SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2009  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/list.h>
  11 #include <linux/if_ether.h>
  12 #include <linux/ieee80211.h>
  13 #include <linux/nl80211.h>
  14 #include <linux/rtnetlink.h>
  15 #include <linux/netlink.h>
  16 #include <linux/etherdevice.h>
  17 #include <net/genetlink.h>
  18 #include <net/cfg80211.h>
  19 #include "core.h"
  20 #include "nl80211.h"
  21 #include "reg.h"
  22
  23 /* the netlink family */
  24 static struct genl_family nl80211_fam = {
  25         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  26         .name = "nl80211",      /* have users key off the name instead */
  27         .hdrsize = 0,           /* no private header */
  28         .version = 1,           /* no particular meaning now */
  29         .maxattr = NL80211_ATTR_MAX,
  30 };
  31
  32 /* internal helper: get drv and dev */
  33 static int get_drv_dev_by_info_ifindex(struct nlattr **attrs,
  34                                        struct cfg80211_registered_device **drv,
  35                                        struct net_device **dev)
  36 {
  37         int ifindex;
  38
  39         if (!attrs[NL80211_ATTR_IFINDEX])
  40                 return -EINVAL;
  41
  42         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  43         *dev = dev_get_by_index(&init_net, ifindex);
  44         if (!*dev)
  45                 return -ENODEV;
  46
  47         *drv = cfg80211_get_dev_from_ifindex(ifindex);
  48         if (IS_ERR(*drv)) {
  49                 dev_put(*dev);
  50                 return PTR_ERR(*drv);
  51         }
  52
  53         return 0;
  54 }
  55
  56 /* policy for the attributes */
  57 static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
  58         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  59         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  60                                       .len = 20-1 },
  61         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  62         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  63         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  64         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
  65         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
  66         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
  67         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
  68
  69         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  70         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  71         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  72
  73         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  74
  75         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  76                                     .len = WLAN_MAX_KEY_LEN },
  77         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  78         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  79         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
  80         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
  81
  82         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
  83         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
  84         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
  85                                        .len = IEEE80211_MAX_DATA_LEN },
  86         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
  87                                        .len = IEEE80211_MAX_DATA_LEN },
  88         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
  89         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
  90         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
  91         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
  92                                                .len = NL80211_MAX_SUPP_RATES },
  93         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
  94         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
  95         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
  96         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
  97                                 .len = IEEE80211_MAX_MESH_ID_LEN },
  98         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
  99
 100         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 101         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 102
 103         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 104         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 105         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 106         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 107                                            .len = NL80211_MAX_SUPP_RATES },
 108
 109         [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
 110
 111         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 112                                          .len = NL80211_HT_CAPABILITY_LEN },
 113
 114         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 115         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 116                               .len = IEEE80211_MAX_DATA_LEN },
 117         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 118         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 119
 120         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 121                                 .len = IEEE80211_MAX_SSID_LEN },
 122         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 123         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 124         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 125         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 126         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 127         [NL80211_ATTR_STA_FLAGS2] = {
 128                 .len = sizeof(struct nl80211_sta_flag_update),
 129         },
 130         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 131         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 132         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 133         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 134 };
 135
 136 /* IE validation */
 137 static bool is_valid_ie_attr(const struct nlattr *attr)
 138 {
 139         const u8 *pos;
 140         int len;
 141
 142         if (!attr)
 143                 return true;
 144
 145         pos = nla_data(attr);
 146         len = nla_len(attr);
 147
 148         while (len) {
 149                 u8 elemlen;
 150
 151                 if (len < 2)
 152                         return false;
 153                 len -= 2;
 154
 155                 elemlen = pos[1];
 156                 if (elemlen > len)
 157                         return false;
 158
 159                 len -= elemlen;
 160                 pos += 2 + elemlen;
 161         }
 162
 163         return true;
 164 }
 165
 166 /* message building helper */
 167 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 168                                    int flags, u8 cmd)
 169 {
 170         /* since there is no private header just add the generic one */
 171         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 172 }
 173
 174 static int nl80211_msg_put_channel(struct sk_buff *msg,
 175                                    struct ieee80211_channel *chan)
 176 {
 177         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 178                     chan->center_freq);
 179
 180         if (chan->flags & IEEE80211_CHAN_DISABLED)
 181                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 182         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 183                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 184         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 185                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 186         if (chan->flags & IEEE80211_CHAN_RADAR)
 187                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 188
 189         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 190                     DBM_TO_MBM(chan->max_power));
 191
 192         return 0;
 193
 194  nla_put_failure:
 195         return -ENOBUFS;
 196 }
 197
 198 /* netlink command implementations */
 199
 200 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 201                               struct cfg80211_registered_device *dev)
 202 {
 203         void *hdr;
 204         struct nlattr *nl_bands, *nl_band;
 205         struct nlattr *nl_freqs, *nl_freq;
 206         struct nlattr *nl_rates, *nl_rate;
 207         struct nlattr *nl_modes;
 208         struct nlattr *nl_cmds;
 209         enum ieee80211_band band;
 210         struct ieee80211_channel *chan;
 211         struct ieee80211_rate *rate;
 212         int i;
 213         u16 ifmodes = dev->wiphy.interface_modes;
 214
 215         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 216         if (!hdr)
 217                 return -1;
 218
 219         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 220         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 221
 222         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 223                    dev->wiphy.retry_short);
 224         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 225                    dev->wiphy.retry_long);
 226         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 227                     dev->wiphy.frag_threshold);
 228         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 229                     dev->wiphy.rts_threshold);
 230
 231         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 232                    dev->wiphy.max_scan_ssids);
 233         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 234                     dev->wiphy.max_scan_ie_len);
 235
 236         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
 237                 sizeof(u32) * dev->wiphy.n_cipher_suites,
 238                 dev->wiphy.cipher_suites);
 239
 240         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
 241         if (!nl_modes)
 242                 goto nla_put_failure;
 243
 244         i = 0;
 245         while (ifmodes) {
 246                 if (ifmodes & 1)
 247                         NLA_PUT_FLAG(msg, i);
 248                 ifmodes >>= 1;
 249                 i++;
 250         }
 251
 252         nla_nest_end(msg, nl_modes);
 253
 254         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 255         if (!nl_bands)
 256                 goto nla_put_failure;
 257
 258         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 259                 if (!dev->wiphy.bands[band])
 260                         continue;
 261
 262                 nl_band = nla_nest_start(msg, band);
 263                 if (!nl_band)
 264                         goto nla_put_failure;
 265
 266                 /* add HT info */
 267                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 268                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 269                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 270                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 271                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 272                                 dev->wiphy.bands[band]->ht_cap.cap);
 273                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 274                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 275                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 276                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 277                 }
 278
 279                 /* add frequencies */
 280                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 281                 if (!nl_freqs)
 282                         goto nla_put_failure;
 283
 284                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 285                         nl_freq = nla_nest_start(msg, i);
 286                         if (!nl_freq)
 287                                 goto nla_put_failure;
 288
 289                         chan = &dev->wiphy.bands[band]->channels[i];
 290
 291                         if (nl80211_msg_put_channel(msg, chan))
 292                                 goto nla_put_failure;
 293
 294                         nla_nest_end(msg, nl_freq);
 295                 }
 296
 297                 nla_nest_end(msg, nl_freqs);
 298
 299                 /* add bitrates */
 300                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 301                 if (!nl_rates)
 302                         goto nla_put_failure;
 303
 304                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 305                         nl_rate = nla_nest_start(msg, i);
 306                         if (!nl_rate)
 307                                 goto nla_put_failure;
 308
 309                         rate = &dev->wiphy.bands[band]->bitrates[i];
 310                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 311                                     rate->bitrate);
 312                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 313                                 NLA_PUT_FLAG(msg,
 314                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 315
 316                         nla_nest_end(msg, nl_rate);
 317                 }
 318
 319                 nla_nest_end(msg, nl_rates);
 320
 321                 nla_nest_end(msg, nl_band);
 322         }
 323         nla_nest_end(msg, nl_bands);
 324
 325         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 326         if (!nl_cmds)
 327                 goto nla_put_failure;
 328
 329         i = 0;
 330 #define CMD(op, n)                                              \
 331          do {                                                   \
 332                 if (dev->ops->op) {                             \
 333                         i++;                                    \
 334                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 335                 }                                               \
 336         } while (0)
 337
 338         CMD(add_virtual_intf, NEW_INTERFACE);
 339         CMD(change_virtual_intf, SET_INTERFACE);
 340         CMD(add_key, NEW_KEY);
 341         CMD(add_beacon, NEW_BEACON);
 342         CMD(add_station, NEW_STATION);
 343         CMD(add_mpath, NEW_MPATH);
 344         CMD(set_mesh_params, SET_MESH_PARAMS);
 345         CMD(change_bss, SET_BSS);
 346         CMD(auth, AUTHENTICATE);
 347         CMD(assoc, ASSOCIATE);
 348         CMD(deauth, DEAUTHENTICATE);
 349         CMD(disassoc, DISASSOCIATE);
 350         CMD(join_ibss, JOIN_IBSS);
 351
 352 #undef CMD
 353
 354         if (dev->ops->connect || dev->ops->auth) {
 355                 i++;
 356                 NLA_PUT_U32(msg, i, NL80211_CMD_CONNECT);
 357         }
 358
 359         if (dev->ops->disconnect || dev->ops->deauth) {
 360                 i++;
 361                 NLA_PUT_U32(msg, i, NL80211_CMD_DISCONNECT);
 362         }
 363
 364         nla_nest_end(msg, nl_cmds);
 365
 366         return genlmsg_end(msg, hdr);
 367
 368  nla_put_failure:
 369         genlmsg_cancel(msg, hdr);
 370         return -EMSGSIZE;
 371 }
 372
 373 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 374 {
 375         int idx = 0;
 376         int start = cb->args[0];
 377         struct cfg80211_registered_device *dev;
 378
 379         mutex_lock(&cfg80211_mutex);
 380         list_for_each_entry(dev, &cfg80211_drv_list, list) {
 381                 if (++idx <= start)
 382                         continue;
 383                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
 384                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
 385                                        dev) < 0) {
 386                         idx--;
 387                         break;
 388                 }
 389         }
 390         mutex_unlock(&cfg80211_mutex);
 391
 392         cb->args[0] = idx;
 393
 394         return skb->len;
 395 }
 396
 397 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 398 {
 399         struct sk_buff *msg;
 400         struct cfg80211_registered_device *dev;
 401
 402         dev = cfg80211_get_dev_from_info(info);
 403         if (IS_ERR(dev))
 404                 return PTR_ERR(dev);
 405
 406         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 407         if (!msg)
 408                 goto out_err;
 409
 410         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
 411                 goto out_free;
 412
 413         cfg80211_put_dev(dev);
 414
 415         return genlmsg_unicast(msg, info->snd_pid);
 416
 417  out_free:
 418         nlmsg_free(msg);
 419  out_err:
 420         cfg80211_put_dev(dev);
 421         return -ENOBUFS;
 422 }
 423
 424 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 425         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
 426         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
 427         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
 428         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
 429         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
 430 };
 431
 432 static int parse_txq_params(struct nlattr *tb[],
 433                             struct ieee80211_txq_params *txq_params)
 434 {
 435         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 436             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 437             !tb[NL80211_TXQ_ATTR_AIFS])
 438                 return -EINVAL;
 439
 440         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
 441         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 442         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 443         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 444         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 445
 446         return 0;
 447 }
 448
 449 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 450 {
 451         struct cfg80211_registered_device *rdev;
 452         int result = 0, rem_txq_params = 0;
 453         struct nlattr *nl_txq_params;
 454         u32 changed;
 455         u8 retry_short = 0, retry_long = 0;
 456         u32 frag_threshold = 0, rts_threshold = 0;
 457
 458         rtnl_lock();
 459
 460         mutex_lock(&cfg80211_mutex);
 461
 462         rdev = __cfg80211_drv_from_info(info);
 463         if (IS_ERR(rdev)) {
 464                 mutex_unlock(&cfg80211_mutex);
 465                 result = PTR_ERR(rdev);
 466                 goto unlock;
 467         }
 468
 469         mutex_lock(&rdev->mtx);
 470
 471         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
 472                 result = cfg80211_dev_rename(
 473                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 474
 475         mutex_unlock(&cfg80211_mutex);
 476
 477         if (result)
 478                 goto bad_res;
 479
 480         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
 481                 struct ieee80211_txq_params txq_params;
 482                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
 483
 484                 if (!rdev->ops->set_txq_params) {
 485                         result = -EOPNOTSUPP;
 486                         goto bad_res;
 487                 }
 488
 489                 nla_for_each_nested(nl_txq_params,
 490                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
 491                                     rem_txq_params) {
 492                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
 493                                   nla_data(nl_txq_params),
 494                                   nla_len(nl_txq_params),
 495                                   txq_params_policy);
 496                         result = parse_txq_params(tb, &txq_params);
 497                         if (result)
 498                                 goto bad_res;
 499
 500                         result = rdev->ops->set_txq_params(&rdev->wiphy,
 501                                                            &txq_params);
 502                         if (result)
 503                                 goto bad_res;
 504                 }
 505         }
 506
 507         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
 508                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 509                 struct ieee80211_channel *chan;
 510                 struct ieee80211_sta_ht_cap *ht_cap;
 511                 u32 freq;
 512
 513                 if (!rdev->ops->set_channel) {
 514                         result = -EOPNOTSUPP;
 515                         goto bad_res;
 516                 }
 517
 518                 result = -EINVAL;
 519
 520                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 521                         channel_type = nla_get_u32(info->attrs[
 522                                            NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 523                         if (channel_type != NL80211_CHAN_NO_HT &&
 524                             channel_type != NL80211_CHAN_HT20 &&
 525                             channel_type != NL80211_CHAN_HT40PLUS &&
 526                             channel_type != NL80211_CHAN_HT40MINUS)
 527                                 goto bad_res;
 528                 }
 529
 530                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 531                 chan = ieee80211_get_channel(&rdev->wiphy, freq);
 532
 533                 /* Primary channel not allowed */
 534                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 535                         goto bad_res;
 536
 537                 if (channel_type == NL80211_CHAN_HT40MINUS &&
 538                     (chan->flags & IEEE80211_CHAN_NO_HT40MINUS))
 539                         goto bad_res;
 540                 else if (channel_type == NL80211_CHAN_HT40PLUS &&
 541                          (chan->flags & IEEE80211_CHAN_NO_HT40PLUS))
 542                         goto bad_res;
 543
 544                 /*
 545                  * At this point we know if that if HT40 was requested
 546                  * we are allowed to use it and the extension channel
 547                  * exists.
