net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2009  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/list.h>
  11 #include <linux/if_ether.h>
  12 #include <linux/ieee80211.h>
  13 #include <linux/nl80211.h>
  14 #include <linux/rtnetlink.h>
  15 #include <linux/netlink.h>
  16 #include <linux/etherdevice.h>
  17 #include <net/genetlink.h>
  18 #include <net/cfg80211.h>
  19 #include "core.h"
  20 #include "nl80211.h"
  21 #include "reg.h"
  22
  23 /* the netlink family */
  24 static struct genl_family nl80211_fam = {
  25         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  26         .name = "nl80211",      /* have users key off the name instead */
  27         .hdrsize = 0,           /* no private header */
  28         .version = 1,           /* no particular meaning now */
  29         .maxattr = NL80211_ATTR_MAX,
  30 };
  31
  32 /* internal helper: get drv and dev */
  33 static int get_drv_dev_by_info_ifindex(struct nlattr **attrs,
  34                                        struct cfg80211_registered_device **drv,
  35                                        struct net_device **dev)
  36 {
  37         int ifindex;
  38
  39         if (!attrs[NL80211_ATTR_IFINDEX])
  40                 return -EINVAL;
  41
  42         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  43         *dev = dev_get_by_index(&init_net, ifindex);
  44         if (!*dev)
  45                 return -ENODEV;
  46
  47         *drv = cfg80211_get_dev_from_ifindex(ifindex);
  48         if (IS_ERR(*drv)) {
  49                 dev_put(*dev);
  50                 return PTR_ERR(*drv);
  51         }
  52
  53         return 0;
  54 }
  55
  56 /* policy for the attributes */
  57 static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
  58         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  59         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  60                                       .len = 20-1 },
  61         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  62         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  63         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  64         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
  65         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
  66         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
  67         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
  68
  69         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  70         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  71         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  72
  73         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  74
  75         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  76                                     .len = WLAN_MAX_KEY_LEN },
  77         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  78         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  79         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
  80         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
  81
  82         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
  83         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
  84         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
  85                                        .len = IEEE80211_MAX_DATA_LEN },
  86         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
  87                                        .len = IEEE80211_MAX_DATA_LEN },
  88         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
  89         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
  90         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
  91         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
  92                                                .len = NL80211_MAX_SUPP_RATES },
  93         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
  94         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
  95         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
  96         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
  97                                 .len = IEEE80211_MAX_MESH_ID_LEN },
  98         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
  99
 100         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 101         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 102
 103         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 104         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 105         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 106         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 107                                            .len = NL80211_MAX_SUPP_RATES },
 108
 109         [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
 110
 111         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 112                                          .len = NL80211_HT_CAPABILITY_LEN },
 113
 114         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 115         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 116                               .len = IEEE80211_MAX_DATA_LEN },
 117         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 118         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 119
 120         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 121                                 .len = IEEE80211_MAX_SSID_LEN },
 122         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 123         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 124         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 125         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 126         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 127         [NL80211_ATTR_STA_FLAGS2] = {
 128                 .len = sizeof(struct nl80211_sta_flag_update),
 129         },
 130         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 131 };
 132
 133 /* IE validation */
 134 static bool is_valid_ie_attr(const struct nlattr *attr)
 135 {
 136         const u8 *pos;
 137         int len;
 138
 139         if (!attr)
 140                 return true;
 141
 142         pos = nla_data(attr);
 143         len = nla_len(attr);
 144
 145         while (len) {
 146                 u8 elemlen;
 147
 148                 if (len < 2)
 149                         return false;
 150                 len -= 2;
 151
 152                 elemlen = pos[1];
 153                 if (elemlen > len)
 154                         return false;
 155
 156                 len -= elemlen;
 157                 pos += 2 + elemlen;
 158         }
 159
 160         return true;
 161 }
 162
 163 /* message building helper */
 164 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 165                                    int flags, u8 cmd)
 166 {
 167         /* since there is no private header just add the generic one */
 168         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 169 }
 170
 171 static int nl80211_msg_put_channel(struct sk_buff *msg,
 172                                    struct ieee80211_channel *chan)
 173 {
 174         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 175                     chan->center_freq);
 176
 177         if (chan->flags & IEEE80211_CHAN_DISABLED)
 178                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 179         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 180                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 181         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 182                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 183         if (chan->flags & IEEE80211_CHAN_RADAR)
 184                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 185
 186         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 187                     DBM_TO_MBM(chan->max_power));
 188
 189         return 0;
 190
 191  nla_put_failure:
 192         return -ENOBUFS;
 193 }
 194
 195 /* netlink command implementations */
 196
 197 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 198                               struct cfg80211_registered_device *dev)
 199 {
 200         void *hdr;
 201         struct nlattr *nl_bands, *nl_band;
 202         struct nlattr *nl_freqs, *nl_freq;
 203         struct nlattr *nl_rates, *nl_rate;
 204         struct nlattr *nl_modes;
 205         struct nlattr *nl_cmds;
 206         enum ieee80211_band band;
 207         struct ieee80211_channel *chan;
 208         struct ieee80211_rate *rate;
 209         int i;
 210         u16 ifmodes = dev->wiphy.interface_modes;
 211
 212         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 213         if (!hdr)
 214                 return -1;
 215
 216         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 217         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 218
 219         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 220                    dev->wiphy.retry_short);
 221         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 222                    dev->wiphy.retry_long);
 223         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 224                     dev->wiphy.frag_threshold);
 225         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 226                     dev->wiphy.rts_threshold);
 227
 228         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 229                    dev->wiphy.max_scan_ssids);
 230         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 231                     dev->wiphy.max_scan_ie_len);
 232
 233         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
 234                 sizeof(u32) * dev->wiphy.n_cipher_suites,
 235                 dev->wiphy.cipher_suites);
 236
 237         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
 238         if (!nl_modes)
 239                 goto nla_put_failure;
 240
 241         i = 0;
 242         while (ifmodes) {
 243                 if (ifmodes & 1)
 244                         NLA_PUT_FLAG(msg, i);
 245                 ifmodes >>= 1;
 246                 i++;
 247         }
 248
 249         nla_nest_end(msg, nl_modes);
 250
 251         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 252         if (!nl_bands)
 253                 goto nla_put_failure;
 254
 255         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 256                 if (!dev->wiphy.bands[band])
 257                         continue;
 258
 259                 nl_band = nla_nest_start(msg, band);
 260                 if (!nl_band)
 261                         goto nla_put_failure;
 262
 263                 /* add HT info */
 264                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 265                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 266                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 267                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 268                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 269                                 dev->wiphy.bands[band]->ht_cap.cap);
 270                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 271                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 272                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 273                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 274                 }
 275
 276                 /* add frequencies */
 277                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 278                 if (!nl_freqs)
 279                         goto nla_put_failure;
 280
 281                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 282                         nl_freq = nla_nest_start(msg, i);
 283                         if (!nl_freq)
 284                                 goto nla_put_failure;
 285
 286                         chan = &dev->wiphy.bands[band]->channels[i];
 287
 288                         if (nl80211_msg_put_channel(msg, chan))
 289                                 goto nla_put_failure;
 290
 291                         nla_nest_end(msg, nl_freq);
 292                 }
 293
 294                 nla_nest_end(msg, nl_freqs);
 295
 296                 /* add bitrates */
 297                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 298                 if (!nl_rates)
 299                         goto nla_put_failure;
 300
 301                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 302                         nl_rate = nla_nest_start(msg, i);
 303                         if (!nl_rate)
 304                                 goto nla_put_failure;
 305
 306                         rate = &dev->wiphy.bands[band]->bitrates[i];
 307                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 308                                     rate->bitrate);
 309                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 310                                 NLA_PUT_FLAG(msg,
 311                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 312
 313                         nla_nest_end(msg, nl_rate);
 314                 }
 315
 316                 nla_nest_end(msg, nl_rates);
 317
 318                 nla_nest_end(msg, nl_band);
 319         }
 320         nla_nest_end(msg, nl_bands);
 321
 322         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 323         if (!nl_cmds)
 324                 goto nla_put_failure;
 325
 326         i = 0;
 327 #define CMD(op, n)                                              \
 328          do {                                                   \
 329                 if (dev->ops->op) {                             \
 330                         i++;                                    \
 331                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 332                 }                                               \
 333         } while (0)
 334
 335         CMD(add_virtual_intf, NEW_INTERFACE);
 336         CMD(change_virtual_intf, SET_INTERFACE);
 337         CMD(add_key, NEW_KEY);
 338         CMD(add_beacon, NEW_BEACON);
 339         CMD(add_station, NEW_STATION);
 340         CMD(add_mpath, NEW_MPATH);
 341         CMD(set_mesh_params, SET_MESH_PARAMS);
 342         CMD(change_bss, SET_BSS);
 343         CMD(auth, AUTHENTICATE);
 344         CMD(assoc, ASSOCIATE);
 345         CMD(deauth, DEAUTHENTICATE);
 346         CMD(disassoc, DISASSOCIATE);
 347         CMD(join_ibss, JOIN_IBSS);
 348
 349 #undef CMD
 350         nla_nest_end(msg, nl_cmds);
 351
 352         return genlmsg_end(msg, hdr);
 353
 354  nla_put_failure:
 355         genlmsg_cancel(msg, hdr);
 356         return -EMSGSIZE;
 357 }
 358
 359 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 360 {
 361         int idx = 0;
 362         int start = cb->args[0];
 363         struct cfg80211_registered_device *dev;
 364
 365         mutex_lock(&cfg80211_mutex);
 366         list_for_each_entry(dev, &cfg80211_drv_list, list) {
 367                 if (++idx <= start)
 368                         continue;
 369                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
 370                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
 371                                        dev) < 0) {
 372                         idx--;
 373                         break;
 374                 }
 375         }
 376         mutex_unlock(&cfg80211_mutex);
 377
 378         cb->args[0] = idx;
 379
 380         return skb->len;
 381 }
 382
 383 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 384 {
 385         struct sk_buff *msg;
 386         struct cfg80211_registered_device *dev;
 387
 388         dev = cfg80211_get_dev_from_info(info);
 389         if (IS_ERR(dev))
 390                 return PTR_ERR(dev);
 391
 392         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 393         if (!msg)
 394                 goto out_err;
 395
 396         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
 397                 goto out_free;
 398
 399         cfg80211_put_dev(dev);
 400
 401         return genlmsg_unicast(msg, info->snd_pid);
 402
 403  out_free:
 404         nlmsg_free(msg);
 405  out_err:
 406         cfg80211_put_dev(dev);
 407         return -ENOBUFS;
 408 }
 409
 410 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 411         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
 412         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
 413         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
 414         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
 415         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
 416 };
 417
 418 static int parse_txq_params(struct nlattr *tb[],
 419                             struct ieee80211_txq_params *txq_params)
 420 {
 421         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 422             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 423             !tb[NL80211_TXQ_ATTR_AIFS])
 424                 return -EINVAL;
 425
 426         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
 427         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 428         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 429         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 430         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 431
 432         return 0;
 433 }
 434
 435 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 436 {
 437         struct cfg80211_registered_device *rdev;
 438         int result = 0, rem_txq_params = 0;
 439         struct nlattr *nl_txq_params;
 440         u32 changed;
 441         u8 retry_short = 0, retry_long = 0;
 442         u32 frag_threshold = 0, rts_threshold = 0;
 443
 444         rtnl_lock();
 445
 446         mutex_lock(&cfg80211_mutex);
 447
 448         rdev = __cfg80211_drv_from_info(info);
 449         if (IS_ERR(rdev)) {
 450                 result = PTR_ERR(rdev);
 451                 goto unlock;
 452         }
 453
 454         mutex_lock(&rdev->mtx);
 455
 456         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
 457                 result = cfg80211_dev_rename(
 458                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 459
 460         mutex_unlock(&cfg80211_mutex);
 461
 462         if (result)
 463                 goto bad_res;
 464
 465         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
 466                 struct ieee80211_txq_params txq_params;
 467                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
 468
 469                 if (!rdev->ops->set_txq_params) {
 470                         result = -EOPNOTSUPP;
 471                         goto bad_res;
 472                 }
 473
 474                 nla_for_each_nested(nl_txq_params,
 475                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
 476                                     rem_txq_params) {
 477                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
 478                                   nla_data(nl_txq_params),
 479                                   nla_len(nl_txq_params),
 480                                   txq_params_policy);
 481                         result = parse_txq_params(tb, &txq_params);
 482                         if (result)
 483                                 goto bad_res;
 484
 485                         result = rdev->ops->set_txq_params(&rdev->wiphy,
 486                                                            &txq_params);
 487                         if (result)
 488                                 goto bad_res;
 489                 }
 490         }
 491
 492         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
 493                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 494                 struct ieee80211_channel *chan;
 495                 struct ieee80211_sta_ht_cap *ht_cap;
 496                 u32 freq;
 497
 498                 if (!rdev->ops->set_channel) {
 499                         result = -EOPNOTSUPP;
 500                         goto bad_res;
 501                 }
 502
 503                 result = -EINVAL;
 504
 505                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 506                         channel_type = nla_get_u32(info->attrs[
 507                                            NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 508                         if (channel_type != NL80211_CHAN_NO_HT &&
 509                             channel_type != NL80211_CHAN_HT20 &&
 510                             channel_type != NL80211_CHAN_HT40PLUS &&
 511                             channel_type != NL80211_CHAN_HT40MINUS)
 512                                 goto bad_res;
 513                 }
 514
 515                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 516                 chan = ieee80211_get_channel(&rdev->wiphy, freq);
 517
 518                 /* Primary channel not allowed */
 519                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 520                         goto bad_res;
 521
 522                 if (channel_type == NL80211_CHAN_HT40MINUS &&
 523                     (chan->flags & IEEE80211_CHAN_NO_HT40MINUS))
 524                         goto bad_res;
 525                 else if (channel_type == NL80211_CHAN_HT40PLUS &&
 526                          (chan->flags & IEEE80211_CHAN_NO_HT40PLUS))
 527                         goto bad_res;
 528
 529                 /*
 530                  * At this point we know if that if HT40 was requested
 531                  * we are allowed to use it and the extension channel
 532                  * exists.
