net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006, 2007 Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/list.h>
  11 #include <linux/if_ether.h>
  12 #include <linux/ieee80211.h>
  13 #include <linux/nl80211.h>
  14 #include <linux/rtnetlink.h>
  15 #include <linux/netlink.h>
  16 #include <linux/etherdevice.h>
  17 #include <net/genetlink.h>
  18 #include <net/cfg80211.h>
  19 #include "core.h"
  20 #include "nl80211.h"
  21 #include "reg.h"
  22
  23 /* the netlink family */
  24 static struct genl_family nl80211_fam = {
  25         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  26         .name = "nl80211",      /* have users key off the name instead */
  27         .hdrsize = 0,           /* no private header */
  28         .version = 1,           /* no particular meaning now */
  29         .maxattr = NL80211_ATTR_MAX,
  30 };
  31
  32 /* internal helper: get drv and dev */
  33 static int get_drv_dev_by_info_ifindex(struct nlattr **attrs,
  34                                        struct cfg80211_registered_device **drv,
  35                                        struct net_device **dev)
  36 {
  37         int ifindex;
  38
  39         if (!attrs[NL80211_ATTR_IFINDEX])
  40                 return -EINVAL;
  41
  42         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  43         *dev = dev_get_by_index(&init_net, ifindex);
  44         if (!*dev)
  45                 return -ENODEV;
  46
  47         *drv = cfg80211_get_dev_from_ifindex(ifindex);
  48         if (IS_ERR(*drv)) {
  49                 dev_put(*dev);
  50                 return PTR_ERR(*drv);
  51         }
  52
  53         return 0;
  54 }
  55
  56 /* policy for the attributes */
  57 static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
  58         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  59         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  60                                       .len = BUS_ID_SIZE-1 },
  61         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  62         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  63         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  64
  65         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  66         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  67         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  68
  69         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  70
  71         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  72                                     .len = WLAN_MAX_KEY_LEN },
  73         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  74         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  75         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
  76
  77         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
  78         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
  79         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
  80                                        .len = IEEE80211_MAX_DATA_LEN },
  81         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
  82                                        .len = IEEE80211_MAX_DATA_LEN },
  83         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
  84         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
  85         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
  86         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
  87                                                .len = NL80211_MAX_SUPP_RATES },
  88         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
  89         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
  90         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
  91         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
  92                                 .len = IEEE80211_MAX_MESH_ID_LEN },
  93         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
  94
  95         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
  96         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
  97
  98         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
  99         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 100         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 101         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 102                                            .len = NL80211_MAX_SUPP_RATES },
 103
 104         [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
 105
 106         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 107                                          .len = NL80211_HT_CAPABILITY_LEN },
 108
 109         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 110         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 111                               .len = IEEE80211_MAX_DATA_LEN },
 112         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 113         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 114
 115         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 116                                 .len = IEEE80211_MAX_SSID_LEN },
 117         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 118         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 119 };
 120
 121 /* message building helper */
 122 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 123                                    int flags, u8 cmd)
 124 {
 125         /* since there is no private header just add the generic one */
 126         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 127 }
 128
 129 /* netlink command implementations */
 130
 131 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 132                               struct cfg80211_registered_device *dev)
 133 {
 134         void *hdr;
 135         struct nlattr *nl_bands, *nl_band;
 136         struct nlattr *nl_freqs, *nl_freq;
 137         struct nlattr *nl_rates, *nl_rate;
 138         struct nlattr *nl_modes;
 139         struct nlattr *nl_cmds;
 140         enum ieee80211_band band;
 141         struct ieee80211_channel *chan;
 142         struct ieee80211_rate *rate;
 143         int i;
 144         u16 ifmodes = dev->wiphy.interface_modes;
 145
 146         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 147         if (!hdr)
 148                 return -1;
 149
 150         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 151         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 152         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 153                    dev->wiphy.max_scan_ssids);
 154
 155         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
 156         if (!nl_modes)
 157                 goto nla_put_failure;
 158
 159         i = 0;
 160         while (ifmodes) {
 161                 if (ifmodes & 1)
 162                         NLA_PUT_FLAG(msg, i);
 163                 ifmodes >>= 1;
 164                 i++;
 165         }
 166
 167         nla_nest_end(msg, nl_modes);
 168
 169         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 170         if (!nl_bands)
 171                 goto nla_put_failure;
 172
 173         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 174                 if (!dev->wiphy.bands[band])
 175                         continue;
 176
 177                 nl_band = nla_nest_start(msg, band);
 178                 if (!nl_band)
 179                         goto nla_put_failure;
 180
 181                 /* add HT info */
 182                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 183                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 184                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 185                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 186                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 187                                 dev->wiphy.bands[band]->ht_cap.cap);
 188                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 189                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 190                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 191                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 192                 }
 193
 194                 /* add frequencies */
 195                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 196                 if (!nl_freqs)
 197                         goto nla_put_failure;
 198
 199                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 200                         nl_freq = nla_nest_start(msg, i);
 201                         if (!nl_freq)
 202                                 goto nla_put_failure;
 203
 204                         chan = &dev->wiphy.bands[band]->channels[i];
 205                         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 206                                     chan->center_freq);
 207
 208                         if (chan->flags & IEEE80211_CHAN_DISABLED)
 209                                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 210                         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 211                                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 212                         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 213                                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 214                         if (chan->flags & IEEE80211_CHAN_RADAR)
 215                                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 216
 217                         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 218                                     DBM_TO_MBM(chan->max_power));
 219
 220                         nla_nest_end(msg, nl_freq);
 221                 }
 222
 223                 nla_nest_end(msg, nl_freqs);
 224
 225                 /* add bitrates */
 226                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 227                 if (!nl_rates)
 228                         goto nla_put_failure;
 229
 230                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 231                         nl_rate = nla_nest_start(msg, i);
 232                         if (!nl_rate)
 233                                 goto nla_put_failure;
 234
 235                         rate = &dev->wiphy.bands[band]->bitrates[i];
 236                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 237                                     rate->bitrate);
 238                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 239                                 NLA_PUT_FLAG(msg,
 240                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 241
 242                         nla_nest_end(msg, nl_rate);
 243                 }
 244
 245                 nla_nest_end(msg, nl_rates);
 246
 247                 nla_nest_end(msg, nl_band);
 248         }
 249         nla_nest_end(msg, nl_bands);
 250
 251         nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
 252         if (!nl_cmds)
 253                 goto nla_put_failure;
 254
 255         i = 0;
 256 #define CMD(op, n)                                              \
 257          do {                                                   \
 258                 if (dev->ops->op) {                             \
 259                         i++;                                    \
 260                         NLA_PUT_U32(msg, i, NL80211_CMD_ ## n); \
 261                 }                                               \
 262         } while (0)
 263
 264         CMD(add_virtual_intf, NEW_INTERFACE);
 265         CMD(change_virtual_intf, SET_INTERFACE);
 266         CMD(add_key, NEW_KEY);
 267         CMD(add_beacon, NEW_BEACON);
 268         CMD(add_station, NEW_STATION);
 269         CMD(add_mpath, NEW_MPATH);
 270         CMD(set_mesh_params, SET_MESH_PARAMS);
 271         CMD(change_bss, SET_BSS);
 272         CMD(auth, AUTHENTICATE);
 273         CMD(assoc, ASSOCIATE);
 274         CMD(deauth, DEAUTHENTICATE);
 275         CMD(disassoc, DISASSOCIATE);
 276
 277 #undef CMD
 278         nla_nest_end(msg, nl_cmds);
 279
 280         return genlmsg_end(msg, hdr);
 281
 282  nla_put_failure:
 283         genlmsg_cancel(msg, hdr);
 284         return -EMSGSIZE;
 285 }
 286
 287 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 288 {
 289         int idx = 0;
 290         int start = cb->args[0];
 291         struct cfg80211_registered_device *dev;
 292
 293         mutex_lock(&cfg80211_mutex);
 294         list_for_each_entry(dev, &cfg80211_drv_list, list) {
 295                 if (++idx <= start)
 296                         continue;
 297                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
 298                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
 299                                        dev) < 0) {
 300                         idx--;
 301                         break;
 302                 }
 303         }
 304         mutex_unlock(&cfg80211_mutex);
 305
 306         cb->args[0] = idx;
 307
 308         return skb->len;
 309 }
 310
 311 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 312 {
 313         struct sk_buff *msg;
 314         struct cfg80211_registered_device *dev;
 315
 316         dev = cfg80211_get_dev_from_info(info);
 317         if (IS_ERR(dev))
 318                 return PTR_ERR(dev);
 319
 320         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 321         if (!msg)
 322                 goto out_err;
 323
 324         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
 325                 goto out_free;
 326
 327         cfg80211_put_dev(dev);
 328
 329         return genlmsg_unicast(msg, info->snd_pid);
 330
 331  out_free:
 332         nlmsg_free(msg);
 333  out_err:
 334         cfg80211_put_dev(dev);
 335         return -ENOBUFS;
 336 }
 337
 338 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 339         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
 340         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
 341         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
 342         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
 343         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
 344 };
 345
 346 static int parse_txq_params(struct nlattr *tb[],
 347                             struct ieee80211_txq_params *txq_params)
 348 {
 349         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 350             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 351             !tb[NL80211_TXQ_ATTR_AIFS])
 352                 return -EINVAL;
 353
 354         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
 355         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 356         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 357         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 358         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 359
 360         return 0;
 361 }
 362
 363 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 364 {
 365         struct cfg80211_registered_device *rdev;
 366         int result = 0, rem_txq_params = 0;
 367         struct nlattr *nl_txq_params;
 368
 369         rdev = cfg80211_get_dev_from_info(info);
 370         if (IS_ERR(rdev))
 371                 return PTR_ERR(rdev);
 372
 373         if (info->attrs[NL80211_ATTR_WIPHY_NAME]) {
 374                 result = cfg80211_dev_rename(
 375                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 376                 if (result)
 377                         goto bad_res;
 378         }
 379
 380         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
 381                 struct ieee80211_txq_params txq_params;
 382                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
 383
 384                 if (!rdev->ops->set_txq_params) {
 385                         result = -EOPNOTSUPP;
 386                         goto bad_res;
 387                 }
 388
 389                 nla_for_each_nested(nl_txq_params,
 390                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
 391                                     rem_txq_params) {
 392                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
 393                                   nla_data(nl_txq_params),
 394                                   nla_len(nl_txq_params),
 395                                   txq_params_policy);
 396                         result = parse_txq_params(tb, &txq_params);
 397                         if (result)
 398                                 goto bad_res;
 399
 400                         result = rdev->ops->set_txq_params(&rdev->wiphy,
 401                                                            &txq_params);
 402                         if (result)
 403                                 goto bad_res;
 404                 }
 405         }
 406
 407         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
 408                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 409                 struct ieee80211_channel *chan;
 410                 struct ieee80211_sta_ht_cap *ht_cap;
 411                 u32 freq, sec_freq;
 412
 413                 if (!rdev->ops->set_channel) {
