net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006, 2007 Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/list.h>
  11 #include <linux/if_ether.h>
  12 #include <linux/ieee80211.h>
  13 #include <linux/nl80211.h>
  14 #include <linux/rtnetlink.h>
  15 #include <linux/netlink.h>
  16 #include <linux/etherdevice.h>
  17 #include <net/genetlink.h>
  18 #include <net/cfg80211.h>
  19 #include "core.h"
  20 #include "nl80211.h"
  21 #include "reg.h"
  22
  23 /* the netlink family */
  24 static struct genl_family nl80211_fam = {
  25         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  26         .name = "nl80211",      /* have users key off the name instead */
  27         .hdrsize = 0,           /* no private header */
  28         .version = 1,           /* no particular meaning now */
  29         .maxattr = NL80211_ATTR_MAX,
  30 };
  31
  32 /* internal helper: get drv and dev */
  33 static int get_drv_dev_by_info_ifindex(struct nlattr **attrs,
  34                                        struct cfg80211_registered_device **drv,
  35                                        struct net_device **dev)
  36 {
  37         int ifindex;
  38
  39         if (!attrs[NL80211_ATTR_IFINDEX])
  40                 return -EINVAL;
  41
  42         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  43         *dev = dev_get_by_index(&init_net, ifindex);
  44         if (!*dev)
  45                 return -ENODEV;
  46
  47         *drv = cfg80211_get_dev_from_ifindex(ifindex);
  48         if (IS_ERR(*drv)) {
  49                 dev_put(*dev);
  50                 return PTR_ERR(*drv);
  51         }
  52
  53         return 0;
  54 }
  55
  56 /* policy for the attributes */
  57 static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
  58         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  59         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  60                                       .len = BUS_ID_SIZE-1 },
  61         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  62         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  63         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  64
  65         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  66         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  67         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  68
  69         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  70
  71         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  72                                     .len = WLAN_MAX_KEY_LEN },
  73         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  74         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  75         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
  76
  77         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
  78         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
  79         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
  80                                        .len = IEEE80211_MAX_DATA_LEN },
  81         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
  82                                        .len = IEEE80211_MAX_DATA_LEN },
  83         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
  84         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
  85         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
  86         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
  87                                                .len = NL80211_MAX_SUPP_RATES },
  88         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
  89         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
  90         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
  91         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
  92                                 .len = IEEE80211_MAX_MESH_ID_LEN },
  93         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
  94
  95         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
  96         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
  97
  98         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
  99         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 100         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 101         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 102                                            .len = NL80211_MAX_SUPP_RATES },
 103
 104         [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
 105
 106         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 107                                          .len = NL80211_HT_CAPABILITY_LEN },
 108
 109         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 110         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 111                               .len = IEEE80211_MAX_DATA_LEN },
 112         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 113         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 114 };
 115
 116 /* message building helper */
 117 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 118                                    int flags, u8 cmd)
 119 {
 120         /* since there is no private header just add the generic one */
 121         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 122 }
 123
 124 /* netlink command implementations */
 125
 126 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 127                               struct cfg80211_registered_device *dev)
 128 {
 129         void *hdr;
 130         struct nlattr *nl_bands, *nl_band;
 131         struct nlattr *nl_freqs, *nl_freq;
 132         struct nlattr *nl_rates, *nl_rate;
 133         struct nlattr *nl_modes;
 134         struct nlattr *nl_cmds;
 135         enum ieee80211_band band;
 136         struct ieee80211_channel *chan;
 137         struct ieee80211_rate *rate;
 138         int i;
 139         u16 ifmodes = dev->wiphy.interface_modes;
 140
 141         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 142         if (!hdr)
 143                 return -1;
 144
 145         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 146         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 147         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 148                    dev->wiphy.max_scan_ssids);
 149
 150         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
 151         if (!nl_modes)
 152                 goto nla_put_failure;
 153
 154         i = 0;
 155         while (ifmodes) {
 156                 if (ifmodes & 1)
 157                         NLA_PUT_FLAG(msg, i);
 158                 ifmodes >>= 1;
 159                 i++;
 160         }
 161
 162         nla_nest_end(msg, nl_modes);
 163
 164         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 165         if (!nl_bands)
 166                 goto nla_put_failure;
 167
 168         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 169                 if (!dev->wiphy.bands[band])
 170                         continue;
 171
 172                 nl_band = nla_nest_start(msg, band);
 173                 if (!nl_band)
 174                         goto nla_put_failure;
 175
 176                 /* add HT info */
 177                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 178                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 179                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 180                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 181                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 182                                 dev->wiphy.bands[band]->ht_cap.cap);
 183                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 184                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 185                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 186                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 187                 }
 188
 189                 /* add frequencies */
 190                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 191                 if (!nl_freqs)
 192                         goto nla_put_failure;
 193
 194                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 195                         nl_freq = nla_nest_start(msg, i);
 196                         if (!nl_freq)
 197                                 goto nla_put_failure;
 198
 199                         chan = &dev->wiphy.bands[band]->channels[i];
 200                         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 201                                     chan->center_freq);
 202
 203                         if (chan->flags & IEEE80211_CHAN_DISABLED)
 204                                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 205                         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 206                                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 207                         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 208                                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 209                         if (chan->flags & IEEE80211_CHAN_RADAR)
 210                                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 211
 212                         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 213                                     DBM_TO_MBM(chan->max_power));
 214
 215                         nla_nest_end(msg, nl_freq);
 216                 }
 217
 218                 nla_nest_end(msg, nl_freqs);
 219
 220                 /* add bitrates */
 221                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 222                 if (!nl_rates)
 223                         goto nla_put_failure;
 224
 225                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 226                         nl_rate = nla_nest_start(msg, i);
 227                         if (!nl_rate)
 228                                 goto nla_put_failure;
 229
 230                         rate = &dev->wiphy.bands[band]->bitrates[i];
 231                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 232                                     rate->bitrate);
 233                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 234                                 NLA_PUT_FLAG(msg,
 235                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 236
 237                         nla_nest_end(msg, nl_rate);
 238                 }
 239
 240                 nla_nest_end(msg, nl_rates);
 241
 242                 nla_nest_end(msg, nl_band);
 243         }
 244         nla_nest_end(msg, nl_bands);
 245
 246         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 247         if (!nl_cmds)
 248                 goto nla_put_failure;
 249
 250         i = 0;
 251 #define CMD(op, n)                                              \
 252          do {                                                   \
 253                 if (dev->ops->op) {                             \
 254                         i++;                                    \
 255                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 256                 }                                               \
 257         } while (0)
 258
 259         CMD(add_virtual_intf, NEW_INTERFACE);
 260         CMD(change_virtual_intf, SET_INTERFACE);
 261         CMD(add_key, NEW_KEY);
 262         CMD(add_beacon, NEW_BEACON);
 263         CMD(add_station, NEW_STATION);
 264         CMD(add_mpath, NEW_MPATH);
 265         CMD(set_mesh_params, SET_MESH_PARAMS);
 266         CMD(change_bss, SET_BSS);
 267         CMD(set_mgmt_extra_ie, SET_MGMT_EXTRA_IE);
 268
 269 #undef CMD
 270         nla_nest_end(msg, nl_cmds);
 271
 272         return genlmsg_end(msg, hdr);
 273
 274  nla_put_failure:
 275         genlmsg_cancel(msg, hdr);
 276         return -EMSGSIZE;
 277 }
 278
 279 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 280 {
 281         int idx = 0;
 282         int start = cb->args[0];
 283         struct cfg80211_registered_device *dev;
 284
 285         mutex_lock(&cfg80211_mutex);
 286         list_for_each_entry(dev, &cfg80211_drv_list, list) {
 287                 if (++idx <= start)
 288                         continue;
 289                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
 290                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
 291                                        dev) < 0) {
 292                         idx--;
 293                         break;
 294                 }
 295         }
 296         mutex_unlock(&cfg80211_mutex);
 297
 298         cb->args[0] = idx;
 299
 300         return skb->len;
 301 }
 302
 303 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 304 {
 305         struct sk_buff *msg;
 306         struct cfg80211_registered_device *dev;
 307
 308         dev = cfg80211_get_dev_from_info(info);
 309         if (IS_ERR(dev))
 310                 return PTR_ERR(dev);
 311
 312         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 313         if (!msg)
 314                 goto out_err;
 315
 316         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
 317                 goto out_free;
 318
 319         cfg80211_put_dev(dev);
 320
 321         return genlmsg_unicast(msg, info->snd_pid);
 322
 323  out_free:
 324         nlmsg_free(msg);
 325  out_err:
 326         cfg80211_put_dev(dev);
 327         return -ENOBUFS;
 328 }
 329
 330 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 331         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
 332         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
 333         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
 334         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
 335         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
 336 };
 337
 338 static int parse_txq_params(struct nlattr *tb[],
 339                             struct ieee80211_txq_params *txq_params)
 340 {
