66024ef57bab684900ac79cb714c1672a61b027c
[linux-2.6.git] / net / wireless / nl80211.c
1 /*
2  * This is the new netlink-based wireless configuration interface.
3  *
4  * Copyright 2006-2009  Johannes Berg <johannes@sipsolutions.net>
5  */
6
7 #include <linux/if.h>
8 #include <linux/module.h>
9 #include <linux/err.h>
10 #include <linux/list.h>
11 #include <linux/if_ether.h>
12 #include <linux/ieee80211.h>
13 #include <linux/nl80211.h>
14 #include <linux/rtnetlink.h>
15 #include <linux/netlink.h>
16 #include <linux/etherdevice.h>
17 #include <net/genetlink.h>
18 #include <net/cfg80211.h>
19 #include "core.h"
20 #include "nl80211.h"
21 #include "reg.h"
22
23 /* the netlink family */
24 static struct genl_family nl80211_fam = {
25         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
26         .name = "nl80211",      /* have users key off the name instead */
27         .hdrsize = 0,           /* no private header */
28         .version = 1,           /* no particular meaning now */
29         .maxattr = NL80211_ATTR_MAX,
30 };
31
32 /* internal helper: get drv and dev */
33 static int get_drv_dev_by_info_ifindex(struct nlattr **attrs,
34                                        struct cfg80211_registered_device **drv,
35                                        struct net_device **dev)
36 {
37         int ifindex;
38
39         if (!attrs[NL80211_ATTR_IFINDEX])
40                 return -EINVAL;
41
42         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
43         *dev = dev_get_by_index(&init_net, ifindex);
44         if (!*dev)
45                 return -ENODEV;
46
47         *drv = cfg80211_get_dev_from_ifindex(ifindex);
48         if (IS_ERR(*drv)) {
49                 dev_put(*dev);
50                 return PTR_ERR(*drv);
51         }
52
53         return 0;
54 }
55
56 /* policy for the attributes */
57 static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
58         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
59         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
60                                       .len = BUS_ID_SIZE-1 },
61         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
62         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
63         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
64         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
65         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
66         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
67         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
68
69         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
70         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
71         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
72
73         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
74
75         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
76                                     .len = WLAN_MAX_KEY_LEN },
77         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
78         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
79         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
80
81         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
82         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
83         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
84                                        .len = IEEE80211_MAX_DATA_LEN },
85         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
86                                        .len = IEEE80211_MAX_DATA_LEN },
87         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
88         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
89         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
90         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
91                                                .len = NL80211_MAX_SUPP_RATES },
92         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
93         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
94         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
95         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
96                                 .len = IEEE80211_MAX_MESH_ID_LEN },
97         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
98
99         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
100         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
101
102         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
103         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
104         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
105         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
106                                            .len = NL80211_MAX_SUPP_RATES },
107
108         [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
109
110         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
111                                          .len = NL80211_HT_CAPABILITY_LEN },
112
113         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
114         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
115                               .len = IEEE80211_MAX_DATA_LEN },
116         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
117         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
118
119         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
120                                 .len = IEEE80211_MAX_SSID_LEN },
121         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
122         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
123         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
124         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
125         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
126         [NL80211_ATTR_STA_FLAGS2] = {
127                 .len = sizeof(struct nl80211_sta_flag_update),
128         },
129 };
130
131 /* IE validation */
132 static bool is_valid_ie_attr(const struct nlattr *attr)
133 {
134         const u8 *pos;
135         int len;
136
137         if (!attr)
138                 return true;
139
140         pos = nla_data(attr);
141         len = nla_len(attr);
142
143         while (len) {
144                 u8 elemlen;
145
146                 if (len < 2)
147                         return false;
148                 len -= 2;
149
150                 elemlen = pos[1];
151                 if (elemlen > len)
152                         return false;
153
154                 len -= elemlen;
155                 pos += 2 + elemlen;
156         }
157
158         return true;
159 }
160
161 /* message building helper */
162 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
163                                    int flags, u8 cmd)
164 {
165         /* since there is no private header just add the generic one */
166         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
167 }
168
169 static int nl80211_msg_put_channel(struct sk_buff *msg,
170                                    struct ieee80211_channel *chan)
171 {
172         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
173                     chan->center_freq);
174
175         if (chan->flags & IEEE80211_CHAN_DISABLED)
176                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
177         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
178                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
179         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
180                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
181         if (chan->flags & IEEE80211_CHAN_RADAR)
182                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
183
184         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
185                     DBM_TO_MBM(chan->max_power));
186
187         return 0;
188
189  nla_put_failure:
190         return -ENOBUFS;
191 }
192
193 /* netlink command implementations */
194
195 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
196                               struct cfg80211_registered_device *dev)
197 {
198         void *hdr;
199         struct nlattr *nl_bands, *nl_band;
200         struct nlattr *nl_freqs, *nl_freq;
201         struct nlattr *nl_rates, *nl_rate;
202         struct nlattr *nl_modes;
203         struct nlattr *nl_cmds;
204         enum ieee80211_band band;
205         struct ieee80211_channel *chan;
206         struct ieee80211_rate *rate;
207         int i;
208         u16 ifmodes = dev->wiphy.interface_modes;
209
210         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
211         if (!hdr)
212                 return -1;
213
214         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
215         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
216
217         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
218                    dev->wiphy.retry_short);
219         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
220                    dev->wiphy.retry_long);
221         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
222                     dev->wiphy.frag_threshold);
223         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
224                     dev->wiphy.rts_threshold);
225
226         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
227                    dev->wiphy.max_scan_ssids);
228         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
229                     dev->wiphy.max_scan_ie_len);
230
231         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
232                 sizeof(u32) * dev->wiphy.n_cipher_suites,
233                 dev->wiphy.cipher_suites);
234
235         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
236         if (!nl_modes)
237                 goto nla_put_failure;
238
239         i = 0;
240         while (ifmodes) {
241                 if (ifmodes & 1)
242                         NLA_PUT_FLAG(msg, i);
243                 ifmodes >>= 1;
244                 i++;
245         }
246
247         nla_nest_end(msg, nl_modes);
248
249         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
250         if (!nl_bands)
251                 goto nla_put_failure;
252
253         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
254                 if (!dev->wiphy.bands[band])
255                         continue;
256
257                 nl_band = nla_nest_start(msg, band);
258                 if (!nl_band)
259                         goto nla_put_failure;
260
261                 /* add HT info */
262                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
263                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
264                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
265                                 &dev->wiphy.bands[band]->ht_cap.mcs);
266                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
267                                 dev->wiphy.bands[band]->ht_cap.cap);
268                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
269                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
270                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
271                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
272                 }
273
274                 /* add frequencies */
275                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
276                 if (!nl_freqs)
277                         goto nla_put_failure;
278
279                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
280                         nl_freq = nla_nest_start(msg, i);
281                         if (!nl_freq)
282                                 goto nla_put_failure;
283
284                         chan = &dev->wiphy.bands[band]->channels[i];
285
286                         if (nl80211_msg_put_channel(msg, chan))
287                                 goto nla_put_failure;
288
289                         nla_nest_end(msg, nl_freq);
290                 }
291
292                 nla_nest_end(msg, nl_freqs);
293
294                 /* add bitrates */
295                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
296                 if (!nl_rates)
297                         goto nla_put_failure;
298
299                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
300                         nl_rate = nla_nest_start(msg, i);
301                         if (!nl_rate)
302                                 goto nla_put_failure;
303
304                         rate = &dev->wiphy.bands[band]->bitrates[i];
305                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
306                                     rate->bitrate);
307                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
308                                 NLA_PUT_FLAG(msg,
309                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
310
311                         nla_nest_end(msg, nl_rate);
312                 }
313
314                 nla_nest_end(msg, nl_rates);
315
316                 nla_nest_end(msg, nl_band);
317         }
318         nla_nest_end(msg, nl_bands);
319
320         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
321         if (!nl_cmds)
322                 goto nla_put_failure;
323
324         i = 0;
325 #define CMD(op, n)                                              \
326          do {                                                   \
327                 if (dev->ops->op) {                             \
328                         i++;                                    \
329                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
330                 }                                               \
331         } while (0)
332
333         CMD(add_virtual_intf, NEW_INTERFACE);
334         CMD(change_virtual_intf, SET_INTERFACE);
335         CMD(add_key, NEW_KEY);
336         CMD(add_beacon, NEW_BEACON);
337         CMD(add_station, NEW_STATION);
338         CMD(add_mpath, NEW_MPATH);
339         CMD(set_mesh_params, SET_MESH_PARAMS);
340         CMD(change_bss, SET_BSS);
341         CMD(auth, AUTHENTICATE);
342         CMD(assoc, ASSOCIATE);
343         CMD(deauth, DEAUTHENTICATE);
344         CMD(disassoc, DISASSOCIATE);
345         CMD(join_ibss, JOIN_IBSS);
346
347 #undef CMD
348         nla_nest_end(msg, nl_cmds);
349
350         return genlmsg_end(msg, hdr);
351
352  nla_put_failure:
353         genlmsg_cancel(msg, hdr);
354         return -EMSGSIZE;
355 }
356
357 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
358 {
359         int idx = 0;
360         int start = cb->args[0];
361         struct cfg80211_registered_device *dev;
362
363         mutex_lock(&cfg80211_mutex);
364         list_for_each_entry(dev, &cfg80211_drv_list, list) {
365                 if (++idx <= start)
366                         continue;
367                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
368                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
369                                        dev) < 0) {
370                         idx--;
371                         break;
372                 }
373         }
374         mutex_unlock(&cfg80211_mutex);
375
376         cb->args[0] = idx;
377
378         return skb->len;
379 }
380
381 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
382 {
383         struct sk_buff *msg;
384         struct cfg80211_registered_device *dev;
385
386         dev = cfg80211_get_dev_from_info(info);
387         if (IS_ERR(dev))
388                 return PTR_ERR(dev);
389
390         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
391         if (!msg)
392                 goto out_err;
393
394         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
395                 goto out_free;
396
397         cfg80211_put_dev(dev);
398
399         return genlmsg_unicast(msg, info->snd_pid);
400
401  out_free:
402         nlmsg_free(msg);
403  out_err:
404         cfg80211_put_dev(dev);
405         return -ENOBUFS;
406 }
407
408 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
409         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
410         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
411         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
412         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
413         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
414 };
415
416 static int parse_txq_params(struct nlattr *tb[],
417                             struct ieee80211_txq_params *txq_params)
418 {
419         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
420             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
421             !tb[NL80211_TXQ_ATTR_AIFS])
422                 return -EINVAL;
423
424         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
425         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
426         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
427         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
428         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
429
430         return 0;
431 }
432
433 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
434 {
435         struct cfg80211_registered_device *rdev;
436         int result = 0, rem_txq_params = 0;
437         struct nlattr *nl_txq_params;
438         u32 changed;
439         u8 retry_short = 0, retry_long = 0;
440         u32 frag_threshold = 0, rts_threshold = 0;
441
442         rtnl_lock();
443
444         mutex_lock(&cfg80211_mutex);
445
446         rdev = __cfg80211_drv_from_info(info);
447         if (IS_ERR(rdev)) {
448                 result = PTR_ERR(rdev);
449                 goto unlock;
450         }
451
452         mutex_lock(&rdev->mtx);
453
454         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
455                 result = cfg80211_dev_rename(
456                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
457
458         mutex_unlock(&cfg80211_mutex);
459
460         if (result)
461                 goto bad_res;
462
463         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
464                 struct ieee80211_txq_params txq_params;
465                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
466
467                 if (!rdev->ops->set_txq_params) {
468                         result = -EOPNOTSUPP;
469                         goto bad_res;
470                 }
471
472                 nla_for_each_nested(nl_txq_params,
473                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
474                                     rem_txq_params) {
475                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
476                                   nla_data(nl_txq_params),
477                                   nla_len(nl_txq_params),
478                                   txq_params_policy);
479                         result = parse_txq_params(tb, &txq_params);
480                         if (result)
481                                 goto bad_res;
482
483                         result = rdev->ops->set_txq_params(&rdev->wiphy,
484                                                            &txq_params);
485                         if (result)
486                                 goto bad_res;
487                 }
488         }
489
490         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
491                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
492                 struct ieee80211_channel *chan;
493                 struct ieee80211_sta_ht_cap *ht_cap;
494                 u32 freq, sec_freq;
495
496                 if (!rdev->ops->set_channel) {
497                         result = -EOPNOTSUPP;
498                         goto bad_res;
499                 }
500
501                 result = -EINVAL;
502
503                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
504                         channel_type = nla_get_u32(info->attrs[
505                                            NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
506                         if (channel_type != NL80211_CHAN_NO_HT &&
507                             channel_type != NL80211_CHAN_HT20 &&
508                             channel_type != NL80211_CHAN_HT40PLUS &&
509                             channel_type != NL80211_CHAN_HT40MINUS)
510                                 goto bad_res;
511                 }
512
513                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
514                 chan = ieee80211_get_channel(&rdev->wiphy, freq);
515
516                 /* Primary channel not allowed */
517                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
518                         goto bad_res;
519
520                 if (channel_type == NL80211_CHAN_HT40MINUS)
521                         sec_freq = freq - 20;
522                 else if (channel_type == NL80211_CHAN_HT40PLUS)
523                         sec_freq = freq + 20;
524                 else
525                         sec_freq = 0;
526
527                 ht_cap = &rdev->wiphy.bands[chan->band]->ht_cap;
528
529                 /* no HT capabilities */
530                 if (channel_type != NL80211_CHAN_NO_HT &&
531                     !ht_cap->ht_supported)
532                         goto bad_res;
533
534                 if (sec_freq) {
535                         struct ieee80211_channel *schan;
536
537                         /* no 40 MHz capabilities */
538                         if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
539                             (ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT))
540                                 goto bad_res;
541
542                         schan = ieee80211_get_channel(&rdev->wiphy, sec_freq);
543
544                         /* Secondary channel not allowed */
545                         if (!schan || schan->flags & IEEE80211_CHAN_DISABLED)
546                                 goto bad_res;
547                 }
548
549                 result = rdev->ops->set_channel(&rdev->wiphy, chan,
550                                                 channel_type);
551                 if (result)
552                         goto bad_res;
553         }
554
555         changed = 0;
556
557         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
558                 retry_short = nla_get_u8(
559                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
560                 if (retry_short == 0) {
561                         result = -EINVAL;
562                         goto bad_res;
563                 }
564                 changed |= WIPHY_PARAM_RETRY_SHORT;
565         }
566
567         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
568                 retry_long = nla_get_u8(
569                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
570                 if (retry_long == 0) {
571                         result = -EINVAL;
572                         goto bad_res;
573                 }
574                 changed |= WIPHY_PARAM_RETRY_LONG;
575         }
576
577         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
578                 frag_threshold = nla_get_u32(
579                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
580                 if (frag_threshold < 256) {
581                         result = -EINVAL;
582                         goto bad_res;
583                 }
584                 if (frag_threshold != (u32) -1) {
585                         /*
586                          * Fragments (apart from the last one) are required to
587                          * have even length. Make the fragmentation code
588                          * simpler by stripping LSB should someone try to use
589                          * odd threshold value.
