net: use NLMSG_DEFAULT_SIZE in nlmsg_new() allocations
[linux-2.6.git] / net / wireless / nl80211.c
1 /*
2  * This is the new netlink-based wireless configuration interface.
3  *
4  * Copyright 2006-2009  Johannes Berg <johannes@sipsolutions.net>
5  */
6
7 #include <linux/if.h>
8 #include <linux/module.h>
9 #include <linux/err.h>
10 #include <linux/list.h>
11 #include <linux/if_ether.h>
12 #include <linux/ieee80211.h>
13 #include <linux/nl80211.h>
14 #include <linux/rtnetlink.h>
15 #include <linux/netlink.h>
16 #include <linux/etherdevice.h>
17 #include <net/genetlink.h>
18 #include <net/cfg80211.h>
19 #include "core.h"
20 #include "nl80211.h"
21 #include "reg.h"
22
23 /* the netlink family */
24 static struct genl_family nl80211_fam = {
25         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
26         .name = "nl80211",      /* have users key off the name instead */
27         .hdrsize = 0,           /* no private header */
28         .version = 1,           /* no particular meaning now */
29         .maxattr = NL80211_ATTR_MAX,
30 };
31
32 /* internal helper: get drv and dev */
33 static int get_drv_dev_by_info_ifindex(struct nlattr **attrs,
34                                        struct cfg80211_registered_device **drv,
35                                        struct net_device **dev)
36 {
37         int ifindex;
38
39         if (!attrs[NL80211_ATTR_IFINDEX])
40                 return -EINVAL;
41
42         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
43         *dev = dev_get_by_index(&init_net, ifindex);
44         if (!*dev)
45                 return -ENODEV;
46
47         *drv = cfg80211_get_dev_from_ifindex(ifindex);
48         if (IS_ERR(*drv)) {
49                 dev_put(*dev);
50                 return PTR_ERR(*drv);
51         }
52
53         return 0;
54 }
55
56 /* policy for the attributes */
57 static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
58         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
59         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
60                                       .len = BUS_ID_SIZE-1 },
61         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
62         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
63         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
64         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
65         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
66         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
67         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
68
69         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
70         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
71         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
72
73         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
74
75         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
76                                     .len = WLAN_MAX_KEY_LEN },
77         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
78         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
79         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
80
81         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
82         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
83         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
84                                        .len = IEEE80211_MAX_DATA_LEN },
85         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
86                                        .len = IEEE80211_MAX_DATA_LEN },
87         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
88         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
89         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
90         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
91                                                .len = NL80211_MAX_SUPP_RATES },
92         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
93         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
94         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
95         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
96                                 .len = IEEE80211_MAX_MESH_ID_LEN },
97         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
98
99         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
100         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
101
102         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
103         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
104         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
105         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
106                                            .len = NL80211_MAX_SUPP_RATES },
107
108         [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
109
110         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
111                                          .len = NL80211_HT_CAPABILITY_LEN },
112
113         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
114         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
115                               .len = IEEE80211_MAX_DATA_LEN },
116         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
117         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
118
119         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
120                                 .len = IEEE80211_MAX_SSID_LEN },
121         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
122         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
123         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
124         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
125         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
126         [NL80211_ATTR_STA_FLAGS2] = {
127                 .len = sizeof(struct nl80211_sta_flag_update),
128         },
129         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
130 };
131
132 /* IE validation */
133 static bool is_valid_ie_attr(const struct nlattr *attr)
134 {
135         const u8 *pos;
136         int len;
137
138         if (!attr)
139                 return true;
140
141         pos = nla_data(attr);
142         len = nla_len(attr);
143
144         while (len) {
145                 u8 elemlen;
146
147                 if (len < 2)
148                         return false;
149                 len -= 2;
150
151                 elemlen = pos[1];
152                 if (elemlen > len)
153                         return false;
154
155                 len -= elemlen;
156                 pos += 2 + elemlen;
157         }
158
159         return true;
160 }
161
162 /* message building helper */
163 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
164                                    int flags, u8 cmd)
165 {
166         /* since there is no private header just add the generic one */
167         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
168 }
169
170 static int nl80211_msg_put_channel(struct sk_buff *msg,
171                                    struct ieee80211_channel *chan)
172 {
173         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
174                     chan->center_freq);
175
176         if (chan->flags & IEEE80211_CHAN_DISABLED)
177                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
178         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
179                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
180         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
181                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
182         if (chan->flags & IEEE80211_CHAN_RADAR)
183                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
184
185         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
186                     DBM_TO_MBM(chan->max_power));
187
188         return 0;
189
190  nla_put_failure:
191         return -ENOBUFS;
192 }
193
194 /* netlink command implementations */
195
196 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
197                               struct cfg80211_registered_device *dev)
198 {
199         void *hdr;
200         struct nlattr *nl_bands, *nl_band;
201         struct nlattr *nl_freqs, *nl_freq;
202         struct nlattr *nl_rates, *nl_rate;
203         struct nlattr *nl_modes;
204         struct nlattr *nl_cmds;
205         enum ieee80211_band band;
206         struct ieee80211_channel *chan;
207         struct ieee80211_rate *rate;
208         int i;
209         u16 ifmodes = dev->wiphy.interface_modes;
210
211         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
212         if (!hdr)
213                 return -1;
214
215         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
216         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
217
218         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
219                    dev->wiphy.retry_short);
220         NLA_PUT_U8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
221                    dev->wiphy.retry_long);
222         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
223                     dev->wiphy.frag_threshold);
224         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
225                     dev->wiphy.rts_threshold);
226
227         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
228                    dev->wiphy.max_scan_ssids);
229         NLA_PUT_U16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
230                     dev->wiphy.max_scan_ie_len);
231
232         NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES,
233                 sizeof(u32) * dev->wiphy.n_cipher_suites,
234                 dev->wiphy.cipher_suites);
235
236         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
237         if (!nl_modes)
238                 goto nla_put_failure;
239
240         i = 0;
241         while (ifmodes) {
242                 if (ifmodes & 1)
243                         NLA_PUT_FLAG(msg, i);
244                 ifmodes >>= 1;
245                 i++;
246         }
247
248         nla_nest_end(msg, nl_modes);
249
250         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
251         if (!nl_bands)
252                 goto nla_put_failure;
253
254         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
255                 if (!dev->wiphy.bands[band])
256                         continue;
257
258                 nl_band = nla_nest_start(msg, band);
259                 if (!nl_band)
260                         goto nla_put_failure;
261
262                 /* add HT info */
263                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
264                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
265                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
266                                 &dev->wiphy.bands[band]->ht_cap.mcs);
267                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
268                                 dev->wiphy.bands[band]->ht_cap.cap);
269                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
270                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
271                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
272                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
273                 }
274
275                 /* add frequencies */
276                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
277                 if (!nl_freqs)
278                         goto nla_put_failure;
279
280                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
281                         nl_freq = nla_nest_start(msg, i);
282                         if (!nl_freq)
283                                 goto nla_put_failure;
284
285                         chan = &dev->wiphy.bands[band]->channels[i];
286
287                         if (nl80211_msg_put_channel(msg, chan))
288                                 goto nla_put_failure;
289
290                         nla_nest_end(msg, nl_freq);
291                 }
292
293                 nla_nest_end(msg, nl_freqs);
294
295                 /* add bitrates */
296                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
297                 if (!nl_rates)
298                         goto nla_put_failure;
299
300                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
301                         nl_rate = nla_nest_start(msg, i);
302                         if (!nl_rate)
303                                 goto nla_put_failure;
304
305                         rate = &dev->wiphy.bands[band]->bitrates[i];
306                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
307                                     rate->bitrate);
308                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
309                                 NLA_PUT_FLAG(msg,
310                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
311
312                         nla_nest_end(msg, nl_rate);
313                 }
314
315                 nla_nest_end(msg, nl_rates);
316
317                 nla_nest_end(msg, nl_band);
318         }
319         nla_nest_end(msg, nl_bands);
320
321         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
322         if (!nl_cmds)
323                 goto nla_put_failure;
324
325         i = 0;
326 #define CMD(op, n)                                              \
327          do {                                                   \
328                 if (dev->ops->op) {                             \
329                         i++;                                    \
330                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
331                 }                                               \
332         } while (0)
333
334         CMD(add_virtual_intf, NEW_INTERFACE);
335         CMD(change_virtual_intf, SET_INTERFACE);
336         CMD(add_key, NEW_KEY);
337         CMD(add_beacon, NEW_BEACON);
338         CMD(add_station, NEW_STATION);
339         CMD(add_mpath, NEW_MPATH);
340         CMD(set_mesh_params, SET_MESH_PARAMS);
341         CMD(change_bss, SET_BSS);
342         CMD(auth, AUTHENTICATE);
343         CMD(assoc, ASSOCIATE);
344         CMD(deauth, DEAUTHENTICATE);
345         CMD(disassoc, DISASSOCIATE);
346         CMD(join_ibss, JOIN_IBSS);
347
348 #undef CMD
349         nla_nest_end(msg, nl_cmds);
350
351         return genlmsg_end(msg, hdr);
352
353  nla_put_failure:
354         genlmsg_cancel(msg, hdr);
355         return -EMSGSIZE;
356 }
357
358 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
359 {
360         int idx = 0;
361         int start = cb->args[0];
362         struct cfg80211_registered_device *dev;
363
364         mutex_lock(&cfg80211_mutex);
365         list_for_each_entry(dev, &cfg80211_drv_list, list) {
366                 if (++idx <= start)
367                         continue;
368                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
369                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
370                                        dev) < 0) {
371                         idx--;
372                         break;
373                 }
374         }
375         mutex_unlock(&cfg80211_mutex);
376
377         cb->args[0] = idx;
378
379         return skb->len;
380 }
381
382 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
383 {
384         struct sk_buff *msg;
385         struct cfg80211_registered_device *dev;
386
387         dev = cfg80211_get_dev_from_info(info);
388         if (IS_ERR(dev))
389                 return PTR_ERR(dev);
390
391         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
392         if (!msg)
393                 goto out_err;
394
395         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
396                 goto out_free;
397
398         cfg80211_put_dev(dev);
399
400         return genlmsg_unicast(msg, info->snd_pid);
401
402  out_free:
403         nlmsg_free(msg);
404  out_err:
405         cfg80211_put_dev(dev);
406         return -ENOBUFS;
407 }
408
409 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
410         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
411         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
412         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
413         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
414         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
415 };
416
417 static int parse_txq_params(struct nlattr *tb[],
418                             struct ieee80211_txq_params *txq_params)
419 {
420         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
421             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
422             !tb[NL80211_TXQ_ATTR_AIFS])
423                 return -EINVAL;
424
425         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
426         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
427         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
428         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
429         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
430
431         return 0;
432 }
433
434 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
435 {
436         struct cfg80211_registered_device *rdev;
437         int result = 0, rem_txq_params = 0;
438         struct nlattr *nl_txq_params;
439         u32 changed;
440         u8 retry_short = 0, retry_long = 0;
441         u32 frag_threshold = 0, rts_threshold = 0;
442
443         rtnl_lock();
444
445         mutex_lock(&cfg80211_mutex);
446
447         rdev = __cfg80211_drv_from_info(info);
448         if (IS_ERR(rdev)) {
449                 result = PTR_ERR(rdev);
450                 goto unlock;
451         }
452
453         mutex_lock(&rdev->mtx);
454
455         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
456                 result = cfg80211_dev_rename(
457                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
458
459         mutex_unlock(&cfg80211_mutex);
460
461         if (result)
462                 goto bad_res;
463
464         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
465                 struct ieee80211_txq_params txq_params;
466                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
467
468                 if (!rdev->ops->set_txq_params) {
469                         result = -EOPNOTSUPP;
470                         goto bad_res;
471                 }
472
473                 nla_for_each_nested(nl_txq_params,
474                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
475                                     rem_txq_params) {
476                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
477                                   nla_data(nl_txq_params),
478                                   nla_len(nl_txq_params),
479                                   txq_params_policy);
480                         result = parse_txq_params(tb, &txq_params);
481                         if (result)
482                                 goto bad_res;
483
484                         result = rdev->ops->set_txq_params(&rdev->wiphy,
485                                                            &txq_params);
486                         if (result)
487                                 goto bad_res;
488                 }
489         }
490
491         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
492                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
493                 struct ieee80211_channel *chan;
494                 struct ieee80211_sta_ht_cap *ht_cap;
495                 u32 freq, sec_freq;
496
497                 if (!rdev->ops->set_channel) {
498                         result = -EOPNOTSUPP;
499                         goto bad_res;
500                 }
501
502                 result = -EINVAL;
503
504                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
505                         channel_type = nla_get_u32(info->attrs[
506                                            NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
507                         if (channel_type != NL80211_CHAN_NO_HT &&
508                             channel_type != NL80211_CHAN_HT20 &&
509                             channel_type != NL80211_CHAN_HT40PLUS &&
510                             channel_type != NL80211_CHAN_HT40MINUS)
511                                 goto bad_res;
512                 }
513
514                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
515                 chan = ieee80211_get_channel(&rdev->wiphy, freq);
516
517                 /* Primary channel not allowed */
518                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
519                         goto bad_res;
520
521                 if (channel_type == NL80211_CHAN_HT40MINUS)
522                         sec_freq = freq - 20;
523                 else if (channel_type == NL80211_CHAN_HT40PLUS)
524                         sec_freq = freq + 20;
525                 else
526                         sec_freq = 0;
527
528                 ht_cap = &rdev->wiphy.bands[chan->band]->ht_cap;
529
530                 /* no HT capabilities */
531                 if (channel_type != NL80211_CHAN_NO_HT &&
532                     !ht_cap->ht_supported)
533                         goto bad_res;
534
535                 if (sec_freq) {
536                         struct ieee80211_channel *schan;
537
538                         /* no 40 MHz capabilities */
539                         if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
540                             (ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT))
541                                 goto bad_res;
542
543                         schan = ieee80211_get_channel(&rdev->wiphy, sec_freq);
544
545                         /* Secondary channel not allowed */
546                         if (!schan || schan->flags & IEEE80211_CHAN_DISABLED)
547                                 goto bad_res;
548                 }
549
550                 result = rdev->ops->set_channel(&rdev->wiphy, chan,
551                                                 channel_type);
552                 if (result)
553                         goto bad_res;
554         }
555
556         changed = 0;
557
558         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
559                 retry_short = nla_get_u8(
560                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
561                 if (retry_short == 0) {
562                         result = -EINVAL;
563                         goto bad_res;
564                 }
565                 changed |= WIPHY_PARAM_RETRY_SHORT;
566         }
567
568         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
569                 retry_long = nla_get_u8(
570                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
571                 if (retry_long == 0) {
572                         result = -EINVAL;
573                         goto bad_res;
574                 }
575                 changed |= WIPHY_PARAM_RETRY_LONG;
576         }
577
578         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
579                 frag_threshold = nla_get_u32(
580                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
581                 if (frag_threshold < 256) {
582                         result = -EINVAL;
583                         goto bad_res;
584                 }
585                 if (frag_threshold != (u32) -1) {
586                         /*
587                          * Fragments (apart from the last one) are required to
588                          * have even length. Make the fragmentation code
589                          * simpler by stripping LSB should someone try to use
590                          * odd threshold value.
