net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006, 2007 Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/list.h>
  11 #include <linux/if_ether.h>
  12 #include <linux/ieee80211.h>
  13 #include <linux/nl80211.h>
  14 #include <linux/rtnetlink.h>
  15 #include <linux/netlink.h>
  16 #include <linux/etherdevice.h>
  17 #include <net/genetlink.h>
  18 #include <net/cfg80211.h>
  19 #include "core.h"
  20 #include "nl80211.h"
  21 #include "reg.h"
  22
  23 /* the netlink family */
  24 static struct genl_family nl80211_fam = {
  25         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  26         .name = "nl80211",      /* have users key off the name instead */
  27         .hdrsize = 0,           /* no private header */
  28         .version = 1,           /* no particular meaning now */
  29         .maxattr = NL80211_ATTR_MAX,
  30 };
  31
  32 /* internal helper: get drv and dev */
  33 static int get_drv_dev_by_info_ifindex(struct nlattr **attrs,
  34                                        struct cfg80211_registered_device **drv,
  35                                        struct net_device **dev)
  36 {
  37         int ifindex;
  38
  39         if (!attrs[NL80211_ATTR_IFINDEX])
  40                 return -EINVAL;
  41
  42         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  43         *dev = dev_get_by_index(&init_net, ifindex);
  44         if (!*dev)
  45                 return -ENODEV;
  46
  47         *drv = cfg80211_get_dev_from_ifindex(ifindex);
  48         if (IS_ERR(*drv)) {
  49                 dev_put(*dev);
  50                 return PTR_ERR(*drv);
  51         }
  52
  53         return 0;
  54 }
  55
  56 /* policy for the attributes */
  57 static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
  58         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  59         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  60                                       .len = BUS_ID_SIZE-1 },
  61         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  62         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  63         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  64
  65         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  66         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  67         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  68
  69         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  70
  71         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  72                                     .len = WLAN_MAX_KEY_LEN },
  73         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  74         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  75         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
  76
  77         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
  78         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
  79         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
  80                                        .len = IEEE80211_MAX_DATA_LEN },
  81         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
  82                                        .len = IEEE80211_MAX_DATA_LEN },
  83         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
  84         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
  85         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
  86         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
  87                                                .len = NL80211_MAX_SUPP_RATES },
  88         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
  89         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
  90         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
  91         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
  92                                 .len = IEEE80211_MAX_MESH_ID_LEN },
  93         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
  94
  95         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
  96         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
  97
  98         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
  99         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 100         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 101         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 102                                            .len = NL80211_MAX_SUPP_RATES },
 103
 104         [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
 105
 106         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 107                                          .len = NL80211_HT_CAPABILITY_LEN },
 108
 109         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 110         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 111                               .len = IEEE80211_MAX_DATA_LEN },
 112         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 113         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 114
 115         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 116                                 .len = IEEE80211_MAX_SSID_LEN },
 117         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 118         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 119 };
 120
 121 /* IE validation */
 122 static bool is_valid_ie_attr(const struct nlattr *attr)
 123 {
 124         const u8 *pos;
 125         int len;
 126
 127         if (!attr)
 128                 return true;
 129
 130         pos = nla_data(attr);
 131         len = nla_len(attr);
 132
 133         while (len) {
 134                 u8 elemlen;
 135
 136                 if (len < 2)
 137                         return false;
 138                 len -= 2;
 139
 140                 elemlen = pos[1];
 141                 if (elemlen > len)
 142                         return false;
 143
 144                 len -= elemlen;
 145                 pos += 2 + elemlen;
 146         }
 147
 148         return true;
 149 }
 150
 151 /* message building helper */
 152 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 153                                    int flags, u8 cmd)
 154 {
 155         /* since there is no private header just add the generic one */
 156         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 157 }
 158
 159 /* netlink command implementations */
 160
 161 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 162                               struct cfg80211_registered_device *dev)
 163 {
 164         void *hdr;
 165         struct nlattr *nl_bands, *nl_band;
 166         struct nlattr *nl_freqs, *nl_freq;
 167         struct nlattr *nl_rates, *nl_rate;
 168         struct nlattr *nl_modes;
 169         struct nlattr *nl_cmds;
 170         enum ieee80211_band band;
 171         struct ieee80211_channel *chan;
 172         struct ieee80211_rate *rate;
 173         int i;
 174         u16 ifmodes = dev->wiphy.interface_modes;
 175
 176         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 177         if (!hdr)
 178                 return -1;
 179
 180         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 181         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 182         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 183                    dev->wiphy.max_scan_ssids);
 184
 185         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
 186         if (!nl_modes)
 187                 goto nla_put_failure;
 188
 189         i = 0;
 190         while (ifmodes) {
 191                 if (ifmodes & 1)
 192                         NLA_PUT_FLAG(msg, i);
 193                 ifmodes >>= 1;
 194                 i++;
 195         }
 196
 197         nla_nest_end(msg, nl_modes);
 198
 199         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 200         if (!nl_bands)
 201                 goto nla_put_failure;
 202
 203         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 204                 if (!dev->wiphy.bands[band])
 205                         continue;
 206
 207                 nl_band = nla_nest_start(msg, band);
 208                 if (!nl_band)
 209                         goto nla_put_failure;
 210
 211                 /* add HT info */
 212                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 213                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 214                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 215                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 216                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 217                                 dev->wiphy.bands[band]->ht_cap.cap);
 218                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 219                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 220                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 221                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 222                 }
 223
 224                 /* add frequencies */
 225                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 226                 if (!nl_freqs)
 227                         goto nla_put_failure;
 228
 229                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 230                         nl_freq = nla_nest_start(msg, i);
 231                         if (!nl_freq)
 232                                 goto nla_put_failure;
 233
 234                         chan = &dev->wiphy.bands[band]->channels[i];
 235                         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 236                                     chan->center_freq);
 237
 238                         if (chan->flags & IEEE80211_CHAN_DISABLED)
 239                                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 240                         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 241                                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 242                         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 243                                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 244                         if (chan->flags & IEEE80211_CHAN_RADAR)
 245                                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 246
 247                         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 248                                     DBM_TO_MBM(chan->max_power));
 249
 250                         nla_nest_end(msg, nl_freq);
 251                 }
 252
 253                 nla_nest_end(msg, nl_freqs);
 254
 255                 /* add bitrates */
 256                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 257                 if (!nl_rates)
 258                         goto nla_put_failure;
 259
 260                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 261                         nl_rate = nla_nest_start(msg, i);
 262                         if (!nl_rate)
 263                                 goto nla_put_failure;
 264
 265                         rate = &dev->wiphy.bands[band]->bitrates[i];
 266                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 267                                     rate->bitrate);
 268                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 269                                 NLA_PUT_FLAG(msg,
 270                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 271
 272                         nla_nest_end(msg, nl_rate);
 273                 }
 274
 275                 nla_nest_end(msg, nl_rates);
 276
 277                 nla_nest_end(msg, nl_band);
 278         }
 279         nla_nest_end(msg, nl_bands);
 280
 281         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 282         if (!nl_cmds)
 283                 goto nla_put_failure;
 284
 285         i = 0;
 286 #define CMD(op, n)                                              \
 287          do {                                                   \
 288                 if (dev->ops->op) {                             \
 289                         i++;                                    \
 290                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 291                 }                                               \
 292         } while (0)
 293
 294         CMD(add_virtual_intf, NEW_INTERFACE);
 295         CMD(change_virtual_intf, SET_INTERFACE);
 296         CMD(add_key, NEW_KEY);
 297         CMD(add_beacon, NEW_BEACON);
 298         CMD(add_station, NEW_STATION);
 299         CMD(add_mpath, NEW_MPATH);
 300         CMD(set_mesh_params, SET_MESH_PARAMS);
 301         CMD(change_bss, SET_BSS);
 302         CMD(auth, AUTHENTICATE);
 303         CMD(assoc, ASSOCIATE);
 304         CMD(deauth, DEAUTHENTICATE);
 305         CMD(disassoc, DISASSOCIATE);
 306
 307 #undef CMD
 308         nla_nest_end(msg, nl_cmds);
 309
 310         return genlmsg_end(msg, hdr);
 311
 312  nla_put_failure:
 313         genlmsg_cancel(msg, hdr);
 314         return -EMSGSIZE;
 315 }
 316
 317 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 318 {
 319         int idx = 0;
 320         int start = cb->args[0];
 321         struct cfg80211_registered_device *dev;
 322
 323         mutex_lock(&cfg80211_mutex);
 324         list_for_each_entry(dev, &cfg80211_drv_list, list) {
 325                 if (++idx <= start)
 326                         continue;
 327                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
 328                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
 329                                        dev) < 0) {
 330                         idx--;
 331                         break;
 332                 }
 333         }
 334         mutex_unlock(&cfg80211_mutex);
 335
 336         cb->args[0] = idx;
 337
 338         return skb->len;
 339 }
 340
 341 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 342 {
 343         struct sk_buff *msg;
 344         struct cfg80211_registered_device *dev;
 345
 346         dev = cfg80211_get_dev_from_info(info);
 347         if (IS_ERR(dev))
 348                 return PTR_ERR(dev);
 349
 350         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 351         if (!msg)
 352                 goto out_err;
 353
 354         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
 355                 goto out_free;
 356
 357         cfg80211_put_dev(dev);
 358
 359         return genlmsg_unicast(msg, info->snd_pid);
 360
 361  out_free:
 362         nlmsg_free(msg);
 363  out_err:
 364         cfg80211_put_dev(dev);
 365         return -ENOBUFS;
 366 }
 367
 368 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 369         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
 370         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
 371         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
 372         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
 373         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
 374 };
 375
 376 static int parse_txq_params(struct nlattr *tb[],
 377                             struct ieee80211_txq_params *txq_params)
 378 {
 379         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 380             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 381             !tb[NL80211_TXQ_ATTR_AIFS])
 382                 return -EINVAL;
 383
 384         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
 385         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 386         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 387         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 388         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 389
