SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2009  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/list.h>
  11 #include <linux/if_ether.h>
  12 #include <linux/ieee80211.h>
  13 #include <linux/nl80211.h>
  14 #include <linux/rtnetlink.h>
  15 #include <linux/netlink.h>
  16 #include <linux/etherdevice.h>
  17 #include <net/genetlink.h>
  18 #include <net/cfg80211.h>
  19 #include "core.h"
  20 #include "nl80211.h"
  21 #include "reg.h"
  22
  23 /* the netlink family */
  24 static struct genl_family nl80211_fam = {
  25         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  26         .name = "nl80211",      /* have users key off the name instead */
  27         .hdrsize = 0,           /* no private header */
  28         .version = 1,           /* no particular meaning now */
  29         .maxattr = NL80211_ATTR_MAX,
  30 };
  31
  32 /* internal helper: get drv and dev */
  33 static int get_drv_dev_by_info_ifindex(struct nlattr **attrs,
  34                                        struct cfg80211_registered_device **drv,
  35                                        struct net_device **dev)
  36 {
  37         int ifindex;
  38
  39         if (!attrs[NL80211_ATTR_IFINDEX])
  40                 return -EINVAL;
  41
  42         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  43         *dev = dev_get_by_index(&init_net, ifindex);
  44         if (!*dev)
  45                 return -ENODEV;
  46
  47         *drv = cfg80211_get_dev_from_ifindex(ifindex);
  48         if (IS_ERR(*drv)) {
  49                 dev_put(*dev);
  50                 return PTR_ERR(*drv);
  51         }
  52
  53         return 0;
  54 }
  55
  56 /* policy for the attributes */
  57 static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
  58         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  59         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  60                                       .len = BUS_ID_SIZE-1 },
  61         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  62         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  63         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  64         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
  65         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
  66         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
  67         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
  68
  69         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  70         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  71         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  72
  73         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  74
  75         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  76                                     .len = WLAN_MAX_KEY_LEN },
  77         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  78         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  79         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
  80
  81         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
  82         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
  83         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
  84                                        .len = IEEE80211_MAX_DATA_LEN },
  85         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
  86                                        .len = IEEE80211_MAX_DATA_LEN },
  87         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
  88         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
  89         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
  90         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
  91                                                .len = NL80211_MAX_SUPP_RATES },
  92         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
  93         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
  94         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
  95         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
  96                                 .len = IEEE80211_MAX_MESH_ID_LEN },
  97         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
  98
  99         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 100         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 101
 102         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 103         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 104         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 105         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 106                                            .len = NL80211_MAX_SUPP_RATES },
 107
 108         [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
 109
 110         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 111                                          .len = NL80211_HT_CAPABILITY_LEN },
 112
 113         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 114         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 115                               .len = IEEE80211_MAX_DATA_LEN },
 116         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 117         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 118
 119         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 120                                 .len = IEEE80211_MAX_SSID_LEN },
 121         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 122         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 123         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 124         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 125         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 126         [NL80211_ATTR_STA_FLAGS2] = {
 127                 .len = sizeof(struct nl80211_sta_flag_update),
 128         },
 129         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 130 };
 131
 132 /* IE validation */
 133 static bool is_valid_ie_attr(const struct nlattr *attr)
 134 {
 135         const u8 *pos;
 136         int len;
 137
 138         if (!attr)
 139                 return true;
 140
 141         pos = nla_data(attr);
 142         len = nla_len(attr);
 143
 144         while (len) {
 145                 u8 elemlen;
 146
 147                 if (len < 2)
 148                         return false;
 149                 len -= 2;
 150
 151                 elemlen = pos[1];
 152                 if (elemlen > len)
 153                         return false;
 154
 155                 len -= elemlen;
 156                 pos += 2 + elemlen;
 157         }
 158
 159         return true;
 160 }
 161
 162 /* message building helper */
 163 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 164                                    int flags, u8 cmd)
 165 {
 166         /* since there is no private header just add the generic one */
 167         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 168 }
 169
 170 static int nl80211_msg_put_channel(struct sk_buff *msg,
 171                                    struct ieee80211_channel *chan)
 172 {
 173         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 174                     chan->center_freq);
 175
 176         if (chan->flags & IEEE80211_CHAN_DISABLED)
 177                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 178         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 179                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 180         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 181                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 182         if (chan->flags & IEEE80211_CHAN_RADAR)
 183                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 184
 185         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 186                     DBM_TO_MBM(chan->max_power));
 187
 188         return 0;
 189
 190  nla_put_failure:
 191         return -ENOBUFS;
 192 }
 193
 194 /* netlink command implementations */
 195
 196 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 197                               struct cfg80211_registered_device *dev)
 198 {
 199         void *hdr;
 200         struct nlattr *nl_bands, *nl_band;
 201         struct nlattr *nl_freqs, *nl_freq;
 202         struct nlattr *nl_rates, *nl_rate;
 203         struct nlattr *nl_modes;
 204         struct nlattr *nl_cmds;
 205         enum ieee80211_band band;
 206         struct ieee80211_channel *chan;
 207         struct ieee80211_rate *rate;
 208         int i;
 209         u16 ifmodes = dev->wiphy.interface_modes;
 210
 211         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 212         if (!hdr)
 213                 return -1;
 214
 215         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 216         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 217
 218         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 219                    dev->wiphy.retry_short);
 220         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 221                    dev->wiphy.retry_long);
 222         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 223                     dev->wiphy.frag_threshold);
 224         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 225                     dev->wiphy.rts_threshold);
 226
 227         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 228                    dev->wiphy.max_scan_ssids);
 229         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 230                     dev->wiphy.max_scan_ie_len);
 231
 232         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
 233                 sizeof(u32) * dev->wiphy.n_cipher_suites,
 234                 dev->wiphy.cipher_suites);
 235
 236         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
 237         if (!nl_modes)
 238                 goto nla_put_failure;
 239
 240         i = 0;
 241         while (ifmodes) {
 242                 if (ifmodes & 1)
 243                         NLA_PUT_FLAG(msg, i);
 244                 ifmodes >>= 1;
 245                 i++;
 246         }
 247
 248         nla_nest_end(msg, nl_modes);
 249
 250         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 251         if (!nl_bands)
 252                 goto nla_put_failure;
 253
 254         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 255                 if (!dev->wiphy.bands[band])
 256                         continue;
 257
 258                 nl_band = nla_nest_start(msg, band);
 259                 if (!nl_band)
 260                         goto nla_put_failure;
 261
 262                 /* add HT info */
 263                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 264                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 265                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 266                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 267                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 268                                 dev->wiphy.bands[band]->ht_cap.cap);
 269                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 270                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 271                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 272                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 273                 }
 274
 275                 /* add frequencies */
 276                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 277                 if (!nl_freqs)
 278                         goto nla_put_failure;
 279
 280                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 281                         nl_freq = nla_nest_start(msg, i);
 282                         if (!nl_freq)
 283                                 goto nla_put_failure;
 284
 285                         chan = &dev->wiphy.bands[band]->channels[i];
 286
 287                         if (nl80211_msg_put_channel(msg, chan))
 288                                 goto nla_put_failure;
 289
 290                         nla_nest_end(msg, nl_freq);
 291                 }
 292
 293                 nla_nest_end(msg, nl_freqs);
 294
 295                 /* add bitrates */
 296                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 297                 if (!nl_rates)
 298                         goto nla_put_failure;
 299
 300                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 301                         nl_rate = nla_nest_start(msg, i);
 302                         if (!nl_rate)
 303                                 goto nla_put_failure;
 304
 305                         rate = &dev->wiphy.bands[band]->bitrates[i];
 306                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 307                                     rate->bitrate);
 308                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 309                                 NLA_PUT_FLAG(msg,
 310                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 311
 312                         nla_nest_end(msg, nl_rate);
 313                 }
 314
 315                 nla_nest_end(msg, nl_rates);
 316
 317                 nla_nest_end(msg, nl_band);
 318         }
 319         nla_nest_end(msg, nl_bands);
 320
 321         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 322         if (!nl_cmds)
 323                 goto nla_put_failure;
 324
 325         i = 0;
 326 #define CMD(op, n)                                              \
 327          do {                                                   \
 328                 if (dev->ops->op) {                             \
 329                         i++;                                    \
 330                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 331                 }                                               \
 332         } while (0)
 333
 334         CMD(add_virtual_intf, NEW_INTERFACE);
 335         CMD(change_virtual_intf, SET_INTERFACE);
 336         CMD(add_key, NEW_KEY);
 337         CMD(add_beacon, NEW_BEACON);
 338         CMD(add_station, NEW_STATION);
 339         CMD(add_mpath, NEW_MPATH);
 340         CMD(set_mesh_params, SET_MESH_PARAMS);
 341         CMD(change_bss, SET_BSS);
 342         CMD(auth, AUTHENTICATE);
 343         CMD(assoc, ASSOCIATE);
 344         CMD(deauth, DEAUTHENTICATE);
 345         CMD(disassoc, DISASSOCIATE);
 346         CMD(join_ibss, JOIN_IBSS);
 347
 348 #undef CMD
 349         nla_nest_end(msg, nl_cmds);
 350
 351         return genlmsg_end(msg, hdr);
 352
 353  nla_put_failure:
 354         genlmsg_cancel(msg, hdr);
 355         return -EMSGSIZE;
 356 }
 357
 358 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 359 {
 360         int idx = 0;
 361         int start = cb->args[0];
 362         struct cfg80211_registered_device *dev;
 363
 364         mutex_lock(&cfg80211_mutex);
 365         list_for_each_entry(dev, &cfg80211_drv_list, list) {
 366                 if (++idx <= start)
 367                         continue;
 368                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
 369                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
 370                                        dev) < 0) {
 371                         idx--;
 372                         break;
 373                 }
 374         }
 375         mutex_unlock(&cfg80211_mutex);
 376
 377         cb->args[0] = idx;
 378
 379         return skb->len;
 380 }
 381
 382 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 383 {
 384         struct sk_buff *msg;
 385         struct cfg80211_registered_device *dev;
 386
 387         dev = cfg80211_get_dev_from_info(info);
 388         if (IS_ERR(dev))
 389                 return PTR_ERR(dev);
 390
 391         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 392         if (!msg)
 393                 goto out_err;
 394
 395         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
 396                 goto out_free;
 397
 398         cfg80211_put_dev(dev);
 399
 400         return genlmsg_unicast(msg, info->snd_pid);
 401
 402  out_free:
 403         nlmsg_free(msg);
 404  out_err:
 405         cfg80211_put_dev(dev);
 406         return -ENOBUFS;
 407 }
 408
 409 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 410         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
 411         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
 412         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
 413         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
 414         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
 415 };
 416
 417 static int parse_txq_params(struct nlattr *tb[],
 418                             struct ieee80211_txq_params *txq_params)
 419 {
 420         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 421             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 422             !tb[NL80211_TXQ_ATTR_AIFS])
 423                 return -EINVAL;
 424
 425         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
 426         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 427         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 428         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 429         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 430
 431         return 0;
 432 }
 433
 434 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 435 {
 436         struct cfg80211_registered_device *rdev;
 437         int result = 0, rem_txq_params = 0;
 438         struct nlattr *nl_txq_params;
 439         u32 changed;
 440         u8 retry_short = 0, retry_long = 0;
 441         u32 frag_threshold = 0, rts_threshold = 0;
 442
 443         rtnl_lock();
 444
 445         mutex_lock(&cfg80211_mutex);
 446
 447         rdev = __cfg80211_drv_from_info(info);
 448         if (IS_ERR(rdev)) {
 449                 result = PTR_ERR(rdev);
 450                 goto unlock;
 451         }
 452
 453         mutex_lock(&rdev->mtx);
 454
 455         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
 456                 result = cfg80211_dev_rename(
 457                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 458
 459         mutex_unlock(&cfg80211_mutex);
 460
 461         if (result)
 462                 goto bad_res;
 463
 464         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
 465                 struct ieee80211_txq_params txq_params;
 466                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
 467
 468                 if (!rdev->ops->set_txq_params) {
 469                         result = -EOPNOTSUPP;
 470                         goto bad_res;
 471                 }
 472
 473                 nla_for_each_nested(nl_txq_params,
 474                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
 475                                     rem_txq_params) {
 476                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
 477                                   nla_data(nl_txq_params),
 478                                   nla_len(nl_txq_params),
 479                                   txq_params_policy);
 480                         result = parse_txq_params(tb, &txq_params);
 481                         if (result)
 482                                 goto bad_res;
 483
 484                         result = rdev->ops->set_txq_params(&rdev->wiphy,
 485                                                            &txq_params);
 486                         if (result)
 487                                 goto bad_res;
 488                 }
 489         }
 490
 491         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
 492                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 493                 struct ieee80211_channel *chan;
 494                 struct ieee80211_sta_ht_cap *ht_cap;
 495                 u32 freq, sec_freq;
 496
 497                 if (!rdev->ops->set_channel) {
 498                         result = -EOPNOTSUPP;
 499                         goto bad_res;
 500                 }
 501
 502                 result = -EINVAL;
 503
 504                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 505                         channel_type = nla_get_u32(info->attrs[
 506                                            NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 507                         if (channel_type != NL80211_CHAN_NO_HT &&
 508                             channel_type != NL80211_CHAN_HT20 &&
 509                             channel_type != NL80211_CHAN_HT40PLUS &&
 510                             channel_type != NL80211_CHAN_HT40MINUS)
 511                                 goto bad_res;
 512                 }
 513
 514                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 515                 chan = ieee80211_get_channel(&rdev->wiphy, freq);
 516
 517                 /* Primary channel not allowed */
 518                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 519                         goto bad_res;
 520
 521                 if (channel_type == NL80211_CHAN_HT40MINUS)
 522                         sec_freq = freq - 20;
 523                 else if (channel_type == NL80211_CHAN_HT40PLUS)
 524                         sec_freq = freq + 20;
 525                 else
 526                         sec_freq = 0;
 527
 528                 ht_cap = &rdev->wiphy.bands[chan->band]->ht_cap;
 529
 530                 /* no HT capabilities */
 531                 if (channel_type != NL80211_CHAN_NO_HT &&
 532                     !ht_cap->ht_supported)
 533                         goto bad_res;
 534
 535                 if (sec_freq) {
 536                         struct ieee80211_channel *schan;
 537
 538                         /* no 40 MHz capabilities */
 539                         if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
 540                             (ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT))
 541                                 goto bad_res;
 542
 543                         schan = ieee80211_get_channel(&rdev->wiphy, sec_freq);
 544
 545                         /* Secondary channel not allowed */
 546                         if (!schan || schan->flags & IEEE80211_CHAN_DISABLED)
 547                                 goto bad_res;
 548                 }
 549
 550                 result = rdev->ops->set_channel(&rdev->wiphy, chan,
 551                                                 channel_type);
 552                 if (result)
 553                         goto bad_res;
 554         }
 555
 556         changed = 0;
 557
 558         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
 559                 retry_short = nla_get_u8(
 560                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
 561                 if (retry_short == 0) {
 562                         result = -EINVAL;
 563                         goto bad_res;
 564                 }
 565                 changed |= WIPHY_PARAM_RETRY_SHORT;
 566         }
 567
 568         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
 569                 retry_long = nla_get_u8(
 570                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
 571                 if (retry_long == 0) {
 572                         result = -EINVAL;
 573                         goto bad_res;
 574                 }
 575                 changed |= WIPHY_PARAM_RETRY_LONG;
 576         }
 577
 578         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
 579                 frag_threshold = nla_get_u32(
 580                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
 581                 if (frag_threshold < 256) {
 582                         result = -EINVAL;
 583                         goto bad_res;
 584                 }
 585                 if (frag_threshold != (u32) -1) {
 586                         /*
 587                          * Fragments (apart from the last one) are required to
 588                          * have even length. Make the fragmentation code
 589                          * simpler by stripping LSB should someone try to use
 590                          * odd threshold value.
