net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006, 2007 Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/list.h>
  11 #include <linux/if_ether.h>
  12 #include <linux/ieee80211.h>
  13 #include <linux/nl80211.h>
  14 #include <linux/rtnetlink.h>
  15 #include <linux/netlink.h>
  16 #include <linux/etherdevice.h>
  17 #include <net/genetlink.h>
  18 #include <net/cfg80211.h>
  19 #include "core.h"
  20 #include "nl80211.h"
  21 #include "reg.h"
  22
  23 /* the netlink family */
  24 static struct genl_family nl80211_fam = {
  25         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  26         .name = "nl80211",      /* have users key off the name instead */
  27         .hdrsize = 0,           /* no private header */
  28         .version = 1,           /* no particular meaning now */
  29         .maxattr = NL80211_ATTR_MAX,
  30 };
  31
  32 /* internal helper: get drv and dev */
  33 static int get_drv_dev_by_info_ifindex(struct nlattr **attrs,
  34                                        struct cfg80211_registered_device **drv,
  35                                        struct net_device **dev)
  36 {
  37         int ifindex;
  38
  39         if (!attrs[NL80211_ATTR_IFINDEX])
  40                 return -EINVAL;
  41
  42         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  43         *dev = dev_get_by_index(&init_net, ifindex);
  44         if (!*dev)
  45                 return -ENODEV;
  46
  47         *drv = cfg80211_get_dev_from_ifindex(ifindex);
  48         if (IS_ERR(*drv)) {
  49                 dev_put(*dev);
  50                 return PTR_ERR(*drv);
  51         }
  52
  53         return 0;
  54 }
  55
  56 /* policy for the attributes */
  57 static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
  58         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  59         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  60                                       .len = BUS_ID_SIZE-1 },
  61         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  62         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  63         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  64
  65         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  66         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  67         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  68
  69         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  70
  71         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  72                                     .len = WLAN_MAX_KEY_LEN },
  73         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  74         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  75         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
  76
  77         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
  78         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
  79         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
  80                                        .len = IEEE80211_MAX_DATA_LEN },
  81         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
  82                                        .len = IEEE80211_MAX_DATA_LEN },
  83         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
  84         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
  85         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
  86         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
  87                                                .len = NL80211_MAX_SUPP_RATES },
  88         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
  89         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
  90         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
  91         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
  92                                 .len = IEEE80211_MAX_MESH_ID_LEN },
  93         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
  94
  95         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
  96         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
  97
  98         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
  99         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 100         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 101         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 102                                            .len = NL80211_MAX_SUPP_RATES },
 103
 104         [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
 105
 106         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 107                                          .len = NL80211_HT_CAPABILITY_LEN },
 108
 109         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 110         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 111                               .len = IEEE80211_MAX_DATA_LEN },
 112         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 113         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 114
 115         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 116                                 .len = IEEE80211_MAX_SSID_LEN },
 117         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 118         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 119 };
 120
 121 /* IE validation */
 122 static bool is_valid_ie_attr(const struct nlattr *attr)
 123 {
 124         const u8 *pos;
 125         int len;
 126
 127         if (!attr)
 128                 return true;
 129
 130         pos = nla_data(attr);
 131         len = nla_len(attr);
 132
 133         while (len) {
 134                 u8 elemlen;
 135
 136                 if (len < 2)
 137                         return false;
 138                 len -= 2;
 139
 140                 elemlen = pos[1];
 141                 if (elemlen > len)
 142                         return false;
 143
 144                 len -= elemlen;
 145                 pos += 2 + elemlen;
 146         }
 147
 148         return true;
 149 }
 150
 151 /* message building helper */
 152 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 153                                    int flags, u8 cmd)
 154 {
 155         /* since there is no private header just add the generic one */
 156         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 157 }
 158
 159 static int nl80211_msg_put_channel(struct sk_buff *msg,
 160                                    struct ieee80211_channel *chan)
 161 {
 162         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 163                     chan->center_freq);
 164
 165         if (chan->flags & IEEE80211_CHAN_DISABLED)
 166                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 167         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 168                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 169         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 170                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 171         if (chan->flags & IEEE80211_CHAN_RADAR)
 172                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 173
 174         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 175                     DBM_TO_MBM(chan->max_power));
 176
 177         return 0;
 178
 179  nla_put_failure:
 180         return -ENOBUFS;
 181 }
 182
 183 /* netlink command implementations */
 184
 185 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 186                               struct cfg80211_registered_device *dev)
 187 {
 188         void *hdr;
 189         struct nlattr *nl_bands, *nl_band;
 190         struct nlattr *nl_freqs, *nl_freq;
 191         struct nlattr *nl_rates, *nl_rate;
 192         struct nlattr *nl_modes;
 193         struct nlattr *nl_cmds;
 194         enum ieee80211_band band;
 195         struct ieee80211_channel *chan;
 196         struct ieee80211_rate *rate;
 197         int i;
 198         u16 ifmodes = dev->wiphy.interface_modes;
 199
 200         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 201         if (!hdr)
 202                 return -1;
 203
 204         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 205         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 206         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 207                    dev->wiphy.max_scan_ssids);
 208         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 209                     dev->wiphy.max_scan_ie_len);
 210
 211         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
 212         if (!nl_modes)
 213                 goto nla_put_failure;
 214
 215         i = 0;
 216         while (ifmodes) {
 217                 if (ifmodes & 1)
 218                         NLA_PUT_FLAG(msg, i);
 219                 ifmodes >>= 1;
 220                 i++;
 221         }
 222
 223         nla_nest_end(msg, nl_modes);
 224
 225         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 226         if (!nl_bands)
 227                 goto nla_put_failure;
 228
 229         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 230                 if (!dev->wiphy.bands[band])
 231                         continue;
 232
 233                 nl_band = nla_nest_start(msg, band);
 234                 if (!nl_band)
 235                         goto nla_put_failure;
 236
 237                 /* add HT info */
 238                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 239                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 240                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 241                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 242                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 243                                 dev->wiphy.bands[band]->ht_cap.cap);
 244                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 245                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 246                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 247                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 248                 }
 249
 250                 /* add frequencies */
 251                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 252                 if (!nl_freqs)
 253                         goto nla_put_failure;
 254
 255                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 256                         nl_freq = nla_nest_start(msg, i);
 257                         if (!nl_freq)
 258                                 goto nla_put_failure;
 259
 260                         chan = &dev->wiphy.bands[band]->channels[i];
 261
 262                         if (nl80211_msg_put_channel(msg, chan))
 263                                 goto nla_put_failure;
 264
 265                         nla_nest_end(msg, nl_freq);
 266                 }
 267
 268                 nla_nest_end(msg, nl_freqs);
 269
 270                 /* add bitrates */
 271                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 272                 if (!nl_rates)
 273                         goto nla_put_failure;
 274
 275                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 276                         nl_rate = nla_nest_start(msg, i);
 277                         if (!nl_rate)
 278                                 goto nla_put_failure;
 279
 280                         rate = &dev->wiphy.bands[band]->bitrates[i];
 281                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 282                                     rate->bitrate);
 283                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 284                                 NLA_PUT_FLAG(msg,
 285                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 286
 287                         nla_nest_end(msg, nl_rate);
 288                 }
 289
 290                 nla_nest_end(msg, nl_rates);
 291
 292                 nla_nest_end(msg, nl_band);
 293         }
 294         nla_nest_end(msg, nl_bands);
 295
 296         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 297         if (!nl_cmds)
 298                 goto nla_put_failure;
 299
 300         i = 0;
 301 #define CMD(op, n)                                              \
 302          do {                                                   \
 303                 if (dev->ops->op) {                             \
 304                         i++;                                    \
 305                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 306                 }                                               \
 307         } while (0)
 308
 309         CMD(add_virtual_intf, NEW_INTERFACE);
 310         CMD(change_virtual_intf, SET_INTERFACE);
 311         CMD(add_key, NEW_KEY);
 312         CMD(add_beacon, NEW_BEACON);
 313         CMD(add_station, NEW_STATION);
 314         CMD(add_mpath, NEW_MPATH);
 315         CMD(set_mesh_params, SET_MESH_PARAMS);
 316         CMD(change_bss, SET_BSS);
 317         CMD(auth, AUTHENTICATE);
 318         CMD(assoc, ASSOCIATE);
 319         CMD(deauth, DEAUTHENTICATE);
 320         CMD(disassoc, DISASSOCIATE);
 321
 322 #undef CMD
 323         nla_nest_end(msg, nl_cmds);
 324
 325         return genlmsg_end(msg, hdr);
 326
 327  nla_put_failure:
 328         genlmsg_cancel(msg, hdr);
 329         return -EMSGSIZE;
 330 }
 331
 332 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 333 {
 334         int idx = 0;
 335         int start = cb->args[0];
 336         struct cfg80211_registered_device *dev;
 337
 338         mutex_lock(&cfg80211_mutex);
 339         list_for_each_entry(dev, &cfg80211_drv_list, list) {
 340                 if (++idx <= start)
 341                         continue;
 342                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
 343                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
 344                                        dev) < 0) {
 345                         idx--;
 346                         break;
 347                 }
 348         }
 349         mutex_unlock(&cfg80211_mutex);
 350
 351         cb->args[0] = idx;
 352
 353         return skb->len;
 354 }
 355
 356 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 357 {
 358         struct sk_buff *msg;
 359         struct cfg80211_registered_device *dev;
 360
 361         dev = cfg80211_get_dev_from_info(info);
 362         if (IS_ERR(dev))
 363                 return PTR_ERR(dev);
 364
 365         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 366         if (!msg)
 367                 goto out_err;
 368
 369         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
 370                 goto out_free;
 371
 372         cfg80211_put_dev(dev);
 373
 374         return genlmsg_unicast(msg, info->snd_pid);
 375
 376  out_free:
 377         nlmsg_free(msg);
 378  out_err:
 379         cfg80211_put_dev(dev);
 380         return -ENOBUFS;
 381 }
 382
 383 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 384         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
 385         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
 386         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
 387         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
 388         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
 389 };
 390
 391 static int parse_txq_params(struct nlattr *tb[],
 392                             struct ieee80211_txq_params *txq_params)
 393 {
 394         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 395             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 396             !tb[NL80211_TXQ_ATTR_AIFS])
 397                 return -EINVAL;
 398
 399         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
 400         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 401         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 402         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 403         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 404
 405         return 0;
 406 }
 407
 408 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 409 {
 410         struct cfg80211_registered_device *rdev;
 411         int result = 0, rem_txq_params = 0;
 412         struct nlattr *nl_txq_params;
 413
 414         rtnl_lock();
 415
 416         mutex_lock(&cfg80211_mutex);
 417
 418         rdev = __cfg80211_drv_from_info(info);
 419         if (IS_ERR(rdev)) {
 420                 result = PTR_ERR(rdev);
 421                 goto unlock;
 422         }
 423
 424         mutex_lock(&rdev->mtx);
 425
 426         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
 427                 result = cfg80211_dev_rename(
 428                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 429
 430         mutex_unlock(&cfg80211_mutex);
 431
 432         if (result)
 433                 goto bad_res;
 434
 435         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
 436                 struct ieee80211_txq_params txq_params;
 437                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
 438
 439                 if (!rdev->ops->set_txq_params) {
 440                         result = -EOPNOTSUPP;
 441                         goto bad_res;
 442                 }
 443
 444                 nla_for_each_nested(nl_txq_params,
 445                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
 446                                     rem_txq_params) {
 447                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
 448                                   nla_data(nl_txq_params),
 449                                   nla_len(nl_txq_params),
 450                                   txq_params_policy);
 451                         result = parse_txq_params(tb, &txq_params);
 452                         if (result)
 453                                 goto bad_res;
 454
