net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2009  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/list.h>
  11 #include <linux/if_ether.h>
  12 #include <linux/ieee80211.h>
  13 #include <linux/nl80211.h>
  14 #include <linux/rtnetlink.h>
  15 #include <linux/netlink.h>
  16 #include <linux/etherdevice.h>
  17 #include <net/genetlink.h>
  18 #include <net/cfg80211.h>
  19 #include "core.h"
  20 #include "nl80211.h"
  21 #include "reg.h"
  22
  23 /* the netlink family */
  24 static struct genl_family nl80211_fam = {
  25         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  26         .name = "nl80211",      /* have users key off the name instead */
  27         .hdrsize = 0,           /* no private header */
  28         .version = 1,           /* no particular meaning now */
  29         .maxattr = NL80211_ATTR_MAX,
  30 };
  31
  32 /* internal helper: get drv and dev */
  33 static int get_drv_dev_by_info_ifindex(struct nlattr **attrs,
  34                                        struct cfg80211_registered_device **drv,
  35                                        struct net_device **dev)
  36 {
  37         int ifindex;
  38
  39         if (!attrs[NL80211_ATTR_IFINDEX])
  40                 return -EINVAL;
  41
  42         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  43         *dev = dev_get_by_index(&init_net, ifindex);
  44         if (!*dev)
  45                 return -ENODEV;
  46
  47         *drv = cfg80211_get_dev_from_ifindex(ifindex);
  48         if (IS_ERR(*drv)) {
  49                 dev_put(*dev);
  50                 return PTR_ERR(*drv);
  51         }
  52
  53         return 0;
  54 }
  55
  56 /* policy for the attributes */
  57 static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
  58         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  59         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  60                                       .len = 20-1 },
  61         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  62         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  63         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  64         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
  65         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
  66         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
  67         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
  68
  69         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  70         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  71         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  72
  73         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  74
  75         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  76                                     .len = WLAN_MAX_KEY_LEN },
  77         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  78         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  79         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
  80         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
  81
  82         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
  83         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
  84         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
  85                                        .len = IEEE80211_MAX_DATA_LEN },
  86         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
  87                                        .len = IEEE80211_MAX_DATA_LEN },
  88         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
  89         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
  90         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
  91         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
  92                                                .len = NL80211_MAX_SUPP_RATES },
  93         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
  94         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
  95         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
  96         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
  97                                 .len = IEEE80211_MAX_MESH_ID_LEN },
  98         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
  99
 100         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 101         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 102
 103         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 104         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 105         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 106         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 107                                            .len = NL80211_MAX_SUPP_RATES },
 108
 109         [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
 110
 111         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 112                                          .len = NL80211_HT_CAPABILITY_LEN },
 113
 114         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 115         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 116                               .len = IEEE80211_MAX_DATA_LEN },
 117         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 118         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 119
 120         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 121                                 .len = IEEE80211_MAX_SSID_LEN },
 122         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 123         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 124         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 125         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 126         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 127         [NL80211_ATTR_STA_FLAGS2] = {
 128                 .len = sizeof(struct nl80211_sta_flag_update),
 129         },
 130         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 131 };
 132
 133 /* IE validation */
 134 static bool is_valid_ie_attr(const struct nlattr *attr)
 135 {
 136         const u8 *pos;
 137         int len;
 138
 139         if (!attr)
 140                 return true;
 141
 142         pos = nla_data(attr);
 143         len = nla_len(attr);
 144
 145         while (len) {
 146                 u8 elemlen;
 147
 148                 if (len < 2)
 149                         return false;
 150                 len -= 2;
 151
 152                 elemlen = pos[1];
 153                 if (elemlen > len)
 154                         return false;
 155
 156                 len -= elemlen;
 157                 pos += 2 + elemlen;
 158         }
 159
 160         return true;
 161 }
 162
 163 /* message building helper */
 164 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 165                                    int flags, u8 cmd)
 166 {
 167         /* since there is no private header just add the generic one */
 168         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 169 }
 170
 171 static int nl80211_msg_put_channel(struct sk_buff *msg,
 172                                    struct ieee80211_channel *chan)
 173 {
 174         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 175                     chan->center_freq);
 176
 177         if (chan->flags & IEEE80211_CHAN_DISABLED)
 178                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 179         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 180                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 181         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 182                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 183         if (chan->flags & IEEE80211_CHAN_RADAR)
 184                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 185
 186         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 187                     DBM_TO_MBM(chan->max_power));
 188
 189         return 0;
 190
 191  nla_put_failure:
 192         return -ENOBUFS;
 193 }
 194
 195 /* netlink command implementations */
 196
 197 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 198                               struct cfg80211_registered_device *dev)
 199 {
 200         void *hdr;
 201         struct nlattr *nl_bands, *nl_band;
 202         struct nlattr *nl_freqs, *nl_freq;
 203         struct nlattr *nl_rates, *nl_rate;
 204         struct nlattr *nl_modes;
 205         struct nlattr *nl_cmds;
 206         enum ieee80211_band band;
 207         struct ieee80211_channel *chan;
 208         struct ieee80211_rate *rate;
 209         int i;
 210         u16 ifmodes = dev->wiphy.interface_modes;
 211
 212         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 213         if (!hdr)
 214                 return -1;
 215
 216         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 217         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 218
 219         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 220                    dev->wiphy.retry_short);
 221         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 222                    dev->wiphy.retry_long);
 223         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 224                     dev->wiphy.frag_threshold);
 225         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 226                     dev->wiphy.rts_threshold);
 227
 228         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 229                    dev->wiphy.max_scan_ssids);
 230         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 231                     dev->wiphy.max_scan_ie_len);
 232
 233         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
 234                 sizeof(u32) * dev->wiphy.n_cipher_suites,
 235                 dev->wiphy.cipher_suites);
 236
 237         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
 238         if (!nl_modes)
 239                 goto nla_put_failure;
 240
 241         i = 0;
 242         while (ifmodes) {
 243                 if (ifmodes & 1)
 244                         NLA_PUT_FLAG(msg, i);
 245                 ifmodes >>= 1;
 246                 i++;
 247         }
 248
 249         nla_nest_end(msg, nl_modes);
 250
 251         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 252         if (!nl_bands)
 253                 goto nla_put_failure;
 254
 255         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 256                 if (!dev->wiphy.bands[band])
 257                         continue;
 258
 259                 nl_band = nla_nest_start(msg, band);
 260                 if (!nl_band)
 261                         goto nla_put_failure;
 262
 263                 /* add HT info */
 264                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 265                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 266                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 267                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 268                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 269                                 dev->wiphy.bands[band]->ht_cap.cap);
 270                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 271                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 272                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 273                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 274                 }
 275
 276                 /* add frequencies */
 277                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 278                 if (!nl_freqs)
 279                         goto nla_put_failure;
 280
 281                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 282                         nl_freq = nla_nest_start(msg, i);
 283                         if (!nl_freq)
 284                                 goto nla_put_failure;
 285
 286                         chan = &dev->wiphy.bands[band]->channels[i];
 287
 288                         if (nl80211_msg_put_channel(msg, chan))
 289                                 goto nla_put_failure;
 290
 291                         nla_nest_end(msg, nl_freq);
 292                 }
 293
 294                 nla_nest_end(msg, nl_freqs);
 295
 296                 /* add bitrates */
 297                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 298                 if (!nl_rates)
 299                         goto nla_put_failure;
 300
 301                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 302                         nl_rate = nla_nest_start(msg, i);
 303                         if (!nl_rate)
 304                                 goto nla_put_failure;
 305
 306                         rate = &dev->wiphy.bands[band]->bitrates[i];
 307                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 308                                     rate->bitrate);
 309                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 310                                 NLA_PUT_FLAG(msg,
 311                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 312
 313                         nla_nest_end(msg, nl_rate);
 314                 }
 315
 316                 nla_nest_end(msg, nl_rates);
 317
 318                 nla_nest_end(msg, nl_band);
 319         }
 320         nla_nest_end(msg, nl_bands);
 321
 322         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 323         if (!nl_cmds)
 324                 goto nla_put_failure;
 325
 326         i = 0;
 327 #define CMD(op, n)                                              \
 328          do {                                                   \
 329                 if (dev->ops->op) {                             \
 330                         i++;                                    \
 331                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 332                 }                                               \
 333         } while (0)
 334
 335         CMD(add_virtual_intf, NEW_INTERFACE);
 336         CMD(change_virtual_intf, SET_INTERFACE);
 337         CMD(add_key, NEW_KEY);
 338         CMD(add_beacon, NEW_BEACON);
 339         CMD(add_station, NEW_STATION);
 340         CMD(add_mpath, NEW_MPATH);
 341         CMD(set_mesh_params, SET_MESH_PARAMS);
 342         CMD(change_bss, SET_BSS);
 343         CMD(auth, AUTHENTICATE);
 344         CMD(assoc, ASSOCIATE);
 345         CMD(deauth, DEAUTHENTICATE);
 346         CMD(disassoc, DISASSOCIATE);
 347         CMD(join_ibss, JOIN_IBSS);
 348
 349 #undef CMD
 350         nla_nest_end(msg, nl_cmds);
 351
 352         return genlmsg_end(msg, hdr);
 353
 354  nla_put_failure:
 355         genlmsg_cancel(msg, hdr);
 356         return -EMSGSIZE;
 357 }
 358
 359 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 360 {
 361         int idx = 0;
 362         int start = cb->args[0];
 363         struct cfg80211_registered_device *dev;
 364
 365         mutex_lock(&cfg80211_mutex);
 366         list_for_each_entry(dev, &cfg80211_drv_list, list) {
 367                 if (++idx <= start)
 368                         continue;
 369                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
 370                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
 371                                        dev) < 0) {
 372                         idx--;
 373                         break;
 374                 }
 375         }
 376         mutex_unlock(&cfg80211_mutex);
 377
 378         cb->args[0] = idx;
 379
 380         return skb->len;
 381 }
 382
 383 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 384 {
 385         struct sk_buff *msg;
 386         struct cfg80211_registered_device *dev;
 387
 388         dev = cfg80211_get_dev_from_info(info);
 389         if (IS_ERR(dev))
 390                 return PTR_ERR(dev);
 391
 392         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 393         if (!msg)
 394                 goto out_err;
 395
 396         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
 397                 goto out_free;
 398
 399         cfg80211_put_dev(dev);
 400
 401         return genlmsg_unicast(msg, info->snd_pid);
 402
 403  out_free:
 404         nlmsg_free(msg);
 405  out_err:
 406         cfg80211_put_dev(dev);
 407         return -ENOBUFS;
 408 }
 409
 410 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 411         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
 412         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
 413         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
 414         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
 415         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
 416 };
 417
 418 static int parse_txq_params(struct nlattr *tb[],
 419                             struct ieee80211_txq_params *txq_params)
 420 {
 421         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 422             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 423             !tb[NL80211_TXQ_ATTR_AIFS])
 424                 return -EINVAL;
 425
 426         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
 427         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 428         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 429         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 430         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 431
 432         return 0;
 433 }
 434
 435 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 436 {
 437         struct cfg80211_registered_device *rdev;
 438         int result = 0, rem_txq_params = 0;
 439         struct nlattr *nl_txq_params;
 440         u32 changed;
 441         u8 retry_short = 0, retry_long = 0;
 442         u32 frag_threshold = 0, rts_threshold = 0;
 443
 444         rtnl_lock();
 445
 446         mutex_lock(&cfg80211_mutex);
 447
 448         rdev = __cfg80211_drv_from_info(info);
 449         if (IS_ERR(rdev)) {
 450                 mutex_unlock(&cfg80211_mutex);
 451                 result = PTR_ERR(rdev);
 452                 goto unlock;
 453         }
 454
 455         mutex_lock(&rdev->mtx);
 456
 457         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
 458                 result = cfg80211_dev_rename(
 459                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 460
 461         mutex_unlock(&cfg80211_mutex);
 462
 463         if (result)
 464                 goto bad_res;
 465
 466         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
 467                 struct ieee80211_txq_params txq_params;
 468                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
 469
 470                 if (!rdev->ops->set_txq_params) {
 471                         result = -EOPNOTSUPP;
 472                         goto bad_res;
 473                 }
 474
 475                 nla_for_each_nested(nl_txq_params,
 476                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
 477                                     rem_txq_params) {
 478                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
 479                                   nla_data(nl_txq_params),
 480                                   nla_len(nl_txq_params),
 481                                   txq_params_policy);
 482                         result = parse_txq_params(tb, &txq_params);
 483                         if (result)
 484                                 goto bad_res;
 485
 486                         result = rdev->ops->set_txq_params(&rdev->wiphy,
 487                                                            &txq_params);
 488                         if (result)
 489                                 goto bad_res;
 490                 }
 491         }
 492
 493         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
 494                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 495                 struct ieee80211_channel *chan;
 496                 struct ieee80211_sta_ht_cap *ht_cap;
 497                 u32 freq;
 498
 499                 if (!rdev->ops->set_channel) {
 500                         result = -EOPNOTSUPP;
 501                         goto bad_res;
 502                 }
 503
 504                 result = -EINVAL;
 505
 506                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 507                         channel_type = nla_get_u32(info->attrs[
 508                                            NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 509                         if (channel_type != NL80211_CHAN_NO_HT &&
 510                             channel_type != NL80211_CHAN_HT20 &&
 511                             channel_type != NL80211_CHAN_HT40PLUS &&
 512                             channel_type != NL80211_CHAN_HT40MINUS)
 513                                 goto bad_res;
 514                 }
 515
 516                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 517                 chan = ieee80211_get_channel(&rdev->wiphy, freq);
 518
 519                 /* Primary channel not allowed */
 520                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 521                         goto bad_res;
 522
 523                 if (channel_type == NL80211_CHAN_HT40MINUS &&
 524                     (chan->flags & IEEE80211_CHAN_NO_HT40MINUS))
 525                         goto bad_res;
 526                 else if (channel_type == NL80211_CHAN_HT40PLUS &&
 527                          (chan->flags & IEEE80211_CHAN_NO_HT40PLUS))
 528                         goto bad_res;
 529
 530                 /*
 531                  * At this point we know if that if HT40 was requested
 532                  * we are allowed to use it and the extension channel
 533                  * exists.
