SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2009  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/list.h>
  11 #include <linux/if_ether.h>
  12 #include <linux/ieee80211.h>
  13 #include <linux/nl80211.h>
  14 #include <linux/rtnetlink.h>
  15 #include <linux/netlink.h>
  16 #include <linux/etherdevice.h>
  17 #include <net/genetlink.h>
  18 #include <net/cfg80211.h>
  19 #include "core.h"
  20 #include "nl80211.h"
  21 #include "reg.h"
  22
  23 /* the netlink family */
  24 static struct genl_family nl80211_fam = {
  25         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  26         .name = "nl80211",      /* have users key off the name instead */
  27         .hdrsize = 0,           /* no private header */
  28         .version = 1,           /* no particular meaning now */
  29         .maxattr = NL80211_ATTR_MAX,
  30 };
  31
  32 /* internal helper: get drv and dev */
  33 static int get_drv_dev_by_info_ifindex(struct nlattr **attrs,
  34                                        struct cfg80211_registered_device **drv,
  35                                        struct net_device **dev)
  36 {
  37         int ifindex;
  38
  39         if (!attrs[NL80211_ATTR_IFINDEX])
  40                 return -EINVAL;
  41
  42         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  43         *dev = dev_get_by_index(&init_net, ifindex);
  44         if (!*dev)
  45                 return -ENODEV;
  46
  47         *drv = cfg80211_get_dev_from_ifindex(ifindex);
  48         if (IS_ERR(*drv)) {
  49                 dev_put(*dev);
  50                 return PTR_ERR(*drv);
  51         }
  52
  53         return 0;
  54 }
  55
  56 /* policy for the attributes */
  57 static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
  58         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  59         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  60                                       .len = BUS_ID_SIZE-1 },
  61         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  62         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  63         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  64         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
  65         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
  66         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
  67         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
  68
  69         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  70         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  71         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  72
  73         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  74
  75         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  76                                     .len = WLAN_MAX_KEY_LEN },
  77         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  78         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  79         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
  80
  81         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
  82         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
  83         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
  84                                        .len = IEEE80211_MAX_DATA_LEN },
  85         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
  86                                        .len = IEEE80211_MAX_DATA_LEN },
  87         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
  88         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
  89         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
  90         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
  91                                                .len = NL80211_MAX_SUPP_RATES },
  92         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
  93         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
  94         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
  95         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
  96                                 .len = IEEE80211_MAX_MESH_ID_LEN },
  97         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
  98
  99         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 100         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 101
 102         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 103         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 104         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 105         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 106                                            .len = NL80211_MAX_SUPP_RATES },
 107
 108         [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
 109
 110         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 111                                          .len = NL80211_HT_CAPABILITY_LEN },
 112
 113         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 114         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 115                               .len = IEEE80211_MAX_DATA_LEN },
 116         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 117         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 118
 119         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 120                                 .len = IEEE80211_MAX_SSID_LEN },
 121         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 122         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 123         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 124         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 125         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 126         [NL80211_ATTR_STA_FLAGS2] = {
 127                 .len = sizeof(struct nl80211_sta_flag_update),
 128         },
 129         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 130 };
 131
 132 /* IE validation */
 133 static bool is_valid_ie_attr(const struct nlattr *attr)
 134 {
 135         const u8 *pos;
 136         int len;
 137
 138         if (!attr)
 139                 return true;
 140
 141         pos = nla_data(attr);
 142         len = nla_len(attr);
 143
 144         while (len) {
 145                 u8 elemlen;
 146
 147                 if (len < 2)
 148                         return false;
 149                 len -= 2;
 150
 151                 elemlen = pos[1];
 152                 if (elemlen > len)
 153                         return false;
 154
 155                 len -= elemlen;
 156                 pos += 2 + elemlen;
 157         }
 158
 159         return true;
 160 }
 161
 162 /* message building helper */
 163 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 164                                    int flags, u8 cmd)
 165 {
 166         /* since there is no private header just add the generic one */
 167         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 168 }
 169
 170 static int nl80211_msg_put_channel(struct sk_buff *msg,
 171                                    struct ieee80211_channel *chan)
 172 {
 173         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 174                     chan->center_freq);
 175
 176         if (chan->flags & IEEE80211_CHAN_DISABLED)
 177                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 178         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 179                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 180         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 181                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 182         if (chan->flags & IEEE80211_CHAN_RADAR)
 183                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 184
 185         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 186                     DBM_TO_MBM(chan->max_power));
 187
 188         return 0;
 189
 190  nla_put_failure:
 191         return -ENOBUFS;
 192 }
 193
 194 /* netlink command implementations */
 195
 196 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 197                               struct cfg80211_registered_device *dev)
 198 {
 199         void *hdr;
 200         struct nlattr *nl_bands, *nl_band;
 201         struct nlattr *nl_freqs, *nl_freq;
 202         struct nlattr *nl_rates, *nl_rate;
 203         struct nlattr *nl_modes;
 204         struct nlattr *nl_cmds;
 205         enum ieee80211_band band;
 206         struct ieee80211_channel *chan;
 207         struct ieee80211_rate *rate;
 208         int i;
 209         u16 ifmodes = dev->wiphy.interface_modes;
 210
 211         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 212         if (!hdr)
 213                 return -1;
 214
 215         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 216         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 217
 218         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 219                    dev->wiphy.retry_short);
 220         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 221                    dev->wiphy.retry_long);
 222         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 223                     dev->wiphy.frag_threshold);
 224         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 225                     dev->wiphy.rts_threshold);
 226
 227         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 228                    dev->wiphy.max_scan_ssids);
 229         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 230                     dev->wiphy.max_scan_ie_len);
 231
 232         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
 233                 sizeof(u32) * dev->wiphy.n_cipher_suites,
 234                 dev->wiphy.cipher_suites);
 235
 236         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
 237         if (!nl_modes)
 238                 goto nla_put_failure;
 239
 240         i = 0;
 241         while (ifmodes) {
 242                 if (ifmodes & 1)
 243                         NLA_PUT_FLAG(msg, i);
 244                 ifmodes >>= 1;
 245                 i++;
 246         }
 247
 248         nla_nest_end(msg, nl_modes);
 249
 250         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 251         if (!nl_bands)
 252                 goto nla_put_failure;
 253
 254         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 255                 if (!dev->wiphy.bands[band])
 256                         continue;
 257
 258                 nl_band = nla_nest_start(msg, band);
 259                 if (!nl_band)
 260                         goto nla_put_failure;
 261
 262                 /* add HT info */
 263                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 264                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 265                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 266                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 267                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 268                                 dev->wiphy.bands[band]->ht_cap.cap);
 269                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 270                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 271                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 272                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 273                 }
 274
 275                 /* add frequencies */
 276                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 277                 if (!nl_freqs)
 278                         goto nla_put_failure;
 279
 280                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 281                         nl_freq = nla_nest_start(msg, i);
 282                         if (!nl_freq)
 283                                 goto nla_put_failure;
 284
 285                         chan = &dev->wiphy.bands[band]->channels[i];
 286
 287                         if (nl80211_msg_put_channel(msg, chan))
 288                                 goto nla_put_failure;
 289
 290                         nla_nest_end(msg, nl_freq);
 291                 }
 292
 293                 nla_nest_end(msg, nl_freqs);
 294
 295                 /* add bitrates */
 296                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 297                 if (!nl_rates)
 298                         goto nla_put_failure;
 299
 300                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 301                         nl_rate = nla_nest_start(msg, i);
 302                         if (!nl_rate)
 303                                 goto nla_put_failure;
 304
 305                         rate = &dev->wiphy.bands[band]->bitrates[i];
 306                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 307                                     rate->bitrate);
 308                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 309                                 NLA_PUT_FLAG(msg,
 310                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 311
 312                         nla_nest_end(msg, nl_rate);
 313                 }
 314
 315                 nla_nest_end(msg, nl_rates);
 316
 317                 nla_nest_end(msg, nl_band);
 318         }
 319         nla_nest_end(msg, nl_bands);
 320
 321         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 322         if (!nl_cmds)
 323                 goto nla_put_failure;
 324
 325         i = 0;
 326 #define CMD(op, n)                                              \
 327          do {                                                   \
 328                 if (dev->ops->op) {                             \
 329                         i++;                                    \
 330                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 331                 }                                               \
 332         } while (0)
 333
 334         CMD(add_virtual_intf, NEW_INTERFACE);
 335         CMD(change_virtual_intf, SET_INTERFACE);
 336         CMD(add_key, NEW_KEY);
 337         CMD(add_beacon, NEW_BEACON);
 338         CMD(add_station, NEW_STATION);
 339         CMD(add_mpath, NEW_MPATH);
 340         CMD(set_mesh_params, SET_MESH_PARAMS);
 341         CMD(change_bss, SET_BSS);
 342         CMD(auth, AUTHENTICATE);
 343         CMD(assoc, ASSOCIATE);
 344         CMD(deauth, DEAUTHENTICATE);
 345         CMD(disassoc, DISASSOCIATE);
 346         CMD(join_ibss, JOIN_IBSS);
 347
 348 #undef CMD
 349         nla_nest_end(msg, nl_cmds);
 350
 351         return genlmsg_end(msg, hdr);
 352
 353  nla_put_failure:
 354         genlmsg_cancel(msg, hdr);
 355         return -EMSGSIZE;
 356 }
 357
 358 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 359 {
 360         int idx = 0;
 361         int start = cb->args[0];
 362         struct cfg80211_registered_device *dev;
 363
 364         mutex_lock(&cfg80211_mutex);
 365         list_for_each_entry(dev, &cfg80211_drv_list, list) {
 366                 if (++idx <= start)
 367                         continue;
 368                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
 369                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
 370                                        dev) < 0) {
 371                         idx--;
 372                         break;
 373                 }
 374         }
 375         mutex_unlock(&cfg80211_mutex);
 376
 377         cb->args[0] = idx;
 378
 379         return skb->len;
 380 }
 381
 382 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 383 {
 384         struct sk_buff *msg;
 385         struct cfg80211_registered_device *dev;
 386
 387         dev = cfg80211_get_dev_from_info(info);
 388         if (IS_ERR(dev))
 389                 return PTR_ERR(dev);
 390
 391         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 392         if (!msg)
 393                 goto out_err;
 394
 395         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
 396                 goto out_free;
 397
 398         cfg80211_put_dev(dev);
 399
 400         return genlmsg_unicast(msg, info->snd_pid);
 401
 402  out_free:
 403         nlmsg_free(msg);
 404  out_err:
 405         cfg80211_put_dev(dev);
 406         return -ENOBUFS;
 407 }
 408
 409 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 410         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
 411         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
 412         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
 413         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
 414         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
 415 };
 416
 417 static int parse_txq_params(struct nlattr *tb[],
 418                             struct ieee80211_txq_params *txq_params)
 419 {
 420         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 421             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 422             !tb[NL80211_TXQ_ATTR_AIFS])
 423                 return -EINVAL;
 424
 425         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
 426         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 427         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 428         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 429         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 430
 431         return 0;
 432 }
 433
 434 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 435 {
 436         struct cfg80211_registered_device *rdev;
 437         int result = 0, rem_txq_params = 0;
 438         struct nlattr *nl_txq_params;
 439         u32 changed;
 440         u8 retry_short = 0, retry_long = 0;
 441         u32 frag_threshold = 0, rts_threshold = 0;
 442
 443         rtnl_lock();
 444
 445         mutex_lock(&cfg80211_mutex);
 446
 447         rdev = __cfg80211_drv_from_info(info);
 448         if (IS_ERR(rdev)) {
 449                 result = PTR_ERR(rdev);
 450                 goto unlock;
 451         }
 452
 453         mutex_lock(&rdev->mtx);
 454
 455         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
 456                 result = cfg80211_dev_rename(
 457                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 458
 459         mutex_unlock(&cfg80211_mutex);
 460
 461         if (result)
 462                 goto bad_res;
 463
 464         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
 465                 struct ieee80211_txq_params txq_params;
 466                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
 467
 468                 if (!rdev->ops->set_txq_params) {
 469                         result = -EOPNOTSUPP;
 470                         goto bad_res;
 471                 }
 472
 473                 nla_for_each_nested(nl_txq_params,
 474                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
 475                                     rem_txq_params) {
 476                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
 477                                   nla_data(nl_txq_params),
 478                                   nla_len(nl_txq_params),
 479                                   txq_params_policy);
 480                         result = parse_txq_params(tb, &txq_params);
 481                         if (result)
 482                                 goto bad_res;
 483
 484                         result = rdev->ops->set_txq_params(&rdev->wiphy,
 485                                                            &txq_params);
 486                         if (result)
 487                                 goto bad_res;
 488                 }
 489         }
 490
 491         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
 492                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 493                 struct ieee80211_channel *chan;
 494                 struct ieee80211_sta_ht_cap *ht_cap;
 495                 u32 freq;
 496
 497                 if (!rdev->ops->set_channel) {
 498                         result = -EOPNOTSUPP;
 499                         goto bad_res;
 500                 }
 501
 502                 result = -EINVAL;
 503
 504                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 505                         channel_type = nla_get_u32(info->attrs[
 506                                            NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 507                         if (channel_type != NL80211_CHAN_NO_HT &&
 508                             channel_type != NL80211_CHAN_HT20 &&
 509                             channel_type != NL80211_CHAN_HT40PLUS &&
 510                             channel_type != NL80211_CHAN_HT40MINUS)
 511                                 goto bad_res;
 512                 }
 513
 514                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 515                 chan = ieee80211_get_channel(&rdev->wiphy, freq);
 516
 517                 /* Primary channel not allowed */
 518                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 519                         goto bad_res;
 520
 521                 if (channel_type == NL80211_CHAN_HT40MINUS &&
 522                     (chan->flags & IEEE80211_CHAN_NO_HT40MINUS))
 523                         goto bad_res;
 524                 else if (channel_type == NL80211_CHAN_HT40PLUS &&
 525                          (chan->flags & IEEE80211_CHAN_NO_HT40PLUS))
 526                         goto bad_res;
 527
 528                 /*
 529                  * At this point we know if that if HT40 was requested
 530                  * we are allowed to use it and the extension channel
 531                  * exists.
