net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006, 2007 Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/list.h>
  11 #include <linux/if_ether.h>
  12 #include <linux/ieee80211.h>
  13 #include <linux/nl80211.h>
  14 #include <linux/rtnetlink.h>
  15 #include <linux/netlink.h>
  16 #include <linux/etherdevice.h>
  17 #include <net/genetlink.h>
  18 #include <net/cfg80211.h>
  19 #include "core.h"
  20 #include "nl80211.h"
  21 #include "reg.h"
  22
  23 /* the netlink family */
  24 static struct genl_family nl80211_fam = {
  25         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  26         .name = "nl80211",      /* have users key off the name instead */
  27         .hdrsize = 0,           /* no private header */
  28         .version = 1,           /* no particular meaning now */
  29         .maxattr = NL80211_ATTR_MAX,
  30 };
  31
  32 /* internal helper: get drv and dev */
  33 static int get_drv_dev_by_info_ifindex(struct nlattr **attrs,
  34                                        struct cfg80211_registered_device **drv,
  35                                        struct net_device **dev)
  36 {
  37         int ifindex;
  38
  39         if (!attrs[NL80211_ATTR_IFINDEX])
  40                 return -EINVAL;
  41
  42         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  43         *dev = dev_get_by_index(&init_net, ifindex);
  44         if (!*dev)
  45                 return -ENODEV;
  46
  47         *drv = cfg80211_get_dev_from_ifindex(ifindex);
  48         if (IS_ERR(*drv)) {
  49                 dev_put(*dev);
  50                 return PTR_ERR(*drv);
  51         }
  52
  53         return 0;
  54 }
  55
  56 /* policy for the attributes */
  57 static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
  58         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  59         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  60                                       .len = BUS_ID_SIZE-1 },
  61         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  62         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  63         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  64
  65         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  66         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  67         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  68
  69         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  70
  71         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  72                                     .len = WLAN_MAX_KEY_LEN },
  73         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  74         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  75         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
  76
  77         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
  78         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
  79         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
  80                                        .len = IEEE80211_MAX_DATA_LEN },
  81         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
  82                                        .len = IEEE80211_MAX_DATA_LEN },
  83         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
  84         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
  85         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
  86         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
  87                                                .len = NL80211_MAX_SUPP_RATES },
  88         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
  89         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
  90         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
  91         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
  92                                 .len = IEEE80211_MAX_MESH_ID_LEN },
  93         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
  94
  95         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
  96         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
  97
  98         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
  99         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 100         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 101         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 102                                            .len = NL80211_MAX_SUPP_RATES },
 103
 104         [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
 105
 106         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 107                                          .len = NL80211_HT_CAPABILITY_LEN },
 108
 109         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 110         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 111                               .len = IEEE80211_MAX_DATA_LEN },
 112         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 113         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 114
 115         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 116                                 .len = IEEE80211_MAX_SSID_LEN },
 117         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 118         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 119 };
 120
 121 /* IE validation */
 122 static bool is_valid_ie_attr(const struct nlattr *attr)
 123 {
 124         const u8 *pos;
 125         int len;
 126
 127         if (!attr)
 128                 return true;
 129
 130         pos = nla_data(attr);
 131         len = nla_len(attr);
 132
 133         while (len) {
 134                 u8 elemlen;
 135
 136                 if (len < 2)
 137                         return false;
 138                 len -= 2;
 139
 140                 elemlen = pos[1];
 141                 if (elemlen > len)
 142                         return false;
 143
 144                 len -= elemlen;
 145                 pos += 2 + elemlen;
 146         }
 147
 148         return true;
 149 }
 150
 151 /* message building helper */
 152 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 153                                    int flags, u8 cmd)
 154 {
 155         /* since there is no private header just add the generic one */
 156         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 157 }
 158
 159 /* netlink command implementations */
 160
 161 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 162                               struct cfg80211_registered_device *dev)
 163 {
 164         void *hdr;
 165         struct nlattr *nl_bands, *nl_band;
 166         struct nlattr *nl_freqs, *nl_freq;
 167         struct nlattr *nl_rates, *nl_rate;
 168         struct nlattr *nl_modes;
 169         struct nlattr *nl_cmds;
 170         enum ieee80211_band band;
 171         struct ieee80211_channel *chan;
 172         struct ieee80211_rate *rate;
 173         int i;
 174         u16 ifmodes = dev->wiphy.interface_modes;
 175
 176         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 177         if (!hdr)
 178                 return -1;
 179
 180         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 181         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 182         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 183                    dev->wiphy.max_scan_ssids);
 184         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 185                     dev->wiphy.max_scan_ie_len);
 186
 187         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
 188         if (!nl_modes)
 189                 goto nla_put_failure;
 190
 191         i = 0;
 192         while (ifmodes) {
 193                 if (ifmodes & 1)
 194                         NLA_PUT_FLAG(msg, i);
 195                 ifmodes >>= 1;
 196                 i++;
 197         }
 198
 199         nla_nest_end(msg, nl_modes);
 200
 201         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 202         if (!nl_bands)
 203                 goto nla_put_failure;
 204
 205         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 206                 if (!dev->wiphy.bands[band])
 207                         continue;
 208
 209                 nl_band = nla_nest_start(msg, band);
 210                 if (!nl_band)
 211                         goto nla_put_failure;
 212
 213                 /* add HT info */
 214                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 215                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 216                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 217                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 218                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 219                                 dev->wiphy.bands[band]->ht_cap.cap);
 220                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 221                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 222                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 223                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 224                 }
 225
 226                 /* add frequencies */
 227                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 228                 if (!nl_freqs)
 229                         goto nla_put_failure;
 230
 231                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 232                         nl_freq = nla_nest_start(msg, i);
 233                         if (!nl_freq)
 234                                 goto nla_put_failure;
 235
 236                         chan = &dev->wiphy.bands[band]->channels[i];
 237                         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 238                                     chan->center_freq);
 239
 240                         if (chan->flags & IEEE80211_CHAN_DISABLED)
 241                                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 242                         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 243                                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 244                         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 245                                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 246                         if (chan->flags & IEEE80211_CHAN_RADAR)
 247                                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 248
 249                         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 250                                     DBM_TO_MBM(chan->max_power));
 251
 252                         nla_nest_end(msg, nl_freq);
 253                 }
 254
 255                 nla_nest_end(msg, nl_freqs);
 256
 257                 /* add bitrates */
 258                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 259                 if (!nl_rates)
 260                         goto nla_put_failure;
 261
 262                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 263                         nl_rate = nla_nest_start(msg, i);
 264                         if (!nl_rate)
 265                                 goto nla_put_failure;
 266
 267                         rate = &dev->wiphy.bands[band]->bitrates[i];
 268                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 269                                     rate->bitrate);
 270                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 271                                 NLA_PUT_FLAG(msg,
 272                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 273
 274                         nla_nest_end(msg, nl_rate);
 275                 }
 276
 277                 nla_nest_end(msg, nl_rates);
 278
 279                 nla_nest_end(msg, nl_band);
 280         }
 281         nla_nest_end(msg, nl_bands);
 282
 283         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 284         if (!nl_cmds)
 285                 goto nla_put_failure;
 286
 287         i = 0;
 288 #define CMD(op, n)                                              \
 289          do {                                                   \
 290                 if (dev->ops->op) {                             \
 291                         i++;                                    \
 292                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 293                 }                                               \
 294         } while (0)
 295
 296         CMD(add_virtual_intf, NEW_INTERFACE);
 297         CMD(change_virtual_intf, SET_INTERFACE);
 298         CMD(add_key, NEW_KEY);
 299         CMD(add_beacon, NEW_BEACON);
 300         CMD(add_station, NEW_STATION);
 301         CMD(add_mpath, NEW_MPATH);
 302         CMD(set_mesh_params, SET_MESH_PARAMS);
 303         CMD(change_bss, SET_BSS);
 304         CMD(auth, AUTHENTICATE);
 305         CMD(assoc, ASSOCIATE);
 306         CMD(deauth, DEAUTHENTICATE);
 307         CMD(disassoc, DISASSOCIATE);
 308
 309 #undef CMD
 310         nla_nest_end(msg, nl_cmds);
 311
 312         return genlmsg_end(msg, hdr);
 313
 314  nla_put_failure:
 315         genlmsg_cancel(msg, hdr);
 316         return -EMSGSIZE;
 317 }
 318
 319 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 320 {
 321         int idx = 0;
 322         int start = cb->args[0];
 323         struct cfg80211_registered_device *dev;
 324
 325         mutex_lock(&cfg80211_mutex);
 326         list_for_each_entry(dev, &cfg80211_drv_list, list) {
 327                 if (++idx <= start)
 328                         continue;
 329                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
 330                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
 331                                        dev) < 0) {
 332                         idx--;
 333                         break;
 334                 }
 335         }
 336         mutex_unlock(&cfg80211_mutex);
 337
 338         cb->args[0] = idx;
 339
 340         return skb->len;
 341 }
 342
 343 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 344 {
 345         struct sk_buff *msg;
 346         struct cfg80211_registered_device *dev;
 347
 348         dev = cfg80211_get_dev_from_info(info);
 349         if (IS_ERR(dev))
 350                 return PTR_ERR(dev);
 351
 352         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 353         if (!msg)
 354                 goto out_err;
 355
 356         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
 357                 goto out_free;
 358
 359         cfg80211_put_dev(dev);
 360
 361         return genlmsg_unicast(msg, info->snd_pid);
 362
 363  out_free:
 364         nlmsg_free(msg);
 365  out_err:
 366         cfg80211_put_dev(dev);
 367         return -ENOBUFS;
 368 }
 369
 370 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 371         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
 372         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
 373         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
 374         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
 375         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
 376 };
 377
 378 static int parse_txq_params(struct nlattr *tb[],
 379                             struct ieee80211_txq_params *txq_params)
 380 {
 381         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 382             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 383             !tb[NL80211_TXQ_ATTR_AIFS])
 384                 return -EINVAL;
 385
 386         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
 387         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 388         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 389         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 390         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 391