 455                         result = rdev->ops->set_txq_params(&rdev->wiphy,
 456                                                            &txq_params);
 457                         if (result)
 458                                 goto bad_res;
 459                 }
 460         }
 461
 462         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
 463                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 464                 struct ieee80211_channel *chan;
 465                 struct ieee80211_sta_ht_cap *ht_cap;
 466                 u32 freq, sec_freq;
 467
 468                 if (!rdev->ops->set_channel) {
 469                         result = -EOPNOTSUPP;
 470                         goto bad_res;
 471                 }
 472
 473                 result = -EINVAL;
 474
 475                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 476                         channel_type = nla_get_u32(info->attrs[
 477                                            NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 478                         if (channel_type != NL80211_CHAN_NO_HT &&
 479                             channel_type != NL80211_CHAN_HT20 &&
 480                             channel_type != NL80211_CHAN_HT40PLUS &&
 481                             channel_type != NL80211_CHAN_HT40MINUS)
 482                                 goto bad_res;
 483                 }
 484
 485                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 486                 chan = ieee80211_get_channel(&rdev->wiphy, freq);
 487
 488                 /* Primary channel not allowed */
 489                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 490                         goto bad_res;
 491
 492                 if (channel_type == NL80211_CHAN_HT40MINUS)
 493                         sec_freq = freq - 20;
 494                 else if (channel_type == NL80211_CHAN_HT40PLUS)
 495                         sec_freq = freq + 20;
 496                 else
 497                         sec_freq = 0;
 498
 499                 ht_cap = &rdev->wiphy.bands[chan->band]->ht_cap;
 500
 501                 /* no HT capabilities */
 502                 if (channel_type != NL80211_CHAN_NO_HT &&
 503                     !ht_cap->ht_supported)
 504                         goto bad_res;
 505
 506                 if (sec_freq) {
 507                         struct ieee80211_channel *schan;
 508
 509                         /* no 40 MHz capabilities */
 510                         if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
 511                             (ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT))
 512                                 goto bad_res;
 513
 514                         schan = ieee80211_get_channel(&rdev->wiphy, sec_freq);
 515
 516                         /* Secondary channel not allowed */
 517                         if (!schan || schan->flags & IEEE80211_CHAN_DISABLED)
 518                                 goto bad_res;
 519                 }
 520
 521                 result = rdev->ops->set_channel(&rdev->wiphy, chan,
 522                                                 channel_type);
 523                 if (result)
 524                         goto bad_res;
 525         }
 526
 527
 528  bad_res:
 529         mutex_unlock(&rdev->mtx);
 530  unlock:
 531         rtnl_unlock();
 532         return result;
 533 }
 534
 535
 536 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 537                               struct net_device *dev)
 538 {
 539         void *hdr;
 540
 541         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
 542         if (!hdr)
 543                 return -1;
 544
 545         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 546         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
 547         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
 548         return genlmsg_end(msg, hdr);
 549
 550  nla_put_failure:
 551         genlmsg_cancel(msg, hdr);
 552         return -EMSGSIZE;
 553 }
 554
 555 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
 556 {
 557         int wp_idx = 0;
 558         int if_idx = 0;
 559         int wp_start = cb->args[0];
 560         int if_start = cb->args[1];
 561         struct cfg80211_registered_device *dev;
 562         struct wireless_dev *wdev;
 563
 564         mutex_lock(&cfg80211_mutex);
 565         list_for_each_entry(dev, &cfg80211_drv_list, list) {
 566                 if (wp_idx < wp_start) {
 567                         wp_idx++;
 568                         continue;
 569                 }
 570                 if_idx = 0;
 571
 572                 mutex_lock(&dev->devlist_mtx);
 573                 list_for_each_entry(wdev, &dev->netdev_list, list) {
 574                         if (if_idx < if_start) {
 575                                 if_idx++;
 576                                 continue;
 577                         }
 578                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
 579                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
 580                                                wdev->netdev) < 0) {
 581                                 mutex_unlock(&dev->devlist_mtx);
 582                                 goto out;
 583                         }
 584                         if_idx++;
 585                 }
 586                 mutex_unlock(&dev->devlist_mtx);
 587
 588                 wp_idx++;
 589         }
 590  out:
 591         mutex_unlock(&cfg80211_mutex);
 592
 593         cb->args[0] = wp_idx;
 594         cb->args[1] = if_idx;
 595
 596         return skb->len;
 597 }
 598
 599 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
 600 {
 601         struct sk_buff *msg;
 602         struct cfg80211_registered_device *dev;
 603         struct net_device *netdev;
 604         int err;
 605
 606         err = get_drv_dev_by_info_ifindex(info->attrs, &dev, &netdev);
 607         if (err)
 608                 return err;
 609
 610         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 611         if (!msg)
 612                 goto out_err;
 613
 614         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0, netdev) < 0)
 615                 goto out_free;
 616
 617         dev_put(netdev);
 618         cfg80211_put_dev(dev);
 619
 620         return genlmsg_unicast(msg, info->snd_pid);
 621
 622  out_free:
 623         nlmsg_free(msg);
 624  out_err:
 625         dev_put(netdev);
 626         cfg80211_put_dev(dev);
 627         return -ENOBUFS;
 628 }
 629
 630 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
 631         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
 632         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
 633         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
 634         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
 635         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
 636 };
 637
 638 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
 639 {
 640         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
 641         int flag;
 642
 643         *mntrflags = 0;
 644
 645         if (!nla)
 646                 return -EINVAL;
 647
 648         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
 649                              nla, mntr_flags_policy))
 650                 return -EINVAL;
 651
 652         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
 653                 if (flags[flag])
 654                         *mntrflags |= (1<<flag);
 655
 656         return 0;
 657 }
 658
 659 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 660 {
 661         struct cfg80211_registered_device *drv;
 662         struct vif_params params;
 663         int err, ifindex;
 664         enum nl80211_iftype type;
 665         struct net_device *dev;
 666         u32 _flags, *flags = NULL;
 667         bool change = false;
 668
 669         memset(&params, 0, sizeof(params));
 670
 671         rtnl_lock();
 672
 673         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 674         if (err)
 675                 goto unlock_rtnl;
 676
 677         ifindex = dev->ifindex;
 678         type = dev->ieee80211_ptr->iftype;
 679         dev_put(dev);
 680
 681         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 682                 enum nl80211_iftype ntype;
 683
 684                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 685                 if (type != ntype)
 686                         change = true;
 687                 type = ntype;
 688                 if (type > NL80211_IFTYPE_MAX) {
 689                         err = -EINVAL;
 690                         goto unlock;
 691                 }
 692         }
 693
 694         if (!drv->ops->change_virtual_intf ||
 695             !(drv->wiphy.interface_modes & (1 << type))) {
 696                 err = -EOPNOTSUPP;
 697                 goto unlock;
 698         }
 699
 700         if (info->attrs[NL80211_ATTR_MESH_ID]) {
 701                 if (type != NL80211_IFTYPE_MESH_POINT) {
 702                         err = -EINVAL;
 703                         goto unlock;
 704                 }
 705                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 706                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 707                 change = true;
 708         }
 709
 710         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
 711                 if (type != NL80211_IFTYPE_MONITOR) {
 712                         err = -EINVAL;
 713                         goto unlock;
 714                 }
 715                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
 716                                           &_flags);
 717                 if (err)
 718                         goto unlock;
 719
 720                 flags = &_flags;
 721                 change = true;
 722         }
 723
 724         if (change)
 725                 err = drv->ops->change_virtual_intf(&drv->wiphy, ifindex,
 726                                                     type, flags, &params);
 727         else
 728                 err = 0;
 729
 730         dev = __dev_get_by_index(&init_net, ifindex);
 731         WARN_ON(!dev || (!err && dev->ieee80211_ptr->iftype != type));
 732
 733  unlock:
 734         cfg80211_put_dev(drv);
 735  unlock_rtnl:
 736         rtnl_unlock();
 737         return err;
 738 }
 739
 740 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
 741 {
 742         struct cfg80211_registered_device *drv;
 743         struct vif_params params;
 744         int err;
 745         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
 746         u32 flags;
 747
 748         memset(&params, 0, sizeof(params));
 749
 750         if (!info->attrs[NL80211_ATTR_IFNAME])
 751                 return -EINVAL;
 752
 753         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 754                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 755                 if (type > NL80211_IFTYPE_MAX)
 756                         return -EINVAL;
 757         }
 758
 759         rtnl_lock();
 760
 761         drv = cfg80211_get_dev_from_info(info);
 762         if (IS_ERR(drv)) {
 763                 err = PTR_ERR(drv);
 764                 goto unlock_rtnl;
 765         }
 766
 767         if (!drv->ops->add_virtual_intf ||
 768             !(drv->wiphy.interface_modes & (1 << type))) {
 769                 err = -EOPNOTSUPP;
 770                 goto unlock;
 771         }
 772
 773         if (type == NL80211_IFTYPE_MESH_POINT &&
 774             info->attrs[NL80211_ATTR_MESH_ID]) {
 775                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 776                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 777         }
 778
 779         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
 780                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
 781                                   &flags);
 782         err = drv->ops->add_virtual_intf(&drv->wiphy,
 783                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
 784                 type, err ? NULL : &flags, &params);
 785
 786  unlock:
 787         cfg80211_put_dev(drv);
 788  unlock_rtnl:
 789         rtnl_unlock();
 790         return err;
 791 }
 792
 793 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
 794 {
 795         struct cfg80211_registered_device *drv;
 796         int ifindex, err;
 797         struct net_device *dev;
 798
 799         rtnl_lock();
 800
 801         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 802         if (err)
 803                 goto unlock_rtnl;
 804         ifindex = dev->ifindex;
 805         dev_put(dev);
 806
 807         if (!drv->ops->del_virtual_intf) {
 808                 err = -EOPNOTSUPP;
 809                 goto out;
 810         }
 811
 812         err = drv->ops->del_virtual_intf(&drv->wiphy, ifindex);
 813
 814  out:
 815         cfg80211_put_dev(drv);
 816  unlock_rtnl:
 817         rtnl_unlock();
 818         return err;
 819 }
 820
 821 struct get_key_cookie {
 822         struct sk_buff *msg;
 823         int error;
 824 };
 825
 826 static void get_key_callback(void *c, struct key_params *params)
 827 {
 828         struct get_key_cookie *cookie = c;
 829
 830         if (params->key)
 831                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
 832                         params->key_len, params->key);
 833
 834         if (params->seq)
 835                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
 836                         params->seq_len, params->seq);
 837
 838         if (params->cipher)
 839                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
 840                             params->cipher);
 841
 842         return;
 843  nla_put_failure:
 844         cookie->error = 1;
 845 }
 846
 847 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
 848 {
 849         struct cfg80211_registered_device *drv;
 850         int err;
 851         struct net_device *dev;
 852         u8 key_idx = 0;
 853         u8 *mac_addr = NULL;
 854         struct get_key_cookie cookie = {
 855                 .error = 0,
 856         };
 857         void *hdr;
 858         struct sk_buff *msg;
 859
 860         if (info->attrs[NL80211_ATTR_KEY_IDX])
 861                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 862
 863         if (key_idx > 5)
 864                 return -EINVAL;
 865
 866         if (info->attrs[NL80211_ATTR_MAC])
 867                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 868
 869         rtnl_lock();
 870
 871         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 872         if (err)
 873                 goto unlock_rtnl;
 874
 875         if (!drv->ops->get_key) {
 876                 err = -EOPNOTSUPP;
 877                 goto out;
 878         }
 879
 880         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 881         if (!msg) {
 882                 err = -ENOMEM;
 883                 goto out;
 884         }
 885
 886         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
 887                              NL80211_CMD_NEW_KEY);
 888
 889         if (IS_ERR(hdr)) {
 890                 err = PTR_ERR(hdr);
 891                 goto out;
 892         }
 893
 894         cookie.msg = msg;
 895
 896         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 897         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
 898         if (mac_addr)
 899                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
 900
 901         err = drv->ops->get_key(&drv->wiphy, dev, key_idx, mac_addr,
 902                                 &cookie, get_key_callback);
 903
 904         if (err)
 905                 goto out;
 906
 907         if (cookie.error)
 908                 goto nla_put_failure;
 909
 910         genlmsg_end(msg, hdr);
 911         err = genlmsg_unicast(msg, info->snd_pid);
 912         goto out;
 913
 914  nla_put_failure:
 915         err = -ENOBUFS;
 916         nlmsg_free(msg);
 917  out:
 918         cfg80211_put_dev(drv);
 919         dev_put(dev);
 920  unlock_rtnl:
 921         rtnl_unlock();
 922
 923         return err;
 924 }
 925
 926 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
 927 {
 928         struct cfg80211_registered_device *drv;
 929         int err;
 930         struct net_device *dev;
 931         u8 key_idx;
 932         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
 933                     u8 key_index);
 934
 935         if (!info->attrs[NL80211_ATTR_KEY_IDX])
 936                 return -EINVAL;
 937
 938         key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 939
 940         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]) {
 941                 if (key_idx < 4 || key_idx > 5)
 942                         return -EINVAL;
 943         } else if (key_idx > 3)
 944                 return -EINVAL;
 945
 946         /* currently only support setting default key */
 947         if (!info->attrs[NL80211_ATTR_KEY_DEFAULT] &&
 948             !info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT])
 949                 return -EINVAL;
 950
 951         rtnl_lock();
 952
 953         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 954         if (err)
 955                 goto unlock_rtnl;
 956
 957         if (info->attrs[NL80211_ATTR_KEY_DEFAULT])
 958                 func = drv->ops->set_default_key;
 959         else
 960                 func = drv->ops->set_default_mgmt_key;
 961
 962         if (!func) {
 963                 err = -EOPNOTSUPP;
 964                 goto out;
 965         }
 966
 967         err = func(&drv->wiphy, dev, key_idx);
 968
 969  out:
 970         cfg80211_put_dev(drv);
 971         dev_put(dev);
 972
 973  unlock_rtnl:
 974         rtnl_unlock();
 975
 976         return err;
 977 }
 978
 979 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