 534                  */
 535
 536                 ht_cap = &rdev->wiphy.bands[chan->band]->ht_cap;
 537
 538                 /* no HT capabilities or intolerant */
 539                 if (channel_type != NL80211_CHAN_NO_HT) {
 540                         if (!ht_cap->ht_supported)
 541                                 goto bad_res;
 542                         if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
 543                             (ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT))
 544                                 goto bad_res;
 545                 }
 546
 547                 result = rdev->ops->set_channel(&rdev->wiphy, chan,
 548                                                 channel_type);
 549                 if (result)
 550                         goto bad_res;
 551         }
 552
 553         changed = 0;
 554
 555         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
 556                 retry_short = nla_get_u8(
 557                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
 558                 if (retry_short == 0) {
 559                         result = -EINVAL;
 560                         goto bad_res;
 561                 }
 562                 changed |= WIPHY_PARAM_RETRY_SHORT;
 563         }
 564
 565         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
 566                 retry_long = nla_get_u8(
 567                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
 568                 if (retry_long == 0) {
 569                         result = -EINVAL;
 570                         goto bad_res;
 571                 }
 572                 changed |= WIPHY_PARAM_RETRY_LONG;
 573         }
 574
 575         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
 576                 frag_threshold = nla_get_u32(
 577                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
 578                 if (frag_threshold < 256) {
 579                         result = -EINVAL;
 580                         goto bad_res;
 581                 }
 582                 if (frag_threshold != (u32) -1) {
 583                         /*
 584                          * Fragments (apart from the last one) are required to
 585                          * have even length. Make the fragmentation code
 586                          * simpler by stripping LSB should someone try to use
 587                          * odd threshold value.
 588                          */
 589                         frag_threshold &= ~0x1;
 590                 }
 591                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
 592         }
 593
 594         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
 595                 rts_threshold = nla_get_u32(
 596                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
 597                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
 598         }
 599
 600         if (changed) {
 601                 u8 old_retry_short, old_retry_long;
 602                 u32 old_frag_threshold, old_rts_threshold;
 603
 604                 if (!rdev->ops->set_wiphy_params) {
 605                         result = -EOPNOTSUPP;
 606                         goto bad_res;
 607                 }
 608
 609                 old_retry_short = rdev->wiphy.retry_short;
 610                 old_retry_long = rdev->wiphy.retry_long;
 611                 old_frag_threshold = rdev->wiphy.frag_threshold;
 612                 old_rts_threshold = rdev->wiphy.rts_threshold;
 613
 614                 if (changed & WIPHY_PARAM_RETRY_SHORT)
 615                         rdev->wiphy.retry_short = retry_short;
 616                 if (changed & WIPHY_PARAM_RETRY_LONG)
 617                         rdev->wiphy.retry_long = retry_long;
 618                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
 619                         rdev->wiphy.frag_threshold = frag_threshold;
 620                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
 621                         rdev->wiphy.rts_threshold = rts_threshold;
 622
 623                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
 624                 if (result) {
 625                         rdev->wiphy.retry_short = old_retry_short;
 626                         rdev->wiphy.retry_long = old_retry_long;
 627                         rdev->wiphy.frag_threshold = old_frag_threshold;
 628                         rdev->wiphy.rts_threshold = old_rts_threshold;
 629                 }
 630         }
 631
 632  bad_res:
 633         mutex_unlock(&rdev->mtx);
 634  unlock:
 635         rtnl_unlock();
 636         return result;
 637 }
 638
 639
 640 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 641                               struct cfg80211_registered_device *rdev,
 642                               struct net_device *dev)
 643 {
 644         void *hdr;
 645
 646         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
 647         if (!hdr)
 648                 return -1;
 649
 650         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 651         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 652         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
 653         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
 654         return genlmsg_end(msg, hdr);
 655
 656  nla_put_failure:
 657         genlmsg_cancel(msg, hdr);
 658         return -EMSGSIZE;
 659 }
 660
 661 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
 662 {
 663         int wp_idx = 0;
 664         int if_idx = 0;
 665         int wp_start = cb->args[0];
 666         int if_start = cb->args[1];
 667         struct cfg80211_registered_device *dev;
 668         struct wireless_dev *wdev;
 669
 670         mutex_lock(&cfg80211_mutex);
 671         list_for_each_entry(dev, &cfg80211_drv_list, list) {
 672                 if (wp_idx < wp_start) {
 673                         wp_idx++;
 674                         continue;
 675                 }
 676                 if_idx = 0;
 677
 678                 mutex_lock(&dev->devlist_mtx);
 679                 list_for_each_entry(wdev, &dev->netdev_list, list) {
 680                         if (if_idx < if_start) {
 681                                 if_idx++;
 682                                 continue;
 683                         }
 684                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
 685                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
 686                                                dev, wdev->netdev) < 0) {
 687                                 mutex_unlock(&dev->devlist_mtx);
 688                                 goto out;
 689                         }
 690                         if_idx++;
 691                 }
 692                 mutex_unlock(&dev->devlist_mtx);
 693
 694                 wp_idx++;
 695         }
 696  out:
 697         mutex_unlock(&cfg80211_mutex);
 698
 699         cb->args[0] = wp_idx;
 700         cb->args[1] = if_idx;
 701
 702         return skb->len;
 703 }
 704
 705 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
 706 {
 707         struct sk_buff *msg;
 708         struct cfg80211_registered_device *dev;
 709         struct net_device *netdev;
 710         int err;
 711
 712         err = get_drv_dev_by_info_ifindex(info->attrs, &dev, &netdev);
 713         if (err)
 714                 return err;
 715
 716         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 717         if (!msg)
 718                 goto out_err;
 719
 720         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
 721                                dev, netdev) < 0)
 722                 goto out_free;
 723
 724         dev_put(netdev);
 725         cfg80211_put_dev(dev);
 726
 727         return genlmsg_unicast(msg, info->snd_pid);
 728
 729  out_free:
 730         nlmsg_free(msg);
 731  out_err:
 732         dev_put(netdev);
 733         cfg80211_put_dev(dev);
 734         return -ENOBUFS;
 735 }
 736
 737 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
 738         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
 739         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
 740         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
 741         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
 742         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
 743 };
 744
 745 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
 746 {
 747         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
 748         int flag;
 749
 750         *mntrflags = 0;
 751
 752         if (!nla)
 753                 return -EINVAL;
 754
 755         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
 756                              nla, mntr_flags_policy))
 757                 return -EINVAL;
 758
 759         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
 760                 if (flags[flag])
 761                         *mntrflags |= (1<<flag);
 762
 763         return 0;
 764 }
 765
 766 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 767 {
 768         struct cfg80211_registered_device *drv;
 769         struct vif_params params;
 770         int err, ifindex;
 771         enum nl80211_iftype otype, ntype;
 772         struct net_device *dev;
 773         u32 _flags, *flags = NULL;
 774         bool change = false;
 775
 776         memset(&params, 0, sizeof(params));
 777
 778         rtnl_lock();
 779
 780         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 781         if (err)
 782                 goto unlock_rtnl;
 783
 784         ifindex = dev->ifindex;
 785         otype = ntype = dev->ieee80211_ptr->iftype;
 786         dev_put(dev);
 787
 788         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 789                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 790                 if (otype != ntype)
 791                         change = true;
 792                 if (ntype > NL80211_IFTYPE_MAX) {
 793                         err = -EINVAL;
 794                         goto unlock;
 795                 }
 796         }
 797
 798         if (!drv->ops->change_virtual_intf ||
 799             !(drv->wiphy.interface_modes & (1 << ntype))) {
 800                 err = -EOPNOTSUPP;
 801                 goto unlock;
 802         }
 803
 804         if (info->attrs[NL80211_ATTR_MESH_ID]) {
 805                 if (ntype != NL80211_IFTYPE_MESH_POINT) {
 806                         err = -EINVAL;
 807                         goto unlock;
 808                 }
 809                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 810                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 811                 change = true;
 812         }
 813
 814         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
 815                 if (ntype != NL80211_IFTYPE_MONITOR) {
 816                         err = -EINVAL;
 817                         goto unlock;
 818                 }
 819                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
 820                                           &_flags);
 821                 if (err)
 822                         goto unlock;
 823
 824                 flags = &_flags;
 825                 change = true;
 826         }
 827
 828         if (change)
 829                 err = drv->ops->change_virtual_intf(&drv->wiphy, ifindex,
 830                                                     ntype, flags, &params);
 831         else
 832                 err = 0;
 833
 834         dev = __dev_get_by_index(&init_net, ifindex);
 835         WARN_ON(!dev || (!err && dev->ieee80211_ptr->iftype != ntype));
 836
 837         if (dev && !err && (ntype != otype)) {
 838                 if (otype == NL80211_IFTYPE_ADHOC)
 839                         cfg80211_clear_ibss(dev, false);
 840         }
 841
 842  unlock:
 843         cfg80211_put_dev(drv);
 844  unlock_rtnl:
 845         rtnl_unlock();
 846         return err;
 847 }
 848
 849 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
 850 {
 851         struct cfg80211_registered_device *drv;
 852         struct vif_params params;
 853         int err;
 854         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
 855         u32 flags;
 856
 857         memset(&params, 0, sizeof(params));
 858
 859         if (!info->attrs[NL80211_ATTR_IFNAME])
 860                 return -EINVAL;
 861
 862         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 863                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 864                 if (type > NL80211_IFTYPE_MAX)
 865                         return -EINVAL;
 866         }
 867
 868         rtnl_lock();
 869
 870         drv = cfg80211_get_dev_from_info(info);
 871         if (IS_ERR(drv)) {
 872                 err = PTR_ERR(drv);
 873                 goto unlock_rtnl;
 874         }
 875
 876         if (!drv->ops->add_virtual_intf ||
 877             !(drv->wiphy.interface_modes & (1 << type))) {
 878                 err = -EOPNOTSUPP;
 879                 goto unlock;
 880         }
 881
 882         if (type == NL80211_IFTYPE_MESH_POINT &&
 883             info->attrs[NL80211_ATTR_MESH_ID]) {
 884                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 885                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 886         }
 887
 888         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
 889                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
 890                                   &flags);
 891         err = drv->ops->add_virtual_intf(&drv->wiphy,
 892                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
 893                 type, err ? NULL : &flags, &params);
 894
 895  unlock:
 896         cfg80211_put_dev(drv);
 897  unlock_rtnl:
 898         rtnl_unlock();
 899         return err;
 900 }
 901
 902 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
 903 {
 904         struct cfg80211_registered_device *drv;
 905         int ifindex, err;
 906         struct net_device *dev;
 907
 908         rtnl_lock();
 909
 910         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 911         if (err)
 912                 goto unlock_rtnl;
 913         ifindex = dev->ifindex;
 914         dev_put(dev);
 915
 916         if (!drv->ops->del_virtual_intf) {
 917                 err = -EOPNOTSUPP;
 918                 goto out;
 919         }
 920
 921         err = drv->ops->del_virtual_intf(&drv->wiphy, ifindex);
 922
 923  out:
 924         cfg80211_put_dev(drv);
 925  unlock_rtnl:
 926         rtnl_unlock();
 927         return err;
 928 }
 929
 930 struct get_key_cookie {
 931         struct sk_buff *msg;
 932         int error;
 933 };
 934
 935 static void get_key_callback(void *c, struct key_params *params)
 936 {
 937         struct get_key_cookie *cookie = c;
 938
 939         if (params->key)
 940                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
 941                         params->key_len, params->key);
 942
 943         if (params->seq)
 944                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
 945                         params->seq_len, params->seq);
 946
 947         if (params->cipher)
 948                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
 949                             params->cipher);
 950
 951         return;
 952  nla_put_failure:
 953         cookie->error = 1;
 954 }
 955
 956 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
 957 {
 958         struct cfg80211_registered_device *drv;
 959         int err;
 960         struct net_device *dev;
 961         u8 key_idx = 0;
 962         u8 *mac_addr = NULL;
 963         struct get_key_cookie cookie = {
 964                 .error = 0,
 965         };
 966         void *hdr;
 967         struct sk_buff *msg;
 968
 969         if (info->attrs[NL80211_ATTR_KEY_IDX])
 970                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 971
 972         if (key_idx > 5)
 973                 return -EINVAL;
 974
 975         if (info->attrs[NL80211_ATTR_MAC])
 976                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 977
 978         rtnl_lock();
 979
 980         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 981         if (err)
 982                 goto unlock_rtnl;
 983
 984         if (!drv->ops->get_key) {
 985                 err = -EOPNOTSUPP;
 986                 goto out;
 987         }
 988
 989         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 990         if (!msg) {
 991                 err = -ENOMEM;
 992                 goto out;
 993         }
 994
 995         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
 996                              NL80211_CMD_NEW_KEY);
 997
 998         if (IS_ERR(hdr)) {
 999                 err = PTR_ERR(hdr);
1000                 goto free_msg;
1001         }
1002
1003         cookie.msg = msg;
1004
1005         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1006         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1007         if (mac_addr)
1008                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1009
1010         err = drv->ops->get_key(&drv->wiphy, dev, key_idx, mac_addr,
1011                                 &cookie, get_key_callback);
1012
1013         if (err)
1014                 goto free_msg;
1015
1016         if (cookie.error)
1017                 goto nla_put_failure;
1018
1019         genlmsg_end(msg, hdr);
1020         err = genlmsg_unicast(msg, info->snd_pid);
1021         goto out;
1022
1023  nla_put_failure:
1024         err = -ENOBUFS;
1025  free_msg:
1026         nlmsg_free(msg);
1027  out:
1028         cfg80211_put_dev(drv);
1029         dev_put(dev);
1030  unlock_rtnl:
1031         rtnl_unlock();
1032
1033         return err;
1034 }
1035
1036 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1037 {
1038         struct cfg80211_registered_device *drv;
1039         int err;
1040         struct net_device *dev;
1041         u8 key_idx;
1042         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
1043                     u8 key_index);
1044
1045         if (!info->attrs[NL80211_ATTR_KEY_IDX])
1046                 return -EINVAL;
1047
1048         key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1049
1050         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]) {
1051                 if (key_idx < 4 || key_idx > 5)
1052                         return -EINVAL;
1053         } else if (key_idx > 3)
1054                 return -EINVAL;
1055
1056         /* currently only support setting default key */
1057         if (!info->attrs[NL80211_ATTR_KEY_DEFAULT] &&
1058             !info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT])
1059                 return -EINVAL;
1060
1061         rtnl_lock();
1062
1063         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1064         if (err)
1065                 goto unlock_rtnl;
1066
1067         if (info->attrs[NL80211_ATTR_KEY_DEFAULT])
1068                 func = drv->ops->set_default_key;
1069         else
1070                 func = drv->ops->set_default_mgmt_key;
1071
1072         if (!func) {
