xref: /openbmc/linux/net/wireless/nl80211.c (revision 78c99ba1)
1 /*
2  * This is the new netlink-based wireless configuration interface.
3  *
4  * Copyright 2006, 2007	Johannes Berg <johannes@sipsolutions.net>
5  */
6 
7 #include <linux/if.h>
8 #include <linux/module.h>
9 #include <linux/err.h>
10 #include <linux/list.h>
11 #include <linux/if_ether.h>
12 #include <linux/ieee80211.h>
13 #include <linux/nl80211.h>
14 #include <linux/rtnetlink.h>
15 #include <linux/netlink.h>
16 #include <linux/etherdevice.h>
17 #include <net/genetlink.h>
18 #include <net/cfg80211.h>
19 #include "core.h"
20 #include "nl80211.h"
21 #include "reg.h"
22 
23 /* the netlink family */
24 static struct genl_family nl80211_fam = {
25 	.id = GENL_ID_GENERATE,	/* don't bother with a hardcoded ID */
26 	.name = "nl80211",	/* have users key off the name instead */
27 	.hdrsize = 0,		/* no private header */
28 	.version = 1,		/* no particular meaning now */
29 	.maxattr = NL80211_ATTR_MAX,
30 };
31 
32 /* internal helper: get drv and dev */
33 static int get_drv_dev_by_info_ifindex(struct nlattr **attrs,
34 				       struct cfg80211_registered_device **drv,
35 				       struct net_device **dev)
36 {
37 	int ifindex;
38 
39 	if (!attrs[NL80211_ATTR_IFINDEX])
40 		return -EINVAL;
41 
42 	ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
43 	*dev = dev_get_by_index(&init_net, ifindex);
44 	if (!*dev)
45 		return -ENODEV;
46 
47 	*drv = cfg80211_get_dev_from_ifindex(ifindex);
48 	if (IS_ERR(*drv)) {
49 		dev_put(*dev);
50 		return PTR_ERR(*drv);
51 	}
52 
53 	return 0;
54 }
55 
56 /* policy for the attributes */
57 static struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] __read_mostly = {
58 	[NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
59 	[NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
60 				      .len = BUS_ID_SIZE-1 },
61 	[NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
62 	[NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
63 	[NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
64 
65 	[NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
66 	[NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
67 	[NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
68 
69 	[NL80211_ATTR_MAC] = { .type = NLA_BINARY, .len = ETH_ALEN },
70 
71 	[NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
72 				    .len = WLAN_MAX_KEY_LEN },
73 	[NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
74 	[NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
75 	[NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
76 
77 	[NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
78 	[NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
79 	[NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
80 				       .len = IEEE80211_MAX_DATA_LEN },
81 	[NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
82 				       .len = IEEE80211_MAX_DATA_LEN },
83 	[NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
84 	[NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
85 	[NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
86 	[NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
87 					       .len = NL80211_MAX_SUPP_RATES },
88 	[NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
89 	[NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
90 	[NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
91 	[NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
92 				.len = IEEE80211_MAX_MESH_ID_LEN },
93 	[NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
94 
95 	[NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
96 	[NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
97 
98 	[NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
99 	[NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