 414                         result = -EOPNOTSUPP;
 415                         goto bad_res;
 416                 }
 417
 418                 result = -EINVAL;
 419
 420                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 421                         channel_type = nla_get_u32(info->attrs[
 422                                            NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 423                         if (channel_type != NL80211_CHAN_NO_HT &&
 424                             channel_type != NL80211_CHAN_HT20 &&
 425                             channel_type != NL80211_CHAN_HT40PLUS &&
 426                             channel_type != NL80211_CHAN_HT40MINUS)
 427                                 goto bad_res;
 428                 }
 429
 430                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 431                 chan = ieee80211_get_channel(&rdev->wiphy, freq);
 432
 433                 /* Primary channel not allowed */
 434                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 435                         goto bad_res;
 436
 437                 if (channel_type == NL80211_CHAN_HT40MINUS)
 438                         sec_freq = freq - 20;
 439                 else if (channel_type == NL80211_CHAN_HT40PLUS)
 440                         sec_freq = freq + 20;
 441                 else
 442                         sec_freq = 0;
 443
 444                 ht_cap = &rdev->wiphy.bands[chan->band]->ht_cap;
 445
 446                 /* no HT capabilities */
 447                 if (channel_type != NL80211_CHAN_NO_HT &&
 448                     !ht_cap->ht_supported)
 449                         goto bad_res;
 450
 451                 if (sec_freq) {
 452                         struct ieee80211_channel *schan;
 453
 454                         /* no 40 MHz capabilities */
 455                         if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
 456                             (ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT))
 457                                 goto bad_res;
 458
 459                         schan = ieee80211_get_channel(&rdev->wiphy, sec_freq);
 460
 461                         /* Secondary channel not allowed */
 462                         if (!schan || schan->flags & IEEE80211_CHAN_DISABLED)
 463                                 goto bad_res;
 464                 }
 465
 466                 result = rdev->ops->set_channel(&rdev->wiphy, chan,
 467                                                 channel_type);
 468                 if (result)
 469                         goto bad_res;
 470         }
 471
 472
 473  bad_res:
 474         cfg80211_put_dev(rdev);
 475         return result;
 476 }
 477
 478
 479 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 480                               struct net_device *dev)
 481 {
 482         void *hdr;
 483
 484         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
 485         if (!hdr)
 486                 return -1;
 487
 488         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 489         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
 490         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
 491         return genlmsg_end(msg, hdr);
 492
 493  nla_put_failure:
 494         genlmsg_cancel(msg, hdr);
 495         return -EMSGSIZE;
 496 }
 497
 498 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
 499 {
 500         int wp_idx = 0;
 501         int if_idx = 0;
 502         int wp_start = cb->args[0];
 503         int if_start = cb->args[1];
 504         struct cfg80211_registered_device *dev;
 505         struct wireless_dev *wdev;
 506
 507         mutex_lock(&cfg80211_mutex);
 508         list_for_each_entry(dev, &cfg80211_drv_list, list) {
 509                 if (wp_idx < wp_start) {
 510                         wp_idx++;
 511                         continue;
 512                 }
 513                 if_idx = 0;
 514
 515                 mutex_lock(&dev->devlist_mtx);
 516                 list_for_each_entry(wdev, &dev->netdev_list, list) {
 517                         if (if_idx < if_start) {
 518                                 if_idx++;
 519                                 continue;
 520                         }
 521                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
 522                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
 523                                                wdev->netdev) < 0) {
 524                                 mutex_unlock(&dev->devlist_mtx);
 525                                 goto out;
 526                         }
 527                         if_idx++;
 528                 }
 529                 mutex_unlock(&dev->devlist_mtx);
 530
 531                 wp_idx++;
 532         }
 533  out:
 534         mutex_unlock(&cfg80211_mutex);
 535
 536         cb->args[0] = wp_idx;
 537         cb->args[1] = if_idx;
 538
 539         return skb->len;
 540 }
 541
 542 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
 543 {
 544         struct sk_buff *msg;
 545         struct cfg80211_registered_device *dev;
 546         struct net_device *netdev;
 547         int err;
 548
 549         err = get_drv_dev_by_info_ifindex(info->attrs, &dev, &netdev);
 550         if (err)
 551                 return err;
 552
 553         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 554         if (!msg)
 555                 goto out_err;
 556
 557         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0, netdev) < 0)
 558                 goto out_free;
 559
 560         dev_put(netdev);
 561         cfg80211_put_dev(dev);
 562
 563         return genlmsg_unicast(msg, info->snd_pid);
 564
 565  out_free:
 566         nlmsg_free(msg);
 567  out_err:
 568         dev_put(netdev);
 569         cfg80211_put_dev(dev);
 570         return -ENOBUFS;
 571 }
 572
 573 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
 574         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
 575         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
 576         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
 577         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
 578         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
 579 };
 580
 581 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
 582 {
 583         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
 584         int flag;
 585
 586         *mntrflags = 0;
 587
 588         if (!nla)
 589                 return -EINVAL;
 590
 591         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
 592                              nla, mntr_flags_policy))
 593                 return -EINVAL;
 594
 595         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
 596                 if (flags[flag])
 597                         *mntrflags |= (1<<flag);
 598
 599         return 0;
 600 }
 601
 602 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 603 {
 604         struct cfg80211_registered_device *drv;
 605         struct vif_params params;
 606         int err, ifindex;
 607         enum nl80211_iftype type;
 608         struct net_device *dev;
 609         u32 _flags, *flags = NULL;
 610
 611         memset(&params, 0, sizeof(params));
 612
 613         rtnl_lock();
 614
 615         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 616         if (err)
 617                 goto unlock_rtnl;
 618
 619         ifindex = dev->ifindex;
 620         type = dev->ieee80211_ptr->iftype;
 621         dev_put(dev);
 622
 623         err = -EINVAL;
 624         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 625                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 626                 if (type > NL80211_IFTYPE_MAX)
 627                         goto unlock;
 628         }
 629
 630         if (!drv->ops->change_virtual_intf ||
 631             !(drv->wiphy.interface_modes & (1 << type))) {
 632                 err = -EOPNOTSUPP;
 633                 goto unlock;
 634         }
 635
 636         if (info->attrs[NL80211_ATTR_MESH_ID]) {
 637                 if (type != NL80211_IFTYPE_MESH_POINT) {
 638                         err = -EINVAL;
 639                         goto unlock;
 640                 }
 641                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 642                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 643         }
 644
 645         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
 646                 if (type != NL80211_IFTYPE_MONITOR) {
 647                         err = -EINVAL;
 648                         goto unlock;
 649                 }
 650                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
 651                                           &_flags);
 652                 if (!err)
 653                         flags = &_flags;
 654         }
 655
 656         err = drv->ops->change_virtual_intf(&drv->wiphy, ifindex,
 657                                             type, flags, &params);
 658
 659         dev = __dev_get_by_index(&init_net, ifindex);
 660         WARN_ON(!dev || (!err && dev->ieee80211_ptr->iftype != type));
 661
 662  unlock:
 663         cfg80211_put_dev(drv);
 664  unlock_rtnl:
 665         rtnl_unlock();
 666         return err;
 667 }
 668
 669 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
 670 {
 671         struct cfg80211_registered_device *drv;
 672         struct vif_params params;
 673         int err;
 674         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
 675         u32 flags;
 676
 677         memset(&params, 0, sizeof(params));
 678
 679         if (!info->attrs[NL80211_ATTR_IFNAME])
 680                 return -EINVAL;
 681
 682         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 683                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 684                 if (type > NL80211_IFTYPE_MAX)
 685                         return -EINVAL;
 686         }
 687
 688         rtnl_lock();
 689
 690         drv = cfg80211_get_dev_from_info(info);
 691         if (IS_ERR(drv)) {
 692                 err = PTR_ERR(drv);
 693                 goto unlock_rtnl;
 694         }
 695
 696         if (!drv->ops->add_virtual_intf ||
 697             !(drv->wiphy.interface_modes & (1 << type))) {
 698                 err = -EOPNOTSUPP;
 699                 goto unlock;
 700         }
 701
 702         if (type == NL80211_IFTYPE_MESH_POINT &&
 703             info->attrs[NL80211_ATTR_MESH_ID]) {
 704                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 705                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 706         }
 707
 708         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
 709                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
 710                                   &flags);
 711         err = drv->ops->add_virtual_intf(&drv->wiphy,
 712                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
 713                 type, err ? NULL : &flags, &params);
 714
 715  unlock:
 716         cfg80211_put_dev(drv);
 717  unlock_rtnl:
 718         rtnl_unlock();
 719         return err;
 720 }
 721
 722 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
 723 {
 724         struct cfg80211_registered_device *drv;
 725         int ifindex, err;
 726         struct net_device *dev;
 727
 728         rtnl_lock();
 729
 730         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 731         if (err)
 732                 goto unlock_rtnl;
 733         ifindex = dev->ifindex;
 734         dev_put(dev);
 735
 736         if (!drv->ops->del_virtual_intf) {
 737                 err = -EOPNOTSUPP;
 738                 goto out;
 739         }
 740
 741         err = drv->ops->del_virtual_intf(&drv->wiphy, ifindex);
 742
 743  out:
 744         cfg80211_put_dev(drv);
 745  unlock_rtnl:
 746         rtnl_unlock();
 747         return err;
 748 }
 749
 750 struct get_key_cookie {
 751         struct sk_buff *msg;
 752         int error;
 753 };
 754
 755 static void get_key_callback(void *c, struct key_params *params)
 756 {
 757         struct get_key_cookie *cookie = c;
 758
 759         if (params->key)
 760                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
 761                         params->key_len, params->key);
 762
 763         if (params->seq)
 764                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
 765                         params->seq_len, params->seq);
 766
 767         if (params->cipher)
 768                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
 769                             params->cipher);
 770
 771         return;
 772  nla_put_failure:
 773         cookie->error = 1;
 774 }
 775
 776 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
 777 {
 778         struct cfg80211_registered_device *drv;
 779         int err;
 780         struct net_device *dev;
 781         u8 key_idx = 0;
 782         u8 *mac_addr = NULL;
 783         struct get_key_cookie cookie = {
 784                 .error = 0,
 785         };
 786         void *hdr;
 787         struct sk_buff *msg;
 788
 789         if (info->attrs[NL80211_ATTR_KEY_IDX])
 790                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 791
 792         if (key_idx > 5)
 793                 return -EINVAL;
 794
 795         if (info->attrs[NL80211_ATTR_MAC])
 796                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 797
 798         rtnl_lock();
 799
 800         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 801         if (err)
 802                 goto unlock_rtnl;
 803
 804         if (!drv->ops->get_key) {
 805                 err = -EOPNOTSUPP;
 806                 goto out;
 807         }
 808
 809         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 810         if (!msg) {
 811                 err = -ENOMEM;
 812                 goto out;
 813         }
 814
 815         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
 816                              NL80211_CMD_NEW_KEY);
 817
 818         if (IS_ERR(hdr)) {
 819                 err = PTR_ERR(hdr);
 820                 goto out;
 821         }
 822
 823         cookie.msg = msg;
 824
 825         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 826         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
 827         if (mac_addr)
 828                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
 829
 830         err = drv->ops->get_key(&drv->wiphy, dev, key_idx, mac_addr,
 831                                 &cookie, get_key_callback);
 832
 833         if (err)
 834                 goto out;
 835
 836         if (cookie.error)
 837                 goto nla_put_failure;
 838
 839         genlmsg_end(msg, hdr);
 840         err = genlmsg_unicast(msg, info->snd_pid);
 841         goto out;
 842
 843  nla_put_failure:
 844         err = -ENOBUFS;
 845         nlmsg_free(msg);
 846  out:
 847         cfg80211_put_dev(drv);
 848         dev_put(dev);
 849  unlock_rtnl:
 850         rtnl_unlock();
 851
 852         return err;
 853 }
 854
 855 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
 856 {
 857         struct cfg80211_registered_device *drv;
 858         int err;
 859         struct net_device *dev;
 860         u8 key_idx;
 861         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
 862                     u8 key_index);
 863
 864         if (!info->attrs[NL80211_ATTR_KEY_IDX])
 865                 return -EINVAL;
 866
 867         key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 868
 869         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]) {
 870                 if (key_idx < 4 || key_idx > 5)
 871                         return -EINVAL;
 872         } else if (key_idx > 3)
 873                 return -EINVAL;
 874
 875         /* currently only support setting default key */
 876         if (!info->attrs[NL80211_ATTR_KEY_DEFAULT] &&
 877             !info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT])
 878                 return -EINVAL;
 879
 880         rtnl_lock();
 881
 882         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 883         if (err)
 884                 goto unlock_rtnl;
 885
 886         if (info->attrs[NL80211_ATTR_KEY_DEFAULT])
 887                 func = drv->ops->set_default_key;
 888         else
 889                 func = drv->ops->set_default_mgmt_key;
 890
 891         if (!func) {
 892                 err = -EOPNOTSUPP;
 893                 goto out;
 894         }
 895
 896         err = func(&drv->wiphy, dev, key_idx);
 897
 898  out:
 899         cfg80211_put_dev(drv);
 900         dev_put(dev);
 901
 902  unlock_rtnl:
 903         rtnl_unlock();
 904
 905         return err;
 906 }
 907
 908 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
 909 {
 910         struct cfg80211_registered_device *drv;
 911         int err;
 912         struct net_device *dev;
 913         struct key_params params;
 914         u8 key_idx = 0;
 915         u8 *mac_addr = NULL;
 916
 917         memset(&params, 0, sizeof(params));
 918
 919         if (!info->attrs[NL80211_ATTR_KEY_CIPHER])
 920                 return -EINVAL;
 921