 980 {
 981         struct cfg80211_registered_device *drv;
 982         int err;
 983         struct net_device *dev;
 984         struct key_params params;
 985         u8 key_idx = 0;
 986         u8 *mac_addr = NULL;
 987
 988         memset(&params, 0, sizeof(params));
 989
 990         if (!info->attrs[NL80211_ATTR_KEY_CIPHER])
 991                 return -EINVAL;
 992
 993         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 994                 params.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 995                 params.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 996         }
 997
 998         if (info->attrs[NL80211_ATTR_KEY_IDX])
 999                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1000
1001         params.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1002
1003         if (info->attrs[NL80211_ATTR_MAC])
1004                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1005
1006         if (key_idx > 5)
1007                 return -EINVAL;
1008
1009         /*
1010          * Disallow pairwise keys with non-zero index unless it's WEP
1011          * (because current deployments use pairwise WEP keys with
1012          * non-zero indizes but 802.11i clearly specifies to use zero)
1013          */
1014         if (mac_addr && key_idx &&
1015             params.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1016             params.cipher != WLAN_CIPHER_SUITE_WEP104)
1017                 return -EINVAL;
1018
1019         /* TODO: add definitions for the lengths to linux/ieee80211.h */
1020         switch (params.cipher) {
1021         case WLAN_CIPHER_SUITE_WEP40:
1022                 if (params.key_len != 5)
1023                         return -EINVAL;
1024                 break;
1025         case WLAN_CIPHER_SUITE_TKIP:
1026                 if (params.key_len != 32)
1027                         return -EINVAL;
1028                 break;
1029         case WLAN_CIPHER_SUITE_CCMP:
1030                 if (params.key_len != 16)
1031                         return -EINVAL;
1032                 break;
1033         case WLAN_CIPHER_SUITE_WEP104:
1034                 if (params.key_len != 13)
1035                         return -EINVAL;
1036                 break;
1037         case WLAN_CIPHER_SUITE_AES_CMAC:
1038                 if (params.key_len != 16)
1039                         return -EINVAL;
1040                 break;
1041         default:
1042                 return -EINVAL;
1043         }
1044
1045         rtnl_lock();
1046
1047         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1048         if (err)
1049                 goto unlock_rtnl;
1050
1051         if (!drv->ops->add_key) {
1052                 err = -EOPNOTSUPP;
1053                 goto out;
1054         }
1055
1056         err = drv->ops->add_key(&drv->wiphy, dev, key_idx, mac_addr, &params);
1057
1058  out:
1059         cfg80211_put_dev(drv);
1060         dev_put(dev);
1061  unlock_rtnl:
1062         rtnl_unlock();
1063
1064         return err;
1065 }
1066
1067 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1068 {
1069         struct cfg80211_registered_device *drv;
1070         int err;
1071         struct net_device *dev;
1072         u8 key_idx = 0;
1073         u8 *mac_addr = NULL;
1074
1075         if (info->attrs[NL80211_ATTR_KEY_IDX])
1076                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1077
1078         if (key_idx > 5)
1079                 return -EINVAL;
1080
1081         if (info->attrs[NL80211_ATTR_MAC])
1082                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1083
1084         rtnl_lock();
1085
1086         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1087         if (err)
1088                 goto unlock_rtnl;
1089
1090         if (!drv->ops->del_key) {
1091                 err = -EOPNOTSUPP;
1092                 goto out;
1093         }
1094
1095         err = drv->ops->del_key(&drv->wiphy, dev, key_idx, mac_addr);
1096
1097  out:
1098         cfg80211_put_dev(drv);
1099         dev_put(dev);
1100
1101  unlock_rtnl:
1102         rtnl_unlock();
1103
1104         return err;
1105 }
1106
1107 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1108 {
1109         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1110                     struct beacon_parameters *info);
1111         struct cfg80211_registered_device *drv;
1112         int err;
1113         struct net_device *dev;
1114         struct beacon_parameters params;
1115         int haveinfo = 0;
1116
1117         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
1118                 return -EINVAL;
1119
1120         rtnl_lock();
1121
1122         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1123         if (err)
1124                 goto unlock_rtnl;
1125
1126         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1127                 err = -EOPNOTSUPP;
1128                 goto out;
1129         }
1130
1131         switch (info->genlhdr->cmd) {
1132         case NL80211_CMD_NEW_BEACON:
1133                 /* these are required for NEW_BEACON */
1134                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1135                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1136                     !info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1137                         err = -EINVAL;
1138                         goto out;
1139                 }
1140
1141                 call = drv->ops->add_beacon;
1142                 break;
1143         case NL80211_CMD_SET_BEACON:
1144                 call = drv->ops->set_beacon;
1145                 break;
1146         default:
1147                 WARN_ON(1);
1148                 err = -EOPNOTSUPP;
1149                 goto out;
1150         }
1151
1152         if (!call) {
1153                 err = -EOPNOTSUPP;
1154                 goto out;
1155         }
1156
1157         memset(&params, 0, sizeof(params));
1158
1159         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1160                 params.interval =
1161                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1162                 haveinfo = 1;
1163         }
1164
1165         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1166                 params.dtim_period =
1167                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1168                 haveinfo = 1;
1169         }
1170
1171         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1172                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1173                 params.head_len =
1174                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1175                 haveinfo = 1;
1176         }
1177
1178         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1179                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1180                 params.tail_len =
1181                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1182                 haveinfo = 1;
1183         }
1184
1185         if (!haveinfo) {
1186                 err = -EINVAL;
1187                 goto out;
1188         }
1189
1190         err = call(&drv->wiphy, dev, &params);
1191
1192  out:
1193         cfg80211_put_dev(drv);
1194         dev_put(dev);
1195  unlock_rtnl:
1196         rtnl_unlock();
1197
1198         return err;
1199 }
1200
1201 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1202 {
1203         struct cfg80211_registered_device *drv;
1204         int err;
1205         struct net_device *dev;
1206
1207         rtnl_lock();
1208
1209         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1210         if (err)
1211                 goto unlock_rtnl;
1212
1213         if (!drv->ops->del_beacon) {
1214                 err = -EOPNOTSUPP;
1215                 goto out;
1216         }
1217
1218         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1219                 err = -EOPNOTSUPP;
1220                 goto out;
1221         }
1222         err = drv->ops->del_beacon(&drv->wiphy, dev);
1223
1224  out:
1225         cfg80211_put_dev(drv);
1226         dev_put(dev);
1227  unlock_rtnl:
1228         rtnl_unlock();
1229
1230         return err;
1231 }
1232
1233 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1234         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1235         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1236         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1237 };
1238
1239 static int parse_station_flags(struct nlattr *nla, u32 *staflags)
1240 {
1241         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1242         int flag;
1243
1244         *staflags = 0;
1245
1246         if (!nla)
1247                 return 0;
1248
1249         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1250                              nla, sta_flags_policy))
1251                 return -EINVAL;
1252
1253         *staflags = STATION_FLAG_CHANGED;
1254
1255         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1256                 if (flags[flag])
1257                         *staflags |= (1<<flag);
1258
1259         return 0;
1260 }
1261
1262 static u16 nl80211_calculate_bitrate(struct rate_info *rate)
1263 {
1264         int modulation, streams, bitrate;
1265
1266         if (!(rate->flags & RATE_INFO_FLAGS_MCS))
1267                 return rate->legacy;
1268
1269         /* the formula below does only work for MCS values smaller than 32 */
1270         if (rate->mcs >= 32)
1271                 return 0;
1272
1273         modulation = rate->mcs & 7;
1274         streams = (rate->mcs >> 3) + 1;
1275
1276         bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
1277                         13500000 : 6500000;
1278
1279         if (modulation < 4)
1280                 bitrate *= (modulation + 1);
1281         else if (modulation == 4)
1282                 bitrate *= (modulation + 2);
1283         else
1284                 bitrate *= (modulation + 3);
1285
1286         bitrate *= streams;
1287
1288         if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
1289                 bitrate = (bitrate / 9) * 10;
1290
1291         /* do NOT round down here */
1292         return (bitrate + 50000) / 100000;
1293 }
1294
1295 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1296                                 int flags, struct net_device *dev,
1297                                 u8 *mac_addr, struct station_info *sinfo)
1298 {
1299         void *hdr;
1300         struct nlattr *sinfoattr, *txrate;
1301         u16 bitrate;
1302
1303         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1304         if (!hdr)
1305                 return -1;
1306
1307         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1308         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1309
1310         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1311         if (!sinfoattr)
1312                 goto nla_put_failure;
1313         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1314                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1315                             sinfo->inactive_time);
1316         if (sinfo->filled & STATION_INFO_RX_BYTES)
1317                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1318                             sinfo->rx_bytes);
1319         if (sinfo->filled & STATION_INFO_TX_BYTES)
1320                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1321                             sinfo->tx_bytes);
1322         if (sinfo->filled & STATION_INFO_LLID)
1323                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1324                             sinfo->llid);
1325         if (sinfo->filled & STATION_INFO_PLID)
1326                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1327                             sinfo->plid);
1328         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1329                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1330                             sinfo->plink_state);
1331         if (sinfo->filled & STATION_INFO_SIGNAL)
1332                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1333                            sinfo->signal);
1334         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1335                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1336                 if (!txrate)
1337                         goto nla_put_failure;
1338
1339                 /* nl80211_calculate_bitrate will return 0 for mcs >= 32 */
1340                 bitrate = nl80211_calculate_bitrate(&sinfo->txrate);
1341                 if (bitrate > 0)
1342                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1343
1344                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1345                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1346                                     sinfo->txrate.mcs);
1347                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1348                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1349                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1350                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1351
1352                 nla_nest_end(msg, txrate);
1353         }
1354         if (sinfo->filled & STATION_INFO_RX_PACKETS)
1355                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
1356                             sinfo->rx_packets);
1357         if (sinfo->filled & STATION_INFO_TX_PACKETS)
1358                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
1359                             sinfo->tx_packets);
1360         nla_nest_end(msg, sinfoattr);
1361
1362         return genlmsg_end(msg, hdr);
1363
1364  nla_put_failure:
1365         genlmsg_cancel(msg, hdr);
1366         return -EMSGSIZE;
1367 }
1368
1369 static int nl80211_dump_station(struct sk_buff *skb,
1370                                 struct netlink_callback *cb)
1371 {
1372         struct station_info sinfo;
1373         struct cfg80211_registered_device *dev;
1374         struct net_device *netdev;
1375         u8 mac_addr[ETH_ALEN];
1376         int ifidx = cb->args[0];
1377         int sta_idx = cb->args[1];
1378         int err;
1379
1380         if (!ifidx) {
1381                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1382                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1383                                   nl80211_policy);
1384                 if (err)
1385                         return err;
1386
1387                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1388                         return -EINVAL;
1389
1390                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1391                 if (!ifidx)
1392                         return -EINVAL;
1393         }
1394
1395         rtnl_lock();
1396
1397         netdev = __dev_get_by_index(&init_net, ifidx);
1398         if (!netdev) {
1399                 err = -ENODEV;
1400                 goto out_rtnl;
1401         }
1402
1403         dev = cfg80211_get_dev_from_ifindex(ifidx);
1404         if (IS_ERR(dev)) {
1405                 err = PTR_ERR(dev);
1406                 goto out_rtnl;
1407         }
1408
1409         if (!dev->ops->dump_station) {
1410                 err = -EOPNOTSUPP;
1411                 goto out_err;
1412         }
1413
1414         while (1) {
1415                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1416                                              mac_addr, &sinfo);
1417                 if (err == -ENOENT)
1418                         break;
1419                 if (err)
1420                         goto out_err;
1421
1422                 if (nl80211_send_station(skb,
1423                                 NETLINK_CB(cb->skb).pid,
1424                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
1425                                 netdev, mac_addr,
1426                                 &sinfo) < 0)
1427                         goto out;
1428
1429                 sta_idx++;
1430         }
1431
1432
1433  out:
1434         cb->args[1] = sta_idx;
1435         err = skb->len;
1436  out_err:
1437         cfg80211_put_dev(dev);
1438  out_rtnl:
1439         rtnl_unlock();
1440
1441         return err;
1442 }
1443
1444 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1445 {
1446         struct cfg80211_registered_device *drv;
1447         int err;
1448         struct net_device *dev;
1449         struct station_info sinfo;
1450         struct sk_buff *msg;
1451         u8 *mac_addr = NULL;
1452
1453         memset(&sinfo, 0, sizeof(sinfo));
1454
1455         if (!info->attrs[NL80211_ATTR_MAC])
1456                 return -EINVAL;
1457
1458         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1459
1460         rtnl_lock();
1461
1462         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1463         if (err)
1464                 goto out_rtnl;
1465
1466         if (!drv->ops->get_station) {
1467                 err = -EOPNOTSUPP;
1468                 goto out;
1469         }
1470
1471         err = drv->ops->get_station(&drv->wiphy, dev, mac_addr, &sinfo);
1472         if (err)
1473                 goto out;
1474
1475         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1476         if (!msg)
1477                 goto out;
1478
1479         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1480                                  dev, mac_addr, &sinfo) < 0)
1481                 goto out_free;
1482
1483         err = genlmsg_unicast(msg, info->snd_pid);
1484         goto out;
1485
1486  out_free:
1487         nlmsg_free(msg);
1488  out:
1489         cfg80211_put_dev(drv);
1490         dev_put(dev);
1491  out_rtnl:
1492         rtnl_unlock();
1493
1494         return err;
1495 }
1496
1497 /*
1498  * Get vlan interface making sure it is on the right wiphy.
