 0;
 377         int start = cb->args[0];
 378         struct cfg80211_registered_device *dev;
 379
 380         mutex_lock(&cfg80211_mutex);
 381         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
 382                 if (++idx <= start)
 383                         continue;
 384                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
 385                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
 386                                        dev) < 0) {
 387                         idx--;
 388                         break;
 389                 }
 390         }
 391         mutex_unlock(&cfg80211_mutex);
 392
 393         cb->args[0] = idx;
 394
 395         return skb->len;
 396 }
 397
 398 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 399 {
 400         struct sk_buff *msg;
 401         struct cfg80211_registered_device *dev;
 402
 403         dev = cfg80211_get_dev_from_info(info);
 404         if (IS_ERR(dev))
 405                 return PTR_ERR(dev);
 406
 407         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 408         if (!msg)
 409                 goto out_err;
 410
 411         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
 412                 goto out_free;
 413
 414         cfg80211_unlock_rdev(dev);
 415
 416         return genlmsg_reply(msg, info);
 417
 418  out_free:
 419         nlmsg_free(msg);
 420  out_err:
 421         cfg80211_unlock_rdev(dev);
 422         return -ENOBUFS;
 423 }
 424
 425 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 426         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
 427         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
 428         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
 429         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
 430         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
 431 };
 432
 433 static int parse_txq_params(struct nlattr *tb[],
 434                             struct ieee80211_txq_params *txq_params)
 435 {
 436         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 437             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 438             !tb[NL80211_TXQ_ATTR_AIFS])
 439                 return -EINVAL;
 440
 441         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
 442         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 443         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 444         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 445         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 446
 447         return 0;
 448 }
 449
 450 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 451 {
 452         struct cfg80211_registered_device *rdev;
 453         int result = 0, rem_txq_params = 0;
 454         struct nlattr *nl_txq_params;
 455         u32 changed;
 456         u8 retry_short = 0, retry_long = 0;
 457         u32 frag_threshold = 0, rts_threshold = 0;
 458
 459         rtnl_lock();
 460
 461         mutex_lock(&cfg80211_mutex);
 462
 463         rdev = __cfg80211_rdev_from_info(info);
 464         if (IS_ERR(rdev)) {
 465                 mutex_unlock(&cfg80211_mutex);
 466                 result = PTR_ERR(rdev);
 467                 goto unlock;
 468         }
 469
 470         mutex_lock(&rdev->mtx);
 471
 472         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
 473                 result = cfg80211_dev_rename(
 474                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 475
 476         mutex_unlock(&cfg80211_mutex);
 477
 478         if (result)
 479                 goto bad_res;
 480
 481         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
 482                 struct ieee80211_txq_params txq_params;
 483                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
 484
 485                 if (!rdev->ops->set_txq_params) {
 486                         result = -EOPNOTSUPP;
 487                         goto bad_res;
 488                 }
 489
 490                 nla_for_each_nested(nl_txq_params,
 491                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
 492                                     rem_txq_params) {
 493                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
 494                                   nla_data(nl_txq_params),
 495                                   nla_len(nl_txq_params),
 496                                   txq_params_policy);
 497                         result = parse_txq_params(tb, &txq_params);
 498                         if (result)
 499                                 goto bad_res;
 500
 501                         result = rdev->ops->set_txq_params(&rdev->wiphy,
 502                                                            &txq_params);
 503                         if (result)
 504                                 goto bad_res;
 505                 }
 506         }
 507
 508         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
 509                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 510                 struct ieee80211_channel *chan;
 511                 struct ieee80211_sta_ht_cap *ht_cap;
 512                 u32 freq;
 513
 514                 if (!rdev->ops->set_channel) {
 515                         result = -EOPNOTSUPP;
 516                         goto bad_res;
 517                 }
 518
 519                 result = -EINVAL;
 520
 521                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 522                         channel_type = nla_get_u32(info->attrs[
 523                                            NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 524                         if (channel_type != NL80211_CHAN_NO_HT &&
 525                             channel_type != NL80211_CHAN_HT20 &&
 526                             channel_type != NL80211_CHAN_HT40PLUS &&
 527                             channel_type != NL80211_CHAN_HT40MINUS)
 528                                 goto bad_res;
 529                 }
 530
 531                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 532                 chan = ieee80211_get_channel(&rdev->wiphy, freq);
 533
 534                 /* Primary channel not allowed */
 535                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 536                         goto bad_res;
 537
 538                 if (channel_type == NL80211_CHAN_HT40MINUS &&
 539                     (chan->flags & IEEE80211_CHAN_NO_HT40MINUS))
 540                         goto bad_res;
 541                 else if (channel_type == NL80211_CHAN_HT40PLUS &&
 542                          (chan->flags & IEEE80211_CHAN_NO_HT40PLUS))
 543                         goto bad_res;
 544
 545                 /*
 546                  * At this point we know if that if HT40 was requested
 547                  * we are allowed to use it and the extension channel
 548                  * exists.
 549                  */
 550
 551                 ht_cap = &rdev->wiphy.bands[chan->band]->ht_cap;
 552
 553                 /* no HT capabilities or intolerant */
 554                 if (channel_type != NL80211_CHAN_NO_HT) {
 555                         if (!ht_cap->ht_supported)
 556                                 goto bad_res;
 557                         if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
 558                             (ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT))
 559                                 goto bad_res;
 560                 }
 561
 562                 result = rdev->ops->set_channel(&rdev->wiphy, chan,
 563                                                 channel_type);
 564                 if (result)
 565                         goto bad_res;
 566         }
 567
 568         changed = 0;
 569
 570         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
 571                 retry_short = nla_get_u8(
 572                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
 573                 if (retry_short == 0) {
 574                         result = -EINVAL;
 575                         goto bad_res;
 576                 }
 577                 changed |= WIPHY_PARAM_RETRY_SHORT;
 578         }
 579
 580         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
 581                 retry_long = nla_get_u8(
 582                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
 583                 if (retry_long == 0) {
 584                         result = -EINVAL;
 585                         goto bad_res;
 586                 }
 587                 changed |= WIPHY_PARAM_RETRY_LONG;
 588         }
 589
 590         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
 591                 frag_threshold = nla_get_u32(
 592                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
 593                 if (frag_threshold < 256) {
 594                         result = -EINVAL;
 595                         goto bad_res;
 596                 }
 597                 if (frag_threshold != (u32) -1) {
 598                         /*
 599                          * Fragments (apart from the last one) are required to
 600                          * have even length. Make the fragmentation code
 601                          * simpler by stripping LSB should someone try to use
 602                          * odd threshold value.
 603                          */
 604                         frag_threshold &= ~0x1;
 605                 }
 606                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
 607         }
 608
 609         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
 610                 rts_threshold = nla_get_u32(
 611                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
 612                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
 613         }
 614
 615         if (changed) {
 616                 u8 old_retry_short, old_retry_long;
 617                 u32 old_frag_threshold, old_rts_threshold;
 618
 619                 if (!rdev->ops->set_wiphy_params) {
 620                         result = -EOPNOTSUPP;
 621                         goto bad_res;
 622                 }
 623
 624                 old_retry_short = rdev->wiphy.retry_short;
 625                 old_retry_long = rdev->wiphy.retry_long;
 626                 old_frag_threshold = rdev->wiphy.frag_threshold;
 627                 old_rts_threshold = rdev->wiphy.rts_threshold;
 628
 629                 if (changed & WIPHY_PARAM_RETRY_SHORT)
 630                         rdev->wiphy.retry_short = retry_short;
 631                 if (changed & WIPHY_PARAM_RETRY_LONG)
 632                         rdev->wiphy.retry_long = retry_long;
 633                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
 634                         rdev->wiphy.frag_threshold = frag_threshold;
 635                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
 636                         rdev->wiphy.rts_threshold = rts_threshold;
 637
 638                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
 639                 if (result) {
 640                         rdev->wiphy.retry_short = old_retry_short;
 641                         rdev->wiphy.retry_long = old_retry_long;
 642                         rdev->wiphy.frag_threshold = old_frag_threshold;
 643                         rdev->wiphy.rts_threshold = old_rts_threshold;
 644                 }
 645         }
 646
 647  bad_res:
 648         mutex_unlock(&rdev->mtx);
 649  unlock:
 650         rtnl_unlock();
 651         return result;
 652 }
 653
 654
 655 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 656                               struct cfg80211_registered_device *rdev,
 657                               struct net_device *dev)
 658 {
 659         void *hdr;
 660
 661         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
 662         if (!hdr)
 663                 return -1;
 664
 665         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 666         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 667         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
 668         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
 669         return genlmsg_end(msg, hdr);
 670
 671  nla_put_failure:
 672         genlmsg_cancel(msg, hdr);
 673         return -EMSGSIZE;
 674 }
 675
 676 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
 677 {
 678         int wp_idx = 0;
 679         int if_idx = 0;
 680         int wp_start = cb->args[0];
 681         int if_start = cb->args[1];
 682         struct cfg80211_registered_device *dev;
 683         struct wireless_dev *wdev;
 684
 685         mutex_lock(&cfg80211_mutex);
 686         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
 687                 if (wp_idx < wp_start) {
 688                         wp_idx++;
 689                         continue;
 690                 }
 691                 if_idx = 0;
 692
 693                 mutex_lock(&dev->devlist_mtx);
 694                 list_for_each_entry(wdev, &dev->netdev_list, list) {
 695                         if (if_idx < if_start) {
 696                                 if_idx++;
 697                                 continue;
 698                         }
 699                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
 700                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
 701                                                dev, wdev->netdev) < 0) {
 702                                 mutex_unlock(&dev->devlist_mtx);
 703                                 goto out;
 704                         }
 705                         if_idx++;
 706                 }
 707                 mutex_unlock(&dev->devlist_mtx);
 708
 709                 wp_idx++;
 710         }
 711  out:
 712         mutex_unlock(&cfg80211_mutex);
 713
 714         cb->args[0] = wp_idx;
 715         cb->args[1] = if_idx;
 716
 717         return skb->len;
 718 }
 719
 720 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
 721 {
 722         struct sk_buff *msg;
 723         struct cfg80211_registered_device *dev;
 724         struct net_device *netdev;
 725         int err;
 726
 727         err = get_rdev_dev_by_info_ifindex(info->attrs, &dev, &netdev);
 728         if (err)
 729                 return err;
 730
 731         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 732         if (!msg)
 733                 goto out_err;
 734
 735         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
 736                                dev, netdev) < 0)
 737                 goto out_free;
 738
 739         dev_put(netdev);
 740         cfg80211_unlock_rdev(dev);
 741
 742         return genlmsg_reply(msg, info);
 743
 744  out_free:
 745         nlmsg_free(msg);
 746  out_err:
 747         dev_put(netdev);
 748         cfg80211_unlock_rdev(dev);
 749         return -ENOBUFS;
 750 }
 751
 752 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
 753         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
 754         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
 755         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
 756         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
 757         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
 758 };
 759
 760 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
 761 {
 762         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
 763         int flag;
 764
 765         *mntrflags = 0;
 766
 767         if (!nla)
 768                 return -EINVAL;
 769
 770         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
 771                              nla, mntr_flags_policy))
 772                 return -EINVAL;
 773
 774         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
 775                 if (flags[flag])
 776                         *mntrflags |= (1<<flag);
 777
 778         return 0;
 779 }
 780
 781 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 782 {
 783         struct cfg80211_registered_device *rdev;
 784         struct vif_params params;
 785         int err;
 786         enum nl80211_iftype otype, ntype;
 787         struct net_device *dev;
 788         u32 _flags, *flags = NULL;
 789         bool change = false;
 790
 791         memset(&params, 0, sizeof(params));
 792
 793         rtnl_lock();
 794
 795         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
 796         if (err)
 797                 goto unlock_rtnl;
 798
 799         otype = ntype = dev->ieee80211_ptr->iftype;
 800
 801         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 802                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 803                 if (otype != ntype)
 804                         change = true;
 805                 if (ntype > NL80211_IFTYPE_MAX) {
 806                         err = -EINVAL;
 807                         goto unlock;
 808                 }
 809         }
 810
 811         if (!rdev->ops->change_virtual_intf ||
 812             !(rdev->wiphy.interface_modes & (1 << ntype))) {
 813                 err = -EOPNOTSUPP;
 814                 goto unlock;
 815         }
 816
 817         if (info->attrs[NL80211_ATTR_MESH_ID]) {
 818                 if (ntype != NL80211_IFTYPE_MESH_POINT) {
 819                         err = -EINVAL;
 820                         goto unlock;
 821                 }
 822                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 823                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 824                 change = true;
 825         }
 826