1073                 err = -EOPNOTSUPP;
1074                 goto out;
1075         }
1076
1077         err = func(&drv->wiphy, dev, key_idx);
1078 #ifdef CONFIG_WIRELESS_EXT
1079         if (!err) {
1080                 if (func == drv->ops->set_default_key)
1081                         dev->ieee80211_ptr->wext.default_key = key_idx;
1082                 else
1083                         dev->ieee80211_ptr->wext.default_mgmt_key = key_idx;
1084         }
1085 #endif
1086
1087  out:
1088         cfg80211_put_dev(drv);
1089         dev_put(dev);
1090
1091  unlock_rtnl:
1092         rtnl_unlock();
1093
1094         return err;
1095 }
1096
1097 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1098 {
1099         struct cfg80211_registered_device *drv;
1100         int err, i;
1101         struct net_device *dev;
1102         struct key_params params;
1103         u8 key_idx = 0;
1104         u8 *mac_addr = NULL;
1105
1106         memset(&params, 0, sizeof(params));
1107
1108         if (!info->attrs[NL80211_ATTR_KEY_CIPHER])
1109                 return -EINVAL;
1110
1111         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1112                 params.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1113                 params.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1114         }
1115
1116         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
1117                 params.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
1118                 params.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
1119         }
1120
1121         if (info->attrs[NL80211_ATTR_KEY_IDX])
1122                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1123
1124         params.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1125
1126         if (info->attrs[NL80211_ATTR_MAC])
1127                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1128
1129         if (cfg80211_validate_key_settings(&params, key_idx, mac_addr))
1130                 return -EINVAL;
1131
1132         rtnl_lock();
1133
1134         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1135         if (err)
1136                 goto unlock_rtnl;
1137
1138         for (i = 0; i < drv->wiphy.n_cipher_suites; i++)
1139                 if (params.cipher == drv->wiphy.cipher_suites[i])
1140                         break;
1141         if (i == drv->wiphy.n_cipher_suites) {
1142                 err = -EINVAL;
1143                 goto out;
1144         }
1145
1146         if (!drv->ops->add_key) {
1147                 err = -EOPNOTSUPP;
1148                 goto out;
1149         }
1150
1151         err = drv->ops->add_key(&drv->wiphy, dev, key_idx, mac_addr, &params);
1152
1153  out:
1154         cfg80211_put_dev(drv);
1155         dev_put(dev);
1156  unlock_rtnl:
1157         rtnl_unlock();
1158
1159         return err;
1160 }
1161
1162 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1163 {
1164         struct cfg80211_registered_device *drv;
1165         int err;
1166         struct net_device *dev;
1167         u8 key_idx = 0;
1168         u8 *mac_addr = NULL;
1169
1170         if (info->attrs[NL80211_ATTR_KEY_IDX])
1171                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1172
1173         if (key_idx > 5)
1174                 return -EINVAL;
1175
1176         if (info->attrs[NL80211_ATTR_MAC])
1177                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1178
1179         rtnl_lock();
1180
1181         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1182         if (err)
1183                 goto unlock_rtnl;
1184
1185         if (!drv->ops->del_key) {
1186                 err = -EOPNOTSUPP;
1187                 goto out;
1188         }
1189
1190         err = drv->ops->del_key(&drv->wiphy, dev, key_idx, mac_addr);
1191
1192 #ifdef CONFIG_WIRELESS_EXT
1193         if (!err) {
1194                 if (key_idx == dev->ieee80211_ptr->wext.default_key)
1195                         dev->ieee80211_ptr->wext.default_key = -1;
1196                 else if (key_idx == dev->ieee80211_ptr->wext.default_mgmt_key)
1197                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
1198         }
1199 #endif
1200
1201  out:
1202         cfg80211_put_dev(drv);
1203         dev_put(dev);
1204
1205  unlock_rtnl:
1206         rtnl_unlock();
1207
1208         return err;
1209 }
1210
1211 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1212 {
1213         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1214                     struct beacon_parameters *info);
1215         struct cfg80211_registered_device *drv;
1216         int err;
1217         struct net_device *dev;
1218         struct beacon_parameters params;
1219         int haveinfo = 0;
1220
1221         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
1222                 return -EINVAL;
1223
1224         rtnl_lock();
1225
1226         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1227         if (err)
1228                 goto unlock_rtnl;
1229
1230         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1231                 err = -EOPNOTSUPP;
1232                 goto out;
1233         }
1234
1235         switch (info->genlhdr->cmd) {
1236         case NL80211_CMD_NEW_BEACON:
1237                 /* these are required for NEW_BEACON */
1238                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1239                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1240                     !info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1241                         err = -EINVAL;
1242                         goto out;
1243                 }
1244
1245                 call = drv->ops->add_beacon;
1246                 break;
1247         case NL80211_CMD_SET_BEACON:
1248                 call = drv->ops->set_beacon;
1249                 break;
1250         default:
1251                 WARN_ON(1);
1252                 err = -EOPNOTSUPP;
1253                 goto out;
1254         }
1255
1256         if (!call) {
1257                 err = -EOPNOTSUPP;
1258                 goto out;
1259         }
1260
1261         memset(&params, 0, sizeof(params));
1262
1263         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1264                 params.interval =
1265                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1266                 haveinfo = 1;
1267         }
1268
1269         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1270                 params.dtim_period =
1271                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1272                 haveinfo = 1;
1273         }
1274
1275         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1276                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1277                 params.head_len =
1278                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1279                 haveinfo = 1;
1280         }
1281
1282         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1283                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1284                 params.tail_len =
1285                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1286                 haveinfo = 1;
1287         }
1288
1289         if (!haveinfo) {
1290                 err = -EINVAL;
1291                 goto out;
1292         }
1293
1294         err = call(&drv->wiphy, dev, &params);
1295
1296  out:
1297         cfg80211_put_dev(drv);
1298         dev_put(dev);
1299  unlock_rtnl:
1300         rtnl_unlock();
1301
1302         return err;
1303 }
1304
1305 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1306 {
1307         struct cfg80211_registered_device *drv;
1308         int err;
1309         struct net_device *dev;
1310
1311         rtnl_lock();
1312
1313         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1314         if (err)
1315                 goto unlock_rtnl;
1316
1317         if (!drv->ops->del_beacon) {
1318                 err = -EOPNOTSUPP;
1319                 goto out;
1320         }
1321
1322         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1323                 err = -EOPNOTSUPP;
1324                 goto out;
1325         }
1326         err = drv->ops->del_beacon(&drv->wiphy, dev);
1327
1328  out:
1329         cfg80211_put_dev(drv);
1330         dev_put(dev);
1331  unlock_rtnl:
1332         rtnl_unlock();
1333
1334         return err;
1335 }
1336
1337 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1338         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1339         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1340         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1341         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
1342 };
1343
1344 static int parse_station_flags(struct genl_info *info,
1345                                struct station_parameters *params)
1346 {
1347         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1348         struct nlattr *nla;
1349         int flag;
1350
1351         /*
1352          * Try parsing the new attribute first so userspace
1353          * can specify both for older kernels.
1354          */
1355         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
1356         if (nla) {
1357                 struct nl80211_sta_flag_update *sta_flags;
1358
1359                 sta_flags = nla_data(nla);
1360                 params->sta_flags_mask = sta_flags->mask;
1361                 params->sta_flags_set = sta_flags->set;
1362                 if ((params->sta_flags_mask |
1363                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
1364                         return -EINVAL;
1365                 return 0;
1366         }
1367
1368         /* if present, parse the old attribute */
1369
1370         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
1371         if (!nla)
1372                 return 0;
1373
1374         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1375                              nla, sta_flags_policy))
1376                 return -EINVAL;
1377
1378         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
1379         params->sta_flags_mask &= ~1;
1380
1381         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1382                 if (flags[flag])
1383                         params->sta_flags_set |= (1<<flag);
1384
1385         return 0;
1386 }
1387
1388 static u16 nl80211_calculate_bitrate(struct rate_info *rate)
1389 {
1390         int modulation, streams, bitrate;
1391
1392         if (!(rate->flags & RATE_INFO_FLAGS_MCS))
1393                 return rate->legacy;
1394
1395         /* the formula below does only work for MCS values smaller than 32 */
1396         if (rate->mcs >= 32)
1397                 return 0;
1398
1399         modulation = rate->mcs & 7;
1400         streams = (rate->mcs >> 3) + 1;
1401
1402         bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
1403                         13500000 : 6500000;
1404
1405         if (modulation < 4)
1406                 bitrate *= (modulation + 1);
1407         else if (modulation == 4)
1408                 bitrate *= (modulation + 2);
1409         else
1410                 bitrate *= (modulation + 3);
1411
1412         bitrate *= streams;
1413
1414         if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
1415                 bitrate = (bitrate / 9) * 10;
1416
1417         /* do NOT round down here */
1418         return (bitrate + 50000) / 100000;
1419 }
1420
1421 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1422                                 int flags, struct net_device *dev,
1423                                 u8 *mac_addr, struct station_info *sinfo)
1424 {
1425         void *hdr;
1426         struct nlattr *sinfoattr, *txrate;
1427         u16 bitrate;
1428
1429         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1430         if (!hdr)
1431                 return -1;
1432
1433         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1434         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1435
1436         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1437         if (!sinfoattr)
1438                 goto nla_put_failure;
1439         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1440                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1441                             sinfo->inactive_time);
1442         if (sinfo->filled & STATION_INFO_RX_BYTES)
1443                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1444                             sinfo->rx_bytes);
1445         if (sinfo->filled & STATION_INFO_TX_BYTES)
1446                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1447                             sinfo->tx_bytes);
1448         if (sinfo->filled & STATION_INFO_LLID)
1449                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1450                             sinfo->llid);
1451         if (sinfo->filled & STATION_INFO_PLID)
1452                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1453                             sinfo->plid);
1454         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1455                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1456                             sinfo->plink_state);
1457         if (sinfo->filled & STATION_INFO_SIGNAL)
1458                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1459                            sinfo->signal);
1460         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1461                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1462                 if (!txrate)
1463                         goto nla_put_failure;
1464
1465                 /* nl80211_calculate_bitrate will return 0 for mcs >= 32 */
1466                 bitrate = nl80211_calculate_bitrate(&sinfo->txrate);
1467                 if (bitrate > 0)
1468                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1469
1470                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1471                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1472                                     sinfo->txrate.mcs);
1473                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1474                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1475                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1476                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1477
1478                 nla_nest_end(msg, txrate);
1479         }
1480         if (sinfo->filled & STATION_INFO_RX_PACKETS)
1481                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
1482                             sinfo->rx_packets);
1483         if (sinfo->filled & STATION_INFO_TX_PACKETS)
1484                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
1485                             sinfo->tx_packets);
1486         nla_nest_end(msg, sinfoattr);
1487
1488         return genlmsg_end(msg, hdr);
1489
1490  nla_put_failure:
1491         genlmsg_cancel(msg, hdr);
1492         return -EMSGSIZE;
1493 }
1494
1495 static int nl80211_dump_station(struct sk_buff *skb,
1496                                 struct netlink_callback *cb)
1497 {
1498         struct station_info sinfo;
1499         struct cfg80211_registered_device *dev;
1500         struct net_device *netdev;
1501         u8 mac_addr[ETH_ALEN];
1502         int ifidx = cb->args[0];
1503         int sta_idx = cb->args[1];
1504         int err;
1505
1506         if (!ifidx) {
1507                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1508                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1509                                   nl80211_policy);
1510                 if (err)
1511                         return err;
1512
1513                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1514                         return -EINVAL;
1515
1516                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1517                 if (!ifidx)
1518                         return -EINVAL;
1519         }
1520
1521         rtnl_lock();
1522
1523         netdev = __dev_get_by_index(&init_net, ifidx);
1524         if (!netdev) {
1525                 err = -ENODEV;
1526                 goto out_rtnl;
1527         }
1528
1529         dev = cfg80211_get_dev_from_ifindex(ifidx);
1530         if (IS_ERR(dev)) {
1531                 err = PTR_ERR(dev);
1532                 goto out_rtnl;
1533         }
1534
1535         if (!dev->ops->dump_station) {
1536                 err = -EOPNOTSUPP;
1537                 goto out_err;
1538         }
1539
1540         while (1) {
1541                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1542                                              mac_addr, &sinfo);
1543                 if (err == -ENOENT)
1544                         break;
1545                 if (err)
1546                         goto out_err;
1547
1548                 if (nl80211_send_station(skb,
1549                                 NETLINK_CB(cb->skb).pid,
1550                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
1551                                 netdev, mac_addr,
1552                                 &sinfo) < 0)
1553                         goto out;
1554
1555                 sta_idx++;
1556         }
1557
1558
1559  out:
1560         cb->args[1] = sta_idx;
1561         err = skb->len;
1562  out_err:
1563         cfg80211_put_dev(dev);
1564  out_rtnl:
1565         rtnl_unlock();
1566
1567         return err;
1568 }
1569
1570 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1571 {
1572         struct cfg80211_registered_device *drv;
1573         int err;
1574         struct net_device *dev;
1575         struct station_info sinfo;
1576         struct sk_buff *msg;
1577         u8 *mac_addr = NULL;
1578
1579         memset(&sinfo, 0, sizeof(sinfo));
1580
1581         if (!info->attrs[NL80211_ATTR_MAC])
1582                 return -EINVAL;
1583
1584         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1585
1586         rtnl_lock();
1587
1588         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1589         if (err)
1590                 goto out_rtnl;
1591
1592         if (!drv->ops->get_station) {
1593                 err = -EOPNOTSUPP;
1594                 goto out;
1595         }
1596
1597         err = drv->ops->get_station(&drv->wiphy, dev, mac_addr, &sinfo);
1598         if (err)
1599                 goto out;
1600
1601         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1602         if (!msg)
1603                 goto out;
1604
1605         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1606                                  dev, mac_addr, &sinfo) < 0)
1607                 goto out_free;
1608
1609         err = genlmsg_unicast(msg, info->snd_pid);
1610         goto out;
1611
1612  out_free:
1613         nlmsg_free(msg);
1614  out:
1615         cfg80211_put_dev(drv);
1616         dev_put(dev);
1617  out_rtnl:
1618         rtnl_unlock();
1619
1620         return err;
1621 }
1622
1623 /*
1624  * Get vlan interface making sure it is on the right wiphy.