 532                  */
 533
 534                 ht_cap = &rdev->wiphy.bands[chan->band]->ht_cap;
 535
 536                 /* no HT capabilities or intolerant */
 537                 if (channel_type != NL80211_CHAN_NO_HT) {
 538                         if (!ht_cap->ht_supported)
 539                                 goto bad_res;
 540                         if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
 541                             (ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT))
 542                                 goto bad_res;
 543                 }
 544
 545                 result = rdev->ops->set_channel(&rdev->wiphy, chan,
 546                                                 channel_type);
 547                 if (result)
 548                         goto bad_res;
 549         }
 550
 551         changed = 0;
 552
 553         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
 554                 retry_short = nla_get_u8(
 555                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
 556                 if (retry_short == 0) {
 557                         result = -EINVAL;
 558                         goto bad_res;
 559                 }
 560                 changed |= WIPHY_PARAM_RETRY_SHORT;
 561         }
 562
 563         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
 564                 retry_long = nla_get_u8(
 565                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
 566                 if (retry_long == 0) {
 567                         result = -EINVAL;
 568                         goto bad_res;
 569                 }
 570                 changed |= WIPHY_PARAM_RETRY_LONG;
 571         }
 572
 573         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
 574                 frag_threshold = nla_get_u32(
 575                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
 576                 if (frag_threshold < 256) {
 577                         result = -EINVAL;
 578                         goto bad_res;
 579                 }
 580                 if (frag_threshold != (u32) -1) {
 581                         /*
 582                          * Fragments (apart from the last one) are required to
 583                          * have even length. Make the fragmentation code
 584                          * simpler by stripping LSB should someone try to use
 585                          * odd threshold value.
 586                          */
 587                         frag_threshold &= ~0x1;
 588                 }
 589                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
 590         }
 591
 592         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
 593                 rts_threshold = nla_get_u32(
 594                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
 595                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
 596         }
 597
 598         if (changed) {
 599                 u8 old_retry_short, old_retry_long;
 600                 u32 old_frag_threshold, old_rts_threshold;
 601
 602                 if (!rdev->ops->set_wiphy_params) {
 603                         result = -EOPNOTSUPP;
 604                         goto bad_res;
 605                 }
 606
 607                 old_retry_short = rdev->wiphy.retry_short;
 608                 old_retry_long = rdev->wiphy.retry_long;
 609                 old_frag_threshold = rdev->wiphy.frag_threshold;
 610                 old_rts_threshold = rdev->wiphy.rts_threshold;
 611
 612                 if (changed & WIPHY_PARAM_RETRY_SHORT)
 613                         rdev->wiphy.retry_short = retry_short;
 614                 if (changed & WIPHY_PARAM_RETRY_LONG)
 615                         rdev->wiphy.retry_long = retry_long;
 616                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
 617                         rdev->wiphy.frag_threshold = frag_threshold;
 618                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
 619                         rdev->wiphy.rts_threshold = rts_threshold;
 620
 621                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
 622                 if (result) {
 623                         rdev->wiphy.retry_short = old_retry_short;
 624                         rdev->wiphy.retry_long = old_retry_long;
 625                         rdev->wiphy.frag_threshold = old_frag_threshold;
 626                         rdev->wiphy.rts_threshold = old_rts_threshold;
 627                 }
 628         }
 629
 630  bad_res:
 631         mutex_unlock(&rdev->mtx);
 632  unlock:
 633         rtnl_unlock();
 634         return result;
 635 }
 636
 637
 638 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 639                               struct cfg80211_registered_device *rdev,
 640                               struct net_device *dev)
 641 {
 642         void *hdr;
 643
 644         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
 645         if (!hdr)
 646                 return -1;
 647
 648         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 649         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 650         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
 651         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
 652         return genlmsg_end(msg, hdr);
 653
 654  nla_put_failure:
 655         genlmsg_cancel(msg, hdr);
 656         return -EMSGSIZE;
 657 }
 658
 659 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
 660 {
 661         int wp_idx = 0;
 662         int if_idx = 0;
 663         int wp_start = cb->args[0];
 664         int if_start = cb->args[1];
 665         struct cfg80211_registered_device *dev;
 666         struct wireless_dev *wdev;
 667
 668         mutex_lock(&cfg80211_mutex);
 669         list_for_each_entry(dev, &cfg80211_drv_list, list) {
 670                 if (wp_idx < wp_start) {
 671                         wp_idx++;
 672                         continue;
 673                 }
 674                 if_idx = 0;
 675
 676                 mutex_lock(&dev->devlist_mtx);
 677                 list_for_each_entry(wdev, &dev->netdev_list, list) {
 678                         if (if_idx < if_start) {
 679                                 if_idx++;
 680                                 continue;
 681                         }
 682                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
 683                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
 684                                                dev, wdev->netdev) < 0) {
 685                                 mutex_unlock(&dev->devlist_mtx);
 686                                 goto out;
 687                         }
 688                         if_idx++;
 689                 }
 690                 mutex_unlock(&dev->devlist_mtx);
 691
 692                 wp_idx++;
 693         }
 694  out:
 695         mutex_unlock(&cfg80211_mutex);
 696
 697         cb->args[0] = wp_idx;
 698         cb->args[1] = if_idx;
 699
 700         return skb->len;
 701 }
 702
 703 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
 704 {
 705         struct sk_buff *msg;
 706         struct cfg80211_registered_device *dev;
 707         struct net_device *netdev;
 708         int err;
 709
 710         err = get_drv_dev_by_info_ifindex(info->attrs, &dev, &netdev);
 711         if (err)
 712                 return err;
 713
 714         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 715         if (!msg)
 716                 goto out_err;
 717
 718         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
 719                                dev, netdev) < 0)
 720                 goto out_free;
 721
 722         dev_put(netdev);
 723         cfg80211_put_dev(dev);
 724
 725         return genlmsg_unicast(msg, info->snd_pid);
 726
 727  out_free:
 728         nlmsg_free(msg);
 729  out_err:
 730         dev_put(netdev);
 731         cfg80211_put_dev(dev);
 732         return -ENOBUFS;
 733 }
 734
 735 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
 736         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
 737         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
 738         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
 739         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
 740         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
 741 };
 742
 743 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
 744 {
 745         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
 746         int flag;
 747
 748         *mntrflags = 0;
 749
 750         if (!nla)
 751                 return -EINVAL;
 752
 753         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
 754                              nla, mntr_flags_policy))
 755                 return -EINVAL;
 756
 757         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
 758                 if (flags[flag])
 759                         *mntrflags |= (1<<flag);
 760
 761         return 0;
 762 }
 763
 764 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 765 {
 766         struct cfg80211_registered_device *drv;
 767         struct vif_params params;
 768         int err, ifindex;
 769         enum nl80211_iftype otype, ntype;
 770         struct net_device *dev;
 771         u32 _flags, *flags = NULL;
 772         bool change = false;
 773
 774         memset(&params, 0, sizeof(params));
 775
 776         rtnl_lock();
 777
 778         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 779         if (err)
 780                 goto unlock_rtnl;
 781
 782         ifindex = dev->ifindex;
 783         otype = ntype = dev->ieee80211_ptr->iftype;
 784         dev_put(dev);
 785
 786         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 787                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 788                 if (otype != ntype)
 789                         change = true;
 790                 if (ntype > NL80211_IFTYPE_MAX) {
 791                         err = -EINVAL;
 792                         goto unlock;
 793                 }
 794         }
 795
 796         if (!drv->ops->change_virtual_intf ||
 797             !(drv->wiphy.interface_modes & (1 << ntype))) {
 798                 err = -EOPNOTSUPP;
 799                 goto unlock;
 800         }
 801
 802         if (info->attrs[NL80211_ATTR_MESH_ID]) {
 803                 if (ntype != NL80211_IFTYPE_MESH_POINT) {
 804                         err = -EINVAL;
 805                         goto unlock;
 806                 }
 807                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 808                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 809                 change = true;
 810         }
 811
 812         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
 813                 if (ntype != NL80211_IFTYPE_MONITOR) {
 814                         err = -EINVAL;
 815                         goto unlock;
 816                 }
 817                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
 818                                           &_flags);
 819                 if (err)
 820                         goto unlock;
 821
 822                 flags = &_flags;
 823                 change = true;
 824         }
 825
 826         if (change)
 827                 err = drv->ops->change_virtual_intf(&drv->wiphy, ifindex,
 828                                                     ntype, flags, &params);
 829         else
 830                 err = 0;
 831
 832         dev = __dev_get_by_index(&init_net, ifindex);
 833         WARN_ON(!dev || (!err && dev->ieee80211_ptr->iftype != ntype));
 834
 835         if (dev && !err && (ntype != otype)) {
 836                 if (otype == NL80211_IFTYPE_ADHOC)
 837                         cfg80211_clear_ibss(dev, false);
 838         }
 839
 840  unlock:
 841         cfg80211_put_dev(drv);
 842  unlock_rtnl:
 843         rtnl_unlock();
 844         return err;
 845 }
 846
 847 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
 848 {
 849         struct cfg80211_registered_device *drv;
 850         struct vif_params params;
 851         int err;
 852         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
 853         u32 flags;
 854
 855         memset(&params, 0, sizeof(params));
 856
 857         if (!info->attrs[NL80211_ATTR_IFNAME])
 858                 return -EINVAL;
 859
 860         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 861                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 862                 if (type > NL80211_IFTYPE_MAX)
 863                         return -EINVAL;
 864         }
 865
 866         rtnl_lock();
 867
 868         drv = cfg80211_get_dev_from_info(info);
 869         if (IS_ERR(drv)) {
 870                 err = PTR_ERR(drv);
 871                 goto unlock_rtnl;
 872         }
 873
 874         if (!drv->ops->add_virtual_intf ||
 875             !(drv->wiphy.interface_modes & (1 << type))) {
 876                 err = -EOPNOTSUPP;
 877                 goto unlock;
 878         }
 879
 880         if (type == NL80211_IFTYPE_MESH_POINT &&
 881             info->attrs[NL80211_ATTR_MESH_ID]) {
 882                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 883                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 884         }
 885
 886         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
 887                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
 888                                   &flags);
 889         err = drv->ops->add_virtual_intf(&drv->wiphy,
 890                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
 891                 type, err ? NULL : &flags, &params);
 892
 893  unlock:
 894         cfg80211_put_dev(drv);
 895  unlock_rtnl:
 896         rtnl_unlock();
 897         return err;
 898 }
 899
 900 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
 901 {
 902         struct cfg80211_registered_device *drv;
 903         int ifindex, err;
 904         struct net_device *dev;
 905
 906         rtnl_lock();
 907
 908         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 909         if (err)