 341         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 342             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 343             !tb[NL80211_TXQ_ATTR_AIFS])
 344                 return -EINVAL;
 345
 346         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
 347         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 348         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 349         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 350         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 351
 352         return 0;
 353 }
 354
 355 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 356 {
 357         struct cfg80211_registered_device *rdev;
 358         int result = 0, rem_txq_params = 0;
 359         struct nlattr *nl_txq_params;
 360
 361         rdev = cfg80211_get_dev_from_info(info);
 362         if (IS_ERR(rdev))
 363                 return PTR_ERR(rdev);
 364
 365         if (info->attrs[NL80211_ATTR_WIPHY_NAME]) {
 366                 result = cfg80211_dev_rename(
 367                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 368                 if (result)
 369                         goto bad_res;
 370         }
 371
 372         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
 373                 struct ieee80211_txq_params txq_params;
 374                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
 375
 376                 if (!rdev->ops->set_txq_params) {
 377                         result = -EOPNOTSUPP;
 378                         goto bad_res;
 379                 }
 380
 381                 nla_for_each_nested(nl_txq_params,
 382                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
 383                                     rem_txq_params) {
 384                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
 385                                   nla_data(nl_txq_params),
 386                                   nla_len(nl_txq_params),
 387                                   txq_params_policy);
 388                         result = parse_txq_params(tb, &txq_params);
 389                         if (result)
 390                                 goto bad_res;
 391
 392                         result = rdev->ops->set_txq_params(&rdev->wiphy,
 393                                                            &txq_params);
 394                         if (result)
 395                                 goto bad_res;
 396                 }
 397         }
 398
 399         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
 400                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 401                 struct ieee80211_channel *chan;
 402                 struct ieee80211_sta_ht_cap *ht_cap;
 403                 u32 freq, sec_freq;
 404
 405                 if (!rdev->ops->set_channel) {
 406                         result = -EOPNOTSUPP;
 407                         goto bad_res;
 408                 }
 409
 410                 result = -EINVAL;
 411
 412                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 413                         channel_type = nla_get_u32(info->attrs[
 414                                            NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 415                         if (channel_type != NL80211_CHAN_NO_HT &&
 416                             channel_type != NL80211_CHAN_HT20 &&
 417                             channel_type != NL80211_CHAN_HT40PLUS &&
 418                             channel_type != NL80211_CHAN_HT40MINUS)
 419                                 goto bad_res;
 420                 }
 421
 422                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 423                 chan = ieee80211_get_channel(&rdev->wiphy, freq);
 424
 425                 /* Primary channel not allowed */
 426                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 427                         goto bad_res;
 428
 429                 if (channel_type == NL80211_CHAN_HT40MINUS)
 430                         sec_freq = freq - 20;
 431                 else if (channel_type == NL80211_CHAN_HT40PLUS)
 432                         sec_freq = freq + 20;
 433                 else
 434                         sec_freq = 0;
 435
 436                 ht_cap = &rdev->wiphy.bands[chan->band]->ht_cap;
 437
 438                 /* no HT capabilities */
 439                 if (channel_type != NL80211_CHAN_NO_HT &&
 440                     !ht_cap->ht_supported)
 441                         goto bad_res;
 442
 443                 if (sec_freq) {
 444                         struct ieee80211_channel *schan;
 445
 446                         /* no 40 MHz capabilities */
 447                         if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
 448                             (ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT))
 449                                 goto bad_res;
 450
 451                         schan = ieee80211_get_channel(&rdev->wiphy, sec_freq);
 452
 453                         /* Secondary channel not allowed */
 454                         if (!schan || schan->flags & IEEE80211_CHAN_DISABLED)
 455                                 goto bad_res;
 456                 }
 457
 458                 result = rdev->ops->set_channel(&rdev->wiphy, chan,
 459                                                 channel_type);
 460                 if (result)
 461                         goto bad_res;
 462         }
 463
 464
 465  bad_res:
 466         cfg80211_put_dev(rdev);
 467         return result;
 468 }
 469
 470
 471 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 472                               struct net_device *dev)
 473 {
 474         void *hdr;
 475
 476         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
 477         if (!hdr)
 478                 return -1;
 479
 480         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 481         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
 482         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
 483         return genlmsg_end(msg, hdr);
 484
 485  nla_put_failure:
 486         genlmsg_cancel(msg, hdr);
 487         return -EMSGSIZE;
 488 }
 489
 490 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
 491 {
 492         int wp_idx = 0;
 493         int if_idx = 0;
 494         int wp_start = cb->args[0];
 495         int if_start = cb->args[1];
 496         struct cfg80211_registered_device *dev;
 497         struct wireless_dev *wdev;
 498
 499         mutex_lock(&cfg80211_mutex);
 500         list_for_each_entry(dev, &cfg80211_drv_list, list) {
 501                 if (wp_idx < wp_start) {
 502                         wp_idx++;
 503                         continue;
 504                 }
 505                 if_idx = 0;
 506
 507                 mutex_lock(&dev->devlist_mtx);
 508                 list_for_each_entry(wdev, &dev->netdev_list, list) {
 509                         if (if_idx < if_start) {
 510                                 if_idx++;
 511                                 continue;
 512                         }
 513                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
 514                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
 515                                                wdev->netdev) < 0) {
 516                                 mutex_unlock(&dev->devlist_mtx);
 517                                 goto out;
 518                         }
 519                         if_idx++;
 520                 }
 521                 mutex_unlock(&dev->devlist_mtx);
 522
 523                 wp_idx++;
 524         }
 525  out:
 526         mutex_unlock(&cfg80211_mutex);
 527
 528         cb->args[0] = wp_idx;
 529         cb->args[1] = if_idx;
 530
 531         return skb->len;
 532 }
 533
 534 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
 535 {
 536         struct sk_buff *msg;
 537         struct cfg80211_registered_device *dev;
 538         struct net_device *netdev;
 539         int err;
 540
 541         err = get_drv_dev_by_info_ifindex(info->attrs, &dev, &netdev);
 542         if (err)
 543                 return err;
 544
 545         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 546         if (!msg)
 547                 goto out_err;
 548
 549         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0, netdev) < 0)
 550                 goto out_free;
 551
 552         dev_put(netdev);
 553         cfg80211_put_dev(dev);
 554
 555         return genlmsg_unicast(msg, info->snd_pid);
 556
 557  out_free:
 558         nlmsg_free(msg);
 559  out_err:
 560         dev_put(netdev);
 561         cfg80211_put_dev(dev);
 562         return -ENOBUFS;
 563 }
 564
 565 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
 566         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
 567         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
 568         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
 569         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
 570         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
 571 };
 572
 573 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
 574 {
 575         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
 576         int flag;
 577
 578         *mntrflags = 0;
 579
 580         if (!nla)
 581                 return -EINVAL;
 582
 583         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
 584                              nla, mntr_flags_policy))
 585                 return -EINVAL;
 586
 587         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
 588                 if (flags[flag])
 589                         *mntrflags |= (1<<flag);
 590
 591         return 0;
 592 }
 593
 594 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 595 {
 596         struct cfg80211_registered_device *drv;
 597         struct vif_params params;
 598         int err, ifindex;
 599         enum nl80211_iftype type;
 600         struct net_device *dev;
 601         u32 _flags, *flags = NULL;
 602
 603         memset(&params, 0, sizeof(params));
 604
 605         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 606         if (err)
 607                 return err;
 608         ifindex = dev->ifindex;
 609         type = dev->ieee80211_ptr->iftype;
 610         dev_put(dev);
 611
 612         err = -EINVAL;
 613         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 614                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 615                 if (type > NL80211_IFTYPE_MAX)
 616                         goto unlock;
 617         }
 618
 619         if (!drv->ops->change_virtual_intf ||
 620             !(drv->wiphy.interface_modes & (1 << type))) {
 621                 err = -EOPNOTSUPP;
 622                 goto unlock;
 623         }
 624
 625         if (info->attrs[NL80211_ATTR_MESH_ID]) {
 626                 if (type != NL80211_IFTYPE_MESH_POINT) {
 627                         err = -EINVAL;
 628                         goto unlock;
 629                 }
 630                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 631                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 632         }
 633
 634         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
 635                 if (type != NL80211_IFTYPE_MONITOR) {
 636                         err = -EINVAL;
 637                         goto unlock;
 638                 }
 639                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
 640                                           &_flags);
 641                 if (!err)
 642                         flags = &_flags;
 643         }
 644         rtnl_lock();
 645         err = drv->ops->change_virtual_intf(&drv->wiphy, ifindex,
 646                                             type, flags, &params);
 647
 648         dev = __dev_get_by_index(&init_net, ifindex);
 649         WARN_ON(!dev || (!err && dev->ieee80211_ptr->iftype != type));
 650
 651         rtnl_unlock();
 652
 653  unlock:
 654         cfg80211_put_dev(drv);
 655         return err;
 656 }
 657
 658 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
 659 {
 660         struct cfg80211_registered_device *drv;
 661         struct vif_params params;
 662         int err;
 663         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
 664         u32 flags;
 665
 666         memset(&params, 0, sizeof(params));
 667
 668         if (!info->attrs[NL80211_ATTR_IFNAME])
 669                 return -EINVAL;
 670
 671         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 672                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 673                 if (type > NL80211_IFTYPE_MAX)
 674                         return -EINVAL;
 675         }
 676
 677         drv = cfg80211_get_dev_from_info(info);
 678         if (IS_ERR(drv))
 679                 return PTR_ERR(drv);
 680
 681         if (!drv->ops->add_virtual_intf ||
 682             !(drv->wiphy.interface_modes & (1 << type))) {
 683                 err = -EOPNOTSUPP;
 684                 goto unlock;
 685         }
 686
 687         if (type == NL80211_IFTYPE_MESH_POINT &&
 688             info->attrs[NL80211_ATTR_MESH_ID]) {
 689                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 690                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 691         }
 692
 693         rtnl_lock();
 694         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
 695                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
 696                                   &flags);
 697         err = drv->ops->add_virtual_intf(&drv->wiphy,
 698                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
 699                 type, err ? NULL : &flags, &params);
 700         rtnl_unlock();
 701
 702
 703  unlock:
 704         cfg80211_put_dev(drv);
 705         return err;
 706 }
 707
 708 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
 709 {
 710         struct cfg80211_registered_device *drv;
 711         int ifindex, err;
 712         struct net_device *dev;
 713
