net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2009  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/list.h>
  11 #include <linux/if_ether.h>
  12 #include <linux/ieee80211.h>
  13 #include <linux/nl80211.h>
  14 #include <linux/rtnetlink.h>
  15 #include <linux/netlink.h>
  16 #include <linux/etherdevice.h>
  17 #include <net/genetlink.h>
  18 #include <net/cfg80211.h>
  19 #include "core.h"
  20 #include "nl80211.h"
  21 #include "reg.h"
  22
  23 /* the netlink family */
  24 static struct genl_family nl80211_fam = {
  25         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  26         .name = "nl80211",      /* have users key off the name instead */
  27         .hdrsize = 0,           /* no private header */
  28         .version = 1,           /* no particular meaning now */
  29         .maxattr = NL80211_ATTR_MAX,
  30 };
  31
  32 /* internal helper: get drv and dev */
  33 static int get_drv_dev_by_info_ifindex(struct nlattr **attrs,
  34                                        struct cfg80211_registered_device **drv,
  35                                        struct net_device **dev)
  36 {
  37         int ifindex;
  38
  39         if (!attrs[NL80211_ATTR_IFINDEX])
  40                 return -EINVAL;
  41
  42         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  43         *dev = dev_get_by_index(&init_net, ifindex);
  44         if (!*dev)
  45                 return -ENODEV;
  46
  47         *drv = cfg80211_get_dev_from_ifindex(ifindex);
  48         if (IS_ERR(*drv)) {
  49                 dev_put(*dev);
  50                 return PTR_ERR(*drv);
  51         }
  52
  53         return 0;
  54 }
  55
  56 /* policy for the attributes */
  57 static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
  58         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  59         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  60                                       .len = 20-1 },
  61         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  62         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  63         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  64         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
  65         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
  66         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
  67         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
  68
  69         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  70         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  71         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  72
  73         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  74
  75         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  76                                     .len = WLAN_MAX_KEY_LEN },
  77         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  78         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  79         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
  80         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
  81
  82         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
  83         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
  84         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
  85                                        .len = IEEE80211_MAX_DATA_LEN },
  86         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
  87                                        .len = IEEE80211_MAX_DATA_LEN },
  88         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
  89         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
  90         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
  91         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
  92                                                .len = NL80211_MAX_SUPP_RATES },
  93         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
  94         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
  95         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
  96         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
  97                                 .len = IEEE80211_MAX_MESH_ID_LEN },
  98         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
  99
 100         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 101         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 102
 103         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 104         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 105         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 106         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 107                                            .len = NL80211_MAX_SUPP_RATES },
 108
 109         [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
 110
 111         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 112                                          .len = NL80211_HT_CAPABILITY_LEN },
 113
 114         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 115         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 116                               .len = IEEE80211_MAX_DATA_LEN },
 117         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 118         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 119
 120         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 121                                 .len = IEEE80211_MAX_SSID_LEN },
 122         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 123         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 124         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 125         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 126         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 127         [NL80211_ATTR_STA_FLAGS2] = {
 128                 .len = sizeof(struct nl80211_sta_flag_update),
 129         },
 130         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 131 };
 132
 133 /* IE validation */
 134 static bool is_valid_ie_attr(const struct nlattr *attr)
 135 {
 136         const u8 *pos;
 137         int len;
 138
 139         if (!attr)
 140                 return true;
 141
 142         pos = nla_data(attr);
 143         len = nla_len(attr);
 144
 145         while (len) {
 146                 u8 elemlen;
 147
 148                 if (len < 2)
 149                         return false;
 150                 len -= 2;
 151
 152                 elemlen = pos[1];
 153                 if (elemlen > len)
 154                         return false;
 155
 156                 len -= elemlen;
 157                 pos += 2 + elemlen;
 158         }
 159
 160         return true;
 161 }
 162
 163 /* message building helper */
 164 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 165                                    int flags, u8 cmd)
 166 {
 167         /* since there is no private header just add the generic one */
 168         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 169 }
 170
 171 static int nl80211_msg_put_channel(struct sk_buff *msg,
 172                                    struct ieee80211_channel *chan)
 173 {
 174         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 175                     chan->center_freq);
 176
 177         if (chan->flags & IEEE80211_CHAN_DISABLED)
 178                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 179         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 180                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 181         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 182                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 183         if (chan->flags & IEEE80211_CHAN_RADAR)
 184                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 185
 186         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 187                     DBM_TO_MBM(chan->max_power));
 188
 189         return 0;
 190
 191  nla_put_failure:
 192         return -ENOBUFS;
 193 }
 194
 195 /* netlink command implementations */
 196
 197 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 198                               struct cfg80211_registered_device *dev)
 199 {
 200         void *hdr;
 201         struct nlattr *nl_bands, *nl_band;
 202         struct nlattr *nl_freqs, *nl_freq;
 203         struct nlattr *nl_rates, *nl_rate;
 204         struct nlattr *nl_modes;
 205         struct nlattr *nl_cmds;
 206         enum ieee80211_band band;
 207         struct ieee80211_channel *chan;
 208         struct ieee80211_rate *rate;
 209         int i;
 210         u16 ifmodes = dev->wiphy.interface_modes;
 211
 212         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 213         if (!hdr)
 214                 return -1;
 215
 216         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 217         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 218
 219         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 220                    dev->wiphy.retry_short);
 221         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 222                    dev->wiphy.retry_long);
 223         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 224                     dev->wiphy.frag_threshold);
 225         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 226                     dev->wiphy.rts_threshold);
 227
 228         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 229                    dev->wiphy.max_scan_ssids);
 230         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 231                     dev->wiphy.max_scan_ie_len);
 232
 233         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
 234                 sizeof(u32) * dev->wiphy.n_cipher_suites,
 235                 dev->wiphy.cipher_suites);
 236
 237         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
 238         if (!nl_modes)
 239                 goto nla_put_failure;
 240
 241         i = 0;
 242         while (ifmodes) {
 243                 if (ifmodes & 1)
 244                         NLA_PUT_FLAG(msg, i);
 245                 ifmodes >>= 1;
 246                 i++;
 247         }
 248
 249         nla_nest_end(msg, nl_modes);
 250
 251         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 252         if (!nl_bands)
 253                 goto nla_put_failure;
 254
 255         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 256                 if (!dev->wiphy.bands[band])
 257                         continue;
 258
 259                 nl_band = nla_nest_start(msg, band);
 260                 if (!nl_band)
 261                         goto nla_put_failure;
 262
 263                 /* add HT info */
 264                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 265                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 266                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 267                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 268                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 269                                 dev->wiphy.bands[band]->ht_cap.cap);
 270                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 271                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 272                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 273                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 274                 }
 275
 276                 /* add frequencies */
 277                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 278                 if (!nl_freqs)
 279                         goto nla_put_failure;
 280
 281                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 282                         nl_freq = nla_nest_start(msg, i);
 283                         if (!nl_freq)
 284                                 goto nla_put_failure;
 285
 286                         chan = &dev->wiphy.bands[band]->channels[i];
 287
 288                         if (nl80211_msg_put_channel(msg, chan))
 289                                 goto nla_put_failure;
 290
 291                         nla_nest_end(msg, nl_freq);
 292                 }
 293
 294                 nla_nest_end(msg, nl_freqs);
 295
 296                 /* add bitrates */
 297                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 298                 if (!nl_rates)
 299                         goto nla_put_failure;
 300
 301                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 302                         nl_rate = nla_nest_start(msg, i);
 303                         if (!nl_rate)
 304                                 goto nla_put_failure;
 305
 306                         rate = &dev->wiphy.bands[band]->bitrates[i];
 307                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 308                                     rate->bitrate);
 309                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 310                                 NLA_PUT_FLAG(msg,
 311                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 312
 313                         nla_nest_end(msg, nl_rate);
 314                 }
 315
 316                 nla_nest_end(msg, nl_rates);
 317
 318                 nla_nest_end(msg, nl_band);
 319         }
 320         nla_nest_end(msg, nl_bands);
 321
 322         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 323         if (!nl_cmds)
 324                 goto nla_put_failure;
 325
 326         i = 0;
 327 #define CMD(op, n)                                              \
 328          do {                                                   \
 329                 if (dev->ops->op) {                             \
 330                         i++;                                    \
 331                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 332                 }                                               \
 333         } while (0)
 334
 335         CMD(add_virtual_intf, NEW_INTERFACE);
 336         CMD(change_virtual_intf, SET_INTERFACE);
 337         CMD(add_key, NEW_KEY);
 338         CMD(add_beacon, NEW_BEACON);
 339         CMD(add_station, NEW_STATION);
 340         CMD(add_mpath, NEW_MPATH);
 341         CMD(set_mesh_params, SET_MESH_PARAMS);
 342         CMD(change_bss, SET_BSS);
 343         CMD(auth, AUTHENTICATE);
 344         CMD(assoc, ASSOCIATE);
 345         CMD(deauth, DEAUTHENTICATE);
 346         CMD(disassoc, DISASSOCIATE);
 347         CMD(join_ibss, JOIN_IBSS);
 348
 349 #undef CMD
 350         nla_nest_end(msg, nl_cmds);
 351
 352         return genlmsg_end(msg, hdr);
 353
 354  nla_put_failure:
 355         genlmsg_cancel(msg, hdr);
 356         return -EMSGSIZE;
 357 }
 358
 359 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 360 {
 361         int idx = 0;
 362         int start = cb->args[0];
 363         struct cfg80211_registered_device *dev;
 364
 365         mutex_lock(&cfg80211_mutex);
 366         list_for_each_entry(dev, &cfg80211_drv_list, list) {
 367                 if (++idx <= start)
 368                         continue;
 369                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
 370                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
 371                                        dev) < 0) {
 372                         idx--;
 373                         break;
 374                 }
 375         }
 376         mutex_unlock(&cfg80211_mutex);
 377
 378         cb->args[0] = idx;
 379
 380         return skb->len;
 381 }
 382
 383 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 384 {
 385         struct sk_buff *msg;
 386         struct cfg80211_registered_device *dev;
 387
 388         dev = cfg80211_get_dev_from_info(info);
 389         if (IS_ERR(dev))
 390                 return PTR_ERR(dev);
 391
 392         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 393         if (!msg)
 394                 goto out_err;
 395
 396         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
 397                 goto out_free;
 398
 399         cfg80211_put_dev(dev);
 400
 401         return genlmsg_unicast(msg, info->snd_pid);
 402
 403  out_free:
 404         nlmsg_free(msg);
 405  out_err:
 406         cfg80211_put_dev(dev);
 407         return -ENOBUFS;
 408 }
 409
 410 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 411         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
 412         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
 413         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
 414         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
 415         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
 416 };
 417
 418 static int parse_txq_params(struct nlattr *tb[],
 419                             struct ieee80211_txq_params *txq_params)
 420 {
 421         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 422             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 423             !tb[NL80211_TXQ_ATTR_AIFS])
 424                 return -EINVAL;
 425
 426         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
 427         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 428         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 429         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 430         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 431
 432         return 0;
 433 }
 434
 435 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 436 {
 437         struct cfg80211_registered_device *rdev;
 438         int result = 0, rem_txq_params = 0;
 439         struct nlattr *nl_txq_params;
 440         u32 changed;
 441         u8 retry_short = 0, retry_long = 0;
 442         u32 frag_threshold = 0, rts_threshold = 0;
 443
 444         rtnl_lock();
 445
 446         mutex_lock(&cfg80211_mutex);
 447
 448         rdev = __cfg80211_drv_from_info(info);
 449         if (IS_ERR(rdev)) {
 450                 mutex_unlock(&cfg80211_mutex);
 451                 result = PTR_ERR(rdev);
 452                 goto unlock;
 453         }
 454
 455         mutex_lock(&rdev->mtx);
 456
 457         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
 458                 result = cfg80211_dev_rename(
 459                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 460
 461         mutex_unlock(&cfg80211_mutex);
 462
 463         if (result)
 464                 goto bad_res;
 465
 466         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
 467                 struct ieee80211_txq_params txq_params;
 468                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
 469
 470                 if (!rdev->ops->set_txq_params) {
 471                         result = -EOPNOTSUPP;
 472                         goto bad_res;
 473                 }
 474
 475                 nla_for_each_nested(nl_txq_params,
 476                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
 477                                     rem_txq_params) {
 478                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
 479                                   nla_data(nl_txq_params),
 480                                   nla_len(nl_txq_params),
 481                                   txq_params_policy);
 482                         result = parse_txq_params(tb, &txq_params);
 483                         if (result)
 484                                 goto bad_res;
 485
 486                         result = rdev->ops->set_txq_params(&rdev->wiphy,
 487                                                            &txq_params);
 488                         if (result)
 489                                 goto bad_res;
 490                 }
 491         }
 492
 493         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
 494                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 495                 struct ieee80211_channel *chan;
 496                 struct ieee80211_sta_ht_cap *ht_cap;
 497                 u32 freq;
 498
 499                 if (!rdev->ops->set_channel) {
 500                         result = -EOPNOTSUPP;
 501                         goto bad_res;
 502                 }
 503
 504                 result = -EINVAL;
 505
 506                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 507                         channel_type = nla_get_u32(info->attrs[
 508                                            NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 509                         if (channel_type != NL80211_CHAN_NO_HT &&
 510                             channel_type != NL80211_CHAN_HT20 &&
 511                             channel_type != NL80211_CHAN_HT40PLUS &&
 512                             channel_type != NL80211_CHAN_HT40MINUS)
 513                                 goto bad_res;
 514                 }
 515
 516                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 517                 chan = ieee80211_get_channel(&rdev->wiphy, freq);
 518
 519                 /* Primary channel not allowed */
 520                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 521                         goto bad_res;
 522
 523                 if (channel_type == NL80211_CHAN_HT40MINUS &&
 524                     (chan->flags & IEEE80211_CHAN_NO_HT40MINUS))
 525                         goto bad_res;
 526                 else if (channel_type == NL80211_CHAN_HT40PLUS &&
 527                          (chan->flags & IEEE80211_CHAN_NO_HT40PLUS))
 528                         goto bad_res;
 529
 530                 /*
 531                  * At this point we know if that if HT40 was requested
 532                  * we are allowed to use it and the extension channel
 533                  * exists.