100 	[NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
101 	[NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
102 					   .len = NL80211_MAX_SUPP_RATES },
103 
104 	[NL80211_ATTR_MESH_PARAMS] = { .type = NLA_NESTED },
105 
106 	[NL80211_ATTR_HT_CAPABILITY] = { .type = NLA_BINARY,
107 					 .len = NL80211_HT_CAPABILITY_LEN },
108 
109 	[NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
110 	[NL80211_ATTR_IE] = { .type = NLA_BINARY,
111 			      .len = IEEE80211_MAX_DATA_LEN },
112 	[NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
113 	[NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
114 
115 	[NL80211_ATTR_SSID] = { .type = NLA_BINARY,
116 				.len = IEEE80211_MAX_SSID_LEN },
117 	[NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
118 	[NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
119 };
120 
121 /* message building helper */
122 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 pid, u32 seq,
123 				   int flags, u8 cmd)
124 {
125 	/* since there is no private header just add the generic one */
126 	return genlmsg_put(skb, pid, seq, &nl80211_fam, flags, cmd);
127 }
128 
129 /* netlink command implementations */
130 
131 static int nl80211_send_wiphy(struct sk_buff *msg, u32 pid, u32 seq, int flags,
132 			      struct cfg80211_registered_device *dev)
133 {
134 	void *hdr;
135 	struct nlattr *nl_bands, *nl_band;
136 	struct nlattr *nl_freqs, *nl_freq;
137 	struct nlattr *nl_rates, *nl_rate;
138 	struct nlattr *nl_modes;
139 	struct nlattr *nl_cmds;
140 	enum ieee80211_band band;
141 	struct ieee80211_channel *chan;
142 	struct ieee80211_rate *rate;
143 	int i;
144 	u16 ifmodes = dev->wiphy.interface_modes;
145 
146 	hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_WIPHY);
147 	if (!hdr)
148 		return -1;
149 
150 	NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx);
151 	NLA_PUT_STRING(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy));
152 	NLA_PUT_U8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
153 		   dev->wiphy.max_scan_ssids);
154 
155 	nl_modes = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_IFTYPES);
156 	if (!nl_modes)
157 		goto nla_put_failure;
158 
159 	i = 0;
160 	while (ifmodes) {
161 		if (ifmodes & 1)
162 			NLA_PUT_FLAG(msg, i);
163 		ifmodes >>= 1;
164 		i++;
165 	}
166 
167 	nla_nest_end(msg, nl_modes);
168 
169 	nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
170 	if (!nl_bands)
171 		goto nla_put_failure;
172 
173 	for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
174 		if (!dev->wiphy.bands[band])
175 			continue;
176 
177 		nl_band = nla_nest_start(msg, band);
178 		if (!nl_band)
179 			goto nla_put_failure;
180 
181 		/* add HT info */
182 		if (dev->wiphy.bands[band]->ht_cap.ht_supported) {
183 			NLA_PUT(msg, NL80211_BAND_ATTR_HT_MCS_SET,
184 				sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
185 				&dev->wiphy.bands[band]->ht_cap.mcs);
186 			NLA_PUT_U16(msg, NL80211_BAND_ATTR_HT_CAPA,
187 				dev->wiphy.bands[band]->ht_cap.cap);
188 			NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
189 				dev->wiphy.bands[band]->ht_cap.ampdu_factor);
190 			NLA_PUT_U8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
191 				dev->wiphy.bands[band]->ht_cap.ampdu_density);
192 		}
193 
194 		/* add frequencies */
195 		nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
196 		if (!nl_freqs)
197 			goto nla_put_failure;
198 
199 		for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
200 			nl_freq = nla_nest_start(msg, i);
201 			if (!nl_freq)
202 				goto nla_put_failure;
203 
204 			chan = &dev->wiphy.bands[band]->channels[i];
205 			NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_FREQ,
206 				    chan->center_freq);
207 