 714         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 715         if (err)
 716                 return err;
 717         ifindex = dev->ifindex;
 718         dev_put(dev);
 719
 720         if (!drv->ops->del_virtual_intf) {
 721                 err = -EOPNOTSUPP;
 722                 goto out;
 723         }
 724
 725         rtnl_lock();
 726         err = drv->ops->del_virtual_intf(&drv->wiphy, ifindex);
 727         rtnl_unlock();
 728
 729  out:
 730         cfg80211_put_dev(drv);
 731         return err;
 732 }
 733
 734 struct get_key_cookie {
 735         struct sk_buff *msg;
 736         int error;
 737 };
 738
 739 static void get_key_callback(void *c, struct key_params *params)
 740 {
 741         struct get_key_cookie *cookie = c;
 742
 743         if (params->key)
 744                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
 745                         params->key_len, params->key);
 746
 747         if (params->seq)
 748                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
 749                         params->seq_len, params->seq);
 750
 751         if (params->cipher)
 752                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
 753                             params->cipher);
 754
 755         return;
 756  nla_put_failure:
 757         cookie->error = 1;
 758 }
 759
 760 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
 761 {
 762         struct cfg80211_registered_device *drv;
 763         int err;
 764         struct net_device *dev;
 765         u8 key_idx = 0;
 766         u8 *mac_addr = NULL;
 767         struct get_key_cookie cookie = {
 768                 .error = 0,
 769         };
 770         void *hdr;
 771         struct sk_buff *msg;
 772
 773         if (info->attrs[NL80211_ATTR_KEY_IDX])
 774                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 775
 776         if (key_idx > 5)
 777                 return -EINVAL;
 778
 779         if (info->attrs[NL80211_ATTR_MAC])
 780                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 781
 782         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 783         if (err)
 784                 return err;
 785
 786         if (!drv->ops->get_key) {
 787                 err = -EOPNOTSUPP;
 788                 goto out;
 789         }
 790
 791         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 792         if (!msg) {
 793                 err = -ENOMEM;
 794                 goto out;
 795         }
 796
 797         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
 798                              NL80211_CMD_NEW_KEY);
 799
 800         if (IS_ERR(hdr)) {
 801                 err = PTR_ERR(hdr);
 802                 goto out;
 803         }
 804
 805         cookie.msg = msg;
 806
 807         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 808         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
 809         if (mac_addr)
 810                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
 811
 812         rtnl_lock();
 813         err = drv->ops->get_key(&drv->wiphy, dev, key_idx, mac_addr,
 814                                 &cookie, get_key_callback);
 815         rtnl_unlock();
 816
 817         if (err)
 818                 goto out;
 819
 820         if (cookie.error)
 821                 goto nla_put_failure;
 822
 823         genlmsg_end(msg, hdr);
 824         err = genlmsg_unicast(msg, info->snd_pid);
 825         goto out;
 826
 827  nla_put_failure:
 828         err = -ENOBUFS;
 829         nlmsg_free(msg);
 830  out:
 831         cfg80211_put_dev(drv);
 832         dev_put(dev);
 833         return err;
 834 }
 835
 836 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
 837 {
 838         struct cfg80211_registered_device *drv;
 839         int err;
 840         struct net_device *dev;
 841         u8 key_idx;
 842         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
 843                     u8 key_index);
 844
 845         if (!info->attrs[NL80211_ATTR_KEY_IDX])
 846                 return -EINVAL;
 847
 848         key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 849
 850         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]) {
 851                 if (key_idx < 4 || key_idx > 5)
 852                         return -EINVAL;
 853         } else if (key_idx > 3)
 854                 return -EINVAL;
 855
 856         /* currently only support setting default key */
 857         if (!info->attrs[NL80211_ATTR_KEY_DEFAULT] &&
 858             !info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT])
 859                 return -EINVAL;
 860
 861         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 862         if (err)
 863                 return err;
 864
 865         if (info->attrs[NL80211_ATTR_KEY_DEFAULT])
 866                 func = drv->ops->set_default_key;
 867         else
 868                 func = drv->ops->set_default_mgmt_key;
 869
 870         if (!func) {
 871                 err = -EOPNOTSUPP;
 872                 goto out;
 873         }
 874
 875         rtnl_lock();
 876         err = func(&drv->wiphy, dev, key_idx);
 877         rtnl_unlock();
 878
 879  out:
 880         cfg80211_put_dev(drv);
 881         dev_put(dev);
 882         return err;
 883 }
 884
 885 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
 886 {
 887         struct cfg80211_registered_device *drv;
 888         int err;
 889         struct net_device *dev;
 890         struct key_params params;
 891         u8 key_idx = 0;
 892         u8 *mac_addr = NULL;
 893
 894         memset(&params, 0, sizeof(params));
 895
 896         if (!info->attrs[NL80211_ATTR_KEY_CIPHER])
 897                 return -EINVAL;
 898
 899         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 900                 params.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 901                 params.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 902         }
 903
 904         if (info->attrs[NL80211_ATTR_KEY_IDX])
 905                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 906
 907         params.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 908
 909         if (info->attrs[NL80211_ATTR_MAC])
 910                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 911
 912         if (key_idx > 5)
 913                 return -EINVAL;
 914
 915         /*
 916          * Disallow pairwise keys with non-zero index unless it's WEP
 917          * (because current deployments use pairwise WEP keys with
 918          * non-zero indizes but 802.11i clearly specifies to use zero)
 919          */
 920         if (mac_addr && key_idx &&
 921             params.cipher != WLAN_CIPHER_SUITE_WEP40 &&
 922             params.cipher != WLAN_CIPHER_SUITE_WEP104)
 923                 return -EINVAL;
 924
 925         /* TODO: add definitions for the lengths to linux/ieee80211.h */
 926         switch (params.cipher) {
 927         case WLAN_CIPHER_SUITE_WEP40:
 928                 if (params.key_len != 5)
 929                         return -EINVAL;
 930                 break;
 931         case WLAN_CIPHER_SUITE_TKIP:
 932                 if (params.key_len != 32)
 933                         return -EINVAL;
 934                 break;
 935         case WLAN_CIPHER_SUITE_CCMP:
 936                 if (params.key_len != 16)
 937                         return -EINVAL;
 938                 break;
 939         case WLAN_CIPHER_SUITE_WEP104:
 940                 if (params.key_len != 13)
 941                         return -EINVAL;
 942                 break;
 943         case WLAN_CIPHER_SUITE_AES_CMAC:
 944                 if (params.key_len != 16)
 945                         return -EINVAL;
 946                 break;
 947         default:
 948                 return -EINVAL;
 949         }
 950
 951         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 952         if (err)
 953                 return err;
 954
 955         if (!drv->ops->add_key) {
 956                 err = -EOPNOTSUPP;
 957                 goto out;
 958         }
 959
 960         rtnl_lock();
 961         err = drv->ops->add_key(&drv->wiphy, dev, key_idx, mac_addr, &params);
 962         rtnl_unlock();
 963
 964  out:
 965         cfg80211_put_dev(drv);
 966         dev_put(dev);
 967         return err;
 968 }
 969
 970 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
 971 {
 972         struct cfg80211_registered_device *drv;
 973         int err;
 974         struct net_device *dev;
 975         u8 key_idx = 0;
 976         u8 *mac_addr = NULL;
 977
 978         if (info->attrs[NL80211_ATTR_KEY_IDX])
 979                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 980
 981         if (key_idx > 5)
 982                 return -EINVAL;
 983
 984         if (info->attrs[NL80211_ATTR_MAC])
 985                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 986
 987         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 988         if (err)
 989                 return err;
 990
 991         if (!drv->ops->del_key) {
 992                 err = -EOPNOTSUPP;
 993                 goto out;
 994         }
 995
 996         rtnl_lock();
 997         err = drv->ops->del_key(&drv->wiphy, dev, key_idx, mac_addr);
 998         rtnl_unlock();
 999
1000  out:
1001         cfg80211_put_dev(drv);
1002         dev_put(dev);
1003         return err;
1004 }
1005
1006 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1007 {
1008         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1009                     struct beacon_parameters *info);
1010         struct cfg80211_registered_device *drv;
1011         int err;
1012         struct net_device *dev;
1013         struct beacon_parameters params;
1014         int haveinfo = 0;
1015
1016         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1017         if (err)
1018                 return err;
1019
1020         switch (info->genlhdr->cmd) {
1021         case NL80211_CMD_NEW_BEACON:
1022                 /* these are required for NEW_BEACON */
1023                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1024                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1025                     !info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1026                         err = -EINVAL;
1027                         goto out;
1028                 }
1029
1030                 call = drv->ops->add_beacon;
1031                 break;
1032         case NL80211_CMD_SET_BEACON:
1033                 call = drv->ops->set_beacon;
1034                 break;
1035         default:
1036                 WARN_ON(1);
1037                 err = -EOPNOTSUPP;
1038                 goto out;
1039         }
1040
1041         if (!call) {
1042                 err = -EOPNOTSUPP;
1043                 goto out;
1044         }
1045
1046         memset(&params, 0, sizeof(params));
1047
1048         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1049                 params.interval =
1050                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1051                 haveinfo = 1;
1052         }
1053
1054         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1055                 params.dtim_period =
1056                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1057                 haveinfo = 1;
1058         }
1059
1060         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1061                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1062                 params.head_len =
1063                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1064                 haveinfo = 1;
1065         }
1066
1067         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1068                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1069                 params.tail_len =
1070                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1071                 haveinfo = 1;
1072         }
1073
1074         if (!haveinfo) {
1075                 err = -EINVAL;
1076                 goto out;
1077         }
1078
1079         rtnl_lock();
1080         err = call(&drv->wiphy, dev, &params);
1081         rtnl_unlock();
1082
1083  out:
1084         cfg80211_put_dev(drv);
1085         dev_put(dev);
1086         return err;
1087 }
1088
1089 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1090 {
1091         struct cfg80211_registered_device *drv;
1092         int err;
1093         struct net_device *dev;
1094
1095         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1096         if (err)
1097                 return err;
1098
1099         if (!drv->ops->del_beacon) {
1100                 err = -EOPNOTSUPP;
1101                 goto out;
1102         }
1103
1104         rtnl_lock();
1105         err = drv->ops->del_beacon(&drv->wiphy, dev);
1106         rtnl_unlock();
1107
1108  out:
1109         cfg80211_put_dev(drv);
1110         dev_put(dev);
1111         return err;
1112 }
1113
1114 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1115         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1116         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1117         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1118 };
1119
1120 static int parse_station_flags(struct nlattr *nla, u32 *staflags)
1121 {
1122         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1123         int flag;
1124
1125         *staflags = 0;
1126
1127         if (!nla)
1128                 return 0;
1129
1130         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1131                              nla, sta_flags_policy))
1132                 return -EINVAL;
1133
1134         *staflags = STATION_FLAG_CHANGED;
1135
1136         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1137                 if (flags[flag])
1138                         *staflags |= (1<<flag);
1139
1140         return 0;
1141 }
1142
1143 static u16 nl80211_calculate_bitrate(struct rate_info *rate)
1144 {
1145         int modulation, streams, bitrate;
1146
1147         if (!(rate->flags & RATE_INFO_FLAGS_MCS))
1148                 return rate->legacy;