 533                  */
 534
 535                 ht_cap = &rdev->wiphy.bands[chan->band]->ht_cap;
 536
 537                 /* no HT capabilities or intolerant */
 538                 if (channel_type != NL80211_CHAN_NO_HT) {
 539                         if (!ht_cap->ht_supported)
 540                                 goto bad_res;
 541                         if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
 542                             (ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT))
 543                                 goto bad_res;
 544                 }
 545
 546                 result = rdev->ops->set_channel(&rdev->wiphy, chan,
 547                                                 channel_type);
 548                 if (result)
 549                         goto bad_res;
 550         }
 551
 552         changed = 0;
 553
 554         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
 555                 retry_short = nla_get_u8(
 556                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
 557                 if (retry_short == 0) {
 558                         result = -EINVAL;
 559                         goto bad_res;
 560                 }
 561                 changed |= WIPHY_PARAM_RETRY_SHORT;
 562         }
 563
 564         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
 565                 retry_long = nla_get_u8(
 566                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
 567                 if (retry_long == 0) {
 568                         result = -EINVAL;
 569                         goto bad_res;
 570                 }
 571                 changed |= WIPHY_PARAM_RETRY_LONG;
 572         }
 573
 574         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
 575                 frag_threshold = nla_get_u32(
 576                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
 577                 if (frag_threshold < 256) {
 578                         result = -EINVAL;
 579                         goto bad_res;
 580                 }
 581                 if (frag_threshold != (u32) -1) {
 582                         /*
 583                          * Fragments (apart from the last one) are required to
 584                          * have even length. Make the fragmentation code
 585                          * simpler by stripping LSB should someone try to use
 586                          * odd threshold value.
 587                          */
 588                         frag_threshold &= ~0x1;
 589                 }
 590                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
 591         }
 592
 593         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
 594                 rts_threshold = nla_get_u32(
 595                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
 596                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
 597         }
 598
 599         if (changed) {
 600                 u8 old_retry_short, old_retry_long;
 601                 u32 old_frag_threshold, old_rts_threshold;
 602
 603                 if (!rdev->ops->set_wiphy_params) {
 604                         result = -EOPNOTSUPP;
 605                         goto bad_res;
 606                 }
 607
 608                 old_retry_short = rdev->wiphy.retry_short;
 609                 old_retry_long = rdev->wiphy.retry_long;
 610                 old_frag_threshold = rdev->wiphy.frag_threshold;
 611                 old_rts_threshold = rdev->wiphy.rts_threshold;
 612
 613                 if (changed & WIPHY_PARAM_RETRY_SHORT)
 614                         rdev->wiphy.retry_short = retry_short;
 615                 if (changed & WIPHY_PARAM_RETRY_LONG)
 616                         rdev->wiphy.retry_long = retry_long;
 617                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
 618                         rdev->wiphy.frag_threshold = frag_threshold;
 619                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
 620                         rdev->wiphy.rts_threshold = rts_threshold;
 621
 622                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
 623                 if (result) {
 624                         rdev->wiphy.retry_short = old_retry_short;
 625                         rdev->wiphy.retry_long = old_retry_long;
 626                         rdev->wiphy.frag_threshold = old_frag_threshold;
 627                         rdev->wiphy.rts_threshold = old_rts_threshold;
 628                 }
 629         }
 630
 631  bad_res:
 632         mutex_unlock(&rdev->mtx);
 633  unlock:
 634         rtnl_unlock();
 635         return result;
 636 }
 637
 638
 639 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 640                               struct cfg80211_registered_device *rdev,
 641                               struct net_device *dev)
 642 {
 643         void *hdr;
 644
 645         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
 646         if (!hdr)
 647                 return -1;
 648
 649         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 650         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 651         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
 652         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
 653         return genlmsg_end(msg, hdr);
 654
 655  nla_put_failure:
 656         genlmsg_cancel(msg, hdr);
 657         return -EMSGSIZE;
 658 }
 659
 660 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
 661 {
 662         int wp_idx = 0;
 663         int if_idx = 0;
 664         int wp_start = cb->args[0];
 665         int if_start = cb->args[1];
 666         struct cfg80211_registered_device *dev;
 667         struct wireless_dev *wdev;
 668
 669         mutex_lock(&cfg80211_mutex);
 670         list_for_each_entry(dev, &cfg80211_drv_list, list) {
 671                 if (wp_idx < wp_start) {
 672                         wp_idx++;
 673                         continue;
 674                 }
 675                 if_idx = 0;
 676
 677                 mutex_lock(&dev->devlist_mtx);
 678                 list_for_each_entry(wdev, &dev->netdev_list, list) {
 679                         if (if_idx < if_start) {
 680                                 if_idx++;
 681                                 continue;
 682                         }
 683                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
 684                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
 685                                                dev, wdev->netdev) < 0) {
 686                                 mutex_unlock(&dev->devlist_mtx);
 687                                 goto out;
 688                         }
 689                         if_idx++;
 690                 }
 691                 mutex_unlock(&dev->devlist_mtx);
 692
 693                 wp_idx++;
 694         }
 695  out:
 696         mutex_unlock(&cfg80211_mutex);
 697
 698         cb->args[0] = wp_idx;
 699         cb->args[1] = if_idx;
 700
 701         return skb->len;
 702 }
 703
 704 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
 705 {
 706         struct sk_buff *msg;
 707         struct cfg80211_registered_device *dev;
 708         struct net_device *netdev;
 709         int err;
 710
 711         err = get_drv_dev_by_info_ifindex(info->attrs, &dev, &netdev);
 712         if (err)
 713                 return err;
 714
 715         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 716         if (!msg)
 717                 goto out_err;
 718
 719         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
 720                                dev, netdev) < 0)
 721                 goto out_free;
 722
 723         dev_put(netdev);
 724         cfg80211_put_dev(dev);
 725
 726         return genlmsg_unicast(msg, info->snd_pid);
 727
 728  out_free:
 729         nlmsg_free(msg);
 730  out_err:
 731         dev_put(netdev);
 732         cfg80211_put_dev(dev);
 733         return -ENOBUFS;
 734 }
 735
 736 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
 737         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
 738         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
 739         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
 740         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
 741         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
 742 };
 743
 744 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
 745 {
 746         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
 747         int flag;
 748
 749         *mntrflags = 0;
 750
 751         if (!nla)
 752                 return -EINVAL;
 753
 754         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
 755                              nla, mntr_flags_policy))
 756                 return -EINVAL;
 757
 758         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
 759                 if (flags[flag])
 760                         *mntrflags |= (1<<flag);
 761
 762         return 0;
 763 }
 764
 765 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 766 {
 767         struct cfg80211_registered_device *drv;
 768         struct vif_params params;
 769         int err, ifindex;
 770         enum nl80211_iftype otype, ntype;
 771         struct net_device *dev;
 772         u32 _flags, *flags = NULL;
 773         bool change = false;
 774
 775         memset(&params, 0, sizeof(params));
 776
 777         rtnl_lock();
 778
 779         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 780         if (err)
 781                 goto unlock_rtnl;
 782
 783         ifindex = dev->ifindex;
 784         otype = ntype = dev->ieee80211_ptr->iftype;
 785         dev_put(dev);
 786
 787         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 788                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 789                 if (otype != ntype)
 790                         change = true;
 791                 if (ntype > NL80211_IFTYPE_MAX) {
 792                         err = -EINVAL;
 793                         goto unlock;
 794                 }
 795         }
 796
 797         if (!drv->ops->change_virtual_intf ||
 798             !(drv->wiphy.interface_modes & (1 << ntype))) {
 799                 err = -EOPNOTSUPP;
 800                 goto unlock;
 801         }
 802
 803         if (info->attrs[NL80211_ATTR_MESH_ID]) {
 804                 if (ntype != NL80211_IFTYPE_MESH_POINT) {
 805                         err = -EINVAL;
 806                         goto unlock;
 807                 }
 808                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 809                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 810                 change = true;
 811         }
 812
 813         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
 814                 if (ntype != NL80211_IFTYPE_MONITOR) {
 815                         err = -EINVAL;
 816                         goto unlock;
 817                 }
 818                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
 819                                           &_flags);
 820                 if (err)
 821                         goto unlock;
 822
 823                 flags = &_flags;
 824                 change = true;
 825         }
 826
 827         if (change)
 828                 err = drv->ops->change_virtual_intf(&drv->wiphy, ifindex,
 829                                                     ntype, flags, &params);
 830         else
 831                 err = 0;
 832
 833         dev = __dev_get_by_index(&init_net, ifindex);
 834         WARN_ON(!dev || (!err && dev->ieee80211_ptr->iftype != ntype));
 835
 836         if (dev && !err && (ntype != otype)) {
 837                 if (otype == NL80211_IFTYPE_ADHOC)
 838                         cfg80211_clear_ibss(dev, false);
 839         }
 840
 841  unlock:
 842         cfg80211_put_dev(drv);
 843  unlock_rtnl:
 844         rtnl_unlock();
 845         return err;
 846 }
 847
 848 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
 849 {
 850         struct cfg80211_registered_device *drv;
 851         struct vif_params params;
 852         int err;
 853         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
 854         u32 flags;
 855
 856         memset(&params, 0, sizeof(params));
 857
 858         if (!info->attrs[NL80211_ATTR_IFNAME])
 859                 return -EINVAL;
 860
 861         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 862                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 863                 if (type > NL80211_IFTYPE_MAX)
 864                         return -EINVAL;
 865         }
 866
 867         rtnl_lock();
 868
 869         drv = cfg80211_get_dev_from_info(info);
 870         if (IS_ERR(drv)) {
 871                 err = PTR_ERR(drv);
 872                 goto unlock_rtnl;
 873         }
 874
 875         if (!drv->ops->add_virtual_intf ||
 876             !(drv->wiphy.interface_modes & (1 << type))) {
 877                 err = -EOPNOTSUPP;
 878                 goto unlock;
 879         }
 880
 881         if (type == NL80211_IFTYPE_MESH_POINT &&
 882             info->attrs[NL80211_ATTR_MESH_ID]) {
 883                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 884                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 885         }
 886
 887         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
 888                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
 889                                   &flags);
 890         err = drv->ops->add_virtual_intf(&drv->wiphy,
 891                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
 892                 type, err ? NULL : &flags, &params);
 893
 894  unlock:
 895         cfg80211_put_dev(drv);
 896  unlock_rtnl:
 897         rtnl_unlock();
 898         return err;
 899 }
 900
 901 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
 902 {
 903         struct cfg80211_registered_device *drv;
 904         int ifindex, err;
 905         struct net_device *dev;
 906
 907         rtnl_lock();
 908
 909         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 910         if (err)
 911                 goto unlock_rtnl;
 912         ifindex = dev->ifindex;
 913         dev_put(dev);
 914
 915         if (!drv->ops->del_virtual_intf) {
 916                 err = -EOPNOTSUPP;
 917                 goto out;
 918         }
 919
 920         err = drv->ops->del_virtual_intf(&drv->wiphy, ifindex);
 921
 922  out:
 923         cfg80211_put_dev(drv);
 924  unlock_rtnl:
 925         rtnl_unlock();
 926         return err;
 927 }
 928
 929 struct get_key_cookie {
 930         struct sk_buff *msg;
 931         int error;
 932 };
 933
 934 static void get_key_callback(void *c, struct key_params *params)
 935 {
 936         struct get_key_cookie *cookie = c;
 937
 938         if (params->key)
 939                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
 940                         params->key_len, params->key);
 941
 942         if (params->seq)
 943                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
 944                         params->seq_len, params->seq);
 945
 946         if (params->cipher)
 947                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
 948                             params->cipher);
 949
 950         return;
 951  nla_put_failure:
 952         cookie->error = 1;
 953 }
 954
 955 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
 956 {
 957         struct cfg80211_registered_device *drv;
 958         int err;
 959         struct net_device *dev;
 960         u8 key_idx = 0;
 961         u8 *mac_addr = NULL;
 962         struct get_key_cookie cookie = {
 963                 .error = 0,
 964         };
 965         void *hdr;
 966         struct sk_buff *msg;
 967
 968         if (info->attrs[NL80211_ATTR_KEY_IDX])
 969                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 970
 971         if (key_idx > 5)
 972                 return -EINVAL;
 973
 974         if (info->attrs[NL80211_ATTR_MAC])
 975                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 976
 977         rtnl_lock();
 978
 979         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 980         if (err)
 981                 goto unlock_rtnl;
 982
 983         if (!drv->ops->get_key) {
 984                 err = -EOPNOTSUPP;
 985                 goto out;
 986         }
 987
 988         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 989         if (!msg) {
 990                 err = -ENOMEM;
 991                 goto out;
 992         }
 993
 994         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
 995                              NL80211_CMD_NEW_KEY);
 996
 997         if (IS_ERR(hdr)) {
 998                 err = PTR_ERR(hdr);
 999                 goto out;
1000         }
1001
1002         cookie.msg = msg;
1003
1004         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1005         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1006         if (mac_addr)
1007                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1008
1009         err = drv->ops->get_key(&drv->wiphy, dev, key_idx, mac_addr,
1010                                 &cookie, get_key_callback);
1011
1012         if (err)
1013                 goto out;
1014
1015         if (cookie.error)
1016                 goto nla_put_failure;
1017
1018         genlmsg_end(msg, hdr);
1019         err = genlmsg_unicast(msg, info->snd_pid);
1020         goto out;
1021
1022  nla_put_failure:
1023         err = -ENOBUFS;
1024         nlmsg_free(msg);
1025  out:
1026         cfg80211_put_dev(drv);
1027         dev_put(dev);
1028  unlock_rtnl:
1029         rtnl_unlock();
1030
1031         return err;
1032 }
1033
1034 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1035 {
1036         struct cfg80211_registered_device *drv;
1037         int err;
1038         struct net_device *dev;
1039         u8 key_idx;
1040         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
1041                     u8 key_index);
1042
1043         if (!info->attrs[NL80211_ATTR_KEY_IDX])
1044                 return -EINVAL;
1045
1046         key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1047
1048         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]) {
1049                 if (key_idx < 4 || key_idx > 5)
1050                         return -EINVAL;
1051         } else if (key_idx > 3)
1052                 return -EINVAL;
1053
1054         /* currently only support setting default key */
1055         if (!info->attrs[NL80211_ATTR_KEY_DEFAULT] &&
1056             !info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT])
1057                 return -EINVAL;
1058
1059         rtnl_lock();
1060
1061         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1062         if (err)
1063                 goto unlock_rtnl;
1064
1065         if (info->attrs[NL80211_ATTR_KEY_DEFAULT])
1066                 func = drv->ops->set_default_key;
1067         else
1068                 func = drv->ops->set_default_mgmt_key;
1069
1070         if (!func) {
