net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006, 2007 Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/list.h>
  11 #include <linux/if_ether.h>
  12 #include <linux/ieee80211.h>
  13 #include <linux/nl80211.h>
  14 #include <linux/rtnetlink.h>
  15 #include <linux/netlink.h>
  16 #include <linux/etherdevice.h>
  17 #include <net/genetlink.h>
  18 #include <net/cfg80211.h>
  19 #include "core.h"
  20 #include "nl80211.h"
  21 #include "reg.h"
  22
  23 /* the netlink family */
  24 static struct genl_family nl80211_fam = {
  25         .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
  26         .name = "nl80211",      /* have users key off the name instead */
  27         .hdrsize = 0,           /* no private header */
  28         .version = 1,           /* no particular meaning now */
  29         .maxattr = NL80211_ATTR_MAX,
  30 };
  31
  32 /* internal helper: get drv and dev */
  33 static int get_drv_dev_by_info_ifindex(struct nlattr **attrs,
  34                                        struct cfg80211_registered_device **drv,
  35                                        struct net_device **dev)
  36 {
  37         int ifindex;
  38
  39         if (!attrs[NL80211_ATTR_IFINDEX])
  40                 return -EINVAL;
  41
  42         ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  43         *dev = dev_get_by_index(&init_net, ifindex);
  44         if (!*dev)
  45                 return -ENODEV;
  46
  47         *drv = cfg80211_get_dev_from_ifindex(ifindex);
  48         if (IS_ERR(*drv)) {
  49                 dev_put(*dev);
  50                 return PTR_ERR(*drv);
  51         }
  52
  53         return 0;
  54 }
  55
  56 /* policy for the attributes */
  57 static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
  58         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  59         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  60                                       .len = BUS_ID_SIZE-1 },
  61         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  62         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  63         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  64
  65         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
  66         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  67         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  68
  69         [NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
  70
  71         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  72                                     .len = WLAN_MAX_KEY_LEN },
  73         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
  74         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  75         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
  76
  77         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
  78         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
  79         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
  80                                        .len = IEEE80211_MAX_DATA_LEN },
  81         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
  82                                        .len = IEEE80211_MAX_DATA_LEN },
  83         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
  84         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
  85         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
  86         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
  87                                                .len = NL80211_MAX_SUPP_RATES },
  88         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
  89         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
  90         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
  91         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
  92                                 .len = IEEE80211_MAX_MESH_ID_LEN },
  93         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
  94
  95         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
  96         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
  97
  98         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
  99         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 100         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 101         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 102                                            .len = NL80211_MAX_SUPP_RATES },
 103
 104         [NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
 105
 106         [NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
 107                                          .len = NL80211_HT_CAPABILITY_LEN },
 108
 109         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 110         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 111                               .len = IEEE80211_MAX_DATA_LEN },
 112         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 113         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 114 };
 115
 116 /* message building helper */
 117 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
 118                                    int flags, u8 cmd)
 119 {
 120         /* since there is no private header just add the generic one */
 121         return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
 122 }
 123
 124 /* netlink command implementations */
 125
 126 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 127                               struct cfg80211_registered_device *dev)
 128 {
 129         void *hdr;
 130         struct nlattr *nl_bands, *nl_band;
 131         struct nlattr *nl_freqs, *nl_freq;
 132         struct nlattr *nl_rates, *nl_rate;
 133         struct nlattr *nl_modes;
 134         enum ieee80211_band band;
 135         struct ieee80211_channel *chan;
 136         struct ieee80211_rate *rate;
 137         int i;
 138         u16 ifmodes = dev->wiphy.interface_modes;
 139
 140         assert_cfg80211_lock();
 141
 142         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
 143         if (!hdr)
 144                 return -1;
 145
 146         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
 147         NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
 148         NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 149                    dev->wiphy.max_scan_ssids);
 150
 151         nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
 152         if (!nl_modes)
 153                 goto nla_put_failure;
 154
 155         i = 0;
 156         while (ifmodes) {
 157                 if (ifmodes & 1)
 158                         NLA_PUT_FLAG(msg, i);
 159                 ifmodes >>= 1;
 160                 i++;
 161         }
 162
 163         nla_nest_end(msg, nl_modes);
 164
 165         nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
 166         if (!nl_bands)
 167                 goto nla_put_failure;
 168
 169         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
 170                 if (!dev->wiphy.bands[band])
 171                         continue;
 172
 173                 nl_band = nla_nest_start(msg, band);
 174                 if (!nl_band)
 175                         goto nla_put_failure;
 176
 177                 /* add HT info */
 178                 if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
 179                         NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 180                                 sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
 181                                 &dev->wiphy.bands[band]->ht_cap.mcs);
 182                         NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
 183                                 dev->wiphy.bands[band]->ht_cap.cap);
 184                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 185                                 dev->wiphy.bands[band]->ht_cap.ampdu_factor);
 186                         NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 187                                 dev->wiphy.bands[band]->ht_cap.ampdu_density);
 188                 }
 189
 190                 /* add frequencies */
 191                 nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
 192                 if (!nl_freqs)
 193                         goto nla_put_failure;
 194
 195                 for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
 196                         nl_freq = nla_nest_start(msg, i);
 197                         if (!nl_freq)
 198                                 goto nla_put_failure;
 199
 200                         chan = &dev->wiphy.bands[band]->channels[i];
 201                         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 202                                     chan->center_freq);
 203
 204                         if (chan->flags & IEEE80211_CHAN_DISABLED)
 205                                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
 206                         if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
 207                                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
 208                         if (chan->flags & IEEE80211_CHAN_NO_IBSS)
 209                                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
 210                         if (chan->flags & IEEE80211_CHAN_RADAR)
 211                                 NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
 212
 213                         NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 214                                     DBM_TO_MBM(chan->max_power));
 215
 216                         nla_nest_end(msg, nl_freq);
 217                 }
 218
 219                 nla_nest_end(msg, nl_freqs);
 220
 221                 /* add bitrates */
 222                 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
 223                 if (!nl_rates)
 224                         goto nla_put_failure;
 225
 226                 for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
 227                         nl_rate = nla_nest_start(msg, i);
 228                         if (!nl_rate)
 229                                 goto nla_put_failure;
 230
 231                         rate = &dev->wiphy.bands[band]->bitrates[i];
 232                         NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
 233                                     rate->bitrate);
 234                         if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
 235                                 NLA_PUT_FLAG(msg,
 236                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
 237
 238                         nla_nest_end(msg, nl_rate);
 239                 }
 240
 241                 nla_nest_end(msg, nl_rates);
 242
 243                 nla_nest_end(msg, nl_band);
 244         }
 245         nla_nest_end(msg, nl_bands);
 246
 247         return genlmsg_end(msg, hdr);
 248
 249  nla_put_failure:
 250         genlmsg_cancel(msg, hdr);
 251         return -EMSGSIZE;
 252 }
 253
 254 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 255 {
 256         int idx = 0;
 257         int start = cb->args[0];
 258         struct cfg80211_registered_device *dev;
 259
 260         mutex_lock(&cfg80211_mutex);
 261         list_for_each_entry(dev, &cfg80211_drv_list, list) {
 262                 if (++idx <= start)
 263                         continue;
 264                 if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
 265                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
 266                                        dev) < 0) {
 267                         idx--;
 268                         break;
 269                 }
 270         }
 271         mutex_unlock(&cfg80211_mutex);
 272
 273         cb->args[0] = idx;
 274
 275         return skb->len;
 276 }
 277
 278 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 279 {
 280         struct sk_buff *msg;
 281         struct cfg80211_registered_device *dev;
 282
 283         dev = cfg80211_get_dev_from_info(info);
 284         if (IS_ERR(dev))
 285                 return PTR_ERR(dev);
 286
 287         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 288         if (!msg)
 289                 goto out_err;
 290
 291         if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
 292                 goto out_free;
 293
 294         cfg80211_put_dev(dev);
 295
 296         return genlmsg_unicast(msg, info->snd_pid);
 297
 298  out_free:
 299         nlmsg_free(msg);