 591                          */
 592                         frag_threshold &= ~0x1;
 593                 }
 594                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
 595         }
 596
 597         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
 598                 rts_threshold = nla_get_u32(
 599                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
 600                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
 601         }
 602
 603         if (changed) {
 604                 u8 old_retry_short, old_retry_long;
 605                 u32 old_frag_threshold, old_rts_threshold;
 606
 607                 if (!rdev->ops->set_wiphy_params) {
 608                         result = -EOPNOTSUPP;
 609                         goto bad_res;
 610                 }
 611
 612                 old_retry_short = rdev->wiphy.retry_short;
 613                 old_retry_long = rdev->wiphy.retry_long;
 614                 old_frag_threshold = rdev->wiphy.frag_threshold;
 615                 old_rts_threshold = rdev->wiphy.rts_threshold;
 616
 617                 if (changed & WIPHY_PARAM_RETRY_SHORT)
 618                         rdev->wiphy.retry_short = retry_short;
 619                 if (changed & WIPHY_PARAM_RETRY_LONG)
 620                         rdev->wiphy.retry_long = retry_long;
 621                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
 622                         rdev->wiphy.frag_threshold = frag_threshold;
 623                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
 624                         rdev->wiphy.rts_threshold = rts_threshold;
 625
 626                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
 627                 if (result) {
 628                         rdev->wiphy.retry_short = old_retry_short;
 629                         rdev->wiphy.retry_long = old_retry_long;
 630                         rdev->wiphy.frag_threshold = old_frag_threshold;
 631                         rdev->wiphy.rts_threshold = old_rts_threshold;
 632                 }
 633         }
 634
 635  bad_res:
 636         mutex_unlock(&rdev->mtx);
 637  unlock:
 638         rtnl_unlock();
 639         return result;
 640 }
 641
 642
 643 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 644                               struct cfg80211_registered_device *rdev,
 645                               struct net_device *dev)
 646 {
 647         void *hdr;
 648
 649         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
 650         if (!hdr)
 651                 return -1;
 652
 653         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 654         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 655         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
 656         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
 657         return genlmsg_end(msg, hdr);
 658
 659  nla_put_failure:
 660         genlmsg_cancel(msg, hdr);
 661         return -EMSGSIZE;
 662 }
 663
 664 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
 665 {
 666         int wp_idx = 0;
 667         int if_idx = 0;
 668         int wp_start = cb->args[0];
 669         int if_start = cb->args[1];
 670         struct cfg80211_registered_device *dev;
 671         struct wireless_dev *wdev;
 672
 673         mutex_lock(&cfg80211_mutex);
 674         list_for_each_entry(dev, &cfg80211_drv_list, list) {
 675                 if (wp_idx < wp_start) {
 676                         wp_idx++;
 677                         continue;
 678                 }
 679                 if_idx = 0;
 680
 681                 mutex_lock(&dev->devlist_mtx);
 682                 list_for_each_entry(wdev, &dev->netdev_list, list) {
 683                         if (if_idx < if_start) {
 684                                 if_idx++;
 685                                 continue;
 686                         }
 687                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
 688                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
 689                                                dev, wdev->netdev) < 0) {
 690                                 mutex_unlock(&dev->devlist_mtx);
 691                                 goto out;
 692                         }
 693                         if_idx++;
 694                 }
 695                 mutex_unlock(&dev->devlist_mtx);
 696
 697                 wp_idx++;
 698         }
 699  out:
 700         mutex_unlock(&cfg80211_mutex);
 701
 702         cb->args[0] = wp_idx;
 703         cb->args[1] = if_idx;
 704
 705         return skb->len;
 706 }
 707
 708 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
 709 {
 710         struct sk_buff *msg;
 711         struct cfg80211_registered_device *dev;
 712         struct net_device *netdev;
 713         int err;
 714
 715         err = get_drv_dev_by_info_ifindex(info->attrs, &dev, &netdev);
 716         if (err)
 717                 return err;
 718
 719         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 720         if (!msg)
 721                 goto out_err;
 722
 723         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
 724                                dev, netdev) < 0)
 725                 goto out_free;
 726
 727         dev_put(netdev);
 728         cfg80211_put_dev(dev);
 729
 730         return genlmsg_unicast(msg, info->snd_pid);
 731
 732  out_free:
 733         nlmsg_free(msg);
 734  out_err:
 735         dev_put(netdev);
 736         cfg80211_put_dev(dev);
 737         return -ENOBUFS;
 738 }
 739
 740 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
 741         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
 742         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
 743         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
 744         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
 745         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
 746 };
 747
 748 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
 749 {
 750         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
 751         int flag;
 752
 753         *mntrflags = 0;
 754
 755         if (!nla)
 756                 return -EINVAL;
 757
 758         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
 759                              nla, mntr_flags_policy))
 760                 return -EINVAL;
 761
 762         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
 763                 if (flags[flag])
 764                         *mntrflags |= (1<<flag);
 765
 766         return 0;
 767 }
 768
 769 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 770 {
 771         struct cfg80211_registered_device *drv;
 772         struct vif_params params;
 773         int err, ifindex;
 774         enum nl80211_iftype otype, ntype;
 775         struct net_device *dev;
 776         u32 _flags, *flags = NULL;
 777         bool change = false;
 778
 779         memset(&params, 0, sizeof(params));
 780
 781         rtnl_lock();
 782
 783         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 784         if (err)
 785                 goto unlock_rtnl;
 786
 787         ifindex = dev->ifindex;
 788         otype = ntype = dev->ieee80211_ptr->iftype;
 789         dev_put(dev);
 790
 791         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 792                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 793                 if (otype != ntype)
 794                         change = true;
 795                 if (ntype > NL80211_IFTYPE_MAX) {
 796                         err = -EINVAL;
 797                         goto unlock;
 798                 }
 799         }
 800
 801         if (!drv->ops->change_virtual_intf ||
 802             !(drv->wiphy.interface_modes & (1 << ntype))) {
 803                 err = -EOPNOTSUPP;
 804                 goto unlock;
 805         }
 806
 807         if (info->attrs[NL80211_ATTR_MESH_ID]) {
 808                 if (ntype != NL80211_IFTYPE_MESH_POINT) {
 809                         err = -EINVAL;
 810                         goto unlock;
 811                 }
 812                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 813                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 814                 change = true;
 815         }
 816
 817         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
 818                 if (ntype != NL80211_IFTYPE_MONITOR) {
 819                         err = -EINVAL;
 820                         goto unlock;
 821                 }
 822                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
 823                                           &_flags);
 824                 if (err)
 825                         goto unlock;
 826
 827                 flags = &_flags;
 828                 change = true;
 829         }
 830
 831         if (change)
 832                 err = drv->ops->change_virtual_intf(&drv->wiphy, ifindex,
 833                                                     ntype, flags, &params);
 834         else
 835                 err = 0;
 836
 837         dev = __dev_get_by_index(&init_net, ifindex);
 838         WARN_ON(!dev || (!err && dev->ieee80211_ptr->iftype != ntype));
 839
 840         if (dev && !err && (ntype != otype)) {
 841                 if (otype == NL80211_IFTYPE_ADHOC)
 842                         cfg80211_clear_ibss(dev, false);
 843         }
 844
 845  unlock:
 846         cfg80211_put_dev(drv);
 847  unlock_rtnl:
 848         rtnl_unlock();
 849         return err;
 850 }
 851
 852 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
 853 {
 854         struct cfg80211_registered_device *drv;
 855         struct vif_params params;
 856         int err;
 857         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
 858         u32 flags;
 859
 860         memset(&params, 0, sizeof(params));
 861
 862         if (!info->attrs[NL80211_ATTR_IFNAME])
 863                 return -EINVAL;
 864
 865         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 866                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 867                 if (type > NL80211_IFTYPE_MAX)
 868                         return -EINVAL;
 869         }
 870
 871         rtnl_lock();
 872
 873         drv = cfg80211_get_dev_from_info(info);
 874         if (IS_ERR(drv)) {
 875                 err = PTR_ERR(drv);
 876                 goto unlock_rtnl;
 877         }
 878
 879         if (!drv->ops->add_virtual_intf ||
 880             !(drv->wiphy.interface_modes & (1 << type))) {
 881                 err = -EOPNOTSUPP;
 882                 goto unlock;
 883         }
 884
 885         if (type == NL80211_IFTYPE_MESH_POINT &&
 886             info->attrs[NL80211_ATTR_MESH_ID]) {
 887                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 888                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 889         }
 890
 891         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
 892                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
 893                                   &flags);
 894         err = drv->ops->add_virtual_intf(&drv->wiphy,
 895                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
 896                 type, err ? NULL : &flags, &params);
 897
 898  unlock:
 899         cfg80211_put_dev(drv);
 900  unlock_rtnl:
 901         rtnl_unlock();
 902         return err;
 903 }
 904
 905 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
 906 {
 907         struct cfg80211_registered_device *drv;
 908         int ifindex, err;
 909         struct net_device *dev;
 910
 911         rtnl_lock();
 912
 913         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 914         if (err)
 915                 goto unlock_rtnl;
 916         ifindex = dev->ifindex;
 917         dev_put(dev);
 918
 919         if (!drv->ops->del_virtual_intf) {
 920                 err = -EOPNOTSUPP;
 921                 goto out;
 922         }
 923
 924         err = drv->ops->del_virtual_intf(&drv->wiphy, ifindex);
 925
 926  out:
 927         cfg80211_put_dev(drv);
 928  unlock_rtnl:
 929         rtnl_unlock();
 930         return err;
 931 }
 932
 933 struct get_key_cookie {
 934         struct sk_buff *msg;
 935         int error;
 936 };
 937
 938 static void get_key_callback(void *c, struct key_params *params)
 939 {
 940         struct get_key_cookie *cookie = c;
 941
 942         if (params->key)
 943                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
 944                         params->key_len, params->key);
 945
 946         if (params->seq)
 947                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
 948                         params->seq_len, params->seq);
 949
 950         if (params->cipher)
 951                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
 952                             params->cipher);
 953
 954         return;
