298a4de5994833b39380d7936e75dbf66e98a85b
[linux-3.10.git] / net / wireless / nl80211.c
1 /*
2  * This is the new netlink-based wireless configuration interface.
3  *
4  * Copyright 2006, 2007 Johannes Berg <johannes@sipsolutions.net>
5  */
6
7 #include <linux/if.h>
8 #include <linux/module.h>
9 #include <linux/err.h>
10 #include <linux/mutex.h>
11 #include <linux/list.h>
12 #include <linux/if_ether.h>
13 #include <linux/ieee80211.h>
14 #include <linux/nl80211.h>
15 #include <linux/rtnetlink.h>
16 #include <linux/netlink.h>
17 #include <linux/etherdevice.h>
18 #include <net/genetlink.h>
19 #include <net/cfg80211.h>
20 #include "core.h"
21 #include "nl80211.h"
22 #include "reg.h"
23
24 /* the netlink family */
25 static struct genl_family nl80211_fam = {
26         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
27         .name = "nl80211",      /* have users key off the name instead */
28         .hdrsize = 0,           /* no private header */
29         .version = 1,           /* no particular meaning now */
30         .maxattr = NL80211_ATTR_MAX,
31 };
32
33 /* internal helper: get drv and dev */
34 static int get_drv_dev_by_info_ifindex(struct nlattr **attrs,
35                                        struct cfg80211_registered_device **drv,
36                                        struct net_device **dev)
37 {
38         int ifindex;
39
40         if (!attrs[NL80211_ATTR_IFINDEX])
41                 return -EINVAL;
42
43         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
44         *dev = dev_get_by_index(&init_net, ifindex);
45         if (!*dev)
46                 return -ENODEV;
47
48         *drv = cfg80211_get_dev_from_ifindex(ifindex);
49         if (IS_ERR(*drv)) {
50                 dev_put(*dev);
51                 return PTR_ERR(*drv);
52         }
53
54         return 0;
55 }
56
57 /* policy for the attributes */
58 static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
59         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
60         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
61                                       .len = BUS_ID_SIZE-1 },
62         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
63         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
64         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
65
66         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
67         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
68         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
69
70         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
71
72         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
73                                     .len = WLAN_MAX_KEY_LEN },
74         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
75         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
76         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
77
78         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
79         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
80         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
81                                        .len = IEEE80211_MAX_DATA_LEN },
82         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
83                                        .len = IEEE80211_MAX_DATA_LEN },
84         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
85         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
86         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
87         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
88                                                .len = NL80211_MAX_SUPP_RATES },
89         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
90         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
91         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
92         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
93                                 .len = IEEE80211_MAX_MESH_ID_LEN },
94         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
95
96         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
97         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
98
99         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
100         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
101         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
102         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
103                                            .len = NL80211_MAX_SUPP_RATES },
104
105         [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
106
107         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
108                                          .len = NL80211_HT_CAPABILITY_LEN },
109
110         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
111         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
112                               .len = IEEE80211_MAX_DATA_LEN },
113         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
114         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
115 };
116
117 /* message building helper */
118 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
119                                    int flags, u8 cmd)
120 {
121         /* since there is no private header just add the generic one */
122         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
123 }
124
125 /* netlink command implementations */
126
127 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
128                               struct cfg80211_registered_device *dev)
129 {
130         void *hdr;
131         struct nlattr *nl_bands, *nl_band;
132         struct nlattr *nl_freqs, *nl_freq;
133         struct nlattr *nl_rates, *nl_rate;
134         struct nlattr *nl_modes;
135         enum ieee80211_band band;
136         struct ieee80211_channel *chan;
137         struct ieee80211_rate *rate;
138         int i;
139         u16 ifmodes = dev->wiphy.interface_modes;
140
141         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
142         if (!hdr)
143                 return -1;
144
145         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->idx);
146         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
147         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
148                    dev->wiphy.max_scan_ssids);
149
150         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
151         if (!nl_modes)
152                 goto nla_put_failure;
153
154         i = 0;
155         while (ifmodes) {
156                 if (ifmodes & 1)
157                         NLA_PUT_FLAG(msg, i);
158                 ifmodes >>= 1;
159                 i++;
160         }
161
162         nla_nest_end(msg, nl_modes);
163
164         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
165         if (!nl_bands)
166                 goto nla_put_failure;
167
168         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
169                 if (!dev->wiphy.bands[band])
170                         continue;
171
172                 nl_band = nla_nest_start(msg, band);
173                 if (!nl_band)
174                         goto nla_put_failure;
175
176                 /* add HT info */
177                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
178                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
179                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
180                                 &dev->wiphy.bands[band]->ht_cap.mcs);
181                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
182                                 dev->wiphy.bands[band]->ht_cap.cap);
183                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
184                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
185                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
186                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
187                 }
188
189                 /* add frequencies */
190                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
191                 if (!nl_freqs)
192                         goto nla_put_failure;
193
194                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
195                         nl_freq = nla_nest_start(msg, i);
196                         if (!nl_freq)
197                                 goto nla_put_failure;
198
199                         chan = &dev->wiphy.bands[band]->channels[i];
200                         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
201                                     chan->center_freq);
202
203                         if (chan->flags & IEEE80211_CHAN_DISABLED)
204                                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
205                         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
206                                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
207                         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
208                                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
209                         if (chan->flags & IEEE80211_CHAN_RADAR)
210                                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
211
212                         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
213                                     DBM_TO_MBM(chan->max_power));
214
215                         nla_nest_end(msg, nl_freq);
216                 }
217
218                 nla_nest_end(msg, nl_freqs);
219
220                 /* add bitrates */
221                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
222                 if (!nl_rates)
223                         goto nla_put_failure;
224
225                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
226                         nl_rate = nla_nest_start(msg, i);
227                         if (!nl_rate)
228                                 goto nla_put_failure;
229
230                         rate = &dev->wiphy.bands[band]->bitrates[i];
231                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
232                                     rate->bitrate);
233                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
234                                 NLA_PUT_FLAG(msg,
235                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
236
237                         nla_nest_end(msg, nl_rate);
238                 }
239
240                 nla_nest_end(msg, nl_rates);
241
242                 nla_nest_end(msg, nl_band);
243         }
244         nla_nest_end(msg, nl_bands);
245
246         return genlmsg_end(msg, hdr);
247
248  nla_put_failure:
249         genlmsg_cancel(msg, hdr);
250         return -EMSGSIZE;
251 }
252
253 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
254 {
255         int idx = 0;
256         int start = cb->args[0];
257         struct cfg80211_registered_device *dev;
258
259         mutex_lock(&cfg80211_drv_mutex);
260         list_for_each_entry(dev, &cfg80211_drv_list, list) {
261                 if (++idx <= start)
262                         continue;
263                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
264                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
265                                        dev) < 0) {
266                         idx--;
267                         break;
268                 }
269         }
270         mutex_unlock(&cfg80211_drv_mutex);
271
272         cb->args[0] = idx;
273
274         return skb->len;
275 }
276
277 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
278 {
279         struct sk_buff *msg;
280         struct cfg80211_registered_device *dev;
281
282         dev = cfg80211_get_dev_from_info(info);
283         if (IS_ERR(dev))
284                 return PTR_ERR(dev);
285
286         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
287         if (!msg)
288                 goto out_err;
289
290         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
291                 goto out_free;
292
293         cfg80211_put_dev(dev);
294
295         return genlmsg_unicast(msg, info->snd_pid);
296
297  out_free:
298         nlmsg_free(msg);
299  out_err:
300         cfg80211_put_dev(dev);
301         return -ENOBUFS;
302 }
303
304 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
305         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
306         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
307         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
308         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
309         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
310 };
311
312 static int parse_txq_params(struct nlattr *tb[],
313                             struct ieee80211_txq_params *txq_params)
314 {
315         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
