SAFE public projects git trees. - safe/jmp/linux-2.6/blob - net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2009  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/list.h>
  11 #include <linux/if_ether.h>
  12 #include <linux/ieee80211.h>
  13 #include <linux/nl80211.h>
  14 #include <linux/rtnetlink.h>
  15 #include <linux/netlink.h>
  16 #include <linux/etherdevice.h>
  17 #include <net/genetlink.h>
  18 #include <net/cfg80211.h>
  19 #include "core.h"
  20 #include "nl80211.h"
  21 #include "reg.h"
  22
  23 /* the netlink family */
  24 static struct genl_family nl80211_fam = {
  25         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  26         .name = "nl80211",      /* have users key off the name instead */
  27         .hdrsize = 0,           /* no private header */
  28         .version = 1,           /* no particular meaning now */
  29         .maxattr = NL80211_ATTR_MAX,
  30 };
  31
  32 /* internal helper: get rdev and dev */
  33 static int get_rdev_dev_by_info_ifindex(struct nlattr **attrs,
  34                                        struct cfg80211_registered_device **rdev,
  35                                        struct net_device **dev)
  36 {
  37         int ifindex;
  38
  39         if (!attrs[NL80211_ATTR_IFINDEX])
  40                 return -EINVAL;
  41
  42         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  43         *dev = dev_get_by_index(&init_net, ifindex);
  44         if (!*dev)
  45                 return -ENODEV;
  46
  47         *rdev = cfg80211_get_dev_from_ifindex(ifindex);
  48         if (IS_ERR(*rdev)) {
  49                 dev_put(*dev);
  50                 return PTR_ERR(*rdev);
  51         }
  52
  53         return 0;
  54 }
  55
  56 /* policy for the attributes */
  57 static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
  58         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  59         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  60                                       .len = 20-1 },
  61         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  62         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  63         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  64         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
  65         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
  66         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
  67         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
  68
  69         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  70         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  71         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  72
  73         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  74         [NL80211_ATTR_PREV_BSSID] = { .type = NLA_BINARY, .len = ETH_ALEN },
  75
  76         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
  77         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  78                                     .len = WLAN_MAX_KEY_LEN },
  79         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  80         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  81         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
  82         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
  83
  84         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
  85         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
  86         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
  87                                        .len = IEEE80211_MAX_DATA_LEN },
  88         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
  89                                        .len = IEEE80211_MAX_DATA_LEN },
  90         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
  91         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
  92         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
  93         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
  94                                                .len = NL80211_MAX_SUPP_RATES },
  95         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
  96         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
  97         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
  98         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
  99                                 .len = IEEE80211_MAX_MESH_ID_LEN },
 100         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 101
 102         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 103         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 104
 105         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 106         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 107         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 108         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 109                                            .len = NL80211_MAX_SUPP_RATES },
 110
 111         [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
 112
 113         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 114                                          .len = NL80211_HT_CAPABILITY_LEN },
 115
 116         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 117         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 118                               .len = IEEE80211_MAX_DATA_LEN },
 119         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 120         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 121
 122         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 123                                 .len = IEEE80211_MAX_SSID_LEN },
 124         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 125         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 126         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 127         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 128         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 129         [NL80211_ATTR_STA_FLAGS2] = {
 130                 .len = sizeof(struct nl80211_sta_flag_update),
 131         },
 132         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 133         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 134         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 135         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 136 };
 137
 138 /* policy for the attributes */
 139 static struct nla_policy
 140 nl80211_key_policy[NL80211_KEY_MAX + 1] __read_mostly = {
 141         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 142         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 143         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 144         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 8 },
 145         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 146         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 147 };
 148
 149 /* IE validation */
 150 static bool is_valid_ie_attr(const struct nlattr *attr)
 151 {
 152         const u8 *pos;
 153         int len;
 154
 155         if (!attr)
 156                 return true;
 157
 158         pos = nla_data(attr);
 159         len = nla_len(attr);
 160
 161         while (len) {
 162                 u8 elemlen;
 163
 164                 if (len < 2)
 165                         return false;
 166                 len -= 2;
 167
 168                 elemlen = pos[1];
 169                 if (elemlen > len)
 170                         return false;
 171
 172                 len -= elemlen;
 173                 pos += 2 + elemlen;
 174         }
 175
 176         return true;
 177 }
 178
 179 /* message building helper */
 180 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 181                                    int flags, u8 cmd)
 182 {
 183         /* since there is no private header just add the generic one */
 184         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 185 }
 186
 187 static int nl80211_msg_put_channel(struct sk_buff *msg,
 188                                    struct ieee80211_channel *chan)
 189 {
 190         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 191                     chan->center_freq);
 192
 193         if (chan->flags & IEEE80211_CHAN_DISABLED)
 194                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 195         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 196                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 197         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 198                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 199         if (chan->flags & IEEE80211_CHAN_RADAR)
 200                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 201
 202         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 203                     DBM_TO_MBM(chan->max_power));
 204
 205         return 0;
 206
 207  nla_put_failure:
 208         return -ENOBUFS;
 209 }
 210
 211 /* netlink command implementations */
 212
 213 struct key_parse {
 214         struct key_params p;
 215         int idx;
 216         bool def, defmgmt;
 217 };
 218
 219 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 220 {
 221         struct nlattr *tb[NL80211_KEY_MAX + 1];
 222         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 223                                    nl80211_key_policy);
 224         if (err)
 225                 return err;
 226
 227         k->def = !!tb[NL80211_KEY_DEFAULT];
 228         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 229
 230         if (tb[NL80211_KEY_IDX])
 231                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 232
 233         if (tb[NL80211_KEY_DATA]) {
 234                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 235                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 236         }
 237
 238         if (tb[NL80211_KEY_SEQ]) {
 239                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 240                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 241         }
 242
 243         if (tb[NL80211_KEY_CIPHER])
 244                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 245
 246         return 0;
 247 }
 248
 249 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 250 {
 251         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 252                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 253                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 254         }
 255
 256         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 257                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 258                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 259         }
 260
 261         if (info->attrs[NL80211_ATTR_KEY_IDX])
 262                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 263
 264         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 265                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 266
 267         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 268         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 269
 270         return 0;
 271 }
 272
 273 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 274 {
 275         int err;
 276
 277         memset(k, 0, sizeof(*k));
 278         k->idx = -1;
 279
 280         if (info->attrs[NL80211_ATTR_KEY])
 281                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 282         else
 283                 err = nl80211_parse_key_old(info, k);
 284
 285         if (err)
 286                 return err;
 287
 288         if (k->def && k->defmgmt)
 289                 return -EINVAL;
 290
 291         if (k->idx != -1) {
 292                 if (k->defmgmt) {
 293                         if (k->idx < 4 || k->idx > 5)
 294                                 return -EINVAL;
 295                 } else if (k->def) {
 296                         if (k->idx < 0 || k->idx > 3)
 297                                 return -EINVAL;
 298                 } else {
 299                         if (k->idx < 0 || k->idx > 5)
 300                                 return -EINVAL;
 301                 }
 302         }
 303
 304         return 0;
 305 }
 306
 307 static struct cfg80211_cached_keys *
 308 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 309                        struct nlattr *keys)
 310 {
 311         struct key_parse parse;
 312         struct nlattr *key;
 313         struct cfg80211_cached_keys *result;
 314         int rem, err, def = 0;
 315
 316         result = kzalloc(sizeof(*result), GFP_KERNEL);
 317         if (!result)
 318                 return ERR_PTR(-ENOMEM);
 319
 320         result->def = -1;
 321         result->defmgmt = -1;
 322
 323         nla_for_each_nested(key, keys, rem) {
 324                 memset(&parse, 0, sizeof(parse));
 325                 parse.idx = -1;
 326
 327                 err = nl80211_parse_key_new(key, &parse);
 328                 if (err)
 329                         goto error;
 330                 err = -EINVAL;
 331                 if (!parse.p.key)
 332                         goto error;
 333                 if (parse.idx < 0 || parse.idx > 4)
 334                         goto error;
 335                 if (parse.def) {
 336                         if (def)
 337                                 goto error;
 338                         def = 1;
 339                         result->def = parse.idx;
 340                 } else if (parse.defmgmt)
 341                         goto error;
 342                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 343                                                      parse.idx, NULL);
 344                 if (err)
 345                         goto error;
 346                 result->params[parse.idx].cipher = parse.p.cipher;
 347                 result->params[parse.idx].key_len = parse.p.key_len;
 348                 result->params[parse.idx].key = result->data[parse.idx];
 349                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 350         }
 351
 352         return result;
 353  error:
 354         kfree(result);
 355         return ERR_PTR(err);
 356 }
 357
 358 static int nl80211_key_allowed(struct wireless_dev *wdev)
 359 {
 360         ASSERT_WDEV_LOCK(wdev);
 361
 362         if (!netif_running(wdev->netdev))
 363                 return -ENETDOWN;
 364
 365         switch (wdev->iftype) {
 366         case NL80211_IFTYPE_AP:
 367         case NL80211_IFTYPE_AP_VLAN:
 368                 break;
 369         case NL80211_IFTYPE_ADHOC:
 370                 if (!wdev->current_bss)
 371                         return -ENOLINK;
 372                 break;
 373         case NL80211_IFTYPE_STATION:
 374                 if (wdev->sme_state != CFG80211_SME_CONNECTED)
 375                         return -ENOLINK;
 376                 break;
 377         default:
 378                 return -EINVAL;
 379         }
 380
 381         return 0;
 382 }
 383
 384 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 385                               struct cfg80211_registered_device *dev)
 386 {
 387         void *hdr;
 388         struct nlattr *nl_bands, *nl_band;
 389         struct nlattr *nl_freqs, *nl_freq;
 390         struct nlattr *nl_rates, *nl_rate;
 391         struct nlattr *nl_modes;
 392         struct nlattr *nl_cmds;
 393         enum ieee80211_band band;
 394         struct ieee80211_channel *chan;
 395         struct ieee80211_rate *rate;
 396         int i;
 397         u16 ifmodes = dev->wiphy.interface_modes;
 398
 399         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 400         if (!hdr)
 401                 return -1;
 402
 403         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 404         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 405
 406         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 407                    dev->wiphy.retry_short);
 408         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 409                    dev->wiphy.retry_long);
 410         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 411                     dev->wiphy.frag_threshold);
 412         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 413                     dev->wiphy.rts_threshold);
 414
 415         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 416                    dev->wiphy.max_scan_ssids);
 417         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 418                     dev->wiphy.max_scan_ie_len);
 419
 420         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
 421                 sizeof(u32) * dev->wiphy.n_cipher_suites,
 422                 dev->wiphy.cipher_suites);
 423
 424         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
 425         if (!nl_modes)
 426                 goto nla_put_failure;
 427
 428         i = 0;
 429         while (ifmodes) {
 430                 if (ifmodes & 1)
 431                         NLA_PUT_FLAG(msg, i);
 432                 ifmodes >>= 1;
 433                 i++;
 434         }
 435
 436         nla_nest_end(msg, nl_modes);
 437
 438         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 439         if (!nl_bands)
 440                 goto nla_put_failure;
 441
 442         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 443                 if (!dev->wiphy.bands[band])
 444                         continue;
 445
 446                 nl_band = nla_nest_start(msg, band);
 447                 if (!nl_band)
 448                         goto nla_put_failure;
 449
 450                 /* add HT info */
 451                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 452                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 453                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 454                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 455                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 456                                 dev->wiphy.bands[band]->ht_cap.cap);
 457                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 458                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 459                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 460                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 461                 }
 462
 463                 /* add frequencies */
 464                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 465                 if (!nl_freqs)
 466                         goto nla_put_failure;
 467
 468                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 469                         nl_freq = nla_nest_start(msg, i);
 470                         if (!nl_freq)
 471                                 goto nla_put_failure;
 472
 473                         chan = &dev->wiphy.bands[band]->channels[i];
 474
 475                         if (nl80211_msg_put_channel(msg, chan))
 476                                 goto nla_put_failure;
 477
 478                         nla_nest_end(msg, nl_freq);
 479                 }
 480
 481                 nla_nest_end(msg, nl_freqs);
 482
 483                 /* add bitrates */
 484                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 485                 if (!nl_rates)
 486                         goto nla_put_failure;
 487
 488                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 489                         nl_rate = nla_nest_start(msg, i);
 490                         if (!nl_rate)
 491                                 goto nla_put_failure;
 492
 493                         rate = &dev->wiphy.bands[band]->bitrates[i];
 494                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 495                                     rate->bitrate);
 496                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 497                                 NLA_PUT_FLAG(msg,
 498                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 499
 500                         nla_nest_end(msg, nl_rate);
 501                 }
 502
 503                 nla_nest_end(msg, nl_rates);
 504
 505                 nla_nest_end(msg, nl_band);
 506         }
 507         nla_nest_end(msg, nl_bands);
 508
 509         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 510         if (!nl_cmds)
 511                 goto nla_put_failure;
 512
 513         i = 0;
 514 #define CMD(op, n)                                              \
 515          do {                                                   \
 516                 if (dev->ops->op) {                             \
 517                         i++;                                    \
 518                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 519                 }                                               \
 520         } while (0)
 521
 522         CMD(add_virtual_intf, NEW_INTERFACE);
 523         CMD(change_virtual_intf, SET_INTERFACE);
 524         CMD(add_key, NEW_KEY);
 525         CMD(add_beacon, NEW_BEACON);
 526         CMD(add_station, NEW_STATION);
 527         CMD(add_mpath, NEW_MPATH);
 528         CMD(set_mesh_params, SET_MESH_PARAMS);
 529         CMD(change_bss, SET_BSS);
 530         CMD(auth, AUTHENTICATE);
 531         CMD(assoc, ASSOCIATE);
 532         CMD(deauth, DEAUTHENTICATE);
 533         CMD(disassoc, DISASSOCIATE);
 534         CMD(join_ibss, JOIN_IBSS);
 535
 536 #undef CMD
 537
 538         if (dev->ops->connect || dev->ops->auth) {
 539                 i++;
 540                 NLA_PUT_U32(msg, i, NL80211_CMD_CONNECT);
 541         }
 542
 543         if (dev->ops->disconnect || dev->ops->deauth) {
 544                 i++;
 545                 NLA_PUT_U32(msg, i, NL80211_CMD_DISCONNECT);
 546         }
 547
 548         nla_nest_end(msg, nl_cmds);
 549
 550         return genlmsg_end(msg, hdr);
 551
 552  nla_put_failure:
 553         genlmsg_cancel(msg, hdr);
 554         return -EMSGSIZE;
 555 }
 556
 557 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 558 {
 559         int idx = 0;
 560         int start = cb->args[0];
 561         struct cfg80211_registered_device *dev;
 562
 563         mutex_lock(&cfg80211_mutex);
 564         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
 565                 if (++idx <= start)
 566                         continue;
 567                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
 568                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
 569                                        dev) < 0) {
 570                         idx--;
 571                         break;
 572                 }
 573         }
 574         mutex_unlock(&cfg80211_mutex);
 575
 576         cb->args[0] = idx;
 577
 578         return skb->len;
 579 }
 580
 581 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 582 {
 583         struct sk_buff *msg;
 584         struct cfg80211_registered_device *dev;
 585
 586         dev = cfg80211_get_dev_from_info(info);
 587         if (IS_ERR(dev))
 588                 return PTR_ERR(dev);
 589
 590         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 591         if (!msg)
 592                 goto out_err;
 593
 594         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
 595                 goto out_free;
 596
 597         cfg80211_unlock_rdev(dev);
 598
 599         return genlmsg_reply(msg, info);
 600
 601  out_free:
 602         nlmsg_free(msg);
 603  out_err:
 604         cfg80211_unlock_rdev(dev);
 605         return -ENOBUFS;
 606 }
 607
 608 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 609         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
 610         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
 611         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
 612         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
 613         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
 614 };
 615
 616 static int parse_txq_params(struct nlattr *tb[],
 617                             struct ieee80211_txq_params *txq_params)
 618 {
 619         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 620             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 621             !tb[NL80211_TXQ_ATTR_AIFS])
 622                 return -EINVAL;
 623
 624         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
 625         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 626         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 627         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 628         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 629
 630         return 0;
 631 }
 632
 633 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 634 {
 635         struct cfg80211_registered_device *rdev;
 636         int result = 0, rem_txq_params = 0;
 637         struct nlattr *nl_txq_params;
 638         u32 changed;
 639         u8 retry_short = 0, retry_long = 0;
 640         u32 frag_threshold = 0, rts_threshold = 0;
 641
 642         rtnl_lock();
 643
 644         mutex_lock(&cfg80211_mutex);
 645
 646         rdev = __cfg80211_rdev_from_info(info);
 647         if (IS_ERR(rdev)) {
 648                 mutex_unlock(&cfg80211_mutex);
 649                 result = PTR_ERR(rdev);
 650                 goto unlock;
 651         }
 652
 653         mutex_lock(&rdev->mtx);
 654
 655         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
 656                 result = cfg80211_dev_rename(
 657                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 658
 659         mutex_unlock(&cfg80211_mutex);
 660
 661         if (result)
 662                 goto bad_res;
 663
 664         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
 665                 struct ieee80211_txq_params txq_params;
 666                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
 667
 668                 if (!rdev->ops->set_txq_params) {
 669                         result = -EOPNOTSUPP;
 670                         goto bad_res;
 671                 }
 672
 673                 nla_for_each_nested(nl_txq_params,
 674                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
 675                                     rem_txq_params) {
 676                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
 677                                   nla_data(nl_txq_params),
 678                                   nla_len(nl_txq_params),
 679                                   txq_params_policy);
 680                         result = parse_txq_params(tb, &txq_params);
 681                         if (result)
 682                                 goto bad_res;
 683
 684                         result = rdev->ops->set_txq_params(&rdev->wiphy,
 685                                                            &txq_params);
 686                         if (result)
 687                                 goto bad_res;
 688                 }
 689         }
 690
 691         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
 692                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 693                 struct ieee80211_channel *chan;
 694                 struct ieee80211_sta_ht_cap *ht_cap;
 695                 u32 freq;
 696
 697                 if (!rdev->ops->set_channel) {
 698                         result = -EOPNOTSUPP;
 699                         goto bad_res;
 700                 }
 701
 702                 result = -EINVAL;
 703
 704                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 705                         channel_type = nla_get_u32(info->attrs[
 706                                            NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 707                         if (channel_type != NL80211_CHAN_NO_HT &&
 708                             channel_type != NL80211_CHAN_HT20 &&
 709                             channel_type != NL80211_CHAN_HT40PLUS &&
 710                             channel_type != NL80211_CHAN_HT40MINUS)
 711                                 goto bad_res;
 712                 }
 713
 714                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 715                 chan = ieee80211_get_channel(&rdev->wiphy, freq);
 716
 717                 /* Primary channel not allowed */
 718                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 719                         goto bad_res;
 720
 721                 if (channel_type == NL80211_CHAN_HT40MINUS &&
 722                     (chan->flags & IEEE80211_CHAN_NO_HT40MINUS))
 723                         goto bad_res;
 724                 else if (channel_type == NL80211_CHAN_HT40PLUS &&
 725                          (chan->flags & IEEE80211_CHAN_NO_HT40PLUS))
 726                         goto bad_res;
 727
 728                 /*
 729                  * At this point we know if that if HT40 was requested
 730                  * we are allowed to use it and the extension channel
 731                  * exists.