 827         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
 828                 if (ntype != NL80211_IFTYPE_MONITOR) {
 829                         err = -EINVAL;
 830                         goto unlock;
 831                 }
 832                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
 833                                           &_flags);
 834                 if (err)
 835                         goto unlock;
 836
 837                 flags = &_flags;
 838                 change = true;
 839         }
 840
 841         if (change)
 842                 err = rdev->ops->change_virtual_intf(&rdev->wiphy, dev,
 843                                                     ntype, flags, &params);
 844         else
 845                 err = 0;
 846
 847         WARN_ON(!err && dev->ieee80211_ptr->iftype != ntype);
 848
 849         if (!err && (ntype != otype)) {
 850                 if (otype == NL80211_IFTYPE_ADHOC)
 851                         cfg80211_clear_ibss(dev, false);
 852         }
 853
 854  unlock:
 855         dev_put(dev);
 856         cfg80211_unlock_rdev(rdev);
 857  unlock_rtnl:
 858         rtnl_unlock();
 859         return err;
 860 }
 861
 862 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
 863 {
 864         struct cfg80211_registered_device *rdev;
 865         struct vif_params params;
 866         int err;
 867         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
 868         u32 flags;
 869
 870         memset(&params, 0, sizeof(params));
 871
 872         if (!info->attrs[NL80211_ATTR_IFNAME])
 873                 return -EINVAL;
 874
 875         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 876                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 877                 if (type > NL80211_IFTYPE_MAX)
 878                         return -EINVAL;
 879         }
 880
 881         rtnl_lock();
 882
 883         rdev = cfg80211_get_dev_from_info(info);
 884         if (IS_ERR(rdev)) {
 885                 err = PTR_ERR(rdev);
 886                 goto unlock_rtnl;
 887         }
 888
 889         if (!rdev->ops->add_virtual_intf ||
 890             !(rdev->wiphy.interface_modes & (1 << type))) {
 891                 err = -EOPNOTSUPP;
 892                 goto unlock;
 893         }
 894
 895         if (type == NL80211_IFTYPE_MESH_POINT &&
 896             info->attrs[NL80211_ATTR_MESH_ID]) {
 897                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 898                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 899         }
 900
 901         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
 902                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
 903                                   &flags);
 904         err = rdev->ops->add_virtual_intf(&rdev->wiphy,
 905                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
 906                 type, err ? NULL : &flags, &params);
 907
 908  unlock:
 909         cfg80211_unlock_rdev(rdev);
 910  unlock_rtnl:
 911         rtnl_unlock();
 912         return err;
 913 }
 914
 915 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
 916 {
 917         struct cfg80211_registered_device *rdev;
 918         int ifindex, err;
 919         struct net_device *dev;
 920
 921         rtnl_lock();
 922
 923         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
 924         if (err)
 925                 goto unlock_rtnl;
 926         ifindex = dev->ifindex;
 927         dev_put(dev);
 928
 929         if (!rdev->ops->del_virtual_intf) {
 930                 err = -EOPNOTSUPP;
 931                 goto out;
 932         }
 933
 934         err = rdev->ops->del_virtual_intf(&rdev->wiphy, ifindex);
 935
 936  out:
 937         cfg80211_unlock_rdev(rdev);
 938  unlock_rtnl:
 939         rtnl_unlock();
 940         return err;
 941 }
 942
 943 struct get_key_cookie {
 944         struct sk_buff *msg;
 945         int error;
 946 };
 947
 948 static void get_key_callback(void *c, struct key_params *params)
 949 {
 950         struct get_key_cookie *cookie = c;
 951
 952         if (params->key)
 953                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
 954                         params->key_len, params->key);
 955
 956         if (params->seq)
 957                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
 958                         params->seq_len, params->seq);
 959
 960         if (params->cipher)
 961                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
 962                             params->cipher);
 963
 964         return;
 965  nla_put_failure:
 966         cookie->error = 1;
 967 }
 968
 969 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
 970 {
 971         struct cfg80211_registered_device *rdev;
 972         int err;
 973         struct net_device *dev;
 974         u8 key_idx = 0;
 975         u8 *mac_addr = NULL;
 976         struct get_key_cookie cookie = {
 977                 .error = 0,
 978         };
 979         void *hdr;
 980         struct sk_buff *msg;
 981
 982         if (info->attrs[NL80211_ATTR_KEY_IDX])
 983                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 984
 985         if (key_idx > 5)
 986                 return -EINVAL;
 987
 988         if (info->attrs[NL80211_ATTR_MAC])
 989                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 990
 991         rtnl_lock();
 992
 993         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
 994         if (err)
 995                 goto unlock_rtnl;
 996
 997         if (!rdev->ops->get_key) {
 998                 err = -EOPNOTSUPP;
 999                 goto out;
1000         }
1001
1002         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1003         if (!msg) {
1004                 err = -ENOMEM;
1005                 goto out;
1006         }
1007
1008         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
1009                              NL80211_CMD_NEW_KEY);
1010
1011         if (IS_ERR(hdr)) {
1012                 err = PTR_ERR(hdr);
1013                 goto free_msg;
1014         }
1015
1016         cookie.msg = msg;
1017
1018         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1019         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1020         if (mac_addr)
1021                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1022
1023         err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, mac_addr,
1024                                 &cookie, get_key_callback);
1025
1026         if (err)
1027                 goto free_msg;
1028
1029         if (cookie.error)
1030                 goto nla_put_failure;
1031
1032         genlmsg_end(msg, hdr);
1033         err = genlmsg_reply(msg, info);
1034         goto out;
1035
1036  nla_put_failure:
1037         err = -ENOBUFS;
1038  free_msg:
1039         nlmsg_free(msg);
1040  out:
1041         cfg80211_unlock_rdev(rdev);
1042         dev_put(dev);
1043  unlock_rtnl:
1044         rtnl_unlock();
1045
1046         return err;
1047 }
1048
1049 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1050 {
1051         struct cfg80211_registered_device *rdev;
1052         int err;
1053         struct net_device *dev;
1054         u8 key_idx;
1055         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
1056                     u8 key_index);
1057
1058         if (!info->attrs[NL80211_ATTR_KEY_IDX])
1059                 return -EINVAL;
1060
1061         key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1062
1063         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]) {
1064                 if (key_idx < 4 || key_idx > 5)
1065                         return -EINVAL;
1066         } else if (key_idx > 3)
1067                 return -EINVAL;
1068
1069         /* currently only support setting default key */
1070         if (!info->attrs[NL80211_ATTR_KEY_DEFAULT] &&
1071             !info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT])
1072                 return -EINVAL;
1073
1074         rtnl_lock();
1075
1076         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
1077         if (err)
1078                 goto unlock_rtnl;
1079
1080         if (info->attrs[NL80211_ATTR_KEY_DEFAULT])
1081                 func = rdev->ops->set_default_key;
1082         else
1083                 func = rdev->ops->set_default_mgmt_key;
1084
1085         if (!func) {
1086                 err = -EOPNOTSUPP;
1087                 goto out;
1088         }
1089
1090         err = func(&rdev->wiphy, dev, key_idx);
1091 #ifdef CONFIG_WIRELESS_EXT
1092         if (!err) {
1093                 if (func == rdev->ops->set_default_key)
1094                         dev->ieee80211_ptr->wext.default_key = key_idx;
1095                 else
1096                         dev->ieee80211_ptr->wext.default_mgmt_key = key_idx;
1097         }
1098 #endif
1099
1100  out:
1101         cfg80211_unlock_rdev(rdev);
1102         dev_put(dev);
1103
1104  unlock_rtnl:
1105         rtnl_unlock();
1106
1107         return err;
1108 }
1109
1110 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1111 {
1112         struct cfg80211_registered_device *rdev;
1113         int err, i;
1114         struct net_device *dev;
1115         struct key_params params;
1116         u8 key_idx = 0;
1117         u8 *mac_addr = NULL;
1118
1119         memset(&params, 0, sizeof(params));
1120
1121         if (!info->attrs[NL80211_ATTR_KEY_CIPHER])
1122                 return -EINVAL;
1123
1124         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1125                 params.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1126                 params.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1127         }
1128
1129         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
1130                 params.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
1131                 params.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
1132         }
1133
1134         if (info->attrs[NL80211_ATTR_KEY_IDX])
1135                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1136
1137         params.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1138
1139         if (info->attrs[NL80211_ATTR_MAC])
1140                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1141
1142         if (cfg80211_validate_key_settings(&params, key_idx, mac_addr))
1143                 return -EINVAL;
1144
1145         rtnl_lock();
1146
1147         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
1148         if (err)
1149                 goto unlock_rtnl;
1150
1151         for (i = 0; i < rdev->wiphy.n_cipher_suites; i++)
1152                 if (params.cipher == rdev->wiphy.cipher_suites[i])
1153                         break;
1154         if (i == rdev->wiphy.n_cipher_suites) {
1155                 err = -EINVAL;
1156                 goto out;
1157         }
1158
1159         if (!rdev->ops->add_key) {
1160                 err = -EOPNOTSUPP;
1161                 goto out;
1162         }
1163
1164         err = rdev->ops->add_key(&rdev->wiphy, dev, key_idx, mac_addr, &params);
1165
1166  out:
1167         cfg80211_unlock_rdev(rdev);
1168         dev_put(dev);
1169  unlock_rtnl:
1170         rtnl_unlock();
1171
1172         return err;
1173 }
1174
1175 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1176 {
1177         struct cfg80211_registered_device *rdev;
1178         int err;
1179         struct net_device *dev;
1180         u8 key_idx = 0;
1181         u8 *mac_addr = NULL;
1182
1183         if (info->attrs[NL80211_ATTR_KEY_IDX])
1184                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1185
1186         if (key_idx > 5)
1187                 return -EINVAL;
1188
1189         if (info->attrs[NL80211_ATTR_MAC])
1190                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1191
1192         rtnl_lock();
1193
1194         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
1195         if (err)
1196                 goto unlock_rtnl;
1197
1198         if (!rdev->ops->del_key) {
1199                 err = -EOPNOTSUPP;
1200                 goto out;
1201         }
1202
1203         err = rdev->ops->del_key(&rdev->wiphy, dev, key_idx, mac_addr);
1204
1205 #ifdef CONFIG_WIRELESS_EXT
1206         if (!err) {
1207                 if (key_idx == dev->ieee80211_ptr->wext.default_key)
1208                         dev->ieee80211_ptr->wext.default_key = -1;
1209                 else if (key_idx == dev->ieee80211_ptr->wext.default_mgmt_key)
1210                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
1211         }
1212 #endif
1213
1214  out:
1215         cfg80211_unlock_rdev(rdev);
1216         dev_put(dev);
1217
1218  unlock_rtnl:
1219         rtnl_unlock();
1220
1221         return err;
1222 }
1223
1224 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1225 {
1226         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1227                     struct beacon_parameters *info);
1228         struct cfg80211_registered_device *rdev;
1229         int err;
1230         struct net_device *dev;
1231         struct beacon_parameters params;
1232         int haveinfo = 0;
1233
1234         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
1235                 return -EINVAL;
1236
1237         rtnl_lock();
1238
1239         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
1240         if (err)
1241                 goto unlock_rtnl;
1242
1243         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1244                 err = -EOPNOTSUPP;
1245                 goto out;
1246         }
1247
1248         switch (info->genlhdr->cmd) {
1249         case NL80211_CMD_NEW_BEACON:
1250                 /* these are required for NEW_BEACON */
1251                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1252                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1253                     !info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1254                         err = -EINVAL;
1255                         goto out;
1256                 }
1257
1258                 call = rdev->ops->add_beacon;
1259                 break;
1260         case NL80211_CMD_SET_BEACON:
1261                 call = rdev->ops->set_beacon;
1262                 break;
1263         default:
1264                 WARN_ON(1);
1265                 err = -EOPNOTSUPP;
1266                 goto out;
1267         }
1268
1269         if (!call) {
1270                 err = -EOPNOTSUPP;
1271                 goto out;
1272         }
1273
1274         memset(&params, 0, sizeof(params));
1275
1276         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1277                 params.interval =
1278                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1279                 haveinfo = 1;
1280         }
1281
1282         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1283                 params.dtim_period =
1284                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1285                 haveinfo = 1;
1286         }
1287
1288         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1289                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1290                 params.head_len =
1291                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1292                 haveinfo = 1;
1293         }
1294
1295         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1296                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1297                 params.tail_len =
1298                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1299                 haveinfo = 1;
1300         }
1301
1302         if (!haveinfo) {
1303                 err = -EINVAL;
1304                 goto out;
1305         }
1306
1307         err = call(&rdev->wiphy, dev, &params);
1308
1309  out:
1310         cfg80211_unlock_rdev(rdev);
1311         dev_put(dev);
1312  unlock_rtnl:
1313         rtnl_unlock();
1314
1315         return err;
1316 }
1317
1318 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1319 {
1320         struct cfg80211_registered_device *rdev;
1321         int err;
1322         struct net_device *dev;
1323
1324         rtnl_lock();
1325
1326         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
1327         if (err)
1328                 goto unlock_rtnl;
1329
1330         if (!rdev->ops->del_beacon) {
1331                 err = -EOPNOTSUPP;
1332                 goto out;
1333         }
1334
1335         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1336                 err = -EOPNOTSUPP;
1337                 goto out;
1338         }
1339         err = rdev->ops->del_beacon(&rdev->wiphy, dev);
1340
1341  out:
1342         cfg80211_unlock_rdev(rdev);
1343         dev_put(dev);
1344  unlock_rtnl:
1345         rtnl_unlock();
1346
1347         return err;
1348 }
1349
1350 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1351         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1352         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1353         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1354         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
1355 };
1356
1357 static int parse_station_flags(struct genl_info *info,
1358                                struct station_parameters *params)
1359 {
1360         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1361         struct nlattr *nla;
1362         int flag;
1363
1364         /*
1365          * Try parsing the new attribute first so userspace
1366          * can specify both for older kernels.