1499  */
1500 static int get_vlan(struct nlattr *vlanattr,
1501                     struct cfg80211_registered_device *rdev,
1502                     struct net_device **vlan)
1503 {
1504         *vlan = NULL;
1505
1506         if (vlanattr) {
1507                 *vlan = dev_get_by_index(&init_net, nla_get_u32(vlanattr));
1508                 if (!*vlan)
1509                         return -ENODEV;
1510                 if (!(*vlan)->ieee80211_ptr)
1511                         return -EINVAL;
1512                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
1513                         return -EINVAL;
1514         }
1515         return 0;
1516 }
1517
1518 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
1519 {
1520         struct cfg80211_registered_device *drv;
1521         int err;
1522         struct net_device *dev;
1523         struct station_parameters params;
1524         u8 *mac_addr = NULL;
1525
1526         memset(&params, 0, sizeof(params));
1527
1528         params.listen_interval = -1;
1529
1530         if (info->attrs[NL80211_ATTR_STA_AID])
1531                 return -EINVAL;
1532
1533         if (!info->attrs[NL80211_ATTR_MAC])
1534                 return -EINVAL;
1535
1536         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1537
1538         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
1539                 params.supported_rates =
1540                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1541                 params.supported_rates_len =
1542                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1543         }
1544
1545         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1546                 params.listen_interval =
1547                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1548
1549         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1550                 params.ht_capa =
1551                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1552
1553         if (parse_station_flags(info->attrs[NL80211_ATTR_STA_FLAGS],
1554                                 &params.station_flags))
1555                 return -EINVAL;
1556
1557         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
1558                 params.plink_action =
1559                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
1560
1561         rtnl_lock();
1562
1563         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1564         if (err)
1565                 goto out_rtnl;
1566
1567         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1568         if (err)
1569                 goto out;
1570
1571         if (!drv->ops->change_station) {
1572                 err = -EOPNOTSUPP;
1573                 goto out;
1574         }
1575
1576         err = drv->ops->change_station(&drv->wiphy, dev, mac_addr, &params);
1577
1578  out:
1579         if (params.vlan)
1580                 dev_put(params.vlan);
1581         cfg80211_put_dev(drv);
1582         dev_put(dev);
1583  out_rtnl:
1584         rtnl_unlock();
1585
1586         return err;
1587 }
1588
1589 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
1590 {
1591         struct cfg80211_registered_device *drv;
1592         int err;
1593         struct net_device *dev;
1594         struct station_parameters params;
1595         u8 *mac_addr = NULL;
1596
1597         memset(&params, 0, sizeof(params));
1598
1599         if (!info->attrs[NL80211_ATTR_MAC])
1600                 return -EINVAL;
1601
1602         if (!info->attrs[NL80211_ATTR_STA_AID])
1603                 return -EINVAL;
1604
1605         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1606                 return -EINVAL;
1607
1608         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
1609                 return -EINVAL;
1610
1611         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1612         params.supported_rates =
1613                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1614         params.supported_rates_len =
1615                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1616         params.listen_interval =
1617                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1618         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
1619         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1620                 params.ht_capa =
1621                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1622
1623         if (parse_station_flags(info->attrs[NL80211_ATTR_STA_FLAGS],
1624                                 &params.station_flags))
1625                 return -EINVAL;
1626
1627         rtnl_lock();
1628
1629         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1630         if (err)
1631                 goto out_rtnl;
1632
1633         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1634         if (err)
1635                 goto out;
1636
1637         if (!drv->ops->add_station) {
1638                 err = -EOPNOTSUPP;
1639                 goto out;
1640         }
1641
1642         if (!netif_running(dev)) {
1643                 err = -ENETDOWN;
1644                 goto out;
1645         }
1646
1647         err = drv->ops->add_station(&drv->wiphy, dev, mac_addr, &params);
1648
1649  out:
1650         if (params.vlan)
1651                 dev_put(params.vlan);
1652         cfg80211_put_dev(drv);
1653         dev_put(dev);
1654  out_rtnl:
1655         rtnl_unlock();
1656
1657         return err;
1658 }
1659
1660 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
1661 {
1662         struct cfg80211_registered_device *drv;
1663         int err;
1664         struct net_device *dev;
1665         u8 *mac_addr = NULL;
1666
1667         if (info->attrs[NL80211_ATTR_MAC])
1668                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1669
1670         rtnl_lock();
1671
1672         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1673         if (err)
1674                 goto out_rtnl;
1675
1676         if (!drv->ops->del_station) {
1677                 err = -EOPNOTSUPP;
1678                 goto out;
1679         }
1680
1681         err = drv->ops->del_station(&drv->wiphy, dev, mac_addr);
1682
1683  out:
1684         cfg80211_put_dev(drv);
1685         dev_put(dev);
1686  out_rtnl:
1687         rtnl_unlock();
1688
1689         return err;
1690 }
1691
1692 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
1693                                 int flags, struct net_device *dev,
1694                                 u8 *dst, u8 *next_hop,
1695                                 struct mpath_info *pinfo)
1696 {
1697         void *hdr;
1698         struct nlattr *pinfoattr;
1699
1700         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1701         if (!hdr)
1702                 return -1;
1703
1704         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1705         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
1706         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
1707
1708         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
1709         if (!pinfoattr)
1710                 goto nla_put_failure;
1711         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
1712                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
1713                             pinfo->frame_qlen);
1714         if (pinfo->filled & MPATH_INFO_DSN)
1715                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DSN,
1716                             pinfo->dsn);
1717         if (pinfo->filled & MPATH_INFO_METRIC)
1718                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
1719                             pinfo->metric);
1720         if (pinfo->filled & MPATH_INFO_EXPTIME)
1721                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
1722                             pinfo->exptime);
1723         if (pinfo->filled & MPATH_INFO_FLAGS)
1724                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
1725                             pinfo->flags);
1726         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
1727                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
1728                             pinfo->discovery_timeout);
1729         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
1730                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
1731                             pinfo->discovery_retries);
1732
1733         nla_nest_end(msg, pinfoattr);
1734
1735         return genlmsg_end(msg, hdr);
1736
1737  nla_put_failure:
1738         genlmsg_cancel(msg, hdr);
1739         return -EMSGSIZE;
1740 }
1741
1742 static int nl80211_dump_mpath(struct sk_buff *skb,
1743                               struct netlink_callback *cb)
1744 {
1745         struct mpath_info pinfo;
1746         struct cfg80211_registered_device *dev;
1747         struct net_device *netdev;
1748         u8 dst[ETH_ALEN];
1749         u8 next_hop[ETH_ALEN];
1750         int ifidx = cb->args[0];
1751         int path_idx = cb->args[1];
1752         int err;
1753
1754         if (!ifidx) {
1755                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1756                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1757                                   nl80211_policy);
1758                 if (err)
1759                         return err;
1760
1761                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1762                         return -EINVAL;
1763
1764                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1765                 if (!ifidx)
1766                         return -EINVAL;
1767         }
1768
1769         rtnl_lock();
1770
1771         netdev = __dev_get_by_index(&init_net, ifidx);
1772         if (!netdev) {
1773                 err = -ENODEV;
1774                 goto out_rtnl;
1775         }
1776
1777         dev = cfg80211_get_dev_from_ifindex(ifidx);
1778         if (IS_ERR(dev)) {
1779                 err = PTR_ERR(dev);
1780                 goto out_rtnl;
1781         }
1782
1783         if (!dev->ops->dump_mpath) {
1784                 err = -EOPNOTSUPP;
1785                 goto out_err;
1786         }
1787
1788         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1789                 err = -EOPNOTSUPP;
1790                 goto out;
1791         }
1792
1793         while (1) {
1794                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
1795                                            dst, next_hop, &pinfo);
1796                 if (err == -ENOENT)
1797                         break;
1798                 if (err)
1799                         goto out_err;
1800
1801                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
1802                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
1803                                        netdev, dst, next_hop,
1804                                        &pinfo) < 0)
1805                         goto out;
1806
1807                 path_idx++;
1808         }
1809
1810
1811  out:
1812         cb->args[1] = path_idx;
1813         err = skb->len;
1814  out_err:
1815         cfg80211_put_dev(dev);
1816  out_rtnl:
1817         rtnl_unlock();
1818
1819         return err;
1820 }
1821
1822 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
1823 {
1824         struct cfg80211_registered_device *drv;
1825         int err;
1826         struct net_device *dev;
1827         struct mpath_info pinfo;
1828         struct sk_buff *msg;
1829         u8 *dst = NULL;
1830         u8 next_hop[ETH_ALEN];
1831
1832         memset(&pinfo, 0, sizeof(pinfo));
1833
1834         if (!info->attrs[NL80211_ATTR_MAC])
1835                 return -EINVAL;
1836
1837         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1838
1839         rtnl_lock();
1840
1841         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1842         if (err)
1843                 goto out_rtnl;
1844
1845         if (!drv->ops->get_mpath) {
1846                 err = -EOPNOTSUPP;
1847                 goto out;
1848         }
1849
1850         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1851                 err = -EOPNOTSUPP;
1852                 goto out;
1853         }
1854
1855         err = drv->ops->get_mpath(&drv->wiphy, dev, dst, next_hop, &pinfo);
1856         if (err)
1857                 goto out;
1858
1859         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1860         if (!msg)
1861                 goto out;
1862
1863         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
1864                                  dev, dst, next_hop, &pinfo) < 0)
1865                 goto out_free;
1866
1867         err = genlmsg_unicast(msg, info->snd_pid);
1868         goto out;
1869
1870  out_free:
1871         nlmsg_free(msg);
1872  out:
1873         cfg80211_put_dev(drv);
1874         dev_put(dev);
1875  out_rtnl:
1876         rtnl_unlock();
1877
1878         return err;
1879 }
1880
1881 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
1882 {
1883         struct cfg80211_registered_device *drv;
1884         int err;
1885         struct net_device *dev;
1886         u8 *dst = NULL;
1887         u8 *next_hop = NULL;
1888
1889         if (!info->attrs[NL80211_ATTR_MAC])
1890                 return -EINVAL;
1891
1892         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
1893                 return -EINVAL;
1894
1895         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1896         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
1897
1898         rtnl_lock();
1899
1900         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1901         if (err)
1902                 goto out_rtnl;
1903
1904         if (!drv->ops->change_mpath) {
1905                 err = -EOPNOTSUPP;
1906                 goto out;
1907         }
1908
1909         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1910                 err = -EOPNOTSUPP;
1911                 goto out;
1912         }
1913
1914         if (!netif_running(dev)) {
1915                 err = -ENETDOWN;
1916                 goto out;
1917         }
1918
1919         err = drv->ops->change_mpath(&drv->wiphy, dev, dst, next_hop);
1920
1921  out:
1922         cfg80211_put_dev(drv);
1923         dev_put(dev);
1924  out_rtnl:
1925         rtnl_unlock();
1926
1927         return err;
1928 }
1929 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
1930 {
1931         struct cfg80211_registered_device *drv;
1932         int err;
1933         struct net_device *dev;
1934         u8 *dst = NULL;
1935         u8 *next_hop = NULL;
1936
1937         if (!info->attrs[NL80211_ATTR_MAC])
1938                 return -EINVAL;
1939
1940         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
1941                 return -EINVAL;
1942
1943         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1944         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