1071                 err = -EOPNOTSUPP;
1072                 goto out;
1073         }
1074
1075         err = func(&drv->wiphy, dev, key_idx);
1076 #ifdef CONFIG_WIRELESS_EXT
1077         if (!err) {
1078                 if (func == drv->ops->set_default_key)
1079                         dev->ieee80211_ptr->wext.default_key = key_idx;
1080                 else
1081                         dev->ieee80211_ptr->wext.default_mgmt_key = key_idx;
1082         }
1083 #endif
1084
1085  out:
1086         cfg80211_put_dev(drv);
1087         dev_put(dev);
1088
1089  unlock_rtnl:
1090         rtnl_unlock();
1091
1092         return err;
1093 }
1094
1095 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1096 {
1097         struct cfg80211_registered_device *drv;
1098         int err, i;
1099         struct net_device *dev;
1100         struct key_params params;
1101         u8 key_idx = 0;
1102         u8 *mac_addr = NULL;
1103
1104         memset(&params, 0, sizeof(params));
1105
1106         if (!info->attrs[NL80211_ATTR_KEY_CIPHER])
1107                 return -EINVAL;
1108
1109         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1110                 params.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1111                 params.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1112         }
1113
1114         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
1115                 params.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
1116                 params.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
1117         }
1118
1119         if (info->attrs[NL80211_ATTR_KEY_IDX])
1120                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1121
1122         params.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1123
1124         if (info->attrs[NL80211_ATTR_MAC])
1125                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1126
1127         if (cfg80211_validate_key_settings(&params, key_idx, mac_addr))
1128                 return -EINVAL;
1129
1130         rtnl_lock();
1131
1132         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1133         if (err)
1134                 goto unlock_rtnl;
1135
1136         for (i = 0; i < drv->wiphy.n_cipher_suites; i++)
1137                 if (params.cipher == drv->wiphy.cipher_suites[i])
1138                         break;
1139         if (i == drv->wiphy.n_cipher_suites) {
1140                 err = -EINVAL;
1141                 goto out;
1142         }
1143
1144         if (!drv->ops->add_key) {
1145                 err = -EOPNOTSUPP;
1146                 goto out;
1147         }
1148
1149         err = drv->ops->add_key(&drv->wiphy, dev, key_idx, mac_addr, &params);
1150
1151  out:
1152         cfg80211_put_dev(drv);
1153         dev_put(dev);
1154  unlock_rtnl:
1155         rtnl_unlock();
1156
1157         return err;
1158 }
1159
1160 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1161 {
1162         struct cfg80211_registered_device *drv;
1163         int err;
1164         struct net_device *dev;
1165         u8 key_idx = 0;
1166         u8 *mac_addr = NULL;
1167
1168         if (info->attrs[NL80211_ATTR_KEY_IDX])
1169                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1170
1171         if (key_idx > 5)
1172                 return -EINVAL;
1173
1174         if (info->attrs[NL80211_ATTR_MAC])
1175                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1176
1177         rtnl_lock();
1178
1179         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1180         if (err)
1181                 goto unlock_rtnl;
1182
1183         if (!drv->ops->del_key) {
1184                 err = -EOPNOTSUPP;
1185                 goto out;
1186         }
1187
1188         err = drv->ops->del_key(&drv->wiphy, dev, key_idx, mac_addr);
1189
1190 #ifdef CONFIG_WIRELESS_EXT
1191         if (!err) {
1192                 if (key_idx == dev->ieee80211_ptr->wext.default_key)
1193                         dev->ieee80211_ptr->wext.default_key = -1;
1194                 else if (key_idx == dev->ieee80211_ptr->wext.default_mgmt_key)
1195                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
1196         }
1197 #endif
1198
1199  out:
1200         cfg80211_put_dev(drv);
1201         dev_put(dev);
1202
1203  unlock_rtnl:
1204         rtnl_unlock();
1205
1206         return err;
1207 }
1208
1209 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1210 {
1211         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1212                     struct beacon_parameters *info);
1213         struct cfg80211_registered_device *drv;
1214         int err;
1215         struct net_device *dev;
1216         struct beacon_parameters params;
1217         int haveinfo = 0;
1218
1219         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
1220                 return -EINVAL;
1221
1222         rtnl_lock();
1223
1224         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1225         if (err)
1226                 goto unlock_rtnl;
1227
1228         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1229                 err = -EOPNOTSUPP;
1230                 goto out;
1231         }
1232
1233         switch (info->genlhdr->cmd) {
1234         case NL80211_CMD_NEW_BEACON:
1235                 /* these are required for NEW_BEACON */
1236                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1237                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1238                     !info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1239                         err = -EINVAL;
1240                         goto out;
1241                 }
1242
1243                 call = drv->ops->add_beacon;
1244                 break;
1245         case NL80211_CMD_SET_BEACON:
1246                 call = drv->ops->set_beacon;
1247                 break;
1248         default:
1249                 WARN_ON(1);
1250                 err = -EOPNOTSUPP;
1251                 goto out;
1252         }
1253
1254         if (!call) {
1255                 err = -EOPNOTSUPP;
1256                 goto out;
1257         }
1258
1259         memset(&params, 0, sizeof(params));
1260
1261         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1262                 params.interval =
1263                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1264                 haveinfo = 1;
1265         }
1266
1267         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1268                 params.dtim_period =
1269                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1270                 haveinfo = 1;
1271         }
1272
1273         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1274                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1275                 params.head_len =
1276                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1277                 haveinfo = 1;
1278         }
1279
1280         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1281                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1282                 params.tail_len =
1283                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1284                 haveinfo = 1;
1285         }
1286
1287         if (!haveinfo) {
1288                 err = -EINVAL;
1289                 goto out;
1290         }
1291
1292         err = call(&drv->wiphy, dev, &params);
1293
1294  out:
1295         cfg80211_put_dev(drv);
1296         dev_put(dev);
1297  unlock_rtnl:
1298         rtnl_unlock();
1299
1300         return err;
1301 }
1302
1303 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1304 {
1305         struct cfg80211_registered_device *drv;
1306         int err;
1307         struct net_device *dev;
1308
1309         rtnl_lock();
1310
1311         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1312         if (err)
1313                 goto unlock_rtnl;
1314
1315         if (!drv->ops->del_beacon) {
1316                 err = -EOPNOTSUPP;
1317                 goto out;
1318         }
1319
1320         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1321                 err = -EOPNOTSUPP;
1322                 goto out;
1323         }
1324         err = drv->ops->del_beacon(&drv->wiphy, dev);
1325
1326  out:
1327         cfg80211_put_dev(drv);
1328         dev_put(dev);
1329  unlock_rtnl:
1330         rtnl_unlock();
1331
1332         return err;
1333 }
1334
1335 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1336         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1337         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1338         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1339         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
1340 };
1341
1342 static int parse_station_flags(struct genl_info *info,
1343                                struct station_parameters *params)
1344 {
1345         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1346         struct nlattr *nla;
1347         int flag;
1348
1349         /*
1350          * Try parsing the new attribute first so userspace
1351          * can specify both for older kernels.
1352          */
1353         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
1354         if (nla) {
1355                 struct nl80211_sta_flag_update *sta_flags;
1356
1357                 sta_flags = nla_data(nla);
1358                 params->sta_flags_mask = sta_flags->mask;
1359                 params->sta_flags_set = sta_flags->set;
1360                 if ((params->sta_flags_mask |
1361                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
1362                         return -EINVAL;
1363                 return 0;
1364         }
1365
1366         /* if present, parse the old attribute */
1367
1368         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
1369         if (!nla)
1370                 return 0;
1371
1372         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1373                              nla, sta_flags_policy))
1374                 return -EINVAL;
1375
1376         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
1377         params->sta_flags_mask &= ~1;
1378
1379         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1380                 if (flags[flag])
1381                         params->sta_flags_set |= (1<<flag);
1382
1383         return 0;
1384 }
1385
1386 static u16 nl80211_calculate_bitrate(struct rate_info *rate)
1387 {
1388         int modulation, streams, bitrate;
1389
1390         if (!(rate->flags & RATE_INFO_FLAGS_MCS))
1391                 return rate->legacy;
1392
1393         /* the formula below does only work for MCS values smaller than 32 */
1394         if (rate->mcs >= 32)
1395                 return 0;
1396
1397         modulation = rate->mcs & 7;
1398         streams = (rate->mcs >> 3) + 1;
1399
1400         bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
1401                         13500000 : 6500000;
1402
1403         if (modulation < 4)
1404                 bitrate *= (modulation + 1);
1405         else if (modulation == 4)
1406                 bitrate *= (modulation + 2);
1407         else
1408                 bitrate *= (modulation + 3);
1409
1410         bitrate *= streams;
1411
1412         if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
1413                 bitrate = (bitrate / 9) * 10;
1414
1415         /* do NOT round down here */
1416         return (bitrate + 50000) / 100000;
1417 }
1418
1419 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1420                                 int flags, struct net_device *dev,
1421                                 u8 *mac_addr, struct station_info *sinfo)
1422 {
1423         void *hdr;
1424         struct nlattr *sinfoattr, *txrate;
1425         u16 bitrate;
1426
1427         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1428         if (!hdr)
1429                 return -1;
1430
1431         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1432         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1433
1434         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1435         if (!sinfoattr)
1436                 goto nla_put_failure;
1437         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1438                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1439                             sinfo->inactive_time);
1440         if (sinfo->filled & STATION_INFO_RX_BYTES)
1441                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1442                             sinfo->rx_bytes);
1443         if (sinfo->filled & STATION_INFO_TX_BYTES)
1444                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1445                             sinfo->tx_bytes);
1446         if (sinfo->filled & STATION_INFO_LLID)
1447                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1448                             sinfo->llid);
1449         if (sinfo->filled & STATION_INFO_PLID)
1450                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1451                             sinfo->plid);
1452         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1453                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1454                             sinfo->plink_state);
1455         if (sinfo->filled & STATION_INFO_SIGNAL)
1456                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1457                            sinfo->signal);
1458         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1459                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1460                 if (!txrate)
1461                         goto nla_put_failure;
1462
1463                 /* nl80211_calculate_bitrate will return 0 for mcs >= 32 */
1464                 bitrate = nl80211_calculate_bitrate(&sinfo->txrate);
1465                 if (bitrate > 0)
1466                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1467
1468                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1469                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1470                                     sinfo->txrate.mcs);
1471                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1472                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1473                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1474                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1475
1476                 nla_nest_end(msg, txrate);
1477         }
1478         if (sinfo->filled & STATION_INFO_RX_PACKETS)
1479                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
1480                             sinfo->rx_packets);
1481         if (sinfo->filled & STATION_INFO_TX_PACKETS)
1482                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
1483                             sinfo->tx_packets);
1484         nla_nest_end(msg, sinfoattr);
1485
1486         return genlmsg_end(msg, hdr);
1487
1488  nla_put_failure:
1489         genlmsg_cancel(msg, hdr);
1490         return -EMSGSIZE;
1491 }
1492
1493 static int nl80211_dump_station(struct sk_buff *skb,
1494                                 struct netlink_callback *cb)
1495 {
1496         struct station_info sinfo;
1497         struct cfg80211_registered_device *dev;
1498         struct net_device *netdev;
1499         u8 mac_addr[ETH_ALEN];
1500         int ifidx = cb->args[0];
1501         int sta_idx = cb->args[1];
1502         int err;
1503
1504         if (!ifidx) {
1505                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1506                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1507                                   nl80211_policy);
1508                 if (err)
1509                         return err;
1510
1511                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1512                         return -EINVAL;
1513
1514                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1515                 if (!ifidx)
1516                         return -EINVAL;
1517         }
1518
1519         rtnl_lock();
1520
1521         netdev = __dev_get_by_index(&init_net, ifidx);
1522         if (!netdev) {
1523                 err = -ENODEV;
1524                 goto out_rtnl;
1525         }
1526
1527         dev = cfg80211_get_dev_from_ifindex(ifidx);
1528         if (IS_ERR(dev)) {
1529                 err = PTR_ERR(dev);
1530                 goto out_rtnl;
1531         }
1532
1533         if (!dev->ops->dump_station) {
1534                 err = -EOPNOTSUPP;
1535                 goto out_err;
1536         }
1537
1538         while (1) {
1539                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1540                                              mac_addr, &sinfo);
1541                 if (err == -ENOENT)
1542                         break;
1543                 if (err)
1544                         goto out_err;
1545
1546                 if (nl80211_send_station(skb,
1547                                 NETLINK_CB(cb->skb).pid,
1548                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
1549                                 netdev, mac_addr,
1550                                 &sinfo) < 0)
1551                         goto out;
1552
1553                 sta_idx++;
1554         }
1555
1556
1557  out:
1558         cb->args[1] = sta_idx;
1559         err = skb->len;
1560  out_err:
1561         cfg80211_put_dev(dev);
1562  out_rtnl:
1563         rtnl_unlock();
1564
1565         return err;
1566 }
1567
1568 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1569 {
1570         struct cfg80211_registered_device *drv;
1571         int err;
1572         struct net_device *dev;
1573         struct station_info sinfo;
1574         struct sk_buff *msg;
1575         u8 *mac_addr = NULL;
1576
1577         memset(&sinfo, 0, sizeof(sinfo));
1578
1579         if (!info->attrs[NL80211_ATTR_MAC])
1580                 return -EINVAL;
1581
1582         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1583
1584         rtnl_lock();
1585
1586         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1587         if (err)
1588                 goto out_rtnl;
1589
1590         if (!drv->ops->get_station) {
1591                 err = -EOPNOTSUPP;
1592                 goto out;
1593         }
1594
1595         err = drv->ops->get_station(&drv->wiphy, dev, mac_addr, &sinfo);
1596         if (err)
1597                 goto out;
1598
1599         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1600         if (!msg)
1601                 goto out;
1602
1603         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1604                                  dev, mac_addr, &sinfo) < 0)
1605                 goto out_free;
1606
1607         err = genlmsg_unicast(msg, info->snd_pid);
1608         goto out;
1609
1610  out_free:
1611         nlmsg_free(msg);
1612  out:
1613         cfg80211_put_dev(drv);
1614         dev_put(dev);
1615  out_rtnl:
1616         rtnl_unlock();
1617
1618         return err;
1619 }
1620
1621 /*
1622  * Get vlan interface making sure it is on the right wiphy.