1367          */
1368         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
1369         if (nla) {
1370                 struct nl80211_sta_flag_update *sta_flags;
1371
1372                 sta_flags = nla_data(nla);
1373                 params->sta_flags_mask = sta_flags->mask;
1374                 params->sta_flags_set = sta_flags->set;
1375                 if ((params->sta_flags_mask |
1376                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
1377                         return -EINVAL;
1378                 return 0;
1379         }
1380
1381         /* if present, parse the old attribute */
1382
1383         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
1384         if (!nla)
1385                 return 0;
1386
1387         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1388                              nla, sta_flags_policy))
1389                 return -EINVAL;
1390
1391         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
1392         params->sta_flags_mask &= ~1;
1393
1394         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1395                 if (flags[flag])
1396                         params->sta_flags_set |= (1<<flag);
1397
1398         return 0;
1399 }
1400
1401 static u16 nl80211_calculate_bitrate(struct rate_info *rate)
1402 {
1403         int modulation, streams, bitrate;
1404
1405         if (!(rate->flags & RATE_INFO_FLAGS_MCS))
1406                 return rate->legacy;
1407
1408         /* the formula below does only work for MCS values smaller than 32 */
1409         if (rate->mcs >= 32)
1410                 return 0;
1411
1412         modulation = rate->mcs & 7;
1413         streams = (rate->mcs >> 3) + 1;
1414
1415         bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
1416                         13500000 : 6500000;
1417
1418         if (modulation < 4)
1419                 bitrate *= (modulation + 1);
1420         else if (modulation == 4)
1421                 bitrate *= (modulation + 2);
1422         else
1423                 bitrate *= (modulation + 3);
1424
1425         bitrate *= streams;
1426
1427         if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
1428                 bitrate = (bitrate / 9) * 10;
1429
1430         /* do NOT round down here */
1431         return (bitrate + 50000) / 100000;
1432 }
1433
1434 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1435                                 int flags, struct net_device *dev,
1436                                 u8 *mac_addr, struct station_info *sinfo)
1437 {
1438         void *hdr;
1439         struct nlattr *sinfoattr, *txrate;
1440         u16 bitrate;
1441
1442         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1443         if (!hdr)
1444                 return -1;
1445
1446         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1447         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1448
1449         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1450         if (!sinfoattr)
1451                 goto nla_put_failure;
1452         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1453                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1454                             sinfo->inactive_time);
1455         if (sinfo->filled & STATION_INFO_RX_BYTES)
1456                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1457                             sinfo->rx_bytes);
1458         if (sinfo->filled & STATION_INFO_TX_BYTES)
1459                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1460                             sinfo->tx_bytes);
1461         if (sinfo->filled & STATION_INFO_LLID)
1462                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1463                             sinfo->llid);
1464         if (sinfo->filled & STATION_INFO_PLID)
1465                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1466                             sinfo->plid);
1467         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1468                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1469                             sinfo->plink_state);
1470         if (sinfo->filled & STATION_INFO_SIGNAL)
1471                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1472                            sinfo->signal);
1473         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1474                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1475                 if (!txrate)
1476                         goto nla_put_failure;
1477
1478                 /* nl80211_calculate_bitrate will return 0 for mcs >= 32 */
1479                 bitrate = nl80211_calculate_bitrate(&sinfo->txrate);
1480                 if (bitrate > 0)
1481                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1482
1483                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1484                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1485                                     sinfo->txrate.mcs);
1486                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1487                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1488                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1489                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1490
1491                 nla_nest_end(msg, txrate);
1492         }
1493         if (sinfo->filled & STATION_INFO_RX_PACKETS)
1494                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
1495                             sinfo->rx_packets);
1496         if (sinfo->filled & STATION_INFO_TX_PACKETS)
1497                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
1498                             sinfo->tx_packets);
1499         nla_nest_end(msg, sinfoattr);
1500
1501         return genlmsg_end(msg, hdr);
1502
1503  nla_put_failure:
1504         genlmsg_cancel(msg, hdr);
1505         return -EMSGSIZE;
1506 }
1507
1508 static int nl80211_dump_station(struct sk_buff *skb,
1509                                 struct netlink_callback *cb)
1510 {
1511         struct station_info sinfo;
1512         struct cfg80211_registered_device *dev;
1513         struct net_device *netdev;
1514         u8 mac_addr[ETH_ALEN];
1515         int ifidx = cb->args[0];
1516         int sta_idx = cb->args[1];
1517         int err;
1518
1519         if (!ifidx) {
1520                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1521                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1522                                   nl80211_policy);
1523                 if (err)
1524                         return err;
1525
1526                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1527                         return -EINVAL;
1528
1529                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1530                 if (!ifidx)
1531                         return -EINVAL;
1532         }
1533
1534         rtnl_lock();
1535
1536         netdev = __dev_get_by_index(&init_net, ifidx);
1537         if (!netdev) {
1538                 err = -ENODEV;
1539                 goto out_rtnl;
1540         }
1541
1542         dev = cfg80211_get_dev_from_ifindex(ifidx);
1543         if (IS_ERR(dev)) {
1544                 err = PTR_ERR(dev);
1545                 goto out_rtnl;
1546         }
1547
1548         if (!dev->ops->dump_station) {
1549                 err = -EOPNOTSUPP;
1550                 goto out_err;
1551         }
1552
1553         while (1) {
1554                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1555                                              mac_addr, &sinfo);
1556                 if (err == -ENOENT)
1557                         break;
1558                 if (err)
1559                         goto out_err;
1560
1561                 if (nl80211_send_station(skb,
1562                                 NETLINK_CB(cb->skb).pid,
1563                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
1564                                 netdev, mac_addr,
1565                                 &sinfo) < 0)
1566                         goto out;
1567
1568                 sta_idx++;
1569         }
1570
1571
1572  out:
1573         cb->args[1] = sta_idx;
1574         err = skb->len;
1575  out_err:
1576         cfg80211_unlock_rdev(dev);
1577  out_rtnl:
1578         rtnl_unlock();
1579
1580         return err;
1581 }
1582
1583 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1584 {
1585         struct cfg80211_registered_device *rdev;
1586         int err;
1587         struct net_device *dev;
1588         struct station_info sinfo;
1589         struct sk_buff *msg;
1590         u8 *mac_addr = NULL;
1591
1592         memset(&sinfo, 0, sizeof(sinfo));
1593
1594         if (!info->attrs[NL80211_ATTR_MAC])
1595                 return -EINVAL;
1596
1597         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1598
1599         rtnl_lock();
1600
1601         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
1602         if (err)
1603                 goto out_rtnl;
1604
1605         if (!rdev->ops->get_station) {
1606                 err = -EOPNOTSUPP;
1607                 goto out;
1608         }
1609
1610         err = rdev->ops->get_station(&rdev->wiphy, dev, mac_addr, &sinfo);
1611         if (err)
1612                 goto out;
1613
1614         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1615         if (!msg)
1616                 goto out;
1617
1618         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1619                                  dev, mac_addr, &sinfo) < 0)
1620                 goto out_free;
1621
1622         err = genlmsg_reply(msg, info);
1623         goto out;
1624
1625  out_free:
1626         nlmsg_free(msg);
1627  out:
1628         cfg80211_unlock_rdev(rdev);
1629         dev_put(dev);
1630  out_rtnl:
1631         rtnl_unlock();
1632
1633         return err;
1634 }
1635
1636 /*
1637  * Get vlan interface making sure it is on the right wiphy.
1638  */
1639 static int get_vlan(struct nlattr *vlanattr,
1640                     struct cfg80211_registered_device *rdev,
1641                     struct net_device **vlan)
1642 {
1643         *vlan = NULL;
1644
1645         if (vlanattr) {
1646                 *vlan = dev_get_by_index(&init_net, nla_get_u32(vlanattr));
1647                 if (!*vlan)
1648                         return -ENODEV;
1649                 if (!(*vlan)->ieee80211_ptr)
1650                         return -EINVAL;
1651                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
1652                         return -EINVAL;
1653         }
1654         return 0;
1655 }
1656
1657 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
1658 {
1659         struct cfg80211_registered_device *rdev;
1660         int err;
1661         struct net_device *dev;
1662         struct station_parameters params;
1663         u8 *mac_addr = NULL;
1664
1665         memset(&params, 0, sizeof(params));
1666
1667         params.listen_interval = -1;
1668
1669         if (info->attrs[NL80211_ATTR_STA_AID])
1670                 return -EINVAL;
1671
1672         if (!info->attrs[NL80211_ATTR_MAC])
1673                 return -EINVAL;
1674
1675         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1676
1677         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
1678                 params.supported_rates =
1679                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1680                 params.supported_rates_len =
1681                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1682         }
1683
1684         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1685                 params.listen_interval =
1686                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1687
1688         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1689                 params.ht_capa =
1690                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1691
1692         if (parse_station_flags(info, &params))
1693                 return -EINVAL;
1694
1695         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
1696                 params.plink_action =
1697                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
1698
1699         rtnl_lock();
1700
1701         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
1702         if (err)
1703                 goto out_rtnl;
1704
1705         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], rdev, &params.vlan);
1706         if (err)
1707                 goto out;
1708
1709         /* validate settings */
1710         err = 0;
1711
1712         switch (dev->ieee80211_ptr->iftype) {
1713         case NL80211_IFTYPE_AP:
1714         case NL80211_IFTYPE_AP_VLAN:
1715                 /* disallow mesh-specific things */
1716                 if (params.plink_action)
1717                         err = -EINVAL;
1718                 break;
1719         case NL80211_IFTYPE_STATION:
1720                 /* disallow everything but AUTHORIZED flag */
1721                 if (params.plink_action)
1722                         err = -EINVAL;
1723                 if (params.vlan)
1724                         err = -EINVAL;
1725                 if (params.supported_rates)
1726                         err = -EINVAL;
1727                 if (params.ht_capa)
1728                         err = -EINVAL;
1729                 if (params.listen_interval >= 0)
1730                         err = -EINVAL;
1731                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
1732                         err = -EINVAL;
1733                 break;
1734         case NL80211_IFTYPE_MESH_POINT:
1735                 /* disallow things mesh doesn't support */
1736                 if (params.vlan)
1737                         err = -EINVAL;
1738                 if (params.ht_capa)
1739                         err = -EINVAL;
1740                 if (params.listen_interval >= 0)
1741                         err = -EINVAL;
1742                 if (params.supported_rates)
1743                         err = -EINVAL;
1744                 if (params.sta_flags_mask)
1745                         err = -EINVAL;
1746                 break;
1747         default:
1748                 err = -EINVAL;
1749         }
1750
1751         if (err)
1752                 goto out;
1753
1754         if (!rdev->ops->change_station) {
1755                 err = -EOPNOTSUPP;
1756                 goto out;
1757         }
1758
1759         err = rdev->ops->change_station(&rdev->wiphy, dev, mac_addr, &params);
1760
1761  out:
1762         if (params.vlan)
1763                 dev_put(params.vlan);
1764         cfg80211_unlock_rdev(rdev);
1765         dev_put(dev);
1766  out_rtnl:
1767         rtnl_unlock();
1768
1769         return err;
1770 }
1771
1772 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
1773 {
1774         struct cfg80211_registered_device *rdev;
1775         int err;
1776         struct net_device *dev;
1777         struct station_parameters params;
1778         u8 *mac_addr = NULL;
1779
1780         memset(&params, 0, sizeof(params));
1781
1782         if (!info->attrs[NL80211_ATTR_MAC])
1783                 return -EINVAL;
1784
1785         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1786                 return -EINVAL;
1787
1788         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
1789                 return -EINVAL;
1790
1791         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1792         params.supported_rates =
1793                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1794         params.supported_rates_len =
1795                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1796         params.listen_interval =
1797                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1798
1799         if (info->attrs[NL80211_ATTR_STA_AID]) {
1800                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
1801                 if (!params.aid || params.aid > IEEE80211_MAX_AID)
1802                         return -EINVAL;
1803         }
1804
1805         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1806                 params.ht_capa =
1807                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1808
1809         if (parse_station_flags(info, &params))
1810                 return -EINVAL;
1811
1812         rtnl_lock();
1813
1814         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
1815         if (err)
1816                 goto out_rtnl;
1817
1818         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], rdev, &params.vlan);
1819         if (err)
1820                 goto out;
1821
1822         /* validate settings */
1823         err = 0;
1824
1825         switch (dev->ieee80211_ptr->iftype) {
1826         case NL80211_IFTYPE_AP:
1827         case NL80211_IFTYPE_AP_VLAN:
1828                 /* all ok but must have AID */
1829                 if (!params.aid)
1830                         err = -EINVAL;
1831                 break;
1832         case NL80211_IFTYPE_MESH_POINT:
1833                 /* disallow things mesh doesn't support */
1834                 if (params.vlan)
1835                         err = -EINVAL;
1836                 if (params.aid)
1837                         err = -EINVAL;
1838                 if (params.ht_capa)
1839                         err = -EINVAL;
1840                 if (params.listen_interval >= 0)
1841                         err = -EINVAL;
1842                 if (params.supported_rates)
1843                         err = -EINVAL;
1844                 if (params.sta_flags_mask)
1845                         err = -EINVAL;
1846                 break;
1847         default:
1848                 err = -EINVAL;
1849         }
1850
1851         if (err)
1852                 goto out;
1853
1854         if (!rdev->ops->add_station) {
1855                 err = -EOPNOTSUPP;
1856                 goto out;
1857         }
1858
1859         if (!netif_running(dev)) {
1860                 err = -ENETDOWN;
1861                 goto out;
1862         }
1863
1864         err = rdev->ops->add_station(&rdev->wiphy, dev, mac_addr, &params);
1865
1866  out:
1867         if (params.vlan)
1868                 dev_put(params.vlan);
1869         cfg80211_unlock_rdev(rdev);
1870         dev_put(dev);
1871  out_rtnl:
1872         rtnl_unlock();
1873
1874         return err;
1875 }
1876
1877 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
1878 {
1879         struct cfg80211_registered_device *rdev;
1880         int err;
1881         struct net_device *dev;
1882         u8 *mac_addr = NULL;
1883
1884         if (info->attrs[NL80211_ATTR_MAC])
1885                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1886
1887         rtnl_lock();
1888
1889         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
1890         if (err)
1891                 goto out_rtnl;
1892
1893         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1894             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
1895             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1896                 err = -EINVAL;
1897                 goto out;
1898         }
1899
1900         if (!rdev->ops->del_station) {
1901                 err = -EOPNOTSUPP;
1902                 goto out;
1903         }
1904
1905         err = rdev->ops->del_station(&rdev->wiphy, dev, mac_addr);
1906
1907  out:
1908         cfg80211_unlock_rdev(rdev);
1909         dev_put(dev);
1910  out_rtnl:
1911         rtnl_unlock();
1912
1913         return err;
1914 }
1915
1916 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
1917                                 int flags, struct net_device *dev,
1918                                 u8 *dst, u8 *next_hop,
1919                                 struct mpath_info *pinfo)
1920 {