 910                 goto unlock_rtnl;
 911         ifindex = dev->ifindex;
 912         dev_put(dev);
 913
 914         if (!drv->ops->del_virtual_intf) {
 915                 err = -EOPNOTSUPP;
 916                 goto out;
 917         }
 918
 919         err = drv->ops->del_virtual_intf(&drv->wiphy, ifindex);
 920
 921  out:
 922         cfg80211_put_dev(drv);
 923  unlock_rtnl:
 924         rtnl_unlock();
 925         return err;
 926 }
 927
 928 struct get_key_cookie {
 929         struct sk_buff *msg;
 930         int error;
 931 };
 932
 933 static void get_key_callback(void *c, struct key_params *params)
 934 {
 935         struct get_key_cookie *cookie = c;
 936
 937         if (params->key)
 938                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
 939                         params->key_len, params->key);
 940
 941         if (params->seq)
 942                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
 943                         params->seq_len, params->seq);
 944
 945         if (params->cipher)
 946                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
 947                             params->cipher);
 948
 949         return;
 950  nla_put_failure:
 951         cookie->error = 1;
 952 }
 953
 954 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
 955 {
 956         struct cfg80211_registered_device *drv;
 957         int err;
 958         struct net_device *dev;
 959         u8 key_idx = 0;
 960         u8 *mac_addr = NULL;
 961         struct get_key_cookie cookie = {
 962                 .error = 0,
 963         };
 964         void *hdr;
 965         struct sk_buff *msg;
 966
 967         if (info->attrs[NL80211_ATTR_KEY_IDX])
 968                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 969
 970         if (key_idx > 5)
 971                 return -EINVAL;
 972
 973         if (info->attrs[NL80211_ATTR_MAC])
 974                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 975
 976         rtnl_lock();
 977
 978         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 979         if (err)
 980                 goto unlock_rtnl;
 981
 982         if (!drv->ops->get_key) {
 983                 err = -EOPNOTSUPP;
 984                 goto out;
 985         }
 986
 987         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 988         if (!msg) {
 989                 err = -ENOMEM;
 990                 goto out;
 991         }
 992
 993         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
 994                              NL80211_CMD_NEW_KEY);
 995
 996         if (IS_ERR(hdr)) {
 997                 err = PTR_ERR(hdr);
 998                 goto out;
 999         }
1000
1001         cookie.msg = msg;
1002
1003         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1004         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1005         if (mac_addr)
1006                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1007
1008         err = drv->ops->get_key(&drv->wiphy, dev, key_idx, mac_addr,
1009                                 &cookie, get_key_callback);
1010
1011         if (err)
1012                 goto out;
1013
1014         if (cookie.error)
1015                 goto nla_put_failure;
1016
1017         genlmsg_end(msg, hdr);
1018         err = genlmsg_unicast(msg, info->snd_pid);
1019         goto out;
1020
1021  nla_put_failure:
1022         err = -ENOBUFS;
1023         nlmsg_free(msg);
1024  out:
1025         cfg80211_put_dev(drv);
1026         dev_put(dev);
1027  unlock_rtnl:
1028         rtnl_unlock();
1029
1030         return err;
1031 }
1032
1033 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1034 {
1035         struct cfg80211_registered_device *drv;
1036         int err;
1037         struct net_device *dev;
1038         u8 key_idx;
1039         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
1040                     u8 key_index);
1041
1042         if (!info->attrs[NL80211_ATTR_KEY_IDX])
1043                 return -EINVAL;
1044
1045         key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1046
1047         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]) {
1048                 if (key_idx < 4 || key_idx > 5)
1049                         return -EINVAL;
1050         } else if (key_idx > 3)
1051                 return -EINVAL;
1052
1053         /* currently only support setting default key */
1054         if (!info->attrs[NL80211_ATTR_KEY_DEFAULT] &&
1055             !info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT])
1056                 return -EINVAL;
1057
1058         rtnl_lock();
1059
1060         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1061         if (err)
1062                 goto unlock_rtnl;
1063
1064         if (info->attrs[NL80211_ATTR_KEY_DEFAULT])
1065                 func = drv->ops->set_default_key;
1066         else
1067                 func = drv->ops->set_default_mgmt_key;
1068
1069         if (!func) {
1070                 err = -EOPNOTSUPP;
1071                 goto out;
1072         }
1073
1074         err = func(&drv->wiphy, dev, key_idx);
1075 #ifdef CONFIG_WIRELESS_EXT
1076         if (!err) {
1077                 if (func == drv->ops->set_default_key)
1078                         dev->ieee80211_ptr->wext.default_key = key_idx;
1079                 else
1080                         dev->ieee80211_ptr->wext.default_mgmt_key = key_idx;
1081         }
1082 #endif
1083
1084  out:
1085         cfg80211_put_dev(drv);
1086         dev_put(dev);
1087
1088  unlock_rtnl:
1089         rtnl_unlock();
1090
1091         return err;
1092 }
1093
1094 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1095 {
1096         struct cfg80211_registered_device *drv;
1097         int err, i;
1098         struct net_device *dev;
1099         struct key_params params;
1100         u8 key_idx = 0;
1101         u8 *mac_addr = NULL;
1102
1103         memset(&params, 0, sizeof(params));
1104
1105         if (!info->attrs[NL80211_ATTR_KEY_CIPHER])
1106                 return -EINVAL;
1107
1108         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1109                 params.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1110                 params.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1111         }
1112
1113         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
1114                 params.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
1115                 params.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
1116         }
1117
1118         if (info->attrs[NL80211_ATTR_KEY_IDX])
1119                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1120
1121         params.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1122
1123         if (info->attrs[NL80211_ATTR_MAC])
1124                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1125
1126         if (cfg80211_validate_key_settings(&params, key_idx, mac_addr))
1127                 return -EINVAL;
1128
1129         rtnl_lock();
1130
1131         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1132         if (err)
1133                 goto unlock_rtnl;
1134
1135         for (i = 0; i < drv->wiphy.n_cipher_suites; i++)
1136                 if (params.cipher == drv->wiphy.cipher_suites[i])
1137                         break;
1138         if (i == drv->wiphy.n_cipher_suites) {
1139                 err = -EINVAL;
1140                 goto out;
1141         }
1142
1143         if (!drv->ops->add_key) {
1144                 err = -EOPNOTSUPP;
1145                 goto out;
1146         }
1147
1148         err = drv->ops->add_key(&drv->wiphy, dev, key_idx, mac_addr, &params);
1149
1150  out:
1151         cfg80211_put_dev(drv);
1152         dev_put(dev);
1153  unlock_rtnl:
1154         rtnl_unlock();
1155
1156         return err;
1157 }
1158
1159 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1160 {
1161         struct cfg80211_registered_device *drv;
1162         int err;
1163         struct net_device *dev;
1164         u8 key_idx = 0;
1165         u8 *mac_addr = NULL;
1166
1167         if (info->attrs[NL80211_ATTR_KEY_IDX])
1168                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1169
1170         if (key_idx > 5)
1171                 return -EINVAL;
1172
1173         if (info->attrs[NL80211_ATTR_MAC])
1174                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1175
1176         rtnl_lock();
1177
1178         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1179         if (err)
1180                 goto unlock_rtnl;
1181
1182         if (!drv->ops->del_key) {
1183                 err = -EOPNOTSUPP;
1184                 goto out;
1185         }
1186
1187         err = drv->ops->del_key(&drv->wiphy, dev, key_idx, mac_addr);
1188
1189 #ifdef CONFIG_WIRELESS_EXT
1190         if (!err) {
1191                 if (key_idx == dev->ieee80211_ptr->wext.default_key)
1192                         dev->ieee80211_ptr->wext.default_key = -1;
1193                 else if (key_idx == dev->ieee80211_ptr->wext.default_mgmt_key)
1194                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
1195         }
1196 #endif
1197
1198  out:
1199         cfg80211_put_dev(drv);
1200         dev_put(dev);
1201
1202  unlock_rtnl:
1203         rtnl_unlock();
1204
1205         return err;
1206 }
1207
1208 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1209 {
1210         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1211                     struct beacon_parameters *info);
1212         struct cfg80211_registered_device *drv;
1213         int err;
1214         struct net_device *dev;
1215         struct beacon_parameters params;
1216         int haveinfo = 0;
1217
1218         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
1219                 return -EINVAL;
1220
1221         rtnl_lock();
1222
1223         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1224         if (err)
1225                 goto unlock_rtnl;
1226
1227         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1228                 err = -EOPNOTSUPP;
1229                 goto out;
1230         }
1231
1232         switch (info->genlhdr->cmd) {
1233         case NL80211_CMD_NEW_BEACON:
1234                 /* these are required for NEW_BEACON */
1235                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1236                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1237                     !info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1238                         err = -EINVAL;
1239                         goto out;
1240                 }
1241
1242                 call = drv->ops->add_beacon;
1243                 break;
1244         case NL80211_CMD_SET_BEACON:
1245                 call = drv->ops->set_beacon;
1246                 break;
1247         default:
1248                 WARN_ON(1);
1249                 err = -EOPNOTSUPP;
1250                 goto out;
1251         }
1252
1253         if (!call) {
1254                 err = -EOPNOTSUPP;
1255                 goto out;
1256         }
1257
1258         memset(&params, 0, sizeof(params));
1259
1260         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1261                 params.interval =
1262                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1263                 haveinfo = 1;
1264         }
1265
1266         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1267                 params.dtim_period =
1268                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1269                 haveinfo = 1;
1270         }
1271
1272         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1273                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1274                 params.head_len =
1275                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1276                 haveinfo = 1;
1277         }
1278
1279         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1280                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1281                 params.tail_len =
1282                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1283                 haveinfo = 1;
1284         }
1285
1286         if (!haveinfo) {
1287                 err = -EINVAL;
1288                 goto out;
1289         }
1290
1291         err = call(&drv->wiphy, dev, &params);
1292
1293  out:
1294         cfg80211_put_dev(drv);
1295         dev_put(dev);
1296  unlock_rtnl:
1297         rtnl_unlock();
1298
1299         return err;
1300 }
1301
1302 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1303 {
1304         struct cfg80211_registered_device *drv;
1305         int err;
1306         struct net_device *dev;
1307
1308         rtnl_lock();
1309
1310         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1311         if (err)
1312                 goto unlock_rtnl;
1313
1314         if (!drv->ops->del_beacon) {
1315                 err = -EOPNOTSUPP;
1316                 goto out;
1317         }
1318
1319         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1320                 err = -EOPNOTSUPP;
1321                 goto out;
1322         }
1323         err = drv->ops->del_beacon(&drv->wiphy, dev);
1324
1325  out:
1326         cfg80211_put_dev(drv);
1327         dev_put(dev);
1328  unlock_rtnl:
1329         rtnl_unlock();
1330
1331         return err;
1332 }
1333
1334 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1335         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1336         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1337         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1338         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
1339 };
1340
1341 static int parse_station_flags(struct genl_info *info,
1342                                struct station_parameters *params)
1343 {
1344         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1345         struct nlattr *nla;
1346         int flag;
1347
1348         /*
1349          * Try parsing the new attribute first so userspace
1350          * can specify both for older kernels.
