SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2009  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/list.h>
  11 #include <linux/if_ether.h>
  12 #include <linux/ieee80211.h>
  13 #include <linux/nl80211.h>
  14 #include <linux/rtnetlink.h>
  15 #include <linux/netlink.h>
  16 #include <linux/etherdevice.h>
  17 #include <net/genetlink.h>
  18 #include <net/cfg80211.h>
  19 #include "core.h"
  20 #include "nl80211.h"
  21 #include "reg.h"
  22
  23 /* the netlink family */
  24 static struct genl_family nl80211_fam = {
  25         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  26         .name = "nl80211",      /* have users key off the name instead */
  27         .hdrsize = 0,           /* no private header */
  28         .version = 1,           /* no particular meaning now */
  29         .maxattr = NL80211_ATTR_MAX,
  30 };
  31
  32 /* internal helper: get drv and dev */
  33 static int get_drv_dev_by_info_ifindex(struct nlattr **attrs,
  34                                        struct cfg80211_registered_device **drv,
  35                                        struct net_device **dev)
  36 {
  37         int ifindex;
  38
  39         if (!attrs[NL80211_ATTR_IFINDEX])
  40                 return -EINVAL;
  41
  42         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  43         *dev = dev_get_by_index(&init_net, ifindex);
  44         if (!*dev)
  45                 return -ENODEV;
  46
  47         *drv = cfg80211_get_dev_from_ifindex(ifindex);
  48         if (IS_ERR(*drv)) {
  49                 dev_put(*dev);
  50                 return PTR_ERR(*drv);
  51         }
  52
  53         return 0;
  54 }
  55
  56 /* policy for the attributes */
  57 static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
  58         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  59         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  60                                       .len = BUS_ID_SIZE-1 },
  61         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  62         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  63         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  64         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
  65         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
  66         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
  67         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
  68
  69         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  70         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  71         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  72
  73         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  74
  75         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  76                                     .len = WLAN_MAX_KEY_LEN },
  77         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  78         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  79         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
  80
  81         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
  82         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
  83         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
  84                                        .len = IEEE80211_MAX_DATA_LEN },
  85         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
  86                                        .len = IEEE80211_MAX_DATA_LEN },
  87         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
  88         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
  89         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
  90         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
  91                                                .len = NL80211_MAX_SUPP_RATES },
  92         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
  93         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
  94         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
  95         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
  96                                 .len = IEEE80211_MAX_MESH_ID_LEN },
  97         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
  98
  99         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 100         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 101
 102         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 103         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 104         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 105         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 106                                            .len = NL80211_MAX_SUPP_RATES },
 107
 108         [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
 109
 110         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 111                                          .len = NL80211_HT_CAPABILITY_LEN },
 112
 113         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 114         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 115                               .len = IEEE80211_MAX_DATA_LEN },
 116         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 117         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 118
 119         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 120                                 .len = IEEE80211_MAX_SSID_LEN },
 121         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 122         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 123         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 124         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 125         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 126 };
 127
 128 /* IE validation */
 129 static bool is_valid_ie_attr(const struct nlattr *attr)
 130 {
 131         const u8 *pos;
 132         int len;
 133
 134         if (!attr)
 135                 return true;
 136
 137         pos = nla_data(attr);
 138         len = nla_len(attr);
 139
 140         while (len) {
 141                 u8 elemlen;
 142
 143                 if (len < 2)
 144                         return false;
 145                 len -= 2;
 146
 147                 elemlen = pos[1];
 148                 if (elemlen > len)
 149                         return false;
 150
 151                 len -= elemlen;
 152                 pos += 2 + elemlen;
 153         }
 154
 155         return true;
 156 }
 157
 158 /* message building helper */
 159 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 160                                    int flags, u8 cmd)
 161 {
 162         /* since there is no private header just add the generic one */
 163         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 164 }
 165
 166 static int nl80211_msg_put_channel(struct sk_buff *msg,
 167                                    struct ieee80211_channel *chan)
 168 {
 169         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 170                     chan->center_freq);
 171
 172         if (chan->flags & IEEE80211_CHAN_DISABLED)
 173                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 174         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 175                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 176         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 177                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 178         if (chan->flags & IEEE80211_CHAN_RADAR)
 179                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 180
 181         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 182                     DBM_TO_MBM(chan->max_power));
 183
 184         return 0;
 185
 186  nla_put_failure:
 187         return -ENOBUFS;
 188 }
 189
 190 /* netlink command implementations */
 191
 192 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 193                               struct cfg80211_registered_device *dev)
 194 {
 195         void *hdr;
 196         struct nlattr *nl_bands, *nl_band;
 197         struct nlattr *nl_freqs, *nl_freq;
 198         struct nlattr *nl_rates, *nl_rate;
 199         struct nlattr *nl_modes;
 200         struct nlattr *nl_cmds;
 201         enum ieee80211_band band;
 202         struct ieee80211_channel *chan;
 203         struct ieee80211_rate *rate;
 204         int i;
 205         u16 ifmodes = dev->wiphy.interface_modes;
 206
 207         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 208         if (!hdr)
 209                 return -1;
 210
 211         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 212         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 213
 214         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 215                    dev->wiphy.retry_short);
 216         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 217                    dev->wiphy.retry_long);
 218         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 219                     dev->wiphy.frag_threshold);
 220         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 221                     dev->wiphy.rts_threshold);
 222
 223         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 224                    dev->wiphy.max_scan_ssids);
 225         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 226                     dev->wiphy.max_scan_ie_len);
 227
 228         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
 229                 sizeof(u32) * dev->wiphy.n_cipher_suites,
 230                 dev->wiphy.cipher_suites);
 231
 232         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
 233         if (!nl_modes)
 234                 goto nla_put_failure;
 235
 236         i = 0;
 237         while (ifmodes) {
 238                 if (ifmodes & 1)
 239                         NLA_PUT_FLAG(msg, i);
 240                 ifmodes >>= 1;
 241                 i++;
 242         }
 243
 244         nla_nest_end(msg, nl_modes);
 245
 246         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 247         if (!nl_bands)
 248                 goto nla_put_failure;
 249
 250         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 251                 if (!dev->wiphy.bands[band])
 252                         continue;
 253
 254                 nl_band = nla_nest_start(msg, band);
 255                 if (!nl_band)
 256                         goto nla_put_failure;
 257
 258                 /* add HT info */
 259                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 260                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 261                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 262                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 263                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 264                                 dev->wiphy.bands[band]->ht_cap.cap);
 265                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 266                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 267                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 268                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 269                 }
 270
 271                 /* add frequencies */
 272                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 273                 if (!nl_freqs)
 274                         goto nla_put_failure;
 275
 276                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 277                         nl_freq = nla_nest_start(msg, i);
 278                         if (!nl_freq)
 279                                 goto nla_put_failure;
 280
 281                         chan = &dev->wiphy.bands[band]->channels[i];
 282
 283                         if (nl80211_msg_put_channel(msg, chan))
 284                                 goto nla_put_failure;
 285
 286                         nla_nest_end(msg, nl_freq);
 287                 }
 288
 289                 nla_nest_end(msg, nl_freqs);
 290
 291                 /* add bitrates */
 292                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 293                 if (!nl_rates)
 294                         goto nla_put_failure;
 295
 296                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 297                         nl_rate = nla_nest_start(msg, i);
 298                         if (!nl_rate)
 299                                 goto nla_put_failure;
 300
 301                         rate = &dev->wiphy.bands[band]->bitrates[i];
 302                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 303                                     rate->bitrate);
 304                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 305                                 NLA_PUT_FLAG(msg,
 306                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 307
 308                         nla_nest_end(msg, nl_rate);
 309                 }
 310
 311                 nla_nest_end(msg, nl_rates);
 312
 313                 nla_nest_end(msg, nl_band);
 314         }
 315         nla_nest_end(msg, nl_bands);
 316
 317         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 318         if (!nl_cmds)
 319                 goto nla_put_failure;
 320
 321         i = 0;
 322 #define CMD(op, n)                                              \
 323          do {                                                   \
 324                 if (dev->ops->op) {                             \
 325                         i++;                                    \
 326                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 327                 }                                               \
 328         } while (0)
 329
 330         CMD(add_virtual_intf, NEW_INTERFACE);
 331         CMD(change_virtual_intf, SET_INTERFACE);
 332         CMD(add_key, NEW_KEY);
 333         CMD(add_beacon, NEW_BEACON);
 334         CMD(add_station, NEW_STATION);
 335         CMD(add_mpath, NEW_MPATH);
 336         CMD(set_mesh_params, SET_MESH_PARAMS);
 337         CMD(change_bss, SET_BSS);
 338         CMD(auth, AUTHENTICATE);
 339         CMD(assoc, ASSOCIATE);
 340         CMD(deauth, DEAUTHENTICATE);
 341         CMD(disassoc, DISASSOCIATE);
 342         CMD(join_ibss, JOIN_IBSS);
 343
 344 #undef CMD
 345         nla_nest_end(msg, nl_cmds);
 346
 347         return genlmsg_end(msg, hdr);
 348
 349  nla_put_failure:
 350         genlmsg_cancel(msg, hdr);
 351         return -EMSGSIZE;
 352 }
 353
 354 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 355 {
 356         int idx = 0;
 357         int start = cb->args[0];
 358         struct cfg80211_registered_device *dev;
 359
 360         mutex_lock(&cfg80211_mutex);
 361         list_for_each_entry(dev, &cfg80211_drv_list, list) {
 362                 if (++idx <= start)
 363                         continue;
 364                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
 365                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
 366                                        dev) < 0) {
 367                         idx--;
 368                         break;
 369                 }
 370         }
 371         mutex_unlock(&cfg80211_mutex);
 372
 373         cb->args[0] = idx;
 374
 375         return skb->len;
 376 }
 377
 378 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 379 {
 380         struct sk_buff *msg;
 381         struct cfg80211_registered_device *dev;
 382
 383         dev = cfg80211_get_dev_from_info(info);
 384         if (IS_ERR(dev))
 385                 return PTR_ERR(dev);
 386
 387         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 388         if (!msg)
 389                 goto out_err;
 390
 391         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
 392                 goto out_free;
 393
 394         cfg80211_put_dev(dev);
 395
 396         return genlmsg_unicast(msg, info->snd_pid);
 397
 398  out_free:
 399         nlmsg_free(msg);
 400  out_err:
 401         cfg80211_put_dev(dev);
 402         return -ENOBUFS;
 403 }
 404
 405 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 406         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
 407         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
 408         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
 409         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
 410         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
 411 };
 412
 413 static int parse_txq_params(struct nlattr *tb[],
 414                             struct ieee80211_txq_params *txq_params)
 415 {
 416         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 417             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 418             !tb[NL80211_TXQ_ATTR_AIFS])
 419                 return -EINVAL;
 420
 421         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
 422         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 423         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 424         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 425         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 426
 427         return 0;
 428 }
 429
 430 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 431 {
 432         struct cfg80211_registered_device *rdev;
 433         int result = 0, rem_txq_params = 0;
 434         struct nlattr *nl_txq_params;
 435         u32 changed;
 436         u8 retry_short = 0, retry_long = 0;
 437         u32 frag_threshold = 0, rts_threshold = 0;
 438
 439         rtnl_lock();
 440
 441         mutex_lock(&cfg80211_mutex);
 442
 443         rdev = __cfg80211_drv_from_info(info);
 444         if (IS_ERR(rdev)) {
 445                 result = PTR_ERR(rdev);
 446                 goto unlock;
 447         }
 448
 449         mutex_lock(&rdev->mtx);
 450
 451         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
 452                 result = cfg80211_dev_rename(
 453                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 454
 455         mutex_unlock(&cfg80211_mutex);
 456
 457         if (result)
 458                 goto bad_res;
 459
 460         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
 461                 struct ieee80211_txq_params txq_params;
 462                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
 463
 464                 if (!rdev->ops->set_txq_params) {
 465                         result = -EOPNOTSUPP;
 466                         goto bad_res;
 467                 }
 468
 469                 nla_for_each_nested(nl_txq_params,
 470                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
 471                                     rem_txq_params) {
 472                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
 473                                   nla_data(nl_txq_params),
 474                                   nla_len(nl_txq_params),
 475                                   txq_params_policy);
 476                         result = parse_txq_params(tb, &txq_params);
 477                         if (result)
 478                                 goto bad_res;
 479
 480                         result = rdev->ops->set_txq_params(&rdev->wiphy,
 481                                                            &txq_params);
 482                         if (result)
 483                                 goto bad_res;
 484                 }
 485         }
 486
 487         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
 488                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 489                 struct ieee80211_channel *chan;
 490                 struct ieee80211_sta_ht_cap *ht_cap;
 491                 u32 freq, sec_freq;
 492
 493                 if (!rdev->ops->set_channel) {
 494                         result = -EOPNOTSUPP;
 495                         goto bad_res;
 496                 }
 497
 498                 result = -EINVAL;
 499
 500                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 501                         channel_type = nla_get_u32(info->attrs[
 502                                            NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 503                         if (channel_type != NL80211_CHAN_NO_HT &&
 504                             channel_type != NL80211_CHAN_HT20 &&
 505                             channel_type != NL80211_CHAN_HT40PLUS &&
 506                             channel_type != NL80211_CHAN_HT40MINUS)
 507                                 goto bad_res;
 508                 }
 509
 510                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 511                 chan = ieee80211_get_channel(&rdev->wiphy, freq);
 512
 513                 /* Primary channel not allowed */
 514                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 515                         goto bad_res;
 516
 517                 if (channel_type == NL80211_CHAN_HT40MINUS)
 518                         sec_freq = freq - 20;
 519                 else if (channel_type == NL80211_CHAN_HT40PLUS)
 520                         sec_freq = freq + 20;
 521                 else
 522                         sec_freq = 0;
 523
 524                 ht_cap = &rdev->wiphy.bands[chan->band]->ht_cap;
 525
 526                 /* no HT capabilities */
 527                 if (channel_type != NL80211_CHAN_NO_HT &&
 528                     !ht_cap->ht_supported)
 529                         goto bad_res;
 530
 531                 if (sec_freq) {
 532                         struct ieee80211_channel *schan;
 533
 534                         /* no 40 MHz capabilities */
 535                         if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
 536                             (ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT))
 537                                 goto bad_res;
 538
 539                         schan = ieee80211_get_channel(&rdev->wiphy, sec_freq);
 540
 541                         /* Secondary channel not allowed */
 542                         if (!schan || schan->flags & IEEE80211_CHAN_DISABLED)
 543                                 goto bad_res;
 544                 }
 545
 546                 result = rdev->ops->set_channel(&rdev->wiphy, chan,
 547                                                 channel_type);
 548                 if (result)
 549                         goto bad_res;
 550         }
 551
 552         changed = 0;
 553
 554         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
 555                 retry_short = nla_get_u8(
 556                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
 557                 if (retry_short == 0) {
 558                         result = -EINVAL;
 559                         goto bad_res;
 560                 }
 561                 changed |= WIPHY_PARAM_RETRY_SHORT;
 562         }
 563
 564         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
 565                 retry_long = nla_get_u8(
 566                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
 567                 if (retry_long == 0) {
 568                         result = -EINVAL;
 569                         goto bad_res;
 570                 }
 571                 changed |= WIPHY_PARAM_RETRY_LONG;
 572         }
 573
 574         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
 575                 frag_threshold = nla_get_u32(
 576                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
 577                 if (frag_threshold < 256) {
 578                         result = -EINVAL;
 579                         goto bad_res;
 580                 }
 581                 if (frag_threshold != (u32) -1) {
 582                         /*
 583                          * Fragments (apart from the last one) are required to
 584                          * have even length. Make the fragmentation code
 585                          * simpler by stripping LSB should someone try to use
 586                          * odd threshold value.