 300  out_err:
 301         cfg80211_put_dev(dev);
 302         return -ENOBUFS;
 303 }
 304
 305 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 306         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
 307         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
 308         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
 309         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
 310         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
 311 };
 312
 313 static int parse_txq_params(struct nlattr *tb[],
 314                             struct ieee80211_txq_params *txq_params)
 315 {
 316         if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 317             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 318             !tb[NL80211_TXQ_ATTR_AIFS])
 319                 return -EINVAL;
 320
 321         txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
 322         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 323         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 324         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 325         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 326
 327         return 0;
 328 }
 329
 330 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 331 {
 332         struct cfg80211_registered_device *rdev;
 333         int result = 0, rem_txq_params = 0;
 334         struct nlattr *nl_txq_params;
 335
 336         rdev = cfg80211_get_dev_from_info(info);
 337         if (IS_ERR(rdev))
 338                 return PTR_ERR(rdev);
 339
 340         if (info->attrs[NL80211_ATTR_WIPHY_NAME]) {
 341                 result = cfg80211_dev_rename(
 342                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 343                 if (result)
 344                         goto bad_res;
 345         }
 346
 347         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
 348                 struct ieee80211_txq_params txq_params;
 349                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
 350
 351                 if (!rdev->ops->set_txq_params) {
 352                         result = -EOPNOTSUPP;
 353                         goto bad_res;
 354                 }
 355
 356                 nla_for_each_nested(nl_txq_params,
 357                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
 358                                     rem_txq_params) {
 359                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
 360                                   nla_data(nl_txq_params),
 361                                   nla_len(nl_txq_params),
 362                                   txq_params_policy);
 363                         result = parse_txq_params(tb, &txq_params);
 364                         if (result)
 365                                 goto bad_res;
 366
 367                         result = rdev->ops->set_txq_params(&rdev->wiphy,
 368                                                            &txq_params);
 369                         if (result)
 370                                 goto bad_res;
 371                 }
 372         }
 373
 374         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
 375                 enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
 376                 struct ieee80211_channel *chan;
 377                 struct ieee80211_sta_ht_cap *ht_cap;
 378                 u32 freq, sec_freq;
 379
 380                 if (!rdev->ops->set_channel) {
 381                         result = -EOPNOTSUPP;
 382                         goto bad_res;
 383                 }
 384
 385                 result = -EINVAL;
 386
 387                 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 388                         channel_type = nla_get_u32(info->attrs[
 389                                            NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 390                         if (channel_type != NL80211_CHAN_NO_HT &&
 391                             channel_type != NL80211_CHAN_HT20 &&
 392                             channel_type != NL80211_CHAN_HT40PLUS &&
 393                             channel_type != NL80211_CHAN_HT40MINUS)
 394                                 goto bad_res;
 395                 }
 396
 397                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
 398                 chan = ieee80211_get_channel(&rdev->wiphy, freq);
 399
 400                 /* Primary channel not allowed */
 401                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 402                         goto bad_res;
 403
 404                 if (channel_type == NL80211_CHAN_HT40MINUS)
 405                         sec_freq = freq - 20;
 406                 else if (channel_type == NL80211_CHAN_HT40PLUS)
 407                         sec_freq = freq + 20;
 408                 else
 409                         sec_freq = 0;
 410
 411                 ht_cap = &rdev->wiphy.bands[chan->band]->ht_cap;
 412
 413                 /* no HT capabilities */
 414                 if (channel_type != NL80211_CHAN_NO_HT &&
 415                     !ht_cap->ht_supported)
 416                         goto bad_res;
 417
 418                 if (sec_freq) {
 419                         struct ieee80211_channel *schan;
 420
 421                         /* no 40 MHz capabilities */
 422                         if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
 423                             (ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT))
 424                                 goto bad_res;
 425
 426                         schan = ieee80211_get_channel(&rdev->wiphy, sec_freq);
 427
 428                         /* Secondary channel not allowed */
 429                         if (!schan || schan->flags & IEEE80211_CHAN_DISABLED)
 430                                 goto bad_res;
 431                 }
 432
 433                 result = rdev->ops->set_channel(&rdev->wiphy, chan,
 434                                                 channel_type);
 435                 if (result)
 436                         goto bad_res;
 437         }
 438
 439
 440  bad_res:
 441         cfg80211_put_dev(rdev);
 442         return result;
 443 }
 444
 445
 446 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
 447                               struct net_device *dev)
 448 {
 449         void *hdr;
 450
 451         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
 452         if (!hdr)
 453                 return -1;
 454
 455         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 456         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
 457         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
 458         return genlmsg_end(msg, hdr);
 459
 460  nla_put_failure:
 461         genlmsg_cancel(msg, hdr);
 462         return -EMSGSIZE;
 463 }
 464
 465 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
 466 {
 467         int wp_idx = 0;
 468         int if_idx = 0;
 469         int wp_start = cb->args[0];
 470         int if_start = cb->args[1];
 471         struct cfg80211_registered_device *dev;
 472         struct wireless_dev *wdev;
 473
 474         mutex_lock(&cfg80211_mutex);
 475         list_for_each_entry(dev, &cfg80211_drv_list, list) {
 476                 if (wp_idx < wp_start) {
 477                         wp_idx++;
 478                         continue;
 479                 }
 480                 if_idx = 0;
 481
 482                 mutex_lock(&dev->devlist_mtx);
 483                 list_for_each_entry(wdev, &dev->netdev_list, list) {
 484                         if (if_idx < if_start) {
 485                                 if_idx++;
 486                                 continue;
 487                         }
 488                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
 489                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
 490                                                wdev->netdev) < 0) {
 491                                 mutex_unlock(&dev->devlist_mtx);
 492                                 goto out;
 493                         }
 494                         if_idx++;
 495                 }
 496                 mutex_unlock(&dev->devlist_mtx);
 497
 498                 wp_idx++;
 499         }
 500  out:
 501         mutex_unlock(&cfg80211_mutex);
 502
 503         cb->args[0] = wp_idx;
 504         cb->args[1] = if_idx;
 505
 506         return skb->len;
 507 }
 508
 509 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
 510 {
 511         struct sk_buff *msg;
 512         struct cfg80211_registered_device *dev;
 513         struct net_device *netdev;
 514         int err;
 515
 516         err = get_drv_dev_by_info_ifindex(info->attrs, &dev, &netdev);
 517         if (err)
 518                 return err;
 519
 520         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 521         if (!msg)
 522                 goto out_err;
 523
 524         if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0, netdev) < 0)
 525                 goto out_free;
 526
 527         dev_put(netdev);
 528         cfg80211_put_dev(dev);
 529
 530         return genlmsg_unicast(msg, info->snd_pid);
 531
 532  out_free:
 533         nlmsg_free(msg);
 534  out_err:
 535         dev_put(netdev);
 536         cfg80211_put_dev(dev);
 537         return -ENOBUFS;
 538 }
 539
 540 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
 541         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
 542         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
 543         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
 544         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
 545         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
 546 };
 547
 548 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
 549 {
 550         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
 551         int flag;
 552
 553         *mntrflags = 0;
 554
 555         if (!nla)
 556                 return -EINVAL;
 557
 558         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
 559                              nla, mntr_flags_policy))
 560                 return -EINVAL;
 561
 562         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
 563                 if (flags[flag])
 564                         *mntrflags |= (1<<flag);
 565
 566         return 0;
 567 }
 568
 569 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 570 {
 571         struct cfg80211_registered_device *drv;
 572         struct vif_params params;
 573         int err, ifindex;
 574         enum nl80211_iftype type;
 575         struct net_device *dev;
 576         u32 _flags, *flags = NULL;
 577
 578         memset(&params, 0, sizeof(params));
 579
 580         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 581         if (err)
 582                 return err;
 583         ifindex = dev->ifindex;
 584         type = dev->ieee80211_ptr->iftype;
 585         dev_put(dev);
 586
 587         err = -EINVAL;
 588         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 589                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 590                 if (type > NL80211_IFTYPE_MAX)
 591                         goto unlock;
 592         }
 593
 594         if (!drv->ops->change_virtual_intf ||
 595             !(drv->wiphy.interface_modes & (1 << type))) {
 596                 err = -EOPNOTSUPP;
 597                 goto unlock;
 598         }
 599
 600         if (info->attrs[NL80211_ATTR_MESH_ID]) {
 601                 if (type != NL80211_IFTYPE_MESH_POINT) {
 602                         err = -EINVAL;
 603                         goto unlock;
 604                 }
 605                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 606                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 607         }
 608
 609         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
 610                 if (type != NL80211_IFTYPE_MONITOR) {
 611                         err = -EINVAL;
 612                         goto unlock;
 613                 }
 614                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
 615                                           &_flags);
 616                 if (!err)
 617                         flags = &_flags;
 618         }
 619         rtnl_lock();
 620         err = drv->ops->change_virtual_intf(&drv->wiphy, ifindex,
 621                                             type, flags, &params);
 622
