SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006, 2007 Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/list.h>
  11 #include <linux/if_ether.h>
  12 #include <linux/ieee80211.h>
  13 #include <linux/nl80211.h>
  14 #include <linux/rtnetlink.h>
  15 #include <linux/netlink.h>
  16 #include <linux/etherdevice.h>
  17 #include <net/genetlink.h>
  18 #include <net/cfg80211.h>
  19 #include "core.h"
  20 #include "nl80211.h"
  21 #include "reg.h"
  22
  23 /* the netlink family */
  24 static struct genl_family nl80211_fam = {
  25         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  26         .name = "nl80211",      /* have users key off the name instead */
  27         .hdrsize = 0,           /* no private header */
  28         .version = 1,           /* no particular meaning now */
  29         .maxattr = NL80211_ATTR_MAX,
  30 };
  31
  32 /* internal helper: get drv and dev */
  33 static int get_drv_dev_by_info_ifindex(struct nlattr **attrs,
  34                                        struct cfg80211_registered_device **drv,
  35                                        struct net_device **dev)
  36 {
  37         int ifindex;
  38
  39         if (!attrs[NL80211_ATTR_IFINDEX])
  40                 return -EINVAL;
  41
  42         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  43         *dev = dev_get_by_index(&init_net, ifindex);
  44         if (!*dev)
  45                 return -ENODEV;
  46
  47         *drv = cfg80211_get_dev_from_ifindex(ifindex);
  48         if (IS_ERR(*drv)) {
  49                 dev_put(*dev);
  50                 return PTR_ERR(*drv);
  51         }
  52
  53         return 0;
  54 }
  55
  56 /* policy for the attributes */
  57 static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
  58         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  59         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  60                                       .len = BUS_ID_SIZE-1 },
  61         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  62         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  63         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  64
  65         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  66         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  67         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  68
  69         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  70
  71         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  72                                     .len = WLAN_MAX_KEY_LEN },
  73         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  74         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  75         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
  76
  77         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
  78         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
  79         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
  80                                        .len = IEEE80211_MAX_DATA_LEN },
  81         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
  82                                        .len = IEEE80211_MAX_DATA_LEN },
  83         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
  84         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
  85         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
  86         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
  87                                                .len = NL80211_MAX_SUPP_RATES },
  88         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
  89         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
  90         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
  91         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
  92                                 .len = IEEE80211_MAX_MESH_ID_LEN },
  93         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
  94
  95         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
  96         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
  97
  98         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
  99         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 100         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 101         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 102                                            .len = NL80211_MAX_SUPP_RATES },
 103
 104         [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
 105
 106         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 107                                          .len = NL80211_HT_CAPABILITY_LEN },
 108
 109         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 110         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 111                               .len = IEEE80211_MAX_DATA_LEN },
 112         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 113         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 114
 115         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 116                                 .len = IEEE80211_MAX_SSID_LEN },
 117         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 118         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 119 };
 120
 121 /* message building helper */
 122 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 123                                    int flags, u8 cmd)
 124 {
 125         /* since there is no private header just add the generic one */
 126         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 127 }
 128
 129 /* netlink command implementations */
 130
 131 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 132                               struct cfg80211_registered_device *dev)
 133 {
 134         void *hdr;
 135         struct nlattr *nl_bands, *nl_band;
 136         struct nlattr *nl_freqs, *nl_freq;
 137         struct nlattr *nl_rates, *nl_rate;
 138         struct nlattr *nl_modes;
 139         struct nlattr *nl_cmds;
 140         enum ieee80211_band band;
 141         struct ieee80211_channel *chan;
 142         struct ieee80211_rate *rate;
 143         int i;
 144         u16 ifmodes = dev->wiphy.interface_modes;
 145
 146         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 147         if (!hdr)
 148                 return -1;
 149
 150         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 151         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 152         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 153                    dev->wiphy.max_scan_ssids);
 154
 155         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
 156         if (!nl_modes)
 157                 goto nla_put_failure;
 158
 159         i = 0;
 160         while (ifmodes) {
 161                 if (ifmodes & 1)
 162                         NLA_PUT_FLAG(msg, i);
 163                 ifmodes >>= 1;
 164                 i++;
 165         }
 166
 167         nla_nest_end(msg, nl_modes);
 168
 169         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 170         if (!nl_bands)
 171                 goto nla_put_failure;
 172
 173         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 174                 if (!dev->wiphy.bands[band])
 175                         continue;
 176
 177                 nl_band = nla_nest_start(msg, band);
 178                 if (!nl_band)
 179                         goto nla_put_failure;
 180
 181                 /* add HT info */
 182                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 183                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 184                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 185                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 186                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 187                                 dev->wiphy.bands[band]->ht_cap.cap);
 188                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 189                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 190                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 191                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 192                 }
 193
 194                 /* add frequencies */
 195                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 196                 if (!nl_freqs)
 197                         goto nla_put_failure;
 198
 199                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 200                         nl_freq = nla_nest_start(msg, i);
 201                         if (!nl_freq)
 202                                 goto nla_put_failure;
 203
 204                         chan = &dev->wiphy.bands[band]->channels[i];
 205                         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 206                                     chan->center_freq);
 207
 208                         if (chan->flags & IEEE80211_CHAN_DISABLED)
 209                                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 210                         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 211                                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 212                         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 213                                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 214                         if (chan->flags & IEEE80211_CHAN_RADAR)
 215                                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 216
 217                         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 218                                     DBM_TO_MBM(chan->max_power));
 219
 220                         nla_nest_end(msg, nl_freq);
 221                 }
 222
 223                 nla_nest_end(msg, nl_freqs);
 224
 225                 /* add bitrates */
 226                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 227                 if (!nl_rates)
 228                         goto nla_put_failure;
 229
 230                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 231                         nl_rate = nla_nest_start(msg, i);
 232                         if (!nl_rate)
 233                                 goto nla_put_failure;
 234
 235                         rate = &dev->wiphy.bands[band]->bitrates[i];
 236                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 237                                     rate->bitrate);
 238                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 239                                 NLA_PUT_FLAG(msg,
 240                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 241
 242                         nla_nest_end(msg, nl_rate);
 243                 }
 244
 245                 nla_nest_end(msg, nl_rates);
 246
 247                 nla_nest_end(msg, nl_band);
 248         }
 249         nla_nest_end(msg, nl_bands);
 250
 251         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 252         if (!nl_cmds)
 253                 goto nla_put_failure;
 254
 255         i = 0;
 256 #define CMD(op, n)                                              \
 257          do {                                                   \
 258                 if (dev->ops->op) {                             \
 259                         i++;                                    \
 260                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 261                 }                                               \
 262         } while (0)
 263
 264         CMD(add_virtual_intf, NEW_INTERFACE);
 265         CMD(change_virtual_intf, SET_INTERFACE);
 266         CMD(add_key, NEW_KEY);
 267         CMD(add_beacon, NEW_BEACON);
 268         CMD(add_station, NEW_STATION);
 269         CMD(add_mpath, NEW_MPATH);
 270         CMD(set_mesh_params, SET_MESH_PARAMS);
 271         CMD(change_bss, SET_BSS);
 272         CMD(set_mgmt_extra_ie, SET_MGMT_EXTRA_IE);
 273         CMD(auth, AUTHENTICATE);
 274         CMD(assoc, ASSOCIATE);
 275         CMD(deauth, DEAUTHENTICATE);
 276         CMD(disassoc, DISASSOCIATE);
 277
 278 #undef CMD
 279         nla_nest_end(msg, nl_cmds);
 280
 281         return genlmsg_end(msg, hdr);
 282
 283  nla_put_failure:
 284         genlmsg_cancel(msg, hdr);
 285         return -EMSGSIZE;
 286 }
 287
 288 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 289 {
 290         int idx = 0;
 291         int start = cb->args[0];
 292         struct cfg80211_registered_device *dev;
 293
 294         mutex_lock(&cfg80211_mutex);
 295         list_for_each_entry(dev, &cfg80211_drv_list, list) {
 296                 if (++idx <= start)
 297                         continue;
 298                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
 299                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
 300                                        dev) < 0) {
 301                         idx--;
 302                         break;
 303                 }
 304         }
 305         mutex_unlock(&cfg80211_mutex);
 306
 307         cb->args[0] = idx;
 308
 309         return skb->len;
 310 }
 311
 312 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 313 {
 314         struct sk_buff *msg;
 315         struct cfg80211_registered_device *dev;
 316
 317         dev = cfg80211_get_dev_from_info(info);
 318         if (IS_ERR(dev))
 319                 return PTR_ERR(dev);
 320
 321         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 322         if (!msg)
 323                 goto out_err;
 324
 325         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
 326                 goto out_free;
 327
 328         cfg80211_put_dev(dev);
 329
 330         return genlmsg_unicast(msg, info->snd_pid);
 331
 332  out_free:
 333         nlmsg_free(msg);
 334  out_err:
 335         cfg80211_put_dev(dev);
 336         return -ENOBUFS;
 337 }
 338
 339 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 340         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
 341         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
 342         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
 343         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
 344         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
 345 };
 346
 347 static int parse_txq_params(struct nlattr *tb[],
 348                             struct ieee80211_txq_params *txq_params)
 349 {
 350         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 351             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 352             !tb[NL80211_TXQ_ATTR_AIFS])
 353                 return -EINVAL;
 354
 355         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
 356         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 357         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 358         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 359         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 360
 361         return 0;
 362 }
 363