1351          */
1352         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
1353         if (nla) {
1354                 struct nl80211_sta_flag_update *sta_flags;
1355
1356                 sta_flags = nla_data(nla);
1357                 params->sta_flags_mask = sta_flags->mask;
1358                 params->sta_flags_set = sta_flags->set;
1359                 if ((params->sta_flags_mask |
1360                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
1361                         return -EINVAL;
1362                 return 0;
1363         }
1364
1365         /* if present, parse the old attribute */
1366
1367         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
1368         if (!nla)
1369                 return 0;
1370
1371         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1372                              nla, sta_flags_policy))
1373                 return -EINVAL;
1374
1375         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
1376         params->sta_flags_mask &= ~1;
1377
1378         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1379                 if (flags[flag])
1380                         params->sta_flags_set |= (1<<flag);
1381
1382         return 0;
1383 }
1384
1385 static u16 nl80211_calculate_bitrate(struct rate_info *rate)
1386 {
1387         int modulation, streams, bitrate;
1388
1389         if (!(rate->flags & RATE_INFO_FLAGS_MCS))
1390                 return rate->legacy;
1391
1392         /* the formula below does only work for MCS values smaller than 32 */
1393         if (rate->mcs >= 32)
1394                 return 0;
1395
1396         modulation = rate->mcs & 7;
1397         streams = (rate->mcs >> 3) + 1;
1398
1399         bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
1400                         13500000 : 6500000;
1401
1402         if (modulation < 4)
1403                 bitrate *= (modulation + 1);
1404         else if (modulation == 4)
1405                 bitrate *= (modulation + 2);
1406         else
1407                 bitrate *= (modulation + 3);
1408
1409         bitrate *= streams;
1410
1411         if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
1412                 bitrate = (bitrate / 9) * 10;
1413
1414         /* do NOT round down here */
1415         return (bitrate + 50000) / 100000;
1416 }
1417
1418 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1419                                 int flags, struct net_device *dev,
1420                                 u8 *mac_addr, struct station_info *sinfo)
1421 {
1422         void *hdr;
1423         struct nlattr *sinfoattr, *txrate;
1424         u16 bitrate;
1425
1426         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1427         if (!hdr)
1428                 return -1;
1429
1430         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1431         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1432
1433         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1434         if (!sinfoattr)
1435                 goto nla_put_failure;
1436         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1437                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1438                             sinfo->inactive_time);
1439         if (sinfo->filled & STATION_INFO_RX_BYTES)
1440                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1441                             sinfo->rx_bytes);
1442         if (sinfo->filled & STATION_INFO_TX_BYTES)
1443                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1444                             sinfo->tx_bytes);
1445         if (sinfo->filled & STATION_INFO_LLID)
1446                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1447                             sinfo->llid);
1448         if (sinfo->filled & STATION_INFO_PLID)
1449                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1450                             sinfo->plid);
1451         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1452                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1453                             sinfo->plink_state);
1454         if (sinfo->filled & STATION_INFO_SIGNAL)
1455                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1456                            sinfo->signal);
1457         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1458                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1459                 if (!txrate)
1460                         goto nla_put_failure;
1461
1462                 /* nl80211_calculate_bitrate will return 0 for mcs >= 32 */
1463                 bitrate = nl80211_calculate_bitrate(&sinfo->txrate);
1464                 if (bitrate > 0)
1465                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1466
1467                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1468                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1469                                     sinfo->txrate.mcs);
1470                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1471                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1472                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1473                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1474
1475                 nla_nest_end(msg, txrate);
1476         }
1477         if (sinfo->filled & STATION_INFO_RX_PACKETS)
1478                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
1479                             sinfo->rx_packets);
1480         if (sinfo->filled & STATION_INFO_TX_PACKETS)
1481                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
1482                             sinfo->tx_packets);
1483         nla_nest_end(msg, sinfoattr);
1484
1485         return genlmsg_end(msg, hdr);
1486
1487  nla_put_failure:
1488         genlmsg_cancel(msg, hdr);
1489         return -EMSGSIZE;
1490 }
1491
1492 static int nl80211_dump_station(struct sk_buff *skb,
1493                                 struct netlink_callback *cb)
1494 {
1495         struct station_info sinfo;
1496         struct cfg80211_registered_device *dev;
1497         struct net_device *netdev;
1498         u8 mac_addr[ETH_ALEN];
1499         int ifidx = cb->args[0];
1500         int sta_idx = cb->args[1];
1501         int err;
1502
1503         if (!ifidx) {
1504                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1505                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1506                                   nl80211_policy);
1507                 if (err)
1508                         return err;
1509
1510                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1511                         return -EINVAL;
1512
1513                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1514                 if (!ifidx)
1515                         return -EINVAL;
1516         }
1517
1518         rtnl_lock();
1519
1520         netdev = __dev_get_by_index(&init_net, ifidx);
1521         if (!netdev) {
1522                 err = -ENODEV;
1523                 goto out_rtnl;
1524         }
1525
1526         dev = cfg80211_get_dev_from_ifindex(ifidx);
1527         if (IS_ERR(dev)) {
1528                 err = PTR_ERR(dev);
1529                 goto out_rtnl;
1530         }
1531
1532         if (!dev->ops->dump_station) {
1533                 err = -EOPNOTSUPP;
1534                 goto out_err;
1535         }
1536
1537         while (1) {
1538                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1539                                              mac_addr, &sinfo);
1540                 if (err == -ENOENT)
1541                         break;
1542                 if (err)
1543                         goto out_err;
1544
1545                 if (nl80211_send_station(skb,
1546                                 NETLINK_CB(cb->skb).pid,
1547                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
1548                                 netdev, mac_addr,
1549                                 &sinfo) < 0)
1550                         goto out;
1551
1552                 sta_idx++;
1553         }
1554
1555
1556  out:
1557         cb->args[1] = sta_idx;
1558         err = skb->len;
1559  out_err:
1560         cfg80211_put_dev(dev);
1561  out_rtnl:
1562         rtnl_unlock();
1563
1564         return err;
1565 }
1566
1567 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1568 {
1569         struct cfg80211_registered_device *drv;
1570         int err;
1571         struct net_device *dev;
1572         struct station_info sinfo;
1573         struct sk_buff *msg;
1574         u8 *mac_addr = NULL;
1575
1576         memset(&sinfo, 0, sizeof(sinfo));
1577
1578         if (!info->attrs[NL80211_ATTR_MAC])
1579                 return -EINVAL;
1580
1581         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1582
1583         rtnl_lock();
1584
1585         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1586         if (err)
1587                 goto out_rtnl;
1588
1589         if (!drv->ops->get_station) {
1590                 err = -EOPNOTSUPP;
1591                 goto out;
1592         }
1593
1594         err = drv->ops->get_station(&drv->wiphy, dev, mac_addr, &sinfo);
1595         if (err)
1596                 goto out;
1597
1598         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1599         if (!msg)
1600                 goto out;
1601
1602         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1603                                  dev, mac_addr, &sinfo) < 0)
1604                 goto out_free;
1605
1606         err = genlmsg_unicast(msg, info->snd_pid);
1607         goto out;
1608
1609  out_free:
1610         nlmsg_free(msg);
1611  out:
1612         cfg80211_put_dev(drv);
1613         dev_put(dev);
1614  out_rtnl:
1615         rtnl_unlock();
1616
1617         return err;
1618 }
1619
1620 /*
1621  * Get vlan interface making sure it is on the right wiphy.
1622  */
1623 static int get_vlan(struct nlattr *vlanattr,
1624                     struct cfg80211_registered_device *rdev,
1625                     struct net_device **vlan)
1626 {
1627         *vlan = NULL;
1628
1629         if (vlanattr) {
1630                 *vlan = dev_get_by_index(&init_net, nla_get_u32(vlanattr));
1631                 if (!*vlan)
1632                         return -ENODEV;
1633                 if (!(*vlan)->ieee80211_ptr)
1634                         return -EINVAL;
1635                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
1636                         return -EINVAL;
1637         }
1638         return 0;
1639 }
1640
1641 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
1642 {
1643         struct cfg80211_registered_device *drv;
1644         int err;
1645         struct net_device *dev;
1646         struct station_parameters params;
1647         u8 *mac_addr = NULL;
1648
1649         memset(&params, 0, sizeof(params));
1650
1651         params.listen_interval = -1;
1652
1653         if (info->attrs[NL80211_ATTR_STA_AID])
1654                 return -EINVAL;
1655
1656         if (!info->attrs[NL80211_ATTR_MAC])
1657                 return -EINVAL;
1658
1659         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1660
1661         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
1662                 params.supported_rates =
1663                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1664                 params.supported_rates_len =
1665                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1666         }
1667
1668         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1669                 params.listen_interval =
1670                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1671
1672         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1673                 params.ht_capa =
1674                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1675
1676         if (parse_station_flags(info, &params))
1677                 return -EINVAL;
1678
1679         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
1680                 params.plink_action =
1681                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
1682
1683         rtnl_lock();
1684
1685         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1686         if (err)
1687                 goto out_rtnl;
1688
1689         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1690         if (err)
1691                 goto out;
1692
1693         if (!drv->ops->change_station) {
1694                 err = -EOPNOTSUPP;
1695                 goto out;
1696         }
1697
1698         err = drv->ops->change_station(&drv->wiphy, dev, mac_addr, &params);
1699
1700  out:
1701         if (params.vlan)
1702                 dev_put(params.vlan);
1703         cfg80211_put_dev(drv);
1704         dev_put(dev);
1705  out_rtnl:
1706         rtnl_unlock();
1707
1708         return err;
1709 }
1710
1711 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
1712 {
1713         struct cfg80211_registered_device *drv;
1714         int err;
1715         struct net_device *dev;
1716         struct station_parameters params;
1717         u8 *mac_addr = NULL;
1718
1719         memset(&params, 0, sizeof(params));
1720
1721         if (!info->attrs[NL80211_ATTR_MAC])
1722                 return -EINVAL;
1723
1724         if (!info->attrs[NL80211_ATTR_STA_AID])
1725                 return -EINVAL;
1726
1727         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1728                 return -EINVAL;
1729
1730         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
1731                 return -EINVAL;
1732
1733         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1734         params.supported_rates =
1735                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1736         params.supported_rates_len =
1737                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1738         params.listen_interval =
1739                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1740         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
1741         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1742                 params.ht_capa =
1743                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1744
1745         if (parse_station_flags(info, &params))
1746                 return -EINVAL;
1747
1748         rtnl_lock();
1749
1750         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1751         if (err)
1752                 goto out_rtnl;
1753
1754         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1755             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN) {
1756                 err = -EINVAL;
1757                 goto out;
1758         }
1759
1760         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1761         if (err)
1762                 goto out;
1763
1764         if (!drv->ops->add_station) {
1765                 err = -EOPNOTSUPP;
1766                 goto out;
1767         }
1768
1769         if (!netif_running(dev)) {
1770                 err = -ENETDOWN;
1771                 goto out;
1772         }
1773
1774         err = drv->ops->add_station(&drv->wiphy, dev, mac_addr, &params);
1775
1776  out:
1777         if (params.vlan)
1778                 dev_put(params.vlan);
1779         cfg80211_put_dev(drv);
1780         dev_put(dev);
1781  out_rtnl:
1782         rtnl_unlock();
1783
1784         return err;
1785 }
1786
1787 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
1788 {
1789         struct cfg80211_registered_device *drv;
1790         int err;
1791         struct net_device *dev;
1792         u8 *mac_addr = NULL;
1793
1794         if (info->attrs[NL80211_ATTR_MAC])
1795                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1796
1797         rtnl_lock();
1798
1799         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1800         if (err)
1801                 goto out_rtnl;
1802
1803         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1804             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN) {
1805                 err = -EINVAL;
1806                 goto out;
1807         }
1808
1809         if (!drv->ops->del_station) {
1810                 err = -EOPNOTSUPP;
1811                 goto out;
1812         }
1813
1814         err = drv->ops->del_station(&drv->wiphy, dev, mac_addr);
1815
1816  out:
1817         cfg80211_put_dev(drv);
1818         dev_put(dev);
1819  out_rtnl:
1820         rtnl_unlock();
1821
1822         return err;
1823 }
1824
1825 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
1826                                 int flags, struct net_device *dev,
1827                                 u8 *dst, u8 *next_hop,
1828                                 struct mpath_info *pinfo)
1829 {
1830         void *hdr;
1831         struct nlattr *pinfoattr;
1832
1833         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1834         if (!hdr)
1835                 return -1;
1836
1837         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1838         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
1839         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
1840
1841         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
1842         if (!pinfoattr)
1843                 goto nla_put_failure;
1844         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
1845                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
1846                             pinfo->frame_qlen);
1847         if (pinfo->filled & MPATH_INFO_DSN)
1848                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DSN,
1849                             pinfo->dsn);
1850         if (pinfo->filled & MPATH_INFO_METRIC)
1851                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
1852                             pinfo->metric);
1853         if (pinfo->filled & MPATH_INFO_EXPTIME)
1854                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
1855                             pinfo->exptime);
1856         if (pinfo->filled & MPATH_INFO_FLAGS)
1857                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
1858                             pinfo->flags);
1859         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
1860                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