591                          */
592                         frag_threshold &= ~0x1;
593                 }
594                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
595         }
596
597         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
598                 rts_threshold = nla_get_u32(
599                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
600                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
601         }
602
603         if (changed) {
604                 u8 old_retry_short, old_retry_long;
605                 u32 old_frag_threshold, old_rts_threshold;
606
607                 if (!rdev->ops->set_wiphy_params) {
608                         result = -EOPNOTSUPP;
609                         goto bad_res;
610                 }
611
612                 old_retry_short = rdev->wiphy.retry_short;
613                 old_retry_long = rdev->wiphy.retry_long;
614                 old_frag_threshold = rdev->wiphy.frag_threshold;
615                 old_rts_threshold = rdev->wiphy.rts_threshold;
616
617                 if (changed & WIPHY_PARAM_RETRY_SHORT)
618                         rdev->wiphy.retry_short = retry_short;
619                 if (changed & WIPHY_PARAM_RETRY_LONG)
620                         rdev->wiphy.retry_long = retry_long;
621                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
622                         rdev->wiphy.frag_threshold = frag_threshold;
623                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
624                         rdev->wiphy.rts_threshold = rts_threshold;
625
626                 result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
627                 if (result) {
628                         rdev->wiphy.retry_short = old_retry_short;
629                         rdev->wiphy.retry_long = old_retry_long;
630                         rdev->wiphy.frag_threshold = old_frag_threshold;
631                         rdev->wiphy.rts_threshold = old_rts_threshold;
632                 }
633         }
634
635  bad_res:
636         mutex_unlock(&rdev->mtx);
637  unlock:
638         rtnl_unlock();
639         return result;
640 }
641
642
643 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
644                               struct cfg80211_registered_device *rdev,
645                               struct net_device *dev)
646 {
647         void *hdr;
648
649         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
650         if (!hdr)
651                 return -1;
652
653         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
654         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
655         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
656         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
657         return genlmsg_end(msg, hdr);
658
659  nla_put_failure:
660         genlmsg_cancel(msg, hdr);
661         return -EMSGSIZE;
662 }
663
664 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
665 {
666         int wp_idx = 0;
667         int if_idx = 0;
668         int wp_start = cb->args[0];
669         int if_start = cb->args[1];
670         struct cfg80211_registered_device *dev;
671         struct wireless_dev *wdev;
672
673         mutex_lock(&cfg80211_mutex);
674         list_for_each_entry(dev, &cfg80211_drv_list, list) {
675                 if (wp_idx < wp_start) {
676                         wp_idx++;
677                         continue;
678                 }
679                 if_idx = 0;
680
681                 mutex_lock(&dev->devlist_mtx);
682                 list_for_each_entry(wdev, &dev->netdev_list, list) {
683                         if (if_idx < if_start) {
684                                 if_idx++;
685                                 continue;
686                         }
687                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
688                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
689                                                dev, wdev->netdev) < 0) {
690                                 mutex_unlock(&dev->devlist_mtx);
691                                 goto out;
692                         }
693                         if_idx++;
694                 }
695                 mutex_unlock(&dev->devlist_mtx);
696
697                 wp_idx++;
698         }
699  out:
700         mutex_unlock(&cfg80211_mutex);
701
702         cb->args[0] = wp_idx;
703         cb->args[1] = if_idx;
704
705         return skb->len;
706 }
707
708 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
709 {
710         struct sk_buff *msg;
711         struct cfg80211_registered_device *dev;
712         struct net_device *netdev;
713         int err;
714
715         err = get_drv_dev_by_info_ifindex(info->attrs, &dev, &netdev);
716         if (err)
717                 return err;
718
719         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
720         if (!msg)
721                 goto out_err;
722
723         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0,
724                                dev, netdev) < 0)
725                 goto out_free;
726
727         dev_put(netdev);
728         cfg80211_put_dev(dev);
729
730         return genlmsg_unicast(msg, info->snd_pid);
731
732  out_free:
733         nlmsg_free(msg);
734  out_err:
735         dev_put(netdev);
736         cfg80211_put_dev(dev);
737         return -ENOBUFS;
738 }
739
740 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
741         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
742         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
743         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
744         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
745         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
746 };
747
748 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
749 {
750         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
751         int flag;
752
753         *mntrflags = 0;
754
755         if (!nla)
756                 return -EINVAL;
757
758         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
759                              nla, mntr_flags_policy))
760                 return -EINVAL;
761
762         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
763                 if (flags[flag])
764                         *mntrflags |= (1<<flag);
765
766         return 0;
767 }
768
769 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
770 {
771         struct cfg80211_registered_device *drv;
772         struct vif_params params;
773         int err, ifindex;
774         enum nl80211_iftype otype, ntype;
775         struct net_device *dev;
776         u32 _flags, *flags = NULL;
777         bool change = false;
778
779         memset(&params, 0, sizeof(params));
780
781         rtnl_lock();
782
783         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
784         if (err)
785                 goto unlock_rtnl;
786
787         ifindex = dev->ifindex;
788         otype = ntype = dev->ieee80211_ptr->iftype;
789         dev_put(dev);
790
791         if (info->attrs[NL80211_ATTR_IFTYPE]) {
792                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
793                 if (otype != ntype)
794                         change = true;
795                 if (ntype > NL80211_IFTYPE_MAX) {
796                         err = -EINVAL;
797                         goto unlock;
798                 }
799         }
800
801         if (!drv->ops->change_virtual_intf ||
802             !(drv->wiphy.interface_modes & (1 << ntype))) {
803                 err = -EOPNOTSUPP;
804                 goto unlock;
805         }
806
807         if (info->attrs[NL80211_ATTR_MESH_ID]) {
808                 if (ntype != NL80211_IFTYPE_MESH_POINT) {
809                         err = -EINVAL;
810                         goto unlock;
811                 }
812                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
813                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
814                 change = true;
815         }
816
817         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
818                 if (ntype != NL80211_IFTYPE_MONITOR) {
819                         err = -EINVAL;
820                         goto unlock;
821                 }
822                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
823                                           &_flags);
824                 if (err)
825                         goto unlock;
826
827                 flags = &_flags;
828                 change = true;
829         }
830
831         if (change)
832                 err = drv->ops->change_virtual_intf(&drv->wiphy, ifindex,
833                                                     ntype, flags, &params);
834         else
835                 err = 0;
836
837         dev = __dev_get_by_index(&init_net, ifindex);
838         WARN_ON(!dev || (!err && dev->ieee80211_ptr->iftype != ntype));
839
840         if (dev && !err && (ntype != otype)) {
841                 if (otype == NL80211_IFTYPE_ADHOC)
842                         cfg80211_clear_ibss(dev, false);
843         }
844
845  unlock:
846         cfg80211_put_dev(drv);
847  unlock_rtnl:
848         rtnl_unlock();
849         return err;
850 }
851
852 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
853 {
854         struct cfg80211_registered_device *drv;
855         struct vif_params params;
856         int err;
857         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
858         u32 flags;
859
860         memset(&params, 0, sizeof(params));
861
862         if (!info->attrs[NL80211_ATTR_IFNAME])
863                 return -EINVAL;
864
865         if (info->attrs[NL80211_ATTR_IFTYPE]) {
866                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
867                 if (type > NL80211_IFTYPE_MAX)
868                         return -EINVAL;
869         }
870
871         rtnl_lock();
872
873         drv = cfg80211_get_dev_from_info(info);
874         if (IS_ERR(drv)) {
875                 err = PTR_ERR(drv);
876                 goto unlock_rtnl;
877         }
878
879         if (!drv->ops->add_virtual_intf ||
880             !(drv->wiphy.interface_modes & (1 << type))) {
881                 err = -EOPNOTSUPP;
882                 goto unlock;
883         }
884
885         if (type == NL80211_IFTYPE_MESH_POINT &&
886             info->attrs[NL80211_ATTR_MESH_ID]) {
887                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
888                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
889         }
890
891         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
892                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
893                                   &flags);
894         err = drv->ops->add_virtual_intf(&drv->wiphy,
895                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
896                 type, err ? NULL : &flags, &params);
897
898  unlock:
899         cfg80211_put_dev(drv);
900  unlock_rtnl:
901         rtnl_unlock();
902         return err;
903 }
904
905 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
906 {
907         struct cfg80211_registered_device *drv;
908         int ifindex, err;
909         struct net_device *dev;
910
911         rtnl_lock();
912
913         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
914         if (err)
915                 goto unlock_rtnl;
916         ifindex = dev->ifindex;
917         dev_put(dev);
918
919         if (!drv->ops->del_virtual_intf) {
920                 err = -EOPNOTSUPP;
921                 goto out;
922         }
923
924         err = drv->ops->del_virtual_intf(&drv->wiphy, ifindex);
925
926  out:
927         cfg80211_put_dev(drv);
928  unlock_rtnl:
929         rtnl_unlock();
930         return err;
931 }
932
933 struct get_key_cookie {
934         struct sk_buff *msg;
935         int error;
936 };
937
938 static void get_key_callback(void *c, struct key_params *params)
939 {
940         struct get_key_cookie *cookie = c;
941
942         if (params->key)
943                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
944                         params->key_len, params->key);
945
946         if (params->seq)
947                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
948                         params->seq_len, params->seq);
949
950         if (params->cipher)
951                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
952                             params->cipher);
953
954         return;
955  nla_put_failure:
956         cookie->error = 1;
957 }
958
959 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
960 {
961         struct cfg80211_registered_device *drv;
962         int err;
963         struct net_device *dev;
964         u8 key_idx = 0;
965         u8 *mac_addr = NULL;
966         struct get_key_cookie cookie = {
967                 .error = 0,
968         };
969         void *hdr;
970         struct sk_buff *msg;
971
972         if (info->attrs[NL80211_ATTR_KEY_IDX])
973                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
974
975         if (key_idx > 5)
976                 return -EINVAL;
977
978         if (info->attrs[NL80211_ATTR_MAC])
979                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
980
981         rtnl_lock();
982
983         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
984         if (err)
985                 goto unlock_rtnl;
986
987         if (!drv->ops->get_key) {
988                 err = -EOPNOTSUPP;
989                 goto out;
990         }
991
992         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
993         if (!msg) {
994                 err = -ENOMEM;
995                 goto out;
996         }
997
998         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
999                              NL80211_CMD_NEW_KEY);
1000
1001         if (IS_ERR(hdr)) {
1002                 err = PTR_ERR(hdr);
1003                 goto out;
1004         }
1005
1006         cookie.msg = msg;
1007
1008         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1009         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1010         if (mac_addr)
1011                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1012
1013         err = drv->ops->get_key(&drv->wiphy, dev, key_idx, mac_addr,
1014                                 &cookie, get_key_callback);
1015
1016         if (err)
1017                 goto out;
1018
1019         if (cookie.error)
1020                 goto nla_put_failure;
1021
1022         genlmsg_end(msg, hdr);
1023         err = genlmsg_unicast(msg, info->snd_pid);
1024         goto out;
1025
1026  nla_put_failure:
1027         err = -ENOBUFS;
1028         nlmsg_free(msg);
1029  out:
1030         cfg80211_put_dev(drv);
1031         dev_put(dev);
1032  unlock_rtnl:
1033         rtnl_unlock();
1034
1035         return err;
1036 }
1037
1038 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
1039 {
1040         struct cfg80211_registered_device *drv;
1041         int err;
1042         struct net_device *dev;
1043         u8 key_idx;
1044         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
1045                     u8 key_index);
1046
1047         if (!info->attrs[NL80211_ATTR_KEY_IDX])
1048                 return -EINVAL;
1049
1050         key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1051
1052         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]) {
1053                 if (key_idx < 4 || key_idx > 5)
1054                         return -EINVAL;
1055         } else if (key_idx > 3)
1056                 return -EINVAL;
1057
1058         /* currently only support setting default key */
1059         if (!info->attrs[NL80211_ATTR_KEY_DEFAULT] &&
1060             !info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT])
1061                 return -EINVAL;
1062
1063         rtnl_lock();
1064
1065         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1066         if (err)
1067                 goto unlock_rtnl;
1068
1069         if (info->attrs[NL80211_ATTR_KEY_DEFAULT])
1070                 func = drv->ops->set_default_key;
1071         else
1072                 func = drv->ops->set_default_mgmt_key;
1073
1074         if (!func) {
1075                 err = -EOPNOTSUPP;
1076                 goto out;
1077         }
1078
1079         err = func(&drv->wiphy, dev, key_idx);
1080 #ifdef CONFIG_WIRELESS_EXT
1081         if (!err) {
1082                 if (func == drv->ops->set_default_key)
1083                         dev->ieee80211_ptr->wext.default_key = key_idx;
1084                 else
1085                         dev->ieee80211_ptr->wext.default_mgmt_key = key_idx;
1086         }
1087 #endif
1088
1089  out:
1090         cfg80211_put_dev(drv);
1091         dev_put(dev);
1092
1093  unlock_rtnl:
1094         rtnl_unlock();
1095
1096         return err;
1097 }
1098
1099 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
1100 {
1101         struct cfg80211_registered_device *drv;
1102         int err, i;
1103         struct net_device *dev;
1104         struct key_params params;
1105         u8 key_idx = 0;
1106         u8 *mac_addr = NULL;
1107
1108         memset(&params, 0, sizeof(params));
1109
1110         if (!info->attrs[NL80211_ATTR_KEY_CIPHER])
1111                 return -EINVAL;
1112
1113         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1114                 params.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1115                 params.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1116         }
1117
1118         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
1119                 params.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