 732                  */
 733
 734                 ht_cap = &rdev->wiphy.bands[chan->band]->ht_cap;
 735
 736                 /* no HT capabilities or intolerant */
 737                 if (channel_type != NL80211_CHAN_NO_HT) {
 738                         if (!ht_cap->ht_supported)
 739                                 goto bad_res;
 740                         if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
 741                             (ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT))
 742                                 goto bad_res;
 743                 }
 744
 745                 result = rdev->ops->set_channel(&rdev->wiphy, chan,
 746                                                 channel_type);
 747                 if (result)
 748                         goto bad_res;
 749         }
 750
 751         changed = 0;
 752
 753         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
 754                 retry_short = nla_get_u8(
 755                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
 756                 if (retry_short == 0) {
 757                         result = -EINVAL;
 758                         goto bad_res;
 759                 }
 760                 changed |= WIPHY_PARAM_RETRY_SHORT;
 761         }
 762
 763         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
 764                 retry_long = nla_get_u8(
 765                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
 766                 if (retry_long == 0) {
 767                         result = -EINVAL;
 768                         goto bad_res;
 769                 }
 770                 changed |= WIPHY_PARAM_RETRY_LONG;
 771         }
 772
 773         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
 774                 frag_threshold = nla_get_u32(
 775                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
 776                 if (frag_threshold < 256) {
 777                         result = -EINVAL;
 778                         goto bad_res;
 779                 }
 780                 if (frag_threshold != (u32) -1) {
 781                         /*
 782                          * Fragments (apart from the last one) are required to
 783                          * have even length. Make the fragmentation code
 784                          * simpler by stripping LSB should someone try to use
 785                          * odd threshold value.
 786                          */
 787                         frag_threshold &= ~0x1;
 788                 }
 789                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
 790         }
 791
 792         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
 793                 rts_threshold = nla_get_u32(
 794                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
 795                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
 796         }
 797
 798         if (changed) {
 799                 u8 old_retry_short, old_retry_long;
 800                 u32 old_frag_threshold, old_rts_threshold;
 801
 802                 if (!rdev->ops->set_wiphy_params) {
 803                         result = -EOPNOTSUPP;
 804                         goto bad_res;
 805                 }
 806
 807                 old_retry_short = rdev->wiphy.retry_short;
 808                 old_retry_long = rdev->wiphy.retry_long;
 809                 old_frag_threshold = rdev->wiphy.frag_threshold;
 810                 old_rts_threshold = rdev->wiphy.rts_threshold;
 811
 812                 if (changed & WIPHY_PARAM_RETRY_SHORT)
 813                         rdev->wiphy.retry_short = retry_short;
 814                 if (changed & WIPHY_PARAM_RETRY_LONG)
 815                         rdev->wiphy.retry_long = retry_long;
 816                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
 817                         rdev->wiphy.frag_threshold = frag_threshold;
 818                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
 819                         rdev->wiphy.rts_threshold = rts_threshold;
 820
 821                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
 822                 if (result) {
 823                         rdev->wiphy.retry_short = old_retry_short;
 824                         rdev->wiphy.retry_long = old_retry_long;
 825                         rdev->wiphy.frag_threshold = old_frag_threshold;
 826                         rdev->wiphy.rts_threshold = old_rts_threshold;
 827                 }
 828         }
 829
 830  bad_res:
 831         mutex_unlock(&rdev->mtx);
 832  unlock:
 833         rtnl_unlock();
 834         return result;
 835 }
 836
 837
 838 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 839                               struct cfg80211_registered_device *rdev,
 840                               struct net_device *dev)
 841 {
 842         void *hdr;
 843
 844         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
 845         if (!hdr)
 846                 return -1;
 847
 848         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 849         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
 850         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
 851         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
 852         return genlmsg_end(msg, hdr);
 853
 854  nla_put_failure:
 855         genlmsg_cancel(msg, hdr);
 856         return -EMSGSIZE;
 857 }
 858
 859 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
 860 {
 861         int wp_idx = 0;
 862         int if_idx = 0;
 863         int wp_start = cb->args[0];
 864         int if_start = cb->args[1];
 865         struct cfg80211_registered_device *dev;
 866         struct wireless_dev *wdev;
 867
 868         mutex_lock(&cfg80211_mutex);
 869         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
 870                 if (wp_idx < wp_start) {
 871                         wp_idx++;
 872                         continue;
 873                 }
 874                 if_idx = 0;
 875
 876                 mutex_lock(&dev->devlist_mtx);
 877                 list_for_each_entry(wdev, &dev->netdev_list, list) {
 878                         if (if_idx < if_start) {
 879                                 if_idx++;
 880                                 continue;
 881                         }
 882                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
 883                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
 884                                                dev, wdev->netdev) < 0) {
 885                                 mutex_unlock(&dev->devlist_mtx);
 886                                 goto out;
 887                         }
 888                         if_idx++;
 889                 }
 890                 mutex_unlock(&dev->devlist_mtx);
 891
 892                 wp_idx++;
 893         }
 894  out:
 895         mutex_unlock(&cfg80211_mutex);
 896
 897         cb->args[0] = wp_idx;
 898         cb->args[1] = if_idx;
 899
 900         return skb->len;
 901 }
 902
 903 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
 904 {
 905         struct sk_buff *msg;
 906         struct cfg80211_registered_device *dev;
 907         struct net_device *netdev;
 908         int err;
 909
 910         err = get_rdev_dev_by_info_ifindex(info->attrs, &dev, &netdev);
 911         if (err)
 912                 return err;
 913
 914         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 915         if (!msg)
 916                 goto out_err;
 917
 918         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
 919                                dev, netdev) < 0)
 920                 goto out_free;
 921
 922         dev_put(netdev);
 923         cfg80211_unlock_rdev(dev);
 924
 925         return genlmsg_reply(msg, info);
 926
 927  out_free:
 928         nlmsg_free(msg);
 929  out_err:
 930         dev_put(netdev);
 931         cfg80211_unlock_rdev(dev);
 932         return -ENOBUFS;
 933 }
 934
 935 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
 936         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
 937         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
 938         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
 939         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
 940         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
 941 };
 942
 943 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
 944 {
 945         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
 946         int flag;
 947
 948         *mntrflags = 0;
 949
 950         if (!nla)
 951                 return -EINVAL;
 952
 953         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
 954                              nla, mntr_flags_policy))
 955                 return -EINVAL;
 956
 957         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
 958                 if (flags[flag])
 959                         *mntrflags |= (1<<flag);
 960
 961         return 0;
 962 }
 963
 964 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 965 {
 966         struct cfg80211_registered_device *rdev;
 967         struct vif_params params;
 968         int err;
 969         enum nl80211_iftype otype, ntype;
 970         struct net_device *dev;
 971         u32 _flags, *flags = NULL;
 972         bool change = false;
 973
 974         memset(&params, 0, sizeof(params));
 975
 976         rtnl_lock();
 977
 978         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
 979         if (err)
 980                 goto unlock_rtnl;
 981
 982         otype = ntype = dev->ieee80211_ptr->iftype;
 983
 984         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 985                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 986                 if (otype != ntype)
 987                         change = true;
 988                 if (ntype > NL80211_IFTYPE_MAX) {
 989                         err = -EINVAL;
 990                         goto unlock;
 991                 }
 992         }
 993
 994         if (!rdev->ops->change_virtual_intf ||
 995             !(rdev->wiphy.interface_modes & (1 << ntype))) {
 996                 err = -EOPNOTSUPP;
 997                 goto unlock;
 998         }
 999
1000         if (info->attrs[NL80211_ATTR_MESH_ID]) {
1001                 if (ntype != NL80211_IFTYPE_MESH_POINT) {
1002                         err = -EINVAL;
1003                         goto unlock;
1004                 }
1005                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
1006                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1007                 change = true;
1008         }
1009
1010         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
1011                 if (ntype != NL80211_IFTYPE_MONITOR) {
1012                         err = -EINVAL;
1013                         goto unlock;
1014                 }
1015                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
1016                                           &_flags);
1017                 if (err)
1018                         goto unlock;
1019
1020                 flags = &_flags;
1021                 change = true;
1022         }
1023
1024         if (change)
1025                 err = rdev->ops->change_virtual_intf(&rdev->wiphy, dev,
1026                                                     ntype, flags, &params);
1027         else
1028                 err = 0;
1029
1030         WARN_ON(!err && dev->ieee80211_ptr->iftype != ntype);
1031
1032         if (!err && (ntype != otype)) {
1033                 if (otype == NL80211_IFTYPE_ADHOC)
1034                         cfg80211_clear_ibss(dev, false);
1035         }
1036
1037  unlock:
1038         dev_put(dev);
1039         cfg80211_unlock_rdev(rdev);
1040  unlock_rtnl:
1041         rtnl_unlock();
1042         return err;
1043 }
1044
1045 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
1046 {
1047         struct cfg80211_registered_device *rdev;
1048         struct vif_params params;
1049         int err;
1050         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
1051         u32 flags;
1052
1053         memset(&params, 0, sizeof(params));
1054
1055         if (!info->attrs[NL80211_ATTR_IFNAME])
1056                 return -EINVAL;
1057
1058         if (info->attrs[NL80211_ATTR_IFTYPE]) {
1059                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1060                 if (type > NL80211_IFTYPE_MAX)
1061                         return -EINVAL;
1062         }
1063
1064         rtnl_lock();
1065
1066         rdev = cfg80211_get_dev_from_info(info);
1067         if (IS_ERR(rdev)) {
1068                 err = PTR_ERR(rdev);
1069                 goto unlock_rtnl;
1070         }
1071
1072         if (!rdev->ops->add_virtual_intf ||
1073             !(rdev->wiphy.interface_modes & (1 << type))) {
1074                 err = -EOPNOTSUPP;
1075                 goto unlock;
1076         }
1077
1078         if (type == NL80211_IFTYPE_MESH_POINT &&
1079             info->attrs[NL80211_ATTR_MESH_ID]) {
1080                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
1081                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1082         }
1083
1084         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
1085                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
1086                                   &flags);
1087         err = rdev->ops->add_virtual_intf(&rdev->wiphy,
1088                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
1089                 type, err ? NULL : &flags, &params);
1090
1091  unlock:
1092         cfg80211_unlock_rdev(rdev);
1093  unlock_rtnl:
1094         rtnl_unlock();
1095         return err;
1096 }
1097
1098 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
1099 {
1100         struct cfg80211_registered_device *rdev;
1101         int ifindex, err;
1102         struct net_device *dev;
1103
1104         rtnl_lock();
1105
1106         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
1107         if (err)
1108                 goto unlock_rtnl;
1109         ifindex = dev->ifindex;
1110         dev_put(dev);
1111
1112         if (!rdev->ops->del_virtual_intf) {
1113                 err = -EOPNOTSUPP;
1114                 goto out;
1115         }
1116
1117         err = rdev->ops->del_virtual_intf(&rdev->wiphy, ifindex);
1118
1119  out:
1120         cfg80211_unlock_rdev(rdev);
1121  unlock_rtnl:
1122         rtnl_unlock();
1123         return err;
1124 }
1125
1126 struct get_key_cookie {
1127         struct sk_buff *msg;
1128         int error;
1129         int idx;
1130 };
1131
1132 static void get_key_callback(void *c, struct key_params *params)
1133 {
1134         struct nlattr *key;
1135         struct get_key_cookie *cookie = c;
1136
1137         if (params->key)
1138                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
1139                         params->key_len, params->key);
1140
1141         if (params->seq)
1142                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
1143                         params->seq_len, params->seq);
1144
1145         if (params->cipher)
1146                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
1147                             params->cipher);
1148
1149         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
1150         if (!key)
1151                 goto nla_put_failure;
1152
1153         if (params->key)
1154                 NLA_PUT(cookie->msg, NL80211_KEY_DATA,
1155                         params->key_len, params->key);
1156
1157         if (params->seq)
1158                 NLA_PUT(cookie->msg, NL80211_KEY_SEQ,
1159                         params->seq_len, params->seq);
1160
1161         if (params->cipher)
1162                 NLA_PUT_U32(cookie->msg, NL80211_KEY_CIPHER,
1163                             params->cipher);
1164
1165         NLA_PUT_U8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx);
1166
1167         nla_nest_end(cookie->msg, key);
1168
1169         return;
1170  nla_put_failure:
1171         cookie->error = 1;
1172 }
1173
1174 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
1175 {
1176         struct cfg80211_registered_device *rdev;
1177         int err;
1178         struct net_device *dev;
1179         u8 key_idx = 0;
1180         u8 *mac_addr = NULL;
1181         struct get_key_cookie cookie = {
1182                 .error = 0,
1183         };
1184         void *hdr;
1185         struct sk_buff *msg;
1186
1187         if (info->attrs[NL80211_ATTR_KEY_IDX])
1188                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1189
1190         if (key_idx > 5)
1191                 return -EINVAL;
1192
1193         if (info->attrs[NL80211_ATTR_MAC])
1194                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1195
1196         rtnl_lock();
1197
1198         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
1199         if (err)
1200                 goto unlock_rtnl;
1201
1202         if (!rdev->ops->get_key) {
1203                 err = -EOPNOTSUPP;
1204                 goto out;
1205         }
1206
1207         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1208         if (!msg) {
1209                 err = -ENOMEM;
1210                 goto out;
1211         }
1212
1213         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
1214                              NL80211_CMD_NEW_KEY);
1215
1216         if (IS_ERR(hdr)) {
1217                 err = PTR_ERR(hdr);
1218                 goto free_msg;
1219         }
1220
1221         cookie.msg = msg;
1222         cookie.idx = key_idx;
1223
1224         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1225         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1226         if (mac_addr)
1227                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1228
1229         err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, mac_addr,
1230                                 &cookie, get_key_callback);
1231
1232         if (err)
1233                 goto free_msg;
1234
1235         if (cookie.error)
1236                 goto nla_put_failure;
1237
1238         genlmsg_end(msg, hdr);
1239         err = genlmsg_reply(msg, info);
1240         goto out;
1241
1242  nla_put_failure:
1243         err = -ENOBUFS;
1244  free_msg:
1245         nlmsg_free(msg);
1246  out:
1247         cfg80211_unlock_rdev(rdev);
1248         dev_put(dev);
1249  unlock_rtnl:
1250         rtnl_unlock();
1251
1252         return err;
1253 }
1254
1255 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1256 {
1257         struct cfg80211_registered_device *rdev;
1258         struct key_parse key;
1259         int err;
1260         struct net_device *dev;
1261         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
1262                     u8 key_index);
1263
1264         err = nl80211_parse_key(info, &key);
1265         if (err)
1266                 return err;
1267
1268         if (key.idx < 0)
1269                 return -EINVAL;
1270
1271         /* only support setting default key */
1272         if (!key.def && !key.defmgmt)