1861                             pinfo->discovery_timeout);
1862         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
1863                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
1864                             pinfo->discovery_retries);
1865
1866         nla_nest_end(msg, pinfoattr);
1867
1868         return genlmsg_end(msg, hdr);
1869
1870  nla_put_failure:
1871         genlmsg_cancel(msg, hdr);
1872         return -EMSGSIZE;
1873 }
1874
1875 static int nl80211_dump_mpath(struct sk_buff *skb,
1876                               struct netlink_callback *cb)
1877 {
1878         struct mpath_info pinfo;
1879         struct cfg80211_registered_device *dev;
1880         struct net_device *netdev;
1881         u8 dst[ETH_ALEN];
1882         u8 next_hop[ETH_ALEN];
1883         int ifidx = cb->args[0];
1884         int path_idx = cb->args[1];
1885         int err;
1886
1887         if (!ifidx) {
1888                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1889                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1890                                   nl80211_policy);
1891                 if (err)
1892                         return err;
1893
1894                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1895                         return -EINVAL;
1896
1897                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1898                 if (!ifidx)
1899                         return -EINVAL;
1900         }
1901
1902         rtnl_lock();
1903
1904         netdev = __dev_get_by_index(&init_net, ifidx);
1905         if (!netdev) {
1906                 err = -ENODEV;
1907                 goto out_rtnl;
1908         }
1909
1910         dev = cfg80211_get_dev_from_ifindex(ifidx);
1911         if (IS_ERR(dev)) {
1912                 err = PTR_ERR(dev);
1913                 goto out_rtnl;
1914         }
1915
1916         if (!dev->ops->dump_mpath) {
1917                 err = -EOPNOTSUPP;
1918                 goto out_err;
1919         }
1920
1921         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1922                 err = -EOPNOTSUPP;
1923                 goto out;
1924         }
1925
1926         while (1) {
1927                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
1928                                            dst, next_hop, &pinfo);
1929                 if (err == -ENOENT)
1930                         break;
1931                 if (err)
1932                         goto out_err;
1933
1934                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
1935                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
1936                                        netdev, dst, next_hop,
1937                                        &pinfo) < 0)
1938                         goto out;
1939
1940                 path_idx++;
1941         }
1942
1943
1944  out:
1945         cb->args[1] = path_idx;
1946         err = skb->len;
1947  out_err:
1948         cfg80211_put_dev(dev);
1949  out_rtnl:
1950         rtnl_unlock();
1951
1952         return err;
1953 }
1954
1955 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
1956 {
1957         struct cfg80211_registered_device *drv;
1958         int err;
1959         struct net_device *dev;
1960         struct mpath_info pinfo;
1961         struct sk_buff *msg;
1962         u8 *dst = NULL;
1963         u8 next_hop[ETH_ALEN];
1964
1965         memset(&pinfo, 0, sizeof(pinfo));
1966
1967         if (!info->attrs[NL80211_ATTR_MAC])
1968                 return -EINVAL;
1969
1970         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1971
1972         rtnl_lock();
1973
1974         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1975         if (err)
1976                 goto out_rtnl;
1977
1978         if (!drv->ops->get_mpath) {
1979                 err = -EOPNOTSUPP;
1980                 goto out;
1981         }
1982
1983         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1984                 err = -EOPNOTSUPP;
1985                 goto out;
1986         }
1987
1988         err = drv->ops->get_mpath(&drv->wiphy, dev, dst, next_hop, &pinfo);
1989         if (err)
1990                 goto out;
1991
1992         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1993         if (!msg)
1994                 goto out;
1995
1996         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
1997                                  dev, dst, next_hop, &pinfo) < 0)
1998                 goto out_free;
1999
2000         err = genlmsg_unicast(msg, info->snd_pid);
2001         goto out;
2002
2003  out_free:
2004         nlmsg_free(msg);
2005  out:
2006         cfg80211_put_dev(drv);
2007         dev_put(dev);
2008  out_rtnl:
2009         rtnl_unlock();
2010
2011         return err;
2012 }
2013
2014 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2015 {
2016         struct cfg80211_registered_device *drv;
2017         int err;
2018         struct net_device *dev;
2019         u8 *dst = NULL;
2020         u8 *next_hop = NULL;
2021
2022         if (!info->attrs[NL80211_ATTR_MAC])
2023                 return -EINVAL;
2024
2025         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2026                 return -EINVAL;
2027
2028         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2029         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2030
2031         rtnl_lock();
2032
2033         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2034         if (err)
2035                 goto out_rtnl;
2036
2037         if (!drv->ops->change_mpath) {
2038                 err = -EOPNOTSUPP;
2039                 goto out;
2040         }
2041
2042         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2043                 err = -EOPNOTSUPP;
2044                 goto out;
2045         }
2046
2047         if (!netif_running(dev)) {
2048                 err = -ENETDOWN;
2049                 goto out;
2050         }
2051
2052         err = drv->ops->change_mpath(&drv->wiphy, dev, dst, next_hop);
2053
2054  out:
2055         cfg80211_put_dev(drv);
2056         dev_put(dev);
2057  out_rtnl:
2058         rtnl_unlock();
2059
2060         return err;
2061 }
2062 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2063 {
2064         struct cfg80211_registered_device *drv;
2065         int err;
2066         struct net_device *dev;
2067         u8 *dst = NULL;
2068         u8 *next_hop = NULL;
2069
2070         if (!info->attrs[NL80211_ATTR_MAC])
2071                 return -EINVAL;
2072
2073         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2074                 return -EINVAL;
2075
2076         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2077         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2078
2079         rtnl_lock();
2080
2081         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2082         if (err)
2083                 goto out_rtnl;
2084
2085         if (!drv->ops->add_mpath) {
2086                 err = -EOPNOTSUPP;
2087                 goto out;
2088         }
2089
2090         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2091                 err = -EOPNOTSUPP;
2092                 goto out;
2093         }
2094
2095         if (!netif_running(dev)) {
2096                 err = -ENETDOWN;
2097                 goto out;
2098         }
2099
2100         err = drv->ops->add_mpath(&drv->wiphy, dev, dst, next_hop);
2101
2102  out:
2103         cfg80211_put_dev(drv);
2104         dev_put(dev);
2105  out_rtnl:
2106         rtnl_unlock();
2107
2108         return err;
2109 }
2110
2111 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2112 {
2113         struct cfg80211_registered_device *drv;
2114         int err;
2115         struct net_device *dev;
2116         u8 *dst = NULL;
2117
2118         if (info->attrs[NL80211_ATTR_MAC])
2119                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2120
2121         rtnl_lock();
2122
2123         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2124         if (err)
2125                 goto out_rtnl;
2126
2127         if (!drv->ops->del_mpath) {
2128                 err = -EOPNOTSUPP;
2129                 goto out;
2130         }
2131
2132         err = drv->ops->del_mpath(&drv->wiphy, dev, dst);
2133
2134  out:
2135         cfg80211_put_dev(drv);
2136         dev_put(dev);
2137  out_rtnl:
2138         rtnl_unlock();
2139
2140         return err;
2141 }
2142
2143 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2144 {
2145         struct cfg80211_registered_device *drv;
2146         int err;
2147         struct net_device *dev;
2148         struct bss_parameters params;
2149
2150         memset(&params, 0, sizeof(params));
2151         /* default to not changing parameters */
2152         params.use_cts_prot = -1;
2153         params.use_short_preamble = -1;
2154         params.use_short_slot_time = -1;
2155
2156         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2157                 params.use_cts_prot =
2158                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2159         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2160                 params.use_short_preamble =
2161                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2162         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2163                 params.use_short_slot_time =
2164                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2165         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2166                 params.basic_rates =
2167                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2168                 params.basic_rates_len =
2169                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2170         }
2171
2172         rtnl_lock();
2173
2174         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2175         if (err)
2176                 goto out_rtnl;
2177
2178         if (!drv->ops->change_bss) {
2179                 err = -EOPNOTSUPP;
2180                 goto out;
2181         }
2182
2183         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
2184                 err = -EOPNOTSUPP;
2185                 goto out;
2186         }
2187
2188         err = drv->ops->change_bss(&drv->wiphy, dev, &params);
2189
2190  out:
2191         cfg80211_put_dev(drv);
2192         dev_put(dev);
2193  out_rtnl:
2194         rtnl_unlock();
2195
2196         return err;
2197 }
2198
2199 static const struct nla_policy
2200         reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2201         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2202         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2203         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2204         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2205         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2206         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2207 };
2208
2209 static int parse_reg_rule(struct nlattr *tb[],
2210         struct ieee80211_reg_rule *reg_rule)
2211 {
2212         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2213         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2214
2215         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2216                 return -EINVAL;
2217         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2218                 return -EINVAL;
2219         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2220                 return -EINVAL;
2221         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2222                 return -EINVAL;
2223         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2224                 return -EINVAL;
2225
2226         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2227
2228         freq_range->start_freq_khz =
2229                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2230         freq_range->end_freq_khz =
2231                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2232         freq_range->max_bandwidth_khz =
2233                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2234
2235         power_rule->max_eirp =
2236                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2237
2238         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2239                 power_rule->max_antenna_gain =
2240                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2241
2242         return 0;
2243 }
2244
2245 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2246 {
2247         int r;
2248         char *data = NULL;
2249
2250         /*
2251          * You should only get this when cfg80211 hasn't yet initialized
2252          * completely when built-in to the kernel right between the time
2253          * window between nl80211_init() and regulatory_init(), if that is
2254          * even possible.
2255          */
2256         mutex_lock(&cfg80211_mutex);
2257         if (unlikely(!cfg80211_regdomain)) {
2258                 mutex_unlock(&cfg80211_mutex);
2259                 return -EINPROGRESS;
2260         }
2261         mutex_unlock(&cfg80211_mutex);
2262
2263         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2264                 return -EINVAL;
2265
2266         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2267
2268 #ifdef CONFIG_WIRELESS_OLD_REGULATORY
2269         /* We ignore world regdom requests with the old regdom setup */
2270         if (is_world_regdom(data))
2271                 return -EINVAL;
2272 #endif
2273
2274         r = regulatory_hint_user(data);
2275
2276         return r;
2277 }
2278
2279 static int nl80211_get_mesh_params(struct sk_buff *skb,
2280         struct genl_info *info)
2281 {
2282         struct cfg80211_registered_device *drv;
2283         struct mesh_config cur_params;
2284         int err;
2285         struct net_device *dev;
2286         void *hdr;
2287         struct nlattr *pinfoattr;
2288         struct sk_buff *msg;
2289
2290         rtnl_lock();
2291
2292         /* Look up our device */
2293         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2294         if (err)
2295                 goto out_rtnl;
2296
2297         if (!drv->ops->get_mesh_params) {
2298                 err = -EOPNOTSUPP;
2299                 goto out;
2300         }
2301
2302         /* Get the mesh params */
2303         err = drv->ops->get_mesh_params(&drv->wiphy, dev, &cur_params);
2304         if (err)
2305                 goto out;
2306
2307         /* Draw up a netlink message to send back */
2308         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2309         if (!msg) {
2310                 err = -ENOBUFS;
2311                 goto out;
2312         }
2313         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2314                              NL80211_CMD_GET_MESH_PARAMS);
2315         if (!hdr)
2316                 goto nla_put_failure;
2317         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
2318         if (!pinfoattr)
2319                 goto nla_put_failure;
2320         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2321         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2322                         cur_params.dot11MeshRetryTimeout);
2323         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2324                         cur_params.dot11MeshConfirmTimeout);
2325         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2326                         cur_params.dot11MeshHoldingTimeout);
2327         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2328                         cur_params.dot11MeshMaxPeerLinks);
2329         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2330                         cur_params.dot11MeshMaxRetries);
2331         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2332                         cur_params.dot11MeshTTL);
2333         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2334                         cur_params.auto_open_plinks);
2335         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2336                         cur_params.dot11MeshHWMPmaxPREQretries);
2337         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2338                         cur_params.path_refresh_time);
2339         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2340                         cur_params.min_discovery_timeout);
2341         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2342                         cur_params.dot11MeshHWMPactivePathTimeout);
2343         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2344                         cur_params.dot11MeshHWMPpreqMinInterval);
2345         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2346                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2347         nla_nest_end(msg, pinfoattr);
2348         genlmsg_end(msg, hdr);
2349         err = genlmsg_unicast(msg, info->snd_pid);
2350         goto out;
2351
2352  nla_put_failure:
2353         genlmsg_cancel(msg, hdr);
2354         err = -EMSGSIZE;
2355  out:
2356         /* Cleanup */
2357         cfg80211_put_dev(drv);
2358         dev_put(dev);
2359  out_rtnl:
2360         rtnl_unlock();
2361
2362         return err;
2363 }
2364
2365 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2366 do {\
2367         if (table[attr_num]) {\
2368                 cfg.param = nla_fn(table[attr_num]); \
2369                 mask |= (1 << (attr_num - 1)); \
2370         } \
2371 } while (0);\
2372
2373 static struct nla_policy
2374 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] __read_mostly = {
2375         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2376         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2377         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2378         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2379         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2380         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2381         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2382
2383         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2384         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2385         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2386         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2387         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2388         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2389 };