1623  */
1624 static int get_vlan(struct nlattr *vlanattr,
1625                     struct cfg80211_registered_device *rdev,
1626                     struct net_device **vlan)
1627 {
1628         *vlan = NULL;
1629
1630         if (vlanattr) {
1631                 *vlan = dev_get_by_index(&init_net, nla_get_u32(vlanattr));
1632                 if (!*vlan)
1633                         return -ENODEV;
1634                 if (!(*vlan)->ieee80211_ptr)
1635                         return -EINVAL;
1636                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
1637                         return -EINVAL;
1638         }
1639         return 0;
1640 }
1641
1642 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
1643 {
1644         struct cfg80211_registered_device *drv;
1645         int err;
1646         struct net_device *dev;
1647         struct station_parameters params;
1648         u8 *mac_addr = NULL;
1649
1650         memset(&params, 0, sizeof(params));
1651
1652         params.listen_interval = -1;
1653
1654         if (info->attrs[NL80211_ATTR_STA_AID])
1655                 return -EINVAL;
1656
1657         if (!info->attrs[NL80211_ATTR_MAC])
1658                 return -EINVAL;
1659
1660         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1661
1662         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
1663                 params.supported_rates =
1664                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1665                 params.supported_rates_len =
1666                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1667         }
1668
1669         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1670                 params.listen_interval =
1671                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1672
1673         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1674                 params.ht_capa =
1675                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1676
1677         if (parse_station_flags(info, &params))
1678                 return -EINVAL;
1679
1680         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
1681                 params.plink_action =
1682                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
1683
1684         rtnl_lock();
1685
1686         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1687         if (err)
1688                 goto out_rtnl;
1689
1690         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1691         if (err)
1692                 goto out;
1693
1694         /* validate settings */
1695         err = 0;
1696
1697         switch (dev->ieee80211_ptr->iftype) {
1698         case NL80211_IFTYPE_AP:
1699         case NL80211_IFTYPE_AP_VLAN:
1700                 /* disallow mesh-specific things */
1701                 if (params.plink_action)
1702                         err = -EINVAL;
1703                 break;
1704         case NL80211_IFTYPE_STATION:
1705                 /* disallow everything but AUTHORIZED flag */
1706                 if (params.plink_action)
1707                         err = -EINVAL;
1708                 if (params.vlan)
1709                         err = -EINVAL;
1710                 if (params.supported_rates)
1711                         err = -EINVAL;
1712                 if (params.ht_capa)
1713                         err = -EINVAL;
1714                 if (params.listen_interval >= 0)
1715                         err = -EINVAL;
1716                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
1717                         err = -EINVAL;
1718                 break;
1719         case NL80211_IFTYPE_MESH_POINT:
1720                 /* disallow things mesh doesn't support */
1721                 if (params.vlan)
1722                         err = -EINVAL;
1723                 if (params.ht_capa)
1724                         err = -EINVAL;
1725                 if (params.listen_interval >= 0)
1726                         err = -EINVAL;
1727                 if (params.supported_rates)
1728                         err = -EINVAL;
1729                 if (params.sta_flags_mask)
1730                         err = -EINVAL;
1731                 break;
1732         default:
1733                 err = -EINVAL;
1734         }
1735
1736         if (err)
1737                 goto out;
1738
1739         if (!drv->ops->change_station) {
1740                 err = -EOPNOTSUPP;
1741                 goto out;
1742         }
1743
1744         err = drv->ops->change_station(&drv->wiphy, dev, mac_addr, &params);
1745
1746  out:
1747         if (params.vlan)
1748                 dev_put(params.vlan);
1749         cfg80211_put_dev(drv);
1750         dev_put(dev);
1751  out_rtnl:
1752         rtnl_unlock();
1753
1754         return err;
1755 }
1756
1757 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
1758 {
1759         struct cfg80211_registered_device *drv;
1760         int err;
1761         struct net_device *dev;
1762         struct station_parameters params;
1763         u8 *mac_addr = NULL;
1764
1765         memset(&params, 0, sizeof(params));
1766
1767         if (!info->attrs[NL80211_ATTR_MAC])
1768                 return -EINVAL;
1769
1770         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1771                 return -EINVAL;
1772
1773         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
1774                 return -EINVAL;
1775
1776         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1777         params.supported_rates =
1778                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1779         params.supported_rates_len =
1780                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1781         params.listen_interval =
1782                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1783
1784         if (info->attrs[NL80211_ATTR_STA_AID]) {
1785                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
1786                 if (!params.aid || params.aid > IEEE80211_MAX_AID)
1787                         return -EINVAL;
1788         }
1789
1790         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1791                 params.ht_capa =
1792                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1793
1794         if (parse_station_flags(info, &params))
1795                 return -EINVAL;
1796
1797         rtnl_lock();
1798
1799         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1800         if (err)
1801                 goto out_rtnl;
1802
1803         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1804         if (err)
1805                 goto out;
1806
1807         /* validate settings */
1808         err = 0;
1809
1810         switch (dev->ieee80211_ptr->iftype) {
1811         case NL80211_IFTYPE_AP:
1812         case NL80211_IFTYPE_AP_VLAN:
1813                 /* all ok but must have AID */
1814                 if (!params.aid)
1815                         err = -EINVAL;
1816                 break;
1817         case NL80211_IFTYPE_MESH_POINT:
1818                 /* disallow things mesh doesn't support */
1819                 if (params.vlan)
1820                         err = -EINVAL;
1821                 if (params.aid)
1822                         err = -EINVAL;
1823                 if (params.ht_capa)
1824                         err = -EINVAL;
1825                 if (params.listen_interval >= 0)
1826                         err = -EINVAL;
1827                 if (params.supported_rates)
1828                         err = -EINVAL;
1829                 if (params.sta_flags_mask)
1830                         err = -EINVAL;
1831                 break;
1832         default:
1833                 err = -EINVAL;
1834         }
1835
1836         if (err)
1837                 goto out;
1838
1839         if (!drv->ops->add_station) {
1840                 err = -EOPNOTSUPP;
1841                 goto out;
1842         }
1843
1844         if (!netif_running(dev)) {
1845                 err = -ENETDOWN;
1846                 goto out;
1847         }
1848
1849         err = drv->ops->add_station(&drv->wiphy, dev, mac_addr, &params);
1850
1851  out:
1852         if (params.vlan)
1853                 dev_put(params.vlan);
1854         cfg80211_put_dev(drv);
1855         dev_put(dev);
1856  out_rtnl:
1857         rtnl_unlock();
1858
1859         return err;
1860 }
1861
1862 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
1863 {
1864         struct cfg80211_registered_device *drv;
1865         int err;
1866         struct net_device *dev;
1867         u8 *mac_addr = NULL;
1868
1869         if (info->attrs[NL80211_ATTR_MAC])
1870                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1871
1872         rtnl_lock();
1873
1874         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1875         if (err)
1876                 goto out_rtnl;
1877
1878         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1879             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
1880             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1881                 err = -EINVAL;
1882                 goto out;
1883         }
1884
1885         if (!drv->ops->del_station) {
1886                 err = -EOPNOTSUPP;
1887                 goto out;
1888         }
1889
1890         err = drv->ops->del_station(&drv->wiphy, dev, mac_addr);
1891
1892  out:
1893         cfg80211_put_dev(drv);
1894         dev_put(dev);
1895  out_rtnl:
1896         rtnl_unlock();
1897
1898         return err;
1899 }
1900
1901 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
1902                                 int flags, struct net_device *dev,
1903                                 u8 *dst, u8 *next_hop,
1904                                 struct mpath_info *pinfo)
1905 {
1906         void *hdr;
1907         struct nlattr *pinfoattr;
1908
1909         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1910         if (!hdr)
1911                 return -1;
1912
1913         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1914         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
1915         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
1916
1917         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
1918         if (!pinfoattr)
1919                 goto nla_put_failure;
1920         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
1921                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
1922                             pinfo->frame_qlen);
1923         if (pinfo->filled & MPATH_INFO_DSN)
1924                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DSN,
1925                             pinfo->dsn);
1926         if (pinfo->filled & MPATH_INFO_METRIC)
1927                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
1928                             pinfo->metric);
1929         if (pinfo->filled & MPATH_INFO_EXPTIME)
1930                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
1931                             pinfo->exptime);
1932         if (pinfo->filled & MPATH_INFO_FLAGS)
1933                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
1934                             pinfo->flags);
1935         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
1936                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
1937                             pinfo->discovery_timeout);
1938         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
1939                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
1940                             pinfo->discovery_retries);
1941
1942         nla_nest_end(msg, pinfoattr);
1943
1944         return genlmsg_end(msg, hdr);
1945
1946  nla_put_failure:
1947         genlmsg_cancel(msg, hdr);
1948         return -EMSGSIZE;
1949 }
1950
1951 static int nl80211_dump_mpath(struct sk_buff *skb,
1952                               struct netlink_callback *cb)
1953 {
1954         struct mpath_info pinfo;
1955         struct cfg80211_registered_device *dev;
1956         struct net_device *netdev;
1957         u8 dst[ETH_ALEN];
1958         u8 next_hop[ETH_ALEN];
1959         int ifidx = cb->args[0];
1960         int path_idx = cb->args[1];
1961         int err;
1962
1963         if (!ifidx) {
1964                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1965                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1966                                   nl80211_policy);
1967                 if (err)
1968                         return err;
1969
1970                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1971                         return -EINVAL;
1972
1973                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1974                 if (!ifidx)
1975                         return -EINVAL;
1976         }
1977
1978         rtnl_lock();
1979
1980         netdev = __dev_get_by_index(&init_net, ifidx);
1981         if (!netdev) {
1982                 err = -ENODEV;
1983                 goto out_rtnl;
1984         }
1985
1986         dev = cfg80211_get_dev_from_ifindex(ifidx);
1987         if (IS_ERR(dev)) {
1988                 err = PTR_ERR(dev);
1989                 goto out_rtnl;
1990         }
1991
1992         if (!dev->ops->dump_mpath) {
1993                 err = -EOPNOTSUPP;
1994                 goto out_err;
1995         }
1996
1997         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1998                 err = -EOPNOTSUPP;
1999                 goto out;
2000         }
2001
2002         while (1) {
2003                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
2004                                            dst, next_hop, &pinfo);
2005                 if (err == -ENOENT)
2006                         break;
2007                 if (err)
2008                         goto out_err;
2009
2010                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
2011                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
2012                                        netdev, dst, next_hop,
2013                                        &pinfo) < 0)
2014                         goto out;
2015
2016                 path_idx++;
2017         }
2018
2019
2020  out:
2021         cb->args[1] = path_idx;
2022         err = skb->len;
2023  out_err:
2024         cfg80211_put_dev(dev);
2025  out_rtnl:
2026         rtnl_unlock();
2027
2028         return err;
2029 }
2030
2031 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
2032 {
2033         struct cfg80211_registered_device *drv;
2034         int err;
2035         struct net_device *dev;
2036         struct mpath_info pinfo;
2037         struct sk_buff *msg;
2038         u8 *dst = NULL;
2039         u8 next_hop[ETH_ALEN];
2040
2041         memset(&pinfo, 0, sizeof(pinfo));
2042
2043         if (!info->attrs[NL80211_ATTR_MAC])
2044                 return -EINVAL;
2045
2046         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2047
2048         rtnl_lock();
2049
2050         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2051         if (err)
2052                 goto out_rtnl;
2053
2054         if (!drv->ops->get_mpath) {
2055                 err = -EOPNOTSUPP;
2056                 goto out;
2057         }
2058
2059         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2060                 err = -EOPNOTSUPP;
2061                 goto out;
2062         }
2063
2064         err = drv->ops->get_mpath(&drv->wiphy, dev, dst, next_hop, &pinfo);
2065         if (err)
2066                 goto out;
2067
2068         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2069         if (!msg)
2070                 goto out;
2071
2072         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2073                                  dev, dst, next_hop, &pinfo) < 0)
2074                 goto out_free;
2075
2076         err = genlmsg_unicast(msg, info->snd_pid);
2077         goto out;
2078
2079  out_free:
2080         nlmsg_free(msg);
2081  out:
2082         cfg80211_put_dev(drv);
2083         dev_put(dev);
2084  out_rtnl:
2085         rtnl_unlock();
2086
2087         return err;
2088 }
2089
2090 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2091 {
2092         struct cfg80211_registered_device *drv;
2093         int err;
2094         struct net_device *dev;
2095         u8 *dst = NULL;
2096         u8 *next_hop = NULL;
2097
2098         if (!info->attrs[NL80211_ATTR_MAC])
2099                 return -EINVAL;
2100
2101         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2102                 return -EINVAL;
2103
2104         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2105         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2106
2107         rtnl_lock();
2108
2109         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2110         if (err)
2111                 goto out_rtnl;
2112
2113         if (!drv->ops->change_mpath) {
2114                 err = -EOPNOTSUPP;
2115                 goto out;
2116         }
2117
2118         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2119                 err = -EOPNOTSUPP;
2120                 goto out;
2121         }
2122
2123         if (!netif_running(dev)) {
2124                 err = -ENETDOWN;
2125                 goto out;