 623         dev = __dev_get_by_index(&init_net, ifindex);
 624         WARN_ON(!dev || (!err && dev->ieee80211_ptr->iftype != type));
 625
 626         rtnl_unlock();
 627
 628  unlock:
 629         cfg80211_put_dev(drv);
 630         return err;
 631 }
 632
 633 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
 634 {
 635         struct cfg80211_registered_device *drv;
 636         struct vif_params params;
 637         int err;
 638         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
 639         u32 flags;
 640
 641         memset(&params, 0, sizeof(params));
 642
 643         if (!info->attrs[NL80211_ATTR_IFNAME])
 644                 return -EINVAL;
 645
 646         if (info->attrs[NL80211_ATTR_IFTYPE]) {
 647                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 648                 if (type > NL80211_IFTYPE_MAX)
 649                         return -EINVAL;
 650         }
 651
 652         drv = cfg80211_get_dev_from_info(info);
 653         if (IS_ERR(drv))
 654                 return PTR_ERR(drv);
 655
 656         if (!drv->ops->add_virtual_intf ||
 657             !(drv->wiphy.interface_modes & (1 << type))) {
 658                 err = -EOPNOTSUPP;
 659                 goto unlock;
 660         }
 661
 662         if (type == NL80211_IFTYPE_MESH_POINT &&
 663             info->attrs[NL80211_ATTR_MESH_ID]) {
 664                 params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
 665                 params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 666         }
 667
 668         rtnl_lock();
 669         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
 670                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
 671                                   &flags);
 672         err = drv->ops->add_virtual_intf(&drv->wiphy,
 673                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
 674                 type, err ? NULL : &flags, &params);
 675         rtnl_unlock();
 676
 677
 678  unlock:
 679         cfg80211_put_dev(drv);
 680         return err;
 681 }
 682
 683 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
 684 {
 685         struct cfg80211_registered_device *drv;
 686         int ifindex, err;
 687         struct net_device *dev;
 688
 689         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 690         if (err)
 691                 return err;
 692         ifindex = dev->ifindex;
 693         dev_put(dev);
 694
 695         if (!drv->ops->del_virtual_intf) {
 696                 err = -EOPNOTSUPP;
 697                 goto out;
 698         }
 699
 700         rtnl_lock();
 701         err = drv->ops->del_virtual_intf(&drv->wiphy, ifindex);
 702         rtnl_unlock();
 703
 704  out:
 705         cfg80211_put_dev(drv);
 706         return err;
 707 }
 708
 709 struct get_key_cookie {
 710         struct sk_buff *msg;
 711         int error;
 712 };
 713
 714 static void get_key_callback(void *c, struct key_params *params)
 715 {
 716         struct get_key_cookie *cookie = c;
 717
 718         if (params->key)
 719                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
 720                         params->key_len, params->key);
 721
 722         if (params->seq)
 723                 NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
 724                         params->seq_len, params->seq);
 725
 726         if (params->cipher)
 727                 NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
 728                             params->cipher);
 729
 730         return;
 731  nla_put_failure:
 732         cookie->error = 1;
 733 }
 734
 735 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
 736 {
 737         struct cfg80211_registered_device *drv;
 738         int err;
 739         struct net_device *dev;
 740         u8 key_idx = 0;
 741         u8 *mac_addr = NULL;
 742         struct get_key_cookie cookie = {
 743                 .error = 0,
 744         };
 745         void *hdr;
 746         struct sk_buff *msg;
 747
 748         if (info->attrs[NL80211_ATTR_KEY_IDX])
 749                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 750
 751         if (key_idx > 5)
 752                 return -EINVAL;
 753
 754         if (info->attrs[NL80211_ATTR_MAC])
 755                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 756
 757         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 758         if (err)
 759                 return err;
 760
 761         if (!drv->ops->get_key) {
 762                 err = -EOPNOTSUPP;
 763                 goto out;
 764         }
 765
 766         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
 767         if (!msg) {
 768                 err = -ENOMEM;
 769                 goto out;
 770         }
 771
 772         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
 773                              NL80211_CMD_NEW_KEY);
 774
 775         if (IS_ERR(hdr)) {
 776                 err = PTR_ERR(hdr);
 777                 goto out;
 778         }
 779
 780         cookie.msg = msg;
 781
 782         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
 783         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
 784         if (mac_addr)
 785                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
 786
 787         rtnl_lock();
 788         err = drv->ops->get_key(&drv->wiphy, dev, key_idx, mac_addr,
 789                                 &cookie, get_key_callback);
 790         rtnl_unlock();
 791
 792         if (err)
 793                 goto out;
 794
 795         if (cookie.error)
 796                 goto nla_put_failure;
 797
 798         genlmsg_end(msg, hdr);
 799         err = genlmsg_unicast(msg, info->snd_pid);
 800         goto out;
 801
 802  nla_put_failure:
 803         err = -ENOBUFS;
 804         nlmsg_free(msg);
 805  out:
 806         cfg80211_put_dev(drv);
 807         dev_put(dev);
 808         return err;
 809 }
 810
 811 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
 812 {
 813         struct cfg80211_registered_device *drv;
 814         int err;
 815         struct net_device *dev;
 816         u8 key_idx;
 817         int (*func)(struct wiphy *wiphy, struct net_device *netdev,
 818                     u8 key_index);
 819
 820         if (!info->attrs[NL80211_ATTR_KEY_IDX])
 821                 return -EINVAL;
 822
 823         key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 824
 825         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]) {
 826                 if (key_idx < 4 || key_idx > 5)
 827                         return -EINVAL;
 828         } else if (key_idx > 3)
 829                 return -EINVAL;
 830
 831         /* currently only support setting default key */
 832         if (!info->attrs[NL80211_ATTR_KEY_DEFAULT] &&
 833             !info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT])
 834                 return -EINVAL;
 835
 836         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 837         if (err)
 838                 return err;
 839
 840         if (info->attrs[NL80211_ATTR_KEY_DEFAULT])
 841                 func = drv->ops->set_default_key;
 842         else
 843                 func = drv->ops->set_default_mgmt_key;
 844
 845         if (!func) {
 846                 err = -EOPNOTSUPP;
 847                 goto out;
 848         }
 849
 850         rtnl_lock();
 851         err = func(&drv->wiphy, dev, key_idx);
 852         rtnl_unlock();
 853
 854  out:
 855         cfg80211_put_dev(drv);
 856         dev_put(dev);
 857         return err;
 858 }
 859
 860 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
 861 {
 862         struct cfg80211_registered_device *drv;
 863         int err;
 864         struct net_device *dev;
 865         struct key_params params;
 866         u8 key_idx = 0;
 867         u8 *mac_addr = NULL;
 868
 869         memset(&params, 0, sizeof(params));
 870
 871         if (!info->attrs[NL80211_ATTR_KEY_CIPHER])
 872                 return -EINVAL;
 873
 874         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 875                 params.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 876                 params.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 877         }
 878
 879         if (info->attrs[NL80211_ATTR_KEY_IDX])
 880                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 881
 882         params.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 883
 884         if (info->attrs[NL80211_ATTR_MAC])
 885                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 886
 887         if (key_idx > 5)
 888                 return -EINVAL;
 889
 890         /*
 891          * Disallow pairwise keys with non-zero index unless it's WEP
 892          * (because current deployments use pairwise WEP keys with
 893          * non-zero indizes but 802.11i clearly specifies to use zero)
 894          */
 895         if (mac_addr && key_idx &&
 896             params.cipher != WLAN_CIPHER_SUITE_WEP40 &&
 897             params.cipher != WLAN_CIPHER_SUITE_WEP104)
 898                 return -EINVAL;
 899
 900         /* TODO: add definitions for the lengths to linux/ieee80211.h */
 901         switch (params.cipher) {
 902         case WLAN_CIPHER_SUITE_WEP40:
 903                 if (params.key_len != 5)
 904                         return -EINVAL;
 905                 break;
 906         case WLAN_CIPHER_SUITE_TKIP:
 907                 if (params.key_len != 32)
 908                         return -EINVAL;
 909                 break;
 910         case WLAN_CIPHER_SUITE_CCMP:
 911                 if (params.key_len != 16)
 912                         return -EINVAL;
 913                 break;
 914         case WLAN_CIPHER_SUITE_WEP104:
 915                 if (params.key_len != 13)
 916                         return -EINVAL;
 917                 break;
 918         case WLAN_CIPHER_SUITE_AES_CMAC:
 919                 if (params.key_len != 16)
 920                         return -EINVAL;
 921                 break;
 922         default:
 923                 return -EINVAL;
 924         }
 925
 926         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 927         if (err)
 928                 return err;
 929
 930         if (!drv->ops->add_key) {
 931                 err = -EOPNOTSUPP;
 932                 goto out;
 933         }
 934
 935         rtnl_lock();
 936         err = drv->ops->add_key(&drv->wiphy, dev, key_idx, mac_addr, &params);
 937         rtnl_unlock();
 938
 939  out:
 940         cfg80211_put_dev(drv);
 941         dev_put(dev);
 942         return err;
 943 }
 944
 945 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
 946 {
 947         struct cfg80211_registered_device *drv;
 948         int err;
 949         struct net_device *dev;
 950         u8 key_idx = 0;
 951         u8 *mac_addr = NULL;
 952
 953         if (info->attrs[NL80211_ATTR_KEY_IDX])
 954                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 955
 956         if (key_idx > 5)
 957                 return -EINVAL;
 958
 959         if (info->attrs[NL80211_ATTR_MAC])
 960                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 961
 962         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 963         if (err)
 964                 return err;
 965
 966         if (!drv->ops->del_key) {
 967                 err = -EOPNOTSUPP;
 968                 goto out;
 969         }
 970
 971         rtnl_lock();
 972         err = drv->ops->del_key(&drv->wiphy, dev, key_idx, mac_addr);
 973         rtnl_unlock();
 974
 975  out:
 976         cfg80211_put_dev(drv);
 977         dev_put(dev);
 978         return err;
 979 }
 980
 981 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
 982 {
 983         int (*call)(struct wiphy *wiphy, struct net_device *dev,
 984                     struct beacon_parameters *info);
 985         struct cfg80211_registered_device *drv;
 986         int err;
 987         struct net_device *dev;
 988         struct beacon_parameters params;
 989         int haveinfo = 0;
 990
 991         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
 992         if (err)
 993                 return err;
 994
 995         switch (info->genlhdr->cmd) {
 996         case NL80211_CMD_NEW_BEACON:
 997                 /* these are required for NEW_BEACON */
 998                 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
 999                     !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1000                     !info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1001                         err = -EINVAL;