1273                 return -EINVAL;
1274
1275         rtnl_lock();
1276
1277         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
1278         if (err)
1279                 goto unlock_rtnl;
1280
1281         if (key.def)
1282                 func = rdev->ops->set_default_key;
1283         else
1284                 func = rdev->ops->set_default_mgmt_key;
1285
1286         if (!func) {
1287                 err = -EOPNOTSUPP;
1288                 goto out;
1289         }
1290
1291         wdev_lock(dev->ieee80211_ptr);
1292         err = nl80211_key_allowed(dev->ieee80211_ptr);
1293         if (!err)
1294                 err = func(&rdev->wiphy, dev, key.idx);
1295
1296 #ifdef CONFIG_WIRELESS_EXT
1297         if (!err) {
1298                 if (func == rdev->ops->set_default_key)
1299                         dev->ieee80211_ptr->wext.default_key = key.idx;
1300                 else
1301                         dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
1302         }
1303 #endif
1304         wdev_unlock(dev->ieee80211_ptr);
1305
1306  out:
1307         cfg80211_unlock_rdev(rdev);
1308         dev_put(dev);
1309
1310  unlock_rtnl:
1311         rtnl_unlock();
1312
1313         return err;
1314 }
1315
1316 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1317 {
1318         struct cfg80211_registered_device *rdev;
1319         int err;
1320         struct net_device *dev;
1321         struct key_parse key;
1322         u8 *mac_addr = NULL;
1323
1324         err = nl80211_parse_key(info, &key);
1325         if (err)
1326                 return err;
1327
1328         if (!key.p.key)
1329                 return -EINVAL;
1330
1331         if (info->attrs[NL80211_ATTR_MAC])
1332                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1333
1334         rtnl_lock();
1335
1336         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
1337         if (err)
1338                 goto unlock_rtnl;
1339
1340         if (!rdev->ops->add_key) {
1341                 err = -EOPNOTSUPP;
1342                 goto out;
1343         }
1344
1345         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx, mac_addr)) {
1346                 err = -EINVAL;
1347                 goto out;
1348         }
1349
1350         wdev_lock(dev->ieee80211_ptr);
1351         err = nl80211_key_allowed(dev->ieee80211_ptr);
1352         if (!err)
1353                 err = rdev->ops->add_key(&rdev->wiphy, dev, key.idx,
1354                                          mac_addr, &key.p);
1355         wdev_unlock(dev->ieee80211_ptr);
1356
1357  out:
1358         cfg80211_unlock_rdev(rdev);
1359         dev_put(dev);
1360  unlock_rtnl:
1361         rtnl_unlock();
1362
1363         return err;
1364 }
1365
1366 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1367 {
1368         struct cfg80211_registered_device *rdev;
1369         int err;
1370         struct net_device *dev;
1371         u8 *mac_addr = NULL;
1372         struct key_parse key;
1373
1374         err = nl80211_parse_key(info, &key);
1375         if (err)
1376                 return err;
1377
1378         if (info->attrs[NL80211_ATTR_MAC])
1379                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1380
1381         rtnl_lock();
1382
1383         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
1384         if (err)
1385                 goto unlock_rtnl;
1386
1387         if (!rdev->ops->del_key) {
1388                 err = -EOPNOTSUPP;
1389                 goto out;
1390         }
1391
1392         wdev_lock(dev->ieee80211_ptr);
1393         err = nl80211_key_allowed(dev->ieee80211_ptr);
1394         if (!err)
1395                 err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx, mac_addr);
1396
1397 #ifdef CONFIG_WIRELESS_EXT
1398         if (!err) {
1399                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
1400                         dev->ieee80211_ptr->wext.default_key = -1;
1401                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
1402                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
1403         }
1404 #endif
1405         wdev_unlock(dev->ieee80211_ptr);
1406
1407  out:
1408         cfg80211_unlock_rdev(rdev);
1409         dev_put(dev);
1410
1411  unlock_rtnl:
1412         rtnl_unlock();
1413
1414         return err;
1415 }
1416
1417 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1418 {
1419         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1420                     struct beacon_parameters *info);
1421         struct cfg80211_registered_device *rdev;
1422         int err;
1423         struct net_device *dev;
1424         struct beacon_parameters params;
1425         int haveinfo = 0;
1426
1427         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
1428                 return -EINVAL;
1429
1430         rtnl_lock();
1431
1432         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
1433         if (err)
1434                 goto unlock_rtnl;
1435
1436         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1437                 err = -EOPNOTSUPP;
1438                 goto out;
1439         }
1440
1441         switch (info->genlhdr->cmd) {
1442         case NL80211_CMD_NEW_BEACON:
1443                 /* these are required for NEW_BEACON */
1444                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1445                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1446                     !info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1447                         err = -EINVAL;
1448                         goto out;
1449                 }
1450
1451                 call = rdev->ops->add_beacon;
1452                 break;
1453         case NL80211_CMD_SET_BEACON:
1454                 call = rdev->ops->set_beacon;
1455                 break;
1456         default:
1457                 WARN_ON(1);
1458                 err = -EOPNOTSUPP;
1459                 goto out;
1460         }
1461
1462         if (!call) {
1463                 err = -EOPNOTSUPP;
1464                 goto out;
1465         }
1466
1467         memset(&params, 0, sizeof(params));
1468
1469         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1470                 params.interval =
1471                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1472                 haveinfo = 1;
1473         }
1474
1475         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1476                 params.dtim_period =
1477                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1478                 haveinfo = 1;
1479         }
1480
1481         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1482                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1483                 params.head_len =
1484                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1485                 haveinfo = 1;
1486         }
1487
1488         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1489                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1490                 params.tail_len =
1491                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1492                 haveinfo = 1;
1493         }
1494
1495         if (!haveinfo) {
1496                 err = -EINVAL;
1497                 goto out;
1498         }
1499
1500         err = call(&rdev->wiphy, dev, &params);
1501
1502  out:
1503         cfg80211_unlock_rdev(rdev);
1504         dev_put(dev);
1505  unlock_rtnl:
1506         rtnl_unlock();
1507
1508         return err;
1509 }
1510
1511 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1512 {
1513         struct cfg80211_registered_device *rdev;
1514         int err;
1515         struct net_device *dev;
1516
1517         rtnl_lock();
1518
1519         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
1520         if (err)
1521                 goto unlock_rtnl;
1522
1523         if (!rdev->ops->del_beacon) {
1524                 err = -EOPNOTSUPP;
1525                 goto out;
1526         }
1527
1528         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1529                 err = -EOPNOTSUPP;
1530                 goto out;
1531         }
1532         err = rdev->ops->del_beacon(&rdev->wiphy, dev);
1533
1534  out:
1535         cfg80211_unlock_rdev(rdev);
1536         dev_put(dev);
1537  unlock_rtnl:
1538         rtnl_unlock();
1539
1540         return err;
1541 }
1542
1543 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1544         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1545         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1546         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1547         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
1548 };
1549
1550 static int parse_station_flags(struct genl_info *info,
1551                                struct station_parameters *params)
1552 {
1553         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1554         struct nlattr *nla;
1555         int flag;
1556
1557         /*
1558          * Try parsing the new attribute first so userspace
1559          * can specify both for older kernels.
1560          */
1561         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
1562         if (nla) {
1563                 struct nl80211_sta_flag_update *sta_flags;
1564
1565                 sta_flags = nla_data(nla);
1566                 params->sta_flags_mask = sta_flags->mask;
1567                 params->sta_flags_set = sta_flags->set;
1568                 if ((params->sta_flags_mask |
1569                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
1570                         return -EINVAL;
1571                 return 0;
1572         }
1573
1574         /* if present, parse the old attribute */
1575
1576         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
1577         if (!nla)
1578                 return 0;
1579
1580         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1581                              nla, sta_flags_policy))
1582                 return -EINVAL;
1583
1584         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
1585         params->sta_flags_mask &= ~1;
1586
1587         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1588                 if (flags[flag])
1589                         params->sta_flags_set |= (1<<flag);
1590
1591         return 0;
1592 }
1593
1594 static u16 nl80211_calculate_bitrate(struct rate_info *rate)
1595 {
1596         int modulation, streams, bitrate;
1597
1598         if (!(rate->flags & RATE_INFO_FLAGS_MCS))
1599                 return rate->legacy;
1600
1601         /* the formula below does only work for MCS values smaller than 32 */
1602         if (rate->mcs >= 32)
1603                 return 0;
1604
1605         modulation = rate->mcs & 7;
1606         streams = (rate->mcs >> 3) + 1;
1607
1608         bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
1609                         13500000 : 6500000;
1610
1611         if (modulation < 4)
1612                 bitrate *= (modulation + 1);
1613         else if (modulation == 4)
1614                 bitrate *= (modulation + 2);
1615         else
1616                 bitrate *= (modulation + 3);
1617
1618         bitrate *= streams;
1619
1620         if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
1621                 bitrate = (bitrate / 9) * 10;
1622
1623         /* do NOT round down here */
1624         return (bitrate + 50000) / 100000;
1625 }
1626
1627 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1628                                 int flags, struct net_device *dev,
1629                                 u8 *mac_addr, struct station_info *sinfo)
1630 {
1631         void *hdr;
1632         struct nlattr *sinfoattr, *txrate;
1633         u16 bitrate;
1634
1635         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1636         if (!hdr)
1637                 return -1;
1638
1639         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1640         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1641
1642         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1643         if (!sinfoattr)
1644                 goto nla_put_failure;
1645         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1646                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1647                             sinfo->inactive_time);
1648         if (sinfo->filled & STATION_INFO_RX_BYTES)
1649                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1650                             sinfo->rx_bytes);
1651         if (sinfo->filled & STATION_INFO_TX_BYTES)
1652                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1653                             sinfo->tx_bytes);
1654         if (sinfo->filled & STATION_INFO_LLID)
1655                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1656                             sinfo->llid);
1657         if (sinfo->filled & STATION_INFO_PLID)
1658                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1659                             sinfo->plid);
1660         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1661                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1662                             sinfo->plink_state);
1663         if (sinfo->filled & STATION_INFO_SIGNAL)
1664                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1665                            sinfo->signal);
1666         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1667                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1668                 if (!txrate)
1669                         goto nla_put_failure;
1670
1671                 /* nl80211_calculate_bitrate will return 0 for mcs >= 32 */
1672                 bitrate = nl80211_calculate_bitrate(&sinfo->txrate);
1673                 if (bitrate > 0)
1674                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1675
1676                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1677                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1678                                     sinfo->txrate.mcs);
1679                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1680                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1681                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1682                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1683
1684                 nla_nest_end(msg, txrate);
1685         }
1686         if (sinfo->filled & STATION_INFO_RX_PACKETS)
1687                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
1688                             sinfo->rx_packets);
1689         if (sinfo->filled & STATION_INFO_TX_PACKETS)
1690                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
1691                             sinfo->tx_packets);
1692         nla_nest_end(msg, sinfoattr);
1693
1694         return genlmsg_end(msg, hdr);
1695
1696  nla_put_failure:
1697         genlmsg_cancel(msg, hdr);
1698         return -EMSGSIZE;
1699 }
1700
1701 static int nl80211_dump_station(struct sk_buff *skb,
1702                                 struct netlink_callback *cb)
1703 {
1704         struct station_info sinfo;
1705         struct cfg80211_registered_device *dev;
1706         struct net_device *netdev;
1707         u8 mac_addr[ETH_ALEN];
1708         int ifidx = cb->args[0];
1709         int sta_idx = cb->args[1];
1710         int err;
1711
1712         if (!ifidx) {
1713                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1714                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1715                                   nl80211_policy);
1716                 if (err)
1717                         return err;
1718
1719                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1720                         return -EINVAL;
1721
1722                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1723                 if (!ifidx)
1724                         return -EINVAL;
1725         }
1726
1727         rtnl_lock();
1728
1729         netdev = __dev_get_by_index(&init_net, ifidx);
1730         if (!netdev) {
1731                 err = -ENODEV;
1732                 goto out_rtnl;
1733         }
1734
1735         dev = cfg80211_get_dev_from_ifindex(ifidx);
1736         if (IS_ERR(dev)) {
1737                 err = PTR_ERR(dev);
1738                 goto out_rtnl;
1739         }
1740
1741         if (!dev->ops->dump_station) {
1742                 err = -EOPNOTSUPP;
1743                 goto out_err;
1744         }
1745
1746         while (1) {
1747                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1748                                              mac_addr, &sinfo);
1749                 if (err == -ENOENT)
1750                         break;
1751                 if (err)
1752                         goto out_err;
1753
1754                 if (nl80211_send_station(skb,
1755                                 NETLINK_CB(cb->skb).pid,
1756                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
1757                                 netdev, mac_addr,
1758                                 &sinfo) < 0)
1759                         goto out;
1760
1761                 sta_idx++;
1762         }
1763
1764
1765  out:
1766         cb->args[1] = sta_idx;
1767         err = skb->len;
1768  out_err:
1769         cfg80211_unlock_rdev(dev);
1770  out_rtnl:
1771         rtnl_unlock();
1772
1773         return err;
1774 }
1775
1776 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1777 {
1778         struct cfg80211_registered_device *rdev;
1779         int err;
1780         struct net_device *dev;
1781         struct station_info sinfo;
1782         struct sk_buff *msg;
1783         u8 *mac_addr = NULL;
1784
1785         memset(&sinfo, 0, sizeof(sinfo));
1786
1787         if (!info->attrs[NL80211_ATTR_MAC])
1788                 return -EINVAL;
1789
1790         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1791
1792         rtnl_lock();
1793
1794         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
1795         if (err)
1796                 goto out_rtnl;
1797
1798         if (!rdev->ops->get_station) {
1799                 err = -EOPNOTSUPP;
1800                 goto out;
1801         }
1802
1803         err = rdev->ops->get_station(&rdev->wiphy, dev, mac_addr, &sinfo);
1804         if (err)
1805                 goto out;
1806
1807         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1808         if (!msg)
1809                 goto out;
1810
1811         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1812                                  dev, mac_addr, &sinfo) < 0)
1813                 goto out_free;
1814
1815         err = genlmsg_reply(msg, info);
1816         goto out;
1817
1818  out_free:
1819         nlmsg_free(msg);
1820  out:
1821         cfg80211_unlock_rdev(rdev);
1822         dev_put(dev);
1823  out_rtnl:
1824         rtnl_unlock();
1825
1826         return err;
1827 }
1828
1829 /*
1830  * Get vlan interface making sure it is on the right wiphy.