 364 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 365 {
 366         struct cfg80211_registered_device *rdev;
 367         int result = 0, rem_txq_params = 0;
 368         struct nlattr *nl_txq_params;
 369
 370         rdev = cfg80211_get_dev_from_info(info);
 371         if (IS_ERR(rdev))
 372                 return PTR_ERR(rdev);
 373
 374         if (info->attrs[NL80211_ATTR_WIPHY_NAME]) {
 375                 result = cfg80211_dev_rename(
 376                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 377                 if (result)
 378                         goto bad_res;
 379         }
 380
 381         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
 382                 struct ieee80211_txq_params txq_params;
 383                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
 384
 385                 if (!rdev->ops->set_txq_params) {
 386                         result = -EOPNOTSUPP;
 387                         goto bad_res;
 388                 }
 389
 390                 nla_for_each_nested(nl_txq_params,
 391                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
 392                                     rem_txq_params) {
 393                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
 394                                   nla_data(nl_txq_params),
 395                                   nla_len(nl_txq_params),
 396                                   txq_params_policy);
 397                         result = parse_txq_params(tb, &txq_params);
 398                         if (result)
 399                                 goto bad_res;
 400
 401                         result = rdev->ops->set_txq_params(&rdev->wiphy,
 402                                                            &txq_params);
 403                         if (result)
 404                                 goto bad_res;
 405                 }
 406         }
 407
 408         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
 409                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 410                 struct ieee80211_channel *chan;
 411                 struct ieee80211_sta_ht_cap *ht_cap;
 412                 u32 freq, sec_freq;
 413
 414                 if (!rdev->ops->set_channel) {
 415                         result = -EOPNOTSUPP;
 416                         goto bad_res;
 417                 }
 418
 419                 result = -EINVAL;
 420
 421                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 422                         channel_type = nla_get_u32(info->attrs[
 423                                            NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 424                         if (channel_type != NL80211_CHAN_NO_HT &&
 425                             channel_type != NL80211_CHAN_HT20 &&
 426                             channel_type != NL80211_CHAN_HT40PLUS &&
 427                             channel_type != NL80211_CHAN_HT40MINUS)
 428                                 goto bad_res;
 429                 }
 430
 431                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 432                 chan = ieee80211_get_channel(&rdev->wiphy, freq);
 433
 434                 /* Primary channel not allowed */
 435                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 436                         goto bad_res;
 437
 438                 if (channel_type == NL80211_CHAN_HT40MINUS)
 439                         sec_freq = freq - 20;
 440                 else if (channel_type == NL80211_CHAN_HT40PLUS)
 441                         sec_freq = freq + 20;
 442                 else
 443                         sec_freq = 0;
 444
 445                 ht_cap = &rdev->wiphy.bands[chan->band]->ht_cap;
 446
 447                 /* no HT capabilities */
 448                 if (channel_type != NL80211_CHAN_NO_HT &&
 449                     !ht_cap->ht_supported)
 450                         goto bad_res;
 451
 452                 if (sec_freq) {
 453                         struct ieee80211_channel *schan;
 454
 455                         /* no 40 MHz capabilities */
 456                         if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
 457                             (ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT))
 458                                 goto bad_res;
 459
 460                         schan = ieee80211_get_channel(&rdev->wiphy, sec_freq);
 461
 462                         /* Secondary channel not allowed */
 463                         if (!schan || schan->flags & IEEE80211_CHAN_DISABLED)
 464                                 goto bad_res;
 465                 }
 466
 467                 result = rdev->ops->set_channel(&rdev->wiphy, chan,
 468                                                 channel_type);
 469                 if (result)
 470                         goto bad_res;
 471         }
 472
 473
 474  bad_res:
 475         cfg80211_put_dev(rdev);
 476         return result;
 477 }
 478
 479
 480 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 481                               struct net_device *dev)
 482 {
 483         void *hdr;
 484
 485         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
 486         if (!hdr)
 487                 return -1;
 488
 489         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 490         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
 491         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
 492         return genlmsg_end(msg, hdr);
 493
 494  nla_put_failure:
 495         genlmsg_cancel(msg, hdr);
 496         return -EMSGSIZE;
 497 }
 498
 499 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
 500 {
 501         int wp_idx = 0;
 502         int if_idx = 0;
 503         int wp_start = cb->args[0];
 504         int if_start = cb->args[1];
 505         struct cfg80211_registered_device *dev;
 506         struct wireless_dev *wdev;
 507
 508         mutex_lock(&cfg80211_mutex);
 509         list_for_each_entry(dev, &cfg80211_drv_list, list) {
 510                 if (wp_idx < wp_start) {
 511                         wp_idx++;
 512                         continue;
 513                 }
 514                 if_idx = 0;
 515
 516                 mutex_lock(&dev->devlist_mtx);
 517                 list_for_each_entry(wdev, &dev->netdev_list, list) {
 518                         if (if_idx < if_start) {
 519                                 if_idx++;
 520                                 continue;
 521                         }
 522                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
 523                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
 524                                                wdev->netdev) < 0) {
 525                                 mutex_unlock(&dev->devlist_mtx);
 526                                 goto out;
 527                         }
 528                         if_idx++;
 529                 }
 530                 mutex_unlock(&dev->devlist_mtx);
 531
 532                 wp_idx++;
 533         }
 534  out:
 535         mutex_unlock(&cfg80211_mutex);
 536
 537         cb->args[0] = wp_idx;
 538         cb->args[1] = if_idx;
 539
 540         return skb->len;
 541 }
 542
 543 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
 544 {
 545         struct sk_buff *msg;
 546         struct cfg80211_registered_device *dev;
 547         struct net_device *netdev;
 548         int err;
 549
 550         err = get_drv_dev_by_info_ifindex(info->attrs, &dev, &netdev);
 551         if (err)
 552                 return err;
 553
 554         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 555         if (!msg)
 556                 goto out_err;
 557
 558         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0, netdev) < 0)
 559                 goto out_free;
 560
 561         dev_put(netdev);
 562         cfg80211_put_dev(dev);
 563
 564         return genlmsg_unicast(msg, info->snd_pid);
 565
 566  out_free:
 567         nlmsg_free(msg);
 568  out_err:
 569         dev_put(netdev);
 570         cfg80211_put_dev(dev);
 571         return -ENOBUFS;
 572 }
 573
 574 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
 575         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
 576         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
 577         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
 578         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
 579         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
 580 };
 581
 582 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
 583 {
 584         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
 585         int flag;
 586
 587         *mntrflags = 0;
 588
 589         if (!nla)
 590                 return -EINVAL;
 591
 592         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
 593                              nla, mntr_flags_policy))
 594                 return -EINVAL;
 595
 596         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
 597                 if (flags[flag])
 598                         *mntrflags |= (1<<flag);
 599
 600         return 0;
 601 }
 602
 603 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 604 {
 605         struct cfg80211_registered_device *drv;
 606         struct vif_params params;
 607         int err, ifindex;
 608         enum nl80211_iftype type;
 609         struct net_device *dev;
 610         u32 _flags, *flags = NULL;
 611
 612         memset(&params, 0, sizeof(params));
 613
 614         rtnl_lock();
 615
 616         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 617         if (err)
 618                 goto unlock_rtnl;
 619
 620         ifindex = dev->ifindex;
 621         type = dev->ieee80211_ptr->iftype;
 622         dev_put(dev);
 623
 624         err = -EINVAL;
 625         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 626                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 627                 if (type > NL80211_IFTYPE_MAX)
 628                         goto unlock;
 629         }
 630
 631         if (!drv->ops->change_virtual_intf ||
 632             !(drv->wiphy.interface_modes & (1 << type))) {
 633                 err = -EOPNOTSUPP;
 634                 goto unlock;
 635         }
 636
 637         if (info->attrs[NL80211_ATTR_MESH_ID]) {
 638                 if (type != NL80211_IFTYPE_MESH_POINT) {
 639                         err = -EINVAL;
 640                         goto unlock;
 641                 }
 642                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 643                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 644         }
 645
 646         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
 647                 if (type != NL80211_IFTYPE_MONITOR) {
 648                         err = -EINVAL;
 649                         goto unlock;
 650                 }
 651                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
 652                                           &_flags);
 653                 if (!err)
 654                         flags = &_flags;
 655         }
 656
 657         err = drv->ops->change_virtual_intf(&drv->wiphy, ifindex,
 658                                             type, flags, &params);
 659
 660         dev = __dev_get_by_index(&init_net, ifindex);
 661         WARN_ON(!dev || (!err && dev->ieee80211_ptr->iftype != type));
 662
 663  unlock:
 664         cfg80211_put_dev(drv);
 665  unlock_rtnl:
 666         rtnl_unlock();
 667         return err;
 668 }
 669
 670 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
 671 {
 672         struct cfg80211_registered_device *drv;
 673         struct vif_params params;
 674         int err;
 675         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
 676         u32 flags;
 677
 678         memset(&params, 0, sizeof(params));
 679
 680         if (!info->attrs[NL80211_ATTR_IFNAME])
 681                 return -EINVAL;
 682
 683         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 684                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 685                 if (type > NL80211_IFTYPE_MAX)
 686                         return -EINVAL;
 687         }
 688
 689         rtnl_lock();
 690
 691         drv = cfg80211_get_dev_from_info(info);
 692         if (IS_ERR(drv)) {
 693                 err = PTR_ERR(drv);
 694                 goto unlock_rtnl;
 695         }
 696
 697         if (!drv->ops->add_virtual_intf ||
 698             !(drv->wiphy.interface_modes & (1 << type))) {
 699                 err = -EOPNOTSUPP;
 700                 goto unlock;
 701         }
 702
 703         if (type == NL80211_IFTYPE_MESH_POINT &&
 704             info->attrs[NL80211_ATTR_MESH_ID]) {
 705                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 706                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 707         }
 708
 709         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
 710                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
 711                                   &flags);
 712         err = drv->ops->add_virtual_intf(&drv->wiphy,
 713                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
 714                 type, err ? NULL : &flags, &params);
 715
 716  unlock:
 717         cfg80211_put_dev(drv);
 718  unlock_rtnl:
 719         rtnl_unlock();
 720         return err;
 721 }
 722
 723 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
 724 {
 725         struct cfg80211_registered_device *drv;
 726         int ifindex, err;
 727         struct net_device *dev;
 728
 729         rtnl_lock();
 730
 731         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 732         if (err)
 733                 goto unlock_rtnl;
 734         ifindex = dev->ifindex;
 735         dev_put(dev);
 736
 737         if (!drv->ops->del_virtual_intf) {
 738                 err = -EOPNOTSUPP;
 739                 goto out;
 740         }
 741
 742         err = drv->ops->del_virtual_intf(&drv->wiphy, ifindex);
 743
 744  out:
 745         cfg80211_put_dev(drv);
 746  unlock_rtnl:
 747         rtnl_unlock();
 748         return err;
 749 }
 750
 751 struct get_key_cookie {
 752         struct sk_buff *msg;
 753         int error;
 754 };
 755
 756 static void get_key_callback(void *c, struct key_params *params)
 757 {
 758         struct get_key_cookie *cookie = c;
 759
 760         if (params->key)
 761                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
 762                         params->key_len, params->key);
 763
 764         if (params->seq)
 765                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
 766                         params->seq_len, params->seq);
 767
 768         if (params->cipher)
 769                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
 770                             params->cipher);
 771
 772         return;
 773  nla_put_failure:
 774         cookie->error = 1;
 775 }
 776
 777 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
 778 {
 779         struct cfg80211_registered_device *drv;