 922         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 923                 params.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 924                 params.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 925         }
 926
 927         if (info->attrs[NL80211_ATTR_KEY_IDX])
 928                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 929
 930         params.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 931
 932         if (info->attrs[NL80211_ATTR_MAC])
 933                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 934
 935         if (key_idx > 5)
 936                 return -EINVAL;
 937
 938         /*
 939          * Disallow pairwise keys with non-zero index unless it's WEP
 940          * (because current deployments use pairwise WEP keys with
 941          * non-zero indizes but 802.11i clearly specifies to use zero)
 942          */
 943         if (mac_addr && key_idx &&
 944             params.cipher != WLAN_CIPHER_SUITE_WEP40 &&
 945             params.cipher != WLAN_CIPHER_SUITE_WEP104)
 946                 return -EINVAL;
 947
 948         /* TODO: add definitions for the lengths to linux/ieee80211.h */
 949         switch (params.cipher) {
 950         case WLAN_CIPHER_SUITE_WEP40:
 951                 if (params.key_len != 5)
 952                         return -EINVAL;
 953                 break;
 954         case WLAN_CIPHER_SUITE_TKIP:
 955                 if (params.key_len != 32)
 956                         return -EINVAL;
 957                 break;
 958         case WLAN_CIPHER_SUITE_CCMP:
 959                 if (params.key_len != 16)
 960                         return -EINVAL;
 961                 break;
 962         case WLAN_CIPHER_SUITE_WEP104:
 963                 if (params.key_len != 13)
 964                         return -EINVAL;
 965                 break;
 966         case WLAN_CIPHER_SUITE_AES_CMAC:
 967                 if (params.key_len != 16)
 968                         return -EINVAL;
 969                 break;
 970         default:
 971                 return -EINVAL;
 972         }
 973
 974         rtnl_lock();
 975
 976         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 977         if (err)
 978                 goto unlock_rtnl;
 979
 980         if (!drv->ops->add_key) {
 981                 err = -EOPNOTSUPP;
 982                 goto out;
 983         }
 984
 985         err = drv->ops->add_key(&drv->wiphy, dev, key_idx, mac_addr, &params);
 986
 987  out:
 988         cfg80211_put_dev(drv);
 989         dev_put(dev);
 990  unlock_rtnl:
 991         rtnl_unlock();
 992
 993         return err;
 994 }
 995
 996 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
 997 {
 998         struct cfg80211_registered_device *drv;
 999         int err;
1000         struct net_device *dev;
1001         u8 key_idx = 0;
1002         u8 *mac_addr = NULL;
1003
1004         if (info->attrs[NL80211_ATTR_KEY_IDX])
1005                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1006
1007         if (key_idx > 5)
1008                 return -EINVAL;
1009
1010         if (info->attrs[NL80211_ATTR_MAC])
1011                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1012
1013         rtnl_lock();
1014
1015         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1016         if (err)
1017                 goto unlock_rtnl;
1018
1019         if (!drv->ops->del_key) {
1020                 err = -EOPNOTSUPP;
1021                 goto out;
1022         }
1023
1024         err = drv->ops->del_key(&drv->wiphy, dev, key_idx, mac_addr);
1025
1026  out:
1027         cfg80211_put_dev(drv);
1028         dev_put(dev);
1029
1030  unlock_rtnl:
1031         rtnl_unlock();
1032
1033         return err;
1034 }
1035
1036 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1037 {
1038         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1039                     struct beacon_parameters *info);
1040         struct cfg80211_registered_device *drv;
1041         int err;
1042         struct net_device *dev;
1043         struct beacon_parameters params;
1044         int haveinfo = 0;
1045
1046         rtnl_lock();
1047
1048         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1049         if (err)
1050                 goto unlock_rtnl;
1051
1052         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1053                 err = -EOPNOTSUPP;
1054                 goto out;
1055         }
1056
1057         switch (info->genlhdr->cmd) {
1058         case NL80211_CMD_NEW_BEACON:
1059                 /* these are required for NEW_BEACON */
1060                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1061                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1062                     !info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1063                         err = -EINVAL;
1064                         goto out;
1065                 }
1066
1067                 call = drv->ops->add_beacon;
1068                 break;
1069         case NL80211_CMD_SET_BEACON:
1070                 call = drv->ops->set_beacon;
1071                 break;
1072         default:
1073                 WARN_ON(1);
1074                 err = -EOPNOTSUPP;
1075                 goto out;
1076         }
1077
1078         if (!call) {
1079                 err = -EOPNOTSUPP;
1080                 goto out;
1081         }
1082
1083         memset(&params, 0, sizeof(params));
1084
1085         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1086                 params.interval =
1087                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1088                 haveinfo = 1;
1089         }
1090
1091         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1092                 params.dtim_period =
1093                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1094                 haveinfo = 1;
1095         }
1096
1097         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1098                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1099                 params.head_len =
1100                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1101                 haveinfo = 1;
1102         }
1103
1104         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1105                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1106                 params.tail_len =
1107                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1108                 haveinfo = 1;
1109         }
1110
1111         if (!haveinfo) {
1112                 err = -EINVAL;
1113                 goto out;
1114         }
1115
1116         err = call(&drv->wiphy, dev, &params);
1117
1118  out:
1119         cfg80211_put_dev(drv);
1120         dev_put(dev);
1121  unlock_rtnl:
1122         rtnl_unlock();
1123
1124         return err;
1125 }
1126
1127 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1128 {
1129         struct cfg80211_registered_device *drv;
1130         int err;
1131         struct net_device *dev;
1132
1133         rtnl_lock();
1134
1135         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1136         if (err)
1137                 goto unlock_rtnl;
1138
1139         if (!drv->ops->del_beacon) {
1140                 err = -EOPNOTSUPP;
1141                 goto out;
1142         }
1143
1144         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1145                 err = -EOPNOTSUPP;
1146                 goto out;
1147         }
1148         err = drv->ops->del_beacon(&drv->wiphy, dev);
1149
1150  out:
1151         cfg80211_put_dev(drv);
1152         dev_put(dev);
1153  unlock_rtnl:
1154         rtnl_unlock();
1155
1156         return err;
1157 }
1158
1159 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1160         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1161         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1162         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1163 };
1164
1165 static int parse_station_flags(struct nlattr *nla, u32 *staflags)
1166 {
1167         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1168         int flag;
1169
1170         *staflags = 0;
1171
1172         if (!nla)
1173                 return 0;
1174
1175         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1176                              nla, sta_flags_policy))
1177                 return -EINVAL;
1178
1179         *staflags = STATION_FLAG_CHANGED;
1180
1181         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1182                 if (flags[flag])
1183                         *staflags |= (1<<flag);
1184
1185         return 0;
1186 }
1187
1188 static u16 nl80211_calculate_bitrate(struct rate_info *rate)
1189 {
1190         int modulation, streams, bitrate;
1191
1192         if (!(rate->flags & RATE_INFO_FLAGS_MCS))
1193                 return rate->legacy;
1194
1195         /* the formula below does only work for MCS values smaller than 32 */
1196         if (rate->mcs >= 32)
1197                 return 0;
1198
1199         modulation = rate->mcs & 7;
1200         streams = (rate->mcs >> 3) + 1;
1201
1202         bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
1203                         13500000 : 6500000;
1204
1205         if (modulation < 4)
1206                 bitrate *= (modulation + 1);
1207         else if (modulation == 4)
1208                 bitrate *= (modulation + 2);
1209         else
1210                 bitrate *= (modulation + 3);
1211
1212         bitrate *= streams;
1213
1214         if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
1215                 bitrate = (bitrate / 9) * 10;
1216
1217         /* do NOT round down here */
1218         return (bitrate + 50000) / 100000;
1219 }
1220
1221 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1222                                 int flags, struct net_device *dev,
1223                                 u8 *mac_addr, struct station_info *sinfo)
1224 {
1225         void *hdr;
1226         struct nlattr *sinfoattr, *txrate;
1227         u16 bitrate;
1228
1229         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1230         if (!hdr)
1231                 return -1;
1232
1233         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1234         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1235
1236         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1237         if (!sinfoattr)
1238                 goto nla_put_failure;
1239         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1240                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1241                             sinfo->inactive_time);
1242         if (sinfo->filled & STATION_INFO_RX_BYTES)
1243                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1244                             sinfo->rx_bytes);
1245         if (sinfo->filled & STATION_INFO_TX_BYTES)
1246                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1247                             sinfo->tx_bytes);
1248         if (sinfo->filled & STATION_INFO_LLID)
1249                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1250                             sinfo->llid);
1251         if (sinfo->filled & STATION_INFO_PLID)
1252                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1253                             sinfo->plid);
1254         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1255                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1256                             sinfo->plink_state);
1257         if (sinfo->filled & STATION_INFO_SIGNAL)
1258                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1259                            sinfo->signal);
1260         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1261                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1262                 if (!txrate)
1263                         goto nla_put_failure;
1264
1265                 /* nl80211_calculate_bitrate will return 0 for mcs >= 32 */
1266                 bitrate = nl80211_calculate_bitrate(&sinfo->txrate);
1267                 if (bitrate > 0)
1268                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1269
1270                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1271                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1272                                     sinfo->txrate.mcs);
1273                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1274                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1275                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1276                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1277
1278                 nla_nest_end(msg, txrate);
1279         }
1280         if (sinfo->filled & STATION_INFO_RX_PACKETS)
1281                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
1282                             sinfo->rx_packets);
1283         if (sinfo->filled & STATION_INFO_TX_PACKETS)
1284                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
1285                             sinfo->tx_packets);
1286         nla_nest_end(msg, sinfoattr);
1287
1288         return genlmsg_end(msg, hdr);
1289
1290  nla_put_failure:
1291         genlmsg_cancel(msg, hdr);
1292         return -EMSGSIZE;
1293 }
1294
1295 static int nl80211_dump_station(struct sk_buff *skb,
1296                                 struct netlink_callback *cb)
1297 {
1298         struct station_info sinfo;
1299         struct cfg80211_registered_device *dev;
1300         struct net_device *netdev;
1301         u8 mac_addr[ETH_ALEN];
1302         int ifidx = cb->args[0];
1303         int sta_idx = cb->args[1];
1304         int err;
1305
1306         if (!ifidx) {
1307                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1308                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1309                                   nl80211_policy);
1310                 if (err)
1311                         return err;
1312
1313                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1314                         return -EINVAL;
1315
1316                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1317                 if (!ifidx)
1318                         return -EINVAL;
1319         }
1320
1321         rtnl_lock();
1322
1323         netdev = __dev_get_by_index(&init_net, ifidx);
1324         if (!netdev) {
1325                 err = -ENODEV;
1326                 goto out_rtnl;
1327         }
1328
1329         dev = cfg80211_get_dev_from_ifindex(ifidx);
1330         if (IS_ERR(dev)) {
1331                 err = PTR_ERR(dev);
1332                 goto out_rtnl;
1333         }
1334
1335         if (!dev->ops->dump_station) {
1336                 err = -EOPNOTSUPP;
1337                 goto out_err;
1338         }
1339
1340         while (1) {
1341                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1342                                              mac_addr, &sinfo);
1343                 if (err == -ENOENT)
1344                         break;
1345                 if (err)
1346                         goto out_err;
1347
1348                 if (nl80211_send_station(skb,
1349                                 NETLINK_CB(cb->skb).pid,
1350                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
1351                                 netdev, mac_addr,
1352                                 &sinfo) < 0)
1353                         goto out;
1354
1355                 sta_idx++;
1356         }
1357
1358
1359  out:
1360         cb->args[1] = sta_idx;
1361         err = skb->len;
1362  out_err:
1363         cfg80211_put_dev(dev);
1364  out_rtnl:
1365         rtnl_unlock();
1366
1367         return err;
1368 }
1369
1370 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1371 {
1372         struct cfg80211_registered_device *drv;
1373         int err;
1374         struct net_device *dev;
1375         struct station_info sinfo;
1376         struct sk_buff *msg;
1377         u8 *mac_addr = NULL;
1378
1379         memset(&sinfo, 0, sizeof(sinfo));
1380
1381         if (!info->attrs[NL80211_ATTR_MAC])
1382                 return -EINVAL;
1383
1384         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1385
1386         rtnl_lock();
1387
1388         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1389         if (err)
1390                 goto out_rtnl;
1391
1392         if (!drv->ops->get_station) {
1393                 err = -EOPNOTSUPP;
1394                 goto out;
1395         }
1396
1397         err = drv->ops->get_station(&drv->wiphy, dev, mac_addr, &sinfo);
1398         if (err)
1399                 goto out;
1400
1401         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1402         if (!msg)
1403                 goto out;
1404
1405         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1406                                  dev, mac_addr, &sinfo) < 0)
1407                 goto out_free;
1408
1409         err = genlmsg_unicast(msg, info->snd_pid);
1410         goto out;
1411
1412  out_free:
1413         nlmsg_free(msg);
1414  out:
1415         cfg80211_put_dev(drv);
1416         dev_put(dev);
1417  out_rtnl:
1418         rtnl_unlock();
1419
1420         return err;
1421 }
1422
1423 /*
1424  * Get vlan interface making sure it is on the right wiphy.