316             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
317             !tb[NL80211_TXQ_ATTR_AIFS])
318                 return -EINVAL;
319
320         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
321         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
322         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
323         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
324         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
325
326         return 0;
327 }
328
329 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
330 {
331         struct cfg80211_registered_device *rdev;
332         int result = 0, rem_txq_params = 0;
333         struct nlattr *nl_txq_params;
334
335         rdev = cfg80211_get_dev_from_info(info);
336         if (IS_ERR(rdev))
337                 return PTR_ERR(rdev);
338
339         if (info->attrs[NL80211_ATTR_WIPHY_NAME]) {
340                 result = cfg80211_dev_rename(
341                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
342                 if (result)
343                         goto bad_res;
344         }
345
346         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
347                 struct ieee80211_txq_params txq_params;
348                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
349
350                 if (!rdev->ops->set_txq_params) {
351                         result = -EOPNOTSUPP;
352                         goto bad_res;
353                 }
354
355                 nla_for_each_nested(nl_txq_params,
356                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
357                                     rem_txq_params) {
358                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
359                                   nla_data(nl_txq_params),
360                                   nla_len(nl_txq_params),
361                                   txq_params_policy);
362                         result = parse_txq_params(tb, &txq_params);
363                         if (result)
364                                 goto bad_res;
365
366                         result = rdev->ops->set_txq_params(&rdev->wiphy,
367                                                            &txq_params);
368                         if (result)
369                                 goto bad_res;
370                 }
371         }
372
373         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
374                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
375                 struct ieee80211_channel *chan;
376                 struct ieee80211_sta_ht_cap *ht_cap;
377                 u32 freq, sec_freq;
378
379                 if (!rdev->ops->set_channel) {
380                         result = -EOPNOTSUPP;
381                         goto bad_res;
382                 }
383
384                 result = -EINVAL;
385
386                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
387                         channel_type = nla_get_u32(info->attrs[
388                                            NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
389                         if (channel_type != NL80211_CHAN_NO_HT &&
390                             channel_type != NL80211_CHAN_HT20 &&
391                             channel_type != NL80211_CHAN_HT40PLUS &&
392                             channel_type != NL80211_CHAN_HT40MINUS)
393                                 goto bad_res;
394                 }
395
396                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
397                 chan = ieee80211_get_channel(&rdev->wiphy, freq);
398
399                 /* Primary channel not allowed */
400                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
401                         goto bad_res;
402
403                 if (channel_type == NL80211_CHAN_HT40MINUS)
404                         sec_freq = freq - 20;
405                 else if (channel_type == NL80211_CHAN_HT40PLUS)
406                         sec_freq = freq + 20;
407                 else
408                         sec_freq = 0;
409
410                 ht_cap = &rdev->wiphy.bands[chan->band]->ht_cap;
411
412                 /* no HT capabilities */
413                 if (channel_type != NL80211_CHAN_NO_HT &&
414                     !ht_cap->ht_supported)
415                         goto bad_res;
416
417                 if (sec_freq) {
418                         struct ieee80211_channel *schan;
419
420                         /* no 40 MHz capabilities */
421                         if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
422                             (ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT))
423                                 goto bad_res;
424
425                         schan = ieee80211_get_channel(&rdev->wiphy, sec_freq);
426
427                         /* Secondary channel not allowed */
428                         if (!schan || schan->flags & IEEE80211_CHAN_DISABLED)
429                                 goto bad_res;
430                 }
431
432                 result = rdev->ops->set_channel(&rdev->wiphy, chan,
433                                                 channel_type);
434                 if (result)
435                         goto bad_res;
436         }
437
438
439  bad_res:
440         cfg80211_put_dev(rdev);
441         return result;
442 }
443
444
445 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
446                               struct net_device *dev)
447 {
448         void *hdr;
449
450         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
451         if (!hdr)
452                 return -1;
453
454         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
455         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
456         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
457         return genlmsg_end(msg, hdr);
458
459  nla_put_failure:
460         genlmsg_cancel(msg, hdr);
461         return -EMSGSIZE;
462 }
463
464 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
465 {
466         int wp_idx = 0;
467         int if_idx = 0;
468         int wp_start = cb->args[0];
469         int if_start = cb->args[1];
470         struct cfg80211_registered_device *dev;
471         struct wireless_dev *wdev;
472
473         mutex_lock(&cfg80211_drv_mutex);
474         list_for_each_entry(dev, &cfg80211_drv_list, list) {
475                 if (wp_idx < wp_start) {
476                         wp_idx++;
477                         continue;
478                 }
479                 if_idx = 0;
480
481                 mutex_lock(&dev->devlist_mtx);
482                 list_for_each_entry(wdev, &dev->netdev_list, list) {
483                         if (if_idx < if_start) {
484                                 if_idx++;
485                                 continue;
486                         }
487                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
488                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
489                                                wdev->netdev) < 0) {
490                                 mutex_unlock(&dev->devlist_mtx);
491                                 goto out;
492                         }
493                         if_idx++;
494                 }
495                 mutex_unlock(&dev->devlist_mtx);
496
497                 wp_idx++;
498         }
499  out:
500         mutex_unlock(&cfg80211_drv_mutex);
501
502         cb->args[0] = wp_idx;
503         cb->args[1] = if_idx;
504
505         return skb->len;
506 }
507
508 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
509 {
510         struct sk_buff *msg;
511         struct cfg80211_registered_device *dev;
512         struct net_device *netdev;
513         int err;
514
515         err = get_drv_dev_by_info_ifindex(info->attrs, &dev, &netdev);
516         if (err)
517                 return err;
518
519         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
520         if (!msg)
521                 goto out_err;
522
523         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0, netdev) < 0)
524                 goto out_free;
525
526         dev_put(netdev);
527         cfg80211_put_dev(dev);
528
529         return genlmsg_unicast(msg, info->snd_pid);
530
531  out_free:
532         nlmsg_free(msg);
533  out_err:
534         dev_put(netdev);
535         cfg80211_put_dev(dev);
536         return -ENOBUFS;
537 }
538
539 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
540         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
541         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
542         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
543         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
544         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
545 };
546
547 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
548 {
549         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
550         int flag;
551
552         *mntrflags = 0;
553
554         if (!nla)
555                 return -EINVAL;
556
557         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
558                              nla, mntr_flags_policy))
559                 return -EINVAL;
560
561         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
562                 if (flags[flag])
563                         *mntrflags |= (1<<flag);
564
565         return 0;
566 }
567
568 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
569 {
570         struct cfg80211_registered_device *drv;
571         struct vif_params params;
572         int err, ifindex;
573         enum nl80211_iftype type;
574         struct net_device *dev;
575         u32 _flags, *flags = NULL;
576
577         memset(&params, 0, sizeof(params));
578
579         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
580         if (err)
581                 return err;
582         ifindex = dev->ifindex;
583         type = dev->ieee80211_ptr->iftype;
584         dev_put(dev);
585
586         err = -EINVAL;
587         if (info->attrs[NL80211_ATTR_IFTYPE]) {
588                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
589                 if (type > NL80211_IFTYPE_MAX)
590                         goto unlock;
591         }
592
593         if (!drv->ops->change_virtual_intf ||
594             !(drv->wiphy.interface_modes & (1 << type))) {
595                 err = -EOPNOTSUPP;
596                 goto unlock;
597         }
598
599         if (info->attrs[NL80211_ATTR_MESH_ID]) {
600                 if (type != NL80211_IFTYPE_MESH_POINT) {
601                         err = -EINVAL;
602                         goto unlock;
603                 }
604                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
605                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
606         }
607
608         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
609                 if (type != NL80211_IFTYPE_MONITOR) {
610                         err = -EINVAL;
611                         goto unlock;
612                 }
613                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
614                                           &_flags);
615                 if (!err)
616                         flags = &_flags;
617         }
618         rtnl_lock();
619         err = drv->ops->change_virtual_intf(&drv->wiphy, ifindex,
620                                             type, flags, &params);
621
622         dev = __dev_get_by_index(&init_net, ifindex);
623         WARN_ON(!dev || (!err && dev->ieee80211_ptr->iftype != type));
624
625         rtnl_unlock();
626
627  unlock:
628         cfg80211_put_dev(drv);
629         return err;
630 }
631
632 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
633 {
634         struct cfg80211_registered_device *drv;
635         struct vif_params params;
636         int err;
637         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
638         u32 flags;
639
640         memset(&params, 0, sizeof(params));
641
642         if (!info->attrs[NL80211_ATTR_IFNAME])
643                 return -EINVAL;
644
645         if (info->attrs[NL80211_ATTR_IFTYPE]) {
646                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
647                 if (type > NL80211_IFTYPE_MAX)
648                         return -EINVAL;
649         }
650
651         drv = cfg80211_get_dev_from_info(info);
652         if (IS_ERR(drv))
653                 return PTR_ERR(drv);
654
655         if (!drv->ops->add_virtual_intf ||
656             !(drv->wiphy.interface_modes & (1 << type))) {
657                 err = -EOPNOTSUPP;
658                 goto unlock;
659         }
660
661         if (type == NL80211_IFTYPE_MESH_POINT &&
662             info->attrs[NL80211_ATTR_MESH_ID]) {
663                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
664                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