 587                          */
 588                         frag_threshold &= ~0x1;
 589                 }
 590                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
 591         }
 592
 593         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
 594                 rts_threshold = nla_get_u32(
 595                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
 596                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
 597         }
 598
 599         if (changed) {
 600                 u8 old_retry_short, old_retry_long;
 601                 u32 old_frag_threshold, old_rts_threshold;
 602
 603                 if (!rdev->ops->set_wiphy_params) {
 604                         result = -EOPNOTSUPP;
 605                         goto bad_res;
 606                 }
 607
 608                 old_retry_short = rdev->wiphy.retry_short;
 609                 old_retry_long = rdev->wiphy.retry_long;
 610                 old_frag_threshold = rdev->wiphy.frag_threshold;
 611                 old_rts_threshold = rdev->wiphy.rts_threshold;
 612
 613                 if (changed & WIPHY_PARAM_RETRY_SHORT)
 614                         rdev->wiphy.retry_short = retry_short;
 615                 if (changed & WIPHY_PARAM_RETRY_LONG)
 616                         rdev->wiphy.retry_long = retry_long;
 617                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
 618                         rdev->wiphy.frag_threshold = frag_threshold;
 619                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
 620                         rdev->wiphy.rts_threshold = rts_threshold;
 621
 622                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
 623                 if (result) {
 624                         rdev->wiphy.retry_short = old_retry_short;
 625                         rdev->wiphy.retry_long = old_retry_long;
 626                         rdev->wiphy.frag_threshold = old_frag_threshold;
 627                         rdev->wiphy.rts_threshold = old_rts_threshold;
 628                 }
 629         }
 630
 631  bad_res:
 632         mutex_unlock(&rdev->mtx);
 633  unlock:
 634         rtnl_unlock();
 635         return result;
 636 }
 637
 638
 639 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 640                               struct cfg80211_registered_device *rdev,
 641                               struct net_device *dev)
 642 {
 643         void *hdr;
 644
 645         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
 646         if (!hdr)
 647                 return -1;
 648
 649         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 650         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 651         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
 652         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
 653         return genlmsg_end(msg, hdr);
 654
 655  nla_put_failure:
 656         genlmsg_cancel(msg, hdr);
 657         return -EMSGSIZE;
 658 }
 659
 660 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
 661 {
 662         int wp_idx = 0;
 663         int if_idx = 0;
 664         int wp_start = cb->args[0];
 665         int if_start = cb->args[1];
 666         struct cfg80211_registered_device *dev;
 667         struct wireless_dev *wdev;
 668
 669         mutex_lock(&cfg80211_mutex);
 670         list_for_each_entry(dev, &cfg80211_drv_list, list) {
 671                 if (wp_idx < wp_start) {
 672                         wp_idx++;
 673                         continue;
 674                 }
 675                 if_idx = 0;
 676
 677                 mutex_lock(&dev->devlist_mtx);
 678                 list_for_each_entry(wdev, &dev->netdev_list, list) {
 679                         if (if_idx < if_start) {
 680                                 if_idx++;
 681                                 continue;
 682                         }
 683                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
 684                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
 685                                                dev, wdev->netdev) < 0) {
 686                                 mutex_unlock(&dev->devlist_mtx);
 687                                 goto out;
 688                         }
 689                         if_idx++;
 690                 }
 691                 mutex_unlock(&dev->devlist_mtx);
 692
 693                 wp_idx++;
 694         }
 695  out:
 696         mutex_unlock(&cfg80211_mutex);
 697
 698         cb->args[0] = wp_idx;
 699         cb->args[1] = if_idx;
 700
 701         return skb->len;
 702 }
 703
 704 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
 705 {
 706         struct sk_buff *msg;
 707         struct cfg80211_registered_device *dev;
 708         struct net_device *netdev;
 709         int err;
 710
 711         err = get_drv_dev_by_info_ifindex(info->attrs, &dev, &netdev);
 712         if (err)
 713                 return err;
 714
 715         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 716         if (!msg)
 717                 goto out_err;
 718
 719         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
 720                                dev, netdev) < 0)
 721                 goto out_free;
 722
 723         dev_put(netdev);
 724         cfg80211_put_dev(dev);
 725
 726         return genlmsg_unicast(msg, info->snd_pid);
 727
 728  out_free:
 729         nlmsg_free(msg);
 730  out_err:
 731         dev_put(netdev);
 732         cfg80211_put_dev(dev);
 733         return -ENOBUFS;
 734 }
 735
 736 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
 737         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
 738         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
 739         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
 740         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
 741         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
 742 };
 743
 744 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
 745 {
 746         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
 747         int flag;
 748
 749         *mntrflags = 0;
 750
 751         if (!nla)
 752                 return -EINVAL;
 753
 754         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
 755                              nla, mntr_flags_policy))
 756                 return -EINVAL;
 757
 758         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
 759                 if (flags[flag])
 760                         *mntrflags |= (1<<flag);
 761
 762         return 0;
 763 }
 764
 765 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 766 {
 767         struct cfg80211_registered_device *drv;
 768         struct vif_params params;
 769         int err, ifindex;
 770         enum nl80211_iftype otype, ntype;
 771         struct net_device *dev;
 772         u32 _flags, *flags = NULL;
 773         bool change = false;
 774
 775         memset(&params, 0, sizeof(params));
 776
 777         rtnl_lock();
 778
 779         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 780         if (err)
 781                 goto unlock_rtnl;
 782
 783         ifindex = dev->ifindex;
 784         otype = ntype = dev->ieee80211_ptr->iftype;
 785         dev_put(dev);
 786
 787         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 788                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 789                 if (otype != ntype)
 790                         change = true;
 791                 if (ntype > NL80211_IFTYPE_MAX) {
 792                         err = -EINVAL;
 793                         goto unlock;
 794                 }
 795         }
 796
 797         if (!drv->ops->change_virtual_intf ||
 798             !(drv->wiphy.interface_modes & (1 << ntype))) {
 799                 err = -EOPNOTSUPP;
 800                 goto unlock;
 801         }
 802
 803         if (info->attrs[NL80211_ATTR_MESH_ID]) {
 804                 if (ntype != NL80211_IFTYPE_MESH_POINT) {
 805                         err = -EINVAL;
 806                         goto unlock;
 807                 }
 808                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 809                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 810                 change = true;
 811         }
 812
 813         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
 814                 if (ntype != NL80211_IFTYPE_MONITOR) {
 815                         err = -EINVAL;
 816                         goto unlock;
 817                 }
 818                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
 819                                           &_flags);
 820                 if (err)
 821                         goto unlock;
 822
 823                 flags = &_flags;
 824                 change = true;
 825         }
 826
 827         if (change)
 828                 err = drv->ops->change_virtual_intf(&drv->wiphy, ifindex,
 829                                                     ntype, flags, &params);
 830         else
 831                 err = 0;
 832
 833         dev = __dev_get_by_index(&init_net, ifindex);
 834         WARN_ON(!dev || (!err && dev->ieee80211_ptr->iftype != ntype));
 835
 836         if (dev && !err && (ntype != otype)) {
 837                 if (otype == NL80211_IFTYPE_ADHOC)
 838                         cfg80211_clear_ibss(dev, false);
 839         }
 840
 841  unlock:
 842         cfg80211_put_dev(drv);
 843  unlock_rtnl:
 844         rtnl_unlock();
 845         return err;
 846 }
 847
 848 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
 849 {
 850         struct cfg80211_registered_device *drv;
 851         struct vif_params params;
 852         int err;
 853         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
 854         u32 flags;
 855
 856         memset(&params, 0, sizeof(params));
 857
 858         if (!info->attrs[NL80211_ATTR_IFNAME])
 859                 return -EINVAL;
 860
 861         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 862                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 863                 if (type > NL80211_IFTYPE_MAX)
 864                         return -EINVAL;
 865         }
 866
 867         rtnl_lock();
 868
 869         drv = cfg80211_get_dev_from_info(info);
 870         if (IS_ERR(drv)) {
 871                 err = PTR_ERR(drv);
 872                 goto unlock_rtnl;
 873         }
 874
 875         if (!drv->ops->add_virtual_intf ||
 876             !(drv->wiphy.interface_modes & (1 << type))) {
 877                 err = -EOPNOTSUPP;
 878                 goto unlock;
 879         }
 880
 881         if (type == NL80211_IFTYPE_MESH_POINT &&
 882             info->attrs[NL80211_ATTR_MESH_ID]) {
 883                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 884                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 885         }
 886
 887         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
 888                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
 889                                   &flags);
 890         err = drv->ops->add_virtual_intf(&drv->wiphy,
 891                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
 892                 type, err ? NULL : &flags, &params);
 893
 894  unlock:
 895         cfg80211_put_dev(drv);
 896  unlock_rtnl:
 897         rtnl_unlock();
 898         return err;
 899 }
 900
 901 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
 902 {
 903         struct cfg80211_registered_device *drv;
 904         int ifindex, err;
 905         struct net_device *dev;
 906
 907         rtnl_lock();
 908
 909         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 910         if (err)
 911                 goto unlock_rtnl;
 912         ifindex = dev->ifindex;
 913         dev_put(dev);
 914
 915         if (!drv->ops->del_virtual_intf) {
 916                 err = -EOPNOTSUPP;
 917                 goto out;
 918         }
 919
 920         err = drv->ops->del_virtual_intf(&drv->wiphy, ifindex);
 921
 922  out:
 923         cfg80211_put_dev(drv);
 924  unlock_rtnl:
 925         rtnl_unlock();
 926         return err;
 927 }
 928
 929 struct get_key_cookie {
 930         struct sk_buff *msg;
 931         int error;
 932 };
 933
 934 static void get_key_callback(void *c, struct key_params *params)
 935 {
 936         struct get_key_cookie *cookie = c;
 937
 938         if (params->key)
 939                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
 940                         params->key_len, params->key);
 941
 942         if (params->seq)
 943                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
 944                         params->seq_len, params->seq);
 945
 946         if (params->cipher)
 947                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
 948                             params->cipher);
 949
 950         return;
 951  nla_put_failure:
 952         cookie->error = 1;
 953 }
 954
 955 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
 956 {
 957         struct cfg80211_registered_device *drv;
 958         int err;
 959         struct net_device *dev;
 960         u8 key_idx = 0;
 961         u8 *mac_addr = NULL;
 962         struct get_key_cookie cookie = {
 963                 .error = 0,
 964         };
 965         void *hdr;
 966         struct sk_buff *msg;
 967
 968         if (info->attrs[NL80211_ATTR_KEY_IDX])
 969                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 970
 971         if (key_idx > 5)
 972                 return -EINVAL;
 973
 974         if (info->attrs[NL80211_ATTR_MAC])
 975                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 976
 977         rtnl_lock();
 978
 979         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 980         if (err)
 981                 goto unlock_rtnl;
 982
 983         if (!drv->ops->get_key) {
 984                 err = -EOPNOTSUPP;
 985                 goto out;
 986         }
 987
 988         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 989         if (!msg) {
 990                 err = -ENOMEM;
 991                 goto out;
 992         }
 993
 994         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
 995                              NL80211_CMD_NEW_KEY);
 996
 997         if (IS_ERR(hdr)) {
 998                 err = PTR_ERR(hdr);
 999                 goto out;
1000         }
1001
1002         cookie.msg = msg;
1003
1004         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1005         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1006         if (mac_addr)
1007                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1008
1009         err = drv->ops->get_key(&drv->wiphy, dev, key_idx, mac_addr,
1010                                 &cookie, get_key_callback);
1011
1012         if (err)
1013                 goto out;
1014
1015         if (cookie.error)
1016                 goto nla_put_failure;
1017
1018         genlmsg_end(msg, hdr);
1019         err = genlmsg_unicast(msg, info->snd_pid);
1020         goto out;
1021
1022  nla_put_failure:
1023         err = -ENOBUFS;
1024         nlmsg_free(msg);
1025  out:
1026         cfg80211_put_dev(drv);
1027         dev_put(dev);
1028  unlock_rtnl:
1029         rtnl_unlock();
1030
1031         return err;
1032 }
1033
1034 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1035 {
1036         struct cfg80211_registered_device *drv;
1037         int err;
1038         struct net_device *dev;
1039         u8 key_idx;
1040         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
1041                     u8 key_index);
1042
1043         if (!info->attrs[NL80211_ATTR_KEY_IDX])
1044                 return -EINVAL;
1045
1046         key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1047
1048         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]) {
1049                 if (key_idx < 4 || key_idx > 5)
1050                         return -EINVAL;
1051         } else if (key_idx > 3)
1052                 return -EINVAL;
1053
1054         /* currently only support setting default key */
1055         if (!info->attrs[NL80211_ATTR_KEY_DEFAULT] &&
1056             !info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT])
1057                 return -EINVAL;
1058
1059         rtnl_lock();
1060
1061         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1062         if (err)
1063                 goto unlock_rtnl;
1064
1065         if (info->attrs[NL80211_ATTR_KEY_DEFAULT])
1066                 func = drv->ops->set_default_key;
1067         else
1068                 func = drv->ops->set_default_mgmt_key;
1069
1070         if (!func) {
1071                 err = -EOPNOTSUPP;
1072                 goto out;
1073         }
1074
1075         err = func(&drv->wiphy, dev, key_idx);
1076 #ifdef CONFIG_WIRELESS_EXT
1077         if (!err) {
1078                 if (func == drv->ops->set_default_key)
1079                         dev->ieee80211_ptr->wext.default_key = key_idx;
1080                 else
1081                         dev->ieee80211_ptr->wext.default_mgmt_key = key_idx;
1082         }
1083 #endif
1084
1085  out:
1086         cfg80211_put_dev(drv);
1087         dev_put(dev);
1088
1089  unlock_rtnl:
1090         rtnl_unlock();