 780         int err;
 781         struct net_device *dev;
 782         u8 key_idx = 0;
 783         u8 *mac_addr = NULL;
 784         struct get_key_cookie cookie = {
 785                 .error = 0,
 786         };
 787         void *hdr;
 788         struct sk_buff *msg;
 789
 790         if (info->attrs[NL80211_ATTR_KEY_IDX])
 791                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 792
 793         if (key_idx > 5)
 794                 return -EINVAL;
 795
 796         if (info->attrs[NL80211_ATTR_MAC])
 797                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 798
 799         rtnl_lock();
 800
 801         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 802         if (err)
 803                 goto unlock_rtnl;
 804
 805         if (!drv->ops->get_key) {
 806                 err = -EOPNOTSUPP;
 807                 goto out;
 808         }
 809
 810         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 811         if (!msg) {
 812                 err = -ENOMEM;
 813                 goto out;
 814         }
 815
 816         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
 817                              NL80211_CMD_NEW_KEY);
 818
 819         if (IS_ERR(hdr)) {
 820                 err = PTR_ERR(hdr);
 821                 goto out;
 822         }
 823
 824         cookie.msg = msg;
 825
 826         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 827         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
 828         if (mac_addr)
 829                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
 830
 831         err = drv->ops->get_key(&drv->wiphy, dev, key_idx, mac_addr,
 832                                 &cookie, get_key_callback);
 833
 834         if (err)
 835                 goto out;
 836
 837         if (cookie.error)
 838                 goto nla_put_failure;
 839
 840         genlmsg_end(msg, hdr);
 841         err = genlmsg_unicast(msg, info->snd_pid);
 842         goto out;
 843
 844  nla_put_failure:
 845         err = -ENOBUFS;
 846         nlmsg_free(msg);
 847  out:
 848         cfg80211_put_dev(drv);
 849         dev_put(dev);
 850  unlock_rtnl:
 851         rtnl_unlock();
 852
 853         return err;
 854 }
 855
 856 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
 857 {
 858         struct cfg80211_registered_device *drv;
 859         int err;
 860         struct net_device *dev;
 861         u8 key_idx;
 862         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
 863                     u8 key_index);
 864
 865         if (!info->attrs[NL80211_ATTR_KEY_IDX])
 866                 return -EINVAL;
 867
 868         key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 869
 870         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]) {
 871                 if (key_idx < 4 || key_idx > 5)
 872                         return -EINVAL;
 873         } else if (key_idx > 3)
 874                 return -EINVAL;
 875
 876         /* currently only support setting default key */
 877         if (!info->attrs[NL80211_ATTR_KEY_DEFAULT] &&
 878             !info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT])
 879                 return -EINVAL;
 880
 881         rtnl_lock();
 882
 883         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 884         if (err)
 885                 goto unlock_rtnl;
 886
 887         if (info->attrs[NL80211_ATTR_KEY_DEFAULT])
 888                 func = drv->ops->set_default_key;
 889         else
 890                 func = drv->ops->set_default_mgmt_key;
 891
 892         if (!func) {
 893                 err = -EOPNOTSUPP;
 894                 goto out;
 895         }
 896
 897         err = func(&drv->wiphy, dev, key_idx);
 898
 899  out:
 900         cfg80211_put_dev(drv);
 901         dev_put(dev);
 902
 903  unlock_rtnl:
 904         rtnl_unlock();
 905
 906         return err;
 907 }
 908
 909 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
 910 {
 911         struct cfg80211_registered_device *drv;
 912         int err;
 913         struct net_device *dev;
 914         struct key_params params;
 915         u8 key_idx = 0;
 916         u8 *mac_addr = NULL;
 917
 918         memset(&params, 0, sizeof(params));
 919
 920         if (!info->attrs[NL80211_ATTR_KEY_CIPHER])
 921                 return -EINVAL;
 922
 923         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 924                 params.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 925                 params.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 926         }
 927
 928         if (info->attrs[NL80211_ATTR_KEY_IDX])
 929                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 930
 931         params.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 932
 933         if (info->attrs[NL80211_ATTR_MAC])
 934                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 935
 936         if (key_idx > 5)
 937                 return -EINVAL;
 938
 939         /*
 940          * Disallow pairwise keys with non-zero index unless it's WEP
 941          * (because current deployments use pairwise WEP keys with
 942          * non-zero indizes but 802.11i clearly specifies to use zero)
 943          */
 944         if (mac_addr && key_idx &&
 945             params.cipher != WLAN_CIPHER_SUITE_WEP40 &&
 946             params.cipher != WLAN_CIPHER_SUITE_WEP104)
 947                 return -EINVAL;
 948
 949         /* TODO: add definitions for the lengths to linux/ieee80211.h */
 950         switch (params.cipher) {
 951         case WLAN_CIPHER_SUITE_WEP40:
 952                 if (params.key_len != 5)
 953                         return -EINVAL;
 954                 break;
 955         case WLAN_CIPHER_SUITE_TKIP:
 956                 if (params.key_len != 32)
 957                         return -EINVAL;
 958                 break;
 959         case WLAN_CIPHER_SUITE_CCMP:
 960                 if (params.key_len != 16)
 961                         return -EINVAL;
 962                 break;
 963         case WLAN_CIPHER_SUITE_WEP104:
 964                 if (params.key_len != 13)
 965                         return -EINVAL;
 966                 break;
 967         case WLAN_CIPHER_SUITE_AES_CMAC:
 968                 if (params.key_len != 16)
 969                         return -EINVAL;
 970                 break;
 971         default:
 972                 return -EINVAL;
 973         }
 974
 975         rtnl_lock();
 976
 977         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 978         if (err)
 979                 goto unlock_rtnl;
 980
 981         if (!drv->ops->add_key) {
 982                 err = -EOPNOTSUPP;
 983                 goto out;
 984         }
 985
 986         err = drv->ops->add_key(&drv->wiphy, dev, key_idx, mac_addr, &params);
 987
 988  out:
 989         cfg80211_put_dev(drv);
 990         dev_put(dev);
 991  unlock_rtnl:
 992         rtnl_unlock();
 993
 994         return err;
 995 }
 996
 997 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
 998 {
 999         struct cfg80211_registered_device *drv;
1000         int err;
1001         struct net_device *dev;
1002         u8 key_idx = 0;
1003         u8 *mac_addr = NULL;
1004
1005         if (info->attrs[NL80211_ATTR_KEY_IDX])
1006                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1007
1008         if (key_idx > 5)
1009                 return -EINVAL;
1010
1011         if (info->attrs[NL80211_ATTR_MAC])
1012                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1013
1014         rtnl_lock();
1015
1016         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1017         if (err)
1018                 goto unlock_rtnl;
1019
1020         if (!drv->ops->del_key) {
1021                 err = -EOPNOTSUPP;
1022                 goto out;
1023         }
1024
1025         err = drv->ops->del_key(&drv->wiphy, dev, key_idx, mac_addr);
1026
1027  out:
1028         cfg80211_put_dev(drv);
1029         dev_put(dev);
1030
1031  unlock_rtnl:
1032         rtnl_unlock();
1033
1034         return err;
1035 }
1036
1037 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1038 {
1039         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1040                     struct beacon_parameters *info);
1041         struct cfg80211_registered_device *drv;
1042         int err;
1043         struct net_device *dev;
1044         struct beacon_parameters params;
1045         int haveinfo = 0;
1046
1047         rtnl_lock();
1048
1049         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1050         if (err)
1051                 goto unlock_rtnl;
1052
1053         switch (info->genlhdr->cmd) {
1054         case NL80211_CMD_NEW_BEACON:
1055                 /* these are required for NEW_BEACON */
1056                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1057                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1058                     !info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1059                         err = -EINVAL;
1060                         goto out;
1061                 }
1062
1063                 call = drv->ops->add_beacon;
1064                 break;
1065         case NL80211_CMD_SET_BEACON:
1066                 call = drv->ops->set_beacon;
1067                 break;
1068         default:
1069                 WARN_ON(1);
1070                 err = -EOPNOTSUPP;
1071                 goto out;
1072         }
1073
1074         if (!call) {
1075                 err = -EOPNOTSUPP;
1076                 goto out;
1077         }
1078
1079         memset(&params, 0, sizeof(params));
1080
1081         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1082                 params.interval =
1083                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1084                 haveinfo = 1;
1085         }
1086
1087         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1088                 params.dtim_period =
1089                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1090                 haveinfo = 1;
1091         }
1092
1093         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1094                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1095                 params.head_len =
1096                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1097                 haveinfo = 1;
1098         }
1099
1100         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1101                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1102                 params.tail_len =
1103                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1104                 haveinfo = 1;
1105         }
1106
1107         if (!haveinfo) {
1108                 err = -EINVAL;
1109                 goto out;
1110         }
1111
1112         err = call(&drv->wiphy, dev, &params);
1113
1114  out:
1115         cfg80211_put_dev(drv);
1116         dev_put(dev);
1117  unlock_rtnl:
1118         rtnl_unlock();
1119
1120         return err;
1121 }
1122
1123 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1124 {
1125         struct cfg80211_registered_device *drv;
1126         int err;
1127         struct net_device *dev;
1128
1129         rtnl_lock();
1130
1131         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1132         if (err)
1133                 goto unlock_rtnl;
1134
1135         if (!drv->ops->del_beacon) {
1136                 err = -EOPNOTSUPP;
1137                 goto out;
1138         }
1139
1140         err = drv->ops->del_beacon(&drv->wiphy, dev);
1141
1142  out:
1143         cfg80211_put_dev(drv);
1144         dev_put(dev);
1145  unlock_rtnl:
1146         rtnl_unlock();
1147
1148         return err;
1149 }
1150
1151 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1152         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1153         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1154         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1155 };
1156
1157 static int parse_station_flags(struct nlattr *nla, u32 *staflags)
1158 {
1159         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1160         int flag;
1161
1162         *staflags = 0;
1163
1164         if (!nla)
1165                 return 0;
1166
1167         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1168                              nla, sta_flags_policy))
1169                 return -EINVAL;
1170
1171         *staflags = STATION_FLAG_CHANGED;
1172
1173         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1174                 if (flags[flag])
1175                         *staflags |= (1<<flag);
1176
1177         return 0;
1178 }
1179
1180 static u16 nl80211_calculate_bitrate(struct rate_info *rate)
1181 {
1182         int modulation, streams, bitrate;
1183
1184         if (!(rate->flags & RATE_INFO_FLAGS_MCS))
1185                 return rate->legacy;
1186
1187         /* the formula below does only work for MCS values smaller than 32 */
1188         if (rate->mcs >= 32)
1189                 return 0;
1190
1191         modulation = rate->mcs & 7;
1192         streams = (rate->mcs >> 3) + 1;
1193
1194         bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
1195                         13500000 : 6500000;
1196
1197         if (modulation < 4)
1198                 bitrate *= (modulation + 1);
1199         else if (modulation == 4)
1200                 bitrate *= (modulation + 2);
1201         else
1202                 bitrate *= (modulation + 3);
1203
1204         bitrate *= streams;
1205
1206         if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
1207                 bitrate = (bitrate / 9) * 10;
1208
1209         /* do NOT round down here */
1210         return (bitrate + 50000) / 100000;
1211 }
1212
1213 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1214                                 int flags, struct net_device *dev,
1215                                 u8 *mac_addr, struct station_info *sinfo)
1216 {
1217         void *hdr;
1218         struct nlattr *sinfoattr, *txrate;
1219         u16 bitrate;
1220
1221         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1222         if (!hdr)
1223                 return -1;
1224
1225         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1226         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1227
1228         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1229         if (!sinfoattr)
1230                 goto nla_put_failure;
1231         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1232                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1233                             sinfo->inactive_time);
1234         if (sinfo->filled & STATION_INFO_RX_BYTES)
1235                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1236                             sinfo->rx_bytes);
1237         if (sinfo->filled & STATION_INFO_TX_BYTES)
1238                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1239                             sinfo->tx_bytes);
1240         if (sinfo->filled & STATION_INFO_LLID)