1002                         goto out;
1003                 }
1004
1005                 call = drv->ops->add_beacon;
1006                 break;
1007         case NL80211_CMD_SET_BEACON:
1008                 call = drv->ops->set_beacon;
1009                 break;
1010         default:
1011                 WARN_ON(1);
1012                 err = -EOPNOTSUPP;
1013                 goto out;
1014         }
1015
1016         if (!call) {
1017                 err = -EOPNOTSUPP;
1018                 goto out;
1019         }
1020
1021         memset(&params, 0, sizeof(params));
1022
1023         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1024                 params.interval =
1025                     nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1026                 haveinfo = 1;
1027         }
1028
1029         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1030                 params.dtim_period =
1031                     nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1032                 haveinfo = 1;
1033         }
1034
1035         if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1036                 params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1037                 params.head_len =
1038                     nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1039                 haveinfo = 1;
1040         }
1041
1042         if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1043                 params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1044                 params.tail_len =
1045                     nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1046                 haveinfo = 1;
1047         }
1048
1049         if (!haveinfo) {
1050                 err = -EINVAL;
1051                 goto out;
1052         }
1053
1054         rtnl_lock();
1055         err = call(&drv->wiphy, dev, &params);
1056         rtnl_unlock();
1057
1058  out:
1059         cfg80211_put_dev(drv);
1060         dev_put(dev);
1061         return err;
1062 }
1063
1064 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1065 {
1066         struct cfg80211_registered_device *drv;
1067         int err;
1068         struct net_device *dev;
1069
1070         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1071         if (err)
1072                 return err;
1073
1074         if (!drv->ops->del_beacon) {
1075                 err = -EOPNOTSUPP;
1076                 goto out;
1077         }
1078
1079         rtnl_lock();
1080         err = drv->ops->del_beacon(&drv->wiphy, dev);
1081         rtnl_unlock();
1082
1083  out:
1084         cfg80211_put_dev(drv);
1085         dev_put(dev);
1086         return err;
1087 }
1088
1089 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1090         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1091         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1092         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1093 };
1094
1095 static int parse_station_flags(struct nlattr *nla, u32 *staflags)
1096 {
1097         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1098         int flag;
1099
1100         *staflags = 0;
1101
1102         if (!nla)
1103                 return 0;
1104
1105         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1106                              nla, sta_flags_policy))
1107                 return -EINVAL;
1108
1109         *staflags = STATION_FLAG_CHANGED;
1110
1111         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1112                 if (flags[flag])
1113                         *staflags |= (1<<flag);
1114
1115         return 0;
1116 }
1117
1118 static u16 nl80211_calculate_bitrate(struct rate_info *rate)
1119 {
1120         int modulation, streams, bitrate;
1121
1122         if (!(rate->flags & RATE_INFO_FLAGS_MCS))
1123                 return rate->legacy;
1124
1125         /* the formula below does only work for MCS values smaller than 32 */
1126         if (rate->mcs >= 32)
1127                 return 0;
1128
1129         modulation = rate->mcs & 7;
1130         streams = (rate->mcs >> 3) + 1;
1131
1132         bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
1133                         13500000 : 6500000;
1134
1135         if (modulation < 4)
1136                 bitrate *= (modulation + 1);
1137         else if (modulation == 4)
1138                 bitrate *= (modulation + 2);
1139         else
1140                 bitrate *= (modulation + 3);
1141
1142         bitrate *= streams;
1143
1144         if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
1145                 bitrate = (bitrate / 9) * 10;
1146
1147         /* do NOT round down here */
1148         return (bitrate + 50000) / 100000;
1149 }
1150
1151 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1152                                 int flags, struct net_device *dev,
1153                                 u8 *mac_addr, struct station_info *sinfo)
1154 {
1155         void *hdr;
1156         struct nlattr *sinfoattr, *txrate;
1157         u16 bitrate;
1158
1159         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1160         if (!hdr)
1161                 return -1;
1162
1163         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1164         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1165
1166         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1167         if (!sinfoattr)
1168                 goto nla_put_failure;
1169         if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1170                 NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1171                             sinfo->inactive_time);
1172         if (sinfo->filled & STATION_INFO_RX_BYTES)
1173                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1174                             sinfo->rx_bytes);
1175         if (sinfo->filled & STATION_INFO_TX_BYTES)
1176                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1177                             sinfo->tx_bytes);
1178         if (sinfo->filled & STATION_INFO_LLID)
1179                 NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1180                             sinfo->llid);
1181         if (sinfo->filled & STATION_INFO_PLID)
1182                 NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1183                             sinfo->plid);
1184         if (sinfo->filled & STATION_INFO_PLINK_STATE)
1185                 NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1186                             sinfo->plink_state);
1187         if (sinfo->filled & STATION_INFO_SIGNAL)
1188                 NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1189                            sinfo->signal);
1190         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1191                 txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1192                 if (!txrate)
1193                         goto nla_put_failure;
1194
1195                 /* nl80211_calculate_bitrate will return 0 for mcs >= 32 */
1196                 bitrate = nl80211_calculate_bitrate(&sinfo->txrate);
1197                 if (bitrate > 0)
1198                         NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1199
1200                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1201                         NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1202                                     sinfo->txrate.mcs);
1203                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1204                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1205                 if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1206                         NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1207
1208                 nla_nest_end(msg, txrate);
1209         }
1210         if (sinfo->filled & STATION_INFO_RX_PACKETS)
1211                 NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
1212                             sinfo->rx_packets);
1213         if (sinfo->filled & STATION_INFO_TX_PACKETS)
1214                 NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
1215                             sinfo->tx_packets);
1216         nla_nest_end(msg, sinfoattr);
1217
1218         return genlmsg_end(msg, hdr);
1219
1220  nla_put_failure:
1221         genlmsg_cancel(msg, hdr);
1222         return -EMSGSIZE;
1223 }
1224
1225 static int nl80211_dump_station(struct sk_buff *skb,
1226                                 struct netlink_callback *cb)
1227 {
1228         struct station_info sinfo;
1229         struct cfg80211_registered_device *dev;
1230         struct net_device *netdev;
1231         u8 mac_addr[ETH_ALEN];
1232         int ifidx = cb->args[0];
1233         int sta_idx = cb->args[1];
1234         int err;
1235
1236         if (!ifidx) {
1237                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1238                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1239                                   nl80211_policy);
1240                 if (err)
1241                         return err;
1242
1243                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1244                         return -EINVAL;
1245
1246                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1247                 if (!ifidx)
1248                         return -EINVAL;
1249         }
1250
1251         netdev = dev_get_by_index(&init_net, ifidx);
1252         if (!netdev)
1253                 return -ENODEV;
1254
1255         dev = cfg80211_get_dev_from_ifindex(ifidx);
1256         if (IS_ERR(dev)) {
1257                 err = PTR_ERR(dev);
1258                 goto out_put_netdev;
1259         }
1260
1261         if (!dev->ops->dump_station) {
1262                 err = -ENOSYS;
1263                 goto out_err;
1264         }
1265
1266         rtnl_lock();
1267
1268         while (1) {
1269                 err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1270                                              mac_addr, &sinfo);
1271                 if (err == -ENOENT)
1272                         break;
1273                 if (err)
1274                         goto out_err_rtnl;
1275
1276                 if (nl80211_send_station(skb,
1277                                 NETLINK_CB(cb->skb).pid,
1278                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
1279                                 netdev, mac_addr,
1280                                 &sinfo) < 0)
1281                         goto out;
1282
1283                 sta_idx++;
1284         }
1285
1286
1287  out:
1288         cb->args[1] = sta_idx;
1289         err = skb->len;
1290  out_err_rtnl:
1291         rtnl_unlock();
1292  out_err:
1293         cfg80211_put_dev(dev);
1294  out_put_netdev:
1295         dev_put(netdev);
1296
1297         return err;
1298 }
1299
1300 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1301 {
1302         struct cfg80211_registered_device *drv;
1303         int err;
1304         struct net_device *dev;
1305         struct station_info sinfo;
1306         struct sk_buff *msg;
1307         u8 *mac_addr = NULL;
1308
1309         memset(&sinfo, 0, sizeof(sinfo));
1310
1311         if (!info->attrs[NL80211_ATTR_MAC])
1312                 return -EINVAL;
1313
1314         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1315
1316         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1317         if (err)
1318                 return err;
1319
1320         if (!drv->ops->get_station) {
1321                 err = -EOPNOTSUPP;
1322                 goto out;
1323         }
1324
1325         rtnl_lock();
1326         err = drv->ops->get_station(&drv->wiphy, dev, mac_addr, &sinfo);
1327         rtnl_unlock();
1328
1329         if (err)
1330                 goto out;
1331
1332         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1333         if (!msg)
1334                 goto out;
1335
1336         if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1337                                  dev, mac_addr, &sinfo) < 0)
1338                 goto out_free;
1339
1340         err = genlmsg_unicast(msg, info->snd_pid);
1341         goto out;
1342
1343  out_free:
1344         nlmsg_free(msg);
1345
1346  out:
1347         cfg80211_put_dev(drv);
1348         dev_put(dev);
1349         return err;
1350 }
1351
1352 /*
1353  * Get vlan interface making sure it is on the right wiphy.