 390         return 0;
 391 }
 392
 393 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 394 {
 395         struct cfg80211_registered_device *rdev;
 396         int result = 0, rem_txq_params = 0;
 397         struct nlattr *nl_txq_params;
 398
 399         rtnl_lock();
 400
 401         mutex_lock(&cfg80211_mutex);
 402
 403         rdev = __cfg80211_drv_from_info(info);
 404         if (IS_ERR(rdev)) {
 405                 result = PTR_ERR(rdev);
 406                 goto unlock;
 407         }
 408
 409         mutex_lock(&rdev->mtx);
 410
 411         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
 412                 result = cfg80211_dev_rename(
 413                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 414
 415         mutex_unlock(&cfg80211_mutex);
 416
 417         if (result)
 418                 goto bad_res;
 419
 420         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
 421                 struct ieee80211_txq_params txq_params;
 422                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
 423
 424                 if (!rdev->ops->set_txq_params) {
 425                         result = -EOPNOTSUPP;
 426                         goto bad_res;
 427                 }
 428
 429                 nla_for_each_nested(nl_txq_params,
 430                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
 431                                     rem_txq_params) {
 432                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
 433                                   nla_data(nl_txq_params),
 434                                   nla_len(nl_txq_params),
 435                                   txq_params_policy);
 436                         result = parse_txq_params(tb, &txq_params);
 437                         if (result)
 438                                 goto bad_res;
 439
 440                         result = rdev->ops->set_txq_params(&rdev->wiphy,
 441                                                            &txq_params);
 442                         if (result)
 443                                 goto bad_res;
 444                 }
 445         }
 446
 447         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
 448                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 449                 struct ieee80211_channel *chan;
 450                 struct ieee80211_sta_ht_cap *ht_cap;
 451                 u32 freq, sec_freq;
 452
 453                 if (!rdev->ops->set_channel) {
 454                         result = -EOPNOTSUPP;
 455                         goto bad_res;
 456                 }
 457
 458                 result = -EINVAL;
 459
 460                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 461                         channel_type = nla_get_u32(info->attrs[
 462                                            NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 463                         if (channel_type != NL80211_CHAN_NO_HT &&
 464                             channel_type != NL80211_CHAN_HT20 &&
 465                             channel_type != NL80211_CHAN_HT40PLUS &&
 466                             channel_type != NL80211_CHAN_HT40MINUS)
 467                                 goto bad_res;
 468                 }
 469
 470                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 471                 chan = ieee80211_get_channel(&rdev->wiphy, freq);
 472
 473                 /* Primary channel not allowed */
 474                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 475                         goto bad_res;
 476
 477                 if (channel_type == NL80211_CHAN_HT40MINUS)
 478                         sec_freq = freq - 20;
 479                 else if (channel_type == NL80211_CHAN_HT40PLUS)
 480                         sec_freq = freq + 20;
 481                 else
 482                         sec_freq = 0;
 483
 484                 ht_cap = &rdev->wiphy.bands[chan->band]->ht_cap;
 485
 486                 /* no HT capabilities */
 487                 if (channel_type != NL80211_CHAN_NO_HT &&
 488                     !ht_cap->ht_supported)
 489                         goto bad_res;
 490
 491                 if (sec_freq) {
 492                         struct ieee80211_channel *schan;
 493
 494                         /* no 40 MHz capabilities */
 495                         if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
 496                             (ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT))
 497                                 goto bad_res;
 498
 499                         schan = ieee80211_get_channel(&rdev->wiphy, sec_freq);
 500
 501                         /* Secondary channel not allowed */
 502                         if (!schan || schan->flags & IEEE80211_CHAN_DISABLED)
 503                                 goto bad_res;
 504                 }
 505
 506                 result = rdev->ops->set_channel(&rdev->wiphy, chan,
 507                                                 channel_type);
 508                 if (result)
 509                         goto bad_res;
 510         }
 511
 512
 513  bad_res:
 514         mutex_unlock(&rdev->mtx);
 515  unlock:
 516         rtnl_unlock();
 517         return result;
 518 }
 519
 520
 521 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 522                               struct net_device *dev)
 523 {
 524         void *hdr;
 525
 526         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
 527         if (!hdr)
 528                 return -1;
 529
 530         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 531         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
 532         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
 533         return genlmsg_end(msg, hdr);
 534
 535  nla_put_failure:
 536         genlmsg_cancel(msg, hdr);
 537         return -EMSGSIZE;
 538 }
 539
 540 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
 541 {
 542         int wp_idx = 0;
 543         int if_idx = 0;
 544         int wp_start = cb->args[0];
 545         int if_start = cb->args[1];
 546         struct cfg80211_registered_device *dev;
 547         struct wireless_dev *wdev;
 548
 549         mutex_lock(&cfg80211_mutex);
 550         list_for_each_entry(dev, &cfg80211_drv_list, list) {
 551                 if (wp_idx < wp_start) {
 552                         wp_idx++;
 553                         continue;
 554                 }
 555                 if_idx = 0;
 556
 557                 mutex_lock(&dev->devlist_mtx);
 558                 list_for_each_entry(wdev, &dev->netdev_list, list) {
 559                         if (if_idx < if_start) {
 560                                 if_idx++;
 561                                 continue;
 562                         }
 563                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
 564                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
 565                                                wdev->netdev) < 0) {
 566                                 mutex_unlock(&dev->devlist_mtx);
 567                                 goto out;
 568                         }
 569                         if_idx++;
 570                 }
 571                 mutex_unlock(&dev->devlist_mtx);
 572
 573                 wp_idx++;
 574         }
 575  out:
 576         mutex_unlock(&cfg80211_mutex);
 577
 578         cb->args[0] = wp_idx;
 579         cb->args[1] = if_idx;
 580
 581         return skb->len;
 582 }
 583
 584 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
 585 {
 586         struct sk_buff *msg;
 587         struct cfg80211_registered_device *dev;
 588         struct net_device *netdev;
 589         int err;
 590
 591         err = get_drv_dev_by_info_ifindex(info->attrs, &dev, &netdev);
 592         if (err)
 593                 return err;
 594
 595         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 596         if (!msg)
 597                 goto out_err;
 598
 599         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0, netdev) < 0)
 600                 goto out_free;
 601
 602         dev_put(netdev);
 603         cfg80211_put_dev(dev);
 604
 605         return genlmsg_unicast(msg, info->snd_pid);
 606
 607  out_free:
 608         nlmsg_free(msg);
 609  out_err:
 610         dev_put(netdev);
 611         cfg80211_put_dev(dev);
 612         return -ENOBUFS;
 613 }
 614
 615 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
 616         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
 617         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
 618         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
 619         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
 620         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
 621 };
 622
 623 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
 624 {
 625         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
 626         int flag;
 627
 628         *mntrflags = 0;
 629
 630         if (!nla)
 631                 return -EINVAL;
 632
 633         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
 634                              nla, mntr_flags_policy))
 635                 return -EINVAL;
 636
 637         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
 638                 if (flags[flag])
 639                         *mntrflags |= (1<<flag);
 640
 641         return 0;
 642 }
 643
 644 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 645 {
 646         struct cfg80211_registered_device *drv;
 647         struct vif_params params;
 648         int err, ifindex;
 649         enum nl80211_iftype type;
 650         struct net_device *dev;
 651         u32 _flags, *flags = NULL;
 652         bool change = false;
 653
 654         memset(&params, 0, sizeof(params));
 655
 656         rtnl_lock();
 657
 658         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 659         if (err)
 660                 goto unlock_rtnl;
 661
 662         ifindex = dev->ifindex;
 663         type = dev->ieee80211_ptr->iftype;
 664         dev_put(dev);
 665
 666         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 667                 enum nl80211_iftype ntype;
 668
 669                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 670                 if (type != ntype)
 671                         change = true;
 672                 type = ntype;
 673                 if (type > NL80211_IFTYPE_MAX) {
 674                         err = -EINVAL;
 675                         goto unlock;
 676                 }
 677         }
 678
 679         if (!drv->ops->change_virtual_intf ||
 680             !(drv->wiphy.interface_modes & (1 << type))) {
 681                 err = -EOPNOTSUPP;
 682                 goto unlock;
 683         }
 684
 685         if (info->attrs[NL80211_ATTR_MESH_ID]) {
 686                 if (type != NL80211_IFTYPE_MESH_POINT) {
 687                         err = -EINVAL;
 688                         goto unlock;
 689                 }
 690                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 691                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 692                 change = true;
 693         }
 694
 695         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
 696                 if (type != NL80211_IFTYPE_MONITOR) {
 697                         err = -EINVAL;
 698                         goto unlock;
 699                 }
 700                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
 701                                           &_flags);
 702                 if (err)
 703                         goto unlock;
 704
 705                 flags = &_flags;
 706                 change = true;
 707         }
 708
 709         if (change)
 710                 err = drv->ops->change_virtual_intf(&drv->wiphy, ifindex,
 711                                                     type, flags, &params);
 712         else
 713                 err = 0;
 714
 715         dev = __dev_get_by_index(&init_net, ifindex);
 716         WARN_ON(!dev || (!err && dev->ieee80211_ptr->iftype != type));
 717
 718  unlock:
 719         cfg80211_put_dev(drv);
 720  unlock_rtnl:
 721         rtnl_unlock();
 722         return err;
 723 }
 724
 725 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
 726 {
 727         struct cfg80211_registered_device *drv;
 728         struct vif_params params;
 729         int err;
 730         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
 731         u32 flags;
 732
 733         memset(&params, 0, sizeof(params));
 734
 735         if (!info->attrs[NL80211_ATTR_IFNAME])
 736                 return -EINVAL;
 737
 738         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 739                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 740                 if (type > NL80211_IFTYPE_MAX)
 741                         return -EINVAL;
 742         }
 743
 744         rtnl_lock();
 745
 746         drv = cfg80211_get_dev_from_info(info);
 747         if (IS_ERR(drv)) {
 748                 err = PTR_ERR(drv);
 749                 goto unlock_rtnl;
 750         }
 751
 752         if (!drv->ops->add_virtual_intf ||
 753             !(drv->wiphy.interface_modes & (1 << type))) {
 754                 err = -EOPNOTSUPP;
 755                 goto unlock;
 756         }
 757
 758         if (type == NL80211_IFTYPE_MESH_POINT &&
 759             info->attrs[NL80211_ATTR_MESH_ID]) {
 760                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 761                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 762         }
 763
 764         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
 765                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
 766                                   &flags);
 767         err = drv->ops->add_virtual_intf(&drv->wiphy,
 768                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
 769                 type, err ? NULL : &flags, &params);
 770
 771  unlock:
 772         cfg80211_put_dev(drv);
 773  unlock_rtnl:
 774         rtnl_unlock();
 775         return err;
 776 }
 777
 778 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
 779 {
 780         struct cfg80211_registered_device *drv;
 781         int ifindex, err;
 782         struct net_device *dev;
 783
 784         rtnl_lock();
 785
 786         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 787         if (err)
 788                 goto unlock_rtnl;
 789         ifindex = dev->ifindex;
 790         dev_put(dev);
 791
 792         if (!drv->ops->del_virtual_intf) {
 793                 err = -EOPNOTSUPP;
 794                 goto out;
 795         }
 796
 797         err = drv->ops->del_virtual_intf(&drv->wiphy, ifindex);
 798
 799  out:
 800         cfg80211_put_dev(drv);
 801  unlock_rtnl:
 802         rtnl_unlock();
 803         return err;
 804 }
 805
 806 struct get_key_cookie {
 807         struct sk_buff *msg;
 808         int error;
 809 };
 810
 811 static void get_key_callback(void *c, struct key_params *params)
 812 {
 813         struct get_key_cookie *cookie = c;
 814
 815         if (params->key)
 816                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
 817                         params->key_len, params->key);
 818
 819         if (params->seq)
 820                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
 821                         params->seq_len, params->seq);
 822
 823         if (params->cipher)
 824                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
 825                             params->cipher);
 826
 827         return;
 828  nla_put_failure:
 829         cookie->error = 1;