 392         return 0;
 393 }
 394
 395 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 396 {
 397         struct cfg80211_registered_device *rdev;
 398         int result = 0, rem_txq_params = 0;
 399         struct nlattr *nl_txq_params;
 400
 401         rtnl_lock();
 402
 403         mutex_lock(&cfg80211_mutex);
 404
 405         rdev = __cfg80211_drv_from_info(info);
 406         if (IS_ERR(rdev)) {
 407                 result = PTR_ERR(rdev);
 408                 goto unlock;
 409         }
 410
 411         mutex_lock(&rdev->mtx);
 412
 413         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
 414                 result = cfg80211_dev_rename(
 415                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 416
 417         mutex_unlock(&cfg80211_mutex);
 418
 419         if (result)
 420                 goto bad_res;
 421
 422         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
 423                 struct ieee80211_txq_params txq_params;
 424                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
 425
 426                 if (!rdev->ops->set_txq_params) {
 427                         result = -EOPNOTSUPP;
 428                         goto bad_res;
 429                 }
 430
 431                 nla_for_each_nested(nl_txq_params,
 432                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
 433                                     rem_txq_params) {
 434                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
 435                                   nla_data(nl_txq_params),
 436                                   nla_len(nl_txq_params),
 437                                   txq_params_policy);
 438                         result = parse_txq_params(tb, &txq_params);
 439                         if (result)
 440                                 goto bad_res;
 441
 442                         result = rdev->ops->set_txq_params(&rdev->wiphy,
 443                                                            &txq_params);
 444                         if (result)
 445                                 goto bad_res;
 446                 }
 447         }
 448
 449         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
 450                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 451                 struct ieee80211_channel *chan;
 452                 struct ieee80211_sta_ht_cap *ht_cap;
 453                 u32 freq, sec_freq;
 454
 455                 if (!rdev->ops->set_channel) {
 456                         result = -EOPNOTSUPP;
 457                         goto bad_res;
 458                 }
 459
 460                 result = -EINVAL;
 461
 462                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 463                         channel_type = nla_get_u32(info->attrs[
 464                                            NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 465                         if (channel_type != NL80211_CHAN_NO_HT &&
 466                             channel_type != NL80211_CHAN_HT20 &&
 467                             channel_type != NL80211_CHAN_HT40PLUS &&
 468                             channel_type != NL80211_CHAN_HT40MINUS)
 469                                 goto bad_res;
 470                 }
 471
 472                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 473                 chan = ieee80211_get_channel(&rdev->wiphy, freq);
 474
 475                 /* Primary channel not allowed */
 476                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 477                         goto bad_res;
 478
 479                 if (channel_type == NL80211_CHAN_HT40MINUS)
 480                         sec_freq = freq - 20;
 481                 else if (channel_type == NL80211_CHAN_HT40PLUS)
 482                         sec_freq = freq + 20;
 483                 else
 484                         sec_freq = 0;
 485
 486                 ht_cap = &rdev->wiphy.bands[chan->band]->ht_cap;
 487
 488                 /* no HT capabilities */
 489                 if (channel_type != NL80211_CHAN_NO_HT &&
 490                     !ht_cap->ht_supported)
 491                         goto bad_res;
 492
 493                 if (sec_freq) {
 494                         struct ieee80211_channel *schan;
 495
 496                         /* no 40 MHz capabilities */
 497                         if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
 498                             (ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT))
 499                                 goto bad_res;
 500
 501                         schan = ieee80211_get_channel(&rdev->wiphy, sec_freq);
 502
 503                         /* Secondary channel not allowed */
 504                         if (!schan || schan->flags & IEEE80211_CHAN_DISABLED)
 505                                 goto bad_res;
 506                 }
 507
 508                 result = rdev->ops->set_channel(&rdev->wiphy, chan,
 509                                                 channel_type);
 510                 if (result)
 511                         goto bad_res;
 512         }
 513
 514
 515  bad_res:
 516         mutex_unlock(&rdev->mtx);
 517  unlock:
 518         rtnl_unlock();
 519         return result;
 520 }
 521
 522
 523 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 524                               struct net_device *dev)
 525 {
 526         void *hdr;
 527
 528         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
 529         if (!hdr)
 530                 return -1;
 531
 532         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 533         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
 534         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
 535         return genlmsg_end(msg, hdr);
 536
 537  nla_put_failure:
 538         genlmsg_cancel(msg, hdr);
 539         return -EMSGSIZE;
 540 }
 541
 542 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
 543 {
 544         int wp_idx = 0;
 545         int if_idx = 0;
 546         int wp_start = cb->args[0];
 547         int if_start = cb->args[1];
 548         struct cfg80211_registered_device *dev;
 549         struct wireless_dev *wdev;
 550
 551         mutex_lock(&cfg80211_mutex);
 552         list_for_each_entry(dev, &cfg80211_drv_list, list) {
 553                 if (wp_idx < wp_start) {
 554                         wp_idx++;
 555                         continue;
 556                 }
 557                 if_idx = 0;
 558
 559                 mutex_lock(&dev->devlist_mtx);
 560                 list_for_each_entry(wdev, &dev->netdev_list, list) {
 561                         if (if_idx < if_start) {
 562                                 if_idx++;
 563                                 continue;
 564                         }
 565                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
 566                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
 567                                                wdev->netdev) < 0) {
 568                                 mutex_unlock(&dev->devlist_mtx);
 569                                 goto out;
 570                         }
 571                         if_idx++;
 572                 }
 573                 mutex_unlock(&dev->devlist_mtx);
 574
 575                 wp_idx++;
 576         }
 577  out:
 578         mutex_unlock(&cfg80211_mutex);
 579
 580         cb->args[0] = wp_idx;
 581         cb->args[1] = if_idx;
 582
 583         return skb->len;
 584 }
 585
 586 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
 587 {
 588         struct sk_buff *msg;
 589         struct cfg80211_registered_device *dev;
 590         struct net_device *netdev;
 591         int err;
 592
 593         err = get_drv_dev_by_info_ifindex(info->attrs, &dev, &netdev);
 594         if (err)
 595                 return err;
 596
 597         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 598         if (!msg)
 599                 goto out_err;
 600
 601         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0, netdev) < 0)
 602                 goto out_free;
 603
 604         dev_put(netdev);
 605         cfg80211_put_dev(dev);
 606
 607         return genlmsg_unicast(msg, info->snd_pid);
 608
 609  out_free:
 610         nlmsg_free(msg);
 611  out_err:
 612         dev_put(netdev);
 613         cfg80211_put_dev(dev);
 614         return -ENOBUFS;
 615 }
 616
 617 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
 618         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
 619         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
 620         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
 621         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
 622         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
 623 };
 624
 625 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
 626 {
 627         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
 628         int flag;
 629
 630         *mntrflags = 0;
 631
 632         if (!nla)
 633                 return -EINVAL;
 634
 635         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
 636                              nla, mntr_flags_policy))
 637                 return -EINVAL;
 638
 639         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
 640                 if (flags[flag])
 641                         *mntrflags |= (1<<flag);
 642
 643         return 0;
 644 }
 645
 646 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 647 {
 648         struct cfg80211_registered_device *drv;
 649         struct vif_params params;
 650         int err, ifindex;
 651         enum nl80211_iftype type;
 652         struct net_device *dev;
 653         u32 _flags, *flags = NULL;
 654         bool change = false;
 655
 656         memset(&params, 0, sizeof(params));
 657
 658         rtnl_lock();
 659
 660         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 661         if (err)
 662                 goto unlock_rtnl;
 663
 664         ifindex = dev->ifindex;
 665         type = dev->ieee80211_ptr->iftype;
 666         dev_put(dev);
 667
 668         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 669                 enum nl80211_iftype ntype;
 670
 671                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 672                 if (type != ntype)
 673                         change = true;
 674                 type = ntype;
 675                 if (type > NL80211_IFTYPE_MAX) {
 676                         err = -EINVAL;
 677                         goto unlock;
 678                 }
 679         }
 680
 681         if (!drv->ops->change_virtual_intf ||
 682             !(drv->wiphy.interface_modes & (1 << type))) {
 683                 err = -EOPNOTSUPP;
 684                 goto unlock;
 685         }
 686
 687         if (info->attrs[NL80211_ATTR_MESH_ID]) {
 688                 if (type != NL80211_IFTYPE_MESH_POINT) {
 689                         err = -EINVAL;
 690                         goto unlock;
 691                 }
 692                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 693                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 694                 change = true;
 695         }
 696
 697         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
 698                 if (type != NL80211_IFTYPE_MONITOR) {
 699                         err = -EINVAL;
 700                         goto unlock;
 701                 }
 702                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
 703                                           &_flags);
 704                 if (err)
 705                         goto unlock;
 706
 707                 flags = &_flags;
 708                 change = true;
 709         }
 710
 711         if (change)
 712                 err = drv->ops->change_virtual_intf(&drv->wiphy, ifindex,
 713                                                     type, flags, &params);
 714         else
 715                 err = 0;
 716
 717         dev = __dev_get_by_index(&init_net, ifindex);
 718         WARN_ON(!dev || (!err && dev->ieee80211_ptr->iftype != type));
 719
 720  unlock:
 721         cfg80211_put_dev(drv);
 722  unlock_rtnl:
 723         rtnl_unlock();
 724         return err;
 725 }
 726
 727 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
 728 {
 729         struct cfg80211_registered_device *drv;
 730         struct vif_params params;
 731         int err;
 732         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
 733         u32 flags;
 734
 735         memset(&params, 0, sizeof(params));
 736
 737         if (!info->attrs[NL80211_ATTR_IFNAME])
 738                 return -EINVAL;
 739
 740         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 741                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 742                 if (type > NL80211_IFTYPE_MAX)
 743                         return -EINVAL;
 744         }
 745
 746         rtnl_lock();
 747
 748         drv = cfg80211_get_dev_from_info(info);
 749         if (IS_ERR(drv)) {
 750                 err = PTR_ERR(drv);
 751                 goto unlock_rtnl;
 752         }
 753
 754         if (!drv->ops->add_virtual_intf ||
 755             !(drv->wiphy.interface_modes & (1 << type))) {
 756                 err = -EOPNOTSUPP;
 757                 goto unlock;
 758         }
 759
 760         if (type == NL80211_IFTYPE_MESH_POINT &&
 761             info->attrs[NL80211_ATTR_MESH_ID]) {
 762                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 763                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 764         }
 765
 766         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
 767                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
 768                                   &flags);
 769         err = drv->ops->add_virtual_intf(&drv->wiphy,
 770                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
 771                 type, err ? NULL : &flags, &params);
 772
 773  unlock:
 774         cfg80211_put_dev(drv);
 775  unlock_rtnl:
 776         rtnl_unlock();
 777         return err;
 778 }
 779
 780 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
 781 {
 782         struct cfg80211_registered_device *drv;
 783         int ifindex, err;
 784         struct net_device *dev;
 785
 786         rtnl_lock();
 787
 788         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 789         if (err)
 790                 goto unlock_rtnl;
 791         ifindex = dev->ifindex;
 792         dev_put(dev);
 793
 794         if (!drv->ops->del_virtual_intf) {
 795                 err = -EOPNOTSUPP;
 796                 goto out;
 797         }
 798
 799         err = drv->ops->del_virtual_intf(&drv->wiphy, ifindex);
 800
 801  out:
 802         cfg80211_put_dev(drv);
 803  unlock_rtnl:
 804         rtnl_unlock();
 805         return err;
 806 }
 807
 808 struct get_key_cookie {
 809         struct sk_buff *msg;
 810         int error;
 811 };
 812
 813 static void get_key_callback(void *c, struct key_params *params)
 814 {
 815         struct get_key_cookie *cookie = c;
 816
 817         if (params->key)
 818                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
 819                         params->key_len, params->key);
 820
 821         if (params->seq)
 822                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
 823                         params->seq_len, params->seq);
 824
 825         if (params->cipher)
 826                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
 827                             params->cipher);
 828
 829         return;