1354  */
1355 static int get_vlan(struct nlattr *vlanattr,
1356                     struct cfg80211_registered_device *rdev,
1357                     struct net_device **vlan)
1358 {
1359         *vlan = NULL;
1360
1361         if (vlanattr) {
1362                 *vlan = dev_get_by_index(&init_net, nla_get_u32(vlanattr));
1363                 if (!*vlan)
1364                         return -ENODEV;
1365                 if (!(*vlan)->ieee80211_ptr)
1366                         return -EINVAL;
1367                 if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
1368                         return -EINVAL;
1369         }
1370         return 0;
1371 }
1372
1373 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
1374 {
1375         struct cfg80211_registered_device *drv;
1376         int err;
1377         struct net_device *dev;
1378         struct station_parameters params;
1379         u8 *mac_addr = NULL;
1380
1381         memset(&params, 0, sizeof(params));
1382
1383         params.listen_interval = -1;
1384
1385         if (info->attrs[NL80211_ATTR_STA_AID])
1386                 return -EINVAL;
1387
1388         if (!info->attrs[NL80211_ATTR_MAC])
1389                 return -EINVAL;
1390
1391         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1392
1393         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
1394                 params.supported_rates =
1395                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1396                 params.supported_rates_len =
1397                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1398         }
1399
1400         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1401                 params.listen_interval =
1402                     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1403
1404         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1405                 params.ht_capa =
1406                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1407
1408         if (parse_station_flags(info->attrs[NL80211_ATTR_STA_FLAGS],
1409                                 &params.station_flags))
1410                 return -EINVAL;
1411
1412         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
1413                 params.plink_action =
1414                     nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
1415
1416         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1417         if (err)
1418                 return err;
1419
1420         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1421         if (err)
1422                 goto out;
1423
1424         if (!drv->ops->change_station) {
1425                 err = -EOPNOTSUPP;
1426                 goto out;
1427         }
1428
1429         rtnl_lock();
1430         err = drv->ops->change_station(&drv->wiphy, dev, mac_addr, &params);
1431         rtnl_unlock();
1432
1433  out:
1434         if (params.vlan)
1435                 dev_put(params.vlan);
1436         cfg80211_put_dev(drv);
1437         dev_put(dev);
1438         return err;
1439 }
1440
1441 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
1442 {
1443         struct cfg80211_registered_device *drv;
1444         int err;
1445         struct net_device *dev;
1446         struct station_parameters params;
1447         u8 *mac_addr = NULL;
1448
1449         memset(&params, 0, sizeof(params));
1450
1451         if (!info->attrs[NL80211_ATTR_MAC])
1452                 return -EINVAL;
1453
1454         if (!info->attrs[NL80211_ATTR_STA_AID])
1455                 return -EINVAL;
1456
1457         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1458                 return -EINVAL;
1459
1460         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
1461                 return -EINVAL;
1462
1463         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1464         params.supported_rates =
1465                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1466         params.supported_rates_len =
1467                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1468         params.listen_interval =
1469                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1470         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
1471         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1472                 params.ht_capa =
1473                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1474
1475         if (parse_station_flags(info->attrs[NL80211_ATTR_STA_FLAGS],
1476                                 &params.station_flags))
1477                 return -EINVAL;
1478
1479         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1480         if (err)
1481                 return err;
1482
1483         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1484         if (err)
1485                 goto out;
1486
1487         if (!drv->ops->add_station) {
1488                 err = -EOPNOTSUPP;
1489                 goto out;
1490         }
1491
1492         rtnl_lock();
1493         err = drv->ops->add_station(&drv->wiphy, dev, mac_addr, &params);
1494         rtnl_unlock();
1495
1496  out:
1497         if (params.vlan)
1498                 dev_put(params.vlan);
1499         cfg80211_put_dev(drv);
1500         dev_put(dev);
1501         return err;
1502 }
1503
1504 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
1505 {
1506         struct cfg80211_registered_device *drv;
1507         int err;
1508         struct net_device *dev;
1509         u8 *mac_addr = NULL;
1510
1511         if (info->attrs[NL80211_ATTR_MAC])
1512                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1513
1514         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1515         if (err)
1516                 return err;
1517
1518         if (!drv->ops->del_station) {
1519                 err = -EOPNOTSUPP;
1520                 goto out;
1521         }
1522
1523         rtnl_lock();
1524         err = drv->ops->del_station(&drv->wiphy, dev, mac_addr);
1525         rtnl_unlock();
1526
1527  out:
1528         cfg80211_put_dev(drv);
1529         dev_put(dev);
1530         return err;
1531 }
1532
1533 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
1534                                 int flags, struct net_device *dev,
1535                                 u8 *dst, u8 *next_hop,
1536                                 struct mpath_info *pinfo)
1537 {
1538         void *hdr;
1539         struct nlattr *pinfoattr;
1540
1541         hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1542         if (!hdr)
1543                 return -1;
1544
1545         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1546         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
1547         NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
1548
1549         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
1550         if (!pinfoattr)
1551                 goto nla_put_failure;
1552         if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
1553                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
1554                             pinfo->frame_qlen);
1555         if (pinfo->filled & MPATH_INFO_DSN)
1556                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DSN,
1557                             pinfo->dsn);
1558         if (pinfo->filled & MPATH_INFO_METRIC)
1559                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
1560                             pinfo->metric);
1561         if (pinfo->filled & MPATH_INFO_EXPTIME)
1562                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
1563                             pinfo->exptime);
1564         if (pinfo->filled & MPATH_INFO_FLAGS)
1565                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
1566                             pinfo->flags);
1567         if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
1568                 NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
1569                             pinfo->discovery_timeout);
1570         if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
1571                 NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
1572                             pinfo->discovery_retries);
1573
1574         nla_nest_end(msg, pinfoattr);
1575
1576         return genlmsg_end(msg, hdr);
1577
1578  nla_put_failure:
1579         genlmsg_cancel(msg, hdr);
1580         return -EMSGSIZE;
1581 }
1582
1583 static int nl80211_dump_mpath(struct sk_buff *skb,
1584                               struct netlink_callback *cb)
1585 {
1586         struct mpath_info pinfo;
1587         struct cfg80211_registered_device *dev;
1588         struct net_device *netdev;
1589         u8 dst[ETH_ALEN];
1590         u8 next_hop[ETH_ALEN];
1591         int ifidx = cb->args[0];
1592         int path_idx = cb->args[1];
1593         int err;
1594
1595         if (!ifidx) {
1596                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1597                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
1598                                   nl80211_policy);
1599                 if (err)
1600                         return err;
1601
1602                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1603                         return -EINVAL;
1604
1605                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1606                 if (!ifidx)
1607                         return -EINVAL;
1608         }
1609
1610         netdev = dev_get_by_index(&init_net, ifidx);
1611         if (!netdev)
1612                 return -ENODEV;
1613
1614         dev = cfg80211_get_dev_from_ifindex(ifidx);
1615         if (IS_ERR(dev)) {
1616                 err = PTR_ERR(dev);
1617                 goto out_put_netdev;
1618         }
1619
1620         if (!dev->ops->dump_mpath) {
1621                 err = -ENOSYS;
1622                 goto out_err;
1623         }
1624
1625         rtnl_lock();
1626
1627         while (1) {
1628                 err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
1629                                            dst, next_hop, &pinfo);
1630                 if (err == -ENOENT)
1631                         break;
1632                 if (err)
1633                         goto out_err_rtnl;
1634
1635                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
1636                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
1637                                        netdev, dst, next_hop,
1638                                        &pinfo) < 0)
1639                         goto out;
1640
1641                 path_idx++;
1642         }
1643
1644
1645  out:
1646         cb->args[1] = path_idx;
1647         err = skb->len;
1648  out_err_rtnl:
1649         rtnl_unlock();
1650  out_err:
1651         cfg80211_put_dev(dev);
1652  out_put_netdev:
1653         dev_put(netdev);
1654
1655         return err;
1656 }
1657
1658 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
1659 {
1660         struct cfg80211_registered_device *drv;
1661         int err;
1662         struct net_device *dev;
1663         struct mpath_info pinfo;
1664         struct sk_buff *msg;
1665         u8 *dst = NULL;
1666         u8 next_hop[ETH_ALEN];
1667
1668         memset(&pinfo, 0, sizeof(pinfo));
1669
1670         if (!info->attrs[NL80211_ATTR_MAC])
1671                 return -EINVAL;
1672
1673         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1674
1675         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1676         if (err)
1677                 return err;
1678
1679         if (!drv->ops->get_mpath) {
1680                 err = -EOPNOTSUPP;
1681                 goto out;
1682         }
1683
1684         rtnl_lock();
1685         err = drv->ops->get_mpath(&drv->wiphy, dev, dst, next_hop, &pinfo);
1686         rtnl_unlock();
1687
1688         if (err)
1689                 goto out;
1690
1691         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1692         if (!msg)
1693                 goto out;
1694
1695         if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
1696                                  dev, dst, next_hop, &pinfo) < 0)
1697                 goto out_free;
1698
1699         err = genlmsg_unicast(msg, info->snd_pid);
1700         goto out;
1701
1702  out_free:
1703         nlmsg_free(msg);
1704
1705  out:
1706         cfg80211_put_dev(drv);
1707         dev_put(dev);
1708         return err;
1709 }
1710
1711 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
1712 {
1713         struct cfg80211_registered_device *drv;
1714         int err;
1715         struct net_device *dev;
1716         u8 *dst = NULL;
1717         u8 *next_hop = NULL;
1718
1719         if (!info->attrs[NL80211_ATTR_MAC])
1720                 return -EINVAL;
1721
1722         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
1723                 return -EINVAL;
1724
1725         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1726         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
1727
1728         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1729         if (err)
1730                 return err;
1731
1732         if (!drv->ops->change_mpath) {
1733                 err = -EOPNOTSUPP;
1734                 goto out;
1735         }
1736
1737         rtnl_lock();
1738         err = drv->ops->change_mpath(&drv->wiphy, dev, dst, next_hop);
1739         rtnl_unlock();
1740
1741  out:
1742         cfg80211_put_dev(drv);
1743         dev_put(dev);
1744         return err;
1745 }
1746 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
1747 {
1748         struct cfg80211_registered_device *drv;
1749         int err;
1750         struct net_device *dev;
1751         u8 *dst = NULL;
1752         u8 *next_hop = NULL;
1753
1754         if (!info->attrs[NL80211_ATTR_MAC])
1755                 return -EINVAL;
1756
1757         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
1758                 return -EINVAL;
1759
1760         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1761         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
1762
1763         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1764         if (err)
1765                 return err;
1766
1767         if (!drv->ops->add_mpath) {
1768                 err = -EOPNOTSUPP;
1769                 goto out;
1770         }
1771
1772         rtnl_lock();
1773         err = drv->ops->add_mpath(&drv->wiphy, dev, dst, next_hop);
1774         rtnl_unlock();
1775
1776  out:
1777         cfg80211_put_dev(drv);
1778         dev_put(dev);
1779         return err;
1780 }
1781
1782 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
1783 {
1784         struct cfg80211_registered_device *drv;
1785         int err;
1786         struct net_device *dev;
1787         u8 *dst = NULL;
1788
1789         if (info->attrs[NL80211_ATTR_MAC])
1790                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1791
1792         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1793         if (err)
1794                 return err;
1795
1796         if (!drv->ops->del_mpath) {
1797                 err = -EOPNOTSUPP;
1798                 goto out;
1799         }
1800
1801         rtnl_lock();
1802         err = drv->ops->del_mpath(&drv->wiphy, dev, dst);
1803         rtnl_unlock();
1804
1805  out:
1806         cfg80211_put_dev(drv);
1807         dev_put(dev);
1808         return err;
1809 }
1810
1811 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
1812 {
1813         struct cfg80211_registered_device *drv;
1814         int err;
1815         struct net_device *dev;
1816         struct bss_parameters params;
1817
1818         memset(&params, 0, sizeof(params));
1819         /* default to not changing parameters */
1820         params.use_cts_prot = -1;
1821         params.use_short_preamble = -1;
1822         params.use_short_slot_time = -1;
1823
1824         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
1825                 params.use_cts_prot =
1826                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
1827         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
1828                 params.use_short_preamble =
1829                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
1830         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
1831                 params.use_short_slot_time =
1832                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
1833         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
1834                 params.basic_rates =
1835                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
1836                 params.basic_rates_len =
1837                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
1838         }
1839
1840         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1841         if (err)
1842                 return err;
1843
1844         if (!drv->ops->change_bss) {
1845                 err = -EOPNOTSUPP;
1846                 goto out;
1847         }
1848
1849         rtnl_lock();
1850         err = drv->ops->change_bss(&drv->wiphy, dev, &params);
1851         rtnl_unlock();
1852
1853  out:
1854         cfg80211_put_dev(drv);
1855         dev_put(dev);
1856         return err;
1857 }
1858
1859 static const struct nla_policy
1860         reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
1861         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
1862         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
1863         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
1864         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
1865         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
1866         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
1867 };
1868
1869 static int parse_reg_rule(struct nlattr *tb[],
1870         struct ieee80211_reg_rule *reg_rule)
1871 {
1872         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
1873         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
1874
1875         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
1876                 return -EINVAL;
1877         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
1878                 return -EINVAL;
1879         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
1880                 return -EINVAL;
1881         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
1882                 return -EINVAL;
1883         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
1884                 return -EINVAL;
1885
1886         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
1887
1888         freq_range->start_freq_khz =
1889                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
1890         freq_range->end_freq_khz =
1891                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
1892         freq_range->max_bandwidth_khz =
1893                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
1894
1895         power_rule->max_eirp =
1896                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
1897
1898         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
1899                 power_rule->max_antenna_gain =
1900                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
1901
1902         return 0;
1903 }
1904
1905 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
1906 {
1907         int r;
1908         char *data = NULL;
1909
1910         /*
1911          * You should only get this when cfg80211 hasn't yet initialized
1912          * completely when built-in to the kernel right between the time
1913          * window between nl80211_init() and regulatory_init(), if that is
1914          * even possible.