1241                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1242                             sinfo->llid);
1243         if (sinfo->filled & STATION_INFO_PLID)
1244                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1245                             sinfo->plid);
1246         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1247                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1248                             sinfo->plink_state);
1249         if (sinfo->filled & STATION_INFO_SIGNAL)
1250                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1251                            sinfo->signal);
1252         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1253                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1254                 if (!txrate)
1255                         goto nla_put_failure;
1256
1257                 /* nl80211_calculate_bitrate will return 0 for mcs >= 32 */
1258                 bitrate = nl80211_calculate_bitrate(&sinfo->txrate);
1259                 if (bitrate > 0)
1260                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1261
1262                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1263                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1264                                     sinfo->txrate.mcs);
1265                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1266                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1267                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1268                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1269
1270                 nla_nest_end(msg, txrate);
1271         }
1272         if (sinfo->filled & STATION_INFO_RX_PACKETS)
1273                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
1274                             sinfo->rx_packets);
1275         if (sinfo->filled & STATION_INFO_TX_PACKETS)
1276                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
1277                             sinfo->tx_packets);
1278         nla_nest_end(msg, sinfoattr);
1279
1280         return genlmsg_end(msg, hdr);
1281
1282  nla_put_failure:
1283         genlmsg_cancel(msg, hdr);
1284         return -EMSGSIZE;
1285 }
1286
1287 static int nl80211_dump_station(struct sk_buff *skb,
1288                                 struct netlink_callback *cb)
1289 {
1290         struct station_info sinfo;
1291         struct cfg80211_registered_device *dev;
1292         struct net_device *netdev;
1293         u8 mac_addr[ETH_ALEN];
1294         int ifidx = cb->args[0];
1295         int sta_idx = cb->args[1];
1296         int err;
1297
1298         if (!ifidx) {
1299                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1300                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1301                                   nl80211_policy);
1302                 if (err)
1303                         return err;
1304
1305                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1306                         return -EINVAL;
1307
1308                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1309                 if (!ifidx)
1310                         return -EINVAL;
1311         }
1312
1313         rtnl_lock();
1314
1315         netdev = __dev_get_by_index(&init_net, ifidx);
1316         if (!netdev) {
1317                 err = -ENODEV;
1318                 goto out_rtnl;
1319         }
1320
1321         dev = cfg80211_get_dev_from_ifindex(ifidx);
1322         if (IS_ERR(dev)) {
1323                 err = PTR_ERR(dev);
1324                 goto out_rtnl;
1325         }
1326
1327         if (!dev->ops->dump_station) {
1328                 err = -ENOSYS;
1329                 goto out_err;
1330         }
1331
1332         while (1) {
1333                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1334                                              mac_addr, &sinfo);
1335                 if (err == -ENOENT)
1336                         break;
1337                 if (err)
1338                         goto out_err;
1339
1340                 if (nl80211_send_station(skb,
1341                                 NETLINK_CB(cb->skb).pid,
1342                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
1343                                 netdev, mac_addr,
1344                                 &sinfo) < 0)
1345                         goto out;
1346
1347                 sta_idx++;
1348         }
1349
1350
1351  out:
1352         cb->args[1] = sta_idx;
1353         err = skb->len;
1354  out_err:
1355         cfg80211_put_dev(dev);
1356  out_rtnl:
1357         rtnl_unlock();
1358
1359         return err;
1360 }
1361
1362 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1363 {
1364         struct cfg80211_registered_device *drv;
1365         int err;
1366         struct net_device *dev;
1367         struct station_info sinfo;
1368         struct sk_buff *msg;
1369         u8 *mac_addr = NULL;
1370
1371         memset(&sinfo, 0, sizeof(sinfo));
1372
1373         if (!info->attrs[NL80211_ATTR_MAC])
1374                 return -EINVAL;
1375
1376         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1377
1378         rtnl_lock();
1379
1380         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1381         if (err)
1382                 goto out_rtnl;
1383
1384         if (!drv->ops->get_station) {
1385                 err = -EOPNOTSUPP;
1386                 goto out;
1387         }
1388
1389         err = drv->ops->get_station(&drv->wiphy, dev, mac_addr, &sinfo);
1390         if (err)
1391                 goto out;
1392
1393         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1394         if (!msg)
1395                 goto out;
1396
1397         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1398                                  dev, mac_addr, &sinfo) < 0)
1399                 goto out_free;
1400
1401         err = genlmsg_unicast(msg, info->snd_pid);
1402         goto out;
1403
1404  out_free:
1405         nlmsg_free(msg);
1406  out:
1407         cfg80211_put_dev(drv);
1408         dev_put(dev);
1409  out_rtnl:
1410         rtnl_unlock();
1411
1412         return err;
1413 }
1414
1415 /*
1416  * Get vlan interface making sure it is on the right wiphy.
1417  */
1418 static int get_vlan(struct nlattr *vlanattr,
1419                     struct cfg80211_registered_device *rdev,
1420                     struct net_device **vlan)
1421 {
1422         *vlan = NULL;
1423
1424         if (vlanattr) {
1425                 *vlan = dev_get_by_index(&init_net, nla_get_u32(vlanattr));
1426                 if (!*vlan)
1427                         return -ENODEV;
1428                 if (!(*vlan)->ieee80211_ptr)
1429                         return -EINVAL;
1430                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
1431                         return -EINVAL;
1432         }
1433         return 0;
1434 }
1435
1436 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
1437 {
1438         struct cfg80211_registered_device *drv;
1439         int err;
1440         struct net_device *dev;
1441         struct station_parameters params;
1442         u8 *mac_addr = NULL;
1443
1444         memset(&params, 0, sizeof(params));
1445
1446         params.listen_interval = -1;
1447
1448         if (info->attrs[NL80211_ATTR_STA_AID])
1449                 return -EINVAL;
1450
1451         if (!info->attrs[NL80211_ATTR_MAC])
1452                 return -EINVAL;
1453
1454         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1455
1456         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
1457                 params.supported_rates =
1458                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1459                 params.supported_rates_len =
1460                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1461         }
1462
1463         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1464                 params.listen_interval =
1465                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1466
1467         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1468                 params.ht_capa =
1469                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1470
1471         if (parse_station_flags(info->attrs[NL80211_ATTR_STA_FLAGS],
1472                                 &params.station_flags))
1473                 return -EINVAL;
1474
1475         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
1476                 params.plink_action =
1477                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
1478
1479         rtnl_lock();
1480
1481         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1482         if (err)
1483                 goto out_rtnl;
1484
1485         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1486         if (err)
1487                 goto out;
1488
1489         if (!drv->ops->change_station) {
1490                 err = -EOPNOTSUPP;
1491                 goto out;
1492         }
1493
1494         err = drv->ops->change_station(&drv->wiphy, dev, mac_addr, &params);
1495
1496  out:
1497         if (params.vlan)
1498                 dev_put(params.vlan);
1499         cfg80211_put_dev(drv);
1500         dev_put(dev);
1501  out_rtnl:
1502         rtnl_unlock();
1503
1504         return err;
1505 }
1506
1507 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
1508 {
1509         struct cfg80211_registered_device *drv;
1510         int err;
1511         struct net_device *dev;
1512         struct station_parameters params;
1513         u8 *mac_addr = NULL;
1514
1515         memset(&params, 0, sizeof(params));
1516
1517         if (!info->attrs[NL80211_ATTR_MAC])
1518                 return -EINVAL;
1519
1520         if (!info->attrs[NL80211_ATTR_STA_AID])
1521                 return -EINVAL;
1522
1523         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1524                 return -EINVAL;
1525
1526         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
1527                 return -EINVAL;
1528
1529         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1530         params.supported_rates =
1531                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1532         params.supported_rates_len =
1533                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1534         params.listen_interval =
1535                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1536         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
1537         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1538                 params.ht_capa =
1539                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1540
1541         if (parse_station_flags(info->attrs[NL80211_ATTR_STA_FLAGS],
1542                                 &params.station_flags))
1543                 return -EINVAL;
1544
1545         rtnl_lock();
1546
1547         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1548         if (err)
1549                 goto out_rtnl;
1550
1551         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1552         if (err)
1553                 goto out;
1554
1555         if (!drv->ops->add_station) {
1556                 err = -EOPNOTSUPP;
1557                 goto out;
1558         }
1559
1560         err = drv->ops->add_station(&drv->wiphy, dev, mac_addr, &params);
1561
1562  out:
1563         if (params.vlan)
1564                 dev_put(params.vlan);
1565         cfg80211_put_dev(drv);
1566         dev_put(dev);
1567  out_rtnl:
1568         rtnl_unlock();
1569
1570         return err;
1571 }
1572
1573 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
1574 {
1575         struct cfg80211_registered_device *drv;
1576         int err;
1577         struct net_device *dev;
1578         u8 *mac_addr = NULL;
1579
1580         if (info->attrs[NL80211_ATTR_MAC])
1581                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1582
1583         rtnl_lock();
1584
1585         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1586         if (err)
1587                 goto out_rtnl;
1588
1589         if (!drv->ops->del_station) {
1590                 err = -EOPNOTSUPP;
1591                 goto out;
1592         }
1593
1594         err = drv->ops->del_station(&drv->wiphy, dev, mac_addr);
1595
1596  out:
1597         cfg80211_put_dev(drv);
1598         dev_put(dev);
1599  out_rtnl:
1600         rtnl_unlock();
1601
1602         return err;
1603 }
1604
1605 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
1606                                 int flags, struct net_device *dev,
1607                                 u8 *dst, u8 *next_hop,
1608                                 struct mpath_info *pinfo)
1609 {
1610         void *hdr;
1611         struct nlattr *pinfoattr;
1612
1613         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1614         if (!hdr)
1615                 return -1;
1616
1617         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1618         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
1619         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
1620
1621         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
1622         if (!pinfoattr)
1623                 goto nla_put_failure;
1624         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
1625                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
1626                             pinfo->frame_qlen);
1627         if (pinfo->filled & MPATH_INFO_DSN)
1628                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DSN,
1629                             pinfo->dsn);
1630         if (pinfo->filled & MPATH_INFO_METRIC)
1631                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
1632                             pinfo->metric);
1633         if (pinfo->filled & MPATH_INFO_EXPTIME)
1634                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
1635                             pinfo->exptime);
1636         if (pinfo->filled & MPATH_INFO_FLAGS)
1637                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
1638                             pinfo->flags);
1639         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
1640                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
1641                             pinfo->discovery_timeout);
1642         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
1643                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
1644                             pinfo->discovery_retries);
1645
1646         nla_nest_end(msg, pinfoattr);
1647
1648         return genlmsg_end(msg, hdr);
1649
1650  nla_put_failure:
1651         genlmsg_cancel(msg, hdr);
1652         return -EMSGSIZE;
1653 }
1654
1655 static int nl80211_dump_mpath(struct sk_buff *skb,
1656                               struct netlink_callback *cb)
1657 {
1658         struct mpath_info pinfo;
1659         struct cfg80211_registered_device *dev;
1660         struct net_device *netdev;
1661         u8 dst[ETH_ALEN];