1945
1946         rtnl_lock();
1947
1948         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1949         if (err)
1950                 goto out_rtnl;
1951
1952         if (!drv->ops->add_mpath) {
1953                 err = -EOPNOTSUPP;
1954                 goto out;
1955         }
1956
1957         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1958                 err = -EOPNOTSUPP;
1959                 goto out;
1960         }
1961
1962         if (!netif_running(dev)) {
1963                 err = -ENETDOWN;
1964                 goto out;
1965         }
1966
1967         err = drv->ops->add_mpath(&drv->wiphy, dev, dst, next_hop);
1968
1969  out:
1970         cfg80211_put_dev(drv);
1971         dev_put(dev);
1972  out_rtnl:
1973         rtnl_unlock();
1974
1975         return err;
1976 }
1977
1978 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
1979 {
1980         struct cfg80211_registered_device *drv;
1981         int err;
1982         struct net_device *dev;
1983         u8 *dst = NULL;
1984
1985         if (info->attrs[NL80211_ATTR_MAC])
1986                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1987
1988         rtnl_lock();
1989
1990         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1991         if (err)
1992                 goto out_rtnl;
1993
1994         if (!drv->ops->del_mpath) {
1995                 err = -EOPNOTSUPP;
1996                 goto out;
1997         }
1998
1999         err = drv->ops->del_mpath(&drv->wiphy, dev, dst);
2000
2001  out:
2002         cfg80211_put_dev(drv);
2003         dev_put(dev);
2004  out_rtnl:
2005         rtnl_unlock();
2006
2007         return err;
2008 }
2009
2010 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2011 {
2012         struct cfg80211_registered_device *drv;
2013         int err;
2014         struct net_device *dev;
2015         struct bss_parameters params;
2016
2017         memset(&params, 0, sizeof(params));
2018         /* default to not changing parameters */
2019         params.use_cts_prot = -1;
2020         params.use_short_preamble = -1;
2021         params.use_short_slot_time = -1;
2022
2023         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2024                 params.use_cts_prot =
2025                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2026         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2027                 params.use_short_preamble =
2028                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2029         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2030                 params.use_short_slot_time =
2031                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2032         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2033                 params.basic_rates =
2034                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2035                 params.basic_rates_len =
2036                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2037         }
2038
2039         rtnl_lock();
2040
2041         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2042         if (err)
2043                 goto out_rtnl;
2044
2045         if (!drv->ops->change_bss) {
2046                 err = -EOPNOTSUPP;
2047                 goto out;
2048         }
2049
2050         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
2051                 err = -EOPNOTSUPP;
2052                 goto out;
2053         }
2054
2055         err = drv->ops->change_bss(&drv->wiphy, dev, &params);
2056
2057  out:
2058         cfg80211_put_dev(drv);
2059         dev_put(dev);
2060  out_rtnl:
2061         rtnl_unlock();
2062
2063         return err;
2064 }
2065
2066 static const struct nla_policy
2067         reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2068         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2069         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2070         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2071         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2072         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2073         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2074 };
2075
2076 static int parse_reg_rule(struct nlattr *tb[],
2077         struct ieee80211_reg_rule *reg_rule)
2078 {
2079         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2080         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2081
2082         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2083                 return -EINVAL;
2084         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2085                 return -EINVAL;
2086         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2087                 return -EINVAL;
2088         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2089                 return -EINVAL;
2090         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2091                 return -EINVAL;
2092
2093         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2094
2095         freq_range->start_freq_khz =
2096                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2097         freq_range->end_freq_khz =
2098                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2099         freq_range->max_bandwidth_khz =
2100                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2101
2102         power_rule->max_eirp =
2103                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2104
2105         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2106                 power_rule->max_antenna_gain =
2107                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2108
2109         return 0;
2110 }
2111
2112 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2113 {
2114         int r;
2115         char *data = NULL;
2116
2117         /*
2118          * You should only get this when cfg80211 hasn't yet initialized
2119          * completely when built-in to the kernel right between the time
2120          * window between nl80211_init() and regulatory_init(), if that is
2121          * even possible.
2122          */
2123         mutex_lock(&cfg80211_mutex);
2124         if (unlikely(!cfg80211_regdomain)) {
2125                 mutex_unlock(&cfg80211_mutex);
2126                 return -EINPROGRESS;
2127         }
2128         mutex_unlock(&cfg80211_mutex);
2129
2130         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2131                 return -EINVAL;
2132
2133         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2134
2135 #ifdef CONFIG_WIRELESS_OLD_REGULATORY
2136         /* We ignore world regdom requests with the old regdom setup */
2137         if (is_world_regdom(data))
2138                 return -EINVAL;
2139 #endif
2140
2141         r = regulatory_hint_user(data);
2142
2143         return r;
2144 }
2145
2146 static int nl80211_get_mesh_params(struct sk_buff *skb,
2147         struct genl_info *info)
2148 {
2149         struct cfg80211_registered_device *drv;
2150         struct mesh_config cur_params;
2151         int err;
2152         struct net_device *dev;
2153         void *hdr;
2154         struct nlattr *pinfoattr;
2155         struct sk_buff *msg;
2156
2157         rtnl_lock();
2158
2159         /* Look up our device */
2160         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2161         if (err)
2162                 goto out_rtnl;
2163
2164         if (!drv->ops->get_mesh_params) {
2165                 err = -EOPNOTSUPP;
2166                 goto out;
2167         }
2168
2169         /* Get the mesh params */
2170         err = drv->ops->get_mesh_params(&drv->wiphy, dev, &cur_params);
2171         if (err)
2172                 goto out;
2173
2174         /* Draw up a netlink message to send back */
2175         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2176         if (!msg) {
2177                 err = -ENOBUFS;
2178                 goto out;
2179         }
2180         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2181                              NL80211_CMD_GET_MESH_PARAMS);
2182         if (!hdr)
2183                 goto nla_put_failure;
2184         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
2185         if (!pinfoattr)
2186                 goto nla_put_failure;
2187         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2188         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2189                         cur_params.dot11MeshRetryTimeout);
2190         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2191                         cur_params.dot11MeshConfirmTimeout);
2192         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2193                         cur_params.dot11MeshHoldingTimeout);
2194         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2195                         cur_params.dot11MeshMaxPeerLinks);
2196         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2197                         cur_params.dot11MeshMaxRetries);
2198         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2199                         cur_params.dot11MeshTTL);
2200         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2201                         cur_params.auto_open_plinks);
2202         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2203                         cur_params.dot11MeshHWMPmaxPREQretries);
2204         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2205                         cur_params.path_refresh_time);
2206         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2207                         cur_params.min_discovery_timeout);
2208         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2209                         cur_params.dot11MeshHWMPactivePathTimeout);
2210         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2211                         cur_params.dot11MeshHWMPpreqMinInterval);
2212         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2213                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2214         nla_nest_end(msg, pinfoattr);
2215         genlmsg_end(msg, hdr);
2216         err = genlmsg_unicast(msg, info->snd_pid);
2217         goto out;
2218
2219  nla_put_failure:
2220         genlmsg_cancel(msg, hdr);
2221         err = -EMSGSIZE;
2222  out:
2223         /* Cleanup */
2224         cfg80211_put_dev(drv);
2225         dev_put(dev);
2226  out_rtnl:
2227         rtnl_unlock();
2228
2229         return err;
2230 }
2231
2232 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2233 do {\
2234         if (table[attr_num]) {\
2235                 cfg.param = nla_fn(table[attr_num]); \
2236                 mask |= (1 << (attr_num - 1)); \
2237         } \
2238 } while (0);\
2239
2240 static struct nla_policy
2241 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] __read_mostly = {
2242         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2243         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2244         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2245         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2246         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2247         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2248         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2249
2250         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2251         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2252         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2253         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2254         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2255         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2256 };
2257
2258 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2259 {
2260         int err;
2261         u32 mask;
2262         struct cfg80211_registered_device *drv;
2263         struct net_device *dev;
2264         struct mesh_config cfg;
2265         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2266         struct nlattr *parent_attr;
2267
2268         parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
2269         if (!parent_attr)
2270                 return -EINVAL;
2271         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2272                         parent_attr, nl80211_meshconf_params_policy))
2273                 return -EINVAL;
2274
2275         rtnl_lock();
2276
2277         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2278         if (err)
2279                 goto out_rtnl;
2280
2281         if (!drv->ops->set_mesh_params) {
2282                 err = -EOPNOTSUPP;
2283                 goto out;
2284         }
2285
2286         /* This makes sure that there aren't more than 32 mesh config
2287          * parameters (otherwise our bitfield scheme would not work.) */
2288         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2289
2290         /* Fill in the params struct */
2291         mask = 0;
2292         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2293                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2294         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2295                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2296         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2297                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2298         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2299                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2300         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2301                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2302         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2303                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2304         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2305                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2306         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2307                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2308                         nla_get_u8);
2309         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2310                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2311         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2312                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2313                         nla_get_u16);
2314         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2315                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2316                         nla_get_u32);
2317         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2318                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2319                         nla_get_u16);