1149
1150         /* the formula below does only work for MCS values smaller than 32 */
1151         if (rate->mcs >= 32)
1152                 return 0;
1153
1154         modulation = rate->mcs & 7;
1155         streams = (rate->mcs >> 3) + 1;
1156
1157         bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
1158                         13500000 : 6500000;
1159
1160         if (modulation < 4)
1161                 bitrate *= (modulation + 1);
1162         else if (modulation == 4)
1163                 bitrate *= (modulation + 2);
1164         else
1165                 bitrate *= (modulation + 3);
1166
1167         bitrate *= streams;
1168
1169         if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
1170                 bitrate = (bitrate / 9) * 10;
1171
1172         /* do NOT round down here */
1173         return (bitrate + 50000) / 100000;
1174 }
1175
1176 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1177                                 int flags, struct net_device *dev,
1178                                 u8 *mac_addr, struct station_info *sinfo)
1179 {
1180         void *hdr;
1181         struct nlattr *sinfoattr, *txrate;
1182         u16 bitrate;
1183
1184         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1185         if (!hdr)
1186                 return -1;
1187
1188         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1189         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1190
1191         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1192         if (!sinfoattr)
1193                 goto nla_put_failure;
1194         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1195                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1196                             sinfo->inactive_time);
1197         if (sinfo->filled & STATION_INFO_RX_BYTES)
1198                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1199                             sinfo->rx_bytes);
1200         if (sinfo->filled & STATION_INFO_TX_BYTES)
1201                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1202                             sinfo->tx_bytes);
1203         if (sinfo->filled & STATION_INFO_LLID)
1204                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1205                             sinfo->llid);
1206         if (sinfo->filled & STATION_INFO_PLID)
1207                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1208                             sinfo->plid);
1209         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1210                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1211                             sinfo->plink_state);
1212         if (sinfo->filled & STATION_INFO_SIGNAL)
1213                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1214                            sinfo->signal);
1215         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1216                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1217                 if (!txrate)
1218                         goto nla_put_failure;
1219
1220                 /* nl80211_calculate_bitrate will return 0 for mcs >= 32 */
1221                 bitrate = nl80211_calculate_bitrate(&sinfo->txrate);
1222                 if (bitrate > 0)
1223                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1224
1225                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1226                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1227                                     sinfo->txrate.mcs);
1228                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1229                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1230                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1231                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1232
1233                 nla_nest_end(msg, txrate);
1234         }
1235         if (sinfo->filled & STATION_INFO_RX_PACKETS)
1236                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
1237                             sinfo->rx_packets);
1238         if (sinfo->filled & STATION_INFO_TX_PACKETS)
1239                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
1240                             sinfo->tx_packets);
1241         nla_nest_end(msg, sinfoattr);
1242
1243         return genlmsg_end(msg, hdr);
1244
1245  nla_put_failure:
1246         genlmsg_cancel(msg, hdr);
1247         return -EMSGSIZE;
1248 }
1249
1250 static int nl80211_dump_station(struct sk_buff *skb,
1251                                 struct netlink_callback *cb)
1252 {
1253         struct station_info sinfo;
1254         struct cfg80211_registered_device *dev;
1255         struct net_device *netdev;
1256         u8 mac_addr[ETH_ALEN];
1257         int ifidx = cb->args[0];
1258         int sta_idx = cb->args[1];
1259         int err;
1260
1261         if (!ifidx) {
1262                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1263                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1264                                   nl80211_policy);
1265                 if (err)
1266                         return err;
1267
1268                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1269                         return -EINVAL;
1270
1271                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1272                 if (!ifidx)
1273                         return -EINVAL;
1274         }
1275
1276         netdev = dev_get_by_index(&init_net, ifidx);
1277         if (!netdev)
1278                 return -ENODEV;
1279
1280         dev = cfg80211_get_dev_from_ifindex(ifidx);
1281         if (IS_ERR(dev)) {
1282                 err = PTR_ERR(dev);
1283                 goto out_put_netdev;
1284         }
1285
1286         if (!dev->ops->dump_station) {
1287                 err = -ENOSYS;
1288                 goto out_err;
1289         }
1290
1291         rtnl_lock();
1292
1293         while (1) {
1294                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1295                                              mac_addr, &sinfo);
1296                 if (err == -ENOENT)
1297                         break;
1298                 if (err)
1299                         goto out_err_rtnl;
1300
1301                 if (nl80211_send_station(skb,
1302                                 NETLINK_CB(cb->skb).pid,
1303                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
1304                                 netdev, mac_addr,
1305                                 &sinfo) < 0)
1306                         goto out;
1307
1308                 sta_idx++;
1309         }
1310
1311
1312  out:
1313         cb->args[1] = sta_idx;
1314         err = skb->len;
1315  out_err_rtnl:
1316         rtnl_unlock();
1317  out_err:
1318         cfg80211_put_dev(dev);
1319  out_put_netdev:
1320         dev_put(netdev);
1321
1322         return err;
1323 }
1324
1325 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1326 {
1327         struct cfg80211_registered_device *drv;
1328         int err;
1329         struct net_device *dev;
1330         struct station_info sinfo;
1331         struct sk_buff *msg;
1332         u8 *mac_addr = NULL;
1333
1334         memset(&sinfo, 0, sizeof(sinfo));
1335
1336         if (!info->attrs[NL80211_ATTR_MAC])
1337                 return -EINVAL;
1338
1339         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1340
1341         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1342         if (err)
1343                 return err;
1344
1345         if (!drv->ops->get_station) {
1346                 err = -EOPNOTSUPP;
1347                 goto out;
1348         }
1349
1350         rtnl_lock();
1351         err = drv->ops->get_station(&drv->wiphy, dev, mac_addr, &sinfo);
1352         rtnl_unlock();
1353
1354         if (err)
1355                 goto out;
1356
1357         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1358         if (!msg)
1359                 goto out;
1360
1361         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1362                                  dev, mac_addr, &sinfo) < 0)
1363                 goto out_free;
1364
1365         err = genlmsg_unicast(msg, info->snd_pid);
1366         goto out;
1367
1368  out_free:
1369         nlmsg_free(msg);
1370
1371  out:
1372         cfg80211_put_dev(drv);
1373         dev_put(dev);
1374         return err;
1375 }
1376
1377 /*
1378  * Get vlan interface making sure it is on the right wiphy.
1379  */
1380 static int get_vlan(struct nlattr *vlanattr,
1381                     struct cfg80211_registered_device *rdev,
1382                     struct net_device **vlan)
1383 {
1384         *vlan = NULL;
1385
1386         if (vlanattr) {
1387                 *vlan = dev_get_by_index(&init_net, nla_get_u32(vlanattr));
1388                 if (!*vlan)
1389                         return -ENODEV;
1390                 if (!(*vlan)->ieee80211_ptr)
1391                         return -EINVAL;
1392                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
1393                         return -EINVAL;
1394         }
1395         return 0;
1396 }
1397
1398 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
1399 {
1400         struct cfg80211_registered_device *drv;
1401         int err;
1402         struct net_device *dev;
1403         struct station_parameters params;
1404         u8 *mac_addr = NULL;
1405
1406         memset(&params, 0, sizeof(params));
1407
1408         params.listen_interval = -1;
1409
1410         if (info->attrs[NL80211_ATTR_STA_AID])
1411                 return -EINVAL;
1412
1413         if (!info->attrs[NL80211_ATTR_MAC])
1414                 return -EINVAL;
1415
1416         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1417
1418         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
1419                 params.supported_rates =
1420                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1421                 params.supported_rates_len =
1422                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1423         }
1424
1425         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1426                 params.listen_interval =
1427                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1428
1429         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1430                 params.ht_capa =
1431                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1432
1433         if (parse_station_flags(info->attrs[NL80211_ATTR_STA_FLAGS],
1434                                 &params.station_flags))
1435                 return -EINVAL;
1436
1437         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
1438                 params.plink_action =
1439                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
1440
1441         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1442         if (err)
1443                 return err;
1444
1445         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1446         if (err)
1447                 goto out;
1448
1449         if (!drv->ops->change_station) {
1450                 err = -EOPNOTSUPP;
1451                 goto out;
1452         }
1453
1454         rtnl_lock();
1455         err = drv->ops->change_station(&drv->wiphy, dev, mac_addr, &params);
1456         rtnl_unlock();
1457
1458  out:
1459         if (params.vlan)
1460                 dev_put(params.vlan);
1461         cfg80211_put_dev(drv);
1462         dev_put(dev);
1463         return err;
1464 }
1465
1466 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
1467 {
1468         struct cfg80211_registered_device *drv;
1469         int err;
1470         struct net_device *dev;
1471         struct station_parameters params;
1472         u8 *mac_addr = NULL;
1473
1474         memset(&params, 0, sizeof(params));
1475
1476         if (!info->attrs[NL80211_ATTR_MAC])
1477                 return -EINVAL;
1478
1479         if (!info->attrs[NL80211_ATTR_STA_AID])
1480                 return -EINVAL;
1481
1482         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1483                 return -EINVAL;
1484
1485         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
1486                 return -EINVAL;
1487
1488         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1489         params.supported_rates =
1490                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1491         params.supported_rates_len =
1492                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1493         params.listen_interval =
1494                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1495         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
1496         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1497                 params.ht_capa =
1498                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1499
1500         if (parse_station_flags(info->attrs[NL80211_ATTR_STA_FLAGS],
1501                                 &params.station_flags))
1502                 return -EINVAL;
1503
1504         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1505         if (err)
1506                 return err;
1507
1508         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1509         if (err)
1510                 goto out;
1511
1512         if (!drv->ops->add_station) {
1513                 err = -EOPNOTSUPP;
1514                 goto out;
1515         }
1516
1517         rtnl_lock();
1518         err = drv->ops->add_station(&drv->wiphy, dev, mac_addr, &params);
1519         rtnl_unlock();
1520
1521  out:
1522         if (params.vlan)
1523                 dev_put(params.vlan);
1524         cfg80211_put_dev(drv);
1525         dev_put(dev);
1526         return err;
1527 }
1528
1529 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
1530 {
1531         struct cfg80211_registered_device *drv;
1532         int err;
1533         struct net_device *dev;
1534         u8 *mac_addr = NULL;
1535
1536         if (info->attrs[NL80211_ATTR_MAC])