665         }
666
667         rtnl_lock();
668         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
669                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
670                                   &flags);
671         err = drv->ops->add_virtual_intf(&drv->wiphy,
672                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
673                 type, err ? NULL : &flags, &params);
674         rtnl_unlock();
675
676
677  unlock:
678         cfg80211_put_dev(drv);
679         return err;
680 }
681
682 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
683 {
684         struct cfg80211_registered_device *drv;
685         int ifindex, err;
686         struct net_device *dev;
687
688         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
689         if (err)
690                 return err;
691         ifindex = dev->ifindex;
692         dev_put(dev);
693
694         if (!drv->ops->del_virtual_intf) {
695                 err = -EOPNOTSUPP;
696                 goto out;
697         }
698
699         rtnl_lock();
700         err = drv->ops->del_virtual_intf(&drv->wiphy, ifindex);
701         rtnl_unlock();
702
703  out:
704         cfg80211_put_dev(drv);
705         return err;
706 }
707
708 struct get_key_cookie {
709         struct sk_buff *msg;
710         int error;
711 };
712
713 static void get_key_callback(void *c, struct key_params *params)
714 {
715         struct get_key_cookie *cookie = c;
716
717         if (params->key)
718                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
719                         params->key_len, params->key);
720
721         if (params->seq)
722                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
723                         params->seq_len, params->seq);
724
725         if (params->cipher)
726                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
727                             params->cipher);
728
729         return;
730  nla_put_failure:
731         cookie->error = 1;
732 }
733
734 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
735 {
736         struct cfg80211_registered_device *drv;
737         int err;
738         struct net_device *dev;
739         u8 key_idx = 0;
740         u8 *mac_addr = NULL;
741         struct get_key_cookie cookie = {
742                 .error = 0,
743         };
744         void *hdr;
745         struct sk_buff *msg;
746
747         if (info->attrs[NL80211_ATTR_KEY_IDX])
748                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
749
750         if (key_idx > 5)
751                 return -EINVAL;
752
753         if (info->attrs[NL80211_ATTR_MAC])
754                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
755
756         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
757         if (err)
758                 return err;
759
760         if (!drv->ops->get_key) {
761                 err = -EOPNOTSUPP;
762                 goto out;
763         }
764
765         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
766         if (!msg) {
767                 err = -ENOMEM;
768                 goto out;
769         }
770
771         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
772                              NL80211_CMD_NEW_KEY);
773
774         if (IS_ERR(hdr)) {
775                 err = PTR_ERR(hdr);
776                 goto out;
777         }
778
779         cookie.msg = msg;
780
781         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
782         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
783         if (mac_addr)
784                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
785
786         rtnl_lock();
787         err = drv->ops->get_key(&drv->wiphy, dev, key_idx, mac_addr,
788                                 &cookie, get_key_callback);
789         rtnl_unlock();
790
791         if (err)
792                 goto out;
793
794         if (cookie.error)
795                 goto nla_put_failure;
796
797         genlmsg_end(msg, hdr);
798         err = genlmsg_unicast(msg, info->snd_pid);
799         goto out;
800
801  nla_put_failure:
802         err = -ENOBUFS;
803         nlmsg_free(msg);
804  out:
805         cfg80211_put_dev(drv);
806         dev_put(dev);
807         return err;
808 }
809
810 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
811 {
812         struct cfg80211_registered_device *drv;
813         int err;
814         struct net_device *dev;
815         u8 key_idx;
816         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
817                     u8 key_index);
818
819         if (!info->attrs[NL80211_ATTR_KEY_IDX])
820                 return -EINVAL;
821
822         key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
823
824         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]) {
825                 if (key_idx < 4 || key_idx > 5)
826                         return -EINVAL;
827         } else if (key_idx > 3)
828                 return -EINVAL;
829
830         /* currently only support setting default key */
831         if (!info->attrs[NL80211_ATTR_KEY_DEFAULT] &&
832             !info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT])
833                 return -EINVAL;
834
835         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
836         if (err)
837                 return err;
838
839         if (info->attrs[NL80211_ATTR_KEY_DEFAULT])
840                 func = drv->ops->set_default_key;
841         else
842                 func = drv->ops->set_default_mgmt_key;
843
844         if (!func) {
845                 err = -EOPNOTSUPP;
846                 goto out;
847         }
848
849         rtnl_lock();
850         err = func(&drv->wiphy, dev, key_idx);
851         rtnl_unlock();
852
853  out:
854         cfg80211_put_dev(drv);
855         dev_put(dev);
856         return err;
857 }
858
859 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
860 {
861         struct cfg80211_registered_device *drv;
862         int err;
863         struct net_device *dev;
864         struct key_params params;
865         u8 key_idx = 0;
866         u8 *mac_addr = NULL;
867
868         memset(&params, 0, sizeof(params));
869
870         if (!info->attrs[NL80211_ATTR_KEY_CIPHER])
871                 return -EINVAL;
872
873         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
874                 params.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
875                 params.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
876         }
877
878         if (info->attrs[NL80211_ATTR_KEY_IDX])
879                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
880
881         params.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
882
883         if (info->attrs[NL80211_ATTR_MAC])
884                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
885
886         if (key_idx > 5)
887                 return -EINVAL;
888
889         /*
890          * Disallow pairwise keys with non-zero index unless it's WEP
891          * (because current deployments use pairwise WEP keys with
892          * non-zero indizes but 802.11i clearly specifies to use zero)
893          */
894         if (mac_addr && key_idx &&
895             params.cipher != WLAN_CIPHER_SUITE_WEP40 &&
896             params.cipher != WLAN_CIPHER_SUITE_WEP104)
897                 return -EINVAL;
898
899         /* TODO: add definitions for the lengths to linux/ieee80211.h */
900         switch (params.cipher) {
901         case WLAN_CIPHER_SUITE_WEP40:
902                 if (params.key_len != 5)
903                         return -EINVAL;
904                 break;
905         case WLAN_CIPHER_SUITE_TKIP:
906                 if (params.key_len != 32)
907                         return -EINVAL;
908                 break;
909         case WLAN_CIPHER_SUITE_CCMP:
910                 if (params.key_len != 16)
911                         return -EINVAL;
912                 break;
913         case WLAN_CIPHER_SUITE_WEP104:
914                 if (params.key_len != 13)
915                         return -EINVAL;
916                 break;
917         case WLAN_CIPHER_SUITE_AES_CMAC:
918                 if (params.key_len != 16)
919                         return -EINVAL;
920                 break;
921         default:
922                 return -EINVAL;
923         }
924
925         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
926         if (err)
927                 return err;
928
929         if (!drv->ops->add_key) {
930                 err = -EOPNOTSUPP;
931                 goto out;
932         }
933
934         rtnl_lock();
935         err = drv->ops->add_key(&drv->wiphy, dev, key_idx, mac_addr, &params);
936         rtnl_unlock();
937
938  out:
939         cfg80211_put_dev(drv);
940         dev_put(dev);
941         return err;
942 }
943
944 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
945 {
946         struct cfg80211_registered_device *drv;
947         int err;
948         struct net_device *dev;
949         u8 key_idx = 0;
950         u8 *mac_addr = NULL;
951
952         if (info->attrs[NL80211_ATTR_KEY_IDX])
953                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
954
955         if (key_idx > 5)
956                 return -EINVAL;
957
958         if (info->attrs[NL80211_ATTR_MAC])
959                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
960
961         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
962         if (err)
963                 return err;
964
965         if (!drv->ops->del_key) {
966                 err = -EOPNOTSUPP;
967                 goto out;
968         }
969
970         rtnl_lock();
971         err = drv->ops->del_key(&drv->wiphy, dev, key_idx, mac_addr);
972         rtnl_unlock();
973
974  out:
975         cfg80211_put_dev(drv);
976         dev_put(dev);
977         return err;
978 }
979
980 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
981 {
982         int (*call)(struct wiphy *wiphy, struct net_device *dev,
983                     struct beacon_parameters *info);
984         struct cfg80211_registered_device *drv;
985         int err;
986         struct net_device *dev;
987         struct beacon_parameters params;
988         int haveinfo = 0;
989
990         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
991         if (err)
992                 return err;
993
994         switch (info->genlhdr->cmd) {
995         case NL80211_CMD_NEW_BEACON:
996                 /* these are required for NEW_BEACON */
997                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
998                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
999                     !info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1000                         err = -EINVAL;
1001                         goto out;
1002                 }
1003
1004                 call = drv->ops->add_beacon;
1005                 break;
1006         case NL80211_CMD_SET_BEACON:
1007                 call = drv->ops->set_beacon;
1008                 break;
1009         default:
1010                 WARN_ON(1);
1011                 err = -EOPNOTSUPP;
1012                 goto out;
1013         }
1014
1015         if (!call) {
1016                 err = -EOPNOTSUPP;
1017                 goto out;
1018         }
1019
1020         memset(&params, 0, sizeof(params));
1021
1022         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1023                 params.interval =
1024                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1025                 haveinfo = 1;
1026         }
1027
1028         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1029                 params.dtim_period =
1030                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1031                 haveinfo = 1;
1032         }
1033
1034         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1035                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1036                 params.head_len =
1037                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1038                 haveinfo = 1;
1039         }
1040
1041         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1042                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1043                 params.tail_len =
1044                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1045                 haveinfo = 1;
1046         }
1047
1048         if (!haveinfo) {
1049                 err = -EINVAL;
1050                 goto out;
1051         }
1052
1053         rtnl_lock();
1054         err = call(&drv->wiphy, dev, &params);
1055         rtnl_unlock();
1056
1057  out:
1058         cfg80211_put_dev(drv);
1059         dev_put(dev);
1060         return err;
1061 }
1062
1063 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1064 {
1065         struct cfg80211_registered_device *drv;
1066         int err;