1831  */
1832 static int get_vlan(struct nlattr *vlanattr,
1833                     struct cfg80211_registered_device *rdev,
1834                     struct net_device **vlan)
1835 {
1836         *vlan = NULL;
1837
1838         if (vlanattr) {
1839                 *vlan = dev_get_by_index(&init_net, nla_get_u32(vlanattr));
1840                 if (!*vlan)
1841                         return -ENODEV;
1842                 if (!(*vlan)->ieee80211_ptr)
1843                         return -EINVAL;
1844                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
1845                         return -EINVAL;
1846         }
1847         return 0;
1848 }
1849
1850 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
1851 {
1852         struct cfg80211_registered_device *rdev;
1853         int err;
1854         struct net_device *dev;
1855         struct station_parameters params;
1856         u8 *mac_addr = NULL;
1857
1858         memset(&params, 0, sizeof(params));
1859
1860         params.listen_interval = -1;
1861
1862         if (info->attrs[NL80211_ATTR_STA_AID])
1863                 return -EINVAL;
1864
1865         if (!info->attrs[NL80211_ATTR_MAC])
1866                 return -EINVAL;
1867
1868         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1869
1870         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
1871                 params.supported_rates =
1872                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1873                 params.supported_rates_len =
1874                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1875         }
1876
1877         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1878                 params.listen_interval =
1879                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1880
1881         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1882                 params.ht_capa =
1883                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1884
1885         if (parse_station_flags(info, &params))
1886                 return -EINVAL;
1887
1888         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
1889                 params.plink_action =
1890                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
1891
1892         rtnl_lock();
1893
1894         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
1895         if (err)
1896                 goto out_rtnl;
1897
1898         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], rdev, &params.vlan);
1899         if (err)
1900                 goto out;
1901
1902         /* validate settings */
1903         err = 0;
1904
1905         switch (dev->ieee80211_ptr->iftype) {
1906         case NL80211_IFTYPE_AP:
1907         case NL80211_IFTYPE_AP_VLAN:
1908                 /* disallow mesh-specific things */
1909                 if (params.plink_action)
1910                         err = -EINVAL;
1911                 break;
1912         case NL80211_IFTYPE_STATION:
1913                 /* disallow everything but AUTHORIZED flag */
1914                 if (params.plink_action)
1915                         err = -EINVAL;
1916                 if (params.vlan)
1917                         err = -EINVAL;
1918                 if (params.supported_rates)
1919                         err = -EINVAL;
1920                 if (params.ht_capa)
1921                         err = -EINVAL;
1922                 if (params.listen_interval >= 0)
1923                         err = -EINVAL;
1924                 if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
1925                         err = -EINVAL;
1926                 break;
1927         case NL80211_IFTYPE_MESH_POINT:
1928                 /* disallow things mesh doesn't support */
1929                 if (params.vlan)
1930                         err = -EINVAL;
1931                 if (params.ht_capa)
1932                         err = -EINVAL;
1933                 if (params.listen_interval >= 0)
1934                         err = -EINVAL;
1935                 if (params.supported_rates)
1936                         err = -EINVAL;
1937                 if (params.sta_flags_mask)
1938                         err = -EINVAL;
1939                 break;
1940         default:
1941                 err = -EINVAL;
1942         }
1943
1944         if (err)
1945                 goto out;
1946
1947         if (!rdev->ops->change_station) {
1948                 err = -EOPNOTSUPP;
1949                 goto out;
1950         }
1951
1952         err = rdev->ops->change_station(&rdev->wiphy, dev, mac_addr, &params);
1953
1954  out:
1955         if (params.vlan)
1956                 dev_put(params.vlan);
1957         cfg80211_unlock_rdev(rdev);
1958         dev_put(dev);
1959  out_rtnl:
1960         rtnl_unlock();
1961
1962         return err;
1963 }
1964
1965 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
1966 {
1967         struct cfg80211_registered_device *rdev;
1968         int err;
1969         struct net_device *dev;
1970         struct station_parameters params;
1971         u8 *mac_addr = NULL;
1972
1973         memset(&params, 0, sizeof(params));
1974
1975         if (!info->attrs[NL80211_ATTR_MAC])
1976                 return -EINVAL;
1977
1978         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1979                 return -EINVAL;
1980
1981         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
1982                 return -EINVAL;
1983
1984         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1985         params.supported_rates =
1986                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1987         params.supported_rates_len =
1988                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1989         params.listen_interval =
1990                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1991
1992         if (info->attrs[NL80211_ATTR_STA_AID]) {
1993                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
1994                 if (!params.aid || params.aid > IEEE80211_MAX_AID)
1995                         return -EINVAL;
1996         }
1997
1998         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1999                 params.ht_capa =
2000                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
2001
2002         if (parse_station_flags(info, &params))
2003                 return -EINVAL;
2004
2005         rtnl_lock();
2006
2007         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
2008         if (err)
2009                 goto out_rtnl;
2010
2011         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], rdev, &params.vlan);
2012         if (err)
2013                 goto out;
2014
2015         /* validate settings */
2016         err = 0;
2017
2018         switch (dev->ieee80211_ptr->iftype) {
2019         case NL80211_IFTYPE_AP:
2020         case NL80211_IFTYPE_AP_VLAN:
2021                 /* all ok but must have AID */
2022                 if (!params.aid)
2023                         err = -EINVAL;
2024                 break;
2025         case NL80211_IFTYPE_MESH_POINT:
2026                 /* disallow things mesh doesn't support */
2027                 if (params.vlan)
2028                         err = -EINVAL;
2029                 if (params.aid)
2030                         err = -EINVAL;
2031                 if (params.ht_capa)
2032                         err = -EINVAL;
2033                 if (params.listen_interval >= 0)
2034                         err = -EINVAL;
2035                 if (params.supported_rates)
2036                         err = -EINVAL;
2037                 if (params.sta_flags_mask)
2038                         err = -EINVAL;
2039                 break;
2040         default:
2041                 err = -EINVAL;
2042         }
2043
2044         if (err)
2045                 goto out;
2046
2047         if (!rdev->ops->add_station) {
2048                 err = -EOPNOTSUPP;
2049                 goto out;
2050         }
2051
2052         if (!netif_running(dev)) {
2053                 err = -ENETDOWN;
2054                 goto out;
2055         }
2056
2057         err = rdev->ops->add_station(&rdev->wiphy, dev, mac_addr, &params);
2058
2059  out:
2060         if (params.vlan)
2061                 dev_put(params.vlan);
2062         cfg80211_unlock_rdev(rdev);
2063         dev_put(dev);
2064  out_rtnl:
2065         rtnl_unlock();
2066
2067         return err;
2068 }
2069
2070 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
2071 {
2072         struct cfg80211_registered_device *rdev;
2073         int err;
2074         struct net_device *dev;
2075         u8 *mac_addr = NULL;
2076
2077         if (info->attrs[NL80211_ATTR_MAC])
2078                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2079
2080         rtnl_lock();
2081
2082         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
2083         if (err)
2084                 goto out_rtnl;
2085
2086         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2087             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
2088             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2089                 err = -EINVAL;
2090                 goto out;
2091         }
2092
2093         if (!rdev->ops->del_station) {
2094                 err = -EOPNOTSUPP;
2095                 goto out;
2096         }
2097
2098         err = rdev->ops->del_station(&rdev->wiphy, dev, mac_addr);
2099
2100  out:
2101         cfg80211_unlock_rdev(rdev);
2102         dev_put(dev);
2103  out_rtnl:
2104         rtnl_unlock();
2105
2106         return err;
2107 }
2108
2109 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
2110                                 int flags, struct net_device *dev,
2111                                 u8 *dst, u8 *next_hop,
2112                                 struct mpath_info *pinfo)
2113 {
2114         void *hdr;
2115         struct nlattr *pinfoattr;
2116
2117         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
2118         if (!hdr)
2119                 return -1;
2120
2121         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2122         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
2123         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
2124
2125         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
2126         if (!pinfoattr)
2127                 goto nla_put_failure;
2128         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
2129                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
2130                             pinfo->frame_qlen);
2131         if (pinfo->filled & MPATH_INFO_DSN)
2132                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DSN,
2133                             pinfo->dsn);
2134         if (pinfo->filled & MPATH_INFO_METRIC)
2135                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
2136                             pinfo->metric);
2137         if (pinfo->filled & MPATH_INFO_EXPTIME)
2138                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
2139                             pinfo->exptime);
2140         if (pinfo->filled & MPATH_INFO_FLAGS)
2141                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
2142                             pinfo->flags);
2143         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
2144                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
2145                             pinfo->discovery_timeout);
2146         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
2147                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
2148                             pinfo->discovery_retries);
2149
2150         nla_nest_end(msg, pinfoattr);
2151
2152         return genlmsg_end(msg, hdr);
2153
2154  nla_put_failure:
2155         genlmsg_cancel(msg, hdr);
2156         return -EMSGSIZE;
2157 }
2158
2159 static int nl80211_dump_mpath(struct sk_buff *skb,
2160                               struct netlink_callback *cb)
2161 {
2162         struct mpath_info pinfo;
2163         struct cfg80211_registered_device *dev;
2164         struct net_device *netdev;
2165         u8 dst[ETH_ALEN];
2166         u8 next_hop[ETH_ALEN];
2167         int ifidx = cb->args[0];
2168         int path_idx = cb->args[1];
2169         int err;
2170
2171         if (!ifidx) {
2172                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
2173                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
2174                                   nl80211_policy);
2175                 if (err)
2176                         return err;
2177
2178                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
2179                         return -EINVAL;
2180
2181                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
2182                 if (!ifidx)
2183                         return -EINVAL;
2184         }
2185
2186         rtnl_lock();
2187
2188         netdev = __dev_get_by_index(&init_net, ifidx);
2189         if (!netdev) {
2190                 err = -ENODEV;
2191                 goto out_rtnl;
2192         }
2193
2194         dev = cfg80211_get_dev_from_ifindex(ifidx);
2195         if (IS_ERR(dev)) {
2196                 err = PTR_ERR(dev);
2197                 goto out_rtnl;
2198         }
2199
2200         if (!dev->ops->dump_mpath) {
2201                 err = -EOPNOTSUPP;
2202                 goto out_err;
2203         }
2204
2205         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2206                 err = -EOPNOTSUPP;
2207                 goto out;
2208         }
2209
2210         while (1) {
2211                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
2212                                            dst, next_hop, &pinfo);
2213                 if (err == -ENOENT)
2214                         break;
2215                 if (err)
2216                         goto out_err;
2217
2218                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
2219                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
2220                                        netdev, dst, next_hop,
2221                                        &pinfo) < 0)
2222                         goto out;
2223
2224                 path_idx++;
2225         }
2226
2227
2228  out:
2229         cb->args[1] = path_idx;
2230         err = skb->len;
2231  out_err:
2232         cfg80211_unlock_rdev(dev);
2233  out_rtnl:
2234         rtnl_unlock();
2235
2236         return err;
2237 }
2238
2239 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
2240 {
2241         struct cfg80211_registered_device *rdev;
2242         int err;
2243         struct net_device *dev;
2244         struct mpath_info pinfo;
2245         struct sk_buff *msg;
2246         u8 *dst = NULL;
2247         u8 next_hop[ETH_ALEN];
2248
2249         memset(&pinfo, 0, sizeof(pinfo));
2250
2251         if (!info->attrs[NL80211_ATTR_MAC])
2252                 return -EINVAL;
2253
2254         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2255
2256         rtnl_lock();
2257
2258         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
2259         if (err)
2260                 goto out_rtnl;
2261
2262         if (!rdev->ops->get_mpath) {
2263                 err = -EOPNOTSUPP;
2264                 goto out;
2265         }
2266
2267         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2268                 err = -EOPNOTSUPP;
2269                 goto out;
2270         }
2271
2272         err = rdev->ops->get_mpath(&rdev->wiphy, dev, dst, next_hop, &pinfo);
2273         if (err)
2274                 goto out;
2275
2276         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2277         if (!msg)
2278                 goto out;
2279
2280         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2281                                  dev, dst, next_hop, &pinfo) < 0)
2282                 goto out_free;
2283
2284         err = genlmsg_reply(msg, info);
2285         goto out;
2286
2287  out_free:
2288         nlmsg_free(msg);
2289  out:
2290         cfg80211_unlock_rdev(rdev);
2291         dev_put(dev);
2292  out_rtnl:
2293         rtnl_unlock();
2294
2295         return err;
2296 }
2297
2298 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2299 {
2300         struct cfg80211_registered_device *rdev;
2301         int err;
2302         struct net_device *dev;
2303         u8 *dst = NULL;
2304         u8 *next_hop = NULL;
2305
2306         if (!info->attrs[NL80211_ATTR_MAC])
2307                 return -EINVAL;
2308
2309         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2310                 return -EINVAL;
2311
2312         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2313         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2314
2315         rtnl_lock();
2316
2317         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
2318         if (err)
2319                 goto out_rtnl;
2320
2321         if (!rdev->ops->change_mpath) {
2322                 err = -EOPNOTSUPP;
2323                 goto out;
2324         }
2325
2326         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2327                 err = -EOPNOTSUPP;
2328                 goto out;
2329         }
2330
2331         if (!netif_running(dev)) {
2332                 err = -ENETDOWN;
2333                 goto out;
2334         }
2335
2336         err = rdev->ops->change_mpath(&rdev->wiphy, dev, dst, next_hop);
2337
2338  out:
2339         cfg80211_unlock_rdev(rdev);
2340         dev_put(dev);
2341  out_rtnl:
2342         rtnl_unlock();
2343
2344         return err;
2345 }
2346 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2347 {
2348         struct cfg80211_registered_device *rdev;
2349         int err;
2350         struct net_device *dev;
2351         u8 *dst = NULL;
2352         u8 *next_hop = NULL;
2353
2354         if (!info->attrs[NL80211_ATTR_MAC])
2355                 return -EINVAL;
2356
2357         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2358                 return -EINVAL;
2359
2360         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2361         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2362
2363         rtnl_lock();
2364
2365         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
2366         if (err)
2367                 goto out_rtnl;
2368
2369         if (!rdev->ops->add_mpath) {
2370                 err = -EOPNOTSUPP;
2371                 goto out;
2372         }
2373
2374         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2375                 err = -EOPNOTSUPP;
2376                 goto out;
2377         }
2378
2379         if (!netif_running(dev)) {
2380                 err = -ENETDOWN;
2381                 goto out;
2382         }
2383
2384         err = rdev->ops->add_mpath(&rdev->wiphy, dev, dst, next_hop);
2385
2386  out:
2387         cfg80211_unlock_rdev(rdev);
2388         dev_put(dev);
2389  out_rtnl:
2390         rtnl_unlock();
2391
2392         return err;
2393 }
2394
2395 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2396 {
2397         struct cfg80211_registered_device *rdev;
2398         int err;
2399         struct net_device *dev;
2400         u8 *dst = NULL;
2401
2402         if (info->attrs[NL80211_ATTR_MAC])
2403                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2404
2405         rtnl_lock();
2406
2407         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
2408         if (err)
2409                 goto out_rtnl;
2410
2411         if (!rdev->ops->del_mpath) {
2412                 err = -EOPNOTSUPP;
2413                 goto out;
2414         }
2415
2416         err = rdev->ops->del_mpath(&rdev->wiphy, dev, dst);
2417
2418  out:
2419         cfg80211_unlock_rdev(rdev);
2420         dev_put(dev);
2421  out_rtnl:
2422         rtnl_unlock();
2423
2424         return err;
2425 }
2426
2427 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2428 {
2429         struct cfg80211_registered_device *rdev;
2430         int err;
2431         struct net_device *dev;
2432         struct bss_parameters params;
2433
2434         memset(&params, 0, sizeof(params));
2435         /* default to not changing parameters */
2436         params.use_cts_prot = -1;
2437         params.use_short_preamble = -1;
2438         params.use_short_slot_time = -1;
2439
2440         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2441                 params.use_cts_prot =
2442                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2443         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2444                 params.use_short_preamble =
2445                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2446         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2447                 params.use_short_slot_time =
2448                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2449         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2450                 params.basic_rates =
2451                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2452                 params.basic_rates_len =
2453                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2454         }
2455
2456         rtnl_lock();
2457
2458         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
2459         if (err)
2460                 goto out_rtnl;
2461
2462         if (!rdev->ops->change_bss) {
2463                 err = -EOPNOTSUPP;
2464                 goto out;
2465         }
2466
2467         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
2468                 err = -EOPNOTSUPP;
2469                 goto out;
2470         }
2471
2472         err = rdev->ops->change_bss(&rdev->wiphy, dev, &params);
2473
2474  out:
2475         cfg80211_unlock_rdev(rdev);
2476         dev_put(dev);
2477  out_rtnl:
2478         rtnl_unlock();
2479
2480         return err;
2481 }
2482
2483 static const struct nla_policy
2484         reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2485         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2486         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2487         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2488         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2489         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2490         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2491 };
2492
2493 static int parse_reg_rule(struct nlattr *tb[],
2494         struct ieee80211_reg_rule *reg_rule)
2495 {
2496         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2497         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2498
2499         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2500                 return -EINVAL;
2501         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2502                 return -EINVAL;
2503         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2504                 return -EINVAL;
2505         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2506                 return -EINVAL;
2507         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2508                 return -EINVAL;
2509
2510         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2511
2512         freq_range->start_freq_khz =
2513                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2514         freq_range->end_freq_khz =
2515                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2516         freq_range->max_bandwidth_khz =
2517                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2518
2519         power_rule->max_eirp =
2520                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2521
2522         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2523                 power_rule->max_antenna_gain =
2524                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2525
2526         return 0;
2527 }
2528
2529 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2530 {
2531         int r;
2532         char *data = NULL;
2533
2534         /*
2535          * You should only get this when cfg80211 hasn't yet initialized
2536          * completely when built-in to the kernel right between the time
2537          * window between nl80211_init() and regulatory_init(), if that is
2538          * even possible.