 534                  */
 535
 536                 ht_cap = &rdev->wiphy.bands[chan->band]->ht_cap;
 537
 538                 /* no HT capabilities or intolerant */
 539                 if (channel_type != NL80211_CHAN_NO_HT) {
 540                         if (!ht_cap->ht_supported)
 541                                 goto bad_res;
 542                         if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
 543                             (ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT))
 544                                 goto bad_res;
 545                 }
 546
 547                 result = rdev->ops->set_channel(&rdev->wiphy, chan,
 548                                                 channel_type);
 549                 if (result)
 550                         goto bad_res;
 551         }
 552
 553         changed = 0;
 554
 555         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
 556                 retry_short = nla_get_u8(
 557                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
 558                 if (retry_short == 0) {
 559                         result = -EINVAL;
 560                         goto bad_res;
 561                 }
 562                 changed |= WIPHY_PARAM_RETRY_SHORT;
 563         }
 564
 565         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
 566                 retry_long = nla_get_u8(
 567                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
 568                 if (retry_long == 0) {
 569                         result = -EINVAL;
 570                         goto bad_res;
 571                 }
 572                 changed |= WIPHY_PARAM_RETRY_LONG;
 573         }
 574
 575         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
 576                 frag_threshold = nla_get_u32(
 577                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
 578                 if (frag_threshold < 256) {
 579                         result = -EINVAL;
 580                         goto bad_res;
 581                 }
 582                 if (frag_threshold != (u32) -1) {
 583                         /*
 584                          * Fragments (apart from the last one) are required to
 585                          * have even length. Make the fragmentation code
 586                          * simpler by stripping LSB should someone try to use
 587                          * odd threshold value.
 588                          */
 589                         frag_threshold &= ~0x1;
 590                 }
 591                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
 592         }
 593
 594         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
 595                 rts_threshold = nla_get_u32(
 596                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
 597                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
 598         }
 599
 600         if (changed) {
 601                 u8 old_retry_short, old_retry_long;
 602                 u32 old_frag_threshold, old_rts_threshold;
 603
 604                 if (!rdev->ops->set_wiphy_params) {
 605                         result = -EOPNOTSUPP;
 606                         goto bad_res;
 607                 }
 608
 609                 old_retry_short = rdev->wiphy.retry_short;
 610                 old_retry_long = rdev->wiphy.retry_long;
 611                 old_frag_threshold = rdev->wiphy.frag_threshold;
 612                 old_rts_threshold = rdev->wiphy.rts_threshold;
 613
 614                 if (changed & WIPHY_PARAM_RETRY_SHORT)
 615                         rdev->wiphy.retry_short = retry_short;
 616                 if (changed & WIPHY_PARAM_RETRY_LONG)
 617                         rdev->wiphy.retry_long = retry_long;
 618                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
 619                         rdev->wiphy.frag_threshold = frag_threshold;
 620                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
 621                         rdev->wiphy.rts_threshold = rts_threshold;
 622
 623                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
 624                 if (result) {
 625                         rdev->wiphy.retry_short = old_retry_short;
 626                         rdev->wiphy.retry_long = old_retry_long;
 627                         rdev->wiphy.frag_threshold = old_frag_threshold;
 628                         rdev->wiphy.rts_threshold = old_rts_threshold;
 629                 }
 630         }
 631
 632  bad_res:
 633         mutex_unlock(&rdev->mtx);
 634  unlock:
 635         rtnl_unlock();
 636         return result;
 637 }
 638
 639
 640 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 641                               struct cfg80211_registered_device *rdev,
 642                               struct net_device *dev)
 643 {
 644         void *hdr;
 645
 646         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
 647         if (!hdr)
 648                 return -1;
 649
 650         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 651         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 652         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
 653         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
 654         return genlmsg_end(msg, hdr);
 655
 656  nla_put_failure:
 657         genlmsg_cancel(msg, hdr);
 658         return -EMSGSIZE;
 659 }
 660
 661 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
 662 {
 663         int wp_idx = 0;
 664         int if_idx = 0;
 665         int wp_start = cb->args[0];
 666         int if_start = cb->args[1];
 667         struct cfg80211_registered_device *dev;
 668         struct wireless_dev *wdev;
 669
 670         mutex_lock(&cfg80211_mutex);
 671         list_for_each_entry(dev, &cfg80211_drv_list, list) {
 672                 if (wp_idx < wp_start) {
 673                         wp_idx++;
 674                         continue;
 675                 }
 676                 if_idx = 0;
 677
 678                 mutex_lock(&dev->devlist_mtx);
 679                 list_for_each_entry(wdev, &dev->netdev_list, list) {
 680                         if (if_idx < if_start) {
 681                                 if_idx++;
 682                                 continue;
 683                         }
 684                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
 685                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
 686                                                dev, wdev->netdev) < 0) {
 687                                 mutex_unlock(&dev->devlist_mtx);
 688                                 goto out;
 689                         }
 690                         if_idx++;
 691                 }
 692                 mutex_unlock(&dev->devlist_mtx);
 693
 694                 wp_idx++;
 695         }
 696  out:
 697         mutex_unlock(&cfg80211_mutex);
 698
 699         cb->args[0] = wp_idx;
 700         cb->args[1] = if_idx;
 701
 702         return skb->len;
 703 }
 704
 705 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
 706 {
 707         struct sk_buff *msg;
 708         struct cfg80211_registered_device *dev;
 709         struct net_device *netdev;
 710         int err;
 711
 712         err = get_drv_dev_by_info_ifindex(info->attrs, &dev, &netdev);
 713         if (err)
 714                 return err;
 715
 716         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 717         if (!msg)
 718                 goto out_err;
 719
 720         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
 721                                dev, netdev) < 0)
 722                 goto out_free;
 723
 724         dev_put(netdev);
 725         cfg80211_put_dev(dev);
 726
 727         return genlmsg_unicast(msg, info->snd_pid);
 728
 729  out_free:
 730         nlmsg_free(msg);
 731  out_err:
 732         dev_put(netdev);
 733         cfg80211_put_dev(dev);
 734         return -ENOBUFS;
 735 }
 736
 737 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
 738         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
 739         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
 740         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
 741         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
 742         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
 743 };
 744
 745 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
 746 {
 747         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
 748         int flag;
 749
 750         *mntrflags = 0;
 751
 752         if (!nla)
 753                 return -EINVAL;
 754
 755         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
 756                              nla, mntr_flags_policy))
 757                 return -EINVAL;
 758
 759         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
 760                 if (flags[flag])
 761                         *mntrflags |= (1<<flag);
 762
 763         return 0;
 764 }
 765
 766 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 767 {
 768         struct cfg80211_registered_device *drv;
 769         struct vif_params params;
 770         int err;
 771         enum nl80211_iftype otype, ntype;
 772         struct net_device *dev;
 773         u32 _flags, *flags = NULL;
 774         bool change = false;
 775
 776         memset(&params, 0, sizeof(params));
 777
 778         rtnl_lock();
 779
 780         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 781         if (err)
 782                 goto unlock_rtnl;
 783
 784         otype = ntype = dev->ieee80211_ptr->iftype;
 785
 786         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 787                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 788                 if (otype != ntype)
 789                         change = true;
 790                 if (ntype > NL80211_IFTYPE_MAX) {
 791                         err = -EINVAL;
 792                         goto unlock;
 793                 }
 794         }
 795
 796         if (!drv->ops->change_virtual_intf ||
 797             !(drv->wiphy.interface_modes & (1 << ntype))) {
 798                 err = -EOPNOTSUPP;
 799                 goto unlock;
 800         }
 801
 802         if (info->attrs[NL80211_ATTR_MESH_ID]) {
 803                 if (ntype != NL80211_IFTYPE_MESH_POINT) {
 804                         err = -EINVAL;
 805                         goto unlock;
 806                 }
 807                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 808                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 809                 change = true;
 810         }
 811
 812         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
 813                 if (ntype != NL80211_IFTYPE_MONITOR) {
 814                         err = -EINVAL;
 815                         goto unlock;
 816                 }
 817                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
 818                                           &_flags);
 819                 if (err)
 820                         goto unlock;
 821
 822                 flags = &_flags;
 823                 change = true;
 824         }
 825
 826         if (change)
 827                 err = drv->ops->change_virtual_intf(&drv->wiphy, dev,
 828                                                     ntype, flags, &params);
 829         else
 830                 err = 0;
 831
 832         WARN_ON(!err && dev->ieee80211_ptr->iftype != ntype);
 833
 834         if (!err && (ntype != otype)) {
 835                 if (otype == NL80211_IFTYPE_ADHOC)
 836                         cfg80211_clear_ibss(dev, false);
 837         }
 838
 839  unlock:
 840         dev_put(dev);
 841         cfg80211_put_dev(drv);
 842  unlock_rtnl:
 843         rtnl_unlock();
 844         return err;
 845 }
 846
 847 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
 848 {
 849         struct cfg80211_registered_device *drv;
 850         struct vif_params params;
 851         int err;
 852         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
 853         u32 flags;
 854
 855         memset(&params, 0, sizeof(params));
 856
 857         if (!info->attrs[NL80211_ATTR_IFNAME])
 858                 return -EINVAL;
 859
 860         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 861                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 862                 if (type > NL80211_IFTYPE_MAX)
 863                         return -EINVAL;
 864         }
 865
 866         rtnl_lock();
 867
 868         drv = cfg80211_get_dev_from_info(info);
 869         if (IS_ERR(drv)) {
 870                 err = PTR_ERR(drv);
 871                 goto unlock_rtnl;
 872         }
 873
 874         if (!drv->ops->add_virtual_intf ||
 875             !(drv->wiphy.interface_modes & (1 << type))) {
 876                 err = -EOPNOTSUPP;
 877                 goto unlock;
 878         }
 879
 880         if (type == NL80211_IFTYPE_MESH_POINT &&
 881             info->attrs[NL80211_ATTR_MESH_ID]) {
 882                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 883                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 884         }
 885
 886         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
 887                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
 888                                   &flags);
 889         err = drv->ops->add_virtual_intf(&drv->wiphy,
 890                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
 891                 type, err ? NULL : &flags, &params);
 892
 893  unlock:
 894         cfg80211_put_dev(drv);
 895  unlock_rtnl:
 896         rtnl_unlock();
 897         return err;
 898 }
 899
 900 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
 901 {
 902         struct cfg80211_registered_device *drv;
 903         int ifindex, err;
 904         struct net_device *dev;
 905
 906         rtnl_lock();
 907
 908         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 909         if (err)
 910                 goto unlock_rtnl;
 911         ifindex = dev->ifindex;
 912         dev_put(dev);
 913
 914         if (!drv->ops->del_virtual_intf) {
 915                 err = -EOPNOTSUPP;
 916                 goto out;
 917         }
 918
 919         err = drv->ops->del_virtual_intf(&drv->wiphy, ifindex);
 920
 921  out:
 922         cfg80211_put_dev(drv);
 923  unlock_rtnl:
 924         rtnl_unlock();
 925         return err;
 926 }
 927
 928 struct get_key_cookie {
 929         struct sk_buff *msg;
 930         int error;
 931 };
 932
 933 static void get_key_callback(void *c, struct key_params *params)
 934 {
 935         struct get_key_cookie *cookie = c;
 936
 937         if (params->key)
 938                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
 939                         params->key_len, params->key);
 940
 941         if (params->seq)
 942                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
 943                         params->seq_len, params->seq);
 944
 945         if (params->cipher)
 946                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
 947                             params->cipher);
 948
 949         return;
 950  nla_put_failure:
 951         cookie->error = 1;
 952 }
 953
 954 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
 955 {
 956         struct cfg80211_registered_device *drv;
 957         int err;
 958         struct net_device *dev;
 959         u8 key_idx = 0;
 960         u8 *mac_addr = NULL;
 961         struct get_key_cookie cookie = {
 962                 .error = 0,
 963         };
 964         void *hdr;
 965         struct sk_buff *msg;
 966
 967         if (info->attrs[NL80211_ATTR_KEY_IDX])
 968                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 969
 970         if (key_idx > 5)
 971                 return -EINVAL;
 972
 973         if (info->attrs[NL80211_ATTR_MAC])
 974                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 975
 976         rtnl_lock();
 977
 978         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 979         if (err)
 980                 goto unlock_rtnl;
 981
 982         if (!drv->ops->get_key) {
 983                 err = -EOPNOTSUPP;
 984                 goto out;
 985         }
 986
 987         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 988         if (!msg) {
 989                 err = -ENOMEM;
 990                 goto out;
 991         }
 992
 993         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
 994                              NL80211_CMD_NEW_KEY);
 995
 996         if (IS_ERR(hdr)) {
 997                 err = PTR_ERR(hdr);
 998                 goto out;
 999         }
1000
1001         cookie.msg = msg;
1002
1003         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1004         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1005         if (mac_addr)
1006                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1007
1008         err = drv->ops->get_key(&drv->wiphy, dev, key_idx, mac_addr,
1009                                 &cookie, get_key_callback);
1010
1011         if (err)
1012                 goto out;
1013
1014         if (cookie.error)
1015                 goto nla_put_failure;
1016
1017         genlmsg_end(msg, hdr);
1018         err = genlmsg_unicast(msg, info->snd_pid);
1019         goto out;
1020
1021  nla_put_failure:
1022         err = -ENOBUFS;
1023         nlmsg_free(msg);
1024  out:
1025         cfg80211_put_dev(drv);
1026         dev_put(dev);
1027  unlock_rtnl:
1028         rtnl_unlock();
1029
1030         return err;
1031 }
1032
1033 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1034 {
1035         struct cfg80211_registered_device *drv;
1036         int err;
1037         struct net_device *dev;
1038         u8 key_idx;
1039         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
1040                     u8 key_index);
1041
1042         if (!info->attrs[NL80211_ATTR_KEY_IDX])
1043                 return -EINVAL;
1044
1045         key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1046
1047         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]) {
1048                 if (key_idx < 4 || key_idx > 5)
1049                         return -EINVAL;
1050         } else if (key_idx > 3)
1051                 return -EINVAL;
1052
1053         /* currently only support setting default key */
1054         if (!info->attrs[NL80211_ATTR_KEY_DEFAULT] &&
1055             !info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT])
1056                 return -EINVAL;
1057
1058         rtnl_lock();
1059
1060         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1061         if (err)
1062                 goto unlock_rtnl;
1063
1064         if (info->attrs[NL80211_ATTR_KEY_DEFAULT])
1065                 func = drv->ops->set_default_key;
1066         else
1067                 func = drv->ops->set_default_mgmt_key;
1068
1069         if (!func) {
1070                 err = -EOPNOTSUPP;
1071                 goto out;