1625  */
1626 static int get_vlan(struct nlattr *vlanattr,
1627                     struct cfg80211_registered_device *rdev,
1628                     struct net_device **vlan)
1629 {
1630         *vlan = NULL;
1631
1632         if (vlanattr) {
1633                 *vlan = dev_get_by_index(&init_net, nla_get_u32(vlanattr));
1634                 if (!*vlan)
1635                         return -ENODEV;
1636                 if (!(*vlan)->ieee80211_ptr)
1637                         return -EINVAL;
1638                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
1639                         return -EINVAL;
1640         }
1641         return 0;
1642 }
1643
1644 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
1645 {
1646         struct cfg80211_registered_device *drv;
1647         int err;
1648         struct net_device *dev;
1649         struct station_parameters params;
1650         u8 *mac_addr = NULL;
1651
1652         memset(&params, 0, sizeof(params));
1653
1654         params.listen_interval = -1;
1655
1656         if (info->attrs[NL80211_ATTR_STA_AID])
1657                 return -EINVAL;
1658
1659         if (!info->attrs[NL80211_ATTR_MAC])
1660                 return -EINVAL;
1661
1662         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1663
1664         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
1665                 params.supported_rates =
1666                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1667                 params.supported_rates_len =
1668                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1669         }
1670
1671         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1672                 params.listen_interval =
1673                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1674
1675         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1676                 params.ht_capa =
1677                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1678
1679         if (parse_station_flags(info, &params))
1680                 return -EINVAL;
1681
1682         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
1683                 params.plink_action =
1684                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
1685
1686         rtnl_lock();
1687
1688         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1689         if (err)
1690                 goto out_rtnl;
1691
1692         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1693         if (err)
1694                 goto out;
1695
1696         /* validate settings */
1697         err = 0;
1698
1699         switch (dev->ieee80211_ptr->iftype) {
1700         case NL80211_IFTYPE_AP:
1701         case NL80211_IFTYPE_AP_VLAN:
1702                 /* disallow mesh-specific things */
1703                 if (params.plink_action)
1704                         err = -EINVAL;
1705                 break;
1706         case NL80211_IFTYPE_STATION:
1707                 /* disallow everything but AUTHORIZED flag */
1708                 if (params.plink_action)
1709                         err = -EINVAL;
1710                 if (params.vlan)
1711                         err = -EINVAL;
1712                 if (params.supported_rates)
1713                         err = -EINVAL;
1714                 if (params.ht_capa)
1715                         err = -EINVAL;
1716                 if (params.listen_interval >= 0)
1717                         err = -EINVAL;
1718                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
1719                         err = -EINVAL;
1720                 break;
1721         case NL80211_IFTYPE_MESH_POINT:
1722                 /* disallow things mesh doesn't support */
1723                 if (params.vlan)
1724                         err = -EINVAL;
1725                 if (params.ht_capa)
1726                         err = -EINVAL;
1727                 if (params.listen_interval >= 0)
1728                         err = -EINVAL;
1729                 if (params.supported_rates)
1730                         err = -EINVAL;
1731                 if (params.sta_flags_mask)
1732                         err = -EINVAL;
1733                 break;
1734         default:
1735                 err = -EINVAL;
1736         }
1737
1738         if (err)
1739                 goto out;
1740
1741         if (!drv->ops->change_station) {
1742                 err = -EOPNOTSUPP;
1743                 goto out;
1744         }
1745
1746         err = drv->ops->change_station(&drv->wiphy, dev, mac_addr, &params);
1747
1748  out:
1749         if (params.vlan)
1750                 dev_put(params.vlan);
1751         cfg80211_put_dev(drv);
1752         dev_put(dev);
1753  out_rtnl:
1754         rtnl_unlock();
1755
1756         return err;
1757 }
1758
1759 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
1760 {
1761         struct cfg80211_registered_device *drv;
1762         int err;
1763         struct net_device *dev;
1764         struct station_parameters params;
1765         u8 *mac_addr = NULL;
1766
1767         memset(&params, 0, sizeof(params));
1768
1769         if (!info->attrs[NL80211_ATTR_MAC])
1770                 return -EINVAL;
1771
1772         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1773                 return -EINVAL;
1774
1775         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
1776                 return -EINVAL;
1777
1778         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1779         params.supported_rates =
1780                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1781         params.supported_rates_len =
1782                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1783         params.listen_interval =
1784                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1785
1786         if (info->attrs[NL80211_ATTR_STA_AID]) {
1787                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
1788                 if (!params.aid || params.aid > IEEE80211_MAX_AID)
1789                         return -EINVAL;
1790         }
1791
1792         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1793                 params.ht_capa =
1794                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1795
1796         if (parse_station_flags(info, &params))
1797                 return -EINVAL;
1798
1799         rtnl_lock();
1800
1801         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1802         if (err)
1803                 goto out_rtnl;
1804
1805         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1806         if (err)
1807                 goto out;
1808
1809         /* validate settings */
1810         err = 0;
1811
1812         switch (dev->ieee80211_ptr->iftype) {
1813         case NL80211_IFTYPE_AP:
1814         case NL80211_IFTYPE_AP_VLAN:
1815                 /* all ok but must have AID */
1816                 if (!params.aid)
1817                         err = -EINVAL;
1818                 break;
1819         case NL80211_IFTYPE_MESH_POINT:
1820                 /* disallow things mesh doesn't support */
1821                 if (params.vlan)
1822                         err = -EINVAL;
1823                 if (params.aid)
1824                         err = -EINVAL;
1825                 if (params.ht_capa)
1826                         err = -EINVAL;
1827                 if (params.listen_interval >= 0)
1828                         err = -EINVAL;
1829                 if (params.supported_rates)
1830                         err = -EINVAL;
1831                 if (params.sta_flags_mask)
1832                         err = -EINVAL;
1833                 break;
1834         default:
1835                 err = -EINVAL;
1836         }
1837
1838         if (err)
1839                 goto out;
1840
1841         if (!drv->ops->add_station) {
1842                 err = -EOPNOTSUPP;
1843                 goto out;
1844         }
1845
1846         if (!netif_running(dev)) {
1847                 err = -ENETDOWN;
1848                 goto out;
1849         }
1850
1851         err = drv->ops->add_station(&drv->wiphy, dev, mac_addr, &params);
1852
1853  out:
1854         if (params.vlan)
1855                 dev_put(params.vlan);
1856         cfg80211_put_dev(drv);
1857         dev_put(dev);
1858  out_rtnl:
1859         rtnl_unlock();
1860
1861         return err;
1862 }
1863
1864 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
1865 {
1866         struct cfg80211_registered_device *drv;
1867         int err;
1868         struct net_device *dev;
1869         u8 *mac_addr = NULL;
1870
1871         if (info->attrs[NL80211_ATTR_MAC])
1872                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1873
1874         rtnl_lock();
1875
1876         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1877         if (err)
1878                 goto out_rtnl;
1879
1880         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1881             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
1882             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1883                 err = -EINVAL;
1884                 goto out;
1885         }
1886
1887         if (!drv->ops->del_station) {
1888                 err = -EOPNOTSUPP;
1889                 goto out;
1890         }
1891
1892         err = drv->ops->del_station(&drv->wiphy, dev, mac_addr);
1893
1894  out:
1895         cfg80211_put_dev(drv);
1896         dev_put(dev);
1897  out_rtnl:
1898         rtnl_unlock();
1899
1900         return err;
1901 }
1902
1903 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
1904                                 int flags, struct net_device *dev,
1905                                 u8 *dst, u8 *next_hop,
1906                                 struct mpath_info *pinfo)
1907 {
1908         void *hdr;
1909         struct nlattr *pinfoattr;
1910
1911         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1912         if (!hdr)
1913                 return -1;
1914
1915         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1916         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
1917         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
1918
1919         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
1920         if (!pinfoattr)
1921                 goto nla_put_failure;
1922         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
1923                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
1924                             pinfo->frame_qlen);
1925         if (pinfo->filled & MPATH_INFO_DSN)
1926                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DSN,
1927                             pinfo->dsn);
1928         if (pinfo->filled & MPATH_INFO_METRIC)
1929                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
1930                             pinfo->metric);
1931         if (pinfo->filled & MPATH_INFO_EXPTIME)
1932                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
1933                             pinfo->exptime);
1934         if (pinfo->filled & MPATH_INFO_FLAGS)
1935                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
1936                             pinfo->flags);
1937         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
1938                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
1939                             pinfo->discovery_timeout);
1940         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
1941                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
1942                             pinfo->discovery_retries);
1943
1944         nla_nest_end(msg, pinfoattr);
1945
1946         return genlmsg_end(msg, hdr);
1947
1948  nla_put_failure:
1949         genlmsg_cancel(msg, hdr);
1950         return -EMSGSIZE;
1951 }
1952
1953 static int nl80211_dump_mpath(struct sk_buff *skb,
1954                               struct netlink_callback *cb)
1955 {
1956         struct mpath_info pinfo;
1957         struct cfg80211_registered_device *dev;
1958         struct net_device *netdev;
1959         u8 dst[ETH_ALEN];
1960         u8 next_hop[ETH_ALEN];
1961         int ifidx = cb->args[0];
1962         int path_idx = cb->args[1];
1963         int err;
1964
1965         if (!ifidx) {
1966                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1967                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1968                                   nl80211_policy);
1969                 if (err)
1970                         return err;
1971
1972                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1973                         return -EINVAL;
1974
1975                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1976                 if (!ifidx)
1977                         return -EINVAL;
1978         }
1979
1980         rtnl_lock();
1981
1982         netdev = __dev_get_by_index(&init_net, ifidx);
1983         if (!netdev) {
1984                 err = -ENODEV;
1985                 goto out_rtnl;
1986         }
1987
1988         dev = cfg80211_get_dev_from_ifindex(ifidx);
1989         if (IS_ERR(dev)) {
1990                 err = PTR_ERR(dev);
1991                 goto out_rtnl;
1992         }
1993
1994         if (!dev->ops->dump_mpath) {
1995                 err = -EOPNOTSUPP;
1996                 goto out_err;
1997         }
1998
1999         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2000                 err = -EOPNOTSUPP;
2001                 goto out;
2002         }
2003
2004         while (1) {
2005                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
2006                                            dst, next_hop, &pinfo);
2007                 if (err == -ENOENT)
2008                         break;
2009                 if (err)
2010                         goto out_err;
2011
2012                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
2013                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
2014                                        netdev, dst, next_hop,
2015                                        &pinfo) < 0)
2016                         goto out;
2017
2018                 path_idx++;
2019         }
2020
2021
2022  out:
2023         cb->args[1] = path_idx;
2024         err = skb->len;
2025  out_err:
2026         cfg80211_put_dev(dev);
2027  out_rtnl:
2028         rtnl_unlock();
2029
2030         return err;
2031 }
2032
2033 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
2034 {
2035         struct cfg80211_registered_device *drv;
2036         int err;
2037         struct net_device *dev;
2038         struct mpath_info pinfo;
2039         struct sk_buff *msg;
2040         u8 *dst = NULL;
2041         u8 next_hop[ETH_ALEN];
2042
2043         memset(&pinfo, 0, sizeof(pinfo));
2044
2045         if (!info->attrs[NL80211_ATTR_MAC])
2046                 return -EINVAL;
2047
2048         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2049
2050         rtnl_lock();
2051
2052         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2053         if (err)
2054                 goto out_rtnl;
2055
2056         if (!drv->ops->get_mpath) {
2057                 err = -EOPNOTSUPP;
2058                 goto out;
2059         }
2060
2061         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2062                 err = -EOPNOTSUPP;
2063                 goto out;
2064         }
2065
2066         err = drv->ops->get_mpath(&drv->wiphy, dev, dst, next_hop, &pinfo);
2067         if (err)
2068                 goto out;
2069
2070         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2071         if (!msg)
2072                 goto out;
2073
2074         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2075                                  dev, dst, next_hop, &pinfo) < 0)
2076                 goto out_free;
2077
2078         err = genlmsg_unicast(msg, info->snd_pid);
2079         goto out;
2080
2081  out_free:
2082         nlmsg_free(msg);
2083  out:
2084         cfg80211_put_dev(drv);
2085         dev_put(dev);
2086  out_rtnl:
2087         rtnl_unlock();
2088
2089         return err;
2090 }
2091
2092 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2093 {
2094         struct cfg80211_registered_device *drv;
2095         int err;
2096         struct net_device *dev;
2097         u8 *dst = NULL;
2098         u8 *next_hop = NULL;
2099
2100         if (!info->attrs[NL80211_ATTR_MAC])
2101                 return -EINVAL;
2102
2103         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2104                 return -EINVAL;
2105
2106         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2107         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2108
2109         rtnl_lock();
2110
2111         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2112         if (err)
2113                 goto out_rtnl;
2114
2115         if (!drv->ops->change_mpath) {
2116                 err = -EOPNOTSUPP;
2117                 goto out;
2118         }
2119
2120         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2121                 err = -EOPNOTSUPP;
2122                 goto out;
2123         }
2124
2125         if (!netif_running(dev)) {
2126                 err = -ENETDOWN;
2127                 goto out;