2539          */
2540         mutex_lock(&cfg80211_mutex);
2541         if (unlikely(!cfg80211_regdomain)) {
2542                 mutex_unlock(&cfg80211_mutex);
2543                 return -EINPROGRESS;
2544         }
2545         mutex_unlock(&cfg80211_mutex);
2546
2547         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2548                 return -EINVAL;
2549
2550         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2551
2552 #ifdef CONFIG_WIRELESS_OLD_REGULATORY
2553         /* We ignore world regdom requests with the old regdom setup */
2554         if (is_world_regdom(data))
2555                 return -EINVAL;
2556 #endif
2557
2558         r = regulatory_hint_user(data);
2559
2560         return r;
2561 }
2562
2563 static int nl80211_get_mesh_params(struct sk_buff *skb,
2564         struct genl_info *info)
2565 {
2566         struct cfg80211_registered_device *rdev;
2567         struct mesh_config cur_params;
2568         int err;
2569         struct net_device *dev;
2570         void *hdr;
2571         struct nlattr *pinfoattr;
2572         struct sk_buff *msg;
2573
2574         rtnl_lock();
2575
2576         /* Look up our device */
2577         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
2578         if (err)
2579                 goto out_rtnl;
2580
2581         if (!rdev->ops->get_mesh_params) {
2582                 err = -EOPNOTSUPP;
2583                 goto out;
2584         }
2585
2586         /* Get the mesh params */
2587         err = rdev->ops->get_mesh_params(&rdev->wiphy, dev, &cur_params);
2588         if (err)
2589                 goto out;
2590
2591         /* Draw up a netlink message to send back */
2592         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2593         if (!msg) {
2594                 err = -ENOBUFS;
2595                 goto out;
2596         }
2597         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2598                              NL80211_CMD_GET_MESH_PARAMS);
2599         if (!hdr)
2600                 goto nla_put_failure;
2601         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
2602         if (!pinfoattr)
2603                 goto nla_put_failure;
2604         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2605         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2606                         cur_params.dot11MeshRetryTimeout);
2607         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2608                         cur_params.dot11MeshConfirmTimeout);
2609         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2610                         cur_params.dot11MeshHoldingTimeout);
2611         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2612                         cur_params.dot11MeshMaxPeerLinks);
2613         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2614                         cur_params.dot11MeshMaxRetries);
2615         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2616                         cur_params.dot11MeshTTL);
2617         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2618                         cur_params.auto_open_plinks);
2619         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2620                         cur_params.dot11MeshHWMPmaxPREQretries);
2621         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2622                         cur_params.path_refresh_time);
2623         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2624                         cur_params.min_discovery_timeout);
2625         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2626                         cur_params.dot11MeshHWMPactivePathTimeout);
2627         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2628                         cur_params.dot11MeshHWMPpreqMinInterval);
2629         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2630                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2631         nla_nest_end(msg, pinfoattr);
2632         genlmsg_end(msg, hdr);
2633         err = genlmsg_reply(msg, info);
2634         goto out;
2635
2636  nla_put_failure:
2637         genlmsg_cancel(msg, hdr);
2638         err = -EMSGSIZE;
2639  out:
2640         /* Cleanup */
2641         cfg80211_unlock_rdev(rdev);
2642         dev_put(dev);
2643  out_rtnl:
2644         rtnl_unlock();
2645
2646         return err;
2647 }
2648
2649 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2650 do {\
2651         if (table[attr_num]) {\
2652                 cfg.param = nla_fn(table[attr_num]); \
2653                 mask |= (1 << (attr_num - 1)); \
2654         } \
2655 } while (0);\
2656
2657 static struct nla_policy
2658 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] __read_mostly = {
2659         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2660         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2661         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2662         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2663         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2664         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2665         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2666
2667         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2668         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2669         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2670         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2671         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2672         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2673 };
2674
2675 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2676 {
2677         int err;
2678         u32 mask;
2679         struct cfg80211_registered_device *rdev;
2680         struct net_device *dev;
2681         struct mesh_config cfg;
2682         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2683         struct nlattr *parent_attr;
2684
2685         parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
2686         if (!parent_attr)
2687                 return -EINVAL;
2688         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2689                         parent_attr, nl80211_meshconf_params_policy))
2690                 return -EINVAL;
2691
2692         rtnl_lock();
2693
2694         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
2695         if (err)
2696                 goto out_rtnl;
2697
2698         if (!rdev->ops->set_mesh_params) {
2699                 err = -EOPNOTSUPP;
2700                 goto out;
2701         }
2702
2703         /* This makes sure that there aren't more than 32 mesh config
2704          * parameters (otherwise our bitfield scheme would not work.) */
2705         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2706
2707         /* Fill in the params struct */
2708         mask = 0;
2709         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2710                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2711         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2712                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2713         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2714                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2715         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2716                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2717         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2718                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2719         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2720                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2721         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2722                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2723         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2724                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2725                         nla_get_u8);
2726         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2727                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2728         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2729                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2730                         nla_get_u16);
2731         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2732                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2733                         nla_get_u32);
2734         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2735                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2736                         nla_get_u16);
2737         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2738                         dot11MeshHWMPnetDiameterTraversalTime,
2739                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2740                         nla_get_u16);
2741
2742         /* Apply changes */
2743         err = rdev->ops->set_mesh_params(&rdev->wiphy, dev, &cfg, mask);
2744
2745  out:
2746         /* cleanup */
2747         cfg80211_unlock_rdev(rdev);
2748         dev_put(dev);
2749  out_rtnl:
2750         rtnl_unlock();
2751
2752         return err;
2753 }
2754
2755 #undef FILL_IN_MESH_PARAM_IF_SET
2756
2757 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2758 {
2759         struct sk_buff *msg;
2760         void *hdr = NULL;
2761         struct nlattr *nl_reg_rules;
2762         unsigned int i;
2763         int err = -EINVAL;
2764
2765         mutex_lock(&cfg80211_mutex);
2766
2767         if (!cfg80211_regdomain)
2768                 goto out;
2769
2770         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2771         if (!msg) {
2772                 err = -ENOBUFS;
2773                 goto out;
2774         }
2775
2776         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2777                              NL80211_CMD_GET_REG);
2778         if (!hdr)
2779                 goto nla_put_failure;
2780
2781         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2782                 cfg80211_regdomain->alpha2);
2783
2784         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2785         if (!nl_reg_rules)
2786                 goto nla_put_failure;
2787
2788         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2789                 struct nlattr *nl_reg_rule;
2790                 const struct ieee80211_reg_rule *reg_rule;
2791                 const struct ieee80211_freq_range *freq_range;
2792                 const struct ieee80211_power_rule *power_rule;
2793
2794                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2795                 freq_range = &reg_rule->freq_range;
2796                 power_rule = &reg_rule->power_rule;
2797
2798                 nl_reg_rule = nla_nest_start(msg, i);
2799                 if (!nl_reg_rule)
2800                         goto nla_put_failure;
2801
2802                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2803                         reg_rule->flags);
2804                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2805                         freq_range->start_freq_khz);
2806                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2807                         freq_range->end_freq_khz);
2808                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2809                         freq_range->max_bandwidth_khz);
2810                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2811                         power_rule->max_antenna_gain);
2812                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2813                         power_rule->max_eirp);
2814
2815                 nla_nest_end(msg, nl_reg_rule);
2816         }
2817
2818         nla_nest_end(msg, nl_reg_rules);
2819
2820         genlmsg_end(msg, hdr);
2821         err = genlmsg_reply(msg, info);
2822         goto out;
2823
2824 nla_put_failure:
2825         genlmsg_cancel(msg, hdr);
2826         err = -EMSGSIZE;
2827 out:
2828         mutex_unlock(&cfg80211_mutex);
2829         return err;
2830 }
2831
2832 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2833 {
2834         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2835         struct nlattr *nl_reg_rule;
2836         char *alpha2 = NULL;
2837         int rem_reg_rules = 0, r = 0;
2838         u32 num_rules = 0, rule_idx = 0, size_of_regd;
2839         struct ieee80211_regdomain *rd = NULL;
2840
2841         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2842                 return -EINVAL;
2843
2844         if (!info->attrs[NL80211_ATTR_REG_RULES])
2845                 return -EINVAL;
2846
2847         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2848
2849         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2850                         rem_reg_rules) {
2851                 num_rules++;
2852                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2853                         return -EINVAL;
2854         }
2855
2856         mutex_lock(&cfg80211_mutex);
2857
2858         if (!reg_is_valid_request(alpha2)) {
2859                 r = -EINVAL;
2860                 goto bad_reg;
2861         }
2862
2863         size_of_regd = sizeof(struct ieee80211_regdomain) +
2864                 (num_rules * sizeof(struct ieee80211_reg_rule));
2865
2866         rd = kzalloc(size_of_regd, GFP_KERNEL);
2867         if (!rd) {
2868                 r = -ENOMEM;
2869                 goto bad_reg;
2870         }
2871
2872         rd->n_reg_rules = num_rules;
2873         rd->alpha2[0] = alpha2[0];
2874         rd->alpha2[1] = alpha2[1];
2875
2876         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2877                         rem_reg_rules) {
2878                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2879                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2880                         reg_rule_policy);
2881                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2882                 if (r)
2883                         goto bad_reg;
2884
2885                 rule_idx++;
2886
2887                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
2888                         r = -EINVAL;
2889                         goto bad_reg;
2890                 }
2891         }
2892
2893         BUG_ON(rule_idx != num_rules);
2894
2895         r = set_regdom(rd);
2896
2897         mutex_unlock(&cfg80211_mutex);
2898
2899         return r;
2900
2901  bad_reg:
2902         mutex_unlock(&cfg80211_mutex);
2903         kfree(rd);
2904         return r;
2905 }
2906
2907 static int validate_scan_freqs(struct nlattr *freqs)
2908 {
2909         struct nlattr *attr1, *attr2;
2910         int n_channels = 0, tmp1, tmp2;
2911
2912         nla_for_each_nested(attr1, freqs, tmp1) {
2913                 n_channels++;
2914                 /*
2915                  * Some hardware has a limited channel list for
2916                  * scanning, and it is pretty much nonsensical
2917                  * to scan for a channel twice, so disallow that
2918                  * and don't require drivers to check that the
2919                  * channel list they get isn't longer than what
2920                  * they can scan, as long as they can scan all
2921                  * the channels they registered at once.