1425  */
1426 static int get_vlan(struct nlattr *vlanattr,
1427                     struct cfg80211_registered_device *rdev,
1428                     struct net_device **vlan)
1429 {
1430         *vlan = NULL;
1431
1432         if (vlanattr) {
1433                 *vlan = dev_get_by_index(&init_net, nla_get_u32(vlanattr));
1434                 if (!*vlan)
1435                         return -ENODEV;
1436                 if (!(*vlan)->ieee80211_ptr)
1437                         return -EINVAL;
1438                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
1439                         return -EINVAL;
1440         }
1441         return 0;
1442 }
1443
1444 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
1445 {
1446         struct cfg80211_registered_device *drv;
1447         int err;
1448         struct net_device *dev;
1449         struct station_parameters params;
1450         u8 *mac_addr = NULL;
1451
1452         memset(&params, 0, sizeof(params));
1453
1454         params.listen_interval = -1;
1455
1456         if (info->attrs[NL80211_ATTR_STA_AID])
1457                 return -EINVAL;
1458
1459         if (!info->attrs[NL80211_ATTR_MAC])
1460                 return -EINVAL;
1461
1462         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1463
1464         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
1465                 params.supported_rates =
1466                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1467                 params.supported_rates_len =
1468                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1469         }
1470
1471         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1472                 params.listen_interval =
1473                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1474
1475         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1476                 params.ht_capa =
1477                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1478
1479         if (parse_station_flags(info->attrs[NL80211_ATTR_STA_FLAGS],
1480                                 &params.station_flags))
1481                 return -EINVAL;
1482
1483         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
1484                 params.plink_action =
1485                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
1486
1487         rtnl_lock();
1488
1489         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1490         if (err)
1491                 goto out_rtnl;
1492
1493         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1494         if (err)
1495                 goto out;
1496
1497         if (!drv->ops->change_station) {
1498                 err = -EOPNOTSUPP;
1499                 goto out;
1500         }
1501
1502         err = drv->ops->change_station(&drv->wiphy, dev, mac_addr, &params);
1503
1504  out:
1505         if (params.vlan)
1506                 dev_put(params.vlan);
1507         cfg80211_put_dev(drv);
1508         dev_put(dev);
1509  out_rtnl:
1510         rtnl_unlock();
1511
1512         return err;
1513 }
1514
1515 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
1516 {
1517         struct cfg80211_registered_device *drv;
1518         int err;
1519         struct net_device *dev;
1520         struct station_parameters params;
1521         u8 *mac_addr = NULL;
1522
1523         memset(&params, 0, sizeof(params));
1524
1525         if (!info->attrs[NL80211_ATTR_MAC])
1526                 return -EINVAL;
1527
1528         if (!info->attrs[NL80211_ATTR_STA_AID])
1529                 return -EINVAL;
1530
1531         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1532                 return -EINVAL;
1533
1534         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
1535                 return -EINVAL;
1536
1537         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1538         params.supported_rates =
1539                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1540         params.supported_rates_len =
1541                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1542         params.listen_interval =
1543                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1544         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
1545         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1546                 params.ht_capa =
1547                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1548
1549         if (parse_station_flags(info->attrs[NL80211_ATTR_STA_FLAGS],
1550                                 &params.station_flags))
1551                 return -EINVAL;
1552
1553         rtnl_lock();
1554
1555         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1556         if (err)
1557                 goto out_rtnl;
1558
1559         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1560         if (err)
1561                 goto out;
1562
1563         if (!drv->ops->add_station) {
1564                 err = -EOPNOTSUPP;
1565                 goto out;
1566         }
1567
1568         if (!netif_running(dev)) {
1569                 err = -ENETDOWN;
1570                 goto out;
1571         }
1572
1573         err = drv->ops->add_station(&drv->wiphy, dev, mac_addr, &params);
1574
1575  out:
1576         if (params.vlan)
1577                 dev_put(params.vlan);
1578         cfg80211_put_dev(drv);
1579         dev_put(dev);
1580  out_rtnl:
1581         rtnl_unlock();
1582
1583         return err;
1584 }
1585
1586 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
1587 {
1588         struct cfg80211_registered_device *drv;
1589         int err;
1590         struct net_device *dev;
1591         u8 *mac_addr = NULL;
1592
1593         if (info->attrs[NL80211_ATTR_MAC])
1594                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1595
1596         rtnl_lock();
1597
1598         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1599         if (err)
1600                 goto out_rtnl;
1601
1602         if (!drv->ops->del_station) {
1603                 err = -EOPNOTSUPP;
1604                 goto out;
1605         }
1606
1607         err = drv->ops->del_station(&drv->wiphy, dev, mac_addr);
1608
1609  out:
1610         cfg80211_put_dev(drv);
1611         dev_put(dev);
1612  out_rtnl:
1613         rtnl_unlock();
1614
1615         return err;
1616 }
1617
1618 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
1619                                 int flags, struct net_device *dev,
1620                                 u8 *dst, u8 *next_hop,
1621                                 struct mpath_info *pinfo)
1622 {
1623         void *hdr;
1624         struct nlattr *pinfoattr;
1625
1626         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1627         if (!hdr)
1628                 return -1;
1629
1630         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1631         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
1632         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
1633
1634         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
1635         if (!pinfoattr)
1636                 goto nla_put_failure;
1637         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
1638                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
1639                             pinfo->frame_qlen);
1640         if (pinfo->filled & MPATH_INFO_DSN)
1641                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DSN,
1642                             pinfo->dsn);
1643         if (pinfo->filled & MPATH_INFO_METRIC)
1644                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
1645                             pinfo->metric);
1646         if (pinfo->filled & MPATH_INFO_EXPTIME)
1647                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
1648                             pinfo->exptime);
1649         if (pinfo->filled & MPATH_INFO_FLAGS)
1650                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
1651                             pinfo->flags);
1652         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
1653                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
1654                             pinfo->discovery_timeout);
1655         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
1656                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
1657                             pinfo->discovery_retries);
1658
1659         nla_nest_end(msg, pinfoattr);
1660
1661         return genlmsg_end(msg, hdr);
1662
1663  nla_put_failure:
1664         genlmsg_cancel(msg, hdr);
1665         return -EMSGSIZE;
1666 }
1667
1668 static int nl80211_dump_mpath(struct sk_buff *skb,
1669                               struct netlink_callback *cb)
1670 {
1671         struct mpath_info pinfo;
1672         struct cfg80211_registered_device *dev;
1673         struct net_device *netdev;
1674         u8 dst[ETH_ALEN];
1675         u8 next_hop[ETH_ALEN];
1676         int ifidx = cb->args[0];
1677         int path_idx = cb->args[1];
1678         int err;
1679
1680         if (!ifidx) {
1681                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1682                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1683                                   nl80211_policy);
1684                 if (err)
1685                         return err;
1686
1687                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1688                         return -EINVAL;
1689
1690                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1691                 if (!ifidx)
1692                         return -EINVAL;
1693         }
1694
1695         rtnl_lock();
1696
1697         netdev = __dev_get_by_index(&init_net, ifidx);
1698         if (!netdev) {
1699                 err = -ENODEV;
1700                 goto out_rtnl;
1701         }
1702
1703         dev = cfg80211_get_dev_from_ifindex(ifidx);
1704         if (IS_ERR(dev)) {
1705                 err = PTR_ERR(dev);
1706                 goto out_rtnl;
1707         }
1708
1709         if (!dev->ops->dump_mpath) {
1710                 err = -EOPNOTSUPP;
1711                 goto out_err;
1712         }
1713
1714         if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1715                 err = -EOPNOTSUPP;
1716                 goto out;
1717         }
1718
1719         while (1) {
1720                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
1721                                            dst, next_hop, &pinfo);
1722                 if (err == -ENOENT)
1723                         break;
1724                 if (err)
1725                         goto out_err;
1726
1727                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
1728                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
1729                                        netdev, dst, next_hop,
1730                                        &pinfo) < 0)
1731                         goto out;
1732
1733                 path_idx++;
1734         }
1735
1736
1737  out:
1738         cb->args[1] = path_idx;
1739         err = skb->len;
1740  out_err:
1741         cfg80211_put_dev(dev);
1742  out_rtnl:
1743         rtnl_unlock();
1744
1745         return err;
1746 }
1747
1748 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
1749 {
1750         struct cfg80211_registered_device *drv;
1751         int err;
1752         struct net_device *dev;
1753         struct mpath_info pinfo;
1754         struct sk_buff *msg;
1755         u8 *dst = NULL;
1756         u8 next_hop[ETH_ALEN];
1757
1758         memset(&pinfo, 0, sizeof(pinfo));
1759
1760         if (!info->attrs[NL80211_ATTR_MAC])
1761                 return -EINVAL;
1762
1763         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1764
1765         rtnl_lock();
1766
1767         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1768         if (err)
1769                 goto out_rtnl;
1770
1771         if (!drv->ops->get_mpath) {
1772                 err = -EOPNOTSUPP;
1773                 goto out;
1774         }
1775
1776         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1777                 err = -EOPNOTSUPP;
1778                 goto out;
1779         }
1780
1781         err = drv->ops->get_mpath(&drv->wiphy, dev, dst, next_hop, &pinfo);
1782         if (err)
1783                 goto out;
1784
1785         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1786         if (!msg)
1787                 goto out;
1788
1789         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
1790                                  dev, dst, next_hop, &pinfo) < 0)
1791                 goto out_free;
1792
1793         err = genlmsg_unicast(msg, info->snd_pid);
1794         goto out;
1795
1796  out_free:
1797         nlmsg_free(msg);
1798  out:
1799         cfg80211_put_dev(drv);
1800         dev_put(dev);
1801  out_rtnl:
1802         rtnl_unlock();
1803
1804         return err;
1805 }
1806
1807 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
1808 {
1809         struct cfg80211_registered_device *drv;
1810         int err;
1811         struct net_device *dev;
1812         u8 *dst = NULL;
1813         u8 *next_hop = NULL;
1814
1815         if (!info->attrs[NL80211_ATTR_MAC])
1816                 return -EINVAL;
1817
1818         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
1819                 return -EINVAL;
1820
1821         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1822         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
1823
1824         rtnl_lock();
1825
1826         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1827         if (err)
1828                 goto out_rtnl;
1829
1830         if (!drv->ops->change_mpath) {
1831                 err = -EOPNOTSUPP;
1832                 goto out;
1833         }
1834
1835         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1836                 err = -EOPNOTSUPP;
1837                 goto out;
1838         }
1839
1840         if (!netif_running(dev)) {
1841                 err = -ENETDOWN;
1842                 goto out;
1843         }
1844
1845         err = drv->ops->change_mpath(&drv->wiphy, dev, dst, next_hop);