 548                  */
 549
 550                 ht_cap = &rdev->wiphy.bands[chan->band]->ht_cap;
 551
 552                 /* no HT capabilities or intolerant */
 553                 if (channel_type != NL80211_CHAN_NO_HT) {
 554                         if (!ht_cap->ht_supported)
 555                                 goto bad_res;
 556                         if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
 557                             (ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT))
 558                                 goto bad_res;
 559                 }
 560
 561                 result = rdev->ops->set_channel(&rdev->wiphy, chan,
 562                                                 channel_type);
 563                 if (result)
 564                         goto bad_res;
 565         }
 566
 567         changed = 0;
 568
 569         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
 570                 retry_short = nla_get_u8(
 571                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
 572                 if (retry_short == 0) {
 573                         result = -EINVAL;
 574                         goto bad_res;
 575                 }
 576                 changed |= WIPHY_PARAM_RETRY_SHORT;
 577         }
 578
 579         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
 580                 retry_long = nla_get_u8(
 581                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
 582                 if (retry_long == 0) {
 583                         result = -EINVAL;
 584                         goto bad_res;
 585                 }
 586                 changed |= WIPHY_PARAM_RETRY_LONG;
 587         }
 588
 589         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
 590                 frag_threshold = nla_get_u32(
 591                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
 592                 if (frag_threshold < 256) {
 593                         result = -EINVAL;
 594                         goto bad_res;
 595                 }
 596                 if (frag_threshold != (u32) -1) {
 597                         /*
 598                          * Fragments (apart from the last one) are required to
 599                          * have even length. Make the fragmentation code
 600                          * simpler by stripping LSB should someone try to use
 601                          * odd threshold value.
 602                          */
 603                         frag_threshold &= ~0x1;
 604                 }
 605                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
 606         }
 607
 608         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
 609                 rts_threshold = nla_get_u32(
 610                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
 611                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
 612         }
 613
 614         if (changed) {
 615                 u8 old_retry_short, old_retry_long;
 616                 u32 old_frag_threshold, old_rts_threshold;
 617
 618                 if (!rdev->ops->set_wiphy_params) {
 619                         result = -EOPNOTSUPP;
 620                         goto bad_res;
 621                 }
 622
 623                 old_retry_short = rdev->wiphy.retry_short;
 624                 old_retry_long = rdev->wiphy.retry_long;
 625                 old_frag_threshold = rdev->wiphy.frag_threshold;
 626                 old_rts_threshold = rdev->wiphy.rts_threshold;
 627
 628                 if (changed & WIPHY_PARAM_RETRY_SHORT)
 629                         rdev->wiphy.retry_short = retry_short;
 630                 if (changed & WIPHY_PARAM_RETRY_LONG)
 631                         rdev->wiphy.retry_long = retry_long;
 632                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
 633                         rdev->wiphy.frag_threshold = frag_threshold;
 634                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
 635                         rdev->wiphy.rts_threshold = rts_threshold;
 636
 637                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
 638                 if (result) {
 639                         rdev->wiphy.retry_short = old_retry_short;
 640                         rdev->wiphy.retry_long = old_retry_long;
 641                         rdev->wiphy.frag_threshold = old_frag_threshold;
 642                         rdev->wiphy.rts_threshold = old_rts_threshold;
 643                 }
 644         }
 645
 646  bad_res:
 647         mutex_unlock(&rdev->mtx);
 648  unlock:
 649         rtnl_unlock();
 650         return result;
 651 }
 652
 653
 654 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 655                               struct cfg80211_registered_device *rdev,
 656                               struct net_device *dev)
 657 {
 658         void *hdr;
 659
 660         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
 661         if (!hdr)
 662                 return -1;
 663
 664         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 665         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 666         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
 667         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
 668         return genlmsg_end(msg, hdr);
 669
 670  nla_put_failure:
 671         genlmsg_cancel(msg, hdr);
 672         return -EMSGSIZE;
 673 }
 674
 675 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
 676 {
 677         int wp_idx = 0;
 678         int if_idx = 0;
 679         int wp_start = cb->args[0];
 680         int if_start = cb->args[1];
 681         struct cfg80211_registered_device *dev;
 682         struct wireless_dev *wdev;
 683
 684         mutex_lock(&cfg80211_mutex);
 685         list_for_each_entry(dev, &cfg80211_drv_list, list) {
 686                 if (wp_idx < wp_start) {
 687                         wp_idx++;
 688                         continue;
 689                 }
 690                 if_idx = 0;
 691
 692                 mutex_lock(&dev->devlist_mtx);
 693                 list_for_each_entry(wdev, &dev->netdev_list, list) {
 694                         if (if_idx < if_start) {
 695                                 if_idx++;
 696                                 continue;
 697                         }
 698                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
 699                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
 700                                                dev, wdev->netdev) < 0) {
 701                                 mutex_unlock(&dev->devlist_mtx);
 702                                 goto out;
 703                         }
 704                         if_idx++;
 705                 }
 706                 mutex_unlock(&dev->devlist_mtx);
 707
 708                 wp_idx++;
 709         }
 710  out:
 711         mutex_unlock(&cfg80211_mutex);
 712
 713         cb->args[0] = wp_idx;
 714         cb->args[1] = if_idx;
 715
 716         return skb->len;
 717 }
 718
 719 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
 720 {
 721         struct sk_buff *msg;
 722         struct cfg80211_registered_device *dev;
 723         struct net_device *netdev;
 724         int err;
 725
 726         err = get_drv_dev_by_info_ifindex(info->attrs, &dev, &netdev);
 727         if (err)
 728                 return err;
 729
 730         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 731         if (!msg)
 732                 goto out_err;
 733
 734         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
 735                                dev, netdev) < 0)
 736                 goto out_free;
 737
 738         dev_put(netdev);
 739         cfg80211_put_dev(dev);
 740
 741         return genlmsg_unicast(msg, info->snd_pid);
 742
 743  out_free:
 744         nlmsg_free(msg);
 745  out_err:
 746         dev_put(netdev);
 747         cfg80211_put_dev(dev);
 748         return -ENOBUFS;
 749 }
 750
 751 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
 752         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
 753         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
 754         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
 755         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
 756         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
 757 };
 758
 759 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
 760 {
 761         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
 762         int flag;
 763
 764         *mntrflags = 0;
 765
 766         if (!nla)
 767                 return -EINVAL;
 768
 769         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
 770                              nla, mntr_flags_policy))
 771                 return -EINVAL;
 772
 773         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
 774                 if (flags[flag])
 775                         *mntrflags |= (1<<flag);
 776
 777         return 0;
 778 }
 779
 780 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 781 {
 782         struct cfg80211_registered_device *drv;
 783         struct vif_params params;
 784         int err;
 785         enum nl80211_iftype otype, ntype;
 786         struct net_device *dev;
 787         u32 _flags, *flags = NULL;
 788         bool change = false;
 789
 790         memset(&params, 0, sizeof(params));
 791
 792         rtnl_lock();
 793
 794         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 795         if (err)
 796                 goto unlock_rtnl;
 797
 798         otype = ntype = dev->ieee80211_ptr->iftype;
 799
 800         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 801                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 802                 if (otype != ntype)
 803                         change = true;
 804                 if (ntype > NL80211_IFTYPE_MAX) {
 805                         err = -EINVAL;
 806                         goto unlock;
 807                 }
 808         }
 809
 810         if (!drv->ops->change_virtual_intf ||
 811             !(drv->wiphy.interface_modes & (1 << ntype))) {
 812                 err = -EOPNOTSUPP;
 813                 goto unlock;
 814         }
 815
 816         if (info->attrs[NL80211_ATTR_MESH_ID]) {
 817                 if (ntype != NL80211_IFTYPE_MESH_POINT) {
 818                         err = -EINVAL;
 819                         goto unlock;
 820                 }
 821                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 822                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 823                 change = true;
 824         }
 825
 826         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
 827                 if (ntype != NL80211_IFTYPE_MONITOR) {
 828                         err = -EINVAL;
 829                         goto unlock;
 830                 }
 831                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
 832                                           &_flags);
 833                 if (err)
 834                         goto unlock;
 835
 836                 flags = &_flags;
 837                 change = true;
 838         }
 839
 840         if (change)
 841                 err = drv->ops->change_virtual_intf(&drv->wiphy, dev,
 842                                                     ntype, flags, &params);
 843         else
 844                 err = 0;
 845
 846         WARN_ON(!err && dev->ieee80211_ptr->iftype != ntype);
 847
 848         if (!err && (ntype != otype)) {
 849                 if (otype == NL80211_IFTYPE_ADHOC)
 850                         cfg80211_clear_ibss(dev, false);
 851         }
 852
 853  unlock:
 854         dev_put(dev);
 855         cfg80211_put_dev(drv);
 856  unlock_rtnl:
 857         rtnl_unlock();
 858         return err;
 859 }
 860
 861 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
 862 {
 863         struct cfg80211_registered_device *drv;
 864         struct vif_params params;
 865         int err;
 866         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
 867         u32 flags;
 868
 869         memset(&params, 0, sizeof(params));
 870
 871         if (!info->attrs[NL80211_ATTR_IFNAME])
 872                 return -EINVAL;
 873
 874         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 875                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 876                 if (type > NL80211_IFTYPE_MAX)
 877                         return -EINVAL;
 878         }
 879
 880         rtnl_lock();
 881
 882         drv = cfg80211_get_dev_from_info(info);
 883         if (IS_ERR(drv)) {
 884                 err = PTR_ERR(drv);
 885                 goto unlock_rtnl;
 886         }
 887
 888         if (!drv->ops->add_virtual_intf ||
 889             !(drv->wiphy.interface_modes & (1 << type))) {
 890                 err = -EOPNOTSUPP;
 891                 goto unlock;
 892         }
 893
 894         if (type == NL80211_IFTYPE_MESH_POINT &&
 895             info->attrs[NL80211_ATTR_MESH_ID]) {
 896                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 897                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 898         }
 899
 900         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
 901                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
 902                                   &flags);
 903         err = drv->ops->add_virtual_intf(&drv->wiphy,
 904                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
 905                 type, err ? NULL : &flags, &params);
 906
 907  unlock:
 908         cfg80211_put_dev(drv);
 909  unlock_rtnl:
 910         rtnl_unlock();
 911         return err;
 912 }
 913
 914 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
 915 {
 916         struct cfg80211_registered_device *drv;
 917         int ifindex, err;
 918         struct net_device *dev;
 919
 920         rtnl_lock();
 921
 922         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 923         if (err)
 924                 goto unlock_rtnl;
 925         ifindex = dev->ifindex;
 926         dev_put(dev);
 927
 928         if (!drv->ops->del_virtual_intf) {
 929                 err = -EOPNOTSUPP;
 930                 goto out;
 931         }
 932
 933         err = drv->ops->del_virtual_intf(&drv->wiphy, ifindex);
 934
 935  out:
 936         cfg80211_put_dev(drv);
 937  unlock_rtnl:
 938         rtnl_unlock();
 939         return err;
 940 }
 941
 942 struct get_key_cookie {
 943         struct sk_buff *msg;
 944         int error;
 945 };
 946
 947 static void get_key_callback(void *c, struct key_params *params)
 948 {
 949         struct get_key_cookie *cookie = c;
 950
 951         if (params->key)
 952                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
 953                         params->key_len, params->key);
 954
 955         if (params->seq)
 956                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
 957                         params->seq_len, params->seq);
 958
 959         if (params->cipher)
 960                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
 961                             params->cipher);
 962
 963         return;
 964  nla_put_failure:
 965         cookie->error = 1;
 966 }
 967
 968 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
 969 {
 970         struct cfg80211_registered_device *drv;
 971         int err;
 972         struct net_device *dev;
 973         u8 key_idx = 0;
 974         u8 *mac_addr = NULL;
 975         struct get_key_cookie cookie = {
 976                 .error = 0,
 977         };
 978         void *hdr;
 979         struct sk_buff *msg;
 980
 981         if (info->attrs[NL80211_ATTR_KEY_IDX])
 982                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 983
 984         if (key_idx > 5)
 985                 return -EINVAL;
 986
 987         if (info->attrs[NL80211_ATTR_MAC])
 988                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 989
 990         rtnl_lock();
 991
 992         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 993         if (err)
 994                 goto unlock_rtnl;
 995
 996         if (!drv->ops->get_key) {
 997                 err = -EOPNOTSUPP;
 998                 goto out;
 999         }
1000
1001         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1002         if (!msg) {
1003                 err = -ENOMEM;
1004                 goto out;
1005         }
1006
1007         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
1008                              NL80211_CMD_NEW_KEY);
1009
1010         if (IS_ERR(hdr)) {
1011                 err = PTR_ERR(hdr);
1012                 goto out;
1013         }
1014
1015         cookie.msg = msg;
1016
1017         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1018         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1019         if (mac_addr)
1020                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1021
1022         err = drv->ops->get_key(&drv->wiphy, dev, key_idx, mac_addr,
1023                                 &cookie, get_key_callback);
1024
1025         if (err)
1026                 goto out;
1027
1028         if (cookie.error)
1029                 goto nla_put_failure;
1030
1031         genlmsg_end(msg, hdr);
1032         err = genlmsg_unicast(msg, info->snd_pid);
1033         goto out;
1034
1035  nla_put_failure:
1036         err = -ENOBUFS;
1037         nlmsg_free(msg);
1038  out:
1039         cfg80211_put_dev(drv);
1040         dev_put(dev);
1041  unlock_rtnl:
1042         rtnl_unlock();
1043
1044         return err;
1045 }
1046
1047 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1048 {
1049         struct cfg80211_registered_device *drv;
1050         int err;
1051         struct net_device *dev;
1052         u8 key_idx;
1053         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
1054                     u8 key_index);
1055
1056         if (!info->attrs[NL80211_ATTR_KEY_IDX])
1057                 return -EINVAL;
1058
1059         key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1060
1061         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]) {
1062                 if (key_idx < 4 || key_idx > 5)
1063                         return -EINVAL;
1064         } else if (key_idx > 3)
1065                 return -EINVAL;
1066
1067         /* currently only support setting default key */
1068         if (!info->attrs[NL80211_ATTR_KEY_DEFAULT] &&
1069             !info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT])
1070                 return -EINVAL;
1071
1072         rtnl_lock();
1073
1074         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1075         if (err)
1076                 goto unlock_rtnl;
1077
1078         if (info->attrs[NL80211_ATTR_KEY_DEFAULT])
1079                 func = drv->ops->set_default_key;
1080         else
1081                 func = drv->ops->set_default_mgmt_key;
1082
1083         if (!func) {
1084                 err = -EOPNOTSUPP;
1085                 goto out;