2320         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2321                         dot11MeshHWMPnetDiameterTraversalTime,
2322                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2323                         nla_get_u16);
2324
2325         /* Apply changes */
2326         err = drv->ops->set_mesh_params(&drv->wiphy, dev, &cfg, mask);
2327
2328  out:
2329         /* cleanup */
2330         cfg80211_put_dev(drv);
2331         dev_put(dev);
2332  out_rtnl:
2333         rtnl_unlock();
2334
2335         return err;
2336 }
2337
2338 #undef FILL_IN_MESH_PARAM_IF_SET
2339
2340 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2341 {
2342         struct sk_buff *msg;
2343         void *hdr = NULL;
2344         struct nlattr *nl_reg_rules;
2345         unsigned int i;
2346         int err = -EINVAL;
2347
2348         mutex_lock(&cfg80211_mutex);
2349
2350         if (!cfg80211_regdomain)
2351                 goto out;
2352
2353         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2354         if (!msg) {
2355                 err = -ENOBUFS;
2356                 goto out;
2357         }
2358
2359         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2360                              NL80211_CMD_GET_REG);
2361         if (!hdr)
2362                 goto nla_put_failure;
2363
2364         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2365                 cfg80211_regdomain->alpha2);
2366
2367         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2368         if (!nl_reg_rules)
2369                 goto nla_put_failure;
2370
2371         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2372                 struct nlattr *nl_reg_rule;
2373                 const struct ieee80211_reg_rule *reg_rule;
2374                 const struct ieee80211_freq_range *freq_range;
2375                 const struct ieee80211_power_rule *power_rule;
2376
2377                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2378                 freq_range = &reg_rule->freq_range;
2379                 power_rule = &reg_rule->power_rule;
2380
2381                 nl_reg_rule = nla_nest_start(msg, i);
2382                 if (!nl_reg_rule)
2383                         goto nla_put_failure;
2384
2385                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2386                         reg_rule->flags);
2387                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2388                         freq_range->start_freq_khz);
2389                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2390                         freq_range->end_freq_khz);
2391                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2392                         freq_range->max_bandwidth_khz);
2393                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2394                         power_rule->max_antenna_gain);
2395                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2396                         power_rule->max_eirp);
2397
2398                 nla_nest_end(msg, nl_reg_rule);
2399         }
2400
2401         nla_nest_end(msg, nl_reg_rules);
2402
2403         genlmsg_end(msg, hdr);
2404         err = genlmsg_unicast(msg, info->snd_pid);
2405         goto out;
2406
2407 nla_put_failure:
2408         genlmsg_cancel(msg, hdr);
2409         err = -EMSGSIZE;
2410 out:
2411         mutex_unlock(&cfg80211_mutex);
2412         return err;
2413 }
2414
2415 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2416 {
2417         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2418         struct nlattr *nl_reg_rule;
2419         char *alpha2 = NULL;
2420         int rem_reg_rules = 0, r = 0;
2421         u32 num_rules = 0, rule_idx = 0, size_of_regd;
2422         struct ieee80211_regdomain *rd = NULL;
2423
2424         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2425                 return -EINVAL;
2426
2427         if (!info->attrs[NL80211_ATTR_REG_RULES])
2428                 return -EINVAL;
2429
2430         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2431
2432         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2433                         rem_reg_rules) {
2434                 num_rules++;
2435                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2436                         goto bad_reg;
2437         }
2438
2439         if (!reg_is_valid_request(alpha2))
2440                 return -EINVAL;
2441
2442         size_of_regd = sizeof(struct ieee80211_regdomain) +
2443                 (num_rules * sizeof(struct ieee80211_reg_rule));
2444
2445         rd = kzalloc(size_of_regd, GFP_KERNEL);
2446         if (!rd)
2447                 return -ENOMEM;
2448
2449         rd->n_reg_rules = num_rules;
2450         rd->alpha2[0] = alpha2[0];
2451         rd->alpha2[1] = alpha2[1];
2452
2453         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2454                         rem_reg_rules) {
2455                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2456                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2457                         reg_rule_policy);
2458                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2459                 if (r)
2460                         goto bad_reg;
2461
2462                 rule_idx++;
2463
2464                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES)
2465                         goto bad_reg;
2466         }
2467
2468         BUG_ON(rule_idx != num_rules);
2469
2470         mutex_lock(&cfg80211_mutex);
2471         r = set_regdom(rd);
2472         mutex_unlock(&cfg80211_mutex);
2473         return r;
2474
2475  bad_reg:
2476         kfree(rd);
2477         return -EINVAL;
2478 }
2479
2480 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
2481 {
2482         struct cfg80211_registered_device *drv;
2483         struct net_device *dev;
2484         struct cfg80211_scan_request *request;
2485         struct cfg80211_ssid *ssid;
2486         struct ieee80211_channel *channel;
2487         struct nlattr *attr;
2488         struct wiphy *wiphy;
2489         int err, tmp, n_ssids = 0, n_channels = 0, i;
2490         enum ieee80211_band band;
2491         size_t ie_len;
2492
2493         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2494                 return -EINVAL;
2495
2496         rtnl_lock();
2497
2498         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2499         if (err)
2500                 goto out_rtnl;
2501
2502         wiphy = &drv->wiphy;
2503
2504         if (!drv->ops->scan) {
2505                 err = -EOPNOTSUPP;
2506                 goto out;
2507         }
2508
2509         if (!netif_running(dev)) {
2510                 err = -ENETDOWN;
2511                 goto out;
2512         }
2513
2514         if (drv->scan_req) {
2515                 err = -EBUSY;
2516                 goto out;
2517         }
2518
2519         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2520                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp)
2521                         n_channels++;
2522                 if (!n_channels) {
2523                         err = -EINVAL;
2524                         goto out;
2525                 }
2526         } else {
2527                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
2528                         if (wiphy->bands[band])
2529                                 n_channels += wiphy->bands[band]->n_channels;
2530         }
2531
2532         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
2533                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
2534                         n_ssids++;
2535
2536         if (n_ssids > wiphy->max_scan_ssids) {
2537                 err = -EINVAL;
2538                 goto out;
2539         }
2540
2541         if (info->attrs[NL80211_ATTR_IE])
2542                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2543         else
2544                 ie_len = 0;
2545
2546         if (ie_len > wiphy->max_scan_ie_len) {
2547                 err = -EINVAL;
2548                 goto out;
2549         }
2550
2551         request = kzalloc(sizeof(*request)
2552                         + sizeof(*ssid) * n_ssids
2553                         + sizeof(channel) * n_channels
2554                         + ie_len, GFP_KERNEL);
2555         if (!request) {
2556                 err = -ENOMEM;
2557                 goto out;
2558         }
2559
2560         request->channels = (void *)((char *)request + sizeof(*request));
2561         request->n_channels = n_channels;
2562         if (n_ssids)
2563                 request->ssids = (void *)(request->channels + n_channels);
2564         request->n_ssids = n_ssids;
2565         if (ie_len) {
2566                 if (request->ssids)
2567                         request->ie = (void *)(request->ssids + n_ssids);
2568                 else
2569                         request->ie = (void *)(request->channels + n_channels);
2570         }
2571
2572         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2573                 /* user specified, bail out if channel not found */
2574                 request->n_channels = n_channels;
2575                 i = 0;
2576                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
2577                         request->channels[i] = ieee80211_get_channel(wiphy, nla_get_u32(attr));
2578                         if (!request->channels[i]) {
2579                                 err = -EINVAL;
2580                                 goto out_free;
2581                         }
2582                         i++;
2583                 }
2584         } else {
2585                 /* all channels */
2586                 i = 0;
2587                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
2588                         int j;
2589                         if (!wiphy->bands[band])
2590                                 continue;
2591                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
2592                                 request->channels[i] = &wiphy->bands[band]->channels[j];
2593                                 i++;
2594                         }
2595                 }
2596         }
2597
2598         i = 0;
2599         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
2600                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
2601                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
2602                                 err = -EINVAL;
2603                                 goto out_free;
2604                         }
2605                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
2606                         request->ssids[i].ssid_len = nla_len(attr);
2607                         i++;
2608                 }
2609         }
2610
2611         if (info->attrs[NL80211_ATTR_IE]) {
2612                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2613                 memcpy((void *)request->ie,
2614                        nla_data(info->attrs[NL80211_ATTR_IE]),
2615                        request->ie_len);
2616         }
2617
2618         request->ifidx = dev->ifindex;
2619         request->wiphy = &drv->wiphy;
2620
2621         drv->scan_req = request;
2622         err = drv->ops->scan(&drv->wiphy, dev, request);
2623
2624  out_free:
2625         if (err) {
2626                 drv->scan_req = NULL;
2627                 kfree(request);
2628         }
2629  out:
2630         cfg80211_put_dev(drv);
2631         dev_put(dev);
2632  out_rtnl:
2633         rtnl_unlock();
2634
2635         return err;
2636 }
2637
2638 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
2639                             struct cfg80211_registered_device *rdev,
2640                             struct net_device *dev,
2641                             struct cfg80211_bss *res)
2642 {
2643         void *hdr;
2644         struct nlattr *bss;
2645
2646         hdr = nl80211hdr_put(msg, pid, seq, flags,
2647                              NL80211_CMD_NEW_SCAN_RESULTS);
2648         if (!hdr)
2649                 return -1;
2650
2651         NLA_PUT_U32(msg, NL80211_ATTR_SCAN_GENERATION,
2652                     rdev->bss_generation);
2653         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2654
2655         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
2656         if (!bss)
2657                 goto nla_put_failure;
2658         if (!is_zero_ether_addr(res->bssid))
2659                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
2660         if (res->information_elements && res->len_information_elements)
2661                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
2662                         res->len_information_elements,
2663                         res->information_elements);
2664         if (res->tsf)
2665                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
2666         if (res->beacon_interval)
2667                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
2668         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
2669         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
2670
2671         switch (rdev->wiphy.signal_type) {
2672         case CFG80211_SIGNAL_TYPE_MBM:
2673                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
2674                 break;
2675         case CFG80211_SIGNAL_TYPE_UNSPEC:
2676                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
2677                 break;
2678         default:
2679                 break;
2680         }
2681
2682         nla_nest_end(msg, bss);
2683
2684         return genlmsg_end(msg, hdr);
2685
2686  nla_put_failure:
2687         genlmsg_cancel(msg, hdr);
2688         return -EMSGSIZE;
2689 }
2690
2691 static int nl80211_dump_scan(struct sk_buff *skb,
2692                              struct netlink_callback *cb)
2693 {
2694         struct cfg80211_registered_device *dev;
2695         struct net_device *netdev;
2696         struct cfg80211_internal_bss *scan;
2697         int ifidx = cb->args[0];
2698         int start = cb->args[1], idx = 0;
2699         int err;
2700
2701         if (!ifidx) {
2702                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
2703                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
2704                                   nl80211_policy);
2705                 if (err)
2706                         return err;
2707
2708                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
2709                         return -EINVAL;
2710
2711                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
2712                 if (!ifidx)
2713                         return -EINVAL;
2714                 cb->args[0] = ifidx;
2715         }
2716
2717         netdev = dev_get_by_index(&init_net, ifidx);
2718         if (!netdev)