 830  nla_put_failure:
 831         cookie->error = 1;
 832 }
 833
 834 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
 835 {
 836         struct cfg80211_registered_device *drv;
 837         int err;
 838         struct net_device *dev;
 839         u8 key_idx = 0;
 840         u8 *mac_addr = NULL;
 841         struct get_key_cookie cookie = {
 842                 .error = 0,
 843         };
 844         void *hdr;
 845         struct sk_buff *msg;
 846
 847         if (info->attrs[NL80211_ATTR_KEY_IDX])
 848                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 849
 850         if (key_idx > 5)
 851                 return -EINVAL;
 852
 853         if (info->attrs[NL80211_ATTR_MAC])
 854                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 855
 856         rtnl_lock();
 857
 858         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 859         if (err)
 860                 goto unlock_rtnl;
 861
 862         if (!drv->ops->get_key) {
 863                 err = -EOPNOTSUPP;
 864                 goto out;
 865         }
 866
 867         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 868         if (!msg) {
 869                 err = -ENOMEM;
 870                 goto out;
 871         }
 872
 873         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
 874                              NL80211_CMD_NEW_KEY);
 875
 876         if (IS_ERR(hdr)) {
 877                 err = PTR_ERR(hdr);
 878                 goto out;
 879         }
 880
 881         cookie.msg = msg;
 882
 883         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 884         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
 885         if (mac_addr)
 886                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
 887
 888         err = drv->ops->get_key(&drv->wiphy, dev, key_idx, mac_addr,
 889                                 &cookie, get_key_callback);
 890
 891         if (err)
 892                 goto out;
 893
 894         if (cookie.error)
 895                 goto nla_put_failure;
 896
 897         genlmsg_end(msg, hdr);
 898         err = genlmsg_unicast(msg, info->snd_pid);
 899         goto out;
 900
 901  nla_put_failure:
 902         err = -ENOBUFS;
 903         nlmsg_free(msg);
 904  out:
 905         cfg80211_put_dev(drv);
 906         dev_put(dev);
 907  unlock_rtnl:
 908         rtnl_unlock();
 909
 910         return err;
 911 }
 912
 913 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
 914 {
 915         struct cfg80211_registered_device *drv;
 916         int err;
 917         struct net_device *dev;
 918         u8 key_idx;
 919         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
 920                     u8 key_index);
 921
 922         if (!info->attrs[NL80211_ATTR_KEY_IDX])
 923                 return -EINVAL;
 924
 925         key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 926
 927         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]) {
 928                 if (key_idx < 4 || key_idx > 5)
 929                         return -EINVAL;
 930         } else if (key_idx > 3)
 931                 return -EINVAL;
 932
 933         /* currently only support setting default key */
 934         if (!info->attrs[NL80211_ATTR_KEY_DEFAULT] &&
 935             !info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT])
 936                 return -EINVAL;
 937
 938         rtnl_lock();
 939
 940         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 941         if (err)
 942                 goto unlock_rtnl;
 943
 944         if (info->attrs[NL80211_ATTR_KEY_DEFAULT])
 945                 func = drv->ops->set_default_key;
 946         else
 947                 func = drv->ops->set_default_mgmt_key;
 948
 949         if (!func) {
 950                 err = -EOPNOTSUPP;
 951                 goto out;
 952         }
 953
 954         err = func(&drv->wiphy, dev, key_idx);
 955
 956  out:
 957         cfg80211_put_dev(drv);
 958         dev_put(dev);
 959
 960  unlock_rtnl:
 961         rtnl_unlock();
 962
 963         return err;
 964 }
 965
 966 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
 967 {
 968         struct cfg80211_registered_device *drv;
 969         int err;
 970         struct net_device *dev;
 971         struct key_params params;
 972         u8 key_idx = 0;
 973         u8 *mac_addr = NULL;
 974
 975         memset(&params, 0, sizeof(params));
 976
 977         if (!info->attrs[NL80211_ATTR_KEY_CIPHER])
 978                 return -EINVAL;
 979
 980         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 981                 params.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 982                 params.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 983         }
 984
 985         if (info->attrs[NL80211_ATTR_KEY_IDX])
 986                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 987
 988         params.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 989
 990         if (info->attrs[NL80211_ATTR_MAC])
 991                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 992
 993         if (key_idx > 5)
 994                 return -EINVAL;
 995
 996         /*
 997          * Disallow pairwise keys with non-zero index unless it's WEP
 998          * (because current deployments use pairwise WEP keys with
 999          * non-zero indizes but 802.11i clearly specifies to use zero)
1000          */
1001         if (mac_addr && key_idx &&
1002             params.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1003             params.cipher != WLAN_CIPHER_SUITE_WEP104)
1004                 return -EINVAL;
1005
1006         /* TODO: add definitions for the lengths to linux/ieee80211.h */
1007         switch (params.cipher) {
1008         case WLAN_CIPHER_SUITE_WEP40:
1009                 if (params.key_len != 5)
1010                         return -EINVAL;
1011                 break;
1012         case WLAN_CIPHER_SUITE_TKIP:
1013                 if (params.key_len != 32)
1014                         return -EINVAL;
1015                 break;
1016         case WLAN_CIPHER_SUITE_CCMP:
1017                 if (params.key_len != 16)
1018                         return -EINVAL;
1019                 break;
1020         case WLAN_CIPHER_SUITE_WEP104:
1021                 if (params.key_len != 13)
1022                         return -EINVAL;
1023                 break;
1024         case WLAN_CIPHER_SUITE_AES_CMAC:
1025                 if (params.key_len != 16)
1026                         return -EINVAL;
1027                 break;
1028         default:
1029                 return -EINVAL;
1030         }
1031
1032         rtnl_lock();
1033
1034         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1035         if (err)
1036                 goto unlock_rtnl;
1037
1038         if (!drv->ops->add_key) {
1039                 err = -EOPNOTSUPP;
1040                 goto out;
1041         }
1042
1043         err = drv->ops->add_key(&drv->wiphy, dev, key_idx, mac_addr, &params);
1044
1045  out:
1046         cfg80211_put_dev(drv);
1047         dev_put(dev);
1048  unlock_rtnl:
1049         rtnl_unlock();
1050
1051         return err;
1052 }
1053
1054 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1055 {
1056         struct cfg80211_registered_device *drv;
1057         int err;
1058         struct net_device *dev;
1059         u8 key_idx = 0;
1060         u8 *mac_addr = NULL;
1061
1062         if (info->attrs[NL80211_ATTR_KEY_IDX])
1063                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1064
1065         if (key_idx > 5)
1066                 return -EINVAL;
1067
1068         if (info->attrs[NL80211_ATTR_MAC])
1069                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1070
1071         rtnl_lock();
1072
1073         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1074         if (err)
1075                 goto unlock_rtnl;
1076
1077         if (!drv->ops->del_key) {
1078                 err = -EOPNOTSUPP;
1079                 goto out;
1080         }
1081
1082         err = drv->ops->del_key(&drv->wiphy, dev, key_idx, mac_addr);
1083
1084  out:
1085         cfg80211_put_dev(drv);
1086         dev_put(dev);
1087
1088  unlock_rtnl:
1089         rtnl_unlock();
1090
1091         return err;
1092 }
1093
1094 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1095 {
1096         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1097                     struct beacon_parameters *info);
1098         struct cfg80211_registered_device *drv;
1099         int err;
1100         struct net_device *dev;
1101         struct beacon_parameters params;
1102         int haveinfo = 0;
1103
1104         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
1105                 return -EINVAL;
1106
1107         rtnl_lock();
1108
1109         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1110         if (err)
1111                 goto unlock_rtnl;
1112
1113         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1114                 err = -EOPNOTSUPP;
1115                 goto out;
1116         }
1117
1118         switch (info->genlhdr->cmd) {
1119         case NL80211_CMD_NEW_BEACON:
1120                 /* these are required for NEW_BEACON */
1121                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1122                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1123                     !info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1124                         err = -EINVAL;
1125                         goto out;
1126                 }
1127
1128                 call = drv->ops->add_beacon;
1129                 break;
1130         case NL80211_CMD_SET_BEACON:
1131                 call = drv->ops->set_beacon;
1132                 break;
1133         default:
1134                 WARN_ON(1);
1135                 err = -EOPNOTSUPP;
1136                 goto out;
1137         }
1138
1139         if (!call) {
1140                 err = -EOPNOTSUPP;
1141                 goto out;
1142         }
1143
1144         memset(&params, 0, sizeof(params));
1145
1146         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1147                 params.interval =
1148                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1149                 haveinfo = 1;
1150         }
1151
1152         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1153                 params.dtim_period =
1154                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1155                 haveinfo = 1;
1156         }
1157
1158         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1159                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1160                 params.head_len =
1161                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1162                 haveinfo = 1;
1163         }
1164
1165         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1166                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1167                 params.tail_len =
1168                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1169                 haveinfo = 1;
1170         }
1171
1172         if (!haveinfo) {
1173                 err = -EINVAL;
1174                 goto out;
1175         }
1176
1177         err = call(&drv->wiphy, dev, &params);
1178
1179  out:
1180         cfg80211_put_dev(drv);
1181         dev_put(dev);
1182  unlock_rtnl:
1183         rtnl_unlock();
1184
1185         return err;
1186 }
1187
1188 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1189 {
1190         struct cfg80211_registered_device *drv;
1191         int err;
1192         struct net_device *dev;
1193
1194         rtnl_lock();
1195
1196         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1197         if (err)
1198                 goto unlock_rtnl;
1199
1200         if (!drv->ops->del_beacon) {
1201                 err = -EOPNOTSUPP;
1202                 goto out;
1203         }
1204
1205         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1206                 err = -EOPNOTSUPP;
1207                 goto out;
1208         }
1209         err = drv->ops->del_beacon(&drv->wiphy, dev);
1210
1211  out:
1212         cfg80211_put_dev(drv);
1213         dev_put(dev);
1214  unlock_rtnl:
1215         rtnl_unlock();
1216
1217         return err;
1218 }
1219
1220 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1221         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1222         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1223         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1224 };
1225
1226 static int parse_station_flags(struct nlattr *nla, u32 *staflags)
1227 {
1228         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1229         int flag;
1230
1231         *staflags = 0;
1232
1233         if (!nla)
1234                 return 0;
1235
1236         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1237                              nla, sta_flags_policy))
1238                 return -EINVAL;
1239
1240         *staflags = STATION_FLAG_CHANGED;
1241
1242         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1243                 if (flags[flag])
1244                         *staflags |= (1<<flag);
1245
1246         return 0;
1247 }
1248
1249 static u16 nl80211_calculate_bitrate(struct rate_info *rate)
1250 {
1251         int modulation, streams, bitrate;
1252
1253         if (!(rate->flags & RATE_INFO_FLAGS_MCS))
1254                 return rate->legacy;
1255
1256         /* the formula below does only work for MCS values smaller than 32 */
1257         if (rate->mcs >= 32)
1258                 return 0;
1259
1260         modulation = rate->mcs & 7;
1261         streams = (rate->mcs >> 3) + 1;
1262
1263         bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
1264                         13500000 : 6500000;
1265
1266         if (modulation < 4)
1267                 bitrate *= (modulation + 1);
1268         else if (modulation == 4)
1269                 bitrate *= (modulation + 2);
1270         else
1271                 bitrate *= (modulation + 3);
1272
1273         bitrate *= streams;
1274
1275         if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
1276                 bitrate = (bitrate / 9) * 10;
1277
1278         /* do NOT round down here */
1279         return (bitrate + 50000) / 100000;
1280 }
1281
1282 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1283                                 int flags, struct net_device *dev,
1284                                 u8 *mac_addr, struct station_info *sinfo)
1285 {
1286         void *hdr;
1287         struct nlattr *sinfoattr, *txrate;
1288         u16 bitrate;
1289
1290         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1291         if (!hdr)
1292                 return -1;
1293
1294         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1295         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1296
1297         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1298         if (!sinfoattr)
1299                 goto nla_put_failure;
1300         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1301                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1302                             sinfo->inactive_time);
1303         if (sinfo->filled & STATION_INFO_RX_BYTES)
1304                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1305                             sinfo->rx_bytes);
1306         if (sinfo->filled & STATION_INFO_TX_BYTES)
1307                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1308                             sinfo->tx_bytes);
1309         if (sinfo->filled & STATION_INFO_LLID)