1091
1092         return err;
1093 }
1094
1095 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1096 {
1097         struct cfg80211_registered_device *drv;
1098         int err, i;
1099         struct net_device *dev;
1100         struct key_params params;
1101         u8 key_idx = 0;
1102         u8 *mac_addr = NULL;
1103
1104         memset(&params, 0, sizeof(params));
1105
1106         if (!info->attrs[NL80211_ATTR_KEY_CIPHER])
1107                 return -EINVAL;
1108
1109         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1110                 params.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1111                 params.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1112         }
1113
1114         if (info->attrs[NL80211_ATTR_KEY_IDX])
1115                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1116
1117         params.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1118
1119         if (info->attrs[NL80211_ATTR_MAC])
1120                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1121
1122         if (cfg80211_validate_key_settings(&params, key_idx, mac_addr))
1123                 return -EINVAL;
1124
1125         rtnl_lock();
1126
1127         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1128         if (err)
1129                 goto unlock_rtnl;
1130
1131         for (i = 0; i < drv->wiphy.n_cipher_suites; i++)
1132                 if (params.cipher == drv->wiphy.cipher_suites[i])
1133                         break;
1134         if (i == drv->wiphy.n_cipher_suites) {
1135                 err = -EINVAL;
1136                 goto out;
1137         }
1138
1139         if (!drv->ops->add_key) {
1140                 err = -EOPNOTSUPP;
1141                 goto out;
1142         }
1143
1144         err = drv->ops->add_key(&drv->wiphy, dev, key_idx, mac_addr, &params);
1145
1146  out:
1147         cfg80211_put_dev(drv);
1148         dev_put(dev);
1149  unlock_rtnl:
1150         rtnl_unlock();
1151
1152         return err;
1153 }
1154
1155 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1156 {
1157         struct cfg80211_registered_device *drv;
1158         int err;
1159         struct net_device *dev;
1160         u8 key_idx = 0;
1161         u8 *mac_addr = NULL;
1162
1163         if (info->attrs[NL80211_ATTR_KEY_IDX])
1164                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1165
1166         if (key_idx > 5)
1167                 return -EINVAL;
1168
1169         if (info->attrs[NL80211_ATTR_MAC])
1170                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1171
1172         rtnl_lock();
1173
1174         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1175         if (err)
1176                 goto unlock_rtnl;
1177
1178         if (!drv->ops->del_key) {
1179                 err = -EOPNOTSUPP;
1180                 goto out;
1181         }
1182
1183         err = drv->ops->del_key(&drv->wiphy, dev, key_idx, mac_addr);
1184
1185 #ifdef CONFIG_WIRELESS_EXT
1186         if (!err) {
1187                 if (key_idx == dev->ieee80211_ptr->wext.default_key)
1188                         dev->ieee80211_ptr->wext.default_key = -1;
1189                 else if (key_idx == dev->ieee80211_ptr->wext.default_mgmt_key)
1190                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
1191         }
1192 #endif
1193
1194  out:
1195         cfg80211_put_dev(drv);
1196         dev_put(dev);
1197
1198  unlock_rtnl:
1199         rtnl_unlock();
1200
1201         return err;
1202 }
1203
1204 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1205 {
1206         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1207                     struct beacon_parameters *info);
1208         struct cfg80211_registered_device *drv;
1209         int err;
1210         struct net_device *dev;
1211         struct beacon_parameters params;
1212         int haveinfo = 0;
1213
1214         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
1215                 return -EINVAL;
1216
1217         rtnl_lock();
1218
1219         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1220         if (err)
1221                 goto unlock_rtnl;
1222
1223         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1224                 err = -EOPNOTSUPP;
1225                 goto out;
1226         }
1227
1228         switch (info->genlhdr->cmd) {
1229         case NL80211_CMD_NEW_BEACON:
1230                 /* these are required for NEW_BEACON */
1231                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1232                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1233                     !info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1234                         err = -EINVAL;
1235                         goto out;
1236                 }
1237
1238                 call = drv->ops->add_beacon;
1239                 break;
1240         case NL80211_CMD_SET_BEACON:
1241                 call = drv->ops->set_beacon;
1242                 break;
1243         default:
1244                 WARN_ON(1);
1245                 err = -EOPNOTSUPP;
1246                 goto out;
1247         }
1248
1249         if (!call) {
1250                 err = -EOPNOTSUPP;
1251                 goto out;
1252         }
1253
1254         memset(&params, 0, sizeof(params));
1255
1256         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1257                 params.interval =
1258                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1259                 haveinfo = 1;
1260         }
1261
1262         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1263                 params.dtim_period =
1264                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1265                 haveinfo = 1;
1266         }
1267
1268         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1269                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1270                 params.head_len =
1271                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1272                 haveinfo = 1;
1273         }
1274
1275         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1276                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1277                 params.tail_len =
1278                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1279                 haveinfo = 1;
1280         }
1281
1282         if (!haveinfo) {
1283                 err = -EINVAL;
1284                 goto out;
1285         }
1286
1287         err = call(&drv->wiphy, dev, &params);
1288
1289  out:
1290         cfg80211_put_dev(drv);
1291         dev_put(dev);
1292  unlock_rtnl:
1293         rtnl_unlock();
1294
1295         return err;
1296 }
1297
1298 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1299 {
1300         struct cfg80211_registered_device *drv;
1301         int err;
1302         struct net_device *dev;
1303
1304         rtnl_lock();
1305
1306         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1307         if (err)
1308                 goto unlock_rtnl;
1309
1310         if (!drv->ops->del_beacon) {
1311                 err = -EOPNOTSUPP;
1312                 goto out;
1313         }
1314
1315         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1316                 err = -EOPNOTSUPP;
1317                 goto out;
1318         }
1319         err = drv->ops->del_beacon(&drv->wiphy, dev);
1320
1321  out:
1322         cfg80211_put_dev(drv);
1323         dev_put(dev);
1324  unlock_rtnl:
1325         rtnl_unlock();
1326
1327         return err;
1328 }
1329
1330 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1331         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1332         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1333         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1334 };
1335
1336 static int parse_station_flags(struct nlattr *nla, u32 *staflags)
1337 {
1338         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1339         int flag;
1340
1341         *staflags = 0;
1342
1343         if (!nla)
1344                 return 0;
1345
1346         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1347                              nla, sta_flags_policy))
1348                 return -EINVAL;
1349
1350         *staflags = STATION_FLAG_CHANGED;
1351
1352         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1353                 if (flags[flag])
1354                         *staflags |= (1<<flag);
1355
1356         return 0;
1357 }
1358
1359 static u16 nl80211_calculate_bitrate(struct rate_info *rate)
1360 {
1361         int modulation, streams, bitrate;
1362
1363         if (!(rate->flags & RATE_INFO_FLAGS_MCS))
1364                 return rate->legacy;
1365
1366         /* the formula below does only work for MCS values smaller than 32 */
1367         if (rate->mcs >= 32)
1368                 return 0;
1369
1370         modulation = rate->mcs & 7;
1371         streams = (rate->mcs >> 3) + 1;
1372
1373         bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
1374                         13500000 : 6500000;
1375
1376         if (modulation < 4)
1377                 bitrate *= (modulation + 1);
1378         else if (modulation == 4)
1379                 bitrate *= (modulation + 2);
1380         else
1381                 bitrate *= (modulation + 3);
1382
1383         bitrate *= streams;
1384
1385         if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
1386                 bitrate = (bitrate / 9) * 10;
1387
1388         /* do NOT round down here */
1389         return (bitrate + 50000) / 100000;
1390 }
1391
1392 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1393                                 int flags, struct net_device *dev,
1394                                 u8 *mac_addr, struct station_info *sinfo)
1395 {
1396         void *hdr;
1397         struct nlattr *sinfoattr, *txrate;
1398         u16 bitrate;
1399
1400         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1401         if (!hdr)
1402                 return -1;
1403
1404         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1405         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1406
1407         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1408         if (!sinfoattr)
1409                 goto nla_put_failure;
1410         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1411                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1412                             sinfo->inactive_time);
1413         if (sinfo->filled & STATION_INFO_RX_BYTES)
1414                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1415                             sinfo->rx_bytes);
1416         if (sinfo->filled & STATION_INFO_TX_BYTES)
1417                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1418                             sinfo->tx_bytes);
1419         if (sinfo->filled & STATION_INFO_LLID)
1420                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1421                             sinfo->llid);
1422         if (sinfo->filled & STATION_INFO_PLID)
1423                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1424                             sinfo->plid);
1425         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1426                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1427                             sinfo->plink_state);
1428         if (sinfo->filled & STATION_INFO_SIGNAL)
1429                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1430                            sinfo->signal);
1431         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1432                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1433                 if (!txrate)
1434                         goto nla_put_failure;
1435
1436                 /* nl80211_calculate_bitrate will return 0 for mcs >= 32 */
1437                 bitrate = nl80211_calculate_bitrate(&sinfo->txrate);
1438                 if (bitrate > 0)
1439                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1440
1441                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1442                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1443                                     sinfo->txrate.mcs);
1444                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1445                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1446                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1447                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1448
1449                 nla_nest_end(msg, txrate);
1450         }
1451         if (sinfo->filled & STATION_INFO_RX_PACKETS)
1452                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
1453                             sinfo->rx_packets);
1454         if (sinfo->filled & STATION_INFO_TX_PACKETS)
1455                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
1456                             sinfo->tx_packets);
1457         nla_nest_end(msg, sinfoattr);
1458
1459         return genlmsg_end(msg, hdr);
1460
1461  nla_put_failure:
1462         genlmsg_cancel(msg, hdr);
1463         return -EMSGSIZE;
1464 }
1465
1466 static int nl80211_dump_station(struct sk_buff *skb,
1467                                 struct netlink_callback *cb)
1468 {
1469         struct station_info sinfo;
1470         struct cfg80211_registered_device *dev;
1471         struct net_device *netdev;
1472         u8 mac_addr[ETH_ALEN];
1473         int ifidx = cb->args[0];
1474         int sta_idx = cb->args[1];
1475         int err;
1476
1477         if (!ifidx) {
1478                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1479                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1480                                   nl80211_policy);
1481                 if (err)
1482                         return err;
1483
1484                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1485                         return -EINVAL;
1486
1487                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1488                 if (!ifidx)
1489                         return -EINVAL;
1490         }
1491
1492         rtnl_lock();
1493
1494         netdev = __dev_get_by_index(&init_net, ifidx);
1495         if (!netdev) {
1496                 err = -ENODEV;
1497                 goto out_rtnl;
1498         }
1499
1500         dev = cfg80211_get_dev_from_ifindex(ifidx);
1501         if (IS_ERR(dev)) {
1502                 err = PTR_ERR(dev);
1503                 goto out_rtnl;
1504         }
1505
1506         if (!dev->ops->dump_station) {
1507                 err = -EOPNOTSUPP;
1508                 goto out_err;
1509         }
1510
1511         while (1) {
1512                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1513                                              mac_addr, &sinfo);
1514                 if (err == -ENOENT)
1515                         break;
1516                 if (err)
1517                         goto out_err;
1518
1519                 if (nl80211_send_station(skb,
1520                                 NETLINK_CB(cb->skb).pid,
1521                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
1522                                 netdev, mac_addr,
1523                                 &sinfo) < 0)
1524                         goto out;
1525
1526                 sta_idx++;
1527         }
1528
1529
1530  out:
1531         cb->args[1] = sta_idx;
1532         err = skb->len;
1533  out_err:
1534         cfg80211_put_dev(dev);
1535  out_rtnl:
1536         rtnl_unlock();
1537
1538         return err;
1539 }
1540
1541 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1542 {
1543         struct cfg80211_registered_device *drv;
1544         int err;
1545         struct net_device *dev;
1546         struct station_info sinfo;
1547         struct sk_buff *msg;
1548         u8 *mac_addr = NULL;
1549
1550         memset(&sinfo, 0, sizeof(sinfo));
1551
1552         if (!info->attrs[NL80211_ATTR_MAC])
1553                 return -EINVAL;
1554
1555         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1556
1557         rtnl_lock();
1558
1559         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1560         if (err)
1561                 goto out_rtnl;
1562
1563         if (!drv->ops->get_station) {
1564                 err = -EOPNOTSUPP;
1565                 goto out;
1566         }
1567
1568         err = drv->ops->get_station(&drv->wiphy, dev, mac_addr, &sinfo);
1569         if (err)
1570                 goto out;
1571
1572         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1573         if (!msg)
1574                 goto out;
1575
1576         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1577                                  dev, mac_addr, &sinfo) < 0)
1578                 goto out_free;
1579
1580         err = genlmsg_unicast(msg, info->snd_pid);
1581         goto out;
1582
1583  out_free:
1584         nlmsg_free(msg);
1585  out:
1586         cfg80211_put_dev(drv);
1587         dev_put(dev);
1588  out_rtnl:
1589         rtnl_unlock();
1590
1591         return err;
1592 }
1593
1594 /*
1595  * Get vlan interface making sure it is on the right wiphy.