2128         }
2129
2130         err = drv->ops->change_mpath(&drv->wiphy, dev, dst, next_hop);
2131
2132  out:
2133         cfg80211_put_dev(drv);
2134         dev_put(dev);
2135  out_rtnl:
2136         rtnl_unlock();
2137
2138         return err;
2139 }
2140 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2141 {
2142         struct cfg80211_registered_device *drv;
2143         int err;
2144         struct net_device *dev;
2145         u8 *dst = NULL;
2146         u8 *next_hop = NULL;
2147
2148         if (!info->attrs[NL80211_ATTR_MAC])
2149                 return -EINVAL;
2150
2151         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2152                 return -EINVAL;
2153
2154         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2155         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2156
2157         rtnl_lock();
2158
2159         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2160         if (err)
2161                 goto out_rtnl;
2162
2163         if (!drv->ops->add_mpath) {
2164                 err = -EOPNOTSUPP;
2165                 goto out;
2166         }
2167
2168         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2169                 err = -EOPNOTSUPP;
2170                 goto out;
2171         }
2172
2173         if (!netif_running(dev)) {
2174                 err = -ENETDOWN;
2175                 goto out;
2176         }
2177
2178         err = drv->ops->add_mpath(&drv->wiphy, dev, dst, next_hop);
2179
2180  out:
2181         cfg80211_put_dev(drv);
2182         dev_put(dev);
2183  out_rtnl:
2184         rtnl_unlock();
2185
2186         return err;
2187 }
2188
2189 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2190 {
2191         struct cfg80211_registered_device *drv;
2192         int err;
2193         struct net_device *dev;
2194         u8 *dst = NULL;
2195
2196         if (info->attrs[NL80211_ATTR_MAC])
2197                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2198
2199         rtnl_lock();
2200
2201         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2202         if (err)
2203                 goto out_rtnl;
2204
2205         if (!drv->ops->del_mpath) {
2206                 err = -EOPNOTSUPP;
2207                 goto out;
2208         }
2209
2210         err = drv->ops->del_mpath(&drv->wiphy, dev, dst);
2211
2212  out:
2213         cfg80211_put_dev(drv);
2214         dev_put(dev);
2215  out_rtnl:
2216         rtnl_unlock();
2217
2218         return err;
2219 }
2220
2221 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2222 {
2223         struct cfg80211_registered_device *drv;
2224         int err;
2225         struct net_device *dev;
2226         struct bss_parameters params;
2227
2228         memset(&params, 0, sizeof(params));
2229         /* default to not changing parameters */
2230         params.use_cts_prot = -1;
2231         params.use_short_preamble = -1;
2232         params.use_short_slot_time = -1;
2233
2234         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2235                 params.use_cts_prot =
2236                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2237         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2238                 params.use_short_preamble =
2239                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2240         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2241                 params.use_short_slot_time =
2242                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2243         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2244                 params.basic_rates =
2245                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2246                 params.basic_rates_len =
2247                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2248         }
2249
2250         rtnl_lock();
2251
2252         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2253         if (err)
2254                 goto out_rtnl;
2255
2256         if (!drv->ops->change_bss) {
2257                 err = -EOPNOTSUPP;
2258                 goto out;
2259         }
2260
2261         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
2262                 err = -EOPNOTSUPP;
2263                 goto out;
2264         }
2265
2266         err = drv->ops->change_bss(&drv->wiphy, dev, &params);
2267
2268  out:
2269         cfg80211_put_dev(drv);
2270         dev_put(dev);
2271  out_rtnl:
2272         rtnl_unlock();
2273
2274         return err;
2275 }
2276
2277 static const struct nla_policy
2278         reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2279         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2280         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2281         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2282         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2283         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2284         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2285 };
2286
2287 static int parse_reg_rule(struct nlattr *tb[],
2288         struct ieee80211_reg_rule *reg_rule)
2289 {
2290         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2291         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2292
2293         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2294                 return -EINVAL;
2295         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2296                 return -EINVAL;
2297         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2298                 return -EINVAL;
2299         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2300                 return -EINVAL;
2301         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2302                 return -EINVAL;
2303
2304         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2305
2306         freq_range->start_freq_khz =
2307                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2308         freq_range->end_freq_khz =
2309                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2310         freq_range->max_bandwidth_khz =
2311                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2312
2313         power_rule->max_eirp =
2314                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2315
2316         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2317                 power_rule->max_antenna_gain =
2318                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2319
2320         return 0;
2321 }
2322
2323 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2324 {
2325         int r;
2326         char *data = NULL;
2327
2328         /*
2329          * You should only get this when cfg80211 hasn't yet initialized
2330          * completely when built-in to the kernel right between the time
2331          * window between nl80211_init() and regulatory_init(), if that is
2332          * even possible.
2333          */
2334         mutex_lock(&cfg80211_mutex);
2335         if (unlikely(!cfg80211_regdomain)) {
2336                 mutex_unlock(&cfg80211_mutex);
2337                 return -EINPROGRESS;
2338         }
2339         mutex_unlock(&cfg80211_mutex);
2340
2341         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2342                 return -EINVAL;
2343
2344         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2345
2346 #ifdef CONFIG_WIRELESS_OLD_REGULATORY
2347         /* We ignore world regdom requests with the old regdom setup */
2348         if (is_world_regdom(data))
2349                 return -EINVAL;
2350 #endif
2351
2352         r = regulatory_hint_user(data);
2353
2354         return r;
2355 }
2356
2357 static int nl80211_get_mesh_params(struct sk_buff *skb,
2358         struct genl_info *info)
2359 {
2360         struct cfg80211_registered_device *drv;
2361         struct mesh_config cur_params;
2362         int err;
2363         struct net_device *dev;
2364         void *hdr;
2365         struct nlattr *pinfoattr;
2366         struct sk_buff *msg;
2367
2368         rtnl_lock();
2369
2370         /* Look up our device */
2371         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2372         if (err)
2373                 goto out_rtnl;
2374
2375         if (!drv->ops->get_mesh_params) {
2376                 err = -EOPNOTSUPP;
2377                 goto out;
2378         }
2379
2380         /* Get the mesh params */
2381         err = drv->ops->get_mesh_params(&drv->wiphy, dev, &cur_params);
2382         if (err)
2383                 goto out;
2384
2385         /* Draw up a netlink message to send back */
2386         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2387         if (!msg) {
2388                 err = -ENOBUFS;
2389                 goto out;
2390         }
2391         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2392                              NL80211_CMD_GET_MESH_PARAMS);
2393         if (!hdr)
2394                 goto nla_put_failure;
2395         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
2396         if (!pinfoattr)
2397                 goto nla_put_failure;
2398         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2399         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2400                         cur_params.dot11MeshRetryTimeout);
2401         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2402                         cur_params.dot11MeshConfirmTimeout);
2403         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2404                         cur_params.dot11MeshHoldingTimeout);
2405         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2406                         cur_params.dot11MeshMaxPeerLinks);
2407         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2408                         cur_params.dot11MeshMaxRetries);
2409         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2410                         cur_params.dot11MeshTTL);
2411         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2412                         cur_params.auto_open_plinks);
2413         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2414                         cur_params.dot11MeshHWMPmaxPREQretries);
2415         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2416                         cur_params.path_refresh_time);
2417         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2418                         cur_params.min_discovery_timeout);
2419         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2420                         cur_params.dot11MeshHWMPactivePathTimeout);
2421         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2422                         cur_params.dot11MeshHWMPpreqMinInterval);
2423         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2424                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2425         nla_nest_end(msg, pinfoattr);
2426         genlmsg_end(msg, hdr);
2427         err = genlmsg_unicast(msg, info->snd_pid);
2428         goto out;
2429
2430  nla_put_failure:
2431         genlmsg_cancel(msg, hdr);
2432         err = -EMSGSIZE;
2433  out:
2434         /* Cleanup */
2435         cfg80211_put_dev(drv);
2436         dev_put(dev);
2437  out_rtnl:
2438         rtnl_unlock();
2439
2440         return err;
2441 }
2442
2443 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2444 do {\
2445         if (table[attr_num]) {\
2446                 cfg.param = nla_fn(table[attr_num]); \
2447                 mask |= (1 << (attr_num - 1)); \
2448         } \
2449 } while (0);\
2450
2451 static struct nla_policy
2452 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] __read_mostly = {
2453         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2454         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2455         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2456         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2457         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2458         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2459         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2460
2461         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2462         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2463         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2464         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2465         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2466         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2467 };
2468
2469 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2470 {
2471         int err;
2472         u32 mask;
2473         struct cfg80211_registered_device *drv;
2474         struct net_device *dev;
2475         struct mesh_config cfg;
2476         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2477         struct nlattr *parent_attr;
2478
2479         parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
2480         if (!parent_attr)
2481                 return -EINVAL;
2482         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2483                         parent_attr, nl80211_meshconf_params_policy))
2484                 return -EINVAL;
2485
2486         rtnl_lock();
2487
2488         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2489         if (err)
2490                 goto out_rtnl;
2491
2492         if (!drv->ops->set_mesh_params) {
2493                 err = -EOPNOTSUPP;
2494                 goto out;
2495         }
2496
2497         /* This makes sure that there aren't more than 32 mesh config
2498          * parameters (otherwise our bitfield scheme would not work.) */
2499         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2500
2501         /* Fill in the params struct */
2502         mask = 0;
2503         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2504                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2505         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2506                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2507         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2508                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2509         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2510                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2511         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2512                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2513         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2514                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2515         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2516                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2517         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2518                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2519                         nla_get_u8);
2520         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2521                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2522         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2523                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2524                         nla_get_u16);
2525         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2526                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2527                         nla_get_u32);
2528         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2529                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2530                         nla_get_u16);
2531         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2532                         dot11MeshHWMPnetDiameterTraversalTime,
2533                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2534                         nla_get_u16);
2535
2536         /* Apply changes */
2537         err = drv->ops->set_mesh_params(&drv->wiphy, dev, &cfg, mask);
2538
2539  out:
2540         /* cleanup */
2541         cfg80211_put_dev(drv);
2542         dev_put(dev);
2543  out_rtnl:
2544         rtnl_unlock();
2545
2546         return err;
2547 }
2548
2549 #undef FILL_IN_MESH_PARAM_IF_SET
2550
2551 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2552 {
2553         struct sk_buff *msg;
2554         void *hdr = NULL;
2555         struct nlattr *nl_reg_rules;
2556         unsigned int i;
2557         int err = -EINVAL;
2558
2559         mutex_lock(&cfg80211_mutex);
2560
2561         if (!cfg80211_regdomain)
2562                 goto out;
2563
2564         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2565         if (!msg) {
2566                 err = -ENOBUFS;
2567                 goto out;
2568         }
2569
2570         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2571                              NL80211_CMD_GET_REG);
2572         if (!hdr)
2573                 goto nla_put_failure;
2574
2575         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2576                 cfg80211_regdomain->alpha2);
2577
2578         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2579         if (!nl_reg_rules)
2580                 goto nla_put_failure;
2581