1310                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1311                             sinfo->llid);
1312         if (sinfo->filled & STATION_INFO_PLID)
1313                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1314                             sinfo->plid);
1315         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1316                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1317                             sinfo->plink_state);
1318         if (sinfo->filled & STATION_INFO_SIGNAL)
1319                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1320                            sinfo->signal);
1321         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1322                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1323                 if (!txrate)
1324                         goto nla_put_failure;
1325
1326                 /* nl80211_calculate_bitrate will return 0 for mcs >= 32 */
1327                 bitrate = nl80211_calculate_bitrate(&sinfo->txrate);
1328                 if (bitrate > 0)
1329                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1330
1331                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1332                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1333                                     sinfo->txrate.mcs);
1334                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1335                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1336                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1337                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1338
1339                 nla_nest_end(msg, txrate);
1340         }
1341         if (sinfo->filled & STATION_INFO_RX_PACKETS)
1342                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
1343                             sinfo->rx_packets);
1344         if (sinfo->filled & STATION_INFO_TX_PACKETS)
1345                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
1346                             sinfo->tx_packets);
1347         nla_nest_end(msg, sinfoattr);
1348
1349         return genlmsg_end(msg, hdr);
1350
1351  nla_put_failure:
1352         genlmsg_cancel(msg, hdr);
1353         return -EMSGSIZE;
1354 }
1355
1356 static int nl80211_dump_station(struct sk_buff *skb,
1357                                 struct netlink_callback *cb)
1358 {
1359         struct station_info sinfo;
1360         struct cfg80211_registered_device *dev;
1361         struct net_device *netdev;
1362         u8 mac_addr[ETH_ALEN];
1363         int ifidx = cb->args[0];
1364         int sta_idx = cb->args[1];
1365         int err;
1366
1367         if (!ifidx) {
1368                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1369                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1370                                   nl80211_policy);
1371                 if (err)
1372                         return err;
1373
1374                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1375                         return -EINVAL;
1376
1377                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1378                 if (!ifidx)
1379                         return -EINVAL;
1380         }
1381
1382         rtnl_lock();
1383
1384         netdev = __dev_get_by_index(&init_net, ifidx);
1385         if (!netdev) {
1386                 err = -ENODEV;
1387                 goto out_rtnl;
1388         }
1389
1390         dev = cfg80211_get_dev_from_ifindex(ifidx);
1391         if (IS_ERR(dev)) {
1392                 err = PTR_ERR(dev);
1393                 goto out_rtnl;
1394         }
1395
1396         if (!dev->ops->dump_station) {
1397                 err = -EOPNOTSUPP;
1398                 goto out_err;
1399         }
1400
1401         while (1) {
1402                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1403                                              mac_addr, &sinfo);
1404                 if (err == -ENOENT)
1405                         break;
1406                 if (err)
1407                         goto out_err;
1408
1409                 if (nl80211_send_station(skb,
1410                                 NETLINK_CB(cb->skb).pid,
1411                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
1412                                 netdev, mac_addr,
1413                                 &sinfo) < 0)
1414                         goto out;
1415
1416                 sta_idx++;
1417         }
1418
1419
1420  out:
1421         cb->args[1] = sta_idx;
1422         err = skb->len;
1423  out_err:
1424         cfg80211_put_dev(dev);
1425  out_rtnl:
1426         rtnl_unlock();
1427
1428         return err;
1429 }
1430
1431 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1432 {
1433         struct cfg80211_registered_device *drv;
1434         int err;
1435         struct net_device *dev;
1436         struct station_info sinfo;
1437         struct sk_buff *msg;
1438         u8 *mac_addr = NULL;
1439
1440         memset(&sinfo, 0, sizeof(sinfo));
1441
1442         if (!info->attrs[NL80211_ATTR_MAC])
1443                 return -EINVAL;
1444
1445         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1446
1447         rtnl_lock();
1448
1449         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1450         if (err)
1451                 goto out_rtnl;
1452
1453         if (!drv->ops->get_station) {
1454                 err = -EOPNOTSUPP;
1455                 goto out;
1456         }
1457
1458         err = drv->ops->get_station(&drv->wiphy, dev, mac_addr, &sinfo);
1459         if (err)
1460                 goto out;
1461
1462         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1463         if (!msg)
1464                 goto out;
1465
1466         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1467                                  dev, mac_addr, &sinfo) < 0)
1468                 goto out_free;
1469
1470         err = genlmsg_unicast(msg, info->snd_pid);
1471         goto out;
1472
1473  out_free:
1474         nlmsg_free(msg);
1475  out:
1476         cfg80211_put_dev(drv);
1477         dev_put(dev);
1478  out_rtnl:
1479         rtnl_unlock();
1480
1481         return err;
1482 }
1483
1484 /*
1485  * Get vlan interface making sure it is on the right wiphy.
1486  */
1487 static int get_vlan(struct nlattr *vlanattr,
1488                     struct cfg80211_registered_device *rdev,
1489                     struct net_device **vlan)
1490 {
1491         *vlan = NULL;
1492
1493         if (vlanattr) {
1494                 *vlan = dev_get_by_index(&init_net, nla_get_u32(vlanattr));
1495                 if (!*vlan)
1496                         return -ENODEV;
1497                 if (!(*vlan)->ieee80211_ptr)
1498                         return -EINVAL;
1499                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
1500                         return -EINVAL;
1501         }
1502         return 0;
1503 }
1504
1505 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
1506 {
1507         struct cfg80211_registered_device *drv;
1508         int err;
1509         struct net_device *dev;
1510         struct station_parameters params;
1511         u8 *mac_addr = NULL;
1512
1513         memset(&params, 0, sizeof(params));
1514
1515         params.listen_interval = -1;
1516
1517         if (info->attrs[NL80211_ATTR_STA_AID])
1518                 return -EINVAL;
1519
1520         if (!info->attrs[NL80211_ATTR_MAC])
1521                 return -EINVAL;
1522
1523         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1524
1525         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
1526                 params.supported_rates =
1527                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1528                 params.supported_rates_len =
1529                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1530         }
1531
1532         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1533                 params.listen_interval =
1534                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1535
1536         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1537                 params.ht_capa =
1538                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1539
1540         if (parse_station_flags(info->attrs[NL80211_ATTR_STA_FLAGS],
1541                                 &params.station_flags))
1542                 return -EINVAL;
1543
1544         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
1545                 params.plink_action =
1546                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
1547
1548         rtnl_lock();
1549
1550         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1551         if (err)
1552                 goto out_rtnl;
1553
1554         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1555         if (err)
1556                 goto out;
1557
1558         if (!drv->ops->change_station) {
1559                 err = -EOPNOTSUPP;
1560                 goto out;
1561         }
1562
1563         err = drv->ops->change_station(&drv->wiphy, dev, mac_addr, &params);
1564
1565  out:
1566         if (params.vlan)
1567                 dev_put(params.vlan);
1568         cfg80211_put_dev(drv);
1569         dev_put(dev);
1570  out_rtnl:
1571         rtnl_unlock();
1572
1573         return err;
1574 }
1575
1576 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
1577 {
1578         struct cfg80211_registered_device *drv;
1579         int err;
1580         struct net_device *dev;
1581         struct station_parameters params;
1582         u8 *mac_addr = NULL;
1583
1584         memset(&params, 0, sizeof(params));
1585
1586         if (!info->attrs[NL80211_ATTR_MAC])
1587                 return -EINVAL;
1588
1589         if (!info->attrs[NL80211_ATTR_STA_AID])
1590                 return -EINVAL;
1591
1592         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1593                 return -EINVAL;
1594
1595         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
1596                 return -EINVAL;
1597
1598         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1599         params.supported_rates =
1600                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1601         params.supported_rates_len =
1602                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1603         params.listen_interval =
1604                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1605         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
1606         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1607                 params.ht_capa =
1608                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1609
1610         if (parse_station_flags(info->attrs[NL80211_ATTR_STA_FLAGS],
1611                                 &params.station_flags))
1612                 return -EINVAL;
1613
1614         rtnl_lock();
1615
1616         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1617         if (err)
1618                 goto out_rtnl;
1619
1620         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1621         if (err)
1622                 goto out;
1623
1624         if (!drv->ops->add_station) {
1625                 err = -EOPNOTSUPP;
1626                 goto out;
1627         }
1628
1629         if (!netif_running(dev)) {
1630                 err = -ENETDOWN;
1631                 goto out;
1632         }
1633
1634         err = drv->ops->add_station(&drv->wiphy, dev, mac_addr, &params);
1635
1636  out:
1637         if (params.vlan)
1638                 dev_put(params.vlan);
1639         cfg80211_put_dev(drv);
1640         dev_put(dev);
1641  out_rtnl:
1642         rtnl_unlock();
1643
1644         return err;
1645 }
1646
1647 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
1648 {
1649         struct cfg80211_registered_device *drv;
1650         int err;
1651         struct net_device *dev;
1652         u8 *mac_addr = NULL;
1653
1654         if (info->attrs[NL80211_ATTR_MAC])
1655                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1656
1657         rtnl_lock();
1658
1659         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1660         if (err)
1661                 goto out_rtnl;
1662
1663         if (!drv->ops->del_station) {
1664                 err = -EOPNOTSUPP;
1665                 goto out;
1666         }
1667
1668         err = drv->ops->del_station(&drv->wiphy, dev, mac_addr);
1669
1670  out:
1671         cfg80211_put_dev(drv);
1672         dev_put(dev);
1673  out_rtnl:
1674         rtnl_unlock();
1675
1676         return err;
1677 }
1678
1679 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
1680                                 int flags, struct net_device *dev,
1681                                 u8 *dst, u8 *next_hop,
1682                                 struct mpath_info *pinfo)
1683 {
1684         void *hdr;
1685         struct nlattr *pinfoattr;
1686
1687         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1688         if (!hdr)
1689                 return -1;
1690
1691         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1692         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
1693         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
1694
1695         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
1696         if (!pinfoattr)
1697                 goto nla_put_failure;
1698         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
1699                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
1700                             pinfo->frame_qlen);
1701         if (pinfo->filled & MPATH_INFO_DSN)
1702                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DSN,
1703                             pinfo->dsn);
1704         if (pinfo->filled & MPATH_INFO_METRIC)
1705                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
1706                             pinfo->metric);
1707         if (pinfo->filled & MPATH_INFO_EXPTIME)
1708                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
1709                             pinfo->exptime);
1710         if (pinfo->filled & MPATH_INFO_FLAGS)
1711                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
1712                             pinfo->flags);
1713         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
1714                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
1715                             pinfo->discovery_timeout);
1716         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
1717                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
1718                             pinfo->discovery_retries);
1719
1720         nla_nest_end(msg, pinfoattr);
1721
1722         return genlmsg_end(msg, hdr);
1723
1724  nla_put_failure:
1725         genlmsg_cancel(msg, hdr);
1726         return -EMSGSIZE;
1727 }
1728
1729 static int nl80211_dump_mpath(struct sk_buff *skb,
1730                               struct netlink_callback *cb)
1731 {
1732         struct mpath_info pinfo;
1733         struct cfg80211_registered_device *dev;
1734         struct net_device *netdev;
1735         u8 dst[ETH_ALEN];
1736         u8 next_hop[ETH_ALEN];
1737         int ifidx = cb->args[0];
1738         int path_idx = cb->args[1];
1739         int err;
1740
1741         if (!ifidx) {
1742                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1743                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1744                                   nl80211_policy);
1745                 if (err)
1746                         return err;
1747
1748                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1749                         return -EINVAL;