590                          */
591                         frag_threshold &= ~0x1;
592                 }
593                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
594         }
595
596         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
597                 rts_threshold = nla_get_u32(
598                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
599                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
600         }
601
602         if (changed) {
603                 u8 old_retry_short, old_retry_long;
604                 u32 old_frag_threshold, old_rts_threshold;
605
606                 if (!rdev->ops->set_wiphy_params) {
607                         result = -EOPNOTSUPP;
608                         goto bad_res;
609                 }
610
611                 old_retry_short = rdev->wiphy.retry_short;
612                 old_retry_long = rdev->wiphy.retry_long;
613                 old_frag_threshold = rdev->wiphy.frag_threshold;
614                 old_rts_threshold = rdev->wiphy.rts_threshold;
615
616                 if (changed & WIPHY_PARAM_RETRY_SHORT)
617                         rdev->wiphy.retry_short = retry_short;
618                 if (changed & WIPHY_PARAM_RETRY_LONG)
619                         rdev->wiphy.retry_long = retry_long;
620                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
621                         rdev->wiphy.frag_threshold = frag_threshold;
622                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
623                         rdev->wiphy.rts_threshold = rts_threshold;
624
625                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
626                 if (result) {
627                         rdev->wiphy.retry_short = old_retry_short;
628                         rdev->wiphy.retry_long = old_retry_long;
629                         rdev->wiphy.frag_threshold = old_frag_threshold;
630                         rdev->wiphy.rts_threshold = old_rts_threshold;
631                 }
632         }
633
634  bad_res:
635         mutex_unlock(&rdev->mtx);
636  unlock:
637         rtnl_unlock();
638         return result;
639 }
640
641
642 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
643                               struct cfg80211_registered_device *rdev,
644                               struct net_device *dev)
645 {
646         void *hdr;
647
648         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
649         if (!hdr)
650                 return -1;
651
652         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
653         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
654         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
655         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
656         return genlmsg_end(msg, hdr);
657
658  nla_put_failure:
659         genlmsg_cancel(msg, hdr);
660         return -EMSGSIZE;
661 }
662
663 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
664 {
665         int wp_idx = 0;
666         int if_idx = 0;
667         int wp_start = cb->args[0];
668         int if_start = cb->args[1];
669         struct cfg80211_registered_device *dev;
670         struct wireless_dev *wdev;
671
672         mutex_lock(&cfg80211_mutex);
673         list_for_each_entry(dev, &cfg80211_drv_list, list) {
674                 if (wp_idx < wp_start) {
675                         wp_idx++;
676                         continue;
677                 }
678                 if_idx = 0;
679
680                 mutex_lock(&dev->devlist_mtx);
681                 list_for_each_entry(wdev, &dev->netdev_list, list) {
682                         if (if_idx < if_start) {
683                                 if_idx++;
684                                 continue;
685                         }
686                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
687                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
688                                                dev, wdev->netdev) < 0) {
689                                 mutex_unlock(&dev->devlist_mtx);
690                                 goto out;
691                         }
692                         if_idx++;
693                 }
694                 mutex_unlock(&dev->devlist_mtx);
695
696                 wp_idx++;
697         }
698  out:
699         mutex_unlock(&cfg80211_mutex);
700
701         cb->args[0] = wp_idx;
702         cb->args[1] = if_idx;
703
704         return skb->len;
705 }
706
707 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
708 {
709         struct sk_buff *msg;
710         struct cfg80211_registered_device *dev;
711         struct net_device *netdev;
712         int err;
713
714         err = get_drv_dev_by_info_ifindex(info->attrs, &dev, &netdev);
715         if (err)
716                 return err;
717
718         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
719         if (!msg)
720                 goto out_err;
721
722         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
723                                dev, netdev) < 0)
724                 goto out_free;
725
726         dev_put(netdev);
727         cfg80211_put_dev(dev);
728
729         return genlmsg_unicast(msg, info->snd_pid);
730
731  out_free:
732         nlmsg_free(msg);
733  out_err:
734         dev_put(netdev);
735         cfg80211_put_dev(dev);
736         return -ENOBUFS;
737 }
738
739 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
740         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
741         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
742         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
743         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
744         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
745 };
746
747 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
748 {
749         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
750         int flag;
751
752         *mntrflags = 0;
753
754         if (!nla)
755                 return -EINVAL;
756
757         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
758                              nla, mntr_flags_policy))
759                 return -EINVAL;
760
761         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
762                 if (flags[flag])
763                         *mntrflags |= (1<<flag);
764
765         return 0;
766 }
767
768 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
769 {
770         struct cfg80211_registered_device *drv;
771         struct vif_params params;
772         int err, ifindex;
773         enum nl80211_iftype otype, ntype;
774         struct net_device *dev;
775         u32 _flags, *flags = NULL;
776         bool change = false;
777
778         memset(&params, 0, sizeof(params));
779
780         rtnl_lock();
781
782         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
783         if (err)
784                 goto unlock_rtnl;
785
786         ifindex = dev->ifindex;
787         otype = ntype = dev->ieee80211_ptr->iftype;
788         dev_put(dev);
789
790         if (info->attrs[NL80211_ATTR_IFTYPE]) {
791                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
792                 if (otype != ntype)
793                         change = true;
794                 if (ntype > NL80211_IFTYPE_MAX) {
795                         err = -EINVAL;
796                         goto unlock;
797                 }
798         }
799
800         if (!drv->ops->change_virtual_intf ||
801             !(drv->wiphy.interface_modes & (1 << ntype))) {
802                 err = -EOPNOTSUPP;
803                 goto unlock;
804         }
805
806         if (info->attrs[NL80211_ATTR_MESH_ID]) {
807                 if (ntype != NL80211_IFTYPE_MESH_POINT) {
808                         err = -EINVAL;
809                         goto unlock;
810                 }
811                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
812                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
813                 change = true;
814         }
815
816         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
817                 if (ntype != NL80211_IFTYPE_MONITOR) {
818                         err = -EINVAL;
819                         goto unlock;
820                 }
821                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
822                                           &_flags);
823                 if (err)
824                         goto unlock;
825
826                 flags = &_flags;
827                 change = true;
828         }
829
830         if (change)
831                 err = drv->ops->change_virtual_intf(&drv->wiphy, ifindex,
832                                                     ntype, flags, &params);
833         else
834                 err = 0;
835
836         dev = __dev_get_by_index(&init_net, ifindex);
837         WARN_ON(!dev || (!err && dev->ieee80211_ptr->iftype != ntype));
838
839         if (dev && !err && (ntype != otype)) {
840                 if (otype == NL80211_IFTYPE_ADHOC)
841                         cfg80211_clear_ibss(dev, false);
842         }
843
844  unlock:
845         cfg80211_put_dev(drv);
846  unlock_rtnl:
847         rtnl_unlock();
848         return err;
849 }
850
851 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
852 {
853         struct cfg80211_registered_device *drv;
854         struct vif_params params;
855         int err;
856         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
857         u32 flags;
858
859         memset(&params, 0, sizeof(params));
860
861         if (!info->attrs[NL80211_ATTR_IFNAME])
862                 return -EINVAL;
863
864         if (info->attrs[NL80211_ATTR_IFTYPE]) {
865                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
866                 if (type > NL80211_IFTYPE_MAX)
867                         return -EINVAL;
868         }
869
870         rtnl_lock();
871
872         drv = cfg80211_get_dev_from_info(info);
873         if (IS_ERR(drv)) {
874                 err = PTR_ERR(drv);
875                 goto unlock_rtnl;
876         }
877
878         if (!drv->ops->add_virtual_intf ||
879             !(drv->wiphy.interface_modes & (1 << type))) {
880                 err = -EOPNOTSUPP;
881                 goto unlock;
882         }
883
884         if (type == NL80211_IFTYPE_MESH_POINT &&
885             info->attrs[NL80211_ATTR_MESH_ID]) {
886                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
887                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
888         }
889
890         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
891                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
892                                   &flags);
893         err = drv->ops->add_virtual_intf(&drv->wiphy,
894                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
895                 type, err ? NULL : &flags, &params);
896
897  unlock:
898         cfg80211_put_dev(drv);
899  unlock_rtnl:
900         rtnl_unlock();
901         return err;
902 }
903
904 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
905 {
906         struct cfg80211_registered_device *drv;
907         int ifindex, err;
908         struct net_device *dev;
909
910         rtnl_lock();
911
912         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
913         if (err)
914                 goto unlock_rtnl;
915         ifindex = dev->ifindex;
916         dev_put(dev);
917
918         if (!drv->ops->del_virtual_intf) {
919                 err = -EOPNOTSUPP;
920                 goto out;
921         }
922
923         err = drv->ops->del_virtual_intf(&drv->wiphy, ifindex);
924
925  out:
926         cfg80211_put_dev(drv);
927  unlock_rtnl:
928         rtnl_unlock();
929         return err;
930 }
931
932 struct get_key_cookie {
933         struct sk_buff *msg;
934         int error;
935 };
936
937 static void get_key_callback(void *c, struct key_params *params)
938 {
939         struct get_key_cookie *cookie = c;
940
941         if (params->key)
942                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
943                         params->key_len, params->key);
944
945         if (params->seq)
946                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
947                         params->seq_len, params->seq);
948
949         if (params->cipher)
950                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
951                             params->cipher);
952
953         return;
954  nla_put_failure:
955         cookie->error = 1;
956 }
957
958 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
959 {
960         struct cfg80211_registered_device *drv;
961         int err;
962         struct net_device *dev;
963         u8 key_idx = 0;
964         u8 *mac_addr = NULL;
965         struct get_key_cookie cookie = {
966                 .error = 0,
967         };
968         void *hdr;
969         struct sk_buff *msg;
970
971         if (info->attrs[NL80211_ATTR_KEY_IDX])
972                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
973
974         if (key_idx > 5)
975                 return -EINVAL;
976
977         if (info->attrs[NL80211_ATTR_MAC])
978                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
979
980         rtnl_lock();
981
982         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
983         if (err)
984                 goto unlock_rtnl;
985
986         if (!drv->ops->get_key) {
987                 err = -EOPNOTSUPP;
988                 goto out;
989         }
990
991         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
992         if (!msg) {
993                 err = -ENOMEM;
994                 goto out;
995         }
996
997         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
998                              NL80211_CMD_NEW_KEY);
999
1000         if (IS_ERR(hdr)) {
1001                 err = PTR_ERR(hdr);
1002                 goto out;
1003         }
1004
1005         cookie.msg = msg;
1006
1007         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1008         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1009         if (mac_addr)
1010                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1011
1012         err = drv->ops->get_key(&drv->wiphy, dev, key_idx, mac_addr,
1013                                 &cookie, get_key_callback);
1014
1015         if (err)
1016                 goto out;
1017
1018         if (cookie.error)
1019                 goto nla_put_failure;
1020
1021         genlmsg_end(msg, hdr);
1022         err = genlmsg_unicast(msg, info->snd_pid);
1023         goto out;
1024
1025  nla_put_failure:
1026         err = -ENOBUFS;
1027         nlmsg_free(msg);
1028  out:
1029         cfg80211_put_dev(drv);
1030         dev_put(dev);
1031  unlock_rtnl:
1032         rtnl_unlock();
1033
1034         return err;
1035 }
1036
1037 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1038 {
1039         struct cfg80211_registered_device *drv;
1040         int err;
1041         struct net_device *dev;
1042         u8 key_idx;
1043         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
1044                     u8 key_index);
1045
1046         if (!info->attrs[NL80211_ATTR_KEY_IDX])
1047                 return -EINVAL;
1048
1049         key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1050
1051         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]) {
1052                 if (key_idx < 4 || key_idx > 5)
1053                         return -EINVAL;
1054         } else if (key_idx > 3)
1055                 return -EINVAL;
1056
1057         /* currently only support setting default key */
1058         if (!info->attrs[NL80211_ATTR_KEY_DEFAULT] &&
1059             !info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT])
1060                 return -EINVAL;
1061
1062         rtnl_lock();
1063
1064         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1065         if (err)
1066                 goto unlock_rtnl;
1067
1068         if (info->attrs[NL80211_ATTR_KEY_DEFAULT])
1069                 func = drv->ops->set_default_key;
1070         else
1071                 func = drv->ops->set_default_mgmt_key;
1072
1073         if (!func) {
1074                 err = -EOPNOTSUPP;
1075                 goto out;
1076         }
1077
1078         err = func(&drv->wiphy, dev, key_idx);
1079 #ifdef CONFIG_WIRELESS_EXT
1080         if (!err) {
1081                 if (func == drv->ops->set_default_key)
1082                         dev->ieee80211_ptr->wext.default_key = key_idx;
1083                 else
1084                         dev->ieee80211_ptr->wext.default_mgmt_key = key_idx;
1085         }
1086 #endif
1087
1088  out:
1089         cfg80211_put_dev(drv);
1090         dev_put(dev);
1091
1092  unlock_rtnl:
1093         rtnl_unlock();
1094
1095         return err;
1096 }
1097
1098 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1099 {
1100         struct cfg80211_registered_device *drv;
1101         int err, i;
1102         struct net_device *dev;
1103         struct key_params params;
1104         u8 key_idx = 0;
1105         u8 *mac_addr = NULL;
1106
1107         memset(&params, 0, sizeof(params));
1108
1109         if (!info->attrs[NL80211_ATTR_KEY_CIPHER])
1110                 return -EINVAL;
1111
1112         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1113                 params.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1114                 params.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1115         }