1921         void *hdr;
1922         struct nlattr *pinfoattr;
1923
1924         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1925         if (!hdr)
1926                 return -1;
1927
1928         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1929         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
1930         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
1931
1932         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
1933         if (!pinfoattr)
1934                 goto nla_put_failure;
1935         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
1936                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
1937                             pinfo->frame_qlen);
1938         if (pinfo->filled & MPATH_INFO_DSN)
1939                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DSN,
1940                             pinfo->dsn);
1941         if (pinfo->filled & MPATH_INFO_METRIC)
1942                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
1943                             pinfo->metric);
1944         if (pinfo->filled & MPATH_INFO_EXPTIME)
1945                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
1946                             pinfo->exptime);
1947         if (pinfo->filled & MPATH_INFO_FLAGS)
1948                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
1949                             pinfo->flags);
1950         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
1951                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
1952                             pinfo->discovery_timeout);
1953         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
1954                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
1955                             pinfo->discovery_retries);
1956
1957         nla_nest_end(msg, pinfoattr);
1958
1959         return genlmsg_end(msg, hdr);
1960
1961  nla_put_failure:
1962         genlmsg_cancel(msg, hdr);
1963         return -EMSGSIZE;
1964 }
1965
1966 static int nl80211_dump_mpath(struct sk_buff *skb,
1967                               struct netlink_callback *cb)
1968 {
1969         struct mpath_info pinfo;
1970         struct cfg80211_registered_device *dev;
1971         struct net_device *netdev;
1972         u8 dst[ETH_ALEN];
1973         u8 next_hop[ETH_ALEN];
1974         int ifidx = cb->args[0];
1975         int path_idx = cb->args[1];
1976         int err;
1977
1978         if (!ifidx) {
1979                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1980                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1981                                   nl80211_policy);
1982                 if (err)
1983                         return err;
1984
1985                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1986                         return -EINVAL;
1987
1988                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1989                 if (!ifidx)
1990                         return -EINVAL;
1991         }
1992
1993         rtnl_lock();
1994
1995         netdev = __dev_get_by_index(&init_net, ifidx);
1996         if (!netdev) {
1997                 err = -ENODEV;
1998                 goto out_rtnl;
1999         }
2000
2001         dev = cfg80211_get_dev_from_ifindex(ifidx);
2002         if (IS_ERR(dev)) {
2003                 err = PTR_ERR(dev);
2004                 goto out_rtnl;
2005         }
2006
2007         if (!dev->ops->dump_mpath) {
2008                 err = -EOPNOTSUPP;
2009                 goto out_err;
2010         }
2011
2012         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2013                 err = -EOPNOTSUPP;
2014                 goto out;
2015         }
2016
2017         while (1) {
2018                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
2019                                            dst, next_hop, &pinfo);
2020                 if (err == -ENOENT)
2021                         break;
2022                 if (err)
2023                         goto out_err;
2024
2025                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
2026                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
2027                                        netdev, dst, next_hop,
2028                                        &pinfo) < 0)
2029                         goto out;
2030
2031                 path_idx++;
2032         }
2033
2034
2035  out:
2036         cb->args[1] = path_idx;
2037         err = skb->len;
2038  out_err:
2039         cfg80211_unlock_rdev(dev);
2040  out_rtnl:
2041         rtnl_unlock();
2042
2043         return err;
2044 }
2045
2046 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
2047 {
2048         struct cfg80211_registered_device *rdev;
2049         int err;
2050         struct net_device *dev;
2051         struct mpath_info pinfo;
2052         struct sk_buff *msg;
2053         u8 *dst = NULL;
2054         u8 next_hop[ETH_ALEN];
2055
2056         memset(&pinfo, 0, sizeof(pinfo));
2057
2058         if (!info->attrs[NL80211_ATTR_MAC])
2059                 return -EINVAL;
2060
2061         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2062
2063         rtnl_lock();
2064
2065         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
2066         if (err)
2067                 goto out_rtnl;
2068
2069         if (!rdev->ops->get_mpath) {
2070                 err = -EOPNOTSUPP;
2071                 goto out;
2072         }
2073
2074         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2075                 err = -EOPNOTSUPP;
2076                 goto out;
2077         }
2078
2079         err = rdev->ops->get_mpath(&rdev->wiphy, dev, dst, next_hop, &pinfo);
2080         if (err)
2081                 goto out;
2082
2083         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2084         if (!msg)
2085                 goto out;
2086
2087         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2088                                  dev, dst, next_hop, &pinfo) < 0)
2089                 goto out_free;
2090
2091         err = genlmsg_reply(msg, info);
2092         goto out;
2093
2094  out_free:
2095         nlmsg_free(msg);
2096  out:
2097         cfg80211_unlock_rdev(rdev);
2098         dev_put(dev);
2099  out_rtnl:
2100         rtnl_unlock();
2101
2102         return err;
2103 }
2104
2105 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2106 {
2107         struct cfg80211_registered_device *rdev;
2108         int err;
2109         struct net_device *dev;
2110         u8 *dst = NULL;
2111         u8 *next_hop = NULL;
2112
2113         if (!info->attrs[NL80211_ATTR_MAC])
2114                 return -EINVAL;
2115
2116         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2117                 return -EINVAL;
2118
2119         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2120         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2121
2122         rtnl_lock();
2123
2124         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
2125         if (err)
2126                 goto out_rtnl;
2127
2128         if (!rdev->ops->change_mpath) {
2129                 err = -EOPNOTSUPP;
2130                 goto out;
2131         }
2132
2133         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2134                 err = -EOPNOTSUPP;
2135                 goto out;
2136         }
2137
2138         if (!netif_running(dev)) {
2139                 err = -ENETDOWN;
2140                 goto out;
2141         }
2142
2143         err = rdev->ops->change_mpath(&rdev->wiphy, dev, dst, next_hop);
2144
2145  out:
2146         cfg80211_unlock_rdev(rdev);
2147         dev_put(dev);
2148  out_rtnl:
2149         rtnl_unlock();
2150
2151         return err;
2152 }
2153 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2154 {
2155         struct cfg80211_registered_device *rdev;
2156         int err;
2157         struct net_device *dev;
2158         u8 *dst = NULL;
2159         u8 *next_hop = NULL;
2160
2161         if (!info->attrs[NL80211_ATTR_MAC])
2162                 return -EINVAL;
2163
2164         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2165                 return -EINVAL;
2166
2167         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2168         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2169
2170         rtnl_lock();
2171
2172         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
2173         if (err)
2174                 goto out_rtnl;
2175
2176         if (!rdev->ops->add_mpath) {
2177                 err = -EOPNOTSUPP;
2178                 goto out;
2179         }
2180
2181         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2182                 err = -EOPNOTSUPP;
2183                 goto out;
2184         }
2185
2186         if (!netif_running(dev)) {
2187                 err = -ENETDOWN;
2188                 goto out;
2189         }
2190
2191         err = rdev->ops->add_mpath(&rdev->wiphy, dev, dst, next_hop);
2192
2193  out:
2194         cfg80211_unlock_rdev(rdev);
2195         dev_put(dev);
2196  out_rtnl:
2197         rtnl_unlock();
2198
2199         return err;
2200 }
2201
2202 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2203 {
2204         struct cfg80211_registered_device *rdev;
2205         int err;
2206         struct net_device *dev;
2207         u8 *dst = NULL;
2208
2209         if (info->attrs[NL80211_ATTR_MAC])
2210                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2211
2212         rtnl_lock();
2213
2214         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
2215         if (err)
2216                 goto out_rtnl;
2217
2218         if (!rdev->ops->del_mpath) {
2219                 err = -EOPNOTSUPP;
2220                 goto out;
2221         }
2222
2223         err = rdev->ops->del_mpath(&rdev->wiphy, dev, dst);
2224
2225  out:
2226         cfg80211_unlock_rdev(rdev);
2227         dev_put(dev);
2228  out_rtnl:
2229         rtnl_unlock();
2230
2231         return err;
2232 }
2233
2234 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2235 {
2236         struct cfg80211_registered_device *rdev;
2237         int err;
2238         struct net_device *dev;
2239         struct bss_parameters params;
2240
2241         memset(&params, 0, sizeof(params));
2242         /* default to not changing parameters */
2243         params.use_cts_prot = -1;
2244         params.use_short_preamble = -1;
2245         params.use_short_slot_time = -1;
2246
2247         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2248                 params.use_cts_prot =
2249                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2250         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2251                 params.use_short_preamble =
2252                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2253         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2254                 params.use_short_slot_time =
2255                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2256         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2257                 params.basic_rates =
2258                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2259                 params.basic_rates_len =
2260                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2261         }
2262
2263         rtnl_lock();
2264
2265         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
2266         if (err)
2267                 goto out_rtnl;
2268
2269         if (!rdev->ops->change_bss) {
2270                 err = -EOPNOTSUPP;
2271                 goto out;
2272         }
2273
2274         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
2275                 err = -EOPNOTSUPP;
2276                 goto out;
2277         }
2278
2279         err = rdev->ops->change_bss(&rdev->wiphy, dev, &params);
2280
2281  out:
2282         cfg80211_unlock_rdev(rdev);
2283         dev_put(dev);
2284  out_rtnl:
2285         rtnl_unlock();
2286
2287         return err;
2288 }
2289
2290 static const struct nla_policy
2291         reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2292         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2293         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2294         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2295         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2296         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2297         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2298 };
2299
2300 static int parse_reg_rule(struct nlattr *tb[],
2301         struct ieee80211_reg_rule *reg_rule)
2302 {
2303         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2304         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2305
2306         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2307                 return -EINVAL;
2308         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2309                 return -EINVAL;
2310         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2311                 return -EINVAL;
2312         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2313                 return -EINVAL;
2314         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2315                 return -EINVAL;
2316
2317         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2318
2319         freq_range->start_freq_khz =
2320                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2321         freq_range->end_freq_khz =
2322                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2323         freq_range->max_bandwidth_khz =
2324                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2325
2326         power_rule->max_eirp =
2327                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2328
2329         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2330                 power_rule->max_antenna_gain =
2331                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2332
2333         return 0;
2334 }
2335
2336 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2337 {
2338         int r;
2339         char *data = NULL;
2340
2341         /*
2342          * You should only get this when cfg80211 hasn't yet initialized
2343          * completely when built-in to the kernel right between the time
2344          * window between nl80211_init() and regulatory_init(), if that is
2345          * even possible.
2346          */
2347         mutex_lock(&cfg80211_mutex);
2348         if (unlikely(!cfg80211_regdomain)) {
2349                 mutex_unlock(&cfg80211_mutex);
2350                 return -EINPROGRESS;
2351         }
2352         mutex_unlock(&cfg80211_mutex);
2353
2354         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2355                 return -EINVAL;
2356
2357         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2358
2359 #ifdef CONFIG_WIRELESS_OLD_REGULATORY
2360         /* We ignore world regdom requests with the old regdom setup */
2361         if (is_world_regdom(data))
2362                 return -EINVAL;
2363 #endif
2364
2365         r = regulatory_hint_user(data);
2366
2367         return r;
2368 }
2369
2370 static int nl80211_get_mesh_params(struct sk_buff *skb,
2371         struct genl_info *info)
2372 {
2373         struct cfg80211_registered_device *rdev;
2374         struct mesh_config cur_params;
2375         int err;
2376         struct net_device *dev;
2377         void *hdr;
2378         struct nlattr *pinfoattr;
2379         struct sk_buff *msg;
2380
2381         rtnl_lock();
2382
2383         /* Look up our device */
2384         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
2385         if (err)
2386                 goto out_rtnl;
2387
2388         if (!rdev->ops->get_mesh_params) {
2389                 err = -EOPNOTSUPP;
2390                 goto out;
2391         }
2392
2393         /* Get the mesh params */
2394         err = rdev->ops->get_mesh_params(&rdev->wiphy, dev, &cur_params);
2395         if (err)
2396                 goto out;
2397
2398         /* Draw up a netlink message to send back */
2399         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2400         if (!msg) {
2401                 err = -ENOBUFS;
2402                 goto out;
2403         }
2404         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2405                              NL80211_CMD_GET_MESH_PARAMS);
2406         if (!hdr)
2407                 goto nla_put_failure;
2408         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
2409         if (!pinfoattr)
2410                 goto nla_put_failure;
2411         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2412         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2413                         cur_params.dot11MeshRetryTimeout);
2414         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2415                         cur_params.dot11MeshConfirmTimeout);
2416         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2417                         cur_params.dot11MeshHoldingTimeout);
2418         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2419                         cur_params.dot11MeshMaxPeerLinks);
2420         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2421                         cur_params.dot11MeshMaxRetries);
2422         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2423                         cur_params.dot11MeshTTL);
2424         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2425                         cur_params.auto_open_plinks);
2426         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2427                         cur_params.dot11MeshHWMPmaxPREQretries);
2428         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2429                         cur_params.path_refresh_time);
2430         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2431                         cur_params.min_discovery_timeout);
2432         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2433                         cur_params.dot11MeshHWMPactivePathTimeout);
2434         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2435                         cur_params.dot11MeshHWMPpreqMinInterval);
2436         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2437                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2438         nla_nest_end(msg, pinfoattr);
2439         genlmsg_end(msg, hdr);
2440         err = genlmsg_reply(msg, info);
2441         goto out;
2442
2443  nla_put_failure:
2444         genlmsg_cancel(msg, hdr);
2445         err = -EMSGSIZE;
2446  out:
2447         /* Cleanup */
2448         cfg80211_unlock_rdev(rdev);
2449         dev_put(dev);
2450  out_rtnl:
2451         rtnl_unlock();
2452
2453         return err;
2454 }
2455
2456 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2457 do {\
2458         if (table[attr_num]) {\
2459                 cfg.param = nla_fn(table[attr_num]); \
2460                 mask |= (1 << (attr_num - 1)); \
2461         } \
2462 } while (0);\
2463
2464 static struct nla_policy
2465 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] __read_mostly = {
2466         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2467         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2468         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2469         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2470         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2471         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2472         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2473