1067         struct net_device *dev;
1068
1069         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1070         if (err)
1071                 return err;
1072
1073         if (!drv->ops->del_beacon) {
1074                 err = -EOPNOTSUPP;
1075                 goto out;
1076         }
1077
1078         rtnl_lock();
1079         err = drv->ops->del_beacon(&drv->wiphy, dev);
1080         rtnl_unlock();
1081
1082  out:
1083         cfg80211_put_dev(drv);
1084         dev_put(dev);
1085         return err;
1086 }
1087
1088 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1089         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1090         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1091         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1092 };
1093
1094 static int parse_station_flags(struct nlattr *nla, u32 *staflags)
1095 {
1096         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1097         int flag;
1098
1099         *staflags = 0;
1100
1101         if (!nla)
1102                 return 0;
1103
1104         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1105                              nla, sta_flags_policy))
1106                 return -EINVAL;
1107
1108         *staflags = STATION_FLAG_CHANGED;
1109
1110         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1111                 if (flags[flag])
1112                         *staflags |= (1<<flag);
1113
1114         return 0;
1115 }
1116
1117 static u16 nl80211_calculate_bitrate(struct rate_info *rate)
1118 {
1119         int modulation, streams, bitrate;
1120
1121         if (!(rate->flags & RATE_INFO_FLAGS_MCS))
1122                 return rate->legacy;
1123
1124         /* the formula below does only work for MCS values smaller than 32 */
1125         if (rate->mcs >= 32)
1126                 return 0;
1127
1128         modulation = rate->mcs & 7;
1129         streams = (rate->mcs >> 3) + 1;
1130
1131         bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
1132                         13500000 : 6500000;
1133
1134         if (modulation < 4)
1135                 bitrate *= (modulation + 1);
1136         else if (modulation == 4)
1137                 bitrate *= (modulation + 2);
1138         else
1139                 bitrate *= (modulation + 3);
1140
1141         bitrate *= streams;
1142
1143         if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
1144                 bitrate = (bitrate / 9) * 10;
1145
1146         /* do NOT round down here */
1147         return (bitrate + 50000) / 100000;
1148 }
1149
1150 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1151                                 int flags, struct net_device *dev,
1152                                 u8 *mac_addr, struct station_info *sinfo)
1153 {
1154         void *hdr;
1155         struct nlattr *sinfoattr, *txrate;
1156         u16 bitrate;
1157
1158         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1159         if (!hdr)
1160                 return -1;
1161
1162         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1163         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1164
1165         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1166         if (!sinfoattr)
1167                 goto nla_put_failure;
1168         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1169                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1170                             sinfo->inactive_time);
1171         if (sinfo->filled & STATION_INFO_RX_BYTES)
1172                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1173                             sinfo->rx_bytes);
1174         if (sinfo->filled & STATION_INFO_TX_BYTES)
1175                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1176                             sinfo->tx_bytes);
1177         if (sinfo->filled & STATION_INFO_LLID)
1178                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1179                             sinfo->llid);
1180         if (sinfo->filled & STATION_INFO_PLID)
1181                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1182                             sinfo->plid);
1183         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1184                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1185                             sinfo->plink_state);
1186         if (sinfo->filled & STATION_INFO_SIGNAL)
1187                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1188                            sinfo->signal);
1189         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1190                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1191                 if (!txrate)
1192                         goto nla_put_failure;
1193
1194                 /* nl80211_calculate_bitrate will return 0 for mcs >= 32 */
1195                 bitrate = nl80211_calculate_bitrate(&sinfo->txrate);
1196                 if (bitrate > 0)
1197                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1198
1199                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1200                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1201                                     sinfo->txrate.mcs);
1202                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1203                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1204                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1205                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1206
1207                 nla_nest_end(msg, txrate);
1208         }
1209         nla_nest_end(msg, sinfoattr);
1210
1211         return genlmsg_end(msg, hdr);
1212
1213  nla_put_failure:
1214         genlmsg_cancel(msg, hdr);
1215         return -EMSGSIZE;
1216 }
1217
1218 static int nl80211_dump_station(struct sk_buff *skb,
1219                                 struct netlink_callback *cb)
1220 {
1221         struct station_info sinfo;
1222         struct cfg80211_registered_device *dev;
1223         struct net_device *netdev;
1224         u8 mac_addr[ETH_ALEN];
1225         int ifidx = cb->args[0];
1226         int sta_idx = cb->args[1];
1227         int err;
1228
1229         if (!ifidx) {
1230                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1231                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1232                                   nl80211_policy);
1233                 if (err)
1234                         return err;
1235
1236                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1237                         return -EINVAL;
1238
1239                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1240                 if (!ifidx)
1241                         return -EINVAL;
1242         }
1243
1244         netdev = dev_get_by_index(&init_net, ifidx);
1245         if (!netdev)
1246                 return -ENODEV;
1247
1248         dev = cfg80211_get_dev_from_ifindex(ifidx);
1249         if (IS_ERR(dev)) {
1250                 err = PTR_ERR(dev);
1251                 goto out_put_netdev;
1252         }
1253
1254         if (!dev->ops->dump_station) {
1255                 err = -ENOSYS;
1256                 goto out_err;
1257         }
1258
1259         rtnl_lock();
1260
1261         while (1) {
1262                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1263                                              mac_addr, &sinfo);
1264                 if (err == -ENOENT)
1265                         break;
1266                 if (err)
1267                         goto out_err_rtnl;
1268
1269                 if (nl80211_send_station(skb,
1270                                 NETLINK_CB(cb->skb).pid,
1271                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
1272                                 netdev, mac_addr,
1273                                 &sinfo) < 0)
1274                         goto out;
1275
1276                 sta_idx++;
1277         }
1278
1279
1280  out:
1281         cb->args[1] = sta_idx;
1282         err = skb->len;
1283  out_err_rtnl:
1284         rtnl_unlock();
1285  out_err:
1286         cfg80211_put_dev(dev);
1287  out_put_netdev:
1288         dev_put(netdev);
1289
1290         return err;
1291 }
1292
1293 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1294 {
1295         struct cfg80211_registered_device *drv;
1296         int err;
1297         struct net_device *dev;
1298         struct station_info sinfo;
1299         struct sk_buff *msg;
1300         u8 *mac_addr = NULL;
1301
1302         memset(&sinfo, 0, sizeof(sinfo));
1303
1304         if (!info->attrs[NL80211_ATTR_MAC])
1305                 return -EINVAL;
1306
1307         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1308
1309         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1310         if (err)
1311                 return err;
1312
1313         if (!drv->ops->get_station) {
1314                 err = -EOPNOTSUPP;
1315                 goto out;
1316         }
1317
1318         rtnl_lock();
1319         err = drv->ops->get_station(&drv->wiphy, dev, mac_addr, &sinfo);
1320         rtnl_unlock();
1321
1322         if (err)
1323                 goto out;
1324
1325         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1326         if (!msg)
1327                 goto out;
1328
1329         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1330                                  dev, mac_addr, &sinfo) < 0)
1331                 goto out_free;
1332
1333         err = genlmsg_unicast(msg, info->snd_pid);
1334         goto out;
1335
1336  out_free:
1337         nlmsg_free(msg);
1338
1339  out:
1340         cfg80211_put_dev(drv);
1341         dev_put(dev);
1342         return err;
1343 }
1344
1345 /*
1346  * Get vlan interface making sure it is on the right wiphy.
1347  */
1348 static int get_vlan(struct nlattr *vlanattr,
1349                     struct cfg80211_registered_device *rdev,
1350                     struct net_device **vlan)
1351 {
1352         *vlan = NULL;
1353
1354         if (vlanattr) {
1355                 *vlan = dev_get_by_index(&init_net, nla_get_u32(vlanattr));
1356                 if (!*vlan)
1357                         return -ENODEV;
1358                 if (!(*vlan)->ieee80211_ptr)
1359                         return -EINVAL;
1360                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
1361                         return -EINVAL;
1362         }
1363         return 0;
1364 }
1365
1366 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
1367 {
1368         struct cfg80211_registered_device *drv;
1369         int err;
1370         struct net_device *dev;
1371         struct station_parameters params;
1372         u8 *mac_addr = NULL;
1373
1374         memset(&params, 0, sizeof(params));
1375
1376         params.listen_interval = -1;
1377
1378         if (info->attrs[NL80211_ATTR_STA_AID])
1379                 return -EINVAL;
1380
1381         if (!info->attrs[NL80211_ATTR_MAC])
1382                 return -EINVAL;
1383
1384         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1385
1386         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
1387                 params.supported_rates =
1388                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1389                 params.supported_rates_len =
1390                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1391         }
1392
1393         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1394                 params.listen_interval =
1395                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1396
1397         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1398                 params.ht_capa =
1399                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1400
1401         if (parse_station_flags(info->attrs[NL80211_ATTR_STA_FLAGS],
1402                                 &params.station_flags))
1403                 return -EINVAL;
1404
1405         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
1406                 params.plink_action =
1407                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
1408
1409         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1410         if (err)
1411                 return err;
1412
1413         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1414         if (err)
1415                 goto out;
1416
1417         if (!drv->ops->change_station) {
1418                 err = -EOPNOTSUPP;
1419                 goto out;
1420         }
1421
1422         rtnl_lock();
1423         err = drv->ops->change_station(&drv->wiphy, dev, mac_addr, &params);
1424         rtnl_unlock();
1425
1426  out:
1427         if (params.vlan)
1428                 dev_put(params.vlan);
1429         cfg80211_put_dev(drv);
1430         dev_put(dev);
1431         return err;
1432 }
1433
1434 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
1435 {