1750
1751                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1752                 if (!ifidx)
1753                         return -EINVAL;
1754         }
1755
1756         rtnl_lock();
1757
1758         netdev = __dev_get_by_index(&init_net, ifidx);
1759         if (!netdev) {
1760                 err = -ENODEV;
1761                 goto out_rtnl;
1762         }
1763
1764         dev = cfg80211_get_dev_from_ifindex(ifidx);
1765         if (IS_ERR(dev)) {
1766                 err = PTR_ERR(dev);
1767                 goto out_rtnl;
1768         }
1769
1770         if (!dev->ops->dump_mpath) {
1771                 err = -EOPNOTSUPP;
1772                 goto out_err;
1773         }
1774
1775         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1776                 err = -EOPNOTSUPP;
1777                 goto out;
1778         }
1779
1780         while (1) {
1781                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
1782                                            dst, next_hop, &pinfo);
1783                 if (err == -ENOENT)
1784                         break;
1785                 if (err)
1786                         goto out_err;
1787
1788                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
1789                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
1790                                        netdev, dst, next_hop,
1791                                        &pinfo) < 0)
1792                         goto out;
1793
1794                 path_idx++;
1795         }
1796
1797
1798  out:
1799         cb->args[1] = path_idx;
1800         err = skb->len;
1801  out_err:
1802         cfg80211_put_dev(dev);
1803  out_rtnl:
1804         rtnl_unlock();
1805
1806         return err;
1807 }
1808
1809 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
1810 {
1811         struct cfg80211_registered_device *drv;
1812         int err;
1813         struct net_device *dev;
1814         struct mpath_info pinfo;
1815         struct sk_buff *msg;
1816         u8 *dst = NULL;
1817         u8 next_hop[ETH_ALEN];
1818
1819         memset(&pinfo, 0, sizeof(pinfo));
1820
1821         if (!info->attrs[NL80211_ATTR_MAC])
1822                 return -EINVAL;
1823
1824         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1825
1826         rtnl_lock();
1827
1828         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1829         if (err)
1830                 goto out_rtnl;
1831
1832         if (!drv->ops->get_mpath) {
1833                 err = -EOPNOTSUPP;
1834                 goto out;
1835         }
1836
1837         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1838                 err = -EOPNOTSUPP;
1839                 goto out;
1840         }
1841
1842         err = drv->ops->get_mpath(&drv->wiphy, dev, dst, next_hop, &pinfo);
1843         if (err)
1844                 goto out;
1845
1846         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1847         if (!msg)
1848                 goto out;
1849
1850         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
1851                                  dev, dst, next_hop, &pinfo) < 0)
1852                 goto out_free;
1853
1854         err = genlmsg_unicast(msg, info->snd_pid);
1855         goto out;
1856
1857  out_free:
1858         nlmsg_free(msg);
1859  out:
1860         cfg80211_put_dev(drv);
1861         dev_put(dev);
1862  out_rtnl:
1863         rtnl_unlock();
1864
1865         return err;
1866 }
1867
1868 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
1869 {
1870         struct cfg80211_registered_device *drv;
1871         int err;
1872         struct net_device *dev;
1873         u8 *dst = NULL;
1874         u8 *next_hop = NULL;
1875
1876         if (!info->attrs[NL80211_ATTR_MAC])
1877                 return -EINVAL;
1878
1879         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
1880                 return -EINVAL;
1881
1882         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1883         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
1884
1885         rtnl_lock();
1886
1887         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1888         if (err)
1889                 goto out_rtnl;
1890
1891         if (!drv->ops->change_mpath) {
1892                 err = -EOPNOTSUPP;
1893                 goto out;
1894         }
1895
1896         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1897                 err = -EOPNOTSUPP;
1898                 goto out;
1899         }
1900
1901         if (!netif_running(dev)) {
1902                 err = -ENETDOWN;
1903                 goto out;
1904         }
1905
1906         err = drv->ops->change_mpath(&drv->wiphy, dev, dst, next_hop);
1907
1908  out:
1909         cfg80211_put_dev(drv);
1910         dev_put(dev);
1911  out_rtnl:
1912         rtnl_unlock();
1913
1914         return err;
1915 }
1916 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
1917 {
1918         struct cfg80211_registered_device *drv;
1919         int err;
1920         struct net_device *dev;
1921         u8 *dst = NULL;
1922         u8 *next_hop = NULL;
1923
1924         if (!info->attrs[NL80211_ATTR_MAC])
1925                 return -EINVAL;
1926
1927         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
1928                 return -EINVAL;
1929
1930         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1931         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
1932
1933         rtnl_lock();
1934
1935         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1936         if (err)
1937                 goto out_rtnl;
1938
1939         if (!drv->ops->add_mpath) {
1940                 err = -EOPNOTSUPP;
1941                 goto out;
1942         }
1943
1944         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1945                 err = -EOPNOTSUPP;
1946                 goto out;
1947         }
1948
1949         if (!netif_running(dev)) {
1950                 err = -ENETDOWN;
1951                 goto out;
1952         }
1953
1954         err = drv->ops->add_mpath(&drv->wiphy, dev, dst, next_hop);
1955
1956  out:
1957         cfg80211_put_dev(drv);
1958         dev_put(dev);
1959  out_rtnl:
1960         rtnl_unlock();
1961
1962         return err;
1963 }
1964
1965 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
1966 {
1967         struct cfg80211_registered_device *drv;
1968         int err;
1969         struct net_device *dev;
1970         u8 *dst = NULL;
1971
1972         if (info->attrs[NL80211_ATTR_MAC])
1973                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1974
1975         rtnl_lock();
1976
1977         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1978         if (err)
1979                 goto out_rtnl;
1980
1981         if (!drv->ops->del_mpath) {
1982                 err = -EOPNOTSUPP;
1983                 goto out;
1984         }
1985
1986         err = drv->ops->del_mpath(&drv->wiphy, dev, dst);
1987
1988  out:
1989         cfg80211_put_dev(drv);
1990         dev_put(dev);
1991  out_rtnl:
1992         rtnl_unlock();
1993
1994         return err;
1995 }
1996
1997 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
1998 {
1999         struct cfg80211_registered_device *drv;
2000         int err;
2001         struct net_device *dev;
2002         struct bss_parameters params;
2003
2004         memset(&params, 0, sizeof(params));
2005         /* default to not changing parameters */
2006         params.use_cts_prot = -1;
2007         params.use_short_preamble = -1;
2008         params.use_short_slot_time = -1;
2009
2010         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2011                 params.use_cts_prot =
2012                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2013         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2014                 params.use_short_preamble =
2015                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2016         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2017                 params.use_short_slot_time =
2018                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2019         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2020                 params.basic_rates =
2021                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2022                 params.basic_rates_len =
2023                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2024         }
2025
2026         rtnl_lock();
2027
2028         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2029         if (err)
2030                 goto out_rtnl;
2031
2032         if (!drv->ops->change_bss) {
2033                 err = -EOPNOTSUPP;
2034                 goto out;
2035         }
2036
2037         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
2038                 err = -EOPNOTSUPP;
2039                 goto out;
2040         }
2041
2042         err = drv->ops->change_bss(&drv->wiphy, dev, &params);
2043
2044  out:
2045         cfg80211_put_dev(drv);
2046         dev_put(dev);
2047  out_rtnl:
2048         rtnl_unlock();
2049
2050         return err;
2051 }
2052
2053 static const struct nla_policy
2054         reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2055         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2056         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2057         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2058         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2059         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2060         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2061 };
2062
2063 static int parse_reg_rule(struct nlattr *tb[],
2064         struct ieee80211_reg_rule *reg_rule)
2065 {
2066         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2067         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2068
2069         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2070                 return -EINVAL;
2071         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2072                 return -EINVAL;
2073         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2074                 return -EINVAL;
2075         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2076                 return -EINVAL;
2077         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2078                 return -EINVAL;
2079
2080         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2081
2082         freq_range->start_freq_khz =
2083                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2084         freq_range->end_freq_khz =
2085                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2086         freq_range->max_bandwidth_khz =
2087                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2088
2089         power_rule->max_eirp =
2090                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2091
2092         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2093                 power_rule->max_antenna_gain =
2094                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2095
2096         return 0;
2097 }
2098
2099 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2100 {
2101         int r;
2102         char *data = NULL;
2103
2104         /*
2105          * You should only get this when cfg80211 hasn't yet initialized
2106          * completely when built-in to the kernel right between the time
2107          * window between nl80211_init() and regulatory_init(), if that is
2108          * even possible.
2109          */
2110         mutex_lock(&cfg80211_mutex);
2111         if (unlikely(!cfg80211_regdomain)) {
2112                 mutex_unlock(&cfg80211_mutex);
2113                 return -EINPROGRESS;
2114         }
2115         mutex_unlock(&cfg80211_mutex);
2116
2117         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2118                 return -EINVAL;
2119
2120         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2121
2122 #ifdef CONFIG_WIRELESS_OLD_REGULATORY
2123         /* We ignore world regdom requests with the old regdom setup */
2124         if (is_world_regdom(data))
2125                 return -EINVAL;
2126 #endif
2127
2128         r = regulatory_hint_user(data);
2129
2130         return r;
2131 }
2132
2133 static int nl80211_get_mesh_params(struct sk_buff *skb,
2134         struct genl_info *info)
2135 {
2136         struct cfg80211_registered_device *drv;
2137         struct mesh_config cur_params;
2138         int err;
2139         struct net_device *dev;
2140         void *hdr;
2141         struct nlattr *pinfoattr;
2142         struct sk_buff *msg;
2143
2144         rtnl_lock();
2145
2146         /* Look up our device */
2147         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2148         if (err)
2149                 goto out_rtnl;
2150
2151         if (!drv->ops->get_mesh_params) {
2152                 err = -EOPNOTSUPP;
2153                 goto out;
2154         }
2155
2156         /* Get the mesh params */
2157         err = drv->ops->get_mesh_params(&drv->wiphy, dev, &cur_params);
2158         if (err)
2159                 goto out;
2160
2161         /* Draw up a netlink message to send back */
2162         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2163         if (!msg) {
2164                 err = -ENOBUFS;
2165                 goto out;
2166         }
2167         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2168                              NL80211_CMD_GET_MESH_PARAMS);
2169         if (!hdr)
2170                 goto nla_put_failure;
2171         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
2172         if (!pinfoattr)
2173                 goto nla_put_failure;
2174         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2175         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2176                         cur_params.dot11MeshRetryTimeout);
2177         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2178                         cur_params.dot11MeshConfirmTimeout);
2179         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2180                         cur_params.dot11MeshHoldingTimeout);
2181         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2182                         cur_params.dot11MeshMaxPeerLinks);
2183         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2184                         cur_params.dot11MeshMaxRetries);
2185         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2186                         cur_params.dot11MeshTTL);
2187         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2188                         cur_params.auto_open_plinks);
2189         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2190                         cur_params.dot11MeshHWMPmaxPREQretries);
2191         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2192                         cur_params.path_refresh_time);
2193         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2194                         cur_params.min_discovery_timeout);
2195         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2196                         cur_params.dot11MeshHWMPactivePathTimeout);
2197         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2198                         cur_params.dot11MeshHWMPpreqMinInterval);
2199         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2200                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2201         nla_nest_end(msg, pinfoattr);
2202         genlmsg_end(msg, hdr);
2203         err = genlmsg_unicast(msg, info->snd_pid);
2204         goto out;
2205
2206  nla_put_failure:
2207         genlmsg_cancel(msg, hdr);
2208         err = -EMSGSIZE;