2126         }
2127
2128         err = drv->ops->change_mpath(&drv->wiphy, dev, dst, next_hop);
2129
2130  out:
2131         cfg80211_put_dev(drv);
2132         dev_put(dev);
2133  out_rtnl:
2134         rtnl_unlock();
2135
2136         return err;
2137 }
2138 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2139 {
2140         struct cfg80211_registered_device *drv;
2141         int err;
2142         struct net_device *dev;
2143         u8 *dst = NULL;
2144         u8 *next_hop = NULL;
2145
2146         if (!info->attrs[NL80211_ATTR_MAC])
2147                 return -EINVAL;
2148
2149         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2150                 return -EINVAL;
2151
2152         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2153         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2154
2155         rtnl_lock();
2156
2157         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2158         if (err)
2159                 goto out_rtnl;
2160
2161         if (!drv->ops->add_mpath) {
2162                 err = -EOPNOTSUPP;
2163                 goto out;
2164         }
2165
2166         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2167                 err = -EOPNOTSUPP;
2168                 goto out;
2169         }
2170
2171         if (!netif_running(dev)) {
2172                 err = -ENETDOWN;
2173                 goto out;
2174         }
2175
2176         err = drv->ops->add_mpath(&drv->wiphy, dev, dst, next_hop);
2177
2178  out:
2179         cfg80211_put_dev(drv);
2180         dev_put(dev);
2181  out_rtnl:
2182         rtnl_unlock();
2183
2184         return err;
2185 }
2186
2187 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2188 {
2189         struct cfg80211_registered_device *drv;
2190         int err;
2191         struct net_device *dev;
2192         u8 *dst = NULL;
2193
2194         if (info->attrs[NL80211_ATTR_MAC])
2195                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2196
2197         rtnl_lock();
2198
2199         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2200         if (err)
2201                 goto out_rtnl;
2202
2203         if (!drv->ops->del_mpath) {
2204                 err = -EOPNOTSUPP;
2205                 goto out;
2206         }
2207
2208         err = drv->ops->del_mpath(&drv->wiphy, dev, dst);
2209
2210  out:
2211         cfg80211_put_dev(drv);
2212         dev_put(dev);
2213  out_rtnl:
2214         rtnl_unlock();
2215
2216         return err;
2217 }
2218
2219 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2220 {
2221         struct cfg80211_registered_device *drv;
2222         int err;
2223         struct net_device *dev;
2224         struct bss_parameters params;
2225
2226         memset(&params, 0, sizeof(params));
2227         /* default to not changing parameters */
2228         params.use_cts_prot = -1;
2229         params.use_short_preamble = -1;
2230         params.use_short_slot_time = -1;
2231
2232         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2233                 params.use_cts_prot =
2234                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2235         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2236                 params.use_short_preamble =
2237                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2238         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2239                 params.use_short_slot_time =
2240                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2241         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2242                 params.basic_rates =
2243                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2244                 params.basic_rates_len =
2245                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2246         }
2247
2248         rtnl_lock();
2249
2250         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2251         if (err)
2252                 goto out_rtnl;
2253
2254         if (!drv->ops->change_bss) {
2255                 err = -EOPNOTSUPP;
2256                 goto out;
2257         }
2258
2259         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
2260                 err = -EOPNOTSUPP;
2261                 goto out;
2262         }
2263
2264         err = drv->ops->change_bss(&drv->wiphy, dev, &params);
2265
2266  out:
2267         cfg80211_put_dev(drv);
2268         dev_put(dev);
2269  out_rtnl:
2270         rtnl_unlock();
2271
2272         return err;
2273 }
2274
2275 static const struct nla_policy
2276         reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2277         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2278         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2279         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2280         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2281         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2282         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2283 };
2284
2285 static int parse_reg_rule(struct nlattr *tb[],
2286         struct ieee80211_reg_rule *reg_rule)
2287 {
2288         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2289         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2290
2291         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2292                 return -EINVAL;
2293         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2294                 return -EINVAL;
2295         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2296                 return -EINVAL;
2297         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2298                 return -EINVAL;
2299         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2300                 return -EINVAL;
2301
2302         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2303
2304         freq_range->start_freq_khz =
2305                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2306         freq_range->end_freq_khz =
2307                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2308         freq_range->max_bandwidth_khz =
2309                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2310
2311         power_rule->max_eirp =
2312                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2313
2314         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2315                 power_rule->max_antenna_gain =
2316                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2317
2318         return 0;
2319 }
2320
2321 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2322 {
2323         int r;
2324         char *data = NULL;
2325
2326         /*
2327          * You should only get this when cfg80211 hasn't yet initialized
2328          * completely when built-in to the kernel right between the time
2329          * window between nl80211_init() and regulatory_init(), if that is
2330          * even possible.
2331          */
2332         mutex_lock(&cfg80211_mutex);
2333         if (unlikely(!cfg80211_regdomain)) {
2334                 mutex_unlock(&cfg80211_mutex);
2335                 return -EINPROGRESS;
2336         }
2337         mutex_unlock(&cfg80211_mutex);
2338
2339         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2340                 return -EINVAL;
2341
2342         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2343
2344 #ifdef CONFIG_WIRELESS_OLD_REGULATORY
2345         /* We ignore world regdom requests with the old regdom setup */
2346         if (is_world_regdom(data))
2347                 return -EINVAL;
2348 #endif
2349
2350         r = regulatory_hint_user(data);
2351
2352         return r;
2353 }
2354
2355 static int nl80211_get_mesh_params(struct sk_buff *skb,
2356         struct genl_info *info)
2357 {
2358         struct cfg80211_registered_device *drv;
2359         struct mesh_config cur_params;
2360         int err;
2361         struct net_device *dev;
2362         void *hdr;
2363         struct nlattr *pinfoattr;
2364         struct sk_buff *msg;
2365
2366         rtnl_lock();
2367
2368         /* Look up our device */
2369         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2370         if (err)
2371                 goto out_rtnl;
2372
2373         if (!drv->ops->get_mesh_params) {
2374                 err = -EOPNOTSUPP;
2375                 goto out;
2376         }
2377
2378         /* Get the mesh params */
2379         err = drv->ops->get_mesh_params(&drv->wiphy, dev, &cur_params);
2380         if (err)
2381                 goto out;
2382
2383         /* Draw up a netlink message to send back */
2384         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2385         if (!msg) {
2386                 err = -ENOBUFS;
2387                 goto out;
2388         }
2389         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2390                              NL80211_CMD_GET_MESH_PARAMS);
2391         if (!hdr)
2392                 goto nla_put_failure;
2393         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
2394         if (!pinfoattr)
2395                 goto nla_put_failure;
2396         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2397         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2398                         cur_params.dot11MeshRetryTimeout);
2399         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2400                         cur_params.dot11MeshConfirmTimeout);
2401         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2402                         cur_params.dot11MeshHoldingTimeout);
2403         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2404                         cur_params.dot11MeshMaxPeerLinks);
2405         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2406                         cur_params.dot11MeshMaxRetries);
2407         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2408                         cur_params.dot11MeshTTL);
2409         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2410                         cur_params.auto_open_plinks);
2411         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2412                         cur_params.dot11MeshHWMPmaxPREQretries);
2413         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2414                         cur_params.path_refresh_time);
2415         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2416                         cur_params.min_discovery_timeout);
2417         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2418                         cur_params.dot11MeshHWMPactivePathTimeout);
2419         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2420                         cur_params.dot11MeshHWMPpreqMinInterval);
2421         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2422                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2423         nla_nest_end(msg, pinfoattr);
2424         genlmsg_end(msg, hdr);
2425         err = genlmsg_unicast(msg, info->snd_pid);
2426         goto out;
2427
2428  nla_put_failure:
2429         genlmsg_cancel(msg, hdr);
2430         err = -EMSGSIZE;
2431  out:
2432         /* Cleanup */
2433         cfg80211_put_dev(drv);
2434         dev_put(dev);
2435  out_rtnl:
2436         rtnl_unlock();
2437
2438         return err;
2439 }
2440
2441 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2442 do {\
2443         if (table[attr_num]) {\
2444                 cfg.param = nla_fn(table[attr_num]); \
2445                 mask |= (1 << (attr_num - 1)); \
2446         } \
2447 } while (0);\
2448
2449 static struct nla_policy
2450 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] __read_mostly = {
2451         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2452         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2453         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2454         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2455         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2456         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2457         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2458
2459         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2460         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2461         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2462         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2463         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2464         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2465 };
2466
2467 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2468 {
2469         int err;
2470         u32 mask;
2471         struct cfg80211_registered_device *drv;
2472         struct net_device *dev;
2473         struct mesh_config cfg;
2474         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2475         struct nlattr *parent_attr;
2476
2477         parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
2478         if (!parent_attr)
2479                 return -EINVAL;
2480         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2481                         parent_attr, nl80211_meshconf_params_policy))
2482                 return -EINVAL;
2483
2484         rtnl_lock();
2485
2486         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2487         if (err)
2488                 goto out_rtnl;
2489
2490         if (!drv->ops->set_mesh_params) {
2491                 err = -EOPNOTSUPP;
2492                 goto out;
2493         }
2494
2495         /* This makes sure that there aren't more than 32 mesh config
2496          * parameters (otherwise our bitfield scheme would not work.) */
2497         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2498
2499         /* Fill in the params struct */
2500         mask = 0;
2501         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2502                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2503         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2504                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2505         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2506                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2507         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2508                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2509         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2510                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2511         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2512                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2513         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2514                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2515         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2516                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2517                         nla_get_u8);
2518         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2519                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2520         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2521                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2522                         nla_get_u16);
2523         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2524                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2525                         nla_get_u32);
2526         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2527                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2528                         nla_get_u16);
2529         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2530                         dot11MeshHWMPnetDiameterTraversalTime,
2531                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2532                         nla_get_u16);
2533
2534         /* Apply changes */
2535         err = drv->ops->set_mesh_params(&drv->wiphy, dev, &cfg, mask);
2536
2537  out:
2538         /* cleanup */
2539         cfg80211_put_dev(drv);
2540         dev_put(dev);
2541  out_rtnl:
2542         rtnl_unlock();
2543
2544         return err;
2545 }
2546
2547 #undef FILL_IN_MESH_PARAM_IF_SET
2548
2549 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2550 {
2551         struct sk_buff *msg;
2552         void *hdr = NULL;
2553         struct nlattr *nl_reg_rules;
2554         unsigned int i;
2555         int err = -EINVAL;
2556
2557         mutex_lock(&cfg80211_mutex);
2558
2559         if (!cfg80211_regdomain)
2560                 goto out;
2561
2562         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2563         if (!msg) {
2564                 err = -ENOBUFS;
2565                 goto out;
2566         }
2567
2568         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2569                              NL80211_CMD_GET_REG);
2570         if (!hdr)
2571                 goto nla_put_failure;
2572
2573         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2574                 cfg80211_regdomain->alpha2);
2575
2576         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2577         if (!nl_reg_rules)
2578                 goto nla_put_failure;
2579