1537                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1538
1539         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1540         if (err)
1541                 return err;
1542
1543         if (!drv->ops->del_station) {
1544                 err = -EOPNOTSUPP;
1545                 goto out;
1546         }
1547
1548         rtnl_lock();
1549         err = drv->ops->del_station(&drv->wiphy, dev, mac_addr);
1550         rtnl_unlock();
1551
1552  out:
1553         cfg80211_put_dev(drv);
1554         dev_put(dev);
1555         return err;
1556 }
1557
1558 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
1559                                 int flags, struct net_device *dev,
1560                                 u8 *dst, u8 *next_hop,
1561                                 struct mpath_info *pinfo)
1562 {
1563         void *hdr;
1564         struct nlattr *pinfoattr;
1565
1566         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1567         if (!hdr)
1568                 return -1;
1569
1570         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1571         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
1572         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
1573
1574         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
1575         if (!pinfoattr)
1576                 goto nla_put_failure;
1577         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
1578                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
1579                             pinfo->frame_qlen);
1580         if (pinfo->filled & MPATH_INFO_DSN)
1581                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DSN,
1582                             pinfo->dsn);
1583         if (pinfo->filled & MPATH_INFO_METRIC)
1584                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
1585                             pinfo->metric);
1586         if (pinfo->filled & MPATH_INFO_EXPTIME)
1587                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
1588                             pinfo->exptime);
1589         if (pinfo->filled & MPATH_INFO_FLAGS)
1590                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
1591                             pinfo->flags);
1592         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
1593                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
1594                             pinfo->discovery_timeout);
1595         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
1596                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
1597                             pinfo->discovery_retries);
1598
1599         nla_nest_end(msg, pinfoattr);
1600
1601         return genlmsg_end(msg, hdr);
1602
1603  nla_put_failure:
1604         genlmsg_cancel(msg, hdr);
1605         return -EMSGSIZE;
1606 }
1607
1608 static int nl80211_dump_mpath(struct sk_buff *skb,
1609                               struct netlink_callback *cb)
1610 {
1611         struct mpath_info pinfo;
1612         struct cfg80211_registered_device *dev;
1613         struct net_device *netdev;
1614         u8 dst[ETH_ALEN];
1615         u8 next_hop[ETH_ALEN];
1616         int ifidx = cb->args[0];
1617         int path_idx = cb->args[1];
1618         int err;
1619
1620         if (!ifidx) {
1621                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1622                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1623                                   nl80211_policy);
1624                 if (err)
1625                         return err;
1626
1627                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1628                         return -EINVAL;
1629
1630                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1631                 if (!ifidx)
1632                         return -EINVAL;
1633         }
1634
1635         netdev = dev_get_by_index(&init_net, ifidx);
1636         if (!netdev)
1637                 return -ENODEV;
1638
1639         dev = cfg80211_get_dev_from_ifindex(ifidx);
1640         if (IS_ERR(dev)) {
1641                 err = PTR_ERR(dev);
1642                 goto out_put_netdev;
1643         }
1644
1645         if (!dev->ops->dump_mpath) {
1646                 err = -ENOSYS;
1647                 goto out_err;
1648         }
1649
1650         rtnl_lock();
1651
1652         while (1) {
1653                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
1654                                            dst, next_hop, &pinfo);
1655                 if (err == -ENOENT)
1656                         break;
1657                 if (err)
1658                         goto out_err_rtnl;
1659
1660                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
1661                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
1662                                        netdev, dst, next_hop,
1663                                        &pinfo) < 0)
1664                         goto out;
1665
1666                 path_idx++;
1667         }
1668
1669
1670  out:
1671         cb->args[1] = path_idx;
1672         err = skb->len;
1673  out_err_rtnl:
1674         rtnl_unlock();
1675  out_err:
1676         cfg80211_put_dev(dev);
1677  out_put_netdev:
1678         dev_put(netdev);
1679
1680         return err;
1681 }
1682
1683 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
1684 {
1685         struct cfg80211_registered_device *drv;
1686         int err;
1687         struct net_device *dev;
1688         struct mpath_info pinfo;
1689         struct sk_buff *msg;
1690         u8 *dst = NULL;
1691         u8 next_hop[ETH_ALEN];
1692
1693         memset(&pinfo, 0, sizeof(pinfo));
1694
1695         if (!info->attrs[NL80211_ATTR_MAC])
1696                 return -EINVAL;
1697
1698         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1699
1700         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1701         if (err)
1702                 return err;
1703
1704         if (!drv->ops->get_mpath) {
1705                 err = -EOPNOTSUPP;
1706                 goto out;
1707         }
1708
1709         rtnl_lock();
1710         err = drv->ops->get_mpath(&drv->wiphy, dev, dst, next_hop, &pinfo);
1711         rtnl_unlock();
1712
1713         if (err)
1714                 goto out;
1715
1716         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1717         if (!msg)
1718                 goto out;
1719
1720         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
1721                                  dev, dst, next_hop, &pinfo) < 0)
1722                 goto out_free;
1723
1724         err = genlmsg_unicast(msg, info->snd_pid);
1725         goto out;
1726
1727  out_free:
1728         nlmsg_free(msg);
1729
1730  out:
1731         cfg80211_put_dev(drv);
1732         dev_put(dev);
1733         return err;
1734 }
1735
1736 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
1737 {
1738         struct cfg80211_registered_device *drv;
1739         int err;
1740         struct net_device *dev;
1741         u8 *dst = NULL;
1742         u8 *next_hop = NULL;
1743
1744         if (!info->attrs[NL80211_ATTR_MAC])
1745                 return -EINVAL;
1746
1747         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
1748                 return -EINVAL;
1749
1750         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1751         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
1752
1753         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1754         if (err)
1755                 return err;
1756
1757         if (!drv->ops->change_mpath) {
1758                 err = -EOPNOTSUPP;
1759                 goto out;
1760         }
1761
1762         rtnl_lock();
1763         err = drv->ops->change_mpath(&drv->wiphy, dev, dst, next_hop);
1764         rtnl_unlock();
1765
1766  out:
1767         cfg80211_put_dev(drv);
1768         dev_put(dev);
1769         return err;
1770 }
1771 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
1772 {
1773         struct cfg80211_registered_device *drv;
1774         int err;
1775         struct net_device *dev;
1776         u8 *dst = NULL;
1777         u8 *next_hop = NULL;
1778
1779         if (!info->attrs[NL80211_ATTR_MAC])
1780                 return -EINVAL;
1781
1782         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
1783                 return -EINVAL;
1784
1785         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1786         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
1787
1788         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1789         if (err)
1790                 return err;
1791
1792         if (!drv->ops->add_mpath) {
1793                 err = -EOPNOTSUPP;
1794                 goto out;
1795         }
1796
1797         rtnl_lock();
1798         err = drv->ops->add_mpath(&drv->wiphy, dev, dst, next_hop);
1799         rtnl_unlock();
1800
1801  out:
1802         cfg80211_put_dev(drv);
1803         dev_put(dev);
1804         return err;
1805 }
1806
1807 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
1808 {
1809         struct cfg80211_registered_device *drv;
1810         int err;
1811         struct net_device *dev;
1812         u8 *dst = NULL;
1813
1814         if (info->attrs[NL80211_ATTR_MAC])
1815                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1816
1817         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1818         if (err)
1819                 return err;
1820
1821         if (!drv->ops->del_mpath) {
1822                 err = -EOPNOTSUPP;
1823                 goto out;
1824         }
1825
1826         rtnl_lock();
1827         err = drv->ops->del_mpath(&drv->wiphy, dev, dst);
1828         rtnl_unlock();
1829
1830  out:
1831         cfg80211_put_dev(drv);
1832         dev_put(dev);
1833         return err;
1834 }
1835
1836 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
1837 {
1838         struct cfg80211_registered_device *drv;
1839         int err;
1840         struct net_device *dev;
1841         struct bss_parameters params;
1842
1843         memset(&params, 0, sizeof(params));
1844         /* default to not changing parameters */
1845         params.use_cts_prot = -1;
1846         params.use_short_preamble = -1;
1847         params.use_short_slot_time = -1;
1848
1849         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
1850                 params.use_cts_prot =
1851                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
1852         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
1853                 params.use_short_preamble =
1854                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
1855         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
1856                 params.use_short_slot_time =
1857                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
1858         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
1859                 params.basic_rates =
1860                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
1861                 params.basic_rates_len =
1862                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
1863         }
1864
1865         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1866         if (err)
1867                 return err;
1868
1869         if (!drv->ops->change_bss) {
1870                 err = -EOPNOTSUPP;
1871                 goto out;
1872         }
1873
1874         rtnl_lock();
1875         err = drv->ops->change_bss(&drv->wiphy, dev, &params);
1876         rtnl_unlock();
1877
1878  out:
1879         cfg80211_put_dev(drv);
1880         dev_put(dev);
1881         return err;
1882 }
1883
1884 static const struct nla_policy
1885         reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
1886         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
1887         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
1888         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
1889         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
1890         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
1891         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
1892 };
1893
1894 static int parse_reg_rule(struct nlattr *tb[],
1895         struct ieee80211_reg_rule *reg_rule)
1896 {
1897         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
1898         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
1899
1900         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
1901                 return -EINVAL;
1902         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
1903                 return -EINVAL;
1904         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
1905                 return -EINVAL;
1906         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
1907                 return -EINVAL;
1908         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
1909                 return -EINVAL;
1910
1911         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
1912
1913         freq_range->start_freq_khz =
1914                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
1915         freq_range->end_freq_khz =
1916                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
1917         freq_range->max_bandwidth_khz =
1918                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
1919
1920         power_rule->max_eirp =
1921                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
1922
1923         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
1924                 power_rule->max_antenna_gain =
1925                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
1926
1927         return 0;
1928 }
1929
1930 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
1931 {
1932         int r;
1933         char *data = NULL;
1934
1935         /*
1936          * You should only get this when cfg80211 hasn't yet initialized
1937          * completely when built-in to the kernel right between the time
1938          * window between nl80211_init() and regulatory_init(), if that is
1939          * even possible.