2582         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2583                 struct nlattr *nl_reg_rule;
2584                 const struct ieee80211_reg_rule *reg_rule;
2585                 const struct ieee80211_freq_range *freq_range;
2586                 const struct ieee80211_power_rule *power_rule;
2587
2588                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2589                 freq_range = &reg_rule->freq_range;
2590                 power_rule = &reg_rule->power_rule;
2591
2592                 nl_reg_rule = nla_nest_start(msg, i);
2593                 if (!nl_reg_rule)
2594                         goto nla_put_failure;
2595
2596                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2597                         reg_rule->flags);
2598                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2599                         freq_range->start_freq_khz);
2600                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2601                         freq_range->end_freq_khz);
2602                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2603                         freq_range->max_bandwidth_khz);
2604                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2605                         power_rule->max_antenna_gain);
2606                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2607                         power_rule->max_eirp);
2608
2609                 nla_nest_end(msg, nl_reg_rule);
2610         }
2611
2612         nla_nest_end(msg, nl_reg_rules);
2613
2614         genlmsg_end(msg, hdr);
2615         err = genlmsg_unicast(msg, info->snd_pid);
2616         goto out;
2617
2618 nla_put_failure:
2619         genlmsg_cancel(msg, hdr);
2620         err = -EMSGSIZE;
2621 out:
2622         mutex_unlock(&cfg80211_mutex);
2623         return err;
2624 }
2625
2626 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2627 {
2628         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2629         struct nlattr *nl_reg_rule;
2630         char *alpha2 = NULL;
2631         int rem_reg_rules = 0, r = 0;
2632         u32 num_rules = 0, rule_idx = 0, size_of_regd;
2633         struct ieee80211_regdomain *rd = NULL;
2634
2635         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2636                 return -EINVAL;
2637
2638         if (!info->attrs[NL80211_ATTR_REG_RULES])
2639                 return -EINVAL;
2640
2641         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2642
2643         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2644                         rem_reg_rules) {
2645                 num_rules++;
2646                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2647                         return -EINVAL;
2648         }
2649
2650         mutex_lock(&cfg80211_mutex);
2651
2652         if (!reg_is_valid_request(alpha2)) {
2653                 r = -EINVAL;
2654                 goto bad_reg;
2655         }
2656
2657         size_of_regd = sizeof(struct ieee80211_regdomain) +
2658                 (num_rules * sizeof(struct ieee80211_reg_rule));
2659
2660         rd = kzalloc(size_of_regd, GFP_KERNEL);
2661         if (!rd) {
2662                 r = -ENOMEM;
2663                 goto bad_reg;
2664         }
2665
2666         rd->n_reg_rules = num_rules;
2667         rd->alpha2[0] = alpha2[0];
2668         rd->alpha2[1] = alpha2[1];
2669
2670         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2671                         rem_reg_rules) {
2672                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2673                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2674                         reg_rule_policy);
2675                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2676                 if (r)
2677                         goto bad_reg;
2678
2679                 rule_idx++;
2680
2681                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
2682                         r = -EINVAL;
2683                         goto bad_reg;
2684                 }
2685         }
2686
2687         BUG_ON(rule_idx != num_rules);
2688
2689         r = set_regdom(rd);
2690
2691         mutex_unlock(&cfg80211_mutex);
2692
2693         return r;
2694
2695  bad_reg:
2696         mutex_unlock(&cfg80211_mutex);
2697         kfree(rd);
2698         return r;
2699 }
2700
2701 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
2702 {
2703         struct cfg80211_registered_device *drv;
2704         struct net_device *dev;
2705         struct cfg80211_scan_request *request;
2706         struct cfg80211_ssid *ssid;
2707         struct ieee80211_channel *channel;
2708         struct nlattr *attr;
2709         struct wiphy *wiphy;
2710         int err, tmp, n_ssids = 0, n_channels = 0, i;
2711         enum ieee80211_band band;
2712         size_t ie_len;
2713
2714         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2715                 return -EINVAL;
2716
2717         rtnl_lock();
2718
2719         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2720         if (err)
2721                 goto out_rtnl;
2722
2723         wiphy = &drv->wiphy;
2724
2725         if (!drv->ops->scan) {
2726                 err = -EOPNOTSUPP;
2727                 goto out;
2728         }
2729
2730         if (!netif_running(dev)) {
2731                 err = -ENETDOWN;
2732                 goto out;
2733         }
2734
2735         if (drv->scan_req) {
2736                 err = -EBUSY;
2737                 goto out;
2738         }
2739
2740         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2741                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp)
2742                         n_channels++;
2743                 if (!n_channels) {
2744                         err = -EINVAL;
2745                         goto out;
2746                 }
2747         } else {
2748                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
2749                         if (wiphy->bands[band])
2750                                 n_channels += wiphy->bands[band]->n_channels;
2751         }
2752
2753         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
2754                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
2755                         n_ssids++;
2756
2757         if (n_ssids > wiphy->max_scan_ssids) {
2758                 err = -EINVAL;
2759                 goto out;
2760         }
2761
2762         if (info->attrs[NL80211_ATTR_IE])
2763                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2764         else
2765                 ie_len = 0;
2766
2767         if (ie_len > wiphy->max_scan_ie_len) {
2768                 err = -EINVAL;
2769                 goto out;
2770         }
2771
2772         request = kzalloc(sizeof(*request)
2773                         + sizeof(*ssid) * n_ssids
2774                         + sizeof(channel) * n_channels
2775                         + ie_len, GFP_KERNEL);
2776         if (!request) {
2777                 err = -ENOMEM;
2778                 goto out;
2779         }
2780
2781         request->channels = (void *)((char *)request + sizeof(*request));
2782         request->n_channels = n_channels;
2783         if (n_ssids)
2784                 request->ssids = (void *)(request->channels + n_channels);
2785         request->n_ssids = n_ssids;
2786         if (ie_len) {
2787                 if (request->ssids)
2788                         request->ie = (void *)(request->ssids + n_ssids);
2789                 else
2790                         request->ie = (void *)(request->channels + n_channels);
2791         }
2792
2793         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2794                 /* user specified, bail out if channel not found */
2795                 request->n_channels = n_channels;
2796                 i = 0;
2797                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
2798                         request->channels[i] = ieee80211_get_channel(wiphy, nla_get_u32(attr));
2799                         if (!request->channels[i]) {
2800                                 err = -EINVAL;
2801                                 goto out_free;
2802                         }
2803                         i++;
2804                 }
2805         } else {
2806                 /* all channels */
2807                 i = 0;
2808                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
2809                         int j;
2810                         if (!wiphy->bands[band])
2811                                 continue;
2812                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
2813                                 request->channels[i] = &wiphy->bands[band]->channels[j];
2814                                 i++;
2815                         }
2816                 }
2817         }
2818
2819         i = 0;
2820         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
2821                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
2822                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
2823                                 err = -EINVAL;
2824                                 goto out_free;
2825                         }
2826                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
2827                         request->ssids[i].ssid_len = nla_len(attr);
2828                         i++;
2829                 }
2830         }
2831
2832         if (info->attrs[NL80211_ATTR_IE]) {
2833                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2834                 memcpy((void *)request->ie,
2835                        nla_data(info->attrs[NL80211_ATTR_IE]),
2836                        request->ie_len);
2837         }
2838
2839         request->ifidx = dev->ifindex;
2840         request->wiphy = &drv->wiphy;
2841
2842         drv->scan_req = request;
2843         err = drv->ops->scan(&drv->wiphy, dev, request);
2844
2845  out_free:
2846         if (err) {
2847                 drv->scan_req = NULL;
2848                 kfree(request);
2849         }
2850  out:
2851         cfg80211_put_dev(drv);
2852         dev_put(dev);
2853  out_rtnl:
2854         rtnl_unlock();
2855
2856         return err;
2857 }
2858
2859 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
2860                             struct cfg80211_registered_device *rdev,
2861                             struct net_device *dev,
2862                             struct cfg80211_bss *res)
2863 {
2864         void *hdr;
2865         struct nlattr *bss;
2866
2867         hdr = nl80211hdr_put(msg, pid, seq, flags,
2868                              NL80211_CMD_NEW_SCAN_RESULTS);
2869         if (!hdr)
2870                 return -1;
2871
2872         NLA_PUT_U32(msg, NL80211_ATTR_SCAN_GENERATION,
2873                     rdev->bss_generation);
2874         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2875
2876         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
2877         if (!bss)
2878                 goto nla_put_failure;
2879         if (!is_zero_ether_addr(res->bssid))
2880                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
2881         if (res->information_elements && res->len_information_elements)
2882                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
2883                         res->len_information_elements,
2884                         res->information_elements);
2885         if (res->tsf)
2886                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
2887         if (res->beacon_interval)
2888                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
2889         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
2890         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
2891
2892         switch (rdev->wiphy.signal_type) {
2893         case CFG80211_SIGNAL_TYPE_MBM:
2894                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
2895                 break;
2896         case CFG80211_SIGNAL_TYPE_UNSPEC:
2897                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
2898                 break;
2899         default:
2900                 break;
2901         }
2902
2903         nla_nest_end(msg, bss);
2904
2905         return genlmsg_end(msg, hdr);
2906
2907  nla_put_failure:
2908         genlmsg_cancel(msg, hdr);
2909         return -EMSGSIZE;
2910 }
2911
2912 static int nl80211_dump_scan(struct sk_buff *skb,
2913                              struct netlink_callback *cb)
2914 {
2915         struct cfg80211_registered_device *dev;
2916         struct net_device *netdev;
2917         struct cfg80211_internal_bss *scan;
2918         int ifidx = cb->args[0];
2919         int start = cb->args[1], idx = 0;
2920         int err;
2921
2922         if (!ifidx) {
2923                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
2924                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
2925                                   nl80211_policy);
2926                 if (err)
2927                         return err;
2928
2929                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
2930                         return -EINVAL;
2931
2932                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
2933                 if (!ifidx)
2934                         return -EINVAL;
2935                 cb->args[0] = ifidx;
2936         }
2937
2938         netdev = dev_get_by_index(&init_net, ifidx);
2939         if (!netdev)
2940                 return -ENODEV;
2941
2942         dev = cfg80211_get_dev_from_ifindex(ifidx);
2943         if (IS_ERR(dev)) {
2944                 err = PTR_ERR(dev);
2945                 goto out_put_netdev;
2946         }
2947
2948         spin_lock_bh(&dev->bss_lock);
2949         cfg80211_bss_expire(dev);
2950
2951         list_for_each_entry(scan, &dev->bss_list, list) {
2952                 if (++idx <= start)
2953                         continue;
2954                 if (nl80211_send_bss(skb,
2955                                 NETLINK_CB(cb->skb).pid,
2956                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2957                                 dev, netdev, &scan->pub) < 0) {
2958                         idx--;
2959                         goto out;
2960                 }
2961         }
2962
2963  out:
2964         spin_unlock_bh(&dev->bss_lock);
2965
2966         cb->args[1] = idx;
2967         err = skb->len;
2968         cfg80211_put_dev(dev);
2969  out_put_netdev:
2970         dev_put(netdev);
2971
2972         return err;
2973 }
2974
2975 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
2976 {
2977         return auth_type == NL80211_AUTHTYPE_OPEN_SYSTEM ||
2978                 auth_type == NL80211_AUTHTYPE_SHARED_KEY ||
2979                 auth_type == NL80211_AUTHTYPE_FT ||
2980                 auth_type == NL80211_AUTHTYPE_NETWORK_EAP;
2981 }
2982
2983 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
2984 {
2985         struct cfg80211_registered_device *drv;
2986         struct net_device *dev;
2987         struct cfg80211_auth_request req;
2988         struct wiphy *wiphy;
2989         int err;
2990
2991         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2992                 return -EINVAL;
2993
2994         if (!info->attrs[NL80211_ATTR_MAC])
2995                 return -EINVAL;
2996
2997         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
2998                 return -EINVAL;
2999
3000         rtnl_lock();
3001
3002         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3003         if (err)
3004                 goto unlock_rtnl;
3005
3006         if (!drv->ops->auth) {
3007                 err = -EOPNOTSUPP;
3008                 goto out;
3009         }
3010
3011         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3012                 err = -EOPNOTSUPP;
3013                 goto out;
3014         }
3015
3016         if (!netif_running(dev)) {
3017                 err = -ENETDOWN;
3018                 goto out;
3019         }
3020
3021         wiphy = &drv->wiphy;
3022         memset(&req, 0, sizeof(req));
3023
3024         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3025
3026         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3027                 req.chan = ieee80211_get_channel(
3028                         wiphy,
3029                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3030                 if (!req.chan) {
3031                         err = -EINVAL;
3032                         goto out;
3033                 }
3034         }
3035
3036         if (info->attrs[NL80211_ATTR_SSID]) {
3037                 req.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3038                 req.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3039         }
3040
3041         if (info->attrs[NL80211_ATTR_IE]) {
3042                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3043                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3044         }
3045
3046         req.auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
3047         if (!nl80211_valid_auth_type(req.auth_type)) {
3048                 err = -EINVAL;
3049                 goto out;
3050         }
3051
3052         err = drv->ops->auth(&drv->wiphy, dev, &req);