1596  */
1597 static int get_vlan(struct nlattr *vlanattr,
1598                     struct cfg80211_registered_device *rdev,
1599                     struct net_device **vlan)
1600 {
1601         *vlan = NULL;
1602
1603         if (vlanattr) {
1604                 *vlan = dev_get_by_index(&init_net, nla_get_u32(vlanattr));
1605                 if (!*vlan)
1606                         return -ENODEV;
1607                 if (!(*vlan)->ieee80211_ptr)
1608                         return -EINVAL;
1609                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
1610                         return -EINVAL;
1611         }
1612         return 0;
1613 }
1614
1615 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
1616 {
1617         struct cfg80211_registered_device *drv;
1618         int err;
1619         struct net_device *dev;
1620         struct station_parameters params;
1621         u8 *mac_addr = NULL;
1622
1623         memset(&params, 0, sizeof(params));
1624
1625         params.listen_interval = -1;
1626
1627         if (info->attrs[NL80211_ATTR_STA_AID])
1628                 return -EINVAL;
1629
1630         if (!info->attrs[NL80211_ATTR_MAC])
1631                 return -EINVAL;
1632
1633         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1634
1635         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
1636                 params.supported_rates =
1637                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1638                 params.supported_rates_len =
1639                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1640         }
1641
1642         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1643                 params.listen_interval =
1644                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1645
1646         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1647                 params.ht_capa =
1648                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1649
1650         if (parse_station_flags(info->attrs[NL80211_ATTR_STA_FLAGS],
1651                                 &params.station_flags))
1652                 return -EINVAL;
1653
1654         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
1655                 params.plink_action =
1656                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
1657
1658         rtnl_lock();
1659
1660         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1661         if (err)
1662                 goto out_rtnl;
1663
1664         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1665         if (err)
1666                 goto out;
1667
1668         if (!drv->ops->change_station) {
1669                 err = -EOPNOTSUPP;
1670                 goto out;
1671         }
1672
1673         err = drv->ops->change_station(&drv->wiphy, dev, mac_addr, &params);
1674
1675  out:
1676         if (params.vlan)
1677                 dev_put(params.vlan);
1678         cfg80211_put_dev(drv);
1679         dev_put(dev);
1680  out_rtnl:
1681         rtnl_unlock();
1682
1683         return err;
1684 }
1685
1686 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
1687 {
1688         struct cfg80211_registered_device *drv;
1689         int err;
1690         struct net_device *dev;
1691         struct station_parameters params;
1692         u8 *mac_addr = NULL;
1693
1694         memset(&params, 0, sizeof(params));
1695
1696         if (!info->attrs[NL80211_ATTR_MAC])
1697                 return -EINVAL;
1698
1699         if (!info->attrs[NL80211_ATTR_STA_AID])
1700                 return -EINVAL;
1701
1702         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1703                 return -EINVAL;
1704
1705         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
1706                 return -EINVAL;
1707
1708         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1709         params.supported_rates =
1710                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1711         params.supported_rates_len =
1712                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1713         params.listen_interval =
1714                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1715         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
1716         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1717                 params.ht_capa =
1718                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1719
1720         if (parse_station_flags(info->attrs[NL80211_ATTR_STA_FLAGS],
1721                                 &params.station_flags))
1722                 return -EINVAL;
1723
1724         rtnl_lock();
1725
1726         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1727         if (err)
1728                 goto out_rtnl;
1729
1730         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1731             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN) {
1732                 err = -EINVAL;
1733                 goto out;
1734         }
1735
1736         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1737         if (err)
1738                 goto out;
1739
1740         if (!drv->ops->add_station) {
1741                 err = -EOPNOTSUPP;
1742                 goto out;
1743         }
1744
1745         if (!netif_running(dev)) {
1746                 err = -ENETDOWN;
1747                 goto out;
1748         }
1749
1750         err = drv->ops->add_station(&drv->wiphy, dev, mac_addr, &params);
1751
1752  out:
1753         if (params.vlan)
1754                 dev_put(params.vlan);
1755         cfg80211_put_dev(drv);
1756         dev_put(dev);
1757  out_rtnl:
1758         rtnl_unlock();
1759
1760         return err;
1761 }
1762
1763 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
1764 {
1765         struct cfg80211_registered_device *drv;
1766         int err;
1767         struct net_device *dev;
1768         u8 *mac_addr = NULL;
1769
1770         if (info->attrs[NL80211_ATTR_MAC])
1771                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1772
1773         rtnl_lock();
1774
1775         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1776         if (err)
1777                 goto out_rtnl;
1778
1779         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1780             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN) {
1781                 err = -EINVAL;
1782                 goto out;
1783         }
1784
1785         if (!drv->ops->del_station) {
1786                 err = -EOPNOTSUPP;
1787                 goto out;
1788         }
1789
1790         err = drv->ops->del_station(&drv->wiphy, dev, mac_addr);
1791
1792  out:
1793         cfg80211_put_dev(drv);
1794         dev_put(dev);
1795  out_rtnl:
1796         rtnl_unlock();
1797
1798         return err;
1799 }
1800
1801 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
1802                                 int flags, struct net_device *dev,
1803                                 u8 *dst, u8 *next_hop,
1804                                 struct mpath_info *pinfo)
1805 {
1806         void *hdr;
1807         struct nlattr *pinfoattr;
1808
1809         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1810         if (!hdr)
1811                 return -1;
1812
1813         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1814         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
1815         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
1816
1817         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
1818         if (!pinfoattr)
1819                 goto nla_put_failure;
1820         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
1821                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
1822                             pinfo->frame_qlen);
1823         if (pinfo->filled & MPATH_INFO_DSN)
1824                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DSN,
1825                             pinfo->dsn);
1826         if (pinfo->filled & MPATH_INFO_METRIC)
1827                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
1828                             pinfo->metric);
1829         if (pinfo->filled & MPATH_INFO_EXPTIME)
1830                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
1831                             pinfo->exptime);
1832         if (pinfo->filled & MPATH_INFO_FLAGS)
1833                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
1834                             pinfo->flags);
1835         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
1836                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
1837                             pinfo->discovery_timeout);
1838         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
1839                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
1840                             pinfo->discovery_retries);
1841
1842         nla_nest_end(msg, pinfoattr);
1843
1844         return genlmsg_end(msg, hdr);
1845
1846  nla_put_failure:
1847         genlmsg_cancel(msg, hdr);
1848         return -EMSGSIZE;
1849 }
1850
1851 static int nl80211_dump_mpath(struct sk_buff *skb,
1852                               struct netlink_callback *cb)
1853 {
1854         struct mpath_info pinfo;
1855         struct cfg80211_registered_device *dev;
1856         struct net_device *netdev;
1857         u8 dst[ETH_ALEN];
1858         u8 next_hop[ETH_ALEN];
1859         int ifidx = cb->args[0];
1860         int path_idx = cb->args[1];
1861         int err;
1862
1863         if (!ifidx) {
1864                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1865                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1866                                   nl80211_policy);
1867                 if (err)
1868                         return err;
1869
1870                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1871                         return -EINVAL;
1872
1873                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1874                 if (!ifidx)
1875                         return -EINVAL;
1876         }
1877
1878         rtnl_lock();
1879
1880         netdev = __dev_get_by_index(&init_net, ifidx);
1881         if (!netdev) {
1882                 err = -ENODEV;
1883                 goto out_rtnl;
1884         }
1885
1886         dev = cfg80211_get_dev_from_ifindex(ifidx);
1887         if (IS_ERR(dev)) {
1888                 err = PTR_ERR(dev);
1889                 goto out_rtnl;
1890         }
1891
1892         if (!dev->ops->dump_mpath) {
1893                 err = -EOPNOTSUPP;
1894                 goto out_err;
1895         }
1896
1897         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1898                 err = -EOPNOTSUPP;
1899                 goto out;
1900         }
1901
1902         while (1) {
1903                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
1904                                            dst, next_hop, &pinfo);
1905                 if (err == -ENOENT)
1906                         break;
1907                 if (err)
1908                         goto out_err;
1909
1910                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
1911                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
1912                                        netdev, dst, next_hop,
1913                                        &pinfo) < 0)
1914                         goto out;
1915
1916                 path_idx++;
1917         }
1918
1919
1920  out:
1921         cb->args[1] = path_idx;
1922         err = skb->len;
1923  out_err:
1924         cfg80211_put_dev(dev);
1925  out_rtnl:
1926         rtnl_unlock();
1927
1928         return err;
1929 }
1930
1931 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
1932 {
1933         struct cfg80211_registered_device *drv;
1934         int err;
1935         struct net_device *dev;
1936         struct mpath_info pinfo;
1937         struct sk_buff *msg;
1938         u8 *dst = NULL;
1939         u8 next_hop[ETH_ALEN];
1940
1941         memset(&pinfo, 0, sizeof(pinfo));
1942
1943         if (!info->attrs[NL80211_ATTR_MAC])
1944                 return -EINVAL;
1945
1946         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1947
1948         rtnl_lock();
1949
1950         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1951         if (err)
1952                 goto out_rtnl;
1953
1954         if (!drv->ops->get_mpath) {
1955                 err = -EOPNOTSUPP;
1956                 goto out;
1957         }
1958
1959         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1960                 err = -EOPNOTSUPP;
1961                 goto out;
1962         }
1963
1964         err = drv->ops->get_mpath(&drv->wiphy, dev, dst, next_hop, &pinfo);
1965         if (err)
1966                 goto out;
1967
1968         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1969         if (!msg)
1970                 goto out;
1971
1972         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
1973                                  dev, dst, next_hop, &pinfo) < 0)
1974                 goto out_free;
1975
1976         err = genlmsg_unicast(msg, info->snd_pid);
1977         goto out;
1978
1979  out_free:
1980         nlmsg_free(msg);
1981  out:
1982         cfg80211_put_dev(drv);
1983         dev_put(dev);
1984  out_rtnl:
1985         rtnl_unlock();
1986
1987         return err;
1988 }
1989
1990 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
1991 {
1992         struct cfg80211_registered_device *drv;
1993         int err;
1994         struct net_device *dev;
1995         u8 *dst = NULL;
1996         u8 *next_hop = NULL;
1997
1998         if (!info->attrs[NL80211_ATTR_MAC])
1999                 return -EINVAL;
2000
2001         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2002                 return -EINVAL;
2003
2004         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2005         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2006
2007         rtnl_lock();
2008
2009         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2010         if (err)
2011                 goto out_rtnl;
2012
2013         if (!drv->ops->change_mpath) {
2014                 err = -EOPNOTSUPP;
2015                 goto out;
2016         }
2017
2018         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2019                 err = -EOPNOTSUPP;
2020                 goto out;
2021         }
2022
2023         if (!netif_running(dev)) {
2024                 err = -ENETDOWN;
2025                 goto out;
2026         }
2027
2028         err = drv->ops->change_mpath(&drv->wiphy, dev, dst, next_hop);
2029
2030  out:
2031         cfg80211_put_dev(drv);
2032         dev_put(dev);
2033  out_rtnl:
2034         rtnl_unlock();
2035
2036         return err;
2037 }
2038 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2039 {
2040         struct cfg80211_registered_device *drv;
2041         int err;
2042         struct net_device *dev;
2043         u8 *dst = NULL;
2044         u8 *next_hop = NULL;
2045
2046         if (!info->attrs[NL80211_ATTR_MAC])
2047                 return -EINVAL;
2048
2049         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2050                 return -EINVAL;
2051
2052         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2053         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2054
2055         rtnl_lock();
2056
2057         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2058         if (err)
2059                 goto out_rtnl;
2060
2061         if (!drv->ops->add_mpath) {
2062                 err = -EOPNOTSUPP;
2063                 goto out;
2064         }
2065
2066         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2067                 err = -EOPNOTSUPP;
2068                 goto out;
2069         }
2070
2071         if (!netif_running(dev)) {
2072                 err = -ENETDOWN;
2073                 goto out;
2074         }
2075
2076         err = drv->ops->add_mpath(&drv->wiphy, dev, dst, next_hop);
2077
2078  out:
2079         cfg80211_put_dev(drv);
2080         dev_put(dev);
2081  out_rtnl:
2082         rtnl_unlock();
2083
2084         return err;
2085 }
2086
2087 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2088 {
2089         struct cfg80211_registered_device *drv;
2090         int err;
2091         struct net_device *dev;
2092         u8 *dst = NULL;
2093
2094         if (info->attrs[NL80211_ATTR_MAC])