 955  nla_put_failure:
 956         cookie->error = 1;
 957 }
 958
 959 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
 960 {
 961         struct cfg80211_registered_device *drv;
 962         int err;
 963         struct net_device *dev;
 964         u8 key_idx = 0;
 965         u8 *mac_addr = NULL;
 966         struct get_key_cookie cookie = {
 967                 .error = 0,
 968         };
 969         void *hdr;
 970         struct sk_buff *msg;
 971
 972         if (info->attrs[NL80211_ATTR_KEY_IDX])
 973                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 974
 975         if (key_idx > 5)
 976                 return -EINVAL;
 977
 978         if (info->attrs[NL80211_ATTR_MAC])
 979                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 980
 981         rtnl_lock();
 982
 983         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 984         if (err)
 985                 goto unlock_rtnl;
 986
 987         if (!drv->ops->get_key) {
 988                 err = -EOPNOTSUPP;
 989                 goto out;
 990         }
 991
 992         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 993         if (!msg) {
 994                 err = -ENOMEM;
 995                 goto out;
 996         }
 997
 998         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
 999                              NL80211_CMD_NEW_KEY);
1000
1001         if (IS_ERR(hdr)) {
1002                 err = PTR_ERR(hdr);
1003                 goto out;
1004         }
1005
1006         cookie.msg = msg;
1007
1008         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1009         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1010         if (mac_addr)
1011                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1012
1013         err = drv->ops->get_key(&drv->wiphy, dev, key_idx, mac_addr,
1014                                 &cookie, get_key_callback);
1015
1016         if (err)
1017                 goto out;
1018
1019         if (cookie.error)
1020                 goto nla_put_failure;
1021
1022         genlmsg_end(msg, hdr);
1023         err = genlmsg_unicast(msg, info->snd_pid);
1024         goto out;
1025
1026  nla_put_failure:
1027         err = -ENOBUFS;
1028         nlmsg_free(msg);
1029  out:
1030         cfg80211_put_dev(drv);
1031         dev_put(dev);
1032  unlock_rtnl:
1033         rtnl_unlock();
1034
1035         return err;
1036 }
1037
1038 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1039 {
1040         struct cfg80211_registered_device *drv;
1041         int err;
1042         struct net_device *dev;
1043         u8 key_idx;
1044         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
1045                     u8 key_index);
1046
1047         if (!info->attrs[NL80211_ATTR_KEY_IDX])
1048                 return -EINVAL;
1049
1050         key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1051
1052         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]) {
1053                 if (key_idx < 4 || key_idx > 5)
1054                         return -EINVAL;
1055         } else if (key_idx > 3)
1056                 return -EINVAL;
1057
1058         /* currently only support setting default key */
1059         if (!info->attrs[NL80211_ATTR_KEY_DEFAULT] &&
1060             !info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT])
1061                 return -EINVAL;
1062
1063         rtnl_lock();
1064
1065         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1066         if (err)
1067                 goto unlock_rtnl;
1068
1069         if (info->attrs[NL80211_ATTR_KEY_DEFAULT])
1070                 func = drv->ops->set_default_key;
1071         else
1072                 func = drv->ops->set_default_mgmt_key;
1073
1074         if (!func) {
1075                 err = -EOPNOTSUPP;
1076                 goto out;
1077         }
1078
1079         err = func(&drv->wiphy, dev, key_idx);
1080 #ifdef CONFIG_WIRELESS_EXT
1081         if (!err) {
1082                 if (func == drv->ops->set_default_key)
1083                         dev->ieee80211_ptr->wext.default_key = key_idx;
1084                 else
1085                         dev->ieee80211_ptr->wext.default_mgmt_key = key_idx;
1086         }
1087 #endif
1088
1089  out:
1090         cfg80211_put_dev(drv);
1091         dev_put(dev);
1092
1093  unlock_rtnl:
1094         rtnl_unlock();
1095
1096         return err;
1097 }
1098
1099 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1100 {
1101         struct cfg80211_registered_device *drv;
1102         int err, i;
1103         struct net_device *dev;
1104         struct key_params params;
1105         u8 key_idx = 0;
1106         u8 *mac_addr = NULL;
1107
1108         memset(&params, 0, sizeof(params));
1109
1110         if (!info->attrs[NL80211_ATTR_KEY_CIPHER])
1111                 return -EINVAL;
1112
1113         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1114                 params.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1115                 params.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1116         }
1117
1118         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
1119                 params.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
1120                 params.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
1121         }
1122
1123         if (info->attrs[NL80211_ATTR_KEY_IDX])
1124                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1125
1126         params.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1127
1128         if (info->attrs[NL80211_ATTR_MAC])
1129                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1130
1131         if (cfg80211_validate_key_settings(&params, key_idx, mac_addr))
1132                 return -EINVAL;
1133
1134         rtnl_lock();
1135
1136         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1137         if (err)
1138                 goto unlock_rtnl;
1139
1140         for (i = 0; i < drv->wiphy.n_cipher_suites; i++)
1141                 if (params.cipher == drv->wiphy.cipher_suites[i])
1142                         break;
1143         if (i == drv->wiphy.n_cipher_suites) {
1144                 err = -EINVAL;
1145                 goto out;
1146         }
1147
1148         if (!drv->ops->add_key) {
1149                 err = -EOPNOTSUPP;
1150                 goto out;
1151         }
1152
1153         err = drv->ops->add_key(&drv->wiphy, dev, key_idx, mac_addr, &params);
1154
1155  out:
1156         cfg80211_put_dev(drv);
1157         dev_put(dev);
1158  unlock_rtnl:
1159         rtnl_unlock();
1160
1161         return err;
1162 }
1163
1164 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1165 {
1166         struct cfg80211_registered_device *drv;
1167         int err;
1168         struct net_device *dev;
1169         u8 key_idx = 0;
1170         u8 *mac_addr = NULL;
1171
1172         if (info->attrs[NL80211_ATTR_KEY_IDX])
1173                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1174
1175         if (key_idx > 5)
1176                 return -EINVAL;
1177
1178         if (info->attrs[NL80211_ATTR_MAC])
1179                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1180
1181         rtnl_lock();
1182
1183         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1184         if (err)
1185                 goto unlock_rtnl;
1186
1187         if (!drv->ops->del_key) {
1188                 err = -EOPNOTSUPP;
1189                 goto out;
1190         }
1191
1192         err = drv->ops->del_key(&drv->wiphy, dev, key_idx, mac_addr);
1193
1194 #ifdef CONFIG_WIRELESS_EXT
1195         if (!err) {
1196                 if (key_idx == dev->ieee80211_ptr->wext.default_key)
1197                         dev->ieee80211_ptr->wext.default_key = -1;
1198                 else if (key_idx == dev->ieee80211_ptr->wext.default_mgmt_key)
1199                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
1200         }
1201 #endif
1202
1203  out:
1204         cfg80211_put_dev(drv);
1205         dev_put(dev);
1206
1207  unlock_rtnl:
1208         rtnl_unlock();
1209
1210         return err;
1211 }
1212
1213 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1214 {
1215         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1216                     struct beacon_parameters *info);
1217         struct cfg80211_registered_device *drv;
1218         int err;
1219         struct net_device *dev;
1220         struct beacon_parameters params;
1221         int haveinfo = 0;
1222
1223         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
1224                 return -EINVAL;
1225
1226         rtnl_lock();
1227
1228         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1229         if (err)
1230                 goto unlock_rtnl;
1231
1232         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1233                 err = -EOPNOTSUPP;
1234                 goto out;
1235         }
1236
1237         switch (info->genlhdr->cmd) {
1238         case NL80211_CMD_NEW_BEACON:
1239                 /* these are required for NEW_BEACON */
1240                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1241                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1242                     !info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1243                         err = -EINVAL;
1244                         goto out;
1245                 }
1246
1247                 call = drv->ops->add_beacon;
1248                 break;
1249         case NL80211_CMD_SET_BEACON:
1250                 call = drv->ops->set_beacon;
1251                 break;
1252         default:
1253                 WARN_ON(1);
1254                 err = -EOPNOTSUPP;
1255                 goto out;
1256         }
1257
1258         if (!call) {
1259                 err = -EOPNOTSUPP;
1260                 goto out;
1261         }
1262
1263         memset(&params, 0, sizeof(params));
1264
1265         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1266                 params.interval =
1267                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1268                 haveinfo = 1;
1269         }
1270
1271         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1272                 params.dtim_period =
1273                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1274                 haveinfo = 1;
1275         }
1276
1277         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1278                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1279                 params.head_len =
1280                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1281                 haveinfo = 1;
1282         }
1283
1284         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1285                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1286                 params.tail_len =
1287                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1288                 haveinfo = 1;
1289         }
1290
1291         if (!haveinfo) {
1292                 err = -EINVAL;
1293                 goto out;
1294         }
1295
1296         err = call(&drv->wiphy, dev, &params);
1297
1298  out:
1299         cfg80211_put_dev(drv);
1300         dev_put(dev);
1301  unlock_rtnl:
1302         rtnl_unlock();
1303
1304         return err;
1305 }
1306
1307 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1308 {
1309         struct cfg80211_registered_device *drv;
1310         int err;
1311         struct net_device *dev;
1312
1313         rtnl_lock();
1314
1315         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1316         if (err)
1317                 goto unlock_rtnl;
1318
1319         if (!drv->ops->del_beacon) {
1320                 err = -EOPNOTSUPP;
1321                 goto out;
1322         }
1323
1324         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1325                 err = -EOPNOTSUPP;
1326                 goto out;
1327         }
1328         err = drv->ops->del_beacon(&drv->wiphy, dev);
1329
1330  out:
1331         cfg80211_put_dev(drv);
1332         dev_put(dev);
1333  unlock_rtnl:
1334         rtnl_unlock();
1335
1336         return err;
1337 }
1338
1339 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1340         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1341         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1342         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1343         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
1344 };
1345
1346 static int parse_station_flags(struct genl_info *info,
1347                                struct station_parameters *params)
1348 {
1349         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1350         struct nlattr *nla;
1351         int flag;
1352
1353         /*
1354          * Try parsing the new attribute first so userspace
1355          * can specify both for older kernels.