1120                 params.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
1121         }
1122
1123         if (info->attrs[NL80211_ATTR_KEY_IDX])
1124                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1125
1126         params.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1127
1128         if (info->attrs[NL80211_ATTR_MAC])
1129                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1130
1131         if (cfg80211_validate_key_settings(&params, key_idx, mac_addr))
1132                 return -EINVAL;
1133
1134         rtnl_lock();
1135
1136         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1137         if (err)
1138                 goto unlock_rtnl;
1139
1140         for (i = 0; i < drv->wiphy.n_cipher_suites; i++)
1141                 if (params.cipher == drv->wiphy.cipher_suites[i])
1142                         break;
1143         if (i == drv->wiphy.n_cipher_suites) {
1144                 err = -EINVAL;
1145                 goto out;
1146         }
1147
1148         if (!drv->ops->add_key) {
1149                 err = -EOPNOTSUPP;
1150                 goto out;
1151         }
1152
1153         err = drv->ops->add_key(&drv->wiphy, dev, key_idx, mac_addr, &params);
1154
1155  out:
1156         cfg80211_put_dev(drv);
1157         dev_put(dev);
1158  unlock_rtnl:
1159         rtnl_unlock();
1160
1161         return err;
1162 }
1163
1164 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1165 {
1166         struct cfg80211_registered_device *drv;
1167         int err;
1168         struct net_device *dev;
1169         u8 key_idx = 0;
1170         u8 *mac_addr = NULL;
1171
1172         if (info->attrs[NL80211_ATTR_KEY_IDX])
1173                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1174
1175         if (key_idx > 5)
1176                 return -EINVAL;
1177
1178         if (info->attrs[NL80211_ATTR_MAC])
1179                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1180
1181         rtnl_lock();
1182
1183         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1184         if (err)
1185                 goto unlock_rtnl;
1186
1187         if (!drv->ops->del_key) {
1188                 err = -EOPNOTSUPP;
1189                 goto out;
1190         }
1191
1192         err = drv->ops->del_key(&drv->wiphy, dev, key_idx, mac_addr);
1193
1194 #ifdef CONFIG_WIRELESS_EXT
1195         if (!err) {
1196                 if (key_idx == dev->ieee80211_ptr->wext.default_key)
1197                         dev->ieee80211_ptr->wext.default_key = -1;
1198                 else if (key_idx == dev->ieee80211_ptr->wext.default_mgmt_key)
1199                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
1200         }
1201 #endif
1202
1203  out:
1204         cfg80211_put_dev(drv);
1205         dev_put(dev);
1206
1207  unlock_rtnl:
1208         rtnl_unlock();
1209
1210         return err;
1211 }
1212
1213 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1214 {
1215         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1216                     struct beacon_parameters *info);
1217         struct cfg80211_registered_device *drv;
1218         int err;
1219         struct net_device *dev;
1220         struct beacon_parameters params;
1221         int haveinfo = 0;
1222
1223         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]))
1224                 return -EINVAL;
1225
1226         rtnl_lock();
1227
1228         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1229         if (err)
1230                 goto unlock_rtnl;
1231
1232         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1233                 err = -EOPNOTSUPP;
1234                 goto out;
1235         }
1236
1237         switch (info->genlhdr->cmd) {
1238         case NL80211_CMD_NEW_BEACON:
1239                 /* these are required for NEW_BEACON */
1240                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1241                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1242                     !info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1243                         err = -EINVAL;
1244                         goto out;
1245                 }
1246
1247                 call = drv->ops->add_beacon;
1248                 break;
1249         case NL80211_CMD_SET_BEACON:
1250                 call = drv->ops->set_beacon;
1251                 break;
1252         default:
1253                 WARN_ON(1);
1254                 err = -EOPNOTSUPP;
1255                 goto out;
1256         }
1257
1258         if (!call) {
1259                 err = -EOPNOTSUPP;
1260                 goto out;
1261         }
1262
1263         memset(&params, 0, sizeof(params));
1264
1265         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1266                 params.interval =
1267                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1268                 haveinfo = 1;
1269         }
1270
1271         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1272                 params.dtim_period =
1273                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1274                 haveinfo = 1;
1275         }
1276
1277         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1278                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1279                 params.head_len =
1280                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1281                 haveinfo = 1;
1282         }
1283
1284         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1285                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1286                 params.tail_len =
1287                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1288                 haveinfo = 1;
1289         }
1290
1291         if (!haveinfo) {
1292                 err = -EINVAL;
1293                 goto out;
1294         }
1295
1296         err = call(&drv->wiphy, dev, &params);
1297
1298  out:
1299         cfg80211_put_dev(drv);
1300         dev_put(dev);
1301  unlock_rtnl:
1302         rtnl_unlock();
1303
1304         return err;
1305 }
1306
1307 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1308 {
1309         struct cfg80211_registered_device *drv;
1310         int err;
1311         struct net_device *dev;
1312
1313         rtnl_lock();
1314
1315         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1316         if (err)
1317                 goto unlock_rtnl;
1318
1319         if (!drv->ops->del_beacon) {
1320                 err = -EOPNOTSUPP;
1321                 goto out;
1322         }
1323
1324         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1325                 err = -EOPNOTSUPP;
1326                 goto out;
1327         }
1328         err = drv->ops->del_beacon(&drv->wiphy, dev);
1329
1330  out:
1331         cfg80211_put_dev(drv);
1332         dev_put(dev);
1333  unlock_rtnl:
1334         rtnl_unlock();
1335
1336         return err;
1337 }
1338
1339 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1340         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1341         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1342         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1343         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
1344 };
1345
1346 static int parse_station_flags(struct genl_info *info,
1347                                struct station_parameters *params)
1348 {
1349         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1350         struct nlattr *nla;
1351         int flag;
1352
1353         /*
1354          * Try parsing the new attribute first so userspace
1355          * can specify both for older kernels.
1356          */
1357         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
1358         if (nla) {
1359                 struct nl80211_sta_flag_update *sta_flags;
1360
1361                 sta_flags = nla_data(nla);
1362                 params->sta_flags_mask = sta_flags->mask;
1363                 params->sta_flags_set = sta_flags->set;
1364                 if ((params->sta_flags_mask |
1365                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
1366                         return -EINVAL;
1367                 return 0;
1368         }
1369
1370         /* if present, parse the old attribute */
1371
1372         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
1373         if (!nla)
1374                 return 0;
1375
1376         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1377                              nla, sta_flags_policy))
1378                 return -EINVAL;
1379
1380         params->sta_flags_mask = (1 << __NL80211_STA_FLAG_AFTER_LAST) - 1;
1381         params->sta_flags_mask &= ~1;
1382
1383         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1384                 if (flags[flag])
1385                         params->sta_flags_set |= (1<<flag);
1386
1387         return 0;
1388 }
1389
1390 static u16 nl80211_calculate_bitrate(struct rate_info *rate)
1391 {
1392         int modulation, streams, bitrate;
1393
1394         if (!(rate->flags & RATE_INFO_FLAGS_MCS))
1395                 return rate->legacy;
1396
1397         /* the formula below does only work for MCS values smaller than 32 */
1398         if (rate->mcs >= 32)
1399                 return 0;
1400
1401         modulation = rate->mcs & 7;
1402         streams = (rate->mcs >> 3) + 1;
1403
1404         bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
1405                         13500000 : 6500000;
1406
1407         if (modulation < 4)
1408                 bitrate *= (modulation + 1);
1409         else if (modulation == 4)
1410                 bitrate *= (modulation + 2);
1411         else
1412                 bitrate *= (modulation + 3);
1413
1414         bitrate *= streams;
1415
1416         if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
1417                 bitrate = (bitrate / 9) * 10;
1418
1419         /* do NOT round down here */
1420         return (bitrate + 50000) / 100000;
1421 }
1422
1423 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1424                                 int flags, struct net_device *dev,
1425                                 u8 *mac_addr, struct station_info *sinfo)
1426 {
1427         void *hdr;
1428         struct nlattr *sinfoattr, *txrate;
1429         u16 bitrate;
1430
1431         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1432         if (!hdr)
1433                 return -1;
1434
1435         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1436         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1437
1438         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1439         if (!sinfoattr)
1440                 goto nla_put_failure;
1441         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1442                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1443                             sinfo->inactive_time);
1444         if (sinfo->filled & STATION_INFO_RX_BYTES)
1445                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1446                             sinfo->rx_bytes);
1447         if (sinfo->filled & STATION_INFO_TX_BYTES)
1448                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1449                             sinfo->tx_bytes);
1450         if (sinfo->filled & STATION_INFO_LLID)
1451                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1452                             sinfo->llid);
1453         if (sinfo->filled & STATION_INFO_PLID)
1454                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1455                             sinfo->plid);
1456         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1457                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1458                             sinfo->plink_state);
1459         if (sinfo->filled & STATION_INFO_SIGNAL)
1460                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1461                            sinfo->signal);
1462         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1463                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1464                 if (!txrate)
1465                         goto nla_put_failure;
1466
1467                 /* nl80211_calculate_bitrate will return 0 for mcs >= 32 */
1468                 bitrate = nl80211_calculate_bitrate(&sinfo->txrate);
1469                 if (bitrate > 0)
1470                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1471
1472                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1473                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1474                                     sinfo->txrate.mcs);
1475                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1476                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1477                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1478                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1479
1480                 nla_nest_end(msg, txrate);
1481         }
1482         if (sinfo->filled & STATION_INFO_RX_PACKETS)
1483                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
1484                             sinfo->rx_packets);
1485         if (sinfo->filled & STATION_INFO_TX_PACKETS)
1486                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
1487                             sinfo->tx_packets);
1488         nla_nest_end(msg, sinfoattr);
1489
1490         return genlmsg_end(msg, hdr);
1491
1492  nla_put_failure:
1493         genlmsg_cancel(msg, hdr);
1494         return -EMSGSIZE;
1495 }
1496
1497 static int nl80211_dump_station(struct sk_buff *skb,
1498                                 struct netlink_callback *cb)
1499 {
1500         struct station_info sinfo;
1501         struct cfg80211_registered_device *dev;
1502         struct net_device *netdev;
1503         u8 mac_addr[ETH_ALEN];
1504         int ifidx = cb->args[0];
1505         int sta_idx = cb->args[1];
1506         int err;
1507
1508         if (!ifidx) {
1509                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1510                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1511                                   nl80211_policy);
1512                 if (err)
1513                         return err;
1514
1515                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1516                         return -EINVAL;
1517
1518                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1519                 if (!ifidx)
1520                         return -EINVAL;
1521         }
1522
1523         rtnl_lock();
1524
1525         netdev = __dev_get_by_index(&init_net, ifidx);
1526         if (!netdev) {
1527                 err = -ENODEV;
1528                 goto out_rtnl;
1529         }
1530
1531         dev = cfg80211_get_dev_from_ifindex(ifidx);
1532         if (IS_ERR(dev)) {
1533                 err = PTR_ERR(dev);
1534                 goto out_rtnl;
1535         }
1536
1537         if (!dev->ops->dump_station) {
1538                 err = -EOPNOTSUPP;
1539                 goto out_err;
1540         }
1541
1542         while (1) {
1543                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1544                                              mac_addr, &sinfo);
1545                 if (err == -ENOENT)
1546                         break;
1547                 if (err)
1548                         goto out_err;
1549
1550                 if (nl80211_send_station(skb,
1551                                 NETLINK_CB(cb->skb).pid,
1552                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
1553                                 netdev, mac_addr,
1554                                 &sinfo) < 0)
1555                         goto out;
1556
1557                 sta_idx++;
1558         }
1559
1560
1561  out:
1562         cb->args[1] = sta_idx;
1563         err = skb->len;
1564  out_err:
1565         cfg80211_put_dev(dev);
1566  out_rtnl:
1567         rtnl_unlock();
1568
1569         return err;
1570 }
1571
1572 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1573 {
1574         struct cfg80211_registered_device *drv;
1575         int err;
1576         struct net_device *dev;
1577         struct station_info sinfo;
1578         struct sk_buff *msg;
1579         u8 *mac_addr = NULL;
1580
1581         memset(&sinfo, 0, sizeof(sinfo));
1582
1583         if (!info->attrs[NL80211_ATTR_MAC])
1584                 return -EINVAL;
1585
1586         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1587
1588         rtnl_lock();
1589
1590         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1591         if (err)
1592                 goto out_rtnl;
1593
1594         if (!drv->ops->get_station) {
1595                 err = -EOPNOTSUPP;
1596                 goto out;
1597         }
1598
1599         err = drv->ops->get_station(&drv->wiphy, dev, mac_addr, &sinfo);
1600         if (err)
1601                 goto out;
1602
1603         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1604         if (!msg)
1605                 goto out;
1606
1607         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1608                                  dev, mac_addr, &sinfo) < 0)
1609                 goto out_free;
1610
1611         err = genlmsg_unicast(msg, info->snd_pid);
1612         goto out;
1613
1614  out_free:
1615         nlmsg_free(msg);
1616  out:
1617         cfg80211_put_dev(drv);
1618         dev_put(dev);
1619  out_rtnl:
1620         rtnl_unlock();
1621
1622         return err;
1623 }
1624
1625 /*
1626  * Get vlan interface making sure it is on the right wiphy.