2209  out:
2210         /* Cleanup */
2211         cfg80211_put_dev(drv);
2212         dev_put(dev);
2213  out_rtnl:
2214         rtnl_unlock();
2215
2216         return err;
2217 }
2218
2219 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2220 do {\
2221         if (table[attr_num]) {\
2222                 cfg.param = nla_fn(table[attr_num]); \
2223                 mask |= (1 << (attr_num - 1)); \
2224         } \
2225 } while (0);\
2226
2227 static struct nla_policy
2228 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] __read_mostly = {
2229         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2230         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2231         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2232         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2233         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2234         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2235         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2236
2237         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2238         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2239         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2240         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2241         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2242         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2243 };
2244
2245 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2246 {
2247         int err;
2248         u32 mask;
2249         struct cfg80211_registered_device *drv;
2250         struct net_device *dev;
2251         struct mesh_config cfg;
2252         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2253         struct nlattr *parent_attr;
2254
2255         parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
2256         if (!parent_attr)
2257                 return -EINVAL;
2258         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2259                         parent_attr, nl80211_meshconf_params_policy))
2260                 return -EINVAL;
2261
2262         rtnl_lock();
2263
2264         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2265         if (err)
2266                 goto out_rtnl;
2267
2268         if (!drv->ops->set_mesh_params) {
2269                 err = -EOPNOTSUPP;
2270                 goto out;
2271         }
2272
2273         /* This makes sure that there aren't more than 32 mesh config
2274          * parameters (otherwise our bitfield scheme would not work.) */
2275         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2276
2277         /* Fill in the params struct */
2278         mask = 0;
2279         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2280                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2281         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2282                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2283         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2284                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2285         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2286                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2287         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2288                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2289         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2290                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2291         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2292                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2293         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2294                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2295                         nla_get_u8);
2296         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2297                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2298         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2299                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2300                         nla_get_u16);
2301         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2302                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2303                         nla_get_u32);
2304         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2305                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2306                         nla_get_u16);
2307         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2308                         dot11MeshHWMPnetDiameterTraversalTime,
2309                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2310                         nla_get_u16);
2311
2312         /* Apply changes */
2313         err = drv->ops->set_mesh_params(&drv->wiphy, dev, &cfg, mask);
2314
2315  out:
2316         /* cleanup */
2317         cfg80211_put_dev(drv);
2318         dev_put(dev);
2319  out_rtnl:
2320         rtnl_unlock();
2321
2322         return err;
2323 }
2324
2325 #undef FILL_IN_MESH_PARAM_IF_SET
2326
2327 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2328 {
2329         struct sk_buff *msg;
2330         void *hdr = NULL;
2331         struct nlattr *nl_reg_rules;
2332         unsigned int i;
2333         int err = -EINVAL;
2334
2335         mutex_lock(&cfg80211_mutex);
2336
2337         if (!cfg80211_regdomain)
2338                 goto out;
2339
2340         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2341         if (!msg) {
2342                 err = -ENOBUFS;
2343                 goto out;
2344         }
2345
2346         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2347                              NL80211_CMD_GET_REG);
2348         if (!hdr)
2349                 goto nla_put_failure;
2350
2351         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2352                 cfg80211_regdomain->alpha2);
2353
2354         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2355         if (!nl_reg_rules)
2356                 goto nla_put_failure;
2357
2358         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2359                 struct nlattr *nl_reg_rule;
2360                 const struct ieee80211_reg_rule *reg_rule;
2361                 const struct ieee80211_freq_range *freq_range;
2362                 const struct ieee80211_power_rule *power_rule;
2363
2364                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2365                 freq_range = &reg_rule->freq_range;
2366                 power_rule = &reg_rule->power_rule;
2367
2368                 nl_reg_rule = nla_nest_start(msg, i);
2369                 if (!nl_reg_rule)
2370                         goto nla_put_failure;
2371
2372                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2373                         reg_rule->flags);
2374                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2375                         freq_range->start_freq_khz);
2376                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2377                         freq_range->end_freq_khz);
2378                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2379                         freq_range->max_bandwidth_khz);
2380                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2381                         power_rule->max_antenna_gain);
2382                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2383                         power_rule->max_eirp);
2384
2385                 nla_nest_end(msg, nl_reg_rule);
2386         }
2387
2388         nla_nest_end(msg, nl_reg_rules);
2389
2390         genlmsg_end(msg, hdr);
2391         err = genlmsg_unicast(msg, info->snd_pid);
2392         goto out;
2393
2394 nla_put_failure:
2395         genlmsg_cancel(msg, hdr);
2396         err = -EMSGSIZE;
2397 out:
2398         mutex_unlock(&cfg80211_mutex);
2399         return err;
2400 }
2401
2402 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2403 {
2404         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2405         struct nlattr *nl_reg_rule;
2406         char *alpha2 = NULL;
2407         int rem_reg_rules = 0, r = 0;
2408         u32 num_rules = 0, rule_idx = 0, size_of_regd;
2409         struct ieee80211_regdomain *rd = NULL;
2410
2411         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2412                 return -EINVAL;
2413
2414         if (!info->attrs[NL80211_ATTR_REG_RULES])
2415                 return -EINVAL;
2416
2417         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2418
2419         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2420                         rem_reg_rules) {
2421                 num_rules++;
2422                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2423                         goto bad_reg;
2424         }
2425
2426         if (!reg_is_valid_request(alpha2))
2427                 return -EINVAL;
2428
2429         size_of_regd = sizeof(struct ieee80211_regdomain) +
2430                 (num_rules * sizeof(struct ieee80211_reg_rule));
2431
2432         rd = kzalloc(size_of_regd, GFP_KERNEL);
2433         if (!rd)
2434                 return -ENOMEM;
2435
2436         rd->n_reg_rules = num_rules;
2437         rd->alpha2[0] = alpha2[0];
2438         rd->alpha2[1] = alpha2[1];
2439
2440         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2441                         rem_reg_rules) {
2442                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2443                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2444                         reg_rule_policy);
2445                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2446                 if (r)
2447                         goto bad_reg;
2448
2449                 rule_idx++;
2450
2451                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES)
2452                         goto bad_reg;
2453         }
2454
2455         BUG_ON(rule_idx != num_rules);
2456
2457         mutex_lock(&cfg80211_mutex);
2458         r = set_regdom(rd);
2459         mutex_unlock(&cfg80211_mutex);
2460         return r;
2461
2462  bad_reg:
2463         kfree(rd);
2464         return -EINVAL;
2465 }
2466
2467 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
2468 {
2469         struct cfg80211_registered_device *drv;
2470         struct net_device *dev;
2471         struct cfg80211_scan_request *request;
2472         struct cfg80211_ssid *ssid;
2473         struct ieee80211_channel *channel;
2474         struct nlattr *attr;
2475         struct wiphy *wiphy;
2476         int err, tmp, n_ssids = 0, n_channels = 0, i;
2477         enum ieee80211_band band;
2478         size_t ie_len;
2479
2480         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2481                 return -EINVAL;
2482
2483         rtnl_lock();
2484
2485         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2486         if (err)
2487                 goto out_rtnl;
2488
2489         wiphy = &drv->wiphy;
2490
2491         if (!drv->ops->scan) {
2492                 err = -EOPNOTSUPP;
2493                 goto out;
2494         }
2495
2496         if (!netif_running(dev)) {
2497                 err = -ENETDOWN;
2498                 goto out;
2499         }
2500
2501         if (drv->scan_req) {
2502                 err = -EBUSY;
2503                 goto out;
2504         }
2505
2506         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2507                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp)
2508                         n_channels++;
2509                 if (!n_channels) {
2510                         err = -EINVAL;
2511                         goto out;
2512                 }
2513         } else {
2514                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
2515                         if (wiphy->bands[band])
2516                                 n_channels += wiphy->bands[band]->n_channels;
2517         }
2518
2519         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
2520                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
2521                         n_ssids++;
2522
2523         if (n_ssids > wiphy->max_scan_ssids) {
2524                 err = -EINVAL;
2525                 goto out;
2526         }
2527
2528         if (info->attrs[NL80211_ATTR_IE])
2529                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2530         else
2531                 ie_len = 0;
2532
2533         if (ie_len > wiphy->max_scan_ie_len) {
2534                 err = -EINVAL;
2535                 goto out;
2536         }
2537
2538         request = kzalloc(sizeof(*request)
2539                         + sizeof(*ssid) * n_ssids
2540                         + sizeof(channel) * n_channels
2541                         + ie_len, GFP_KERNEL);
2542         if (!request) {
2543                 err = -ENOMEM;
2544                 goto out;
2545         }
2546
2547         request->channels = (void *)((char *)request + sizeof(*request));
2548         request->n_channels = n_channels;
2549         if (n_ssids)
2550                 request->ssids = (void *)(request->channels + n_channels);
2551         request->n_ssids = n_ssids;
2552         if (ie_len) {
2553                 if (request->ssids)
2554                         request->ie = (void *)(request->ssids + n_ssids);
2555                 else
2556                         request->ie = (void *)(request->channels + n_channels);
2557         }
2558
2559         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2560                 /* user specified, bail out if channel not found */
2561                 request->n_channels = n_channels;
2562                 i = 0;
2563                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
2564                         request->channels[i] = ieee80211_get_channel(wiphy, nla_get_u32(attr));
2565                         if (!request->channels[i]) {
2566                                 err = -EINVAL;
2567                                 goto out_free;
2568                         }
2569                         i++;
2570                 }
2571         } else {
2572                 /* all channels */
2573                 i = 0;
2574                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
2575                         int j;
2576                         if (!wiphy->bands[band])
2577                                 continue;
2578                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
2579                                 request->channels[i] = &wiphy->bands[band]->channels[j];
2580                                 i++;
2581                         }
2582                 }
2583         }
2584
2585         i = 0;
2586         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
2587                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
2588                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
2589                                 err = -EINVAL;
2590                                 goto out_free;
2591                         }
2592                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
2593                         request->ssids[i].ssid_len = nla_len(attr);
2594                         i++;
2595                 }
2596         }
2597
2598         if (info->attrs[NL80211_ATTR_IE]) {
2599                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2600                 memcpy(request->ie, nla_data(info->attrs[NL80211_ATTR_IE]),
2601                        request->ie_len);
2602         }
2603
2604         request->ifidx = dev->ifindex;
2605         request->wiphy = &drv->wiphy;
2606
2607         drv->scan_req = request;