1116
1117         if (info->attrs[NL80211_ATTR_KEY_IDX])
1118                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1119
1120         params.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1121
1122         if (info->attrs[NL80211_ATTR_MAC])
1123                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1124
1125         if (cfg80211_validate_key_settings(&params, key_idx, mac_addr))
1126                 return -EINVAL;
1127
1128         rtnl_lock();
1129
1130         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1131         if (err)
1132                 goto unlock_rtnl;
1133
1134         for (i = 0; i < drv->wiphy.n_cipher_suites; i++)
1135                 if (params.cipher == drv->wiphy.cipher_suites[i])
1136                         break;
1137         if (i == drv->wiphy.n_cipher_suites) {
1138                 err = -EINVAL;
1139                 goto out;
1140         }
1141
1142         if (!drv->ops->add_key) {
1143                 err = -EOPNOTSUPP;
1144                 goto out;
1145         }
1146
1147         err = drv->ops->add_key(&drv->wiphy, dev, key_idx, mac_addr, &params);
1148
1149  out:
1150         cfg80211_put_dev(drv);
1151         dev_put(dev);
1152  unlock_rtnl:
1153         rtnl_unlock();
1154
1155         return err;
1156 }
1157
1158 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1159 {
1160         struct cfg80211_registered_device *drv;
1161         int err;
1162         struct net_device *dev;
1163         u8 key_idx = 0;
1164         u8 *mac_addr = NULL;
1165
1166         if (info->attrs[NL80211_ATTR_KEY_IDX])
1167                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1168
1169         if (key_idx > 5)
1170                 return -EINVAL;
1171
1172         if (info->attrs[NL80211_ATTR_MAC])
1173                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1174
1175         rtnl_lock();
1176
1177         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1178         if (err)
1179                 goto unlock_rtnl;
1180
1181         if (!drv->ops->del_key) {
1182                 err = -EOPNOTSUPP;
1183                 goto out;
1184         }
1185
1186         err = drv->ops->del_key(&drv->wiphy, dev, key_idx, mac_addr);
1187
1188 #ifdef CONFIG_WIRELESS_EXT
1189         if (!err) {
1190                 if (key_idx == dev->ieee80211_ptr->wext.default_key)
1191                         dev->ieee80211_ptr->wext.default_key = -1;
1192                 else if (key_idx == dev->ieee80211_ptr->wext.default_mgmt_key)
1193                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
1194         }
1195 #endif
1196
1197  out:
1198         cfg80211_put_dev(drv);
1199         dev_put(dev);
1200
1201  unlock_rtnl:
1202         rtnl_unlock();
1203
1204         return err;
1205 }
1206
1207 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1208 {
1209         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1210                     struct beacon_parameters *info);
1211         struct cfg80211_registered_device *drv;
1212         int err;
1213         struct net_device *dev;
1214         struct beacon_parameters params;
1215         int haveinfo = 0;
1216
1217         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
1218                 return -EINVAL;
1219
1220         rtnl_lock();
1221
1222         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1223         if (err)
1224                 goto unlock_rtnl;
1225
1226         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1227                 err = -EOPNOTSUPP;
1228                 goto out;
1229         }
1230
1231         switch (info->genlhdr->cmd) {
1232         case NL80211_CMD_NEW_BEACON:
1233                 /* these are required for NEW_BEACON */
1234                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1235                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1236                     !info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1237                         err = -EINVAL;
1238                         goto out;
1239                 }
1240
1241                 call = drv->ops->add_beacon;
1242                 break;
1243         case NL80211_CMD_SET_BEACON:
1244                 call = drv->ops->set_beacon;
1245                 break;
1246         default:
1247                 WARN_ON(1);
1248                 err = -EOPNOTSUPP;
1249                 goto out;
1250         }
1251
1252         if (!call) {
1253                 err = -EOPNOTSUPP;
1254                 goto out;
1255         }
1256
1257         memset(&params, 0, sizeof(params));
1258
1259         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1260                 params.interval =
1261                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1262                 haveinfo = 1;
1263         }
1264
1265         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1266                 params.dtim_period =
1267                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1268                 haveinfo = 1;
1269         }
1270
1271         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1272                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1273                 params.head_len =
1274                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1275                 haveinfo = 1;
1276         }
1277
1278         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1279                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1280                 params.tail_len =
1281                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1282                 haveinfo = 1;
1283         }
1284
1285         if (!haveinfo) {
1286                 err = -EINVAL;
1287                 goto out;
1288         }
1289
1290         err = call(&drv->wiphy, dev, &params);
1291
1292  out:
1293         cfg80211_put_dev(drv);
1294         dev_put(dev);
1295  unlock_rtnl:
1296         rtnl_unlock();
1297
1298         return err;
1299 }
1300
1301 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1302 {
1303         struct cfg80211_registered_device *drv;
1304         int err;
1305         struct net_device *dev;
1306
1307         rtnl_lock();
1308
1309         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1310         if (err)
1311                 goto unlock_rtnl;
1312
1313         if (!drv->ops->del_beacon) {
1314                 err = -EOPNOTSUPP;
1315                 goto out;
1316         }
1317
1318         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1319                 err = -EOPNOTSUPP;
1320                 goto out;
1321         }
1322         err = drv->ops->del_beacon(&drv->wiphy, dev);
1323
1324  out:
1325         cfg80211_put_dev(drv);
1326         dev_put(dev);
1327  unlock_rtnl:
1328         rtnl_unlock();
1329
1330         return err;
1331 }
1332
1333 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1334         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1335         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1336         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1337         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
1338 };
1339
1340 static int parse_station_flags(struct genl_info *info,
1341                                struct station_parameters *params)
1342 {
1343         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1344         struct nlattr *nla;
1345         int flag;
1346
1347         /*
1348          * Try parsing the new attribute first so userspace
1349          * can specify both for older kernels.
1350          */
1351         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
1352         if (nla) {
1353                 struct nl80211_sta_flag_update *sta_flags;
1354
1355                 sta_flags = nla_data(nla);
1356                 params->sta_flags_mask = sta_flags->mask;
1357                 params->sta_flags_set = sta_flags->set;
1358                 if ((params->sta_flags_mask |
1359                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
1360                         return -EINVAL;
1361                 return 0;
1362         }
1363
1364         /* if present, parse the old attribute */
1365
1366         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
1367         if (!nla)
1368                 return 0;
1369
1370         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1371                              nla, sta_flags_policy))
1372                 return -EINVAL;
1373
1374         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
1375         params->sta_flags_mask &= ~1;
1376
1377         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1378                 if (flags[flag])
1379                         params->sta_flags_set |= (1<<flag);
1380
1381         return 0;
1382 }
1383
1384 static u16 nl80211_calculate_bitrate(struct rate_info *rate)
1385 {
1386         int modulation, streams, bitrate;
1387
1388         if (!(rate->flags & RATE_INFO_FLAGS_MCS))
1389                 return rate->legacy;
1390
1391         /* the formula below does only work for MCS values smaller than 32 */
1392         if (rate->mcs >= 32)
1393                 return 0;
1394
1395         modulation = rate->mcs & 7;
1396         streams = (rate->mcs >> 3) + 1;
1397
1398         bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
1399                         13500000 : 6500000;
1400
1401         if (modulation < 4)
1402                 bitrate *= (modulation + 1);
1403         else if (modulation == 4)
1404                 bitrate *= (modulation + 2);
1405         else
1406                 bitrate *= (modulation + 3);
1407
1408         bitrate *= streams;
1409
1410         if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
1411                 bitrate = (bitrate / 9) * 10;
1412
1413         /* do NOT round down here */
1414         return (bitrate + 50000) / 100000;
1415 }
1416
1417 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1418                                 int flags, struct net_device *dev,
1419                                 u8 *mac_addr, struct station_info *sinfo)
1420 {
1421         void *hdr;
1422         struct nlattr *sinfoattr, *txrate;
1423         u16 bitrate;
1424
1425         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1426         if (!hdr)
1427                 return -1;
1428
1429         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1430         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1431
1432         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1433         if (!sinfoattr)
1434                 goto nla_put_failure;
1435         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1436                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1437                             sinfo->inactive_time);
1438         if (sinfo->filled & STATION_INFO_RX_BYTES)
1439                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1440                             sinfo->rx_bytes);
1441         if (sinfo->filled & STATION_INFO_TX_BYTES)
1442                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1443                             sinfo->tx_bytes);
1444         if (sinfo->filled & STATION_INFO_LLID)
1445                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1446                             sinfo->llid);
1447         if (sinfo->filled & STATION_INFO_PLID)
1448                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1449                             sinfo->plid);
1450         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1451                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1452                             sinfo->plink_state);
1453         if (sinfo->filled & STATION_INFO_SIGNAL)
1454                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1455                            sinfo->signal);
1456         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1457                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1458                 if (!txrate)
1459                         goto nla_put_failure;
1460
1461                 /* nl80211_calculate_bitrate will return 0 for mcs >= 32 */
1462                 bitrate = nl80211_calculate_bitrate(&sinfo->txrate);
1463                 if (bitrate > 0)
1464                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1465
1466                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1467                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1468                                     sinfo->txrate.mcs);
1469                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1470                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1471                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1472                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1473
1474                 nla_nest_end(msg, txrate);
1475         }
1476         if (sinfo->filled & STATION_INFO_RX_PACKETS)
1477                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
1478                             sinfo->rx_packets);
1479         if (sinfo->filled & STATION_INFO_TX_PACKETS)
1480                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
1481                             sinfo->tx_packets);
1482         nla_nest_end(msg, sinfoattr);
1483
1484         return genlmsg_end(msg, hdr);
1485
1486  nla_put_failure:
1487         genlmsg_cancel(msg, hdr);
1488         return -EMSGSIZE;
1489 }
1490
1491 static int nl80211_dump_station(struct sk_buff *skb,
1492                                 struct netlink_callback *cb)
1493 {
1494         struct station_info sinfo;
1495         struct cfg80211_registered_device *dev;
1496         struct net_device *netdev;
1497         u8 mac_addr[ETH_ALEN];
1498         int ifidx = cb->args[0];
1499         int sta_idx = cb->args[1];
1500         int err;
1501
1502         if (!ifidx) {
1503                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1504                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1505                                   nl80211_policy);
1506                 if (err)
1507                         return err;
1508
1509                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1510                         return -EINVAL;
1511
1512                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1513                 if (!ifidx)
1514                         return -EINVAL;
1515         }
1516
1517         rtnl_lock();
1518
1519         netdev = __dev_get_by_index(&init_net, ifidx);
1520         if (!netdev) {
1521                 err = -ENODEV;
1522                 goto out_rtnl;
1523         }
1524
1525         dev = cfg80211_get_dev_from_ifindex(ifidx);
1526         if (IS_ERR(dev)) {
1527                 err = PTR_ERR(dev);
1528                 goto out_rtnl;
1529         }
1530
1531         if (!dev->ops->dump_station) {
1532                 err = -EOPNOTSUPP;
1533                 goto out_err;
1534         }
1535
1536         while (1) {
1537                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1538                                              mac_addr, &sinfo);
1539                 if (err == -ENOENT)
1540                         break;
1541                 if (err)
1542                         goto out_err;
1543
1544                 if (nl80211_send_station(skb,
1545                                 NETLINK_CB(cb->skb).pid,
1546                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
1547                                 netdev, mac_addr,
1548                                 &sinfo) < 0)
1549                         goto out;
1550
1551                 sta_idx++;
1552         }
1553
1554
1555  out:
1556         cb->args[1] = sta_idx;
1557         err = skb->len;
1558  out_err:
1559         cfg80211_put_dev(dev);
1560  out_rtnl:
1561         rtnl_unlock();
1562
1563         return err;
1564 }
1565
1566 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1567 {
1568         struct cfg80211_registered_device *drv;
1569         int err;
1570         struct net_device *dev;
1571         struct station_info sinfo;
1572         struct sk_buff *msg;
1573         u8 *mac_addr = NULL;
1574
1575         memset(&sinfo, 0, sizeof(sinfo));
1576
1577         if (!info->attrs[NL80211_ATTR_MAC])
1578                 return -EINVAL;
1579
1580         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1581
1582         rtnl_lock();
1583
1584         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1585         if (err)
1586                 goto out_rtnl;
1587
1588         if (!drv->ops->get_station) {
1589                 err = -EOPNOTSUPP;
1590                 goto out;
1591         }
1592
1593         err = drv->ops->get_station(&drv->wiphy, dev, mac_addr, &sinfo);
1594         if (err)
1595                 goto out;
1596
1597         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1598         if (!msg)
1599                 goto out;
1600
1601         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1602                                  dev, mac_addr, &sinfo) < 0)
1603                 goto out_free;
1604
1605         err = genlmsg_unicast(msg, info->snd_pid);
1606         goto out;
1607
1608  out_free:
1609         nlmsg_free(msg);
1610  out:
1611         cfg80211_put_dev(drv);
1612         dev_put(dev);
1613  out_rtnl:
1614         rtnl_unlock();
1615
1616         return err;
1617 }
1618
1619 /*
1620  * Get vlan interface making sure it is on the right wiphy.