1627  */
1628 static int get_vlan(struct nlattr *vlanattr,
1629                     struct cfg80211_registered_device *rdev,
1630                     struct net_device **vlan)
1631 {
1632         *vlan = NULL;
1633
1634         if (vlanattr) {
1635                 *vlan = dev_get_by_index(&init_net, nla_get_u32(vlanattr));
1636                 if (!*vlan)
1637                         return -ENODEV;
1638                 if (!(*vlan)->ieee80211_ptr)
1639                         return -EINVAL;
1640                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
1641                         return -EINVAL;
1642         }
1643         return 0;
1644 }
1645
1646 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
1647 {
1648         struct cfg80211_registered_device *drv;
1649         int err;
1650         struct net_device *dev;
1651         struct station_parameters params;
1652         u8 *mac_addr = NULL;
1653
1654         memset(&params, 0, sizeof(params));
1655
1656         params.listen_interval = -1;
1657
1658         if (info->attrs[NL80211_ATTR_STA_AID])
1659                 return -EINVAL;
1660
1661         if (!info->attrs[NL80211_ATTR_MAC])
1662                 return -EINVAL;
1663
1664         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1665
1666         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
1667                 params.supported_rates =
1668                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1669                 params.supported_rates_len =
1670                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1671         }
1672
1673         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1674                 params.listen_interval =
1675                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1676
1677         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1678                 params.ht_capa =
1679                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1680
1681         if (parse_station_flags(info, &params))
1682                 return -EINVAL;
1683
1684         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
1685                 params.plink_action =
1686                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
1687
1688         rtnl_lock();
1689
1690         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1691         if (err)
1692                 goto out_rtnl;
1693
1694         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1695         if (err)
1696                 goto out;
1697
1698         if (!drv->ops->change_station) {
1699                 err = -EOPNOTSUPP;
1700                 goto out;
1701         }
1702
1703         err = drv->ops->change_station(&drv->wiphy, dev, mac_addr, &params);
1704
1705  out:
1706         if (params.vlan)
1707                 dev_put(params.vlan);
1708         cfg80211_put_dev(drv);
1709         dev_put(dev);
1710  out_rtnl:
1711         rtnl_unlock();
1712
1713         return err;
1714 }
1715
1716 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
1717 {
1718         struct cfg80211_registered_device *drv;
1719         int err;
1720         struct net_device *dev;
1721         struct station_parameters params;
1722         u8 *mac_addr = NULL;
1723
1724         memset(&params, 0, sizeof(params));
1725
1726         if (!info->attrs[NL80211_ATTR_MAC])
1727                 return -EINVAL;
1728
1729         if (!info->attrs[NL80211_ATTR_STA_AID])
1730                 return -EINVAL;
1731
1732         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1733                 return -EINVAL;
1734
1735         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
1736                 return -EINVAL;
1737
1738         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1739         params.supported_rates =
1740                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1741         params.supported_rates_len =
1742                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1743         params.listen_interval =
1744                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1745         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
1746         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1747                 params.ht_capa =
1748                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1749
1750         if (parse_station_flags(info, &params))
1751                 return -EINVAL;
1752
1753         rtnl_lock();
1754
1755         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1756         if (err)
1757                 goto out_rtnl;
1758
1759         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1760             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN) {
1761                 err = -EINVAL;
1762                 goto out;
1763         }
1764
1765         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1766         if (err)
1767                 goto out;
1768
1769         if (!drv->ops->add_station) {
1770                 err = -EOPNOTSUPP;
1771                 goto out;
1772         }
1773
1774         if (!netif_running(dev)) {
1775                 err = -ENETDOWN;
1776                 goto out;
1777         }
1778
1779         err = drv->ops->add_station(&drv->wiphy, dev, mac_addr, &params);
1780
1781  out:
1782         if (params.vlan)
1783                 dev_put(params.vlan);
1784         cfg80211_put_dev(drv);
1785         dev_put(dev);
1786  out_rtnl:
1787         rtnl_unlock();
1788
1789         return err;
1790 }
1791
1792 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
1793 {
1794         struct cfg80211_registered_device *drv;
1795         int err;
1796         struct net_device *dev;
1797         u8 *mac_addr = NULL;
1798
1799         if (info->attrs[NL80211_ATTR_MAC])
1800                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1801
1802         rtnl_lock();
1803
1804         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1805         if (err)
1806                 goto out_rtnl;
1807
1808         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1809             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN) {
1810                 err = -EINVAL;
1811                 goto out;
1812         }
1813
1814         if (!drv->ops->del_station) {
1815                 err = -EOPNOTSUPP;
1816                 goto out;
1817         }
1818
1819         err = drv->ops->del_station(&drv->wiphy, dev, mac_addr);
1820
1821  out:
1822         cfg80211_put_dev(drv);
1823         dev_put(dev);
1824  out_rtnl:
1825         rtnl_unlock();
1826
1827         return err;
1828 }
1829
1830 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
1831                                 int flags, struct net_device *dev,
1832                                 u8 *dst, u8 *next_hop,
1833                                 struct mpath_info *pinfo)
1834 {
1835         void *hdr;
1836         struct nlattr *pinfoattr;
1837
1838         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1839         if (!hdr)
1840                 return -1;
1841
1842         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1843         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
1844         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
1845
1846         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
1847         if (!pinfoattr)
1848                 goto nla_put_failure;
1849         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
1850                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
1851                             pinfo->frame_qlen);
1852         if (pinfo->filled & MPATH_INFO_DSN)
1853                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DSN,
1854                             pinfo->dsn);
1855         if (pinfo->filled & MPATH_INFO_METRIC)
1856                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
1857                             pinfo->metric);
1858         if (pinfo->filled & MPATH_INFO_EXPTIME)
1859                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
1860                             pinfo->exptime);
1861         if (pinfo->filled & MPATH_INFO_FLAGS)
1862                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
1863                             pinfo->flags);
1864         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
1865                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
1866                             pinfo->discovery_timeout);
1867         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
1868                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
1869                             pinfo->discovery_retries);
1870
1871         nla_nest_end(msg, pinfoattr);
1872
1873         return genlmsg_end(msg, hdr);
1874
1875  nla_put_failure:
1876         genlmsg_cancel(msg, hdr);
1877         return -EMSGSIZE;
1878 }
1879
1880 static int nl80211_dump_mpath(struct sk_buff *skb,
1881                               struct netlink_callback *cb)
1882 {
1883         struct mpath_info pinfo;
1884         struct cfg80211_registered_device *dev;
1885         struct net_device *netdev;
1886         u8 dst[ETH_ALEN];
1887         u8 next_hop[ETH_ALEN];
1888         int ifidx = cb->args[0];
1889         int path_idx = cb->args[1];
1890         int err;
1891
1892         if (!ifidx) {
1893                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1894                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1895                                   nl80211_policy);
1896                 if (err)
1897                         return err;
1898
1899                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1900                         return -EINVAL;
1901
1902                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1903                 if (!ifidx)
1904                         return -EINVAL;
1905         }
1906
1907         rtnl_lock();
1908
1909         netdev = __dev_get_by_index(&init_net, ifidx);
1910         if (!netdev) {
1911                 err = -ENODEV;
1912                 goto out_rtnl;
1913         }
1914
1915         dev = cfg80211_get_dev_from_ifindex(ifidx);
1916         if (IS_ERR(dev)) {
1917                 err = PTR_ERR(dev);
1918                 goto out_rtnl;
1919         }
1920
1921         if (!dev->ops->dump_mpath) {
1922                 err = -EOPNOTSUPP;
1923                 goto out_err;
1924         }
1925
1926         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1927                 err = -EOPNOTSUPP;
1928                 goto out;
1929         }
1930
1931         while (1) {
1932                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
1933                                            dst, next_hop, &pinfo);
1934                 if (err == -ENOENT)
1935                         break;
1936                 if (err)
1937                         goto out_err;
1938
1939                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
1940                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
1941                                        netdev, dst, next_hop,
1942                                        &pinfo) < 0)
1943                         goto out;
1944
1945                 path_idx++;
1946         }
1947
1948
1949  out:
1950         cb->args[1] = path_idx;
1951         err = skb->len;
1952  out_err:
1953         cfg80211_put_dev(dev);
1954  out_rtnl:
1955         rtnl_unlock();
1956
1957         return err;
1958 }
1959
1960 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
1961 {
1962         struct cfg80211_registered_device *drv;
1963         int err;
1964         struct net_device *dev;
1965         struct mpath_info pinfo;
1966         struct sk_buff *msg;
1967         u8 *dst = NULL;
1968         u8 next_hop[ETH_ALEN];
1969
1970         memset(&pinfo, 0, sizeof(pinfo));
1971
1972         if (!info->attrs[NL80211_ATTR_MAC])
1973                 return -EINVAL;
1974
1975         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1976
1977         rtnl_lock();
1978
1979         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1980         if (err)
1981                 goto out_rtnl;
1982
1983         if (!drv->ops->get_mpath) {
1984                 err = -EOPNOTSUPP;
1985                 goto out;
1986         }
1987
1988         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1989                 err = -EOPNOTSUPP;
1990                 goto out;
1991         }
1992
1993         err = drv->ops->get_mpath(&drv->wiphy, dev, dst, next_hop, &pinfo);
1994         if (err)
1995                 goto out;
1996
1997         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1998         if (!msg)
1999                 goto out;
2000
2001         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
2002                                  dev, dst, next_hop, &pinfo) < 0)
2003                 goto out_free;
2004
2005         err = genlmsg_unicast(msg, info->snd_pid);
2006         goto out;
2007
2008  out_free:
2009         nlmsg_free(msg);
2010  out:
2011         cfg80211_put_dev(drv);
2012         dev_put(dev);
2013  out_rtnl:
2014         rtnl_unlock();
2015
2016         return err;
2017 }
2018
2019 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
2020 {
2021         struct cfg80211_registered_device *drv;
2022         int err;
2023         struct net_device *dev;
2024         u8 *dst = NULL;
2025         u8 *next_hop = NULL;
2026
2027         if (!info->attrs[NL80211_ATTR_MAC])
2028                 return -EINVAL;
2029
2030         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2031                 return -EINVAL;
2032
2033         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2034         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2035
2036         rtnl_lock();
2037
2038         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2039         if (err)
2040                 goto out_rtnl;
2041
2042         if (!drv->ops->change_mpath) {
2043                 err = -EOPNOTSUPP;
2044                 goto out;
2045         }
2046
2047         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2048                 err = -EOPNOTSUPP;
2049                 goto out;
2050         }
2051
2052         if (!netif_running(dev)) {
2053                 err = -ENETDOWN;
2054                 goto out;
2055         }
2056
2057         err = drv->ops->change_mpath(&drv->wiphy, dev, dst, next_hop);
2058
2059  out:
2060         cfg80211_put_dev(drv);
2061         dev_put(dev);
2062  out_rtnl:
2063         rtnl_unlock();
2064
2065         return err;
2066 }
2067 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
2068 {
2069         struct cfg80211_registered_device *drv;
2070         int err;
2071         struct net_device *dev;
2072         u8 *dst = NULL;
2073         u8 *next_hop = NULL;
2074
2075         if (!info->attrs[NL80211_ATTR_MAC])
2076                 return -EINVAL;
2077
2078         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
2079                 return -EINVAL;
2080
2081         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2082         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
2083
2084         rtnl_lock();
2085
2086         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2087         if (err)
2088                 goto out_rtnl;
2089
2090         if (!drv->ops->add_mpath) {
2091                 err = -EOPNOTSUPP;
2092                 goto out;
2093         }
2094
2095         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
2096                 err = -EOPNOTSUPP;
2097                 goto out;
2098         }
2099
2100         if (!netif_running(dev)) {
2101                 err = -ENETDOWN;
2102                 goto out;
2103         }
2104
2105         err = drv->ops->add_mpath(&drv->wiphy, dev, dst, next_hop);
2106
2107  out:
2108         cfg80211_put_dev(drv);
2109         dev_put(dev);
2110  out_rtnl:
2111         rtnl_unlock();
2112
2113         return err;
2114 }
2115
2116 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
2117 {
2118         struct cfg80211_registered_device *drv;
2119         int err;
2120         struct net_device *dev;
2121         u8 *dst = NULL;
2122
2123         if (info->attrs[NL80211_ATTR_MAC])
2124                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
2125
2126         rtnl_lock();
2127