1846
1847  out:
1848         cfg80211_put_dev(drv);
1849         dev_put(dev);
1850  out_rtnl:
1851         rtnl_unlock();
1852
1853         return err;
1854 }
1855 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
1856 {
1857         struct cfg80211_registered_device *drv;
1858         int err;
1859         struct net_device *dev;
1860         u8 *dst = NULL;
1861         u8 *next_hop = NULL;
1862
1863         if (!info->attrs[NL80211_ATTR_MAC])
1864                 return -EINVAL;
1865
1866         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
1867                 return -EINVAL;
1868
1869         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1870         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
1871
1872         rtnl_lock();
1873
1874         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1875         if (err)
1876                 goto out_rtnl;
1877
1878         if (!drv->ops->add_mpath) {
1879                 err = -EOPNOTSUPP;
1880                 goto out;
1881         }
1882
1883         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1884                 err = -EOPNOTSUPP;
1885                 goto out;
1886         }
1887
1888         if (!netif_running(dev)) {
1889                 err = -ENETDOWN;
1890                 goto out;
1891         }
1892
1893         err = drv->ops->add_mpath(&drv->wiphy, dev, dst, next_hop);
1894
1895  out:
1896         cfg80211_put_dev(drv);
1897         dev_put(dev);
1898  out_rtnl:
1899         rtnl_unlock();
1900
1901         return err;
1902 }
1903
1904 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
1905 {
1906         struct cfg80211_registered_device *drv;
1907         int err;
1908         struct net_device *dev;
1909         u8 *dst = NULL;
1910
1911         if (info->attrs[NL80211_ATTR_MAC])
1912                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1913
1914         rtnl_lock();
1915
1916         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1917         if (err)
1918                 goto out_rtnl;
1919
1920         if (!drv->ops->del_mpath) {
1921                 err = -EOPNOTSUPP;
1922                 goto out;
1923         }
1924
1925         err = drv->ops->del_mpath(&drv->wiphy, dev, dst);
1926
1927  out:
1928         cfg80211_put_dev(drv);
1929         dev_put(dev);
1930  out_rtnl:
1931         rtnl_unlock();
1932
1933         return err;
1934 }
1935
1936 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
1937 {
1938         struct cfg80211_registered_device *drv;
1939         int err;
1940         struct net_device *dev;
1941         struct bss_parameters params;
1942
1943         memset(&params, 0, sizeof(params));
1944         /* default to not changing parameters */
1945         params.use_cts_prot = -1;
1946         params.use_short_preamble = -1;
1947         params.use_short_slot_time = -1;
1948
1949         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
1950                 params.use_cts_prot =
1951                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
1952         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
1953                 params.use_short_preamble =
1954                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
1955         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
1956                 params.use_short_slot_time =
1957                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
1958         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
1959                 params.basic_rates =
1960                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
1961                 params.basic_rates_len =
1962                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
1963         }
1964
1965         rtnl_lock();
1966
1967         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1968         if (err)
1969                 goto out_rtnl;
1970
1971         if (!drv->ops->change_bss) {
1972                 err = -EOPNOTSUPP;
1973                 goto out;
1974         }
1975
1976         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1977                 err = -EOPNOTSUPP;
1978                 goto out;
1979         }
1980
1981         err = drv->ops->change_bss(&drv->wiphy, dev, &params);
1982
1983  out:
1984         cfg80211_put_dev(drv);
1985         dev_put(dev);
1986  out_rtnl:
1987         rtnl_unlock();
1988
1989         return err;
1990 }
1991
1992 static const struct nla_policy
1993         reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
1994         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
1995         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
1996         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
1997         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
1998         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
1999         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
2000 };
2001
2002 static int parse_reg_rule(struct nlattr *tb[],
2003         struct ieee80211_reg_rule *reg_rule)
2004 {
2005         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2006         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2007
2008         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2009                 return -EINVAL;
2010         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2011                 return -EINVAL;
2012         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2013                 return -EINVAL;
2014         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2015                 return -EINVAL;
2016         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2017                 return -EINVAL;
2018
2019         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2020
2021         freq_range->start_freq_khz =
2022                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2023         freq_range->end_freq_khz =
2024                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2025         freq_range->max_bandwidth_khz =
2026                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2027
2028         power_rule->max_eirp =
2029                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2030
2031         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2032                 power_rule->max_antenna_gain =
2033                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2034
2035         return 0;
2036 }
2037
2038 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2039 {
2040         int r;
2041         char *data = NULL;
2042
2043         /*
2044          * You should only get this when cfg80211 hasn't yet initialized
2045          * completely when built-in to the kernel right between the time
2046          * window between nl80211_init() and regulatory_init(), if that is
2047          * even possible.
2048          */
2049         mutex_lock(&cfg80211_mutex);
2050         if (unlikely(!cfg80211_regdomain)) {
2051                 mutex_unlock(&cfg80211_mutex);
2052                 return -EINPROGRESS;
2053         }
2054         mutex_unlock(&cfg80211_mutex);
2055
2056         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2057                 return -EINVAL;
2058
2059         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2060
2061 #ifdef CONFIG_WIRELESS_OLD_REGULATORY
2062         /* We ignore world regdom requests with the old regdom setup */
2063         if (is_world_regdom(data))
2064                 return -EINVAL;
2065 #endif
2066
2067         r = regulatory_hint_user(data);
2068
2069         return r;
2070 }
2071
2072 static int nl80211_get_mesh_params(struct sk_buff *skb,
2073         struct genl_info *info)
2074 {
2075         struct cfg80211_registered_device *drv;
2076         struct mesh_config cur_params;
2077         int err;
2078         struct net_device *dev;
2079         void *hdr;
2080         struct nlattr *pinfoattr;
2081         struct sk_buff *msg;
2082
2083         rtnl_lock();
2084
2085         /* Look up our device */
2086         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2087         if (err)
2088                 goto out_rtnl;
2089
2090         if (!drv->ops->get_mesh_params) {
2091                 err = -EOPNOTSUPP;
2092                 goto out;
2093         }
2094
2095         /* Get the mesh params */
2096         err = drv->ops->get_mesh_params(&drv->wiphy, dev, &cur_params);
2097         if (err)
2098                 goto out;
2099
2100         /* Draw up a netlink message to send back */
2101         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2102         if (!msg) {
2103                 err = -ENOBUFS;
2104                 goto out;
2105         }
2106         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2107                              NL80211_CMD_GET_MESH_PARAMS);
2108         if (!hdr)
2109                 goto nla_put_failure;
2110         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
2111         if (!pinfoattr)
2112                 goto nla_put_failure;
2113         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2114         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2115                         cur_params.dot11MeshRetryTimeout);
2116         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2117                         cur_params.dot11MeshConfirmTimeout);
2118         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2119                         cur_params.dot11MeshHoldingTimeout);
2120         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2121                         cur_params.dot11MeshMaxPeerLinks);
2122         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2123                         cur_params.dot11MeshMaxRetries);
2124         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2125                         cur_params.dot11MeshTTL);
2126         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2127                         cur_params.auto_open_plinks);
2128         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2129                         cur_params.dot11MeshHWMPmaxPREQretries);
2130         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2131                         cur_params.path_refresh_time);
2132         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2133                         cur_params.min_discovery_timeout);
2134         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2135                         cur_params.dot11MeshHWMPactivePathTimeout);
2136         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2137                         cur_params.dot11MeshHWMPpreqMinInterval);
2138         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2139                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2140         nla_nest_end(msg, pinfoattr);
2141         genlmsg_end(msg, hdr);
2142         err = genlmsg_unicast(msg, info->snd_pid);
2143         goto out;
2144
2145  nla_put_failure:
2146         genlmsg_cancel(msg, hdr);
2147         err = -EMSGSIZE;
2148  out:
2149         /* Cleanup */
2150         cfg80211_put_dev(drv);
2151         dev_put(dev);
2152  out_rtnl:
2153         rtnl_unlock();
2154
2155         return err;
2156 }
2157
2158 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2159 do {\
2160         if (table[attr_num]) {\
2161                 cfg.param = nla_fn(table[attr_num]); \
2162                 mask |= (1 << (attr_num - 1)); \
2163         } \
2164 } while (0);\
2165
2166 static struct nla_policy
2167 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] __read_mostly = {
2168         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2169         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2170         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2171         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2172         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2173         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2174         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2175
2176         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2177         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2178         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2179         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2180         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2181         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2182 };
2183
2184 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2185 {
2186         int err;
2187         u32 mask;
2188         struct cfg80211_registered_device *drv;
2189         struct net_device *dev;
2190         struct mesh_config cfg;
2191         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2192         struct nlattr *parent_attr;
2193
2194         parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
2195         if (!parent_attr)
2196                 return -EINVAL;
2197         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2198                         parent_attr, nl80211_meshconf_params_policy))
2199                 return -EINVAL;
2200
2201         rtnl_lock();
2202
2203         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2204         if (err)
2205                 goto out_rtnl;
2206
2207         if (!drv->ops->set_mesh_params) {
2208                 err = -EOPNOTSUPP;
2209                 goto out;
2210         }
2211
2212         /* This makes sure that there aren't more than 32 mesh config
2213          * parameters (otherwise our bitfield scheme would not work.) */
2214         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2215
2216         /* Fill in the params struct */
2217         mask = 0;