1621  */
1622 static int get_vlan(struct nlattr *vlanattr,
1623                     struct cfg80211_registered_device *rdev,
1624                     struct net_device **vlan)
1625 {
1626         *vlan = NULL;
1627
1628         if (vlanattr) {
1629                 *vlan = dev_get_by_index(&init_net, nla_get_u32(vlanattr));
1630                 if (!*vlan)
1631                         return -ENODEV;
1632                 if (!(*vlan)->ieee80211_ptr)
1633                         return -EINVAL;
1634                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
1635                         return -EINVAL;
1636         }
1637         return 0;
1638 }
1639
1640 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
1641 {
1642         struct cfg80211_registered_device *drv;
1643         int err;
1644         struct net_device *dev;
1645         struct station_parameters params;
1646         u8 *mac_addr = NULL;
1647
1648         memset(&params, 0, sizeof(params));
1649
1650         params.listen_interval = -1;
1651
1652         if (info->attrs[NL80211_ATTR_STA_AID])
1653                 return -EINVAL;
1654
1655         if (!info->attrs[NL80211_ATTR_MAC])
1656                 return -EINVAL;
1657
1658         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1659
1660         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
1661                 params.supported_rates =
1662                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1663                 params.supported_rates_len =
1664                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1665         }
1666
1667         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1668                 params.listen_interval =
1669                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1670
1671         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1672                 params.ht_capa =
1673                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1674
1675         if (parse_station_flags(info, &params))
1676                 return -EINVAL;
1677
1678         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
1679                 params.plink_action =
1680                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
1681
1682         rtnl_lock();
1683
1684         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1685         if (err)
1686                 goto out_rtnl;
1687
1688         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1689         if (err)
1690                 goto out;
1691
1692         if (!drv->ops->change_station) {
1693                 err = -EOPNOTSUPP;
1694                 goto out;
1695         }
1696
1697         err = drv->ops->change_station(&drv->wiphy, dev, mac_addr, &params);
1698
1699  out:
1700         if (params.vlan)
1701                 dev_put(params.vlan);
1702         cfg80211_put_dev(drv);
1703         dev_put(dev);
1704  out_rtnl:
1705         rtnl_unlock();
1706
1707         return err;
1708 }
1709
1710 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
1711 {
1712         struct cfg80211_registered_device *drv;
1713         int err;
1714         struct net_device *dev;
1715         struct station_parameters params;
1716         u8 *mac_addr = NULL;
1717
1718         memset(&params, 0, sizeof(params));
1719
1720         if (!info->attrs[NL80211_ATTR_MAC])
1721                 return -EINVAL;
1722
1723         if (!info->attrs[NL80211_ATTR_STA_AID])
1724                 return -EINVAL;
1725
1726         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1727                 return -EINVAL;
1728
1729         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
1730                 return -EINVAL;
1731
1732         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1733         params.supported_rates =
1734                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1735         params.supported_rates_len =
1736                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1737         params.listen_interval =
1738                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1739         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
1740         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1741                 params.ht_capa =
1742                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1743
1744         if (parse_station_flags(info, &params))
1745                 return -EINVAL;
1746
1747         rtnl_lock();
1748
1749         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1750         if (err)
1751                 goto out_rtnl;
1752
1753         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1754             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN) {
1755                 err = -EINVAL;
1756                 goto out;
1757         }
1758
1759         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1760         if (err)
1761                 goto out;
1762
1763         if (!drv->ops->add_station) {
1764                 err = -EOPNOTSUPP;
1765                 goto out;
1766         }
1767
1768         if (!netif_running(dev)) {
1769                 err = -ENETDOWN;
1770                 goto out;
1771         }
1772
1773         err = drv->ops->add_station(&drv->wiphy, dev, mac_addr, &params);
1774
1775  out:
1776         if (params.vlan)
1777                 dev_put(params.vlan);
1778         cfg80211_put_dev(drv);
1779         dev_put(dev);
1780  out_rtnl:
1781         rtnl_unlock();
1782
1783         return err;
1784 }
1785
1786 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
1787 {
1788         struct cfg80211_registered_device *drv;
1789         int err;
1790         struct net_device *dev;
1791         u8 *mac_addr = NULL;
1792
1793         if (info->attrs[NL80211_ATTR_MAC])
1794                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1795
1796         rtnl_lock();
1797
1798         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1799         if (err)
1800                 goto out_rtnl;
1801
1802         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1803             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN) {
1804                 err = -EINVAL;
1805                 goto out;
1806         }
1807
1808         if (!drv->ops->del_station) {
1809                 err = -EOPNOTSUPP;
1810                 goto out;
1811         }
1812
1813         err = drv->ops->del_station(&drv->wiphy, dev, mac_addr);
1814
1815  out:
1816         cfg80211_put_dev(drv);
1817         dev_put(dev);
1818  out_rtnl:
1819         rtnl_unlock();
1820
1821         return err;
1822 }
1823
1824 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
1825                                 int flags, struct net_device *dev,
1826                                 u8 *dst, u8 *next_hop,
1827                                 struct mpath_info *pinfo)
1828 {
1829         void *hdr;
1830         struct nlattr *pinfoattr;
1831
1832         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1833         if (!hdr)
1834                 return -1;
1835
1836         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1837         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
1838         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
1839
1840         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
1841         if (!pinfoattr)
1842                 goto nla_put_failure;
1843         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
1844                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
1845                             pinfo->frame_qlen);
1846         if (pinfo->filled & MPATH_INFO_DSN)
1847                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DSN,
1848                             pinfo->dsn);
1849         if (pinfo->filled & MPATH_INFO_METRIC)
1850                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
1851                             pinfo->metric);
1852         if (pinfo->filled & MPATH_INFO_EXPTIME)
1853                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
1854                             pinfo->exptime);
1855         if (pinfo->filled & MPATH_INFO_FLAGS)
1856                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
1857                             pinfo->flags);
1858         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
1859                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
1860                             pinfo->discovery_timeout);
1861         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
1862                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
1863                             pinfo->discovery_retries);
1864
1865         nla_nest_end(msg, pinfoattr);
1866
1867         return genlmsg_end(msg, hdr);
1868
1869  nla_put_failure:
1870         genlmsg_cancel(msg, hdr);
1871         return -EMSGSIZE;
1872 }
1873
1874 static int nl80211_dump_mpath(struct sk_buff *skb,
1875                               struct netlink_callback *cb)
1876 {
1877         struct mpath_info pinfo;
1878         struct cfg80211_registered_device *dev;
1879         struct net_device *netdev;
1880         u8 dst[ETH_ALEN];
1881         u8 next_hop[ETH_ALEN];
1882         int ifidx = cb->args[0];
1883         int path_idx = cb->args[1];
1884         int err;
1885
1886         if (!ifidx) {
1887                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1888                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1889                                   nl80211_policy);
1890                 if (err)
1891                         return err;
1892
1893                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1894                         return -EINVAL;
1895
1896                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1897                 if (!ifidx)
1898                         return -EINVAL;
1899         }
1900
1901         rtnl_lock();
1902
1903         netdev = __dev_get_by_index(&init_net, ifidx);
1904         if (!netdev) {
1905                 err = -ENODEV;
1906                 goto out_rtnl;
1907         }
1908
1909         dev = cfg80211_get_dev_from_ifindex(ifidx);
1910         if (IS_ERR(dev)) {
1911                 err = PTR_ERR(dev);
1912                 goto out_rtnl;
1913         }
1914
1915         if (!dev->ops->dump_mpath) {
1916                 err = -EOPNOTSUPP;
1917                 goto out_err;
1918         }
1919
1920         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1921                 err = -EOPNOTSUPP;
1922                 goto out;
1923         }
1924
1925         while (1) {
1926                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
1927                                            dst, next_hop, &pinfo);
1928                 if (err == -ENOENT)
1929                         break;
1930                 if (err)
1931                         goto out_err;
1932
1933                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
1934                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
1935                                        netdev, dst, next_hop,
1936                                        &pinfo) < 0)
1937                         goto out;
1938
1939                 path_idx++;
1940         }
1941
1942
1943  out:
1944         cb->args[1] = path_idx;
1945         err = skb->len;
1946  out_err:
1947         cfg80211_put_dev(dev);
1948  out_rtnl:
1949         rtnl_unlock();
1950
1951         return err;
1952 }
1953
1954 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
1955 {
1956         struct cfg80211_registered_device *drv;
1957         int err;
1958         struct net_device *dev;
1959         struct mpath_info pinfo;
1960         struct sk_buff *msg;
1961         u8 *dst = NULL;
1962         u8 next_hop[ETH_ALEN];
1963
1964         memset(&pinfo, 0, sizeof(pinfo));
1965
1966         if (!info->attrs[NL80211_ATTR_MAC])
1967                 return -EINVAL;
1968
1969         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1970
1971         rtnl_lock();
1972
1973         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1974         if (err)
1975                 goto out_rtnl;
1976
1977         if (!drv->ops->get_mpath) {
1978                 err = -EOPNOTSUPP;
1979                 goto out;
1980         }
1981
1982         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1983                 err = -EOPNOTSUPP;
1984                 goto out;
1985         }
1986
1987         err = drv->ops->get_mpath(&drv->wiphy, dev, dst, next_hop, &pinfo);
1988         if (err)
1989                 goto out;
1990
1991         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1992         if (!msg)
1993                 goto out;
1994
1995         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
1996                                  dev, dst, next_hop, &pinfo) < 0)
1997                 goto out_free;
1998
1999         err = genlmsg_unicast(msg, info->snd_pid);
2000         goto out;
2001
2002  out_free:
2003         nlmsg_free(msg);
2004  out:
2005         cfg80211_put_dev(drv);
2006         dev_put(dev);
2007  out_rtnl:
2008         rtnl_unlock();
2009
2010         return err;
2011 }
2012
2013 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2014 {
2015         struct cfg80211_registered_device *drv;
2016         int err;
2017         struct net_device *dev;
2018         u8 *dst = NULL;
2019         u8 *next_hop = NULL;
2020
2021         if (!info->attrs[NL80211_ATTR_MAC])
2022                 return -EINVAL;
2023
2024         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2025                 return -EINVAL;
2026
2027         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2028         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2029
2030         rtnl_lock();
2031
2032         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2033         if (err)
2034                 goto out_rtnl;
2035
2036         if (!drv->ops->change_mpath) {
2037                 err = -EOPNOTSUPP;
2038                 goto out;
2039         }
2040
2041         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2042                 err = -EOPNOTSUPP;
2043                 goto out;
2044         }
2045
2046         if (!netif_running(dev)) {
2047                 err = -ENETDOWN;
2048                 goto out;
2049         }
2050
2051         err = drv->ops->change_mpath(&drv->wiphy, dev, dst, next_hop);
2052
2053  out:
2054         cfg80211_put_dev(drv);
2055         dev_put(dev);
2056  out_rtnl:
2057         rtnl_unlock();
2058
2059         return err;
2060 }
2061 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2062 {
2063         struct cfg80211_registered_device *drv;
2064         int err;
2065         struct net_device *dev;
2066         u8 *dst = NULL;
2067         u8 *next_hop = NULL;
2068
2069         if (!info->attrs[NL80211_ATTR_MAC])
2070                 return -EINVAL;
2071
2072         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2073                 return -EINVAL;
2074
2075         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2076         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2077
2078         rtnl_lock();
2079
2080         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2081         if (err)
2082                 goto out_rtnl;
2083
2084         if (!drv->ops->add_mpath) {
2085                 err = -EOPNOTSUPP;
2086                 goto out;
2087         }
2088
2089         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2090                 err = -EOPNOTSUPP;
2091                 goto out;
2092         }
2093
2094         if (!netif_running(dev)) {
2095                 err = -ENETDOWN;
2096                 goto out;
2097         }
2098
2099         err = drv->ops->add_mpath(&drv->wiphy, dev, dst, next_hop);
2100
2101  out:
2102         cfg80211_put_dev(drv);
2103         dev_put(dev);
2104  out_rtnl:
2105         rtnl_unlock();
2106
2107         return err;
2108 }
2109
2110 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2111 {
2112         struct cfg80211_registered_device *drv;
2113         int err;
2114         struct net_device *dev;
2115         u8 *dst = NULL;
2116
2117         if (info->attrs[NL80211_ATTR_MAC])
2118                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2119
2120         rtnl_lock();
2121