2608         err = drv->ops->scan(&drv->wiphy, dev, request);
2609
2610  out_free:
2611         if (err) {
2612                 drv->scan_req = NULL;
2613                 kfree(request);
2614         }
2615  out:
2616         cfg80211_put_dev(drv);
2617         dev_put(dev);
2618  out_rtnl:
2619         rtnl_unlock();
2620
2621         return err;
2622 }
2623
2624 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
2625                             struct cfg80211_registered_device *rdev,
2626                             struct net_device *dev,
2627                             struct cfg80211_bss *res)
2628 {
2629         void *hdr;
2630         struct nlattr *bss;
2631
2632         hdr = nl80211hdr_put(msg, pid, seq, flags,
2633                              NL80211_CMD_NEW_SCAN_RESULTS);
2634         if (!hdr)
2635                 return -1;
2636
2637         NLA_PUT_U32(msg, NL80211_ATTR_SCAN_GENERATION,
2638                     rdev->bss_generation);
2639         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2640
2641         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
2642         if (!bss)
2643                 goto nla_put_failure;
2644         if (!is_zero_ether_addr(res->bssid))
2645                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
2646         if (res->information_elements && res->len_information_elements)
2647                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
2648                         res->len_information_elements,
2649                         res->information_elements);
2650         if (res->tsf)
2651                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
2652         if (res->beacon_interval)
2653                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
2654         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
2655         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
2656
2657         switch (rdev->wiphy.signal_type) {
2658         case CFG80211_SIGNAL_TYPE_MBM:
2659                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
2660                 break;
2661         case CFG80211_SIGNAL_TYPE_UNSPEC:
2662                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
2663                 break;
2664         default:
2665                 break;
2666         }
2667
2668         nla_nest_end(msg, bss);
2669
2670         return genlmsg_end(msg, hdr);
2671
2672  nla_put_failure:
2673         genlmsg_cancel(msg, hdr);
2674         return -EMSGSIZE;
2675 }
2676
2677 static int nl80211_dump_scan(struct sk_buff *skb,
2678                              struct netlink_callback *cb)
2679 {
2680         struct cfg80211_registered_device *dev;
2681         struct net_device *netdev;
2682         struct cfg80211_internal_bss *scan;
2683         int ifidx = cb->args[0];
2684         int start = cb->args[1], idx = 0;
2685         int err;
2686
2687         if (!ifidx) {
2688                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
2689                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
2690                                   nl80211_policy);
2691                 if (err)
2692                         return err;
2693
2694                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
2695                         return -EINVAL;
2696
2697                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
2698                 if (!ifidx)
2699                         return -EINVAL;
2700                 cb->args[0] = ifidx;
2701         }
2702
2703         netdev = dev_get_by_index(&init_net, ifidx);
2704         if (!netdev)
2705                 return -ENODEV;
2706
2707         dev = cfg80211_get_dev_from_ifindex(ifidx);
2708         if (IS_ERR(dev)) {
2709                 err = PTR_ERR(dev);
2710                 goto out_put_netdev;
2711         }
2712
2713         spin_lock_bh(&dev->bss_lock);
2714         cfg80211_bss_expire(dev);
2715
2716         list_for_each_entry(scan, &dev->bss_list, list) {
2717                 if (++idx <= start)
2718                         continue;
2719                 if (nl80211_send_bss(skb,
2720                                 NETLINK_CB(cb->skb).pid,
2721                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2722                                 dev, netdev, &scan->pub) < 0) {
2723                         idx--;
2724                         goto out;
2725                 }
2726         }
2727
2728  out:
2729         spin_unlock_bh(&dev->bss_lock);
2730
2731         cb->args[1] = idx;
2732         err = skb->len;
2733         cfg80211_put_dev(dev);
2734  out_put_netdev:
2735         dev_put(netdev);
2736
2737         return err;
2738 }
2739
2740 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
2741 {
2742         return auth_type == NL80211_AUTHTYPE_OPEN_SYSTEM ||
2743                 auth_type == NL80211_AUTHTYPE_SHARED_KEY ||
2744                 auth_type == NL80211_AUTHTYPE_FT ||
2745                 auth_type == NL80211_AUTHTYPE_NETWORK_EAP;
2746 }
2747
2748 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
2749 {
2750         struct cfg80211_registered_device *drv;
2751         struct net_device *dev;
2752         struct cfg80211_auth_request req;
2753         struct wiphy *wiphy;
2754         int err;
2755
2756         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2757                 return -EINVAL;
2758
2759         if (!info->attrs[NL80211_ATTR_MAC])
2760                 return -EINVAL;
2761
2762         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
2763                 return -EINVAL;
2764
2765         rtnl_lock();
2766
2767         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2768         if (err)
2769                 goto unlock_rtnl;
2770
2771         if (!drv->ops->auth) {
2772                 err = -EOPNOTSUPP;
2773                 goto out;
2774         }
2775
2776         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
2777                 err = -EOPNOTSUPP;
2778                 goto out;
2779         }
2780
2781         if (!netif_running(dev)) {
2782                 err = -ENETDOWN;
2783                 goto out;
2784         }
2785
2786         wiphy = &drv->wiphy;
2787         memset(&req, 0, sizeof(req));
2788
2789         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2790
2791         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2792                 req.chan = ieee80211_get_channel(
2793                         wiphy,
2794                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
2795                 if (!req.chan) {
2796                         err = -EINVAL;
2797                         goto out;
2798                 }
2799         }
2800
2801         if (info->attrs[NL80211_ATTR_SSID]) {
2802                 req.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2803                 req.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
2804         }
2805
2806         if (info->attrs[NL80211_ATTR_IE]) {
2807                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
2808                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2809         }
2810
2811         req.auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
2812         if (!nl80211_valid_auth_type(req.auth_type)) {
2813                 err = -EINVAL;
2814                 goto out;
2815         }
2816
2817         err = drv->ops->auth(&drv->wiphy, dev, &req);
2818
2819 out:
2820         cfg80211_put_dev(drv);
2821         dev_put(dev);
2822 unlock_rtnl:
2823         rtnl_unlock();
2824         return err;
2825 }
2826
2827 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
2828 {
2829         struct cfg80211_registered_device *drv;
2830         struct net_device *dev;
2831         struct cfg80211_assoc_request req;
2832         struct wiphy *wiphy;
2833         int err;
2834
2835         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2836                 return -EINVAL;
2837
2838         if (!info->attrs[NL80211_ATTR_MAC] ||
2839             !info->attrs[NL80211_ATTR_SSID])
2840                 return -EINVAL;
2841
2842         rtnl_lock();
2843
2844         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2845         if (err)
2846                 goto unlock_rtnl;
2847
2848         if (!drv->ops->assoc) {
2849                 err = -EOPNOTSUPP;
2850                 goto out;
2851         }
2852
2853         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
2854                 err = -EOPNOTSUPP;
2855                 goto out;
2856         }
2857
2858         if (!netif_running(dev)) {
2859                 err = -ENETDOWN;
2860                 goto out;
2861         }
2862
2863         wiphy = &drv->wiphy;
2864         memset(&req, 0, sizeof(req));
2865
2866         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2867
2868         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2869                 req.chan = ieee80211_get_channel(
2870                         wiphy,
2871                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
2872                 if (!req.chan) {
2873                         err = -EINVAL;
2874                         goto out;
2875                 }
2876         }
2877
2878         req.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2879         req.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
2880
2881         if (info->attrs[NL80211_ATTR_IE]) {
2882                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
2883                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2884         }
2885
2886         err = drv->ops->assoc(&drv->wiphy, dev, &req);
2887
2888 out:
2889         cfg80211_put_dev(drv);
2890         dev_put(dev);
2891 unlock_rtnl:
2892         rtnl_unlock();
2893         return err;
2894 }
2895
2896 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
2897 {
2898         struct cfg80211_registered_device *drv;
2899         struct net_device *dev;
2900         struct cfg80211_deauth_request req;
2901         struct wiphy *wiphy;
2902         int err;
2903
2904         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2905                 return -EINVAL;
2906
2907         if (!info->attrs[NL80211_ATTR_MAC])
2908                 return -EINVAL;
2909
2910         if (!info->attrs[NL80211_ATTR_REASON_CODE])
2911                 return -EINVAL;
2912
2913         rtnl_lock();
2914
2915         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2916         if (err)
2917                 goto unlock_rtnl;
2918
2919         if (!drv->ops->deauth) {
2920                 err = -EOPNOTSUPP;
2921                 goto out;
2922         }
2923
2924         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
2925                 err = -EOPNOTSUPP;
2926                 goto out;
2927         }
2928
2929         if (!netif_running(dev)) {
2930                 err = -ENETDOWN;
2931                 goto out;
2932         }
2933
2934         wiphy = &drv->wiphy;
2935         memset(&req, 0, sizeof(req));
2936
2937         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2938
2939         req.reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
2940         if (req.reason_code == 0) {
2941                 /* Reason Code 0 is reserved */
2942                 err = -EINVAL;
2943                 goto out;
2944         }
2945
2946         if (info->attrs[NL80211_ATTR_IE]) {
2947                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
2948                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2949         }
2950
2951         err = drv->ops->deauth(&drv->wiphy, dev, &req);
2952
2953 out:
2954         cfg80211_put_dev(drv);
2955         dev_put(dev);
2956 unlock_rtnl:
2957         rtnl_unlock();
2958         return err;
2959 }
2960
2961 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
2962 {
2963         struct cfg80211_registered_device *drv;
2964         struct net_device *dev;
2965         struct cfg80211_disassoc_request req;
2966         struct wiphy *wiphy;
2967         int err;
2968
2969         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2970                 return -EINVAL;
2971
2972         if (!info->attrs[NL80211_ATTR_MAC])
2973                 return -EINVAL;
2974
2975         if (!info->attrs[NL80211_ATTR_REASON_CODE])
2976                 return -EINVAL;
2977
2978         rtnl_lock();
2979
2980         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2981         if (err)
2982                 goto unlock_rtnl;
2983
2984         if (!drv->ops->disassoc) {
2985                 err = -EOPNOTSUPP;
2986                 goto out;
2987         }
2988
2989         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
2990                 err = -EOPNOTSUPP;
2991                 goto out;
2992         }
2993
2994         if (!netif_running(dev)) {
2995                 err = -ENETDOWN;
2996                 goto out;
2997         }
2998
2999         wiphy = &drv->wiphy;
3000         memset(&req, 0, sizeof(req));
3001
3002         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3003
3004         req.reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3005         if (req.reason_code == 0) {
3006                 /* Reason Code 0 is reserved */
3007                 err = -EINVAL;
3008                 goto out;
3009         }
3010
3011         if (info->attrs[NL80211_ATTR_IE]) {
3012                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3013                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3014         }
3015
3016         err = drv->ops->disassoc(&drv->wiphy, dev, &req);
3017
3018 out:
3019         cfg80211_put_dev(drv);
3020         dev_put(dev);
3021 unlock_rtnl:
3022         rtnl_unlock();
3023         return err;
3024 }
3025
3026 static struct genl_ops nl80211_ops[] = {
3027         {
3028                 .cmd = NL80211_CMD_GET_WIPHY,
3029                 .doit = nl80211_get_wiphy,
3030                 .dumpit = nl80211_dump_wiphy,
3031                 .policy = nl80211_policy,
3032                 /* can be retrieved by unprivileged users */
3033         },
3034         {
3035                 .cmd = NL80211_CMD_SET_WIPHY,
3036                 .doit = nl80211_set_wiphy,
3037                 .policy = nl80211_policy,
3038                 .flags = GENL_ADMIN_PERM,
3039         },
3040         {
3041                 .cmd = NL80211_CMD_GET_INTERFACE,
3042                 .doit = nl80211_get_interface,
3043                 .dumpit = nl80211_dump_interface,
3044                 .policy = nl80211_policy,
3045                 /* can be retrieved by unprivileged users */
3046         },
3047         {
3048                 .cmd = NL80211_CMD_SET_INTERFACE,
3049                 .doit = nl80211_set_interface,
3050                 .policy = nl80211_policy,
3051                 .flags = GENL_ADMIN_PERM,
3052         },
3053         {
3054                 .cmd = NL80211_CMD_NEW_INTERFACE,
3055                 .doit = nl80211_new_interface,
3056                 .policy = nl80211_policy,
3057                 .flags = GENL_ADMIN_PERM,
3058         },
3059         {
3060                 .cmd = NL80211_CMD_DEL_INTERFACE,
3061                 .doit = nl80211_del_interface,
3062                 .policy = nl80211_policy,
3063                 .flags = GENL_ADMIN_PERM,
3064         },
3065         {
3066                 .cmd = NL80211_CMD_GET_KEY,
3067                 .doit = nl80211_get_key,
3068                 .policy = nl80211_policy,
3069                 .flags = GENL_ADMIN_PERM,
3070         },
3071         {
3072                 .cmd = NL80211_CMD_SET_KEY,
3073                 .doit = nl80211_set_key,
3074                 .policy = nl80211_policy,
3075                 .flags = GENL_ADMIN_PERM,
3076         },
3077         {