1072         }
1073
1074         err = func(&drv->wiphy, dev, key_idx);
1075 #ifdef CONFIG_WIRELESS_EXT
1076         if (!err) {
1077                 if (func == drv->ops->set_default_key)
1078                         dev->ieee80211_ptr->wext.default_key = key_idx;
1079                 else
1080                         dev->ieee80211_ptr->wext.default_mgmt_key = key_idx;
1081         }
1082 #endif
1083
1084  out:
1085         cfg80211_put_dev(drv);
1086         dev_put(dev);
1087
1088  unlock_rtnl:
1089         rtnl_unlock();
1090
1091         return err;
1092 }
1093
1094 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1095 {
1096         struct cfg80211_registered_device *drv;
1097         int err, i;
1098         struct net_device *dev;
1099         struct key_params params;
1100         u8 key_idx = 0;
1101         u8 *mac_addr = NULL;
1102
1103         memset(&params, 0, sizeof(params));
1104
1105         if (!info->attrs[NL80211_ATTR_KEY_CIPHER])
1106                 return -EINVAL;
1107
1108         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1109                 params.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1110                 params.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1111         }
1112
1113         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
1114                 params.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
1115                 params.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
1116         }
1117
1118         if (info->attrs[NL80211_ATTR_KEY_IDX])
1119                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1120
1121         params.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1122
1123         if (info->attrs[NL80211_ATTR_MAC])
1124                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1125
1126         if (cfg80211_validate_key_settings(&params, key_idx, mac_addr))
1127                 return -EINVAL;
1128
1129         rtnl_lock();
1130
1131         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1132         if (err)
1133                 goto unlock_rtnl;
1134
1135         for (i = 0; i < drv->wiphy.n_cipher_suites; i++)
1136                 if (params.cipher == drv->wiphy.cipher_suites[i])
1137                         break;
1138         if (i == drv->wiphy.n_cipher_suites) {
1139                 err = -EINVAL;
1140                 goto out;
1141         }
1142
1143         if (!drv->ops->add_key) {
1144                 err = -EOPNOTSUPP;
1145                 goto out;
1146         }
1147
1148         err = drv->ops->add_key(&drv->wiphy, dev, key_idx, mac_addr, &params);
1149
1150  out:
1151         cfg80211_put_dev(drv);
1152         dev_put(dev);
1153  unlock_rtnl:
1154         rtnl_unlock();
1155
1156         return err;
1157 }
1158
1159 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1160 {
1161         struct cfg80211_registered_device *drv;
1162         int err;
1163         struct net_device *dev;
1164         u8 key_idx = 0;
1165         u8 *mac_addr = NULL;
1166
1167         if (info->attrs[NL80211_ATTR_KEY_IDX])
1168                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1169
1170         if (key_idx > 5)
1171                 return -EINVAL;
1172
1173         if (info->attrs[NL80211_ATTR_MAC])
1174                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1175
1176         rtnl_lock();
1177
1178         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1179         if (err)
1180                 goto unlock_rtnl;
1181
1182         if (!drv->ops->del_key) {
1183                 err = -EOPNOTSUPP;
1184                 goto out;
1185         }
1186
1187         err = drv->ops->del_key(&drv->wiphy, dev, key_idx, mac_addr);
1188
1189 #ifdef CONFIG_WIRELESS_EXT
1190         if (!err) {
1191                 if (key_idx == dev->ieee80211_ptr->wext.default_key)
1192                         dev->ieee80211_ptr->wext.default_key = -1;
1193                 else if (key_idx == dev->ieee80211_ptr->wext.default_mgmt_key)
1194                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
1195         }
1196 #endif
1197
1198  out:
1199         cfg80211_put_dev(drv);
1200         dev_put(dev);
1201
1202  unlock_rtnl:
1203         rtnl_unlock();
1204
1205         return err;
1206 }
1207
1208 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1209 {
1210         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1211                     struct beacon_parameters *info);
1212         struct cfg80211_registered_device *drv;
1213         int err;
1214         struct net_device *dev;
1215         struct beacon_parameters params;
1216         int haveinfo = 0;
1217
1218         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
1219                 return -EINVAL;
1220
1221         rtnl_lock();
1222
1223         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1224         if (err)
1225                 goto unlock_rtnl;
1226
1227         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1228                 err = -EOPNOTSUPP;
1229                 goto out;
1230         }
1231
1232         switch (info->genlhdr->cmd) {
1233         case NL80211_CMD_NEW_BEACON:
1234                 /* these are required for NEW_BEACON */
1235                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1236                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1237                     !info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1238                         err = -EINVAL;
1239                         goto out;
1240                 }
1241
1242                 call = drv->ops->add_beacon;
1243                 break;
1244         case NL80211_CMD_SET_BEACON:
1245                 call = drv->ops->set_beacon;
1246                 break;
1247         default:
1248                 WARN_ON(1);
1249                 err = -EOPNOTSUPP;
1250                 goto out;
1251         }
1252
1253         if (!call) {
1254                 err = -EOPNOTSUPP;
1255                 goto out;
1256         }
1257
1258         memset(&params, 0, sizeof(params));
1259
1260         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1261                 params.interval =
1262                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1263                 haveinfo = 1;
1264         }
1265
1266         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1267                 params.dtim_period =
1268                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1269                 haveinfo = 1;
1270         }
1271
1272         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1273                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1274                 params.head_len =
1275                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1276                 haveinfo = 1;
1277         }
1278
1279         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1280                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1281                 params.tail_len =
1282                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1283                 haveinfo = 1;
1284         }
1285
1286         if (!haveinfo) {
1287                 err = -EINVAL;
1288                 goto out;
1289         }
1290
1291         err = call(&drv->wiphy, dev, &params);
1292
1293  out:
1294         cfg80211_put_dev(drv);
1295         dev_put(dev);
1296  unlock_rtnl:
1297         rtnl_unlock();
1298
1299         return err;
1300 }
1301
1302 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1303 {
1304         struct cfg80211_registered_device *drv;
1305         int err;
1306         struct net_device *dev;
1307
1308         rtnl_lock();
1309
1310         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1311         if (err)
1312                 goto unlock_rtnl;
1313
1314         if (!drv->ops->del_beacon) {
1315                 err = -EOPNOTSUPP;
1316                 goto out;
1317         }
1318
1319         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1320                 err = -EOPNOTSUPP;
1321                 goto out;
1322         }
1323         err = drv->ops->del_beacon(&drv->wiphy, dev);
1324
1325  out:
1326         cfg80211_put_dev(drv);
1327         dev_put(dev);
1328  unlock_rtnl:
1329         rtnl_unlock();
1330
1331         return err;
1332 }
1333
1334 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1335         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1336         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1337         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1338         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
1339 };
1340
1341 static int parse_station_flags(struct genl_info *info,
1342                                struct station_parameters *params)
1343 {
1344         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1345         struct nlattr *nla;
1346         int flag;
1347
1348         /*
1349          * Try parsing the new attribute first so userspace
1350          * can specify both for older kernels.
1351          */
1352         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
1353         if (nla) {
1354                 struct nl80211_sta_flag_update *sta_flags;
1355
1356                 sta_flags = nla_data(nla);
1357                 params->sta_flags_mask = sta_flags->mask;
1358                 params->sta_flags_set = sta_flags->set;
1359                 if ((params->sta_flags_mask |
1360                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
1361                         return -EINVAL;
1362                 return 0;
1363         }
1364
1365         /* if present, parse the old attribute */
1366
1367         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
1368         if (!nla)
1369                 return 0;
1370
1371         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1372                              nla, sta_flags_policy))
1373                 return -EINVAL;
1374
1375         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
1376         params->sta_flags_mask &= ~1;
1377
1378         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1379                 if (flags[flag])
1380                         params->sta_flags_set |= (1<<flag);
1381
1382         return 0;
1383 }
1384
1385 static u16 nl80211_calculate_bitrate(struct rate_info *rate)
1386 {
1387         int modulation, streams, bitrate;
1388
1389         if (!(rate->flags & RATE_INFO_FLAGS_MCS))
1390                 return rate->legacy;
1391
1392         /* the formula below does only work for MCS values smaller than 32 */
1393         if (rate->mcs >= 32)
1394                 return 0;
1395
1396         modulation = rate->mcs & 7;
1397         streams = (rate->mcs >> 3) + 1;
1398
1399         bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
1400                         13500000 : 6500000;
1401
1402         if (modulation < 4)
1403                 bitrate *= (modulation + 1);
1404         else if (modulation == 4)
1405                 bitrate *= (modulation + 2);
1406         else
1407                 bitrate *= (modulation + 3);
1408
1409         bitrate *= streams;
1410
1411         if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
1412                 bitrate = (bitrate / 9) * 10;
1413
1414         /* do NOT round down here */
1415         return (bitrate + 50000) / 100000;
1416 }
1417
1418 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1419                                 int flags, struct net_device *dev,
1420                                 u8 *mac_addr, struct station_info *sinfo)
1421 {
1422         void *hdr;
1423         struct nlattr *sinfoattr, *txrate;
1424         u16 bitrate;
1425
1426         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1427         if (!hdr)
1428                 return -1;
1429
1430         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1431         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1432
1433         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1434         if (!sinfoattr)
1435                 goto nla_put_failure;
1436         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1437                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1438                             sinfo->inactive_time);
1439         if (sinfo->filled & STATION_INFO_RX_BYTES)
1440                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1441                             sinfo->rx_bytes);
1442         if (sinfo->filled & STATION_INFO_TX_BYTES)
1443                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1444                             sinfo->tx_bytes);
1445         if (sinfo->filled & STATION_INFO_LLID)
1446                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1447                             sinfo->llid);
1448         if (sinfo->filled & STATION_INFO_PLID)
1449                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1450                             sinfo->plid);
1451         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1452                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1453                             sinfo->plink_state);
1454         if (sinfo->filled & STATION_INFO_SIGNAL)
1455                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1456                            sinfo->signal);
1457         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1458                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1459                 if (!txrate)
1460                         goto nla_put_failure;
1461
1462                 /* nl80211_calculate_bitrate will return 0 for mcs >= 32 */
1463                 bitrate = nl80211_calculate_bitrate(&sinfo->txrate);
1464                 if (bitrate > 0)
1465                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1466
1467                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1468                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1469                                     sinfo->txrate.mcs);
1470                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1471                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1472                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1473                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1474
1475                 nla_nest_end(msg, txrate);
1476         }
1477         if (sinfo->filled & STATION_INFO_RX_PACKETS)
1478                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
1479                             sinfo->rx_packets);
1480         if (sinfo->filled & STATION_INFO_TX_PACKETS)
1481                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
1482                             sinfo->tx_packets);
1483         nla_nest_end(msg, sinfoattr);
1484
1485         return genlmsg_end(msg, hdr);
1486
1487  nla_put_failure:
1488         genlmsg_cancel(msg, hdr);
1489         return -EMSGSIZE;
1490 }
1491
1492 static int nl80211_dump_station(struct sk_buff *skb,
1493                                 struct netlink_callback *cb)
1494 {
1495         struct station_info sinfo;
1496         struct cfg80211_registered_device *dev;
1497         struct net_device *netdev;
1498         u8 mac_addr[ETH_ALEN];
1499         int ifidx = cb->args[0];
1500         int sta_idx = cb->args[1];
1501         int err;
1502
1503         if (!ifidx) {
1504                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1505                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1506                                   nl80211_policy);
1507                 if (err)
1508                         return err;
1509
1510                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1511                         return -EINVAL;
1512
1513                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1514                 if (!ifidx)
1515                         return -EINVAL;
1516         }
1517
1518         rtnl_lock();
1519
1520         netdev = __dev_get_by_index(&init_net, ifidx);
1521         if (!netdev) {
1522                 err = -ENODEV;
1523                 goto out_rtnl;
1524         }
1525
1526         dev = cfg80211_get_dev_from_ifindex(ifidx);
1527         if (IS_ERR(dev)) {
1528                 err = PTR_ERR(dev);
1529                 goto out_rtnl;
1530         }
1531
1532         if (!dev->ops->dump_station) {
1533                 err = -EOPNOTSUPP;
1534                 goto out_err;
1535         }
1536
1537         while (1) {
1538                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1539                                              mac_addr, &sinfo);
1540                 if (err == -ENOENT)
1541                         break;
1542                 if (err)
1543                         goto out_err;
1544
1545                 if (nl80211_send_station(skb,
1546                                 NETLINK_CB(cb->skb).pid,
1547                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
1548                                 netdev, mac_addr,
1549                                 &sinfo) < 0)
1550                         goto out;
1551
1552                 sta_idx++;
1553         }
1554
1555
1556  out:
1557         cb->args[1] = sta_idx;
1558         err = skb->len;
1559  out_err:
1560         cfg80211_put_dev(dev);
1561  out_rtnl:
1562         rtnl_unlock();
1563
1564         return err;
1565 }
1566
1567 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1568 {
1569         struct cfg80211_registered_device *drv;
1570         int err;
1571         struct net_device *dev;
1572         struct station_info sinfo;
1573         struct sk_buff *msg;
1574         u8 *mac_addr = NULL;
1575
1576         memset(&sinfo, 0, sizeof(sinfo));
1577
1578         if (!info->attrs[NL80211_ATTR_MAC])
1579                 return -EINVAL;
1580
1581         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1582
1583         rtnl_lock();
1584
1585         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1586         if (err)
1587                 goto out_rtnl;
1588
1589         if (!drv->ops->get_station) {
1590                 err = -EOPNOTSUPP;
1591                 goto out;
1592         }
1593
1594         err = drv->ops->get_station(&drv->wiphy, dev, mac_addr, &sinfo);
1595         if (err)
1596                 goto out;
1597
1598         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1599         if (!msg)
1600                 goto out;
1601
1602         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1603                                  dev, mac_addr, &sinfo) < 0)
1604                 goto out_free;
1605
1606         err = genlmsg_unicast(msg, info->snd_pid);
1607         goto out;
1608
1609  out_free:
1610         nlmsg_free(msg);
1611  out:
1612         cfg80211_put_dev(drv);
1613         dev_put(dev);
1614  out_rtnl:
1615         rtnl_unlock();
1616
1617         return err;
1618 }
1619
1620 /*
1621  * Get vlan interface making sure it is on the right wiphy.