2218         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2219                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2220         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2221                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2222         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2223                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2224         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2225                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2226         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2227                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2228         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2229                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2230         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2231                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2232         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2233                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2234                         nla_get_u8);
2235         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2236                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2237         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2238                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2239                         nla_get_u16);
2240         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2241                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2242                         nla_get_u32);
2243         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2244                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2245                         nla_get_u16);
2246         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2247                         dot11MeshHWMPnetDiameterTraversalTime,
2248                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2249                         nla_get_u16);
2250
2251         /* Apply changes */
2252         err = drv->ops->set_mesh_params(&drv->wiphy, dev, &cfg, mask);
2253
2254  out:
2255         /* cleanup */
2256         cfg80211_put_dev(drv);
2257         dev_put(dev);
2258  out_rtnl:
2259         rtnl_unlock();
2260
2261         return err;
2262 }
2263
2264 #undef FILL_IN_MESH_PARAM_IF_SET
2265
2266 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2267 {
2268         struct sk_buff *msg;
2269         void *hdr = NULL;
2270         struct nlattr *nl_reg_rules;
2271         unsigned int i;
2272         int err = -EINVAL;
2273
2274         mutex_lock(&cfg80211_mutex);
2275
2276         if (!cfg80211_regdomain)
2277                 goto out;
2278
2279         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2280         if (!msg) {
2281                 err = -ENOBUFS;
2282                 goto out;
2283         }
2284
2285         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2286                              NL80211_CMD_GET_REG);
2287         if (!hdr)
2288                 goto nla_put_failure;
2289
2290         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2291                 cfg80211_regdomain->alpha2);
2292
2293         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2294         if (!nl_reg_rules)
2295                 goto nla_put_failure;
2296
2297         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2298                 struct nlattr *nl_reg_rule;
2299                 const struct ieee80211_reg_rule *reg_rule;
2300                 const struct ieee80211_freq_range *freq_range;
2301                 const struct ieee80211_power_rule *power_rule;
2302
2303                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2304                 freq_range = &reg_rule->freq_range;
2305                 power_rule = &reg_rule->power_rule;
2306
2307                 nl_reg_rule = nla_nest_start(msg, i);
2308                 if (!nl_reg_rule)
2309                         goto nla_put_failure;
2310
2311                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2312                         reg_rule->flags);
2313                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2314                         freq_range->start_freq_khz);
2315                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2316                         freq_range->end_freq_khz);
2317                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2318                         freq_range->max_bandwidth_khz);
2319                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2320                         power_rule->max_antenna_gain);
2321                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2322                         power_rule->max_eirp);
2323
2324                 nla_nest_end(msg, nl_reg_rule);
2325         }
2326
2327         nla_nest_end(msg, nl_reg_rules);
2328
2329         genlmsg_end(msg, hdr);
2330         err = genlmsg_unicast(msg, info->snd_pid);
2331         goto out;
2332
2333 nla_put_failure:
2334         genlmsg_cancel(msg, hdr);
2335         err = -EMSGSIZE;
2336 out:
2337         mutex_unlock(&cfg80211_mutex);
2338         return err;
2339 }
2340
2341 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2342 {
2343         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2344         struct nlattr *nl_reg_rule;
2345         char *alpha2 = NULL;
2346         int rem_reg_rules = 0, r = 0;
2347         u32 num_rules = 0, rule_idx = 0, size_of_regd;
2348         struct ieee80211_regdomain *rd = NULL;
2349
2350         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2351                 return -EINVAL;
2352
2353         if (!info->attrs[NL80211_ATTR_REG_RULES])
2354                 return -EINVAL;
2355
2356         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2357
2358         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2359                         rem_reg_rules) {
2360                 num_rules++;
2361                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2362                         goto bad_reg;
2363         }
2364
2365         if (!reg_is_valid_request(alpha2))
2366                 return -EINVAL;
2367
2368         size_of_regd = sizeof(struct ieee80211_regdomain) +
2369                 (num_rules * sizeof(struct ieee80211_reg_rule));
2370
2371         rd = kzalloc(size_of_regd, GFP_KERNEL);
2372         if (!rd)
2373                 return -ENOMEM;
2374
2375         rd->n_reg_rules = num_rules;
2376         rd->alpha2[0] = alpha2[0];
2377         rd->alpha2[1] = alpha2[1];
2378
2379         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2380                         rem_reg_rules) {
2381                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2382                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2383                         reg_rule_policy);
2384                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2385                 if (r)
2386                         goto bad_reg;
2387
2388                 rule_idx++;
2389
2390                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES)
2391                         goto bad_reg;
2392         }
2393
2394         BUG_ON(rule_idx != num_rules);
2395
2396         mutex_lock(&cfg80211_mutex);
2397         r = set_regdom(rd);
2398         mutex_unlock(&cfg80211_mutex);
2399         return r;
2400
2401  bad_reg:
2402         kfree(rd);
2403         return -EINVAL;
2404 }
2405
2406 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
2407 {
2408         struct cfg80211_registered_device *drv;
2409         struct net_device *dev;
2410         struct cfg80211_scan_request *request;
2411         struct cfg80211_ssid *ssid;
2412         struct ieee80211_channel *channel;
2413         struct nlattr *attr;
2414         struct wiphy *wiphy;
2415         int err, tmp, n_ssids = 0, n_channels = 0, i;
2416         enum ieee80211_band band;
2417         size_t ie_len;
2418
2419         rtnl_lock();
2420
2421         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2422         if (err)
2423                 goto out_rtnl;
2424
2425         wiphy = &drv->wiphy;
2426
2427         if (!drv->ops->scan) {
2428                 err = -EOPNOTSUPP;
2429                 goto out;
2430         }
2431
2432         if (!netif_running(dev)) {
2433                 err = -ENETDOWN;
2434                 goto out;
2435         }
2436
2437         if (drv->scan_req) {
2438                 err = -EBUSY;
2439                 goto out;
2440         }
2441
2442         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2443                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp)
2444                         n_channels++;
2445                 if (!n_channels) {
2446                         err = -EINVAL;
2447                         goto out;
2448                 }
2449         } else {
2450                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
2451                         if (wiphy->bands[band])
2452                                 n_channels += wiphy->bands[band]->n_channels;
2453         }
2454
2455         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
2456                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
2457                         n_ssids++;
2458
2459         if (n_ssids > wiphy->max_scan_ssids) {
2460                 err = -EINVAL;
2461                 goto out;
2462         }
2463
2464         if (info->attrs[NL80211_ATTR_IE])
2465                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2466         else
2467                 ie_len = 0;
2468
2469         request = kzalloc(sizeof(*request)
2470                         + sizeof(*ssid) * n_ssids
2471                         + sizeof(channel) * n_channels
2472                         + ie_len, GFP_KERNEL);
2473         if (!request) {
2474                 err = -ENOMEM;
2475                 goto out;
2476         }
2477
2478         request->channels = (void *)((char *)request + sizeof(*request));
2479         request->n_channels = n_channels;
2480         if (n_ssids)
2481                 request->ssids = (void *)(request->channels + n_channels);
2482         request->n_ssids = n_ssids;
2483         if (ie_len) {
2484                 if (request->ssids)
2485                         request->ie = (void *)(request->ssids + n_ssids);
2486                 else
2487                         request->ie = (void *)(request->channels + n_channels);
2488         }
2489
2490         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2491                 /* user specified, bail out if channel not found */
2492                 request->n_channels = n_channels;
2493                 i = 0;
2494                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
2495                         request->channels[i] = ieee80211_get_channel(wiphy, nla_get_u32(attr));
2496                         if (!request->channels[i]) {
2497                                 err = -EINVAL;
2498                                 goto out_free;
2499                         }
2500                         i++;
2501                 }
2502         } else {
2503                 /* all channels */
2504                 i = 0;
2505                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
2506                         int j;
2507                         if (!wiphy->bands[band])
2508                                 continue;
2509                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
2510                                 request->channels[i] = &wiphy->bands[band]->channels[j];
2511                                 i++;
2512                         }
2513                 }
2514         }
2515
2516         i = 0;
2517         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
2518                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
2519                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
2520                                 err = -EINVAL;
2521                                 goto out_free;
2522                         }
2523                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
2524                         request->ssids[i].ssid_len = nla_len(attr);
2525                         i++;
2526                 }
2527         }
2528
2529         if (info->attrs[NL80211_ATTR_IE]) {
2530                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2531                 memcpy(request->ie, nla_data(info->attrs[NL80211_ATTR_IE]),
2532                        request->ie_len);
2533         }
2534
2535         request->ifidx = dev->ifindex;
2536         request->wiphy = &drv->wiphy;
2537
2538         drv->scan_req = request;
2539         err = drv->ops->scan(&drv->wiphy, dev, request);
2540
2541  out_free:
2542         if (err) {
2543                 drv->scan_req = NULL;
2544                 kfree(request);
2545         }
2546  out:
2547         cfg80211_put_dev(drv);
2548         dev_put(dev);
2549  out_rtnl:
2550         rtnl_unlock();
2551
2552         return err;
2553 }
2554
2555 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
2556                             struct cfg80211_registered_device *rdev,
2557                             struct net_device *dev,
2558                             struct cfg80211_bss *res)
2559 {
2560         void *hdr;
2561         struct nlattr *bss;
2562
2563         hdr = nl80211hdr_put(msg, pid, seq, flags,
2564                              NL80211_CMD_NEW_SCAN_RESULTS);
2565         if (!hdr)
2566                 return -1;
2567
2568         NLA_PUT_U32(msg, NL80211_ATTR_SCAN_GENERATION,
2569                     rdev->bss_generation);
2570         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2571
2572         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
2573         if (!bss)
2574                 goto nla_put_failure;
2575         if (!is_zero_ether_addr(res->bssid))
2576                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
2577         if (res->information_elements && res->len_information_elements)
2578                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
2579                         res->len_information_elements,
2580                         res->information_elements);
2581         if (res->tsf)
2582                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
2583         if (res->beacon_interval)
2584                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