1915          */
1916         mutex_lock(&cfg80211_mutex);
1917         if (unlikely(!cfg80211_regdomain)) {
1918                 mutex_unlock(&cfg80211_mutex);
1919                 return -EINPROGRESS;
1920         }
1921         mutex_unlock(&cfg80211_mutex);
1922
1923         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
1924                 return -EINVAL;
1925
1926         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
1927
1928 #ifdef CONFIG_WIRELESS_OLD_REGULATORY
1929         /* We ignore world regdom requests with the old regdom setup */
1930         if (is_world_regdom(data))
1931                 return -EINVAL;
1932 #endif
1933
1934         r = regulatory_hint_user(data);
1935
1936         return r;
1937 }
1938
1939 static int nl80211_get_mesh_params(struct sk_buff *skb,
1940         struct genl_info *info)
1941 {
1942         struct cfg80211_registered_device *drv;
1943         struct mesh_config cur_params;
1944         int err;
1945         struct net_device *dev;
1946         void *hdr;
1947         struct nlattr *pinfoattr;
1948         struct sk_buff *msg;
1949
1950         /* Look up our device */
1951         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1952         if (err)
1953                 return err;
1954
1955         /* Get the mesh params */
1956         rtnl_lock();
1957         err = drv->ops->get_mesh_params(&drv->wiphy, dev, &cur_params);
1958         rtnl_unlock();
1959         if (err)
1960                 goto out;
1961
1962         /* Draw up a netlink message to send back */
1963         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1964         if (!msg) {
1965                 err = -ENOBUFS;
1966                 goto out;
1967         }
1968         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
1969                              NL80211_CMD_GET_MESH_PARAMS);
1970         if (!hdr)
1971                 goto nla_put_failure;
1972         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
1973         if (!pinfoattr)
1974                 goto nla_put_failure;
1975         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1976         NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
1977                         cur_params.dot11MeshRetryTimeout);
1978         NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
1979                         cur_params.dot11MeshConfirmTimeout);
1980         NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
1981                         cur_params.dot11MeshHoldingTimeout);
1982         NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
1983                         cur_params.dot11MeshMaxPeerLinks);
1984         NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
1985                         cur_params.dot11MeshMaxRetries);
1986         NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
1987                         cur_params.dot11MeshTTL);
1988         NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
1989                         cur_params.auto_open_plinks);
1990         NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
1991                         cur_params.dot11MeshHWMPmaxPREQretries);
1992         NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
1993                         cur_params.path_refresh_time);
1994         NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
1995                         cur_params.min_discovery_timeout);
1996         NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
1997                         cur_params.dot11MeshHWMPactivePathTimeout);
1998         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
1999                         cur_params.dot11MeshHWMPpreqMinInterval);
2000         NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2001                         cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2002         nla_nest_end(msg, pinfoattr);
2003         genlmsg_end(msg, hdr);
2004         err = genlmsg_unicast(msg, info->snd_pid);
2005         goto out;
2006
2007 nla_put_failure:
2008         genlmsg_cancel(msg, hdr);
2009         err = -EMSGSIZE;
2010 out:
2011         /* Cleanup */
2012         cfg80211_put_dev(drv);
2013         dev_put(dev);
2014         return err;
2015 }
2016
2017 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2018 do {\
2019         if (table[attr_num]) {\
2020                 cfg.param = nla_fn(table[attr_num]); \
2021                 mask |= (1 << (attr_num - 1)); \
2022         } \
2023 } while (0);\
2024
2025 static struct nla_policy
2026 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] __read_mostly = {
2027         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2028         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2029         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2030         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2031         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2032         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2033         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2034
2035         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2036         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2037         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2038         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2039         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2040         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2041 };
2042
2043 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2044 {
2045         int err;
2046         u32 mask;
2047         struct cfg80211_registered_device *drv;
2048         struct net_device *dev;
2049         struct mesh_config cfg;
2050         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2051         struct nlattr *parent_attr;
2052
2053         parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
2054         if (!parent_attr)
2055                 return -EINVAL;
2056         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2057                         parent_attr, nl80211_meshconf_params_policy))
2058                 return -EINVAL;
2059
2060         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2061         if (err)
2062                 return err;
2063
2064         /* This makes sure that there aren't more than 32 mesh config
2065          * parameters (otherwise our bitfield scheme would not work.) */
2066         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2067
2068         /* Fill in the params struct */
2069         mask = 0;
2070         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2071                         mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2072         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2073                         mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2074         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2075                         mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2076         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2077                         mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2078         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2079                         mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2080         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2081                         mask, NL80211_MESHCONF_TTL, nla_get_u8);
2082         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2083                         mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2084         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2085                         mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2086                         nla_get_u8);
2087         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2088                         mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2089         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2090                         mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2091                         nla_get_u16);
2092         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2093                         mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2094                         nla_get_u32);
2095         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2096                         mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2097                         nla_get_u16);
2098         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2099                         dot11MeshHWMPnetDiameterTraversalTime,
2100                         mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2101                         nla_get_u16);
2102
2103         /* Apply changes */
2104         rtnl_lock();
2105         err = drv->ops->set_mesh_params(&drv->wiphy, dev, &cfg, mask);
2106         rtnl_unlock();
2107
2108         /* cleanup */
2109         cfg80211_put_dev(drv);
2110         dev_put(dev);
2111         return err;
2112 }
2113
2114 #undef FILL_IN_MESH_PARAM_IF_SET
2115
2116 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2117 {
2118         struct sk_buff *msg;
2119         void *hdr = NULL;
2120         struct nlattr *nl_reg_rules;
2121         unsigned int i;
2122         int err = -EINVAL;
2123
2124         mutex_lock(&cfg80211_mutex);
2125
2126         if (!cfg80211_regdomain)
2127                 goto out;
2128
2129         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2130         if (!msg) {
2131                 err = -ENOBUFS;
2132                 goto out;
2133         }
2134
2135         hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2136                              NL80211_CMD_GET_REG);
2137         if (!hdr)
2138                 goto nla_put_failure;
2139
2140         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2141                 cfg80211_regdomain->alpha2);
2142
2143         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2144         if (!nl_reg_rules)
2145                 goto nla_put_failure;
2146
2147         for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2148                 struct nlattr *nl_reg_rule;
2149                 const struct ieee80211_reg_rule *reg_rule;
2150                 const struct ieee80211_freq_range *freq_range;
2151                 const struct ieee80211_power_rule *power_rule;
2152
2153                 reg_rule = &cfg80211_regdomain->reg_rules[i];
2154                 freq_range = &reg_rule->freq_range;
2155                 power_rule = &reg_rule->power_rule;
2156
2157                 nl_reg_rule = nla_nest_start(msg, i);
2158                 if (!nl_reg_rule)
2159                         goto nla_put_failure;
2160
2161                 NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2162                         reg_rule->flags);
2163                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2164                         freq_range->start_freq_khz);
2165                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2166                         freq_range->end_freq_khz);
2167                 NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2168                         freq_range->max_bandwidth_khz);
2169                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2170                         power_rule->max_antenna_gain);
2171                 NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2172                         power_rule->max_eirp);
2173
2174                 nla_nest_end(msg, nl_reg_rule);
2175         }
2176
2177         nla_nest_end(msg, nl_reg_rules);
2178
2179         genlmsg_end(msg, hdr);
2180         err = genlmsg_unicast(msg, info->snd_pid);
2181         goto out;
2182
2183 nla_put_failure:
2184         genlmsg_cancel(msg, hdr);
2185         err = -EMSGSIZE;
2186 out:
2187         mutex_unlock(&cfg80211_mutex);
2188         return err;
2189 }
2190
2191 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2192 {
2193         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2194         struct nlattr *nl_reg_rule;