2122         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2123         if (err)
2124                 goto out_rtnl;
2125
2126         if (!drv->ops->del_mpath) {
2127                 err = -EOPNOTSUPP;
2128                 goto out;
2129         }
2130
2131         err = drv->ops->del_mpath(&drv->wiphy, dev, dst);
2132
2133  out:
2134         cfg80211_put_dev(drv);
2135         dev_put(dev);
2136  out_rtnl:
2137         rtnl_unlock();
2138
2139         return err;
2140 }
2141
2142 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2143 {
2144         struct cfg80211_registered_device *drv;
2145         int err;
2146         struct net_device *dev;
2147         struct bss_parameters params;
2148
2149         memset(&params, 0, sizeof(params));
2150         /* default to not changing parameters */
2151         params.use_cts_prot = -1;
2152         params.use_short_preamble = -1;
2153         params.use_short_slot_time = -1;
2154
2155         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2156                 params.use_cts_prot =
2157                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2158         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2159                 params.use_short_preamble =
2160                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2161         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2162                 params.use_short_slot_time =
2163                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2164         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2165                 params.basic_rates =
2166                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2167                 params.basic_rates_len =
2168                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2169         }
2170
2171         rtnl_lock();
2172
2173         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2174         if (err)
2175                 goto out_rtnl;
2176
2177         if (!drv->ops->change_bss) {
2178                 err = -EOPNOTSUPP;
2179                 goto out;
2180         }
2181
2182         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
2183                 err = -EOPNOTSUPP;
2184                 goto out;
2185         }
2186
2187         err = drv->ops->change_bss(&drv->wiphy, dev, &params);
2188
2189  out:
2190         cfg80211_put_dev(drv);
2191         dev_put(dev);
2192  out_rtnl:
2193         rtnl_unlock();
2194
2195         return err;
2196 }
2197
2198 static const struct nla_policy
2199         reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2200         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2201         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2202         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2203         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2204         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2205         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2206 };
2207
2208 static int parse_reg_rule(struct nlattr *tb[],
2209         struct ieee80211_reg_rule *reg_rule)
2210 {
2211         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2212         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2213
2214         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2215                 return -EINVAL;
2216         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2217                 return -EINVAL;
2218         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2219                 return -EINVAL;
2220         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2221                 return -EINVAL;
2222         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2223                 return -EINVAL;
2224
2225         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2226
2227         freq_range->start_freq_khz =
2228                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2229         freq_range->end_freq_khz =
2230                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2231         freq_range->max_bandwidth_khz =
2232                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2233
2234         power_rule->max_eirp =
2235                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2236
2237         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2238                 power_rule->max_antenna_gain =
2239                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2240
2241         return 0;
2242 }
2243
2244 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2245 {
2246         int r;
2247         char *data = NULL;
2248
2249         /*
2250          * You should only get this when cfg80211 hasn't yet initialized
2251          * completely when built-in to the kernel right between the time
2252          * window between nl80211_init() and regulatory_init(), if that is
2253          * even possible.
2254          */
2255         mutex_lock(&cfg80211_mutex);
2256         if (unlikely(!cfg80211_regdomain)) {
2257                 mutex_unlock(&cfg80211_mutex);
2258                 return -EINPROGRESS;
2259         }
2260         mutex_unlock(&cfg80211_mutex);
2261
2262         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2263                 return -EINVAL;
2264
2265         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2266
2267 #ifdef CONFIG_WIRELESS_OLD_REGULATORY
2268         /* We ignore world regdom requests with the old regdom setup */
2269         if (is_world_regdom(data))
2270                 return -EINVAL;
2271 #endif
2272
2273         r = regulatory_hint_user(data);
2274
2275         return r;
2276 }
2277
2278 static int nl80211_get_mesh_params(struct sk_buff *skb,
2279         struct genl_info *info)
2280 {
2281         struct cfg80211_registered_device *drv;
2282         struct mesh_config cur_params;
2283         int err;
2284         struct net_device *dev;
2285         void *hdr;
2286         struct nlattr *pinfoattr;
2287         struct sk_buff *msg;
2288
2289         rtnl_lock();
2290
2291         /* Look up our device */
2292         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2293         if (err)
2294                 goto out_rtnl;
2295
2296         if (!drv->ops->get_mesh_params) {
2297                 err = -EOPNOTSUPP;
2298                 goto out;
2299         }
2300
2301         /* Get the mesh params */
2302         err = drv->ops->get_mesh_params(&drv->wiphy, dev, &cur_params);
2303         if (err)
2304                 goto out;
2305
2306         /* Draw up a netlink message to send back */
2307         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2308         if (!msg) {
2309                 err = -ENOBUFS;
2310                 goto out;
2311         }
2312         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2313                              NL80211_CMD_GET_MESH_PARAMS);
2314         if (!hdr)
2315                 goto nla_put_failure;
2316         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
2317         if (!pinfoattr)
2318                 goto nla_put_failure;
2319         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2320         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2321                         cur_params.dot11MeshRetryTimeout);
2322         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2323                         cur_params.dot11MeshConfirmTimeout);
2324         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2325                         cur_params.dot11MeshHoldingTimeout);
2326         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2327                         cur_params.dot11MeshMaxPeerLinks);
2328         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2329                         cur_params.dot11MeshMaxRetries);
2330         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2331                         cur_params.dot11MeshTTL);
2332         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2333                         cur_params.auto_open_plinks);
2334         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2335                         cur_params.dot11MeshHWMPmaxPREQretries);
2336         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2337                         cur_params.path_refresh_time);
2338         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2339                         cur_params.min_discovery_timeout);
2340         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2341                         cur_params.dot11MeshHWMPactivePathTimeout);
2342         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2343                         cur_params.dot11MeshHWMPpreqMinInterval);
2344         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2345                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2346         nla_nest_end(msg, pinfoattr);
2347         genlmsg_end(msg, hdr);
2348         err = genlmsg_unicast(msg, info->snd_pid);
2349         goto out;
2350
2351  nla_put_failure:
2352         genlmsg_cancel(msg, hdr);
2353         err = -EMSGSIZE;
2354  out:
2355         /* Cleanup */
2356         cfg80211_put_dev(drv);
2357         dev_put(dev);
2358  out_rtnl:
2359         rtnl_unlock();
2360
2361         return err;
2362 }
2363
2364 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2365 do {\
2366         if (table[attr_num]) {\
2367                 cfg.param = nla_fn(table[attr_num]); \
2368                 mask |= (1 << (attr_num - 1)); \
2369         } \
2370 } while (0);\
2371
2372 static struct nla_policy
2373 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] __read_mostly = {
2374         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2375         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2376         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2377         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2378         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2379         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2380         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2381
2382         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2383         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2384         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2385         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2386         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2387         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2388 };
2389
2390 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2391 {
2392         int err;
2393         u32 mask;
2394         struct cfg80211_registered_device *drv;
2395         struct net_device *dev;
2396         struct mesh_config cfg;
2397         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2398         struct nlattr *parent_attr;
2399
2400         parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
2401         if (!parent_attr)
2402                 return -EINVAL;
2403         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2404                         parent_attr, nl80211_meshconf_params_policy))
2405                 return -EINVAL;
2406
2407         rtnl_lock();
2408
2409         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2410         if (err)
2411                 goto out_rtnl;
2412
2413         if (!drv->ops->set_mesh_params) {
2414                 err = -EOPNOTSUPP;
2415                 goto out;
2416         }
2417
2418         /* This makes sure that there aren't more than 32 mesh config
2419          * parameters (otherwise our bitfield scheme would not work.) */
2420         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2421
2422         /* Fill in the params struct */
2423         mask = 0;
2424         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2425                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2426         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2427                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2428         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2429                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2430         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2431                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2432         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2433                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2434         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2435                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2436         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2437                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2438         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2439                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2440                         nla_get_u8);
2441         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2442                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2443         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2444                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2445                         nla_get_u16);
2446         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2447                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2448                         nla_get_u32);
2449         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2450                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2451                         nla_get_u16);
2452         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2453                         dot11MeshHWMPnetDiameterTraversalTime,
2454                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2455                         nla_get_u16);
2456
2457         /* Apply changes */
2458         err = drv->ops->set_mesh_params(&drv->wiphy, dev, &cfg, mask);
2459
2460  out:
2461         /* cleanup */
2462         cfg80211_put_dev(drv);
2463         dev_put(dev);
2464  out_rtnl:
2465         rtnl_unlock();
2466
2467         return err;
2468 }
2469
2470 #undef FILL_IN_MESH_PARAM_IF_SET
2471
2472 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2473 {
2474         struct sk_buff *msg;
2475         void *hdr = NULL;
2476         struct nlattr *nl_reg_rules;
2477         unsigned int i;
2478         int err = -EINVAL;
2479
2480         mutex_lock(&cfg80211_mutex);
2481
2482         if (!cfg80211_regdomain)
2483                 goto out;
2484
2485         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2486         if (!msg) {
2487                 err = -ENOBUFS;
2488                 goto out;
2489         }
2490
2491         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2492                              NL80211_CMD_GET_REG);
2493         if (!hdr)
2494                 goto nla_put_failure;
2495
2496         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2497                 cfg80211_regdomain->alpha2);
2498
2499         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2500         if (!nl_reg_rules)
2501                 goto nla_put_failure;
2502
2503         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2504                 struct nlattr *nl_reg_rule;
2505                 const struct ieee80211_reg_rule *reg_rule;
2506                 const struct ieee80211_freq_range *freq_range;
2507                 const struct ieee80211_power_rule *power_rule;
2508
2509                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2510                 freq_range = &reg_rule->freq_range;
2511                 power_rule = &reg_rule->power_rule;
2512
2513                 nl_reg_rule = nla_nest_start(msg, i);
2514                 if (!nl_reg_rule)
2515                         goto nla_put_failure;
2516
2517                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2518                         reg_rule->flags);
2519                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2520                         freq_range->start_freq_khz);
2521                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2522                         freq_range->end_freq_khz);
2523                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2524                         freq_range->max_bandwidth_khz);