2585         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
2586         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
2587
2588         switch (rdev->wiphy.signal_type) {
2589         case CFG80211_SIGNAL_TYPE_MBM:
2590                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
2591                 break;
2592         case CFG80211_SIGNAL_TYPE_UNSPEC:
2593                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
2594                 break;
2595         default:
2596                 break;
2597         }
2598
2599         nla_nest_end(msg, bss);
2600
2601         return genlmsg_end(msg, hdr);
2602
2603  nla_put_failure:
2604         genlmsg_cancel(msg, hdr);
2605         return -EMSGSIZE;
2606 }
2607
2608 static int nl80211_dump_scan(struct sk_buff *skb,
2609                              struct netlink_callback *cb)
2610 {
2611         struct cfg80211_registered_device *dev;
2612         struct net_device *netdev;
2613         struct cfg80211_internal_bss *scan;
2614         int ifidx = cb->args[0];
2615         int start = cb->args[1], idx = 0;
2616         int err;
2617
2618         if (!ifidx) {
2619                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
2620                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
2621                                   nl80211_policy);
2622                 if (err)
2623                         return err;
2624
2625                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
2626                         return -EINVAL;
2627
2628                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
2629                 if (!ifidx)
2630                         return -EINVAL;
2631                 cb->args[0] = ifidx;
2632         }
2633
2634         netdev = dev_get_by_index(&init_net, ifidx);
2635         if (!netdev)
2636                 return -ENODEV;
2637
2638         dev = cfg80211_get_dev_from_ifindex(ifidx);
2639         if (IS_ERR(dev)) {
2640                 err = PTR_ERR(dev);
2641                 goto out_put_netdev;
2642         }
2643
2644         spin_lock_bh(&dev->bss_lock);
2645         cfg80211_bss_expire(dev);
2646
2647         list_for_each_entry(scan, &dev->bss_list, list) {
2648                 if (++idx <= start)
2649                         continue;
2650                 if (nl80211_send_bss(skb,
2651                                 NETLINK_CB(cb->skb).pid,
2652                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2653                                 dev, netdev, &scan->pub) < 0) {
2654                         idx--;
2655                         goto out;
2656                 }
2657         }
2658
2659  out:
2660         spin_unlock_bh(&dev->bss_lock);
2661
2662         cb->args[1] = idx;
2663         err = skb->len;
2664         cfg80211_put_dev(dev);
2665  out_put_netdev:
2666         dev_put(netdev);
2667
2668         return err;
2669 }
2670
2671 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
2672 {
2673         return auth_type == NL80211_AUTHTYPE_OPEN_SYSTEM ||
2674                 auth_type == NL80211_AUTHTYPE_SHARED_KEY ||
2675                 auth_type == NL80211_AUTHTYPE_FT ||
2676                 auth_type == NL80211_AUTHTYPE_NETWORK_EAP;
2677 }
2678
2679 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
2680 {
2681         struct cfg80211_registered_device *drv;
2682         struct net_device *dev;
2683         struct cfg80211_auth_request req;
2684         struct wiphy *wiphy;
2685         int err;
2686
2687         rtnl_lock();
2688
2689         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2690         if (err)
2691                 goto unlock_rtnl;
2692
2693         if (!drv->ops->auth) {
2694                 err = -EOPNOTSUPP;
2695                 goto out;
2696         }
2697
2698         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
2699                 err = -EOPNOTSUPP;
2700                 goto out;
2701         }
2702
2703         if (!netif_running(dev)) {
2704                 err = -ENETDOWN;
2705                 goto out;
2706         }
2707
2708         if (!info->attrs[NL80211_ATTR_MAC]) {
2709                 err = -EINVAL;
2710                 goto out;
2711         }
2712
2713         wiphy = &drv->wiphy;
2714         memset(&req, 0, sizeof(req));
2715
2716         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2717
2718         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2719                 req.chan = ieee80211_get_channel(
2720                         wiphy,
2721                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
2722                 if (!req.chan) {
2723                         err = -EINVAL;
2724                         goto out;
2725                 }
2726         }
2727
2728         if (info->attrs[NL80211_ATTR_SSID]) {
2729                 req.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2730                 req.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
2731         }
2732
2733         if (info->attrs[NL80211_ATTR_IE]) {
2734                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
2735                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2736         }
2737
2738         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
2739                 req.auth_type =
2740                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
2741                 if (!nl80211_valid_auth_type(req.auth_type)) {
2742                         err = -EINVAL;
2743                         goto out;
2744                 }
2745         }
2746
2747         err = drv->ops->auth(&drv->wiphy, dev, &req);
2748
2749 out:
2750         cfg80211_put_dev(drv);
2751         dev_put(dev);
2752 unlock_rtnl:
2753         rtnl_unlock();
2754         return err;
2755 }
2756
2757 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
2758 {
2759         struct cfg80211_registered_device *drv;
2760         struct net_device *dev;
2761         struct cfg80211_assoc_request req;
2762         struct wiphy *wiphy;
2763         int err;
2764
2765         rtnl_lock();
2766
2767         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2768         if (err)
2769                 goto unlock_rtnl;
2770
2771         if (!drv->ops->assoc) {
2772                 err = -EOPNOTSUPP;
2773                 goto out;
2774         }
2775
2776         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
2777                 err = -EOPNOTSUPP;
2778                 goto out;
2779         }
2780
2781         if (!netif_running(dev)) {
2782                 err = -ENETDOWN;
2783                 goto out;
2784         }
2785
2786         if (!info->attrs[NL80211_ATTR_MAC] ||
2787             !info->attrs[NL80211_ATTR_SSID]) {
2788                 err = -EINVAL;
2789                 goto out;
2790         }
2791
2792         wiphy = &drv->wiphy;
2793         memset(&req, 0, sizeof(req));
2794
2795         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2796
2797         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2798                 req.chan = ieee80211_get_channel(
2799                         wiphy,
2800                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
2801                 if (!req.chan) {
2802                         err = -EINVAL;
2803                         goto out;
2804                 }
2805         }
2806
2807         req.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2808         req.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
2809
2810         if (info->attrs[NL80211_ATTR_IE]) {
2811                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
2812                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2813         }
2814
2815         err = drv->ops->assoc(&drv->wiphy, dev, &req);
2816
2817 out:
2818         cfg80211_put_dev(drv);
2819         dev_put(dev);
2820 unlock_rtnl:
2821         rtnl_unlock();
2822         return err;
2823 }
2824
2825 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
2826 {
2827         struct cfg80211_registered_device *drv;
2828         struct net_device *dev;
2829         struct cfg80211_deauth_request req;
2830         struct wiphy *wiphy;
2831         int err;
2832
2833         rtnl_lock();
2834
2835         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2836         if (err)
2837                 goto unlock_rtnl;
2838
2839         if (!drv->ops->deauth) {
2840                 err = -EOPNOTSUPP;
2841                 goto out;
2842         }
2843
2844         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
2845                 err = -EOPNOTSUPP;
2846                 goto out;
2847         }
2848
2849         if (!netif_running(dev)) {
2850                 err = -ENETDOWN;
2851                 goto out;
2852         }
2853
2854         if (!info->attrs[NL80211_ATTR_MAC]) {
2855                 err = -EINVAL;
2856                 goto out;
2857         }
2858
2859         wiphy = &drv->wiphy;
2860         memset(&req, 0, sizeof(req));
2861
2862         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2863
2864         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
2865                 req.reason_code =
2866                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
2867                 if (req.reason_code == 0) {
2868                         /* Reason Code 0 is reserved */
2869                         err = -EINVAL;
2870                         goto out;
2871                 }
2872         }
2873
2874         if (info->attrs[NL80211_ATTR_IE]) {
2875                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
2876                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2877         }
2878
2879         err = drv->ops->deauth(&drv->wiphy, dev, &req);
2880
2881 out:
2882         cfg80211_put_dev(drv);
2883         dev_put(dev);
2884 unlock_rtnl:
2885         rtnl_unlock();
2886         return err;
2887 }
2888
2889 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
2890 {
2891         struct cfg80211_registered_device *drv;
2892         struct net_device *dev;
2893         struct cfg80211_disassoc_request req;
2894         struct wiphy *wiphy;
2895         int err;
2896
2897         rtnl_lock();
2898
2899         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2900         if (err)
2901                 goto unlock_rtnl;
2902
2903         if (!drv->ops->disassoc) {
2904                 err = -EOPNOTSUPP;
2905                 goto out;
2906         }
2907
2908         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
2909                 err = -EOPNOTSUPP;
2910                 goto out;
2911         }
2912
2913         if (!netif_running(dev)) {
2914                 err = -ENETDOWN;
2915                 goto out;
2916         }
2917
2918         if (!info->attrs[NL80211_ATTR_MAC]) {
2919                 err = -EINVAL;
2920                 goto out;
2921         }
2922
2923         wiphy = &drv->wiphy;
2924         memset(&req, 0, sizeof(req));
2925
2926         req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2927
2928         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
2929                 req.reason_code =
2930                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
2931                 if (req.reason_code == 0) {
2932                         /* Reason Code 0 is reserved */
2933                         err = -EINVAL;
2934                         goto out;
2935                 }
2936         }
2937
2938         if (info->attrs[NL80211_ATTR_IE]) {
2939                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
2940                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2941         }
2942
2943         err = drv->ops->disassoc(&drv->wiphy, dev, &req);
2944
2945 out:
2946         cfg80211_put_dev(drv);
2947         dev_put(dev);
2948 unlock_rtnl:
2949         rtnl_unlock();
2950         return err;
2951 }
2952
2953 static struct genl_ops nl80211_ops[] = {
2954         {
2955                 .cmd = NL80211_CMD_GET_WIPHY,
2956                 .doit = nl80211_get_wiphy,
2957                 .dumpit = nl80211_dump_wiphy,
2958                 .policy = nl80211_policy,
2959                 /* can be retrieved by unprivileged users */
2960         },
2961         {
2962                 .cmd = NL80211_CMD_SET_WIPHY,
2963                 .doit = nl80211_set_wiphy,
2964                 .policy = nl80211_policy,
2965                 .flags = GENL_ADMIN_PERM,
2966         },
2967         {
2968                 .cmd = NL80211_CMD_GET_INTERFACE,
2969                 .doit = nl80211_get_interface,
2970                 .dumpit = nl80211_dump_interface,
2971                 .policy = nl80211_policy,
2972                 /* can be retrieved by unprivileged users */
2973         },
2974         {
2975                 .cmd = NL80211_CMD_SET_INTERFACE,
2976                 .doit = nl80211_set_interface,
2977                 .policy = nl80211_policy,
2978                 .flags = GENL_ADMIN_PERM,
2979         },
2980         {
2981                 .cmd = NL80211_CMD_NEW_INTERFACE,
2982                 .doit = nl80211_new_interface,
2983                 .policy = nl80211_policy,
2984                 .flags = GENL_ADMIN_PERM,
2985         },
2986         {
2987                 .cmd = NL80211_CMD_DEL_INTERFACE,
2988                 .doit = nl80211_del_interface,
2989                 .policy = nl80211_policy,
2990                 .flags = GENL_ADMIN_PERM,
2991         },
2992         {
2993                 .cmd = NL80211_CMD_GET_KEY,
2994                 .doit = nl80211_get_key,
2995                 .policy = nl80211_policy,
2996                 .flags = GENL_ADMIN_PERM,
2997         },
2998         {
2999                 .cmd = NL80211_CMD_SET_KEY,
3000                 .doit = nl80211_set_key,
3001                 .policy = nl80211_policy,
3002                 .flags = GENL_ADMIN_PERM,
3003         },
3004         {
3005                 .cmd = NL80211_CMD_NEW_KEY,
3006                 .doit = nl80211_new_key,
3007                 .policy = nl80211_policy,
3008                 .flags = GENL_ADMIN_PERM,
3009         },
3010         {
3011                 .cmd = NL80211_CMD_DEL_KEY,