2922                  */
2923                 nla_for_each_nested(attr2, freqs, tmp2)
2924                         if (attr1 != attr2 &&
2925                             nla_get_u32(attr1) == nla_get_u32(attr2))
2926                                 return 0;
2927         }
2928
2929         return n_channels;
2930 }
2931
2932 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
2933 {
2934         struct cfg80211_registered_device *rdev;
2935         struct net_device *dev;
2936         struct cfg80211_scan_request *request;
2937         struct cfg80211_ssid *ssid;
2938         struct ieee80211_channel *channel;
2939         struct nlattr *attr;
2940         struct wiphy *wiphy;
2941         int err, tmp, n_ssids = 0, n_channels, i;
2942         enum ieee80211_band band;
2943         size_t ie_len;
2944
2945         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2946                 return -EINVAL;
2947
2948         rtnl_lock();
2949
2950         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
2951         if (err)
2952                 goto out_rtnl;
2953
2954         wiphy = &rdev->wiphy;
2955
2956         if (!rdev->ops->scan) {
2957                 err = -EOPNOTSUPP;
2958                 goto out;
2959         }
2960
2961         if (!netif_running(dev)) {
2962                 err = -ENETDOWN;
2963                 goto out;
2964         }
2965
2966         if (rdev->scan_req) {
2967                 err = -EBUSY;
2968                 goto out;
2969         }
2970
2971         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2972                 n_channels = validate_scan_freqs(
2973                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
2974                 if (!n_channels) {
2975                         err = -EINVAL;
2976                         goto out;
2977                 }
2978         } else {
2979                 n_channels = 0;
2980
2981                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
2982                         if (wiphy->bands[band])
2983                                 n_channels += wiphy->bands[band]->n_channels;
2984         }
2985
2986         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
2987                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
2988                         n_ssids++;
2989
2990         if (n_ssids > wiphy->max_scan_ssids) {
2991                 err = -EINVAL;
2992                 goto out;
2993         }
2994
2995         if (info->attrs[NL80211_ATTR_IE])
2996                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2997         else
2998                 ie_len = 0;
2999
3000         if (ie_len > wiphy->max_scan_ie_len) {
3001                 err = -EINVAL;
3002                 goto out;
3003         }
3004
3005         request = kzalloc(sizeof(*request)
3006                         + sizeof(*ssid) * n_ssids
3007                         + sizeof(channel) * n_channels
3008                         + ie_len, GFP_KERNEL);
3009         if (!request) {
3010                 err = -ENOMEM;
3011                 goto out;
3012         }
3013
3014         request->channels = (void *)((char *)request + sizeof(*request));
3015         request->n_channels = n_channels;
3016         if (n_ssids)
3017                 request->ssids = (void *)(request->channels + n_channels);
3018         request->n_ssids = n_ssids;
3019         if (ie_len) {
3020                 if (request->ssids)
3021                         request->ie = (void *)(request->ssids + n_ssids);
3022                 else
3023                         request->ie = (void *)(request->channels + n_channels);
3024         }
3025
3026         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
3027                 /* user specified, bail out if channel not found */
3028                 request->n_channels = n_channels;
3029                 i = 0;
3030                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
3031                         request->channels[i] = ieee80211_get_channel(wiphy, nla_get_u32(attr));
3032                         if (!request->channels[i]) {
3033                                 err = -EINVAL;
3034                                 goto out_free;
3035                         }
3036                         i++;
3037                 }
3038         } else {
3039                 /* all channels */
3040                 i = 0;
3041                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
3042                         int j;
3043                         if (!wiphy->bands[band])
3044                                 continue;
3045                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
3046                                 request->channels[i] = &wiphy->bands[band]->channels[j];
3047                                 i++;
3048                         }
3049                 }
3050         }
3051
3052         i = 0;
3053         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
3054                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
3055                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
3056                                 err = -EINVAL;
3057                                 goto out_free;
3058                         }
3059                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
3060                         request->ssids[i].ssid_len = nla_len(attr);
3061                         i++;
3062                 }
3063         }
3064
3065         if (info->attrs[NL80211_ATTR_IE]) {
3066                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3067                 memcpy((void *)request->ie,
3068                        nla_data(info->attrs[NL80211_ATTR_IE]),
3069                        request->ie_len);
3070         }
3071
3072         request->ifidx = dev->ifindex;
3073         request->wiphy = &rdev->wiphy;
3074
3075         rdev->scan_req = request;
3076         err = rdev->ops->scan(&rdev->wiphy, dev, request);
3077
3078         if (!err)
3079                 nl80211_send_scan_start(rdev, dev);
3080
3081  out_free:
3082         if (err) {
3083                 rdev->scan_req = NULL;
3084                 kfree(request);
3085         }
3086  out:
3087         cfg80211_unlock_rdev(rdev);
3088         dev_put(dev);
3089  out_rtnl:
3090         rtnl_unlock();
3091
3092         return err;
3093 }
3094
3095 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
3096                             struct cfg80211_registered_device *rdev,
3097                             struct net_device *dev,
3098                             struct cfg80211_bss *res)
3099 {
3100         void *hdr;
3101         struct nlattr *bss;
3102
3103         hdr = nl80211hdr_put(msg, pid, seq, flags,
3104                              NL80211_CMD_NEW_SCAN_RESULTS);
3105         if (!hdr)
3106                 return -1;
3107
3108         NLA_PUT_U32(msg, NL80211_ATTR_SCAN_GENERATION,
3109                     rdev->bss_generation);
3110         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
3111
3112         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
3113         if (!bss)
3114                 goto nla_put_failure;
3115         if (!is_zero_ether_addr(res->bssid))
3116                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
3117         if (res->information_elements && res->len_information_elements)
3118                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
3119                         res->len_information_elements,
3120                         res->information_elements);
3121         if (res->tsf)
3122                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
3123         if (res->beacon_interval)
3124                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
3125         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
3126         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
3127
3128         switch (rdev->wiphy.signal_type) {
3129         case CFG80211_SIGNAL_TYPE_MBM:
3130                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
3131                 break;
3132         case CFG80211_SIGNAL_TYPE_UNSPEC:
3133                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
3134                 break;
3135         default:
3136                 break;
3137         }
3138
3139         nla_nest_end(msg, bss);
3140
3141         return genlmsg_end(msg, hdr);
3142
3143  nla_put_failure:
3144         genlmsg_cancel(msg, hdr);
3145         return -EMSGSIZE;
3146 }
3147
3148 static int nl80211_dump_scan(struct sk_buff *skb,
3149                              struct netlink_callback *cb)
3150 {
3151         struct cfg80211_registered_device *dev;
3152         struct net_device *netdev;
3153         struct cfg80211_internal_bss *scan;
3154         int ifidx = cb->args[0];
3155         int start = cb->args[1], idx = 0;
3156         int err;
3157
3158         if (!ifidx) {
3159                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
3160                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
3161                                   nl80211_policy);
3162                 if (err)
3163                         return err;
3164
3165                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
3166                         return -EINVAL;
3167
3168                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
3169                 if (!ifidx)
3170                         return -EINVAL;
3171                 cb->args[0] = ifidx;
3172         }
3173
3174         netdev = dev_get_by_index(&init_net, ifidx);
3175         if (!netdev)
3176                 return -ENODEV;
3177
3178         dev = cfg80211_get_dev_from_ifindex(ifidx);
3179         if (IS_ERR(dev)) {
3180                 err = PTR_ERR(dev);
3181                 goto out_put_netdev;
3182         }
3183
3184         spin_lock_bh(&dev->bss_lock);
3185         cfg80211_bss_expire(dev);
3186
3187         list_for_each_entry(scan, &dev->bss_list, list) {
3188                 if (++idx <= start)
3189                         continue;
3190                 if (nl80211_send_bss(skb,
3191                                 NETLINK_CB(cb->skb).pid,
3192                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3193                                 dev, netdev, &scan->pub) < 0) {
3194                         idx--;
3195                         goto out;
3196                 }
3197         }
3198
3199  out:
3200         spin_unlock_bh(&dev->bss_lock);
3201
3202         cb->args[1] = idx;
3203         err = skb->len;
3204         cfg80211_unlock_rdev(dev);
3205  out_put_netdev:
3206         dev_put(netdev);
3207
3208         return err;
3209 }
3210
3211 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
3212 {
3213         return auth_type <= NL80211_AUTHTYPE_MAX;
3214 }
3215
3216 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
3217 {
3218         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
3219                                   NL80211_WPA_VERSION_2));
3220 }
3221
3222 static bool nl80211_valid_akm_suite(u32 akm)
3223 {
3224         return akm == WLAN_AKM_SUITE_8021X ||
3225                 akm == WLAN_AKM_SUITE_PSK;
3226 }
3227
3228 static bool nl80211_valid_cipher_suite(u32 cipher)
3229 {
3230         return cipher == WLAN_CIPHER_SUITE_WEP40 ||
3231                 cipher == WLAN_CIPHER_SUITE_WEP104 ||
3232                 cipher == WLAN_CIPHER_SUITE_TKIP ||
3233                 cipher == WLAN_CIPHER_SUITE_CCMP ||
3234                 cipher == WLAN_CIPHER_SUITE_AES_CMAC;
3235 }
3236
3237
3238 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
3239 {
3240         struct cfg80211_registered_device *rdev;
3241         struct net_device *dev;
3242         struct ieee80211_channel *chan;
3243         const u8 *bssid, *ssid, *ie = NULL;
3244         int err, ssid_len, ie_len = 0;
3245         enum nl80211_auth_type auth_type;
3246         struct key_parse key;
3247
3248         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3249                 return -EINVAL;
3250
3251         if (!info->attrs[NL80211_ATTR_MAC])
3252                 return -EINVAL;
3253
3254         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
3255                 return -EINVAL;
3256
3257         if (!info->attrs[NL80211_ATTR_SSID])
3258                 return -EINVAL;
3259
3260         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
3261                 return -EINVAL;
3262
3263         err = nl80211_parse_key(info, &key);
3264         if (err)
3265                 return err;
3266
3267         if (key.idx >= 0) {
3268                 if (!key.p.key || !key.p.key_len)
3269                         return -EINVAL;
3270                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
3271                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
3272                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
3273                      key.p.key_len != WLAN_KEY_LEN_WEP104))
3274                         return -EINVAL;
3275                 if (key.idx > 4)
3276                         return -EINVAL;
3277         } else {
3278                 key.p.key_len = 0;
3279                 key.p.key = NULL;
3280         }
3281
3282         rtnl_lock();
3283
3284         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
3285         if (err)
3286                 goto unlock_rtnl;
3287
3288         if (!rdev->ops->auth) {
3289                 err = -EOPNOTSUPP;
3290                 goto out;
3291         }
3292
3293         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3294                 err = -EOPNOTSUPP;
3295                 goto out;
3296         }
3297
3298         if (!netif_running(dev)) {
3299                 err = -ENETDOWN;
3300                 goto out;
3301         }
3302
3303         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3304         chan = ieee80211_get_channel(&rdev->wiphy,
3305                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3306         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED)) {
3307                 err = -EINVAL;
3308                 goto out;
3309         }
3310
3311         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3312         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3313
3314         if (info->attrs[NL80211_ATTR_IE]) {
3315                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3316                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3317         }
3318
3319         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
3320         if (!nl80211_valid_auth_type(auth_type)) {
3321                 err = -EINVAL;
3322                 goto out;
3323         }
3324
3325         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
3326                                  ssid, ssid_len, ie, ie_len,
3327                                  key.p.key, key.p.key_len, key.idx);
3328
3329 out:
3330         cfg80211_unlock_rdev(rdev);
3331         dev_put(dev);
3332 unlock_rtnl:
3333         rtnl_unlock();
3334         return err;
3335 }
3336
3337 static int nl80211_crypto_settings(struct genl_info *info,
3338                                    struct cfg80211_crypto_settings *settings,
3339                                    int cipher_limit)
3340 {
3341         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
3342
3343         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
3344                 void *data;
3345                 int len, i;
3346
3347                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3348                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
3349                 settings->n_ciphers_pairwise = len / sizeof(u32);
3350
3351                 if (len % sizeof(u32))
3352                         return -EINVAL;
3353
3354                 if (settings->n_ciphers_pairwise > cipher_limit)
3355                         return -EINVAL;
3356
3357                 memcpy(settings->ciphers_pairwise, data, len);
3358
3359                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3360                         if (!nl80211_valid_cipher_suite(
3361                                         settings->ciphers_pairwise[i]))
3362                                 return -EINVAL;
3363         }
3364
3365         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
3366                 settings->cipher_group =
3367                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
3368                 if (!nl80211_valid_cipher_suite(settings->cipher_group))
3369                         return -EINVAL;
3370         }
3371
3372         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
3373                 settings->wpa_versions =
3374                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
3375                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
3376                         return -EINVAL;
3377         }
3378
3379         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
3380                 void *data;
3381                 int len, i;
3382
3383                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
3384                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
3385                 settings->n_akm_suites = len / sizeof(u32);
3386
3387                 if (len % sizeof(u32))
3388                         return -EINVAL;
3389
3390                 memcpy(settings->akm_suites, data, len);
3391
3392                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
3393                         if (!nl80211_valid_akm_suite(settings->akm_suites[i]))
3394                                 return -EINVAL;
3395         }
3396
3397         return 0;
3398 }
3399
3400 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
3401 {
3402         struct cfg80211_registered_device *rdev;
3403         struct net_device *dev;
3404         struct cfg80211_crypto_settings crypto;
3405         struct ieee80211_channel *chan;
3406         const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
3407         int err, ssid_len, ie_len = 0;
3408         bool use_mfp = false;
3409
3410         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3411                 return -EINVAL;
3412
3413         if (!info->attrs[NL80211_ATTR_MAC] ||
3414             !info->attrs[NL80211_ATTR_SSID] ||
3415             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
3416                 return -EINVAL;
3417
3418         rtnl_lock();
3419
3420         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
3421         if (err)
3422                 goto unlock_rtnl;
3423
3424         if (!rdev->ops->assoc) {
3425                 err = -EOPNOTSUPP;
3426                 goto out;
3427         }
3428
3429         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3430                 err = -EOPNOTSUPP;
3431                 goto out;
3432         }
3433
3434         if (!netif_running(dev)) {
3435                 err = -ENETDOWN;
3436                 goto out;
3437         }
3438
3439         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3440
3441         chan = ieee80211_get_channel(&rdev->wiphy,
3442                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3443         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED)) {
3444                 err = -EINVAL;
3445                 goto out;
3446         }
3447
3448         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3449         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3450
3451         if (info->attrs[NL80211_ATTR_IE]) {
3452                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3453                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3454         }
3455
3456         if (info->attrs[NL80211_ATTR_USE_MFP]) {
3457                 enum nl80211_mfp mfp =
3458                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
3459                 if (mfp == NL80211_MFP_REQUIRED)
3460                         use_mfp = true;
3461                 else if (mfp != NL80211_MFP_NO) {
3462                         err = -EINVAL;
3463                         goto out;
3464                 }
3465         }
3466
3467         if (info->attrs[NL80211_ATTR_PREV_BSSID])
3468                 prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
3469
3470         err = nl80211_crypto_settings(info, &crypto, 1);
3471         if (!err)
3472                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
3473                                           ssid, ssid_len, ie, ie_len, use_mfp,
3474                                           &crypto);
3475
3476 out:
3477         cfg80211_unlock_rdev(rdev);
3478         dev_put(dev);
3479 unlock_rtnl:
3480         rtnl_unlock();
3481         return err;
3482 }
3483
3484 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
3485 {
3486         struct cfg80211_registered_device *rdev;
3487         struct net_device *dev;
3488         const u8 *ie = NULL, *bssid;
3489         int err, ie_len = 0;
3490         u16 reason_code;
3491
3492         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3493                 return -EINVAL;
3494
3495         if (!info->attrs[NL80211_ATTR_MAC])
3496                 return -EINVAL;
3497
3498         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3499                 return -EINVAL;
3500
3501         rtnl_lock();
3502
3503         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
3504         if (err)
3505                 goto unlock_rtnl;
3506
3507         if (!rdev->ops->deauth) {
3508                 err = -EOPNOTSUPP;
3509                 goto out;
3510         }
3511
3512         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3513                 err = -EOPNOTSUPP;
3514                 goto out;
3515         }
3516
3517         if (!netif_running(dev)) {
3518                 err = -ENETDOWN;
3519                 goto out;
3520         }
3521
3522         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3523
3524         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3525         if (reason_code == 0) {
3526                 /* Reason Code 0 is reserved */
3527                 err = -EINVAL;
3528                 goto out;
3529         }
3530
3531         if (info->attrs[NL80211_ATTR_IE]) {
3532                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3533                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3534         }
3535
3536         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code);
3537
3538 out:
3539         cfg80211_unlock_rdev(rdev);