2390
2391 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2392 {
2393         int err;
2394         u32 mask;
2395         struct cfg80211_registered_device *drv;
2396         struct net_device *dev;
2397         struct mesh_config cfg;
2398         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2399         struct nlattr *parent_attr;
2400
2401         parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
2402         if (!parent_attr)
2403                 return -EINVAL;
2404         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2405                         parent_attr, nl80211_meshconf_params_policy))
2406                 return -EINVAL;
2407
2408         rtnl_lock();
2409
2410         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2411         if (err)
2412                 goto out_rtnl;
2413
2414         if (!drv->ops->set_mesh_params) {
2415                 err = -EOPNOTSUPP;
2416                 goto out;
2417         }
2418
2419         /* This makes sure that there aren't more than 32 mesh config
2420          * parameters (otherwise our bitfield scheme would not work.) */
2421         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2422
2423         /* Fill in the params struct */
2424         mask = 0;
2425         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2426                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2427         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2428                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2429         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2430                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2431         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2432                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2433         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2434                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2435         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2436                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2437         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2438                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2439         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2440                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2441                         nla_get_u8);
2442         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2443                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2444         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2445                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2446                         nla_get_u16);
2447         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2448                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2449                         nla_get_u32);
2450         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2451                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2452                         nla_get_u16);
2453         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2454                         dot11MeshHWMPnetDiameterTraversalTime,
2455                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2456                         nla_get_u16);
2457
2458         /* Apply changes */
2459         err = drv->ops->set_mesh_params(&drv->wiphy, dev, &cfg, mask);
2460
2461  out:
2462         /* cleanup */
2463         cfg80211_put_dev(drv);
2464         dev_put(dev);
2465  out_rtnl:
2466         rtnl_unlock();
2467
2468         return err;
2469 }
2470
2471 #undef FILL_IN_MESH_PARAM_IF_SET
2472
2473 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2474 {
2475         struct sk_buff *msg;
2476         void *hdr = NULL;
2477         struct nlattr *nl_reg_rules;
2478         unsigned int i;
2479         int err = -EINVAL;
2480
2481         mutex_lock(&cfg80211_mutex);
2482
2483         if (!cfg80211_regdomain)
2484                 goto out;
2485
2486         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2487         if (!msg) {
2488                 err = -ENOBUFS;
2489                 goto out;
2490         }
2491
2492         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2493                              NL80211_CMD_GET_REG);
2494         if (!hdr)
2495                 goto nla_put_failure;
2496
2497         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2498                 cfg80211_regdomain->alpha2);
2499
2500         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2501         if (!nl_reg_rules)
2502                 goto nla_put_failure;
2503
2504         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2505                 struct nlattr *nl_reg_rule;
2506                 const struct ieee80211_reg_rule *reg_rule;
2507                 const struct ieee80211_freq_range *freq_range;
2508                 const struct ieee80211_power_rule *power_rule;
2509
2510                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2511                 freq_range = &reg_rule->freq_range;
2512                 power_rule = &reg_rule->power_rule;
2513
2514                 nl_reg_rule = nla_nest_start(msg, i);
2515                 if (!nl_reg_rule)
2516                         goto nla_put_failure;
2517
2518                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2519                         reg_rule->flags);
2520                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2521                         freq_range->start_freq_khz);
2522                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2523                         freq_range->end_freq_khz);
2524                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2525                         freq_range->max_bandwidth_khz);
2526                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2527                         power_rule->max_antenna_gain);
2528                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2529                         power_rule->max_eirp);
2530
2531                 nla_nest_end(msg, nl_reg_rule);
2532         }
2533
2534         nla_nest_end(msg, nl_reg_rules);
2535
2536         genlmsg_end(msg, hdr);
2537         err = genlmsg_unicast(msg, info->snd_pid);
2538         goto out;
2539
2540 nla_put_failure:
2541         genlmsg_cancel(msg, hdr);
2542         err = -EMSGSIZE;
2543 out:
2544         mutex_unlock(&cfg80211_mutex);
2545         return err;
2546 }
2547
2548 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2549 {
2550         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2551         struct nlattr *nl_reg_rule;
2552         char *alpha2 = NULL;
2553         int rem_reg_rules = 0, r = 0;
2554         u32 num_rules = 0, rule_idx = 0, size_of_regd;
2555         struct ieee80211_regdomain *rd = NULL;
2556
2557         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2558                 return -EINVAL;
2559
2560         if (!info->attrs[NL80211_ATTR_REG_RULES])
2561                 return -EINVAL;
2562
2563         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2564
2565         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2566                         rem_reg_rules) {
2567                 num_rules++;
2568                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2569                         goto bad_reg;
2570         }
2571
2572         if (!reg_is_valid_request(alpha2))
2573                 return -EINVAL;
2574
2575         size_of_regd = sizeof(struct ieee80211_regdomain) +
2576                 (num_rules * sizeof(struct ieee80211_reg_rule));
2577
2578         rd = kzalloc(size_of_regd, GFP_KERNEL);
2579         if (!rd)
2580                 return -ENOMEM;
2581
2582         rd->n_reg_rules = num_rules;
2583         rd->alpha2[0] = alpha2[0];
2584         rd->alpha2[1] = alpha2[1];
2585
2586         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2587                         rem_reg_rules) {
2588                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2589                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2590                         reg_rule_policy);
2591                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2592                 if (r)
2593                         goto bad_reg;
2594
2595                 rule_idx++;
2596
2597                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES)
2598                         goto bad_reg;
2599         }
2600
2601         BUG_ON(rule_idx != num_rules);
2602
2603         mutex_lock(&cfg80211_mutex);
2604         r = set_regdom(rd);
2605         mutex_unlock(&cfg80211_mutex);
2606         return r;
2607
2608  bad_reg:
2609         kfree(rd);
2610         return -EINVAL;
2611 }
2612
2613 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
2614 {
2615         struct cfg80211_registered_device *drv;
2616         struct net_device *dev;
2617         struct cfg80211_scan_request *request;
2618         struct cfg80211_ssid *ssid;
2619         struct ieee80211_channel *channel;
2620         struct nlattr *attr;
2621         struct wiphy *wiphy;
2622         int err, tmp, n_ssids = 0, n_channels = 0, i;
2623         enum ieee80211_band band;
2624         size_t ie_len;
2625
2626         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2627                 return -EINVAL;
2628
2629         rtnl_lock();
2630
2631         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2632         if (err)
2633                 goto out_rtnl;
2634
2635         wiphy = &drv->wiphy;
2636
2637         if (!drv->ops->scan) {
2638                 err = -EOPNOTSUPP;
2639                 goto out;
2640         }
2641
2642         if (!netif_running(dev)) {
2643                 err = -ENETDOWN;
2644                 goto out;
2645         }
2646
2647         if (drv->scan_req) {
2648                 err = -EBUSY;
2649                 goto out;
2650         }
2651
2652         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2653                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp)
2654                         n_channels++;
2655                 if (!n_channels) {
2656                         err = -EINVAL;
2657                         goto out;
2658                 }
2659         } else {
2660                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
2661                         if (wiphy->bands[band])
2662                                 n_channels += wiphy->bands[band]->n_channels;
2663         }
2664
2665         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
2666                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
2667                         n_ssids++;
2668
2669         if (n_ssids > wiphy->max_scan_ssids) {
2670                 err = -EINVAL;
2671                 goto out;
2672         }
2673
2674         if (info->attrs[NL80211_ATTR_IE])
2675                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2676         else
2677                 ie_len = 0;
2678
2679         if (ie_len > wiphy->max_scan_ie_len) {
2680                 err = -EINVAL;
2681                 goto out;
2682         }
2683
2684         request = kzalloc(sizeof(*request)
2685                         + sizeof(*ssid) * n_ssids
2686                         + sizeof(channel) * n_channels
2687                         + ie_len, GFP_KERNEL);
2688         if (!request) {
2689                 err = -ENOMEM;
2690                 goto out;
2691         }
2692
2693         request->channels = (void *)((char *)request + sizeof(*request));
2694         request->n_channels = n_channels;
2695         if (n_ssids)
2696                 request->ssids = (void *)(request->channels + n_channels);
2697         request->n_ssids = n_ssids;
2698         if (ie_len) {
2699                 if (request->ssids)
2700                         request->ie = (void *)(request->ssids + n_ssids);
2701                 else
2702                         request->ie = (void *)(request->channels + n_channels);
2703         }
2704
2705         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2706                 /* user specified, bail out if channel not found */
2707                 request->n_channels = n_channels;
2708                 i = 0;
2709                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
2710                         request->channels[i] = ieee80211_get_channel(wiphy, nla_get_u32(attr));
2711                         if (!request->channels[i]) {
2712                                 err = -EINVAL;
2713                                 goto out_free;
2714                         }
2715                         i++;
2716                 }
2717         } else {
2718                 /* all channels */
2719                 i = 0;
2720                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
2721                         int j;
2722                         if (!wiphy->bands[band])
2723                                 continue;
2724                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
2725                                 request->channels[i] = &wiphy->bands[band]->channels[j];
2726                                 i++;
2727                         }
2728                 }
2729         }
2730
2731         i = 0;
2732         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
2733                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
2734                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
2735                                 err = -EINVAL;
2736                                 goto out_free;
2737                         }
2738                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
2739                         request->ssids[i].ssid_len = nla_len(attr);
2740                         i++;
2741                 }
2742         }
2743
2744         if (info->attrs[NL80211_ATTR_IE]) {
2745                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2746                 memcpy((void *)request->ie,
2747                        nla_data(info->attrs[NL80211_ATTR_IE]),
2748                        request->ie_len);
2749         }
2750
2751         request->ifidx = dev->ifindex;
2752         request->wiphy = &drv->wiphy;
2753
2754         drv->scan_req = request;
2755         err = drv->ops->scan(&drv->wiphy, dev, request);
2756
2757  out_free:
2758         if (err) {
2759                 drv->scan_req = NULL;
2760                 kfree(request);
2761         }
2762  out:
2763         cfg80211_put_dev(drv);
2764         dev_put(dev);
2765  out_rtnl:
2766         rtnl_unlock();
2767
2768         return err;
2769 }
2770
2771 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
2772                             struct cfg80211_registered_device *rdev,
2773                             struct net_device *dev,
2774                             struct cfg80211_bss *res)
2775 {
2776         void *hdr;
2777         struct nlattr *bss;
2778
2779         hdr = nl80211hdr_put(msg, pid, seq, flags,
2780                              NL80211_CMD_NEW_SCAN_RESULTS);
2781         if (!hdr)
2782                 return -1;
2783
2784         NLA_PUT_U32(msg, NL80211_ATTR_SCAN_GENERATION,
2785                     rdev->bss_generation);
2786         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2787
2788         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
2789         if (!bss)
2790                 goto nla_put_failure;
2791         if (!is_zero_ether_addr(res->bssid))
2792                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
2793         if (res->information_elements && res->len_information_elements)
2794                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
2795                         res->len_information_elements,
2796                         res->information_elements);
2797         if (res->tsf)
2798                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
2799         if (res->beacon_interval)
2800                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
2801         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
2802         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
2803
2804         switch (rdev->wiphy.signal_type) {
2805         case CFG80211_SIGNAL_TYPE_MBM:
2806                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
2807                 break;
2808         case CFG80211_SIGNAL_TYPE_UNSPEC:
2809                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
2810                 break;
2811         default:
2812                 break;
2813         }
2814
2815         nla_nest_end(msg, bss);
2816
2817         return genlmsg_end(msg, hdr);
2818
2819  nla_put_failure:
2820         genlmsg_cancel(msg, hdr);
2821         return -EMSGSIZE;
2822 }
2823
2824 static int nl80211_dump_scan(struct sk_buff *skb,
2825                              struct netlink_callback *cb)
2826 {
2827         struct cfg80211_registered_device *dev;
2828         struct net_device *netdev;
2829         struct cfg80211_internal_bss *scan;
2830         int ifidx = cb->args[0];
2831         int start = cb->args[1], idx = 0;
2832         int err;
2833
2834         if (!ifidx) {
2835                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
2836                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
2837                                   nl80211_policy);
2838                 if (err)
2839                         return err;
2840
2841                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
2842                         return -EINVAL;
2843
2844                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
2845                 if (!ifidx)
2846                         return -EINVAL;
2847                 cb->args[0] = ifidx;
2848         }
2849
2850         netdev = dev_get_by_index(&init_net, ifidx);
2851         if (!netdev)
2852                 return -ENODEV;
2853
2854         dev = cfg80211_get_dev_from_ifindex(ifidx);
2855         if (IS_ERR(dev)) {
2856                 err = PTR_ERR(dev);
2857                 goto out_put_netdev;
2858         }
2859
2860         spin_lock_bh(&dev->bss_lock);
2861         cfg80211_bss_expire(dev);
2862
2863         list_for_each_entry(scan, &dev->bss_list, list) {
2864                 if (++idx <= start)