1940          */
1941         mutex_lock(&cfg80211_mutex);
1942         if (unlikely(!cfg80211_regdomain)) {
1943                 mutex_unlock(&cfg80211_mutex);
1944                 return -EINPROGRESS;
1945         }
1946         mutex_unlock(&cfg80211_mutex);
1947
1948         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
1949                 return -EINVAL;
1950
1951         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
1952
1953 #ifdef CONFIG_WIRELESS_OLD_REGULATORY
1954         /* We ignore world regdom requests with the old regdom setup */
1955         if (is_world_regdom(data))
1956                 return -EINVAL;
1957 #endif
1958
1959         r = regulatory_hint_user(data);
1960
1961         return r;
1962 }
1963
1964 static int nl80211_get_mesh_params(struct sk_buff *skb,
1965         struct genl_info *info)
1966 {
1967         struct cfg80211_registered_device *drv;
1968         struct mesh_config cur_params;
1969         int err;
1970         struct net_device *dev;
1971         void *hdr;
1972         struct nlattr *pinfoattr;
1973         struct sk_buff *msg;
1974
1975         /* Look up our device */
1976         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1977         if (err)
1978                 return err;
1979
1980         if (!drv->ops->get_mesh_params) {
1981                 err = -EOPNOTSUPP;
1982                 goto out;
1983         }
1984
1985         /* Get the mesh params */
1986         rtnl_lock();
1987         err = drv->ops->get_mesh_params(&drv->wiphy, dev, &cur_params);
1988         rtnl_unlock();
1989         if (err)
1990                 goto out;
1991
1992         /* Draw up a netlink message to send back */
1993         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1994         if (!msg) {
1995                 err = -ENOBUFS;
1996                 goto out;
1997         }
1998         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
1999                              NL80211_CMD_GET_MESH_PARAMS);
2000         if (!hdr)
2001                 goto nla_put_failure;
2002         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
2003         if (!pinfoattr)
2004                 goto nla_put_failure;
2005         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2006         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2007                         cur_params.dot11MeshRetryTimeout);
2008         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2009                         cur_params.dot11MeshConfirmTimeout);
2010         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2011                         cur_params.dot11MeshHoldingTimeout);
2012         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2013                         cur_params.dot11MeshMaxPeerLinks);
2014         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2015                         cur_params.dot11MeshMaxRetries);
2016         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2017                         cur_params.dot11MeshTTL);
2018         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2019                         cur_params.auto_open_plinks);
2020         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2021                         cur_params.dot11MeshHWMPmaxPREQretries);
2022         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2023                         cur_params.path_refresh_time);
2024         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2025                         cur_params.min_discovery_timeout);
2026         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2027                         cur_params.dot11MeshHWMPactivePathTimeout);
2028         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2029                         cur_params.dot11MeshHWMPpreqMinInterval);
2030         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2031                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2032         nla_nest_end(msg, pinfoattr);
2033         genlmsg_end(msg, hdr);
2034         err = genlmsg_unicast(msg, info->snd_pid);
2035         goto out;
2036
2037 nla_put_failure:
2038         genlmsg_cancel(msg, hdr);
2039         err = -EMSGSIZE;
2040 out:
2041         /* Cleanup */
2042         cfg80211_put_dev(drv);
2043         dev_put(dev);
2044         return err;
2045 }
2046
2047 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2048 do {\
2049         if (table[attr_num]) {\
2050                 cfg.param = nla_fn(table[attr_num]); \
2051                 mask |= (1 << (attr_num - 1)); \
2052         } \
2053 } while (0);\
2054
2055 static struct nla_policy
2056 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] __read_mostly = {
2057         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2058         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2059         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2060         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2061         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2062         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2063         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2064
2065         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2066         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2067         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2068         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2069         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2070         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2071 };
2072
2073 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2074 {
2075         int err;
2076         u32 mask;
2077         struct cfg80211_registered_device *drv;
2078         struct net_device *dev;
2079         struct mesh_config cfg;
2080         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2081         struct nlattr *parent_attr;
2082
2083         parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
2084         if (!parent_attr)
2085                 return -EINVAL;
2086         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2087                         parent_attr, nl80211_meshconf_params_policy))
2088                 return -EINVAL;
2089
2090         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2091         if (err)
2092                 return err;
2093
2094         if (!drv->ops->set_mesh_params) {
2095                 err = -EOPNOTSUPP;
2096                 goto out;
2097         }
2098
2099         /* This makes sure that there aren't more than 32 mesh config
2100          * parameters (otherwise our bitfield scheme would not work.) */
2101         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2102
2103         /* Fill in the params struct */
2104         mask = 0;
2105         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2106                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2107         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2108                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2109         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2110                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2111         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2112                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2113         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2114                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2115         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2116                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2117         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2118                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2119         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2120                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2121                         nla_get_u8);
2122         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2123                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2124         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2125                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2126                         nla_get_u16);
2127         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2128                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2129                         nla_get_u32);
2130         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2131                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2132                         nla_get_u16);
2133         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2134                         dot11MeshHWMPnetDiameterTraversalTime,
2135                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2136                         nla_get_u16);
2137
2138         /* Apply changes */
2139         rtnl_lock();
2140         err = drv->ops->set_mesh_params(&drv->wiphy, dev, &cfg, mask);
2141         rtnl_unlock();
2142
2143  out:
2144         /* cleanup */
2145         cfg80211_put_dev(drv);
2146         dev_put(dev);
2147         return err;
2148 }
2149
2150 #undef FILL_IN_MESH_PARAM_IF_SET
2151
2152 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2153 {
2154         struct sk_buff *msg;
2155         void *hdr = NULL;
2156         struct nlattr *nl_reg_rules;
2157         unsigned int i;
2158         int err = -EINVAL;
2159
2160         mutex_lock(&cfg80211_mutex);
2161
2162         if (!cfg80211_regdomain)
2163                 goto out;
2164
2165         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2166         if (!msg) {
2167                 err = -ENOBUFS;
2168                 goto out;
2169         }
2170
2171         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2172                              NL80211_CMD_GET_REG);
2173         if (!hdr)
2174                 goto nla_put_failure;
2175
2176         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2177                 cfg80211_regdomain->alpha2);
2178
2179         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2180         if (!nl_reg_rules)
2181                 goto nla_put_failure;
2182
2183         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2184                 struct nlattr *nl_reg_rule;
2185                 const struct ieee80211_reg_rule *reg_rule;
2186                 const struct ieee80211_freq_range *freq_range;
2187                 const struct ieee80211_power_rule *power_rule;
2188
2189                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2190                 freq_range = &reg_rule->freq_range;
2191                 power_rule = &reg_rule->power_rule;
2192
2193                 nl_reg_rule = nla_nest_start(msg, i);
2194                 if (!nl_reg_rule)
2195                         goto nla_put_failure;
2196
2197                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2198                         reg_rule->flags);
2199                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2200                         freq_range->start_freq_khz);
2201                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2202                         freq_range->end_freq_khz);
2203                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2204                         freq_range->max_bandwidth_khz);
2205                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2206                         power_rule->max_antenna_gain);
2207                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2208                         power_rule->max_eirp);
2209
2210                 nla_nest_end(msg, nl_reg_rule);
2211         }
2212
2213         nla_nest_end(msg, nl_reg_rules);
2214
2215         genlmsg_end(msg, hdr);
2216         err = genlmsg_unicast(msg, info->snd_pid);
2217         goto out;
2218
2219 nla_put_failure:
2220         genlmsg_cancel(msg, hdr);
2221         err = -EMSGSIZE;
2222 out:
2223         mutex_unlock(&cfg80211_mutex);
2224         return err;
2225 }
2226
2227 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2228 {
2229         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2230         struct nlattr *nl_reg_rule;
2231         char *alpha2 = NULL;
2232         int rem_reg_rules = 0, r = 0;
2233         u32 num_rules = 0, rule_idx = 0, size_of_regd;
2234         struct ieee80211_regdomain *rd = NULL;
2235
2236         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2237                 return -EINVAL;
2238
2239         if (!info->attrs[NL80211_ATTR_REG_RULES])
2240                 return -EINVAL;
2241
2242         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2243
2244         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2245                         rem_reg_rules) {
2246                 num_rules++;