1086         }
1087
1088         err = func(&drv->wiphy, dev, key_idx);
1089 #ifdef CONFIG_WIRELESS_EXT
1090         if (!err) {
1091                 if (func == drv->ops->set_default_key)
1092                         dev->ieee80211_ptr->wext.default_key = key_idx;
1093                 else
1094                         dev->ieee80211_ptr->wext.default_mgmt_key = key_idx;
1095         }
1096 #endif
1097
1098  out:
1099         cfg80211_put_dev(drv);
1100         dev_put(dev);
1101
1102  unlock_rtnl:
1103         rtnl_unlock();
1104
1105         return err;
1106 }
1107
1108 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1109 {
1110         struct cfg80211_registered_device *drv;
1111         int err, i;
1112         struct net_device *dev;
1113         struct key_params params;
1114         u8 key_idx = 0;
1115         u8 *mac_addr = NULL;
1116
1117         memset(&params, 0, sizeof(params));
1118
1119         if (!info->attrs[NL80211_ATTR_KEY_CIPHER])
1120                 return -EINVAL;
1121
1122         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1123                 params.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1124                 params.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1125         }
1126
1127         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
1128                 params.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
1129                 params.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
1130         }
1131
1132         if (info->attrs[NL80211_ATTR_KEY_IDX])
1133                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1134
1135         params.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1136
1137         if (info->attrs[NL80211_ATTR_MAC])
1138                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1139
1140         if (cfg80211_validate_key_settings(&params, key_idx, mac_addr))
1141                 return -EINVAL;
1142
1143         rtnl_lock();
1144
1145         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1146         if (err)
1147                 goto unlock_rtnl;
1148
1149         for (i = 0; i < drv->wiphy.n_cipher_suites; i++)
1150                 if (params.cipher == drv->wiphy.cipher_suites[i])
1151                         break;
1152         if (i == drv->wiphy.n_cipher_suites) {
1153                 err = -EINVAL;
1154                 goto out;
1155         }
1156
1157         if (!drv->ops->add_key) {
1158                 err = -EOPNOTSUPP;
1159                 goto out;
1160         }
1161
1162         err = drv->ops->add_key(&drv->wiphy, dev, key_idx, mac_addr, &params);
1163
1164  out:
1165         cfg80211_put_dev(drv);
1166         dev_put(dev);
1167  unlock_rtnl:
1168         rtnl_unlock();
1169
1170         return err;
1171 }
1172
1173 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1174 {
1175         struct cfg80211_registered_device *drv;
1176         int err;
1177         struct net_device *dev;
1178         u8 key_idx = 0;
1179         u8 *mac_addr = NULL;
1180
1181         if (info->attrs[NL80211_ATTR_KEY_IDX])
1182                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1183
1184         if (key_idx > 5)
1185                 return -EINVAL;
1186
1187         if (info->attrs[NL80211_ATTR_MAC])
1188                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1189
1190         rtnl_lock();
1191
1192         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1193         if (err)
1194                 goto unlock_rtnl;
1195
1196         if (!drv->ops->del_key) {
1197                 err = -EOPNOTSUPP;
1198                 goto out;
1199         }
1200
1201         err = drv->ops->del_key(&drv->wiphy, dev, key_idx, mac_addr);
1202
1203 #ifdef CONFIG_WIRELESS_EXT
1204         if (!err) {
1205                 if (key_idx == dev->ieee80211_ptr->wext.default_key)
1206                         dev->ieee80211_ptr->wext.default_key = -1;
1207                 else if (key_idx == dev->ieee80211_ptr->wext.default_mgmt_key)
1208                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
1209         }
1210 #endif
1211
1212  out:
1213         cfg80211_put_dev(drv);
1214         dev_put(dev);
1215
1216  unlock_rtnl:
1217         rtnl_unlock();
1218
1219         return err;
1220 }
1221
1222 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1223 {
1224         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1225                     struct beacon_parameters *info);
1226         struct cfg80211_registered_device *drv;
1227         int err;
1228         struct net_device *dev;
1229         struct beacon_parameters params;
1230         int haveinfo = 0;
1231
1232         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
1233                 return -EINVAL;
1234
1235         rtnl_lock();
1236
1237         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1238         if (err)
1239                 goto unlock_rtnl;
1240
1241         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1242                 err = -EOPNOTSUPP;
1243                 goto out;
1244         }
1245
1246         switch (info->genlhdr->cmd) {
1247         case NL80211_CMD_NEW_BEACON:
1248                 /* these are required for NEW_BEACON */
1249                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1250                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1251                     !info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1252                         err = -EINVAL;
1253                         goto out;
1254                 }
1255
1256                 call = drv->ops->add_beacon;
1257                 break;
1258         case NL80211_CMD_SET_BEACON:
1259                 call = drv->ops->set_beacon;
1260                 break;
1261         default:
1262                 WARN_ON(1);
1263                 err = -EOPNOTSUPP;
1264                 goto out;
1265         }
1266
1267         if (!call) {
1268                 err = -EOPNOTSUPP;
1269                 goto out;
1270         }
1271
1272         memset(&params, 0, sizeof(params));
1273
1274         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1275                 params.interval =
1276                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1277                 haveinfo = 1;
1278         }
1279
1280         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1281                 params.dtim_period =
1282                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1283                 haveinfo = 1;
1284         }
1285
1286         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1287                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1288                 params.head_len =
1289                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1290                 haveinfo = 1;
1291         }
1292
1293         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1294                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1295                 params.tail_len =
1296                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1297                 haveinfo = 1;
1298         }
1299
1300         if (!haveinfo) {
1301                 err = -EINVAL;
1302                 goto out;
1303         }
1304
1305         err = call(&drv->wiphy, dev, &params);
1306
1307  out:
1308         cfg80211_put_dev(drv);
1309         dev_put(dev);
1310  unlock_rtnl:
1311         rtnl_unlock();
1312
1313         return err;
1314 }
1315
1316 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1317 {
1318         struct cfg80211_registered_device *drv;
1319         int err;
1320         struct net_device *dev;
1321
1322         rtnl_lock();
1323
1324         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1325         if (err)
1326                 goto unlock_rtnl;
1327
1328         if (!drv->ops->del_beacon) {
1329                 err = -EOPNOTSUPP;
1330                 goto out;
1331         }
1332
1333         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1334                 err = -EOPNOTSUPP;
1335                 goto out;
1336         }
1337         err = drv->ops->del_beacon(&drv->wiphy, dev);
1338
1339  out:
1340         cfg80211_put_dev(drv);
1341         dev_put(dev);
1342  unlock_rtnl:
1343         rtnl_unlock();
1344
1345         return err;
1346 }
1347
1348 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1349         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1350         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1351         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1352         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
1353 };
1354
1355 static int parse_station_flags(struct genl_info *info,
1356                                struct station_parameters *params)
1357 {
1358         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1359         struct nlattr *nla;
1360         int flag;
1361
1362         /*
1363          * Try parsing the new attribute first so userspace
1364          * can specify both for older kernels.
1365          */
1366         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
1367         if (nla) {
1368                 struct nl80211_sta_flag_update *sta_flags;
1369
1370                 sta_flags = nla_data(nla);
1371                 params->sta_flags_mask = sta_flags->mask;
1372                 params->sta_flags_set = sta_flags->set;
1373                 if ((params->sta_flags_mask |
1374                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
1375                         return -EINVAL;
1376                 return 0;
1377         }
1378
1379         /* if present, parse the old attribute */
1380
1381         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
1382         if (!nla)
1383                 return 0;
1384
1385         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1386                              nla, sta_flags_policy))
1387                 return -EINVAL;
1388
1389         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
1390         params->sta_flags_mask &= ~1;
1391
1392         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1393                 if (flags[flag])
1394                         params->sta_flags_set |= (1<<flag);
1395
1396         return 0;
1397 }
1398
1399 static u16 nl80211_calculate_bitrate(struct rate_info *rate)
1400 {
1401         int modulation, streams, bitrate;
1402
1403         if (!(rate->flags & RATE_INFO_FLAGS_MCS))
1404                 return rate->legacy;
1405
1406         /* the formula below does only work for MCS values smaller than 32 */
1407         if (rate->mcs >= 32)
1408                 return 0;
1409
1410         modulation = rate->mcs & 7;
1411         streams = (rate->mcs >> 3) + 1;
1412
1413         bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
1414                         13500000 : 6500000;
1415
1416         if (modulation < 4)
1417                 bitrate *= (modulation + 1);
1418         else if (modulation == 4)
1419                 bitrate *= (modulation + 2);
1420         else
1421                 bitrate *= (modulation + 3);
1422
1423         bitrate *= streams;
1424
1425         if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
1426                 bitrate = (bitrate / 9) * 10;
1427
1428         /* do NOT round down here */
1429         return (bitrate + 50000) / 100000;
1430 }
1431
1432 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1433                                 int flags, struct net_device *dev,
1434                                 u8 *mac_addr, struct station_info *sinfo)
1435 {
1436         void *hdr;
1437         struct nlattr *sinfoattr, *txrate;
1438         u16 bitrate;
1439
1440         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1441         if (!hdr)
1442                 return -1;
1443
1444         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1445         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1446
1447         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1448         if (!sinfoattr)
1449                 goto nla_put_failure;
1450         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1451                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1452                             sinfo->inactive_time);
1453         if (sinfo->filled & STATION_INFO_RX_BYTES)
1454                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1455                             sinfo->rx_bytes);
1456         if (sinfo->filled & STATION_INFO_TX_BYTES)
1457                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1458                             sinfo->tx_bytes);
1459         if (sinfo->filled & STATION_INFO_LLID)
1460                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1461                             sinfo->llid);
1462         if (sinfo->filled & STATION_INFO_PLID)
1463                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1464                             sinfo->plid);
1465         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1466                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1467                             sinfo->plink_state);
1468         if (sinfo->filled & STATION_INFO_SIGNAL)
1469                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1470                            sinfo->signal);
1471         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1472                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1473                 if (!txrate)
1474                         goto nla_put_failure;
1475
1476                 /* nl80211_calculate_bitrate will return 0 for mcs >= 32 */
1477                 bitrate = nl80211_calculate_bitrate(&sinfo->txrate);
1478                 if (bitrate > 0)
1479                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1480
1481                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1482                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1483                                     sinfo->txrate.mcs);
1484                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1485                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1486                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1487                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1488
1489                 nla_nest_end(msg, txrate);
1490         }
1491         if (sinfo->filled & STATION_INFO_RX_PACKETS)
1492                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
1493                             sinfo->rx_packets);
1494         if (sinfo->filled & STATION_INFO_TX_PACKETS)
1495                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
1496                             sinfo->tx_packets);
1497         nla_nest_end(msg, sinfoattr);
1498
1499         return genlmsg_end(msg, hdr);
1500
1501  nla_put_failure:
1502         genlmsg_cancel(msg, hdr);
1503         return -EMSGSIZE;
1504 }
1505
1506 static int nl80211_dump_station(struct sk_buff *skb,
1507                                 struct netlink_callback *cb)
1508 {
1509         struct station_info sinfo;
1510         struct cfg80211_registered_device *dev;
1511         struct net_device *netdev;
1512         u8 mac_addr[ETH_ALEN];
1513         int ifidx = cb->args[0];
1514         int sta_idx = cb->args[1];
1515         int err;
1516
1517         if (!ifidx) {
1518                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1519                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1520                                   nl80211_policy);
1521                 if (err)
1522                         return err;
1523
1524                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1525                         return -EINVAL;
1526
1527                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1528                 if (!ifidx)
1529                         return -EINVAL;
1530         }
1531
1532         rtnl_lock();
1533
1534         netdev = __dev_get_by_index(&init_net, ifidx);
1535         if (!netdev) {
1536                 err = -ENODEV;
1537                 goto out_rtnl;
1538         }
1539
1540         dev = cfg80211_get_dev_from_ifindex(ifidx);
1541         if (IS_ERR(dev)) {
1542                 err = PTR_ERR(dev);
1543                 goto out_rtnl;
1544         }
1545
1546         if (!dev->ops->dump_station) {
1547                 err = -EOPNOTSUPP;
1548                 goto out_err;
1549         }
1550
1551         while (1) {
1552                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1553                                              mac_addr, &sinfo);
1554                 if (err == -ENOENT)
1555                         break;
1556                 if (err)
1557                         goto out_err;
1558
1559                 if (nl80211_send_station(skb,
1560                                 NETLINK_CB(cb->skb).pid,
1561                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
1562                                 netdev, mac_addr,
1563                                 &sinfo) < 0)
1564                         goto out;
1565
1566                 sta_idx++;
1567         }
1568
1569
1570  out:
1571         cb->args[1] = sta_idx;
1572         err = skb->len;
1573  out_err:
1574         cfg80211_put_dev(dev);
1575  out_rtnl:
1576         rtnl_unlock();
1577
1578         return err;
1579 }
1580
1581 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1582 {
1583         struct cfg80211_registered_device *drv;
1584         int err;
1585         struct net_device *dev;
1586         struct station_info sinfo;
1587         struct sk_buff *msg;
1588         u8 *mac_addr = NULL;
1589
1590         memset(&sinfo, 0, sizeof(sinfo));
1591
1592         if (!info->attrs[NL80211_ATTR_MAC])
1593                 return -EINVAL;
1594
1595         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1596
1597         rtnl_lock();
1598
1599         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1600         if (err)
1601                 goto out_rtnl;
1602
1603         if (!drv->ops->get_station) {
1604                 err = -EOPNOTSUPP;
1605                 goto out;
1606         }
1607
1608         err = drv->ops->get_station(&drv->wiphy, dev, mac_addr, &sinfo);
1609         if (err)
1610                 goto out;
1611
1612         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1613         if (!msg)
1614                 goto out;
1615
1616         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1617                                  dev, mac_addr, &sinfo) < 0)
1618                 goto out_free;
1619
1620         err = genlmsg_unicast(msg, info->snd_pid);
1621         goto out;
1622
1623  out_free:
1624         nlmsg_free(msg);
1625  out:
1626         cfg80211_put_dev(drv);
1627         dev_put(dev);
1628  out_rtnl:
1629         rtnl_unlock();
1630
1631         return err;
1632 }
1633
1634 /*
1635  * Get vlan interface making sure it is on the right wiphy.