3078                 .cmd = NL80211_CMD_NEW_KEY,
3079                 .doit = nl80211_new_key,
3080                 .policy = nl80211_policy,
3081                 .flags = GENL_ADMIN_PERM,
3082         },
3083         {
3084                 .cmd = NL80211_CMD_DEL_KEY,
3085                 .doit = nl80211_del_key,
3086                 .policy = nl80211_policy,
3087                 .flags = GENL_ADMIN_PERM,
3088         },
3089         {
3090                 .cmd = NL80211_CMD_SET_BEACON,
3091                 .policy = nl80211_policy,
3092                 .flags = GENL_ADMIN_PERM,
3093                 .doit = nl80211_addset_beacon,
3094         },
3095         {
3096                 .cmd = NL80211_CMD_NEW_BEACON,
3097                 .policy = nl80211_policy,
3098                 .flags = GENL_ADMIN_PERM,
3099                 .doit = nl80211_addset_beacon,
3100         },
3101         {
3102                 .cmd = NL80211_CMD_DEL_BEACON,
3103                 .policy = nl80211_policy,
3104                 .flags = GENL_ADMIN_PERM,
3105                 .doit = nl80211_del_beacon,
3106         },
3107         {
3108                 .cmd = NL80211_CMD_GET_STATION,
3109                 .doit = nl80211_get_station,
3110                 .dumpit = nl80211_dump_station,
3111                 .policy = nl80211_policy,
3112         },
3113         {
3114                 .cmd = NL80211_CMD_SET_STATION,
3115                 .doit = nl80211_set_station,
3116                 .policy = nl80211_policy,
3117                 .flags = GENL_ADMIN_PERM,
3118         },
3119         {
3120                 .cmd = NL80211_CMD_NEW_STATION,
3121                 .doit = nl80211_new_station,
3122                 .policy = nl80211_policy,
3123                 .flags = GENL_ADMIN_PERM,
3124         },
3125         {
3126                 .cmd = NL80211_CMD_DEL_STATION,
3127                 .doit = nl80211_del_station,
3128                 .policy = nl80211_policy,
3129                 .flags = GENL_ADMIN_PERM,
3130         },
3131         {
3132                 .cmd = NL80211_CMD_GET_MPATH,
3133                 .doit = nl80211_get_mpath,
3134                 .dumpit = nl80211_dump_mpath,
3135                 .policy = nl80211_policy,
3136                 .flags = GENL_ADMIN_PERM,
3137         },
3138         {
3139                 .cmd = NL80211_CMD_SET_MPATH,
3140                 .doit = nl80211_set_mpath,
3141                 .policy = nl80211_policy,
3142                 .flags = GENL_ADMIN_PERM,
3143         },
3144         {
3145                 .cmd = NL80211_CMD_NEW_MPATH,
3146                 .doit = nl80211_new_mpath,
3147                 .policy = nl80211_policy,
3148                 .flags = GENL_ADMIN_PERM,
3149         },
3150         {
3151                 .cmd = NL80211_CMD_DEL_MPATH,
3152                 .doit = nl80211_del_mpath,
3153                 .policy = nl80211_policy,
3154                 .flags = GENL_ADMIN_PERM,
3155         },
3156         {
3157                 .cmd = NL80211_CMD_SET_BSS,
3158                 .doit = nl80211_set_bss,
3159                 .policy = nl80211_policy,
3160                 .flags = GENL_ADMIN_PERM,
3161         },
3162         {
3163                 .cmd = NL80211_CMD_GET_REG,
3164                 .doit = nl80211_get_reg,
3165                 .policy = nl80211_policy,
3166                 /* can be retrieved by unprivileged users */
3167         },
3168         {
3169                 .cmd = NL80211_CMD_SET_REG,
3170                 .doit = nl80211_set_reg,
3171                 .policy = nl80211_policy,
3172                 .flags = GENL_ADMIN_PERM,
3173         },
3174         {
3175                 .cmd = NL80211_CMD_REQ_SET_REG,
3176                 .doit = nl80211_req_set_reg,
3177                 .policy = nl80211_policy,
3178                 .flags = GENL_ADMIN_PERM,
3179         },
3180         {
3181                 .cmd = NL80211_CMD_GET_MESH_PARAMS,
3182                 .doit = nl80211_get_mesh_params,
3183                 .policy = nl80211_policy,
3184                 /* can be retrieved by unprivileged users */
3185         },
3186         {
3187                 .cmd = NL80211_CMD_SET_MESH_PARAMS,
3188                 .doit = nl80211_set_mesh_params,
3189                 .policy = nl80211_policy,
3190                 .flags = GENL_ADMIN_PERM,
3191         },
3192         {
3193                 .cmd = NL80211_CMD_TRIGGER_SCAN,
3194                 .doit = nl80211_trigger_scan,
3195                 .policy = nl80211_policy,
3196                 .flags = GENL_ADMIN_PERM,
3197         },
3198         {
3199                 .cmd = NL80211_CMD_GET_SCAN,
3200                 .policy = nl80211_policy,
3201                 .dumpit = nl80211_dump_scan,
3202         },
3203         {
3204                 .cmd = NL80211_CMD_AUTHENTICATE,
3205                 .doit = nl80211_authenticate,
3206                 .policy = nl80211_policy,
3207                 .flags = GENL_ADMIN_PERM,
3208         },
3209         {
3210                 .cmd = NL80211_CMD_ASSOCIATE,
3211                 .doit = nl80211_associate,
3212                 .policy = nl80211_policy,
3213                 .flags = GENL_ADMIN_PERM,
3214         },
3215         {
3216                 .cmd = NL80211_CMD_DEAUTHENTICATE,
3217                 .doit = nl80211_deauthenticate,
3218                 .policy = nl80211_policy,
3219                 .flags = GENL_ADMIN_PERM,
3220         },
3221         {
3222                 .cmd = NL80211_CMD_DISASSOCIATE,
3223                 .doit = nl80211_disassociate,
3224                 .policy = nl80211_policy,
3225                 .flags = GENL_ADMIN_PERM,
3226         },
3227 };
3228 static struct genl_multicast_group nl80211_mlme_mcgrp = {
3229         .name = "mlme",
3230 };
3231
3232 /* multicast groups */
3233 static struct genl_multicast_group nl80211_config_mcgrp = {
3234         .name = "config",
3235 };
3236 static struct genl_multicast_group nl80211_scan_mcgrp = {
3237         .name = "scan",
3238 };
3239 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
3240         .name = "regulatory",
3241 };
3242
3243 /* notification functions */
3244
3245 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
3246 {
3247         struct sk_buff *msg;
3248
3249         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3250         if (!msg)
3251                 return;
3252
3253         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
3254                 nlmsg_free(msg);
3255                 return;
3256         }
3257
3258         genlmsg_multicast(msg, 0, nl80211_config_mcgrp.id, GFP_KERNEL);
3259 }
3260
3261 static int nl80211_send_scan_donemsg(struct sk_buff *msg,
3262                                     struct cfg80211_registered_device *rdev,
3263                                     struct net_device *netdev,
3264                                     u32 pid, u32 seq, int flags,
3265                                     u32 cmd)
3266 {
3267         void *hdr;
3268
3269         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
3270         if (!hdr)
3271                 return -1;
3272
3273         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3274         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3275
3276         /* XXX: we should probably bounce back the request? */
3277
3278         return genlmsg_end(msg, hdr);
3279
3280  nla_put_failure:
3281         genlmsg_cancel(msg, hdr);
3282         return -EMSGSIZE;
3283 }
3284
3285 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
3286                             struct net_device *netdev)
3287 {
3288         struct sk_buff *msg;
3289
3290         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3291         if (!msg)
3292                 return;
3293
3294         if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
3295                                       NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
3296                 nlmsg_free(msg);
3297                 return;
3298         }
3299
3300         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
3301 }
3302
3303 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
3304                                struct net_device *netdev)
3305 {
3306         struct sk_buff *msg;
3307
3308         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3309         if (!msg)
3310                 return;
3311
3312         if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
3313                                       NL80211_CMD_SCAN_ABORTED) < 0) {
3314                 nlmsg_free(msg);
3315                 return;
3316         }
3317
3318         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
3319 }
3320
3321 /*
3322  * This can happen on global regulatory changes or device specific settings
3323  * based on custom world regulatory domains.
3324  */
3325 void nl80211_send_reg_change_event(struct regulatory_request *request)
3326 {
3327         struct sk_buff *msg;
3328         void *hdr;
3329
3330         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3331         if (!msg)
3332                 return;
3333
3334         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
3335         if (!hdr) {
3336                 nlmsg_free(msg);
3337                 return;
3338         }
3339
3340         /* Userspace can always count this one always being set */
3341         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
3342
3343         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
3344                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3345                            NL80211_REGDOM_TYPE_WORLD);
3346         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
3347                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3348                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
3349         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
3350                  request->intersect)
3351                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3352                            NL80211_REGDOM_TYPE_INTERSECTION);
3353         else {
3354                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3355                            NL80211_REGDOM_TYPE_COUNTRY);
3356                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
3357         }
3358
3359         if (wiphy_idx_valid(request->wiphy_idx))
3360                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
3361
3362         if (genlmsg_end(msg, hdr) < 0) {
3363                 nlmsg_free(msg);
3364                 return;
3365         }
3366
3367         genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_KERNEL);
3368
3369         return;
3370
3371 nla_put_failure:
3372         genlmsg_cancel(msg, hdr);
3373         nlmsg_free(msg);
3374 }
3375
3376 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
3377                                     struct net_device *netdev,
3378                                     const u8 *buf, size_t len,
3379                                     enum nl80211_commands cmd)
3380 {
3381         struct sk_buff *msg;
3382         void *hdr;
3383
3384         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
3385         if (!msg)
3386                 return;
3387
3388         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
3389         if (!hdr) {
3390                 nlmsg_free(msg);
3391                 return;
3392         }
3393
3394         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3395         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3396         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
3397
3398         if (genlmsg_end(msg, hdr) < 0) {
3399                 nlmsg_free(msg);
3400                 return;
3401         }
3402
3403         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_ATOMIC);
3404         return;
3405
3406  nla_put_failure:
3407         genlmsg_cancel(msg, hdr);
3408         nlmsg_free(msg);
3409 }
3410
3411 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
3412                           struct net_device *netdev, const u8 *buf, size_t len)
3413 {
3414         nl80211_send_mlme_event(rdev, netdev, buf, len,
3415                                 NL80211_CMD_AUTHENTICATE);
3416 }
3417
3418 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
3419                            struct net_device *netdev, const u8 *buf,
3420                            size_t len)
3421 {
3422         nl80211_send_mlme_event(rdev, netdev, buf, len, NL80211_CMD_ASSOCIATE);
3423 }
3424
3425 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
3426                          struct net_device *netdev, const u8 *buf, size_t len)
3427 {
3428         nl80211_send_mlme_event(rdev, netdev, buf, len,
3429                                 NL80211_CMD_DEAUTHENTICATE);
3430 }
3431
3432 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
3433                            struct net_device *netdev, const u8 *buf,
3434                            size_t len)
3435 {
3436         nl80211_send_mlme_event(rdev, netdev, buf, len,
3437                                 NL80211_CMD_DISASSOCIATE);
3438 }
3439
3440 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
3441                                  struct net_device *netdev, const u8 *addr,
3442                                  enum nl80211_key_type key_type, int key_id,
3443                                  const u8 *tsc)
3444 {
3445         struct sk_buff *msg;
3446         void *hdr;
3447
3448         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3449         if (!msg)
3450                 return;
3451
3452         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
3453         if (!hdr) {
3454                 nlmsg_free(msg);
3455                 return;
3456         }
3457
3458         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3459         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3460         if (addr)
3461                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3462         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
3463         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
3464         if (tsc)
3465                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
3466
3467         if (genlmsg_end(msg, hdr) < 0) {
3468                 nlmsg_free(msg);
3469                 return;
3470         }
3471
3472         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_KERNEL);
3473         return;
3474
3475  nla_put_failure:
3476         genlmsg_cancel(msg, hdr);
3477         nlmsg_free(msg);
3478 }
3479
3480 /* initialisation/exit functions */
3481
3482 int nl80211_init(void)
3483 {
3484         int err, i;
3485
3486         err = genl_register_family(&nl80211_fam);
3487         if (err)
3488                 return err;
3489
3490         for (i = 0; i < ARRAY_SIZE(nl80211_ops); i++) {
3491                 err = genl_register_ops(&nl80211_fam, &nl80211_ops[i]);
3492                 if (err)
3493                         goto err_out;
3494         }
3495
3496         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
3497         if (err)
3498                 goto err_out;
3499
3500         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
3501         if (err)
3502                 goto err_out;
3503
3504         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
3505         if (err)
3506                 goto err_out;
3507
3508         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
3509         if (err)
3510                 goto err_out;
3511
3512         return 0;
3513  err_out:
3514         genl_unregister_family(&nl80211_fam);
3515         return err;
3516 }
3517
3518 void nl80211_exit(void)
3519 {
3520         genl_unregister_family(&nl80211_fam);
3521 }