1662         u8 next_hop[ETH_ALEN];
1663         int ifidx = cb->args[0];
1664         int path_idx = cb->args[1];
1665         int err;
1666
1667         if (!ifidx) {
1668                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1669                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1670                                   nl80211_policy);
1671                 if (err)
1672                         return err;
1673
1674                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1675                         return -EINVAL;
1676
1677                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1678                 if (!ifidx)
1679                         return -EINVAL;
1680         }
1681
1682         rtnl_lock();
1683
1684         netdev = __dev_get_by_index(&init_net, ifidx);
1685         if (!netdev) {
1686                 err = -ENODEV;
1687                 goto out_rtnl;
1688         }
1689
1690         dev = cfg80211_get_dev_from_ifindex(ifidx);
1691         if (IS_ERR(dev)) {
1692                 err = PTR_ERR(dev);
1693                 goto out_rtnl;
1694         }
1695
1696         if (!dev->ops->dump_mpath) {
1697                 err = -ENOSYS;
1698                 goto out_err;
1699         }
1700
1701         while (1) {
1702                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
1703                                            dst, next_hop, &pinfo);
1704                 if (err == -ENOENT)
1705                         break;
1706                 if (err)
1707                         goto out_err;
1708
1709                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
1710                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
1711                                        netdev, dst, next_hop,
1712                                        &pinfo) < 0)
1713                         goto out;
1714
1715                 path_idx++;
1716         }
1717
1718
1719  out:
1720         cb->args[1] = path_idx;
1721         err = skb->len;
1722  out_err:
1723         cfg80211_put_dev(dev);
1724  out_rtnl:
1725         rtnl_unlock();
1726
1727         return err;
1728 }
1729
1730 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
1731 {
1732         struct cfg80211_registered_device *drv;
1733         int err;
1734         struct net_device *dev;
1735         struct mpath_info pinfo;
1736         struct sk_buff *msg;
1737         u8 *dst = NULL;
1738         u8 next_hop[ETH_ALEN];
1739
1740         memset(&pinfo, 0, sizeof(pinfo));
1741
1742         if (!info->attrs[NL80211_ATTR_MAC])
1743                 return -EINVAL;
1744
1745         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1746
1747         rtnl_lock();
1748
1749         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1750         if (err)
1751                 goto out_rtnl;
1752
1753         if (!drv->ops->get_mpath) {
1754                 err = -EOPNOTSUPP;
1755                 goto out;
1756         }
1757
1758         err = drv->ops->get_mpath(&drv->wiphy, dev, dst, next_hop, &pinfo);
1759         if (err)
1760                 goto out;
1761
1762         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1763         if (!msg)
1764                 goto out;
1765
1766         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
1767                                  dev, dst, next_hop, &pinfo) < 0)
1768                 goto out_free;
1769
1770         err = genlmsg_unicast(msg, info->snd_pid);
1771         goto out;
1772
1773  out_free:
1774         nlmsg_free(msg);
1775  out:
1776         cfg80211_put_dev(drv);
1777         dev_put(dev);
1778  out_rtnl:
1779         rtnl_unlock();
1780
1781         return err;
1782 }
1783
1784 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
1785 {
1786         struct cfg80211_registered_device *drv;
1787         int err;
1788         struct net_device *dev;
1789         u8 *dst = NULL;
1790         u8 *next_hop = NULL;
1791
1792         if (!info->attrs[NL80211_ATTR_MAC])
1793                 return -EINVAL;
1794
1795         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
1796                 return -EINVAL;
1797
1798         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1799         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
1800
1801         rtnl_lock();
1802
1803         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1804         if (err)
1805                 goto out_rtnl;
1806
1807         if (!drv->ops->change_mpath) {
1808                 err = -EOPNOTSUPP;
1809                 goto out;
1810         }
1811
1812         err = drv->ops->change_mpath(&drv->wiphy, dev, dst, next_hop);
1813
1814  out:
1815         cfg80211_put_dev(drv);
1816         dev_put(dev);
1817  out_rtnl:
1818         rtnl_unlock();
1819
1820         return err;
1821 }
1822 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
1823 {
1824         struct cfg80211_registered_device *drv;
1825         int err;
1826         struct net_device *dev;
1827         u8 *dst = NULL;
1828         u8 *next_hop = NULL;
1829
1830         if (!info->attrs[NL80211_ATTR_MAC])
1831                 return -EINVAL;
1832
1833         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
1834                 return -EINVAL;
1835
1836         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1837         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
1838
1839         rtnl_lock();
1840
1841         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1842         if (err)
1843                 goto out_rtnl;
1844
1845         if (!drv->ops->add_mpath) {
1846                 err = -EOPNOTSUPP;
1847                 goto out;
1848         }
1849
1850         err = drv->ops->add_mpath(&drv->wiphy, dev, dst, next_hop);
1851
1852  out:
1853         cfg80211_put_dev(drv);
1854         dev_put(dev);
1855  out_rtnl:
1856         rtnl_unlock();
1857
1858         return err;
1859 }
1860
1861 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
1862 {
1863         struct cfg80211_registered_device *drv;
1864         int err;
1865         struct net_device *dev;
1866         u8 *dst = NULL;
1867
1868         if (info->attrs[NL80211_ATTR_MAC])
1869                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1870
1871         rtnl_lock();
1872
1873         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1874         if (err)
1875                 goto out_rtnl;
1876
1877         if (!drv->ops->del_mpath) {
1878                 err = -EOPNOTSUPP;
1879                 goto out;
1880         }
1881
1882         err = drv->ops->del_mpath(&drv->wiphy, dev, dst);
1883
1884  out:
1885         cfg80211_put_dev(drv);
1886         dev_put(dev);
1887  out_rtnl:
1888         rtnl_unlock();
1889
1890         return err;
1891 }
1892
1893 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
1894 {
1895         struct cfg80211_registered_device *drv;
1896         int err;
1897         struct net_device *dev;
1898         struct bss_parameters params;
1899
1900         memset(&params, 0, sizeof(params));
1901         /* default to not changing parameters */
1902         params.use_cts_prot = -1;
1903         params.use_short_preamble = -1;
1904         params.use_short_slot_time = -1;
1905
1906         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
1907                 params.use_cts_prot =
1908                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
1909         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
1910                 params.use_short_preamble =
1911                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
1912         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
1913                 params.use_short_slot_time =
1914                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
1915         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
1916                 params.basic_rates =
1917                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
1918                 params.basic_rates_len =
1919                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
1920         }
1921
1922         rtnl_lock();
1923
1924         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1925         if (err)
1926                 goto out_rtnl;
1927
1928         if (!drv->ops->change_bss) {
1929                 err = -EOPNOTSUPP;
1930                 goto out;
1931         }
1932
1933         err = drv->ops->change_bss(&drv->wiphy, dev, &params);
1934
1935  out:
1936         cfg80211_put_dev(drv);
1937         dev_put(dev);
1938  out_rtnl:
1939         rtnl_unlock();
1940
1941         return err;
1942 }
1943
1944 static const struct nla_policy
1945         reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
1946         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
1947         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
1948         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
1949         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
1950         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
1951         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
1952 };
1953
1954 static int parse_reg_rule(struct nlattr *tb[],
1955         struct ieee80211_reg_rule *reg_rule)
1956 {
1957         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
1958         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
1959
1960         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
1961                 return -EINVAL;
1962         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
1963                 return -EINVAL;
1964         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
1965                 return -EINVAL;
1966         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
1967                 return -EINVAL;
1968         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
1969                 return -EINVAL;
1970
1971         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
1972
1973         freq_range->start_freq_khz =
1974                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
1975         freq_range->end_freq_khz =
1976                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
1977         freq_range->max_bandwidth_khz =
1978                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
1979
1980         power_rule->max_eirp =
1981                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
1982
1983         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
1984                 power_rule->max_antenna_gain =
1985                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
1986
1987         return 0;
1988 }
1989
1990 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
1991 {
1992         int r;
1993         char *data = NULL;
1994
1995         /*
1996          * You should only get this when cfg80211 hasn't yet initialized
1997          * completely when built-in to the kernel right between the time
1998          * window between nl80211_init() and regulatory_init(), if that is
1999          * even possible.
2000          */
2001         mutex_lock(&cfg80211_mutex);
2002         if (unlikely(!cfg80211_regdomain)) {
2003                 mutex_unlock(&cfg80211_mutex);
2004                 return -EINPROGRESS;
2005         }
2006         mutex_unlock(&cfg80211_mutex);
2007
2008         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2009                 return -EINVAL;
2010
2011         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2012
2013 #ifdef CONFIG_WIRELESS_OLD_REGULATORY
2014         /* We ignore world regdom requests with the old regdom setup */
2015         if (is_world_regdom(data))
2016                 return -EINVAL;
2017 #endif
2018
2019         r = regulatory_hint_user(data);
2020
2021         return r;
2022 }
2023
2024 static int nl80211_get_mesh_params(struct sk_buff *skb,
2025         struct genl_info *info)
2026 {
2027         struct cfg80211_registered_device *drv;
2028         struct mesh_config cur_params;
2029         int err;
2030         struct net_device *dev;
2031         void *hdr;
2032         struct nlattr *pinfoattr;
2033         struct sk_buff *msg;
2034
2035         rtnl_lock();
2036
2037         /* Look up our device */
2038         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2039         if (err)
2040                 goto out_rtnl;
2041
2042         if (!drv->ops->get_mesh_params) {
2043                 err = -EOPNOTSUPP;
2044                 goto out;
2045         }
2046
2047         /* Get the mesh params */
2048         err = drv->ops->get_mesh_params(&drv->wiphy, dev, &cur_params);
2049         if (err)
2050                 goto out;
2051
2052         /* Draw up a netlink message to send back */
2053         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2054         if (!msg) {
2055                 err = -ENOBUFS;
2056                 goto out;
2057         }
2058         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2059                              NL80211_CMD_GET_MESH_PARAMS);
2060         if (!hdr)
2061                 goto nla_put_failure;
2062         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
2063         if (!pinfoattr)
2064                 goto nla_put_failure;
2065         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2066         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2067                         cur_params.dot11MeshRetryTimeout);
2068         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2069                         cur_params.dot11MeshConfirmTimeout);
2070         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2071                         cur_params.dot11MeshHoldingTimeout);
2072         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2073                         cur_params.dot11MeshMaxPeerLinks);
2074         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2075                         cur_params.dot11MeshMaxRetries);
2076         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2077                         cur_params.dot11MeshTTL);
2078         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2079                         cur_params.auto_open_plinks);
2080         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2081                         cur_params.dot11MeshHWMPmaxPREQretries);
2082         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2083                         cur_params.path_refresh_time);
2084         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2085                         cur_params.min_discovery_timeout);
2086         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2087                         cur_params.dot11MeshHWMPactivePathTimeout);
2088         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2089                         cur_params.dot11MeshHWMPpreqMinInterval);
2090         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2091                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2092         nla_nest_end(msg, pinfoattr);