2719                 return -ENODEV;
2720
2721         dev = cfg80211_get_dev_from_ifindex(ifidx);
2722         if (IS_ERR(dev)) {
2723                 err = PTR_ERR(dev);
2724                 goto out_put_netdev;
2725         }
2726
2727         spin_lock_bh(&dev->bss_lock);
2728         cfg80211_bss_expire(dev);
2729
2730         list_for_each_entry(scan, &dev->bss_list, list) {
2731                 if (++idx <= start)
2732                         continue;
2733                 if (nl80211_send_bss(skb,
2734                                 NETLINK_CB(cb->skb).pid,
2735                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2736                                 dev, netdev, &scan->pub) < 0) {
2737                         idx--;
2738                         goto out;
2739                 }
2740         }
2741
2742  out:
2743         spin_unlock_bh(&dev->bss_lock);
2744
2745         cb->args[1] = idx;
2746         err = skb->len;
2747         cfg80211_put_dev(dev);
2748  out_put_netdev:
2749         dev_put(netdev);
2750
2751         return err;
2752 }
2753
2754 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
2755 {
2756         return auth_type == NL80211_AUTHTYPE_OPEN_SYSTEM ||
2757                 auth_type == NL80211_AUTHTYPE_SHARED_KEY ||
2758                 auth_type == NL80211_AUTHTYPE_FT ||
2759                 auth_type == NL80211_AUTHTYPE_NETWORK_EAP;
2760 }
2761
2762 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
2763 {
2764         struct cfg80211_registered_device *drv;
2765         struct net_device *dev;
2766         struct cfg80211_auth_request req;
2767         struct wiphy *wiphy;
2768         int err;
2769
2770         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2771                 return -EINVAL;
2772
2773         if (!info->attrs[NL80211_ATTR_MAC])
2774                 return -EINVAL;
2775
2776         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
2777                 return -EINVAL;
2778
2779         rtnl_lock();
2780
2781         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2782         if (err)
2783                 goto unlock_rtnl;
2784
2785         if (!drv->ops->auth) {
2786                 err = -EOPNOTSUPP;
2787                 goto out;
2788         }
2789
2790         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
2791                 err = -EOPNOTSUPP;
2792                 goto out;
2793         }
2794
2795         if (!netif_running(dev)) {
2796                 err = -ENETDOWN;
2797                 goto out;
2798         }
2799
2800         wiphy = &drv->wiphy;
2801         memset(&req, 0, sizeof(req));
2802
2803         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2804
2805         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2806                 req.chan = ieee80211_get_channel(
2807                         wiphy,
2808                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
2809                 if (!req.chan) {
2810                         err = -EINVAL;
2811                         goto out;
2812                 }
2813         }
2814
2815         if (info->attrs[NL80211_ATTR_SSID]) {
2816                 req.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2817                 req.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
2818         }
2819
2820         if (info->attrs[NL80211_ATTR_IE]) {
2821                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
2822                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2823         }
2824
2825         req.auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
2826         if (!nl80211_valid_auth_type(req.auth_type)) {
2827                 err = -EINVAL;
2828                 goto out;
2829         }
2830
2831         err = drv->ops->auth(&drv->wiphy, dev, &req);
2832
2833 out:
2834         cfg80211_put_dev(drv);
2835         dev_put(dev);
2836 unlock_rtnl:
2837         rtnl_unlock();
2838         return err;
2839 }
2840
2841 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
2842 {
2843         struct cfg80211_registered_device *drv;
2844         struct net_device *dev;
2845         struct cfg80211_assoc_request req;
2846         struct wiphy *wiphy;
2847         int err;
2848
2849         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2850                 return -EINVAL;
2851
2852         if (!info->attrs[NL80211_ATTR_MAC] ||
2853             !info->attrs[NL80211_ATTR_SSID])
2854                 return -EINVAL;
2855
2856         rtnl_lock();
2857
2858         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2859         if (err)
2860                 goto unlock_rtnl;
2861
2862         if (!drv->ops->assoc) {
2863                 err = -EOPNOTSUPP;
2864                 goto out;
2865         }
2866
2867         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
2868                 err = -EOPNOTSUPP;
2869                 goto out;
2870         }
2871
2872         if (!netif_running(dev)) {
2873                 err = -ENETDOWN;
2874                 goto out;
2875         }
2876
2877         wiphy = &drv->wiphy;
2878         memset(&req, 0, sizeof(req));
2879
2880         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2881
2882         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2883                 req.chan = ieee80211_get_channel(
2884                         wiphy,
2885                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
2886                 if (!req.chan) {
2887                         err = -EINVAL;
2888                         goto out;
2889                 }
2890         }
2891
2892         req.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2893         req.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
2894
2895         if (info->attrs[NL80211_ATTR_IE]) {
2896                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
2897                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2898         }
2899
2900         err = drv->ops->assoc(&drv->wiphy, dev, &req);
2901
2902 out:
2903         cfg80211_put_dev(drv);
2904         dev_put(dev);
2905 unlock_rtnl:
2906         rtnl_unlock();
2907         return err;
2908 }
2909
2910 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
2911 {
2912         struct cfg80211_registered_device *drv;
2913         struct net_device *dev;
2914         struct cfg80211_deauth_request req;
2915         struct wiphy *wiphy;
2916         int err;
2917
2918         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2919                 return -EINVAL;
2920
2921         if (!info->attrs[NL80211_ATTR_MAC])
2922                 return -EINVAL;
2923
2924         if (!info->attrs[NL80211_ATTR_REASON_CODE])
2925                 return -EINVAL;
2926
2927         rtnl_lock();
2928
2929         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2930         if (err)
2931                 goto unlock_rtnl;
2932
2933         if (!drv->ops->deauth) {
2934                 err = -EOPNOTSUPP;
2935                 goto out;
2936         }
2937
2938         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
2939                 err = -EOPNOTSUPP;
2940                 goto out;
2941         }
2942
2943         if (!netif_running(dev)) {
2944                 err = -ENETDOWN;
2945                 goto out;
2946         }
2947
2948         wiphy = &drv->wiphy;
2949         memset(&req, 0, sizeof(req));
2950
2951         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2952
2953         req.reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
2954         if (req.reason_code == 0) {
2955                 /* Reason Code 0 is reserved */
2956                 err = -EINVAL;
2957                 goto out;
2958         }
2959
2960         if (info->attrs[NL80211_ATTR_IE]) {
2961                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
2962                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2963         }
2964
2965         err = drv->ops->deauth(&drv->wiphy, dev, &req);
2966
2967 out:
2968         cfg80211_put_dev(drv);
2969         dev_put(dev);
2970 unlock_rtnl:
2971         rtnl_unlock();
2972         return err;
2973 }
2974
2975 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
2976 {
2977         struct cfg80211_registered_device *drv;
2978         struct net_device *dev;
2979         struct cfg80211_disassoc_request req;
2980         struct wiphy *wiphy;
2981         int err;
2982
2983         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2984                 return -EINVAL;
2985
2986         if (!info->attrs[NL80211_ATTR_MAC])
2987                 return -EINVAL;
2988
2989         if (!info->attrs[NL80211_ATTR_REASON_CODE])
2990                 return -EINVAL;
2991
2992         rtnl_lock();
2993
2994         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2995         if (err)
2996                 goto unlock_rtnl;
2997
2998         if (!drv->ops->disassoc) {
2999                 err = -EOPNOTSUPP;
3000                 goto out;
3001         }
3002
3003         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3004                 err = -EOPNOTSUPP;
3005                 goto out;
3006         }
3007
3008         if (!netif_running(dev)) {
3009                 err = -ENETDOWN;
3010                 goto out;
3011         }
3012
3013         wiphy = &drv->wiphy;
3014         memset(&req, 0, sizeof(req));
3015
3016         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3017
3018         req.reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3019         if (req.reason_code == 0) {
3020                 /* Reason Code 0 is reserved */
3021                 err = -EINVAL;
3022                 goto out;
3023         }
3024
3025         if (info->attrs[NL80211_ATTR_IE]) {
3026                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3027                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3028         }
3029
3030         err = drv->ops->disassoc(&drv->wiphy, dev, &req);
3031
3032 out:
3033         cfg80211_put_dev(drv);
3034         dev_put(dev);
3035 unlock_rtnl:
3036         rtnl_unlock();
3037         return err;
3038 }
3039
3040 static struct genl_ops nl80211_ops[] = {
3041         {
3042                 .cmd = NL80211_CMD_GET_WIPHY,
3043                 .doit = nl80211_get_wiphy,
3044                 .dumpit = nl80211_dump_wiphy,
3045                 .policy = nl80211_policy,
3046                 /* can be retrieved by unprivileged users */
3047         },
3048         {
3049                 .cmd = NL80211_CMD_SET_WIPHY,
3050                 .doit = nl80211_set_wiphy,
3051                 .policy = nl80211_policy,
3052                 .flags = GENL_ADMIN_PERM,
3053         },
3054         {
3055                 .cmd = NL80211_CMD_GET_INTERFACE,
3056                 .doit = nl80211_get_interface,
3057                 .dumpit = nl80211_dump_interface,
3058                 .policy = nl80211_policy,
3059                 /* can be retrieved by unprivileged users */
3060         },
3061         {
3062                 .cmd = NL80211_CMD_SET_INTERFACE,
3063                 .doit = nl80211_set_interface,
3064                 .policy = nl80211_policy,
3065                 .flags = GENL_ADMIN_PERM,
3066         },
3067         {
3068                 .cmd = NL80211_CMD_NEW_INTERFACE,
3069                 .doit = nl80211_new_interface,
3070                 .policy = nl80211_policy,
3071                 .flags = GENL_ADMIN_PERM,
3072         },
3073         {
3074                 .cmd = NL80211_CMD_DEL_INTERFACE,
3075                 .doit = nl80211_del_interface,
3076                 .policy = nl80211_policy,
3077                 .flags = GENL_ADMIN_PERM,
3078         },
3079         {
3080                 .cmd = NL80211_CMD_GET_KEY,
3081                 .doit = nl80211_get_key,
3082                 .policy = nl80211_policy,
3083                 .flags = GENL_ADMIN_PERM,
3084         },
3085         {
3086                 .cmd = NL80211_CMD_SET_KEY,
3087                 .doit = nl80211_set_key,
3088                 .policy = nl80211_policy,
3089                 .flags = GENL_ADMIN_PERM,
3090         },
3091         {
3092                 .cmd = NL80211_CMD_NEW_KEY,
3093                 .doit = nl80211_new_key,
3094                 .policy = nl80211_policy,
3095                 .flags = GENL_ADMIN_PERM,
3096         },
3097         {
3098                 .cmd = NL80211_CMD_DEL_KEY,
3099                 .doit = nl80211_del_key,
3100                 .policy = nl80211_policy,
3101                 .flags = GENL_ADMIN_PERM,
3102         },
3103         {
3104                 .cmd = NL80211_CMD_SET_BEACON,
3105                 .policy = nl80211_policy,
3106                 .flags = GENL_ADMIN_PERM,
3107                 .doit = nl80211_addset_beacon,
3108         },
3109         {
3110                 .cmd = NL80211_CMD_NEW_BEACON,
3111                 .policy = nl80211_policy,
3112                 .flags = GENL_ADMIN_PERM,
3113                 .doit = nl80211_addset_beacon,
3114         },
3115         {
3116                 .cmd = NL80211_CMD_DEL_BEACON,
3117                 .policy = nl80211_policy,
3118                 .flags = GENL_ADMIN_PERM,
3119                 .doit = nl80211_del_beacon,
3120         },
3121         {
3122                 .cmd = NL80211_CMD_GET_STATION,
3123                 .doit = nl80211_get_station,
3124                 .dumpit = nl80211_dump_station,
3125                 .policy = nl80211_policy,
3126         },
3127         {
3128                 .cmd = NL80211_CMD_SET_STATION,
3129                 .doit = nl80211_set_station,
3130                 .policy = nl80211_policy,
3131                 .flags = GENL_ADMIN_PERM,
3132         },
3133         {
3134                 .cmd = NL80211_CMD_NEW_STATION,
3135                 .doit = nl80211_new_station,
3136                 .policy = nl80211_policy,
3137                 .flags = GENL_ADMIN_PERM,
3138         },
3139         {
3140                 .cmd = NL80211_CMD_DEL_STATION,
3141                 .doit = nl80211_del_station,
3142                 .policy = nl80211_policy,
3143                 .flags = GENL_ADMIN_PERM,
3144         },
3145         {
3146                 .cmd = NL80211_CMD_GET_MPATH,
3147                 .doit = nl80211_get_mpath,
3148                 .dumpit = nl80211_dump_mpath,
3149                 .policy = nl80211_policy,
3150                 .flags = GENL_ADMIN_PERM,
3151         },
3152         {
3153                 .cmd = NL80211_CMD_SET_MPATH,
3154                 .doit = nl80211_set_mpath,
3155                 .policy = nl80211_policy,
3156                 .flags = GENL_ADMIN_PERM,
3157         },
3158         {
3159                 .cmd = NL80211_CMD_NEW_MPATH,
3160                 .doit = nl80211_new_mpath,
3161                 .policy = nl80211_policy,
3162                 .flags = GENL_ADMIN_PERM,