1622  */
1623 static int get_vlan(struct nlattr *vlanattr,
1624                     struct cfg80211_registered_device *rdev,
1625                     struct net_device **vlan)
1626 {
1627         *vlan = NULL;
1628
1629         if (vlanattr) {
1630                 *vlan = dev_get_by_index(&init_net, nla_get_u32(vlanattr));
1631                 if (!*vlan)
1632                         return -ENODEV;
1633                 if (!(*vlan)->ieee80211_ptr)
1634                         return -EINVAL;
1635                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
1636                         return -EINVAL;
1637         }
1638         return 0;
1639 }
1640
1641 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
1642 {
1643         struct cfg80211_registered_device *drv;
1644         int err;
1645         struct net_device *dev;
1646         struct station_parameters params;
1647         u8 *mac_addr = NULL;
1648
1649         memset(&params, 0, sizeof(params));
1650
1651         params.listen_interval = -1;
1652
1653         if (info->attrs[NL80211_ATTR_STA_AID])
1654                 return -EINVAL;
1655
1656         if (!info->attrs[NL80211_ATTR_MAC])
1657                 return -EINVAL;
1658
1659         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1660
1661         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
1662                 params.supported_rates =
1663                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1664                 params.supported_rates_len =
1665                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1666         }
1667
1668         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1669                 params.listen_interval =
1670                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1671
1672         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1673                 params.ht_capa =
1674                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1675
1676         if (parse_station_flags(info, &params))
1677                 return -EINVAL;
1678
1679         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
1680                 params.plink_action =
1681                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
1682
1683         rtnl_lock();
1684
1685         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1686         if (err)
1687                 goto out_rtnl;
1688
1689         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1690         if (err)
1691                 goto out;
1692
1693         /* validate settings */
1694         err = 0;
1695
1696         switch (dev->ieee80211_ptr->iftype) {
1697         case NL80211_IFTYPE_AP:
1698         case NL80211_IFTYPE_AP_VLAN:
1699                 /* disallow mesh-specific things */
1700                 if (params.plink_action)
1701                         err = -EINVAL;
1702                 break;
1703         case NL80211_IFTYPE_STATION:
1704                 /* disallow everything but AUTHORIZED flag */
1705                 if (params.plink_action)
1706                         err = -EINVAL;
1707                 if (params.vlan)
1708                         err = -EINVAL;
1709                 if (params.supported_rates)
1710                         err = -EINVAL;
1711                 if (params.ht_capa)
1712                         err = -EINVAL;
1713                 if (params.listen_interval >= 0)
1714                         err = -EINVAL;
1715                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
1716                         err = -EINVAL;
1717                 break;
1718         case NL80211_IFTYPE_MESH_POINT:
1719                 /* disallow things mesh doesn't support */
1720                 if (params.vlan)
1721                         err = -EINVAL;
1722                 if (params.ht_capa)
1723                         err = -EINVAL;
1724                 if (params.listen_interval >= 0)
1725                         err = -EINVAL;
1726                 if (params.supported_rates)
1727                         err = -EINVAL;
1728                 if (params.sta_flags_mask)
1729                         err = -EINVAL;
1730                 break;
1731         default:
1732                 err = -EINVAL;
1733         }
1734
1735         if (err)
1736                 goto out;
1737
1738         if (!drv->ops->change_station) {
1739                 err = -EOPNOTSUPP;
1740                 goto out;
1741         }
1742
1743         err = drv->ops->change_station(&drv->wiphy, dev, mac_addr, &params);
1744
1745  out:
1746         if (params.vlan)
1747                 dev_put(params.vlan);
1748         cfg80211_put_dev(drv);
1749         dev_put(dev);
1750  out_rtnl:
1751         rtnl_unlock();
1752
1753         return err;
1754 }
1755
1756 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
1757 {
1758         struct cfg80211_registered_device *drv;
1759         int err;
1760         struct net_device *dev;
1761         struct station_parameters params;
1762         u8 *mac_addr = NULL;
1763
1764         memset(&params, 0, sizeof(params));
1765
1766         if (!info->attrs[NL80211_ATTR_MAC])
1767                 return -EINVAL;
1768
1769         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1770                 return -EINVAL;
1771
1772         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
1773                 return -EINVAL;
1774
1775         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1776         params.supported_rates =
1777                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1778         params.supported_rates_len =
1779                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1780         params.listen_interval =
1781                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1782
1783         if (info->attrs[NL80211_ATTR_STA_AID]) {
1784                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
1785                 if (!params.aid || params.aid > IEEE80211_MAX_AID)
1786                         return -EINVAL;
1787         }
1788
1789         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1790                 params.ht_capa =
1791                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1792
1793         if (parse_station_flags(info, &params))
1794                 return -EINVAL;
1795
1796         rtnl_lock();
1797
1798         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1799         if (err)
1800                 goto out_rtnl;
1801
1802         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1803         if (err)
1804                 goto out;
1805
1806         /* validate settings */
1807         err = 0;
1808
1809         switch (dev->ieee80211_ptr->iftype) {
1810         case NL80211_IFTYPE_AP:
1811         case NL80211_IFTYPE_AP_VLAN:
1812                 /* all ok but must have AID */
1813                 if (!params.aid)
1814                         err = -EINVAL;
1815                 break;
1816         case NL80211_IFTYPE_MESH_POINT:
1817                 /* disallow things mesh doesn't support */
1818                 if (params.vlan)
1819                         err = -EINVAL;
1820                 if (params.aid)
1821                         err = -EINVAL;
1822                 if (params.ht_capa)
1823                         err = -EINVAL;
1824                 if (params.listen_interval >= 0)
1825                         err = -EINVAL;
1826                 if (params.supported_rates)
1827                         err = -EINVAL;
1828                 if (params.sta_flags_mask)
1829                         err = -EINVAL;
1830                 break;
1831         default:
1832                 err = -EINVAL;
1833         }
1834
1835         if (err)
1836                 goto out;
1837
1838         if (!drv->ops->add_station) {
1839                 err = -EOPNOTSUPP;
1840                 goto out;
1841         }
1842
1843         if (!netif_running(dev)) {
1844                 err = -ENETDOWN;
1845                 goto out;
1846         }
1847
1848         err = drv->ops->add_station(&drv->wiphy, dev, mac_addr, &params);
1849
1850  out:
1851         if (params.vlan)
1852                 dev_put(params.vlan);
1853         cfg80211_put_dev(drv);
1854         dev_put(dev);
1855  out_rtnl:
1856         rtnl_unlock();
1857
1858         return err;
1859 }
1860
1861 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
1862 {
1863         struct cfg80211_registered_device *drv;
1864         int err;
1865         struct net_device *dev;
1866         u8 *mac_addr = NULL;
1867
1868         if (info->attrs[NL80211_ATTR_MAC])
1869                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1870
1871         rtnl_lock();
1872
1873         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1874         if (err)
1875                 goto out_rtnl;
1876
1877         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1878             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
1879             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1880                 err = -EINVAL;
1881                 goto out;
1882         }
1883
1884         if (!drv->ops->del_station) {
1885                 err = -EOPNOTSUPP;
1886                 goto out;
1887         }
1888
1889         err = drv->ops->del_station(&drv->wiphy, dev, mac_addr);
1890
1891  out:
1892         cfg80211_put_dev(drv);
1893         dev_put(dev);
1894  out_rtnl:
1895         rtnl_unlock();
1896
1897         return err;
1898 }
1899
1900 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
1901                                 int flags, struct net_device *dev,
1902                                 u8 *dst, u8 *next_hop,
1903                                 struct mpath_info *pinfo)
1904 {
1905         void *hdr;
1906         struct nlattr *pinfoattr;
1907
1908         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1909         if (!hdr)
1910                 return -1;
1911
1912         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1913         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
1914         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
1915
1916         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
1917         if (!pinfoattr)
1918                 goto nla_put_failure;
1919         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
1920                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
1921                             pinfo->frame_qlen);
1922         if (pinfo->filled & MPATH_INFO_DSN)
1923                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DSN,
1924                             pinfo->dsn);
1925         if (pinfo->filled & MPATH_INFO_METRIC)
1926                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
1927                             pinfo->metric);
1928         if (pinfo->filled & MPATH_INFO_EXPTIME)
1929                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
1930                             pinfo->exptime);
1931         if (pinfo->filled & MPATH_INFO_FLAGS)
1932                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
1933                             pinfo->flags);
1934         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
1935                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
1936                             pinfo->discovery_timeout);
1937         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
1938                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
1939                             pinfo->discovery_retries);
1940
1941         nla_nest_end(msg, pinfoattr);
1942
1943         return genlmsg_end(msg, hdr);
1944
1945  nla_put_failure:
1946         genlmsg_cancel(msg, hdr);
1947         return -EMSGSIZE;
1948 }
1949
1950 static int nl80211_dump_mpath(struct sk_buff *skb,
1951                               struct netlink_callback *cb)
1952 {
1953         struct mpath_info pinfo;
1954         struct cfg80211_registered_device *dev;
1955         struct net_device *netdev;
1956         u8 dst[ETH_ALEN];
1957         u8 next_hop[ETH_ALEN];
1958         int ifidx = cb->args[0];
1959         int path_idx = cb->args[1];
1960         int err;
1961
1962         if (!ifidx) {
1963                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1964                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1965                                   nl80211_policy);
1966                 if (err)
1967                         return err;
1968
1969                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1970                         return -EINVAL;
1971
1972                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1973                 if (!ifidx)
1974                         return -EINVAL;
1975         }
1976
1977         rtnl_lock();
1978
1979         netdev = __dev_get_by_index(&init_net, ifidx);
1980         if (!netdev) {
1981                 err = -ENODEV;
1982                 goto out_rtnl;
1983         }
1984
1985         dev = cfg80211_get_dev_from_ifindex(ifidx);
1986         if (IS_ERR(dev)) {
1987                 err = PTR_ERR(dev);
1988                 goto out_rtnl;
1989         }
1990
1991         if (!dev->ops->dump_mpath) {
1992                 err = -EOPNOTSUPP;
1993                 goto out_err;
1994         }
1995
1996         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1997                 err = -EOPNOTSUPP;
1998                 goto out;
1999         }
2000
2001         while (1) {
2002                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
2003                                            dst, next_hop, &pinfo);
2004                 if (err == -ENOENT)
2005                         break;
2006                 if (err)
2007                         goto out_err;
2008
2009                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
2010                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
2011                                        netdev, dst, next_hop,
2012                                        &pinfo) < 0)
2013                         goto out;
2014
2015                 path_idx++;
2016         }
2017
2018
2019  out:
2020         cb->args[1] = path_idx;
2021         err = skb->len;
2022  out_err:
2023         cfg80211_put_dev(dev);
2024  out_rtnl:
2025         rtnl_unlock();
2026
2027         return err;
2028 }
2029
2030 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
2031 {
2032         struct cfg80211_registered_device *drv;
2033         int err;
2034         struct net_device *dev;
2035         struct mpath_info pinfo;
2036         struct sk_buff *msg;
2037         u8 *dst = NULL;
2038         u8 next_hop[ETH_ALEN];
2039
2040         memset(&pinfo, 0, sizeof(pinfo));
2041
2042         if (!info->attrs[NL80211_ATTR_MAC])
2043                 return -EINVAL;
2044
2045         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2046
2047         rtnl_lock();
2048
2049         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2050         if (err)
2051                 goto out_rtnl;
2052
2053         if (!drv->ops->get_mpath) {
2054                 err = -EOPNOTSUPP;
2055                 goto out;
2056         }
2057
2058         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2059                 err = -EOPNOTSUPP;
2060                 goto out;
2061         }
2062
2063         err = drv->ops->get_mpath(&drv->wiphy, dev, dst, next_hop, &pinfo);
2064         if (err)
2065                 goto out;
2066
2067         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2068         if (!msg)
2069                 goto out;
2070
2071         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2072                                  dev, dst, next_hop, &pinfo) < 0)
2073                 goto out_free;
2074
2075         err = genlmsg_unicast(msg, info->snd_pid);
2076         goto out;
2077
2078  out_free:
2079         nlmsg_free(msg);
2080  out:
2081         cfg80211_put_dev(drv);
2082         dev_put(dev);
2083  out_rtnl:
2084         rtnl_unlock();
2085
2086         return err;
2087 }
2088
2089 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2090 {
2091         struct cfg80211_registered_device *drv;
2092         int err;
2093         struct net_device *dev;
2094         u8 *dst = NULL;
2095         u8 *next_hop = NULL;
2096
2097         if (!info->attrs[NL80211_ATTR_MAC])
2098                 return -EINVAL;
2099
2100         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2101                 return -EINVAL;
2102
2103         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2104         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2105
2106         rtnl_lock();
2107
2108         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2109         if (err)
2110                 goto out_rtnl;
2111
2112         if (!drv->ops->change_mpath) {
2113                 err = -EOPNOTSUPP;
2114                 goto out;
2115         }
2116
2117         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2118                 err = -EOPNOTSUPP;
2119                 goto out;
2120         }
2121
2122         if (!netif_running(dev)) {
2123                 err = -ENETDOWN;
2124                 goto out;
2125         }
2126
2127         err = drv->ops->change_mpath(&drv->wiphy, dev, dst, next_hop);
2128
2129  out:
2130         cfg80211_put_dev(drv);
2131         dev_put(dev);
2132  out_rtnl:
2133         rtnl_unlock();
2134
2135         return err;
2136 }
2137 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2138 {
2139         struct cfg80211_registered_device *drv;
2140         int err;
2141         struct net_device *dev;
2142         u8 *dst = NULL;
2143         u8 *next_hop = NULL;
2144
2145         if (!info->attrs[NL80211_ATTR_MAC])
2146                 return -EINVAL;
2147
2148         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2149                 return -EINVAL;
2150
2151         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2152         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2153
2154         rtnl_lock();
2155
2156         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2157         if (err)
2158                 goto out_rtnl;
2159
2160         if (!drv->ops->add_mpath) {
2161                 err = -EOPNOTSUPP;
2162                 goto out;
2163         }
2164
2165         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2166                 err = -EOPNOTSUPP;
2167                 goto out;
2168         }
2169
2170         if (!netif_running(dev)) {
2171                 err = -ENETDOWN;
2172                 goto out;
2173         }
2174
2175         err = drv->ops->add_mpath(&drv->wiphy, dev, dst, next_hop);
2176
2177  out:
2178         cfg80211_put_dev(drv);
2179         dev_put(dev);
2180  out_rtnl:
2181         rtnl_unlock();
2182
2183         return err;
2184 }
2185
2186 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2187 {
2188         struct cfg80211_registered_device *drv;
2189         int err;
2190         struct net_device *dev;
2191         u8 *dst = NULL;
2192
2193         if (info->attrs[NL80211_ATTR_MAC])
2194                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2195
2196         rtnl_lock();
2197
2198         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2199         if (err)
2200                 goto out_rtnl;
2201
2202         if (!drv->ops->del_mpath) {
2203                 err = -EOPNOTSUPP;
2204                 goto out;
2205         }
2206
2207         err = drv->ops->del_mpath(&drv->wiphy, dev, dst);
2208
2209  out:
2210         cfg80211_put_dev(drv);
2211         dev_put(dev);
2212  out_rtnl:
2213         rtnl_unlock();
2214
2215         return err;
2216 }
2217
2218 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2219 {