2580         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2581                 struct nlattr *nl_reg_rule;
2582                 const struct ieee80211_reg_rule *reg_rule;
2583                 const struct ieee80211_freq_range *freq_range;
2584                 const struct ieee80211_power_rule *power_rule;
2585
2586                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2587                 freq_range = &reg_rule->freq_range;
2588                 power_rule = &reg_rule->power_rule;
2589
2590                 nl_reg_rule = nla_nest_start(msg, i);
2591                 if (!nl_reg_rule)
2592                         goto nla_put_failure;
2593
2594                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2595                         reg_rule->flags);
2596                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2597                         freq_range->start_freq_khz);
2598                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2599                         freq_range->end_freq_khz);
2600                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2601                         freq_range->max_bandwidth_khz);
2602                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2603                         power_rule->max_antenna_gain);
2604                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2605                         power_rule->max_eirp);
2606
2607                 nla_nest_end(msg, nl_reg_rule);
2608         }
2609
2610         nla_nest_end(msg, nl_reg_rules);
2611
2612         genlmsg_end(msg, hdr);
2613         err = genlmsg_unicast(msg, info->snd_pid);
2614         goto out;
2615
2616 nla_put_failure:
2617         genlmsg_cancel(msg, hdr);
2618         err = -EMSGSIZE;
2619 out:
2620         mutex_unlock(&cfg80211_mutex);
2621         return err;
2622 }
2623
2624 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2625 {
2626         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2627         struct nlattr *nl_reg_rule;
2628         char *alpha2 = NULL;
2629         int rem_reg_rules = 0, r = 0;
2630         u32 num_rules = 0, rule_idx = 0, size_of_regd;
2631         struct ieee80211_regdomain *rd = NULL;
2632
2633         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2634                 return -EINVAL;
2635
2636         if (!info->attrs[NL80211_ATTR_REG_RULES])
2637                 return -EINVAL;
2638
2639         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2640
2641         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2642                         rem_reg_rules) {
2643                 num_rules++;
2644                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2645                         return -EINVAL;
2646         }
2647
2648         mutex_lock(&cfg80211_mutex);
2649
2650         if (!reg_is_valid_request(alpha2)) {
2651                 r = -EINVAL;
2652                 goto bad_reg;
2653         }
2654
2655         size_of_regd = sizeof(struct ieee80211_regdomain) +
2656                 (num_rules * sizeof(struct ieee80211_reg_rule));
2657
2658         rd = kzalloc(size_of_regd, GFP_KERNEL);
2659         if (!rd) {
2660                 r = -ENOMEM;
2661                 goto bad_reg;
2662         }
2663
2664         rd->n_reg_rules = num_rules;
2665         rd->alpha2[0] = alpha2[0];
2666         rd->alpha2[1] = alpha2[1];
2667
2668         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2669                         rem_reg_rules) {
2670                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2671                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2672                         reg_rule_policy);
2673                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2674                 if (r)
2675                         goto bad_reg;
2676
2677                 rule_idx++;
2678
2679                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
2680                         r = -EINVAL;
2681                         goto bad_reg;
2682                 }
2683         }
2684
2685         BUG_ON(rule_idx != num_rules);
2686
2687         r = set_regdom(rd);
2688
2689         mutex_unlock(&cfg80211_mutex);
2690
2691         return r;
2692
2693  bad_reg:
2694         mutex_unlock(&cfg80211_mutex);
2695         kfree(rd);
2696         return r;
2697 }
2698
2699 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
2700 {
2701         struct cfg80211_registered_device *drv;
2702         struct net_device *dev;
2703         struct cfg80211_scan_request *request;
2704         struct cfg80211_ssid *ssid;
2705         struct ieee80211_channel *channel;
2706         struct nlattr *attr;
2707         struct wiphy *wiphy;
2708         int err, tmp, n_ssids = 0, n_channels = 0, i;
2709         enum ieee80211_band band;
2710         size_t ie_len;
2711
2712         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2713                 return -EINVAL;
2714
2715         rtnl_lock();
2716
2717         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2718         if (err)
2719                 goto out_rtnl;
2720
2721         wiphy = &drv->wiphy;
2722
2723         if (!drv->ops->scan) {
2724                 err = -EOPNOTSUPP;
2725                 goto out;
2726         }
2727
2728         if (!netif_running(dev)) {
2729                 err = -ENETDOWN;
2730                 goto out;
2731         }
2732
2733         if (drv->scan_req) {
2734                 err = -EBUSY;
2735                 goto out;
2736         }
2737
2738         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2739                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp)
2740                         n_channels++;
2741                 if (!n_channels) {
2742                         err = -EINVAL;
2743                         goto out;
2744                 }
2745         } else {
2746                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
2747                         if (wiphy->bands[band])
2748                                 n_channels += wiphy->bands[band]->n_channels;
2749         }
2750
2751         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
2752                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
2753                         n_ssids++;
2754
2755         if (n_ssids > wiphy->max_scan_ssids) {
2756                 err = -EINVAL;
2757                 goto out;
2758         }
2759
2760         if (info->attrs[NL80211_ATTR_IE])
2761                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2762         else
2763                 ie_len = 0;
2764
2765         if (ie_len > wiphy->max_scan_ie_len) {
2766                 err = -EINVAL;
2767                 goto out;
2768         }
2769
2770         request = kzalloc(sizeof(*request)
2771                         + sizeof(*ssid) * n_ssids
2772                         + sizeof(channel) * n_channels
2773                         + ie_len, GFP_KERNEL);
2774         if (!request) {
2775                 err = -ENOMEM;
2776                 goto out;
2777         }
2778
2779         request->channels = (void *)((char *)request + sizeof(*request));
2780         request->n_channels = n_channels;
2781         if (n_ssids)
2782                 request->ssids = (void *)(request->channels + n_channels);
2783         request->n_ssids = n_ssids;
2784         if (ie_len) {
2785                 if (request->ssids)
2786                         request->ie = (void *)(request->ssids + n_ssids);
2787                 else
2788                         request->ie = (void *)(request->channels + n_channels);
2789         }
2790
2791         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2792                 /* user specified, bail out if channel not found */
2793                 request->n_channels = n_channels;
2794                 i = 0;
2795                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
2796                         request->channels[i] = ieee80211_get_channel(wiphy, nla_get_u32(attr));
2797                         if (!request->channels[i]) {
2798                                 err = -EINVAL;
2799                                 goto out_free;
2800                         }
2801                         i++;
2802                 }
2803         } else {
2804                 /* all channels */
2805                 i = 0;
2806                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
2807                         int j;
2808                         if (!wiphy->bands[band])
2809                                 continue;
2810                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
2811                                 request->channels[i] = &wiphy->bands[band]->channels[j];
2812                                 i++;
2813                         }
2814                 }
2815         }
2816
2817         i = 0;
2818         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
2819                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
2820                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
2821                                 err = -EINVAL;
2822                                 goto out_free;
2823                         }
2824                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
2825                         request->ssids[i].ssid_len = nla_len(attr);
2826                         i++;
2827                 }
2828         }
2829
2830         if (info->attrs[NL80211_ATTR_IE]) {
2831                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2832                 memcpy((void *)request->ie,
2833                        nla_data(info->attrs[NL80211_ATTR_IE]),
2834                        request->ie_len);
2835         }
2836
2837         request->ifidx = dev->ifindex;
2838         request->wiphy = &drv->wiphy;
2839
2840         drv->scan_req = request;
2841         err = drv->ops->scan(&drv->wiphy, dev, request);
2842
2843  out_free:
2844         if (err) {
2845                 drv->scan_req = NULL;
2846                 kfree(request);
2847         }
2848  out:
2849         cfg80211_put_dev(drv);
2850         dev_put(dev);
2851  out_rtnl:
2852         rtnl_unlock();
2853
2854         return err;
2855 }
2856
2857 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
2858                             struct cfg80211_registered_device *rdev,
2859                             struct net_device *dev,
2860                             struct cfg80211_bss *res)
2861 {
2862         void *hdr;
2863         struct nlattr *bss;
2864
2865         hdr = nl80211hdr_put(msg, pid, seq, flags,
2866                              NL80211_CMD_NEW_SCAN_RESULTS);
2867         if (!hdr)
2868                 return -1;
2869
2870         NLA_PUT_U32(msg, NL80211_ATTR_SCAN_GENERATION,
2871                     rdev->bss_generation);
2872         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2873
2874         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
2875         if (!bss)
2876                 goto nla_put_failure;
2877         if (!is_zero_ether_addr(res->bssid))
2878                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
2879         if (res->information_elements && res->len_information_elements)
2880                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
2881                         res->len_information_elements,
2882                         res->information_elements);
2883         if (res->tsf)
2884                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
2885         if (res->beacon_interval)
2886                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
2887         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
2888         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
2889
2890         switch (rdev->wiphy.signal_type) {
2891         case CFG80211_SIGNAL_TYPE_MBM:
2892                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
2893                 break;
2894         case CFG80211_SIGNAL_TYPE_UNSPEC:
2895                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
2896                 break;
2897         default:
2898                 break;
2899         }
2900
2901         nla_nest_end(msg, bss);
2902
2903         return genlmsg_end(msg, hdr);
2904
2905  nla_put_failure:
2906         genlmsg_cancel(msg, hdr);
2907         return -EMSGSIZE;
2908 }
2909
2910 static int nl80211_dump_scan(struct sk_buff *skb,
2911                              struct netlink_callback *cb)
2912 {
2913         struct cfg80211_registered_device *dev;
2914         struct net_device *netdev;
2915         struct cfg80211_internal_bss *scan;
2916         int ifidx = cb->args[0];
2917         int start = cb->args[1], idx = 0;
2918         int err;
2919
2920         if (!ifidx) {
2921                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
2922                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
2923                                   nl80211_policy);
2924                 if (err)
2925                         return err;
2926
2927                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
2928                         return -EINVAL;
2929
2930                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
2931                 if (!ifidx)
2932                         return -EINVAL;
2933                 cb->args[0] = ifidx;
2934         }
2935
2936         netdev = dev_get_by_index(&init_net, ifidx);
2937         if (!netdev)
2938                 return -ENODEV;
2939
2940         dev = cfg80211_get_dev_from_ifindex(ifidx);
2941         if (IS_ERR(dev)) {
2942                 err = PTR_ERR(dev);
2943                 goto out_put_netdev;
2944         }
2945
2946         spin_lock_bh(&dev->bss_lock);
2947         cfg80211_bss_expire(dev);
2948
2949         list_for_each_entry(scan, &dev->bss_list, list) {
2950                 if (++idx <= start)
2951                         continue;
2952                 if (nl80211_send_bss(skb,
2953                                 NETLINK_CB(cb->skb).pid,
2954                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2955                                 dev, netdev, &scan->pub) < 0) {
2956                         idx--;
2957                         goto out;
2958                 }
2959         }
2960
2961  out:
2962         spin_unlock_bh(&dev->bss_lock);
2963
2964         cb->args[1] = idx;
2965         err = skb->len;
2966         cfg80211_put_dev(dev);
2967  out_put_netdev:
2968         dev_put(netdev);
2969
2970         return err;
2971 }
2972
2973 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
2974 {
2975         return auth_type == NL80211_AUTHTYPE_OPEN_SYSTEM ||
2976                 auth_type == NL80211_AUTHTYPE_SHARED_KEY ||
2977                 auth_type == NL80211_AUTHTYPE_FT ||
2978                 auth_type == NL80211_AUTHTYPE_NETWORK_EAP;
2979 }
2980
2981 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
2982 {
2983         struct cfg80211_registered_device *drv;
2984         struct net_device *dev;
2985         struct cfg80211_auth_request req;
2986         struct wiphy *wiphy;
2987         int err;
2988
2989         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2990                 return -EINVAL;
2991
2992         if (!info->attrs[NL80211_ATTR_MAC])
2993                 return -EINVAL;
2994
2995         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
2996                 return -EINVAL;
2997
2998         rtnl_lock();
2999
3000         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3001         if (err)
3002                 goto unlock_rtnl;
3003
3004         if (!drv->ops->auth) {
3005                 err = -EOPNOTSUPP;
3006                 goto out;
3007         }
3008
3009         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3010                 err = -EOPNOTSUPP;
3011                 goto out;
3012         }
3013
3014         if (!netif_running(dev)) {
3015                 err = -ENETDOWN;
3016                 goto out;
3017         }
3018
3019         wiphy = &drv->wiphy;
3020         memset(&req, 0, sizeof(req));
3021
3022         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3023
3024         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3025                 req.chan = ieee80211_get_channel(
3026                         wiphy,
3027                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3028                 if (!req.chan) {
3029                         err = -EINVAL;
3030                         goto out;
3031                 }
3032         }
3033
3034         if (info->attrs[NL80211_ATTR_SSID]) {
3035                 req.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3036                 req.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3037         }
3038
3039         if (info->attrs[NL80211_ATTR_IE]) {
3040                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3041                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3042         }
3043
3044         req.auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
3045         if (!nl80211_valid_auth_type(req.auth_type)) {
3046                 err = -EINVAL;
3047                 goto out;
3048         }
3049
3050         err = drv->ops->auth(&drv->wiphy, dev, &req);