3540         dev_put(dev);
3541 unlock_rtnl:
3542         rtnl_unlock();
3543         return err;
3544 }
3545
3546 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
3547 {
3548         struct cfg80211_registered_device *rdev;
3549         struct net_device *dev;
3550         const u8 *ie = NULL, *bssid;
3551         int err, ie_len = 0;
3552         u16 reason_code;
3553
3554         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3555                 return -EINVAL;
3556
3557         if (!info->attrs[NL80211_ATTR_MAC])
3558                 return -EINVAL;
3559
3560         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3561                 return -EINVAL;
3562
3563         rtnl_lock();
3564
3565         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
3566         if (err)
3567                 goto unlock_rtnl;
3568
3569         if (!rdev->ops->disassoc) {
3570                 err = -EOPNOTSUPP;
3571                 goto out;
3572         }
3573
3574         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3575                 err = -EOPNOTSUPP;
3576                 goto out;
3577         }
3578
3579         if (!netif_running(dev)) {
3580                 err = -ENETDOWN;
3581                 goto out;
3582         }
3583
3584         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3585
3586         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3587         if (reason_code == 0) {
3588                 /* Reason Code 0 is reserved */
3589                 err = -EINVAL;
3590                 goto out;
3591         }
3592
3593         if (info->attrs[NL80211_ATTR_IE]) {
3594                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3595                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3596         }
3597
3598         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code);
3599
3600 out:
3601         cfg80211_unlock_rdev(rdev);
3602         dev_put(dev);
3603 unlock_rtnl:
3604         rtnl_unlock();
3605         return err;
3606 }
3607
3608 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
3609 {
3610         struct cfg80211_registered_device *rdev;
3611         struct net_device *dev;
3612         struct cfg80211_ibss_params ibss;
3613         struct wiphy *wiphy;
3614         struct cfg80211_cached_keys *connkeys = NULL;
3615         int err;
3616
3617         memset(&ibss, 0, sizeof(ibss));
3618
3619         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3620                 return -EINVAL;
3621
3622         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
3623             !info->attrs[NL80211_ATTR_SSID] ||
3624             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3625                 return -EINVAL;
3626
3627         ibss.beacon_interval = 100;
3628
3629         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
3630                 ibss.beacon_interval =
3631                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3632                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
3633                         return -EINVAL;
3634         }
3635
3636         rtnl_lock();
3637
3638         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
3639         if (err)
3640                 goto unlock_rtnl;
3641
3642         if (!rdev->ops->join_ibss) {
3643                 err = -EOPNOTSUPP;
3644                 goto out;
3645         }
3646
3647         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3648                 err = -EOPNOTSUPP;
3649                 goto out;
3650         }
3651
3652         if (!netif_running(dev)) {
3653                 err = -ENETDOWN;
3654                 goto out;
3655         }
3656
3657         wiphy = &rdev->wiphy;
3658
3659         if (info->attrs[NL80211_ATTR_MAC])
3660                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3661         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3662         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3663
3664         if (info->attrs[NL80211_ATTR_IE]) {
3665                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3666                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3667         }
3668
3669         ibss.channel = ieee80211_get_channel(wiphy,
3670                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3671         if (!ibss.channel ||
3672             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
3673             ibss.channel->flags & IEEE80211_CHAN_DISABLED) {
3674                 err = -EINVAL;
3675                 goto out;
3676         }
3677
3678         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
3679         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3680
3681         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
3682                 connkeys = nl80211_parse_connkeys(rdev,
3683                                         info->attrs[NL80211_ATTR_KEYS]);
3684                 if (IS_ERR(connkeys)) {
3685                         err = PTR_ERR(connkeys);
3686                         connkeys = NULL;
3687                         goto out;
3688                 }
3689         }
3690
3691         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
3692
3693 out:
3694         cfg80211_unlock_rdev(rdev);
3695         dev_put(dev);
3696 unlock_rtnl:
3697         if (err)
3698                 kfree(connkeys);
3699         rtnl_unlock();
3700         return err;
3701 }
3702
3703 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
3704 {
3705         struct cfg80211_registered_device *rdev;
3706         struct net_device *dev;
3707         int err;
3708
3709         rtnl_lock();
3710
3711         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
3712         if (err)
3713                 goto unlock_rtnl;
3714
3715         if (!rdev->ops->leave_ibss) {
3716                 err = -EOPNOTSUPP;
3717                 goto out;
3718         }
3719
3720         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3721                 err = -EOPNOTSUPP;
3722                 goto out;
3723         }
3724
3725         if (!netif_running(dev)) {
3726                 err = -ENETDOWN;
3727                 goto out;
3728         }
3729
3730         err = cfg80211_leave_ibss(rdev, dev, false);
3731
3732 out:
3733         cfg80211_unlock_rdev(rdev);
3734         dev_put(dev);
3735 unlock_rtnl:
3736         rtnl_unlock();
3737         return err;
3738 }
3739
3740 #ifdef CONFIG_NL80211_TESTMODE
3741 static struct genl_multicast_group nl80211_testmode_mcgrp = {
3742         .name = "testmode",
3743 };
3744
3745 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
3746 {
3747         struct cfg80211_registered_device *rdev;
3748         int err;
3749
3750         if (!info->attrs[NL80211_ATTR_TESTDATA])
3751                 return -EINVAL;
3752
3753         rtnl_lock();
3754
3755         rdev = cfg80211_get_dev_from_info(info);
3756         if (IS_ERR(rdev)) {
3757                 err = PTR_ERR(rdev);
3758                 goto unlock_rtnl;
3759         }
3760
3761         err = -EOPNOTSUPP;
3762         if (rdev->ops->testmode_cmd) {
3763                 rdev->testmode_info = info;
3764                 err = rdev->ops->testmode_cmd(&rdev->wiphy,
3765                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
3766                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
3767                 rdev->testmode_info = NULL;
3768         }
3769
3770         cfg80211_unlock_rdev(rdev);
3771
3772  unlock_rtnl:
3773         rtnl_unlock();
3774         return err;
3775 }
3776
3777 static struct sk_buff *
3778 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
3779                               int approxlen, u32 pid, u32 seq, gfp_t gfp)
3780 {
3781         struct sk_buff *skb;
3782         void *hdr;
3783         struct nlattr *data;
3784
3785         skb = nlmsg_new(approxlen + 100, gfp);
3786         if (!skb)
3787                 return NULL;
3788
3789         hdr = nl80211hdr_put(skb, pid, seq, 0, NL80211_CMD_TESTMODE);
3790         if (!hdr) {
3791                 kfree_skb(skb);
3792                 return NULL;
3793         }
3794
3795         NLA_PUT_U32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3796         data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
3797
3798         ((void **)skb->cb)[0] = rdev;
3799         ((void **)skb->cb)[1] = hdr;
3800         ((void **)skb->cb)[2] = data;
3801
3802         return skb;
3803
3804  nla_put_failure:
3805         kfree_skb(skb);
3806         return NULL;
3807 }
3808
3809 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
3810                                                   int approxlen)
3811 {
3812         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
3813
3814         if (WARN_ON(!rdev->testmode_info))
3815                 return NULL;
3816
3817         return __cfg80211_testmode_alloc_skb(rdev, approxlen,
3818                                 rdev->testmode_info->snd_pid,
3819                                 rdev->testmode_info->snd_seq,
3820                                 GFP_KERNEL);
3821 }
3822 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
3823
3824 int cfg80211_testmode_reply(struct sk_buff *skb)
3825 {
3826         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
3827         void *hdr = ((void **)skb->cb)[1];
3828         struct nlattr *data = ((void **)skb->cb)[2];
3829
3830         if (WARN_ON(!rdev->testmode_info)) {
3831                 kfree_skb(skb);
3832                 return -EINVAL;
3833         }
3834
3835         nla_nest_end(skb, data);
3836         genlmsg_end(skb, hdr);
3837         return genlmsg_reply(skb, rdev->testmode_info);
3838 }
3839 EXPORT_SYMBOL(cfg80211_testmode_reply);
3840
3841 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
3842                                                   int approxlen, gfp_t gfp)
3843 {
3844         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
3845
3846         return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
3847 }
3848 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
3849
3850 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
3851 {
3852         void *hdr = ((void **)skb->cb)[1];
3853         struct nlattr *data = ((void **)skb->cb)[2];
3854
3855         nla_nest_end(skb, data);
3856         genlmsg_end(skb, hdr);
3857         genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
3858 }
3859 EXPORT_SYMBOL(cfg80211_testmode_event);
3860 #endif
3861
3862 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
3863 {
3864         struct cfg80211_registered_device *rdev;
3865         struct net_device *dev;
3866         struct cfg80211_connect_params connect;
3867         struct wiphy *wiphy;
3868         struct cfg80211_cached_keys *connkeys = NULL;
3869         int err;
3870
3871         memset(&connect, 0, sizeof(connect));
3872
3873         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3874                 return -EINVAL;
3875
3876         if (!info->attrs[NL80211_ATTR_SSID] ||
3877             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3878                 return -EINVAL;
3879
3880         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3881                 connect.auth_type =
3882                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
3883                 if (!nl80211_valid_auth_type(connect.auth_type))
3884                         return -EINVAL;
3885         } else
3886                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3887
3888         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
3889
3890         err = nl80211_crypto_settings(info, &connect.crypto,
3891                                       NL80211_MAX_NR_CIPHER_SUITES);
3892         if (err)
3893                 return err;
3894         rtnl_lock();
3895
3896         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
3897         if (err)
3898                 goto unlock_rtnl;
3899
3900         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3901                 err = -EOPNOTSUPP;
3902                 goto out;
3903         }
3904
3905         if (!netif_running(dev)) {
3906                 err = -ENETDOWN;
3907                 goto out;
3908         }
3909
3910         wiphy = &rdev->wiphy;
3911
3912         if (info->attrs[NL80211_ATTR_MAC])
3913                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3914         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3915         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3916
3917         if (info->attrs[NL80211_ATTR_IE]) {
3918                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3919                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3920         }
3921
3922         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3923                 connect.channel =
3924                         ieee80211_get_channel(wiphy,
3925                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3926                 if (!connect.channel ||
3927                     connect.channel->flags & IEEE80211_CHAN_DISABLED) {
3928                         err = -EINVAL;
3929                         goto out;
3930                 }
3931         }
3932
3933         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
3934                 connkeys = nl80211_parse_connkeys(rdev,
3935                                         info->attrs[NL80211_ATTR_KEYS]);
3936                 if (IS_ERR(connkeys)) {
3937                         err = PTR_ERR(connkeys);
3938                         connkeys = NULL;
3939                         goto out;
3940                 }
3941         }
3942
3943         err = cfg80211_connect(rdev, dev, &connect, connkeys);
3944
3945 out:
3946         cfg80211_unlock_rdev(rdev);
3947         dev_put(dev);
3948 unlock_rtnl:
3949         if (err)
3950                 kfree(connkeys);
3951         rtnl_unlock();
3952         return err;
3953 }
3954
3955 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
3956 {
3957         struct cfg80211_registered_device *rdev;
3958         struct net_device *dev;
3959         int err;
3960         u16 reason;
3961
3962         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3963                 reason = WLAN_REASON_DEAUTH_LEAVING;
3964         else
3965                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3966
3967         if (reason == 0)
3968                 return -EINVAL;
3969
3970         rtnl_lock();
3971
3972         err = get_rdev_dev_by_info_ifindex(info->attrs, &rdev, &dev);
3973         if (err)
3974                 goto unlock_rtnl;
3975
3976         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3977                 err = -EOPNOTSUPP;
3978                 goto out;
3979         }
3980
3981         if (!netif_running(dev)) {
3982                 err = -ENETDOWN;
3983                 goto out;
3984         }
3985
3986         err = cfg80211_disconnect(rdev, dev, reason, true);
3987
3988 out:
3989         cfg80211_unlock_rdev(rdev);
3990         dev_put(dev);
3991 unlock_rtnl:
3992         rtnl_unlock();
3993         return err;
3994 }
3995
3996 static struct genl_ops nl80211_ops[] = {
3997         {
3998                 .cmd = NL80211_CMD_GET_WIPHY,
3999                 .doit = nl80211_get_wiphy,
4000                 .dumpit = nl80211_dump_wiphy,
4001                 .policy = nl80211_policy,
4002                 /* can be retrieved by unprivileged users */
4003         },
4004         {
4005                 .cmd = NL80211_CMD_SET_WIPHY,
4006                 .doit = nl80211_set_wiphy,
4007                 .policy = nl80211_policy,
4008                 .flags = GENL_ADMIN_PERM,
4009         },
4010         {
4011                 .cmd = NL80211_CMD_GET_INTERFACE,
4012                 .doit = nl80211_get_interface,
4013                 .dumpit = nl80211_dump_interface,
4014                 .policy = nl80211_policy,
4015                 /* can be retrieved by unprivileged users */
4016         },
4017         {
4018                 .cmd = NL80211_CMD_SET_INTERFACE,
4019                 .doit = nl80211_set_interface,
4020                 .policy = nl80211_policy,
4021                 .flags = GENL_ADMIN_PERM,
4022         },
4023         {
4024                 .cmd = NL80211_CMD_NEW_INTERFACE,
4025                 .doit = nl80211_new_interface,
4026                 .policy = nl80211_policy,
4027                 .flags = GENL_ADMIN_PERM,
4028         },
4029         {
4030                 .cmd = NL80211_CMD_DEL_INTERFACE,
4031                 .doit = nl80211_del_interface,
4032                 .policy = nl80211_policy,
4033                 .flags = GENL_ADMIN_PERM,
4034         },
4035         {
4036                 .cmd = NL80211_CMD_GET_KEY,
4037                 .doit = nl80211_get_key,
4038                 .policy = nl80211_policy,
4039                 .flags = GENL_ADMIN_PERM,
4040         },
4041         {
4042                 .cmd = NL80211_CMD_SET_KEY,
4043                 .doit = nl80211_set_key,
4044                 .policy = nl80211_policy,
4045                 .flags = GENL_ADMIN_PERM,
4046         },
4047         {
4048                 .cmd = NL80211_CMD_NEW_KEY,
4049                 .doit = nl80211_new_key,
4050                 .policy = nl80211_policy,
4051                 .flags = GENL_ADMIN_PERM,
4052         },
4053         {
4054                 .cmd = NL80211_CMD_DEL_KEY,
4055                 .doit = nl80211_del_key,
4056                 .policy = nl80211_policy,
4057                 .flags = GENL_ADMIN_PERM,
4058         },
4059         {
4060                 .cmd = NL80211_CMD_SET_BEACON,
4061                 .policy = nl80211_policy,
4062                 .flags = GENL_ADMIN_PERM,
4063                 .doit = nl80211_addset_beacon,
4064         },
4065         {
4066                 .cmd = NL80211_CMD_NEW_BEACON,
4067                 .policy = nl80211_policy,
4068                 .flags = GENL_ADMIN_PERM,
4069                 .doit = nl80211_addset_beacon,
4070         },
4071         {
4072                 .cmd = NL80211_CMD_DEL_BEACON,
4073                 .policy = nl80211_policy,
4074                 .flags = GENL_ADMIN_PERM,
4075                 .doit = nl80211_del_beacon,
4076         },
4077         {
4078                 .cmd = NL80211_CMD_GET_STATION,
4079                 .doit = nl80211_get_station,
4080                 .dumpit = nl80211_dump_station,
4081                 .policy = nl80211_policy,
4082         },
4083         {
4084                 .cmd = NL80211_CMD_SET_STATION,
4085                 .doit = nl80211_set_station,
4086                 .policy = nl80211_policy,
4087                 .flags = GENL_ADMIN_PERM,
4088         },
4089         {
4090                 .cmd = NL80211_CMD_NEW_STATION,
4091                 .doit = nl80211_new_station,
4092                 .policy = nl80211_policy,
4093                 .flags = GENL_ADMIN_PERM,
4094         },
4095         {
4096                 .cmd = NL80211_CMD_DEL_STATION,
4097                 .doit = nl80211_del_station,
4098                 .policy = nl80211_policy,
4099                 .flags = GENL_ADMIN_PERM,
4100         },
4101         {
4102                 .cmd = NL80211_CMD_GET_MPATH,
4103                 .doit = nl80211_get_mpath,
4104                 .dumpit = nl80211_dump_mpath,
4105                 .policy = nl80211_policy,
4106                 .flags = GENL_ADMIN_PERM,
4107         },
4108         {
4109                 .cmd = NL80211_CMD_SET_MPATH,
4110                 .doit = nl80211_set_mpath,
4111                 .policy = nl80211_policy,
4112                 .flags = GENL_ADMIN_PERM,
4113         },
4114         {
4115                 .cmd = NL80211_CMD_NEW_MPATH,
4116                 .doit = nl80211_new_mpath,
4117                 .policy = nl80211_policy,
4118                 .flags = GENL_ADMIN_PERM,
4119         },
4120         {
4121                 .cmd = NL80211_CMD_DEL_MPATH,
4122                 .doit = nl80211_del_mpath,
4123                 .policy = nl80211_policy,
4124                 .flags = GENL_ADMIN_PERM,
4125         },
4126         {
4127                 .cmd = NL80211_CMD_SET_BSS,
4128                 .doit = nl80211_set_bss,
4129                 .policy = nl80211_policy,
4130                 .flags = GENL_ADMIN_PERM,
4131         },
4132         {
4133                 .cmd = NL80211_CMD_GET_REG,
4134                 .doit = nl80211_get_reg,
4135                 .policy = nl80211_policy,
4136                 /* can be retrieved by unprivileged users */
4137         },
4138         {
4139                 .cmd = NL80211_CMD_SET_REG,
4140                 .doit = nl80211_set_reg,
4141                 .policy = nl80211_policy,
4142                 .flags = GENL_ADMIN_PERM,
4143         },
4144         {
4145                 .cmd = NL80211_CMD_REQ_SET_REG,
4146                 .doit = nl80211_req_set_reg,
4147                 .policy = nl80211_policy,
4148                 .flags = GENL_ADMIN_PERM,
4149         },
4150         {
4151                 .cmd = NL80211_CMD_GET_MESH_PARAMS,
4152                 .doit = nl80211_get_mesh_params,
4153                 .policy = nl80211_policy,
4154                 /* can be retrieved by unprivileged users */
4155         },
4156         {
4157                 .cmd = NL80211_CMD_SET_MESH_PARAMS,
4158                 .doit = nl80211_set_mesh_params,
4159                 .policy = nl80211_policy,
4160                 .flags = GENL_ADMIN_PERM,
4161         },
4162         {
4163                 .cmd = NL80211_CMD_TRIGGER_SCAN,
4164                 .doit = nl80211_trigger_scan,
4165                 .policy = nl80211_policy,
4166                 .flags = GENL_ADMIN_PERM,
4167         },
4168         {
4169                 .cmd = NL80211_CMD_GET_SCAN,
4170                 .policy = nl80211_policy,
4171                 .dumpit = nl80211_dump_scan,
4172         },
4173         {
4174                 .cmd = NL80211_CMD_AUTHENTICATE,
4175                 .doit = nl80211_authenticate,
4176                 .policy = nl80211_policy,
4177                 .flags = GENL_ADMIN_PERM,
4178         },
4179         {
4180                 .cmd = NL80211_CMD_ASSOCIATE,
4181                 .doit = nl80211_associate,
4182                 .policy = nl80211_policy,
4183                 .flags = GENL_ADMIN_PERM,
4184         },
4185         {
4186                 .cmd = NL80211_CMD_DEAUTHENTICATE,
4187                 .doit = nl80211_deauthenticate,
4188                 .policy = nl80211_policy,
4189                 .flags = GENL_ADMIN_PERM,