2220         struct cfg80211_registered_device *drv;
2221         int err;
2222         struct net_device *dev;
2223         struct bss_parameters params;
2224
2225         memset(&params, 0, sizeof(params));
2226         /* default to not changing parameters */
2227         params.use_cts_prot = -1;
2228         params.use_short_preamble = -1;
2229         params.use_short_slot_time = -1;
2230
2231         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2232                 params.use_cts_prot =
2233                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2234         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2235                 params.use_short_preamble =
2236                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2237         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2238                 params.use_short_slot_time =
2239                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2240         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2241                 params.basic_rates =
2242                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2243                 params.basic_rates_len =
2244                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2245         }
2246
2247         rtnl_lock();
2248
2249         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2250         if (err)
2251                 goto out_rtnl;
2252
2253         if (!drv->ops->change_bss) {
2254                 err = -EOPNOTSUPP;
2255                 goto out;
2256         }
2257
2258         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
2259                 err = -EOPNOTSUPP;
2260                 goto out;
2261         }
2262
2263         err = drv->ops->change_bss(&drv->wiphy, dev, &params);
2264
2265  out:
2266         cfg80211_put_dev(drv);
2267         dev_put(dev);
2268  out_rtnl:
2269         rtnl_unlock();
2270
2271         return err;
2272 }
2273
2274 static const struct nla_policy
2275         reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2276         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2277         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2278         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2279         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2280         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2281         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2282 };
2283
2284 static int parse_reg_rule(struct nlattr *tb[],
2285         struct ieee80211_reg_rule *reg_rule)
2286 {
2287         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2288         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2289
2290         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2291                 return -EINVAL;
2292         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2293                 return -EINVAL;
2294         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2295                 return -EINVAL;
2296         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2297                 return -EINVAL;
2298         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2299                 return -EINVAL;
2300
2301         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2302
2303         freq_range->start_freq_khz =
2304                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2305         freq_range->end_freq_khz =
2306                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2307         freq_range->max_bandwidth_khz =
2308                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2309
2310         power_rule->max_eirp =
2311                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2312
2313         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2314                 power_rule->max_antenna_gain =
2315                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2316
2317         return 0;
2318 }
2319
2320 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2321 {
2322         int r;
2323         char *data = NULL;
2324
2325         /*
2326          * You should only get this when cfg80211 hasn't yet initialized
2327          * completely when built-in to the kernel right between the time
2328          * window between nl80211_init() and regulatory_init(), if that is
2329          * even possible.
2330          */
2331         mutex_lock(&cfg80211_mutex);
2332         if (unlikely(!cfg80211_regdomain)) {
2333                 mutex_unlock(&cfg80211_mutex);
2334                 return -EINPROGRESS;
2335         }
2336         mutex_unlock(&cfg80211_mutex);
2337
2338         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2339                 return -EINVAL;
2340
2341         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2342
2343 #ifdef CONFIG_WIRELESS_OLD_REGULATORY
2344         /* We ignore world regdom requests with the old regdom setup */
2345         if (is_world_regdom(data))
2346                 return -EINVAL;
2347 #endif
2348
2349         r = regulatory_hint_user(data);
2350
2351         return r;
2352 }
2353
2354 static int nl80211_get_mesh_params(struct sk_buff *skb,
2355         struct genl_info *info)
2356 {
2357         struct cfg80211_registered_device *drv;
2358         struct mesh_config cur_params;
2359         int err;
2360         struct net_device *dev;
2361         void *hdr;
2362         struct nlattr *pinfoattr;
2363         struct sk_buff *msg;
2364
2365         rtnl_lock();
2366
2367         /* Look up our device */
2368         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2369         if (err)
2370                 goto out_rtnl;
2371
2372         if (!drv->ops->get_mesh_params) {
2373                 err = -EOPNOTSUPP;
2374                 goto out;
2375         }
2376
2377         /* Get the mesh params */
2378         err = drv->ops->get_mesh_params(&drv->wiphy, dev, &cur_params);
2379         if (err)
2380                 goto out;
2381
2382         /* Draw up a netlink message to send back */
2383         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2384         if (!msg) {
2385                 err = -ENOBUFS;
2386                 goto out;
2387         }
2388         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2389                              NL80211_CMD_GET_MESH_PARAMS);
2390         if (!hdr)
2391                 goto nla_put_failure;
2392         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
2393         if (!pinfoattr)
2394                 goto nla_put_failure;
2395         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2396         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2397                         cur_params.dot11MeshRetryTimeout);
2398         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2399                         cur_params.dot11MeshConfirmTimeout);
2400         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2401                         cur_params.dot11MeshHoldingTimeout);
2402         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2403                         cur_params.dot11MeshMaxPeerLinks);
2404         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2405                         cur_params.dot11MeshMaxRetries);
2406         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2407                         cur_params.dot11MeshTTL);
2408         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2409                         cur_params.auto_open_plinks);
2410         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2411                         cur_params.dot11MeshHWMPmaxPREQretries);
2412         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2413                         cur_params.path_refresh_time);
2414         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2415                         cur_params.min_discovery_timeout);
2416         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2417                         cur_params.dot11MeshHWMPactivePathTimeout);
2418         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2419                         cur_params.dot11MeshHWMPpreqMinInterval);
2420         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2421                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2422         nla_nest_end(msg, pinfoattr);
2423         genlmsg_end(msg, hdr);
2424         err = genlmsg_unicast(msg, info->snd_pid);
2425         goto out;
2426
2427  nla_put_failure:
2428         genlmsg_cancel(msg, hdr);
2429         err = -EMSGSIZE;
2430  out:
2431         /* Cleanup */
2432         cfg80211_put_dev(drv);
2433         dev_put(dev);
2434  out_rtnl:
2435         rtnl_unlock();
2436
2437         return err;
2438 }
2439
2440 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2441 do {\
2442         if (table[attr_num]) {\
2443                 cfg.param = nla_fn(table[attr_num]); \
2444                 mask |= (1 << (attr_num - 1)); \
2445         } \
2446 } while (0);\
2447
2448 static struct nla_policy
2449 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] __read_mostly = {
2450         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2451         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2452         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2453         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2454         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2455         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2456         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2457
2458         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2459         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2460         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2461         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2462         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2463         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2464 };
2465
2466 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2467 {
2468         int err;
2469         u32 mask;
2470         struct cfg80211_registered_device *drv;
2471         struct net_device *dev;
2472         struct mesh_config cfg;
2473         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2474         struct nlattr *parent_attr;
2475
2476         parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
2477         if (!parent_attr)
2478                 return -EINVAL;
2479         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2480                         parent_attr, nl80211_meshconf_params_policy))
2481                 return -EINVAL;
2482
2483         rtnl_lock();
2484
2485         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2486         if (err)
2487                 goto out_rtnl;
2488
2489         if (!drv->ops->set_mesh_params) {
2490                 err = -EOPNOTSUPP;
2491                 goto out;
2492         }
2493
2494         /* This makes sure that there aren't more than 32 mesh config
2495          * parameters (otherwise our bitfield scheme would not work.) */
2496         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2497
2498         /* Fill in the params struct */
2499         mask = 0;
2500         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2501                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2502         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2503                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2504         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2505                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2506         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2507                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2508         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2509                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2510         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2511                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2512         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2513                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2514         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2515                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2516                         nla_get_u8);
2517         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2518                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2519         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2520                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2521                         nla_get_u16);
2522         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2523                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2524                         nla_get_u32);
2525         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2526                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2527                         nla_get_u16);
2528         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2529                         dot11MeshHWMPnetDiameterTraversalTime,
2530                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2531                         nla_get_u16);
2532
2533         /* Apply changes */
2534         err = drv->ops->set_mesh_params(&drv->wiphy, dev, &cfg, mask);
2535
2536  out:
2537         /* cleanup */
2538         cfg80211_put_dev(drv);
2539         dev_put(dev);
2540  out_rtnl:
2541         rtnl_unlock();
2542
2543         return err;
2544 }
2545
2546 #undef FILL_IN_MESH_PARAM_IF_SET
2547
2548 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2549 {
2550         struct sk_buff *msg;
2551         void *hdr = NULL;
2552         struct nlattr *nl_reg_rules;
2553         unsigned int i;
2554         int err = -EINVAL;
2555
2556         mutex_lock(&cfg80211_mutex);
2557
2558         if (!cfg80211_regdomain)
2559                 goto out;
2560
2561         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2562         if (!msg) {
2563                 err = -ENOBUFS;
2564                 goto out;
2565         }
2566
2567         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2568                              NL80211_CMD_GET_REG);
2569         if (!hdr)
2570                 goto nla_put_failure;
2571
2572         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2573                 cfg80211_regdomain->alpha2);
2574
2575         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2576         if (!nl_reg_rules)
2577                 goto nla_put_failure;
2578
2579         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2580                 struct nlattr *nl_reg_rule;
2581                 const struct ieee80211_reg_rule *reg_rule;
2582                 const struct ieee80211_freq_range *freq_range;
2583                 const struct ieee80211_power_rule *power_rule;
2584
2585                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2586                 freq_range = &reg_rule->freq_range;
2587                 power_rule = &reg_rule->power_rule;
2588
2589                 nl_reg_rule = nla_nest_start(msg, i);
2590                 if (!nl_reg_rule)
2591                         goto nla_put_failure;
2592
2593                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2594                         reg_rule->flags);
2595                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2596                         freq_range->start_freq_khz);
2597                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2598                         freq_range->end_freq_khz);
2599                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2600                         freq_range->max_bandwidth_khz);
2601                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2602                         power_rule->max_antenna_gain);
2603                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2604                         power_rule->max_eirp);
2605
2606                 nla_nest_end(msg, nl_reg_rule);
2607         }
2608
2609         nla_nest_end(msg, nl_reg_rules);
2610
2611         genlmsg_end(msg, hdr);
2612         err = genlmsg_unicast(msg, info->snd_pid);
2613         goto out;
2614
2615 nla_put_failure:
2616         genlmsg_cancel(msg, hdr);
2617         err = -EMSGSIZE;
2618 out:
2619         mutex_unlock(&cfg80211_mutex);
2620         return err;
2621 }
2622
2623 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2624 {
2625         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2626         struct nlattr *nl_reg_rule;
2627         char *alpha2 = NULL;
2628         int rem_reg_rules = 0, r = 0;
2629         u32 num_rules = 0, rule_idx = 0, size_of_regd;
2630         struct ieee80211_regdomain *rd = NULL;
2631
2632         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2633                 return -EINVAL;
2634
2635         if (!info->attrs[NL80211_ATTR_REG_RULES])
2636                 return -EINVAL;
2637
2638         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2639
2640         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2641                         rem_reg_rules) {
2642                 num_rules++;
2643                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2644                         return -EINVAL;
2645         }
2646
2647         mutex_lock(&cfg80211_mutex);
2648
2649         if (!reg_is_valid_request(alpha2)) {
2650                 r = -EINVAL;
2651                 goto bad_reg;
2652         }
2653
2654         size_of_regd = sizeof(struct ieee80211_regdomain) +
2655                 (num_rules * sizeof(struct ieee80211_reg_rule));
2656
2657         rd = kzalloc(size_of_regd, GFP_KERNEL);
2658         if (!rd) {
2659                 r = -ENOMEM;
2660                 goto bad_reg;
2661         }
2662
2663         rd->n_reg_rules = num_rules;
2664         rd->alpha2[0] = alpha2[0];
2665         rd->alpha2[1] = alpha2[1];
2666
2667         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2668                         rem_reg_rules) {
2669                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2670                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2671                         reg_rule_policy);
2672                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2673                 if (r)
2674                         goto bad_reg;
2675
2676                 rule_idx++;
2677
2678                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
2679                         r = -EINVAL;
2680                         goto bad_reg;
2681                 }
2682         }
2683
2684         BUG_ON(rule_idx != num_rules);
2685
2686         r = set_regdom(rd);
2687
2688         mutex_unlock(&cfg80211_mutex);
2689
2690         return r;
2691
2692  bad_reg:
2693         mutex_unlock(&cfg80211_mutex);
2694         kfree(rd);
2695         return r;
2696 }
2697
2698 static int validate_scan_freqs(struct nlattr *freqs)
2699 {
2700         struct nlattr *attr1, *attr2;
2701         int n_channels = 0, tmp1, tmp2;
2702
2703         nla_for_each_nested(attr1, freqs, tmp1) {
2704                 n_channels++;
2705                 /*
2706                  * Some hardware has a limited channel list for
2707                  * scanning, and it is pretty much nonsensical
2708                  * to scan for a channel twice, so disallow that
2709                  * and don't require drivers to check that the
2710                  * channel list they get isn't longer than what
2711                  * they can scan, as long as they can scan all
2712                  * the channels they registered at once.