2093         genlmsg_end(msg, hdr);
2094         err = genlmsg_unicast(msg, info->snd_pid);
2095         goto out;
2096
2097  nla_put_failure:
2098         genlmsg_cancel(msg, hdr);
2099         err = -EMSGSIZE;
2100  out:
2101         /* Cleanup */
2102         cfg80211_put_dev(drv);
2103         dev_put(dev);
2104  out_rtnl:
2105         rtnl_unlock();
2106
2107         return err;
2108 }
2109
2110 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2111 do {\
2112         if (table[attr_num]) {\
2113                 cfg.param = nla_fn(table[attr_num]); \
2114                 mask |= (1 << (attr_num - 1)); \
2115         } \
2116 } while (0);\
2117
2118 static struct nla_policy
2119 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] __read_mostly = {
2120         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2121         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2122         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2123         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2124         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2125         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2126         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2127
2128         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2129         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2130         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2131         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2132         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2133         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2134 };
2135
2136 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2137 {
2138         int err;
2139         u32 mask;
2140         struct cfg80211_registered_device *drv;
2141         struct net_device *dev;
2142         struct mesh_config cfg;
2143         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2144         struct nlattr *parent_attr;
2145
2146         parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
2147         if (!parent_attr)
2148                 return -EINVAL;
2149         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2150                         parent_attr, nl80211_meshconf_params_policy))
2151                 return -EINVAL;
2152
2153         rtnl_lock();
2154
2155         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2156         if (err)
2157                 goto out_rtnl;
2158
2159         if (!drv->ops->set_mesh_params) {
2160                 err = -EOPNOTSUPP;
2161                 goto out;
2162         }
2163
2164         /* This makes sure that there aren't more than 32 mesh config
2165          * parameters (otherwise our bitfield scheme would not work.) */
2166         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2167
2168         /* Fill in the params struct */
2169         mask = 0;
2170         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2171                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2172         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2173                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2174         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2175                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2176         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2177                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2178         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2179                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2180         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2181                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2182         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2183                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2184         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2185                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2186                         nla_get_u8);
2187         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2188                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2189         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2190                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2191                         nla_get_u16);
2192         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2193                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2194                         nla_get_u32);
2195         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2196                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2197                         nla_get_u16);
2198         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2199                         dot11MeshHWMPnetDiameterTraversalTime,
2200                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2201                         nla_get_u16);
2202
2203         /* Apply changes */
2204         err = drv->ops->set_mesh_params(&drv->wiphy, dev, &cfg, mask);
2205
2206  out:
2207         /* cleanup */
2208         cfg80211_put_dev(drv);
2209         dev_put(dev);
2210  out_rtnl:
2211         rtnl_unlock();
2212
2213         return err;
2214 }
2215
2216 #undef FILL_IN_MESH_PARAM_IF_SET
2217
2218 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2219 {
2220         struct sk_buff *msg;
2221         void *hdr = NULL;
2222         struct nlattr *nl_reg_rules;
2223         unsigned int i;
2224         int err = -EINVAL;
2225
2226         mutex_lock(&cfg80211_mutex);
2227
2228         if (!cfg80211_regdomain)
2229                 goto out;
2230
2231         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2232         if (!msg) {
2233                 err = -ENOBUFS;
2234                 goto out;
2235         }
2236
2237         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2238                              NL80211_CMD_GET_REG);
2239         if (!hdr)
2240                 goto nla_put_failure;
2241
2242         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2243                 cfg80211_regdomain->alpha2);
2244
2245         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2246         if (!nl_reg_rules)
2247                 goto nla_put_failure;
2248
2249         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2250                 struct nlattr *nl_reg_rule;
2251                 const struct ieee80211_reg_rule *reg_rule;
2252                 const struct ieee80211_freq_range *freq_range;
2253                 const struct ieee80211_power_rule *power_rule;
2254
2255                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2256                 freq_range = &reg_rule->freq_range;
2257                 power_rule = &reg_rule->power_rule;
2258
2259                 nl_reg_rule = nla_nest_start(msg, i);
2260                 if (!nl_reg_rule)
2261                         goto nla_put_failure;
2262
2263                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2264                         reg_rule->flags);
2265                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2266                         freq_range->start_freq_khz);
2267                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2268                         freq_range->end_freq_khz);
2269                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2270                         freq_range->max_bandwidth_khz);
2271                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2272                         power_rule->max_antenna_gain);
2273                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2274                         power_rule->max_eirp);
2275
2276                 nla_nest_end(msg, nl_reg_rule);
2277         }
2278
2279         nla_nest_end(msg, nl_reg_rules);
2280
2281         genlmsg_end(msg, hdr);
2282         err = genlmsg_unicast(msg, info->snd_pid);
2283         goto out;
2284
2285 nla_put_failure:
2286         genlmsg_cancel(msg, hdr);
2287         err = -EMSGSIZE;
2288 out:
2289         mutex_unlock(&cfg80211_mutex);
2290         return err;
2291 }
2292
2293 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2294 {
2295         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2296         struct nlattr *nl_reg_rule;
2297         char *alpha2 = NULL;
2298         int rem_reg_rules = 0, r = 0;
2299         u32 num_rules = 0, rule_idx = 0, size_of_regd;
2300         struct ieee80211_regdomain *rd = NULL;
2301
2302         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2303                 return -EINVAL;
2304
2305         if (!info->attrs[NL80211_ATTR_REG_RULES])
2306                 return -EINVAL;
2307
2308         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2309
2310         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2311                         rem_reg_rules) {
2312                 num_rules++;
2313                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2314                         goto bad_reg;
2315         }
2316
2317         if (!reg_is_valid_request(alpha2))
2318                 return -EINVAL;
2319
2320         size_of_regd = sizeof(struct ieee80211_regdomain) +
2321                 (num_rules * sizeof(struct ieee80211_reg_rule));
2322
2323         rd = kzalloc(size_of_regd, GFP_KERNEL);
2324         if (!rd)
2325                 return -ENOMEM;
2326
2327         rd->n_reg_rules = num_rules;
2328         rd->alpha2[0] = alpha2[0];
2329         rd->alpha2[1] = alpha2[1];
2330
2331         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2332                         rem_reg_rules) {
2333                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2334                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2335                         reg_rule_policy);
2336                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2337                 if (r)
2338                         goto bad_reg;
2339
2340                 rule_idx++;
2341
2342                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES)
2343                         goto bad_reg;
2344         }
2345
2346         BUG_ON(rule_idx != num_rules);
2347
2348         mutex_lock(&cfg80211_mutex);
2349         r = set_regdom(rd);
2350         mutex_unlock(&cfg80211_mutex);
2351         return r;
2352
2353  bad_reg:
2354         kfree(rd);
2355         return -EINVAL;
2356 }
2357
2358 static int nl80211_set_mgmt_extra_ie(struct sk_buff *skb,
2359                                      struct genl_info *info)
2360 {
2361         struct cfg80211_registered_device *drv;
2362         int err;
2363         struct net_device *dev;
2364         struct mgmt_extra_ie_params params;
2365
2366         memset(&params, 0, sizeof(params));
2367
2368         if (!info->attrs[NL80211_ATTR_MGMT_SUBTYPE])
2369                 return -EINVAL;
2370         params.subtype = nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
2371         if (params.subtype > 15)
2372                 return -EINVAL; /* FC Subtype field is 4 bits (0..15) */
2373
2374         if (info->attrs[NL80211_ATTR_IE]) {
2375                 params.ies = nla_data(info->attrs[NL80211_ATTR_IE]);
2376                 params.ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2377         }
2378
2379         rtnl_lock();
2380
2381         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2382         if (err)
2383                 goto out_rtnl;
2384
2385         if (drv->ops->set_mgmt_extra_ie)
2386                 err = drv->ops->set_mgmt_extra_ie(&drv->wiphy, dev, &params);
2387         else
2388                 err = -EOPNOTSUPP;
2389
2390         cfg80211_put_dev(drv);
2391         dev_put(dev);
2392  out_rtnl:
2393         rtnl_unlock();
2394
2395         return err;
2396 }
2397
2398 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
2399 {
2400         struct cfg80211_registered_device *drv;
2401         struct net_device *dev;
2402         struct cfg80211_scan_request *request;
2403         struct cfg80211_ssid *ssid;
2404         struct ieee80211_channel *channel;
2405         struct nlattr *attr;
2406         struct wiphy *wiphy;
2407         int err, tmp, n_ssids = 0, n_channels = 0, i;
2408         enum ieee80211_band band;
2409         size_t ie_len;
2410
2411         rtnl_lock();
2412
2413         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2414         if (err)
2415                 goto out_rtnl;
2416
2417         wiphy = &drv->wiphy;
2418
2419         if (!drv->ops->scan) {
2420                 err = -EOPNOTSUPP;
2421                 goto out;
2422         }
2423
2424         if (drv->scan_req) {
2425                 err = -EBUSY;
2426                 goto out;
2427         }
2428
2429         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2430                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp)
2431                         n_channels++;
2432                 if (!n_channels) {
2433                         err = -EINVAL;
2434                         goto out;
2435                 }
2436         } else {
2437                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
2438                         if (wiphy->bands[band])
2439                                 n_channels += wiphy->bands[band]->n_channels;
2440         }
2441
2442         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
2443                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
2444                         n_ssids++;
2445
2446         if (n_ssids > wiphy->max_scan_ssids) {
2447                 err = -EINVAL;
2448                 goto out;
2449         }
2450
2451         if (info->attrs[NL80211_ATTR_IE])
2452                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2453         else
2454                 ie_len = 0;
2455
2456         request = kzalloc(sizeof(*request)
2457                         + sizeof(*ssid) * n_ssids
2458                         + sizeof(channel) * n_channels
2459                         + ie_len, GFP_KERNEL);
2460         if (!request) {
2461                 err = -ENOMEM;
2462                 goto out;
2463         }
2464
2465         request->channels = (void *)((char *)request + sizeof(*request));
2466         request->n_channels = n_channels;
2467         if (n_ssids)
2468                 request->ssids = (void *)(request->channels + n_channels);
2469         request->n_ssids = n_ssids;
2470         if (ie_len) {
2471                 if (request->ssids)
2472                         request->ie = (void *)(request->ssids + n_ssids);
2473                 else
2474                         request->ie = (void *)(request->channels + n_channels);
2475         }
2476
2477         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2478                 /* user specified, bail out if channel not found */
2479                 request->n_channels = n_channels;
2480                 i = 0;
2481                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
2482                         request->channels[i] = ieee80211_get_channel(wiphy, nla_get_u32(attr));