2474         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2475         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2476         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2477         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2478         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2479         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2480 };
2481
2482 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2483 {
2484         int err;
2485         u32 mask;
2486         struct cfg80211_registered_device *rdev;
2487         struct net_device *dev;
2488         struct mesh_config cfg;
2489         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2490         struct nlattr *parent_attr;
2491
2492         parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
2493         if (!parent_attr)
2494                 return -EINVAL;
2495         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2496                         parent_attr, nl80211_meshconf_params_policy))
2497                 return -EINVAL;
2498
2499         rtnl_lock();
2500
2501         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
2502         if (err)
2503                 goto out_rtnl;
2504
2505         if (!rdev->ops->set_mesh_params) {
2506                 err = -EOPNOTSUPP;
2507                 goto out;
2508         }
2509
2510         /* This makes sure that there aren't more than 32 mesh config
2511          * parameters (otherwise our bitfield scheme would not work.) */
2512         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2513
2514         /* Fill in the params struct */
2515         mask = 0;
2516         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2517                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2518         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2519                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2520         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2521                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2522         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2523                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2524         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2525                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2526         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2527                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2528         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2529                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2530         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2531                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2532                         nla_get_u8);
2533         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2534                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2535         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2536                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2537                         nla_get_u16);
2538         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2539                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2540                         nla_get_u32);
2541         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2542                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2543                         nla_get_u16);
2544         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2545                         dot11MeshHWMPnetDiameterTraversalTime,
2546                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2547                         nla_get_u16);
2548
2549         /* Apply changes */
2550         err = rdev->ops->set_mesh_params(&rdev->wiphy, dev, &cfg, mask);
2551
2552  out:
2553         /* cleanup */
2554         cfg80211_unlock_rdev(rdev);
2555         dev_put(dev);
2556  out_rtnl:
2557         rtnl_unlock();
2558
2559         return err;
2560 }
2561
2562 #undef FILL_IN_MESH_PARAM_IF_SET
2563
2564 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2565 {
2566         struct sk_buff *msg;
2567         void *hdr = NULL;
2568         struct nlattr *nl_reg_rules;
2569         unsigned int i;
2570         int err = -EINVAL;
2571
2572         mutex_lock(&cfg80211_mutex);
2573
2574         if (!cfg80211_regdomain)
2575                 goto out;
2576
2577         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2578         if (!msg) {
2579                 err = -ENOBUFS;
2580                 goto out;
2581         }
2582
2583         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2584                              NL80211_CMD_GET_REG);
2585         if (!hdr)
2586                 goto nla_put_failure;
2587
2588         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2589                 cfg80211_regdomain->alpha2);
2590
2591         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2592         if (!nl_reg_rules)
2593                 goto nla_put_failure;
2594
2595         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2596                 struct nlattr *nl_reg_rule;
2597                 const struct ieee80211_reg_rule *reg_rule;
2598                 const struct ieee80211_freq_range *freq_range;
2599                 const struct ieee80211_power_rule *power_rule;
2600
2601                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2602                 freq_range = &reg_rule->freq_range;
2603                 power_rule = &reg_rule->power_rule;
2604
2605                 nl_reg_rule = nla_nest_start(msg, i);
2606                 if (!nl_reg_rule)
2607                         goto nla_put_failure;
2608
2609                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2610                         reg_rule->flags);
2611                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2612                         freq_range->start_freq_khz);
2613                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2614                         freq_range->end_freq_khz);
2615                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2616                         freq_range->max_bandwidth_khz);
2617                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2618                         power_rule->max_antenna_gain);
2619                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2620                         power_rule->max_eirp);
2621
2622                 nla_nest_end(msg, nl_reg_rule);
2623         }
2624
2625         nla_nest_end(msg, nl_reg_rules);
2626
2627         genlmsg_end(msg, hdr);
2628         err = genlmsg_reply(msg, info);
2629         goto out;
2630
2631 nla_put_failure:
2632         genlmsg_cancel(msg, hdr);
2633         err = -EMSGSIZE;
2634 out:
2635         mutex_unlock(&cfg80211_mutex);
2636         return err;
2637 }
2638
2639 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2640 {
2641         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2642         struct nlattr *nl_reg_rule;
2643         char *alpha2 = NULL;
2644         int rem_reg_rules = 0, r = 0;
2645         u32 num_rules = 0, rule_idx = 0, size_of_regd;
2646         struct ieee80211_regdomain *rd = NULL;
2647
2648         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2649                 return -EINVAL;
2650
2651         if (!info->attrs[NL80211_ATTR_REG_RULES])
2652                 return -EINVAL;
2653
2654         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2655
2656         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2657                         rem_reg_rules) {
2658                 num_rules++;
2659                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2660                         return -EINVAL;
2661         }
2662
2663         mutex_lock(&cfg80211_mutex);
2664
2665         if (!reg_is_valid_request(alpha2)) {
2666                 r = -EINVAL;
2667                 goto bad_reg;
2668         }
2669
2670         size_of_regd = sizeof(struct ieee80211_regdomain) +
2671                 (num_rules * sizeof(struct ieee80211_reg_rule));
2672
2673         rd = kzalloc(size_of_regd, GFP_KERNEL);
2674         if (!rd) {
2675                 r = -ENOMEM;
2676                 goto bad_reg;
2677         }
2678
2679         rd->n_reg_rules = num_rules;
2680         rd->alpha2[0] = alpha2[0];
2681         rd->alpha2[1] = alpha2[1];
2682
2683         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2684                         rem_reg_rules) {
2685                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2686                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2687                         reg_rule_policy);
2688                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2689                 if (r)
2690                         goto bad_reg;
2691
2692                 rule_idx++;
2693
2694                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
2695                         r = -EINVAL;
2696                         goto bad_reg;
2697                 }
2698         }
2699
2700         BUG_ON(rule_idx != num_rules);
2701
2702         r = set_regdom(rd);
2703
2704         mutex_unlock(&cfg80211_mutex);
2705
2706         return r;
2707
2708  bad_reg:
2709         mutex_unlock(&cfg80211_mutex);
2710         kfree(rd);
2711         return r;
2712 }
2713
2714 static int validate_scan_freqs(struct nlattr *freqs)
2715 {
2716         struct nlattr *attr1, *attr2;
2717         int n_channels = 0, tmp1, tmp2;
2718
2719         nla_for_each_nested(attr1, freqs, tmp1) {
2720                 n_channels++;
2721                 /*
2722                  * Some hardware has a limited channel list for
2723                  * scanning, and it is pretty much nonsensical
2724                  * to scan for a channel twice, so disallow that
2725                  * and don't require drivers to check that the
2726                  * channel list they get isn't longer than what
2727                  * they can scan, as long as they can scan all
2728                  * the channels they registered at once.
2729                  */
2730                 nla_for_each_nested(attr2, freqs, tmp2)
2731                         if (attr1 != attr2 &&
2732                             nla_get_u32(attr1) == nla_get_u32(attr2))
2733                                 return 0;
2734         }
2735
2736         return n_channels;
2737 }
2738
2739 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
2740 {
2741         struct cfg80211_registered_device *rdev;
2742         struct net_device *dev;
2743         struct cfg80211_scan_request *request;
2744         struct cfg80211_ssid *ssid;
2745         struct ieee80211_channel *channel;
2746         struct nlattr *attr;
2747         struct wiphy *wiphy;
2748         int err, tmp, n_ssids = 0, n_channels, i;
2749         enum ieee80211_band band;
2750         size_t ie_len;
2751
2752         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2753                 return -EINVAL;
2754
2755         rtnl_lock();
2756
2757         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
2758         if (err)
2759                 goto out_rtnl;
2760
2761         wiphy = &rdev->wiphy;
2762
2763         if (!rdev->ops->scan) {
2764                 err = -EOPNOTSUPP;
2765                 goto out;
2766         }
2767
2768         if (!netif_running(dev)) {
2769                 err = -ENETDOWN;
2770                 goto out;
2771         }
2772
2773         if (rdev->scan_req) {
2774                 err = -EBUSY;
2775                 goto out;
2776         }
2777
2778         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2779                 n_channels = validate_scan_freqs(
2780                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
2781                 if (!n_channels) {
2782                         err = -EINVAL;
2783                         goto out;
2784                 }
2785         } else {
2786                 n_channels = 0;
2787
2788                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
2789                         if (wiphy->bands[band])
2790                                 n_channels += wiphy->bands[band]->n_channels;
2791         }
2792
2793         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
2794                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
2795                         n_ssids++;
2796
2797         if (n_ssids > wiphy->max_scan_ssids) {
2798                 err = -EINVAL;
2799                 goto out;
2800         }
2801
2802         if (info->attrs[NL80211_ATTR_IE])
2803                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2804         else
2805                 ie_len = 0;
2806
2807         if (ie_len > wiphy->max_scan_ie_len) {
2808                 err = -EINVAL;
2809                 goto out;
2810         }
2811
2812         request = kzalloc(sizeof(*request)
2813                         + sizeof(*ssid) * n_ssids
2814                         + sizeof(channel) * n_channels
2815                         + ie_len, GFP_KERNEL);
2816         if (!request) {
2817                 err = -ENOMEM;
2818                 goto out;
2819         }
2820
2821         request->channels = (void *)((char *)request + sizeof(*request));
2822         request->n_channels = n_channels;
2823         if (n_ssids)
2824                 request->ssids = (void *)(request->channels + n_channels);
2825         request->n_ssids = n_ssids;
2826         if (ie_len) {
2827                 if (request->ssids)
2828                         request->ie = (void *)(request->ssids + n_ssids);
2829                 else
2830                         request->ie = (void *)(request->channels + n_channels);
2831         }
2832
2833         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2834                 /* user specified, bail out if channel not found */
2835                 request->n_channels = n_channels;
2836                 i = 0;
2837                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
2838                         request->channels[i] = ieee80211_get_channel(wiphy, nla_get_u32(attr));
2839                         if (!request->channels[i]) {
2840                                 err = -EINVAL;
2841                                 goto out_free;
2842                         }
2843                         i++;
2844                 }
2845         } else {
2846                 /* all channels */
2847                 i = 0;
2848                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
2849                         int j;
2850                         if (!wiphy->bands[band])
2851                                 continue;
2852                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
2853                                 request->channels[i] = &wiphy->bands[band]->channels[j];
2854                                 i++;
2855                         }
2856                 }
2857         }
2858
2859         i = 0;
2860         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
2861                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
2862                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
2863                                 err = -EINVAL;
2864                                 goto out_free;
2865                         }
2866                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
2867                         request->ssids[i].ssid_len = nla_len(attr);
2868                         i++;
2869                 }
2870         }
2871
2872         if (info->attrs[NL80211_ATTR_IE]) {
2873                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2874                 memcpy((void *)request->ie,
2875                        nla_data(info->attrs[NL80211_ATTR_IE]),
2876                        request->ie_len);
2877         }
2878
2879         request->ifidx = dev->ifindex;
2880         request->wiphy = &rdev->wiphy;
2881
2882         rdev->scan_req = request;
2883         err = rdev->ops->scan(&rdev->wiphy, dev, request);
2884
2885         if (!err)
2886                 nl80211_send_scan_start(rdev, dev);
2887
2888  out_free:
2889         if (err) {
2890                 rdev->scan_req = NULL;
2891                 kfree(request);
2892         }
2893  out:
2894         cfg80211_unlock_rdev(rdev);
2895         dev_put(dev);
2896  out_rtnl:
2897         rtnl_unlock();
2898
2899         return err;
2900 }
2901
2902 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
2903                             struct cfg80211_registered_device *rdev,
2904                             struct net_device *dev,
2905                             struct cfg80211_bss *res)
2906 {
2907         void *hdr;
2908         struct nlattr *bss;
2909
2910         hdr = nl80211hdr_put(msg, pid, seq, flags,
2911                              NL80211_CMD_NEW_SCAN_RESULTS);
2912         if (!hdr)
2913                 return -1;
2914
2915         NLA_PUT_U32(msg, NL80211_ATTR_SCAN_GENERATION,
2916                     rdev->bss_generation);
2917         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2918
2919         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
2920         if (!bss)
2921                 goto nla_put_failure;
2922         if (!is_zero_ether_addr(res->bssid))
2923                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
2924         if (res->information_elements && res->len_information_elements)
2925                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
2926                         res->len_information_elements,
2927                         res->information_elements);
2928         if (res->tsf)
2929                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
2930         if (res->beacon_interval)
2931                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
2932         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
2933         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
2934
2935         switch (rdev->wiphy.signal_type) {
2936         case CFG80211_SIGNAL_TYPE_MBM:
2937                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
2938                 break;
2939         case CFG80211_SIGNAL_TYPE_UNSPEC:
2940                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
2941                 break;
2942         default:
2943                 break;
2944         }
2945
2946         nla_nest_end(msg, bss);
2947
2948         return genlmsg_end(msg, hdr);
2949
2950  nla_put_failure:
2951         genlmsg_cancel(msg, hdr);
2952         return -EMSGSIZE;
2953 }
2954
2955 static int nl80211_dump_scan(struct sk_buff *skb,
2956                              struct netlink_callback *cb)
2957 {
2958         struct cfg80211_registered_device *dev;
2959         struct net_device *netdev;
2960         struct cfg80211_internal_bss *scan;
2961         int ifidx = cb->args[0];
2962         int start = cb->args[1], idx = 0;
2963         int err;
2964
2965         if (!ifidx) {
2966                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
2967                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
2968                                   nl80211_policy);
2969                 if (err)
2970                         return err;
2971
2972                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
2973                         return -EINVAL;
2974
2975                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
2976                 if (!ifidx)
2977                         return -EINVAL;
2978                 cb->args[0] = ifidx;
2979         }
2980
2981         netdev = dev_get_by_index(&init_net, ifidx);
2982         if (!netdev)
2983                 return -ENODEV;
2984
2985         dev = cfg80211_get_dev_from_ifindex(ifidx);
2986         if (IS_ERR(dev)) {
2987                 err = PTR_ERR(dev);
2988                 goto out_put_netdev;
2989         }
2990