 830 }
 831
 832 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
 833 {
 834         struct cfg80211_registered_device *drv;
 835         int err;
 836         struct net_device *dev;
 837         u8 key_idx = 0;
 838         u8 *mac_addr = NULL;
 839         struct get_key_cookie cookie = {
 840                 .error = 0,
 841         };
 842         void *hdr;
 843         struct sk_buff *msg;
 844
 845         if (info->attrs[NL80211_ATTR_KEY_IDX])
 846                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 847
 848         if (key_idx > 5)
 849                 return -EINVAL;
 850
 851         if (info->attrs[NL80211_ATTR_MAC])
 852                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 853
 854         rtnl_lock();
 855
 856         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 857         if (err)
 858                 goto unlock_rtnl;
 859
 860         if (!drv->ops->get_key) {
 861                 err = -EOPNOTSUPP;
 862                 goto out;
 863         }
 864
 865         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 866         if (!msg) {
 867                 err = -ENOMEM;
 868                 goto out;
 869         }
 870
 871         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
 872                              NL80211_CMD_NEW_KEY);
 873
 874         if (IS_ERR(hdr)) {
 875                 err = PTR_ERR(hdr);
 876                 goto out;
 877         }
 878
 879         cookie.msg = msg;
 880
 881         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 882         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
 883         if (mac_addr)
 884                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
 885
 886         err = drv->ops->get_key(&drv->wiphy, dev, key_idx, mac_addr,
 887                                 &cookie, get_key_callback);
 888
 889         if (err)
 890                 goto out;
 891
 892         if (cookie.error)
 893                 goto nla_put_failure;
 894
 895         genlmsg_end(msg, hdr);
 896         err = genlmsg_unicast(msg, info->snd_pid);
 897         goto out;
 898
 899  nla_put_failure:
 900         err = -ENOBUFS;
 901         nlmsg_free(msg);
 902  out:
 903         cfg80211_put_dev(drv);
 904         dev_put(dev);
 905  unlock_rtnl:
 906         rtnl_unlock();
 907
 908         return err;
 909 }
 910
 911 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
 912 {
 913         struct cfg80211_registered_device *drv;
 914         int err;
 915         struct net_device *dev;
 916         u8 key_idx;
 917         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
 918                     u8 key_index);
 919
 920         if (!info->attrs[NL80211_ATTR_KEY_IDX])
 921                 return -EINVAL;
 922
 923         key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 924
 925         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]) {
 926                 if (key_idx < 4 || key_idx > 5)
 927                         return -EINVAL;
 928         } else if (key_idx > 3)
 929                 return -EINVAL;
 930
 931         /* currently only support setting default key */
 932         if (!info->attrs[NL80211_ATTR_KEY_DEFAULT] &&
 933             !info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT])
 934                 return -EINVAL;
 935
 936         rtnl_lock();
 937
 938         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 939         if (err)
 940                 goto unlock_rtnl;
 941
 942         if (info->attrs[NL80211_ATTR_KEY_DEFAULT])
 943                 func = drv->ops->set_default_key;
 944         else
 945                 func = drv->ops->set_default_mgmt_key;
 946
 947         if (!func) {
 948                 err = -EOPNOTSUPP;
 949                 goto out;
 950         }
 951
 952         err = func(&drv->wiphy, dev, key_idx);
 953
 954  out:
 955         cfg80211_put_dev(drv);
 956         dev_put(dev);
 957
 958  unlock_rtnl:
 959         rtnl_unlock();
 960
 961         return err;
 962 }
 963
 964 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
 965 {
 966         struct cfg80211_registered_device *drv;
 967         int err;
 968         struct net_device *dev;
 969         struct key_params params;
 970         u8 key_idx = 0;
 971         u8 *mac_addr = NULL;
 972
 973         memset(&params, 0, sizeof(params));
 974
 975         if (!info->attrs[NL80211_ATTR_KEY_CIPHER])
 976                 return -EINVAL;
 977
 978         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 979                 params.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 980                 params.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 981         }
 982
 983         if (info->attrs[NL80211_ATTR_KEY_IDX])
 984                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 985
 986         params.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 987
 988         if (info->attrs[NL80211_ATTR_MAC])
 989                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 990
 991         if (key_idx > 5)
 992                 return -EINVAL;
 993
 994         /*
 995          * Disallow pairwise keys with non-zero index unless it's WEP
 996          * (because current deployments use pairwise WEP keys with
 997          * non-zero indizes but 802.11i clearly specifies to use zero)
 998          */
 999         if (mac_addr && key_idx &&
1000             params.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1001             params.cipher != WLAN_CIPHER_SUITE_WEP104)
1002                 return -EINVAL;
1003
1004         /* TODO: add definitions for the lengths to linux/ieee80211.h */
1005         switch (params.cipher) {
1006         case WLAN_CIPHER_SUITE_WEP40:
1007                 if (params.key_len != 5)
1008                         return -EINVAL;
1009                 break;
1010         case WLAN_CIPHER_SUITE_TKIP:
1011                 if (params.key_len != 32)
1012                         return -EINVAL;
1013                 break;
1014         case WLAN_CIPHER_SUITE_CCMP:
1015                 if (params.key_len != 16)
1016                         return -EINVAL;
1017                 break;
1018         case WLAN_CIPHER_SUITE_WEP104:
1019                 if (params.key_len != 13)
1020                         return -EINVAL;
1021                 break;
1022         case WLAN_CIPHER_SUITE_AES_CMAC:
1023                 if (params.key_len != 16)
1024                         return -EINVAL;
1025                 break;
1026         default:
1027                 return -EINVAL;
1028         }
1029
1030         rtnl_lock();
1031
1032         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1033         if (err)
1034                 goto unlock_rtnl;
1035
1036         if (!drv->ops->add_key) {
1037                 err = -EOPNOTSUPP;
1038                 goto out;
1039         }
1040
1041         err = drv->ops->add_key(&drv->wiphy, dev, key_idx, mac_addr, &params);
1042
1043  out:
1044         cfg80211_put_dev(drv);
1045         dev_put(dev);
1046  unlock_rtnl:
1047         rtnl_unlock();
1048
1049         return err;
1050 }
1051
1052 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1053 {
1054         struct cfg80211_registered_device *drv;
1055         int err;
1056         struct net_device *dev;
1057         u8 key_idx = 0;
1058         u8 *mac_addr = NULL;
1059
1060         if (info->attrs[NL80211_ATTR_KEY_IDX])
1061                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1062
1063         if (key_idx > 5)
1064                 return -EINVAL;
1065
1066         if (info->attrs[NL80211_ATTR_MAC])
1067                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1068
1069         rtnl_lock();
1070
1071         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1072         if (err)
1073                 goto unlock_rtnl;
1074
1075         if (!drv->ops->del_key) {
1076                 err = -EOPNOTSUPP;
1077                 goto out;
1078         }
1079
1080         err = drv->ops->del_key(&drv->wiphy, dev, key_idx, mac_addr);
1081
1082  out:
1083         cfg80211_put_dev(drv);
1084         dev_put(dev);
1085
1086  unlock_rtnl:
1087         rtnl_unlock();
1088
1089         return err;
1090 }
1091
1092 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1093 {
1094         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1095                     struct beacon_parameters *info);
1096         struct cfg80211_registered_device *drv;
1097         int err;
1098         struct net_device *dev;
1099         struct beacon_parameters params;
1100         int haveinfo = 0;
1101
1102         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
1103                 return -EINVAL;
1104
1105         rtnl_lock();
1106
1107         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1108         if (err)
1109                 goto unlock_rtnl;
1110
1111         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1112                 err = -EOPNOTSUPP;
1113                 goto out;
1114         }
1115
1116         switch (info->genlhdr->cmd) {
1117         case NL80211_CMD_NEW_BEACON:
1118                 /* these are required for NEW_BEACON */
1119                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1120                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1121                     !info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1122                         err = -EINVAL;
1123                         goto out;
1124                 }
1125
1126                 call = drv->ops->add_beacon;
1127                 break;
1128         case NL80211_CMD_SET_BEACON:
1129                 call = drv->ops->set_beacon;
1130                 break;
1131         default:
1132                 WARN_ON(1);
1133                 err = -EOPNOTSUPP;
1134                 goto out;
1135         }
1136
1137         if (!call) {
1138                 err = -EOPNOTSUPP;
1139                 goto out;
1140         }
1141
1142         memset(&params, 0, sizeof(params));
1143
1144         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1145                 params.interval =
1146                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1147                 haveinfo = 1;
1148         }
1149
1150         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1151                 params.dtim_period =
1152                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1153                 haveinfo = 1;
1154         }
1155
1156         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1157                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1158                 params.head_len =
1159                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1160                 haveinfo = 1;
1161         }
1162
1163         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1164                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1165                 params.tail_len =
1166                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1167                 haveinfo = 1;
1168         }
1169
1170         if (!haveinfo) {
1171                 err = -EINVAL;
1172                 goto out;
1173         }
1174
1175         err = call(&drv->wiphy, dev, &params);
1176
1177  out:
1178         cfg80211_put_dev(drv);
1179         dev_put(dev);
1180  unlock_rtnl:
1181         rtnl_unlock();
1182
1183         return err;
1184 }
1185
1186 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1187 {
1188         struct cfg80211_registered_device *drv;
1189         int err;
1190         struct net_device *dev;
1191
1192         rtnl_lock();
1193
1194         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1195         if (err)
1196                 goto unlock_rtnl;
1197
1198         if (!drv->ops->del_beacon) {
1199                 err = -EOPNOTSUPP;
1200                 goto out;
1201         }
1202
1203         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1204                 err = -EOPNOTSUPP;
1205                 goto out;
1206         }
1207         err = drv->ops->del_beacon(&drv->wiphy, dev);
1208
1209  out:
1210         cfg80211_put_dev(drv);
1211         dev_put(dev);
1212  unlock_rtnl:
1213         rtnl_unlock();
1214
1215         return err;
1216 }
1217
1218 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1219         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1220         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1221         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1222 };
1223
1224 static int parse_station_flags(struct nlattr *nla, u32 *staflags)
1225 {
1226         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1227         int flag;
1228
1229         *staflags = 0;
1230
1231         if (!nla)
1232                 return 0;
1233
1234         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1235                              nla, sta_flags_policy))
1236                 return -EINVAL;
1237
1238         *staflags = STATION_FLAG_CHANGED;
1239
1240         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1241                 if (flags[flag])
1242                         *staflags |= (1<<flag);
1243
1244         return 0;
1245 }
1246
1247 static u16 nl80211_calculate_bitrate(struct rate_info *rate)
1248 {
1249         int modulation, streams, bitrate;
1250
1251         if (!(rate->flags & RATE_INFO_FLAGS_MCS))
1252                 return rate->legacy;
1253
1254         /* the formula below does only work for MCS values smaller than 32 */
1255         if (rate->mcs >= 32)
1256                 return 0;
1257
1258         modulation = rate->mcs & 7;
1259         streams = (rate->mcs >> 3) + 1;
1260
1261         bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
1262                         13500000 : 6500000;
1263
1264         if (modulation < 4)
1265                 bitrate *= (modulation + 1);
1266         else if (modulation == 4)
1267                 bitrate *= (modulation + 2);
1268         else
1269                 bitrate *= (modulation + 3);
1270
1271         bitrate *= streams;
1272
1273         if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
1274                 bitrate = (bitrate / 9) * 10;
1275
1276         /* do NOT round down here */
1277         return (bitrate + 50000) / 100000;
1278 }
1279
1280 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1281                                 int flags, struct net_device *dev,
1282                                 u8 *mac_addr, struct station_info *sinfo)
1283 {
1284         void *hdr;
1285         struct nlattr *sinfoattr, *txrate;
1286         u16 bitrate;
1287
1288         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1289         if (!hdr)
1290                 return -1;
1291
1292         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1293         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1294
1295         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1296         if (!sinfoattr)
1297                 goto nla_put_failure;
1298         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1299                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1300                             sinfo->inactive_time);
1301         if (sinfo->filled & STATION_INFO_RX_BYTES)
1302                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1303                             sinfo->rx_bytes);
1304         if (sinfo->filled & STATION_INFO_TX_BYTES)
1305                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1306                             sinfo->tx_bytes);
1307         if (sinfo->filled & STATION_INFO_LLID)
1308                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1309                             sinfo->llid);