1436         struct cfg80211_registered_device *drv;
1437         int err;
1438         struct net_device *dev;
1439         struct station_parameters params;
1440         u8 *mac_addr = NULL;
1441
1442         memset(&params, 0, sizeof(params));
1443
1444         if (!info->attrs[NL80211_ATTR_MAC])
1445                 return -EINVAL;
1446
1447         if (!info->attrs[NL80211_ATTR_STA_AID])
1448                 return -EINVAL;
1449
1450         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1451                 return -EINVAL;
1452
1453         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
1454                 return -EINVAL;
1455
1456         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1457         params.supported_rates =
1458                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1459         params.supported_rates_len =
1460                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1461         params.listen_interval =
1462                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1463         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
1464         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1465                 params.ht_capa =
1466                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1467
1468         if (parse_station_flags(info->attrs[NL80211_ATTR_STA_FLAGS],
1469                                 &params.station_flags))
1470                 return -EINVAL;
1471
1472         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1473         if (err)
1474                 return err;
1475
1476         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1477         if (err)
1478                 goto out;
1479
1480         if (!drv->ops->add_station) {
1481                 err = -EOPNOTSUPP;
1482                 goto out;
1483         }
1484
1485         rtnl_lock();
1486         err = drv->ops->add_station(&drv->wiphy, dev, mac_addr, &params);
1487         rtnl_unlock();
1488
1489  out:
1490         if (params.vlan)
1491                 dev_put(params.vlan);
1492         cfg80211_put_dev(drv);
1493         dev_put(dev);
1494         return err;
1495 }
1496
1497 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
1498 {
1499         struct cfg80211_registered_device *drv;
1500         int err;
1501         struct net_device *dev;
1502         u8 *mac_addr = NULL;
1503
1504         if (info->attrs[NL80211_ATTR_MAC])
1505                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1506
1507         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1508         if (err)
1509                 return err;
1510
1511         if (!drv->ops->del_station) {
1512                 err = -EOPNOTSUPP;
1513                 goto out;
1514         }
1515
1516         rtnl_lock();
1517         err = drv->ops->del_station(&drv->wiphy, dev, mac_addr);
1518         rtnl_unlock();
1519
1520  out:
1521         cfg80211_put_dev(drv);
1522         dev_put(dev);
1523         return err;
1524 }
1525
1526 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
1527                                 int flags, struct net_device *dev,
1528                                 u8 *dst, u8 *next_hop,
1529                                 struct mpath_info *pinfo)
1530 {
1531         void *hdr;
1532         struct nlattr *pinfoattr;
1533
1534         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1535         if (!hdr)
1536                 return -1;
1537
1538         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1539         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
1540         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
1541
1542         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
1543         if (!pinfoattr)
1544                 goto nla_put_failure;
1545         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
1546                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
1547                             pinfo->frame_qlen);
1548         if (pinfo->filled & MPATH_INFO_DSN)
1549                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DSN,
1550                             pinfo->dsn);
1551         if (pinfo->filled & MPATH_INFO_METRIC)
1552                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
1553                             pinfo->metric);
1554         if (pinfo->filled & MPATH_INFO_EXPTIME)
1555                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
1556                             pinfo->exptime);
1557         if (pinfo->filled & MPATH_INFO_FLAGS)
1558                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
1559                             pinfo->flags);
1560         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
1561                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
1562                             pinfo->discovery_timeout);
1563         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
1564                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
1565                             pinfo->discovery_retries);
1566
1567         nla_nest_end(msg, pinfoattr);
1568
1569         return genlmsg_end(msg, hdr);
1570
1571  nla_put_failure:
1572         genlmsg_cancel(msg, hdr);
1573         return -EMSGSIZE;
1574 }
1575
1576 static int nl80211_dump_mpath(struct sk_buff *skb,
1577                               struct netlink_callback *cb)
1578 {
1579         struct mpath_info pinfo;
1580         struct cfg80211_registered_device *dev;
1581         struct net_device *netdev;
1582         u8 dst[ETH_ALEN];
1583         u8 next_hop[ETH_ALEN];
1584         int ifidx = cb->args[0];
1585         int path_idx = cb->args[1];
1586         int err;
1587
1588         if (!ifidx) {
1589                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1590                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1591                                   nl80211_policy);
1592                 if (err)
1593                         return err;
1594
1595                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1596                         return -EINVAL;
1597
1598                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1599                 if (!ifidx)
1600                         return -EINVAL;
1601         }
1602
1603         netdev = dev_get_by_index(&init_net, ifidx);
1604         if (!netdev)
1605                 return -ENODEV;
1606
1607         dev = cfg80211_get_dev_from_ifindex(ifidx);
1608         if (IS_ERR(dev)) {
1609                 err = PTR_ERR(dev);
1610                 goto out_put_netdev;
1611         }
1612
1613         if (!dev->ops->dump_mpath) {
1614                 err = -ENOSYS;
1615                 goto out_err;
1616         }
1617
1618         rtnl_lock();
1619
1620         while (1) {
1621                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
1622                                            dst, next_hop, &pinfo);
1623                 if (err == -ENOENT)
1624                         break;
1625                 if (err)
1626                         goto out_err_rtnl;
1627
1628                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
1629                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
1630                                        netdev, dst, next_hop,
1631                                        &pinfo) < 0)
1632                         goto out;
1633
1634                 path_idx++;
1635         }
1636
1637
1638  out:
1639         cb->args[1] = path_idx;
1640         err = skb->len;
1641  out_err_rtnl:
1642         rtnl_unlock();
1643  out_err:
1644         cfg80211_put_dev(dev);
1645  out_put_netdev:
1646         dev_put(netdev);
1647
1648         return err;
1649 }
1650
1651 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
1652 {
1653         struct cfg80211_registered_device *drv;
1654         int err;
1655         struct net_device *dev;
1656         struct mpath_info pinfo;
1657         struct sk_buff *msg;
1658         u8 *dst = NULL;
1659         u8 next_hop[ETH_ALEN];
1660
1661         memset(&pinfo, 0, sizeof(pinfo));
1662
1663         if (!info->attrs[NL80211_ATTR_MAC])
1664                 return -EINVAL;
1665
1666         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1667
1668         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1669         if (err)
1670                 return err;
1671
1672         if (!drv->ops->get_mpath) {
1673                 err = -EOPNOTSUPP;
1674                 goto out;
1675         }
1676
1677         rtnl_lock();
1678         err = drv->ops->get_mpath(&drv->wiphy, dev, dst, next_hop, &pinfo);
1679         rtnl_unlock();
1680
1681         if (err)
1682                 goto out;
1683
1684         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1685         if (!msg)
1686                 goto out;
1687
1688         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
1689                                  dev, dst, next_hop, &pinfo) < 0)
1690                 goto out_free;
1691
1692         err = genlmsg_unicast(msg, info->snd_pid);
1693         goto out;
1694
1695  out_free:
1696         nlmsg_free(msg);
1697
1698  out:
1699         cfg80211_put_dev(drv);
1700         dev_put(dev);
1701         return err;
1702 }
1703
1704 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
1705 {
1706         struct cfg80211_registered_device *drv;
1707         int err;
1708         struct net_device *dev;
1709         u8 *dst = NULL;
1710         u8 *next_hop = NULL;
1711
1712         if (!info->attrs[NL80211_ATTR_MAC])
1713                 return -EINVAL;
1714
1715         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
1716                 return -EINVAL;
1717
1718         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1719         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
1720
1721         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1722         if (err)
1723                 return err;
1724
1725         if (!drv->ops->change_mpath) {
1726                 err = -EOPNOTSUPP;
1727                 goto out;
1728         }
1729
1730         rtnl_lock();
1731         err = drv->ops->change_mpath(&drv->wiphy, dev, dst, next_hop);
1732         rtnl_unlock();
1733
1734  out:
1735         cfg80211_put_dev(drv);
1736         dev_put(dev);
1737         return err;
1738 }
1739 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
1740 {
1741         struct cfg80211_registered_device *drv;
1742         int err;
1743         struct net_device *dev;
1744         u8 *dst = NULL;
1745         u8 *next_hop = NULL;
1746
1747         if (!info->attrs[NL80211_ATTR_MAC])
1748                 return -EINVAL;
1749
1750         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
1751                 return -EINVAL;
1752
1753         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1754         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
1755
1756         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1757         if (err)
1758                 return err;
1759
1760         if (!drv->ops->add_mpath) {
1761                 err = -EOPNOTSUPP;
1762                 goto out;
1763         }
1764
1765         rtnl_lock();
1766         err = drv->ops->add_mpath(&drv->wiphy, dev, dst, next_hop);
1767         rtnl_unlock();
1768
1769  out:
1770         cfg80211_put_dev(drv);
1771         dev_put(dev);
1772         return err;
1773 }
1774
1775 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
1776 {
1777         struct cfg80211_registered_device *drv;
1778         int err;
1779         struct net_device *dev;
1780         u8 *dst = NULL;
1781
1782         if (info->attrs[NL80211_ATTR_MAC])
1783                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1784
1785         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1786         if (err)
1787                 return err;
1788
1789         if (!drv->ops->del_mpath) {
1790                 err = -EOPNOTSUPP;
1791                 goto out;
1792         }
1793
1794         rtnl_lock();
1795         err = drv->ops->del_mpath(&drv->wiphy, dev, dst);
1796         rtnl_unlock();
1797
1798  out:
1799         cfg80211_put_dev(drv);
1800         dev_put(dev);
1801         return err;
1802 }
1803
1804 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
1805 {
1806         struct cfg80211_registered_device *drv;
1807         int err;
1808         struct net_device *dev;
1809         struct bss_parameters params;
1810
1811         memset(&params, 0, sizeof(params));
1812         /* default to not changing parameters */
1813         params.use_cts_prot = -1;
1814         params.use_short_preamble = -1;
1815         params.use_short_slot_time = -1;
1816
1817         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
1818                 params.use_cts_prot =
1819                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