2525                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2526                         power_rule->max_antenna_gain);
2527                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2528                         power_rule->max_eirp);
2529
2530                 nla_nest_end(msg, nl_reg_rule);
2531         }
2532
2533         nla_nest_end(msg, nl_reg_rules);
2534
2535         genlmsg_end(msg, hdr);
2536         err = genlmsg_unicast(msg, info->snd_pid);
2537         goto out;
2538
2539 nla_put_failure:
2540         genlmsg_cancel(msg, hdr);
2541         err = -EMSGSIZE;
2542 out:
2543         mutex_unlock(&cfg80211_mutex);
2544         return err;
2545 }
2546
2547 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2548 {
2549         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2550         struct nlattr *nl_reg_rule;
2551         char *alpha2 = NULL;
2552         int rem_reg_rules = 0, r = 0;
2553         u32 num_rules = 0, rule_idx = 0, size_of_regd;
2554         struct ieee80211_regdomain *rd = NULL;
2555
2556         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2557                 return -EINVAL;
2558
2559         if (!info->attrs[NL80211_ATTR_REG_RULES])
2560                 return -EINVAL;
2561
2562         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2563
2564         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2565                         rem_reg_rules) {
2566                 num_rules++;
2567                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2568                         goto bad_reg;
2569         }
2570
2571         if (!reg_is_valid_request(alpha2))
2572                 return -EINVAL;
2573
2574         size_of_regd = sizeof(struct ieee80211_regdomain) +
2575                 (num_rules * sizeof(struct ieee80211_reg_rule));
2576
2577         rd = kzalloc(size_of_regd, GFP_KERNEL);
2578         if (!rd)
2579                 return -ENOMEM;
2580
2581         rd->n_reg_rules = num_rules;
2582         rd->alpha2[0] = alpha2[0];
2583         rd->alpha2[1] = alpha2[1];
2584
2585         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2586                         rem_reg_rules) {
2587                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2588                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2589                         reg_rule_policy);
2590                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2591                 if (r)
2592                         goto bad_reg;
2593
2594                 rule_idx++;
2595
2596                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES)
2597                         goto bad_reg;
2598         }
2599
2600         BUG_ON(rule_idx != num_rules);
2601
2602         mutex_lock(&cfg80211_mutex);
2603         r = set_regdom(rd);
2604         mutex_unlock(&cfg80211_mutex);
2605         return r;
2606
2607  bad_reg:
2608         kfree(rd);
2609         return -EINVAL;
2610 }
2611
2612 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
2613 {
2614         struct cfg80211_registered_device *drv;
2615         struct net_device *dev;
2616         struct cfg80211_scan_request *request;
2617         struct cfg80211_ssid *ssid;
2618         struct ieee80211_channel *channel;
2619         struct nlattr *attr;
2620         struct wiphy *wiphy;
2621         int err, tmp, n_ssids = 0, n_channels = 0, i;
2622         enum ieee80211_band band;
2623         size_t ie_len;
2624
2625         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2626                 return -EINVAL;
2627
2628         rtnl_lock();
2629
2630         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2631         if (err)
2632                 goto out_rtnl;
2633
2634         wiphy = &drv->wiphy;
2635
2636         if (!drv->ops->scan) {
2637                 err = -EOPNOTSUPP;
2638                 goto out;
2639         }
2640
2641         if (!netif_running(dev)) {
2642                 err = -ENETDOWN;
2643                 goto out;
2644         }
2645
2646         if (drv->scan_req) {
2647                 err = -EBUSY;
2648                 goto out;
2649         }
2650
2651         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2652                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp)
2653                         n_channels++;
2654                 if (!n_channels) {
2655                         err = -EINVAL;
2656                         goto out;
2657                 }
2658         } else {
2659                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
2660                         if (wiphy->bands[band])
2661                                 n_channels += wiphy->bands[band]->n_channels;
2662         }
2663
2664         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
2665                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
2666                         n_ssids++;
2667
2668         if (n_ssids > wiphy->max_scan_ssids) {
2669                 err = -EINVAL;
2670                 goto out;
2671         }
2672
2673         if (info->attrs[NL80211_ATTR_IE])
2674                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2675         else
2676                 ie_len = 0;
2677
2678         if (ie_len > wiphy->max_scan_ie_len) {
2679                 err = -EINVAL;
2680                 goto out;
2681         }
2682
2683         request = kzalloc(sizeof(*request)
2684                         + sizeof(*ssid) * n_ssids
2685                         + sizeof(channel) * n_channels
2686                         + ie_len, GFP_KERNEL);
2687         if (!request) {
2688                 err = -ENOMEM;
2689                 goto out;
2690         }
2691
2692         request->channels = (void *)((char *)request + sizeof(*request));
2693         request->n_channels = n_channels;
2694         if (n_ssids)
2695                 request->ssids = (void *)(request->channels + n_channels);
2696         request->n_ssids = n_ssids;
2697         if (ie_len) {
2698                 if (request->ssids)
2699                         request->ie = (void *)(request->ssids + n_ssids);
2700                 else
2701                         request->ie = (void *)(request->channels + n_channels);
2702         }
2703
2704         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2705                 /* user specified, bail out if channel not found */
2706                 request->n_channels = n_channels;
2707                 i = 0;
2708                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
2709                         request->channels[i] = ieee80211_get_channel(wiphy, nla_get_u32(attr));
2710                         if (!request->channels[i]) {
2711                                 err = -EINVAL;
2712                                 goto out_free;
2713                         }
2714                         i++;
2715                 }
2716         } else {
2717                 /* all channels */
2718                 i = 0;
2719                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
2720                         int j;
2721                         if (!wiphy->bands[band])
2722                                 continue;
2723                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
2724                                 request->channels[i] = &wiphy->bands[band]->channels[j];
2725                                 i++;
2726                         }
2727                 }
2728         }
2729
2730         i = 0;
2731         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
2732                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
2733                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
2734                                 err = -EINVAL;
2735                                 goto out_free;
2736                         }
2737                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
2738                         request->ssids[i].ssid_len = nla_len(attr);
2739                         i++;
2740                 }
2741         }
2742
2743         if (info->attrs[NL80211_ATTR_IE]) {
2744                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2745                 memcpy((void *)request->ie,
2746                        nla_data(info->attrs[NL80211_ATTR_IE]),
2747                        request->ie_len);
2748         }
2749
2750         request->ifidx = dev->ifindex;
2751         request->wiphy = &drv->wiphy;
2752
2753         drv->scan_req = request;
2754         err = drv->ops->scan(&drv->wiphy, dev, request);
2755
2756  out_free:
2757         if (err) {
2758                 drv->scan_req = NULL;
2759                 kfree(request);
2760         }
2761  out:
2762         cfg80211_put_dev(drv);
2763         dev_put(dev);
2764  out_rtnl:
2765         rtnl_unlock();
2766
2767         return err;
2768 }
2769
2770 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
2771                             struct cfg80211_registered_device *rdev,
2772                             struct net_device *dev,
2773                             struct cfg80211_bss *res)
2774 {
2775         void *hdr;
2776         struct nlattr *bss;
2777
2778         hdr = nl80211hdr_put(msg, pid, seq, flags,
2779                              NL80211_CMD_NEW_SCAN_RESULTS);
2780         if (!hdr)
2781                 return -1;
2782
2783         NLA_PUT_U32(msg, NL80211_ATTR_SCAN_GENERATION,
2784                     rdev->bss_generation);
2785         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2786
2787         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
2788         if (!bss)
2789                 goto nla_put_failure;
2790         if (!is_zero_ether_addr(res->bssid))
2791                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
2792         if (res->information_elements && res->len_information_elements)
2793                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
2794                         res->len_information_elements,
2795                         res->information_elements);
2796         if (res->tsf)
2797                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
2798         if (res->beacon_interval)
2799                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
2800         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
2801         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
2802
2803         switch (rdev->wiphy.signal_type) {
2804         case CFG80211_SIGNAL_TYPE_MBM:
2805                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
2806                 break;
2807         case CFG80211_SIGNAL_TYPE_UNSPEC:
2808                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
2809                 break;
2810         default:
2811                 break;
2812         }
2813
2814         nla_nest_end(msg, bss);
2815
2816         return genlmsg_end(msg, hdr);
2817
2818  nla_put_failure:
2819         genlmsg_cancel(msg, hdr);
2820         return -EMSGSIZE;
2821 }
2822
2823 static int nl80211_dump_scan(struct sk_buff *skb,
2824                              struct netlink_callback *cb)
2825 {
2826         struct cfg80211_registered_device *dev;
2827         struct net_device *netdev;
2828         struct cfg80211_internal_bss *scan;
2829         int ifidx = cb->args[0];
2830         int start = cb->args[1], idx = 0;
2831         int err;
2832
2833         if (!ifidx) {
2834                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
2835                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
2836                                   nl80211_policy);
2837                 if (err)
2838                         return err;
2839
2840                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
2841                         return -EINVAL;
2842
2843                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
2844                 if (!ifidx)
2845                         return -EINVAL;
2846                 cb->args[0] = ifidx;
2847         }
2848
2849         netdev = dev_get_by_index(&init_net, ifidx);
2850         if (!netdev)
2851                 return -ENODEV;
2852
2853         dev = cfg80211_get_dev_from_ifindex(ifidx);
2854         if (IS_ERR(dev)) {
2855                 err = PTR_ERR(dev);
2856                 goto out_put_netdev;
2857         }
2858
2859         spin_lock_bh(&dev->bss_lock);
2860         cfg80211_bss_expire(dev);
2861
2862         list_for_each_entry(scan, &dev->bss_list, list) {
2863                 if (++idx <= start)
2864                         continue;
2865                 if (nl80211_send_bss(skb,
2866                                 NETLINK_CB(cb->skb).pid,
2867                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2868                                 dev, netdev, &scan->pub) < 0) {
2869                         idx--;
2870                         goto out;
2871                 }
2872         }
2873
2874  out:
2875         spin_unlock_bh(&dev->bss_lock);
2876
2877         cb->args[1] = idx;
2878         err = skb->len;
2879         cfg80211_put_dev(dev);
2880  out_put_netdev:
2881         dev_put(netdev);
2882
2883         return err;
2884 }
2885
2886 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
2887 {
2888         return auth_type == NL80211_AUTHTYPE_OPEN_SYSTEM ||
2889                 auth_type == NL80211_AUTHTYPE_SHARED_KEY ||
2890                 auth_type == NL80211_AUTHTYPE_FT ||
2891                 auth_type == NL80211_AUTHTYPE_NETWORK_EAP;
2892 }
2893
2894 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
2895 {
2896         struct cfg80211_registered_device *drv;
2897         struct net_device *dev;
2898         struct cfg80211_auth_request req;
2899         struct wiphy *wiphy;
2900         int err;
2901
2902         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2903                 return -EINVAL;
2904
2905         if (!info->attrs[NL80211_ATTR_MAC])
2906                 return -EINVAL;
2907
2908         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
2909                 return -EINVAL;
2910
2911         rtnl_lock();
2912
2913         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2914         if (err)
2915                 goto unlock_rtnl;
2916
2917         if (!drv->ops->auth) {
2918                 err = -EOPNOTSUPP;
2919                 goto out;
2920         }
2921
2922         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
2923                 err = -EOPNOTSUPP;
2924                 goto out;
2925         }
2926
2927         if (!netif_running(dev)) {
2928                 err = -ENETDOWN;
2929                 goto out;
2930         }
2931
2932         wiphy = &drv->wiphy;
2933         memset(&req, 0, sizeof(req));
2934
2935         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2936
2937         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2938                 req.chan = ieee80211_get_channel(
2939                         wiphy,
2940                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
2941                 if (!req.chan) {
2942                         err = -EINVAL;
2943                         goto out;
2944                 }
2945         }
2946
2947         if (info->attrs[NL80211_ATTR_SSID]) {
2948                 req.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2949                 req.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
2950         }
2951
2952         if (info->attrs[NL80211_ATTR_IE]) {
2953                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
2954                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2955         }
2956
2957         req.auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
2958         if (!nl80211_valid_auth_type(req.auth_type)) {
2959                 err = -EINVAL;
2960                 goto out;
2961         }
2962
2963         err = drv->ops->auth(&drv->wiphy, dev, &req);
2964
2965 out:
2966         cfg80211_put_dev(drv);
2967         dev_put(dev);
2968 unlock_rtnl:
2969         rtnl_unlock();
2970         return err;
2971 }
2972
2973 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
2974 {
2975         struct cfg80211_registered_device *drv;
2976         struct net_device *dev;
2977         struct cfg80211_assoc_request req;
2978         struct wiphy *wiphy;
2979         int err;
2980
2981         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2982                 return -EINVAL;
2983