2247                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2248                         goto bad_reg;
2249         }
2250
2251         if (!reg_is_valid_request(alpha2))
2252                 return -EINVAL;
2253
2254         size_of_regd = sizeof(struct ieee80211_regdomain) +
2255                 (num_rules * sizeof(struct ieee80211_reg_rule));
2256
2257         rd = kzalloc(size_of_regd, GFP_KERNEL);
2258         if (!rd)
2259                 return -ENOMEM;
2260
2261         rd->n_reg_rules = num_rules;
2262         rd->alpha2[0] = alpha2[0];
2263         rd->alpha2[1] = alpha2[1];
2264
2265         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2266                         rem_reg_rules) {
2267                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2268                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2269                         reg_rule_policy);
2270                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2271                 if (r)
2272                         goto bad_reg;
2273
2274                 rule_idx++;
2275
2276                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES)
2277                         goto bad_reg;
2278         }
2279
2280         BUG_ON(rule_idx != num_rules);
2281
2282         mutex_lock(&cfg80211_mutex);
2283         r = set_regdom(rd);
2284         mutex_unlock(&cfg80211_mutex);
2285         return r;
2286
2287  bad_reg:
2288         kfree(rd);
2289         return -EINVAL;
2290 }
2291
2292 static int nl80211_set_mgmt_extra_ie(struct sk_buff *skb,
2293                                      struct genl_info *info)
2294 {
2295         struct cfg80211_registered_device *drv;
2296         int err;
2297         struct net_device *dev;
2298         struct mgmt_extra_ie_params params;
2299
2300         memset(&params, 0, sizeof(params));
2301
2302         if (!info->attrs[NL80211_ATTR_MGMT_SUBTYPE])
2303                 return -EINVAL;
2304         params.subtype = nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
2305         if (params.subtype > 15)
2306                 return -EINVAL; /* FC Subtype field is 4 bits (0..15) */
2307
2308         if (info->attrs[NL80211_ATTR_IE]) {
2309                 params.ies = nla_data(info->attrs[NL80211_ATTR_IE]);
2310                 params.ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2311         }
2312
2313         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2314         if (err)
2315                 return err;
2316
2317         if (drv->ops->set_mgmt_extra_ie) {
2318                 rtnl_lock();
2319                 err = drv->ops->set_mgmt_extra_ie(&drv->wiphy, dev, &params);
2320                 rtnl_unlock();
2321         } else
2322                 err = -EOPNOTSUPP;
2323
2324         cfg80211_put_dev(drv);
2325         dev_put(dev);
2326         return err;
2327 }
2328
2329 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
2330 {
2331         struct cfg80211_registered_device *drv;
2332         struct net_device *dev;
2333         struct cfg80211_scan_request *request;
2334         struct cfg80211_ssid *ssid;
2335         struct ieee80211_channel *channel;
2336         struct nlattr *attr;
2337         struct wiphy *wiphy;
2338         int err, tmp, n_ssids = 0, n_channels = 0, i;
2339         enum ieee80211_band band;
2340         size_t ie_len;
2341
2342         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2343         if (err)
2344                 return err;
2345
2346         wiphy = &drv->wiphy;
2347
2348         if (!drv->ops->scan) {
2349                 err = -EOPNOTSUPP;
2350                 goto out;
2351         }
2352
2353         rtnl_lock();
2354
2355         if (drv->scan_req) {
2356                 err = -EBUSY;
2357                 goto out_unlock;
2358         }
2359
2360         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2361                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp)
2362                         n_channels++;
2363                 if (!n_channels) {
2364                         err = -EINVAL;
2365                         goto out_unlock;
2366                 }
2367         } else {
2368                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
2369                         if (wiphy->bands[band])
2370                                 n_channels += wiphy->bands[band]->n_channels;
2371         }
2372
2373         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
2374                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
2375                         n_ssids++;
2376
2377         if (n_ssids > wiphy->max_scan_ssids) {
2378                 err = -EINVAL;
2379                 goto out_unlock;
2380         }
2381
2382         if (info->attrs[NL80211_ATTR_IE])
2383                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2384         else
2385                 ie_len = 0;
2386
2387         request = kzalloc(sizeof(*request)
2388                         + sizeof(*ssid) * n_ssids
2389                         + sizeof(channel) * n_channels
2390                         + ie_len, GFP_KERNEL);
2391         if (!request) {
2392                 err = -ENOMEM;
2393                 goto out_unlock;
2394         }
2395
2396         request->channels = (void *)((char *)request + sizeof(*request));
2397         request->n_channels = n_channels;
2398         if (n_ssids)
2399                 request->ssids = (void *)(request->channels + n_channels);
2400         request->n_ssids = n_ssids;
2401         if (ie_len) {
2402                 if (request->ssids)
2403                         request->ie = (void *)(request->ssids + n_ssids);
2404                 else
2405                         request->ie = (void *)(request->channels + n_channels);
2406         }
2407
2408         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2409                 /* user specified, bail out if channel not found */
2410                 request->n_channels = n_channels;
2411                 i = 0;
2412                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
2413                         request->channels[i] = ieee80211_get_channel(wiphy, nla_get_u32(attr));
2414                         if (!request->channels[i]) {
2415                                 err = -EINVAL;
2416                                 goto out_free;
2417                         }
2418                         i++;
2419                 }
2420         } else {
2421                 /* all channels */
2422                 i = 0;
2423                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
2424                         int j;
2425                         if (!wiphy->bands[band])
2426                                 continue;
2427                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
2428                                 request->channels[i] = &wiphy->bands[band]->channels[j];
2429                                 i++;
2430                         }
2431                 }
2432         }
2433
2434         i = 0;
2435         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
2436                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
2437                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
2438                                 err = -EINVAL;
2439                                 goto out_free;
2440                         }
2441                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
2442                         request->ssids[i].ssid_len = nla_len(attr);
2443                         i++;
2444                 }
2445         }
2446
2447         if (info->attrs[NL80211_ATTR_IE]) {
2448                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2449                 memcpy(request->ie, nla_data(info->attrs[NL80211_ATTR_IE]),
2450                        request->ie_len);
2451         }
2452
2453         request->ifidx = dev->ifindex;
2454         request->wiphy = &drv->wiphy;
2455
2456         drv->scan_req = request;
2457         err = drv->ops->scan(&drv->wiphy, dev, request);
2458
2459  out_free:
2460         if (err) {
2461                 drv->scan_req = NULL;
2462                 kfree(request);
2463         }
2464  out_unlock:
2465         rtnl_unlock();
2466  out:
2467         cfg80211_put_dev(drv);
2468         dev_put(dev);
2469         return err;
2470 }
2471
2472 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
2473                             struct cfg80211_registered_device *rdev,
2474                             struct net_device *dev,
2475                             struct cfg80211_bss *res)
2476 {
2477         void *hdr;
2478         struct nlattr *bss;
2479
2480         hdr = nl80211hdr_put(msg, pid, seq, flags,
2481                              NL80211_CMD_NEW_SCAN_RESULTS);
2482         if (!hdr)
2483                 return -1;
2484
2485         NLA_PUT_U32(msg, NL80211_ATTR_SCAN_GENERATION,
2486                     rdev->bss_generation);
2487         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2488
2489         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
2490         if (!bss)
2491                 goto nla_put_failure;
2492         if (!is_zero_ether_addr(res->bssid))
2493                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
2494         if (res->information_elements && res->len_information_elements)
2495                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
2496                         res->len_information_elements,
2497                         res->information_elements);
2498         if (res->tsf)
2499                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
2500         if (res->beacon_interval)
2501                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
2502         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
2503         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
2504
2505         switch (rdev->wiphy.signal_type) {
2506         case CFG80211_SIGNAL_TYPE_MBM:
2507                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
2508                 break;
2509         case CFG80211_SIGNAL_TYPE_UNSPEC:
2510                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
2511                 break;
2512         default:
2513                 break;
2514         }
2515
2516         nla_nest_end(msg, bss);
2517
2518         return genlmsg_end(msg, hdr);
2519
2520  nla_put_failure:
2521         genlmsg_cancel(msg, hdr);
2522         return -EMSGSIZE;
2523 }
2524
2525 static int nl80211_dump_scan(struct sk_buff *skb,
2526                              struct netlink_callback *cb)
2527 {
2528         struct cfg80211_registered_device *dev;
2529         struct net_device *netdev;
2530         struct cfg80211_internal_bss *scan;
2531         int ifidx = cb->args[0];
2532         int start = cb->args[1], idx = 0;
2533         int err;
2534
2535         if (!ifidx) {
2536                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
2537                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
2538                                   nl80211_policy);
2539                 if (err)
2540                         return err;
2541
2542                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
2543                         return -EINVAL;
2544
2545                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
2546                 if (!ifidx)
2547                         return -EINVAL;
2548                 cb->args[0] = ifidx;
2549         }
2550
2551         netdev = dev_get_by_index(&init_net, ifidx);
2552         if (!netdev)
2553                 return -ENODEV;
2554
2555         dev = cfg80211_get_dev_from_ifindex(ifidx);
2556         if (IS_ERR(dev)) {
2557                 err = PTR_ERR(dev);
2558                 goto out_put_netdev;
2559         }
2560
2561         spin_lock_bh(&dev->bss_lock);
2562         cfg80211_bss_expire(dev);
2563
2564         list_for_each_entry(scan, &dev->bss_list, list) {
2565                 if (++idx <= start)
2566                         continue;
2567                 if (nl80211_send_bss(skb,
2568                                 NETLINK_CB(cb->skb).pid,
2569                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2570                                 dev, netdev, &scan->pub) < 0) {
2571                         idx--;
2572                         goto out;
2573                 }
2574         }
2575
2576  out:
2577         spin_unlock_bh(&dev->bss_lock);
2578
2579         cb->args[1] = idx;
2580         err = skb->len;
2581         cfg80211_put_dev(dev);
2582  out_put_netdev:
2583         dev_put(netdev);
2584
2585         return err;
2586 }
2587
2588 static struct genl_ops nl80211_ops[] = {
2589         {
2590                 .cmd = NL80211_CMD_GET_WIPHY,
2591                 .doit = nl80211_get_wiphy,
2592                 .dumpit = nl80211_dump_wiphy,