1310         if (sinfo->filled & STATION_INFO_PLID)
1311                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1312                             sinfo->plid);
1313         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1314                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1315                             sinfo->plink_state);
1316         if (sinfo->filled & STATION_INFO_SIGNAL)
1317                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1318                            sinfo->signal);
1319         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1320                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1321                 if (!txrate)
1322                         goto nla_put_failure;
1323
1324                 /* nl80211_calculate_bitrate will return 0 for mcs >= 32 */
1325                 bitrate = nl80211_calculate_bitrate(&sinfo->txrate);
1326                 if (bitrate > 0)
1327                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1328
1329                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1330                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1331                                     sinfo->txrate.mcs);
1332                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1333                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1334                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1335                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1336
1337                 nla_nest_end(msg, txrate);
1338         }
1339         if (sinfo->filled & STATION_INFO_RX_PACKETS)
1340                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
1341                             sinfo->rx_packets);
1342         if (sinfo->filled & STATION_INFO_TX_PACKETS)
1343                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
1344                             sinfo->tx_packets);
1345         nla_nest_end(msg, sinfoattr);
1346
1347         return genlmsg_end(msg, hdr);
1348
1349  nla_put_failure:
1350         genlmsg_cancel(msg, hdr);
1351         return -EMSGSIZE;
1352 }
1353
1354 static int nl80211_dump_station(struct sk_buff *skb,
1355                                 struct netlink_callback *cb)
1356 {
1357         struct station_info sinfo;
1358         struct cfg80211_registered_device *dev;
1359         struct net_device *netdev;
1360         u8 mac_addr[ETH_ALEN];
1361         int ifidx = cb->args[0];
1362         int sta_idx = cb->args[1];
1363         int err;
1364
1365         if (!ifidx) {
1366                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1367                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1368                                   nl80211_policy);
1369                 if (err)
1370                         return err;
1371
1372                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1373                         return -EINVAL;
1374
1375                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1376                 if (!ifidx)
1377                         return -EINVAL;
1378         }
1379
1380         rtnl_lock();
1381
1382         netdev = __dev_get_by_index(&init_net, ifidx);
1383         if (!netdev) {
1384                 err = -ENODEV;
1385                 goto out_rtnl;
1386         }
1387
1388         dev = cfg80211_get_dev_from_ifindex(ifidx);
1389         if (IS_ERR(dev)) {
1390                 err = PTR_ERR(dev);
1391                 goto out_rtnl;
1392         }
1393
1394         if (!dev->ops->dump_station) {
1395                 err = -EOPNOTSUPP;
1396                 goto out_err;
1397         }
1398
1399         while (1) {
1400                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1401                                              mac_addr, &sinfo);
1402                 if (err == -ENOENT)
1403                         break;
1404                 if (err)
1405                         goto out_err;
1406
1407                 if (nl80211_send_station(skb,
1408                                 NETLINK_CB(cb->skb).pid,
1409                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
1410                                 netdev, mac_addr,
1411                                 &sinfo) < 0)
1412                         goto out;
1413
1414                 sta_idx++;
1415         }
1416
1417
1418  out:
1419         cb->args[1] = sta_idx;
1420         err = skb->len;
1421  out_err:
1422         cfg80211_put_dev(dev);
1423  out_rtnl:
1424         rtnl_unlock();
1425
1426         return err;
1427 }
1428
1429 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1430 {
1431         struct cfg80211_registered_device *drv;
1432         int err;
1433         struct net_device *dev;
1434         struct station_info sinfo;
1435         struct sk_buff *msg;
1436         u8 *mac_addr = NULL;
1437
1438         memset(&sinfo, 0, sizeof(sinfo));
1439
1440         if (!info->attrs[NL80211_ATTR_MAC])
1441                 return -EINVAL;
1442
1443         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1444
1445         rtnl_lock();
1446
1447         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1448         if (err)
1449                 goto out_rtnl;
1450
1451         if (!drv->ops->get_station) {
1452                 err = -EOPNOTSUPP;
1453                 goto out;
1454         }
1455
1456         err = drv->ops->get_station(&drv->wiphy, dev, mac_addr, &sinfo);
1457         if (err)
1458                 goto out;
1459
1460         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1461         if (!msg)
1462                 goto out;
1463
1464         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1465                                  dev, mac_addr, &sinfo) < 0)
1466                 goto out_free;
1467
1468         err = genlmsg_unicast(msg, info->snd_pid);
1469         goto out;
1470
1471  out_free:
1472         nlmsg_free(msg);
1473  out:
1474         cfg80211_put_dev(drv);
1475         dev_put(dev);
1476  out_rtnl:
1477         rtnl_unlock();
1478
1479         return err;
1480 }
1481
1482 /*
1483  * Get vlan interface making sure it is on the right wiphy.
1484  */
1485 static int get_vlan(struct nlattr *vlanattr,
1486                     struct cfg80211_registered_device *rdev,
1487                     struct net_device **vlan)
1488 {
1489         *vlan = NULL;
1490
1491         if (vlanattr) {
1492                 *vlan = dev_get_by_index(&init_net, nla_get_u32(vlanattr));
1493                 if (!*vlan)
1494                         return -ENODEV;
1495                 if (!(*vlan)->ieee80211_ptr)
1496                         return -EINVAL;
1497                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
1498                         return -EINVAL;
1499         }
1500         return 0;
1501 }
1502
1503 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
1504 {
1505         struct cfg80211_registered_device *drv;
1506         int err;
1507         struct net_device *dev;
1508         struct station_parameters params;
1509         u8 *mac_addr = NULL;
1510
1511         memset(&params, 0, sizeof(params));
1512
1513         params.listen_interval = -1;
1514
1515         if (info->attrs[NL80211_ATTR_STA_AID])
1516                 return -EINVAL;
1517
1518         if (!info->attrs[NL80211_ATTR_MAC])
1519                 return -EINVAL;
1520
1521         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1522
1523         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
1524                 params.supported_rates =
1525                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1526                 params.supported_rates_len =
1527                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1528         }
1529
1530         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1531                 params.listen_interval =
1532                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1533
1534         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1535                 params.ht_capa =
1536                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1537
1538         if (parse_station_flags(info->attrs[NL80211_ATTR_STA_FLAGS],
1539                                 &params.station_flags))
1540                 return -EINVAL;
1541
1542         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
1543                 params.plink_action =
1544                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
1545
1546         rtnl_lock();
1547
1548         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1549         if (err)
1550                 goto out_rtnl;
1551
1552         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1553         if (err)
1554                 goto out;
1555
1556         if (!drv->ops->change_station) {
1557                 err = -EOPNOTSUPP;
1558                 goto out;
1559         }
1560
1561         err = drv->ops->change_station(&drv->wiphy, dev, mac_addr, &params);
1562
1563  out:
1564         if (params.vlan)
1565                 dev_put(params.vlan);
1566         cfg80211_put_dev(drv);
1567         dev_put(dev);
1568  out_rtnl:
1569         rtnl_unlock();
1570
1571         return err;
1572 }
1573
1574 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
1575 {
1576         struct cfg80211_registered_device *drv;
1577         int err;
1578         struct net_device *dev;
1579         struct station_parameters params;
1580         u8 *mac_addr = NULL;
1581
1582         memset(&params, 0, sizeof(params));
1583
1584         if (!info->attrs[NL80211_ATTR_MAC])
1585                 return -EINVAL;
1586
1587         if (!info->attrs[NL80211_ATTR_STA_AID])
1588                 return -EINVAL;
1589
1590         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1591                 return -EINVAL;
1592
1593         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
1594                 return -EINVAL;
1595
1596         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1597         params.supported_rates =
1598                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1599         params.supported_rates_len =
1600                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1601         params.listen_interval =
1602                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1603         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
1604         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1605                 params.ht_capa =
1606                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1607
1608         if (parse_station_flags(info->attrs[NL80211_ATTR_STA_FLAGS],
1609                                 &params.station_flags))
1610                 return -EINVAL;
1611
1612         rtnl_lock();
1613
1614         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1615         if (err)
1616                 goto out_rtnl;
1617
1618         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1619         if (err)
1620                 goto out;
1621
1622         if (!drv->ops->add_station) {
1623                 err = -EOPNOTSUPP;
1624                 goto out;
1625         }
1626
1627         if (!netif_running(dev)) {
1628                 err = -ENETDOWN;
1629                 goto out;
1630         }
1631
1632         err = drv->ops->add_station(&drv->wiphy, dev, mac_addr, &params);
1633
1634  out:
1635         if (params.vlan)
1636                 dev_put(params.vlan);
1637         cfg80211_put_dev(drv);
1638         dev_put(dev);
1639  out_rtnl:
1640         rtnl_unlock();
1641
1642         return err;
1643 }
1644
1645 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
1646 {
1647         struct cfg80211_registered_device *drv;
1648         int err;
1649         struct net_device *dev;
1650         u8 *mac_addr = NULL;
1651
1652         if (info->attrs[NL80211_ATTR_MAC])
1653                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1654
1655         rtnl_lock();
1656
1657         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1658         if (err)
1659                 goto out_rtnl;
1660
1661         if (!drv->ops->del_station) {
1662                 err = -EOPNOTSUPP;
1663                 goto out;
1664         }
1665
1666         err = drv->ops->del_station(&drv->wiphy, dev, mac_addr);
1667
1668  out:
1669         cfg80211_put_dev(drv);
1670         dev_put(dev);
1671  out_rtnl:
1672         rtnl_unlock();
1673
1674         return err;
1675 }
1676
1677 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
1678                                 int flags, struct net_device *dev,
1679                                 u8 *dst, u8 *next_hop,
1680                                 struct mpath_info *pinfo)
1681 {
1682         void *hdr;
1683         struct nlattr *pinfoattr;
1684
1685         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1686         if (!hdr)
1687                 return -1;
1688
1689         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1690         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
1691         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
1692
1693         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
1694         if (!pinfoattr)
1695                 goto nla_put_failure;
1696         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
1697                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
1698                             pinfo->frame_qlen);
1699         if (pinfo->filled & MPATH_INFO_DSN)
1700                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DSN,
1701                             pinfo->dsn);
1702         if (pinfo->filled & MPATH_INFO_METRIC)
1703                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
1704                             pinfo->metric);
1705         if (pinfo->filled & MPATH_INFO_EXPTIME)
1706                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
1707                             pinfo->exptime);
1708         if (pinfo->filled & MPATH_INFO_FLAGS)
1709                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
1710                             pinfo->flags);
1711         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
1712                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
1713                             pinfo->discovery_timeout);
1714         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
1715                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
1716                             pinfo->discovery_retries);
1717
1718         nla_nest_end(msg, pinfoattr);
1719
1720         return genlmsg_end(msg, hdr);
1721
1722  nla_put_failure:
1723         genlmsg_cancel(msg, hdr);
1724         return -EMSGSIZE;
1725 }
1726
1727 static int nl80211_dump_mpath(struct sk_buff *skb,
1728                               struct netlink_callback *cb)
1729 {
1730         struct mpath_info pinfo;
1731         struct cfg80211_registered_device *dev;
1732         struct net_device *netdev;
1733         u8 dst[ETH_ALEN];
1734         u8 next_hop[ETH_ALEN];
1735         int ifidx = cb->args[0];
1736         int path_idx = cb->args[1];
1737         int err;
1738
1739         if (!ifidx) {
1740                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1741                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1742                                   nl80211_policy);
1743                 if (err)
1744                         return err;
1745
1746                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1747                         return -EINVAL;