2095                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2096
2097         rtnl_lock();
2098
2099         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2100         if (err)
2101                 goto out_rtnl;
2102
2103         if (!drv->ops->del_mpath) {
2104                 err = -EOPNOTSUPP;
2105                 goto out;
2106         }
2107
2108         err = drv->ops->del_mpath(&drv->wiphy, dev, dst);
2109
2110  out:
2111         cfg80211_put_dev(drv);
2112         dev_put(dev);
2113  out_rtnl:
2114         rtnl_unlock();
2115
2116         return err;
2117 }
2118
2119 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2120 {
2121         struct cfg80211_registered_device *drv;
2122         int err;
2123         struct net_device *dev;
2124         struct bss_parameters params;
2125
2126         memset(&params, 0, sizeof(params));
2127         /* default to not changing parameters */
2128         params.use_cts_prot = -1;
2129         params.use_short_preamble = -1;
2130         params.use_short_slot_time = -1;
2131
2132         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2133                 params.use_cts_prot =
2134                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2135         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2136                 params.use_short_preamble =
2137                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2138         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2139                 params.use_short_slot_time =
2140                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2141         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2142                 params.basic_rates =
2143                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2144                 params.basic_rates_len =
2145                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2146         }
2147
2148         rtnl_lock();
2149
2150         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2151         if (err)
2152                 goto out_rtnl;
2153
2154         if (!drv->ops->change_bss) {
2155                 err = -EOPNOTSUPP;
2156                 goto out;
2157         }
2158
2159         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
2160                 err = -EOPNOTSUPP;
2161                 goto out;
2162         }
2163
2164         err = drv->ops->change_bss(&drv->wiphy, dev, &params);
2165
2166  out:
2167         cfg80211_put_dev(drv);
2168         dev_put(dev);
2169  out_rtnl:
2170         rtnl_unlock();
2171
2172         return err;
2173 }
2174
2175 static const struct nla_policy
2176         reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2177         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2178         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2179         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2180         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2181         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2182         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2183 };
2184
2185 static int parse_reg_rule(struct nlattr *tb[],
2186         struct ieee80211_reg_rule *reg_rule)
2187 {
2188         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2189         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2190
2191         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2192                 return -EINVAL;
2193         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2194                 return -EINVAL;
2195         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2196                 return -EINVAL;
2197         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2198                 return -EINVAL;
2199         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2200                 return -EINVAL;
2201
2202         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2203
2204         freq_range->start_freq_khz =
2205                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2206         freq_range->end_freq_khz =
2207                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2208         freq_range->max_bandwidth_khz =
2209                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2210
2211         power_rule->max_eirp =
2212                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2213
2214         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2215                 power_rule->max_antenna_gain =
2216                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2217
2218         return 0;
2219 }
2220
2221 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2222 {
2223         int r;
2224         char *data = NULL;
2225
2226         /*
2227          * You should only get this when cfg80211 hasn't yet initialized
2228          * completely when built-in to the kernel right between the time
2229          * window between nl80211_init() and regulatory_init(), if that is
2230          * even possible.
2231          */
2232         mutex_lock(&cfg80211_mutex);
2233         if (unlikely(!cfg80211_regdomain)) {
2234                 mutex_unlock(&cfg80211_mutex);
2235                 return -EINPROGRESS;
2236         }
2237         mutex_unlock(&cfg80211_mutex);
2238
2239         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2240                 return -EINVAL;
2241
2242         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2243
2244 #ifdef CONFIG_WIRELESS_OLD_REGULATORY
2245         /* We ignore world regdom requests with the old regdom setup */
2246         if (is_world_regdom(data))
2247                 return -EINVAL;
2248 #endif
2249
2250         r = regulatory_hint_user(data);
2251
2252         return r;
2253 }
2254
2255 static int nl80211_get_mesh_params(struct sk_buff *skb,
2256         struct genl_info *info)
2257 {
2258         struct cfg80211_registered_device *drv;
2259         struct mesh_config cur_params;
2260         int err;
2261         struct net_device *dev;
2262         void *hdr;
2263         struct nlattr *pinfoattr;
2264         struct sk_buff *msg;
2265
2266         rtnl_lock();
2267
2268         /* Look up our device */
2269         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2270         if (err)
2271                 goto out_rtnl;
2272
2273         if (!drv->ops->get_mesh_params) {
2274                 err = -EOPNOTSUPP;
2275                 goto out;
2276         }
2277
2278         /* Get the mesh params */
2279         err = drv->ops->get_mesh_params(&drv->wiphy, dev, &cur_params);
2280         if (err)
2281                 goto out;
2282
2283         /* Draw up a netlink message to send back */
2284         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2285         if (!msg) {
2286                 err = -ENOBUFS;
2287                 goto out;
2288         }
2289         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2290                              NL80211_CMD_GET_MESH_PARAMS);
2291         if (!hdr)
2292                 goto nla_put_failure;
2293         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
2294         if (!pinfoattr)
2295                 goto nla_put_failure;
2296         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2297         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2298                         cur_params.dot11MeshRetryTimeout);
2299         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2300                         cur_params.dot11MeshConfirmTimeout);
2301         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2302                         cur_params.dot11MeshHoldingTimeout);
2303         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2304                         cur_params.dot11MeshMaxPeerLinks);
2305         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2306                         cur_params.dot11MeshMaxRetries);
2307         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2308                         cur_params.dot11MeshTTL);
2309         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2310                         cur_params.auto_open_plinks);
2311         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2312                         cur_params.dot11MeshHWMPmaxPREQretries);
2313         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2314                         cur_params.path_refresh_time);
2315         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2316                         cur_params.min_discovery_timeout);
2317         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2318                         cur_params.dot11MeshHWMPactivePathTimeout);
2319         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2320                         cur_params.dot11MeshHWMPpreqMinInterval);
2321         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2322                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2323         nla_nest_end(msg, pinfoattr);
2324         genlmsg_end(msg, hdr);
2325         err = genlmsg_unicast(msg, info->snd_pid);
2326         goto out;
2327
2328  nla_put_failure:
2329         genlmsg_cancel(msg, hdr);
2330         err = -EMSGSIZE;
2331  out:
2332         /* Cleanup */
2333         cfg80211_put_dev(drv);
2334         dev_put(dev);
2335  out_rtnl:
2336         rtnl_unlock();
2337
2338         return err;
2339 }
2340
2341 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2342 do {\
2343         if (table[attr_num]) {\
2344                 cfg.param = nla_fn(table[attr_num]); \
2345                 mask |= (1 << (attr_num - 1)); \
2346         } \
2347 } while (0);\
2348
2349 static struct nla_policy
2350 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] __read_mostly = {
2351         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2352         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2353         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2354         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2355         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2356         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2357         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2358
2359         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2360         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2361         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2362         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2363         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2364         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2365 };
2366
2367 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2368 {
2369         int err;
2370         u32 mask;
2371         struct cfg80211_registered_device *drv;
2372         struct net_device *dev;
2373         struct mesh_config cfg;
2374         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2375         struct nlattr *parent_attr;
2376
2377         parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
2378         if (!parent_attr)
2379                 return -EINVAL;
2380         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2381                         parent_attr, nl80211_meshconf_params_policy))
2382                 return -EINVAL;
2383
2384         rtnl_lock();
2385
2386         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2387         if (err)
2388                 goto out_rtnl;
2389
2390         if (!drv->ops->set_mesh_params) {
2391                 err = -EOPNOTSUPP;
2392                 goto out;
2393         }
2394
2395         /* This makes sure that there aren't more than 32 mesh config
2396          * parameters (otherwise our bitfield scheme would not work.) */
2397         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2398
2399         /* Fill in the params struct */
2400         mask = 0;
2401         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2402                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2403         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2404                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2405         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2406                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2407         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2408                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2409         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2410                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2411         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2412                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2413         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2414                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2415         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2416                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2417                         nla_get_u8);
2418         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2419                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2420         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2421                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2422                         nla_get_u16);
2423         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2424                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2425                         nla_get_u32);
2426         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2427                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2428                         nla_get_u16);
2429         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2430                         dot11MeshHWMPnetDiameterTraversalTime,
2431                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2432                         nla_get_u16);
2433
2434         /* Apply changes */
2435         err = drv->ops->set_mesh_params(&drv->wiphy, dev, &cfg, mask);
2436
2437  out:
2438         /* cleanup */
2439         cfg80211_put_dev(drv);
2440         dev_put(dev);
2441  out_rtnl:
2442         rtnl_unlock();
2443
2444         return err;
2445 }
2446
2447 #undef FILL_IN_MESH_PARAM_IF_SET
2448
2449 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2450 {
2451         struct sk_buff *msg;
2452         void *hdr = NULL;
2453         struct nlattr *nl_reg_rules;
2454         unsigned int i;
2455         int err = -EINVAL;
2456
2457         mutex_lock(&cfg80211_mutex);
2458
2459         if (!cfg80211_regdomain)
2460                 goto out;
2461
2462         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2463         if (!msg) {
2464                 err = -ENOBUFS;
2465                 goto out;
2466         }
2467
2468         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2469                              NL80211_CMD_GET_REG);
2470         if (!hdr)
2471                 goto nla_put_failure;
2472
2473         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2474                 cfg80211_regdomain->alpha2);
2475
2476         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2477         if (!nl_reg_rules)
2478                 goto nla_put_failure;
2479
2480         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2481                 struct nlattr *nl_reg_rule;
2482                 const struct ieee80211_reg_rule *reg_rule;
2483                 const struct ieee80211_freq_range *freq_range;
2484                 const struct ieee80211_power_rule *power_rule;
2485
2486                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2487                 freq_range = &reg_rule->freq_range;
2488                 power_rule = &reg_rule->power_rule;
2489
2490                 nl_reg_rule = nla_nest_start(msg, i);
2491                 if (!nl_reg_rule)
2492                         goto nla_put_failure;
2493
2494                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2495                         reg_rule->flags);
2496                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2497                         freq_range->start_freq_khz);
2498                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2499                         freq_range->end_freq_khz);
2500                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2501                         freq_range->max_bandwidth_khz);