2865                         continue;
2866                 if (nl80211_send_bss(skb,
2867                                 NETLINK_CB(cb->skb).pid,
2868                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2869                                 dev, netdev, &scan->pub) < 0) {
2870                         idx--;
2871                         goto out;
2872                 }
2873         }
2874
2875  out:
2876         spin_unlock_bh(&dev->bss_lock);
2877
2878         cb->args[1] = idx;
2879         err = skb->len;
2880         cfg80211_put_dev(dev);
2881  out_put_netdev:
2882         dev_put(netdev);
2883
2884         return err;
2885 }
2886
2887 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
2888 {
2889         return auth_type == NL80211_AUTHTYPE_OPEN_SYSTEM ||
2890                 auth_type == NL80211_AUTHTYPE_SHARED_KEY ||
2891                 auth_type == NL80211_AUTHTYPE_FT ||
2892                 auth_type == NL80211_AUTHTYPE_NETWORK_EAP;
2893 }
2894
2895 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
2896 {
2897         struct cfg80211_registered_device *drv;
2898         struct net_device *dev;
2899         struct cfg80211_auth_request req;
2900         struct wiphy *wiphy;
2901         int err;
2902
2903         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2904                 return -EINVAL;
2905
2906         if (!info->attrs[NL80211_ATTR_MAC])
2907                 return -EINVAL;
2908
2909         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
2910                 return -EINVAL;
2911
2912         rtnl_lock();
2913
2914         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2915         if (err)
2916                 goto unlock_rtnl;
2917
2918         if (!drv->ops->auth) {
2919                 err = -EOPNOTSUPP;
2920                 goto out;
2921         }
2922
2923         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
2924                 err = -EOPNOTSUPP;
2925                 goto out;
2926         }
2927
2928         if (!netif_running(dev)) {
2929                 err = -ENETDOWN;
2930                 goto out;
2931         }
2932
2933         wiphy = &drv->wiphy;
2934         memset(&req, 0, sizeof(req));
2935
2936         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2937
2938         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2939                 req.chan = ieee80211_get_channel(
2940                         wiphy,
2941                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
2942                 if (!req.chan) {
2943                         err = -EINVAL;
2944                         goto out;
2945                 }
2946         }
2947
2948         if (info->attrs[NL80211_ATTR_SSID]) {
2949                 req.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2950                 req.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
2951         }
2952
2953         if (info->attrs[NL80211_ATTR_IE]) {
2954                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
2955                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2956         }
2957
2958         req.auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
2959         if (!nl80211_valid_auth_type(req.auth_type)) {
2960                 err = -EINVAL;
2961                 goto out;
2962         }
2963
2964         err = drv->ops->auth(&drv->wiphy, dev, &req);
2965
2966 out:
2967         cfg80211_put_dev(drv);
2968         dev_put(dev);
2969 unlock_rtnl:
2970         rtnl_unlock();
2971         return err;
2972 }
2973
2974 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
2975 {
2976         struct cfg80211_registered_device *drv;
2977         struct net_device *dev;
2978         struct cfg80211_assoc_request req;
2979         struct wiphy *wiphy;
2980         int err;
2981
2982         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2983                 return -EINVAL;
2984
2985         if (!info->attrs[NL80211_ATTR_MAC] ||
2986             !info->attrs[NL80211_ATTR_SSID])
2987                 return -EINVAL;
2988
2989         rtnl_lock();
2990
2991         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2992         if (err)
2993                 goto unlock_rtnl;
2994
2995         if (!drv->ops->assoc) {
2996                 err = -EOPNOTSUPP;
2997                 goto out;
2998         }
2999
3000         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3001                 err = -EOPNOTSUPP;
3002                 goto out;
3003         }
3004
3005         if (!netif_running(dev)) {
3006                 err = -ENETDOWN;
3007                 goto out;
3008         }
3009
3010         wiphy = &drv->wiphy;
3011         memset(&req, 0, sizeof(req));
3012
3013         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3014
3015         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3016                 req.chan = ieee80211_get_channel(
3017                         wiphy,
3018                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3019                 if (!req.chan) {
3020                         err = -EINVAL;
3021                         goto out;
3022                 }
3023         }
3024
3025         req.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3026         req.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3027
3028         if (info->attrs[NL80211_ATTR_IE]) {
3029                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3030                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3031         }
3032
3033         if (info->attrs[NL80211_ATTR_USE_MFP]) {
3034                 enum nl80211_mfp use_mfp =
3035                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
3036                 if (use_mfp == NL80211_MFP_REQUIRED)
3037                         req.use_mfp = true;
3038                 else if (use_mfp != NL80211_MFP_NO) {
3039                         err = -EINVAL;
3040                         goto out;
3041                 }
3042         }
3043
3044         req.control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
3045
3046         err = drv->ops->assoc(&drv->wiphy, dev, &req);
3047
3048 out:
3049         cfg80211_put_dev(drv);
3050         dev_put(dev);
3051 unlock_rtnl:
3052         rtnl_unlock();
3053         return err;
3054 }
3055
3056 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
3057 {
3058         struct cfg80211_registered_device *drv;
3059         struct net_device *dev;
3060         struct cfg80211_deauth_request req;
3061         struct wiphy *wiphy;
3062         int err;
3063
3064         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3065                 return -EINVAL;
3066
3067         if (!info->attrs[NL80211_ATTR_MAC])
3068                 return -EINVAL;
3069
3070         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3071                 return -EINVAL;
3072
3073         rtnl_lock();
3074
3075         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3076         if (err)
3077                 goto unlock_rtnl;
3078
3079         if (!drv->ops->deauth) {
3080                 err = -EOPNOTSUPP;
3081                 goto out;
3082         }
3083
3084         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3085                 err = -EOPNOTSUPP;
3086                 goto out;
3087         }
3088
3089         if (!netif_running(dev)) {
3090                 err = -ENETDOWN;
3091                 goto out;
3092         }
3093
3094         wiphy = &drv->wiphy;
3095         memset(&req, 0, sizeof(req));
3096
3097         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3098
3099         req.reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3100         if (req.reason_code == 0) {
3101                 /* Reason Code 0 is reserved */
3102                 err = -EINVAL;
3103                 goto out;
3104         }
3105
3106         if (info->attrs[NL80211_ATTR_IE]) {
3107                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3108                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3109         }
3110
3111         err = drv->ops->deauth(&drv->wiphy, dev, &req);
3112
3113 out:
3114         cfg80211_put_dev(drv);
3115         dev_put(dev);
3116 unlock_rtnl:
3117         rtnl_unlock();
3118         return err;
3119 }
3120
3121 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
3122 {
3123         struct cfg80211_registered_device *drv;
3124         struct net_device *dev;
3125         struct cfg80211_disassoc_request req;
3126         struct wiphy *wiphy;
3127         int err;
3128
3129         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3130                 return -EINVAL;
3131
3132         if (!info->attrs[NL80211_ATTR_MAC])
3133                 return -EINVAL;
3134
3135         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3136                 return -EINVAL;
3137
3138         rtnl_lock();
3139
3140         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3141         if (err)
3142                 goto unlock_rtnl;
3143
3144         if (!drv->ops->disassoc) {
3145                 err = -EOPNOTSUPP;
3146                 goto out;
3147         }
3148
3149         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3150                 err = -EOPNOTSUPP;
3151                 goto out;
3152         }
3153
3154         if (!netif_running(dev)) {
3155                 err = -ENETDOWN;
3156                 goto out;
3157         }
3158
3159         wiphy = &drv->wiphy;
3160         memset(&req, 0, sizeof(req));
3161
3162         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3163
3164         req.reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3165         if (req.reason_code == 0) {
3166                 /* Reason Code 0 is reserved */
3167                 err = -EINVAL;
3168                 goto out;
3169         }
3170
3171         if (info->attrs[NL80211_ATTR_IE]) {
3172                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3173                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3174         }
3175
3176         err = drv->ops->disassoc(&drv->wiphy, dev, &req);
3177
3178 out:
3179         cfg80211_put_dev(drv);
3180         dev_put(dev);
3181 unlock_rtnl:
3182         rtnl_unlock();
3183         return err;
3184 }
3185
3186 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
3187 {
3188         struct cfg80211_registered_device *drv;
3189         struct net_device *dev;
3190         struct cfg80211_ibss_params ibss;
3191         struct wiphy *wiphy;
3192         int err;
3193
3194         memset(&ibss, 0, sizeof(ibss));
3195
3196         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3197                 return -EINVAL;
3198
3199         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
3200             !info->attrs[NL80211_ATTR_SSID] ||
3201             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3202                 return -EINVAL;
3203
3204         ibss.beacon_interval = 100;
3205
3206         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
3207                 ibss.beacon_interval =
3208                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3209                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
3210                         return -EINVAL;
3211         }
3212
3213         rtnl_lock();
3214
3215         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3216         if (err)
3217                 goto unlock_rtnl;
3218
3219         if (!drv->ops->join_ibss) {
3220                 err = -EOPNOTSUPP;
3221                 goto out;
3222         }
3223
3224         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3225                 err = -EOPNOTSUPP;
3226                 goto out;
3227         }
3228
3229         if (!netif_running(dev)) {
3230                 err = -ENETDOWN;
3231                 goto out;
3232         }
3233
3234         wiphy = &drv->wiphy;
3235
3236         if (info->attrs[NL80211_ATTR_MAC])
3237                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3238         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3239         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3240
3241         if (info->attrs[NL80211_ATTR_IE]) {
3242                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3243                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3244         }
3245
3246         ibss.channel = ieee80211_get_channel(wiphy,
3247                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3248         if (!ibss.channel ||
3249             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
3250             ibss.channel->flags & IEEE80211_CHAN_DISABLED) {
3251                 err = -EINVAL;
3252                 goto out;
3253         }
3254
3255         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
3256
3257         err = cfg80211_join_ibss(drv, dev, &ibss);
3258
3259 out:
3260         cfg80211_put_dev(drv);
3261         dev_put(dev);
3262 unlock_rtnl:
3263         rtnl_unlock();
3264         return err;
3265 }
3266
3267 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
3268 {
3269         struct cfg80211_registered_device *drv;
3270         struct net_device *dev;
3271         int err;
3272
3273         rtnl_lock();
3274
3275         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3276         if (err)
3277                 goto unlock_rtnl;
3278
3279         if (!drv->ops->leave_ibss) {
3280                 err = -EOPNOTSUPP;
3281                 goto out;
3282         }
3283
3284         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3285                 err = -EOPNOTSUPP;
3286                 goto out;
3287         }
3288
3289         if (!netif_running(dev)) {
3290                 err = -ENETDOWN;
3291                 goto out;
3292         }
3293
3294         err = cfg80211_leave_ibss(drv, dev, false);
3295
3296 out:
3297         cfg80211_put_dev(drv);
3298         dev_put(dev);
3299 unlock_rtnl:
3300         rtnl_unlock();
3301         return err;
3302 }
3303
3304 static struct genl_ops nl80211_ops[] = {
3305         {
3306                 .cmd = NL80211_CMD_GET_WIPHY,
3307                 .doit = nl80211_get_wiphy,
3308                 .dumpit = nl80211_dump_wiphy,
3309                 .policy = nl80211_policy,
3310                 /* can be retrieved by unprivileged users */
3311         },
3312         {
3313                 .cmd = NL80211_CMD_SET_WIPHY,
3314                 .doit = nl80211_set_wiphy,
3315                 .policy = nl80211_policy,
3316                 .flags = GENL_ADMIN_PERM,
3317         },
3318         {
3319                 .cmd = NL80211_CMD_GET_INTERFACE,
3320                 .doit = nl80211_get_interface,
3321                 .dumpit = nl80211_dump_interface,
3322                 .policy = nl80211_policy,
3323                 /* can be retrieved by unprivileged users */
3324         },
3325         {
3326                 .cmd = NL80211_CMD_SET_INTERFACE,
3327                 .doit = nl80211_set_interface,
3328                 .policy = nl80211_policy,
3329                 .flags = GENL_ADMIN_PERM,
3330         },
3331         {
3332                 .cmd = NL80211_CMD_NEW_INTERFACE,
3333                 .doit = nl80211_new_interface,
3334                 .policy = nl80211_policy,
3335                 .flags = GENL_ADMIN_PERM,
3336         },
3337         {
3338                 .cmd = NL80211_CMD_DEL_INTERFACE,
3339                 .doit = nl80211_del_interface,
3340                 .policy = nl80211_policy,
3341                 .flags = GENL_ADMIN_PERM,
3342         },
3343         {
3344                 .cmd = NL80211_CMD_GET_KEY,
3345                 .doit = nl80211_get_key,
3346                 .policy = nl80211_policy,
3347                 .flags = GENL_ADMIN_PERM,
3348         },
3349         {
3350                 .cmd = NL80211_CMD_SET_KEY,
3351                 .doit = nl80211_set_key,
3352                 .policy = nl80211_policy,
3353                 .flags = GENL_ADMIN_PERM,
3354         },
3355         {
3356                 .cmd = NL80211_CMD_NEW_KEY,
3357                 .doit = nl80211_new_key,
3358                 .policy = nl80211_policy,
3359                 .flags = GENL_ADMIN_PERM,
3360         },
3361         {
3362                 .cmd = NL80211_CMD_DEL_KEY,
3363                 .doit = nl80211_del_key,
3364                 .policy = nl80211_policy,
3365                 .flags = GENL_ADMIN_PERM,
3366         },
3367         {
3368                 .cmd = NL80211_CMD_SET_BEACON,
3369                 .policy = nl80211_policy,
3370                 .flags = GENL_ADMIN_PERM,
3371                 .doit = nl80211_addset_beacon,
3372         },
3373         {
3374                 .cmd = NL80211_CMD_NEW_BEACON,
3375                 .policy = nl80211_policy,
3376                 .flags = GENL_ADMIN_PERM,
3377                 .doit = nl80211_addset_beacon,
3378         },
3379         {
3380                 .cmd = NL80211_CMD_DEL_BEACON,
3381                 .policy = nl80211_policy,
3382                 .flags = GENL_ADMIN_PERM,
3383                 .doit = nl80211_del_beacon,
3384         },
3385         {
3386                 .cmd = NL80211_CMD_GET_STATION,
3387                 .doit = nl80211_get_station,
3388                 .dumpit = nl80211_dump_station,
3389                 .policy = nl80211_policy,
3390         },
3391         {
3392                 .cmd = NL80211_CMD_SET_STATION,
3393                 .doit = nl80211_set_station,
3394                 .policy = nl80211_policy,
3395                 .flags = GENL_ADMIN_PERM,
3396         },
3397         {
3398                 .cmd = NL80211_CMD_NEW_STATION,
3399                 .doit = nl80211_new_station,
3400                 .policy = nl80211_policy,
3401                 .flags = GENL_ADMIN_PERM,
3402         },
3403         {
3404                 .cmd = NL80211_CMD_DEL_STATION,
3405                 .doit = nl80211_del_station,
3406                 .policy = nl80211_policy,
3407                 .flags = GENL_ADMIN_PERM,
3408         },
3409         {
3410                 .cmd = NL80211_CMD_GET_MPATH,
3411                 .doit = nl80211_get_mpath,
3412                 .dumpit = nl80211_dump_mpath,
3413                 .policy = nl80211_policy,
3414                 .flags = GENL_ADMIN_PERM,
3415         },
3416         {
3417                 .cmd = NL80211_CMD_SET_MPATH,