1636  */
1637 static int get_vlan(struct nlattr *vlanattr,
1638                     struct cfg80211_registered_device *rdev,
1639                     struct net_device **vlan)
1640 {
1641         *vlan = NULL;
1642
1643         if (vlanattr) {
1644                 *vlan = dev_get_by_index(&init_net, nla_get_u32(vlanattr));
1645                 if (!*vlan)
1646                         return -ENODEV;
1647                 if (!(*vlan)->ieee80211_ptr)
1648                         return -EINVAL;
1649                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
1650                         return -EINVAL;
1651         }
1652         return 0;
1653 }
1654
1655 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
1656 {
1657         struct cfg80211_registered_device *drv;
1658         int err;
1659         struct net_device *dev;
1660         struct station_parameters params;
1661         u8 *mac_addr = NULL;
1662
1663         memset(&params, 0, sizeof(params));
1664
1665         params.listen_interval = -1;
1666
1667         if (info->attrs[NL80211_ATTR_STA_AID])
1668                 return -EINVAL;
1669
1670         if (!info->attrs[NL80211_ATTR_MAC])
1671                 return -EINVAL;
1672
1673         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1674
1675         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
1676                 params.supported_rates =
1677                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1678                 params.supported_rates_len =
1679                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1680         }
1681
1682         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1683                 params.listen_interval =
1684                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1685
1686         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1687                 params.ht_capa =
1688                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1689
1690         if (parse_station_flags(info, &params))
1691                 return -EINVAL;
1692
1693         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
1694                 params.plink_action =
1695                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
1696
1697         rtnl_lock();
1698
1699         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1700         if (err)
1701                 goto out_rtnl;
1702
1703         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1704         if (err)
1705                 goto out;
1706
1707         /* validate settings */
1708         err = 0;
1709
1710         switch (dev->ieee80211_ptr->iftype) {
1711         case NL80211_IFTYPE_AP:
1712         case NL80211_IFTYPE_AP_VLAN:
1713                 /* disallow mesh-specific things */
1714                 if (params.plink_action)
1715                         err = -EINVAL;
1716                 break;
1717         case NL80211_IFTYPE_STATION:
1718                 /* disallow everything but AUTHORIZED flag */
1719                 if (params.plink_action)
1720                         err = -EINVAL;
1721                 if (params.vlan)
1722                         err = -EINVAL;
1723                 if (params.supported_rates)
1724                         err = -EINVAL;
1725                 if (params.ht_capa)
1726                         err = -EINVAL;
1727                 if (params.listen_interval >= 0)
1728                         err = -EINVAL;
1729                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
1730                         err = -EINVAL;
1731                 break;
1732         case NL80211_IFTYPE_MESH_POINT:
1733                 /* disallow things mesh doesn't support */
1734                 if (params.vlan)
1735                         err = -EINVAL;
1736                 if (params.ht_capa)
1737                         err = -EINVAL;
1738                 if (params.listen_interval >= 0)
1739                         err = -EINVAL;
1740                 if (params.supported_rates)
1741                         err = -EINVAL;
1742                 if (params.sta_flags_mask)
1743                         err = -EINVAL;
1744                 break;
1745         default:
1746                 err = -EINVAL;
1747         }
1748
1749         if (err)
1750                 goto out;
1751
1752         if (!drv->ops->change_station) {
1753                 err = -EOPNOTSUPP;
1754                 goto out;
1755         }
1756
1757         err = drv->ops->change_station(&drv->wiphy, dev, mac_addr, &params);
1758
1759  out:
1760         if (params.vlan)
1761                 dev_put(params.vlan);
1762         cfg80211_put_dev(drv);
1763         dev_put(dev);
1764  out_rtnl:
1765         rtnl_unlock();
1766
1767         return err;
1768 }
1769
1770 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
1771 {
1772         struct cfg80211_registered_device *drv;
1773         int err;
1774         struct net_device *dev;
1775         struct station_parameters params;
1776         u8 *mac_addr = NULL;
1777
1778         memset(&params, 0, sizeof(params));
1779
1780         if (!info->attrs[NL80211_ATTR_MAC])
1781                 return -EINVAL;
1782
1783         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1784                 return -EINVAL;
1785
1786         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
1787                 return -EINVAL;
1788
1789         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1790         params.supported_rates =
1791                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1792         params.supported_rates_len =
1793                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1794         params.listen_interval =
1795                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1796
1797         if (info->attrs[NL80211_ATTR_STA_AID]) {
1798                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
1799                 if (!params.aid || params.aid > IEEE80211_MAX_AID)
1800                         return -EINVAL;
1801         }
1802
1803         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1804                 params.ht_capa =
1805                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1806
1807         if (parse_station_flags(info, &params))
1808                 return -EINVAL;
1809
1810         rtnl_lock();
1811
1812         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1813         if (err)
1814                 goto out_rtnl;
1815
1816         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1817         if (err)
1818                 goto out;
1819
1820         /* validate settings */
1821         err = 0;
1822
1823         switch (dev->ieee80211_ptr->iftype) {
1824         case NL80211_IFTYPE_AP:
1825         case NL80211_IFTYPE_AP_VLAN:
1826                 /* all ok but must have AID */
1827                 if (!params.aid)
1828                         err = -EINVAL;
1829                 break;
1830         case NL80211_IFTYPE_MESH_POINT:
1831                 /* disallow things mesh doesn't support */
1832                 if (params.vlan)
1833                         err = -EINVAL;
1834                 if (params.aid)
1835                         err = -EINVAL;
1836                 if (params.ht_capa)
1837                         err = -EINVAL;
1838                 if (params.listen_interval >= 0)
1839                         err = -EINVAL;
1840                 if (params.supported_rates)
1841                         err = -EINVAL;
1842                 if (params.sta_flags_mask)
1843                         err = -EINVAL;
1844                 break;
1845         default:
1846                 err = -EINVAL;
1847         }
1848
1849         if (err)
1850                 goto out;
1851
1852         if (!drv->ops->add_station) {
1853                 err = -EOPNOTSUPP;
1854                 goto out;
1855         }
1856
1857         if (!netif_running(dev)) {
1858                 err = -ENETDOWN;
1859                 goto out;
1860         }
1861
1862         err = drv->ops->add_station(&drv->wiphy, dev, mac_addr, &params);
1863
1864  out:
1865         if (params.vlan)
1866                 dev_put(params.vlan);
1867         cfg80211_put_dev(drv);
1868         dev_put(dev);
1869  out_rtnl:
1870         rtnl_unlock();
1871
1872         return err;
1873 }
1874
1875 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
1876 {
1877         struct cfg80211_registered_device *drv;
1878         int err;
1879         struct net_device *dev;
1880         u8 *mac_addr = NULL;
1881
1882         if (info->attrs[NL80211_ATTR_MAC])
1883                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1884
1885         rtnl_lock();
1886
1887         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1888         if (err)
1889                 goto out_rtnl;
1890
1891         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1892             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
1893             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1894                 err = -EINVAL;
1895                 goto out;
1896         }
1897
1898         if (!drv->ops->del_station) {
1899                 err = -EOPNOTSUPP;
1900                 goto out;
1901         }
1902
1903         err = drv->ops->del_station(&drv->wiphy, dev, mac_addr);
1904
1905  out:
1906         cfg80211_put_dev(drv);
1907         dev_put(dev);
1908  out_rtnl:
1909         rtnl_unlock();
1910
1911         return err;
1912 }
1913
1914 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
1915                                 int flags, struct net_device *dev,
1916                                 u8 *dst, u8 *next_hop,
1917                                 struct mpath_info *pinfo)
1918 {
1919         void *hdr;
1920         struct nlattr *pinfoattr;
1921
1922         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1923         if (!hdr)
1924                 return -1;
1925
1926         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1927         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
1928         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
1929
1930         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
1931         if (!pinfoattr)
1932                 goto nla_put_failure;
1933         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
1934                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
1935                             pinfo->frame_qlen);
1936         if (pinfo->filled & MPATH_INFO_DSN)
1937                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DSN,
1938                             pinfo->dsn);
1939         if (pinfo->filled & MPATH_INFO_METRIC)
1940                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
1941                             pinfo->metric);
1942         if (pinfo->filled & MPATH_INFO_EXPTIME)
1943                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
1944                             pinfo->exptime);
1945         if (pinfo->filled & MPATH_INFO_FLAGS)
1946                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
1947                             pinfo->flags);
1948         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
1949                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
1950                             pinfo->discovery_timeout);
1951         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
1952                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
1953                             pinfo->discovery_retries);
1954
1955         nla_nest_end(msg, pinfoattr);
1956
1957         return genlmsg_end(msg, hdr);
1958
1959  nla_put_failure:
1960         genlmsg_cancel(msg, hdr);
1961         return -EMSGSIZE;
1962 }
1963
1964 static int nl80211_dump_mpath(struct sk_buff *skb,
1965                               struct netlink_callback *cb)
1966 {
1967         struct mpath_info pinfo;
1968         struct cfg80211_registered_device *dev;
1969         struct net_device *netdev;
1970         u8 dst[ETH_ALEN];
1971         u8 next_hop[ETH_ALEN];
1972         int ifidx = cb->args[0];
1973         int path_idx = cb->args[1];
1974         int err;
1975
1976         if (!ifidx) {
1977                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1978                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1979                                   nl80211_policy);
1980                 if (err)
1981                         return err;
1982
1983                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1984                         return -EINVAL;
1985
1986                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1987                 if (!ifidx)
1988                         return -EINVAL;
1989         }
1990
1991         rtnl_lock();
1992
1993         netdev = __dev_get_by_index(&init_net, ifidx);
1994         if (!netdev) {
1995                 err = -ENODEV;
1996                 goto out_rtnl;
1997         }
1998
1999         dev = cfg80211_get_dev_from_ifindex(ifidx);
2000         if (IS_ERR(dev)) {
2001                 err = PTR_ERR(dev);
2002                 goto out_rtnl;
2003         }
2004
2005         if (!dev->ops->dump_mpath) {
2006                 err = -EOPNOTSUPP;
2007                 goto out_err;
2008         }
2009
2010         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2011                 err = -EOPNOTSUPP;
2012                 goto out;
2013         }
2014
2015         while (1) {
2016                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
2017                                            dst, next_hop, &pinfo);
2018                 if (err == -ENOENT)
2019                         break;
2020                 if (err)
2021                         goto out_err;
2022
2023                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
2024                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
2025                                        netdev, dst, next_hop,
2026                                        &pinfo) < 0)
2027                         goto out;
2028
2029                 path_idx++;
2030         }
2031
2032
2033  out:
2034         cb->args[1] = path_idx;
2035         err = skb->len;
2036  out_err:
2037         cfg80211_put_dev(dev);
2038  out_rtnl:
2039         rtnl_unlock();
2040
2041         return err;
2042 }
2043
2044 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
2045 {
2046         struct cfg80211_registered_device *drv;
2047         int err;
2048         struct net_device *dev;
2049         struct mpath_info pinfo;
2050         struct sk_buff *msg;
2051         u8 *dst = NULL;
2052         u8 next_hop[ETH_ALEN];
2053
2054         memset(&pinfo, 0, sizeof(pinfo));
2055
2056         if (!info->attrs[NL80211_ATTR_MAC])
2057                 return -EINVAL;
2058
2059         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2060
2061         rtnl_lock();
2062
2063         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2064         if (err)
2065                 goto out_rtnl;
2066
2067         if (!drv->ops->get_mpath) {
2068                 err = -EOPNOTSUPP;
2069                 goto out;
2070         }
2071
2072         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2073                 err = -EOPNOTSUPP;
2074                 goto out;
2075         }
2076
2077         err = drv->ops->get_mpath(&drv->wiphy, dev, dst, next_hop, &pinfo);
2078         if (err)
2079                 goto out;
2080
2081         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2082         if (!msg)
2083                 goto out;
2084
2085         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2086                                  dev, dst, next_hop, &pinfo) < 0)
2087                 goto out_free;
2088
2089         err = genlmsg_unicast(msg, info->snd_pid);
2090         goto out;
2091
2092  out_free:
2093         nlmsg_free(msg);
2094  out:
2095         cfg80211_put_dev(drv);
2096         dev_put(dev);
2097  out_rtnl:
2098         rtnl_unlock();
2099
2100         return err;
2101 }
2102
2103 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2104 {
2105         struct cfg80211_registered_device *drv;
2106         int err;
2107         struct net_device *dev;
2108         u8 *dst = NULL;
2109         u8 *next_hop = NULL;
2110
2111         if (!info->attrs[NL80211_ATTR_MAC])
2112                 return -EINVAL;
2113
2114         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2115                 return -EINVAL;
2116
2117         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2118         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2119
2120         rtnl_lock();
2121
2122         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2123         if (err)
2124                 goto out_rtnl;
2125
2126         if (!drv->ops->change_mpath) {
2127                 err = -EOPNOTSUPP;
2128                 goto out;
2129         }
2130
2131         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2132                 err = -EOPNOTSUPP;
2133                 goto out;
2134         }
2135
2136         if (!netif_running(dev)) {
2137                 err = -ENETDOWN;
2138                 goto out;
2139         }
2140
2141         err = drv->ops->change_mpath(&drv->wiphy, dev, dst, next_hop);
2142
2143  out:
2144         cfg80211_put_dev(drv);
2145         dev_put(dev);
2146  out_rtnl:
2147         rtnl_unlock();
2148
2149         return err;
2150 }
2151 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2152 {
2153         struct cfg80211_registered_device *drv;
2154         int err;
2155         struct net_device *dev;
2156         u8 *dst = NULL;
2157         u8 *next_hop = NULL;
2158
2159         if (!info->attrs[NL80211_ATTR_MAC])
2160                 return -EINVAL;
2161
2162         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2163                 return -EINVAL;
2164
2165         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2166         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2167
2168         rtnl_lock();
2169
2170         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2171         if (err)
2172                 goto out_rtnl;
2173
2174         if (!drv->ops->add_mpath) {
2175                 err = -EOPNOTSUPP;
2176                 goto out;
2177         }
2178
2179         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2180                 err = -EOPNOTSUPP;
2181                 goto out;
2182         }
2183
2184         if (!netif_running(dev)) {
2185                 err = -ENETDOWN;
2186                 goto out;
2187         }
2188
2189         err = drv->ops->add_mpath(&drv->wiphy, dev, dst, next_hop);
2190
2191  out:
2192         cfg80211_put_dev(drv);
2193         dev_put(dev);
2194  out_rtnl:
2195         rtnl_unlock();
2196
2197         return err;
2198 }
2199
2200 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2201 {
2202         struct cfg80211_registered_device *drv;
2203         int err;
2204         struct net_device *dev;
2205         u8 *dst = NULL;
2206
2207         if (info->attrs[NL80211_ATTR_MAC])
2208                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2209
2210         rtnl_lock();
2211
2212         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2213         if (err)
2214                 goto out_rtnl;
2215
2216         if (!drv->ops->del_mpath) {
2217                 err = -EOPNOTSUPP;
2218                 goto out;
2219         }
2220
2221         err = drv->ops->del_mpath(&drv->wiphy, dev, dst);
2222
2223  out:
2224         cfg80211_put_dev(drv);
2225         dev_put(dev);
2226  out_rtnl:
2227         rtnl_unlock();
2228
2229         return err;
2230 }
2231
2232 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2233 {
2234         struct cfg80211_registered_device *drv;
2235         int err;
2236         struct net_device *dev;
2237         struct bss_parameters params;
2238
2239         memset(&params, 0, sizeof(params));
2240         /* default to not changing parameters */
2241         params.use_cts_prot = -1;
2242         params.use_short_preamble = -1;
2243         params.use_short_slot_time = -1;
2244
2245         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2246                 params.use_cts_prot =
2247                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2248         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2249                 params.use_short_preamble =
2250                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2251         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2252                 params.use_short_slot_time =
2253                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2254         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2255                 params.basic_rates =
2256                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2257                 params.basic_rates_len =
2258                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2259         }
2260
2261         rtnl_lock();
2262
2263         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2264         if (err)
2265                 goto out_rtnl;
2266
2267         if (!drv->ops->change_bss) {
2268                 err = -EOPNOTSUPP;
2269                 goto out;
2270         }
2271
2272         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
2273                 err = -EOPNOTSUPP;
2274                 goto out;
2275         }
2276
2277         err = drv->ops->change_bss(&drv->wiphy, dev, &params);
2278
2279  out:
2280         cfg80211_put_dev(drv);
2281         dev_put(dev);
2282  out_rtnl:
2283         rtnl_unlock();
2284
2285         return err;
2286 }
2287
2288 static const struct nla_policy
2289         reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2290         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2291         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2292         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2293         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2294         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2295         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2296 };
2297
2298 static int parse_reg_rule(struct nlattr *tb[],
2299         struct ieee80211_reg_rule *reg_rule)
2300 {
2301         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2302         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2303
2304         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2305                 return -EINVAL;
2306         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2307                 return -EINVAL;
2308         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2309                 return -EINVAL;
2310         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2311                 return -EINVAL;
2312         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2313                 return -EINVAL;
2314
2315         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2316
2317         freq_range->start_freq_khz =
2318                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2319         freq_range->end_freq_khz =
2320                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2321         freq_range->max_bandwidth_khz =
2322                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2323
2324         power_rule->max_eirp =
2325                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2326
2327         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2328                 power_rule->max_antenna_gain =
2329                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2330
2331         return 0;
2332 }
2333
2334 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2335 {
2336         int r;
2337         char *data = NULL;
2338
2339         /*
2340          * You should only get this when cfg80211 hasn't yet initialized
2341          * completely when built-in to the kernel right between the time
2342          * window between nl80211_init() and regulatory_init(), if that is
2343          * even possible.