1820         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
1821                 params.use_short_preamble =
1822                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
1823         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
1824                 params.use_short_slot_time =
1825                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
1826         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
1827                 params.basic_rates =
1828                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
1829                 params.basic_rates_len =
1830                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
1831         }
1832
1833         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1834         if (err)
1835                 return err;
1836
1837         if (!drv->ops->change_bss) {
1838                 err = -EOPNOTSUPP;
1839                 goto out;
1840         }
1841
1842         rtnl_lock();
1843         err = drv->ops->change_bss(&drv->wiphy, dev, &params);
1844         rtnl_unlock();
1845
1846  out:
1847         cfg80211_put_dev(drv);
1848         dev_put(dev);
1849         return err;
1850 }
1851
1852 static const struct nla_policy
1853         reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
1854         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
1855         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
1856         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
1857         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
1858         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
1859         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
1860 };
1861
1862 static int parse_reg_rule(struct nlattr *tb[],
1863         struct ieee80211_reg_rule *reg_rule)
1864 {
1865         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
1866         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
1867
1868         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
1869                 return -EINVAL;
1870         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
1871                 return -EINVAL;
1872         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
1873                 return -EINVAL;
1874         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
1875                 return -EINVAL;
1876         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
1877                 return -EINVAL;
1878
1879         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
1880
1881         freq_range->start_freq_khz =
1882                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
1883         freq_range->end_freq_khz =
1884                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
1885         freq_range->max_bandwidth_khz =
1886                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
1887
1888         power_rule->max_eirp =
1889                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
1890
1891         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
1892                 power_rule->max_antenna_gain =
1893                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
1894
1895         return 0;
1896 }
1897
1898 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
1899 {
1900         int r;
1901         char *data = NULL;
1902
1903         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
1904                 return -EINVAL;
1905
1906         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
1907
1908 #ifdef CONFIG_WIRELESS_OLD_REGULATORY
1909         /* We ignore world regdom requests with the old regdom setup */
1910         if (is_world_regdom(data))
1911                 return -EINVAL;
1912 #endif
1913         mutex_lock(&cfg80211_drv_mutex);
1914         r = __regulatory_hint(NULL, REGDOM_SET_BY_USER, data, 0, ENVIRON_ANY);
1915         mutex_unlock(&cfg80211_drv_mutex);
1916         /* This means the regulatory domain was already set, however
1917          * we don't want to confuse userspace with a "successful error"
1918          * message so lets just treat it as a success */
1919         if (r == -EALREADY)
1920                 r = 0;
1921         return r;
1922 }
1923
1924 static int nl80211_get_mesh_params(struct sk_buff *skb,
1925         struct genl_info *info)
1926 {
1927         struct cfg80211_registered_device *drv;
1928         struct mesh_config cur_params;
1929         int err;
1930         struct net_device *dev;
1931         void *hdr;
1932         struct nlattr *pinfoattr;
1933         struct sk_buff *msg;
1934
1935         /* Look up our device */
1936         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1937         if (err)
1938                 return err;
1939
1940         /* Get the mesh params */
1941         rtnl_lock();
1942         err = drv->ops->get_mesh_params(&drv->wiphy, dev, &cur_params);
1943         rtnl_unlock();
1944         if (err)
1945                 goto out;
1946
1947         /* Draw up a netlink message to send back */
1948         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1949         if (!msg) {
1950                 err = -ENOBUFS;
1951                 goto out;
1952         }
1953         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
1954                              NL80211_CMD_GET_MESH_PARAMS);
1955         if (!hdr)
1956                 goto nla_put_failure;
1957         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
1958         if (!pinfoattr)
1959                 goto nla_put_failure;
1960         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1961         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
1962                         cur_params.dot11MeshRetryTimeout);
1963         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
1964                         cur_params.dot11MeshConfirmTimeout);
1965         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
1966                         cur_params.dot11MeshHoldingTimeout);
1967         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
1968                         cur_params.dot11MeshMaxPeerLinks);
1969         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
1970                         cur_params.dot11MeshMaxRetries);
1971         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
1972                         cur_params.dot11MeshTTL);
1973         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
1974                         cur_params.auto_open_plinks);
1975         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
1976                         cur_params.dot11MeshHWMPmaxPREQretries);
1977         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
1978                         cur_params.path_refresh_time);
1979         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
1980                         cur_params.min_discovery_timeout);
1981         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
1982                         cur_params.dot11MeshHWMPactivePathTimeout);
1983         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
1984                         cur_params.dot11MeshHWMPpreqMinInterval);
1985         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
1986                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
1987         nla_nest_end(msg, pinfoattr);
1988         genlmsg_end(msg, hdr);
1989         err = genlmsg_unicast(msg, info->snd_pid);
1990         goto out;
1991
1992 nla_put_failure:
1993         genlmsg_cancel(msg, hdr);
1994         err = -EMSGSIZE;
1995 out:
1996         /* Cleanup */
1997         cfg80211_put_dev(drv);
1998         dev_put(dev);
1999         return err;
2000 }
2001
2002 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2003 do {\
2004         if (table[attr_num]) {\
2005                 cfg.param = nla_fn(table[attr_num]); \
2006                 mask |= (1 << (attr_num - 1)); \
2007         } \
2008 } while (0);\
2009
2010 static struct nla_policy
2011 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] __read_mostly = {
2012         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2013         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2014         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2015         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2016         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2017         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2018         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2019
2020         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2021         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2022         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2023         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2024         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2025         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2026 };
2027
2028 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2029 {
2030         int err;
2031         u32 mask;
2032         struct cfg80211_registered_device *drv;
2033         struct net_device *dev;
2034         struct mesh_config cfg;
2035         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2036         struct nlattr *parent_attr;
2037
2038         parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
2039         if (!parent_attr)
2040                 return -EINVAL;
2041         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2042                         parent_attr, nl80211_meshconf_params_policy))
2043                 return -EINVAL;
2044
2045         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2046         if (err)
2047                 return err;
2048
2049         /* This makes sure that there aren't more than 32 mesh config
2050          * parameters (otherwise our bitfield scheme would not work.) */
2051         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2052
2053         /* Fill in the params struct */
2054         mask = 0;
2055         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2056                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2057         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2058                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2059         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2060                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2061         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2062                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2063         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2064                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2065         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2066                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2067         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2068                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2069         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2070                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2071                         nla_get_u8);
2072         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2073                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2074         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2075                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2076                         nla_get_u16);
2077         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2078                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2079                         nla_get_u32);
2080         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2081                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2082                         nla_get_u16);
2083         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2084                         dot11MeshHWMPnetDiameterTraversalTime,
2085                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2086                         nla_get_u16);
2087
2088         /* Apply changes */
2089         rtnl_lock();
2090         err = drv->ops->set_mesh_params(&drv->wiphy, dev, &cfg, mask);
2091         rtnl_unlock();
2092
2093         /* cleanup */
2094         cfg80211_put_dev(drv);
2095         dev_put(dev);
2096         return err;
2097 }
2098
2099 #undef FILL_IN_MESH_PARAM_IF_SET
2100
2101 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2102 {
2103         struct sk_buff *msg;
2104         void *hdr = NULL;
2105         struct nlattr *nl_reg_rules;
2106         unsigned int i;
2107         int err = -EINVAL;
2108
2109         mutex_lock(&cfg80211_drv_mutex);
2110
2111         if (!cfg80211_regdomain)
2112                 goto out;
2113
2114         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2115         if (!msg) {
2116                 err = -ENOBUFS;