4190         },
4191         {
4192                 .cmd = NL80211_CMD_DISASSOCIATE,
4193                 .doit = nl80211_disassociate,
4194                 .policy = nl80211_policy,
4195                 .flags = GENL_ADMIN_PERM,
4196         },
4197         {
4198                 .cmd = NL80211_CMD_JOIN_IBSS,
4199                 .doit = nl80211_join_ibss,
4200                 .policy = nl80211_policy,
4201                 .flags = GENL_ADMIN_PERM,
4202         },
4203         {
4204                 .cmd = NL80211_CMD_LEAVE_IBSS,
4205                 .doit = nl80211_leave_ibss,
4206                 .policy = nl80211_policy,
4207                 .flags = GENL_ADMIN_PERM,
4208         },
4209 #ifdef CONFIG_NL80211_TESTMODE
4210         {
4211                 .cmd = NL80211_CMD_TESTMODE,
4212                 .doit = nl80211_testmode_do,
4213                 .policy = nl80211_policy,
4214                 .flags = GENL_ADMIN_PERM,
4215         },
4216 #endif
4217         {
4218                 .cmd = NL80211_CMD_CONNECT,
4219                 .doit = nl80211_connect,
4220                 .policy = nl80211_policy,
4221                 .flags = GENL_ADMIN_PERM,
4222         },
4223         {
4224                 .cmd = NL80211_CMD_DISCONNECT,
4225                 .doit = nl80211_disconnect,
4226                 .policy = nl80211_policy,
4227                 .flags = GENL_ADMIN_PERM,
4228         },
4229 };
4230 static struct genl_multicast_group nl80211_mlme_mcgrp = {
4231         .name = "mlme",
4232 };
4233
4234 /* multicast groups */
4235 static struct genl_multicast_group nl80211_config_mcgrp = {
4236         .name = "config",
4237 };
4238 static struct genl_multicast_group nl80211_scan_mcgrp = {
4239         .name = "scan",
4240 };
4241 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
4242         .name = "regulatory",
4243 };
4244
4245 /* notification functions */
4246
4247 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
4248 {
4249         struct sk_buff *msg;
4250
4251         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4252         if (!msg)
4253                 return;
4254
4255         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
4256                 nlmsg_free(msg);
4257                 return;
4258         }
4259
4260         genlmsg_multicast(msg, 0, nl80211_config_mcgrp.id, GFP_KERNEL);
4261 }
4262
4263 static int nl80211_add_scan_req(struct sk_buff *msg,
4264                                 struct cfg80211_registered_device *rdev)
4265 {
4266         struct cfg80211_scan_request *req = rdev->scan_req;
4267         struct nlattr *nest;
4268         int i;
4269
4270         ASSERT_RDEV_LOCK(rdev);
4271
4272         if (WARN_ON(!req))
4273                 return 0;
4274
4275         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
4276         if (!nest)
4277                 goto nla_put_failure;
4278         for (i = 0; i < req->n_ssids; i++)
4279                 NLA_PUT(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid);
4280         nla_nest_end(msg, nest);
4281
4282         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
4283         if (!nest)
4284                 goto nla_put_failure;
4285         for (i = 0; i < req->n_channels; i++)
4286                 NLA_PUT_U32(msg, i, req->channels[i]->center_freq);
4287         nla_nest_end(msg, nest);
4288
4289         if (req->ie)
4290                 NLA_PUT(msg, NL80211_ATTR_IE, req->ie_len, req->ie);
4291
4292         return 0;
4293  nla_put_failure:
4294         return -ENOBUFS;
4295 }
4296
4297 static int nl80211_send_scan_msg(struct sk_buff *msg,
4298                                  struct cfg80211_registered_device *rdev,
4299                                  struct net_device *netdev,
4300                                  u32 pid, u32 seq, int flags,
4301                                  u32 cmd)
4302 {
4303         void *hdr;
4304
4305         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
4306         if (!hdr)
4307                 return -1;
4308
4309         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4310         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4311
4312         /* ignore errors and send incomplete event anyway */
4313         nl80211_add_scan_req(msg, rdev);
4314
4315         return genlmsg_end(msg, hdr);
4316
4317  nla_put_failure:
4318         genlmsg_cancel(msg, hdr);
4319         return -EMSGSIZE;
4320 }
4321
4322 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
4323                              struct net_device *netdev)
4324 {
4325         struct sk_buff *msg;
4326
4327         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
4328         if (!msg)
4329                 return;
4330
4331         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
4332                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
4333                 nlmsg_free(msg);
4334                 return;
4335         }
4336
4337         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
4338 }
4339
4340 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
4341                             struct net_device *netdev)
4342 {
4343         struct sk_buff *msg;
4344
4345         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4346         if (!msg)
4347                 return;
4348
4349         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
4350                                   NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
4351                 nlmsg_free(msg);
4352                 return;
4353         }
4354
4355         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
4356 }
4357
4358 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
4359                                struct net_device *netdev)
4360 {
4361         struct sk_buff *msg;
4362
4363         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4364         if (!msg)
4365                 return;
4366
4367         if (nl80211_send_scan_msg(msg, rdev, netdev, 0, 0, 0,
4368                                   NL80211_CMD_SCAN_ABORTED) < 0) {
4369                 nlmsg_free(msg);
4370                 return;
4371         }
4372
4373         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
4374 }
4375
4376 /*
4377  * This can happen on global regulatory changes or device specific settings
4378  * based on custom world regulatory domains.
4379  */
4380 void nl80211_send_reg_change_event(struct regulatory_request *request)
4381 {
4382         struct sk_buff *msg;
4383         void *hdr;
4384
4385         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4386         if (!msg)
4387                 return;
4388
4389         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
4390         if (!hdr) {
4391                 nlmsg_free(msg);
4392                 return;
4393         }
4394
4395         /* Userspace can always count this one always being set */
4396         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
4397
4398         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
4399                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
4400                            NL80211_REGDOM_TYPE_WORLD);
4401         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
4402                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
4403                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
4404         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
4405                  request->intersect)
4406                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
4407                            NL80211_REGDOM_TYPE_INTERSECTION);
4408         else {
4409                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
4410                            NL80211_REGDOM_TYPE_COUNTRY);
4411                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
4412         }
4413
4414         if (wiphy_idx_valid(request->wiphy_idx))
4415                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
4416
4417         if (genlmsg_end(msg, hdr) < 0) {
4418                 nlmsg_free(msg);
4419                 return;
4420         }
4421
4422         genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_KERNEL);
4423
4424         return;
4425
4426 nla_put_failure:
4427         genlmsg_cancel(msg, hdr);
4428         nlmsg_free(msg);
4429 }
4430
4431 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
4432                                     struct net_device *netdev,
4433                                     const u8 *buf, size_t len,
4434                                     enum nl80211_commands cmd, gfp_t gfp)
4435 {
4436         struct sk_buff *msg;
4437         void *hdr;
4438
4439         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
4440         if (!msg)
4441                 return;
4442
4443         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
4444         if (!hdr) {
4445                 nlmsg_free(msg);
4446                 return;
4447         }
4448
4449         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4450         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4451         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
4452
4453         if (genlmsg_end(msg, hdr) < 0) {
4454                 nlmsg_free(msg);
4455                 return;
4456         }
4457
4458         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
4459         return;
4460
4461  nla_put_failure:
4462         genlmsg_cancel(msg, hdr);
4463         nlmsg_free(msg);
4464 }
4465
4466 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
4467                           struct net_device *netdev, const u8 *buf,
4468                           size_t len, gfp_t gfp)
4469 {
4470         nl80211_send_mlme_event(rdev, netdev, buf, len,
4471                                 NL80211_CMD_AUTHENTICATE, gfp);
4472 }
4473
4474 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
4475                            struct net_device *netdev, const u8 *buf,
4476                            size_t len, gfp_t gfp)
4477 {
4478         nl80211_send_mlme_event(rdev, netdev, buf, len,
4479                                 NL80211_CMD_ASSOCIATE, gfp);
4480 }
4481
4482 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
4483                          struct net_device *netdev, const u8 *buf,
4484                          size_t len, gfp_t gfp)
4485 {
4486         nl80211_send_mlme_event(rdev, netdev, buf, len,
4487                                 NL80211_CMD_DEAUTHENTICATE, gfp);
4488 }
4489
4490 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
4491                            struct net_device *netdev, const u8 *buf,
4492                            size_t len, gfp_t gfp)
4493 {
4494         nl80211_send_mlme_event(rdev, netdev, buf, len,
4495                                 NL80211_CMD_DISASSOCIATE, gfp);
4496 }
4497
4498 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
4499                                       struct net_device *netdev, int cmd,
4500                                       const u8 *addr, gfp_t gfp)
4501 {
4502         struct sk_buff *msg;
4503         void *hdr;
4504
4505         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
4506         if (!msg)
4507                 return;
4508
4509         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
4510         if (!hdr) {
4511                 nlmsg_free(msg);
4512                 return;
4513         }
4514
4515         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4516         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4517         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
4518         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
4519
4520         if (genlmsg_end(msg, hdr) < 0) {
4521                 nlmsg_free(msg);
4522                 return;
4523         }
4524
4525         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
4526         return;
4527
4528  nla_put_failure:
4529         genlmsg_cancel(msg, hdr);
4530         nlmsg_free(msg);
4531 }
4532
4533 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
4534                                struct net_device *netdev, const u8 *addr,
4535                                gfp_t gfp)
4536 {
4537         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
4538                                   addr, gfp);
4539 }
4540
4541 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
4542                                 struct net_device *netdev, const u8 *addr,
4543                                 gfp_t gfp)
4544 {
4545         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
4546                                   addr, gfp);
4547 }
4548
4549 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
4550                                  struct net_device *netdev, const u8 *bssid,
4551                                  const u8 *req_ie, size_t req_ie_len,
4552                                  const u8 *resp_ie, size_t resp_ie_len,
4553                                  u16 status, gfp_t gfp)
4554 {
4555         struct sk_buff *msg;
4556         void *hdr;
4557
4558         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
4559         if (!msg)
4560                 return;
4561
4562         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
4563         if (!hdr) {
4564                 nlmsg_free(msg);
4565                 return;
4566         }
4567
4568         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4569         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4570         if (bssid)
4571                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
4572         NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status);
4573         if (req_ie)
4574                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
4575         if (resp_ie)
4576                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
4577
4578         if (genlmsg_end(msg, hdr) < 0) {
4579                 nlmsg_free(msg);
4580                 return;
4581         }
4582
4583         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
4584         return;
4585
4586  nla_put_failure:
4587         genlmsg_cancel(msg, hdr);
4588         nlmsg_free(msg);
4589
4590 }
4591
4592 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
4593                          struct net_device *netdev, const u8 *bssid,
4594                          const u8 *req_ie, size_t req_ie_len,
4595                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
4596 {
4597         struct sk_buff *msg;
4598         void *hdr;
4599
4600         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
4601         if (!msg)
4602                 return;
4603
4604         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
4605         if (!hdr) {
4606                 nlmsg_free(msg);
4607                 return;
4608         }
4609
4610         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4611         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4612         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
4613         if (req_ie)
4614                 NLA_PUT(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie);
4615         if (resp_ie)
4616                 NLA_PUT(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie);
4617
4618         if (genlmsg_end(msg, hdr) < 0) {
4619                 nlmsg_free(msg);
4620                 return;
4621         }
4622
4623         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
4624         return;
4625
4626  nla_put_failure:
4627         genlmsg_cancel(msg, hdr);
4628         nlmsg_free(msg);
4629
4630 }
4631
4632 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
4633                                struct net_device *netdev, u16 reason,
4634                                const u8 *ie, size_t ie_len, bool from_ap)
4635 {
4636         struct sk_buff *msg;
4637         void *hdr;
4638
4639         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
4640         if (!msg)
4641                 return;
4642
4643         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
4644         if (!hdr) {
4645                 nlmsg_free(msg);
4646                 return;
4647         }
4648
4649         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4650         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4651         if (from_ap && reason)
4652                 NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason);
4653         if (from_ap)
4654                 NLA_PUT_FLAG(msg, NL80211_ATTR_DISCONNECTED_BY_AP);
4655         if (ie)
4656                 NLA_PUT(msg, NL80211_ATTR_IE, ie_len, ie);
4657
4658         if (genlmsg_end(msg, hdr) < 0) {
4659                 nlmsg_free(msg);
4660                 return;
4661         }
4662
4663         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_KERNEL);
4664         return;
4665
4666  nla_put_failure:
4667         genlmsg_cancel(msg, hdr);
4668         nlmsg_free(msg);
4669
4670 }
4671
4672 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
4673                              struct net_device *netdev, const u8 *bssid,
4674                              gfp_t gfp)
4675 {
4676         struct sk_buff *msg;
4677         void *hdr;
4678
4679         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
4680         if (!msg)
4681                 return;
4682
4683         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
4684         if (!hdr) {
4685                 nlmsg_free(msg);
4686                 return;
4687         }
4688
4689         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4690         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4691         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
4692
4693         if (genlmsg_end(msg, hdr) < 0) {
4694                 nlmsg_free(msg);
4695                 return;
4696         }
4697
4698         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
4699         return;
4700
4701  nla_put_failure:
4702         genlmsg_cancel(msg, hdr);
4703         nlmsg_free(msg);
4704 }
4705
4706 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
4707                                  struct net_device *netdev, const u8 *addr,
4708                                  enum nl80211_key_type key_type, int key_id,
4709                                  const u8 *tsc, gfp_t gfp)
4710 {
4711         struct sk_buff *msg;
4712         void *hdr;
4713
4714         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
4715         if (!msg)
4716                 return;
4717
4718         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
4719         if (!hdr) {
4720                 nlmsg_free(msg);
4721                 return;
4722         }
4723
4724         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
4725         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
4726         if (addr)
4727                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
4728         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
4729         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
4730         if (tsc)
4731                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
4732
4733         if (genlmsg_end(msg, hdr) < 0) {
4734                 nlmsg_free(msg);
4735                 return;
4736         }
4737
4738         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
4739         return;
4740
4741  nla_put_failure:
4742         genlmsg_cancel(msg, hdr);
4743         nlmsg_free(msg);
4744 }
4745
4746 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
4747                                     struct ieee80211_channel *channel_before,
4748                                     struct ieee80211_channel *channel_after)
4749 {
4750         struct sk_buff *msg;
4751         void *hdr;
4752         struct nlattr *nl_freq;
4753
4754         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
4755         if (!msg)
4756                 return;
4757
4758         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
4759         if (!hdr) {
4760                 nlmsg_free(msg);
4761                 return;
4762         }
4763
4764         /*
4765          * Since we are applying the beacon hint to a wiphy we know its
4766          * wiphy_idx is valid
4767          */
4768         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
4769
4770         /* Before */
4771         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
4772         if (!nl_freq)
4773                 goto nla_put_failure;
4774         if (nl80211_msg_put_channel(msg, channel_before))
4775                 goto nla_put_failure;
4776         nla_nest_end(msg, nl_freq);
4777
4778         /* After */
4779         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
4780         if (!nl_freq)
4781                 goto nla_put_failure;
4782         if (nl80211_msg_put_channel(msg, channel_after))
4783                 goto nla_put_failure;
4784         nla_nest_end(msg, nl_freq);
4785
4786         if (genlmsg_end(msg, hdr) < 0) {
4787                 nlmsg_free(msg);
4788                 return;
4789         }
4790
4791         genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_ATOMIC);
4792
4793         return;
4794
4795 nla_put_failure:
4796         genlmsg_cancel(msg, hdr);
4797         nlmsg_free(msg);
4798 }
4799
4800 /* initialisation/exit functions */
4801
4802 int nl80211_init(void)
4803 {
4804         int err;
4805
4806         err = genl_register_family_with_ops(&nl80211_fam,
4807                 nl80211_ops, ARRAY_SIZE(nl80211_ops));
4808         if (err)
4809                 return err;
4810
4811         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
4812         if (err)
4813                 goto err_out;
4814
4815         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
4816         if (err)
4817                 goto err_out;
4818
4819         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
4820         if (err)
4821                 goto err_out;
4822
4823         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
4824         if (err)
4825                 goto err_out;
4826
4827 #ifdef CONFIG_NL80211_TESTMODE
4828         err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
4829         if (err)
4830                 goto err_out;
4831 #endif
4832
4833         return 0;
4834  err_out:
4835         genl_unregister_family(&nl80211_fam);
4836         return err;
4837 }
4838
4839 void nl80211_exit(void)
4840 {
4841         genl_unregister_family(&nl80211_fam);
4842 }