1356          */
1357         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
1358         if (nla) {
1359                 struct nl80211_sta_flag_update *sta_flags;
1360
1361                 sta_flags = nla_data(nla);
1362                 params->sta_flags_mask = sta_flags->mask;
1363                 params->sta_flags_set = sta_flags->set;
1364                 if ((params->sta_flags_mask |
1365                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
1366                         return -EINVAL;
1367                 return 0;
1368         }
1369
1370         /* if present, parse the old attribute */
1371
1372         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
1373         if (!nla)
1374                 return 0;
1375
1376         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1377                              nla, sta_flags_policy))
1378                 return -EINVAL;
1379
1380         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
1381         params->sta_flags_mask &= ~1;
1382
1383         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1384                 if (flags[flag])
1385                         params->sta_flags_set |= (1<<flag);
1386
1387         return 0;
1388 }
1389
1390 static u16 nl80211_calculate_bitrate(struct rate_info *rate)
1391 {
1392         int modulation, streams, bitrate;
1393
1394         if (!(rate->flags & RATE_INFO_FLAGS_MCS))
1395                 return rate->legacy;
1396
1397         /* the formula below does only work for MCS values smaller than 32 */
1398         if (rate->mcs >= 32)
1399                 return 0;
1400
1401         modulation = rate->mcs & 7;
1402         streams = (rate->mcs >> 3) + 1;
1403
1404         bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
1405                         13500000 : 6500000;
1406
1407         if (modulation < 4)
1408                 bitrate *= (modulation + 1);
1409         else if (modulation == 4)
1410                 bitrate *= (modulation + 2);
1411         else
1412                 bitrate *= (modulation + 3);
1413
1414         bitrate *= streams;
1415
1416         if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
1417                 bitrate = (bitrate / 9) * 10;
1418
1419         /* do NOT round down here */
1420         return (bitrate + 50000) / 100000;
1421 }
1422
1423 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1424                                 int flags, struct net_device *dev,
1425                                 u8 *mac_addr, struct station_info *sinfo)
1426 {
1427         void *hdr;
1428         struct nlattr *sinfoattr, *txrate;
1429         u16 bitrate;
1430
1431         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1432         if (!hdr)
1433                 return -1;
1434
1435         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1436         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1437
1438         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1439         if (!sinfoattr)
1440                 goto nla_put_failure;
1441         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1442                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1443                             sinfo->inactive_time);
1444         if (sinfo->filled & STATION_INFO_RX_BYTES)
1445                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1446                             sinfo->rx_bytes);
1447         if (sinfo->filled & STATION_INFO_TX_BYTES)
1448                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1449                             sinfo->tx_bytes);
1450         if (sinfo->filled & STATION_INFO_LLID)
1451                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1452                             sinfo->llid);
1453         if (sinfo->filled & STATION_INFO_PLID)
1454                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1455                             sinfo->plid);
1456         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1457                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1458                             sinfo->plink_state);
1459         if (sinfo->filled & STATION_INFO_SIGNAL)
1460                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1461                            sinfo->signal);
1462         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1463                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1464                 if (!txrate)
1465                         goto nla_put_failure;
1466
1467                 /* nl80211_calculate_bitrate will return 0 for mcs >= 32 */
1468                 bitrate = nl80211_calculate_bitrate(&sinfo->txrate);
1469                 if (bitrate > 0)
1470                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1471
1472                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1473                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1474                                     sinfo->txrate.mcs);
1475                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1476                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1477                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1478                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1479
1480                 nla_nest_end(msg, txrate);
1481         }
1482         if (sinfo->filled & STATION_INFO_RX_PACKETS)
1483                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
1484                             sinfo->rx_packets);
1485         if (sinfo->filled & STATION_INFO_TX_PACKETS)
1486                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
1487                             sinfo->tx_packets);
1488         nla_nest_end(msg, sinfoattr);
1489
1490         return genlmsg_end(msg, hdr);
1491
1492  nla_put_failure:
1493         genlmsg_cancel(msg, hdr);
1494         return -EMSGSIZE;
1495 }
1496
1497 static int nl80211_dump_station(struct sk_buff *skb,
1498                                 struct netlink_callback *cb)
1499 {
1500         struct station_info sinfo;
1501         struct cfg80211_registered_device *dev;
1502         struct net_device *netdev;
1503         u8 mac_addr[ETH_ALEN];
1504         int ifidx = cb->args[0];
1505         int sta_idx = cb->args[1];
1506         int err;
1507
1508         if (!ifidx) {
1509                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1510                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1511                                   nl80211_policy);
1512                 if (err)
1513                         return err;
1514
1515                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1516                         return -EINVAL;
1517
1518                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1519                 if (!ifidx)
1520                         return -EINVAL;
1521         }
1522
1523         rtnl_lock();
1524
1525         netdev = __dev_get_by_index(&init_net, ifidx);
1526         if (!netdev) {
1527                 err = -ENODEV;
1528                 goto out_rtnl;
1529         }
1530
1531         dev = cfg80211_get_dev_from_ifindex(ifidx);
1532         if (IS_ERR(dev)) {
1533                 err = PTR_ERR(dev);
1534                 goto out_rtnl;
1535         }
1536
1537         if (!dev->ops->dump_station) {
1538                 err = -EOPNOTSUPP;
1539                 goto out_err;
1540         }
1541
1542         while (1) {
1543                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1544                                              mac_addr, &sinfo);
1545                 if (err == -ENOENT)
1546                         break;
1547                 if (err)
1548                         goto out_err;
1549
1550                 if (nl80211_send_station(skb,
1551                                 NETLINK_CB(cb->skb).pid,
1552                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
1553                                 netdev, mac_addr,
1554                                 &sinfo) < 0)
1555                         goto out;
1556
1557                 sta_idx++;
1558         }
1559
1560
1561  out:
1562         cb->args[1] = sta_idx;
1563         err = skb->len;
1564  out_err:
1565         cfg80211_put_dev(dev);
1566  out_rtnl:
1567         rtnl_unlock();
1568
1569         return err;
1570 }
1571
1572 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1573 {
1574         struct cfg80211_registered_device *drv;
1575         int err;
1576         struct net_device *dev;
1577         struct station_info sinfo;
1578         struct sk_buff *msg;
1579         u8 *mac_addr = NULL;
1580
1581         memset(&sinfo, 0, sizeof(sinfo));
1582
1583         if (!info->attrs[NL80211_ATTR_MAC])
1584                 return -EINVAL;
1585
1586         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1587
1588         rtnl_lock();
1589
1590         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1591         if (err)
1592                 goto out_rtnl;
1593
1594         if (!drv->ops->get_station) {
1595                 err = -EOPNOTSUPP;
1596                 goto out;
1597         }
1598
1599         err = drv->ops->get_station(&drv->wiphy, dev, mac_addr, &sinfo);
1600         if (err)
1601                 goto out;
1602
1603         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1604         if (!msg)
1605                 goto out;
1606
1607         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1608                                  dev, mac_addr, &sinfo) < 0)
1609                 goto out_free;
1610
1611         err = genlmsg_unicast(msg, info->snd_pid);
1612         goto out;
1613
1614  out_free:
1615         nlmsg_free(msg);
1616  out:
1617         cfg80211_put_dev(drv);
1618         dev_put(dev);
1619  out_rtnl:
1620         rtnl_unlock();
1621
1622         return err;
1623 }
1624
1625 /*
1626  * Get vlan interface making sure it is on the right wiphy.
1627  */
1628 static int get_vlan(struct nlattr *vlanattr,
1629                     struct cfg80211_registered_device *rdev,
1630                     struct net_device **vlan)
1631 {
1632         *vlan = NULL;
1633
1634         if (vlanattr) {
1635                 *vlan = dev_get_by_index(&init_net, nla_get_u32(vlanattr));
1636                 if (!*vlan)
1637                         return -ENODEV;
1638                 if (!(*vlan)->ieee80211_ptr)
1639                         return -EINVAL;
1640                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
1641                         return -EINVAL;
1642         }
1643         return 0;
1644 }
1645
1646 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
1647 {
1648         struct cfg80211_registered_device *drv;
1649         int err;
1650         struct net_device *dev;
1651         struct station_parameters params;
1652         u8 *mac_addr = NULL;
1653
1654         memset(&params, 0, sizeof(params));
1655
1656         params.listen_interval = -1;
1657
1658         if (info->attrs[NL80211_ATTR_STA_AID])
1659                 return -EINVAL;
1660
1661         if (!info->attrs[NL80211_ATTR_MAC])
1662                 return -EINVAL;
1663
1664         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1665
1666         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
1667                 params.supported_rates =
1668                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1669                 params.supported_rates_len =
1670                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1671         }
1672
1673         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1674                 params.listen_interval =
1675                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1676
1677         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1678                 params.ht_capa =
1679                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1680
1681         if (parse_station_flags(info, &params))
1682                 return -EINVAL;
1683
1684         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
1685                 params.plink_action =
1686                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
1687
1688         rtnl_lock();
1689
1690         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1691         if (err)
1692                 goto out_rtnl;
1693
1694         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1695         if (err)
1696                 goto out;
1697
1698         if (!drv->ops->change_station) {
1699                 err = -EOPNOTSUPP;
1700                 goto out;
1701         }
1702
1703         err = drv->ops->change_station(&drv->wiphy, dev, mac_addr, &params);
1704
1705  out:
1706         if (params.vlan)
1707                 dev_put(params.vlan);
1708         cfg80211_put_dev(drv);
1709         dev_put(dev);
1710  out_rtnl:
1711         rtnl_unlock();
1712
1713         return err;
1714 }
1715
1716 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
1717 {
1718         struct cfg80211_registered_device *drv;
1719         int err;
1720         struct net_device *dev;
1721         struct station_parameters params;
1722         u8 *mac_addr = NULL;
1723
1724         memset(&params, 0, sizeof(params));
1725
1726         if (!info->attrs[NL80211_ATTR_MAC])
1727                 return -EINVAL;
1728
1729         if (!info->attrs[NL80211_ATTR_STA_AID])
1730                 return -EINVAL;
1731
1732         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1733                 return -EINVAL;
1734
1735         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
1736                 return -EINVAL;
1737
1738         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1739         params.supported_rates =
1740                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1741         params.supported_rates_len =
1742                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1743         params.listen_interval =
1744                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1745         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
1746         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1747                 params.ht_capa =
1748                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1749
1750         if (parse_station_flags(info, &params))
1751                 return -EINVAL;
1752
1753         rtnl_lock();
1754
1755         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1756         if (err)
1757                 goto out_rtnl;
1758
1759         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1760             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN) {
1761                 err = -EINVAL;
1762                 goto out;
1763         }
1764
1765         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1766         if (err)
1767                 goto out;
1768
1769         if (!drv->ops->add_station) {
1770                 err = -EOPNOTSUPP;
1771                 goto out;
1772         }
1773
1774         if (!netif_running(dev)) {
1775                 err = -ENETDOWN;
1776                 goto out;
1777         }
1778
1779         err = drv->ops->add_station(&drv->wiphy, dev, mac_addr, &params);
1780
1781  out:
1782         if (params.vlan)
1783                 dev_put(params.vlan);
1784         cfg80211_put_dev(drv);
1785         dev_put(dev);
1786  out_rtnl:
1787         rtnl_unlock();
1788
1789         return err;
1790 }
1791
1792 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
1793 {
1794         struct cfg80211_registered_device *drv;
1795         int err;
1796         struct net_device *dev;
1797         u8 *mac_addr = NULL;
1798
1799         if (info->attrs[NL80211_ATTR_MAC])
1800                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1801
1802         rtnl_lock();
1803
1804         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1805         if (err)
1806                 goto out_rtnl;
1807
1808         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1809             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN) {
1810                 err = -EINVAL;
1811                 goto out;
1812         }
1813
1814         if (!drv->ops->del_station) {
1815                 err = -EOPNOTSUPP;
1816                 goto out;
1817         }
1818
1819         err = drv->ops->del_station(&drv->wiphy, dev, mac_addr);
1820
1821  out:
1822         cfg80211_put_dev(drv);
1823         dev_put(dev);
1824  out_rtnl:
1825         rtnl_unlock();
1826
1827         return err;
1828 }
1829
1830 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
1831                                 int flags, struct net_device *dev,
1832                                 u8 *dst, u8 *next_hop,
1833                                 struct mpath_info *pinfo)
1834 {
1835         void *hdr;
1836         struct nlattr *pinfoattr;
1837
1838         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1839         if (!hdr)
1840                 return -1;
1841
1842         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1843         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
1844         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
1845
1846         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
1847         if (!pinfoattr)
1848                 goto nla_put_failure;
1849         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
1850                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
1851                             pinfo->frame_qlen);
1852         if (pinfo->filled & MPATH_INFO_DSN)
1853                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DSN,
1854                             pinfo->dsn);
1855         if (pinfo->filled & MPATH_INFO_METRIC)
1856                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
1857                             pinfo->metric);
1858         if (pinfo->filled & MPATH_INFO_EXPTIME)
1859                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
1860                             pinfo->exptime);
1861         if (pinfo->filled & MPATH_INFO_FLAGS)
1862                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
1863                             pinfo->flags);
1864         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
1865                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