2984         if (!info->attrs[NL80211_ATTR_MAC] ||
2985             !info->attrs[NL80211_ATTR_SSID])
2986                 return -EINVAL;
2987
2988         rtnl_lock();
2989
2990         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2991         if (err)
2992                 goto unlock_rtnl;
2993
2994         if (!drv->ops->assoc) {
2995                 err = -EOPNOTSUPP;
2996                 goto out;
2997         }
2998
2999         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3000                 err = -EOPNOTSUPP;
3001                 goto out;
3002         }
3003
3004         if (!netif_running(dev)) {
3005                 err = -ENETDOWN;
3006                 goto out;
3007         }
3008
3009         wiphy = &drv->wiphy;
3010         memset(&req, 0, sizeof(req));
3011
3012         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3013
3014         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3015                 req.chan = ieee80211_get_channel(
3016                         wiphy,
3017                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3018                 if (!req.chan) {
3019                         err = -EINVAL;
3020                         goto out;
3021                 }
3022         }
3023
3024         req.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3025         req.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3026
3027         if (info->attrs[NL80211_ATTR_IE]) {
3028                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3029                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3030         }
3031
3032         if (info->attrs[NL80211_ATTR_USE_MFP]) {
3033                 enum nl80211_mfp use_mfp =
3034                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
3035                 if (use_mfp == NL80211_MFP_REQUIRED)
3036                         req.use_mfp = true;
3037                 else if (use_mfp != NL80211_MFP_NO) {
3038                         err = -EINVAL;
3039                         goto out;
3040                 }
3041         }
3042
3043         err = drv->ops->assoc(&drv->wiphy, dev, &req);
3044
3045 out:
3046         cfg80211_put_dev(drv);
3047         dev_put(dev);
3048 unlock_rtnl:
3049         rtnl_unlock();
3050         return err;
3051 }
3052
3053 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
3054 {
3055         struct cfg80211_registered_device *drv;
3056         struct net_device *dev;
3057         struct cfg80211_deauth_request req;
3058         struct wiphy *wiphy;
3059         int err;
3060
3061         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3062                 return -EINVAL;
3063
3064         if (!info->attrs[NL80211_ATTR_MAC])
3065                 return -EINVAL;
3066
3067         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3068                 return -EINVAL;
3069
3070         rtnl_lock();
3071
3072         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3073         if (err)
3074                 goto unlock_rtnl;
3075
3076         if (!drv->ops->deauth) {
3077                 err = -EOPNOTSUPP;
3078                 goto out;
3079         }
3080
3081         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3082                 err = -EOPNOTSUPP;
3083                 goto out;
3084         }
3085
3086         if (!netif_running(dev)) {
3087                 err = -ENETDOWN;
3088                 goto out;
3089         }
3090
3091         wiphy = &drv->wiphy;
3092         memset(&req, 0, sizeof(req));
3093
3094         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3095
3096         req.reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3097         if (req.reason_code == 0) {
3098                 /* Reason Code 0 is reserved */
3099                 err = -EINVAL;
3100                 goto out;
3101         }
3102
3103         if (info->attrs[NL80211_ATTR_IE]) {
3104                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3105                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3106         }
3107
3108         err = drv->ops->deauth(&drv->wiphy, dev, &req);
3109
3110 out:
3111         cfg80211_put_dev(drv);
3112         dev_put(dev);
3113 unlock_rtnl:
3114         rtnl_unlock();
3115         return err;
3116 }
3117
3118 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
3119 {
3120         struct cfg80211_registered_device *drv;
3121         struct net_device *dev;
3122         struct cfg80211_disassoc_request req;
3123         struct wiphy *wiphy;
3124         int err;
3125
3126         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3127                 return -EINVAL;
3128
3129         if (!info->attrs[NL80211_ATTR_MAC])
3130                 return -EINVAL;
3131
3132         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3133                 return -EINVAL;
3134
3135         rtnl_lock();
3136
3137         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3138         if (err)
3139                 goto unlock_rtnl;
3140
3141         if (!drv->ops->disassoc) {
3142                 err = -EOPNOTSUPP;
3143                 goto out;
3144         }
3145
3146         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3147                 err = -EOPNOTSUPP;
3148                 goto out;
3149         }
3150
3151         if (!netif_running(dev)) {
3152                 err = -ENETDOWN;
3153                 goto out;
3154         }
3155
3156         wiphy = &drv->wiphy;
3157         memset(&req, 0, sizeof(req));
3158
3159         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3160
3161         req.reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3162         if (req.reason_code == 0) {
3163                 /* Reason Code 0 is reserved */
3164                 err = -EINVAL;
3165                 goto out;
3166         }
3167
3168         if (info->attrs[NL80211_ATTR_IE]) {
3169                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3170                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3171         }
3172
3173         err = drv->ops->disassoc(&drv->wiphy, dev, &req);
3174
3175 out:
3176         cfg80211_put_dev(drv);
3177         dev_put(dev);
3178 unlock_rtnl:
3179         rtnl_unlock();
3180         return err;
3181 }
3182
3183 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
3184 {
3185         struct cfg80211_registered_device *drv;
3186         struct net_device *dev;
3187         struct cfg80211_ibss_params ibss;
3188         struct wiphy *wiphy;
3189         int err;
3190
3191         memset(&ibss, 0, sizeof(ibss));
3192
3193         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3194                 return -EINVAL;
3195
3196         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
3197             !info->attrs[NL80211_ATTR_SSID] ||
3198             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3199                 return -EINVAL;
3200
3201         ibss.beacon_interval = 100;
3202
3203         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
3204                 ibss.beacon_interval =
3205                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3206                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
3207                         return -EINVAL;
3208         }
3209
3210         rtnl_lock();
3211
3212         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3213         if (err)
3214                 goto unlock_rtnl;
3215
3216         if (!drv->ops->join_ibss) {
3217                 err = -EOPNOTSUPP;
3218                 goto out;
3219         }
3220
3221         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3222                 err = -EOPNOTSUPP;
3223                 goto out;
3224         }
3225
3226         if (!netif_running(dev)) {
3227                 err = -ENETDOWN;
3228                 goto out;
3229         }
3230
3231         wiphy = &drv->wiphy;
3232
3233         if (info->attrs[NL80211_ATTR_MAC])
3234                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3235         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3236         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3237
3238         if (info->attrs[NL80211_ATTR_IE]) {
3239                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3240                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3241         }
3242
3243         ibss.channel = ieee80211_get_channel(wiphy,
3244                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3245         if (!ibss.channel ||
3246             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
3247             ibss.channel->flags & IEEE80211_CHAN_DISABLED) {
3248                 err = -EINVAL;
3249                 goto out;
3250         }
3251
3252         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
3253
3254         err = cfg80211_join_ibss(drv, dev, &ibss);
3255
3256 out:
3257         cfg80211_put_dev(drv);
3258         dev_put(dev);
3259 unlock_rtnl:
3260         rtnl_unlock();
3261         return err;
3262 }
3263
3264 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
3265 {
3266         struct cfg80211_registered_device *drv;
3267         struct net_device *dev;
3268         int err;
3269
3270         rtnl_lock();
3271
3272         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3273         if (err)
3274                 goto unlock_rtnl;
3275
3276         if (!drv->ops->leave_ibss) {
3277                 err = -EOPNOTSUPP;
3278                 goto out;
3279         }
3280
3281         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3282                 err = -EOPNOTSUPP;
3283                 goto out;
3284         }
3285
3286         if (!netif_running(dev)) {
3287                 err = -ENETDOWN;
3288                 goto out;
3289         }
3290
3291         err = cfg80211_leave_ibss(drv, dev, false);
3292
3293 out:
3294         cfg80211_put_dev(drv);
3295         dev_put(dev);
3296 unlock_rtnl:
3297         rtnl_unlock();
3298         return err;
3299 }
3300
3301 static struct genl_ops nl80211_ops[] = {
3302         {
3303                 .cmd = NL80211_CMD_GET_WIPHY,
3304                 .doit = nl80211_get_wiphy,
3305                 .dumpit = nl80211_dump_wiphy,
3306                 .policy = nl80211_policy,
3307                 /* can be retrieved by unprivileged users */
3308         },
3309         {
3310                 .cmd = NL80211_CMD_SET_WIPHY,
3311                 .doit = nl80211_set_wiphy,
3312                 .policy = nl80211_policy,
3313                 .flags = GENL_ADMIN_PERM,
3314         },
3315         {
3316                 .cmd = NL80211_CMD_GET_INTERFACE,
3317                 .doit = nl80211_get_interface,
3318                 .dumpit = nl80211_dump_interface,
3319                 .policy = nl80211_policy,
3320                 /* can be retrieved by unprivileged users */
3321         },
3322         {
3323                 .cmd = NL80211_CMD_SET_INTERFACE,
3324                 .doit = nl80211_set_interface,
3325                 .policy = nl80211_policy,
3326                 .flags = GENL_ADMIN_PERM,
3327         },
3328         {
3329                 .cmd = NL80211_CMD_NEW_INTERFACE,
3330                 .doit = nl80211_new_interface,
3331                 .policy = nl80211_policy,
3332                 .flags = GENL_ADMIN_PERM,
3333         },
3334         {
3335                 .cmd = NL80211_CMD_DEL_INTERFACE,
3336                 .doit = nl80211_del_interface,
3337                 .policy = nl80211_policy,
3338                 .flags = GENL_ADMIN_PERM,
3339         },
3340         {
3341                 .cmd = NL80211_CMD_GET_KEY,
3342                 .doit = nl80211_get_key,
3343                 .policy = nl80211_policy,
3344                 .flags = GENL_ADMIN_PERM,
3345         },
3346         {
3347                 .cmd = NL80211_CMD_SET_KEY,
3348                 .doit = nl80211_set_key,
3349                 .policy = nl80211_policy,
3350                 .flags = GENL_ADMIN_PERM,
3351         },
3352         {
3353                 .cmd = NL80211_CMD_NEW_KEY,
3354                 .doit = nl80211_new_key,
3355                 .policy = nl80211_policy,
3356                 .flags = GENL_ADMIN_PERM,
3357         },
3358         {
3359                 .cmd = NL80211_CMD_DEL_KEY,
3360                 .doit = nl80211_del_key,
3361                 .policy = nl80211_policy,
3362                 .flags = GENL_ADMIN_PERM,
3363         },
3364         {
3365                 .cmd = NL80211_CMD_SET_BEACON,
3366                 .policy = nl80211_policy,
3367                 .flags = GENL_ADMIN_PERM,
3368                 .doit = nl80211_addset_beacon,
3369         },
3370         {
3371                 .cmd = NL80211_CMD_NEW_BEACON,
3372                 .policy = nl80211_policy,
3373                 .flags = GENL_ADMIN_PERM,
3374                 .doit = nl80211_addset_beacon,
3375         },
3376         {
3377                 .cmd = NL80211_CMD_DEL_BEACON,
3378                 .policy = nl80211_policy,
3379                 .flags = GENL_ADMIN_PERM,
3380                 .doit = nl80211_del_beacon,
3381         },
3382         {
3383                 .cmd = NL80211_CMD_GET_STATION,
3384                 .doit = nl80211_get_station,
3385                 .dumpit = nl80211_dump_station,
3386                 .policy = nl80211_policy,
3387         },
3388         {
3389                 .cmd = NL80211_CMD_SET_STATION,
3390                 .doit = nl80211_set_station,
3391                 .policy = nl80211_policy,
3392                 .flags = GENL_ADMIN_PERM,
3393         },
3394         {
3395                 .cmd = NL80211_CMD_NEW_STATION,
3396                 .doit = nl80211_new_station,
3397                 .policy = nl80211_policy,
3398                 .flags = GENL_ADMIN_PERM,
3399         },
3400         {
3401                 .cmd = NL80211_CMD_DEL_STATION,
3402                 .doit = nl80211_del_station,
3403                 .policy = nl80211_policy,
3404                 .flags = GENL_ADMIN_PERM,
3405         },
3406         {
3407                 .cmd = NL80211_CMD_GET_MPATH,
3408                 .doit = nl80211_get_mpath,
3409                 .dumpit = nl80211_dump_mpath,
3410                 .policy = nl80211_policy,
3411                 .flags = GENL_ADMIN_PERM,
3412         },
3413         {
3414                 .cmd = NL80211_CMD_SET_MPATH,
3415                 .doit = nl80211_set_mpath,
3416                 .policy = nl80211_policy,
3417                 .flags = GENL_ADMIN_PERM,
3418         },
3419         {
3420                 .cmd = NL80211_CMD_NEW_MPATH,
3421                 .doit = nl80211_new_mpath,
3422                 .policy = nl80211_policy,
3423                 .flags = GENL_ADMIN_PERM,
3424         },
3425         {
3426                 .cmd = NL80211_CMD_DEL_MPATH,
3427                 .doit = nl80211_del_mpath,
3428                 .policy = nl80211_policy,
3429                 .flags = GENL_ADMIN_PERM,
3430         },
3431         {
3432                 .cmd = NL80211_CMD_SET_BSS,
3433                 .doit = nl80211_set_bss,
3434                 .policy = nl80211_policy,
3435                 .flags = GENL_ADMIN_PERM,
3436         },
3437         {
3438                 .cmd = NL80211_CMD_GET_REG,
3439                 .doit = nl80211_get_reg,
3440                 .policy = nl80211_policy,
3441                 /* can be retrieved by unprivileged users */
3442         },
3443         {
3444                 .cmd = NL80211_CMD_SET_REG,
3445                 .doit = nl80211_set_reg,
3446                 .policy = nl80211_policy,
3447                 .flags = GENL_ADMIN_PERM,
3448         },
3449         {
3450                 .cmd = NL80211_CMD_REQ_SET_REG,
3451                 .doit = nl80211_req_set_reg,
3452                 .policy = nl80211_policy,
3453                 .flags = GENL_ADMIN_PERM,
3454         },
3455         {
3456                 .cmd = NL80211_CMD_GET_MESH_PARAMS,
3457                 .doit = nl80211_get_mesh_params,
3458                 .policy = nl80211_policy,
3459                 /* can be retrieved by unprivileged users */
3460         },
3461         {
3462                 .cmd = NL80211_CMD_SET_MESH_PARAMS,
3463                 .doit = nl80211_set_mesh_params,
3464                 .policy = nl80211_policy,
3465                 .flags = GENL_ADMIN_PERM,
3466         },
3467         {