2117                 goto out;
2118         }
2119
2120         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2121                              NL80211_CMD_GET_REG);
2122         if (!hdr)
2123                 goto nla_put_failure;
2124
2125         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2126                 cfg80211_regdomain->alpha2);
2127
2128         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2129         if (!nl_reg_rules)
2130                 goto nla_put_failure;
2131
2132         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2133                 struct nlattr *nl_reg_rule;
2134                 const struct ieee80211_reg_rule *reg_rule;
2135                 const struct ieee80211_freq_range *freq_range;
2136                 const struct ieee80211_power_rule *power_rule;
2137
2138                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2139                 freq_range = &reg_rule->freq_range;
2140                 power_rule = &reg_rule->power_rule;
2141
2142                 nl_reg_rule = nla_nest_start(msg, i);
2143                 if (!nl_reg_rule)
2144                         goto nla_put_failure;
2145
2146                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2147                         reg_rule->flags);
2148                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2149                         freq_range->start_freq_khz);
2150                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2151                         freq_range->end_freq_khz);
2152                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2153                         freq_range->max_bandwidth_khz);
2154                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2155                         power_rule->max_antenna_gain);
2156                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2157                         power_rule->max_eirp);
2158
2159                 nla_nest_end(msg, nl_reg_rule);
2160         }
2161
2162         nla_nest_end(msg, nl_reg_rules);
2163
2164         genlmsg_end(msg, hdr);
2165         err = genlmsg_unicast(msg, info->snd_pid);
2166         goto out;
2167
2168 nla_put_failure:
2169         genlmsg_cancel(msg, hdr);
2170         err = -EMSGSIZE;
2171 out:
2172         mutex_unlock(&cfg80211_drv_mutex);
2173         return err;
2174 }
2175
2176 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2177 {
2178         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2179         struct nlattr *nl_reg_rule;
2180         char *alpha2 = NULL;
2181         int rem_reg_rules = 0, r = 0;
2182         u32 num_rules = 0, rule_idx = 0, size_of_regd;
2183         struct ieee80211_regdomain *rd = NULL;
2184
2185         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2186                 return -EINVAL;
2187
2188         if (!info->attrs[NL80211_ATTR_REG_RULES])
2189                 return -EINVAL;
2190
2191         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2192
2193         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2194                         rem_reg_rules) {
2195                 num_rules++;
2196                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2197                         goto bad_reg;
2198         }
2199
2200         if (!reg_is_valid_request(alpha2))
2201                 return -EINVAL;
2202
2203         size_of_regd = sizeof(struct ieee80211_regdomain) +
2204                 (num_rules * sizeof(struct ieee80211_reg_rule));
2205
2206         rd = kzalloc(size_of_regd, GFP_KERNEL);
2207         if (!rd)
2208                 return -ENOMEM;
2209
2210         rd->n_reg_rules = num_rules;
2211         rd->alpha2[0] = alpha2[0];
2212         rd->alpha2[1] = alpha2[1];
2213
2214         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2215                         rem_reg_rules) {
2216                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2217                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2218                         reg_rule_policy);
2219                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2220                 if (r)
2221                         goto bad_reg;
2222
2223                 rule_idx++;
2224
2225                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES)
2226                         goto bad_reg;
2227         }
2228
2229         BUG_ON(rule_idx != num_rules);
2230
2231         mutex_lock(&cfg80211_drv_mutex);
2232         r = set_regdom(rd);
2233         mutex_unlock(&cfg80211_drv_mutex);
2234         return r;
2235
2236  bad_reg:
2237         kfree(rd);
2238         return -EINVAL;
2239 }
2240
2241 static int nl80211_set_mgmt_extra_ie(struct sk_buff *skb,
2242                                      struct genl_info *info)
2243 {
2244         struct cfg80211_registered_device *drv;
2245         int err;
2246         struct net_device *dev;
2247         struct mgmt_extra_ie_params params;
2248
2249         memset(&params, 0, sizeof(params));
2250
2251         if (!info->attrs[NL80211_ATTR_MGMT_SUBTYPE])
2252                 return -EINVAL;
2253         params.subtype = nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
2254         if (params.subtype > 15)
2255                 return -EINVAL; /* FC Subtype field is 4 bits (0..15) */
2256
2257         if (info->attrs[NL80211_ATTR_IE]) {
2258                 params.ies = nla_data(info->attrs[NL80211_ATTR_IE]);
2259                 params.ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2260         }
2261
2262         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2263         if (err)
2264                 return err;
2265
2266         if (drv->ops->set_mgmt_extra_ie) {
2267                 rtnl_lock();
2268                 err = drv->ops->set_mgmt_extra_ie(&drv->wiphy, dev, &params);
2269                 rtnl_unlock();
2270         } else
2271                 err = -EOPNOTSUPP;
2272
2273         cfg80211_put_dev(drv);
2274         dev_put(dev);
2275         return err;
2276 }
2277
2278 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
2279 {
2280         struct cfg80211_registered_device *drv;
2281         struct net_device *dev;
2282         struct cfg80211_scan_request *request;
2283         struct cfg80211_ssid *ssid;
2284         struct ieee80211_channel *channel;
2285         struct nlattr *attr;
2286         struct wiphy *wiphy;
2287         int err, tmp, n_ssids = 0, n_channels = 0, i;
2288         enum ieee80211_band band;
2289
2290         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2291         if (err)
2292                 return err;
2293
2294         wiphy = &drv->wiphy;
2295
2296         if (!drv->ops->scan) {
2297                 err = -EOPNOTSUPP;
2298                 goto out;
2299         }
2300
2301         rtnl_lock();
2302
2303         if (drv->scan_req) {
2304                 err = -EBUSY;
2305                 goto out_unlock;
2306         }
2307
2308         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2309                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp)
2310                         n_channels++;
2311                 if (!n_channels) {
2312                         err = -EINVAL;
2313                         goto out_unlock;
2314                 }
2315         } else {
2316                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
2317                         if (wiphy->bands[band])
2318                                 n_channels += wiphy->bands[band]->n_channels;
2319         }
2320
2321         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
2322                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
2323                         n_ssids++;
2324
2325         if (n_ssids > wiphy->max_scan_ssids) {
2326                 err = -EINVAL;
2327                 goto out_unlock;
2328         }
2329
2330         request = kzalloc(sizeof(*request)
2331                         + sizeof(*ssid) * n_ssids
2332                         + sizeof(channel) * n_channels, GFP_KERNEL);
2333         if (!request) {
2334                 err = -ENOMEM;
2335                 goto out_unlock;
2336         }
2337
2338         request->channels = (void *)((char *)request + sizeof(*request));
2339         request->n_channels = n_channels;
2340         if (n_ssids)
2341                 request->ssids = (void *)(request->channels + n_channels);
2342         request->n_ssids = n_ssids;
2343
2344         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2345                 /* user specified, bail out if channel not found */
2346                 request->n_channels = n_channels;
2347                 i = 0;
2348                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
2349                         request->channels[i] = ieee80211_get_channel(wiphy, nla_get_u32(attr));
2350                         if (!request->channels[i]) {
2351                                 err = -EINVAL;
2352                                 goto out_free;
2353                         }
2354                         i++;
2355                 }
2356         } else {
2357                 /* all channels */
2358                 i = 0;
2359                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
2360                         int j;
2361                         if (!wiphy->bands[band])
2362                                 continue;
2363                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
2364                                 request->channels[i] = &wiphy->bands[band]->channels[j];
2365                                 i++;
2366                         }
2367                 }
2368         }
2369
2370         i = 0;
2371         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
2372                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
2373                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
2374                                 err = -EINVAL;
2375                                 goto out_free;
2376                         }
2377                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
2378                         request->ssids[i].ssid_len = nla_len(attr);
2379                         i++;
2380                 }
2381         }
2382
2383         request->ifidx = dev->ifindex;
2384         request->wiphy = &drv->wiphy;
2385
2386         drv->scan_req = request;
2387         err = drv->ops->scan(&drv->wiphy, dev, request);
2388
2389  out_free:
2390         if (err) {
2391                 drv->scan_req = NULL;
2392                 kfree(request);
2393         }
2394  out_unlock:
2395         rtnl_unlock();
2396  out:
2397         cfg80211_put_dev(drv);
2398         dev_put(dev);
2399         return err;
2400 }
2401
2402 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
2403                             struct cfg80211_registered_device *rdev,
2404                             struct net_device *dev,
2405                             struct cfg80211_bss *res)
2406 {
2407         void *hdr;
2408         struct nlattr *bss;
2409
2410         hdr = nl80211hdr_put(msg, pid, seq, flags,
2411                              NL80211_CMD_NEW_SCAN_RESULTS);
2412         if (!hdr)
2413                 return -1;
2414
2415         NLA_PUT_U32(msg, NL80211_ATTR_SCAN_GENERATION,
2416                     rdev->bss_generation);
2417         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2418
2419         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
2420         if (!bss)
2421                 goto nla_put_failure;
2422         if (!is_zero_ether_addr(res->bssid))
2423                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
2424         if (res->information_elements && res->len_information_elements)
2425                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
2426                         res->len_information_elements,
2427                         res->information_elements);
2428         if (res->tsf)
2429                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
2430         if (res->beacon_interval)
2431                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
2432         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
2433         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
2434
2435         switch (res->signal_type) {
2436         case CFG80211_SIGNAL_TYPE_MBM:
2437                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
2438                 break;
2439         case CFG80211_SIGNAL_TYPE_UNSPEC:
2440                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
2441                 break;
2442         default:
2443                 break;
2444         }
2445
2446         nla_nest_end(msg, bss);
2447
2448         return genlmsg_end(msg, hdr);
2449
2450  nla_put_failure:
2451         genlmsg_cancel(msg, hdr);
2452         return -EMSGSIZE;
2453 }
2454
2455 static int nl80211_dump_scan(struct sk_buff *skb,