1866                             pinfo->discovery_timeout);
1867         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
1868                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
1869                             pinfo->discovery_retries);
1870
1871         nla_nest_end(msg, pinfoattr);
1872
1873         return genlmsg_end(msg, hdr);
1874
1875  nla_put_failure:
1876         genlmsg_cancel(msg, hdr);
1877         return -EMSGSIZE;
1878 }
1879
1880 static int nl80211_dump_mpath(struct sk_buff *skb,
1881                               struct netlink_callback *cb)
1882 {
1883         struct mpath_info pinfo;
1884         struct cfg80211_registered_device *dev;
1885         struct net_device *netdev;
1886         u8 dst[ETH_ALEN];
1887         u8 next_hop[ETH_ALEN];
1888         int ifidx = cb->args[0];
1889         int path_idx = cb->args[1];
1890         int err;
1891
1892         if (!ifidx) {
1893                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1894                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1895                                   nl80211_policy);
1896                 if (err)
1897                         return err;
1898
1899                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1900                         return -EINVAL;
1901
1902                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1903                 if (!ifidx)
1904                         return -EINVAL;
1905         }
1906
1907         rtnl_lock();
1908
1909         netdev = __dev_get_by_index(&init_net, ifidx);
1910         if (!netdev) {
1911                 err = -ENODEV;
1912                 goto out_rtnl;
1913         }
1914
1915         dev = cfg80211_get_dev_from_ifindex(ifidx);
1916         if (IS_ERR(dev)) {
1917                 err = PTR_ERR(dev);
1918                 goto out_rtnl;
1919         }
1920
1921         if (!dev->ops->dump_mpath) {
1922                 err = -EOPNOTSUPP;
1923                 goto out_err;
1924         }
1925
1926         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1927                 err = -EOPNOTSUPP;
1928                 goto out;
1929         }
1930
1931         while (1) {
1932                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
1933                                            dst, next_hop, &pinfo);
1934                 if (err == -ENOENT)
1935                         break;
1936                 if (err)
1937                         goto out_err;
1938
1939                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
1940                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
1941                                        netdev, dst, next_hop,
1942                                        &pinfo) < 0)
1943                         goto out;
1944
1945                 path_idx++;
1946         }
1947
1948
1949  out:
1950         cb->args[1] = path_idx;
1951         err = skb->len;
1952  out_err:
1953         cfg80211_put_dev(dev);
1954  out_rtnl:
1955         rtnl_unlock();
1956
1957         return err;
1958 }
1959
1960 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
1961 {
1962         struct cfg80211_registered_device *drv;
1963         int err;
1964         struct net_device *dev;
1965         struct mpath_info pinfo;
1966         struct sk_buff *msg;
1967         u8 *dst = NULL;
1968         u8 next_hop[ETH_ALEN];
1969
1970         memset(&pinfo, 0, sizeof(pinfo));
1971
1972         if (!info->attrs[NL80211_ATTR_MAC])
1973                 return -EINVAL;
1974
1975         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1976
1977         rtnl_lock();
1978
1979         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1980         if (err)
1981                 goto out_rtnl;
1982
1983         if (!drv->ops->get_mpath) {
1984                 err = -EOPNOTSUPP;
1985                 goto out;
1986         }
1987
1988         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1989                 err = -EOPNOTSUPP;
1990                 goto out;
1991         }
1992
1993         err = drv->ops->get_mpath(&drv->wiphy, dev, dst, next_hop, &pinfo);
1994         if (err)
1995                 goto out;
1996
1997         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1998         if (!msg)
1999                 goto out;
2000
2001         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2002                                  dev, dst, next_hop, &pinfo) < 0)
2003                 goto out_free;
2004
2005         err = genlmsg_unicast(msg, info->snd_pid);
2006         goto out;
2007
2008  out_free:
2009         nlmsg_free(msg);
2010  out:
2011         cfg80211_put_dev(drv);
2012         dev_put(dev);
2013  out_rtnl:
2014         rtnl_unlock();
2015
2016         return err;
2017 }
2018
2019 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2020 {
2021         struct cfg80211_registered_device *drv;
2022         int err;
2023         struct net_device *dev;
2024         u8 *dst = NULL;
2025         u8 *next_hop = NULL;
2026
2027         if (!info->attrs[NL80211_ATTR_MAC])
2028                 return -EINVAL;
2029
2030         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2031                 return -EINVAL;
2032
2033         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2034         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2035
2036         rtnl_lock();
2037
2038         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2039         if (err)
2040                 goto out_rtnl;
2041
2042         if (!drv->ops->change_mpath) {
2043                 err = -EOPNOTSUPP;
2044                 goto out;
2045         }
2046
2047         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2048                 err = -EOPNOTSUPP;
2049                 goto out;
2050         }
2051
2052         if (!netif_running(dev)) {
2053                 err = -ENETDOWN;
2054                 goto out;
2055         }
2056
2057         err = drv->ops->change_mpath(&drv->wiphy, dev, dst, next_hop);
2058
2059  out:
2060         cfg80211_put_dev(drv);
2061         dev_put(dev);
2062  out_rtnl:
2063         rtnl_unlock();
2064
2065         return err;
2066 }
2067 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2068 {
2069         struct cfg80211_registered_device *drv;
2070         int err;
2071         struct net_device *dev;
2072         u8 *dst = NULL;
2073         u8 *next_hop = NULL;
2074
2075         if (!info->attrs[NL80211_ATTR_MAC])
2076                 return -EINVAL;
2077
2078         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2079                 return -EINVAL;
2080
2081         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2082         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2083
2084         rtnl_lock();
2085
2086         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2087         if (err)
2088                 goto out_rtnl;
2089
2090         if (!drv->ops->add_mpath) {
2091                 err = -EOPNOTSUPP;
2092                 goto out;
2093         }
2094
2095         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2096                 err = -EOPNOTSUPP;
2097                 goto out;
2098         }
2099
2100         if (!netif_running(dev)) {
2101                 err = -ENETDOWN;
2102                 goto out;
2103         }
2104
2105         err = drv->ops->add_mpath(&drv->wiphy, dev, dst, next_hop);
2106
2107  out:
2108         cfg80211_put_dev(drv);
2109         dev_put(dev);
2110  out_rtnl:
2111         rtnl_unlock();
2112
2113         return err;
2114 }
2115
2116 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2117 {
2118         struct cfg80211_registered_device *drv;
2119         int err;
2120         struct net_device *dev;
2121         u8 *dst = NULL;
2122
2123         if (info->attrs[NL80211_ATTR_MAC])
2124                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2125
2126         rtnl_lock();
2127
2128         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2129         if (err)
2130                 goto out_rtnl;
2131
2132         if (!drv->ops->del_mpath) {
2133                 err = -EOPNOTSUPP;
2134                 goto out;
2135         }
2136
2137         err = drv->ops->del_mpath(&drv->wiphy, dev, dst);
2138
2139  out:
2140         cfg80211_put_dev(drv);
2141         dev_put(dev);
2142  out_rtnl:
2143         rtnl_unlock();
2144
2145         return err;
2146 }
2147
2148 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2149 {
2150         struct cfg80211_registered_device *drv;
2151         int err;
2152         struct net_device *dev;
2153         struct bss_parameters params;
2154
2155         memset(&params, 0, sizeof(params));
2156         /* default to not changing parameters */
2157         params.use_cts_prot = -1;
2158         params.use_short_preamble = -1;
2159         params.use_short_slot_time = -1;
2160
2161         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2162                 params.use_cts_prot =
2163                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2164         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2165                 params.use_short_preamble =
2166                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2167         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2168                 params.use_short_slot_time =
2169                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2170         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2171                 params.basic_rates =
2172                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2173                 params.basic_rates_len =
2174                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2175         }
2176
2177         rtnl_lock();
2178
2179         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2180         if (err)
2181                 goto out_rtnl;
2182
2183         if (!drv->ops->change_bss) {
2184                 err = -EOPNOTSUPP;
2185                 goto out;
2186         }
2187
2188         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
2189                 err = -EOPNOTSUPP;
2190                 goto out;
2191         }
2192
2193         err = drv->ops->change_bss(&drv->wiphy, dev, &params);
2194
2195  out:
2196         cfg80211_put_dev(drv);
2197         dev_put(dev);
2198  out_rtnl:
2199         rtnl_unlock();
2200
2201         return err;
2202 }
2203
2204 static const struct nla_policy
2205         reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2206         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2207         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2208         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2209         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2210         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2211         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2212 };
2213
2214 static int parse_reg_rule(struct nlattr *tb[],
2215         struct ieee80211_reg_rule *reg_rule)
2216 {
2217         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2218         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2219
2220         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2221                 return -EINVAL;
2222         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2223                 return -EINVAL;
2224         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2225                 return -EINVAL;
2226         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2227                 return -EINVAL;
2228         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2229                 return -EINVAL;
2230
2231         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2232
2233         freq_range->start_freq_khz =
2234                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2235         freq_range->end_freq_khz =
2236                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2237         freq_range->max_bandwidth_khz =
2238                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2239
2240         power_rule->max_eirp =
2241                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2242
2243         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2244                 power_rule->max_antenna_gain =
2245                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2246
2247         return 0;
2248 }
2249
2250 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2251 {
2252         int r;
2253         char *data = NULL;
2254
2255         /*
2256          * You should only get this when cfg80211 hasn't yet initialized
2257          * completely when built-in to the kernel right between the time
2258          * window between nl80211_init() and regulatory_init(), if that is
2259          * even possible.
2260          */
2261         mutex_lock(&cfg80211_mutex);
2262         if (unlikely(!cfg80211_regdomain)) {
2263                 mutex_unlock(&cfg80211_mutex);
2264                 return -EINPROGRESS;
2265         }
2266         mutex_unlock(&cfg80211_mutex);
2267
2268         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2269                 return -EINVAL;
2270
2271         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2272
2273 #ifdef CONFIG_WIRELESS_OLD_REGULATORY
2274         /* We ignore world regdom requests with the old regdom setup */
2275         if (is_world_regdom(data))
2276                 return -EINVAL;
2277 #endif
2278
2279         r = regulatory_hint_user(data);
2280
2281         return r;
2282 }
2283
2284 static int nl80211_get_mesh_params(struct sk_buff *skb,
2285         struct genl_info *info)
2286 {
2287         struct cfg80211_registered_device *drv;
2288         struct mesh_config cur_params;
2289         int err;
2290         struct net_device *dev;
2291         void *hdr;
2292         struct nlattr *pinfoattr;
2293         struct sk_buff *msg;
2294
2295         rtnl_lock();
2296
2297         /* Look up our device */
2298         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2299         if (err)
2300                 goto out_rtnl;
2301
2302         if (!drv->ops->get_mesh_params) {
2303                 err = -EOPNOTSUPP;
2304                 goto out;
2305         }
2306
2307         /* Get the mesh params */
2308         err = drv->ops->get_mesh_params(&drv->wiphy, dev, &cur_params);
2309         if (err)
2310                 goto out;
2311
2312         /* Draw up a netlink message to send back */
2313         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2314         if (!msg) {
2315                 err = -ENOBUFS;
2316                 goto out;
2317         }
2318         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2319                              NL80211_CMD_GET_MESH_PARAMS);
2320         if (!hdr)
2321                 goto nla_put_failure;
2322         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
2323         if (!pinfoattr)
2324                 goto nla_put_failure;
2325         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2326         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2327                         cur_params.dot11MeshRetryTimeout);
2328         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2329                         cur_params.dot11MeshConfirmTimeout);
2330         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2331                         cur_params.dot11MeshHoldingTimeout);
2332         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2333                         cur_params.dot11MeshMaxPeerLinks);
2334         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2335                         cur_params.dot11MeshMaxRetries);
2336         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2337                         cur_params.dot11MeshTTL);
2338         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2339                         cur_params.auto_open_plinks);
2340         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2341                         cur_params.dot11MeshHWMPmaxPREQretries);
2342         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2343                         cur_params.path_refresh_time);
2344         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2345                         cur_params.min_discovery_timeout);
2346         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2347                         cur_params.dot11MeshHWMPactivePathTimeout);
2348         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2349                         cur_params.dot11MeshHWMPpreqMinInterval);
2350         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2351                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2352         nla_nest_end(msg, pinfoattr);
2353         genlmsg_end(msg, hdr);
2354         err = genlmsg_unicast(msg, info->snd_pid);
2355         goto out;
2356
2357  nla_put_failure:
2358         genlmsg_cancel(msg, hdr);
2359         err = -EMSGSIZE;
2360  out:
2361         /* Cleanup */
2362         cfg80211_put_dev(drv);
2363         dev_put(dev);
2364  out_rtnl:
2365         rtnl_unlock();
2366
2367         return err;
2368 }
2369
2370 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2371 do {\
2372         if (table[attr_num]) {\
2373                 cfg.param = nla_fn(table[attr_num]); \
2374                 mask |= (1 << (attr_num - 1)); \
2375         } \
2376 } while (0);\
2377
2378 static struct nla_policy
2379 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] __read_mostly = {
2380         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2381         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2382         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2383         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2384         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2385         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2386         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2387
2388         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2389         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2390         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2391         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2392         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2393         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2394 };