1748
1749                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1750                 if (!ifidx)
1751                         return -EINVAL;
1752         }
1753
1754         rtnl_lock();
1755
1756         netdev = __dev_get_by_index(&init_net, ifidx);
1757         if (!netdev) {
1758                 err = -ENODEV;
1759                 goto out_rtnl;
1760         }
1761
1762         dev = cfg80211_get_dev_from_ifindex(ifidx);
1763         if (IS_ERR(dev)) {
1764                 err = PTR_ERR(dev);
1765                 goto out_rtnl;
1766         }
1767
1768         if (!dev->ops->dump_mpath) {
1769                 err = -EOPNOTSUPP;
1770                 goto out_err;
1771         }
1772
1773         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1774                 err = -EOPNOTSUPP;
1775                 goto out;
1776         }
1777
1778         while (1) {
1779                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
1780                                            dst, next_hop, &pinfo);
1781                 if (err == -ENOENT)
1782                         break;
1783                 if (err)
1784                         goto out_err;
1785
1786                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
1787                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
1788                                        netdev, dst, next_hop,
1789                                        &pinfo) < 0)
1790                         goto out;
1791
1792                 path_idx++;
1793         }
1794
1795
1796  out:
1797         cb->args[1] = path_idx;
1798         err = skb->len;
1799  out_err:
1800         cfg80211_put_dev(dev);
1801  out_rtnl:
1802         rtnl_unlock();
1803
1804         return err;
1805 }
1806
1807 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
1808 {
1809         struct cfg80211_registered_device *drv;
1810         int err;
1811         struct net_device *dev;
1812         struct mpath_info pinfo;
1813         struct sk_buff *msg;
1814         u8 *dst = NULL;
1815         u8 next_hop[ETH_ALEN];
1816
1817         memset(&pinfo, 0, sizeof(pinfo));
1818
1819         if (!info->attrs[NL80211_ATTR_MAC])
1820                 return -EINVAL;
1821
1822         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1823
1824         rtnl_lock();
1825
1826         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1827         if (err)
1828                 goto out_rtnl;
1829
1830         if (!drv->ops->get_mpath) {
1831                 err = -EOPNOTSUPP;
1832                 goto out;
1833         }
1834
1835         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1836                 err = -EOPNOTSUPP;
1837                 goto out;
1838         }
1839
1840         err = drv->ops->get_mpath(&drv->wiphy, dev, dst, next_hop, &pinfo);
1841         if (err)
1842                 goto out;
1843
1844         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1845         if (!msg)
1846                 goto out;
1847
1848         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
1849                                  dev, dst, next_hop, &pinfo) < 0)
1850                 goto out_free;
1851
1852         err = genlmsg_unicast(msg, info->snd_pid);
1853         goto out;
1854
1855  out_free:
1856         nlmsg_free(msg);
1857  out:
1858         cfg80211_put_dev(drv);
1859         dev_put(dev);
1860  out_rtnl:
1861         rtnl_unlock();
1862
1863         return err;
1864 }
1865
1866 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
1867 {
1868         struct cfg80211_registered_device *drv;
1869         int err;
1870         struct net_device *dev;
1871         u8 *dst = NULL;
1872         u8 *next_hop = NULL;
1873
1874         if (!info->attrs[NL80211_ATTR_MAC])
1875                 return -EINVAL;
1876
1877         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
1878                 return -EINVAL;
1879
1880         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1881         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
1882
1883         rtnl_lock();
1884
1885         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1886         if (err)
1887                 goto out_rtnl;
1888
1889         if (!drv->ops->change_mpath) {
1890                 err = -EOPNOTSUPP;
1891                 goto out;
1892         }
1893
1894         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1895                 err = -EOPNOTSUPP;
1896                 goto out;
1897         }
1898
1899         if (!netif_running(dev)) {
1900                 err = -ENETDOWN;
1901                 goto out;
1902         }
1903
1904         err = drv->ops->change_mpath(&drv->wiphy, dev, dst, next_hop);
1905
1906  out:
1907         cfg80211_put_dev(drv);
1908         dev_put(dev);
1909  out_rtnl:
1910         rtnl_unlock();
1911
1912         return err;
1913 }
1914 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
1915 {
1916         struct cfg80211_registered_device *drv;
1917         int err;
1918         struct net_device *dev;
1919         u8 *dst = NULL;
1920         u8 *next_hop = NULL;
1921
1922         if (!info->attrs[NL80211_ATTR_MAC])
1923                 return -EINVAL;
1924
1925         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
1926                 return -EINVAL;
1927
1928         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1929         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
1930
1931         rtnl_lock();
1932
1933         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1934         if (err)
1935                 goto out_rtnl;
1936
1937         if (!drv->ops->add_mpath) {
1938                 err = -EOPNOTSUPP;
1939                 goto out;
1940         }
1941
1942         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1943                 err = -EOPNOTSUPP;
1944                 goto out;
1945         }
1946
1947         if (!netif_running(dev)) {
1948                 err = -ENETDOWN;
1949                 goto out;
1950         }
1951
1952         err = drv->ops->add_mpath(&drv->wiphy, dev, dst, next_hop);
1953
1954  out:
1955         cfg80211_put_dev(drv);
1956         dev_put(dev);
1957  out_rtnl:
1958         rtnl_unlock();
1959
1960         return err;
1961 }
1962
1963 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
1964 {
1965         struct cfg80211_registered_device *drv;
1966         int err;
1967         struct net_device *dev;
1968         u8 *dst = NULL;
1969
1970         if (info->attrs[NL80211_ATTR_MAC])
1971                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1972
1973         rtnl_lock();
1974
1975         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1976         if (err)
1977                 goto out_rtnl;
1978
1979         if (!drv->ops->del_mpath) {
1980                 err = -EOPNOTSUPP;
1981                 goto out;
1982         }
1983
1984         err = drv->ops->del_mpath(&drv->wiphy, dev, dst);
1985
1986  out:
1987         cfg80211_put_dev(drv);
1988         dev_put(dev);
1989  out_rtnl:
1990         rtnl_unlock();
1991
1992         return err;
1993 }
1994
1995 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
1996 {
1997         struct cfg80211_registered_device *drv;
1998         int err;
1999         struct net_device *dev;
2000         struct bss_parameters params;
2001
2002         memset(&params, 0, sizeof(params));
2003         /* default to not changing parameters */
2004         params.use_cts_prot = -1;
2005         params.use_short_preamble = -1;
2006         params.use_short_slot_time = -1;
2007
2008         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2009                 params.use_cts_prot =
2010                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2011         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2012                 params.use_short_preamble =
2013                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2014         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2015                 params.use_short_slot_time =
2016                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2017         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2018                 params.basic_rates =
2019                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2020                 params.basic_rates_len =
2021                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2022         }
2023
2024         rtnl_lock();
2025
2026         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2027         if (err)
2028                 goto out_rtnl;
2029
2030         if (!drv->ops->change_bss) {
2031                 err = -EOPNOTSUPP;
2032                 goto out;
2033         }
2034
2035         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
2036                 err = -EOPNOTSUPP;
2037                 goto out;
2038         }
2039
2040         err = drv->ops->change_bss(&drv->wiphy, dev, &params);
2041
2042  out:
2043         cfg80211_put_dev(drv);
2044         dev_put(dev);
2045  out_rtnl:
2046         rtnl_unlock();
2047
2048         return err;
2049 }
2050
2051 static const struct nla_policy
2052         reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2053         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2054         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2055         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2056         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2057         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2058         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2059 };
2060
2061 static int parse_reg_rule(struct nlattr *tb[],
2062         struct ieee80211_reg_rule *reg_rule)
2063 {
2064         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2065         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2066
2067         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2068                 return -EINVAL;
2069         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2070                 return -EINVAL;
2071         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2072                 return -EINVAL;
2073         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2074                 return -EINVAL;
2075         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2076                 return -EINVAL;
2077
2078         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2079
2080         freq_range->start_freq_khz =
2081                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2082         freq_range->end_freq_khz =
2083                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2084         freq_range->max_bandwidth_khz =
2085                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2086
2087         power_rule->max_eirp =
2088                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2089
2090         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2091                 power_rule->max_antenna_gain =
2092                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2093
2094         return 0;
2095 }
2096
2097 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2098 {
2099         int r;
2100         char *data = NULL;
2101
2102         /*
2103          * You should only get this when cfg80211 hasn't yet initialized
2104          * completely when built-in to the kernel right between the time
2105          * window between nl80211_init() and regulatory_init(), if that is
2106          * even possible.
2107          */
2108         mutex_lock(&cfg80211_mutex);
2109         if (unlikely(!cfg80211_regdomain)) {
2110                 mutex_unlock(&cfg80211_mutex);
2111                 return -EINPROGRESS;
2112         }
2113         mutex_unlock(&cfg80211_mutex);
2114
2115         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2116                 return -EINVAL;
2117
2118         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2119
2120 #ifdef CONFIG_WIRELESS_OLD_REGULATORY
2121         /* We ignore world regdom requests with the old regdom setup */
2122         if (is_world_regdom(data))
2123                 return -EINVAL;
2124 #endif
2125
2126         r = regulatory_hint_user(data);
2127
2128         return r;
2129 }
2130
2131 static int nl80211_get_mesh_params(struct sk_buff *skb,
2132         struct genl_info *info)
2133 {
2134         struct cfg80211_registered_device *drv;
2135         struct mesh_config cur_params;
2136         int err;
2137         struct net_device *dev;
2138         void *hdr;
2139         struct nlattr *pinfoattr;
2140         struct sk_buff *msg;
2141
2142         rtnl_lock();
2143
2144         /* Look up our device */
2145         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2146         if (err)
2147                 goto out_rtnl;
2148
2149         if (!drv->ops->get_mesh_params) {
2150                 err = -EOPNOTSUPP;
2151                 goto out;
2152         }
2153
2154         /* Get the mesh params */
2155         err = drv->ops->get_mesh_params(&drv->wiphy, dev, &cur_params);
2156         if (err)
2157                 goto out;
2158
2159         /* Draw up a netlink message to send back */
2160         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2161         if (!msg) {
2162                 err = -ENOBUFS;
2163                 goto out;
2164         }
2165         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2166                              NL80211_CMD_GET_MESH_PARAMS);
2167         if (!hdr)
2168                 goto nla_put_failure;
2169         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
2170         if (!pinfoattr)
2171                 goto nla_put_failure;
2172         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2173         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2174                         cur_params.dot11MeshRetryTimeout);
2175         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2176                         cur_params.dot11MeshConfirmTimeout);
2177         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2178                         cur_params.dot11MeshHoldingTimeout);
2179         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2180                         cur_params.dot11MeshMaxPeerLinks);
2181         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2182                         cur_params.dot11MeshMaxRetries);
2183         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2184                         cur_params.dot11MeshTTL);
2185         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2186                         cur_params.auto_open_plinks);
2187         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2188                         cur_params.dot11MeshHWMPmaxPREQretries);
2189         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2190                         cur_params.path_refresh_time);
2191         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2192                         cur_params.min_discovery_timeout);
2193         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2194                         cur_params.dot11MeshHWMPactivePathTimeout);
2195         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2196                         cur_params.dot11MeshHWMPpreqMinInterval);
2197         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2198                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2199         nla_nest_end(msg, pinfoattr);
2200         genlmsg_end(msg, hdr);
2201         err = genlmsg_unicast(msg, info->snd_pid);
2202         goto out;
2203
2204  nla_put_failure:
2205         genlmsg_cancel(msg, hdr);