2713                  */
2714                 nla_for_each_nested(attr2, freqs, tmp2)
2715                         if (attr1 != attr2 &&
2716                             nla_get_u32(attr1) == nla_get_u32(attr2))
2717                                 return 0;
2718         }
2719
2720         return n_channels;
2721 }
2722
2723 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
2724 {
2725         struct cfg80211_registered_device *drv;
2726         struct net_device *dev;
2727         struct cfg80211_scan_request *request;
2728         struct cfg80211_ssid *ssid;
2729         struct ieee80211_channel *channel;
2730         struct nlattr *attr;
2731         struct wiphy *wiphy;
2732         int err, tmp, n_ssids = 0, n_channels, i;
2733         enum ieee80211_band band;
2734         size_t ie_len;
2735
2736         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2737                 return -EINVAL;
2738
2739         rtnl_lock();
2740
2741         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2742         if (err)
2743                 goto out_rtnl;
2744
2745         wiphy = &drv->wiphy;
2746
2747         if (!drv->ops->scan) {
2748                 err = -EOPNOTSUPP;
2749                 goto out;
2750         }
2751
2752         if (!netif_running(dev)) {
2753                 err = -ENETDOWN;
2754                 goto out;
2755         }
2756
2757         if (drv->scan_req) {
2758                 err = -EBUSY;
2759                 goto out;
2760         }
2761
2762         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2763                 n_channels = validate_scan_freqs(
2764                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
2765                 if (!n_channels) {
2766                         err = -EINVAL;
2767                         goto out;
2768                 }
2769         } else {
2770                 n_channels = 0;
2771
2772                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
2773                         if (wiphy->bands[band])
2774                                 n_channels += wiphy->bands[band]->n_channels;
2775         }
2776
2777         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
2778                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
2779                         n_ssids++;
2780
2781         if (n_ssids > wiphy->max_scan_ssids) {
2782                 err = -EINVAL;
2783                 goto out;
2784         }
2785
2786         if (info->attrs[NL80211_ATTR_IE])
2787                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2788         else
2789                 ie_len = 0;
2790
2791         if (ie_len > wiphy->max_scan_ie_len) {
2792                 err = -EINVAL;
2793                 goto out;
2794         }
2795
2796         request = kzalloc(sizeof(*request)
2797                         + sizeof(*ssid) * n_ssids
2798                         + sizeof(channel) * n_channels
2799                         + ie_len, GFP_KERNEL);
2800         if (!request) {
2801                 err = -ENOMEM;
2802                 goto out;
2803         }
2804
2805         request->channels = (void *)((char *)request + sizeof(*request));
2806         request->n_channels = n_channels;
2807         if (n_ssids)
2808                 request->ssids = (void *)(request->channels + n_channels);
2809         request->n_ssids = n_ssids;
2810         if (ie_len) {
2811                 if (request->ssids)
2812                         request->ie = (void *)(request->ssids + n_ssids);
2813                 else
2814                         request->ie = (void *)(request->channels + n_channels);
2815         }
2816
2817         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2818                 /* user specified, bail out if channel not found */
2819                 request->n_channels = n_channels;
2820                 i = 0;
2821                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
2822                         request->channels[i] = ieee80211_get_channel(wiphy, nla_get_u32(attr));
2823                         if (!request->channels[i]) {
2824                                 err = -EINVAL;
2825                                 goto out_free;
2826                         }
2827                         i++;
2828                 }
2829         } else {
2830                 /* all channels */
2831                 i = 0;
2832                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
2833                         int j;
2834                         if (!wiphy->bands[band])
2835                                 continue;
2836                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
2837                                 request->channels[i] = &wiphy->bands[band]->channels[j];
2838                                 i++;
2839                         }
2840                 }
2841         }
2842
2843         i = 0;
2844         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
2845                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
2846                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
2847                                 err = -EINVAL;
2848                                 goto out_free;
2849                         }
2850                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
2851                         request->ssids[i].ssid_len = nla_len(attr);
2852                         i++;
2853                 }
2854         }
2855
2856         if (info->attrs[NL80211_ATTR_IE]) {
2857                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2858                 memcpy((void *)request->ie,
2859                        nla_data(info->attrs[NL80211_ATTR_IE]),
2860                        request->ie_len);
2861         }
2862
2863         request->ifidx = dev->ifindex;
2864         request->wiphy = &drv->wiphy;
2865
2866         drv->scan_req = request;
2867         err = drv->ops->scan(&drv->wiphy, dev, request);
2868
2869         if (!err)
2870                 nl80211_send_scan_start(drv, dev);
2871
2872  out_free:
2873         if (err) {
2874                 drv->scan_req = NULL;
2875                 kfree(request);
2876         }
2877  out:
2878         cfg80211_put_dev(drv);
2879         dev_put(dev);
2880  out_rtnl:
2881         rtnl_unlock();
2882
2883         return err;
2884 }
2885
2886 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
2887                             struct cfg80211_registered_device *rdev,
2888                             struct net_device *dev,
2889                             struct cfg80211_bss *res)
2890 {
2891         void *hdr;
2892         struct nlattr *bss;
2893
2894         hdr = nl80211hdr_put(msg, pid, seq, flags,
2895                              NL80211_CMD_NEW_SCAN_RESULTS);
2896         if (!hdr)
2897                 return -1;
2898
2899         NLA_PUT_U32(msg, NL80211_ATTR_SCAN_GENERATION,
2900                     rdev->bss_generation);
2901         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2902
2903         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
2904         if (!bss)
2905                 goto nla_put_failure;
2906         if (!is_zero_ether_addr(res->bssid))
2907                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
2908         if (res->information_elements && res->len_information_elements)
2909                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
2910                         res->len_information_elements,
2911                         res->information_elements);
2912         if (res->tsf)
2913                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
2914         if (res->beacon_interval)
2915                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
2916         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
2917         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
2918
2919         switch (rdev->wiphy.signal_type) {
2920         case CFG80211_SIGNAL_TYPE_MBM:
2921                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
2922                 break;
2923         case CFG80211_SIGNAL_TYPE_UNSPEC:
2924                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
2925                 break;
2926         default:
2927                 break;
2928         }
2929
2930         nla_nest_end(msg, bss);
2931
2932         return genlmsg_end(msg, hdr);
2933
2934  nla_put_failure:
2935         genlmsg_cancel(msg, hdr);
2936         return -EMSGSIZE;
2937 }
2938
2939 static int nl80211_dump_scan(struct sk_buff *skb,
2940                              struct netlink_callback *cb)
2941 {
2942         struct cfg80211_registered_device *dev;
2943         struct net_device *netdev;
2944         struct cfg80211_internal_bss *scan;
2945         int ifidx = cb->args[0];
2946         int start = cb->args[1], idx = 0;
2947         int err;
2948
2949         if (!ifidx) {
2950                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
2951                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
2952                                   nl80211_policy);
2953                 if (err)
2954                         return err;
2955
2956                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
2957                         return -EINVAL;
2958
2959                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
2960                 if (!ifidx)
2961                         return -EINVAL;
2962                 cb->args[0] = ifidx;
2963         }
2964
2965         netdev = dev_get_by_index(&init_net, ifidx);
2966         if (!netdev)
2967                 return -ENODEV;
2968
2969         dev = cfg80211_get_dev_from_ifindex(ifidx);
2970         if (IS_ERR(dev)) {
2971                 err = PTR_ERR(dev);
2972                 goto out_put_netdev;
2973         }
2974
2975         spin_lock_bh(&dev->bss_lock);
2976         cfg80211_bss_expire(dev);
2977
2978         list_for_each_entry(scan, &dev->bss_list, list) {
2979                 if (++idx <= start)
2980                         continue;
2981                 if (nl80211_send_bss(skb,
2982                                 NETLINK_CB(cb->skb).pid,
2983                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2984                                 dev, netdev, &scan->pub) < 0) {
2985                         idx--;
2986                         goto out;
2987                 }
2988         }
2989
2990  out:
2991         spin_unlock_bh(&dev->bss_lock);
2992
2993         cb->args[1] = idx;
2994         err = skb->len;
2995         cfg80211_put_dev(dev);
2996  out_put_netdev:
2997         dev_put(netdev);
2998
2999         return err;
3000 }
3001
3002 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
3003 {
3004         return auth_type == NL80211_AUTHTYPE_OPEN_SYSTEM ||
3005                 auth_type == NL80211_AUTHTYPE_SHARED_KEY ||
3006                 auth_type == NL80211_AUTHTYPE_FT ||
3007                 auth_type == NL80211_AUTHTYPE_NETWORK_EAP;
3008 }
3009
3010 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
3011 {
3012         struct cfg80211_registered_device *drv;
3013         struct net_device *dev;
3014         struct cfg80211_auth_request req;
3015         struct wiphy *wiphy;
3016         int err;
3017
3018         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3019                 return -EINVAL;
3020
3021         if (!info->attrs[NL80211_ATTR_MAC])
3022                 return -EINVAL;
3023
3024         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
3025                 return -EINVAL;
3026
3027         rtnl_lock();
3028
3029         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3030         if (err)
3031                 goto unlock_rtnl;
3032
3033         if (!drv->ops->auth) {
3034                 err = -EOPNOTSUPP;
3035                 goto out;
3036         }
3037
3038         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3039                 err = -EOPNOTSUPP;
3040                 goto out;
3041         }
3042
3043         if (!netif_running(dev)) {
3044                 err = -ENETDOWN;
3045                 goto out;
3046         }
3047
3048         wiphy = &drv->wiphy;
3049         memset(&req, 0, sizeof(req));
3050
3051         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3052
3053         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3054                 req.chan = ieee80211_get_channel(
3055                         wiphy,
3056                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3057                 if (!req.chan) {
3058                         err = -EINVAL;
3059                         goto out;
3060                 }
3061         }
3062
3063         if (info->attrs[NL80211_ATTR_SSID]) {
3064                 req.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3065                 req.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3066         }
3067
3068         if (info->attrs[NL80211_ATTR_IE]) {
3069                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3070                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3071         }
3072
3073         req.auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
3074         if (!nl80211_valid_auth_type(req.auth_type)) {
3075                 err = -EINVAL;
3076                 goto out;
3077         }
3078
3079         err = drv->ops->auth(&drv->wiphy, dev, &req);
3080
3081 out:
3082         cfg80211_put_dev(drv);
3083         dev_put(dev);
3084 unlock_rtnl:
3085         rtnl_unlock();
3086         return err;
3087 }
3088
3089 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
3090 {
3091         struct cfg80211_registered_device *drv;
3092         struct net_device *dev;
3093         struct cfg80211_assoc_request req;
3094         struct wiphy *wiphy;
3095         int err;
3096
3097         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3098                 return -EINVAL;
3099
3100         if (!info->attrs[NL80211_ATTR_MAC] ||
3101             !info->attrs[NL80211_ATTR_SSID])
3102                 return -EINVAL;
3103
3104         rtnl_lock();
3105
3106         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3107         if (err)
3108                 goto unlock_rtnl;
3109
3110         if (!drv->ops->assoc) {
3111                 err = -EOPNOTSUPP;
3112                 goto out;
3113         }
3114
3115         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3116                 err = -EOPNOTSUPP;
3117                 goto out;
3118         }
3119
3120         if (!netif_running(dev)) {
3121                 err = -ENETDOWN;
3122                 goto out;
3123         }
3124
3125         wiphy = &drv->wiphy;
3126         memset(&req, 0, sizeof(req));
3127
3128         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3129
3130         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3131                 req.chan = ieee80211_get_channel(
3132                         wiphy,
3133                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3134                 if (!req.chan) {
3135                         err = -EINVAL;
3136                         goto out;
3137                 }
3138         }
3139
3140         req.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3141         req.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3142
3143         if (info->attrs[NL80211_ATTR_IE]) {
3144                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3145                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3146         }
3147
3148         if (info->attrs[NL80211_ATTR_USE_MFP]) {
3149                 enum nl80211_mfp use_mfp =
3150                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
3151                 if (use_mfp == NL80211_MFP_REQUIRED)
3152                         req.use_mfp = true;
3153                 else if (use_mfp != NL80211_MFP_NO) {
3154                         err = -EINVAL;
3155                         goto out;
3156                 }
3157         }
3158
3159         req.control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
3160
3161         err = drv->ops->assoc(&drv->wiphy, dev, &req);