2395
2396 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2397 {
2398         int err;
2399         u32 mask;
2400         struct cfg80211_registered_device *drv;
2401         struct net_device *dev;
2402         struct mesh_config cfg;
2403         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2404         struct nlattr *parent_attr;
2405
2406         parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
2407         if (!parent_attr)
2408                 return -EINVAL;
2409         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2410                         parent_attr, nl80211_meshconf_params_policy))
2411                 return -EINVAL;
2412
2413         rtnl_lock();
2414
2415         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2416         if (err)
2417                 goto out_rtnl;
2418
2419         if (!drv->ops->set_mesh_params) {
2420                 err = -EOPNOTSUPP;
2421                 goto out;
2422         }
2423
2424         /* This makes sure that there aren't more than 32 mesh config
2425          * parameters (otherwise our bitfield scheme would not work.) */
2426         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2427
2428         /* Fill in the params struct */
2429         mask = 0;
2430         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2431                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2432         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2433                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2434         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2435                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2436         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2437                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2438         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2439                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2440         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2441                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2442         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2443                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2444         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2445                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2446                         nla_get_u8);
2447         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2448                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2449         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2450                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2451                         nla_get_u16);
2452         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2453                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2454                         nla_get_u32);
2455         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2456                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2457                         nla_get_u16);
2458         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2459                         dot11MeshHWMPnetDiameterTraversalTime,
2460                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2461                         nla_get_u16);
2462
2463         /* Apply changes */
2464         err = drv->ops->set_mesh_params(&drv->wiphy, dev, &cfg, mask);
2465
2466  out:
2467         /* cleanup */
2468         cfg80211_put_dev(drv);
2469         dev_put(dev);
2470  out_rtnl:
2471         rtnl_unlock();
2472
2473         return err;
2474 }
2475
2476 #undef FILL_IN_MESH_PARAM_IF_SET
2477
2478 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2479 {
2480         struct sk_buff *msg;
2481         void *hdr = NULL;
2482         struct nlattr *nl_reg_rules;
2483         unsigned int i;
2484         int err = -EINVAL;
2485
2486         mutex_lock(&cfg80211_mutex);
2487
2488         if (!cfg80211_regdomain)
2489                 goto out;
2490
2491         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2492         if (!msg) {
2493                 err = -ENOBUFS;
2494                 goto out;
2495         }
2496
2497         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2498                              NL80211_CMD_GET_REG);
2499         if (!hdr)
2500                 goto nla_put_failure;
2501
2502         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2503                 cfg80211_regdomain->alpha2);
2504
2505         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2506         if (!nl_reg_rules)
2507                 goto nla_put_failure;
2508
2509         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2510                 struct nlattr *nl_reg_rule;
2511                 const struct ieee80211_reg_rule *reg_rule;
2512                 const struct ieee80211_freq_range *freq_range;
2513                 const struct ieee80211_power_rule *power_rule;
2514
2515                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2516                 freq_range = &reg_rule->freq_range;
2517                 power_rule = &reg_rule->power_rule;
2518
2519                 nl_reg_rule = nla_nest_start(msg, i);
2520                 if (!nl_reg_rule)
2521                         goto nla_put_failure;
2522
2523                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2524                         reg_rule->flags);
2525                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2526                         freq_range->start_freq_khz);
2527                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2528                         freq_range->end_freq_khz);
2529                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2530                         freq_range->max_bandwidth_khz);
2531                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2532                         power_rule->max_antenna_gain);
2533                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2534                         power_rule->max_eirp);
2535
2536                 nla_nest_end(msg, nl_reg_rule);
2537         }
2538
2539         nla_nest_end(msg, nl_reg_rules);
2540
2541         genlmsg_end(msg, hdr);
2542         err = genlmsg_unicast(msg, info->snd_pid);
2543         goto out;
2544
2545 nla_put_failure:
2546         genlmsg_cancel(msg, hdr);
2547         err = -EMSGSIZE;
2548 out:
2549         mutex_unlock(&cfg80211_mutex);
2550         return err;
2551 }
2552
2553 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2554 {
2555         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2556         struct nlattr *nl_reg_rule;
2557         char *alpha2 = NULL;
2558         int rem_reg_rules = 0, r = 0;
2559         u32 num_rules = 0, rule_idx = 0, size_of_regd;
2560         struct ieee80211_regdomain *rd = NULL;
2561
2562         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2563                 return -EINVAL;
2564
2565         if (!info->attrs[NL80211_ATTR_REG_RULES])
2566                 return -EINVAL;
2567
2568         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2569
2570         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2571                         rem_reg_rules) {
2572                 num_rules++;
2573                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2574                         goto bad_reg;
2575         }
2576
2577         if (!reg_is_valid_request(alpha2))
2578                 return -EINVAL;
2579
2580         size_of_regd = sizeof(struct ieee80211_regdomain) +
2581                 (num_rules * sizeof(struct ieee80211_reg_rule));
2582
2583         rd = kzalloc(size_of_regd, GFP_KERNEL);
2584         if (!rd)
2585                 return -ENOMEM;
2586
2587         rd->n_reg_rules = num_rules;
2588         rd->alpha2[0] = alpha2[0];
2589         rd->alpha2[1] = alpha2[1];
2590
2591         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2592                         rem_reg_rules) {
2593                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2594                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2595                         reg_rule_policy);
2596                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2597                 if (r)
2598                         goto bad_reg;
2599
2600                 rule_idx++;
2601
2602                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES)
2603                         goto bad_reg;
2604         }
2605
2606         BUG_ON(rule_idx != num_rules);
2607
2608         mutex_lock(&cfg80211_mutex);
2609         r = set_regdom(rd);
2610         mutex_unlock(&cfg80211_mutex);
2611         return r;
2612
2613  bad_reg:
2614         kfree(rd);
2615         return -EINVAL;
2616 }
2617
2618 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
2619 {
2620         struct cfg80211_registered_device *drv;
2621         struct net_device *dev;
2622         struct cfg80211_scan_request *request;
2623         struct cfg80211_ssid *ssid;
2624         struct ieee80211_channel *channel;
2625         struct nlattr *attr;
2626         struct wiphy *wiphy;
2627         int err, tmp, n_ssids = 0, n_channels = 0, i;
2628         enum ieee80211_band band;
2629         size_t ie_len;
2630
2631         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2632                 return -EINVAL;
2633
2634         rtnl_lock();
2635
2636         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2637         if (err)
2638                 goto out_rtnl;
2639
2640         wiphy = &drv->wiphy;
2641
2642         if (!drv->ops->scan) {
2643                 err = -EOPNOTSUPP;
2644                 goto out;
2645         }
2646
2647         if (!netif_running(dev)) {
2648                 err = -ENETDOWN;
2649                 goto out;
2650         }
2651
2652         if (drv->scan_req) {
2653                 err = -EBUSY;
2654                 goto out;
2655         }
2656
2657         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2658                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp)
2659                         n_channels++;
2660                 if (!n_channels) {
2661                         err = -EINVAL;
2662                         goto out;
2663                 }
2664         } else {
2665                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
2666                         if (wiphy->bands[band])
2667                                 n_channels += wiphy->bands[band]->n_channels;
2668         }
2669
2670         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
2671                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
2672                         n_ssids++;
2673
2674         if (n_ssids > wiphy->max_scan_ssids) {
2675                 err = -EINVAL;
2676                 goto out;
2677         }
2678
2679         if (info->attrs[NL80211_ATTR_IE])
2680                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2681         else
2682                 ie_len = 0;
2683
2684         if (ie_len > wiphy->max_scan_ie_len) {
2685                 err = -EINVAL;
2686                 goto out;
2687         }
2688
2689         request = kzalloc(sizeof(*request)
2690                         + sizeof(*ssid) * n_ssids
2691                         + sizeof(channel) * n_channels
2692                         + ie_len, GFP_KERNEL);
2693         if (!request) {
2694                 err = -ENOMEM;
2695                 goto out;
2696         }
2697
2698         request->channels = (void *)((char *)request + sizeof(*request));
2699         request->n_channels = n_channels;
2700         if (n_ssids)
2701                 request->ssids = (void *)(request->channels + n_channels);
2702         request->n_ssids = n_ssids;
2703         if (ie_len) {
2704                 if (request->ssids)
2705                         request->ie = (void *)(request->ssids + n_ssids);
2706                 else
2707                         request->ie = (void *)(request->channels + n_channels);
2708         }
2709
2710         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2711                 /* user specified, bail out if channel not found */
2712                 request->n_channels = n_channels;
2713                 i = 0;
2714                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
2715                         request->channels[i] = ieee80211_get_channel(wiphy, nla_get_u32(attr));
2716                         if (!request->channels[i]) {
2717                                 err = -EINVAL;
2718                                 goto out_free;
2719                         }
2720                         i++;
2721                 }
2722         } else {
2723                 /* all channels */
2724                 i = 0;
2725                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
2726                         int j;
2727                         if (!wiphy->bands[band])
2728                                 continue;
2729                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
2730                                 request->channels[i] = &wiphy->bands[band]->channels[j];
2731                                 i++;
2732                         }
2733                 }
2734         }
2735
2736         i = 0;
2737         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
2738                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
2739                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
2740                                 err = -EINVAL;
2741                                 goto out_free;
2742                         }
2743                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
2744                         request->ssids[i].ssid_len = nla_len(attr);
2745                         i++;
2746                 }
2747         }
2748
2749         if (info->attrs[NL80211_ATTR_IE]) {
2750                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2751                 memcpy((void *)request->ie,
2752                        nla_data(info->attrs[NL80211_ATTR_IE]),
2753                        request->ie_len);
2754         }
2755
2756         request->ifidx = dev->ifindex;
2757         request->wiphy = &drv->wiphy;
2758
2759         drv->scan_req = request;
2760         err = drv->ops->scan(&drv->wiphy, dev, request);
2761
2762  out_free:
2763         if (err) {
2764                 drv->scan_req = NULL;
2765                 kfree(request);
2766         }
2767  out:
2768         cfg80211_put_dev(drv);
2769         dev_put(dev);
2770  out_rtnl:
2771         rtnl_unlock();
2772
2773         return err;
2774 }
2775
2776 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
2777                             struct cfg80211_registered_device *rdev,
2778                             struct net_device *dev,
2779                             struct cfg80211_bss *res)
2780 {
2781         void *hdr;
2782         struct nlattr *bss;
2783
2784         hdr = nl80211hdr_put(msg, pid, seq, flags,
2785                              NL80211_CMD_NEW_SCAN_RESULTS);
2786         if (!hdr)
2787                 return -1;
2788
2789         NLA_PUT_U32(msg, NL80211_ATTR_SCAN_GENERATION,
2790                     rdev->bss_generation);
2791         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2792
2793         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
2794         if (!bss)
2795                 goto nla_put_failure;
2796         if (!is_zero_ether_addr(res->bssid))
2797                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
2798         if (res->information_elements && res->len_information_elements)
2799                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
2800                         res->len_information_elements,
2801                         res->information_elements);
2802         if (res->tsf)
2803                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
2804         if (res->beacon_interval)
2805                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
2806         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
2807         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
2808
2809         switch (rdev->wiphy.signal_type) {
2810         case CFG80211_SIGNAL_TYPE_MBM:
2811                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
2812                 break;
2813         case CFG80211_SIGNAL_TYPE_UNSPEC:
2814                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
2815                 break;
2816         default:
2817                 break;
2818         }
2819
2820         nla_nest_end(msg, bss);
2821
2822         return genlmsg_end(msg, hdr);
2823
2824  nla_put_failure:
2825         genlmsg_cancel(msg, hdr);
2826         return -EMSGSIZE;
2827 }
2828
2829 static int nl80211_dump_scan(struct sk_buff *skb,
2830                              struct netlink_callback *cb)
2831 {
2832         struct cfg80211_registered_device *dev;
2833         struct net_device *netdev;
2834         struct cfg80211_internal_bss *scan;
2835         int ifidx = cb->args[0];
2836         int start = cb->args[1], idx = 0;
2837         int err;
2838
2839         if (!ifidx) {
2840                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
2841                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
2842                                   nl80211_policy);
2843                 if (err)
2844                         return err;
2845
2846                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
2847                         return -EINVAL;
2848
2849                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
2850                 if (!ifidx)
2851                         return -EINVAL;
2852                 cb->args[0] = ifidx;
2853         }
2854
2855         netdev = dev_get_by_index(&init_net, ifidx);
2856         if (!netdev)
2857                 return -ENODEV;
2858
2859         dev = cfg80211_get_dev_from_ifindex(ifidx);
2860         if (IS_ERR(dev)) {
2861                 err = PTR_ERR(dev);
2862                 goto out_put_netdev;
2863         }
2864
2865         spin_lock_bh(&dev->bss_lock);
2866         cfg80211_bss_expire(dev);
2867
2868         list_for_each_entry(scan, &dev->bss_list, list) {
2869                 if (++idx <= start)