2206         err = -EMSGSIZE;
2207  out:
2208         /* Cleanup */
2209         cfg80211_put_dev(drv);
2210         dev_put(dev);
2211  out_rtnl:
2212         rtnl_unlock();
2213
2214         return err;
2215 }
2216
2217 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2218 do {\
2219         if (table[attr_num]) {\
2220                 cfg.param = nla_fn(table[attr_num]); \
2221                 mask |= (1 << (attr_num - 1)); \
2222         } \
2223 } while (0);\
2224
2225 static struct nla_policy
2226 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] __read_mostly = {
2227         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2228         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2229         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2230         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2231         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2232         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2233         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2234
2235         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2236         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2237         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2238         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2239         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2240         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2241 };
2242
2243 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2244 {
2245         int err;
2246         u32 mask;
2247         struct cfg80211_registered_device *drv;
2248         struct net_device *dev;
2249         struct mesh_config cfg;
2250         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2251         struct nlattr *parent_attr;
2252
2253         parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
2254         if (!parent_attr)
2255                 return -EINVAL;
2256         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2257                         parent_attr, nl80211_meshconf_params_policy))
2258                 return -EINVAL;
2259
2260         rtnl_lock();
2261
2262         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2263         if (err)
2264                 goto out_rtnl;
2265
2266         if (!drv->ops->set_mesh_params) {
2267                 err = -EOPNOTSUPP;
2268                 goto out;
2269         }
2270
2271         /* This makes sure that there aren't more than 32 mesh config
2272          * parameters (otherwise our bitfield scheme would not work.) */
2273         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2274
2275         /* Fill in the params struct */
2276         mask = 0;
2277         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2278                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2279         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2280                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2281         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2282                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2283         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2284                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2285         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2286                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2287         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2288                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2289         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2290                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2291         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2292                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2293                         nla_get_u8);
2294         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2295                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2296         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2297                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2298                         nla_get_u16);
2299         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2300                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2301                         nla_get_u32);
2302         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2303                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2304                         nla_get_u16);
2305         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2306                         dot11MeshHWMPnetDiameterTraversalTime,
2307                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2308                         nla_get_u16);
2309
2310         /* Apply changes */
2311         err = drv->ops->set_mesh_params(&drv->wiphy, dev, &cfg, mask);
2312
2313  out:
2314         /* cleanup */
2315         cfg80211_put_dev(drv);
2316         dev_put(dev);
2317  out_rtnl:
2318         rtnl_unlock();
2319
2320         return err;
2321 }
2322
2323 #undef FILL_IN_MESH_PARAM_IF_SET
2324
2325 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2326 {
2327         struct sk_buff *msg;
2328         void *hdr = NULL;
2329         struct nlattr *nl_reg_rules;
2330         unsigned int i;
2331         int err = -EINVAL;
2332
2333         mutex_lock(&cfg80211_mutex);
2334
2335         if (!cfg80211_regdomain)
2336                 goto out;
2337
2338         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2339         if (!msg) {
2340                 err = -ENOBUFS;
2341                 goto out;
2342         }
2343
2344         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2345                              NL80211_CMD_GET_REG);
2346         if (!hdr)
2347                 goto nla_put_failure;
2348
2349         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2350                 cfg80211_regdomain->alpha2);
2351
2352         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2353         if (!nl_reg_rules)
2354                 goto nla_put_failure;
2355
2356         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2357                 struct nlattr *nl_reg_rule;
2358                 const struct ieee80211_reg_rule *reg_rule;
2359                 const struct ieee80211_freq_range *freq_range;
2360                 const struct ieee80211_power_rule *power_rule;
2361
2362                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2363                 freq_range = &reg_rule->freq_range;
2364                 power_rule = &reg_rule->power_rule;
2365
2366                 nl_reg_rule = nla_nest_start(msg, i);
2367                 if (!nl_reg_rule)
2368                         goto nla_put_failure;
2369
2370                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2371                         reg_rule->flags);
2372                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2373                         freq_range->start_freq_khz);
2374                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2375                         freq_range->end_freq_khz);
2376                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2377                         freq_range->max_bandwidth_khz);
2378                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2379                         power_rule->max_antenna_gain);
2380                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2381                         power_rule->max_eirp);
2382
2383                 nla_nest_end(msg, nl_reg_rule);
2384         }
2385
2386         nla_nest_end(msg, nl_reg_rules);
2387
2388         genlmsg_end(msg, hdr);
2389         err = genlmsg_unicast(msg, info->snd_pid);
2390         goto out;
2391
2392 nla_put_failure:
2393         genlmsg_cancel(msg, hdr);
2394         err = -EMSGSIZE;
2395 out:
2396         mutex_unlock(&cfg80211_mutex);
2397         return err;
2398 }
2399
2400 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2401 {
2402         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2403         struct nlattr *nl_reg_rule;
2404         char *alpha2 = NULL;
2405         int rem_reg_rules = 0, r = 0;
2406         u32 num_rules = 0, rule_idx = 0, size_of_regd;
2407         struct ieee80211_regdomain *rd = NULL;
2408
2409         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2410                 return -EINVAL;
2411
2412         if (!info->attrs[NL80211_ATTR_REG_RULES])
2413                 return -EINVAL;
2414
2415         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2416
2417         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2418                         rem_reg_rules) {
2419                 num_rules++;
2420                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2421                         goto bad_reg;
2422         }
2423
2424         if (!reg_is_valid_request(alpha2))
2425                 return -EINVAL;
2426
2427         size_of_regd = sizeof(struct ieee80211_regdomain) +
2428                 (num_rules * sizeof(struct ieee80211_reg_rule));
2429
2430         rd = kzalloc(size_of_regd, GFP_KERNEL);
2431         if (!rd)
2432                 return -ENOMEM;
2433
2434         rd->n_reg_rules = num_rules;
2435         rd->alpha2[0] = alpha2[0];
2436         rd->alpha2[1] = alpha2[1];
2437
2438         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2439                         rem_reg_rules) {
2440                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2441                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2442                         reg_rule_policy);
2443                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2444                 if (r)
2445                         goto bad_reg;
2446
2447                 rule_idx++;
2448
2449                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES)
2450                         goto bad_reg;
2451         }
2452
2453         BUG_ON(rule_idx != num_rules);
2454
2455         mutex_lock(&cfg80211_mutex);
2456         r = set_regdom(rd);
2457         mutex_unlock(&cfg80211_mutex);
2458         return r;
2459
2460  bad_reg:
2461         kfree(rd);
2462         return -EINVAL;
2463 }
2464
2465 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
2466 {
2467         struct cfg80211_registered_device *drv;
2468         struct net_device *dev;
2469         struct cfg80211_scan_request *request;
2470         struct cfg80211_ssid *ssid;
2471         struct ieee80211_channel *channel;
2472         struct nlattr *attr;
2473         struct wiphy *wiphy;
2474         int err, tmp, n_ssids = 0, n_channels = 0, i;
2475         enum ieee80211_band band;
2476         size_t ie_len;
2477
2478         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2479                 return -EINVAL;
2480
2481         rtnl_lock();
2482
2483         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2484         if (err)
2485                 goto out_rtnl;
2486
2487         wiphy = &drv->wiphy;
2488
2489         if (!drv->ops->scan) {
2490                 err = -EOPNOTSUPP;
2491                 goto out;
2492         }
2493
2494         if (!netif_running(dev)) {
2495                 err = -ENETDOWN;
2496                 goto out;
2497         }
2498
2499         if (drv->scan_req) {
2500                 err = -EBUSY;
2501                 goto out;
2502         }
2503
2504         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2505                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp)
2506                         n_channels++;
2507                 if (!n_channels) {
2508                         err = -EINVAL;
2509                         goto out;
2510                 }
2511         } else {
2512                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
2513                         if (wiphy->bands[band])
2514                                 n_channels += wiphy->bands[band]->n_channels;
2515         }
2516
2517         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
2518                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
2519                         n_ssids++;
2520
2521         if (n_ssids > wiphy->max_scan_ssids) {
2522                 err = -EINVAL;
2523                 goto out;
2524         }
2525
2526         if (info->attrs[NL80211_ATTR_IE])
2527                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2528         else
2529                 ie_len = 0;
2530
2531         request = kzalloc(sizeof(*request)
2532                         + sizeof(*ssid) * n_ssids
2533                         + sizeof(channel) * n_channels
2534                         + ie_len, GFP_KERNEL);
2535         if (!request) {
2536                 err = -ENOMEM;
2537                 goto out;
2538         }
2539
2540         request->channels = (void *)((char *)request + sizeof(*request));
2541         request->n_channels = n_channels;
2542         if (n_ssids)
2543                 request->ssids = (void *)(request->channels + n_channels);
2544         request->n_ssids = n_ssids;
2545         if (ie_len) {
2546                 if (request->ssids)
2547                         request->ie = (void *)(request->ssids + n_ssids);
2548                 else
2549                         request->ie = (void *)(request->channels + n_channels);
2550         }
2551
2552         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2553                 /* user specified, bail out if channel not found */
2554                 request->n_channels = n_channels;
2555                 i = 0;
2556                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
2557                         request->channels[i] = ieee80211_get_channel(wiphy, nla_get_u32(attr));
2558                         if (!request->channels[i]) {
2559                                 err = -EINVAL;
2560                                 goto out_free;
2561                         }
2562                         i++;
2563                 }
2564         } else {
2565                 /* all channels */
2566                 i = 0;
2567                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
2568                         int j;
2569                         if (!wiphy->bands[band])
2570                                 continue;
2571                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
2572                                 request->channels[i] = &wiphy->bands[band]->channels[j];
2573                                 i++;
2574                         }
2575                 }
2576         }
2577
2578         i = 0;
2579         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
2580                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
2581                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
2582                                 err = -EINVAL;
2583                                 goto out_free;
2584                         }
2585                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
2586                         request->ssids[i].ssid_len = nla_len(attr);
2587                         i++;
2588                 }
2589         }
2590
2591         if (info->attrs[NL80211_ATTR_IE]) {
2592                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2593                 memcpy(request->ie, nla_data(info->attrs[NL80211_ATTR_IE]),
2594                        request->ie_len);
2595         }
2596
2597         request->ifidx = dev->ifindex;
2598         request->wiphy = &drv->wiphy;
2599
2600         drv->scan_req = request;
2601         err = drv->ops->scan(&drv->wiphy, dev, request);
2602
2603  out_free:
2604         if (err) {