2991         spin_lock_bh(&dev->bss_lock);
2992         cfg80211_bss_expire(dev);
2993
2994         list_for_each_entry(scan, &dev->bss_list, list) {
2995                 if (++idx <= start)
2996                         continue;
2997                 if (nl80211_send_bss(skb,
2998                                 NETLINK_CB(cb->skb).pid,
2999                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3000                                 dev, netdev, &scan->pub) < 0) {
3001                         idx--;
3002                         goto out;
3003                 }
3004         }
3005
3006  out:
3007         spin_unlock_bh(&dev->bss_lock);
3008
3009         cb->args[1] = idx;
3010         err = skb->len;
3011         cfg80211_unlock_rdev(dev);
3012  out_put_netdev:
3013         dev_put(netdev);
3014
3015         return err;
3016 }
3017
3018 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
3019 {
3020         return auth_type <= NL80211_AUTHTYPE_MAX;
3021 }
3022
3023 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
3024 {
3025         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
3026                                   NL80211_WPA_VERSION_2));
3027 }
3028
3029 static bool nl80211_valid_akm_suite(u32 akm)
3030 {
3031         return akm == WLAN_AKM_SUITE_8021X ||
3032                 akm == WLAN_AKM_SUITE_PSK;
3033 }
3034
3035 static bool nl80211_valid_cipher_suite(u32 cipher)
3036 {
3037         return cipher == WLAN_CIPHER_SUITE_WEP40 ||
3038                 cipher == WLAN_CIPHER_SUITE_WEP104 ||
3039                 cipher == WLAN_CIPHER_SUITE_TKIP ||
3040                 cipher == WLAN_CIPHER_SUITE_CCMP ||
3041                 cipher == WLAN_CIPHER_SUITE_AES_CMAC;
3042 }
3043
3044
3045 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
3046 {
3047         struct cfg80211_registered_device *rdev;
3048         struct net_device *dev;
3049         struct ieee80211_channel *chan;
3050         const u8 *bssid, *ssid, *ie = NULL;
3051         int err, ssid_len, ie_len = 0;
3052         enum nl80211_auth_type auth_type;
3053
3054         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3055                 return -EINVAL;
3056
3057         if (!info->attrs[NL80211_ATTR_MAC])
3058                 return -EINVAL;
3059
3060         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
3061                 return -EINVAL;
3062
3063         if (!info->attrs[NL80211_ATTR_SSID])
3064                 return -EINVAL;
3065
3066         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
3067                 return -EINVAL;
3068
3069         rtnl_lock();
3070
3071         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
3072         if (err)
3073                 goto unlock_rtnl;
3074
3075         if (!rdev->ops->auth) {
3076                 err = -EOPNOTSUPP;
3077                 goto out;
3078         }
3079
3080         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3081                 err = -EOPNOTSUPP;
3082                 goto out;
3083         }
3084
3085         if (!netif_running(dev)) {
3086                 err = -ENETDOWN;
3087                 goto out;
3088         }
3089
3090         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3091         chan = ieee80211_get_channel(&rdev->wiphy,
3092                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3093         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED)) {
3094                 err = -EINVAL;
3095                 goto out;
3096         }
3097
3098         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3099         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3100
3101         if (info->attrs[NL80211_ATTR_IE]) {
3102                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3103                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3104         }
3105
3106         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
3107         if (!nl80211_valid_auth_type(auth_type)) {
3108                 err = -EINVAL;
3109                 goto out;
3110         }
3111
3112         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
3113                                  ssid, ssid_len, ie, ie_len);
3114
3115 out:
3116         cfg80211_unlock_rdev(rdev);
3117         dev_put(dev);
3118 unlock_rtnl:
3119         rtnl_unlock();
3120         return err;
3121 }
3122
3123 static int nl80211_crypto_settings(struct genl_info *info,
3124                                    struct cfg80211_crypto_settings *settings,
3125                                    int cipher_limit)
3126 {
3127         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
3128
3129         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
3130                 void *data;
3131                 int len, i;
3132
3133                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3134                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3135                 settings->n_ciphers_pairwise = len / sizeof(u32);
3136
3137                 if (len % sizeof(u32))
3138                         return -EINVAL;
3139
3140                 if (settings->n_ciphers_pairwise > cipher_limit)
3141                         return -EINVAL;
3142
3143                 memcpy(settings->ciphers_pairwise, data, len);
3144
3145                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3146                         if (!nl80211_valid_cipher_suite(
3147                                         settings->ciphers_pairwise[i]))
3148                                 return -EINVAL;
3149         }
3150
3151         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
3152                 settings->cipher_group =
3153                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
3154                 if (!nl80211_valid_cipher_suite(settings->cipher_group))
3155                         return -EINVAL;
3156         }
3157
3158         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
3159                 settings->wpa_versions =
3160                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
3161                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
3162                         return -EINVAL;
3163         }
3164
3165         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
3166                 void *data;
3167                 int len, i;
3168
3169                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
3170                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
3171                 settings->n_akm_suites = len / sizeof(u32);
3172
3173                 if (len % sizeof(u32))
3174                         return -EINVAL;
3175
3176                 memcpy(settings->akm_suites, data, len);
3177
3178                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3179                         if (!nl80211_valid_akm_suite(settings->akm_suites[i]))
3180                                 return -EINVAL;
3181         }
3182
3183         return 0;
3184 }
3185
3186 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
3187 {
3188         struct cfg80211_registered_device *rdev;
3189         struct net_device *dev;
3190         struct cfg80211_crypto_settings crypto;
3191         struct ieee80211_channel *chan;
3192         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
3193         int err, ssid_len, ie_len = 0;
3194         bool use_mfp = false;
3195
3196         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3197                 return -EINVAL;
3198
3199         if (!info->attrs[NL80211_ATTR_MAC] ||
3200             !info->attrs[NL80211_ATTR_SSID] ||
3201             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
3202                 return -EINVAL;
3203
3204         rtnl_lock();
3205
3206         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
3207         if (err)
3208                 goto unlock_rtnl;
3209
3210         if (!rdev->ops->assoc) {
3211                 err = -EOPNOTSUPP;
3212                 goto out;
3213         }
3214
3215         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3216                 err = -EOPNOTSUPP;
3217                 goto out;
3218         }
3219
3220         if (!netif_running(dev)) {
3221                 err = -ENETDOWN;
3222                 goto out;
3223         }
3224
3225         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3226
3227         chan = ieee80211_get_channel(&rdev->wiphy,
3228                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3229         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED)) {
3230                 err = -EINVAL;
3231                 goto out;
3232         }
3233
3234         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3235         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3236
3237         if (info->attrs[NL80211_ATTR_IE]) {
3238                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3239                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3240         }
3241
3242         if (info->attrs[NL80211_ATTR_USE_MFP]) {
3243                 enum nl80211_mfp mfp =
3244                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
3245                 if (mfp == NL80211_MFP_REQUIRED)
3246                         use_mfp = true;
3247                 else if (mfp != NL80211_MFP_NO) {
3248                         err = -EINVAL;
3249                         goto out;
3250                 }
3251         }
3252
3253         if (info->attrs[NL80211_ATTR_PREV_BSSID])
3254                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
3255
3256         err = nl80211_crypto_settings(info, &crypto, 1);
3257         if (!err)
3258                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
3259                                           ssid, ssid_len, ie, ie_len, use_mfp,
3260                                           &crypto);
3261
3262 out:
3263         cfg80211_unlock_rdev(rdev);
3264         dev_put(dev);
3265 unlock_rtnl:
3266         rtnl_unlock();
3267         return err;
3268 }
3269
3270 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
3271 {
3272         struct cfg80211_registered_device *rdev;
3273         struct net_device *dev;
3274         const u8 *ie = NULL, *bssid;
3275         int err, ie_len = 0;
3276         u16 reason_code;
3277
3278         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3279                 return -EINVAL;
3280
3281         if (!info->attrs[NL80211_ATTR_MAC])
3282                 return -EINVAL;
3283
3284         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3285                 return -EINVAL;
3286
3287         rtnl_lock();
3288
3289         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
3290         if (err)
3291                 goto unlock_rtnl;
3292
3293         if (!rdev->ops->deauth) {
3294                 err = -EOPNOTSUPP;
3295                 goto out;
3296         }
3297
3298         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3299                 err = -EOPNOTSUPP;
3300                 goto out;
3301         }
3302
3303         if (!netif_running(dev)) {
3304                 err = -ENETDOWN;
3305                 goto out;
3306         }
3307
3308         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3309
3310         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3311         if (reason_code == 0) {
3312                 /* Reason Code 0 is reserved */
3313                 err = -EINVAL;
3314                 goto out;
3315         }
3316
3317         if (info->attrs[NL80211_ATTR_IE]) {
3318                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3319                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3320         }
3321
3322         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code);
3323
3324 out:
3325         cfg80211_unlock_rdev(rdev);
3326         dev_put(dev);
3327 unlock_rtnl:
3328         rtnl_unlock();
3329         return err;
3330 }
3331
3332 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
3333 {
3334         struct cfg80211_registered_device *rdev;
3335         struct net_device *dev;
3336         const u8 *ie = NULL, *bssid;
3337         int err, ie_len = 0;
3338         u16 reason_code;
3339
3340         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3341                 return -EINVAL;
3342
3343         if (!info->attrs[NL80211_ATTR_MAC])
3344                 return -EINVAL;
3345
3346         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3347                 return -EINVAL;
3348
3349         rtnl_lock();
3350
3351         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
3352         if (err)
3353                 goto unlock_rtnl;
3354
3355         if (!rdev->ops->disassoc) {
3356                 err = -EOPNOTSUPP;
3357                 goto out;
3358         }
3359
3360         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3361                 err = -EOPNOTSUPP;
3362                 goto out;
3363         }
3364
3365         if (!netif_running(dev)) {
3366                 err = -ENETDOWN;
3367                 goto out;
3368         }
3369
3370         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3371
3372         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3373         if (reason_code == 0) {
3374                 /* Reason Code 0 is reserved */
3375                 err = -EINVAL;
3376                 goto out;
3377         }
3378
3379         if (info->attrs[NL80211_ATTR_IE]) {
3380                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3381                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3382         }
3383
3384         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code);
3385
3386 out:
3387         cfg80211_unlock_rdev(rdev);
3388         dev_put(dev);
3389 unlock_rtnl:
3390         rtnl_unlock();
3391         return err;
3392 }
3393
3394 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
3395 {
3396         struct cfg80211_registered_device *rdev;
3397         struct net_device *dev;
3398         struct cfg80211_ibss_params ibss;
3399         struct wiphy *wiphy;
3400         int err;
3401
3402         memset(&ibss, 0, sizeof(ibss));
3403
3404         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3405                 return -EINVAL;
3406
3407         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
3408             !info->attrs[NL80211_ATTR_SSID] ||
3409             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3410                 return -EINVAL;
3411
3412         ibss.beacon_interval = 100;
3413
3414         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
3415                 ibss.beacon_interval =
3416                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3417                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
3418                         return -EINVAL;
3419         }
3420
3421         rtnl_lock();
3422
3423         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
3424         if (err)
3425                 goto unlock_rtnl;
3426
3427         if (!rdev->ops->join_ibss) {
3428                 err = -EOPNOTSUPP;
3429                 goto out;
3430         }
3431
3432         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3433                 err = -EOPNOTSUPP;
3434                 goto out;
3435         }
3436
3437         if (!netif_running(dev)) {
3438                 err = -ENETDOWN;
3439                 goto out;
3440         }
3441
3442         wiphy = &rdev->wiphy;
3443
3444         if (info->attrs[NL80211_ATTR_MAC])
3445                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3446         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3447         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3448
3449         if (info->attrs[NL80211_ATTR_IE]) {
3450                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3451                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3452         }
3453
3454         ibss.channel = ieee80211_get_channel(wiphy,
3455                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3456         if (!ibss.channel ||
3457             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
3458             ibss.channel->flags & IEEE80211_CHAN_DISABLED) {
3459                 err = -EINVAL;
3460                 goto out;
3461         }
3462
3463         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
3464
3465         err = cfg80211_join_ibss(rdev, dev, &ibss);
3466
3467 out:
3468         cfg80211_unlock_rdev(rdev);
3469         dev_put(dev);
3470 unlock_rtnl:
3471         rtnl_unlock();
3472         return err;
3473 }
3474
3475 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
3476 {
3477         struct cfg80211_registered_device *rdev;
3478         struct net_device *dev;
3479         int err;
3480
3481         rtnl_lock();
3482
3483         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
3484         if (err)
3485                 goto unlock_rtnl;
3486
3487         if (!rdev->ops->leave_ibss) {
3488                 err = -EOPNOTSUPP;
3489                 goto out;
3490         }
3491
3492         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3493                 err = -EOPNOTSUPP;
3494                 goto out;
3495         }
3496
3497         if (!netif_running(dev)) {
3498                 err = -ENETDOWN;
3499                 goto out;
3500         }
3501
3502         err = cfg80211_leave_ibss(rdev, dev, false);
3503
3504 out:
3505         cfg80211_unlock_rdev(rdev);
3506         dev_put(dev);
3507 unlock_rtnl:
3508         rtnl_unlock();
3509         return err;
3510 }
3511
3512 #ifdef CONFIG_NL80211_TESTMODE
3513 static struct genl_multicast_group nl80211_testmode_mcgrp = {
3514         .name = "testmode",
3515 };
3516
3517 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
3518 {
3519         struct cfg80211_registered_device *rdev;
3520         int err;
3521
3522         if (!info->attrs[NL80211_ATTR_TESTDATA])
3523                 return -EINVAL;
3524
3525         rtnl_lock();
3526
3527         rdev = cfg80211_get_dev_from_info(info);
3528         if (IS_ERR(rdev)) {
3529                 err = PTR_ERR(rdev);
3530                 goto unlock_rtnl;
3531         }
3532
3533         err = -EOPNOTSUPP;
3534         if (rdev->ops->testmode_cmd) {
3535                 rdev->testmode_info = info;
3536                 err = rdev->ops->testmode_cmd(&rdev->wiphy,
3537                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
3538                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
3539                 rdev->testmode_info = NULL;
3540         }
3541
3542         cfg80211_unlock_rdev(rdev);
3543
3544  unlock_rtnl:
3545         rtnl_unlock();
3546         return err;
3547 }
3548
3549 static struct sk_buff *
3550 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
3551                               int approxlen, u32 pid, u32 seq, gfp_t gfp)
3552 {
3553         struct sk_buff *skb;
3554         void *hdr;
3555         struct nlattr *data;
3556
3557         skb = nlmsg_new(approxlen + 100, gfp);
3558         if (!skb)
3559                 return NULL;
3560
3561         hdr = nl80211hdr_put(skb, pid, seq, 0, NL80211_CMD_TESTMODE);
3562         if (!hdr) {
3563                 kfree_skb(skb);
3564                 return NULL;
3565         }
3566
3567         NLA_PUT_U32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3568         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
3569
3570         ((void **)skb->cb)[0] = rdev;
3571         ((void **)skb->cb)[1] = hdr;
3572         ((void **)skb->cb)[2] = data;
3573
3574         return skb;
3575
3576  nla_put_failure:
3577         kfree_skb(skb);
3578         return NULL;
3579 }
3580
3581 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