2870                         continue;
2871                 if (nl80211_send_bss(skb,
2872                                 NETLINK_CB(cb->skb).pid,
2873                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2874                                 dev, netdev, &scan->pub) < 0) {
2875                         idx--;
2876                         goto out;
2877                 }
2878         }
2879
2880  out:
2881         spin_unlock_bh(&dev->bss_lock);
2882
2883         cb->args[1] = idx;
2884         err = skb->len;
2885         cfg80211_put_dev(dev);
2886  out_put_netdev:
2887         dev_put(netdev);
2888
2889         return err;
2890 }
2891
2892 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
2893 {
2894         return auth_type == NL80211_AUTHTYPE_OPEN_SYSTEM ||
2895                 auth_type == NL80211_AUTHTYPE_SHARED_KEY ||
2896                 auth_type == NL80211_AUTHTYPE_FT ||
2897                 auth_type == NL80211_AUTHTYPE_NETWORK_EAP;
2898 }
2899
2900 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
2901 {
2902         struct cfg80211_registered_device *drv;
2903         struct net_device *dev;
2904         struct cfg80211_auth_request req;
2905         struct wiphy *wiphy;
2906         int err;
2907
2908         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2909                 return -EINVAL;
2910
2911         if (!info->attrs[NL80211_ATTR_MAC])
2912                 return -EINVAL;
2913
2914         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
2915                 return -EINVAL;
2916
2917         rtnl_lock();
2918
2919         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2920         if (err)
2921                 goto unlock_rtnl;
2922
2923         if (!drv->ops->auth) {
2924                 err = -EOPNOTSUPP;
2925                 goto out;
2926         }
2927
2928         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
2929                 err = -EOPNOTSUPP;
2930                 goto out;
2931         }
2932
2933         if (!netif_running(dev)) {
2934                 err = -ENETDOWN;
2935                 goto out;
2936         }
2937
2938         wiphy = &drv->wiphy;
2939         memset(&req, 0, sizeof(req));
2940
2941         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2942
2943         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2944                 req.chan = ieee80211_get_channel(
2945                         wiphy,
2946                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
2947                 if (!req.chan) {
2948                         err = -EINVAL;
2949                         goto out;
2950                 }
2951         }
2952
2953         if (info->attrs[NL80211_ATTR_SSID]) {
2954                 req.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2955                 req.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
2956         }
2957
2958         if (info->attrs[NL80211_ATTR_IE]) {
2959                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
2960                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2961         }
2962
2963         req.auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
2964         if (!nl80211_valid_auth_type(req.auth_type)) {
2965                 err = -EINVAL;
2966                 goto out;
2967         }
2968
2969         err = drv->ops->auth(&drv->wiphy, dev, &req);
2970
2971 out:
2972         cfg80211_put_dev(drv);
2973         dev_put(dev);
2974 unlock_rtnl:
2975         rtnl_unlock();
2976         return err;
2977 }
2978
2979 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
2980 {
2981         struct cfg80211_registered_device *drv;
2982         struct net_device *dev;
2983         struct cfg80211_assoc_request req;
2984         struct wiphy *wiphy;
2985         int err;
2986
2987         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2988                 return -EINVAL;
2989
2990         if (!info->attrs[NL80211_ATTR_MAC] ||
2991             !info->attrs[NL80211_ATTR_SSID])
2992                 return -EINVAL;
2993
2994         rtnl_lock();
2995
2996         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2997         if (err)
2998                 goto unlock_rtnl;
2999
3000         if (!drv->ops->assoc) {
3001                 err = -EOPNOTSUPP;
3002                 goto out;
3003         }
3004
3005         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3006                 err = -EOPNOTSUPP;
3007                 goto out;
3008         }
3009
3010         if (!netif_running(dev)) {
3011                 err = -ENETDOWN;
3012                 goto out;
3013         }
3014
3015         wiphy = &drv->wiphy;
3016         memset(&req, 0, sizeof(req));
3017
3018         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3019
3020         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3021                 req.chan = ieee80211_get_channel(
3022                         wiphy,
3023                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3024                 if (!req.chan) {
3025                         err = -EINVAL;
3026                         goto out;
3027                 }
3028         }
3029
3030         req.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3031         req.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3032
3033         if (info->attrs[NL80211_ATTR_IE]) {
3034                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3035                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3036         }
3037
3038         if (info->attrs[NL80211_ATTR_USE_MFP]) {
3039                 enum nl80211_mfp use_mfp =
3040                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
3041                 if (use_mfp == NL80211_MFP_REQUIRED)
3042                         req.use_mfp = true;
3043                 else if (use_mfp != NL80211_MFP_NO) {
3044                         err = -EINVAL;
3045                         goto out;
3046                 }
3047         }
3048
3049         req.control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
3050
3051         err = drv->ops->assoc(&drv->wiphy, dev, &req);
3052
3053 out:
3054         cfg80211_put_dev(drv);
3055         dev_put(dev);
3056 unlock_rtnl:
3057         rtnl_unlock();
3058         return err;
3059 }
3060
3061 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
3062 {
3063         struct cfg80211_registered_device *drv;
3064         struct net_device *dev;
3065         struct cfg80211_deauth_request req;
3066         struct wiphy *wiphy;
3067         int err;
3068
3069         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3070                 return -EINVAL;
3071
3072         if (!info->attrs[NL80211_ATTR_MAC])
3073                 return -EINVAL;
3074
3075         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3076                 return -EINVAL;
3077
3078         rtnl_lock();
3079
3080         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3081         if (err)
3082                 goto unlock_rtnl;
3083
3084         if (!drv->ops->deauth) {
3085                 err = -EOPNOTSUPP;
3086                 goto out;
3087         }
3088
3089         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3090                 err = -EOPNOTSUPP;
3091                 goto out;
3092         }
3093
3094         if (!netif_running(dev)) {
3095                 err = -ENETDOWN;
3096                 goto out;
3097         }
3098
3099         wiphy = &drv->wiphy;
3100         memset(&req, 0, sizeof(req));
3101
3102         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3103
3104         req.reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3105         if (req.reason_code == 0) {
3106                 /* Reason Code 0 is reserved */
3107                 err = -EINVAL;
3108                 goto out;
3109         }
3110
3111         if (info->attrs[NL80211_ATTR_IE]) {
3112                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3113                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3114         }
3115
3116         err = drv->ops->deauth(&drv->wiphy, dev, &req);
3117
3118 out:
3119         cfg80211_put_dev(drv);
3120         dev_put(dev);
3121 unlock_rtnl:
3122         rtnl_unlock();
3123         return err;
3124 }
3125
3126 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
3127 {
3128         struct cfg80211_registered_device *drv;
3129         struct net_device *dev;
3130         struct cfg80211_disassoc_request req;
3131         struct wiphy *wiphy;
3132         int err;
3133
3134         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3135                 return -EINVAL;
3136
3137         if (!info->attrs[NL80211_ATTR_MAC])
3138                 return -EINVAL;
3139
3140         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3141                 return -EINVAL;
3142
3143         rtnl_lock();
3144
3145         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3146         if (err)
3147                 goto unlock_rtnl;
3148
3149         if (!drv->ops->disassoc) {
3150                 err = -EOPNOTSUPP;
3151                 goto out;
3152         }
3153
3154         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3155                 err = -EOPNOTSUPP;
3156                 goto out;
3157         }
3158
3159         if (!netif_running(dev)) {
3160                 err = -ENETDOWN;
3161                 goto out;
3162         }
3163
3164         wiphy = &drv->wiphy;
3165         memset(&req, 0, sizeof(req));
3166
3167         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3168
3169         req.reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3170         if (req.reason_code == 0) {
3171                 /* Reason Code 0 is reserved */
3172                 err = -EINVAL;
3173                 goto out;
3174         }
3175
3176         if (info->attrs[NL80211_ATTR_IE]) {
3177                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3178                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3179         }
3180
3181         err = drv->ops->disassoc(&drv->wiphy, dev, &req);
3182
3183 out:
3184         cfg80211_put_dev(drv);
3185         dev_put(dev);
3186 unlock_rtnl:
3187         rtnl_unlock();
3188         return err;
3189 }
3190
3191 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
3192 {
3193         struct cfg80211_registered_device *drv;
3194         struct net_device *dev;
3195         struct cfg80211_ibss_params ibss;
3196         struct wiphy *wiphy;
3197         int err;
3198
3199         memset(&ibss, 0, sizeof(ibss));
3200
3201         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3202                 return -EINVAL;
3203
3204         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
3205             !info->attrs[NL80211_ATTR_SSID] ||
3206             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3207                 return -EINVAL;
3208
3209         ibss.beacon_interval = 100;
3210
3211         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
3212                 ibss.beacon_interval =
3213                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3214                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
3215                         return -EINVAL;
3216         }
3217
3218         rtnl_lock();
3219
3220         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3221         if (err)
3222                 goto unlock_rtnl;
3223
3224         if (!drv->ops->join_ibss) {
3225                 err = -EOPNOTSUPP;
3226                 goto out;
3227         }
3228
3229         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3230                 err = -EOPNOTSUPP;
3231                 goto out;
3232         }
3233
3234         if (!netif_running(dev)) {
3235                 err = -ENETDOWN;
3236                 goto out;
3237         }
3238
3239         wiphy = &drv->wiphy;
3240
3241         if (info->attrs[NL80211_ATTR_MAC])
3242                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3243         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3244         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3245
3246         if (info->attrs[NL80211_ATTR_IE]) {
3247                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3248                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3249         }
3250
3251         ibss.channel = ieee80211_get_channel(wiphy,
3252                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3253         if (!ibss.channel ||
3254             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
3255             ibss.channel->flags & IEEE80211_CHAN_DISABLED) {
3256                 err = -EINVAL;
3257                 goto out;
3258         }
3259
3260         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
3261
3262         err = cfg80211_join_ibss(drv, dev, &ibss);
3263
3264 out:
3265         cfg80211_put_dev(drv);
3266         dev_put(dev);
3267 unlock_rtnl:
3268         rtnl_unlock();
3269         return err;
3270 }
3271
3272 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
3273 {
3274         struct cfg80211_registered_device *drv;
3275         struct net_device *dev;
3276         int err;
3277
3278         rtnl_lock();
3279
3280         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3281         if (err)
3282                 goto unlock_rtnl;
3283
3284         if (!drv->ops->leave_ibss) {
3285                 err = -EOPNOTSUPP;
3286                 goto out;
3287         }
3288
3289         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3290                 err = -EOPNOTSUPP;
3291                 goto out;
3292         }
3293
3294         if (!netif_running(dev)) {
3295                 err = -ENETDOWN;
3296                 goto out;
3297         }
3298
3299         err = cfg80211_leave_ibss(drv, dev, false);
3300
3301 out:
3302         cfg80211_put_dev(drv);
3303         dev_put(dev);
3304 unlock_rtnl:
3305         rtnl_unlock();
3306         return err;
3307 }
3308
3309 static struct genl_ops nl80211_ops[] = {
3310         {
3311                 .cmd = NL80211_CMD_GET_WIPHY,
3312                 .doit = nl80211_get_wiphy,
3313                 .dumpit = nl80211_dump_wiphy,
3314                 .policy = nl80211_policy,
3315                 /* can be retrieved by unprivileged users */
3316         },
3317         {
3318                 .cmd = NL80211_CMD_SET_WIPHY,
3319                 .doit = nl80211_set_wiphy,
3320                 .policy = nl80211_policy,
3321                 .flags = GENL_ADMIN_PERM,
3322         },
3323         {
3324                 .cmd = NL80211_CMD_GET_INTERFACE,
3325                 .doit = nl80211_get_interface,
3326                 .dumpit = nl80211_dump_interface,
3327                 .policy = nl80211_policy,
3328                 /* can be retrieved by unprivileged users */
3329         },
3330         {
3331                 .cmd = NL80211_CMD_SET_INTERFACE,
3332                 .doit = nl80211_set_interface,
3333                 .policy = nl80211_policy,
3334                 .flags = GENL_ADMIN_PERM,
3335         },
3336         {
3337                 .cmd = NL80211_CMD_NEW_INTERFACE,
3338                 .doit = nl80211_new_interface,
3339                 .policy = nl80211_policy,
3340                 .flags = GENL_ADMIN_PERM,
3341         },
3342         {
3343                 .cmd = NL80211_CMD_DEL_INTERFACE,
3344                 .doit = nl80211_del_interface,
3345                 .policy = nl80211_policy,
3346                 .flags = GENL_ADMIN_PERM,
3347         },
3348         {
3349                 .cmd = NL80211_CMD_GET_KEY,
3350                 .doit = nl80211_get_key,
3351                 .policy = nl80211_policy,
3352                 .flags = GENL_ADMIN_PERM,
3353         },
3354         {
3355                 .cmd = NL80211_CMD_SET_KEY,
3356                 .doit = nl80211_set_key,
3357                 .policy = nl80211_policy,
3358                 .flags = GENL_ADMIN_PERM,
3359         },
3360         {
3361                 .cmd = NL80211_CMD_NEW_KEY,
3362                 .doit = nl80211_new_key,
3363                 .policy = nl80211_policy,
3364                 .flags = GENL_ADMIN_PERM,
3365         },
3366         {
3367                 .cmd = NL80211_CMD_DEL_KEY,
3368                 .doit = nl80211_del_key,
3369                 .policy = nl80211_policy,
3370                 .flags = GENL_ADMIN_PERM,
3371         },
3372         {
3373                 .cmd = NL80211_CMD_SET_BEACON,
3374                 .policy = nl80211_policy,
3375                 .flags = GENL_ADMIN_PERM,
3376                 .doit = nl80211_addset_beacon,
3377         },
3378         {
3379                 .cmd = NL80211_CMD_NEW_BEACON,
3380                 .policy = nl80211_policy,
3381                 .flags = GENL_ADMIN_PERM,
3382                 .doit = nl80211_addset_beacon,
3383         },
3384         {
3385                 .cmd = NL80211_CMD_DEL_BEACON,
3386                 .policy = nl80211_policy,
3387                 .flags = GENL_ADMIN_PERM,
3388                 .doit = nl80211_del_beacon,
3389         },
3390         {
3391                 .cmd = NL80211_CMD_GET_STATION,
3392                 .doit = nl80211_get_station,
3393                 .dumpit = nl80211_dump_station,
3394                 .policy = nl80211_policy,
3395         },
3396         {
3397                 .cmd = NL80211_CMD_SET_STATION,
3398                 .doit = nl80211_set_station,
3399                 .policy = nl80211_policy,
3400                 .flags = GENL_ADMIN_PERM,
3401         },
3402         {
3403                 .cmd = NL80211_CMD_NEW_STATION,
3404                 .doit = nl80211_new_station,
3405                 .policy = nl80211_policy,
3406                 .flags = GENL_ADMIN_PERM,
3407         },
3408         {
3409                 .cmd = NL80211_CMD_DEL_STATION,
3410                 .doit = nl80211_del_station,
3411                 .policy = nl80211_policy,
3412                 .flags = GENL_ADMIN_PERM,
3413         },
3414         {
3415                 .cmd = NL80211_CMD_GET_MPATH,
3416                 .doit = nl80211_get_mpath,
3417                 .dumpit = nl80211_dump_mpath,
3418                 .policy = nl80211_policy,
3419                 .flags = GENL_ADMIN_PERM,
3420         },
3421         {
3422                 .cmd = NL80211_CMD_SET_MPATH,