2456                              struct netlink_callback *cb)
2457 {
2458         struct cfg80211_registered_device *dev;
2459         struct net_device *netdev;
2460         struct cfg80211_internal_bss *scan;
2461         int ifidx = cb->args[0];
2462         int start = cb->args[1], idx = 0;
2463         int err;
2464
2465         if (!ifidx) {
2466                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
2467                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
2468                                   nl80211_policy);
2469                 if (err)
2470                         return err;
2471
2472                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
2473                         return -EINVAL;
2474
2475                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
2476                 if (!ifidx)
2477                         return -EINVAL;
2478                 cb->args[0] = ifidx;
2479         }
2480
2481         netdev = dev_get_by_index(&init_net, ifidx);
2482         if (!netdev)
2483                 return -ENODEV;
2484
2485         dev = cfg80211_get_dev_from_ifindex(ifidx);
2486         if (IS_ERR(dev)) {
2487                 err = PTR_ERR(dev);
2488                 goto out_put_netdev;
2489         }
2490
2491         spin_lock_bh(&dev->bss_lock);
2492         cfg80211_bss_expire(dev);
2493
2494         list_for_each_entry(scan, &dev->bss_list, list) {
2495                 if (++idx <= start)
2496                         continue;
2497                 if (nl80211_send_bss(skb,
2498                                 NETLINK_CB(cb->skb).pid,
2499                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2500                                 dev, netdev, &scan->pub) < 0) {
2501                         idx--;
2502                         goto out;
2503                 }
2504         }
2505
2506  out:
2507         spin_unlock_bh(&dev->bss_lock);
2508
2509         cb->args[1] = idx;
2510         err = skb->len;
2511         cfg80211_put_dev(dev);
2512  out_put_netdev:
2513         dev_put(netdev);
2514
2515         return err;
2516 }
2517
2518 static struct genl_ops nl80211_ops[] = {
2519         {
2520                 .cmd = NL80211_CMD_GET_WIPHY,
2521                 .doit = nl80211_get_wiphy,
2522                 .dumpit = nl80211_dump_wiphy,
2523                 .policy = nl80211_policy,
2524                 /* can be retrieved by unprivileged users */
2525         },
2526         {
2527                 .cmd = NL80211_CMD_SET_WIPHY,
2528                 .doit = nl80211_set_wiphy,
2529                 .policy = nl80211_policy,
2530                 .flags = GENL_ADMIN_PERM,
2531         },
2532         {
2533                 .cmd = NL80211_CMD_GET_INTERFACE,
2534                 .doit = nl80211_get_interface,
2535                 .dumpit = nl80211_dump_interface,
2536                 .policy = nl80211_policy,
2537                 /* can be retrieved by unprivileged users */
2538         },
2539         {
2540                 .cmd = NL80211_CMD_SET_INTERFACE,
2541                 .doit = nl80211_set_interface,
2542                 .policy = nl80211_policy,
2543                 .flags = GENL_ADMIN_PERM,
2544         },
2545         {
2546                 .cmd = NL80211_CMD_NEW_INTERFACE,
2547                 .doit = nl80211_new_interface,
2548                 .policy = nl80211_policy,
2549                 .flags = GENL_ADMIN_PERM,
2550         },
2551         {
2552                 .cmd = NL80211_CMD_DEL_INTERFACE,
2553                 .doit = nl80211_del_interface,
2554                 .policy = nl80211_policy,
2555                 .flags = GENL_ADMIN_PERM,
2556         },
2557         {
2558                 .cmd = NL80211_CMD_GET_KEY,
2559                 .doit = nl80211_get_key,
2560                 .policy = nl80211_policy,
2561                 .flags = GENL_ADMIN_PERM,
2562         },
2563         {
2564                 .cmd = NL80211_CMD_SET_KEY,
2565                 .doit = nl80211_set_key,
2566                 .policy = nl80211_policy,
2567                 .flags = GENL_ADMIN_PERM,
2568         },
2569         {
2570                 .cmd = NL80211_CMD_NEW_KEY,
2571                 .doit = nl80211_new_key,
2572                 .policy = nl80211_policy,
2573                 .flags = GENL_ADMIN_PERM,
2574         },
2575         {
2576                 .cmd = NL80211_CMD_DEL_KEY,
2577                 .doit = nl80211_del_key,
2578                 .policy = nl80211_policy,
2579                 .flags = GENL_ADMIN_PERM,
2580         },
2581         {
2582                 .cmd = NL80211_CMD_SET_BEACON,
2583                 .policy = nl80211_policy,
2584                 .flags = GENL_ADMIN_PERM,
2585                 .doit = nl80211_addset_beacon,
2586         },
2587         {
2588                 .cmd = NL80211_CMD_NEW_BEACON,
2589                 .policy = nl80211_policy,
2590                 .flags = GENL_ADMIN_PERM,
2591                 .doit = nl80211_addset_beacon,
2592         },
2593         {
2594                 .cmd = NL80211_CMD_DEL_BEACON,
2595                 .policy = nl80211_policy,
2596                 .flags = GENL_ADMIN_PERM,
2597                 .doit = nl80211_del_beacon,
2598         },
2599         {
2600                 .cmd = NL80211_CMD_GET_STATION,
2601                 .doit = nl80211_get_station,
2602                 .dumpit = nl80211_dump_station,
2603                 .policy = nl80211_policy,
2604                 .flags = GENL_ADMIN_PERM,
2605         },
2606         {
2607                 .cmd = NL80211_CMD_SET_STATION,
2608                 .doit = nl80211_set_station,
2609                 .policy = nl80211_policy,
2610                 .flags = GENL_ADMIN_PERM,
2611         },
2612         {
2613                 .cmd = NL80211_CMD_NEW_STATION,
2614                 .doit = nl80211_new_station,
2615                 .policy = nl80211_policy,
2616                 .flags = GENL_ADMIN_PERM,
2617         },
2618         {
2619                 .cmd = NL80211_CMD_DEL_STATION,
2620                 .doit = nl80211_del_station,
2621                 .policy = nl80211_policy,
2622                 .flags = GENL_ADMIN_PERM,
2623         },
2624         {
2625                 .cmd = NL80211_CMD_GET_MPATH,
2626                 .doit = nl80211_get_mpath,
2627                 .dumpit = nl80211_dump_mpath,
2628                 .policy = nl80211_policy,
2629                 .flags = GENL_ADMIN_PERM,
2630         },
2631         {
2632                 .cmd = NL80211_CMD_SET_MPATH,
2633                 .doit = nl80211_set_mpath,
2634                 .policy = nl80211_policy,
2635                 .flags = GENL_ADMIN_PERM,
2636         },
2637         {
2638                 .cmd = NL80211_CMD_NEW_MPATH,
2639                 .doit = nl80211_new_mpath,
2640                 .policy = nl80211_policy,
2641                 .flags = GENL_ADMIN_PERM,
2642         },
2643         {
2644                 .cmd = NL80211_CMD_DEL_MPATH,
2645                 .doit = nl80211_del_mpath,
2646                 .policy = nl80211_policy,
2647                 .flags = GENL_ADMIN_PERM,
2648         },
2649         {
2650                 .cmd = NL80211_CMD_SET_BSS,
2651                 .doit = nl80211_set_bss,
2652                 .policy = nl80211_policy,
2653                 .flags = GENL_ADMIN_PERM,
2654         },
2655         {
2656                 .cmd = NL80211_CMD_GET_REG,
2657                 .doit = nl80211_get_reg,
2658                 .policy = nl80211_policy,
2659                 /* can be retrieved by unprivileged users */
2660         },
2661         {
2662                 .cmd = NL80211_CMD_SET_REG,
2663                 .doit = nl80211_set_reg,
2664                 .policy = nl80211_policy,
2665                 .flags = GENL_ADMIN_PERM,
2666         },
2667         {
2668                 .cmd = NL80211_CMD_REQ_SET_REG,
2669                 .doit = nl80211_req_set_reg,
2670                 .policy = nl80211_policy,
2671                 .flags = GENL_ADMIN_PERM,
2672         },
2673         {
2674                 .cmd = NL80211_CMD_GET_MESH_PARAMS,
2675                 .doit = nl80211_get_mesh_params,
2676                 .policy = nl80211_policy,
2677                 /* can be retrieved by unprivileged users */
2678         },
2679         {
2680                 .cmd = NL80211_CMD_SET_MESH_PARAMS,
2681                 .doit = nl80211_set_mesh_params,
2682                 .policy = nl80211_policy,
2683                 .flags = GENL_ADMIN_PERM,
2684         },
2685         {
2686                 .cmd = NL80211_CMD_SET_MGMT_EXTRA_IE,
2687                 .doit = nl80211_set_mgmt_extra_ie,
2688                 .policy = nl80211_policy,
2689                 .flags = GENL_ADMIN_PERM,
2690         },
2691         {
2692                 .cmd = NL80211_CMD_TRIGGER_SCAN,
2693                 .doit = nl80211_trigger_scan,
2694                 .policy = nl80211_policy,
2695                 .flags = GENL_ADMIN_PERM,
2696         },
2697         {
2698                 .cmd = NL80211_CMD_GET_SCAN,
2699                 .policy = nl80211_policy,
2700                 .dumpit = nl80211_dump_scan,
2701         },
2702 };
2703
2704 /* multicast groups */
2705 static struct genl_multicast_group nl80211_config_mcgrp = {
2706         .name = "config",
2707 };
2708 static struct genl_multicast_group nl80211_scan_mcgrp = {
2709         .name = "scan",
2710 };
2711
2712 /* notification functions */
2713
2714 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
2715 {
2716         struct sk_buff *msg;
2717
2718         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2719         if (!msg)
2720                 return;
2721
2722         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
2723                 nlmsg_free(msg);
2724                 return;
2725         }
2726
2727         genlmsg_multicast(msg, 0, nl80211_config_mcgrp.id, GFP_KERNEL);
2728 }
2729
2730 static int nl80211_send_scan_donemsg(struct sk_buff *msg,
2731                                     struct cfg80211_registered_device *rdev,
2732                                     struct net_device *netdev,
2733                                     u32 pid, u32 seq, int flags,
2734                                     u32 cmd)
2735 {
2736         void *hdr;
2737
2738         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
2739         if (!hdr)
2740                 return -1;
2741
2742         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->idx);
2743         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
2744
2745         /* XXX: we should probably bounce back the request? */
2746
2747         return genlmsg_end(msg, hdr);
2748
2749  nla_put_failure:
2750         genlmsg_cancel(msg, hdr);
2751         return -EMSGSIZE;
2752 }
2753
2754 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
2755                             struct net_device *netdev)
2756 {
2757         struct sk_buff *msg;
2758
2759         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2760         if (!msg)
2761                 return;
2762
2763         if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
2764                                       NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
2765                 nlmsg_free(msg);
2766                 return;
2767         }
2768
2769         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
2770 }
2771
2772 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
2773                                struct net_device *netdev)
2774 {
2775         struct sk_buff *msg;
2776
2777         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2778         if (!msg)
2779                 return;
2780
2781         if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
2782                                       NL80211_CMD_SCAN_ABORTED) < 0) {
2783                 nlmsg_free(msg);
2784                 return;
2785         }
2786
2787         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
2788 }
2789
2790 /* initialisation/exit functions */
2791
2792 int nl80211_init(void)
2793 {
2794         int err, i;
2795
2796         err = genl_register_family(&nl80211_fam);
2797         if (err)
2798                 return err;
2799
2800         for (i = 0; i < ARRAY_SIZE(nl80211_ops); i++) {
2801                 err = genl_register_ops(&nl80211_fam, &nl80211_ops[i]);
2802                 if (err)
2803                         goto err_out;
2804         }
2805
2806         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
2807         if (err)
2808                 goto err_out;
2809
2810         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
2811         if (err)
2812                 goto err_out;
2813
2814         return 0;
2815  err_out:
2816         genl_unregister_family(&nl80211_fam);
2817         return err;
2818 }
2819
2820 void nl80211_exit(void)
2821 {
2822         genl_unregister_family(&nl80211_fam);
2823 }