3582                                                   int approxlen)
3583 {
3584         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
3585
3586         if (WARN_ON(!rdev->testmode_info))
3587                 return NULL;
3588
3589         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
3590                                 rdev->testmode_info->snd_pid,
3591                                 rdev->testmode_info->snd_seq,
3592                                 GFP_KERNEL);
3593 }
3594 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
3595
3596 int cfg80211_testmode_reply(struct sk_buff *skb)
3597 {
3598         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
3599         void *hdr = ((void **)skb->cb)[1];
3600         struct nlattr *data = ((void **)skb->cb)[2];
3601
3602         if (WARN_ON(!rdev->testmode_info)) {
3603                 kfree_skb(skb);
3604                 return -EINVAL;
3605         }
3606
3607         nla_nest_end(skb, data);
3608         genlmsg_end(skb, hdr);
3609         return genlmsg_reply(skb, rdev->testmode_info);
3610 }
3611 EXPORT_SYMBOL(cfg80211_testmode_reply);
3612
3613 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
3614                                                   int approxlen, gfp_t gfp)
3615 {
3616         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
3617
3618         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
3619 }
3620 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
3621
3622 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
3623 {
3624         void *hdr = ((void **)skb->cb)[1];
3625         struct nlattr *data = ((void **)skb->cb)[2];
3626
3627         nla_nest_end(skb, data);
3628         genlmsg_end(skb, hdr);
3629         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
3630 }
3631 EXPORT_SYMBOL(cfg80211_testmode_event);
3632 #endif
3633
3634 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
3635 {
3636         struct cfg80211_registered_device *rdev;
3637         struct net_device *dev;
3638         struct cfg80211_connect_params connect;
3639         struct wiphy *wiphy;
3640         int err;
3641
3642         memset(&connect, 0, sizeof(connect));
3643
3644         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3645                 return -EINVAL;
3646
3647         if (!info->attrs[NL80211_ATTR_SSID] ||
3648             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3649                 return -EINVAL;
3650
3651         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3652                 connect.auth_type =
3653                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
3654                 if (!nl80211_valid_auth_type(connect.auth_type))
3655                         return -EINVAL;
3656         } else
3657                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3658
3659         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
3660
3661         err = nl80211_crypto_settings(info, &connect.crypto,
3662                                       NL80211_MAX_NR_CIPHER_SUITES);
3663         if (err)
3664                 return err;
3665         rtnl_lock();
3666
3667         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
3668         if (err)
3669                 goto unlock_rtnl;
3670
3671         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3672                 err = -EOPNOTSUPP;
3673                 goto out;
3674         }
3675
3676         if (!netif_running(dev)) {
3677                 err = -ENETDOWN;
3678                 goto out;
3679         }
3680
3681         wiphy = &rdev->wiphy;
3682
3683         connect.bssid = NULL;
3684         connect.channel = NULL;
3685         connect.auth_type = NL80211_AUTHTYPE_OPEN_SYSTEM;
3686
3687         if (info->attrs[NL80211_ATTR_MAC])
3688                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3689         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3690         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3691
3692         if (info->attrs[NL80211_ATTR_IE]) {
3693                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3694                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3695         }
3696
3697         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3698                 connect.channel =
3699                         ieee80211_get_channel(wiphy,
3700                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3701                 if (!connect.channel ||
3702                     connect.channel->flags & IEEE80211_CHAN_DISABLED) {
3703                         err = -EINVAL;
3704                         goto out;
3705                 }
3706         }
3707
3708         err = cfg80211_connect(rdev, dev, &connect);
3709
3710 out:
3711         cfg80211_unlock_rdev(rdev);
3712         dev_put(dev);
3713 unlock_rtnl:
3714         rtnl_unlock();
3715         return err;
3716 }
3717
3718 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
3719 {
3720         struct cfg80211_registered_device *rdev;
3721         struct net_device *dev;
3722         int err;
3723         u16 reason;
3724
3725         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3726                 reason = WLAN_REASON_DEAUTH_LEAVING;
3727         else
3728                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3729
3730         if (reason == 0)
3731                 return -EINVAL;
3732
3733         rtnl_lock();
3734
3735         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
3736         if (err)
3737                 goto unlock_rtnl;
3738
3739         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3740                 err = -EOPNOTSUPP;
3741                 goto out;
3742         }
3743
3744         if (!netif_running(dev)) {
3745                 err = -ENETDOWN;
3746                 goto out;
3747         }
3748
3749         err = cfg80211_disconnect(rdev, dev, reason, true);
3750
3751 out:
3752         cfg80211_unlock_rdev(rdev);
3753         dev_put(dev);
3754 unlock_rtnl:
3755         rtnl_unlock();
3756         return err;
3757 }
3758
3759 static struct genl_ops nl80211_ops[] = {
3760         {
3761                 .cmd = NL80211_CMD_GET_WIPHY,
3762                 .doit = nl80211_get_wiphy,
3763                 .dumpit = nl80211_dump_wiphy,
3764                 .policy = nl80211_policy,
3765                 /* can be retrieved by unprivileged users */
3766         },
3767         {
3768                 .cmd = NL80211_CMD_SET_WIPHY,
3769                 .doit = nl80211_set_wiphy,
3770                 .policy = nl80211_policy,
3771                 .flags = GENL_ADMIN_PERM,
3772         },
3773         {
3774                 .cmd = NL80211_CMD_GET_INTERFACE,
3775                 .doit = nl80211_get_interface,
3776                 .dumpit = nl80211_dump_interface,
3777                 .policy = nl80211_policy,
3778                 /* can be retrieved by unprivileged users */
3779         },
3780         {
3781                 .cmd = NL80211_CMD_SET_INTERFACE,
3782                 .doit = nl80211_set_interface,
3783                 .policy = nl80211_policy,
3784                 .flags = GENL_ADMIN_PERM,
3785         },
3786         {
3787                 .cmd = NL80211_CMD_NEW_INTERFACE,
3788                 .doit = nl80211_new_interface,
3789                 .policy = nl80211_policy,
3790                 .flags = GENL_ADMIN_PERM,
3791         },
3792         {
3793                 .cmd = NL80211_CMD_DEL_INTERFACE,
3794                 .doit = nl80211_del_interface,
3795                 .policy = nl80211_policy,
3796                 .flags = GENL_ADMIN_PERM,
3797         },
3798         {
3799                 .cmd = NL80211_CMD_GET_KEY,
3800                 .doit = nl80211_get_key,
3801                 .policy = nl80211_policy,
3802                 .flags = GENL_ADMIN_PERM,
3803         },
3804         {
3805                 .cmd = NL80211_CMD_SET_KEY,
3806                 .doit = nl80211_set_key,
3807                 .policy = nl80211_policy,
3808                 .flags = GENL_ADMIN_PERM,
3809         },
3810         {
3811                 .cmd = NL80211_CMD_NEW_KEY,
3812                 .doit = nl80211_new_key,
3813                 .policy = nl80211_policy,
3814                 .flags = GENL_ADMIN_PERM,
3815         },
3816         {
3817                 .cmd = NL80211_CMD_DEL_KEY,
3818                 .doit = nl80211_del_key,
3819                 .policy = nl80211_policy,
3820                 .flags = GENL_ADMIN_PERM,
3821         },
3822         {
3823                 .cmd = NL80211_CMD_SET_BEACON,
3824                 .policy = nl80211_policy,
3825                 .flags = GENL_ADMIN_PERM,
3826                 .doit = nl80211_addset_beacon,
3827         },
3828         {
3829                 .cmd = NL80211_CMD_NEW_BEACON,
3830                 .policy = nl80211_policy,
3831                 .flags = GENL_ADMIN_PERM,
3832                 .doit = nl80211_addset_beacon,
3833         },
3834         {
3835                 .cmd = NL80211_CMD_DEL_BEACON,
3836                 .policy = nl80211_policy,
3837                 .flags = GENL_ADMIN_PERM,
3838                 .doit = nl80211_del_beacon,
3839         },
3840         {
3841                 .cmd = NL80211_CMD_GET_STATION,
3842                 .doit = nl80211_get_station,
3843                 .dumpit = nl80211_dump_station,
3844                 .policy = nl80211_policy,
3845         },
3846         {
3847                 .cmd = NL80211_CMD_SET_STATION,
3848                 .doit = nl80211_set_station,
3849                 .policy = nl80211_policy,
3850                 .flags = GENL_ADMIN_PERM,
3851         },
3852         {
3853                 .cmd = NL80211_CMD_NEW_STATION,
3854                 .doit = nl80211_new_station,
3855                 .policy = nl80211_policy,
3856                 .flags = GENL_ADMIN_PERM,
3857         },
3858         {
3859                 .cmd = NL80211_CMD_DEL_STATION,
3860                 .doit = nl80211_del_station,
3861                 .policy = nl80211_policy,
3862                 .flags = GENL_ADMIN_PERM,
3863         },
3864         {
3865                 .cmd = NL80211_CMD_GET_MPATH,
3866                 .doit = nl80211_get_mpath,
3867                 .dumpit = nl80211_dump_mpath,
3868                 .policy = nl80211_policy,
3869                 .flags = GENL_ADMIN_PERM,
3870         },
3871         {
3872                 .cmd = NL80211_CMD_SET_MPATH,
3873                 .doit = nl80211_set_mpath,
3874                 .policy = nl80211_policy,
3875                 .flags = GENL_ADMIN_PERM,
3876         },
3877         {
3878                 .cmd = NL80211_CMD_NEW_MPATH,
3879                 .doit = nl80211_new_mpath,
3880                 .policy = nl80211_policy,
3881                 .flags = GENL_ADMIN_PERM,
3882         },
3883         {
3884                 .cmd = NL80211_CMD_DEL_MPATH,
3885                 .doit = nl80211_del_mpath,
3886                 .policy = nl80211_policy,
3887                 .flags = GENL_ADMIN_PERM,
3888         },
3889         {
3890                 .cmd = NL80211_CMD_SET_BSS,
3891                 .doit = nl80211_set_bss,
3892                 .policy = nl80211_policy,
3893                 .flags = GENL_ADMIN_PERM,
3894         },
3895         {
3896                 .cmd = NL80211_CMD_GET_REG,
3897                 .doit = nl80211_get_reg,
3898                 .policy = nl80211_policy,
3899                 /* can be retrieved by unprivileged users */
3900         },
3901         {
3902                 .cmd = NL80211_CMD_SET_REG,
3903                 .doit = nl80211_set_reg,
3904                 .policy = nl80211_policy,
3905                 .flags = GENL_ADMIN_PERM,
3906         },
3907         {
3908                 .cmd = NL80211_CMD_REQ_SET_REG,
3909                 .doit = nl80211_req_set_reg,
3910                 .policy = nl80211_policy,
3911                 .flags = GENL_ADMIN_PERM,
3912         },
3913         {
3914                 .cmd = NL80211_CMD_GET_MESH_PARAMS,
3915                 .doit = nl80211_get_mesh_params,
3916                 .policy = nl80211_policy,
3917                 /* can be retrieved by unprivileged users */
3918         },
3919         {
3920                 .cmd = NL80211_CMD_SET_MESH_PARAMS,
3921                 .doit = nl80211_set_mesh_params,
3922                 .policy = nl80211_policy,
3923                 .flags = GENL_ADMIN_PERM,
3924         },
3925         {
3926                 .cmd = NL80211_CMD_TRIGGER_SCAN,
3927                 .doit = nl80211_trigger_scan,
3928                 .policy = nl80211_policy,
3929                 .flags = GENL_ADMIN_PERM,
3930         },
3931         {
3932                 .cmd = NL80211_CMD_GET_SCAN,
3933                 .policy = nl80211_policy,
3934                 .dumpit = nl80211_dump_scan,
3935         },
3936         {
3937                 .cmd = NL80211_CMD_AUTHENTICATE,
3938                 .doit = nl80211_authenticate,
3939                 .policy = nl80211_policy,
3940                 .flags = GENL_ADMIN_PERM,
3941         },
3942         {
3943                 .cmd = NL80211_CMD_ASSOCIATE,
3944                 .doit = nl80211_associate,
3945                 .policy = nl80211_policy,
3946                 .flags = GENL_ADMIN_PERM,
3947         },
3948         {
3949                 .cmd = NL80211_CMD_DEAUTHENTICATE,
3950                 .doit = nl80211_deauthenticate,
3951                 .policy = nl80211_policy,
3952                 .flags = GENL_ADMIN_PERM,
3953         },
3954         {
3955                 .cmd = NL80211_CMD_DISASSOCIATE,
3956                 .doit = nl80211_disassociate,
3957                 .policy = nl80211_policy,
3958                 .flags = GENL_ADMIN_PERM,
3959         },
3960         {
3961                 .cmd = NL80211_CMD_JOIN_IBSS,
3962                 .doit = nl80211_join_ibss,
3963                 .policy = nl80211_policy,
3964                 .flags = GENL_ADMIN_PERM,
3965         },
3966         {
3967                 .cmd = NL80211_CMD_LEAVE_IBSS,
3968                 .doit = nl80211_leave_ibss,
3969                 .policy = nl80211_policy,
3970                 .flags = GENL_ADMIN_PERM,
3971         },
3972 #ifdef CONFIG_NL80211_TESTMODE
3973         {
3974                 .cmd = NL80211_CMD_TESTMODE,
3975                 .doit = nl80211_testmode_do,
3976                 .policy = nl80211_policy,
3977                 .flags = GENL_ADMIN_PERM,
3978         },
3979 #endif
3980         {
3981                 .cmd = NL80211_CMD_CONNECT,
3982                 .doit = nl80211_connect,
3983                 .policy = nl80211_policy,
3984                 .flags = GENL_ADMIN_PERM,
3985         },
3986         {
3987                 .cmd = NL80211_CMD_DISCONNECT,
3988                 .doit = nl80211_disconnect,
3989                 .policy = nl80211_policy,
3990                 .flags = GENL_ADMIN_PERM,
3991         },
3992 };
3993 static struct genl_multicast_group nl80211_mlme_mcgrp = {
3994         .name = "mlme",
3995 };
3996
3997 /* multicast groups */
3998 static struct genl_multicast_group nl80211_config_mcgrp = {
3999         .name = "config",
4000 };
4001 static struct genl_multicast_group nl80211_scan_mcgrp = {
4002         .name = "scan",
4003 };
4004 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
4005         .name = "regulatory",
4006 };
4007
4008 /* notification functions */
4009
4010 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
4011 {
4012         struct sk_buff *msg;
4013
4014         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4015         if (!msg)
4016                 return;
4017
4018         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
4019                 nlmsg_free(msg);
4020                 return;
4021         }
4022
4023         genlmsg_multicast(msg, 0, nl80211_config_mcgrp.id, GFP_KERNEL);
4024 }
4025
4026 static int nl80211_add_scan_req(struct sk_buff *msg,
4027                                 struct cfg80211_registered_device *rdev)
4028 {
4029         struct cfg80211_scan_request *req = rdev->scan_req;
4030         struct nlattr *nest;
4031         int i;
4032
4033         ASSERT_RDEV_LOCK(rdev);
4034
4035         if (WARN_ON(!req))
4036                 return 0;
4037
4038         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
4039         if (!nest)
4040                 goto nla_put_failure;
4041         for (i = 0; i < req->n_ssids; i++)
4042                 NLA_PUT(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid);
4043         nla_nest_end(msg, nest);
4044
4045         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
4046         if (!nest)
4047                 goto nla_put_failure;
4048         for (i = 0; i < req->n_channels; i++)
4049                 NLA_PUT_U32(msg, i, req->channels[i]->center_freq);
4050         nla_nest_end(msg, nest);
4051
4052         if (req->ie)
4053                 NLA_PUT(msg, NL80211_ATTR_IE, req->ie_len, req->ie);
4054
4055         return 0;
4056  nla_put_failure:
4057         return -ENOBUFS;
4058 }
4059
4060 static int nl80211_send_scan_msg(struct sk_buff *msg,
4061                                  struct cfg80211_registered_device *rdev,
4062                                  struct net_device *netdev,
4063                                  u32 pid, u32 seq, int flags,
4064                                  u32 cmd)
4065 {
4066         void *hdr;
4067
4068         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
4069         if (!hdr)
4070                 return -1;
4071
4072         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4073         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4074
4075         /* ignore errors and send incomplete event anyway */
4076         nl80211_add_scan_req(msg, rdev);
4077
4078         return genlmsg_end(msg, hdr);
4079
4080  nla_put_failure:
4081         genlmsg_cancel(msg, hdr);
4082         return -EMSGSIZE;
4083 }
4084
4085 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
4086                              struct net_device *netdev)
4087 {
4088         struct sk_buff *msg;
4089
4090         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
4091         if (!msg)
4092                 return;
4093
4094         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
4095                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
4096                 nlmsg_free(msg);
4097                 return;
4098         }
4099
4100         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
4101 }
4102
4103 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
4104                             struct net_device *netdev)
4105 {
4106         struct sk_buff *msg;
4107
4108         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4109         if (!msg)
4110                 return;
4111
4112         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
4113                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
4114                 nlmsg_free(msg);
4115                 return;
4116         }
4117
4118         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
4119 }
4120
4121 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
4122                                struct net_device *netdev)
4123 {
4124         struct sk_buff *msg;
4125
4126         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4127         if (!msg)
4128                 return;
4129
4130         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
4131                                   NL80211_CMD_SCAN_ABORTED) < 0) {
4132                 nlmsg_free(msg);
4133                 return;
4134         }
4135
4136         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
4137 }
4138
4139 /*
4140  * This can happen on global regulatory changes or device specific settings
4141  * based on custom world regulatory domains.