3418                 .doit = nl80211_set_mpath,
3419                 .policy = nl80211_policy,
3420                 .flags = GENL_ADMIN_PERM,
3421         },
3422         {
3423                 .cmd = NL80211_CMD_NEW_MPATH,
3424                 .doit = nl80211_new_mpath,
3425                 .policy = nl80211_policy,
3426                 .flags = GENL_ADMIN_PERM,
3427         },
3428         {
3429                 .cmd = NL80211_CMD_DEL_MPATH,
3430                 .doit = nl80211_del_mpath,
3431                 .policy = nl80211_policy,
3432                 .flags = GENL_ADMIN_PERM,
3433         },
3434         {
3435                 .cmd = NL80211_CMD_SET_BSS,
3436                 .doit = nl80211_set_bss,
3437                 .policy = nl80211_policy,
3438                 .flags = GENL_ADMIN_PERM,
3439         },
3440         {
3441                 .cmd = NL80211_CMD_GET_REG,
3442                 .doit = nl80211_get_reg,
3443                 .policy = nl80211_policy,
3444                 /* can be retrieved by unprivileged users */
3445         },
3446         {
3447                 .cmd = NL80211_CMD_SET_REG,
3448                 .doit = nl80211_set_reg,
3449                 .policy = nl80211_policy,
3450                 .flags = GENL_ADMIN_PERM,
3451         },
3452         {
3453                 .cmd = NL80211_CMD_REQ_SET_REG,
3454                 .doit = nl80211_req_set_reg,
3455                 .policy = nl80211_policy,
3456                 .flags = GENL_ADMIN_PERM,
3457         },
3458         {
3459                 .cmd = NL80211_CMD_GET_MESH_PARAMS,
3460                 .doit = nl80211_get_mesh_params,
3461                 .policy = nl80211_policy,
3462                 /* can be retrieved by unprivileged users */
3463         },
3464         {
3465                 .cmd = NL80211_CMD_SET_MESH_PARAMS,
3466                 .doit = nl80211_set_mesh_params,
3467                 .policy = nl80211_policy,
3468                 .flags = GENL_ADMIN_PERM,
3469         },
3470         {
3471                 .cmd = NL80211_CMD_TRIGGER_SCAN,
3472                 .doit = nl80211_trigger_scan,
3473                 .policy = nl80211_policy,
3474                 .flags = GENL_ADMIN_PERM,
3475         },
3476         {
3477                 .cmd = NL80211_CMD_GET_SCAN,
3478                 .policy = nl80211_policy,
3479                 .dumpit = nl80211_dump_scan,
3480         },
3481         {
3482                 .cmd = NL80211_CMD_AUTHENTICATE,
3483                 .doit = nl80211_authenticate,
3484                 .policy = nl80211_policy,
3485                 .flags = GENL_ADMIN_PERM,
3486         },
3487         {
3488                 .cmd = NL80211_CMD_ASSOCIATE,
3489                 .doit = nl80211_associate,
3490                 .policy = nl80211_policy,
3491                 .flags = GENL_ADMIN_PERM,
3492         },
3493         {
3494                 .cmd = NL80211_CMD_DEAUTHENTICATE,
3495                 .doit = nl80211_deauthenticate,
3496                 .policy = nl80211_policy,
3497                 .flags = GENL_ADMIN_PERM,
3498         },
3499         {
3500                 .cmd = NL80211_CMD_DISASSOCIATE,
3501                 .doit = nl80211_disassociate,
3502                 .policy = nl80211_policy,
3503                 .flags = GENL_ADMIN_PERM,
3504         },
3505         {
3506                 .cmd = NL80211_CMD_JOIN_IBSS,
3507                 .doit = nl80211_join_ibss,
3508                 .policy = nl80211_policy,
3509                 .flags = GENL_ADMIN_PERM,
3510         },
3511         {
3512                 .cmd = NL80211_CMD_LEAVE_IBSS,
3513                 .doit = nl80211_leave_ibss,
3514                 .policy = nl80211_policy,
3515                 .flags = GENL_ADMIN_PERM,
3516         },
3517 };
3518 static struct genl_multicast_group nl80211_mlme_mcgrp = {
3519         .name = "mlme",
3520 };
3521
3522 /* multicast groups */
3523 static struct genl_multicast_group nl80211_config_mcgrp = {
3524         .name = "config",
3525 };
3526 static struct genl_multicast_group nl80211_scan_mcgrp = {
3527         .name = "scan",
3528 };
3529 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
3530         .name = "regulatory",
3531 };
3532
3533 /* notification functions */
3534
3535 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
3536 {
3537         struct sk_buff *msg;
3538
3539         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3540         if (!msg)
3541                 return;
3542
3543         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
3544                 nlmsg_free(msg);
3545                 return;
3546         }
3547
3548         genlmsg_multicast(msg, 0, nl80211_config_mcgrp.id, GFP_KERNEL);
3549 }
3550
3551 static int nl80211_send_scan_donemsg(struct sk_buff *msg,
3552                                     struct cfg80211_registered_device *rdev,
3553                                     struct net_device *netdev,
3554                                     u32 pid, u32 seq, int flags,
3555                                     u32 cmd)
3556 {
3557         void *hdr;
3558
3559         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
3560         if (!hdr)
3561                 return -1;
3562
3563         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3564         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3565
3566         /* XXX: we should probably bounce back the request? */
3567
3568         return genlmsg_end(msg, hdr);
3569
3570  nla_put_failure:
3571         genlmsg_cancel(msg, hdr);
3572         return -EMSGSIZE;
3573 }
3574
3575 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
3576                             struct net_device *netdev)
3577 {
3578         struct sk_buff *msg;
3579
3580         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3581         if (!msg)
3582                 return;
3583
3584         if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
3585                                       NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
3586                 nlmsg_free(msg);
3587                 return;
3588         }
3589
3590         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
3591 }
3592
3593 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
3594                                struct net_device *netdev)
3595 {
3596         struct sk_buff *msg;
3597
3598         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3599         if (!msg)
3600                 return;
3601
3602         if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
3603                                       NL80211_CMD_SCAN_ABORTED) < 0) {
3604                 nlmsg_free(msg);
3605                 return;
3606         }
3607
3608         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
3609 }
3610
3611 /*
3612  * This can happen on global regulatory changes or device specific settings
3613  * based on custom world regulatory domains.
3614  */
3615 void nl80211_send_reg_change_event(struct regulatory_request *request)
3616 {
3617         struct sk_buff *msg;
3618         void *hdr;
3619
3620         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3621         if (!msg)
3622                 return;
3623
3624         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
3625         if (!hdr) {
3626                 nlmsg_free(msg);
3627                 return;
3628         }
3629
3630         /* Userspace can always count this one always being set */
3631         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
3632
3633         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
3634                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3635                            NL80211_REGDOM_TYPE_WORLD);
3636         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
3637                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3638                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
3639         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
3640                  request->intersect)
3641                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3642                            NL80211_REGDOM_TYPE_INTERSECTION);
3643         else {
3644                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3645                            NL80211_REGDOM_TYPE_COUNTRY);
3646                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
3647         }
3648
3649         if (wiphy_idx_valid(request->wiphy_idx))
3650                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
3651
3652         if (genlmsg_end(msg, hdr) < 0) {
3653                 nlmsg_free(msg);
3654                 return;
3655         }
3656
3657         genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_KERNEL);
3658
3659         return;
3660
3661 nla_put_failure:
3662         genlmsg_cancel(msg, hdr);
3663         nlmsg_free(msg);
3664 }
3665
3666 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
3667                                     struct net_device *netdev,
3668                                     const u8 *buf, size_t len,
3669                                     enum nl80211_commands cmd)
3670 {
3671         struct sk_buff *msg;
3672         void *hdr;
3673
3674         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
3675         if (!msg)
3676                 return;
3677
3678         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
3679         if (!hdr) {
3680                 nlmsg_free(msg);
3681                 return;
3682         }
3683
3684         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3685         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3686         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
3687
3688         if (genlmsg_end(msg, hdr) < 0) {
3689                 nlmsg_free(msg);
3690                 return;
3691         }
3692
3693         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_ATOMIC);
3694         return;
3695
3696  nla_put_failure:
3697         genlmsg_cancel(msg, hdr);
3698         nlmsg_free(msg);
3699 }
3700
3701 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
3702                           struct net_device *netdev, const u8 *buf, size_t len)
3703 {
3704         nl80211_send_mlme_event(rdev, netdev, buf, len,
3705                                 NL80211_CMD_AUTHENTICATE);
3706 }
3707
3708 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
3709                            struct net_device *netdev, const u8 *buf,
3710                            size_t len)
3711 {
3712         nl80211_send_mlme_event(rdev, netdev, buf, len, NL80211_CMD_ASSOCIATE);
3713 }
3714
3715 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
3716                          struct net_device *netdev, const u8 *buf, size_t len)
3717 {
3718         nl80211_send_mlme_event(rdev, netdev, buf, len,
3719                                 NL80211_CMD_DEAUTHENTICATE);
3720 }
3721
3722 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
3723                            struct net_device *netdev, const u8 *buf,
3724                            size_t len)
3725 {
3726         nl80211_send_mlme_event(rdev, netdev, buf, len,
3727                                 NL80211_CMD_DISASSOCIATE);
3728 }
3729
3730 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
3731                                       struct net_device *netdev, int cmd,
3732                                       const u8 *addr)
3733 {
3734         struct sk_buff *msg;
3735         void *hdr;
3736
3737         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
3738         if (!msg)
3739                 return;
3740
3741         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
3742         if (!hdr) {
3743                 nlmsg_free(msg);
3744                 return;
3745         }
3746
3747         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3748         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3749         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
3750         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3751
3752         if (genlmsg_end(msg, hdr) < 0) {
3753                 nlmsg_free(msg);
3754                 return;
3755         }
3756
3757         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_ATOMIC);
3758         return;
3759
3760  nla_put_failure:
3761         genlmsg_cancel(msg, hdr);
3762         nlmsg_free(msg);
3763 }
3764
3765 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
3766                                struct net_device *netdev, const u8 *addr)
3767 {
3768         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
3769                                   addr);
3770 }
3771
3772 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
3773                                 struct net_device *netdev, const u8 *addr)
3774 {
3775         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE, addr);
3776 }
3777
3778 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
3779                              struct net_device *netdev, const u8 *bssid,
3780                              gfp_t gfp)
3781 {
3782         struct sk_buff *msg;
3783         void *hdr;
3784
3785         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
3786         if (!msg)
3787                 return;
3788
3789         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
3790         if (!hdr) {
3791                 nlmsg_free(msg);
3792                 return;
3793         }
3794
3795         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3796         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3797         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
3798
3799         if (genlmsg_end(msg, hdr) < 0) {
3800                 nlmsg_free(msg);
3801                 return;
3802         }
3803
3804         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
3805         return;
3806
3807  nla_put_failure:
3808         genlmsg_cancel(msg, hdr);
3809         nlmsg_free(msg);
3810 }
3811
3812 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
3813                                  struct net_device *netdev, const u8 *addr,
3814                                  enum nl80211_key_type key_type, int key_id,
3815                                  const u8 *tsc)
3816 {
3817         struct sk_buff *msg;
3818         void *hdr;
3819
3820         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3821         if (!msg)
3822                 return;
3823
3824         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
3825         if (!hdr) {
3826                 nlmsg_free(msg);
3827                 return;
3828         }
3829
3830         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3831         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3832         if (addr)
3833                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3834         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
3835         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
3836         if (tsc)
3837                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
3838
3839         if (genlmsg_end(msg, hdr) < 0) {
3840                 nlmsg_free(msg);
3841                 return;
3842         }
3843
3844         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_KERNEL);
3845         return;
3846
3847  nla_put_failure:
3848         genlmsg_cancel(msg, hdr);
3849         nlmsg_free(msg);
3850 }
3851
3852 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
3853                                     struct ieee80211_channel *channel_before,
3854                                     struct ieee80211_channel *channel_after)
3855 {
3856         struct sk_buff *msg;
3857         void *hdr;
3858         struct nlattr *nl_freq;
3859
3860         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
3861         if (!msg)
3862                 return;
3863
3864         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
3865         if (!hdr) {
3866                 nlmsg_free(msg);
3867                 return;
3868         }
3869
3870         /*
3871          * Since we are applying the beacon hint to a wiphy we know its
3872          * wiphy_idx is valid
3873          */
3874         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
3875
3876         /* Before */
3877         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
3878         if (!nl_freq)
3879                 goto nla_put_failure;
3880         if (nl80211_msg_put_channel(msg, channel_before))
3881                 goto nla_put_failure;
3882         nla_nest_end(msg, nl_freq);
3883
3884         /* After */
3885         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
3886         if (!nl_freq)
3887                 goto nla_put_failure;
3888         if (nl80211_msg_put_channel(msg, channel_after))
3889                 goto nla_put_failure;
3890         nla_nest_end(msg, nl_freq);
3891
3892         if (genlmsg_end(msg, hdr) < 0) {
3893                 nlmsg_free(msg);
3894                 return;
3895         }
3896
3897         genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_ATOMIC);
3898
3899         return;
3900
3901 nla_put_failure:
3902         genlmsg_cancel(msg, hdr);
3903         nlmsg_free(msg);
3904 }
3905
3906 /* initialisation/exit functions */
3907
3908 int nl80211_init(void)
3909 {
3910         int err, i;
3911
3912         err = genl_register_family(&nl80211_fam);
3913         if (err)
3914                 return err;
3915
3916         for (i = 0; i < ARRAY_SIZE(nl80211_ops); i++) {
3917                 err = genl_register_ops(&nl80211_fam, &nl80211_ops[i]);
3918                 if (err)
3919                         goto err_out;
3920         }
3921
3922         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
3923         if (err)
3924                 goto err_out;
3925
3926         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
3927         if (err)
3928                 goto err_out;
3929
3930         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
3931         if (err)
3932                 goto err_out;
3933
3934         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
3935         if (err)
3936                 goto err_out;
3937
3938         return 0;
3939  err_out:
3940         genl_unregister_family(&nl80211_fam);
3941         return err;
3942 }
3943
3944 void nl80211_exit(void)
3945 {
3946         genl_unregister_family(&nl80211_fam);
3947 }