2344          */
2345         mutex_lock(&cfg80211_mutex);
2346         if (unlikely(!cfg80211_regdomain)) {
2347                 mutex_unlock(&cfg80211_mutex);
2348                 return -EINPROGRESS;
2349         }
2350         mutex_unlock(&cfg80211_mutex);
2351
2352         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2353                 return -EINVAL;
2354
2355         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2356
2357 #ifdef CONFIG_WIRELESS_OLD_REGULATORY
2358         /* We ignore world regdom requests with the old regdom setup */
2359         if (is_world_regdom(data))
2360                 return -EINVAL;
2361 #endif
2362
2363         r = regulatory_hint_user(data);
2364
2365         return r;
2366 }
2367
2368 static int nl80211_get_mesh_params(struct sk_buff *skb,
2369         struct genl_info *info)
2370 {
2371         struct cfg80211_registered_device *drv;
2372         struct mesh_config cur_params;
2373         int err;
2374         struct net_device *dev;
2375         void *hdr;
2376         struct nlattr *pinfoattr;
2377         struct sk_buff *msg;
2378
2379         rtnl_lock();
2380
2381         /* Look up our device */
2382         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2383         if (err)
2384                 goto out_rtnl;
2385
2386         if (!drv->ops->get_mesh_params) {
2387                 err = -EOPNOTSUPP;
2388                 goto out;
2389         }
2390
2391         /* Get the mesh params */
2392         err = drv->ops->get_mesh_params(&drv->wiphy, dev, &cur_params);
2393         if (err)
2394                 goto out;
2395
2396         /* Draw up a netlink message to send back */
2397         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2398         if (!msg) {
2399                 err = -ENOBUFS;
2400                 goto out;
2401         }
2402         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2403                              NL80211_CMD_GET_MESH_PARAMS);
2404         if (!hdr)
2405                 goto nla_put_failure;
2406         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
2407         if (!pinfoattr)
2408                 goto nla_put_failure;
2409         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2410         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2411                         cur_params.dot11MeshRetryTimeout);
2412         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2413                         cur_params.dot11MeshConfirmTimeout);
2414         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2415                         cur_params.dot11MeshHoldingTimeout);
2416         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2417                         cur_params.dot11MeshMaxPeerLinks);
2418         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2419                         cur_params.dot11MeshMaxRetries);
2420         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2421                         cur_params.dot11MeshTTL);
2422         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2423                         cur_params.auto_open_plinks);
2424         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2425                         cur_params.dot11MeshHWMPmaxPREQretries);
2426         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2427                         cur_params.path_refresh_time);
2428         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2429                         cur_params.min_discovery_timeout);
2430         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2431                         cur_params.dot11MeshHWMPactivePathTimeout);
2432         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2433                         cur_params.dot11MeshHWMPpreqMinInterval);
2434         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2435                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2436         nla_nest_end(msg, pinfoattr);
2437         genlmsg_end(msg, hdr);
2438         err = genlmsg_unicast(msg, info->snd_pid);
2439         goto out;
2440
2441  nla_put_failure:
2442         genlmsg_cancel(msg, hdr);
2443         err = -EMSGSIZE;
2444  out:
2445         /* Cleanup */
2446         cfg80211_put_dev(drv);
2447         dev_put(dev);
2448  out_rtnl:
2449         rtnl_unlock();
2450
2451         return err;
2452 }
2453
2454 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2455 do {\
2456         if (table[attr_num]) {\
2457                 cfg.param = nla_fn(table[attr_num]); \
2458                 mask |= (1 << (attr_num - 1)); \
2459         } \
2460 } while (0);\
2461
2462 static struct nla_policy
2463 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] __read_mostly = {
2464         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2465         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2466         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2467         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2468         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2469         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2470         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2471
2472         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2473         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2474         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2475         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2476         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2477         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2478 };
2479
2480 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2481 {
2482         int err;
2483         u32 mask;
2484         struct cfg80211_registered_device *drv;
2485         struct net_device *dev;
2486         struct mesh_config cfg;
2487         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2488         struct nlattr *parent_attr;
2489
2490         parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
2491         if (!parent_attr)
2492                 return -EINVAL;
2493         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2494                         parent_attr, nl80211_meshconf_params_policy))
2495                 return -EINVAL;
2496
2497         rtnl_lock();
2498
2499         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2500         if (err)
2501                 goto out_rtnl;
2502
2503         if (!drv->ops->set_mesh_params) {
2504                 err = -EOPNOTSUPP;
2505                 goto out;
2506         }
2507
2508         /* This makes sure that there aren't more than 32 mesh config
2509          * parameters (otherwise our bitfield scheme would not work.) */
2510         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2511
2512         /* Fill in the params struct */
2513         mask = 0;
2514         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2515                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2516         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2517                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2518         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2519                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2520         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2521                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2522         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2523                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2524         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2525                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2526         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2527                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2528         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2529                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2530                         nla_get_u8);
2531         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2532                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2533         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2534                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2535                         nla_get_u16);
2536         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2537                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2538                         nla_get_u32);
2539         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2540                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2541                         nla_get_u16);
2542         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2543                         dot11MeshHWMPnetDiameterTraversalTime,
2544                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2545                         nla_get_u16);
2546
2547         /* Apply changes */
2548         err = drv->ops->set_mesh_params(&drv->wiphy, dev, &cfg, mask);
2549
2550  out:
2551         /* cleanup */
2552         cfg80211_put_dev(drv);
2553         dev_put(dev);
2554  out_rtnl:
2555         rtnl_unlock();
2556
2557         return err;
2558 }
2559
2560 #undef FILL_IN_MESH_PARAM_IF_SET
2561
2562 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2563 {
2564         struct sk_buff *msg;
2565         void *hdr = NULL;
2566         struct nlattr *nl_reg_rules;
2567         unsigned int i;
2568         int err = -EINVAL;
2569
2570         mutex_lock(&cfg80211_mutex);
2571
2572         if (!cfg80211_regdomain)
2573                 goto out;
2574
2575         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2576         if (!msg) {
2577                 err = -ENOBUFS;
2578                 goto out;
2579         }
2580
2581         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2582                              NL80211_CMD_GET_REG);
2583         if (!hdr)
2584                 goto nla_put_failure;
2585
2586         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2587                 cfg80211_regdomain->alpha2);
2588
2589         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2590         if (!nl_reg_rules)
2591                 goto nla_put_failure;
2592
2593         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2594                 struct nlattr *nl_reg_rule;
2595                 const struct ieee80211_reg_rule *reg_rule;
2596                 const struct ieee80211_freq_range *freq_range;
2597                 const struct ieee80211_power_rule *power_rule;
2598
2599                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2600                 freq_range = &reg_rule->freq_range;
2601                 power_rule = &reg_rule->power_rule;
2602
2603                 nl_reg_rule = nla_nest_start(msg, i);
2604                 if (!nl_reg_rule)
2605                         goto nla_put_failure;
2606
2607                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2608                         reg_rule->flags);
2609                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2610                         freq_range->start_freq_khz);
2611                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2612                         freq_range->end_freq_khz);
2613                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2614                         freq_range->max_bandwidth_khz);
2615                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2616                         power_rule->max_antenna_gain);
2617                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2618                         power_rule->max_eirp);
2619
2620                 nla_nest_end(msg, nl_reg_rule);
2621         }
2622
2623         nla_nest_end(msg, nl_reg_rules);
2624
2625         genlmsg_end(msg, hdr);
2626         err = genlmsg_unicast(msg, info->snd_pid);
2627         goto out;
2628
2629 nla_put_failure:
2630         genlmsg_cancel(msg, hdr);
2631         err = -EMSGSIZE;
2632 out:
2633         mutex_unlock(&cfg80211_mutex);
2634         return err;
2635 }
2636
2637 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2638 {
2639         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2640         struct nlattr *nl_reg_rule;
2641         char *alpha2 = NULL;
2642         int rem_reg_rules = 0, r = 0;
2643         u32 num_rules = 0, rule_idx = 0, size_of_regd;
2644         struct ieee80211_regdomain *rd = NULL;
2645
2646         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2647                 return -EINVAL;
2648
2649         if (!info->attrs[NL80211_ATTR_REG_RULES])
2650                 return -EINVAL;
2651
2652         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2653
2654         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2655                         rem_reg_rules) {
2656                 num_rules++;
2657                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2658                         return -EINVAL;
2659         }
2660
2661         mutex_lock(&cfg80211_mutex);
2662
2663         if (!reg_is_valid_request(alpha2)) {
2664                 r = -EINVAL;
2665                 goto bad_reg;
2666         }
2667
2668         size_of_regd = sizeof(struct ieee80211_regdomain) +
2669                 (num_rules * sizeof(struct ieee80211_reg_rule));
2670
2671         rd = kzalloc(size_of_regd, GFP_KERNEL);
2672         if (!rd) {
2673                 r = -ENOMEM;
2674                 goto bad_reg;
2675         }
2676
2677         rd->n_reg_rules = num_rules;
2678         rd->alpha2[0] = alpha2[0];
2679         rd->alpha2[1] = alpha2[1];
2680
2681         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2682                         rem_reg_rules) {
2683                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2684                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2685                         reg_rule_policy);
2686                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2687                 if (r)
2688                         goto bad_reg;
2689
2690                 rule_idx++;
2691
2692                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
2693                         r = -EINVAL;
2694                         goto bad_reg;
2695                 }
2696         }
2697
2698         BUG_ON(rule_idx != num_rules);
2699
2700         r = set_regdom(rd);
2701
2702         mutex_unlock(&cfg80211_mutex);
2703
2704         return r;
2705
2706  bad_reg:
2707         mutex_unlock(&cfg80211_mutex);
2708         kfree(rd);
2709         return r;
2710 }
2711
2712 static int validate_scan_freqs(struct nlattr *freqs)
2713 {
2714         struct nlattr *attr1, *attr2;
2715         int n_channels = 0, tmp1, tmp2;
2716
2717         nla_for_each_nested(attr1, freqs, tmp1) {
2718                 n_channels++;
2719                 /*
2720                  * Some hardware has a limited channel list for
2721                  * scanning, and it is pretty much nonsensical
2722                  * to scan for a channel twice, so disallow that
2723                  * and don't require drivers to check that the
2724                  * channel list they get isn't longer than what
2725                  * they can scan, as long as they can scan all
2726                  * the channels they registered at once.
2727                  */
2728                 nla_for_each_nested(attr2, freqs, tmp2)
2729                         if (attr1 != attr2 &&
2730                             nla_get_u32(attr1) == nla_get_u32(attr2))
2731                                 return 0;
2732         }
2733
2734         return n_channels;
2735 }
2736
2737 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
2738 {
2739         struct cfg80211_registered_device *drv;
2740         struct net_device *dev;
2741         struct cfg80211_scan_request *request;
2742         struct cfg80211_ssid *ssid;
2743         struct ieee80211_channel *channel;
2744         struct nlattr *attr;
2745         struct wiphy *wiphy;
2746         int err, tmp, n_ssids = 0, n_channels, i;
2747         enum ieee80211_band band;
2748         size_t ie_len;
2749
2750         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2751                 return -EINVAL;
2752
2753         rtnl_lock();
2754
2755         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2756         if (err)
2757                 goto out_rtnl;
2758
2759         wiphy = &drv->wiphy;
2760
2761         if (!drv->ops->scan) {
2762                 err = -EOPNOTSUPP;
2763                 goto out;
2764         }
2765
2766         if (!netif_running(dev)) {
2767                 err = -ENETDOWN;
2768                 goto out;
2769         }
2770
2771         if (drv->scan_req) {
2772                 err = -EBUSY;
2773                 goto out;
2774         }
2775
2776         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2777                 n_channels = validate_scan_freqs(
2778                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
2779                 if (!n_channels) {
2780                         err = -EINVAL;
2781                         goto out;
2782                 }
2783         } else {
2784                 n_channels = 0;
2785
2786                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
2787                         if (wiphy->bands[band])
2788                                 n_channels += wiphy->bands[band]->n_channels;
2789         }
2790
2791         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
2792                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
2793                         n_ssids++;
2794
2795         if (n_ssids > wiphy->max_scan_ssids) {
2796                 err = -EINVAL;
2797                 goto out;
2798         }
2799
2800         if (info->attrs[NL80211_ATTR_IE])
2801                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2802         else
2803                 ie_len = 0;
2804
2805         if (ie_len > wiphy->max_scan_ie_len) {
2806                 err = -EINVAL;
2807                 goto out;
2808         }
2809
2810         request = kzalloc(sizeof(*request)
2811                         + sizeof(*ssid) * n_ssids
2812                         + sizeof(channel) * n_channels
2813                         + ie_len, GFP_KERNEL);
2814         if (!request) {
2815                 err = -ENOMEM;
2816                 goto out;
2817         }
2818
2819         request->channels = (void *)((char *)request + sizeof(*request));
2820         request->n_channels = n_channels;
2821         if (n_ssids)
2822                 request->ssids = (void *)(request->channels + n_channels);
2823         request->n_ssids = n_ssids;
2824         if (ie_len) {
2825                 if (request->ssids)
2826                         request->ie = (void *)(request->ssids + n_ssids);
2827                 else
2828                         request->ie = (void *)(request->channels + n_channels);
2829         }
2830
2831         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2832                 /* user specified, bail out if channel not found */
2833                 request->n_channels = n_channels;
2834                 i = 0;
2835                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
2836                         request->channels[i] = ieee80211_get_channel(wiphy, nla_get_u32(attr));
2837                         if (!request->channels[i]) {
2838                                 err = -EINVAL;
2839                                 goto out_free;
2840                         }
2841                         i++;
2842                 }
2843         } else {
2844                 /* all channels */
2845                 i = 0;
2846                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
2847                         int j;
2848                         if (!wiphy->bands[band])
2849                                 continue;
2850                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
2851                                 request->channels[i] = &wiphy->bands[band]->channels[j];
2852                                 i++;
2853                         }
2854                 }
2855         }
2856
2857         i = 0;
2858         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
2859                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
2860                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
2861                                 err = -EINVAL;
2862                                 goto out_free;
2863                         }
2864                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
2865                         request->ssids[i].ssid_len = nla_len(attr);
2866                         i++;
2867                 }
2868         }
2869
2870         if (info->attrs[NL80211_ATTR_IE]) {
2871                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2872                 memcpy((void *)request->ie,
2873                        nla_data(info->attrs[NL80211_ATTR_IE]),
2874                        request->ie_len);
2875         }
2876
2877         request->ifidx = dev->ifindex;
2878         request->wiphy = &drv->wiphy;
2879
2880         drv->scan_req = request;
2881         err = drv->ops->scan(&drv->wiphy, dev, request);
2882
2883         if (!err)
2884                 nl80211_send_scan_start(drv, dev);
2885
2886  out_free:
2887         if (err) {
2888                 drv->scan_req = NULL;