4142  */
4143 void nl80211_send_reg_change_event(struct regulatory_request *request)
4144 {
4145         struct sk_buff *msg;
4146         void *hdr;
4147
4148         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4149         if (!msg)
4150                 return;
4151
4152         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
4153         if (!hdr) {
4154                 nlmsg_free(msg);
4155                 return;
4156         }
4157
4158         /* Userspace can always count this one always being set */
4159         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
4160
4161         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
4162                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
4163                            NL80211_REGDOM_TYPE_WORLD);
4164         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
4165                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
4166                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
4167         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
4168                  request->intersect)
4169                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
4170                            NL80211_REGDOM_TYPE_INTERSECTION);
4171         else {
4172                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
4173                            NL80211_REGDOM_TYPE_COUNTRY);
4174                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
4175         }
4176
4177         if (wiphy_idx_valid(request->wiphy_idx))
4178                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
4179
4180         if (genlmsg_end(msg, hdr) < 0) {
4181                 nlmsg_free(msg);
4182                 return;
4183         }
4184
4185         genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_KERNEL);
4186
4187         return;
4188
4189 nla_put_failure:
4190         genlmsg_cancel(msg, hdr);
4191         nlmsg_free(msg);
4192 }
4193
4194 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
4195                                     struct net_device *netdev,
4196                                     const u8 *buf, size_t len,
4197                                     enum nl80211_commands cmd, gfp_t gfp)
4198 {
4199         struct sk_buff *msg;
4200         void *hdr;
4201
4202         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
4203         if (!msg)
4204                 return;
4205
4206         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
4207         if (!hdr) {
4208                 nlmsg_free(msg);
4209                 return;
4210         }
4211
4212         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4213         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4214         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
4215
4216         if (genlmsg_end(msg, hdr) < 0) {
4217                 nlmsg_free(msg);
4218                 return;
4219         }
4220
4221         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
4222         return;
4223
4224  nla_put_failure:
4225         genlmsg_cancel(msg, hdr);
4226         nlmsg_free(msg);
4227 }
4228
4229 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
4230                           struct net_device *netdev, const u8 *buf,
4231                           size_t len, gfp_t gfp)
4232 {
4233         nl80211_send_mlme_event(rdev, netdev, buf, len,
4234                                 NL80211_CMD_AUTHENTICATE, gfp);
4235 }
4236
4237 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
4238                            struct net_device *netdev, const u8 *buf,
4239                            size_t len, gfp_t gfp)
4240 {
4241         nl80211_send_mlme_event(rdev, netdev, buf, len,
4242                                 NL80211_CMD_ASSOCIATE, gfp);
4243 }
4244
4245 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
4246                          struct net_device *netdev, const u8 *buf,
4247                          size_t len, gfp_t gfp)
4248 {
4249         nl80211_send_mlme_event(rdev, netdev, buf, len,
4250                                 NL80211_CMD_DEAUTHENTICATE, gfp);
4251 }
4252
4253 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
4254                            struct net_device *netdev, const u8 *buf,
4255                            size_t len, gfp_t gfp)
4256 {
4257         nl80211_send_mlme_event(rdev, netdev, buf, len,
4258                                 NL80211_CMD_DISASSOCIATE, gfp);
4259 }
4260
4261 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
4262                                       struct net_device *netdev, int cmd,
4263                                       const u8 *addr, gfp_t gfp)
4264 {
4265         struct sk_buff *msg;
4266         void *hdr;
4267
4268         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
4269         if (!msg)
4270                 return;
4271
4272         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
4273         if (!hdr) {
4274                 nlmsg_free(msg);
4275                 return;
4276         }
4277
4278         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4279         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4280         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
4281         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
4282
4283         if (genlmsg_end(msg, hdr) < 0) {
4284                 nlmsg_free(msg);
4285                 return;
4286         }
4287
4288         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
4289         return;
4290
4291  nla_put_failure:
4292         genlmsg_cancel(msg, hdr);
4293         nlmsg_free(msg);
4294 }
4295
4296 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
4297                                struct net_device *netdev, const u8 *addr,
4298                                gfp_t gfp)
4299 {
4300         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
4301                                   addr, gfp);
4302 }
4303
4304 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
4305                                 struct net_device *netdev, const u8 *addr,
4306                                 gfp_t gfp)
4307 {
4308         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
4309                                   addr, gfp);
4310 }
4311
4312 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
4313                                  struct net_device *netdev, const u8 *bssid,
4314                                  const u8 *req_ie, size_t req_ie_len,
4315                                  const u8 *resp_ie, size_t resp_ie_len,
4316                                  u16 status, gfp_t gfp)
4317 {
4318         struct sk_buff *msg;
4319         void *hdr;
4320
4321         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
4322         if (!msg)
4323                 return;
4324
4325         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
4326         if (!hdr) {
4327                 nlmsg_free(msg);
4328                 return;
4329         }
4330
4331         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4332         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4333         if (bssid)
4334                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
4335         NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status);
4336         if (req_ie)
4337                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
4338         if (resp_ie)
4339                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
4340
4341         if (genlmsg_end(msg, hdr) < 0) {
4342                 nlmsg_free(msg);
4343                 return;
4344         }
4345
4346         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
4347         return;
4348
4349  nla_put_failure:
4350         genlmsg_cancel(msg, hdr);
4351         nlmsg_free(msg);
4352
4353 }
4354
4355 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
4356                          struct net_device *netdev, const u8 *bssid,
4357                          const u8 *req_ie, size_t req_ie_len,
4358                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
4359 {
4360         struct sk_buff *msg;
4361         void *hdr;
4362
4363         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
4364         if (!msg)
4365                 return;
4366
4367         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
4368         if (!hdr) {
4369                 nlmsg_free(msg);
4370                 return;
4371         }
4372
4373         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4374         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4375         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
4376         if (req_ie)
4377                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
4378         if (resp_ie)
4379                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
4380
4381         if (genlmsg_end(msg, hdr) < 0) {
4382                 nlmsg_free(msg);
4383                 return;
4384         }
4385
4386         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
4387         return;
4388
4389  nla_put_failure:
4390         genlmsg_cancel(msg, hdr);
4391         nlmsg_free(msg);
4392
4393 }
4394
4395 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
4396                                struct net_device *netdev, u16 reason,
4397                                const u8 *ie, size_t ie_len, bool from_ap)
4398 {
4399         struct sk_buff *msg;
4400         void *hdr;
4401
4402         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
4403         if (!msg)
4404                 return;
4405
4406         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
4407         if (!hdr) {
4408                 nlmsg_free(msg);
4409                 return;
4410         }
4411
4412         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4413         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4414         if (from_ap && reason)
4415                 NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason);
4416         if (from_ap)
4417                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISCONNECTED_BY_AP);
4418         if (ie)
4419                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len, ie);
4420
4421         if (genlmsg_end(msg, hdr) < 0) {
4422                 nlmsg_free(msg);
4423                 return;
4424         }
4425
4426         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_KERNEL);
4427         return;
4428
4429  nla_put_failure:
4430         genlmsg_cancel(msg, hdr);
4431         nlmsg_free(msg);
4432
4433 }
4434
4435 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
4436                              struct net_device *netdev, const u8 *bssid,
4437                              gfp_t gfp)
4438 {
4439         struct sk_buff *msg;
4440         void *hdr;
4441
4442         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
4443         if (!msg)
4444                 return;
4445
4446         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
4447         if (!hdr) {
4448                 nlmsg_free(msg);
4449                 return;
4450         }
4451
4452         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4453         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4454         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
4455
4456         if (genlmsg_end(msg, hdr) < 0) {
4457                 nlmsg_free(msg);
4458                 return;
4459         }
4460
4461         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
4462         return;
4463
4464  nla_put_failure:
4465         genlmsg_cancel(msg, hdr);
4466         nlmsg_free(msg);
4467 }
4468
4469 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
4470                                  struct net_device *netdev, const u8 *addr,
4471                                  enum nl80211_key_type key_type, int key_id,
4472                                  const u8 *tsc, gfp_t gfp)
4473 {
4474         struct sk_buff *msg;
4475         void *hdr;
4476
4477         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
4478         if (!msg)
4479                 return;
4480
4481         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
4482         if (!hdr) {
4483                 nlmsg_free(msg);
4484                 return;
4485         }
4486
4487         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4488         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4489         if (addr)
4490                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
4491         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
4492         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
4493         if (tsc)
4494                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
4495
4496         if (genlmsg_end(msg, hdr) < 0) {
4497                 nlmsg_free(msg);
4498                 return;
4499         }
4500
4501         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
4502         return;
4503
4504  nla_put_failure:
4505         genlmsg_cancel(msg, hdr);
4506         nlmsg_free(msg);
4507 }
4508
4509 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
4510                                     struct ieee80211_channel *channel_before,
4511                                     struct ieee80211_channel *channel_after)
4512 {
4513         struct sk_buff *msg;
4514         void *hdr;
4515         struct nlattr *nl_freq;
4516
4517         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
4518         if (!msg)
4519                 return;
4520
4521         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
4522         if (!hdr) {
4523                 nlmsg_free(msg);
4524                 return;
4525         }
4526
4527         /*
4528          * Since we are applying the beacon hint to a wiphy we know its
4529          * wiphy_idx is valid
4530          */
4531         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
4532
4533         /* Before */
4534         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
4535         if (!nl_freq)
4536                 goto nla_put_failure;
4537         if (nl80211_msg_put_channel(msg, channel_before))
4538                 goto nla_put_failure;
4539         nla_nest_end(msg, nl_freq);
4540
4541         /* After */
4542         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
4543         if (!nl_freq)
4544                 goto nla_put_failure;
4545         if (nl80211_msg_put_channel(msg, channel_after))
4546                 goto nla_put_failure;
4547         nla_nest_end(msg, nl_freq);
4548
4549         if (genlmsg_end(msg, hdr) < 0) {
4550                 nlmsg_free(msg);
4551                 return;
4552         }
4553
4554         genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_ATOMIC);
4555
4556         return;
4557
4558 nla_put_failure:
4559         genlmsg_cancel(msg, hdr);
4560         nlmsg_free(msg);
4561 }
4562
4563 /* initialisation/exit functions */
4564
4565 int nl80211_init(void)
4566 {
4567         int err;
4568
4569         err = genl_register_family_with_ops(&nl80211_fam,
4570                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
4571         if (err)
4572                 return err;
4573
4574         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
4575         if (err)
4576                 goto err_out;
4577
4578         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
4579         if (err)
4580                 goto err_out;
4581
4582         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
4583         if (err)
4584                 goto err_out;
4585
4586         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
4587         if (err)
4588                 goto err_out;
4589
4590 #ifdef CONFIG_NL80211_TESTMODE
4591         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
4592         if (err)
4593                 goto err_out;
4594 #endif
4595
4596         return 0;
4597  err_out:
4598         genl_unregister_family(&nl80211_fam);
4599         return err;
4600 }
4601
4602 void nl80211_exit(void)
4603 {
4604         genl_unregister_family(&nl80211_fam);
4605 }