2502                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2503                         power_rule->max_antenna_gain);
2504                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2505                         power_rule->max_eirp);
2506
2507                 nla_nest_end(msg, nl_reg_rule);
2508         }
2509
2510         nla_nest_end(msg, nl_reg_rules);
2511
2512         genlmsg_end(msg, hdr);
2513         err = genlmsg_unicast(msg, info->snd_pid);
2514         goto out;
2515
2516 nla_put_failure:
2517         genlmsg_cancel(msg, hdr);
2518         err = -EMSGSIZE;
2519 out:
2520         mutex_unlock(&cfg80211_mutex);
2521         return err;
2522 }
2523
2524 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2525 {
2526         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2527         struct nlattr *nl_reg_rule;
2528         char *alpha2 = NULL;
2529         int rem_reg_rules = 0, r = 0;
2530         u32 num_rules = 0, rule_idx = 0, size_of_regd;
2531         struct ieee80211_regdomain *rd = NULL;
2532
2533         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2534                 return -EINVAL;
2535
2536         if (!info->attrs[NL80211_ATTR_REG_RULES])
2537                 return -EINVAL;
2538
2539         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2540
2541         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2542                         rem_reg_rules) {
2543                 num_rules++;
2544                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2545                         goto bad_reg;
2546         }
2547
2548         if (!reg_is_valid_request(alpha2))
2549                 return -EINVAL;
2550
2551         size_of_regd = sizeof(struct ieee80211_regdomain) +
2552                 (num_rules * sizeof(struct ieee80211_reg_rule));
2553
2554         rd = kzalloc(size_of_regd, GFP_KERNEL);
2555         if (!rd)
2556                 return -ENOMEM;
2557
2558         rd->n_reg_rules = num_rules;
2559         rd->alpha2[0] = alpha2[0];
2560         rd->alpha2[1] = alpha2[1];
2561
2562         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2563                         rem_reg_rules) {
2564                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2565                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2566                         reg_rule_policy);
2567                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2568                 if (r)
2569                         goto bad_reg;
2570
2571                 rule_idx++;
2572
2573                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES)
2574                         goto bad_reg;
2575         }
2576
2577         BUG_ON(rule_idx != num_rules);
2578
2579         mutex_lock(&cfg80211_mutex);
2580         r = set_regdom(rd);
2581         mutex_unlock(&cfg80211_mutex);
2582         return r;
2583
2584  bad_reg:
2585         kfree(rd);
2586         return -EINVAL;
2587 }
2588
2589 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
2590 {
2591         struct cfg80211_registered_device *drv;
2592         struct net_device *dev;
2593         struct cfg80211_scan_request *request;
2594         struct cfg80211_ssid *ssid;
2595         struct ieee80211_channel *channel;
2596         struct nlattr *attr;
2597         struct wiphy *wiphy;
2598         int err, tmp, n_ssids = 0, n_channels = 0, i;
2599         enum ieee80211_band band;
2600         size_t ie_len;
2601
2602         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2603                 return -EINVAL;
2604
2605         rtnl_lock();
2606
2607         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2608         if (err)
2609                 goto out_rtnl;
2610
2611         wiphy = &drv->wiphy;
2612
2613         if (!drv->ops->scan) {
2614                 err = -EOPNOTSUPP;
2615                 goto out;
2616         }
2617
2618         if (!netif_running(dev)) {
2619                 err = -ENETDOWN;
2620                 goto out;
2621         }
2622
2623         if (drv->scan_req) {
2624                 err = -EBUSY;
2625                 goto out;
2626         }
2627
2628         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2629                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp)
2630                         n_channels++;
2631                 if (!n_channels) {
2632                         err = -EINVAL;
2633                         goto out;
2634                 }
2635         } else {
2636                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
2637                         if (wiphy->bands[band])
2638                                 n_channels += wiphy->bands[band]->n_channels;
2639         }
2640
2641         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
2642                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
2643                         n_ssids++;
2644
2645         if (n_ssids > wiphy->max_scan_ssids) {
2646                 err = -EINVAL;
2647                 goto out;
2648         }
2649
2650         if (info->attrs[NL80211_ATTR_IE])
2651                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2652         else
2653                 ie_len = 0;
2654
2655         if (ie_len > wiphy->max_scan_ie_len) {
2656                 err = -EINVAL;
2657                 goto out;
2658         }
2659
2660         request = kzalloc(sizeof(*request)
2661                         + sizeof(*ssid) * n_ssids
2662                         + sizeof(channel) * n_channels
2663                         + ie_len, GFP_KERNEL);
2664         if (!request) {
2665                 err = -ENOMEM;
2666                 goto out;
2667         }
2668
2669         request->channels = (void *)((char *)request + sizeof(*request));
2670         request->n_channels = n_channels;
2671         if (n_ssids)
2672                 request->ssids = (void *)(request->channels + n_channels);
2673         request->n_ssids = n_ssids;
2674         if (ie_len) {
2675                 if (request->ssids)
2676                         request->ie = (void *)(request->ssids + n_ssids);
2677                 else
2678                         request->ie = (void *)(request->channels + n_channels);
2679         }
2680
2681         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2682                 /* user specified, bail out if channel not found */
2683                 request->n_channels = n_channels;
2684                 i = 0;
2685                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
2686                         request->channels[i] = ieee80211_get_channel(wiphy, nla_get_u32(attr));
2687                         if (!request->channels[i]) {
2688                                 err = -EINVAL;
2689                                 goto out_free;
2690                         }
2691                         i++;
2692                 }
2693         } else {
2694                 /* all channels */
2695                 i = 0;
2696                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
2697                         int j;
2698                         if (!wiphy->bands[band])
2699                                 continue;
2700                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
2701                                 request->channels[i] = &wiphy->bands[band]->channels[j];
2702                                 i++;
2703                         }
2704                 }
2705         }
2706
2707         i = 0;
2708         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
2709                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
2710                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
2711                                 err = -EINVAL;
2712                                 goto out_free;
2713                         }
2714                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
2715                         request->ssids[i].ssid_len = nla_len(attr);
2716                         i++;
2717                 }
2718         }
2719
2720         if (info->attrs[NL80211_ATTR_IE]) {
2721                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2722                 memcpy((void *)request->ie,
2723                        nla_data(info->attrs[NL80211_ATTR_IE]),
2724                        request->ie_len);
2725         }
2726
2727         request->ifidx = dev->ifindex;
2728         request->wiphy = &drv->wiphy;
2729
2730         drv->scan_req = request;
2731         err = drv->ops->scan(&drv->wiphy, dev, request);
2732
2733  out_free:
2734         if (err) {
2735                 drv->scan_req = NULL;
2736                 kfree(request);
2737         }
2738  out:
2739         cfg80211_put_dev(drv);
2740         dev_put(dev);
2741  out_rtnl:
2742         rtnl_unlock();
2743
2744         return err;
2745 }
2746
2747 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
2748                             struct cfg80211_registered_device *rdev,
2749                             struct net_device *dev,
2750                             struct cfg80211_bss *res)
2751 {
2752         void *hdr;
2753         struct nlattr *bss;
2754
2755         hdr = nl80211hdr_put(msg, pid, seq, flags,
2756                              NL80211_CMD_NEW_SCAN_RESULTS);
2757         if (!hdr)
2758                 return -1;
2759
2760         NLA_PUT_U32(msg, NL80211_ATTR_SCAN_GENERATION,
2761                     rdev->bss_generation);
2762         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2763
2764         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
2765         if (!bss)
2766                 goto nla_put_failure;
2767         if (!is_zero_ether_addr(res->bssid))
2768                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
2769         if (res->information_elements && res->len_information_elements)
2770                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
2771                         res->len_information_elements,
2772                         res->information_elements);
2773         if (res->tsf)
2774                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
2775         if (res->beacon_interval)
2776                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
2777         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
2778         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
2779
2780         switch (rdev->wiphy.signal_type) {
2781         case CFG80211_SIGNAL_TYPE_MBM:
2782                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
2783                 break;
2784         case CFG80211_SIGNAL_TYPE_UNSPEC:
2785                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
2786                 break;
2787         default:
2788                 break;
2789         }
2790
2791         nla_nest_end(msg, bss);
2792
2793         return genlmsg_end(msg, hdr);
2794
2795  nla_put_failure:
2796         genlmsg_cancel(msg, hdr);
2797         return -EMSGSIZE;
2798 }
2799
2800 static int nl80211_dump_scan(struct sk_buff *skb,
2801                              struct netlink_callback *cb)
2802 {
2803         struct cfg80211_registered_device *dev;
2804         struct net_device *netdev;
2805         struct cfg80211_internal_bss *scan;
2806         int ifidx = cb->args[0];
2807         int start = cb->args[1], idx = 0;
2808         int err;
2809
2810         if (!ifidx) {
2811                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
2812                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
2813                                   nl80211_policy);
2814                 if (err)
2815                         return err;
2816
2817                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
2818                         return -EINVAL;
2819
2820                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
2821                 if (!ifidx)
2822                         return -EINVAL;
2823                 cb->args[0] = ifidx;
2824         }
2825
2826         netdev = dev_get_by_index(&init_net, ifidx);
2827         if (!netdev)
2828                 return -ENODEV;
2829
2830         dev = cfg80211_get_dev_from_ifindex(ifidx);
2831         if (IS_ERR(dev)) {
2832                 err = PTR_ERR(dev);
2833                 goto out_put_netdev;
2834         }
2835
2836         spin_lock_bh(&dev->bss_lock);
2837         cfg80211_bss_expire(dev);
2838
2839         list_for_each_entry(scan, &dev->bss_list, list) {
2840                 if (++idx <= start)
2841                         continue;
2842                 if (nl80211_send_bss(skb,
2843                                 NETLINK_CB(cb->skb).pid,
2844                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2845                                 dev, netdev, &scan->pub) < 0) {
2846                         idx--;
2847                         goto out;
2848                 }
2849         }
2850
2851  out:
2852         spin_unlock_bh(&dev->bss_lock);
2853
2854         cb->args[1] = idx;
2855         err = skb->len;
2856         cfg80211_put_dev(dev);
2857  out_put_netdev:
2858         dev_put(netdev);
2859
2860         return err;
2861 }
2862
2863 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
2864 {
2865         return auth_type == NL80211_AUTHTYPE_OPEN_SYSTEM ||
2866                 auth_type == NL80211_AUTHTYPE_SHARED_KEY ||
2867                 auth_type == NL80211_AUTHTYPE_FT ||
2868                 auth_type == NL80211_AUTHTYPE_NETWORK_EAP;
2869 }
2870
2871 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
2872 {
2873         struct cfg80211_registered_device *drv;
2874         struct net_device *dev;
2875         struct cfg80211_auth_request req;
2876         struct wiphy *wiphy;
2877         int err;
2878
2879         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2880                 return -EINVAL;
2881
2882         if (!info->attrs[NL80211_ATTR_MAC])
2883                 return -EINVAL;
2884
2885         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
2886                 return -EINVAL;
2887
2888         rtnl_lock();
2889
2890         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2891         if (err)
2892                 goto unlock_rtnl;
2893
2894         if (!drv->ops->auth) {
2895                 err = -EOPNOTSUPP;
2896                 goto out;
2897         }
2898
2899         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
2900                 err = -EOPNOTSUPP;
2901                 goto out;
2902         }
2903
2904         if (!netif_running(dev)) {
2905                 err = -ENETDOWN;
2906                 goto out;
2907         }
2908
2909         wiphy = &drv->wiphy;
2910         memset(&req, 0, sizeof(req));
2911
2912         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2913
2914         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2915                 req.chan = ieee80211_get_channel(
2916                         wiphy,
2917                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
2918                 if (!req.chan) {
2919                         err = -EINVAL;
2920                         goto out;
2921                 }
2922         }
2923
2924         if (info->attrs[NL80211_ATTR_SSID]) {
2925                 req.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2926                 req.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
2927         }
2928
2929         if (info->attrs[NL80211_ATTR_IE]) {
2930                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
2931                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2932         }
2933
2934         req.auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
2935         if (!nl80211_valid_auth_type(req.auth_type)) {
2936                 err = -EINVAL;
2937                 goto out;
2938         }
2939
2940         err = drv->ops->auth(&drv->wiphy, dev, &req);
2941
2942 out:
2943         cfg80211_put_dev(drv);
2944         dev_put(dev);
2945 unlock_rtnl:
2946         rtnl_unlock();
2947         return err;
2948 }
2949
2950 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
2951 {
2952         struct cfg80211_registered_device *drv;
2953         struct net_device *dev;
2954         struct cfg80211_assoc_request req;
2955         struct wiphy *wiphy;
2956         int err;
2957
2958         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2959                 return -EINVAL;