2483                         if (!request->channels[i]) {
2484                                 err = -EINVAL;
2485                                 goto out_free;
2486                         }
2487                         i++;
2488                 }
2489         } else {
2490                 /* all channels */
2491                 i = 0;
2492                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
2493                         int j;
2494                         if (!wiphy->bands[band])
2495                                 continue;
2496                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
2497                                 request->channels[i] = &wiphy->bands[band]->channels[j];
2498                                 i++;
2499                         }
2500                 }
2501         }
2502
2503         i = 0;
2504         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
2505                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
2506                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
2507                                 err = -EINVAL;
2508                                 goto out_free;
2509                         }
2510                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
2511                         request->ssids[i].ssid_len = nla_len(attr);
2512                         i++;
2513                 }
2514         }
2515
2516         if (info->attrs[NL80211_ATTR_IE]) {
2517                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2518                 memcpy(request->ie, nla_data(info->attrs[NL80211_ATTR_IE]),
2519                        request->ie_len);
2520         }
2521
2522         request->ifidx = dev->ifindex;
2523         request->wiphy = &drv->wiphy;
2524
2525         drv->scan_req = request;
2526         err = drv->ops->scan(&drv->wiphy, dev, request);
2527
2528  out_free:
2529         if (err) {
2530                 drv->scan_req = NULL;
2531                 kfree(request);
2532         }
2533  out:
2534         cfg80211_put_dev(drv);
2535         dev_put(dev);
2536  out_rtnl:
2537         rtnl_unlock();
2538
2539         return err;
2540 }
2541
2542 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
2543                             struct cfg80211_registered_device *rdev,
2544                             struct net_device *dev,
2545                             struct cfg80211_bss *res)
2546 {
2547         void *hdr;
2548         struct nlattr *bss;
2549
2550         hdr = nl80211hdr_put(msg, pid, seq, flags,
2551                              NL80211_CMD_NEW_SCAN_RESULTS);
2552         if (!hdr)
2553                 return -1;
2554
2555         NLA_PUT_U32(msg, NL80211_ATTR_SCAN_GENERATION,
2556                     rdev->bss_generation);
2557         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2558
2559         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
2560         if (!bss)
2561                 goto nla_put_failure;
2562         if (!is_zero_ether_addr(res->bssid))
2563                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
2564         if (res->information_elements && res->len_information_elements)
2565                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
2566                         res->len_information_elements,
2567                         res->information_elements);
2568         if (res->tsf)
2569                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
2570         if (res->beacon_interval)
2571                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
2572         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
2573         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
2574
2575         switch (rdev->wiphy.signal_type) {
2576         case CFG80211_SIGNAL_TYPE_MBM:
2577                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
2578                 break;
2579         case CFG80211_SIGNAL_TYPE_UNSPEC:
2580                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
2581                 break;
2582         default:
2583                 break;
2584         }
2585
2586         nla_nest_end(msg, bss);
2587
2588         return genlmsg_end(msg, hdr);
2589
2590  nla_put_failure:
2591         genlmsg_cancel(msg, hdr);
2592         return -EMSGSIZE;
2593 }
2594
2595 static int nl80211_dump_scan(struct sk_buff *skb,
2596                              struct netlink_callback *cb)
2597 {
2598         struct cfg80211_registered_device *dev;
2599         struct net_device *netdev;
2600         struct cfg80211_internal_bss *scan;
2601         int ifidx = cb->args[0];
2602         int start = cb->args[1], idx = 0;
2603         int err;
2604
2605         if (!ifidx) {
2606                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
2607                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
2608                                   nl80211_policy);
2609                 if (err)
2610                         return err;
2611
2612                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
2613                         return -EINVAL;
2614
2615                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
2616                 if (!ifidx)
2617                         return -EINVAL;
2618                 cb->args[0] = ifidx;
2619         }
2620
2621         netdev = dev_get_by_index(&init_net, ifidx);
2622         if (!netdev)
2623                 return -ENODEV;
2624
2625         dev = cfg80211_get_dev_from_ifindex(ifidx);
2626         if (IS_ERR(dev)) {
2627                 err = PTR_ERR(dev);
2628                 goto out_put_netdev;
2629         }
2630
2631         spin_lock_bh(&dev->bss_lock);
2632         cfg80211_bss_expire(dev);
2633
2634         list_for_each_entry(scan, &dev->bss_list, list) {
2635                 if (++idx <= start)
2636                         continue;
2637                 if (nl80211_send_bss(skb,
2638                                 NETLINK_CB(cb->skb).pid,
2639                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2640                                 dev, netdev, &scan->pub) < 0) {
2641                         idx--;
2642                         goto out;
2643                 }
2644         }
2645
2646  out:
2647         spin_unlock_bh(&dev->bss_lock);
2648
2649         cb->args[1] = idx;
2650         err = skb->len;
2651         cfg80211_put_dev(dev);
2652  out_put_netdev:
2653         dev_put(netdev);
2654
2655         return err;
2656 }
2657
2658 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
2659 {
2660         struct cfg80211_registered_device *drv;
2661         struct net_device *dev;
2662         struct cfg80211_auth_request req;
2663         struct wiphy *wiphy;
2664         int err;
2665
2666         rtnl_lock();
2667
2668         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2669         if (err)
2670                 goto unlock_rtnl;
2671
2672         if (!drv->ops->auth) {
2673                 err = -EOPNOTSUPP;
2674                 goto out;
2675         }
2676
2677         if (!info->attrs[NL80211_ATTR_MAC]) {
2678                 err = -EINVAL;
2679                 goto out;
2680         }
2681
2682         wiphy = &drv->wiphy;
2683         memset(&req, 0, sizeof(req));
2684
2685         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2686
2687         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2688                 req.chan = ieee80211_get_channel(
2689                         wiphy,
2690                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
2691                 if (!req.chan) {
2692                         err = -EINVAL;
2693                         goto out;
2694                 }
2695         }
2696
2697         if (info->attrs[NL80211_ATTR_SSID]) {
2698                 req.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2699                 req.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
2700         }
2701
2702         if (info->attrs[NL80211_ATTR_IE]) {
2703                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
2704                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2705         }
2706
2707         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
2708                 req.auth_type =
2709                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
2710         }
2711
2712         err = drv->ops->auth(&drv->wiphy, dev, &req);
2713
2714 out:
2715         cfg80211_put_dev(drv);
2716         dev_put(dev);
2717 unlock_rtnl:
2718         rtnl_unlock();
2719         return err;
2720 }
2721
2722 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
2723 {
2724         struct cfg80211_registered_device *drv;
2725         struct net_device *dev;
2726         struct cfg80211_assoc_request req;
2727         struct wiphy *wiphy;
2728         int err;
2729
2730         rtnl_lock();
2731
2732         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2733         if (err)
2734                 goto unlock_rtnl;
2735
2736         if (!drv->ops->assoc) {
2737                 err = -EOPNOTSUPP;
2738                 goto out;
2739         }
2740
2741         if (!info->attrs[NL80211_ATTR_MAC] ||
2742             !info->attrs[NL80211_ATTR_SSID]) {
2743                 err = -EINVAL;
2744                 goto out;
2745         }
2746
2747         wiphy = &drv->wiphy;
2748         memset(&req, 0, sizeof(req));
2749
2750         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2751
2752         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2753                 req.chan = ieee80211_get_channel(
2754                         wiphy,
2755                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
2756                 if (!req.chan) {
2757                         err = -EINVAL;
2758                         goto out;
2759                 }
2760         }
2761
2762         if (nla_len(info->attrs[NL80211_ATTR_SSID]) > IEEE80211_MAX_SSID_LEN) {
2763                 err = -EINVAL;
2764                 goto out;
2765         }
2766         req.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2767         req.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
2768
2769         if (info->attrs[NL80211_ATTR_IE]) {
2770                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
2771                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2772         }
2773
2774         err = drv->ops->assoc(&drv->wiphy, dev, &req);
2775
2776 out:
2777         cfg80211_put_dev(drv);
2778         dev_put(dev);
2779 unlock_rtnl:
2780         rtnl_unlock();
2781         return err;
2782 }
2783
2784 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
2785 {
2786         struct cfg80211_registered_device *drv;
2787         struct net_device *dev;
2788         struct cfg80211_deauth_request req;
2789         struct wiphy *wiphy;
2790         int err;
2791
2792         rtnl_lock();
2793
2794         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2795         if (err)
2796                 goto unlock_rtnl;
2797
2798         if (!drv->ops->deauth) {
2799                 err = -EOPNOTSUPP;
2800                 goto out;
2801         }
2802
2803         if (!info->attrs[NL80211_ATTR_MAC]) {
2804                 err = -EINVAL;
2805                 goto out;
2806         }
2807
2808         wiphy = &drv->wiphy;
2809         memset(&req, 0, sizeof(req));
2810
2811         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2812
2813         if (info->attrs[NL80211_ATTR_REASON_CODE])
2814                 req.reason_code =
2815                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
2816
2817         if (info->attrs[NL80211_ATTR_IE]) {
2818                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
2819                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2820         }
2821
2822         err = drv->ops->deauth(&drv->wiphy, dev, &req);
2823
2824 out:
2825         cfg80211_put_dev(drv);
2826         dev_put(dev);
2827 unlock_rtnl:
2828         rtnl_unlock();
2829         return err;
2830 }
2831
2832 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
2833 {
2834         struct cfg80211_registered_device *drv;
2835         struct net_device *dev;
2836         struct cfg80211_disassoc_request req;
2837         struct wiphy *wiphy;
2838         int err;
2839
2840         rtnl_lock();
2841
2842         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2843         if (err)
2844                 goto unlock_rtnl;
2845
2846         if (!drv->ops->disassoc) {
2847                 err = -EOPNOTSUPP;
2848                 goto out;
2849         }
2850
2851         if (!info->attrs[NL80211_ATTR_MAC]) {
2852                 err = -EINVAL;
2853                 goto out;
2854         }
2855
2856         wiphy = &drv->wiphy;
2857         memset(&req, 0, sizeof(req));
2858
2859         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2860
2861         if (info->attrs[NL80211_ATTR_REASON_CODE])
2862                 req.reason_code =
2863                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
2864
2865         if (info->attrs[NL80211_ATTR_IE]) {
2866                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
2867                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2868         }
2869
2870         err = drv->ops->disassoc(&drv->wiphy, dev, &req);
2871
2872 out:
2873         cfg80211_put_dev(drv);
2874         dev_put(dev);
2875 unlock_rtnl:
2876         rtnl_unlock();
2877         return err;
2878 }
2879
2880 static struct genl_ops nl80211_ops[] = {
2881         {
2882                 .cmd = NL80211_CMD_GET_WIPHY,
2883                 .doit = nl80211_get_wiphy,
2884                 .dumpit = nl80211_dump_wiphy,
2885                 .policy = nl80211_policy,
2886                 /* can be retrieved by unprivileged users */
2887         },
2888         {
2889                 .cmd = NL80211_CMD_SET_WIPHY,
2890                 .doit = nl80211_set_wiphy,
2891                 .policy = nl80211_policy,
2892                 .flags = GENL_ADMIN_PERM,
2893         },
2894         {
2895                 .cmd = NL80211_CMD_GET_INTERFACE,
2896                 .doit = nl80211_get_interface,
2897                 .dumpit = nl80211_dump_interface,
2898                 .policy = nl80211_policy,
2899                 /* can be retrieved by unprivileged users */
2900         },
2901         {
2902                 .cmd = NL80211_CMD_SET_INTERFACE,
2903                 .doit = nl80211_set_interface,
2904                 .policy = nl80211_policy,
2905                 .flags = GENL_ADMIN_PERM,
2906         },
2907         {
2908                 .cmd = NL80211_CMD_NEW_INTERFACE,
2909                 .doit = nl80211_new_interface,
2910                 .policy = nl80211_policy,
2911                 .flags = GENL_ADMIN_PERM,
2912         },
2913         {
2914                 .cmd = NL80211_CMD_DEL_INTERFACE,
2915                 .doit = nl80211_del_interface,
2916                 .policy = nl80211_policy,
2917                 .flags = GENL_ADMIN_PERM,
2918         },