2195         char *alpha2 = NULL;
2196         int rem_reg_rules = 0, r = 0;
2197         u32 num_rules = 0, rule_idx = 0, size_of_regd;
2198         struct ieee80211_regdomain *rd = NULL;
2199
2200         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2201                 return -EINVAL;
2202
2203         if (!info->attrs[NL80211_ATTR_REG_RULES])
2204                 return -EINVAL;
2205
2206         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2207
2208         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2209                         rem_reg_rules) {
2210                 num_rules++;
2211                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2212                         goto bad_reg;
2213         }
2214
2215         if (!reg_is_valid_request(alpha2))
2216                 return -EINVAL;
2217
2218         size_of_regd = sizeof(struct ieee80211_regdomain) +
2219                 (num_rules * sizeof(struct ieee80211_reg_rule));
2220
2221         rd = kzalloc(size_of_regd, GFP_KERNEL);
2222         if (!rd)
2223                 return -ENOMEM;
2224
2225         rd->n_reg_rules = num_rules;
2226         rd->alpha2[0] = alpha2[0];
2227         rd->alpha2[1] = alpha2[1];
2228
2229         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2230                         rem_reg_rules) {
2231                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2232                         nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2233                         reg_rule_policy);
2234                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2235                 if (r)
2236                         goto bad_reg;
2237
2238                 rule_idx++;
2239
2240                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES)
2241                         goto bad_reg;
2242         }
2243
2244         BUG_ON(rule_idx != num_rules);
2245
2246         mutex_lock(&cfg80211_mutex);
2247         r = set_regdom(rd);
2248         mutex_unlock(&cfg80211_mutex);
2249         return r;
2250
2251  bad_reg:
2252         kfree(rd);
2253         return -EINVAL;
2254 }
2255
2256 static int nl80211_set_mgmt_extra_ie(struct sk_buff *skb,
2257                                      struct genl_info *info)
2258 {
2259         struct cfg80211_registered_device *drv;
2260         int err;
2261         struct net_device *dev;
2262         struct mgmt_extra_ie_params params;
2263
2264         memset(&params, 0, sizeof(params));
2265
2266         if (!info->attrs[NL80211_ATTR_MGMT_SUBTYPE])
2267                 return -EINVAL;
2268         params.subtype = nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
2269         if (params.subtype > 15)
2270                 return -EINVAL; /* FC Subtype field is 4 bits (0..15) */
2271
2272         if (info->attrs[NL80211_ATTR_IE]) {
2273                 params.ies = nla_data(info->attrs[NL80211_ATTR_IE]);
2274                 params.ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2275         }
2276
2277         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2278         if (err)
2279                 return err;
2280
2281         if (drv->ops->set_mgmt_extra_ie) {
2282                 rtnl_lock();
2283                 err = drv->ops->set_mgmt_extra_ie(&drv->wiphy, dev, &params);
2284                 rtnl_unlock();
2285         } else
2286                 err = -EOPNOTSUPP;
2287
2288         cfg80211_put_dev(drv);
2289         dev_put(dev);
2290         return err;
2291 }
2292
2293 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
2294 {
2295         struct cfg80211_registered_device *drv;
2296         struct net_device *dev;
2297         struct cfg80211_scan_request *request;
2298         struct cfg80211_ssid *ssid;
2299         struct ieee80211_channel *channel;
2300         struct nlattr *attr;
2301         struct wiphy *wiphy;
2302         int err, tmp, n_ssids = 0, n_channels = 0, i;
2303         enum ieee80211_band band;
2304         size_t ie_len;
2305
2306         err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2307         if (err)
2308                 return err;
2309
2310         wiphy = &drv->wiphy;
2311
2312         if (!drv->ops->scan) {
2313                 err = -EOPNOTSUPP;
2314                 goto out;
2315         }
2316
2317         rtnl_lock();
2318
2319         if (drv->scan_req) {
2320                 err = -EBUSY;
2321                 goto out_unlock;
2322         }
2323
2324         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2325                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp)
2326                         n_channels++;
2327                 if (!n_channels) {
2328                         err = -EINVAL;
2329                         goto out_unlock;
2330                 }
2331         } else {
2332                 for (band = 0; band < IEEE80211_NUM_BANDS; band++)
2333                         if (wiphy->bands[band])
2334                                 n_channels += wiphy->bands[band]->n_channels;
2335         }
2336
2337         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
2338                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
2339                         n_ssids++;
2340
2341         if (n_ssids > wiphy->max_scan_ssids) {
2342                 err = -EINVAL;
2343                 goto out_unlock;
2344         }
2345
2346         if (info->attrs[NL80211_ATTR_IE])
2347                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2348         else
2349                 ie_len = 0;
2350
2351         request = kzalloc(sizeof(*request)
2352                         + sizeof(*ssid) * n_ssids
2353                         + sizeof(channel) * n_channels
2354                         + ie_len, GFP_KERNEL);
2355         if (!request) {
2356                 err = -ENOMEM;
2357                 goto out_unlock;
2358         }
2359
2360         request->channels = (void *)((char *)request + sizeof(*request));
2361         request->n_channels = n_channels;
2362         if (n_ssids)
2363                 request->ssids = (void *)(request->channels + n_channels);
2364         request->n_ssids = n_ssids;
2365         if (ie_len) {
2366                 if (request->ssids)
2367                         request->ie = (void *)(request->ssids + n_ssids);
2368                 else
2369                         request->ie = (void *)(request->channels + n_channels);
2370         }
2371
2372         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2373                 /* user specified, bail out if channel not found */
2374                 request->n_channels = n_channels;
2375                 i = 0;
2376                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
2377                         request->channels[i] = ieee80211_get_channel(wiphy, nla_get_u32(attr));
2378                         if (!request->channels[i]) {
2379                                 err = -EINVAL;
2380                                 goto out_free;
2381                         }
2382                         i++;
2383                 }
2384         } else {
2385                 /* all channels */
2386                 i = 0;
2387                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
2388                         int j;
2389                         if (!wiphy->bands[band])
2390                                 continue;
2391                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
2392                                 request->channels[i] = &wiphy->bands[band]->channels[j];
2393                                 i++;
2394                         }
2395                 }
2396         }
2397
2398         i = 0;
2399         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
2400                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
2401                         if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
2402                                 err = -EINVAL;
2403                                 goto out_free;
2404                         }
2405                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
2406                         request->ssids[i].ssid_len = nla_len(attr);
2407                         i++;
2408                 }
2409         }
2410
2411         if (info->attrs[NL80211_ATTR_IE]) {
2412                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2413                 memcpy(request->ie, nla_data(info->attrs[NL80211_ATTR_IE]),
2414                        request->ie_len);
2415         }
2416
2417         request->ifidx = dev->ifindex;
2418         request->wiphy = &drv->wiphy;
2419
2420         drv->scan_req = request;
2421         err = drv->ops->scan(&drv->wiphy, dev, request);
2422
2423  out_free:
2424         if (err) {
2425                 drv->scan_req = NULL;
2426                 kfree(request);
2427         }
2428  out_unlock:
2429         rtnl_unlock();
2430  out:
2431         cfg80211_put_dev(drv);
2432         dev_put(dev);
2433         return err;
2434 }
2435
2436 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
2437                             struct cfg80211_registered_device *rdev,
2438                             struct net_device *dev,
2439                             struct cfg80211_bss *res)
2440 {
2441         void *hdr;
2442         struct nlattr *bss;
2443
2444         hdr = nl80211hdr_put(msg, pid, seq, flags,
2445                              NL80211_CMD_NEW_SCAN_RESULTS);
2446         if (!hdr)
2447                 return -1;
2448
2449         NLA_PUT_U32(msg, NL80211_ATTR_SCAN_GENERATION,
2450                     rdev->bss_generation);
2451         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2452
2453         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
2454         if (!bss)
2455                 goto nla_put_failure;
2456         if (!is_zero_ether_addr(res->bssid))
2457                 NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
2458         if (res->information_elements && res->len_information_elements)
2459                 NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
2460                         res->len_information_elements,
2461                         res->information_elements);
2462         if (res->tsf)
2463                 NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
2464         if (res->beacon_interval)
2465                 NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
2466         NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
2467         NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
2468
2469         switch (rdev->wiphy.signal_type) {
2470         case CFG80211_SIGNAL_TYPE_MBM:
2471                 NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
2472                 break;
2473         case CFG80211_SIGNAL_TYPE_UNSPEC:
2474                 NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
2475                 break;
2476         default:
2477                 break;
2478         }
2479
2480         nla_nest_end(msg, bss);
2481
2482         return genlmsg_end(msg, hdr);
2483
2484  nla_put_failure:
2485         genlmsg_cancel(msg, hdr);
2486         return -EMSGSIZE;
2487 }
2488
2489 static int nl80211_dump_scan(struct sk_buff *skb,
2490                              struct netlink_callback *cb)
2491 {
2492         struct cfg80211_registered_device *dev;
2493         struct net_device *netdev;
2494         struct cfg80211_internal_bss *scan;
2495         int ifidx = cb->args[0];
2496         int start = cb->args[1], idx = 0;
2497         int err;
2498
2499         if (!ifidx) {
2500                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
2501                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
2502                                   nl80211_policy);
2503                 if (err)
2504                         return err;
2505
2506                 if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
2507                         return -EINVAL;
2508
2509                 ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