2960
2961         if (!info->attrs[NL80211_ATTR_MAC] ||
2962             !info->attrs[NL80211_ATTR_SSID])
2963                 return -EINVAL;
2964
2965         rtnl_lock();
2966
2967         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2968         if (err)
2969                 goto unlock_rtnl;
2970
2971         if (!drv->ops->assoc) {
2972                 err = -EOPNOTSUPP;
2973                 goto out;
2974         }
2975
2976         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
2977                 err = -EOPNOTSUPP;
2978                 goto out;
2979         }
2980
2981         if (!netif_running(dev)) {
2982                 err = -ENETDOWN;
2983                 goto out;
2984         }
2985
2986         wiphy = &drv->wiphy;
2987         memset(&req, 0, sizeof(req));
2988
2989         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2990
2991         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2992                 req.chan = ieee80211_get_channel(
2993                         wiphy,
2994                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
2995                 if (!req.chan) {
2996                         err = -EINVAL;
2997                         goto out;
2998                 }
2999         }
3000
3001         req.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3002         req.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3003
3004         if (info->attrs[NL80211_ATTR_IE]) {
3005                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3006                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3007         }
3008
3009         if (info->attrs[NL80211_ATTR_USE_MFP]) {
3010                 enum nl80211_mfp use_mfp =
3011                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
3012                 if (use_mfp == NL80211_MFP_REQUIRED)
3013                         req.use_mfp = true;
3014                 else if (use_mfp != NL80211_MFP_NO) {
3015                         err = -EINVAL;
3016                         goto out;
3017                 }
3018         }
3019
3020         err = drv->ops->assoc(&drv->wiphy, dev, &req);
3021
3022 out:
3023         cfg80211_put_dev(drv);
3024         dev_put(dev);
3025 unlock_rtnl:
3026         rtnl_unlock();
3027         return err;
3028 }
3029
3030 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
3031 {
3032         struct cfg80211_registered_device *drv;
3033         struct net_device *dev;
3034         struct cfg80211_deauth_request req;
3035         struct wiphy *wiphy;
3036         int err;
3037
3038         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3039                 return -EINVAL;
3040
3041         if (!info->attrs[NL80211_ATTR_MAC])
3042                 return -EINVAL;
3043
3044         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3045                 return -EINVAL;
3046
3047         rtnl_lock();
3048
3049         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3050         if (err)
3051                 goto unlock_rtnl;
3052
3053         if (!drv->ops->deauth) {
3054                 err = -EOPNOTSUPP;
3055                 goto out;
3056         }
3057
3058         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3059                 err = -EOPNOTSUPP;
3060                 goto out;
3061         }
3062
3063         if (!netif_running(dev)) {
3064                 err = -ENETDOWN;
3065                 goto out;
3066         }
3067
3068         wiphy = &drv->wiphy;
3069         memset(&req, 0, sizeof(req));
3070
3071         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3072
3073         req.reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3074         if (req.reason_code == 0) {
3075                 /* Reason Code 0 is reserved */
3076                 err = -EINVAL;
3077                 goto out;
3078         }
3079
3080         if (info->attrs[NL80211_ATTR_IE]) {
3081                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3082                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3083         }
3084
3085         err = drv->ops->deauth(&drv->wiphy, dev, &req);
3086
3087 out:
3088         cfg80211_put_dev(drv);
3089         dev_put(dev);
3090 unlock_rtnl:
3091         rtnl_unlock();
3092         return err;
3093 }
3094
3095 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
3096 {
3097         struct cfg80211_registered_device *drv;
3098         struct net_device *dev;
3099         struct cfg80211_disassoc_request req;
3100         struct wiphy *wiphy;
3101         int err;
3102
3103         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3104                 return -EINVAL;
3105
3106         if (!info->attrs[NL80211_ATTR_MAC])
3107                 return -EINVAL;
3108
3109         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3110                 return -EINVAL;
3111
3112         rtnl_lock();
3113
3114         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3115         if (err)
3116                 goto unlock_rtnl;
3117
3118         if (!drv->ops->disassoc) {
3119                 err = -EOPNOTSUPP;
3120                 goto out;
3121         }
3122
3123         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3124                 err = -EOPNOTSUPP;
3125                 goto out;
3126         }
3127
3128         if (!netif_running(dev)) {
3129                 err = -ENETDOWN;
3130                 goto out;
3131         }
3132
3133         wiphy = &drv->wiphy;
3134         memset(&req, 0, sizeof(req));
3135
3136         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3137
3138         req.reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3139         if (req.reason_code == 0) {
3140                 /* Reason Code 0 is reserved */
3141                 err = -EINVAL;
3142                 goto out;
3143         }
3144
3145         if (info->attrs[NL80211_ATTR_IE]) {
3146                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3147                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3148         }
3149
3150         err = drv->ops->disassoc(&drv->wiphy, dev, &req);
3151
3152 out:
3153         cfg80211_put_dev(drv);
3154         dev_put(dev);
3155 unlock_rtnl:
3156         rtnl_unlock();
3157         return err;
3158 }
3159
3160 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
3161 {
3162         struct cfg80211_registered_device *drv;
3163         struct net_device *dev;
3164         struct cfg80211_ibss_params ibss;
3165         struct wiphy *wiphy;
3166         int err;
3167
3168         memset(&ibss, 0, sizeof(ibss));
3169
3170         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3171                 return -EINVAL;
3172
3173         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
3174             !info->attrs[NL80211_ATTR_SSID] ||
3175             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3176                 return -EINVAL;
3177
3178         ibss.beacon_interval = 100;
3179
3180         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
3181                 ibss.beacon_interval =
3182                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3183                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
3184                         return -EINVAL;
3185         }
3186
3187         rtnl_lock();
3188
3189         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3190         if (err)
3191                 goto unlock_rtnl;
3192
3193         if (!drv->ops->join_ibss) {
3194                 err = -EOPNOTSUPP;
3195                 goto out;
3196         }
3197
3198         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3199                 err = -EOPNOTSUPP;
3200                 goto out;
3201         }
3202
3203         if (!netif_running(dev)) {
3204                 err = -ENETDOWN;
3205                 goto out;
3206         }
3207
3208         wiphy = &drv->wiphy;
3209
3210         if (info->attrs[NL80211_ATTR_MAC])
3211                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3212         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3213         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3214
3215         if (info->attrs[NL80211_ATTR_IE]) {
3216                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3217                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3218         }
3219
3220         ibss.channel = ieee80211_get_channel(wiphy,
3221                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3222         if (!ibss.channel ||
3223             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
3224             ibss.channel->flags & IEEE80211_CHAN_DISABLED) {
3225                 err = -EINVAL;
3226                 goto out;
3227         }
3228
3229         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
3230
3231         err = cfg80211_join_ibss(drv, dev, &ibss);
3232
3233 out:
3234         cfg80211_put_dev(drv);
3235         dev_put(dev);
3236 unlock_rtnl:
3237         rtnl_unlock();
3238         return err;
3239 }
3240
3241 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
3242 {
3243         struct cfg80211_registered_device *drv;
3244         struct net_device *dev;
3245         int err;
3246
3247         rtnl_lock();
3248
3249         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3250         if (err)
3251                 goto unlock_rtnl;
3252
3253         if (!drv->ops->leave_ibss) {
3254                 err = -EOPNOTSUPP;
3255                 goto out;
3256         }
3257
3258         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3259                 err = -EOPNOTSUPP;
3260                 goto out;
3261         }
3262
3263         if (!netif_running(dev)) {
3264                 err = -ENETDOWN;
3265                 goto out;
3266         }
3267
3268         err = cfg80211_leave_ibss(drv, dev, false);
3269
3270 out:
3271         cfg80211_put_dev(drv);
3272         dev_put(dev);
3273 unlock_rtnl:
3274         rtnl_unlock();
3275         return err;
3276 }
3277
3278 static struct genl_ops nl80211_ops[] = {
3279         {
3280                 .cmd = NL80211_CMD_GET_WIPHY,
3281                 .doit = nl80211_get_wiphy,
3282                 .dumpit = nl80211_dump_wiphy,
3283                 .policy = nl80211_policy,
3284                 /* can be retrieved by unprivileged users */
3285         },
3286         {
3287                 .cmd = NL80211_CMD_SET_WIPHY,
3288                 .doit = nl80211_set_wiphy,
3289                 .policy = nl80211_policy,
3290                 .flags = GENL_ADMIN_PERM,
3291         },
3292         {
3293                 .cmd = NL80211_CMD_GET_INTERFACE,
3294                 .doit = nl80211_get_interface,
3295                 .dumpit = nl80211_dump_interface,
3296                 .policy = nl80211_policy,
3297                 /* can be retrieved by unprivileged users */
3298         },
3299         {
3300                 .cmd = NL80211_CMD_SET_INTERFACE,
3301                 .doit = nl80211_set_interface,
3302                 .policy = nl80211_policy,
3303                 .flags = GENL_ADMIN_PERM,
3304         },
3305         {
3306                 .cmd = NL80211_CMD_NEW_INTERFACE,
3307                 .doit = nl80211_new_interface,
3308                 .policy = nl80211_policy,
3309                 .flags = GENL_ADMIN_PERM,
3310         },
3311         {
3312                 .cmd = NL80211_CMD_DEL_INTERFACE,
3313                 .doit = nl80211_del_interface,
3314                 .policy = nl80211_policy,
3315                 .flags = GENL_ADMIN_PERM,
3316         },
3317         {
3318                 .cmd = NL80211_CMD_GET_KEY,
3319                 .doit = nl80211_get_key,
3320                 .policy = nl80211_policy,
3321                 .flags = GENL_ADMIN_PERM,
3322         },
3323         {
3324                 .cmd = NL80211_CMD_SET_KEY,
3325                 .doit = nl80211_set_key,
3326                 .policy = nl80211_policy,
3327                 .flags = GENL_ADMIN_PERM,
3328         },
3329         {
3330                 .cmd = NL80211_CMD_NEW_KEY,
3331                 .doit = nl80211_new_key,
3332                 .policy = nl80211_policy,
3333                 .flags = GENL_ADMIN_PERM,
3334         },
3335         {
3336                 .cmd = NL80211_CMD_DEL_KEY,
3337                 .doit = nl80211_del_key,
3338                 .policy = nl80211_policy,
3339                 .flags = GENL_ADMIN_PERM,
3340         },
3341         {
3342                 .cmd = NL80211_CMD_SET_BEACON,
3343                 .policy = nl80211_policy,
3344                 .flags = GENL_ADMIN_PERM,
3345                 .doit = nl80211_addset_beacon,
3346         },
3347         {
3348                 .cmd = NL80211_CMD_NEW_BEACON,
3349                 .policy = nl80211_policy,
3350                 .flags = GENL_ADMIN_PERM,
3351                 .doit = nl80211_addset_beacon,
3352         },
3353         {
3354                 .cmd = NL80211_CMD_DEL_BEACON,
3355                 .policy = nl80211_policy,
3356                 .flags = GENL_ADMIN_PERM,
3357                 .doit = nl80211_del_beacon,
3358         },
3359         {
3360                 .cmd = NL80211_CMD_GET_STATION,
3361                 .doit = nl80211_get_station,
3362                 .dumpit = nl80211_dump_station,
3363                 .policy = nl80211_policy,
3364         },
3365         {
3366                 .cmd = NL80211_CMD_SET_STATION,
3367                 .doit = nl80211_set_station,
3368                 .policy = nl80211_policy,
3369                 .flags = GENL_ADMIN_PERM,
3370         },
3371         {
3372                 .cmd = NL80211_CMD_NEW_STATION,
3373                 .doit = nl80211_new_station,
3374                 .policy = nl80211_policy,
3375                 .flags = GENL_ADMIN_PERM,
3376         },
3377         {
3378                 .cmd = NL80211_CMD_DEL_STATION,
3379                 .doit = nl80211_del_station,
3380                 .policy = nl80211_policy,
3381                 .flags = GENL_ADMIN_PERM,
3382         },
3383         {
3384                 .cmd = NL80211_CMD_GET_MPATH,
3385                 .doit = nl80211_get_mpath,
3386                 .dumpit = nl80211_dump_mpath,
3387                 .policy = nl80211_policy,
3388                 .flags = GENL_ADMIN_PERM,
3389         },
3390         {
3391                 .cmd = NL80211_CMD_SET_MPATH,
3392                 .doit = nl80211_set_mpath,
3393                 .policy = nl80211_policy,
3394                 .flags = GENL_ADMIN_PERM,
3395         },
3396         {
3397                 .cmd = NL80211_CMD_NEW_MPATH,
3398                 .doit = nl80211_new_mpath,
3399                 .policy = nl80211_policy,
3400                 .flags = GENL_ADMIN_PERM,
3401         },
3402         {
3403                 .cmd = NL80211_CMD_DEL_MPATH,
3404                 .doit = nl80211_del_mpath,
3405                 .policy = nl80211_policy,
3406                 .flags = GENL_ADMIN_PERM,
3407         },
3408         {
3409                 .cmd = NL80211_CMD_SET_BSS,
3410                 .doit = nl80211_set_bss,
3411                 .policy = nl80211_policy,
3412                 .flags = GENL_ADMIN_PERM,
3413         },
3414         {
3415                 .cmd = NL80211_CMD_GET_REG,
3416                 .doit = nl80211_get_reg,
3417                 .policy = nl80211_policy,
3418                 /* can be retrieved by unprivileged users */
3419         },
3420         {
3421                 .cmd = NL80211_CMD_SET_REG,
3422                 .doit = nl80211_set_reg,
3423                 .policy = nl80211_policy,
3424                 .flags = GENL_ADMIN_PERM,
3425         },
3426         {
3427                 .cmd = NL80211_CMD_REQ_SET_REG,
3428                 .doit = nl80211_req_set_reg,
3429                 .policy = nl80211_policy,
3430                 .flags = GENL_ADMIN_PERM,
3431         },
3432         {
3433                 .cmd = NL80211_CMD_GET_MESH_PARAMS,
3434                 .doit = nl80211_get_mesh_params,
3435                 .policy = nl80211_policy,
3436                 /* can be retrieved by unprivileged users */
3437         },
3438         {
3439                 .cmd = NL80211_CMD_SET_MESH_PARAMS,
3440                 .doit = nl80211_set_mesh_params,
3441                 .policy = nl80211_policy,
3442                 .flags = GENL_ADMIN_PERM,
3443         },