2605                 drv->scan_req = NULL;
2606                 kfree(request);
2607         }
2608  out:
2609         cfg80211_put_dev(drv);
2610         dev_put(dev);
2611  out_rtnl:
2612         rtnl_unlock();
2613
2614         return err;
2615 }
2616
2617 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
2618                             struct cfg80211_registered_device *rdev,
2619                             struct net_device *dev,
2620                             struct cfg80211_bss *res)
2621 {
2622         void *hdr;
2623         struct nlattr *bss;
2624
2625         hdr = nl80211hdr_put(msg, pid, seq, flags,
2626                              NL80211_CMD_NEW_SCAN_RESULTS);
2627         if (!hdr)
2628                 return -1;
2629
2630         NLA_PUT_U32(msg, NL80211_ATTR_SCAN_GENERATION,
2631                     rdev->bss_generation);
2632         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2633
2634         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
2635         if (!bss)
2636                 goto nla_put_failure;
2637         if (!is_zero_ether_addr(res->bssid))
2638                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
2639         if (res->information_elements && res->len_information_elements)
2640                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
2641                         res->len_information_elements,
2642                         res->information_elements);
2643         if (res->tsf)
2644                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
2645         if (res->beacon_interval)
2646                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
2647         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
2648         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
2649
2650         switch (rdev->wiphy.signal_type) {
2651         case CFG80211_SIGNAL_TYPE_MBM:
2652                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
2653                 break;
2654         case CFG80211_SIGNAL_TYPE_UNSPEC:
2655                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
2656                 break;
2657         default:
2658                 break;
2659         }
2660
2661         nla_nest_end(msg, bss);
2662
2663         return genlmsg_end(msg, hdr);
2664
2665  nla_put_failure:
2666         genlmsg_cancel(msg, hdr);
2667         return -EMSGSIZE;
2668 }
2669
2670 static int nl80211_dump_scan(struct sk_buff *skb,
2671                              struct netlink_callback *cb)
2672 {
2673         struct cfg80211_registered_device *dev;
2674         struct net_device *netdev;
2675         struct cfg80211_internal_bss *scan;
2676         int ifidx = cb->args[0];
2677         int start = cb->args[1], idx = 0;
2678         int err;
2679
2680         if (!ifidx) {
2681                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
2682                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
2683                                   nl80211_policy);
2684                 if (err)
2685                         return err;
2686
2687                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
2688                         return -EINVAL;
2689
2690                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
2691                 if (!ifidx)
2692                         return -EINVAL;
2693                 cb->args[0] = ifidx;
2694         }
2695
2696         netdev = dev_get_by_index(&init_net, ifidx);
2697         if (!netdev)
2698                 return -ENODEV;
2699
2700         dev = cfg80211_get_dev_from_ifindex(ifidx);
2701         if (IS_ERR(dev)) {
2702                 err = PTR_ERR(dev);
2703                 goto out_put_netdev;
2704         }
2705
2706         spin_lock_bh(&dev->bss_lock);
2707         cfg80211_bss_expire(dev);
2708
2709         list_for_each_entry(scan, &dev->bss_list, list) {
2710                 if (++idx <= start)
2711                         continue;
2712                 if (nl80211_send_bss(skb,
2713                                 NETLINK_CB(cb->skb).pid,
2714                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2715                                 dev, netdev, &scan->pub) < 0) {
2716                         idx--;
2717                         goto out;
2718                 }
2719         }
2720
2721  out:
2722         spin_unlock_bh(&dev->bss_lock);
2723
2724         cb->args[1] = idx;
2725         err = skb->len;
2726         cfg80211_put_dev(dev);
2727  out_put_netdev:
2728         dev_put(netdev);
2729
2730         return err;
2731 }
2732
2733 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
2734 {
2735         return auth_type == NL80211_AUTHTYPE_OPEN_SYSTEM ||
2736                 auth_type == NL80211_AUTHTYPE_SHARED_KEY ||
2737                 auth_type == NL80211_AUTHTYPE_FT ||
2738                 auth_type == NL80211_AUTHTYPE_NETWORK_EAP;
2739 }
2740
2741 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
2742 {
2743         struct cfg80211_registered_device *drv;
2744         struct net_device *dev;
2745         struct cfg80211_auth_request req;
2746         struct wiphy *wiphy;
2747         int err;
2748
2749         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2750                 return -EINVAL;
2751
2752         if (!info->attrs[NL80211_ATTR_MAC])
2753                 return -EINVAL;
2754
2755         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
2756                 return -EINVAL;
2757
2758         rtnl_lock();
2759
2760         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2761         if (err)
2762                 goto unlock_rtnl;
2763
2764         if (!drv->ops->auth) {
2765                 err = -EOPNOTSUPP;
2766                 goto out;
2767         }
2768
2769         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
2770                 err = -EOPNOTSUPP;
2771                 goto out;
2772         }
2773
2774         if (!netif_running(dev)) {
2775                 err = -ENETDOWN;
2776                 goto out;
2777         }
2778
2779         wiphy = &drv->wiphy;
2780         memset(&req, 0, sizeof(req));
2781
2782         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2783
2784         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2785                 req.chan = ieee80211_get_channel(
2786                         wiphy,
2787                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
2788                 if (!req.chan) {
2789                         err = -EINVAL;
2790                         goto out;
2791                 }
2792         }
2793
2794         if (info->attrs[NL80211_ATTR_SSID]) {
2795                 req.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2796                 req.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
2797         }
2798
2799         if (info->attrs[NL80211_ATTR_IE]) {
2800                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
2801                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2802         }
2803
2804         req.auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
2805         if (!nl80211_valid_auth_type(req.auth_type)) {
2806                 err = -EINVAL;
2807                 goto out;
2808         }
2809
2810         err = drv->ops->auth(&drv->wiphy, dev, &req);
2811
2812 out:
2813         cfg80211_put_dev(drv);
2814         dev_put(dev);
2815 unlock_rtnl:
2816         rtnl_unlock();
2817         return err;
2818 }
2819
2820 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
2821 {
2822         struct cfg80211_registered_device *drv;
2823         struct net_device *dev;
2824         struct cfg80211_assoc_request req;
2825         struct wiphy *wiphy;
2826         int err;
2827
2828         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2829                 return -EINVAL;
2830
2831         if (!info->attrs[NL80211_ATTR_MAC] ||
2832             !info->attrs[NL80211_ATTR_SSID])
2833                 return -EINVAL;
2834
2835         rtnl_lock();
2836
2837         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2838         if (err)
2839                 goto unlock_rtnl;
2840
2841         if (!drv->ops->assoc) {
2842                 err = -EOPNOTSUPP;
2843                 goto out;
2844         }
2845
2846         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
2847                 err = -EOPNOTSUPP;
2848                 goto out;
2849         }
2850
2851         if (!netif_running(dev)) {
2852                 err = -ENETDOWN;
2853                 goto out;
2854         }
2855
2856         wiphy = &drv->wiphy;
2857         memset(&req, 0, sizeof(req));
2858
2859         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2860
2861         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2862                 req.chan = ieee80211_get_channel(
2863                         wiphy,
2864                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
2865                 if (!req.chan) {
2866                         err = -EINVAL;
2867                         goto out;
2868                 }
2869         }
2870
2871         req.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2872         req.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
2873
2874         if (info->attrs[NL80211_ATTR_IE]) {
2875                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
2876                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2877         }
2878
2879         err = drv->ops->assoc(&drv->wiphy, dev, &req);
2880
2881 out:
2882         cfg80211_put_dev(drv);
2883         dev_put(dev);
2884 unlock_rtnl:
2885         rtnl_unlock();
2886         return err;
2887 }
2888
2889 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
2890 {
2891         struct cfg80211_registered_device *drv;
2892         struct net_device *dev;
2893         struct cfg80211_deauth_request req;
2894         struct wiphy *wiphy;
2895         int err;
2896
2897         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2898                 return -EINVAL;
2899
2900         if (!info->attrs[NL80211_ATTR_MAC])
2901                 return -EINVAL;
2902
2903         if (!info->attrs[NL80211_ATTR_REASON_CODE])
2904                 return -EINVAL;
2905
2906         rtnl_lock();
2907
2908         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2909         if (err)
2910                 goto unlock_rtnl;
2911
2912         if (!drv->ops->deauth) {
2913                 err = -EOPNOTSUPP;
2914                 goto out;
2915         }
2916
2917         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
2918                 err = -EOPNOTSUPP;
2919                 goto out;
2920         }
2921
2922         if (!netif_running(dev)) {
2923                 err = -ENETDOWN;
2924                 goto out;
2925         }
2926
2927         wiphy = &drv->wiphy;
2928         memset(&req, 0, sizeof(req));
2929
2930         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2931
2932         req.reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
2933         if (req.reason_code == 0) {
2934                 /* Reason Code 0 is reserved */
2935                 err = -EINVAL;
2936                 goto out;
2937         }
2938
2939         if (info->attrs[NL80211_ATTR_IE]) {
2940                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
2941                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2942         }
2943
2944         err = drv->ops->deauth(&drv->wiphy, dev, &req);
2945
2946 out:
2947         cfg80211_put_dev(drv);
2948         dev_put(dev);
2949 unlock_rtnl:
2950         rtnl_unlock();
2951         return err;
2952 }
2953
2954 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
2955 {
2956         struct cfg80211_registered_device *drv;
2957         struct net_device *dev;
2958         struct cfg80211_disassoc_request req;
2959         struct wiphy *wiphy;
2960         int err;
2961
2962         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2963                 return -EINVAL;
2964
2965         if (!info->attrs[NL80211_ATTR_MAC])
2966                 return -EINVAL;
2967
2968         if (!info->attrs[NL80211_ATTR_REASON_CODE])
2969                 return -EINVAL;
2970
2971         rtnl_lock();
2972
2973         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2974         if (err)
2975                 goto unlock_rtnl;
2976
2977         if (!drv->ops->disassoc) {
2978                 err = -EOPNOTSUPP;
2979                 goto out;
2980         }
2981
2982         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
2983                 err = -EOPNOTSUPP;
2984                 goto out;
2985         }
2986
2987         if (!netif_running(dev)) {
2988                 err = -ENETDOWN;
2989                 goto out;
2990         }
2991
2992         wiphy = &drv->wiphy;
2993         memset(&req, 0, sizeof(req));
2994
2995         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2996
2997         req.reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
2998         if (req.reason_code == 0) {
2999                 /* Reason Code 0 is reserved */
3000                 err = -EINVAL;
3001                 goto out;
3002         }
3003
3004         if (info->attrs[NL80211_ATTR_IE]) {
3005                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3006                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3007         }
3008
3009         err = drv->ops->disassoc(&drv->wiphy, dev, &req);
3010
3011 out:
3012         cfg80211_put_dev(drv);
3013         dev_put(dev);
3014 unlock_rtnl:
3015         rtnl_unlock();
3016         return err;
3017 }
3018
3019 static struct genl_ops nl80211_ops[] = {
3020         {
3021                 .cmd = NL80211_CMD_GET_WIPHY,
3022                 .doit = nl80211_get_wiphy,
3023                 .dumpit = nl80211_dump_wiphy,
3024                 .policy = nl80211_policy,
3025                 /* can be retrieved by unprivileged users */
3026         },
3027         {
3028                 .cmd = NL80211_CMD_SET_WIPHY,
3029                 .doit = nl80211_set_wiphy,
3030                 .policy = nl80211_policy,
3031                 .flags = GENL_ADMIN_PERM,
3032         },
3033         {
3034                 .cmd = NL80211_CMD_GET_INTERFACE,
3035                 .doit = nl80211_get_interface,
3036                 .dumpit = nl80211_dump_interface,
3037                 .policy = nl80211_policy,
3038                 /* can be retrieved by unprivileged users */
3039         },
3040         {
3041                 .cmd = NL80211_CMD_SET_INTERFACE,
3042                 .doit = nl80211_set_interface,
3043                 .policy = nl80211_policy,
3044                 .flags = GENL_ADMIN_PERM,
3045         },
3046         {
3047                 .cmd = NL80211_CMD_NEW_INTERFACE,
3048                 .doit = nl80211_new_interface,
3049                 .policy = nl80211_policy,
3050                 .flags = GENL_ADMIN_PERM,
3051         },
3052         {
3053                 .cmd = NL80211_CMD_DEL_INTERFACE,
3054                 .doit = nl80211_del_interface,
3055                 .policy = nl80211_policy,
3056                 .flags = GENL_ADMIN_PERM,
3057         },
3058         {
3059                 .cmd = NL80211_CMD_GET_KEY,
3060                 .doit = nl80211_get_key,
3061                 .policy = nl80211_policy,
3062                 .flags = GENL_ADMIN_PERM,
3063         },
3064         {
3065                 .cmd = NL80211_CMD_SET_KEY,
3066                 .doit = nl80211_set_key,
3067                 .policy = nl80211_policy,
3068                 .flags = GENL_ADMIN_PERM,
3069         },
3070         {
3071                 .cmd = NL80211_CMD_NEW_KEY,