3053
3054 out:
3055         cfg80211_put_dev(drv);
3056         dev_put(dev);
3057 unlock_rtnl:
3058         rtnl_unlock();
3059         return err;
3060 }
3061
3062 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
3063 {
3064         struct cfg80211_registered_device *drv;
3065         struct net_device *dev;
3066         struct cfg80211_assoc_request req;
3067         struct wiphy *wiphy;
3068         int err;
3069
3070         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3071                 return -EINVAL;
3072
3073         if (!info->attrs[NL80211_ATTR_MAC] ||
3074             !info->attrs[NL80211_ATTR_SSID])
3075                 return -EINVAL;
3076
3077         rtnl_lock();
3078
3079         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3080         if (err)
3081                 goto unlock_rtnl;
3082
3083         if (!drv->ops->assoc) {
3084                 err = -EOPNOTSUPP;
3085                 goto out;
3086         }
3087
3088         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3089                 err = -EOPNOTSUPP;
3090                 goto out;
3091         }
3092
3093         if (!netif_running(dev)) {
3094                 err = -ENETDOWN;
3095                 goto out;
3096         }
3097
3098         wiphy = &drv->wiphy;
3099         memset(&req, 0, sizeof(req));
3100
3101         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3102
3103         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3104                 req.chan = ieee80211_get_channel(
3105                         wiphy,
3106                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3107                 if (!req.chan) {
3108                         err = -EINVAL;
3109                         goto out;
3110                 }
3111         }
3112
3113         req.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3114         req.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3115
3116         if (info->attrs[NL80211_ATTR_IE]) {
3117                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3118                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3119         }
3120
3121         if (info->attrs[NL80211_ATTR_USE_MFP]) {
3122                 enum nl80211_mfp use_mfp =
3123                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
3124                 if (use_mfp == NL80211_MFP_REQUIRED)
3125                         req.use_mfp = true;
3126                 else if (use_mfp != NL80211_MFP_NO) {
3127                         err = -EINVAL;
3128                         goto out;
3129                 }
3130         }
3131
3132         req.control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
3133
3134         err = drv->ops->assoc(&drv->wiphy, dev, &req);
3135
3136 out:
3137         cfg80211_put_dev(drv);
3138         dev_put(dev);
3139 unlock_rtnl:
3140         rtnl_unlock();
3141         return err;
3142 }
3143
3144 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
3145 {
3146         struct cfg80211_registered_device *drv;
3147         struct net_device *dev;
3148         struct cfg80211_deauth_request req;
3149         struct wiphy *wiphy;
3150         int err;
3151
3152         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3153                 return -EINVAL;
3154
3155         if (!info->attrs[NL80211_ATTR_MAC])
3156                 return -EINVAL;
3157
3158         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3159                 return -EINVAL;
3160
3161         rtnl_lock();
3162
3163         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3164         if (err)
3165                 goto unlock_rtnl;
3166
3167         if (!drv->ops->deauth) {
3168                 err = -EOPNOTSUPP;
3169                 goto out;
3170         }
3171
3172         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3173                 err = -EOPNOTSUPP;
3174                 goto out;
3175         }
3176
3177         if (!netif_running(dev)) {
3178                 err = -ENETDOWN;
3179                 goto out;
3180         }
3181
3182         wiphy = &drv->wiphy;
3183         memset(&req, 0, sizeof(req));
3184
3185         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3186
3187         req.reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3188         if (req.reason_code == 0) {
3189                 /* Reason Code 0 is reserved */
3190                 err = -EINVAL;
3191                 goto out;
3192         }
3193
3194         if (info->attrs[NL80211_ATTR_IE]) {
3195                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3196                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3197         }
3198
3199         err = drv->ops->deauth(&drv->wiphy, dev, &req);
3200
3201 out:
3202         cfg80211_put_dev(drv);
3203         dev_put(dev);
3204 unlock_rtnl:
3205         rtnl_unlock();
3206         return err;
3207 }
3208
3209 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
3210 {
3211         struct cfg80211_registered_device *drv;
3212         struct net_device *dev;
3213         struct cfg80211_disassoc_request req;
3214         struct wiphy *wiphy;
3215         int err;
3216
3217         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3218                 return -EINVAL;
3219
3220         if (!info->attrs[NL80211_ATTR_MAC])
3221                 return -EINVAL;
3222
3223         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3224                 return -EINVAL;
3225
3226         rtnl_lock();
3227
3228         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3229         if (err)
3230                 goto unlock_rtnl;
3231
3232         if (!drv->ops->disassoc) {
3233                 err = -EOPNOTSUPP;
3234                 goto out;
3235         }
3236
3237         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3238                 err = -EOPNOTSUPP;
3239                 goto out;
3240         }
3241
3242         if (!netif_running(dev)) {
3243                 err = -ENETDOWN;
3244                 goto out;
3245         }
3246
3247         wiphy = &drv->wiphy;
3248         memset(&req, 0, sizeof(req));
3249
3250         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3251
3252         req.reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3253         if (req.reason_code == 0) {
3254                 /* Reason Code 0 is reserved */
3255                 err = -EINVAL;
3256                 goto out;
3257         }
3258
3259         if (info->attrs[NL80211_ATTR_IE]) {
3260                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3261                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3262         }
3263
3264         err = drv->ops->disassoc(&drv->wiphy, dev, &req);
3265
3266 out:
3267         cfg80211_put_dev(drv);
3268         dev_put(dev);
3269 unlock_rtnl:
3270         rtnl_unlock();
3271         return err;
3272 }
3273
3274 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
3275 {
3276         struct cfg80211_registered_device *drv;
3277         struct net_device *dev;
3278         struct cfg80211_ibss_params ibss;
3279         struct wiphy *wiphy;
3280         int err;
3281
3282         memset(&ibss, 0, sizeof(ibss));
3283
3284         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3285                 return -EINVAL;
3286
3287         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
3288             !info->attrs[NL80211_ATTR_SSID] ||
3289             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3290                 return -EINVAL;
3291
3292         ibss.beacon_interval = 100;
3293
3294         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
3295                 ibss.beacon_interval =
3296                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3297                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
3298                         return -EINVAL;
3299         }
3300
3301         rtnl_lock();
3302
3303         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3304         if (err)
3305                 goto unlock_rtnl;
3306
3307         if (!drv->ops->join_ibss) {
3308                 err = -EOPNOTSUPP;
3309                 goto out;
3310         }
3311
3312         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3313                 err = -EOPNOTSUPP;
3314                 goto out;
3315         }
3316
3317         if (!netif_running(dev)) {
3318                 err = -ENETDOWN;
3319                 goto out;
3320         }
3321
3322         wiphy = &drv->wiphy;
3323
3324         if (info->attrs[NL80211_ATTR_MAC])
3325                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3326         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3327         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3328
3329         if (info->attrs[NL80211_ATTR_IE]) {
3330                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3331                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3332         }
3333
3334         ibss.channel = ieee80211_get_channel(wiphy,
3335                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3336         if (!ibss.channel ||
3337             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
3338             ibss.channel->flags & IEEE80211_CHAN_DISABLED) {
3339                 err = -EINVAL;
3340                 goto out;
3341         }
3342
3343         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
3344
3345         err = cfg80211_join_ibss(drv, dev, &ibss);
3346
3347 out:
3348         cfg80211_put_dev(drv);
3349         dev_put(dev);
3350 unlock_rtnl:
3351         rtnl_unlock();
3352         return err;
3353 }
3354
3355 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
3356 {
3357         struct cfg80211_registered_device *drv;
3358         struct net_device *dev;
3359         int err;
3360
3361         rtnl_lock();
3362
3363         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3364         if (err)
3365                 goto unlock_rtnl;
3366
3367         if (!drv->ops->leave_ibss) {
3368                 err = -EOPNOTSUPP;
3369                 goto out;
3370         }
3371
3372         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3373                 err = -EOPNOTSUPP;
3374                 goto out;
3375         }
3376
3377         if (!netif_running(dev)) {
3378                 err = -ENETDOWN;
3379                 goto out;
3380         }
3381
3382         err = cfg80211_leave_ibss(drv, dev, false);
3383
3384 out:
3385         cfg80211_put_dev(drv);
3386         dev_put(dev);
3387 unlock_rtnl:
3388         rtnl_unlock();
3389         return err;
3390 }
3391
3392 static struct genl_ops nl80211_ops[] = {
3393         {
3394                 .cmd = NL80211_CMD_GET_WIPHY,
3395                 .doit = nl80211_get_wiphy,
3396                 .dumpit = nl80211_dump_wiphy,
3397                 .policy = nl80211_policy,
3398                 /* can be retrieved by unprivileged users */
3399         },
3400         {
3401                 .cmd = NL80211_CMD_SET_WIPHY,
3402                 .doit = nl80211_set_wiphy,
3403                 .policy = nl80211_policy,
3404                 .flags = GENL_ADMIN_PERM,
3405         },
3406         {
3407                 .cmd = NL80211_CMD_GET_INTERFACE,
3408                 .doit = nl80211_get_interface,
3409                 .dumpit = nl80211_dump_interface,
3410                 .policy = nl80211_policy,
3411                 /* can be retrieved by unprivileged users */
3412         },
3413         {
3414                 .cmd = NL80211_CMD_SET_INTERFACE,
3415                 .doit = nl80211_set_interface,
3416                 .policy = nl80211_policy,
3417                 .flags = GENL_ADMIN_PERM,
3418         },
3419         {
3420                 .cmd = NL80211_CMD_NEW_INTERFACE,
3421                 .doit = nl80211_new_interface,
3422                 .policy = nl80211_policy,
3423                 .flags = GENL_ADMIN_PERM,
3424         },
3425         {
3426                 .cmd = NL80211_CMD_DEL_INTERFACE,
3427                 .doit = nl80211_del_interface,
3428                 .policy = nl80211_policy,
3429                 .flags = GENL_ADMIN_PERM,
3430         },
3431         {
3432                 .cmd = NL80211_CMD_GET_KEY,
3433                 .doit = nl80211_get_key,
3434                 .policy = nl80211_policy,
3435                 .flags = GENL_ADMIN_PERM,
3436         },
3437         {
3438                 .cmd = NL80211_CMD_SET_KEY,
3439                 .doit = nl80211_set_key,
3440                 .policy = nl80211_policy,
3441                 .flags = GENL_ADMIN_PERM,
3442         },
3443         {
3444                 .cmd = NL80211_CMD_NEW_KEY,
3445                 .doit = nl80211_new_key,
3446                 .policy = nl80211_policy,
3447                 .flags = GENL_ADMIN_PERM,
3448         },
3449         {
3450                 .cmd = NL80211_CMD_DEL_KEY,
3451                 .doit = nl80211_del_key,
3452                 .policy = nl80211_policy,
3453                 .flags = GENL_ADMIN_PERM,
3454         },
3455         {
3456                 .cmd = NL80211_CMD_SET_BEACON,
3457                 .policy = nl80211_policy,
3458                 .flags = GENL_ADMIN_PERM,
3459                 .doit = nl80211_addset_beacon,
3460         },
3461         {
3462                 .cmd = NL80211_CMD_NEW_BEACON,
3463                 .policy = nl80211_policy,
3464                 .flags = GENL_ADMIN_PERM,
3465                 .doit = nl80211_addset_beacon,
3466         },
3467         {
3468                 .cmd = NL80211_CMD_DEL_BEACON,
3469                 .policy = nl80211_policy,
3470                 .flags = GENL_ADMIN_PERM,
3471                 .doit = nl80211_del_beacon,
3472         },
3473         {
3474                 .cmd = NL80211_CMD_GET_STATION,
3475                 .doit = nl80211_get_station,
3476                 .dumpit = nl80211_dump_station,
3477                 .policy = nl80211_policy,
3478         },
3479         {
3480                 .cmd = NL80211_CMD_SET_STATION,
3481                 .doit = nl80211_set_station,
3482                 .policy = nl80211_policy,
3483                 .flags = GENL_ADMIN_PERM,
3484         },
3485         {
3486                 .cmd = NL80211_CMD_NEW_STATION,
3487                 .doit = nl80211_new_station,
3488                 .policy = nl80211_policy,
3489                 .flags = GENL_ADMIN_PERM,
3490         },
3491         {
3492                 .cmd = NL80211_CMD_DEL_STATION,
3493                 .doit = nl80211_del_station,
3494                 .policy = nl80211_policy,
3495                 .flags = GENL_ADMIN_PERM,
3496         },
3497         {
3498                 .cmd = NL80211_CMD_GET_MPATH,
3499                 .doit = nl80211_get_mpath,
3500                 .dumpit = nl80211_dump_mpath,
3501                 .policy = nl80211_policy,
3502                 .flags = GENL_ADMIN_PERM,
3503         },
3504         {
3505                 .cmd = NL80211_CMD_SET_MPATH,
3506                 .doit = nl80211_set_mpath,
3507                 .policy = nl80211_policy,
3508                 .flags = GENL_ADMIN_PERM,
3509         },
3510         {
3511                 .cmd = NL80211_CMD_NEW_MPATH,
3512                 .doit = nl80211_new_mpath,
3513                 .policy = nl80211_policy,
3514                 .flags = GENL_ADMIN_PERM,
3515         },
3516         {
3517                 .cmd = NL80211_CMD_DEL_MPATH,
3518                 .doit = nl80211_del_mpath,
3519                 .policy = nl80211_policy,
3520                 .flags = GENL_ADMIN_PERM,
3521         },
3522         {
3523                 .cmd = NL80211_CMD_SET_BSS,
3524                 .doit = nl80211_set_bss,
3525                 .policy = nl80211_policy,
3526                 .flags = GENL_ADMIN_PERM,
3527         },
3528         {
3529                 .cmd = NL80211_CMD_GET_REG,
3530                 .doit = nl80211_get_reg,
3531                 .policy = nl80211_policy,
3532                 /* can be retrieved by unprivileged users */
3533         },
3534         {
3535                 .cmd = NL80211_CMD_SET_REG,
3536                 .doit = nl80211_set_reg,
3537                 .policy = nl80211_policy,
3538                 .flags = GENL_ADMIN_PERM,
3539         },
3540         {
3541                 .cmd = NL80211_CMD_REQ_SET_REG,
3542                 .doit = nl80211_req_set_reg,
3543                 .policy = nl80211_policy,
3544                 .flags = GENL_ADMIN_PERM,
3545         },
3546         {
3547                 .cmd = NL80211_CMD_GET_MESH_PARAMS,
3548                 .doit = nl80211_get_mesh_params,
3549                 .policy = nl80211_policy,
3550                 /* can be retrieved by unprivileged users */
3551         },
3552         {
3553                 .cmd = NL80211_CMD_SET_MESH_PARAMS,
3554                 .doit = nl80211_set_mesh_params,
3555                 .policy = nl80211_policy,
3556                 .flags = GENL_ADMIN_PERM,
3557         },
3558         {
3559                 .cmd = NL80211_CMD_TRIGGER_SCAN,
3560                 .doit = nl80211_trigger_scan,
3561                 .policy = nl80211_policy,
3562                 .flags = GENL_ADMIN_PERM,
3563         },