3162
3163 out:
3164         cfg80211_put_dev(drv);
3165         dev_put(dev);
3166 unlock_rtnl:
3167         rtnl_unlock();
3168         return err;
3169 }
3170
3171 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
3172 {
3173         struct cfg80211_registered_device *drv;
3174         struct net_device *dev;
3175         struct cfg80211_deauth_request req;
3176         struct wiphy *wiphy;
3177         int err;
3178
3179         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3180                 return -EINVAL;
3181
3182         if (!info->attrs[NL80211_ATTR_MAC])
3183                 return -EINVAL;
3184
3185         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3186                 return -EINVAL;
3187
3188         rtnl_lock();
3189
3190         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3191         if (err)
3192                 goto unlock_rtnl;
3193
3194         if (!drv->ops->deauth) {
3195                 err = -EOPNOTSUPP;
3196                 goto out;
3197         }
3198
3199         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3200                 err = -EOPNOTSUPP;
3201                 goto out;
3202         }
3203
3204         if (!netif_running(dev)) {
3205                 err = -ENETDOWN;
3206                 goto out;
3207         }
3208
3209         wiphy = &drv->wiphy;
3210         memset(&req, 0, sizeof(req));
3211
3212         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3213
3214         req.reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3215         if (req.reason_code == 0) {
3216                 /* Reason Code 0 is reserved */
3217                 err = -EINVAL;
3218                 goto out;
3219         }
3220
3221         if (info->attrs[NL80211_ATTR_IE]) {
3222                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3223                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3224         }
3225
3226         err = drv->ops->deauth(&drv->wiphy, dev, &req);
3227
3228 out:
3229         cfg80211_put_dev(drv);
3230         dev_put(dev);
3231 unlock_rtnl:
3232         rtnl_unlock();
3233         return err;
3234 }
3235
3236 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
3237 {
3238         struct cfg80211_registered_device *drv;
3239         struct net_device *dev;
3240         struct cfg80211_disassoc_request req;
3241         struct wiphy *wiphy;
3242         int err;
3243
3244         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3245                 return -EINVAL;
3246
3247         if (!info->attrs[NL80211_ATTR_MAC])
3248                 return -EINVAL;
3249
3250         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3251                 return -EINVAL;
3252
3253         rtnl_lock();
3254
3255         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3256         if (err)
3257                 goto unlock_rtnl;
3258
3259         if (!drv->ops->disassoc) {
3260                 err = -EOPNOTSUPP;
3261                 goto out;
3262         }
3263
3264         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3265                 err = -EOPNOTSUPP;
3266                 goto out;
3267         }
3268
3269         if (!netif_running(dev)) {
3270                 err = -ENETDOWN;
3271                 goto out;
3272         }
3273
3274         wiphy = &drv->wiphy;
3275         memset(&req, 0, sizeof(req));
3276
3277         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3278
3279         req.reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3280         if (req.reason_code == 0) {
3281                 /* Reason Code 0 is reserved */
3282                 err = -EINVAL;
3283                 goto out;
3284         }
3285
3286         if (info->attrs[NL80211_ATTR_IE]) {
3287                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3288                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3289         }
3290
3291         err = drv->ops->disassoc(&drv->wiphy, dev, &req);
3292
3293 out:
3294         cfg80211_put_dev(drv);
3295         dev_put(dev);
3296 unlock_rtnl:
3297         rtnl_unlock();
3298         return err;
3299 }
3300
3301 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
3302 {
3303         struct cfg80211_registered_device *drv;
3304         struct net_device *dev;
3305         struct cfg80211_ibss_params ibss;
3306         struct wiphy *wiphy;
3307         int err;
3308
3309         memset(&ibss, 0, sizeof(ibss));
3310
3311         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3312                 return -EINVAL;
3313
3314         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
3315             !info->attrs[NL80211_ATTR_SSID] ||
3316             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3317                 return -EINVAL;
3318
3319         ibss.beacon_interval = 100;
3320
3321         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
3322                 ibss.beacon_interval =
3323                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3324                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
3325                         return -EINVAL;
3326         }
3327
3328         rtnl_lock();
3329
3330         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3331         if (err)
3332                 goto unlock_rtnl;
3333
3334         if (!drv->ops->join_ibss) {
3335                 err = -EOPNOTSUPP;
3336                 goto out;
3337         }
3338
3339         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3340                 err = -EOPNOTSUPP;
3341                 goto out;
3342         }
3343
3344         if (!netif_running(dev)) {
3345                 err = -ENETDOWN;
3346                 goto out;
3347         }
3348
3349         wiphy = &drv->wiphy;
3350
3351         if (info->attrs[NL80211_ATTR_MAC])
3352                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3353         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3354         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3355
3356         if (info->attrs[NL80211_ATTR_IE]) {
3357                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3358                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3359         }
3360
3361         ibss.channel = ieee80211_get_channel(wiphy,
3362                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3363         if (!ibss.channel ||
3364             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
3365             ibss.channel->flags & IEEE80211_CHAN_DISABLED) {
3366                 err = -EINVAL;
3367                 goto out;
3368         }
3369
3370         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
3371
3372         err = cfg80211_join_ibss(drv, dev, &ibss);
3373
3374 out:
3375         cfg80211_put_dev(drv);
3376         dev_put(dev);
3377 unlock_rtnl:
3378         rtnl_unlock();
3379         return err;
3380 }
3381
3382 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
3383 {
3384         struct cfg80211_registered_device *drv;
3385         struct net_device *dev;
3386         int err;
3387
3388         rtnl_lock();
3389
3390         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3391         if (err)
3392                 goto unlock_rtnl;
3393
3394         if (!drv->ops->leave_ibss) {
3395                 err = -EOPNOTSUPP;
3396                 goto out;
3397         }
3398
3399         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3400                 err = -EOPNOTSUPP;
3401                 goto out;
3402         }
3403
3404         if (!netif_running(dev)) {
3405                 err = -ENETDOWN;
3406                 goto out;
3407         }
3408
3409         err = cfg80211_leave_ibss(drv, dev, false);
3410
3411 out:
3412         cfg80211_put_dev(drv);
3413         dev_put(dev);
3414 unlock_rtnl:
3415         rtnl_unlock();
3416         return err;
3417 }
3418
3419 static struct genl_ops nl80211_ops[] = {
3420         {
3421                 .cmd = NL80211_CMD_GET_WIPHY,
3422                 .doit = nl80211_get_wiphy,
3423                 .dumpit = nl80211_dump_wiphy,
3424                 .policy = nl80211_policy,
3425                 /* can be retrieved by unprivileged users */
3426         },
3427         {
3428                 .cmd = NL80211_CMD_SET_WIPHY,
3429                 .doit = nl80211_set_wiphy,
3430                 .policy = nl80211_policy,
3431                 .flags = GENL_ADMIN_PERM,
3432         },
3433         {
3434                 .cmd = NL80211_CMD_GET_INTERFACE,
3435                 .doit = nl80211_get_interface,
3436                 .dumpit = nl80211_dump_interface,
3437                 .policy = nl80211_policy,
3438                 /* can be retrieved by unprivileged users */
3439         },
3440         {
3441                 .cmd = NL80211_CMD_SET_INTERFACE,
3442                 .doit = nl80211_set_interface,
3443                 .policy = nl80211_policy,
3444                 .flags = GENL_ADMIN_PERM,
3445         },
3446         {
3447                 .cmd = NL80211_CMD_NEW_INTERFACE,
3448                 .doit = nl80211_new_interface,
3449                 .policy = nl80211_policy,
3450                 .flags = GENL_ADMIN_PERM,
3451         },
3452         {
3453                 .cmd = NL80211_CMD_DEL_INTERFACE,
3454                 .doit = nl80211_del_interface,
3455                 .policy = nl80211_policy,
3456                 .flags = GENL_ADMIN_PERM,
3457         },
3458         {
3459                 .cmd = NL80211_CMD_GET_KEY,
3460                 .doit = nl80211_get_key,
3461                 .policy = nl80211_policy,
3462                 .flags = GENL_ADMIN_PERM,
3463         },
3464         {
3465                 .cmd = NL80211_CMD_SET_KEY,
3466                 .doit = nl80211_set_key,
3467                 .policy = nl80211_policy,
3468                 .flags = GENL_ADMIN_PERM,
3469         },
3470         {
3471                 .cmd = NL80211_CMD_NEW_KEY,
3472                 .doit = nl80211_new_key,
3473                 .policy = nl80211_policy,
3474                 .flags = GENL_ADMIN_PERM,
3475         },
3476         {
3477                 .cmd = NL80211_CMD_DEL_KEY,
3478                 .doit = nl80211_del_key,
3479                 .policy = nl80211_policy,
3480                 .flags = GENL_ADMIN_PERM,
3481         },
3482         {
3483                 .cmd = NL80211_CMD_SET_BEACON,
3484                 .policy = nl80211_policy,
3485                 .flags = GENL_ADMIN_PERM,
3486                 .doit = nl80211_addset_beacon,
3487         },
3488         {
3489                 .cmd = NL80211_CMD_NEW_BEACON,
3490                 .policy = nl80211_policy,
3491                 .flags = GENL_ADMIN_PERM,
3492                 .doit = nl80211_addset_beacon,
3493         },
3494         {
3495                 .cmd = NL80211_CMD_DEL_BEACON,
3496                 .policy = nl80211_policy,
3497                 .flags = GENL_ADMIN_PERM,
3498                 .doit = nl80211_del_beacon,
3499         },
3500         {
3501                 .cmd = NL80211_CMD_GET_STATION,
3502                 .doit = nl80211_get_station,
3503                 .dumpit = nl80211_dump_station,
3504                 .policy = nl80211_policy,
3505         },
3506         {
3507                 .cmd = NL80211_CMD_SET_STATION,
3508                 .doit = nl80211_set_station,
3509                 .policy = nl80211_policy,
3510                 .flags = GENL_ADMIN_PERM,
3511         },
3512         {
3513                 .cmd = NL80211_CMD_NEW_STATION,
3514                 .doit = nl80211_new_station,
3515                 .policy = nl80211_policy,
3516                 .flags = GENL_ADMIN_PERM,
3517         },
3518         {
3519                 .cmd = NL80211_CMD_DEL_STATION,
3520                 .doit = nl80211_del_station,
3521                 .policy = nl80211_policy,
3522                 .flags = GENL_ADMIN_PERM,
3523         },
3524         {
3525                 .cmd = NL80211_CMD_GET_MPATH,
3526                 .doit = nl80211_get_mpath,
3527                 .dumpit = nl80211_dump_mpath,
3528                 .policy = nl80211_policy,
3529                 .flags = GENL_ADMIN_PERM,
3530         },
3531         {
3532                 .cmd = NL80211_CMD_SET_MPATH,
3533                 .doit = nl80211_set_mpath,
3534                 .policy = nl80211_policy,
3535                 .flags = GENL_ADMIN_PERM,
3536         },
3537         {
3538                 .cmd = NL80211_CMD_NEW_MPATH,
3539                 .doit = nl80211_new_mpath,
3540                 .policy = nl80211_policy,
3541                 .flags = GENL_ADMIN_PERM,
3542         },
3543         {
3544                 .cmd = NL80211_CMD_DEL_MPATH,
3545                 .doit = nl80211_del_mpath,
3546                 .policy = nl80211_policy,
3547                 .flags = GENL_ADMIN_PERM,
3548         },
3549         {
3550                 .cmd = NL80211_CMD_SET_BSS,
3551                 .doit = nl80211_set_bss,
3552                 .policy = nl80211_policy,
3553                 .flags = GENL_ADMIN_PERM,
3554         },
3555         {
3556                 .cmd = NL80211_CMD_GET_REG,
3557                 .doit = nl80211_get_reg,
3558                 .policy = nl80211_policy,
3559                 /* can be retrieved by unprivileged users */
3560         },
3561         {
3562                 .cmd = NL80211_CMD_SET_REG,
3563                 .doit = nl80211_set_reg,
3564                 .policy = nl80211_policy,
3565                 .flags = GENL_ADMIN_PERM,
3566         },
3567         {
3568                 .cmd = NL80211_CMD_REQ_SET_REG,
3569                 .doit = nl80211_req_set_reg,
3570                 .policy = nl80211_policy,
3571                 .flags = GENL_ADMIN_PERM,
3572         },
3573         {
3574                 .cmd = NL80211_CMD_GET_MESH_PARAMS,
3575                 .doit = nl80211_get_mesh_params,
3576                 .policy = nl80211_policy,
3577                 /* can be retrieved by unprivileged users */
3578         },
3579         {
3580                 .cmd = NL80211_CMD_SET_MESH_PARAMS,
3581                 .doit = nl80211_set_mesh_params,
3582                 .policy = nl80211_policy,
3583                 .flags = GENL_ADMIN_PERM,
3584         },
3585         {
3586                 .cmd = NL80211_CMD_TRIGGER_SCAN,
3587                 .doit = nl80211_trigger_scan,
3588                 .policy = nl80211_policy,
3589                 .flags = GENL_ADMIN_PERM,
3590         },
3591         {
3592                 .cmd = NL80211_CMD_GET_SCAN,
3593                 .policy = nl80211_policy,
3594                 .dumpit = nl80211_dump_scan,
3595         },
3596         {
3597                 .cmd = NL80211_CMD_AUTHENTICATE,
3598                 .doit = nl80211_authenticate,
3599                 .policy = nl80211_policy,
3600                 .flags = GENL_ADMIN_PERM,
3601         },
3602         {
3603                 .cmd = NL80211_CMD_ASSOCIATE,
3604                 .doit = nl80211_associate,
3605                 .policy = nl80211_policy,
3606                 .flags = GENL_ADMIN_PERM,
3607         },
3608         {
3609                 .cmd = NL80211_CMD_DEAUTHENTICATE,
3610                 .doit = nl80211_deauthenticate,
3611                 .policy = nl80211_policy,
3612                 .flags = GENL_ADMIN_PERM,
3613         },
3614         {
3615                 .cmd = NL80211_CMD_DISASSOCIATE,
3616                 .doit = nl80211_disassociate,
3617                 .policy = nl80211_policy,
3618                 .flags = GENL_ADMIN_PERM,
3619         },
3620         {
3621                 .cmd = NL80211_CMD_JOIN_IBSS,
3622                 .doit = nl80211_join_ibss,
3623                 .policy = nl80211_policy,
3624                 .flags = GENL_ADMIN_PERM,
3625         },
3626         {
3627                 .cmd = NL80211_CMD_LEAVE_IBSS,
3628                 .doit = nl80211_leave_ibss,
3629                 .policy = nl80211_policy,
3630                 .flags = GENL_ADMIN_PERM,
3631         },
3632 };
3633 static struct genl_multicast_group nl80211_mlme_mcgrp = {
3634         .name = "mlme",
3635 };
3636