2510                 if (!ifidx)
2511                         return -EINVAL;
2512                 cb->args[0] = ifidx;
2513         }
2514
2515         netdev = dev_get_by_index(&init_net, ifidx);
2516         if (!netdev)
2517                 return -ENODEV;
2518
2519         dev = cfg80211_get_dev_from_ifindex(ifidx);
2520         if (IS_ERR(dev)) {
2521                 err = PTR_ERR(dev);
2522                 goto out_put_netdev;
2523         }
2524
2525         spin_lock_bh(&dev->bss_lock);
2526         cfg80211_bss_expire(dev);
2527
2528         list_for_each_entry(scan, &dev->bss_list, list) {
2529                 if (++idx <= start)
2530                         continue;
2531                 if (nl80211_send_bss(skb,
2532                                 NETLINK_CB(cb->skb).pid,
2533                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2534                                 dev, netdev, &scan->pub) < 0) {
2535                         idx--;
2536                         goto out;
2537                 }
2538         }
2539
2540  out:
2541         spin_unlock_bh(&dev->bss_lock);
2542
2543         cb->args[1] = idx;
2544         err = skb->len;
2545         cfg80211_put_dev(dev);
2546  out_put_netdev:
2547         dev_put(netdev);
2548
2549         return err;
2550 }
2551
2552 static struct genl_ops nl80211_ops[] = {
2553         {
2554                 .cmd = NL80211_CMD_GET_WIPHY,
2555                 .doit = nl80211_get_wiphy,
2556                 .dumpit = nl80211_dump_wiphy,
2557                 .policy = nl80211_policy,
2558                 /* can be retrieved by unprivileged users */
2559         },
2560         {
2561                 .cmd = NL80211_CMD_SET_WIPHY,
2562                 .doit = nl80211_set_wiphy,
2563                 .policy = nl80211_policy,
2564                 .flags = GENL_ADMIN_PERM,
2565         },
2566         {
2567                 .cmd = NL80211_CMD_GET_INTERFACE,
2568                 .doit = nl80211_get_interface,
2569                 .dumpit = nl80211_dump_interface,
2570                 .policy = nl80211_policy,
2571                 /* can be retrieved by unprivileged users */
2572         },
2573         {
2574                 .cmd = NL80211_CMD_SET_INTERFACE,
2575                 .doit = nl80211_set_interface,
2576                 .policy = nl80211_policy,
2577                 .flags = GENL_ADMIN_PERM,
2578         },
2579         {
2580                 .cmd = NL80211_CMD_NEW_INTERFACE,
2581                 .doit = nl80211_new_interface,
2582                 .policy = nl80211_policy,
2583                 .flags = GENL_ADMIN_PERM,
2584         },
2585         {
2586                 .cmd = NL80211_CMD_DEL_INTERFACE,
2587                 .doit = nl80211_del_interface,
2588                 .policy = nl80211_policy,
2589                 .flags = GENL_ADMIN_PERM,
2590         },
2591         {
2592                 .cmd = NL80211_CMD_GET_KEY,
2593                 .doit = nl80211_get_key,
2594                 .policy = nl80211_policy,
2595                 .flags = GENL_ADMIN_PERM,
2596         },
2597         {
2598                 .cmd = NL80211_CMD_SET_KEY,
2599                 .doit = nl80211_set_key,
2600                 .policy = nl80211_policy,
2601                 .flags = GENL_ADMIN_PERM,
2602         },
2603         {
2604                 .cmd = NL80211_CMD_NEW_KEY,
2605                 .doit = nl80211_new_key,
2606                 .policy = nl80211_policy,
2607                 .flags = GENL_ADMIN_PERM,
2608         },
2609         {
2610                 .cmd = NL80211_CMD_DEL_KEY,
2611                 .doit = nl80211_del_key,
2612                 .policy = nl80211_policy,
2613                 .flags = GENL_ADMIN_PERM,
2614         },
2615         {
2616                 .cmd = NL80211_CMD_SET_BEACON,
2617                 .policy = nl80211_policy,
2618                 .flags = GENL_ADMIN_PERM,
2619                 .doit = nl80211_addset_beacon,
2620         },
2621         {
2622                 .cmd = NL80211_CMD_NEW_BEACON,
2623                 .policy = nl80211_policy,
2624                 .flags = GENL_ADMIN_PERM,
2625                 .doit = nl80211_addset_beacon,
2626         },
2627         {
2628                 .cmd = NL80211_CMD_DEL_BEACON,
2629                 .policy = nl80211_policy,
2630                 .flags = GENL_ADMIN_PERM,
2631                 .doit = nl80211_del_beacon,
2632         },
2633         {
2634                 .cmd = NL80211_CMD_GET_STATION,
2635                 .doit = nl80211_get_station,
2636                 .dumpit = nl80211_dump_station,
2637                 .policy = nl80211_policy,
2638         },
2639         {
2640                 .cmd = NL80211_CMD_SET_STATION,
2641                 .doit = nl80211_set_station,
2642                 .policy = nl80211_policy,
2643                 .flags = GENL_ADMIN_PERM,
2644         },
2645         {
2646                 .cmd = NL80211_CMD_NEW_STATION,
2647                 .doit = nl80211_new_station,
2648                 .policy = nl80211_policy,
2649                 .flags = GENL_ADMIN_PERM,
2650         },
2651         {
2652                 .cmd = NL80211_CMD_DEL_STATION,
2653                 .doit = nl80211_del_station,
2654                 .policy = nl80211_policy,
2655                 .flags = GENL_ADMIN_PERM,
2656         },
2657         {
2658                 .cmd = NL80211_CMD_GET_MPATH,
2659                 .doit = nl80211_get_mpath,
2660                 .dumpit = nl80211_dump_mpath,
2661                 .policy = nl80211_policy,
2662                 .flags = GENL_ADMIN_PERM,
2663         },
2664         {
2665                 .cmd = NL80211_CMD_SET_MPATH,
2666                 .doit = nl80211_set_mpath,
2667                 .policy = nl80211_policy,
2668                 .flags = GENL_ADMIN_PERM,
2669         },
2670         {
2671                 .cmd = NL80211_CMD_NEW_MPATH,
2672                 .doit = nl80211_new_mpath,
2673                 .policy = nl80211_policy,
2674                 .flags = GENL_ADMIN_PERM,
2675         },
2676         {
2677                 .cmd = NL80211_CMD_DEL_MPATH,
2678                 .doit = nl80211_del_mpath,
2679                 .policy = nl80211_policy,
2680                 .flags = GENL_ADMIN_PERM,
2681         },
2682         {
2683                 .cmd = NL80211_CMD_SET_BSS,
2684                 .doit = nl80211_set_bss,
2685                 .policy = nl80211_policy,
2686                 .flags = GENL_ADMIN_PERM,
2687         },
2688         {
2689                 .cmd = NL80211_CMD_GET_REG,
2690                 .doit = nl80211_get_reg,
2691                 .policy = nl80211_policy,
2692                 /* can be retrieved by unprivileged users */
2693         },
2694         {
2695                 .cmd = NL80211_CMD_SET_REG,
2696                 .doit = nl80211_set_reg,
2697                 .policy = nl80211_policy,
2698                 .flags = GENL_ADMIN_PERM,
2699         },
2700         {
2701                 .cmd = NL80211_CMD_REQ_SET_REG,
2702                 .doit = nl80211_req_set_reg,
2703                 .policy = nl80211_policy,
2704                 .flags = GENL_ADMIN_PERM,
2705         },
2706         {
2707                 .cmd = NL80211_CMD_GET_MESH_PARAMS,
2708                 .doit = nl80211_get_mesh_params,
2709                 .policy = nl80211_policy,
2710                 /* can be retrieved by unprivileged users */
2711         },
2712         {
2713                 .cmd = NL80211_CMD_SET_MESH_PARAMS,
2714                 .doit = nl80211_set_mesh_params,
2715                 .policy = nl80211_policy,
2716                 .flags = GENL_ADMIN_PERM,
2717         },
2718         {
2719                 .cmd = NL80211_CMD_SET_MGMT_EXTRA_IE,
2720                 .doit = nl80211_set_mgmt_extra_ie,
2721                 .policy = nl80211_policy,
2722                 .flags = GENL_ADMIN_PERM,
2723         },
2724         {
2725                 .cmd = NL80211_CMD_TRIGGER_SCAN,
2726                 .doit = nl80211_trigger_scan,
2727                 .policy = nl80211_policy,
2728                 .flags = GENL_ADMIN_PERM,
2729         },
2730         {
2731                 .cmd = NL80211_CMD_GET_SCAN,
2732                 .policy = nl80211_policy,
2733                 .dumpit = nl80211_dump_scan,
2734         },
2735 };
2736
2737 /* multicast groups */
2738 static struct genl_multicast_group nl80211_config_mcgrp = {
2739         .name = "config",
2740 };
2741 static struct genl_multicast_group nl80211_scan_mcgrp = {
2742         .name = "scan",
2743 };
2744
2745 /* notification functions */
2746
2747 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
2748 {
2749         struct sk_buff *msg;
2750
2751         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2752         if (!msg)
2753                 return;
2754
2755         if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
2756                 nlmsg_free(msg);
2757                 return;
2758         }
2759
2760         genlmsg_multicast(msg, 0, nl80211_config_mcgrp.id, GFP_KERNEL);
2761 }
2762
2763 static int nl80211_send_scan_donemsg(struct sk_buff *msg,
2764                                     struct cfg80211_registered_device *rdev,
2765                                     struct net_device *netdev,
2766                                     u32 pid, u32 seq, int flags,
2767                                     u32 cmd)
2768 {
2769         void *hdr;
2770
2771         hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
2772         if (!hdr)
2773                 return -1;
2774
2775         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
2776         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
2777
2778         /* XXX: we should probably bounce back the request? */
2779
2780         return genlmsg_end(msg, hdr);
2781
2782  nla_put_failure:
2783         genlmsg_cancel(msg, hdr);
2784         return -EMSGSIZE;
2785 }
2786
2787 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
2788                             struct net_device *netdev)
2789 {
2790         struct sk_buff *msg;
2791
2792         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2793         if (!msg)
2794                 return;
2795
2796         if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
2797                                       NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
2798                 nlmsg_free(msg);
2799                 return;
2800         }
2801
2802         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
2803 }
2804
2805 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
2806                                struct net_device *netdev)
2807 {
2808         struct sk_buff *msg;
2809
2810         msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2811         if (!msg)
2812                 return;
2813
2814         if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
2815                                       NL80211_CMD_SCAN_ABORTED) < 0) {
2816                 nlmsg_free(msg);
2817                 return;
2818         }
2819
2820         genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
2821 }
2822
2823 /* initialisation/exit functions */
2824
2825 int nl80211_init(void)
2826 {
2827         int err, i;
2828
2829         err = genl_register_family(&nl80211_fam);
2830         if (err)
2831                 return err;
2832
2833         for (i = 0; i < ARRAY_SIZE(nl80211_ops); i++) {
2834                 err = genl_register_ops(&nl80211_fam, &nl80211_ops[i]);
2835                 if (err)
2836                         goto err_out;
2837         }
2838
2839         err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
2840         if (err)
2841                 goto err_out;
2842
2843         err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
2844         if (err)
2845                 goto err_out;
2846
2847         return 0;
2848  err_out:
2849         genl_unregister_family(&nl80211_fam);
2850         return err;
2851 }
2852
2853 void nl80211_exit(void)
2854 {
2855         genl_unregister_family(&nl80211_fam);
2856 }