3564         {
3565                 .cmd = NL80211_CMD_GET_SCAN,
3566                 .policy = nl80211_policy,
3567                 .dumpit = nl80211_dump_scan,
3568         },
3569         {
3570                 .cmd = NL80211_CMD_AUTHENTICATE,
3571                 .doit = nl80211_authenticate,
3572                 .policy = nl80211_policy,
3573                 .flags = GENL_ADMIN_PERM,
3574         },
3575         {
3576                 .cmd = NL80211_CMD_ASSOCIATE,
3577                 .doit = nl80211_associate,
3578                 .policy = nl80211_policy,
3579                 .flags = GENL_ADMIN_PERM,
3580         },
3581         {
3582                 .cmd = NL80211_CMD_DEAUTHENTICATE,
3583                 .doit = nl80211_deauthenticate,
3584                 .policy = nl80211_policy,
3585                 .flags = GENL_ADMIN_PERM,
3586         },
3587         {
3588                 .cmd = NL80211_CMD_DISASSOCIATE,
3589                 .doit = nl80211_disassociate,
3590                 .policy = nl80211_policy,
3591                 .flags = GENL_ADMIN_PERM,
3592         },
3593         {
3594                 .cmd = NL80211_CMD_JOIN_IBSS,
3595                 .doit = nl80211_join_ibss,
3596                 .policy = nl80211_policy,
3597                 .flags = GENL_ADMIN_PERM,
3598         },
3599         {
3600                 .cmd = NL80211_CMD_LEAVE_IBSS,
3601                 .doit = nl80211_leave_ibss,
3602                 .policy = nl80211_policy,
3603                 .flags = GENL_ADMIN_PERM,
3604         },
3605 };
3606 static struct genl_multicast_group nl80211_mlme_mcgrp = {
3607         .name = "mlme",
3608 };
3609
3610 /* multicast groups */
3611 static struct genl_multicast_group nl80211_config_mcgrp = {
3612         .name = "config",
3613 };
3614 static struct genl_multicast_group nl80211_scan_mcgrp = {
3615         .name = "scan",
3616 };
3617 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
3618         .name = "regulatory",
3619 };
3620
3621 /* notification functions */
3622
3623 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
3624 {
3625         struct sk_buff *msg;
3626
3627         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3628         if (!msg)
3629                 return;
3630
3631         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
3632                 nlmsg_free(msg);
3633                 return;
3634         }
3635
3636         genlmsg_multicast(msg, 0, nl80211_config_mcgrp.id, GFP_KERNEL);
3637 }
3638
3639 static int nl80211_add_scan_req(struct sk_buff *msg,
3640                                 struct cfg80211_registered_device *rdev)
3641 {
3642         struct cfg80211_scan_request *req = rdev->scan_req;
3643         struct nlattr *nest;
3644         int i;
3645
3646         if (WARN_ON(!req))
3647                 return 0;
3648
3649         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
3650         if (!nest)
3651                 goto nla_put_failure;
3652         for (i = 0; i < req->n_ssids; i++)
3653                 NLA_PUT(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid);
3654         nla_nest_end(msg, nest);
3655
3656         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
3657         if (!nest)
3658                 goto nla_put_failure;
3659         for (i = 0; i < req->n_channels; i++)
3660                 NLA_PUT_U32(msg, i, req->channels[i]->center_freq);
3661         nla_nest_end(msg, nest);
3662
3663         if (req->ie)
3664                 NLA_PUT(msg, NL80211_ATTR_IE, req->ie_len, req->ie);
3665
3666         return 0;
3667  nla_put_failure:
3668         return -ENOBUFS;
3669 }
3670
3671 static int nl80211_send_scan_donemsg(struct sk_buff *msg,
3672                                      struct cfg80211_registered_device *rdev,
3673                                      struct net_device *netdev,
3674                                      u32 pid, u32 seq, int flags,
3675                                      u32 cmd)
3676 {
3677         void *hdr;
3678
3679         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
3680         if (!hdr)
3681                 return -1;
3682
3683         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3684         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3685
3686         /* ignore errors and send incomplete event anyway */
3687         nl80211_add_scan_req(msg, rdev);
3688
3689         return genlmsg_end(msg, hdr);
3690
3691  nla_put_failure:
3692         genlmsg_cancel(msg, hdr);
3693         return -EMSGSIZE;
3694 }
3695
3696 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
3697                             struct net_device *netdev)
3698 {
3699         struct sk_buff *msg;
3700
3701         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3702         if (!msg)
3703                 return;
3704
3705         if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
3706                                       NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
3707                 nlmsg_free(msg);
3708                 return;
3709         }
3710
3711         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
3712 }
3713
3714 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
3715                                struct net_device *netdev)
3716 {
3717         struct sk_buff *msg;
3718
3719         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3720         if (!msg)
3721                 return;
3722
3723         if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
3724                                       NL80211_CMD_SCAN_ABORTED) < 0) {
3725                 nlmsg_free(msg);
3726                 return;
3727         }
3728
3729         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
3730 }
3731
3732 /*
3733  * This can happen on global regulatory changes or device specific settings
3734  * based on custom world regulatory domains.
3735  */
3736 void nl80211_send_reg_change_event(struct regulatory_request *request)
3737 {
3738         struct sk_buff *msg;
3739         void *hdr;
3740
3741         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3742         if (!msg)
3743                 return;
3744
3745         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
3746         if (!hdr) {
3747                 nlmsg_free(msg);
3748                 return;
3749         }
3750
3751         /* Userspace can always count this one always being set */
3752         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
3753
3754         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
3755                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3756                            NL80211_REGDOM_TYPE_WORLD);
3757         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
3758                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3759                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
3760         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
3761                  request->intersect)
3762                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3763                            NL80211_REGDOM_TYPE_INTERSECTION);
3764         else {
3765                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3766                            NL80211_REGDOM_TYPE_COUNTRY);
3767                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
3768         }
3769
3770         if (wiphy_idx_valid(request->wiphy_idx))
3771                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
3772
3773         if (genlmsg_end(msg, hdr) < 0) {
3774                 nlmsg_free(msg);
3775                 return;
3776         }
3777
3778         genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_KERNEL);
3779
3780         return;
3781
3782 nla_put_failure:
3783         genlmsg_cancel(msg, hdr);
3784         nlmsg_free(msg);
3785 }
3786
3787 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
3788                                     struct net_device *netdev,
3789                                     const u8 *buf, size_t len,
3790                                     enum nl80211_commands cmd)
3791 {
3792         struct sk_buff *msg;
3793         void *hdr;
3794
3795         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
3796         if (!msg)
3797                 return;
3798
3799         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
3800         if (!hdr) {
3801                 nlmsg_free(msg);
3802                 return;
3803         }
3804
3805         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3806         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3807         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
3808
3809         if (genlmsg_end(msg, hdr) < 0) {
3810                 nlmsg_free(msg);
3811                 return;
3812         }
3813
3814         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_ATOMIC);
3815         return;
3816
3817  nla_put_failure:
3818         genlmsg_cancel(msg, hdr);
3819         nlmsg_free(msg);
3820 }
3821
3822 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
3823                           struct net_device *netdev, const u8 *buf, size_t len)
3824 {
3825         nl80211_send_mlme_event(rdev, netdev, buf, len,
3826                                 NL80211_CMD_AUTHENTICATE);
3827 }
3828
3829 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
3830                            struct net_device *netdev, const u8 *buf,
3831                            size_t len)
3832 {
3833         nl80211_send_mlme_event(rdev, netdev, buf, len, NL80211_CMD_ASSOCIATE);
3834 }
3835
3836 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
3837                          struct net_device *netdev, const u8 *buf, size_t len)
3838 {
3839         nl80211_send_mlme_event(rdev, netdev, buf, len,
3840                                 NL80211_CMD_DEAUTHENTICATE);
3841 }
3842
3843 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
3844                            struct net_device *netdev, const u8 *buf,
3845                            size_t len)
3846 {
3847         nl80211_send_mlme_event(rdev, netdev, buf, len,
3848                                 NL80211_CMD_DISASSOCIATE);
3849 }
3850
3851 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
3852                                       struct net_device *netdev, int cmd,
3853                                       const u8 *addr)
3854 {
3855         struct sk_buff *msg;
3856         void *hdr;
3857
3858         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
3859         if (!msg)
3860                 return;
3861
3862         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
3863         if (!hdr) {
3864                 nlmsg_free(msg);
3865                 return;
3866         }
3867
3868         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3869         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3870         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
3871         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3872
3873         if (genlmsg_end(msg, hdr) < 0) {
3874                 nlmsg_free(msg);
3875                 return;
3876         }
3877
3878         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_ATOMIC);
3879         return;
3880
3881  nla_put_failure:
3882         genlmsg_cancel(msg, hdr);
3883         nlmsg_free(msg);
3884 }
3885
3886 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
3887                                struct net_device *netdev, const u8 *addr)
3888 {
3889         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
3890                                   addr);
3891 }
3892
3893 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
3894                                 struct net_device *netdev, const u8 *addr)
3895 {
3896         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE, addr);
3897 }
3898
3899 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
3900                              struct net_device *netdev, const u8 *bssid,
3901                              gfp_t gfp)
3902 {
3903         struct sk_buff *msg;
3904         void *hdr;
3905
3906         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
3907         if (!msg)
3908                 return;
3909
3910         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
3911         if (!hdr) {
3912                 nlmsg_free(msg);
3913                 return;
3914         }
3915
3916         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3917         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3918         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
3919
3920         if (genlmsg_end(msg, hdr) < 0) {
3921                 nlmsg_free(msg);
3922                 return;
3923         }
3924
3925         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
3926         return;
3927
3928  nla_put_failure:
3929         genlmsg_cancel(msg, hdr);
3930         nlmsg_free(msg);
3931 }
3932
3933 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
3934                                  struct net_device *netdev, const u8 *addr,
3935                                  enum nl80211_key_type key_type, int key_id,
3936                                  const u8 *tsc)
3937 {
3938         struct sk_buff *msg;
3939         void *hdr;
3940
3941         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
3942         if (!msg)
3943                 return;
3944
3945         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
3946         if (!hdr) {
3947                 nlmsg_free(msg);
3948                 return;
3949         }
3950
3951         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3952         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3953         if (addr)
3954                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3955         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
3956         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
3957         if (tsc)
3958                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
3959
3960         if (genlmsg_end(msg, hdr) < 0) {
3961                 nlmsg_free(msg);
3962                 return;
3963         }
3964
3965         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_ATOMIC);
3966         return;
3967
3968  nla_put_failure:
3969         genlmsg_cancel(msg, hdr);
3970         nlmsg_free(msg);
3971 }
3972
3973 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
3974                                     struct ieee80211_channel *channel_before,
3975                                     struct ieee80211_channel *channel_after)
3976 {
3977         struct sk_buff *msg;
3978         void *hdr;
3979         struct nlattr *nl_freq;
3980
3981         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
3982         if (!msg)
3983                 return;
3984
3985         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
3986         if (!hdr) {
3987                 nlmsg_free(msg);
3988                 return;
3989         }
3990
3991         /*
3992          * Since we are applying the beacon hint to a wiphy we know its
3993          * wiphy_idx is valid
3994          */
3995         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
3996
3997         /* Before */
3998         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
3999         if (!nl_freq)
4000                 goto nla_put_failure;
4001         if (nl80211_msg_put_channel(msg, channel_before))
4002                 goto nla_put_failure;
4003         nla_nest_end(msg, nl_freq);
4004
4005         /* After */
4006         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
4007         if (!nl_freq)
4008                 goto nla_put_failure;
4009         if (nl80211_msg_put_channel(msg, channel_after))
4010                 goto nla_put_failure;
4011         nla_nest_end(msg, nl_freq);
4012
4013         if (genlmsg_end(msg, hdr) < 0) {
4014                 nlmsg_free(msg);
4015                 return;
4016         }
4017
4018         genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_ATOMIC);
4019
4020         return;
4021
4022 nla_put_failure:
4023         genlmsg_cancel(msg, hdr);
4024         nlmsg_free(msg);
4025 }
4026
4027 /* initialisation/exit functions */
4028
4029 int nl80211_init(void)
4030 {
4031         int err;
4032
4033         err = genl_register_family_with_ops(&nl80211_fam,
4034                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
4035         if (err)
4036                 return err;
4037
4038         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
4039         if (err)
4040                 goto err_out;
4041
4042         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
4043         if (err)
4044                 goto err_out;
4045
4046         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
4047         if (err)
4048                 goto err_out;
4049
4050         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
4051         if (err)
4052                 goto err_out;
4053
4054         return 0;
4055  err_out:
4056         genl_unregister_family(&nl80211_fam);
4057         return err;
4058 }
4059
4060 void nl80211_exit(void)
4061 {
4062         genl_unregister_family(&nl80211_fam);
4063 }