2889                 kfree(request);
2890         }
2891  out:
2892         cfg80211_put_dev(drv);
2893         dev_put(dev);
2894  out_rtnl:
2895         rtnl_unlock();
2896
2897         return err;
2898 }
2899
2900 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
2901                             struct cfg80211_registered_device *rdev,
2902                             struct net_device *dev,
2903                             struct cfg80211_bss *res)
2904 {
2905         void *hdr;
2906         struct nlattr *bss;
2907
2908         hdr = nl80211hdr_put(msg, pid, seq, flags,
2909                              NL80211_CMD_NEW_SCAN_RESULTS);
2910         if (!hdr)
2911                 return -1;
2912
2913         NLA_PUT_U32(msg, NL80211_ATTR_SCAN_GENERATION,
2914                     rdev->bss_generation);
2915         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2916
2917         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
2918         if (!bss)
2919                 goto nla_put_failure;
2920         if (!is_zero_ether_addr(res->bssid))
2921                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
2922         if (res->information_elements && res->len_information_elements)
2923                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
2924                         res->len_information_elements,
2925                         res->information_elements);
2926         if (res->tsf)
2927                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
2928         if (res->beacon_interval)
2929                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
2930         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
2931         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
2932
2933         switch (rdev->wiphy.signal_type) {
2934         case CFG80211_SIGNAL_TYPE_MBM:
2935                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
2936                 break;
2937         case CFG80211_SIGNAL_TYPE_UNSPEC:
2938                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
2939                 break;
2940         default:
2941                 break;
2942         }
2943
2944         nla_nest_end(msg, bss);
2945
2946         return genlmsg_end(msg, hdr);
2947
2948  nla_put_failure:
2949         genlmsg_cancel(msg, hdr);
2950         return -EMSGSIZE;
2951 }
2952
2953 static int nl80211_dump_scan(struct sk_buff *skb,
2954                              struct netlink_callback *cb)
2955 {
2956         struct cfg80211_registered_device *dev;
2957         struct net_device *netdev;
2958         struct cfg80211_internal_bss *scan;
2959         int ifidx = cb->args[0];
2960         int start = cb->args[1], idx = 0;
2961         int err;
2962
2963         if (!ifidx) {
2964                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
2965                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
2966                                   nl80211_policy);
2967                 if (err)
2968                         return err;
2969
2970                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
2971                         return -EINVAL;
2972
2973                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
2974                 if (!ifidx)
2975                         return -EINVAL;
2976                 cb->args[0] = ifidx;
2977         }
2978
2979         netdev = dev_get_by_index(&init_net, ifidx);
2980         if (!netdev)
2981                 return -ENODEV;
2982
2983         dev = cfg80211_get_dev_from_ifindex(ifidx);
2984         if (IS_ERR(dev)) {
2985                 err = PTR_ERR(dev);
2986                 goto out_put_netdev;
2987         }
2988
2989         spin_lock_bh(&dev->bss_lock);
2990         cfg80211_bss_expire(dev);
2991
2992         list_for_each_entry(scan, &dev->bss_list, list) {
2993                 if (++idx <= start)
2994                         continue;
2995                 if (nl80211_send_bss(skb,
2996                                 NETLINK_CB(cb->skb).pid,
2997                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2998                                 dev, netdev, &scan->pub) < 0) {
2999                         idx--;
3000                         goto out;
3001                 }
3002         }
3003
3004  out:
3005         spin_unlock_bh(&dev->bss_lock);
3006
3007         cb->args[1] = idx;
3008         err = skb->len;
3009         cfg80211_put_dev(dev);
3010  out_put_netdev:
3011         dev_put(netdev);
3012
3013         return err;
3014 }
3015
3016 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
3017 {
3018         return auth_type <= NL80211_AUTHTYPE_MAX;
3019 }
3020
3021 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
3022 {
3023         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
3024                                   NL80211_WPA_VERSION_2));
3025 }
3026
3027 static bool nl80211_valid_akm_suite(u32 akm)
3028 {
3029         return akm == WLAN_AKM_SUITE_8021X ||
3030                 akm == WLAN_AKM_SUITE_PSK;
3031 }
3032
3033 static bool nl80211_valid_cipher_suite(u32 cipher)
3034 {
3035         return cipher == WLAN_CIPHER_SUITE_WEP40 ||
3036                 cipher == WLAN_CIPHER_SUITE_WEP104 ||
3037                 cipher == WLAN_CIPHER_SUITE_TKIP ||
3038                 cipher == WLAN_CIPHER_SUITE_CCMP ||
3039                 cipher == WLAN_CIPHER_SUITE_AES_CMAC;
3040 }
3041
3042
3043 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
3044 {
3045         struct cfg80211_registered_device *drv;
3046         struct net_device *dev;
3047         struct ieee80211_channel *chan;
3048         const u8 *bssid, *ssid, *ie = NULL;
3049         int err, ssid_len, ie_len = 0;
3050         enum nl80211_auth_type auth_type;
3051
3052         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3053                 return -EINVAL;
3054
3055         if (!info->attrs[NL80211_ATTR_MAC])
3056                 return -EINVAL;
3057
3058         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
3059                 return -EINVAL;
3060
3061         if (!info->attrs[NL80211_ATTR_SSID])
3062                 return -EINVAL;
3063
3064         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
3065                 return -EINVAL;
3066
3067         rtnl_lock();
3068
3069         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3070         if (err)
3071                 goto unlock_rtnl;
3072
3073         if (!drv->ops->auth) {
3074                 err = -EOPNOTSUPP;
3075                 goto out;
3076         }
3077
3078         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3079                 err = -EOPNOTSUPP;
3080                 goto out;
3081         }
3082
3083         if (!netif_running(dev)) {
3084                 err = -ENETDOWN;
3085                 goto out;
3086         }
3087
3088         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3089         chan = ieee80211_get_channel(&drv->wiphy,
3090                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3091         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED)) {
3092                 err = -EINVAL;
3093                 goto out;
3094         }
3095
3096         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3097         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3098
3099         if (info->attrs[NL80211_ATTR_IE]) {
3100                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3101                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3102         }
3103
3104         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
3105         if (!nl80211_valid_auth_type(auth_type)) {
3106                 err = -EINVAL;
3107                 goto out;
3108         }
3109
3110         err = cfg80211_mlme_auth(drv, dev, chan, auth_type, bssid,
3111                                  ssid, ssid_len, ie, ie_len);
3112
3113 out:
3114         cfg80211_put_dev(drv);
3115         dev_put(dev);
3116 unlock_rtnl:
3117         rtnl_unlock();
3118         return err;
3119 }
3120
3121 static int nl80211_crypto_settings(struct genl_info *info,
3122                                    struct cfg80211_crypto_settings *settings)
3123 {
3124         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
3125
3126         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
3127                 void *data;
3128                 int len, i;
3129
3130                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3131                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3132                 settings->n_ciphers_pairwise = len / sizeof(u32);
3133
3134                 if (len % sizeof(u32))
3135                         return -EINVAL;
3136
3137                 if (settings->n_ciphers_pairwise > NL80211_MAX_NR_CIPHER_SUITES)
3138                         return -EINVAL;
3139
3140                 memcpy(settings->ciphers_pairwise, data, len);
3141
3142                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3143                         if (!nl80211_valid_cipher_suite(
3144                                         settings->ciphers_pairwise[i]))
3145                                 return -EINVAL;
3146         }
3147
3148         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
3149                 settings->cipher_group =
3150                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
3151                 if (!nl80211_valid_cipher_suite(settings->cipher_group))
3152                         return -EINVAL;
3153         }
3154
3155         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
3156                 settings->wpa_versions =
3157                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
3158                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
3159                         return -EINVAL;
3160         }
3161
3162         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
3163                 void *data;
3164                 int len, i;
3165
3166                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
3167                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
3168                 settings->n_akm_suites = len / sizeof(u32);
3169
3170                 if (len % sizeof(u32))
3171                         return -EINVAL;
3172
3173                 memcpy(settings->akm_suites, data, len);
3174
3175                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3176                         if (!nl80211_valid_akm_suite(settings->akm_suites[i]))
3177                                 return -EINVAL;
3178         }
3179
3180         return 0;
3181 }
3182
3183 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
3184 {
3185         struct cfg80211_registered_device *rdev;
3186         struct net_device *dev;
3187         struct cfg80211_crypto_settings crypto;
3188         struct ieee80211_channel *chan;
3189         const u8 *bssid, *ssid, *ie = NULL;
3190         int err, ssid_len, ie_len = 0;
3191         bool use_mfp = false;
3192
3193         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3194                 return -EINVAL;
3195
3196         if (!info->attrs[NL80211_ATTR_MAC] ||
3197             !info->attrs[NL80211_ATTR_SSID] ||
3198             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
3199                 return -EINVAL;
3200
3201         rtnl_lock();
3202
3203         err = get_drv_dev_by_info_ifindex(info->attrs, &rdev, &dev);
3204         if (err)
3205                 goto unlock_rtnl;
3206
3207         if (!rdev->ops->assoc) {
3208                 err = -EOPNOTSUPP;
3209                 goto out;
3210         }
3211
3212         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3213                 err = -EOPNOTSUPP;
3214                 goto out;
3215         }
3216
3217         if (!netif_running(dev)) {
3218                 err = -ENETDOWN;
3219                 goto out;
3220         }
3221
3222         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3223
3224         chan = ieee80211_get_channel(&rdev->wiphy,
3225                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3226         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED)) {
3227                 err = -EINVAL;
3228                 goto out;
3229         }
3230
3231         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3232         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3233
3234         if (info->attrs[NL80211_ATTR_IE]) {
3235                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3236                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3237         }
3238
3239         if (info->attrs[NL80211_ATTR_USE_MFP]) {
3240                 enum nl80211_mfp use_mfp =
3241                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
3242                 if (use_mfp == NL80211_MFP_REQUIRED)
3243                         use_mfp = true;
3244                 else if (use_mfp != NL80211_MFP_NO) {
3245                         err = -EINVAL;
3246                         goto out;
3247                 }
3248         }
3249
3250         err = nl80211_crypto_settings(info, &crypto);
3251         if (!err)
3252                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, ssid,
3253                                           ssid_len, ie, ie_len, use_mfp,
3254                                           &crypto);
3255
3256 out:
3257         cfg80211_put_dev(rdev);
3258         dev_put(dev);
3259 unlock_rtnl:
3260         rtnl_unlock();
3261         return err;
3262 }
3263
3264 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
3265 {
3266         struct cfg80211_registered_device *drv;
3267         struct net_device *dev;
3268         const u8 *ie = NULL, *bssid;
3269         int err, ie_len = 0;
3270         u16 reason_code;
3271
3272         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3273                 return -EINVAL;
3274
3275         if (!info->attrs[NL80211_ATTR_MAC])
3276                 return -EINVAL;
3277
3278         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3279                 return -EINVAL;
3280
3281         rtnl_lock();
3282
3283         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3284         if (err)
3285                 goto unlock_rtnl;
3286
3287         if (!drv->ops->deauth) {
3288                 err = -EOPNOTSUPP;
3289                 goto out;
3290         }
3291
3292         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3293                 err = -EOPNOTSUPP;
3294                 goto out;
3295         }
3296
3297         if (!netif_running(dev)) {
3298                 err = -ENETDOWN;
3299                 goto out;
3300         }
3301
3302         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3303
3304         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3305         if (reason_code == 0) {
3306                 /* Reason Code 0 is reserved */
3307                 err = -EINVAL;
3308                 goto out;
3309         }
3310
3311         if (info->attrs[NL80211_ATTR_IE]) {
3312                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3313                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3314         }
3315
3316         err = cfg80211_mlme_deauth(drv, dev, bssid, ie, ie_len, reason_code);
3317
3318 out:
3319         cfg80211_put_dev(drv);
3320         dev_put(dev);
3321 unlock_rtnl:
3322         rtnl_unlock();
3323         return err;
3324 }
3325
3326 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
3327 {
3328         struct cfg80211_registered_device *drv;
3329         struct net_device *dev;
3330         const u8 *ie = NULL, *bssid;
3331         int err, ie_len = 0;
3332         u16 reason_code;
3333
3334         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3335                 return -EINVAL;
3336
3337         if (!info->attrs[NL80211_ATTR_MAC])
3338                 return -EINVAL;
3339
3340         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3341                 return -EINVAL;
3342
3343         rtnl_lock();
3344
3345         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3346         if (err)
3347                 goto unlock_rtnl;
3348
3349         if (!drv->ops->disassoc) {
3350                 err = -EOPNOTSUPP;
3351                 goto out;
3352         }
3353
3354         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3355                 err = -EOPNOTSUPP;
3356                 goto out;
3357         }
3358
3359         if (!netif_running(dev)) {
3360                 err = -ENETDOWN;
3361                 goto out;
3362         }
3363
3364         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3365
3366         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3367         if (reason_code == 0) {
3368                 /* Reason Code 0 is reserved */
3369                 err = -EINVAL;
3370                 goto out;
3371         }
3372
3373         if (info->attrs[NL80211_ATTR_IE]) {
3374                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3375                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3376         }
3377
3378         err = cfg80211_mlme_disassoc(drv, dev, bssid, ie, ie_len, reason_code);
3379
3380 out:
3381         cfg80211_put_dev(drv);
3382         dev_put(dev);
3383 unlock_rtnl:
3384         rtnl_unlock();
3385         return err;
3386 }
3387
3388 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
3389 {
3390         struct cfg80211_registered_device *drv;
3391         struct net_device *dev;
3392         struct cfg80211_ibss_params ibss;
3393         struct wiphy *wiphy;
3394         int err;
3395
3396         memset(&ibss, 0, sizeof(ibss));
3397
3398         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3399                 return -EINVAL;
3400
3401         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
3402             !info->attrs[NL80211_ATTR_SSID] ||
3403             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3404                 return -EINVAL;
3405
3406         ibss.beacon_interval = 100;
3407
3408         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
3409                 ibss.beacon_interval =
3410                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3411                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
3412                         return -EINVAL;
3413         }
3414
3415         rtnl_lock();
3416
3417         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3418         if (err)
3419                 goto unlock_rtnl;
3420
3421         if (!drv->ops->join_ibss) {
3422                 err = -EOPNOTSUPP;
3423                 goto out;
3424         }
3425
3426         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3427                 err = -EOPNOTSUPP;
3428                 goto out;
3429         }
3430
3431         if (!netif_running(dev)) {
3432                 err = -ENETDOWN;
3433                 goto out;
3434         }
3435
3436         wiphy = &drv->wiphy;
3437
3438         if (info->attrs[NL80211_ATTR_MAC])
3439                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3440         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3441         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3442
3443         if (info->attrs[NL80211_ATTR_IE]) {
3444                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3445                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3446         }
3447
3448         ibss.channel = ieee80211_get_channel(wiphy,
3449                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3450         if (!ibss.channel ||
3451             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
3452             ibss.channel->flags & IEEE80211_CHAN_DISABLED) {
3453                 err = -EINVAL;
3454                 goto out;
3455         }
3456
3457         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
3458
3459         err = cfg80211_join_ibss(drv, dev, &ibss);
3460
3461 out:
3462         cfg80211_put_dev(drv);
3463         dev_put(dev);
3464 unlock_rtnl:
3465         rtnl_unlock();
3466         return err;
3467 }
3468
3469 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
3470 {
3471         struct cfg80211_registered_device *drv;
3472         struct net_device *dev;
3473         int err;
3474
3475         rtnl_lock();
3476
3477         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3478         if (err)
3479                 goto unlock_rtnl;
3480
3481         if (!drv->ops->leave_ibss) {
3482                 err = -EOPNOTSUPP;
3483                 goto out;
3484         }
3485
3486         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3487                 err = -EOPNOTSUPP;
3488                 goto out;
3489         }
3490
3491         if (!netif_running(dev)) {
3492                 err = -ENETDOWN;
3493                 goto out;
3494         }
3495
3496         err = cfg80211_leave_ibss(drv, dev, false);
3497
3498 out:
3499         cfg80211_put_dev(drv);
3500         dev_put(dev);
3501 unlock_rtnl:
3502         rtnl_unlock();
3503         return err;
3504 }
3505
3506 #ifdef CONFIG_NL80211_TESTMODE
3507 static struct genl_multicast_group nl80211_testmode_mcgrp = {
3508         .name = "testmode",
3509 };
3510
3511 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
3512 {
3513         struct cfg80211_registered_device *rdev;
3514         int err;
3515
3516         if (!info->attrs[NL80211_ATTR_TESTDATA])
3517                 return -EINVAL;