3444         {
3445                 .cmd = NL80211_CMD_TRIGGER_SCAN,
3446                 .doit = nl80211_trigger_scan,
3447                 .policy = nl80211_policy,
3448                 .flags = GENL_ADMIN_PERM,
3449         },
3450         {
3451                 .cmd = NL80211_CMD_GET_SCAN,
3452                 .policy = nl80211_policy,
3453                 .dumpit = nl80211_dump_scan,
3454         },
3455         {
3456                 .cmd = NL80211_CMD_AUTHENTICATE,
3457                 .doit = nl80211_authenticate,
3458                 .policy = nl80211_policy,
3459                 .flags = GENL_ADMIN_PERM,
3460         },
3461         {
3462                 .cmd = NL80211_CMD_ASSOCIATE,
3463                 .doit = nl80211_associate,
3464                 .policy = nl80211_policy,
3465                 .flags = GENL_ADMIN_PERM,
3466         },
3467         {
3468                 .cmd = NL80211_CMD_DEAUTHENTICATE,
3469                 .doit = nl80211_deauthenticate,
3470                 .policy = nl80211_policy,
3471                 .flags = GENL_ADMIN_PERM,
3472         },
3473         {
3474                 .cmd = NL80211_CMD_DISASSOCIATE,
3475                 .doit = nl80211_disassociate,
3476                 .policy = nl80211_policy,
3477                 .flags = GENL_ADMIN_PERM,
3478         },
3479         {
3480                 .cmd = NL80211_CMD_JOIN_IBSS,
3481                 .doit = nl80211_join_ibss,
3482                 .policy = nl80211_policy,
3483                 .flags = GENL_ADMIN_PERM,
3484         },
3485         {
3486                 .cmd = NL80211_CMD_LEAVE_IBSS,
3487                 .doit = nl80211_leave_ibss,
3488                 .policy = nl80211_policy,
3489                 .flags = GENL_ADMIN_PERM,
3490         },
3491 };
3492 static struct genl_multicast_group nl80211_mlme_mcgrp = {
3493         .name = "mlme",
3494 };
3495
3496 /* multicast groups */
3497 static struct genl_multicast_group nl80211_config_mcgrp = {
3498         .name = "config",
3499 };
3500 static struct genl_multicast_group nl80211_scan_mcgrp = {
3501         .name = "scan",
3502 };
3503 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
3504         .name = "regulatory",
3505 };
3506
3507 /* notification functions */
3508
3509 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
3510 {
3511         struct sk_buff *msg;
3512
3513         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3514         if (!msg)
3515                 return;
3516
3517         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
3518                 nlmsg_free(msg);
3519                 return;
3520         }
3521
3522         genlmsg_multicast(msg, 0, nl80211_config_mcgrp.id, GFP_KERNEL);
3523 }
3524
3525 static int nl80211_send_scan_donemsg(struct sk_buff *msg,
3526                                     struct cfg80211_registered_device *rdev,
3527                                     struct net_device *netdev,
3528                                     u32 pid, u32 seq, int flags,
3529                                     u32 cmd)
3530 {
3531         void *hdr;
3532
3533         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
3534         if (!hdr)
3535                 return -1;
3536
3537         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3538         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3539
3540         /* XXX: we should probably bounce back the request? */
3541
3542         return genlmsg_end(msg, hdr);
3543
3544  nla_put_failure:
3545         genlmsg_cancel(msg, hdr);
3546         return -EMSGSIZE;
3547 }
3548
3549 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
3550                             struct net_device *netdev)
3551 {
3552         struct sk_buff *msg;
3553
3554         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3555         if (!msg)
3556                 return;
3557
3558         if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
3559                                       NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
3560                 nlmsg_free(msg);
3561                 return;
3562         }
3563
3564         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
3565 }
3566
3567 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
3568                                struct net_device *netdev)
3569 {
3570         struct sk_buff *msg;
3571
3572         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3573         if (!msg)
3574                 return;
3575
3576         if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
3577                                       NL80211_CMD_SCAN_ABORTED) < 0) {
3578                 nlmsg_free(msg);
3579                 return;
3580         }
3581
3582         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
3583 }
3584
3585 /*
3586  * This can happen on global regulatory changes or device specific settings
3587  * based on custom world regulatory domains.
3588  */
3589 void nl80211_send_reg_change_event(struct regulatory_request *request)
3590 {
3591         struct sk_buff *msg;
3592         void *hdr;
3593
3594         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3595         if (!msg)
3596                 return;
3597
3598         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
3599         if (!hdr) {
3600                 nlmsg_free(msg);
3601                 return;
3602         }
3603
3604         /* Userspace can always count this one always being set */
3605         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
3606
3607         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
3608                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3609                            NL80211_REGDOM_TYPE_WORLD);
3610         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
3611                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3612                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
3613         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
3614                  request->intersect)
3615                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3616                            NL80211_REGDOM_TYPE_INTERSECTION);
3617         else {
3618                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3619                            NL80211_REGDOM_TYPE_COUNTRY);
3620                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
3621         }
3622
3623         if (wiphy_idx_valid(request->wiphy_idx))
3624                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
3625
3626         if (genlmsg_end(msg, hdr) < 0) {
3627                 nlmsg_free(msg);
3628                 return;
3629         }
3630
3631         genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_KERNEL);
3632
3633         return;
3634
3635 nla_put_failure:
3636         genlmsg_cancel(msg, hdr);
3637         nlmsg_free(msg);
3638 }
3639
3640 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
3641                                     struct net_device *netdev,
3642                                     const u8 *buf, size_t len,
3643                                     enum nl80211_commands cmd)
3644 {
3645         struct sk_buff *msg;
3646         void *hdr;
3647
3648         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
3649         if (!msg)
3650                 return;
3651
3652         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
3653         if (!hdr) {
3654                 nlmsg_free(msg);
3655                 return;
3656         }
3657
3658         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3659         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3660         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
3661
3662         if (genlmsg_end(msg, hdr) < 0) {
3663                 nlmsg_free(msg);
3664                 return;
3665         }
3666
3667         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_ATOMIC);
3668         return;
3669
3670  nla_put_failure:
3671         genlmsg_cancel(msg, hdr);
3672         nlmsg_free(msg);
3673 }
3674
3675 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
3676                           struct net_device *netdev, const u8 *buf, size_t len)
3677 {
3678         nl80211_send_mlme_event(rdev, netdev, buf, len,
3679                                 NL80211_CMD_AUTHENTICATE);
3680 }
3681
3682 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
3683                            struct net_device *netdev, const u8 *buf,
3684                            size_t len)
3685 {
3686         nl80211_send_mlme_event(rdev, netdev, buf, len, NL80211_CMD_ASSOCIATE);
3687 }
3688
3689 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
3690                          struct net_device *netdev, const u8 *buf, size_t len)
3691 {
3692         nl80211_send_mlme_event(rdev, netdev, buf, len,
3693                                 NL80211_CMD_DEAUTHENTICATE);
3694 }
3695
3696 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
3697                            struct net_device *netdev, const u8 *buf,
3698                            size_t len)
3699 {
3700         nl80211_send_mlme_event(rdev, netdev, buf, len,
3701                                 NL80211_CMD_DISASSOCIATE);
3702 }
3703
3704 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
3705                                       struct net_device *netdev, int cmd,
3706                                       const u8 *addr)
3707 {
3708         struct sk_buff *msg;
3709         void *hdr;
3710
3711         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
3712         if (!msg)
3713                 return;
3714
3715         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
3716         if (!hdr) {
3717                 nlmsg_free(msg);
3718                 return;
3719         }
3720
3721         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3722         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3723         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
3724         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3725
3726         if (genlmsg_end(msg, hdr) < 0) {
3727                 nlmsg_free(msg);
3728                 return;
3729         }
3730
3731         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_ATOMIC);
3732         return;
3733
3734  nla_put_failure:
3735         genlmsg_cancel(msg, hdr);
3736         nlmsg_free(msg);
3737 }
3738
3739 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
3740                                struct net_device *netdev, const u8 *addr)
3741 {
3742         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
3743                                   addr);
3744 }
3745
3746 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
3747                                 struct net_device *netdev, const u8 *addr)
3748 {
3749         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE, addr);
3750 }
3751
3752 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
3753                              struct net_device *netdev, const u8 *bssid,
3754                              gfp_t gfp)
3755 {
3756         struct sk_buff *msg;
3757         void *hdr;
3758
3759         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
3760         if (!msg)
3761                 return;
3762
3763         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
3764         if (!hdr) {
3765                 nlmsg_free(msg);
3766                 return;
3767         }
3768
3769         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3770         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3771         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
3772
3773         if (genlmsg_end(msg, hdr) < 0) {
3774                 nlmsg_free(msg);
3775                 return;
3776         }
3777
3778         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
3779         return;
3780
3781  nla_put_failure:
3782         genlmsg_cancel(msg, hdr);
3783         nlmsg_free(msg);
3784 }
3785
3786 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
3787                                  struct net_device *netdev, const u8 *addr,
3788                                  enum nl80211_key_type key_type, int key_id,
3789                                  const u8 *tsc)
3790 {
3791         struct sk_buff *msg;
3792         void *hdr;
3793
3794         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3795         if (!msg)
3796                 return;
3797
3798         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
3799         if (!hdr) {
3800                 nlmsg_free(msg);
3801                 return;
3802         }
3803
3804         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3805         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3806         if (addr)
3807                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3808         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
3809         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
3810         if (tsc)
3811                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
3812
3813         if (genlmsg_end(msg, hdr) < 0) {
3814                 nlmsg_free(msg);
3815                 return;
3816         }
3817
3818         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_KERNEL);
3819         return;
3820
3821  nla_put_failure:
3822         genlmsg_cancel(msg, hdr);
3823         nlmsg_free(msg);
3824 }
3825
3826 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
3827                                     struct ieee80211_channel *channel_before,
3828                                     struct ieee80211_channel *channel_after)
3829 {
3830         struct sk_buff *msg;
3831         void *hdr;
3832         struct nlattr *nl_freq;
3833
3834         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
3835         if (!msg)
3836                 return;
3837
3838         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
3839         if (!hdr) {
3840                 nlmsg_free(msg);
3841                 return;
3842         }
3843
3844         /*
3845          * Since we are applying the beacon hint to a wiphy we know its
3846          * wiphy_idx is valid
3847          */
3848         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
3849
3850         /* Before */
3851         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
3852         if (!nl_freq)
3853                 goto nla_put_failure;
3854         if (nl80211_msg_put_channel(msg, channel_before))
3855                 goto nla_put_failure;
3856         nla_nest_end(msg, nl_freq);
3857
3858         /* After */
3859         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
3860         if (!nl_freq)
3861                 goto nla_put_failure;
3862         if (nl80211_msg_put_channel(msg, channel_after))
3863                 goto nla_put_failure;
3864         nla_nest_end(msg, nl_freq);
3865
3866         if (genlmsg_end(msg, hdr) < 0) {
3867                 nlmsg_free(msg);
3868                 return;
3869         }
3870
3871         genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_ATOMIC);
3872
3873         return;
3874
3875 nla_put_failure:
3876         genlmsg_cancel(msg, hdr);
3877         nlmsg_free(msg);
3878 }
3879
3880 /* initialisation/exit functions */
3881
3882 int nl80211_init(void)
3883 {
3884         int err, i;
3885
3886         err = genl_register_family(&nl80211_fam);
3887         if (err)
3888                 return err;
3889
3890         for (i = 0; i < ARRAY_SIZE(nl80211_ops); i++) {
3891                 err = genl_register_ops(&nl80211_fam, &nl80211_ops[i]);
3892                 if (err)
3893                         goto err_out;
3894         }
3895
3896         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
3897         if (err)
3898                 goto err_out;
3899
3900         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
3901         if (err)
3902                 goto err_out;
3903
3904         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
3905         if (err)
3906                 goto err_out;
3907
3908         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
3909         if (err)
3910                 goto err_out;
3911
3912         return 0;
3913  err_out:
3914         genl_unregister_family(&nl80211_fam);
3915         return err;
3916 }
3917
3918 void nl80211_exit(void)
3919 {
3920         genl_unregister_family(&nl80211_fam);
3921 }