2128         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2129         if (err)
2130                 goto out_rtnl;
2131
2132         if (!drv->ops->del_mpath) {
2133                 err = -EOPNOTSUPP;
2134                 goto out;
2135         }
2136
2137         err = drv->ops->del_mpath(&drv->wiphy, dev, dst);
2138
2139  out:
2140         cfg80211_put_dev(drv);
2141         dev_put(dev);
2142  out_rtnl:
2143         rtnl_unlock();
2144
2145         return err;
2146 }
2147
2148 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
2149 {
2150         struct cfg80211_registered_device *drv;
2151         int err;
2152         struct net_device *dev;
2153         struct bss_parameters params;
2154
2155         memset(&params, 0, sizeof(params));
2156         /* default to not changing parameters */
2157         params.use_cts_prot = -1;
2158         params.use_short_preamble = -1;
2159         params.use_short_slot_time = -1;
2160
2161         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
2162                 params.use_cts_prot =
2163                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
2164         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
2165                 params.use_short_preamble =
2166                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
2167         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
2168                 params.use_short_slot_time =
2169                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
2170         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
2171                 params.basic_rates =
2172                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2173                 params.basic_rates_len =
2174                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
2175         }
2176
2177         rtnl_lock();
2178
2179         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2180         if (err)
2181                 goto out_rtnl;
2182
2183         if (!drv->ops->change_bss) {
2184                 err = -EOPNOTSUPP;
2185                 goto out;
2186         }
2187
2188         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
2189                 err = -EOPNOTSUPP;
2190                 goto out;
2191         }
2192
2193         err = drv->ops->change_bss(&drv->wiphy, dev, &params);
2194
2195  out:
2196         cfg80211_put_dev(drv);
2197         dev_put(dev);
2198  out_rtnl:
2199         rtnl_unlock();
2200
2201         return err;
2202 }
2203
2204 static const struct nla_policy
2205         reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2206         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
2207         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
2208         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
2209         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
2210         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
2211         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2212 };
2213
2214 static int parse_reg_rule(struct nlattr *tb[],
2215         struct ieee80211_reg_rule *reg_rule)
2216 {
2217         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2218         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2219
2220         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2221                 return -EINVAL;
2222         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2223                 return -EINVAL;
2224         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2225                 return -EINVAL;
2226         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2227                 return -EINVAL;
2228         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2229                 return -EINVAL;
2230
2231         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2232
2233         freq_range->start_freq_khz =
2234                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2235         freq_range->end_freq_khz =
2236                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2237         freq_range->max_bandwidth_khz =
2238                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2239
2240         power_rule->max_eirp =
2241                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2242
2243         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2244                 power_rule->max_antenna_gain =
2245                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2246
2247         return 0;
2248 }
2249
2250 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2251 {
2252         int r;
2253         char *data = NULL;
2254
2255         /*
2256          * You should only get this when cfg80211 hasn't yet initialized
2257          * completely when built-in to the kernel right between the time
2258          * window between nl80211_init() and regulatory_init(), if that is
2259          * even possible.
2260          */
2261         mutex_lock(&cfg80211_mutex);
2262         if (unlikely(!cfg80211_regdomain)) {
2263                 mutex_unlock(&cfg80211_mutex);
2264                 return -EINPROGRESS;
2265         }
2266         mutex_unlock(&cfg80211_mutex);
2267
2268         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2269                 return -EINVAL;
2270
2271         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2272
2273 #ifdef CONFIG_WIRELESS_OLD_REGULATORY
2274         /* We ignore world regdom requests with the old regdom setup */
2275         if (is_world_regdom(data))
2276                 return -EINVAL;
2277 #endif
2278
2279         r = regulatory_hint_user(data);
2280
2281         return r;
2282 }
2283
2284 static int nl80211_get_mesh_params(struct sk_buff *skb,
2285         struct genl_info *info)
2286 {
2287         struct cfg80211_registered_device *drv;
2288         struct mesh_config cur_params;
2289         int err;
2290         struct net_device *dev;
2291         void *hdr;
2292         struct nlattr *pinfoattr;
2293         struct sk_buff *msg;
2294
2295         rtnl_lock();
2296
2297         /* Look up our device */
2298         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2299         if (err)
2300                 goto out_rtnl;
2301
2302         if (!drv->ops->get_mesh_params) {
2303                 err = -EOPNOTSUPP;
2304                 goto out;
2305         }
2306
2307         /* Get the mesh params */
2308         err = drv->ops->get_mesh_params(&drv->wiphy, dev, &cur_params);
2309         if (err)
2310                 goto out;
2311
2312         /* Draw up a netlink message to send back */
2313         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2314         if (!msg) {
2315                 err = -ENOBUFS;
2316                 goto out;
2317         }
2318         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2319                              NL80211_CMD_GET_MESH_PARAMS);
2320         if (!hdr)
2321                 goto nla_put_failure;
2322         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
2323         if (!pinfoattr)
2324                 goto nla_put_failure;
2325         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2326         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2327                         cur_params.dot11MeshRetryTimeout);
2328         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2329                         cur_params.dot11MeshConfirmTimeout);
2330         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2331                         cur_params.dot11MeshHoldingTimeout);
2332         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2333                         cur_params.dot11MeshMaxPeerLinks);
2334         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2335                         cur_params.dot11MeshMaxRetries);
2336         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2337                         cur_params.dot11MeshTTL);
2338         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2339                         cur_params.auto_open_plinks);
2340         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2341                         cur_params.dot11MeshHWMPmaxPREQretries);
2342         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2343                         cur_params.path_refresh_time);
2344         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2345                         cur_params.min_discovery_timeout);
2346         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2347                         cur_params.dot11MeshHWMPactivePathTimeout);
2348         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2349                         cur_params.dot11MeshHWMPpreqMinInterval);
2350         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2351                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2352         nla_nest_end(msg, pinfoattr);
2353         genlmsg_end(msg, hdr);
2354         err = genlmsg_unicast(msg, info->snd_pid);
2355         goto out;
2356
2357  nla_put_failure:
2358         genlmsg_cancel(msg, hdr);
2359         err = -EMSGSIZE;
2360  out:
2361         /* Cleanup */
2362         cfg80211_put_dev(drv);
2363         dev_put(dev);
2364  out_rtnl:
2365         rtnl_unlock();
2366
2367         return err;
2368 }
2369
2370 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2371 do {\
2372         if (table[attr_num]) {\
2373                 cfg.param = nla_fn(table[attr_num]); \
2374                 mask |= (1 << (attr_num - 1)); \
2375         } \
2376 } while (0);\
2377
2378 static struct nla_policy
2379 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] __read_mostly = {
2380         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2381         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2382         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2383         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2384         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2385         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2386         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2387
2388         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2389         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2390         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2391         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2392         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2393         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2394 };
2395
2396 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2397 {
2398         int err;
2399         u32 mask;
2400         struct cfg80211_registered_device *drv;
2401         struct net_device *dev;
2402         struct mesh_config cfg;
2403         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2404         struct nlattr *parent_attr;
2405
2406         parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
2407         if (!parent_attr)
2408                 return -EINVAL;
2409         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2410                         parent_attr, nl80211_meshconf_params_policy))
2411                 return -EINVAL;
2412
2413         rtnl_lock();
2414
2415         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2416         if (err)
2417                 goto out_rtnl;
2418
2419         if (!drv->ops->set_mesh_params) {
2420                 err = -EOPNOTSUPP;
2421                 goto out;
2422         }
2423
2424         /* This makes sure that there aren't more than 32 mesh config
2425          * parameters (otherwise our bitfield scheme would not work.) */
2426         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2427
2428         /* Fill in the params struct */
2429         mask = 0;
2430         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2431                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2432         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2433                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2434         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2435                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2436         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2437                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2438         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2439                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2440         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2441                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2442         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2443                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2444         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2445                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2446                         nla_get_u8);
2447         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2448                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2449         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2450                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2451                         nla_get_u16);
2452         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2453                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2454                         nla_get_u32);
2455         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2456                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2457                         nla_get_u16);
2458         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2459                         dot11MeshHWMPnetDiameterTraversalTime,
2460                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2461                         nla_get_u16);
2462
2463         /* Apply changes */
2464         err = drv->ops->set_mesh_params(&drv->wiphy, dev, &cfg, mask);
2465
2466  out:
2467         /* cleanup */
2468         cfg80211_put_dev(drv);
2469         dev_put(dev);
2470  out_rtnl:
2471         rtnl_unlock();
2472
2473         return err;
2474 }
2475
2476 #undef FILL_IN_MESH_PARAM_IF_SET
2477
2478 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2479 {
2480         struct sk_buff *msg;
2481         void *hdr = NULL;
2482         struct nlattr *nl_reg_rules;
2483         unsigned int i;
2484         int err = -EINVAL;
2485
2486         mutex_lock(&cfg80211_mutex);
2487
2488         if (!cfg80211_regdomain)
2489                 goto out;
2490
2491         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2492         if (!msg) {
2493                 err = -ENOBUFS;
2494                 goto out;
2495         }
2496
2497         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2498                              NL80211_CMD_GET_REG);
2499         if (!hdr)
2500                 goto nla_put_failure;
2501
2502         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2503                 cfg80211_regdomain->alpha2);
2504
2505         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2506         if (!nl_reg_rules)
2507                 goto nla_put_failure;
2508
2509         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2510                 struct nlattr *nl_reg_rule;
2511                 const struct ieee80211_reg_rule *reg_rule;
2512                 const struct ieee80211_freq_range *freq_range;
2513                 const struct ieee80211_power_rule *power_rule;
2514
2515                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2516                 freq_range = &reg_rule->freq_range;
2517                 power_rule = &reg_rule->power_rule;
2518
2519                 nl_reg_rule = nla_nest_start(msg, i);
2520                 if (!nl_reg_rule)
2521                         goto nla_put_failure;
2522
2523                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2524                         reg_rule->flags);
2525                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2526                         freq_range->start_freq_khz);
2527                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2528                         freq_range->end_freq_khz);
2529                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2530                         freq_range->max_bandwidth_khz);
2531                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2532                         power_rule->max_antenna_gain);