2919         {
2920                 .cmd = NL80211_CMD_GET_KEY,
2921                 .doit = nl80211_get_key,
2922                 .policy = nl80211_policy,
2923                 .flags = GENL_ADMIN_PERM,
2924         },
2925         {
2926                 .cmd = NL80211_CMD_SET_KEY,
2927                 .doit = nl80211_set_key,
2928                 .policy = nl80211_policy,
2929                 .flags = GENL_ADMIN_PERM,
2930         },
2931         {
2932                 .cmd = NL80211_CMD_NEW_KEY,
2933                 .doit = nl80211_new_key,
2934                 .policy = nl80211_policy,
2935                 .flags = GENL_ADMIN_PERM,
2936         },
2937         {
2938                 .cmd = NL80211_CMD_DEL_KEY,
2939                 .doit = nl80211_del_key,
2940                 .policy = nl80211_policy,
2941                 .flags = GENL_ADMIN_PERM,
2942         },
2943         {
2944                 .cmd = NL80211_CMD_SET_BEACON,
2945                 .policy = nl80211_policy,
2946                 .flags = GENL_ADMIN_PERM,
2947                 .doit = nl80211_addset_beacon,
2948         },
2949         {
2950                 .cmd = NL80211_CMD_NEW_BEACON,
2951                 .policy = nl80211_policy,
2952                 .flags = GENL_ADMIN_PERM,
2953                 .doit = nl80211_addset_beacon,
2954         },
2955         {
2956                 .cmd = NL80211_CMD_DEL_BEACON,
2957                 .policy = nl80211_policy,
2958                 .flags = GENL_ADMIN_PERM,
2959                 .doit = nl80211_del_beacon,
2960         },
2961         {
2962                 .cmd = NL80211_CMD_GET_STATION,
2963                 .doit = nl80211_get_station,
2964                 .dumpit = nl80211_dump_station,
2965                 .policy = nl80211_policy,
2966         },
2967         {
2968                 .cmd = NL80211_CMD_SET_STATION,
2969                 .doit = nl80211_set_station,
2970                 .policy = nl80211_policy,
2971                 .flags = GENL_ADMIN_PERM,
2972         },
2973         {
2974                 .cmd = NL80211_CMD_NEW_STATION,
2975                 .doit = nl80211_new_station,
2976                 .policy = nl80211_policy,
2977                 .flags = GENL_ADMIN_PERM,
2978         },
2979         {
2980                 .cmd = NL80211_CMD_DEL_STATION,
2981                 .doit = nl80211_del_station,
2982                 .policy = nl80211_policy,
2983                 .flags = GENL_ADMIN_PERM,
2984         },
2985         {
2986                 .cmd = NL80211_CMD_GET_MPATH,
2987                 .doit = nl80211_get_mpath,
2988                 .dumpit = nl80211_dump_mpath,
2989                 .policy = nl80211_policy,
2990                 .flags = GENL_ADMIN_PERM,
2991         },
2992         {
2993                 .cmd = NL80211_CMD_SET_MPATH,
2994                 .doit = nl80211_set_mpath,
2995                 .policy = nl80211_policy,
2996                 .flags = GENL_ADMIN_PERM,
2997         },
2998         {
2999                 .cmd = NL80211_CMD_NEW_MPATH,
3000                 .doit = nl80211_new_mpath,
3001                 .policy = nl80211_policy,
3002                 .flags = GENL_ADMIN_PERM,
3003         },
3004         {
3005                 .cmd = NL80211_CMD_DEL_MPATH,
3006                 .doit = nl80211_del_mpath,
3007                 .policy = nl80211_policy,
3008                 .flags = GENL_ADMIN_PERM,
3009         },
3010         {
3011                 .cmd = NL80211_CMD_SET_BSS,
3012                 .doit = nl80211_set_bss,
3013                 .policy = nl80211_policy,
3014                 .flags = GENL_ADMIN_PERM,
3015         },
3016         {
3017                 .cmd = NL80211_CMD_GET_REG,
3018                 .doit = nl80211_get_reg,
3019                 .policy = nl80211_policy,
3020                 /* can be retrieved by unprivileged users */
3021         },
3022         {
3023                 .cmd = NL80211_CMD_SET_REG,
3024                 .doit = nl80211_set_reg,
3025                 .policy = nl80211_policy,
3026                 .flags = GENL_ADMIN_PERM,
3027         },
3028         {
3029                 .cmd = NL80211_CMD_REQ_SET_REG,
3030                 .doit = nl80211_req_set_reg,
3031                 .policy = nl80211_policy,
3032                 .flags = GENL_ADMIN_PERM,
3033         },
3034         {
3035                 .cmd = NL80211_CMD_GET_MESH_PARAMS,
3036                 .doit = nl80211_get_mesh_params,
3037                 .policy = nl80211_policy,
3038                 /* can be retrieved by unprivileged users */
3039         },
3040         {
3041                 .cmd = NL80211_CMD_SET_MESH_PARAMS,
3042                 .doit = nl80211_set_mesh_params,
3043                 .policy = nl80211_policy,
3044                 .flags = GENL_ADMIN_PERM,
3045         },
3046         {
3047                 .cmd = NL80211_CMD_SET_MGMT_EXTRA_IE,
3048                 .doit = nl80211_set_mgmt_extra_ie,
3049                 .policy = nl80211_policy,
3050                 .flags = GENL_ADMIN_PERM,
3051         },
3052         {
3053                 .cmd = NL80211_CMD_TRIGGER_SCAN,
3054                 .doit = nl80211_trigger_scan,
3055                 .policy = nl80211_policy,
3056                 .flags = GENL_ADMIN_PERM,
3057         },
3058         {
3059                 .cmd = NL80211_CMD_GET_SCAN,
3060                 .policy = nl80211_policy,
3061                 .dumpit = nl80211_dump_scan,
3062         },
3063         {
3064                 .cmd = NL80211_CMD_AUTHENTICATE,
3065                 .doit = nl80211_authenticate,
3066                 .policy = nl80211_policy,
3067                 .flags = GENL_ADMIN_PERM,
3068         },
3069         {
3070                 .cmd = NL80211_CMD_ASSOCIATE,
3071                 .doit = nl80211_associate,
3072                 .policy = nl80211_policy,
3073                 .flags = GENL_ADMIN_PERM,
3074         },
3075         {
3076                 .cmd = NL80211_CMD_DEAUTHENTICATE,
3077                 .doit = nl80211_deauthenticate,
3078                 .policy = nl80211_policy,
3079                 .flags = GENL_ADMIN_PERM,
3080         },
3081         {
3082                 .cmd = NL80211_CMD_DISASSOCIATE,
3083                 .doit = nl80211_disassociate,
3084                 .policy = nl80211_policy,
3085                 .flags = GENL_ADMIN_PERM,
3086         },
3087 };
3088 static struct genl_multicast_group nl80211_mlme_mcgrp = {
3089         .name = "mlme",
3090 };
3091
3092 /* multicast groups */
3093 static struct genl_multicast_group nl80211_config_mcgrp = {
3094         .name = "config",
3095 };
3096 static struct genl_multicast_group nl80211_scan_mcgrp = {
3097         .name = "scan",
3098 };
3099 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
3100         .name = "regulatory",
3101 };
3102
3103 /* notification functions */
3104
3105 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
3106 {
3107         struct sk_buff *msg;
3108
3109         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3110         if (!msg)
3111                 return;
3112
3113         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
3114                 nlmsg_free(msg);
3115                 return;
3116         }
3117
3118         genlmsg_multicast(msg, 0, nl80211_config_mcgrp.id, GFP_KERNEL);
3119 }
3120
3121 static int nl80211_send_scan_donemsg(struct sk_buff *msg,
3122                                     struct cfg80211_registered_device *rdev,
3123                                     struct net_device *netdev,
3124                                     u32 pid, u32 seq, int flags,
3125                                     u32 cmd)
3126 {
3127         void *hdr;
3128
3129         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
3130         if (!hdr)
3131                 return -1;
3132
3133         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3134         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3135
3136         /* XXX: we should probably bounce back the request? */
3137
3138         return genlmsg_end(msg, hdr);
3139
3140  nla_put_failure:
3141         genlmsg_cancel(msg, hdr);
3142         return -EMSGSIZE;
3143 }
3144
3145 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
3146                             struct net_device *netdev)
3147 {
3148         struct sk_buff *msg;
3149
3150         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3151         if (!msg)
3152                 return;
3153
3154         if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
3155                                       NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
3156                 nlmsg_free(msg);
3157                 return;
3158         }
3159
3160         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
3161 }
3162
3163 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
3164                                struct net_device *netdev)
3165 {
3166         struct sk_buff *msg;
3167
3168         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3169         if (!msg)
3170                 return;
3171
3172         if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
3173                                       NL80211_CMD_SCAN_ABORTED) < 0) {
3174                 nlmsg_free(msg);
3175                 return;
3176         }
3177
3178         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
3179 }
3180
3181 /*
3182  * This can happen on global regulatory changes or device specific settings
3183  * based on custom world regulatory domains.
3184  */
3185 void nl80211_send_reg_change_event(struct regulatory_request *request)
3186 {
3187         struct sk_buff *msg;
3188         void *hdr;
3189
3190         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3191         if (!msg)
3192                 return;
3193
3194         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
3195         if (!hdr) {
3196                 nlmsg_free(msg);
3197                 return;
3198         }
3199
3200         /* Userspace can always count this one always being set */
3201         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
3202
3203         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
3204                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3205                            NL80211_REGDOM_TYPE_WORLD);
3206         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
3207                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3208                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
3209         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
3210                  request->intersect)
3211                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3212                            NL80211_REGDOM_TYPE_INTERSECTION);
3213         else {
3214                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3215                            NL80211_REGDOM_TYPE_COUNTRY);
3216                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
3217         }
3218
3219         if (wiphy_idx_valid(request->wiphy_idx))
3220                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
3221
3222         if (genlmsg_end(msg, hdr) < 0) {
3223                 nlmsg_free(msg);
3224                 return;
3225         }
3226
3227         genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_KERNEL);
3228
3229         return;
3230
3231 nla_put_failure:
3232         genlmsg_cancel(msg, hdr);
3233         nlmsg_free(msg);
3234 }
3235
3236 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
3237                                     struct net_device *netdev,
3238                                     const u8 *buf, size_t len,
3239                                     enum nl80211_commands cmd)
3240 {
3241         struct sk_buff *msg;
3242         void *hdr;
3243
3244         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3245         if (!msg)
3246                 return;
3247
3248         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
3249         if (!hdr) {
3250                 nlmsg_free(msg);
3251                 return;
3252         }
3253
3254         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3255         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3256         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
3257
3258         if (genlmsg_end(msg, hdr) < 0) {
3259                 nlmsg_free(msg);
3260                 return;
3261         }
3262
3263         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_KERNEL);
3264         return;
3265
3266  nla_put_failure:
3267         genlmsg_cancel(msg, hdr);
3268         nlmsg_free(msg);
3269 }
3270
3271 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
3272                           struct net_device *netdev, const u8 *buf, size_t len)
3273 {
3274         nl80211_send_mlme_event(rdev, netdev, buf, len,
3275                                 NL80211_CMD_AUTHENTICATE);
3276 }
3277
3278 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
3279                            struct net_device *netdev, const u8 *buf,
3280                            size_t len)
3281 {
3282         nl80211_send_mlme_event(rdev, netdev, buf, len, NL80211_CMD_ASSOCIATE);
3283 }
3284
3285 void nl80211_send_rx_deauth(struct cfg80211_registered_device *rdev,
3286                             struct net_device *netdev, const u8 *buf,
3287                             size_t len)
3288 {
3289         nl80211_send_mlme_event(rdev, netdev, buf, len,
3290                                 NL80211_CMD_DEAUTHENTICATE);
3291 }
3292
3293 void nl80211_send_rx_disassoc(struct cfg80211_registered_device *rdev,
3294                               struct net_device *netdev, const u8 *buf,
3295                               size_t len)
3296 {
3297         nl80211_send_mlme_event(rdev, netdev, buf, len,
3298                                 NL80211_CMD_DISASSOCIATE);
3299 }
3300
3301 /* initialisation/exit functions */
3302
3303 int nl80211_init(void)
3304 {
3305         int err, i;
3306
3307         err = genl_register_family(&nl80211_fam);
3308         if (err)
3309                 return err;
3310
3311         for (i = 0; i < ARRAY_SIZE(nl80211_ops); i++) {
3312                 err = genl_register_ops(&nl80211_fam, &nl80211_ops[i]);
3313                 if (err)
3314                         goto err_out;
3315         }
3316
3317         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
3318         if (err)
3319                 goto err_out;
3320
3321         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
3322         if (err)
3323                 goto err_out;
3324
3325         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
3326         if (err)
3327                 goto err_out;
3328
3329         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
3330         if (err)
3331                 goto err_out;
3332
3333         return 0;
3334  err_out:
3335         genl_unregister_family(&nl80211_fam);
3336         return err;
3337 }
3338
3339 void nl80211_exit(void)
3340 {
3341         genl_unregister_family(&nl80211_fam);
3342 }