3051
3052 out:
3053         cfg80211_put_dev(drv);
3054         dev_put(dev);
3055 unlock_rtnl:
3056         rtnl_unlock();
3057         return err;
3058 }
3059
3060 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
3061 {
3062         struct cfg80211_registered_device *drv;
3063         struct net_device *dev;
3064         struct cfg80211_assoc_request req;
3065         struct wiphy *wiphy;
3066         int err;
3067
3068         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3069                 return -EINVAL;
3070
3071         if (!info->attrs[NL80211_ATTR_MAC] ||
3072             !info->attrs[NL80211_ATTR_SSID])
3073                 return -EINVAL;
3074
3075         rtnl_lock();
3076
3077         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3078         if (err)
3079                 goto unlock_rtnl;
3080
3081         if (!drv->ops->assoc) {
3082                 err = -EOPNOTSUPP;
3083                 goto out;
3084         }
3085
3086         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3087                 err = -EOPNOTSUPP;
3088                 goto out;
3089         }
3090
3091         if (!netif_running(dev)) {
3092                 err = -ENETDOWN;
3093                 goto out;
3094         }
3095
3096         wiphy = &drv->wiphy;
3097         memset(&req, 0, sizeof(req));
3098
3099         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3100
3101         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3102                 req.chan = ieee80211_get_channel(
3103                         wiphy,
3104                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3105                 if (!req.chan) {
3106                         err = -EINVAL;
3107                         goto out;
3108                 }
3109         }
3110
3111         req.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3112         req.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3113
3114         if (info->attrs[NL80211_ATTR_IE]) {
3115                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3116                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3117         }
3118
3119         if (info->attrs[NL80211_ATTR_USE_MFP]) {
3120                 enum nl80211_mfp use_mfp =
3121                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
3122                 if (use_mfp == NL80211_MFP_REQUIRED)
3123                         req.use_mfp = true;
3124                 else if (use_mfp != NL80211_MFP_NO) {
3125                         err = -EINVAL;
3126                         goto out;
3127                 }
3128         }
3129
3130         req.control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
3131
3132         err = drv->ops->assoc(&drv->wiphy, dev, &req);
3133
3134 out:
3135         cfg80211_put_dev(drv);
3136         dev_put(dev);
3137 unlock_rtnl:
3138         rtnl_unlock();
3139         return err;
3140 }
3141
3142 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
3143 {
3144         struct cfg80211_registered_device *drv;
3145         struct net_device *dev;
3146         struct cfg80211_deauth_request req;
3147         struct wiphy *wiphy;
3148         int err;
3149
3150         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3151                 return -EINVAL;
3152
3153         if (!info->attrs[NL80211_ATTR_MAC])
3154                 return -EINVAL;
3155
3156         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3157                 return -EINVAL;
3158
3159         rtnl_lock();
3160
3161         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3162         if (err)
3163                 goto unlock_rtnl;
3164
3165         if (!drv->ops->deauth) {
3166                 err = -EOPNOTSUPP;
3167                 goto out;
3168         }
3169
3170         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3171                 err = -EOPNOTSUPP;
3172                 goto out;
3173         }
3174
3175         if (!netif_running(dev)) {
3176                 err = -ENETDOWN;
3177                 goto out;
3178         }
3179
3180         wiphy = &drv->wiphy;
3181         memset(&req, 0, sizeof(req));
3182
3183         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3184
3185         req.reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3186         if (req.reason_code == 0) {
3187                 /* Reason Code 0 is reserved */
3188                 err = -EINVAL;
3189                 goto out;
3190         }
3191
3192         if (info->attrs[NL80211_ATTR_IE]) {
3193                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3194                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3195         }
3196
3197         err = drv->ops->deauth(&drv->wiphy, dev, &req);
3198
3199 out:
3200         cfg80211_put_dev(drv);
3201         dev_put(dev);
3202 unlock_rtnl:
3203         rtnl_unlock();
3204         return err;
3205 }
3206
3207 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
3208 {
3209         struct cfg80211_registered_device *drv;
3210         struct net_device *dev;
3211         struct cfg80211_disassoc_request req;
3212         struct wiphy *wiphy;
3213         int err;
3214
3215         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3216                 return -EINVAL;
3217
3218         if (!info->attrs[NL80211_ATTR_MAC])
3219                 return -EINVAL;
3220
3221         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3222                 return -EINVAL;
3223
3224         rtnl_lock();
3225
3226         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3227         if (err)
3228                 goto unlock_rtnl;
3229
3230         if (!drv->ops->disassoc) {
3231                 err = -EOPNOTSUPP;
3232                 goto out;
3233         }
3234
3235         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3236                 err = -EOPNOTSUPP;
3237                 goto out;
3238         }
3239
3240         if (!netif_running(dev)) {
3241                 err = -ENETDOWN;
3242                 goto out;
3243         }
3244
3245         wiphy = &drv->wiphy;
3246         memset(&req, 0, sizeof(req));
3247
3248         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3249
3250         req.reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3251         if (req.reason_code == 0) {
3252                 /* Reason Code 0 is reserved */
3253                 err = -EINVAL;
3254                 goto out;
3255         }
3256
3257         if (info->attrs[NL80211_ATTR_IE]) {
3258                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3259                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3260         }
3261
3262         err = drv->ops->disassoc(&drv->wiphy, dev, &req);
3263
3264 out:
3265         cfg80211_put_dev(drv);
3266         dev_put(dev);
3267 unlock_rtnl:
3268         rtnl_unlock();
3269         return err;
3270 }
3271
3272 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
3273 {
3274         struct cfg80211_registered_device *drv;
3275         struct net_device *dev;
3276         struct cfg80211_ibss_params ibss;
3277         struct wiphy *wiphy;
3278         int err;
3279
3280         memset(&ibss, 0, sizeof(ibss));
3281
3282         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3283                 return -EINVAL;
3284
3285         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
3286             !info->attrs[NL80211_ATTR_SSID] ||
3287             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3288                 return -EINVAL;
3289
3290         ibss.beacon_interval = 100;
3291
3292         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
3293                 ibss.beacon_interval =
3294                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3295                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
3296                         return -EINVAL;
3297         }
3298
3299         rtnl_lock();
3300
3301         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3302         if (err)
3303                 goto unlock_rtnl;
3304
3305         if (!drv->ops->join_ibss) {
3306                 err = -EOPNOTSUPP;
3307                 goto out;
3308         }
3309
3310         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3311                 err = -EOPNOTSUPP;
3312                 goto out;
3313         }
3314
3315         if (!netif_running(dev)) {
3316                 err = -ENETDOWN;
3317                 goto out;
3318         }
3319
3320         wiphy = &drv->wiphy;
3321
3322         if (info->attrs[NL80211_ATTR_MAC])
3323                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3324         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3325         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3326
3327         if (info->attrs[NL80211_ATTR_IE]) {
3328                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3329                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3330         }
3331
3332         ibss.channel = ieee80211_get_channel(wiphy,
3333                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3334         if (!ibss.channel ||
3335             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
3336             ibss.channel->flags & IEEE80211_CHAN_DISABLED) {
3337                 err = -EINVAL;
3338                 goto out;
3339         }
3340
3341         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
3342
3343         err = cfg80211_join_ibss(drv, dev, &ibss);
3344
3345 out:
3346         cfg80211_put_dev(drv);
3347         dev_put(dev);
3348 unlock_rtnl:
3349         rtnl_unlock();
3350         return err;
3351 }
3352
3353 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
3354 {
3355         struct cfg80211_registered_device *drv;
3356         struct net_device *dev;
3357         int err;
3358
3359         rtnl_lock();
3360
3361         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3362         if (err)
3363                 goto unlock_rtnl;
3364
3365         if (!drv->ops->leave_ibss) {
3366                 err = -EOPNOTSUPP;
3367                 goto out;
3368         }
3369
3370         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3371                 err = -EOPNOTSUPP;
3372                 goto out;
3373         }
3374
3375         if (!netif_running(dev)) {
3376                 err = -ENETDOWN;
3377                 goto out;
3378         }
3379
3380         err = cfg80211_leave_ibss(drv, dev, false);
3381
3382 out:
3383         cfg80211_put_dev(drv);
3384         dev_put(dev);
3385 unlock_rtnl:
3386         rtnl_unlock();
3387         return err;
3388 }
3389
3390 static struct genl_ops nl80211_ops[] = {
3391         {
3392                 .cmd = NL80211_CMD_GET_WIPHY,
3393                 .doit = nl80211_get_wiphy,
3394                 .dumpit = nl80211_dump_wiphy,
3395                 .policy = nl80211_policy,
3396                 /* can be retrieved by unprivileged users */
3397         },
3398         {
3399                 .cmd = NL80211_CMD_SET_WIPHY,
3400                 .doit = nl80211_set_wiphy,
3401                 .policy = nl80211_policy,
3402                 .flags = GENL_ADMIN_PERM,
3403         },
3404         {
3405                 .cmd = NL80211_CMD_GET_INTERFACE,
3406                 .doit = nl80211_get_interface,
3407                 .dumpit = nl80211_dump_interface,
3408                 .policy = nl80211_policy,
3409                 /* can be retrieved by unprivileged users */
3410         },
3411         {
3412                 .cmd = NL80211_CMD_SET_INTERFACE,
3413                 .doit = nl80211_set_interface,
3414                 .policy = nl80211_policy,
3415                 .flags = GENL_ADMIN_PERM,
3416         },
3417         {
3418                 .cmd = NL80211_CMD_NEW_INTERFACE,
3419                 .doit = nl80211_new_interface,
3420                 .policy = nl80211_policy,
3421                 .flags = GENL_ADMIN_PERM,
3422         },
3423         {
3424                 .cmd = NL80211_CMD_DEL_INTERFACE,
3425                 .doit = nl80211_del_interface,
3426                 .policy = nl80211_policy,
3427                 .flags = GENL_ADMIN_PERM,
3428         },
3429         {
3430                 .cmd = NL80211_CMD_GET_KEY,
3431                 .doit = nl80211_get_key,
3432                 .policy = nl80211_policy,
3433                 .flags = GENL_ADMIN_PERM,
3434         },
3435         {
3436                 .cmd = NL80211_CMD_SET_KEY,
3437                 .doit = nl80211_set_key,
3438                 .policy = nl80211_policy,
3439                 .flags = GENL_ADMIN_PERM,
3440         },
3441         {
3442                 .cmd = NL80211_CMD_NEW_KEY,
3443                 .doit = nl80211_new_key,
3444                 .policy = nl80211_policy,
3445                 .flags = GENL_ADMIN_PERM,
3446         },
3447         {
3448                 .cmd = NL80211_CMD_DEL_KEY,
3449                 .doit = nl80211_del_key,
3450                 .policy = nl80211_policy,
3451                 .flags = GENL_ADMIN_PERM,
3452         },
3453         {
3454                 .cmd = NL80211_CMD_SET_BEACON,
3455                 .policy = nl80211_policy,
3456                 .flags = GENL_ADMIN_PERM,
3457                 .doit = nl80211_addset_beacon,
3458         },
3459         {
3460                 .cmd = NL80211_CMD_NEW_BEACON,
3461                 .policy = nl80211_policy,
3462                 .flags = GENL_ADMIN_PERM,
3463                 .doit = nl80211_addset_beacon,
3464         },
3465         {
3466                 .cmd = NL80211_CMD_DEL_BEACON,
3467                 .policy = nl80211_policy,
3468                 .flags = GENL_ADMIN_PERM,
3469                 .doit = nl80211_del_beacon,
3470         },
3471         {
3472                 .cmd = NL80211_CMD_GET_STATION,
3473                 .doit = nl80211_get_station,
3474                 .dumpit = nl80211_dump_station,
3475                 .policy = nl80211_policy,
3476         },
3477         {
3478                 .cmd = NL80211_CMD_SET_STATION,
3479                 .doit = nl80211_set_station,
3480                 .policy = nl80211_policy,
3481                 .flags = GENL_ADMIN_PERM,
3482         },
3483         {
3484                 .cmd = NL80211_CMD_NEW_STATION,
3485                 .doit = nl80211_new_station,
3486                 .policy = nl80211_policy,
3487                 .flags = GENL_ADMIN_PERM,
3488         },
3489         {
3490                 .cmd = NL80211_CMD_DEL_STATION,
3491                 .doit = nl80211_del_station,
3492                 .policy = nl80211_policy,
3493                 .flags = GENL_ADMIN_PERM,
3494         },
3495         {
3496                 .cmd = NL80211_CMD_GET_MPATH,
3497                 .doit = nl80211_get_mpath,
3498                 .dumpit = nl80211_dump_mpath,
3499                 .policy = nl80211_policy,
3500                 .flags = GENL_ADMIN_PERM,
3501         },
3502         {
3503                 .cmd = NL80211_CMD_SET_MPATH,
3504                 .doit = nl80211_set_mpath,
3505                 .policy = nl80211_policy,
3506                 .flags = GENL_ADMIN_PERM,
3507         },
3508         {
3509                 .cmd = NL80211_CMD_NEW_MPATH,
3510                 .doit = nl80211_new_mpath,
3511                 .policy = nl80211_policy,
3512                 .flags = GENL_ADMIN_PERM,
3513         },
3514         {
3515                 .cmd = NL80211_CMD_DEL_MPATH,
3516                 .doit = nl80211_del_mpath,
3517                 .policy = nl80211_policy,
3518                 .flags = GENL_ADMIN_PERM,
3519         },
3520         {
3521                 .cmd = NL80211_CMD_SET_BSS,
3522                 .doit = nl80211_set_bss,
3523                 .policy = nl80211_policy,
3524                 .flags = GENL_ADMIN_PERM,
3525         },
3526         {
3527                 .cmd = NL80211_CMD_GET_REG,
3528                 .doit = nl80211_get_reg,
3529                 .policy = nl80211_policy,
3530                 /* can be retrieved by unprivileged users */
3531         },
3532         {
3533                 .cmd = NL80211_CMD_SET_REG,
3534                 .doit = nl80211_set_reg,
3535                 .policy = nl80211_policy,
3536                 .flags = GENL_ADMIN_PERM,
3537         },
3538         {
3539                 .cmd = NL80211_CMD_REQ_SET_REG,
3540                 .doit = nl80211_req_set_reg,
3541                 .policy = nl80211_policy,
3542                 .flags = GENL_ADMIN_PERM,
3543         },
3544         {
3545                 .cmd = NL80211_CMD_GET_MESH_PARAMS,
3546                 .doit = nl80211_get_mesh_params,
3547                 .policy = nl80211_policy,
3548                 /* can be retrieved by unprivileged users */
3549         },
3550         {
3551                 .cmd = NL80211_CMD_SET_MESH_PARAMS,
3552                 .doit = nl80211_set_mesh_params,
3553                 .policy = nl80211_policy,
3554                 .flags = GENL_ADMIN_PERM,
3555         },
3556         {
3557                 .cmd = NL80211_CMD_TRIGGER_SCAN,
3558                 .doit = nl80211_trigger_scan,
3559                 .policy = nl80211_policy,
3560                 .flags = GENL_ADMIN_PERM,
3561         },