3518
3519         rtnl_lock();
3520
3521         rdev = cfg80211_get_dev_from_info(info);
3522         if (IS_ERR(rdev)) {
3523                 err = PTR_ERR(rdev);
3524                 goto unlock_rtnl;
3525         }
3526
3527         err = -EOPNOTSUPP;
3528         if (rdev->ops->testmode_cmd) {
3529                 rdev->testmode_info = info;
3530                 err = rdev->ops->testmode_cmd(&rdev->wiphy,
3531                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
3532                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
3533                 rdev->testmode_info = NULL;
3534         }
3535
3536         cfg80211_put_dev(rdev);
3537
3538  unlock_rtnl:
3539         rtnl_unlock();
3540         return err;
3541 }
3542
3543 static struct sk_buff *
3544 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
3545                               int approxlen, u32 pid, u32 seq, gfp_t gfp)
3546 {
3547         struct sk_buff *skb;
3548         void *hdr;
3549         struct nlattr *data;
3550
3551         skb = nlmsg_new(approxlen + 100, gfp);
3552         if (!skb)
3553                 return NULL;
3554
3555         hdr = nl80211hdr_put(skb, pid, seq, 0, NL80211_CMD_TESTMODE);
3556         if (!hdr) {
3557                 kfree_skb(skb);
3558                 return NULL;
3559         }
3560
3561         NLA_PUT_U32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3562         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
3563
3564         ((void **)skb->cb)[0] = rdev;
3565         ((void **)skb->cb)[1] = hdr;
3566         ((void **)skb->cb)[2] = data;
3567
3568         return skb;
3569
3570  nla_put_failure:
3571         kfree_skb(skb);
3572         return NULL;
3573 }
3574
3575 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
3576                                                   int approxlen)
3577 {
3578         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
3579
3580         if (WARN_ON(!rdev->testmode_info))
3581                 return NULL;
3582
3583         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
3584                                 rdev->testmode_info->snd_pid,
3585                                 rdev->testmode_info->snd_seq,
3586                                 GFP_KERNEL);
3587 }
3588 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
3589
3590 int cfg80211_testmode_reply(struct sk_buff *skb)
3591 {
3592         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
3593         void *hdr = ((void **)skb->cb)[1];
3594         struct nlattr *data = ((void **)skb->cb)[2];
3595
3596         if (WARN_ON(!rdev->testmode_info)) {
3597                 kfree_skb(skb);
3598                 return -EINVAL;
3599         }
3600
3601         nla_nest_end(skb, data);
3602         genlmsg_end(skb, hdr);
3603         return genlmsg_reply(skb, rdev->testmode_info);
3604 }
3605 EXPORT_SYMBOL(cfg80211_testmode_reply);
3606
3607 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
3608                                                   int approxlen, gfp_t gfp)
3609 {
3610         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
3611
3612         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
3613 }
3614 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
3615
3616 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
3617 {
3618         void *hdr = ((void **)skb->cb)[1];
3619         struct nlattr *data = ((void **)skb->cb)[2];
3620
3621         nla_nest_end(skb, data);
3622         genlmsg_end(skb, hdr);
3623         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
3624 }
3625 EXPORT_SYMBOL(cfg80211_testmode_event);
3626 #endif
3627
3628 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
3629 {
3630         struct cfg80211_registered_device *drv;
3631         struct net_device *dev;
3632         struct cfg80211_connect_params connect;
3633         struct wiphy *wiphy;
3634         int err;
3635
3636         memset(&connect, 0, sizeof(connect));
3637
3638         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3639                 return -EINVAL;
3640
3641         if (!info->attrs[NL80211_ATTR_SSID] ||
3642             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3643                 return -EINVAL;
3644
3645         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3646                 connect.auth_type =
3647                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
3648                 if (!nl80211_valid_auth_type(connect.auth_type))
3649                         return -EINVAL;
3650         } else
3651                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3652
3653         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
3654
3655         err = nl80211_crypto_settings(info, &connect.crypto);
3656         if (err)
3657                 return err;
3658         rtnl_lock();
3659
3660         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3661         if (err)
3662                 goto unlock_rtnl;
3663
3664         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3665                 err = -EOPNOTSUPP;
3666                 goto out;
3667         }
3668
3669         if (!netif_running(dev)) {
3670                 err = -ENETDOWN;
3671                 goto out;
3672         }
3673
3674         wiphy = &drv->wiphy;
3675
3676         connect.bssid = NULL;
3677         connect.channel = NULL;
3678         connect.auth_type = NL80211_AUTHTYPE_OPEN_SYSTEM;
3679
3680         if (info->attrs[NL80211_ATTR_MAC])
3681                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3682         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3683         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3684
3685         if (info->attrs[NL80211_ATTR_IE]) {
3686                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3687                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3688         }
3689
3690         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3691                 connect.channel =
3692                         ieee80211_get_channel(wiphy,
3693                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3694                 if (!connect.channel ||
3695                     connect.channel->flags & IEEE80211_CHAN_DISABLED) {
3696                         err = -EINVAL;
3697                         goto out;
3698                 }
3699         }
3700
3701         err = cfg80211_connect(drv, dev, &connect);
3702
3703 out:
3704         cfg80211_put_dev(drv);
3705         dev_put(dev);
3706 unlock_rtnl:
3707         rtnl_unlock();
3708         return err;
3709 }
3710
3711 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
3712 {
3713         struct cfg80211_registered_device *drv;
3714         struct net_device *dev;
3715         int err;
3716         u16 reason;
3717
3718         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3719                 reason = WLAN_REASON_DEAUTH_LEAVING;
3720         else
3721                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3722
3723         if (reason == 0)
3724                 return -EINVAL;
3725
3726         rtnl_lock();
3727
3728         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3729         if (err)
3730                 goto unlock_rtnl;
3731
3732         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3733                 err = -EOPNOTSUPP;
3734                 goto out;
3735         }
3736
3737         if (!netif_running(dev)) {
3738                 err = -ENETDOWN;
3739                 goto out;
3740         }
3741
3742         err = cfg80211_disconnect(drv, dev, reason, true);
3743
3744 out:
3745         cfg80211_put_dev(drv);
3746         dev_put(dev);
3747 unlock_rtnl:
3748         rtnl_unlock();
3749         return err;
3750 }
3751
3752 static struct genl_ops nl80211_ops[] = {
3753         {
3754                 .cmd = NL80211_CMD_GET_WIPHY,
3755                 .doit = nl80211_get_wiphy,
3756                 .dumpit = nl80211_dump_wiphy,
3757                 .policy = nl80211_policy,
3758                 /* can be retrieved by unprivileged users */
3759         },
3760         {
3761                 .cmd = NL80211_CMD_SET_WIPHY,
3762                 .doit = nl80211_set_wiphy,
3763                 .policy = nl80211_policy,
3764                 .flags = GENL_ADMIN_PERM,
3765         },
3766         {
3767                 .cmd = NL80211_CMD_GET_INTERFACE,
3768                 .doit = nl80211_get_interface,
3769                 .dumpit = nl80211_dump_interface,
3770                 .policy = nl80211_policy,
3771                 /* can be retrieved by unprivileged users */
3772         },
3773         {
3774                 .cmd = NL80211_CMD_SET_INTERFACE,
3775                 .doit = nl80211_set_interface,
3776                 .policy = nl80211_policy,
3777                 .flags = GENL_ADMIN_PERM,
3778         },
3779         {
3780                 .cmd = NL80211_CMD_NEW_INTERFACE,
3781                 .doit = nl80211_new_interface,
3782                 .policy = nl80211_policy,
3783                 .flags = GENL_ADMIN_PERM,
3784         },
3785         {
3786                 .cmd = NL80211_CMD_DEL_INTERFACE,
3787                 .doit = nl80211_del_interface,
3788                 .policy = nl80211_policy,
3789                 .flags = GENL_ADMIN_PERM,
3790         },
3791         {
3792                 .cmd = NL80211_CMD_GET_KEY,
3793                 .doit = nl80211_get_key,
3794                 .policy = nl80211_policy,
3795                 .flags = GENL_ADMIN_PERM,
3796         },
3797         {
3798                 .cmd = NL80211_CMD_SET_KEY,
3799                 .doit = nl80211_set_key,
3800                 .policy = nl80211_policy,
3801                 .flags = GENL_ADMIN_PERM,
3802         },
3803         {
3804                 .cmd = NL80211_CMD_NEW_KEY,
3805                 .doit = nl80211_new_key,
3806                 .policy = nl80211_policy,
3807                 .flags = GENL_ADMIN_PERM,
3808         },
3809         {
3810                 .cmd = NL80211_CMD_DEL_KEY,
3811                 .doit = nl80211_del_key,
3812                 .policy = nl80211_policy,
3813                 .flags = GENL_ADMIN_PERM,
3814         },
3815         {
3816                 .cmd = NL80211_CMD_SET_BEACON,
3817                 .policy = nl80211_policy,
3818                 .flags = GENL_ADMIN_PERM,
3819                 .doit = nl80211_addset_beacon,
3820         },
3821         {
3822                 .cmd = NL80211_CMD_NEW_BEACON,
3823                 .policy = nl80211_policy,
3824                 .flags = GENL_ADMIN_PERM,
3825                 .doit = nl80211_addset_beacon,
3826         },
3827         {
3828                 .cmd = NL80211_CMD_DEL_BEACON,
3829                 .policy = nl80211_policy,
3830                 .flags = GENL_ADMIN_PERM,
3831                 .doit = nl80211_del_beacon,
3832         },
3833         {
3834                 .cmd = NL80211_CMD_GET_STATION,
3835                 .doit = nl80211_get_station,
3836                 .dumpit = nl80211_dump_station,
3837                 .policy = nl80211_policy,
3838         },
3839         {
3840                 .cmd = NL80211_CMD_SET_STATION,
3841                 .doit = nl80211_set_station,
3842                 .policy = nl80211_policy,
3843                 .flags = GENL_ADMIN_PERM,
3844         },
3845         {
3846                 .cmd = NL80211_CMD_NEW_STATION,
3847                 .doit = nl80211_new_station,
3848                 .policy = nl80211_policy,
3849                 .flags = GENL_ADMIN_PERM,
3850         },
3851         {
3852                 .cmd = NL80211_CMD_DEL_STATION,
3853                 .doit = nl80211_del_station,
3854                 .policy = nl80211_policy,
3855                 .flags = GENL_ADMIN_PERM,
3856         },
3857         {
3858                 .cmd = NL80211_CMD_GET_MPATH,
3859                 .doit = nl80211_get_mpath,
3860                 .dumpit = nl80211_dump_mpath,
3861                 .policy = nl80211_policy,
3862                 .flags = GENL_ADMIN_PERM,
3863         },
3864         {
3865                 .cmd = NL80211_CMD_SET_MPATH,
3866                 .doit = nl80211_set_mpath,
3867                 .policy = nl80211_policy,
3868                 .flags = GENL_ADMIN_PERM,
3869         },
3870         {
3871                 .cmd = NL80211_CMD_NEW_MPATH,
3872                 .doit = nl80211_new_mpath,
3873                 .policy = nl80211_policy,
3874                 .flags = GENL_ADMIN_PERM,
3875         },
3876         {
3877                 .cmd = NL80211_CMD_DEL_MPATH,
3878                 .doit = nl80211_del_mpath,
3879                 .policy = nl80211_policy,
3880                 .flags = GENL_ADMIN_PERM,
3881         },
3882         {
3883                 .cmd = NL80211_CMD_SET_BSS,
3884                 .doit = nl80211_set_bss,
3885                 .policy = nl80211_policy,
3886                 .flags = GENL_ADMIN_PERM,
3887         },
3888         {
3889                 .cmd = NL80211_CMD_GET_REG,
3890                 .doit = nl80211_get_reg,
3891                 .policy = nl80211_policy,
3892                 /* can be retrieved by unprivileged users */
3893         },
3894         {
3895                 .cmd = NL80211_CMD_SET_REG,
3896                 .doit = nl80211_set_reg,
3897                 .policy = nl80211_policy,
3898                 .flags = GENL_ADMIN_PERM,
3899         },
3900         {
3901                 .cmd = NL80211_CMD_REQ_SET_REG,
3902                 .doit = nl80211_req_set_reg,
3903                 .policy = nl80211_policy,
3904                 .flags = GENL_ADMIN_PERM,
3905         },
3906         {
3907                 .cmd = NL80211_CMD_GET_MESH_PARAMS,
3908                 .doit = nl80211_get_mesh_params,
3909                 .policy = nl80211_policy,
3910                 /* can be retrieved by unprivileged users */
3911         },
3912         {
3913                 .cmd = NL80211_CMD_SET_MESH_PARAMS,
3914                 .doit = nl80211_set_mesh_params,
3915                 .policy = nl80211_policy,
3916                 .flags = GENL_ADMIN_PERM,
3917         },
3918         {
3919                 .cmd = NL80211_CMD_TRIGGER_SCAN,
3920                 .doit = nl80211_trigger_scan,
3921                 .policy = nl80211_policy,
3922                 .flags = GENL_ADMIN_PERM,
3923         },
3924         {
3925                 .cmd = NL80211_CMD_GET_SCAN,
3926                 .policy = nl80211_policy,
3927                 .dumpit = nl80211_dump_scan,
3928         },
3929         {
3930                 .cmd = NL80211_CMD_AUTHENTICATE,
3931                 .doit = nl80211_authenticate,
3932                 .policy = nl80211_policy,
3933                 .flags = GENL_ADMIN_PERM,
3934         },
3935         {
3936                 .cmd = NL80211_CMD_ASSOCIATE,
3937                 .doit = nl80211_associate,
3938                 .policy = nl80211_policy,
3939                 .flags = GENL_ADMIN_PERM,
3940         },
3941         {
3942                 .cmd = NL80211_CMD_DEAUTHENTICATE,
3943                 .doit = nl80211_deauthenticate,
3944                 .policy = nl80211_policy,
3945                 .flags = GENL_ADMIN_PERM,
3946         },
3947         {
3948                 .cmd = NL80211_CMD_DISASSOCIATE,
3949                 .doit = nl80211_disassociate,
3950                 .policy = nl80211_policy,
3951                 .flags = GENL_ADMIN_PERM,
3952         },
3953         {
3954                 .cmd = NL80211_CMD_JOIN_IBSS,
3955                 .doit = nl80211_join_ibss,
3956                 .policy = nl80211_policy,
3957                 .flags = GENL_ADMIN_PERM,
3958         },
3959         {
3960                 .cmd = NL80211_CMD_LEAVE_IBSS,
3961                 .doit = nl80211_leave_ibss,
3962                 .policy = nl80211_policy,
3963                 .flags = GENL_ADMIN_PERM,
3964         },
3965 #ifdef CONFIG_NL80211_TESTMODE
3966         {
3967                 .cmd = NL80211_CMD_TESTMODE,
3968                 .doit = nl80211_testmode_do,
3969                 .policy = nl80211_policy,
3970                 .flags = GENL_ADMIN_PERM,
3971         },
3972 #endif
3973         {
3974                 .cmd = NL80211_CMD_CONNECT,
3975                 .doit = nl80211_connect,
3976                 .policy = nl80211_policy,
3977                 .flags = GENL_ADMIN_PERM,
3978         },
3979         {
3980                 .cmd = NL80211_CMD_DISCONNECT,
3981                 .doit = nl80211_disconnect,
3982                 .policy = nl80211_policy,
3983                 .flags = GENL_ADMIN_PERM,
3984         },
3985 };
3986 static struct genl_multicast_group nl80211_mlme_mcgrp = {
3987         .name = "mlme",
3988 };
3989
3990 /* multicast groups */
3991 static struct genl_multicast_group nl80211_config_mcgrp = {
3992         .name = "config",
3993 };
3994 static struct genl_multicast_group nl80211_scan_mcgrp = {
3995         .name = "scan",
3996 };
3997 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
3998         .name = "regulatory",
3999 };
4000
4001 /* notification functions */
4002
4003 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
4004 {
4005         struct sk_buff *msg;
4006
4007         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4008         if (!msg)
4009                 return;
4010
4011         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
4012                 nlmsg_free(msg);
4013                 return;
4014         }
4015
4016         genlmsg_multicast(msg, 0, nl80211_config_mcgrp.id, GFP_KERNEL);
4017 }
4018
4019 static int nl80211_add_scan_req(struct sk_buff *msg,
4020                                 struct cfg80211_registered_device *rdev)
4021 {
4022         struct cfg80211_scan_request *req = rdev->scan_req;
4023         struct nlattr *nest;
4024         int i;
4025
4026         if (WARN_ON(!req))
4027                 return 0;
4028
4029         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
4030         if (!nest)
4031                 goto nla_put_failure;
4032         for (i = 0; i < req->n_ssids; i++)
4033                 NLA_PUT(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid);
4034         nla_nest_end(msg, nest);
4035
4036         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
4037         if (!nest)
4038                 goto nla_put_failure;
4039         for (i = 0; i < req->n_channels; i++)
4040                 NLA_PUT_U32(msg, i, req->channels[i]->center_freq);
4041         nla_nest_end(msg, nest);
4042
4043         if (req->ie)
4044                 NLA_PUT(msg, NL80211_ATTR_IE, req->ie_len, req->ie);
4045
4046         return 0;
4047  nla_put_failure:
4048         return -ENOBUFS;
4049 }
4050
4051 static int nl80211_send_scan_msg(struct sk_buff *msg,
4052                                  struct cfg80211_registered_device *rdev,
4053                                  struct net_device *netdev,
4054                                  u32 pid, u32 seq, int flags,
4055                                  u32 cmd)
4056 {
4057         void *hdr;
4058
4059         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
4060         if (!hdr)
4061                 return -1;
4062
4063         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4064         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4065
4066         /* ignore errors and send incomplete event anyway */
4067         nl80211_add_scan_req(msg, rdev);
4068
4069         return genlmsg_end(msg, hdr);
4070
4071  nla_put_failure:
4072         genlmsg_cancel(msg, hdr);
4073         return -EMSGSIZE;
4074 }
4075
4076 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
4077                              struct net_device *netdev)
4078 {
4079         struct sk_buff *msg;
4080
4081         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
4082         if (!msg)
4083                 return;
4084
4085         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
4086                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
4087                 nlmsg_free(msg);
4088                 return;
4089         }
4090
4091         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
4092 }
4093
4094 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
4095                             struct net_device *netdev)
4096 {
4097         struct sk_buff *msg;
4098
4099         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4100         if (!msg)
4101                 return;
4102
4103         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
4104                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
4105                 nlmsg_free(msg);
4106                 return;
4107         }
4108
4109         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
4110 }
4111
4112 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
4113                                struct net_device *netdev)
4114 {
4115         struct sk_buff *msg;
4116
4117         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4118         if (!msg)
4119                 return;
4120
4121         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
4122                                   NL80211_CMD_SCAN_ABORTED) < 0) {
4123                 nlmsg_free(msg);
4124                 return;
4125         }
4126
4127         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
4128 }
4129
4130 /*
4131  * This can happen on global regulatory changes or device specific settings
4132  * based on custom world regulatory domains.