2593                 .policy = nl80211_policy,
2594                 /* can be retrieved by unprivileged users */
2595         },
2596         {
2597                 .cmd = NL80211_CMD_SET_WIPHY,
2598                 .doit = nl80211_set_wiphy,
2599                 .policy = nl80211_policy,
2600                 .flags = GENL_ADMIN_PERM,
2601         },
2602         {
2603                 .cmd = NL80211_CMD_GET_INTERFACE,
2604                 .doit = nl80211_get_interface,
2605                 .dumpit = nl80211_dump_interface,
2606                 .policy = nl80211_policy,
2607                 /* can be retrieved by unprivileged users */
2608         },
2609         {
2610                 .cmd = NL80211_CMD_SET_INTERFACE,
2611                 .doit = nl80211_set_interface,
2612                 .policy = nl80211_policy,
2613                 .flags = GENL_ADMIN_PERM,
2614         },
2615         {
2616                 .cmd = NL80211_CMD_NEW_INTERFACE,
2617                 .doit = nl80211_new_interface,
2618                 .policy = nl80211_policy,
2619                 .flags = GENL_ADMIN_PERM,
2620         },
2621         {
2622                 .cmd = NL80211_CMD_DEL_INTERFACE,
2623                 .doit = nl80211_del_interface,
2624                 .policy = nl80211_policy,
2625                 .flags = GENL_ADMIN_PERM,
2626         },
2627         {
2628                 .cmd = NL80211_CMD_GET_KEY,
2629                 .doit = nl80211_get_key,
2630                 .policy = nl80211_policy,
2631                 .flags = GENL_ADMIN_PERM,
2632         },
2633         {
2634                 .cmd = NL80211_CMD_SET_KEY,
2635                 .doit = nl80211_set_key,
2636                 .policy = nl80211_policy,
2637                 .flags = GENL_ADMIN_PERM,
2638         },
2639         {
2640                 .cmd = NL80211_CMD_NEW_KEY,
2641                 .doit = nl80211_new_key,
2642                 .policy = nl80211_policy,
2643                 .flags = GENL_ADMIN_PERM,
2644         },
2645         {
2646                 .cmd = NL80211_CMD_DEL_KEY,
2647                 .doit = nl80211_del_key,
2648                 .policy = nl80211_policy,
2649                 .flags = GENL_ADMIN_PERM,
2650         },
2651         {
2652                 .cmd = NL80211_CMD_SET_BEACON,
2653                 .policy = nl80211_policy,
2654                 .flags = GENL_ADMIN_PERM,
2655                 .doit = nl80211_addset_beacon,
2656         },
2657         {
2658                 .cmd = NL80211_CMD_NEW_BEACON,
2659                 .policy = nl80211_policy,
2660                 .flags = GENL_ADMIN_PERM,
2661                 .doit = nl80211_addset_beacon,
2662         },
2663         {
2664                 .cmd = NL80211_CMD_DEL_BEACON,
2665                 .policy = nl80211_policy,
2666                 .flags = GENL_ADMIN_PERM,
2667                 .doit = nl80211_del_beacon,
2668         },
2669         {
2670                 .cmd = NL80211_CMD_GET_STATION,
2671                 .doit = nl80211_get_station,
2672                 .dumpit = nl80211_dump_station,
2673                 .policy = nl80211_policy,
2674         },
2675         {
2676                 .cmd = NL80211_CMD_SET_STATION,
2677                 .doit = nl80211_set_station,
2678                 .policy = nl80211_policy,
2679                 .flags = GENL_ADMIN_PERM,
2680         },
2681         {
2682                 .cmd = NL80211_CMD_NEW_STATION,
2683                 .doit = nl80211_new_station,
2684                 .policy = nl80211_policy,
2685                 .flags = GENL_ADMIN_PERM,
2686         },
2687         {
2688                 .cmd = NL80211_CMD_DEL_STATION,
2689                 .doit = nl80211_del_station,
2690                 .policy = nl80211_policy,
2691                 .flags = GENL_ADMIN_PERM,
2692         },
2693         {
2694                 .cmd = NL80211_CMD_GET_MPATH,
2695                 .doit = nl80211_get_mpath,
2696                 .dumpit = nl80211_dump_mpath,
2697                 .policy = nl80211_policy,
2698                 .flags = GENL_ADMIN_PERM,
2699         },
2700         {
2701                 .cmd = NL80211_CMD_SET_MPATH,
2702                 .doit = nl80211_set_mpath,
2703                 .policy = nl80211_policy,
2704                 .flags = GENL_ADMIN_PERM,
2705         },
2706         {
2707                 .cmd = NL80211_CMD_NEW_MPATH,
2708                 .doit = nl80211_new_mpath,
2709                 .policy = nl80211_policy,
2710                 .flags = GENL_ADMIN_PERM,
2711         },
2712         {
2713                 .cmd = NL80211_CMD_DEL_MPATH,
2714                 .doit = nl80211_del_mpath,
2715                 .policy = nl80211_policy,
2716                 .flags = GENL_ADMIN_PERM,
2717         },
2718         {
2719                 .cmd = NL80211_CMD_SET_BSS,
2720                 .doit = nl80211_set_bss,
2721                 .policy = nl80211_policy,
2722                 .flags = GENL_ADMIN_PERM,
2723         },
2724         {
2725                 .cmd = NL80211_CMD_GET_REG,
2726                 .doit = nl80211_get_reg,
2727                 .policy = nl80211_policy,
2728                 /* can be retrieved by unprivileged users */
2729         },
2730         {
2731                 .cmd = NL80211_CMD_SET_REG,
2732                 .doit = nl80211_set_reg,
2733                 .policy = nl80211_policy,
2734                 .flags = GENL_ADMIN_PERM,
2735         },
2736         {
2737                 .cmd = NL80211_CMD_REQ_SET_REG,
2738                 .doit = nl80211_req_set_reg,
2739                 .policy = nl80211_policy,
2740                 .flags = GENL_ADMIN_PERM,
2741         },
2742         {
2743                 .cmd = NL80211_CMD_GET_MESH_PARAMS,
2744                 .doit = nl80211_get_mesh_params,
2745                 .policy = nl80211_policy,
2746                 /* can be retrieved by unprivileged users */
2747         },
2748         {
2749                 .cmd = NL80211_CMD_SET_MESH_PARAMS,
2750                 .doit = nl80211_set_mesh_params,
2751                 .policy = nl80211_policy,
2752                 .flags = GENL_ADMIN_PERM,
2753         },
2754         {
2755                 .cmd = NL80211_CMD_SET_MGMT_EXTRA_IE,
2756                 .doit = nl80211_set_mgmt_extra_ie,
2757                 .policy = nl80211_policy,
2758                 .flags = GENL_ADMIN_PERM,
2759         },
2760         {
2761                 .cmd = NL80211_CMD_TRIGGER_SCAN,
2762                 .doit = nl80211_trigger_scan,
2763                 .policy = nl80211_policy,
2764                 .flags = GENL_ADMIN_PERM,
2765         },
2766         {
2767                 .cmd = NL80211_CMD_GET_SCAN,
2768                 .policy = nl80211_policy,
2769                 .dumpit = nl80211_dump_scan,
2770         },
2771 };
2772
2773 /* multicast groups */
2774 static struct genl_multicast_group nl80211_config_mcgrp = {
2775         .name = "config",
2776 };
2777 static struct genl_multicast_group nl80211_scan_mcgrp = {
2778         .name = "scan",
2779 };
2780 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
2781         .name = "regulatory",
2782 };
2783
2784 /* notification functions */
2785
2786 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
2787 {
2788         struct sk_buff *msg;
2789
2790         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2791         if (!msg)
2792                 return;
2793
2794         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
2795                 nlmsg_free(msg);
2796                 return;
2797         }
2798
2799         genlmsg_multicast(msg, 0, nl80211_config_mcgrp.id, GFP_KERNEL);
2800 }
2801
2802 static int nl80211_send_scan_donemsg(struct sk_buff *msg,
2803                                     struct cfg80211_registered_device *rdev,
2804                                     struct net_device *netdev,
2805                                     u32 pid, u32 seq, int flags,
2806                                     u32 cmd)
2807 {
2808         void *hdr;
2809
2810         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
2811         if (!hdr)
2812                 return -1;
2813
2814         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
2815         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
2816
2817         /* XXX: we should probably bounce back the request? */
2818
2819         return genlmsg_end(msg, hdr);
2820
2821  nla_put_failure:
2822         genlmsg_cancel(msg, hdr);
2823         return -EMSGSIZE;
2824 }
2825
2826 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
2827                             struct net_device *netdev)
2828 {
2829         struct sk_buff *msg;
2830
2831         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2832         if (!msg)
2833                 return;
2834
2835         if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
2836                                       NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
2837                 nlmsg_free(msg);
2838                 return;
2839         }
2840
2841         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
2842 }
2843
2844 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
2845                                struct net_device *netdev)
2846 {
2847         struct sk_buff *msg;
2848
2849         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2850         if (!msg)
2851                 return;
2852
2853         if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
2854                                       NL80211_CMD_SCAN_ABORTED) < 0) {
2855                 nlmsg_free(msg);
2856                 return;
2857         }
2858
2859         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
2860 }
2861
2862 /*
2863  * This can happen on global regulatory changes or device specific settings
2864  * based on custom world regulatory domains.
2865  */
2866 void nl80211_send_reg_change_event(struct regulatory_request *request)
2867 {
2868         struct sk_buff *msg;
2869         void *hdr;
2870
2871         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2872         if (!msg)
2873                 return;
2874
2875         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
2876         if (!hdr) {
2877                 nlmsg_free(msg);
2878                 return;
2879         }
2880
2881         /* Userspace can always count this one always being set */
2882         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
2883
2884         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
2885                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
2886                            NL80211_REGDOM_TYPE_WORLD);
2887         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
2888                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
2889                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
2890         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
2891                  request->intersect)
2892                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
2893                            NL80211_REGDOM_TYPE_INTERSECTION);
2894         else {
2895                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
2896                            NL80211_REGDOM_TYPE_COUNTRY);
2897                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
2898         }
2899
2900         if (wiphy_idx_valid(request->wiphy_idx))
2901                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
2902
2903         if (genlmsg_end(msg, hdr) < 0) {
2904                 nlmsg_free(msg);
2905                 return;
2906         }
2907
2908         genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_KERNEL);
2909
2910         return;
2911
2912 nla_put_failure:
2913         genlmsg_cancel(msg, hdr);
2914         nlmsg_free(msg);
2915 }
2916
2917 /* initialisation/exit functions */
2918
2919 int nl80211_init(void)
2920 {
2921         int err, i;
2922
2923         err = genl_register_family(&nl80211_fam);
2924         if (err)
2925                 return err;
2926
2927         for (i = 0; i < ARRAY_SIZE(nl80211_ops); i++) {
2928                 err = genl_register_ops(&nl80211_fam, &nl80211_ops[i]);
2929                 if (err)
2930                         goto err_out;
2931         }
2932
2933         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
2934         if (err)
2935                 goto err_out;
2936
2937         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
2938         if (err)
2939                 goto err_out;
2940
2941         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
2942         if (err)
2943                 goto err_out;
2944
2945         return 0;
2946  err_out:
2947         genl_unregister_family(&nl80211_fam);
2948         return err;
2949 }
2950
2951 void nl80211_exit(void)
2952 {
2953         genl_unregister_family(&nl80211_fam);
2954 }