2533                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2534                         power_rule->max_eirp);
2535
2536                 nla_nest_end(msg, nl_reg_rule);
2537         }
2538
2539         nla_nest_end(msg, nl_reg_rules);
2540
2541         genlmsg_end(msg, hdr);
2542         err = genlmsg_unicast(msg, info->snd_pid);
2543         goto out;
2544
2545 nla_put_failure:
2546         genlmsg_cancel(msg, hdr);
2547         err = -EMSGSIZE;
2548 out:
2549         mutex_unlock(&cfg80211_mutex);
2550         return err;
2551 }
2552
2553 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2554 {
2555         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2556         struct nlattr *nl_reg_rule;
2557         char *alpha2 = NULL;
2558         int rem_reg_rules = 0, r = 0;
2559         u32 num_rules = 0, rule_idx = 0, size_of_regd;
2560         struct ieee80211_regdomain *rd = NULL;
2561
2562         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2563                 return -EINVAL;
2564
2565         if (!info->attrs[NL80211_ATTR_REG_RULES])
2566                 return -EINVAL;
2567
2568         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2569
2570         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2571                         rem_reg_rules) {
2572                 num_rules++;
2573                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2574                         goto bad_reg;
2575         }
2576
2577         if (!reg_is_valid_request(alpha2))
2578                 return -EINVAL;
2579
2580         size_of_regd = sizeof(struct ieee80211_regdomain) +
2581                 (num_rules * sizeof(struct ieee80211_reg_rule));
2582
2583         rd = kzalloc(size_of_regd, GFP_KERNEL);
2584         if (!rd)
2585                 return -ENOMEM;
2586
2587         rd->n_reg_rules = num_rules;
2588         rd->alpha2[0] = alpha2[0];
2589         rd->alpha2[1] = alpha2[1];
2590
2591         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2592                         rem_reg_rules) {
2593                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2594                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2595                         reg_rule_policy);
2596                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2597                 if (r)
2598                         goto bad_reg;
2599
2600                 rule_idx++;
2601
2602                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES)
2603                         goto bad_reg;
2604         }
2605
2606         BUG_ON(rule_idx != num_rules);
2607
2608         mutex_lock(&cfg80211_mutex);
2609         r = set_regdom(rd);
2610         mutex_unlock(&cfg80211_mutex);
2611         return r;
2612
2613  bad_reg:
2614         kfree(rd);
2615         return -EINVAL;
2616 }
2617
2618 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
2619 {
2620         struct cfg80211_registered_device *drv;
2621         struct net_device *dev;
2622         struct cfg80211_scan_request *request;
2623         struct cfg80211_ssid *ssid;
2624         struct ieee80211_channel *channel;
2625         struct nlattr *attr;
2626         struct wiphy *wiphy;
2627         int err, tmp, n_ssids = 0, n_channels = 0, i;
2628         enum ieee80211_band band;
2629         size_t ie_len;
2630
2631         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2632                 return -EINVAL;
2633
2634         rtnl_lock();
2635
2636         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2637         if (err)
2638                 goto out_rtnl;
2639
2640         wiphy = &drv->wiphy;
2641
2642         if (!drv->ops->scan) {
2643                 err = -EOPNOTSUPP;
2644                 goto out;
2645         }
2646
2647         if (!netif_running(dev)) {
2648                 err = -ENETDOWN;
2649                 goto out;
2650         }
2651
2652         if (drv->scan_req) {
2653                 err = -EBUSY;
2654                 goto out;
2655         }
2656
2657         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2658                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp)
2659                         n_channels++;
2660                 if (!n_channels) {
2661                         err = -EINVAL;
2662                         goto out;
2663                 }
2664         } else {
2665                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
2666                         if (wiphy->bands[band])
2667                                 n_channels += wiphy->bands[band]->n_channels;
2668         }
2669
2670         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
2671                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
2672                         n_ssids++;
2673
2674         if (n_ssids > wiphy->max_scan_ssids) {
2675                 err = -EINVAL;
2676                 goto out;
2677         }
2678
2679         if (info->attrs[NL80211_ATTR_IE])
2680                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2681         else
2682                 ie_len = 0;
2683
2684         if (ie_len > wiphy->max_scan_ie_len) {
2685                 err = -EINVAL;
2686                 goto out;
2687         }
2688
2689         request = kzalloc(sizeof(*request)
2690                         + sizeof(*ssid) * n_ssids
2691                         + sizeof(channel) * n_channels
2692                         + ie_len, GFP_KERNEL);
2693         if (!request) {
2694                 err = -ENOMEM;
2695                 goto out;
2696         }
2697
2698         request->channels = (void *)((char *)request + sizeof(*request));
2699         request->n_channels = n_channels;
2700         if (n_ssids)
2701                 request->ssids = (void *)(request->channels + n_channels);
2702         request->n_ssids = n_ssids;
2703         if (ie_len) {
2704                 if (request->ssids)
2705                         request->ie = (void *)(request->ssids + n_ssids);
2706                 else
2707                         request->ie = (void *)(request->channels + n_channels);
2708         }
2709
2710         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2711                 /* user specified, bail out if channel not found */
2712                 request->n_channels = n_channels;
2713                 i = 0;
2714                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
2715                         request->channels[i] = ieee80211_get_channel(wiphy, nla_get_u32(attr));
2716                         if (!request->channels[i]) {
2717                                 err = -EINVAL;
2718                                 goto out_free;
2719                         }
2720                         i++;
2721                 }
2722         } else {
2723                 /* all channels */
2724                 i = 0;
2725                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
2726                         int j;
2727                         if (!wiphy->bands[band])
2728                                 continue;
2729                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
2730                                 request->channels[i] = &wiphy->bands[band]->channels[j];
2731                                 i++;
2732                         }
2733                 }
2734         }
2735
2736         i = 0;
2737         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
2738                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
2739                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
2740                                 err = -EINVAL;
2741                                 goto out_free;
2742                         }
2743                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
2744                         request->ssids[i].ssid_len = nla_len(attr);
2745                         i++;
2746                 }
2747         }
2748
2749         if (info->attrs[NL80211_ATTR_IE]) {
2750                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2751                 memcpy((void *)request->ie,
2752                        nla_data(info->attrs[NL80211_ATTR_IE]),
2753                        request->ie_len);
2754         }
2755
2756         request->ifidx = dev->ifindex;
2757         request->wiphy = &drv->wiphy;
2758
2759         drv->scan_req = request;
2760         err = drv->ops->scan(&drv->wiphy, dev, request);
2761
2762  out_free:
2763         if (err) {
2764                 drv->scan_req = NULL;
2765                 kfree(request);
2766         }
2767  out:
2768         cfg80211_put_dev(drv);
2769         dev_put(dev);
2770  out_rtnl:
2771         rtnl_unlock();
2772
2773         return err;
2774 }
2775
2776 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
2777                             struct cfg80211_registered_device *rdev,
2778                             struct net_device *dev,
2779                             struct cfg80211_bss *res)
2780 {
2781         void *hdr;
2782         struct nlattr *bss;
2783
2784         hdr = nl80211hdr_put(msg, pid, seq, flags,
2785                              NL80211_CMD_NEW_SCAN_RESULTS);
2786         if (!hdr)
2787                 return -1;
2788
2789         NLA_PUT_U32(msg, NL80211_ATTR_SCAN_GENERATION,
2790                     rdev->bss_generation);
2791         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2792
2793         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
2794         if (!bss)
2795                 goto nla_put_failure;
2796         if (!is_zero_ether_addr(res->bssid))
2797                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
2798         if (res->information_elements && res->len_information_elements)
2799                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
2800                         res->len_information_elements,
2801                         res->information_elements);
2802         if (res->tsf)
2803                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
2804         if (res->beacon_interval)
2805                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
2806         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
2807         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
2808
2809         switch (rdev->wiphy.signal_type) {
2810         case CFG80211_SIGNAL_TYPE_MBM:
2811                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
2812                 break;
2813         case CFG80211_SIGNAL_TYPE_UNSPEC:
2814                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
2815                 break;
2816         default:
2817                 break;
2818         }
2819
2820         nla_nest_end(msg, bss);
2821
2822         return genlmsg_end(msg, hdr);
2823
2824  nla_put_failure:
2825         genlmsg_cancel(msg, hdr);
2826         return -EMSGSIZE;
2827 }
2828
2829 static int nl80211_dump_scan(struct sk_buff *skb,
2830                              struct netlink_callback *cb)
2831 {
2832         struct cfg80211_registered_device *dev;
2833         struct net_device *netdev;
2834         struct cfg80211_internal_bss *scan;
2835         int ifidx = cb->args[0];
2836         int start = cb->args[1], idx = 0;
2837         int err;
2838
2839         if (!ifidx) {
2840                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
2841                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
2842                                   nl80211_policy);
2843                 if (err)
2844                         return err;
2845
2846                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
2847                         return -EINVAL;
2848
2849                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
2850                 if (!ifidx)
2851                         return -EINVAL;
2852                 cb->args[0] = ifidx;
2853         }
2854
2855         netdev = dev_get_by_index(&init_net, ifidx);
2856         if (!netdev)
2857                 return -ENODEV;
2858
2859         dev = cfg80211_get_dev_from_ifindex(ifidx);
2860         if (IS_ERR(dev)) {
2861                 err = PTR_ERR(dev);
2862                 goto out_put_netdev;
2863         }
2864
2865         spin_lock_bh(&dev->bss_lock);
2866         cfg80211_bss_expire(dev);
2867
2868         list_for_each_entry(scan, &dev->bss_list, list) {
2869                 if (++idx <= start)
2870                         continue;
2871                 if (nl80211_send_bss(skb,
2872                                 NETLINK_CB(cb->skb).pid,
2873                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2874                                 dev, netdev, &scan->pub) < 0) {
2875                         idx--;
2876                         goto out;
2877                 }
2878         }
2879
2880  out:
2881         spin_unlock_bh(&dev->bss_lock);
2882
2883         cb->args[1] = idx;
2884         err = skb->len;
2885         cfg80211_put_dev(dev);
2886  out_put_netdev:
2887         dev_put(netdev);
2888
2889         return err;
2890 }
2891
2892 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
2893 {
2894         return auth_type == NL80211_AUTHTYPE_OPEN_SYSTEM ||
2895                 auth_type == NL80211_AUTHTYPE_SHARED_KEY ||
2896                 auth_type == NL80211_AUTHTYPE_FT ||
2897                 auth_type == NL80211_AUTHTYPE_NETWORK_EAP;
2898 }
2899
2900 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
2901 {
2902         struct cfg80211_registered_device *drv;
2903         struct net_device *dev;
2904         struct cfg80211_auth_request req;
2905         struct wiphy *wiphy;
2906         int err;
2907
2908         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2909                 return -EINVAL;
2910
2911         if (!info->attrs[NL80211_ATTR_MAC])
2912                 return -EINVAL;
2913
2914         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
2915                 return -EINVAL;
2916
2917         rtnl_lock();
2918
2919         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2920         if (err)
2921                 goto unlock_rtnl;
2922
2923         if (!drv->ops->auth) {
2924                 err = -EOPNOTSUPP;
2925                 goto out;
2926         }
2927
2928         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
2929                 err = -EOPNOTSUPP;
2930                 goto out;
2931         }
2932
2933         if (!netif_running(dev)) {
2934                 err = -ENETDOWN;
2935                 goto out;
2936         }
2937
2938         wiphy = &drv->wiphy;
2939         memset(&req, 0, sizeof(req));
2940
2941         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2942
2943         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2944                 req.chan = ieee80211_get_channel(
2945                         wiphy,
2946                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
2947                 if (!req.chan) {
2948                         err = -EINVAL;
2949                         goto out;
2950                 }
2951         }
2952
2953         if (info->attrs[NL80211_ATTR_SSID]) {
2954                 req.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2955                 req.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
2956         }
2957
2958         if (info->attrs[NL80211_ATTR_IE]) {
2959                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
2960                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2961         }
2962
2963         req.auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
2964         if (!nl80211_valid_auth_type(req.auth_type)) {
2965                 err = -EINVAL;
2966                 goto out;
2967         }
2968
2969         err = drv->ops->auth(&drv->wiphy, dev, &req);
2970
2971 out:
2972         cfg80211_put_dev(drv);
2973         dev_put(dev);
2974 unlock_rtnl:
2975         rtnl_unlock();
2976         return err;
2977 }
2978
2979 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
2980 {
2981         struct cfg80211_registered_device *drv;
2982         struct net_device *dev;
2983         struct cfg80211_assoc_request req;
2984         struct wiphy *wiphy;
2985         int err;
2986
2987         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
2988                 return -EINVAL;
2989
2990         if (!info->attrs[NL80211_ATTR_MAC] ||