3012                 .doit = nl80211_del_key,
3013                 .policy = nl80211_policy,
3014                 .flags = GENL_ADMIN_PERM,
3015         },
3016         {
3017                 .cmd = NL80211_CMD_SET_BEACON,
3018                 .policy = nl80211_policy,
3019                 .flags = GENL_ADMIN_PERM,
3020                 .doit = nl80211_addset_beacon,
3021         },
3022         {
3023                 .cmd = NL80211_CMD_NEW_BEACON,
3024                 .policy = nl80211_policy,
3025                 .flags = GENL_ADMIN_PERM,
3026                 .doit = nl80211_addset_beacon,
3027         },
3028         {
3029                 .cmd = NL80211_CMD_DEL_BEACON,
3030                 .policy = nl80211_policy,
3031                 .flags = GENL_ADMIN_PERM,
3032                 .doit = nl80211_del_beacon,
3033         },
3034         {
3035                 .cmd = NL80211_CMD_GET_STATION,
3036                 .doit = nl80211_get_station,
3037                 .dumpit = nl80211_dump_station,
3038                 .policy = nl80211_policy,
3039         },
3040         {
3041                 .cmd = NL80211_CMD_SET_STATION,
3042                 .doit = nl80211_set_station,
3043                 .policy = nl80211_policy,
3044                 .flags = GENL_ADMIN_PERM,
3045         },
3046         {
3047                 .cmd = NL80211_CMD_NEW_STATION,
3048                 .doit = nl80211_new_station,
3049                 .policy = nl80211_policy,
3050                 .flags = GENL_ADMIN_PERM,
3051         },
3052         {
3053                 .cmd = NL80211_CMD_DEL_STATION,
3054                 .doit = nl80211_del_station,
3055                 .policy = nl80211_policy,
3056                 .flags = GENL_ADMIN_PERM,
3057         },
3058         {
3059                 .cmd = NL80211_CMD_GET_MPATH,
3060                 .doit = nl80211_get_mpath,
3061                 .dumpit = nl80211_dump_mpath,
3062                 .policy = nl80211_policy,
3063                 .flags = GENL_ADMIN_PERM,
3064         },
3065         {
3066                 .cmd = NL80211_CMD_SET_MPATH,
3067                 .doit = nl80211_set_mpath,
3068                 .policy = nl80211_policy,
3069                 .flags = GENL_ADMIN_PERM,
3070         },
3071         {
3072                 .cmd = NL80211_CMD_NEW_MPATH,
3073                 .doit = nl80211_new_mpath,
3074                 .policy = nl80211_policy,
3075                 .flags = GENL_ADMIN_PERM,
3076         },
3077         {
3078                 .cmd = NL80211_CMD_DEL_MPATH,
3079                 .doit = nl80211_del_mpath,
3080                 .policy = nl80211_policy,
3081                 .flags = GENL_ADMIN_PERM,
3082         },
3083         {
3084                 .cmd = NL80211_CMD_SET_BSS,
3085                 .doit = nl80211_set_bss,
3086                 .policy = nl80211_policy,
3087                 .flags = GENL_ADMIN_PERM,
3088         },
3089         {
3090                 .cmd = NL80211_CMD_GET_REG,
3091                 .doit = nl80211_get_reg,
3092                 .policy = nl80211_policy,
3093                 /* can be retrieved by unprivileged users */
3094         },
3095         {
3096                 .cmd = NL80211_CMD_SET_REG,
3097                 .doit = nl80211_set_reg,
3098                 .policy = nl80211_policy,
3099                 .flags = GENL_ADMIN_PERM,
3100         },
3101         {
3102                 .cmd = NL80211_CMD_REQ_SET_REG,
3103                 .doit = nl80211_req_set_reg,
3104                 .policy = nl80211_policy,
3105                 .flags = GENL_ADMIN_PERM,
3106         },
3107         {
3108                 .cmd = NL80211_CMD_GET_MESH_PARAMS,
3109                 .doit = nl80211_get_mesh_params,
3110                 .policy = nl80211_policy,
3111                 /* can be retrieved by unprivileged users */
3112         },
3113         {
3114                 .cmd = NL80211_CMD_SET_MESH_PARAMS,
3115                 .doit = nl80211_set_mesh_params,
3116                 .policy = nl80211_policy,
3117                 .flags = GENL_ADMIN_PERM,
3118         },
3119         {
3120                 .cmd = NL80211_CMD_TRIGGER_SCAN,
3121                 .doit = nl80211_trigger_scan,
3122                 .policy = nl80211_policy,
3123                 .flags = GENL_ADMIN_PERM,
3124         },
3125         {
3126                 .cmd = NL80211_CMD_GET_SCAN,
3127                 .policy = nl80211_policy,
3128                 .dumpit = nl80211_dump_scan,
3129         },
3130         {
3131                 .cmd = NL80211_CMD_AUTHENTICATE,
3132                 .doit = nl80211_authenticate,
3133                 .policy = nl80211_policy,
3134                 .flags = GENL_ADMIN_PERM,
3135         },
3136         {
3137                 .cmd = NL80211_CMD_ASSOCIATE,
3138                 .doit = nl80211_associate,
3139                 .policy = nl80211_policy,
3140                 .flags = GENL_ADMIN_PERM,
3141         },
3142         {
3143                 .cmd = NL80211_CMD_DEAUTHENTICATE,
3144                 .doit = nl80211_deauthenticate,
3145                 .policy = nl80211_policy,
3146                 .flags = GENL_ADMIN_PERM,
3147         },
3148         {
3149                 .cmd = NL80211_CMD_DISASSOCIATE,
3150                 .doit = nl80211_disassociate,
3151                 .policy = nl80211_policy,
3152                 .flags = GENL_ADMIN_PERM,
3153         },
3154 };
3155 static struct genl_multicast_group nl80211_mlme_mcgrp = {
3156         .name = "mlme",
3157 };
3158
3159 /* multicast groups */
3160 static struct genl_multicast_group nl80211_config_mcgrp = {
3161         .name = "config",
3162 };
3163 static struct genl_multicast_group nl80211_scan_mcgrp = {
3164         .name = "scan",
3165 };
3166 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
3167         .name = "regulatory",
3168 };
3169
3170 /* notification functions */
3171
3172 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
3173 {
3174         struct sk_buff *msg;
3175
3176         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3177         if (!msg)
3178                 return;
3179
3180         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
3181                 nlmsg_free(msg);
3182                 return;
3183         }
3184
3185         genlmsg_multicast(msg, 0, nl80211_config_mcgrp.id, GFP_KERNEL);
3186 }
3187
3188 static int nl80211_send_scan_donemsg(struct sk_buff *msg,
3189                                     struct cfg80211_registered_device *rdev,
3190                                     struct net_device *netdev,
3191                                     u32 pid, u32 seq, int flags,
3192                                     u32 cmd)
3193 {
3194         void *hdr;
3195
3196         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
3197         if (!hdr)
3198                 return -1;
3199
3200         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3201         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3202
3203         /* XXX: we should probably bounce back the request? */
3204
3205         return genlmsg_end(msg, hdr);
3206
3207  nla_put_failure:
3208         genlmsg_cancel(msg, hdr);
3209         return -EMSGSIZE;
3210 }
3211
3212 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
3213                             struct net_device *netdev)
3214 {
3215         struct sk_buff *msg;
3216
3217         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3218         if (!msg)
3219                 return;
3220
3221         if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
3222                                       NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
3223                 nlmsg_free(msg);
3224                 return;
3225         }
3226
3227         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
3228 }
3229
3230 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
3231                                struct net_device *netdev)
3232 {
3233         struct sk_buff *msg;
3234
3235         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3236         if (!msg)
3237                 return;
3238
3239         if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
3240                                       NL80211_CMD_SCAN_ABORTED) < 0) {
3241                 nlmsg_free(msg);
3242                 return;
3243         }
3244
3245         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
3246 }
3247
3248 /*
3249  * This can happen on global regulatory changes or device specific settings
3250  * based on custom world regulatory domains.
3251  */
3252 void nl80211_send_reg_change_event(struct regulatory_request *request)
3253 {
3254         struct sk_buff *msg;
3255         void *hdr;
3256
3257         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3258         if (!msg)
3259                 return;
3260
3261         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
3262         if (!hdr) {
3263                 nlmsg_free(msg);
3264                 return;
3265         }
3266
3267         /* Userspace can always count this one always being set */
3268         NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
3269
3270         if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
3271                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3272                            NL80211_REGDOM_TYPE_WORLD);
3273         else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
3274                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3275                            NL80211_REGDOM_TYPE_CUSTOM_WORLD);
3276         else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
3277                  request->intersect)
3278                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3279                            NL80211_REGDOM_TYPE_INTERSECTION);
3280         else {
3281                 NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3282                            NL80211_REGDOM_TYPE_COUNTRY);
3283                 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
3284         }
3285
3286         if (wiphy_idx_valid(request->wiphy_idx))
3287                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
3288
3289         if (genlmsg_end(msg, hdr) < 0) {
3290                 nlmsg_free(msg);
3291                 return;
3292         }
3293
3294         genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_KERNEL);
3295
3296         return;
3297
3298 nla_put_failure:
3299         genlmsg_cancel(msg, hdr);
3300         nlmsg_free(msg);
3301 }
3302
3303 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
3304                                     struct net_device *netdev,
3305                                     const u8 *buf, size_t len,
3306                                     enum nl80211_commands cmd)
3307 {
3308         struct sk_buff *msg;
3309         void *hdr;
3310
3311         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3312         if (!msg)
3313                 return;
3314
3315         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
3316         if (!hdr) {
3317                 nlmsg_free(msg);
3318                 return;
3319         }
3320
3321         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3322         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3323         NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
3324
3325         if (genlmsg_end(msg, hdr) < 0) {
3326                 nlmsg_free(msg);
3327                 return;
3328         }
3329
3330         genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_KERNEL);
3331         return;
3332
3333  nla_put_failure:
3334         genlmsg_cancel(msg, hdr);
3335         nlmsg_free(msg);
3336 }
3337
3338 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
3339                           struct net_device *netdev, const u8 *buf, size_t len)
3340 {
3341         nl80211_send_mlme_event(rdev, netdev, buf, len,
3342                                 NL80211_CMD_AUTHENTICATE);
3343 }
3344
3345 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
3346                            struct net_device *netdev, const u8 *buf,
3347                            size_t len)
3348 {
3349         nl80211_send_mlme_event(rdev, netdev, buf, len, NL80211_CMD_ASSOCIATE);
3350 }
3351
3352 void nl80211_send_rx_deauth(struct cfg80211_registered_device *rdev,
3353                             struct net_device *netdev, const u8 *buf,
3354                             size_t len)
3355 {
3356         nl80211_send_mlme_event(rdev, netdev, buf, len,
3357                                 NL80211_CMD_DEAUTHENTICATE);
3358 }
3359
3360 void nl80211_send_rx_disassoc(struct cfg80211_registered_device *rdev,
3361                               struct net_device *netdev, const u8 *buf,
3362                               size_t len)
3363 {
3364         nl80211_send_mlme_event(rdev, netdev, buf, len,
3365                                 NL80211_CMD_DISASSOCIATE);
3366 }
3367
3368 /* initialisation/exit functions */
3369
3370 int nl80211_init(void)
3371 {
3372         int err, i;
3373
3374         err = genl_register_family(&nl80211_fam);
3375         if (err)
3376                 return err;
3377
3378         for (i = 0; i < ARRAY_SIZE(nl80211_ops); i++) {
3379                 err = genl_register_ops(&nl80211_fam, &nl80211_ops[i]);
3380                 if (err)
3381                         goto err_out;
3382         }
3383
3384         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
3385         if (err)
3386                 goto err_out;
3387
3388         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
3389         if (err)
3390                 goto err_out;
3391
3392         err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
3393         if (err)
3394                 goto err_out;
3395
3396         err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
3397         if (err)
3398                 goto err_out;
3399
3400         return 0;
3401  err_out:
3402         genl_unregister_family(&nl80211_fam);
3403         return err;
3404 }
3405
3406 void nl80211_exit(void)
3407 {
3408         genl_unregister_family(&nl80211_fam);
3409 }