3163         },
3164         {
3165                 .cmd = NL80211_CMD_DEL_MPATH,
3166                 .doit = nl80211_del_mpath,
3167                 .policy = nl80211_policy,
3168                 .flags = GENL_ADMIN_PERM,
3169         },
3170         {
3171                 .cmd = NL80211_CMD_SET_BSS,
3172                 .doit = nl80211_set_bss,
3173                 .policy = nl80211_policy,
3174                 .flags = GENL_ADMIN_PERM,
3175         },
3176         {
3177                 .cmd = NL80211_CMD_GET_REG,
3178                 .doit = nl80211_get_reg,
3179                 .policy = nl80211_policy,
3180                 /* can be retrieved by unprivileged users */
3181         },
3182         {
3183                 .cmd = NL80211_CMD_SET_REG,
3184                 .doit = nl80211_set_reg,
3185                 .policy = nl80211_policy,
3186                 .flags = GENL_ADMIN_PERM,
3187         },
3188         {
3189                 .cmd = NL80211_CMD_REQ_SET_REG,
3190                 .doit = nl80211_req_set_reg,
3191                 .policy = nl80211_policy,
3192                 .flags = GENL_ADMIN_PERM,
3193         },
3194         {
3195                 .cmd = NL80211_CMD_GET_MESH_PARAMS,
3196                 .doit = nl80211_get_mesh_params,
3197                 .policy = nl80211_policy,
3198                 /* can be retrieved by unprivileged users */
3199         },
3200         {
3201                 .cmd = NL80211_CMD_SET_MESH_PARAMS,
3202                 .doit = nl80211_set_mesh_params,
3203                 .policy = nl80211_policy,
3204                 .flags = GENL_ADMIN_PERM,
3205         },
3206         {
3207                 .cmd = NL80211_CMD_TRIGGER_SCAN,
3208                 .doit = nl80211_trigger_scan,
3209                 .policy = nl80211_policy,
3210                 .flags = GENL_ADMIN_PERM,
3211         },
3212         {
3213                 .cmd = NL80211_CMD_GET_SCAN,
3214                 .policy = nl80211_policy,
3215                 .dumpit = nl80211_dump_scan,
3216         },
3217         {
3218                 .cmd = NL80211_CMD_AUTHENTICATE,
3219                 .doit = nl80211_authenticate,
3220                 .policy = nl80211_policy,
3221                 .flags = GENL_ADMIN_PERM,
3222         },
3223         {
3224                 .cmd = NL80211_CMD_ASSOCIATE,
3225                 .doit = nl80211_associate,
3226                 .policy = nl80211_policy,
3227                 .flags = GENL_ADMIN_PERM,
3228         },
3229         {
3230                 .cmd = NL80211_CMD_DEAUTHENTICATE,
3231                 .doit = nl80211_deauthenticate,
3232                 .policy = nl80211_policy,
3233                 .flags = GENL_ADMIN_PERM,
3234         },
3235         {
3236                 .cmd = NL80211_CMD_DISASSOCIATE,
3237                 .doit = nl80211_disassociate,
3238                 .policy = nl80211_policy,
3239                 .flags = GENL_ADMIN_PERM,
3240         },
3241 };
3242 static struct genl_multicast_group nl80211_mlme_mcgrp = {
3243         .name = "mlme",
3244 };
3245
3246 /* multicast groups */
3247 static struct genl_multicast_group nl80211_config_mcgrp = {
3248         .name = "config",
3249 };
3250 static struct genl_multicast_group nl80211_scan_mcgrp = {
3251         .name = "scan",
3252 };
3253 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
3254         .name = "regulatory",
3255 };
3256
3257 /* notification functions */
3258
3259 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
3260 {
3261         struct sk_buff *msg;
3262
3263         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3264         if (!msg)
3265                 return;
3266
3267         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
3268                 nlmsg_free(msg);
3269                 return;
3270         }
3271
3272         genlmsg_multicast(msg, 0, nl80211_config_mcgrp.id, GFP_KERNEL);
3273 }
3274
3275 static int nl80211_send_scan_donemsg(struct sk_buff *msg,
3276                                     struct cfg80211_registered_device *rdev,
3277                                     struct net_device *netdev,
3278                                     u32 pid, u32 seq, int flags,
3279                                     u32 cmd)
3280 {
3281         void *hdr;
3282
3283         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
3284         if (!hdr)
3285                 return -1;
3286
3287         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3288         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3289
3290         /* XXX: we should probably bounce back the request? */
3291
3292         return genlmsg_end(msg, hdr);
3293
3294  nla_put_failure:
3295         genlmsg_cancel(msg, hdr);
3296         return -EMSGSIZE;
3297 }
3298
3299 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
3300                             struct net_device *netdev)
3301 {
3302         struct sk_buff *msg;
3303
3304         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3305         if (!msg)
3306                 return;
3307
3308         if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
3309                                       NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
3310                 nlmsg_free(msg);
3311                 return;
3312         }
3313
3314         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
3315 }
3316
3317 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
3318                                struct net_device *netdev)
3319 {
3320         struct sk_buff *msg;
3321
3322         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3323         if (!msg)
3324                 return;
3325
3326         if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
3327                                       NL80211_CMD_SCAN_ABORTED) < 0) {
3328                 nlmsg_free(msg);
3329                 return;
3330         }
3331
3332         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
3333 }
3334
3335 /*
3336  * This can happen on global regulatory changes or device specific settings
3337  * based on custom world regulatory domains.
3338  */
3339 void nl80211_send_reg_change_event(struct regulatory_request *request)
3340 {
3341         struct sk_buff *msg;
3342         void *hdr;
3343
3344         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3345         if (!msg)
3346                 return;
3347
3348         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
3349         if (!hdr) {
3350                 nlmsg_free(msg);
3351                 return;
3352         }
3353
3354         /* Userspace can always count this one always being set */
3355         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
3356
3357         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
3358                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3359                            NL80211_REGDOM_TYPE_WORLD);
3360         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
3361                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3362                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
3363         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
3364                  request->intersect)
3365                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3366                            NL80211_REGDOM_TYPE_INTERSECTION);
3367         else {
3368                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3369                            NL80211_REGDOM_TYPE_COUNTRY);
3370                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
3371         }
3372
3373         if (wiphy_idx_valid(request->wiphy_idx))
3374                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
3375
3376         if (genlmsg_end(msg, hdr) < 0) {
3377                 nlmsg_free(msg);
3378                 return;
3379         }
3380
3381         genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_KERNEL);
3382
3383         return;
3384
3385 nla_put_failure:
3386         genlmsg_cancel(msg, hdr);
3387         nlmsg_free(msg);
3388 }
3389
3390 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
3391                                     struct net_device *netdev,
3392                                     const u8 *buf, size_t len,
3393                                     enum nl80211_commands cmd)
3394 {
3395         struct sk_buff *msg;
3396         void *hdr;
3397
3398         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
3399         if (!msg)
3400                 return;
3401
3402         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
3403         if (!hdr) {
3404                 nlmsg_free(msg);
3405                 return;
3406         }
3407
3408         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3409         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3410         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
3411
3412         if (genlmsg_end(msg, hdr) < 0) {
3413                 nlmsg_free(msg);
3414                 return;
3415         }
3416
3417         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_ATOMIC);
3418         return;
3419
3420  nla_put_failure:
3421         genlmsg_cancel(msg, hdr);
3422         nlmsg_free(msg);
3423 }
3424
3425 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
3426                           struct net_device *netdev, const u8 *buf, size_t len)
3427 {
3428         nl80211_send_mlme_event(rdev, netdev, buf, len,
3429                                 NL80211_CMD_AUTHENTICATE);
3430 }
3431
3432 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
3433                            struct net_device *netdev, const u8 *buf,
3434                            size_t len)
3435 {
3436         nl80211_send_mlme_event(rdev, netdev, buf, len, NL80211_CMD_ASSOCIATE);
3437 }
3438
3439 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
3440                          struct net_device *netdev, const u8 *buf, size_t len)
3441 {
3442         nl80211_send_mlme_event(rdev, netdev, buf, len,
3443                                 NL80211_CMD_DEAUTHENTICATE);
3444 }
3445
3446 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
3447                            struct net_device *netdev, const u8 *buf,
3448                            size_t len)
3449 {
3450         nl80211_send_mlme_event(rdev, netdev, buf, len,
3451                                 NL80211_CMD_DISASSOCIATE);
3452 }
3453
3454 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
3455                                  struct net_device *netdev, const u8 *addr,
3456                                  enum nl80211_key_type key_type, int key_id,
3457                                  const u8 *tsc)
3458 {
3459         struct sk_buff *msg;
3460         void *hdr;
3461
3462         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3463         if (!msg)
3464                 return;
3465
3466         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
3467         if (!hdr) {
3468                 nlmsg_free(msg);
3469                 return;
3470         }
3471
3472         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3473         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3474         if (addr)
3475                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3476         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
3477         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
3478         if (tsc)
3479                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
3480
3481         if (genlmsg_end(msg, hdr) < 0) {
3482                 nlmsg_free(msg);
3483                 return;
3484         }
3485
3486         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_KERNEL);
3487         return;
3488
3489  nla_put_failure:
3490         genlmsg_cancel(msg, hdr);
3491         nlmsg_free(msg);
3492 }
3493
3494 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
3495                                     struct ieee80211_channel *channel_before,
3496                                     struct ieee80211_channel *channel_after)
3497 {
3498         struct sk_buff *msg;
3499         void *hdr;
3500         struct nlattr *nl_freq;
3501
3502         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
3503         if (!msg)
3504                 return;
3505
3506         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
3507         if (!hdr) {
3508                 nlmsg_free(msg);
3509                 return;
3510         }
3511
3512         /*
3513          * Since we are applying the beacon hint to a wiphy we know its
3514          * wiphy_idx is valid
3515          */
3516         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
3517
3518         /* Before */
3519         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
3520         if (!nl_freq)
3521                 goto nla_put_failure;
3522         if (nl80211_msg_put_channel(msg, channel_before))
3523                 goto nla_put_failure;
3524         nla_nest_end(msg, nl_freq);
3525
3526         /* After */
3527         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
3528         if (!nl_freq)
3529                 goto nla_put_failure;
3530         if (nl80211_msg_put_channel(msg, channel_after))
3531                 goto nla_put_failure;
3532         nla_nest_end(msg, nl_freq);
3533
3534         if (genlmsg_end(msg, hdr) < 0) {
3535                 nlmsg_free(msg);
3536                 return;
3537         }
3538
3539         genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_ATOMIC);
3540
3541         return;
3542
3543 nla_put_failure:
3544         genlmsg_cancel(msg, hdr);
3545         nlmsg_free(msg);
3546 }
3547
3548 /* initialisation/exit functions */
3549
3550 int nl80211_init(void)
3551 {
3552         int err, i;
3553
3554         err = genl_register_family(&nl80211_fam);
3555         if (err)
3556                 return err;
3557
3558         for (i = 0; i < ARRAY_SIZE(nl80211_ops); i++) {
3559                 err = genl_register_ops(&nl80211_fam, &nl80211_ops[i]);
3560                 if (err)
3561                         goto err_out;
3562         }
3563
3564         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
3565         if (err)
3566                 goto err_out;
3567
3568         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
3569         if (err)
3570                 goto err_out;
3571
3572         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
3573         if (err)
3574                 goto err_out;
3575
3576         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
3577         if (err)
3578                 goto err_out;
3579
3580         return 0;
3581  err_out:
3582         genl_unregister_family(&nl80211_fam);
3583         return err;
3584 }
3585
3586 void nl80211_exit(void)
3587 {
3588         genl_unregister_family(&nl80211_fam);
3589 }