4133  */
4134 void nl80211_send_reg_change_event(struct regulatory_request *request)
4135 {
4136         struct sk_buff *msg;
4137         void *hdr;
4138
4139         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4140         if (!msg)
4141                 return;
4142
4143         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
4144         if (!hdr) {
4145                 nlmsg_free(msg);
4146                 return;
4147         }
4148
4149         /* Userspace can always count this one always being set */
4150         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
4151
4152         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
4153                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
4154                            NL80211_REGDOM_TYPE_WORLD);
4155         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
4156                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
4157                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
4158         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
4159                  request->intersect)
4160                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
4161                            NL80211_REGDOM_TYPE_INTERSECTION);
4162         else {
4163                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
4164                            NL80211_REGDOM_TYPE_COUNTRY);
4165                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
4166         }
4167
4168         if (wiphy_idx_valid(request->wiphy_idx))
4169                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
4170
4171         if (genlmsg_end(msg, hdr) < 0) {
4172                 nlmsg_free(msg);
4173                 return;
4174         }
4175
4176         genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_KERNEL);
4177
4178         return;
4179
4180 nla_put_failure:
4181         genlmsg_cancel(msg, hdr);
4182         nlmsg_free(msg);
4183 }
4184
4185 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
4186                                     struct net_device *netdev,
4187                                     const u8 *buf, size_t len,
4188                                     enum nl80211_commands cmd, gfp_t gfp)
4189 {
4190         struct sk_buff *msg;
4191         void *hdr;
4192
4193         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
4194         if (!msg)
4195                 return;
4196
4197         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
4198         if (!hdr) {
4199                 nlmsg_free(msg);
4200                 return;
4201         }
4202
4203         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4204         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4205         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
4206
4207         if (genlmsg_end(msg, hdr) < 0) {
4208                 nlmsg_free(msg);
4209                 return;
4210         }
4211
4212         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
4213         return;
4214
4215  nla_put_failure:
4216         genlmsg_cancel(msg, hdr);
4217         nlmsg_free(msg);
4218 }
4219
4220 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
4221                           struct net_device *netdev, const u8 *buf,
4222                           size_t len, gfp_t gfp)
4223 {
4224         nl80211_send_mlme_event(rdev, netdev, buf, len,
4225                                 NL80211_CMD_AUTHENTICATE, gfp);
4226 }
4227
4228 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
4229                            struct net_device *netdev, const u8 *buf,
4230                            size_t len, gfp_t gfp)
4231 {
4232         nl80211_send_mlme_event(rdev, netdev, buf, len,
4233                                 NL80211_CMD_ASSOCIATE, gfp);
4234 }
4235
4236 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
4237                          struct net_device *netdev, const u8 *buf,
4238                          size_t len, gfp_t gfp)
4239 {
4240         nl80211_send_mlme_event(rdev, netdev, buf, len,
4241                                 NL80211_CMD_DEAUTHENTICATE, gfp);
4242 }
4243
4244 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
4245                            struct net_device *netdev, const u8 *buf,
4246                            size_t len, gfp_t gfp)
4247 {
4248         nl80211_send_mlme_event(rdev, netdev, buf, len,
4249                                 NL80211_CMD_DISASSOCIATE, gfp);
4250 }
4251
4252 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
4253                                       struct net_device *netdev, int cmd,
4254                                       const u8 *addr, gfp_t gfp)
4255 {
4256         struct sk_buff *msg;
4257         void *hdr;
4258
4259         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
4260         if (!msg)
4261                 return;
4262
4263         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
4264         if (!hdr) {
4265                 nlmsg_free(msg);
4266                 return;
4267         }
4268
4269         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4270         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4271         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
4272         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
4273
4274         if (genlmsg_end(msg, hdr) < 0) {
4275                 nlmsg_free(msg);
4276                 return;
4277         }
4278
4279         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
4280         return;
4281
4282  nla_put_failure:
4283         genlmsg_cancel(msg, hdr);
4284         nlmsg_free(msg);
4285 }
4286
4287 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
4288                                struct net_device *netdev, const u8 *addr,
4289                                gfp_t gfp)
4290 {
4291         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
4292                                   addr, gfp);
4293 }
4294
4295 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
4296                                 struct net_device *netdev, const u8 *addr,
4297                                 gfp_t gfp)
4298 {
4299         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
4300                                   addr, gfp);
4301 }
4302
4303 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
4304                                  struct net_device *netdev, const u8 *bssid,
4305                                  const u8 *req_ie, size_t req_ie_len,
4306                                  const u8 *resp_ie, size_t resp_ie_len,
4307                                  u16 status, gfp_t gfp)
4308 {
4309         struct sk_buff *msg;
4310         void *hdr;
4311
4312         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
4313         if (!msg)
4314                 return;
4315
4316         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
4317         if (!hdr) {
4318                 nlmsg_free(msg);
4319                 return;
4320         }
4321
4322         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4323         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4324         if (bssid)
4325                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
4326         NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status);
4327         if (req_ie)
4328                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
4329         if (resp_ie)
4330                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
4331
4332         if (genlmsg_end(msg, hdr) < 0) {
4333                 nlmsg_free(msg);
4334                 return;
4335         }
4336
4337         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
4338         return;
4339
4340  nla_put_failure:
4341         genlmsg_cancel(msg, hdr);
4342         nlmsg_free(msg);
4343
4344 }
4345
4346 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
4347                          struct net_device *netdev, const u8 *bssid,
4348                          const u8 *req_ie, size_t req_ie_len,
4349                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
4350 {
4351         struct sk_buff *msg;
4352         void *hdr;
4353
4354         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
4355         if (!msg)
4356                 return;
4357
4358         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
4359         if (!hdr) {
4360                 nlmsg_free(msg);
4361                 return;
4362         }
4363
4364         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4365         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4366         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
4367         if (req_ie)
4368                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
4369         if (resp_ie)
4370                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
4371
4372         if (genlmsg_end(msg, hdr) < 0) {
4373                 nlmsg_free(msg);
4374                 return;
4375         }
4376
4377         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
4378         return;
4379
4380  nla_put_failure:
4381         genlmsg_cancel(msg, hdr);
4382         nlmsg_free(msg);
4383
4384 }
4385
4386 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
4387                                struct net_device *netdev, u16 reason,
4388                                u8 *ie, size_t ie_len, bool from_ap, gfp_t gfp)
4389 {
4390         struct sk_buff *msg;
4391         void *hdr;
4392
4393         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
4394         if (!msg)
4395                 return;
4396
4397         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
4398         if (!hdr) {
4399                 nlmsg_free(msg);
4400                 return;
4401         }
4402
4403         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4404         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4405         if (from_ap && reason)
4406                 NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason);
4407         if (from_ap)
4408                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISCONNECTED_BY_AP);
4409         if (ie)
4410                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len, ie);
4411
4412         if (genlmsg_end(msg, hdr) < 0) {
4413                 nlmsg_free(msg);
4414                 return;
4415         }
4416
4417         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
4418         return;
4419
4420  nla_put_failure:
4421         genlmsg_cancel(msg, hdr);
4422         nlmsg_free(msg);
4423
4424 }
4425
4426 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
4427                              struct net_device *netdev, const u8 *bssid,
4428                              gfp_t gfp)
4429 {
4430         struct sk_buff *msg;
4431         void *hdr;
4432
4433         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
4434         if (!msg)
4435                 return;
4436
4437         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
4438         if (!hdr) {
4439                 nlmsg_free(msg);
4440                 return;
4441         }
4442
4443         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4444         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4445         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
4446
4447         if (genlmsg_end(msg, hdr) < 0) {
4448                 nlmsg_free(msg);
4449                 return;
4450         }
4451
4452         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
4453         return;
4454
4455  nla_put_failure:
4456         genlmsg_cancel(msg, hdr);
4457         nlmsg_free(msg);
4458 }
4459
4460 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
4461                                  struct net_device *netdev, const u8 *addr,
4462                                  enum nl80211_key_type key_type, int key_id,
4463                                  const u8 *tsc, gfp_t gfp)
4464 {
4465         struct sk_buff *msg;
4466         void *hdr;
4467
4468         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
4469         if (!msg)
4470                 return;
4471
4472         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
4473         if (!hdr) {
4474                 nlmsg_free(msg);
4475                 return;
4476         }
4477
4478         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4479         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4480         if (addr)
4481                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
4482         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
4483         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
4484         if (tsc)
4485                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
4486
4487         if (genlmsg_end(msg, hdr) < 0) {
4488                 nlmsg_free(msg);
4489                 return;
4490         }
4491
4492         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
4493         return;
4494
4495  nla_put_failure:
4496         genlmsg_cancel(msg, hdr);
4497         nlmsg_free(msg);
4498 }
4499
4500 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
4501                                     struct ieee80211_channel *channel_before,
4502                                     struct ieee80211_channel *channel_after)
4503 {
4504         struct sk_buff *msg;
4505         void *hdr;
4506         struct nlattr *nl_freq;
4507
4508         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
4509         if (!msg)
4510                 return;
4511
4512         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
4513         if (!hdr) {
4514                 nlmsg_free(msg);
4515                 return;
4516         }
4517
4518         /*
4519          * Since we are applying the beacon hint to a wiphy we know its
4520          * wiphy_idx is valid
4521          */
4522         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
4523
4524         /* Before */
4525         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
4526         if (!nl_freq)
4527                 goto nla_put_failure;
4528         if (nl80211_msg_put_channel(msg, channel_before))
4529                 goto nla_put_failure;
4530         nla_nest_end(msg, nl_freq);
4531
4532         /* After */
4533         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
4534         if (!nl_freq)
4535                 goto nla_put_failure;
4536         if (nl80211_msg_put_channel(msg, channel_after))
4537                 goto nla_put_failure;
4538         nla_nest_end(msg, nl_freq);
4539
4540         if (genlmsg_end(msg, hdr) < 0) {
4541                 nlmsg_free(msg);
4542                 return;
4543         }
4544
4545         genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_ATOMIC);
4546
4547         return;
4548
4549 nla_put_failure:
4550         genlmsg_cancel(msg, hdr);
4551         nlmsg_free(msg);
4552 }
4553
4554 /* initialisation/exit functions */
4555
4556 int nl80211_init(void)
4557 {
4558         int err;
4559
4560         err = genl_register_family_with_ops(&nl80211_fam,
4561                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
4562         if (err)
4563                 return err;
4564
4565         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
4566         if (err)
4567                 goto err_out;
4568
4569         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
4570         if (err)
4571                 goto err_out;
4572
4573         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
4574         if (err)
4575                 goto err_out;
4576
4577         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
4578         if (err)
4579                 goto err_out;
4580
4581 #ifdef CONFIG_NL80211_TESTMODE
4582         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
4583         if (err)
4584                 goto err_out;
4585 #endif
4586
4587         return 0;
4588  err_out:
4589         genl_unregister_family(&nl80211_fam);
4590         return err;
4591 }
4592
4593 void nl80211_exit(void)
4594 {
4595         genl_unregister_family(&nl80211_fam);
4596 }