3637 /* multicast groups */
3638 static struct genl_multicast_group nl80211_config_mcgrp = {
3639         .name = "config",
3640 };
3641 static struct genl_multicast_group nl80211_scan_mcgrp = {
3642         .name = "scan",
3643 };
3644 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
3645         .name = "regulatory",
3646 };
3647
3648 /* notification functions */
3649
3650 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
3651 {
3652         struct sk_buff *msg;
3653
3654         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3655         if (!msg)
3656                 return;
3657
3658         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
3659                 nlmsg_free(msg);
3660                 return;
3661         }
3662
3663         genlmsg_multicast(msg, 0, nl80211_config_mcgrp.id, GFP_KERNEL);
3664 }
3665
3666 static int nl80211_add_scan_req(struct sk_buff *msg,
3667                                 struct cfg80211_registered_device *rdev)
3668 {
3669         struct cfg80211_scan_request *req = rdev->scan_req;
3670         struct nlattr *nest;
3671         int i;
3672
3673         if (WARN_ON(!req))
3674                 return 0;
3675
3676         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
3677         if (!nest)
3678                 goto nla_put_failure;
3679         for (i = 0; i < req->n_ssids; i++)
3680                 NLA_PUT(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid);
3681         nla_nest_end(msg, nest);
3682
3683         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
3684         if (!nest)
3685                 goto nla_put_failure;
3686         for (i = 0; i < req->n_channels; i++)
3687                 NLA_PUT_U32(msg, i, req->channels[i]->center_freq);
3688         nla_nest_end(msg, nest);
3689
3690         if (req->ie)
3691                 NLA_PUT(msg, NL80211_ATTR_IE, req->ie_len, req->ie);
3692
3693         return 0;
3694  nla_put_failure:
3695         return -ENOBUFS;
3696 }
3697
3698 static int nl80211_send_scan_msg(struct sk_buff *msg,
3699                                  struct cfg80211_registered_device *rdev,
3700                                  struct net_device *netdev,
3701                                  u32 pid, u32 seq, int flags,
3702                                  u32 cmd)
3703 {
3704         void *hdr;
3705
3706         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
3707         if (!hdr)
3708                 return -1;
3709
3710         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3711         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3712
3713         /* ignore errors and send incomplete event anyway */
3714         nl80211_add_scan_req(msg, rdev);
3715
3716         return genlmsg_end(msg, hdr);
3717
3718  nla_put_failure:
3719         genlmsg_cancel(msg, hdr);
3720         return -EMSGSIZE;
3721 }
3722
3723 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
3724                              struct net_device *netdev)
3725 {
3726         struct sk_buff *msg;
3727
3728         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3729         if (!msg)
3730                 return;
3731
3732         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
3733                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
3734                 nlmsg_free(msg);
3735                 return;
3736         }
3737
3738         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
3739 }
3740
3741 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
3742                             struct net_device *netdev)
3743 {
3744         struct sk_buff *msg;
3745
3746         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3747         if (!msg)
3748                 return;
3749
3750         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
3751                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
3752                 nlmsg_free(msg);
3753                 return;
3754         }
3755
3756         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
3757 }
3758
3759 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
3760                                struct net_device *netdev)
3761 {
3762         struct sk_buff *msg;
3763
3764         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3765         if (!msg)
3766                 return;
3767
3768         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
3769                                   NL80211_CMD_SCAN_ABORTED) < 0) {
3770                 nlmsg_free(msg);
3771                 return;
3772         }
3773
3774         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
3775 }
3776
3777 /*
3778  * This can happen on global regulatory changes or device specific settings
3779  * based on custom world regulatory domains.
3780  */
3781 void nl80211_send_reg_change_event(struct regulatory_request *request)
3782 {
3783         struct sk_buff *msg;
3784         void *hdr;
3785
3786         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3787         if (!msg)
3788                 return;
3789
3790         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
3791         if (!hdr) {
3792                 nlmsg_free(msg);
3793                 return;
3794         }
3795
3796         /* Userspace can always count this one always being set */
3797         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
3798
3799         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
3800                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3801                            NL80211_REGDOM_TYPE_WORLD);
3802         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
3803                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3804                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
3805         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
3806                  request->intersect)
3807                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3808                            NL80211_REGDOM_TYPE_INTERSECTION);
3809         else {
3810                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3811                            NL80211_REGDOM_TYPE_COUNTRY);
3812                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
3813         }
3814
3815         if (wiphy_idx_valid(request->wiphy_idx))
3816                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
3817
3818         if (genlmsg_end(msg, hdr) < 0) {
3819                 nlmsg_free(msg);
3820                 return;
3821         }
3822
3823         genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_KERNEL);
3824
3825         return;
3826
3827 nla_put_failure:
3828         genlmsg_cancel(msg, hdr);
3829         nlmsg_free(msg);
3830 }
3831
3832 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
3833                                     struct net_device *netdev,
3834                                     const u8 *buf, size_t len,
3835                                     enum nl80211_commands cmd)
3836 {
3837         struct sk_buff *msg;
3838         void *hdr;
3839
3840         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
3841         if (!msg)
3842                 return;
3843
3844         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
3845         if (!hdr) {
3846                 nlmsg_free(msg);
3847                 return;
3848         }
3849
3850         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3851         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3852         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
3853
3854         if (genlmsg_end(msg, hdr) < 0) {
3855                 nlmsg_free(msg);
3856                 return;
3857         }
3858
3859         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_ATOMIC);
3860         return;
3861
3862  nla_put_failure:
3863         genlmsg_cancel(msg, hdr);
3864         nlmsg_free(msg);
3865 }
3866
3867 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
3868                           struct net_device *netdev, const u8 *buf, size_t len)
3869 {
3870         nl80211_send_mlme_event(rdev, netdev, buf, len,
3871                                 NL80211_CMD_AUTHENTICATE);
3872 }
3873
3874 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
3875                            struct net_device *netdev, const u8 *buf,
3876                            size_t len)
3877 {
3878         nl80211_send_mlme_event(rdev, netdev, buf, len, NL80211_CMD_ASSOCIATE);
3879 }
3880
3881 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
3882                          struct net_device *netdev, const u8 *buf, size_t len)
3883 {
3884         nl80211_send_mlme_event(rdev, netdev, buf, len,
3885                                 NL80211_CMD_DEAUTHENTICATE);
3886 }
3887
3888 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
3889                            struct net_device *netdev, const u8 *buf,
3890                            size_t len)
3891 {
3892         nl80211_send_mlme_event(rdev, netdev, buf, len,
3893                                 NL80211_CMD_DISASSOCIATE);
3894 }
3895
3896 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
3897                                       struct net_device *netdev, int cmd,
3898                                       const u8 *addr)
3899 {
3900         struct sk_buff *msg;
3901         void *hdr;
3902
3903         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
3904         if (!msg)
3905                 return;
3906
3907         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
3908         if (!hdr) {
3909                 nlmsg_free(msg);
3910                 return;
3911         }
3912
3913         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3914         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3915         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
3916         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3917
3918         if (genlmsg_end(msg, hdr) < 0) {
3919                 nlmsg_free(msg);
3920                 return;
3921         }
3922
3923         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_ATOMIC);
3924         return;
3925
3926  nla_put_failure:
3927         genlmsg_cancel(msg, hdr);
3928         nlmsg_free(msg);
3929 }
3930
3931 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
3932                                struct net_device *netdev, const u8 *addr)
3933 {
3934         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
3935                                   addr);
3936 }
3937
3938 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
3939                                 struct net_device *netdev, const u8 *addr)
3940 {
3941         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE, addr);
3942 }
3943
3944 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
3945                              struct net_device *netdev, const u8 *bssid,
3946                              gfp_t gfp)
3947 {
3948         struct sk_buff *msg;
3949         void *hdr;
3950
3951         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
3952         if (!msg)
3953                 return;
3954
3955         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
3956         if (!hdr) {
3957                 nlmsg_free(msg);
3958                 return;
3959         }
3960
3961         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3962         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3963         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
3964
3965         if (genlmsg_end(msg, hdr) < 0) {
3966                 nlmsg_free(msg);
3967                 return;
3968         }
3969
3970         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
3971         return;
3972
3973  nla_put_failure:
3974         genlmsg_cancel(msg, hdr);
3975         nlmsg_free(msg);
3976 }
3977
3978 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
3979                                  struct net_device *netdev, const u8 *addr,
3980                                  enum nl80211_key_type key_type, int key_id,
3981                                  const u8 *tsc)
3982 {
3983         struct sk_buff *msg;
3984         void *hdr;
3985
3986         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
3987         if (!msg)
3988                 return;
3989
3990         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
3991         if (!hdr) {
3992                 nlmsg_free(msg);
3993                 return;
3994         }
3995
3996         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3997         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3998         if (addr)
3999                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
4000         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
4001         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
4002         if (tsc)
4003                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
4004
4005         if (genlmsg_end(msg, hdr) < 0) {
4006                 nlmsg_free(msg);
4007                 return;
4008         }
4009
4010         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_ATOMIC);
4011         return;
4012
4013  nla_put_failure:
4014         genlmsg_cancel(msg, hdr);
4015         nlmsg_free(msg);
4016 }
4017
4018 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
4019                                     struct ieee80211_channel *channel_before,
4020                                     struct ieee80211_channel *channel_after)
4021 {
4022         struct sk_buff *msg;
4023         void *hdr;
4024         struct nlattr *nl_freq;
4025
4026         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
4027         if (!msg)
4028                 return;
4029
4030         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
4031         if (!hdr) {
4032                 nlmsg_free(msg);
4033                 return;
4034         }
4035
4036         /*
4037          * Since we are applying the beacon hint to a wiphy we know its
4038          * wiphy_idx is valid
4039          */
4040         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
4041
4042         /* Before */
4043         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
4044         if (!nl_freq)
4045                 goto nla_put_failure;
4046         if (nl80211_msg_put_channel(msg, channel_before))
4047                 goto nla_put_failure;
4048         nla_nest_end(msg, nl_freq);
4049
4050         /* After */
4051         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
4052         if (!nl_freq)
4053                 goto nla_put_failure;
4054         if (nl80211_msg_put_channel(msg, channel_after))
4055                 goto nla_put_failure;
4056         nla_nest_end(msg, nl_freq);
4057
4058         if (genlmsg_end(msg, hdr) < 0) {
4059                 nlmsg_free(msg);
4060                 return;
4061         }
4062
4063         genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_ATOMIC);
4064
4065         return;
4066
4067 nla_put_failure:
4068         genlmsg_cancel(msg, hdr);
4069         nlmsg_free(msg);
4070 }
4071
4072 /* initialisation/exit functions */
4073
4074 int nl80211_init(void)
4075 {
4076         int err;
4077
4078         err = genl_register_family_with_ops(&nl80211_fam,
4079                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
4080         if (err)
4081                 return err;
4082
4083         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
4084         if (err)
4085                 goto err_out;
4086
4087         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
4088         if (err)
4089                 goto err_out;
4090
4091         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
4092         if (err)
4093                 goto err_out;
4094
4095         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
4096         if (err)
4097                 goto err_out;
4098
4099         return 0;
4100  err_out:
4101         genl_unregister_family(&nl80211_fam);
4102         return err;
4103 }
4104
4105 void nl80211_exit(void)
4106 {
4107         genl_unregister_family(&nl80211_fam);
4108 }