3423                 .doit = nl80211_set_mpath,
3424                 .policy = nl80211_policy,
3425                 .flags = GENL_ADMIN_PERM,
3426         },
3427         {
3428                 .cmd = NL80211_CMD_NEW_MPATH,
3429                 .doit = nl80211_new_mpath,
3430                 .policy = nl80211_policy,
3431                 .flags = GENL_ADMIN_PERM,
3432         },
3433         {
3434                 .cmd = NL80211_CMD_DEL_MPATH,
3435                 .doit = nl80211_del_mpath,
3436                 .policy = nl80211_policy,
3437                 .flags = GENL_ADMIN_PERM,
3438         },
3439         {
3440                 .cmd = NL80211_CMD_SET_BSS,
3441                 .doit = nl80211_set_bss,
3442                 .policy = nl80211_policy,
3443                 .flags = GENL_ADMIN_PERM,
3444         },
3445         {
3446                 .cmd = NL80211_CMD_GET_REG,
3447                 .doit = nl80211_get_reg,
3448                 .policy = nl80211_policy,
3449                 /* can be retrieved by unprivileged users */
3450         },
3451         {
3452                 .cmd = NL80211_CMD_SET_REG,
3453                 .doit = nl80211_set_reg,
3454                 .policy = nl80211_policy,
3455                 .flags = GENL_ADMIN_PERM,
3456         },
3457         {
3458                 .cmd = NL80211_CMD_REQ_SET_REG,
3459                 .doit = nl80211_req_set_reg,
3460                 .policy = nl80211_policy,
3461                 .flags = GENL_ADMIN_PERM,
3462         },
3463         {
3464                 .cmd = NL80211_CMD_GET_MESH_PARAMS,
3465                 .doit = nl80211_get_mesh_params,
3466                 .policy = nl80211_policy,
3467                 /* can be retrieved by unprivileged users */
3468         },
3469         {
3470                 .cmd = NL80211_CMD_SET_MESH_PARAMS,
3471                 .doit = nl80211_set_mesh_params,
3472                 .policy = nl80211_policy,
3473                 .flags = GENL_ADMIN_PERM,
3474         },
3475         {
3476                 .cmd = NL80211_CMD_TRIGGER_SCAN,
3477                 .doit = nl80211_trigger_scan,
3478                 .policy = nl80211_policy,
3479                 .flags = GENL_ADMIN_PERM,
3480         },
3481         {
3482                 .cmd = NL80211_CMD_GET_SCAN,
3483                 .policy = nl80211_policy,
3484                 .dumpit = nl80211_dump_scan,
3485         },
3486         {
3487                 .cmd = NL80211_CMD_AUTHENTICATE,
3488                 .doit = nl80211_authenticate,
3489                 .policy = nl80211_policy,
3490                 .flags = GENL_ADMIN_PERM,
3491         },
3492         {
3493                 .cmd = NL80211_CMD_ASSOCIATE,
3494                 .doit = nl80211_associate,
3495                 .policy = nl80211_policy,
3496                 .flags = GENL_ADMIN_PERM,
3497         },
3498         {
3499                 .cmd = NL80211_CMD_DEAUTHENTICATE,
3500                 .doit = nl80211_deauthenticate,
3501                 .policy = nl80211_policy,
3502                 .flags = GENL_ADMIN_PERM,
3503         },
3504         {
3505                 .cmd = NL80211_CMD_DISASSOCIATE,
3506                 .doit = nl80211_disassociate,
3507                 .policy = nl80211_policy,
3508                 .flags = GENL_ADMIN_PERM,
3509         },
3510         {
3511                 .cmd = NL80211_CMD_JOIN_IBSS,
3512                 .doit = nl80211_join_ibss,
3513                 .policy = nl80211_policy,
3514                 .flags = GENL_ADMIN_PERM,
3515         },
3516         {
3517                 .cmd = NL80211_CMD_LEAVE_IBSS,
3518                 .doit = nl80211_leave_ibss,
3519                 .policy = nl80211_policy,
3520                 .flags = GENL_ADMIN_PERM,
3521         },
3522 };
3523 static struct genl_multicast_group nl80211_mlme_mcgrp = {
3524         .name = "mlme",
3525 };
3526
3527 /* multicast groups */
3528 static struct genl_multicast_group nl80211_config_mcgrp = {
3529         .name = "config",
3530 };
3531 static struct genl_multicast_group nl80211_scan_mcgrp = {
3532         .name = "scan",
3533 };
3534 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
3535         .name = "regulatory",
3536 };
3537
3538 /* notification functions */
3539
3540 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
3541 {
3542         struct sk_buff *msg;
3543
3544         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3545         if (!msg)
3546                 return;
3547
3548         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
3549                 nlmsg_free(msg);
3550                 return;
3551         }
3552
3553         genlmsg_multicast(msg, 0, nl80211_config_mcgrp.id, GFP_KERNEL);
3554 }
3555
3556 static int nl80211_send_scan_donemsg(struct sk_buff *msg,
3557                                     struct cfg80211_registered_device *rdev,
3558                                     struct net_device *netdev,
3559                                     u32 pid, u32 seq, int flags,
3560                                     u32 cmd)
3561 {
3562         void *hdr;
3563
3564         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
3565         if (!hdr)
3566                 return -1;
3567
3568         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3569         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3570
3571         /* XXX: we should probably bounce back the request? */
3572
3573         return genlmsg_end(msg, hdr);
3574
3575  nla_put_failure:
3576         genlmsg_cancel(msg, hdr);
3577         return -EMSGSIZE;
3578 }
3579
3580 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
3581                             struct net_device *netdev)
3582 {
3583         struct sk_buff *msg;
3584
3585         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3586         if (!msg)
3587                 return;
3588
3589         if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
3590                                       NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
3591                 nlmsg_free(msg);
3592                 return;
3593         }
3594
3595         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
3596 }
3597
3598 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
3599                                struct net_device *netdev)
3600 {
3601         struct sk_buff *msg;
3602
3603         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3604         if (!msg)
3605                 return;
3606
3607         if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
3608                                       NL80211_CMD_SCAN_ABORTED) < 0) {
3609                 nlmsg_free(msg);
3610                 return;
3611         }
3612
3613         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
3614 }
3615
3616 /*
3617  * This can happen on global regulatory changes or device specific settings
3618  * based on custom world regulatory domains.
3619  */
3620 void nl80211_send_reg_change_event(struct regulatory_request *request)
3621 {
3622         struct sk_buff *msg;
3623         void *hdr;
3624
3625         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3626         if (!msg)
3627                 return;
3628
3629         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
3630         if (!hdr) {
3631                 nlmsg_free(msg);
3632                 return;
3633         }
3634
3635         /* Userspace can always count this one always being set */
3636         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
3637
3638         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
3639                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3640                            NL80211_REGDOM_TYPE_WORLD);
3641         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
3642                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3643                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
3644         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
3645                  request->intersect)
3646                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3647                            NL80211_REGDOM_TYPE_INTERSECTION);
3648         else {
3649                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3650                            NL80211_REGDOM_TYPE_COUNTRY);
3651                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
3652         }
3653
3654         if (wiphy_idx_valid(request->wiphy_idx))
3655                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
3656
3657         if (genlmsg_end(msg, hdr) < 0) {
3658                 nlmsg_free(msg);
3659                 return;
3660         }
3661
3662         genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_KERNEL);
3663
3664         return;
3665
3666 nla_put_failure:
3667         genlmsg_cancel(msg, hdr);
3668         nlmsg_free(msg);
3669 }
3670
3671 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
3672                                     struct net_device *netdev,
3673                                     const u8 *buf, size_t len,
3674                                     enum nl80211_commands cmd)
3675 {
3676         struct sk_buff *msg;
3677         void *hdr;
3678
3679         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
3680         if (!msg)
3681                 return;
3682
3683         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
3684         if (!hdr) {
3685                 nlmsg_free(msg);
3686                 return;
3687         }
3688
3689         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3690         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3691         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
3692
3693         if (genlmsg_end(msg, hdr) < 0) {
3694                 nlmsg_free(msg);
3695                 return;
3696         }
3697
3698         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_ATOMIC);
3699         return;
3700
3701  nla_put_failure:
3702         genlmsg_cancel(msg, hdr);
3703         nlmsg_free(msg);
3704 }
3705
3706 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
3707                           struct net_device *netdev, const u8 *buf, size_t len)
3708 {
3709         nl80211_send_mlme_event(rdev, netdev, buf, len,
3710                                 NL80211_CMD_AUTHENTICATE);
3711 }
3712
3713 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
3714                            struct net_device *netdev, const u8 *buf,
3715                            size_t len)
3716 {
3717         nl80211_send_mlme_event(rdev, netdev, buf, len, NL80211_CMD_ASSOCIATE);
3718 }
3719
3720 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
3721                          struct net_device *netdev, const u8 *buf, size_t len)
3722 {
3723         nl80211_send_mlme_event(rdev, netdev, buf, len,
3724                                 NL80211_CMD_DEAUTHENTICATE);
3725 }
3726
3727 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
3728                            struct net_device *netdev, const u8 *buf,
3729                            size_t len)
3730 {
3731         nl80211_send_mlme_event(rdev, netdev, buf, len,
3732                                 NL80211_CMD_DISASSOCIATE);
3733 }
3734
3735 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
3736                                       struct net_device *netdev, int cmd,
3737                                       const u8 *addr)
3738 {
3739         struct sk_buff *msg;
3740         void *hdr;
3741
3742         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
3743         if (!msg)
3744                 return;
3745
3746         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
3747         if (!hdr) {
3748                 nlmsg_free(msg);
3749                 return;
3750         }
3751
3752         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3753         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3754         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
3755         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3756
3757         if (genlmsg_end(msg, hdr) < 0) {
3758                 nlmsg_free(msg);
3759                 return;
3760         }
3761
3762         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_ATOMIC);
3763         return;
3764
3765  nla_put_failure:
3766         genlmsg_cancel(msg, hdr);
3767         nlmsg_free(msg);
3768 }
3769
3770 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
3771                                struct net_device *netdev, const u8 *addr)
3772 {
3773         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
3774                                   addr);
3775 }
3776
3777 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
3778                                 struct net_device *netdev, const u8 *addr)
3779 {
3780         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE, addr);
3781 }
3782
3783 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
3784                              struct net_device *netdev, const u8 *bssid,
3785                              gfp_t gfp)
3786 {
3787         struct sk_buff *msg;
3788         void *hdr;
3789
3790         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
3791         if (!msg)
3792                 return;
3793
3794         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
3795         if (!hdr) {
3796                 nlmsg_free(msg);
3797                 return;
3798         }
3799
3800         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3801         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3802         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
3803
3804         if (genlmsg_end(msg, hdr) < 0) {
3805                 nlmsg_free(msg);
3806                 return;
3807         }
3808
3809         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
3810         return;
3811
3812  nla_put_failure:
3813         genlmsg_cancel(msg, hdr);
3814         nlmsg_free(msg);
3815 }
3816
3817 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
3818                                  struct net_device *netdev, const u8 *addr,
3819                                  enum nl80211_key_type key_type, int key_id,
3820                                  const u8 *tsc)
3821 {
3822         struct sk_buff *msg;
3823         void *hdr;
3824
3825         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3826         if (!msg)
3827                 return;
3828
3829         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
3830         if (!hdr) {
3831                 nlmsg_free(msg);
3832                 return;
3833         }
3834
3835         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3836         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3837         if (addr)
3838                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3839         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
3840         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
3841         if (tsc)
3842                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
3843
3844         if (genlmsg_end(msg, hdr) < 0) {
3845                 nlmsg_free(msg);
3846                 return;
3847         }
3848
3849         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_KERNEL);
3850         return;
3851
3852  nla_put_failure:
3853         genlmsg_cancel(msg, hdr);
3854         nlmsg_free(msg);
3855 }
3856
3857 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
3858                                     struct ieee80211_channel *channel_before,
3859                                     struct ieee80211_channel *channel_after)
3860 {
3861         struct sk_buff *msg;
3862         void *hdr;
3863         struct nlattr *nl_freq;
3864
3865         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
3866         if (!msg)
3867                 return;
3868
3869         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
3870         if (!hdr) {
3871                 nlmsg_free(msg);
3872                 return;
3873         }
3874
3875         /*
3876          * Since we are applying the beacon hint to a wiphy we know its
3877          * wiphy_idx is valid
3878          */
3879         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
3880
3881         /* Before */
3882         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
3883         if (!nl_freq)
3884                 goto nla_put_failure;
3885         if (nl80211_msg_put_channel(msg, channel_before))
3886                 goto nla_put_failure;
3887         nla_nest_end(msg, nl_freq);
3888
3889         /* After */
3890         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
3891         if (!nl_freq)
3892                 goto nla_put_failure;
3893         if (nl80211_msg_put_channel(msg, channel_after))
3894                 goto nla_put_failure;
3895         nla_nest_end(msg, nl_freq);
3896
3897         if (genlmsg_end(msg, hdr) < 0) {
3898                 nlmsg_free(msg);
3899                 return;
3900         }
3901
3902         genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_ATOMIC);
3903
3904         return;
3905
3906 nla_put_failure:
3907         genlmsg_cancel(msg, hdr);
3908         nlmsg_free(msg);
3909 }
3910
3911 /* initialisation/exit functions */
3912
3913 int nl80211_init(void)
3914 {
3915         int err, i;
3916
3917         err = genl_register_family(&nl80211_fam);
3918         if (err)
3919                 return err;
3920
3921         for (i = 0; i < ARRAY_SIZE(nl80211_ops); i++) {
3922                 err = genl_register_ops(&nl80211_fam, &nl80211_ops[i]);
3923                 if (err)
3924                         goto err_out;
3925         }
3926
3927         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
3928         if (err)
3929                 goto err_out;
3930
3931         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
3932         if (err)
3933                 goto err_out;
3934
3935         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
3936         if (err)
3937                 goto err_out;
3938
3939         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
3940         if (err)
3941                 goto err_out;
3942
3943         return 0;
3944  err_out:
3945         genl_unregister_family(&nl80211_fam);
3946         return err;
3947 }
3948
3949 void nl80211_exit(void)
3950 {
3951         genl_unregister_family(&nl80211_fam);
3952 }