2991             !info->attrs[NL80211_ATTR_SSID])
2992                 return -EINVAL;
2993
2994         rtnl_lock();
2995
2996         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2997         if (err)
2998                 goto unlock_rtnl;
2999
3000         if (!drv->ops->assoc) {
3001                 err = -EOPNOTSUPP;
3002                 goto out;
3003         }
3004
3005         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3006                 err = -EOPNOTSUPP;
3007                 goto out;
3008         }
3009
3010         if (!netif_running(dev)) {
3011                 err = -ENETDOWN;
3012                 goto out;
3013         }
3014
3015         wiphy = &drv->wiphy;
3016         memset(&req, 0, sizeof(req));
3017
3018         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3019
3020         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3021                 req.chan = ieee80211_get_channel(
3022                         wiphy,
3023                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3024                 if (!req.chan) {
3025                         err = -EINVAL;
3026                         goto out;
3027                 }
3028         }
3029
3030         req.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3031         req.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3032
3033         if (info->attrs[NL80211_ATTR_IE]) {
3034                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3035                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3036         }
3037
3038         if (info->attrs[NL80211_ATTR_USE_MFP]) {
3039                 enum nl80211_mfp use_mfp =
3040                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
3041                 if (use_mfp == NL80211_MFP_REQUIRED)
3042                         req.use_mfp = true;
3043                 else if (use_mfp != NL80211_MFP_NO) {
3044                         err = -EINVAL;
3045                         goto out;
3046                 }
3047         }
3048
3049         req.control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
3050
3051         err = drv->ops->assoc(&drv->wiphy, dev, &req);
3052
3053 out:
3054         cfg80211_put_dev(drv);
3055         dev_put(dev);
3056 unlock_rtnl:
3057         rtnl_unlock();
3058         return err;
3059 }
3060
3061 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
3062 {
3063         struct cfg80211_registered_device *drv;
3064         struct net_device *dev;
3065         struct cfg80211_deauth_request req;
3066         struct wiphy *wiphy;
3067         int err;
3068
3069         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3070                 return -EINVAL;
3071
3072         if (!info->attrs[NL80211_ATTR_MAC])
3073                 return -EINVAL;
3074
3075         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3076                 return -EINVAL;
3077
3078         rtnl_lock();
3079
3080         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3081         if (err)
3082                 goto unlock_rtnl;
3083
3084         if (!drv->ops->deauth) {
3085                 err = -EOPNOTSUPP;
3086                 goto out;
3087         }
3088
3089         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3090                 err = -EOPNOTSUPP;
3091                 goto out;
3092         }
3093
3094         if (!netif_running(dev)) {
3095                 err = -ENETDOWN;
3096                 goto out;
3097         }
3098
3099         wiphy = &drv->wiphy;
3100         memset(&req, 0, sizeof(req));
3101
3102         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3103
3104         req.reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3105         if (req.reason_code == 0) {
3106                 /* Reason Code 0 is reserved */
3107                 err = -EINVAL;
3108                 goto out;
3109         }
3110
3111         if (info->attrs[NL80211_ATTR_IE]) {
3112                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3113                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3114         }
3115
3116         err = drv->ops->deauth(&drv->wiphy, dev, &req);
3117
3118 out:
3119         cfg80211_put_dev(drv);
3120         dev_put(dev);
3121 unlock_rtnl:
3122         rtnl_unlock();
3123         return err;
3124 }
3125
3126 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
3127 {
3128         struct cfg80211_registered_device *drv;
3129         struct net_device *dev;
3130         struct cfg80211_disassoc_request req;
3131         struct wiphy *wiphy;
3132         int err;
3133
3134         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3135                 return -EINVAL;
3136
3137         if (!info->attrs[NL80211_ATTR_MAC])
3138                 return -EINVAL;
3139
3140         if (!info->attrs[NL80211_ATTR_REASON_CODE])
3141                 return -EINVAL;
3142
3143         rtnl_lock();
3144
3145         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3146         if (err)
3147                 goto unlock_rtnl;
3148
3149         if (!drv->ops->disassoc) {
3150                 err = -EOPNOTSUPP;
3151                 goto out;
3152         }
3153
3154         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
3155                 err = -EOPNOTSUPP;
3156                 goto out;
3157         }
3158
3159         if (!netif_running(dev)) {
3160                 err = -ENETDOWN;
3161                 goto out;
3162         }
3163
3164         wiphy = &drv->wiphy;
3165         memset(&req, 0, sizeof(req));
3166
3167         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3168
3169         req.reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
3170         if (req.reason_code == 0) {
3171                 /* Reason Code 0 is reserved */
3172                 err = -EINVAL;
3173                 goto out;
3174         }
3175
3176         if (info->attrs[NL80211_ATTR_IE]) {
3177                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3178                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3179         }
3180
3181         err = drv->ops->disassoc(&drv->wiphy, dev, &req);
3182
3183 out:
3184         cfg80211_put_dev(drv);
3185         dev_put(dev);
3186 unlock_rtnl:
3187         rtnl_unlock();
3188         return err;
3189 }
3190
3191 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
3192 {
3193         struct cfg80211_registered_device *drv;
3194         struct net_device *dev;
3195         struct cfg80211_ibss_params ibss;
3196         struct wiphy *wiphy;
3197         int err;
3198
3199         memset(&ibss, 0, sizeof(ibss));
3200
3201         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
3202                 return -EINVAL;
3203
3204         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
3205             !info->attrs[NL80211_ATTR_SSID] ||
3206             !nla_len(info->attrs[NL80211_ATTR_SSID]))
3207                 return -EINVAL;
3208
3209         ibss.beacon_interval = 100;
3210
3211         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
3212                 ibss.beacon_interval =
3213                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3214                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
3215                         return -EINVAL;
3216         }
3217
3218         rtnl_lock();
3219
3220         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3221         if (err)
3222                 goto unlock_rtnl;
3223
3224         if (!drv->ops->join_ibss) {
3225                 err = -EOPNOTSUPP;
3226                 goto out;
3227         }
3228
3229         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3230                 err = -EOPNOTSUPP;
3231                 goto out;
3232         }
3233
3234         if (!netif_running(dev)) {
3235                 err = -ENETDOWN;
3236                 goto out;
3237         }
3238
3239         wiphy = &drv->wiphy;
3240
3241         if (info->attrs[NL80211_ATTR_MAC])
3242                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3243         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3244         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
3245
3246         if (info->attrs[NL80211_ATTR_IE]) {
3247                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
3248                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
3249         }
3250
3251         ibss.channel = ieee80211_get_channel(wiphy,
3252                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3253         if (!ibss.channel ||
3254             ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
3255             ibss.channel->flags & IEEE80211_CHAN_DISABLED) {
3256                 err = -EINVAL;
3257                 goto out;
3258         }
3259
3260         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
3261
3262         err = cfg80211_join_ibss(drv, dev, &ibss);
3263
3264 out:
3265         cfg80211_put_dev(drv);
3266         dev_put(dev);
3267 unlock_rtnl:
3268         rtnl_unlock();
3269         return err;
3270 }
3271
3272 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
3273 {
3274         struct cfg80211_registered_device *drv;
3275         struct net_device *dev;
3276         int err;
3277
3278         rtnl_lock();
3279
3280         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
3281         if (err)
3282                 goto unlock_rtnl;
3283
3284         if (!drv->ops->leave_ibss) {
3285                 err = -EOPNOTSUPP;
3286                 goto out;
3287         }
3288
3289         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) {
3290                 err = -EOPNOTSUPP;
3291                 goto out;
3292         }
3293
3294         if (!netif_running(dev)) {
3295                 err = -ENETDOWN;
3296                 goto out;
3297         }
3298
3299         err = cfg80211_leave_ibss(drv, dev, false);
3300
3301 out:
3302         cfg80211_put_dev(drv);
3303         dev_put(dev);
3304 unlock_rtnl:
3305         rtnl_unlock();
3306         return err;
3307 }
3308
3309 static struct genl_ops nl80211_ops[] = {
3310         {
3311                 .cmd = NL80211_CMD_GET_WIPHY,
3312                 .doit = nl80211_get_wiphy,
3313                 .dumpit = nl80211_dump_wiphy,
3314                 .policy = nl80211_policy,
3315                 /* can be retrieved by unprivileged users */
3316         },
3317         {
3318                 .cmd = NL80211_CMD_SET_WIPHY,
3319                 .doit = nl80211_set_wiphy,
3320                 .policy = nl80211_policy,
3321                 .flags = GENL_ADMIN_PERM,
3322         },
3323         {
3324                 .cmd = NL80211_CMD_GET_INTERFACE,
3325                 .doit = nl80211_get_interface,
3326                 .dumpit = nl80211_dump_interface,
3327                 .policy = nl80211_policy,
3328                 /* can be retrieved by unprivileged users */
3329         },
3330         {
3331                 .cmd = NL80211_CMD_SET_INTERFACE,
3332                 .doit = nl80211_set_interface,
3333                 .policy = nl80211_policy,
3334                 .flags = GENL_ADMIN_PERM,
3335         },
3336         {
3337                 .cmd = NL80211_CMD_NEW_INTERFACE,
3338                 .doit = nl80211_new_interface,
3339                 .policy = nl80211_policy,
3340                 .flags = GENL_ADMIN_PERM,
3341         },
3342         {
3343                 .cmd = NL80211_CMD_DEL_INTERFACE,
3344                 .doit = nl80211_del_interface,
3345                 .policy = nl80211_policy,
3346                 .flags = GENL_ADMIN_PERM,
3347         },
3348         {
3349                 .cmd = NL80211_CMD_GET_KEY,
3350                 .doit = nl80211_get_key,
3351                 .policy = nl80211_policy,
3352                 .flags = GENL_ADMIN_PERM,
3353         },
3354         {
3355                 .cmd = NL80211_CMD_SET_KEY,
3356                 .doit = nl80211_set_key,
3357                 .policy = nl80211_policy,
3358                 .flags = GENL_ADMIN_PERM,
3359         },
3360         {
3361                 .cmd = NL80211_CMD_NEW_KEY,
3362                 .doit = nl80211_new_key,
3363                 .policy = nl80211_policy,
3364                 .flags = GENL_ADMIN_PERM,
3365         },
3366         {
3367                 .cmd = NL80211_CMD_DEL_KEY,
3368                 .doit = nl80211_del_key,
3369                 .policy = nl80211_policy,
3370                 .flags = GENL_ADMIN_PERM,
3371         },
3372         {
3373                 .cmd = NL80211_CMD_SET_BEACON,
3374                 .policy = nl80211_policy,
3375                 .flags = GENL_ADMIN_PERM,
3376                 .doit = nl80211_addset_beacon,
3377         },
3378         {
3379                 .cmd = NL80211_CMD_NEW_BEACON,
3380                 .policy = nl80211_policy,
3381                 .flags = GENL_ADMIN_PERM,
3382                 .doit = nl80211_addset_beacon,
3383         },
3384         {
3385                 .cmd = NL80211_CMD_DEL_BEACON,
3386                 .policy = nl80211_policy,
3387                 .flags = GENL_ADMIN_PERM,
3388                 .doit = nl80211_del_beacon,
3389         },
3390         {
3391                 .cmd = NL80211_CMD_GET_STATION,
3392                 .doit = nl80211_get_station,
3393                 .dumpit = nl80211_dump_station,
3394                 .policy = nl80211_policy,
3395         },
3396         {
3397                 .cmd = NL80211_CMD_SET_STATION,
3398                 .doit = nl80211_set_station,
3399                 .policy = nl80211_policy,
3400                 .flags = GENL_ADMIN_PERM,
3401         },
3402         {
3403                 .cmd = NL80211_CMD_NEW_STATION,
3404                 .doit = nl80211_new_station,
3405                 .policy = nl80211_policy,
3406                 .flags = GENL_ADMIN_PERM,
3407         },
3408         {
3409                 .cmd = NL80211_CMD_DEL_STATION,
3410                 .doit = nl80211_del_station,
3411                 .policy = nl80211_policy,
3412                 .flags = GENL_ADMIN_PERM,
3413         },
3414         {
3415                 .cmd = NL80211_CMD_GET_MPATH,
3416                 .doit = nl80211_get_mpath,
3417                 .dumpit = nl80211_dump_mpath,
3418                 .policy = nl80211_policy,
3419                 .flags = GENL_ADMIN_PERM,
3420         },
3421         {
3422                 .cmd = NL80211_CMD_SET_MPATH,
3423                 .doit = nl80211_set_mpath,
3424                 .policy = nl80211_policy,
3425                 .flags = GENL_ADMIN_PERM,
3426         },
3427         {
3428                 .cmd = NL80211_CMD_NEW_MPATH,
3429                 .doit = nl80211_new_mpath,
3430                 .policy = nl80211_policy,
3431                 .flags = GENL_ADMIN_PERM,
3432         },
3433         {
3434                 .cmd = NL80211_CMD_DEL_MPATH,
3435                 .doit = nl80211_del_mpath,
3436                 .policy = nl80211_policy,
3437                 .flags = GENL_ADMIN_PERM,
3438         },
3439         {
3440                 .cmd = NL80211_CMD_SET_BSS,
3441                 .doit = nl80211_set_bss,
3442                 .policy = nl80211_policy,
3443                 .flags = GENL_ADMIN_PERM,
3444         },
3445         {
3446                 .cmd = NL80211_CMD_GET_REG,
3447                 .doit = nl80211_get_reg,
3448                 .policy = nl80211_policy,
3449                 /* can be retrieved by unprivileged users */
3450         },
3451         {
3452                 .cmd = NL80211_CMD_SET_REG,
3453                 .doit = nl80211_set_reg,
3454                 .policy = nl80211_policy,
3455                 .flags = GENL_ADMIN_PERM,
3456         },
3457         {
3458                 .cmd = NL80211_CMD_REQ_SET_REG,
3459                 .doit = nl80211_req_set_reg,
3460                 .policy = nl80211_policy,
3461                 .flags = GENL_ADMIN_PERM,
3462         },
3463         {
3464                 .cmd = NL80211_CMD_GET_MESH_PARAMS,
3465                 .doit = nl80211_get_mesh_params,
3466                 .policy = nl80211_policy,
3467                 /* can be retrieved by unprivileged users */
3468         },
3469         {
3470                 .cmd = NL80211_CMD_SET_MESH_PARAMS,
3471                 .doit = nl80211_set_mesh_params,
3472                 .policy = nl80211_policy,
3473                 .flags = GENL_ADMIN_PERM,
3474         },
3475         {