3072                 .doit = nl80211_new_key,
3073                 .policy = nl80211_policy,
3074                 .flags = GENL_ADMIN_PERM,
3075         },
3076         {
3077                 .cmd = NL80211_CMD_DEL_KEY,
3078                 .doit = nl80211_del_key,
3079                 .policy = nl80211_policy,
3080                 .flags = GENL_ADMIN_PERM,
3081         },
3082         {
3083                 .cmd = NL80211_CMD_SET_BEACON,
3084                 .policy = nl80211_policy,
3085                 .flags = GENL_ADMIN_PERM,
3086                 .doit = nl80211_addset_beacon,
3087         },
3088         {
3089                 .cmd = NL80211_CMD_NEW_BEACON,
3090                 .policy = nl80211_policy,
3091                 .flags = GENL_ADMIN_PERM,
3092                 .doit = nl80211_addset_beacon,
3093         },
3094         {
3095                 .cmd = NL80211_CMD_DEL_BEACON,
3096                 .policy = nl80211_policy,
3097                 .flags = GENL_ADMIN_PERM,
3098                 .doit = nl80211_del_beacon,
3099         },
3100         {
3101                 .cmd = NL80211_CMD_GET_STATION,
3102                 .doit = nl80211_get_station,
3103                 .dumpit = nl80211_dump_station,
3104                 .policy = nl80211_policy,
3105         },
3106         {
3107                 .cmd = NL80211_CMD_SET_STATION,
3108                 .doit = nl80211_set_station,
3109                 .policy = nl80211_policy,
3110                 .flags = GENL_ADMIN_PERM,
3111         },
3112         {
3113                 .cmd = NL80211_CMD_NEW_STATION,
3114                 .doit = nl80211_new_station,
3115                 .policy = nl80211_policy,
3116                 .flags = GENL_ADMIN_PERM,
3117         },
3118         {
3119                 .cmd = NL80211_CMD_DEL_STATION,
3120                 .doit = nl80211_del_station,
3121                 .policy = nl80211_policy,
3122                 .flags = GENL_ADMIN_PERM,
3123         },
3124         {
3125                 .cmd = NL80211_CMD_GET_MPATH,
3126                 .doit = nl80211_get_mpath,
3127                 .dumpit = nl80211_dump_mpath,
3128                 .policy = nl80211_policy,
3129                 .flags = GENL_ADMIN_PERM,
3130         },
3131         {
3132                 .cmd = NL80211_CMD_SET_MPATH,
3133                 .doit = nl80211_set_mpath,
3134                 .policy = nl80211_policy,
3135                 .flags = GENL_ADMIN_PERM,
3136         },
3137         {
3138                 .cmd = NL80211_CMD_NEW_MPATH,
3139                 .doit = nl80211_new_mpath,
3140                 .policy = nl80211_policy,
3141                 .flags = GENL_ADMIN_PERM,
3142         },
3143         {
3144                 .cmd = NL80211_CMD_DEL_MPATH,
3145                 .doit = nl80211_del_mpath,
3146                 .policy = nl80211_policy,
3147                 .flags = GENL_ADMIN_PERM,
3148         },
3149         {
3150                 .cmd = NL80211_CMD_SET_BSS,
3151                 .doit = nl80211_set_bss,
3152                 .policy = nl80211_policy,
3153                 .flags = GENL_ADMIN_PERM,
3154         },
3155         {
3156                 .cmd = NL80211_CMD_GET_REG,
3157                 .doit = nl80211_get_reg,
3158                 .policy = nl80211_policy,
3159                 /* can be retrieved by unprivileged users */
3160         },
3161         {
3162                 .cmd = NL80211_CMD_SET_REG,
3163                 .doit = nl80211_set_reg,
3164                 .policy = nl80211_policy,
3165                 .flags = GENL_ADMIN_PERM,
3166         },
3167         {
3168                 .cmd = NL80211_CMD_REQ_SET_REG,
3169                 .doit = nl80211_req_set_reg,
3170                 .policy = nl80211_policy,
3171                 .flags = GENL_ADMIN_PERM,
3172         },
3173         {
3174                 .cmd = NL80211_CMD_GET_MESH_PARAMS,
3175                 .doit = nl80211_get_mesh_params,
3176                 .policy = nl80211_policy,
3177                 /* can be retrieved by unprivileged users */
3178         },
3179         {
3180                 .cmd = NL80211_CMD_SET_MESH_PARAMS,
3181                 .doit = nl80211_set_mesh_params,
3182                 .policy = nl80211_policy,
3183                 .flags = GENL_ADMIN_PERM,
3184         },
3185         {
3186                 .cmd = NL80211_CMD_TRIGGER_SCAN,
3187                 .doit = nl80211_trigger_scan,
3188                 .policy = nl80211_policy,
3189                 .flags = GENL_ADMIN_PERM,
3190         },
3191         {
3192                 .cmd = NL80211_CMD_GET_SCAN,
3193                 .policy = nl80211_policy,
3194                 .dumpit = nl80211_dump_scan,
3195         },
3196         {
3197                 .cmd = NL80211_CMD_AUTHENTICATE,
3198                 .doit = nl80211_authenticate,
3199                 .policy = nl80211_policy,
3200                 .flags = GENL_ADMIN_PERM,
3201         },
3202         {
3203                 .cmd = NL80211_CMD_ASSOCIATE,
3204                 .doit = nl80211_associate,
3205                 .policy = nl80211_policy,
3206                 .flags = GENL_ADMIN_PERM,
3207         },
3208         {
3209                 .cmd = NL80211_CMD_DEAUTHENTICATE,
3210                 .doit = nl80211_deauthenticate,
3211                 .policy = nl80211_policy,
3212                 .flags = GENL_ADMIN_PERM,
3213         },
3214         {
3215                 .cmd = NL80211_CMD_DISASSOCIATE,
3216                 .doit = nl80211_disassociate,
3217                 .policy = nl80211_policy,
3218                 .flags = GENL_ADMIN_PERM,
3219         },
3220 };
3221 static struct genl_multicast_group nl80211_mlme_mcgrp = {
3222         .name = "mlme",
3223 };
3224
3225 /* multicast groups */
3226 static struct genl_multicast_group nl80211_config_mcgrp = {
3227         .name = "config",
3228 };
3229 static struct genl_multicast_group nl80211_scan_mcgrp = {
3230         .name = "scan",
3231 };
3232 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
3233         .name = "regulatory",
3234 };
3235
3236 /* notification functions */
3237
3238 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
3239 {
3240         struct sk_buff *msg;
3241
3242         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3243         if (!msg)
3244                 return;
3245
3246         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
3247                 nlmsg_free(msg);
3248                 return;
3249         }
3250
3251         genlmsg_multicast(msg, 0, nl80211_config_mcgrp.id, GFP_KERNEL);
3252 }
3253
3254 static int nl80211_send_scan_donemsg(struct sk_buff *msg,
3255                                     struct cfg80211_registered_device *rdev,
3256                                     struct net_device *netdev,
3257                                     u32 pid, u32 seq, int flags,
3258                                     u32 cmd)
3259 {
3260         void *hdr;
3261
3262         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
3263         if (!hdr)
3264                 return -1;
3265
3266         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3267         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3268
3269         /* XXX: we should probably bounce back the request? */
3270
3271         return genlmsg_end(msg, hdr);
3272
3273  nla_put_failure:
3274         genlmsg_cancel(msg, hdr);
3275         return -EMSGSIZE;
3276 }
3277
3278 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
3279                             struct net_device *netdev)
3280 {
3281         struct sk_buff *msg;
3282
3283         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3284         if (!msg)
3285                 return;
3286
3287         if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
3288                                       NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
3289                 nlmsg_free(msg);
3290                 return;
3291         }
3292
3293         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
3294 }
3295
3296 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
3297                                struct net_device *netdev)
3298 {
3299         struct sk_buff *msg;
3300
3301         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3302         if (!msg)
3303                 return;
3304
3305         if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
3306                                       NL80211_CMD_SCAN_ABORTED) < 0) {
3307                 nlmsg_free(msg);
3308                 return;
3309         }
3310
3311         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
3312 }
3313
3314 /*
3315  * This can happen on global regulatory changes or device specific settings
3316  * based on custom world regulatory domains.
3317  */
3318 void nl80211_send_reg_change_event(struct regulatory_request *request)
3319 {
3320         struct sk_buff *msg;
3321         void *hdr;
3322
3323         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3324         if (!msg)
3325                 return;
3326
3327         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
3328         if (!hdr) {
3329                 nlmsg_free(msg);
3330                 return;
3331         }
3332
3333         /* Userspace can always count this one always being set */
3334         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
3335
3336         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
3337                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3338                            NL80211_REGDOM_TYPE_WORLD);
3339         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
3340                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3341                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
3342         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
3343                  request->intersect)
3344                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3345                            NL80211_REGDOM_TYPE_INTERSECTION);
3346         else {
3347                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3348                            NL80211_REGDOM_TYPE_COUNTRY);
3349                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
3350         }
3351
3352         if (wiphy_idx_valid(request->wiphy_idx))
3353                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
3354
3355         if (genlmsg_end(msg, hdr) < 0) {
3356                 nlmsg_free(msg);
3357                 return;
3358         }
3359
3360         genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_KERNEL);
3361
3362         return;
3363
3364 nla_put_failure:
3365         genlmsg_cancel(msg, hdr);
3366         nlmsg_free(msg);
3367 }
3368
3369 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
3370                                     struct net_device *netdev,
3371                                     const u8 *buf, size_t len,
3372                                     enum nl80211_commands cmd)
3373 {
3374         struct sk_buff *msg;
3375         void *hdr;
3376
3377         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
3378         if (!msg)
3379                 return;
3380
3381         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
3382         if (!hdr) {
3383                 nlmsg_free(msg);
3384                 return;
3385         }
3386
3387         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3388         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3389         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
3390
3391         if (genlmsg_end(msg, hdr) < 0) {
3392                 nlmsg_free(msg);
3393                 return;
3394         }
3395
3396         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_ATOMIC);
3397         return;
3398
3399  nla_put_failure:
3400         genlmsg_cancel(msg, hdr);
3401         nlmsg_free(msg);
3402 }
3403
3404 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
3405                           struct net_device *netdev, const u8 *buf, size_t len)
3406 {
3407         nl80211_send_mlme_event(rdev, netdev, buf, len,
3408                                 NL80211_CMD_AUTHENTICATE);
3409 }
3410
3411 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
3412                            struct net_device *netdev, const u8 *buf,
3413                            size_t len)
3414 {
3415         nl80211_send_mlme_event(rdev, netdev, buf, len, NL80211_CMD_ASSOCIATE);
3416 }
3417
3418 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
3419                          struct net_device *netdev, const u8 *buf, size_t len)
3420 {
3421         nl80211_send_mlme_event(rdev, netdev, buf, len,
3422                                 NL80211_CMD_DEAUTHENTICATE);
3423 }
3424
3425 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
3426                            struct net_device *netdev, const u8 *buf,
3427                            size_t len)
3428 {
3429         nl80211_send_mlme_event(rdev, netdev, buf, len,
3430                                 NL80211_CMD_DISASSOCIATE);
3431 }
3432
3433 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
3434                                  struct net_device *netdev, const u8 *addr,
3435                                  enum nl80211_key_type key_type, int key_id,
3436                                  const u8 *tsc)
3437 {
3438         struct sk_buff *msg;
3439         void *hdr;
3440
3441         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3442         if (!msg)
3443                 return;
3444
3445         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
3446         if (!hdr) {
3447                 nlmsg_free(msg);
3448                 return;
3449         }
3450
3451         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3452         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3453         if (addr)
3454                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3455         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
3456         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
3457         if (tsc)
3458                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
3459
3460         if (genlmsg_end(msg, hdr) < 0) {
3461                 nlmsg_free(msg);
3462                 return;
3463         }
3464
3465         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_KERNEL);
3466         return;
3467
3468  nla_put_failure:
3469         genlmsg_cancel(msg, hdr);
3470         nlmsg_free(msg);
3471 }
3472
3473 /* initialisation/exit functions */
3474
3475 int nl80211_init(void)
3476 {
3477         int err, i;
3478
3479         err = genl_register_family(&nl80211_fam);
3480         if (err)
3481                 return err;
3482
3483         for (i = 0; i < ARRAY_SIZE(nl80211_ops); i++) {
3484                 err = genl_register_ops(&nl80211_fam, &nl80211_ops[i]);
3485                 if (err)
3486                         goto err_out;
3487         }
3488
3489         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
3490         if (err)
3491                 goto err_out;
3492
3493         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
3494         if (err)
3495                 goto err_out;
3496
3497         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
3498         if (err)
3499                 goto err_out;
3500
3501         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
3502         if (err)
3503                 goto err_out;
3504
3505         return 0;
3506  err_out:
3507         genl_unregister_family(&nl80211_fam);
3508         return err;
3509 }
3510
3511 void nl80211_exit(void)
3512 {
3513         genl_unregister_family(&nl80211_fam);
3514 }