3562         {
3563                 .cmd = NL80211_CMD_GET_SCAN,
3564                 .policy = nl80211_policy,
3565                 .dumpit = nl80211_dump_scan,
3566         },
3567         {
3568                 .cmd = NL80211_CMD_AUTHENTICATE,
3569                 .doit = nl80211_authenticate,
3570                 .policy = nl80211_policy,
3571                 .flags = GENL_ADMIN_PERM,
3572         },
3573         {
3574                 .cmd = NL80211_CMD_ASSOCIATE,
3575                 .doit = nl80211_associate,
3576                 .policy = nl80211_policy,
3577                 .flags = GENL_ADMIN_PERM,
3578         },
3579         {
3580                 .cmd = NL80211_CMD_DEAUTHENTICATE,
3581                 .doit = nl80211_deauthenticate,
3582                 .policy = nl80211_policy,
3583                 .flags = GENL_ADMIN_PERM,
3584         },
3585         {
3586                 .cmd = NL80211_CMD_DISASSOCIATE,
3587                 .doit = nl80211_disassociate,
3588                 .policy = nl80211_policy,
3589                 .flags = GENL_ADMIN_PERM,
3590         },
3591         {
3592                 .cmd = NL80211_CMD_JOIN_IBSS,
3593                 .doit = nl80211_join_ibss,
3594                 .policy = nl80211_policy,
3595                 .flags = GENL_ADMIN_PERM,
3596         },
3597         {
3598                 .cmd = NL80211_CMD_LEAVE_IBSS,
3599                 .doit = nl80211_leave_ibss,
3600                 .policy = nl80211_policy,
3601                 .flags = GENL_ADMIN_PERM,
3602         },
3603 };
3604 static struct genl_multicast_group nl80211_mlme_mcgrp = {
3605         .name = "mlme",
3606 };
3607
3608 /* multicast groups */
3609 static struct genl_multicast_group nl80211_config_mcgrp = {
3610         .name = "config",
3611 };
3612 static struct genl_multicast_group nl80211_scan_mcgrp = {
3613         .name = "scan",
3614 };
3615 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
3616         .name = "regulatory",
3617 };
3618
3619 /* notification functions */
3620
3621 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
3622 {
3623         struct sk_buff *msg;
3624
3625         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3626         if (!msg)
3627                 return;
3628
3629         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
3630                 nlmsg_free(msg);
3631                 return;
3632         }
3633
3634         genlmsg_multicast(msg, 0, nl80211_config_mcgrp.id, GFP_KERNEL);
3635 }
3636
3637 static int nl80211_add_scan_req(struct sk_buff *msg,
3638                                 struct cfg80211_registered_device *rdev)
3639 {
3640         struct cfg80211_scan_request *req = rdev->scan_req;
3641         struct nlattr *nest;
3642         int i;
3643
3644         if (WARN_ON(!req))
3645                 return 0;
3646
3647         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
3648         if (!nest)
3649                 goto nla_put_failure;
3650         for (i = 0; i < req->n_ssids; i++)
3651                 NLA_PUT(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid);
3652         nla_nest_end(msg, nest);
3653
3654         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
3655         if (!nest)
3656                 goto nla_put_failure;
3657         for (i = 0; i < req->n_channels; i++)
3658                 NLA_PUT_U32(msg, i, req->channels[i]->center_freq);
3659         nla_nest_end(msg, nest);
3660
3661         if (req->ie)
3662                 NLA_PUT(msg, NL80211_ATTR_IE, req->ie_len, req->ie);
3663
3664         return 0;
3665  nla_put_failure:
3666         return -ENOBUFS;
3667 }
3668
3669 static int nl80211_send_scan_donemsg(struct sk_buff *msg,
3670                                      struct cfg80211_registered_device *rdev,
3671                                      struct net_device *netdev,
3672                                      u32 pid, u32 seq, int flags,
3673                                      u32 cmd)
3674 {
3675         void *hdr;
3676
3677         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
3678         if (!hdr)
3679                 return -1;
3680
3681         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3682         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3683
3684         /* ignore errors and send incomplete event anyway */
3685         nl80211_add_scan_req(msg, rdev);
3686
3687         return genlmsg_end(msg, hdr);
3688
3689  nla_put_failure:
3690         genlmsg_cancel(msg, hdr);
3691         return -EMSGSIZE;
3692 }
3693
3694 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
3695                             struct net_device *netdev)
3696 {
3697         struct sk_buff *msg;
3698
3699         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3700         if (!msg)
3701                 return;
3702
3703         if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
3704                                       NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
3705                 nlmsg_free(msg);
3706                 return;
3707         }
3708
3709         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
3710 }
3711
3712 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
3713                                struct net_device *netdev)
3714 {
3715         struct sk_buff *msg;
3716
3717         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3718         if (!msg)
3719                 return;
3720
3721         if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
3722                                       NL80211_CMD_SCAN_ABORTED) < 0) {
3723                 nlmsg_free(msg);
3724                 return;
3725         }
3726
3727         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
3728 }
3729
3730 /*
3731  * This can happen on global regulatory changes or device specific settings
3732  * based on custom world regulatory domains.
3733  */
3734 void nl80211_send_reg_change_event(struct regulatory_request *request)
3735 {
3736         struct sk_buff *msg;
3737         void *hdr;
3738
3739         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3740         if (!msg)
3741                 return;
3742
3743         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
3744         if (!hdr) {
3745                 nlmsg_free(msg);
3746                 return;
3747         }
3748
3749         /* Userspace can always count this one always being set */
3750         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
3751
3752         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
3753                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3754                            NL80211_REGDOM_TYPE_WORLD);
3755         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
3756                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3757                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
3758         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
3759                  request->intersect)
3760                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3761                            NL80211_REGDOM_TYPE_INTERSECTION);
3762         else {
3763                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3764                            NL80211_REGDOM_TYPE_COUNTRY);
3765                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
3766         }
3767
3768         if (wiphy_idx_valid(request->wiphy_idx))
3769                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
3770
3771         if (genlmsg_end(msg, hdr) < 0) {
3772                 nlmsg_free(msg);
3773                 return;
3774         }
3775
3776         genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_KERNEL);
3777
3778         return;
3779
3780 nla_put_failure:
3781         genlmsg_cancel(msg, hdr);
3782         nlmsg_free(msg);
3783 }
3784
3785 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
3786                                     struct net_device *netdev,
3787                                     const u8 *buf, size_t len,
3788                                     enum nl80211_commands cmd)
3789 {
3790         struct sk_buff *msg;
3791         void *hdr;
3792
3793         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
3794         if (!msg)
3795                 return;
3796
3797         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
3798         if (!hdr) {
3799                 nlmsg_free(msg);
3800                 return;
3801         }
3802
3803         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3804         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3805         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
3806
3807         if (genlmsg_end(msg, hdr) < 0) {
3808                 nlmsg_free(msg);
3809                 return;
3810         }
3811
3812         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_ATOMIC);
3813         return;
3814
3815  nla_put_failure:
3816         genlmsg_cancel(msg, hdr);
3817         nlmsg_free(msg);
3818 }
3819
3820 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
3821                           struct net_device *netdev, const u8 *buf, size_t len)
3822 {
3823         nl80211_send_mlme_event(rdev, netdev, buf, len,
3824                                 NL80211_CMD_AUTHENTICATE);
3825 }
3826
3827 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
3828                            struct net_device *netdev, const u8 *buf,
3829                            size_t len)
3830 {
3831         nl80211_send_mlme_event(rdev, netdev, buf, len, NL80211_CMD_ASSOCIATE);
3832 }
3833
3834 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
3835                          struct net_device *netdev, const u8 *buf, size_t len)
3836 {
3837         nl80211_send_mlme_event(rdev, netdev, buf, len,
3838                                 NL80211_CMD_DEAUTHENTICATE);
3839 }
3840
3841 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
3842                            struct net_device *netdev, const u8 *buf,
3843                            size_t len)
3844 {
3845         nl80211_send_mlme_event(rdev, netdev, buf, len,
3846                                 NL80211_CMD_DISASSOCIATE);
3847 }
3848
3849 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
3850                                       struct net_device *netdev, int cmd,
3851                                       const u8 *addr)
3852 {
3853         struct sk_buff *msg;
3854         void *hdr;
3855
3856         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
3857         if (!msg)
3858                 return;
3859
3860         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
3861         if (!hdr) {
3862                 nlmsg_free(msg);
3863                 return;
3864         }
3865
3866         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3867         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3868         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
3869         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3870
3871         if (genlmsg_end(msg, hdr) < 0) {
3872                 nlmsg_free(msg);
3873                 return;
3874         }
3875
3876         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_ATOMIC);
3877         return;
3878
3879  nla_put_failure:
3880         genlmsg_cancel(msg, hdr);
3881         nlmsg_free(msg);
3882 }
3883
3884 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
3885                                struct net_device *netdev, const u8 *addr)
3886 {
3887         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
3888                                   addr);
3889 }
3890
3891 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
3892                                 struct net_device *netdev, const u8 *addr)
3893 {
3894         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE, addr);
3895 }
3896
3897 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
3898                              struct net_device *netdev, const u8 *bssid,
3899                              gfp_t gfp)
3900 {
3901         struct sk_buff *msg;
3902         void *hdr;
3903
3904         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
3905         if (!msg)
3906                 return;
3907
3908         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
3909         if (!hdr) {
3910                 nlmsg_free(msg);
3911                 return;
3912         }
3913
3914         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3915         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3916         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
3917
3918         if (genlmsg_end(msg, hdr) < 0) {
3919                 nlmsg_free(msg);
3920                 return;
3921         }
3922
3923         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
3924         return;
3925
3926  nla_put_failure:
3927         genlmsg_cancel(msg, hdr);
3928         nlmsg_free(msg);
3929 }
3930
3931 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
3932                                  struct net_device *netdev, const u8 *addr,
3933                                  enum nl80211_key_type key_type, int key_id,
3934                                  const u8 *tsc)
3935 {
3936         struct sk_buff *msg;
3937         void *hdr;
3938
3939         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
3940         if (!msg)
3941                 return;
3942
3943         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
3944         if (!hdr) {
3945                 nlmsg_free(msg);
3946                 return;
3947         }
3948
3949         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3950         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3951         if (addr)
3952                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3953         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
3954         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
3955         if (tsc)
3956                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
3957
3958         if (genlmsg_end(msg, hdr) < 0) {
3959                 nlmsg_free(msg);
3960                 return;
3961         }
3962
3963         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_ATOMIC);
3964         return;
3965
3966  nla_put_failure:
3967         genlmsg_cancel(msg, hdr);
3968         nlmsg_free(msg);
3969 }
3970
3971 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
3972                                     struct ieee80211_channel *channel_before,
3973                                     struct ieee80211_channel *channel_after)
3974 {
3975         struct sk_buff *msg;
3976         void *hdr;
3977         struct nlattr *nl_freq;
3978
3979         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
3980         if (!msg)
3981                 return;
3982
3983         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
3984         if (!hdr) {
3985                 nlmsg_free(msg);
3986                 return;
3987         }
3988
3989         /*
3990          * Since we are applying the beacon hint to a wiphy we know its
3991          * wiphy_idx is valid
3992          */
3993         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
3994
3995         /* Before */
3996         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
3997         if (!nl_freq)
3998                 goto nla_put_failure;
3999         if (nl80211_msg_put_channel(msg, channel_before))
4000                 goto nla_put_failure;
4001         nla_nest_end(msg, nl_freq);
4002
4003         /* After */
4004         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
4005         if (!nl_freq)
4006                 goto nla_put_failure;
4007         if (nl80211_msg_put_channel(msg, channel_after))
4008                 goto nla_put_failure;
4009         nla_nest_end(msg, nl_freq);
4010
4011         if (genlmsg_end(msg, hdr) < 0) {
4012                 nlmsg_free(msg);
4013                 return;
4014         }
4015
4016         genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_ATOMIC);
4017
4018         return;
4019
4020 nla_put_failure:
4021         genlmsg_cancel(msg, hdr);
4022         nlmsg_free(msg);
4023 }
4024
4025 /* initialisation/exit functions */
4026
4027 int nl80211_init(void)
4028 {
4029         int err;
4030
4031         err = genl_register_family_with_ops(&nl80211_fam,
4032                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
4033         if (err)
4034                 return err;
4035
4036         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
4037         if (err)
4038                 goto err_out;
4039
4040         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
4041         if (err)
4042                 goto err_out;
4043
4044         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
4045         if (err)
4046                 goto err_out;
4047
4048         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
4049         if (err)
4050                 goto err_out;
4051
4052         return 0;
4053  err_out:
4054         genl_unregister_family(&nl80211_fam);
4055         return err;
4056 }
4057
4058 void nl80211_exit(void)
4059 {
4060         genl_unregister_family(&nl80211_fam);
4061 }