3468                 .cmd = NL80211_CMD_TRIGGER_SCAN,
3469                 .doit = nl80211_trigger_scan,
3470                 .policy = nl80211_policy,
3471                 .flags = GENL_ADMIN_PERM,
3472         },
3473         {
3474                 .cmd = NL80211_CMD_GET_SCAN,
3475                 .policy = nl80211_policy,
3476                 .dumpit = nl80211_dump_scan,
3477         },
3478         {
3479                 .cmd = NL80211_CMD_AUTHENTICATE,
3480                 .doit = nl80211_authenticate,
3481                 .policy = nl80211_policy,
3482                 .flags = GENL_ADMIN_PERM,
3483         },
3484         {
3485                 .cmd = NL80211_CMD_ASSOCIATE,
3486                 .doit = nl80211_associate,
3487                 .policy = nl80211_policy,
3488                 .flags = GENL_ADMIN_PERM,
3489         },
3490         {
3491                 .cmd = NL80211_CMD_DEAUTHENTICATE,
3492                 .doit = nl80211_deauthenticate,
3493                 .policy = nl80211_policy,
3494                 .flags = GENL_ADMIN_PERM,
3495         },
3496         {
3497                 .cmd = NL80211_CMD_DISASSOCIATE,
3498                 .doit = nl80211_disassociate,
3499                 .policy = nl80211_policy,
3500                 .flags = GENL_ADMIN_PERM,
3501         },
3502         {
3503                 .cmd = NL80211_CMD_JOIN_IBSS,
3504                 .doit = nl80211_join_ibss,
3505                 .policy = nl80211_policy,
3506                 .flags = GENL_ADMIN_PERM,
3507         },
3508         {
3509                 .cmd = NL80211_CMD_LEAVE_IBSS,
3510                 .doit = nl80211_leave_ibss,
3511                 .policy = nl80211_policy,
3512                 .flags = GENL_ADMIN_PERM,
3513         },
3514 };
3515 static struct genl_multicast_group nl80211_mlme_mcgrp = {
3516         .name = "mlme",
3517 };
3518
3519 /* multicast groups */
3520 static struct genl_multicast_group nl80211_config_mcgrp = {
3521         .name = "config",
3522 };
3523 static struct genl_multicast_group nl80211_scan_mcgrp = {
3524         .name = "scan",
3525 };
3526 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
3527         .name = "regulatory",
3528 };
3529
3530 /* notification functions */
3531
3532 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
3533 {
3534         struct sk_buff *msg;
3535
3536         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3537         if (!msg)
3538                 return;
3539
3540         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
3541                 nlmsg_free(msg);
3542                 return;
3543         }
3544
3545         genlmsg_multicast(msg, 0, nl80211_config_mcgrp.id, GFP_KERNEL);
3546 }
3547
3548 static int nl80211_send_scan_donemsg(struct sk_buff *msg,
3549                                     struct cfg80211_registered_device *rdev,
3550                                     struct net_device *netdev,
3551                                     u32 pid, u32 seq, int flags,
3552                                     u32 cmd)
3553 {
3554         void *hdr;
3555
3556         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
3557         if (!hdr)
3558                 return -1;
3559
3560         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3561         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3562
3563         /* XXX: we should probably bounce back the request? */
3564
3565         return genlmsg_end(msg, hdr);
3566
3567  nla_put_failure:
3568         genlmsg_cancel(msg, hdr);
3569         return -EMSGSIZE;
3570 }
3571
3572 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
3573                             struct net_device *netdev)
3574 {
3575         struct sk_buff *msg;
3576
3577         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3578         if (!msg)
3579                 return;
3580
3581         if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
3582                                       NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
3583                 nlmsg_free(msg);
3584                 return;
3585         }
3586
3587         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
3588 }
3589
3590 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
3591                                struct net_device *netdev)
3592 {
3593         struct sk_buff *msg;
3594
3595         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3596         if (!msg)
3597                 return;
3598
3599         if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
3600                                       NL80211_CMD_SCAN_ABORTED) < 0) {
3601                 nlmsg_free(msg);
3602                 return;
3603         }
3604
3605         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
3606 }
3607
3608 /*
3609  * This can happen on global regulatory changes or device specific settings
3610  * based on custom world regulatory domains.
3611  */
3612 void nl80211_send_reg_change_event(struct regulatory_request *request)
3613 {
3614         struct sk_buff *msg;
3615         void *hdr;
3616
3617         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3618         if (!msg)
3619                 return;
3620
3621         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
3622         if (!hdr) {
3623                 nlmsg_free(msg);
3624                 return;
3625         }
3626
3627         /* Userspace can always count this one always being set */
3628         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
3629
3630         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
3631                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3632                            NL80211_REGDOM_TYPE_WORLD);
3633         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
3634                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3635                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
3636         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
3637                  request->intersect)
3638                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3639                            NL80211_REGDOM_TYPE_INTERSECTION);
3640         else {
3641                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3642                            NL80211_REGDOM_TYPE_COUNTRY);
3643                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
3644         }
3645
3646         if (wiphy_idx_valid(request->wiphy_idx))
3647                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
3648
3649         if (genlmsg_end(msg, hdr) < 0) {
3650                 nlmsg_free(msg);
3651                 return;
3652         }
3653
3654         genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_KERNEL);
3655
3656         return;
3657
3658 nla_put_failure:
3659         genlmsg_cancel(msg, hdr);
3660         nlmsg_free(msg);
3661 }
3662
3663 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
3664                                     struct net_device *netdev,
3665                                     const u8 *buf, size_t len,
3666                                     enum nl80211_commands cmd)
3667 {
3668         struct sk_buff *msg;
3669         void *hdr;
3670
3671         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
3672         if (!msg)
3673                 return;
3674
3675         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
3676         if (!hdr) {
3677                 nlmsg_free(msg);
3678                 return;
3679         }
3680
3681         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3682         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3683         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
3684
3685         if (genlmsg_end(msg, hdr) < 0) {
3686                 nlmsg_free(msg);
3687                 return;
3688         }
3689
3690         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_ATOMIC);
3691         return;
3692
3693  nla_put_failure:
3694         genlmsg_cancel(msg, hdr);
3695         nlmsg_free(msg);
3696 }
3697
3698 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
3699                           struct net_device *netdev, const u8 *buf, size_t len)
3700 {
3701         nl80211_send_mlme_event(rdev, netdev, buf, len,
3702                                 NL80211_CMD_AUTHENTICATE);
3703 }
3704
3705 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
3706                            struct net_device *netdev, const u8 *buf,
3707                            size_t len)
3708 {
3709         nl80211_send_mlme_event(rdev, netdev, buf, len, NL80211_CMD_ASSOCIATE);
3710 }
3711
3712 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
3713                          struct net_device *netdev, const u8 *buf, size_t len)
3714 {
3715         nl80211_send_mlme_event(rdev, netdev, buf, len,
3716                                 NL80211_CMD_DEAUTHENTICATE);
3717 }
3718
3719 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
3720                            struct net_device *netdev, const u8 *buf,
3721                            size_t len)
3722 {
3723         nl80211_send_mlme_event(rdev, netdev, buf, len,
3724                                 NL80211_CMD_DISASSOCIATE);
3725 }
3726
3727 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
3728                                       struct net_device *netdev, int cmd,
3729                                       const u8 *addr)
3730 {
3731         struct sk_buff *msg;
3732         void *hdr;
3733
3734         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
3735         if (!msg)
3736                 return;
3737
3738         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
3739         if (!hdr) {
3740                 nlmsg_free(msg);
3741                 return;
3742         }
3743
3744         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3745         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3746         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
3747         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3748
3749         if (genlmsg_end(msg, hdr) < 0) {
3750                 nlmsg_free(msg);
3751                 return;
3752         }
3753
3754         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_ATOMIC);
3755         return;
3756
3757  nla_put_failure:
3758         genlmsg_cancel(msg, hdr);
3759         nlmsg_free(msg);
3760 }
3761
3762 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
3763                                struct net_device *netdev, const u8 *addr)
3764 {
3765         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
3766                                   addr);
3767 }
3768
3769 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
3770                                 struct net_device *netdev, const u8 *addr)
3771 {
3772         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE, addr);
3773 }
3774
3775 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
3776                              struct net_device *netdev, const u8 *bssid,
3777                              gfp_t gfp)
3778 {
3779         struct sk_buff *msg;
3780         void *hdr;
3781
3782         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
3783         if (!msg)
3784                 return;
3785
3786         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
3787         if (!hdr) {
3788                 nlmsg_free(msg);
3789                 return;
3790         }
3791
3792         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3793         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3794         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
3795
3796         if (genlmsg_end(msg, hdr) < 0) {
3797                 nlmsg_free(msg);
3798                 return;
3799         }
3800
3801         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
3802         return;
3803
3804  nla_put_failure:
3805         genlmsg_cancel(msg, hdr);
3806         nlmsg_free(msg);
3807 }
3808
3809 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
3810                                  struct net_device *netdev, const u8 *addr,
3811                                  enum nl80211_key_type key_type, int key_id,
3812                                  const u8 *tsc)
3813 {
3814         struct sk_buff *msg;
3815         void *hdr;
3816
3817         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3818         if (!msg)
3819                 return;
3820
3821         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
3822         if (!hdr) {
3823                 nlmsg_free(msg);
3824                 return;
3825         }
3826
3827         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3828         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3829         if (addr)
3830                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3831         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
3832         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
3833         if (tsc)
3834                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
3835
3836         if (genlmsg_end(msg, hdr) < 0) {
3837                 nlmsg_free(msg);
3838                 return;
3839         }
3840
3841         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_KERNEL);
3842         return;
3843
3844  nla_put_failure:
3845         genlmsg_cancel(msg, hdr);
3846         nlmsg_free(msg);
3847 }
3848
3849 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
3850                                     struct ieee80211_channel *channel_before,
3851                                     struct ieee80211_channel *channel_after)
3852 {
3853         struct sk_buff *msg;
3854         void *hdr;
3855         struct nlattr *nl_freq;
3856
3857         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
3858         if (!msg)
3859                 return;
3860
3861         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
3862         if (!hdr) {
3863                 nlmsg_free(msg);
3864                 return;
3865         }
3866
3867         /*
3868          * Since we are applying the beacon hint to a wiphy we know its
3869          * wiphy_idx is valid
3870          */
3871         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
3872
3873         /* Before */
3874         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
3875         if (!nl_freq)
3876                 goto nla_put_failure;
3877         if (nl80211_msg_put_channel(msg, channel_before))
3878                 goto nla_put_failure;
3879         nla_nest_end(msg, nl_freq);
3880
3881         /* After */
3882         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
3883         if (!nl_freq)
3884                 goto nla_put_failure;
3885         if (nl80211_msg_put_channel(msg, channel_after))
3886                 goto nla_put_failure;
3887         nla_nest_end(msg, nl_freq);
3888
3889         if (genlmsg_end(msg, hdr) < 0) {
3890                 nlmsg_free(msg);
3891                 return;
3892         }
3893
3894         genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_ATOMIC);
3895
3896         return;
3897
3898 nla_put_failure:
3899         genlmsg_cancel(msg, hdr);
3900         nlmsg_free(msg);
3901 }
3902
3903 /* initialisation/exit functions */
3904
3905 int nl80211_init(void)
3906 {
3907         int err, i;
3908
3909         err = genl_register_family(&nl80211_fam);
3910         if (err)
3911                 return err;
3912
3913         for (i = 0; i < ARRAY_SIZE(nl80211_ops); i++) {
3914                 err = genl_register_ops(&nl80211_fam, &nl80211_ops[i]);
3915                 if (err)
3916                         goto err_out;
3917         }
3918
3919         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
3920         if (err)
3921                 goto err_out;
3922
3923         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
3924         if (err)
3925                 goto err_out;
3926
3927         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
3928         if (err)
3929                 goto err_out;
3930
3931         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
3932         if (err)
3933                 goto err_out;
3934
3935         return 0;
3936  err_out:
3937         genl_unregister_family(&nl80211_fam);
3938         return err;
3939 }
3940
3941 void nl80211_exit(void)
3942 {
3943         genl_unregister_family(&nl80211_fam);
3944 }