3476                 .cmd = NL80211_CMD_TRIGGER_SCAN,
3477                 .doit = nl80211_trigger_scan,
3478                 .policy = nl80211_policy,
3479                 .flags = GENL_ADMIN_PERM,
3480         },
3481         {
3482                 .cmd = NL80211_CMD_GET_SCAN,
3483                 .policy = nl80211_policy,
3484                 .dumpit = nl80211_dump_scan,
3485         },
3486         {
3487                 .cmd = NL80211_CMD_AUTHENTICATE,
3488                 .doit = nl80211_authenticate,
3489                 .policy = nl80211_policy,
3490                 .flags = GENL_ADMIN_PERM,
3491         },
3492         {
3493                 .cmd = NL80211_CMD_ASSOCIATE,
3494                 .doit = nl80211_associate,
3495                 .policy = nl80211_policy,
3496                 .flags = GENL_ADMIN_PERM,
3497         },
3498         {
3499                 .cmd = NL80211_CMD_DEAUTHENTICATE,
3500                 .doit = nl80211_deauthenticate,
3501                 .policy = nl80211_policy,
3502                 .flags = GENL_ADMIN_PERM,
3503         },
3504         {
3505                 .cmd = NL80211_CMD_DISASSOCIATE,
3506                 .doit = nl80211_disassociate,
3507                 .policy = nl80211_policy,
3508                 .flags = GENL_ADMIN_PERM,
3509         },
3510         {
3511                 .cmd = NL80211_CMD_JOIN_IBSS,
3512                 .doit = nl80211_join_ibss,
3513                 .policy = nl80211_policy,
3514                 .flags = GENL_ADMIN_PERM,
3515         },
3516         {
3517                 .cmd = NL80211_CMD_LEAVE_IBSS,
3518                 .doit = nl80211_leave_ibss,
3519                 .policy = nl80211_policy,
3520                 .flags = GENL_ADMIN_PERM,
3521         },
3522 };
3523 static struct genl_multicast_group nl80211_mlme_mcgrp = {
3524         .name = "mlme",
3525 };
3526
3527 /* multicast groups */
3528 static struct genl_multicast_group nl80211_config_mcgrp = {
3529         .name = "config",
3530 };
3531 static struct genl_multicast_group nl80211_scan_mcgrp = {
3532         .name = "scan",
3533 };
3534 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
3535         .name = "regulatory",
3536 };
3537
3538 /* notification functions */
3539
3540 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
3541 {
3542         struct sk_buff *msg;
3543
3544         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3545         if (!msg)
3546                 return;
3547
3548         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
3549                 nlmsg_free(msg);
3550                 return;
3551         }
3552
3553         genlmsg_multicast(msg, 0, nl80211_config_mcgrp.id, GFP_KERNEL);
3554 }
3555
3556 static int nl80211_send_scan_donemsg(struct sk_buff *msg,
3557                                     struct cfg80211_registered_device *rdev,
3558                                     struct net_device *netdev,
3559                                     u32 pid, u32 seq, int flags,
3560                                     u32 cmd)
3561 {
3562         void *hdr;
3563
3564         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
3565         if (!hdr)
3566                 return -1;
3567
3568         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3569         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3570
3571         /* XXX: we should probably bounce back the request? */
3572
3573         return genlmsg_end(msg, hdr);
3574
3575  nla_put_failure:
3576         genlmsg_cancel(msg, hdr);
3577         return -EMSGSIZE;
3578 }
3579
3580 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
3581                             struct net_device *netdev)
3582 {
3583         struct sk_buff *msg;
3584
3585         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3586         if (!msg)
3587                 return;
3588
3589         if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
3590                                       NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
3591                 nlmsg_free(msg);
3592                 return;
3593         }
3594
3595         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
3596 }
3597
3598 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
3599                                struct net_device *netdev)
3600 {
3601         struct sk_buff *msg;
3602
3603         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3604         if (!msg)
3605                 return;
3606
3607         if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
3608                                       NL80211_CMD_SCAN_ABORTED) < 0) {
3609                 nlmsg_free(msg);
3610                 return;
3611         }
3612
3613         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
3614 }
3615
3616 /*
3617  * This can happen on global regulatory changes or device specific settings
3618  * based on custom world regulatory domains.
3619  */
3620 void nl80211_send_reg_change_event(struct regulatory_request *request)
3621 {
3622         struct sk_buff *msg;
3623         void *hdr;
3624
3625         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3626         if (!msg)
3627                 return;
3628
3629         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
3630         if (!hdr) {
3631                 nlmsg_free(msg);
3632                 return;
3633         }
3634
3635         /* Userspace can always count this one always being set */
3636         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
3637
3638         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
3639                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3640                            NL80211_REGDOM_TYPE_WORLD);
3641         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
3642                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3643                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
3644         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
3645                  request->intersect)
3646                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3647                            NL80211_REGDOM_TYPE_INTERSECTION);
3648         else {
3649                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3650                            NL80211_REGDOM_TYPE_COUNTRY);
3651                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
3652         }
3653
3654         if (wiphy_idx_valid(request->wiphy_idx))
3655                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
3656
3657         if (genlmsg_end(msg, hdr) < 0) {
3658                 nlmsg_free(msg);
3659                 return;
3660         }
3661
3662         genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_KERNEL);
3663
3664         return;
3665
3666 nla_put_failure:
3667         genlmsg_cancel(msg, hdr);
3668         nlmsg_free(msg);
3669 }
3670
3671 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
3672                                     struct net_device *netdev,
3673                                     const u8 *buf, size_t len,
3674                                     enum nl80211_commands cmd)
3675 {
3676         struct sk_buff *msg;
3677         void *hdr;
3678
3679         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
3680         if (!msg)
3681                 return;
3682
3683         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
3684         if (!hdr) {
3685                 nlmsg_free(msg);
3686                 return;
3687         }
3688
3689         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3690         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3691         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
3692
3693         if (genlmsg_end(msg, hdr) < 0) {
3694                 nlmsg_free(msg);
3695                 return;
3696         }
3697
3698         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_ATOMIC);
3699         return;
3700
3701  nla_put_failure:
3702         genlmsg_cancel(msg, hdr);
3703         nlmsg_free(msg);
3704 }
3705
3706 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
3707                           struct net_device *netdev, const u8 *buf, size_t len)
3708 {
3709         nl80211_send_mlme_event(rdev, netdev, buf, len,
3710                                 NL80211_CMD_AUTHENTICATE);
3711 }
3712
3713 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
3714                            struct net_device *netdev, const u8 *buf,
3715                            size_t len)
3716 {
3717         nl80211_send_mlme_event(rdev, netdev, buf, len, NL80211_CMD_ASSOCIATE);
3718 }
3719
3720 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
3721                          struct net_device *netdev, const u8 *buf, size_t len)
3722 {
3723         nl80211_send_mlme_event(rdev, netdev, buf, len,
3724                                 NL80211_CMD_DEAUTHENTICATE);
3725 }
3726
3727 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
3728                            struct net_device *netdev, const u8 *buf,
3729                            size_t len)
3730 {
3731         nl80211_send_mlme_event(rdev, netdev, buf, len,
3732                                 NL80211_CMD_DISASSOCIATE);
3733 }
3734
3735 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
3736                                       struct net_device *netdev, int cmd,
3737                                       const u8 *addr)
3738 {
3739         struct sk_buff *msg;
3740         void *hdr;
3741
3742         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
3743         if (!msg)
3744                 return;
3745
3746         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
3747         if (!hdr) {
3748                 nlmsg_free(msg);
3749                 return;
3750         }
3751
3752         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3753         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3754         NLA_PUT_FLAG(msg, NL80211_ATTR_TIMED_OUT);
3755         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3756
3757         if (genlmsg_end(msg, hdr) < 0) {
3758                 nlmsg_free(msg);
3759                 return;
3760         }
3761
3762         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_ATOMIC);
3763         return;
3764
3765  nla_put_failure:
3766         genlmsg_cancel(msg, hdr);
3767         nlmsg_free(msg);
3768 }
3769
3770 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
3771                                struct net_device *netdev, const u8 *addr)
3772 {
3773         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
3774                                   addr);
3775 }
3776
3777 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
3778                                 struct net_device *netdev, const u8 *addr)
3779 {
3780         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE, addr);
3781 }
3782
3783 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
3784                              struct net_device *netdev, const u8 *bssid,
3785                              gfp_t gfp)
3786 {
3787         struct sk_buff *msg;
3788         void *hdr;
3789
3790         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
3791         if (!msg)
3792                 return;
3793
3794         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
3795         if (!hdr) {
3796                 nlmsg_free(msg);
3797                 return;
3798         }
3799
3800         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3801         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3802         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
3803
3804         if (genlmsg_end(msg, hdr) < 0) {
3805                 nlmsg_free(msg);
3806                 return;
3807         }
3808
3809         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
3810         return;
3811
3812  nla_put_failure:
3813         genlmsg_cancel(msg, hdr);
3814         nlmsg_free(msg);
3815 }
3816
3817 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
3818                                  struct net_device *netdev, const u8 *addr,
3819                                  enum nl80211_key_type key_type, int key_id,
3820                                  const u8 *tsc)
3821 {
3822         struct sk_buff *msg;
3823         void *hdr;
3824
3825         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3826         if (!msg)
3827                 return;
3828
3829         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
3830         if (!hdr) {
3831                 nlmsg_free(msg);
3832                 return;
3833         }
3834
3835         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3836         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3837         if (addr)
3838                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3839         NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, key_type);
3840         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_id);
3841         if (tsc)
3842                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, 6, tsc);
3843
3844         if (genlmsg_end(msg, hdr) < 0) {
3845                 nlmsg_free(msg);
3846                 return;
3847         }
3848
3849         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_KERNEL);
3850         return;
3851
3852  nla_put_failure:
3853         genlmsg_cancel(msg, hdr);
3854         nlmsg_free(msg);
3855 }
3856
3857 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
3858                                     struct ieee80211_channel *channel_before,
3859                                     struct ieee80211_channel *channel_after)
3860 {
3861         struct sk_buff *msg;
3862         void *hdr;
3863         struct nlattr *nl_freq;
3864
3865         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
3866         if (!msg)
3867                 return;
3868
3869         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
3870         if (!hdr) {
3871                 nlmsg_free(msg);
3872                 return;
3873         }
3874
3875         /*
3876          * Since we are applying the beacon hint to a wiphy we know its
3877          * wiphy_idx is valid
3878          */
3879         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy));
3880
3881         /* Before */
3882         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
3883         if (!nl_freq)
3884                 goto nla_put_failure;
3885         if (nl80211_msg_put_channel(msg, channel_before))
3886                 goto nla_put_failure;
3887         nla_nest_end(msg, nl_freq);
3888
3889         /* After */
3890         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
3891         if (!nl_freq)
3892                 goto nla_put_failure;
3893         if (nl80211_msg_put_channel(msg, channel_after))
3894                 goto nla_put_failure;
3895         nla_nest_end(msg, nl_freq);
3896
3897         if (genlmsg_end(msg, hdr) < 0) {
3898                 nlmsg_free(msg);
3899                 return;
3900         }
3901
3902         genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_ATOMIC);
3903
3904         return;
3905
3906 nla_put_failure:
3907         genlmsg_cancel(msg, hdr);
3908         nlmsg_free(msg);
3909 }
3910
3911 /* initialisation/exit functions */
3912
3913 int nl80211_init(void)
3914 {
3915         int err, i;
3916
3917         err = genl_register_family(&nl80211_fam);
3918         if (err)
3919                 return err;
3920
3921         for (i = 0; i < ARRAY_SIZE(nl80211_ops); i++) {
3922                 err = genl_register_ops(&nl80211_fam, &nl80211_ops[i]);
3923                 if (err)
3924                         goto err_out;
3925         }
3926
3927         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
3928         if (err)
3929                 goto err_out;
3930
3931         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
3932         if (err)
3933                 goto err_out;
3934
3935         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
3936         if (err)
3937                 goto err_out;
3938
3939         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
3940         if (err)
3941                 goto err_out;
3942
3943         return 0;
3944  err_out:
3945         genl_unregister_family(&nl80211_fam);
3946         return err;
3947 }
3948
3949 void nl80211_exit(void)
3950 {
3951         genl_unregister_family(&nl80211_fam);
3952 }