208 			if (chan->flags & IEEE80211_CHAN_DISABLED)
209 				NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_DISABLED);
210 			if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
211 				NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN);
212 			if (chan->flags & IEEE80211_CHAN_NO_IBSS)
213 				NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_NO_IBSS);
214 			if (chan->flags & IEEE80211_CHAN_RADAR)
215 				NLA_PUT_FLAG(msg, NL80211_FREQUENCY_ATTR_RADAR);
216 
217 			NLA_PUT_U32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
218 				    DBM_TO_MBM(chan->max_power));
219 
220 			nla_nest_end(msg, nl_freq);
221 		}
222 
223 		nla_nest_end(msg, nl_freqs);
224 
225 		/* add bitrates */
226 		nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
227 		if (!nl_rates)
228 			goto nla_put_failure;
229 
230 		for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
231 			nl_rate = nla_nest_start(msg, i);
232 			if (!nl_rate)
233 				goto nla_put_failure;
234 
235 			rate = &dev->wiphy.bands[band]->bitrates[i];
236 			NLA_PUT_U32(msg, NL80211_BITRATE_ATTR_RATE,
237 				    rate->bitrate);
238 			if (rate->flags & IEEE80211_RATE_SHORT_PREAMBLE)
239 				NLA_PUT_FLAG(msg,
240 					NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE);
241 
242 			nla_nest_end(msg, nl_rate);
243 		}
244 
245 		nla_nest_end(msg, nl_rates);
246 
247 		nla_nest_end(msg, nl_band);
248 	}
249 	nla_nest_end(msg, nl_bands);
250 
251 	nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
252 	if (!nl_cmds)
253 		goto nla_put_failure;
254 
255 	i = 0;
256 #define CMD(op, n)						\
257 	 do {							\
258 		if (dev->ops->op) {				\
259 			i++;					\
260 			NLA_PUT_U32(msg, i, NL80211_CMD_ ## n);	\
261 		}						\
262 	} while (0)
263 
264 	CMD(add_virtual_intf, NEW_INTERFACE);
265 	CMD(change_virtual_intf, SET_INTERFACE);
266 	CMD(add_key, NEW_KEY);
267 	CMD(add_beacon, NEW_BEACON);
268 	CMD(add_station, NEW_STATION);
269 	CMD(add_mpath, NEW_MPATH);
270 	CMD(set_mesh_params, SET_MESH_PARAMS);
271 	CMD(change_bss, SET_BSS);
272 	CMD(auth, AUTHENTICATE);
273 	CMD(assoc, ASSOCIATE);
274 	CMD(deauth, DEAUTHENTICATE);
275 	CMD(disassoc, DISASSOCIATE);
276 
277 #undef CMD
278 	nla_nest_end(msg, nl_cmds);
279 
280 	return genlmsg_end(msg, hdr);
281 
282  nla_put_failure:
283 	genlmsg_cancel(msg, hdr);
284 	return -EMSGSIZE;
285 }
286 
287 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
288 {
289 	int idx = 0;
290 	int start = cb->args[0];
291 	struct cfg80211_registered_device *dev;
292 
293 	mutex_lock(&cfg80211_mutex);
294 	list_for_each_entry(dev, &cfg80211_drv_list, list) {
295 		if (++idx <= start)
296 			continue;
297 		if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).pid,
298 				       cb->nlh->nlmsg_seq, NLM_F_MULTI,
299 				       dev) < 0) {
300 			idx--;
301 			break;
302 		}
303 	}
304 	mutex_unlock(&cfg80211_mutex);
305 
306 	cb->args[0] = idx;
307 
308 	return skb->len;
309 }
310 
311 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
312 {
313 	struct sk_buff *msg;
314 	struct cfg80211_registered_device *dev;
315 
316 	dev = cfg80211_get_dev_from_info(info);
317 	if (IS_ERR(dev))
318 		return PTR_ERR(dev);
319 
320 	msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
321 	if (!msg)
322 		goto out_err;
323 
324 	if (nl80211_send_wiphy(msg, info->snd_pid, info->snd_seq, 0, dev) < 0)
325 		goto out_free;
326 
327 	cfg80211_put_dev(dev);
328 
329 	return genlmsg_unicast(msg, info->snd_pid);
330 
331  out_free:
332 	nlmsg_free(msg);
333  out_err:
334 	cfg80211_put_dev(dev);
335 	return -ENOBUFS;
336 }
337 
338 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
339 	[NL80211_TXQ_ATTR_QUEUE]		= { .type = NLA_U8 },
340 	[NL80211_TXQ_ATTR_TXOP]			= { .type = NLA_U16 },
341 	[NL80211_TXQ_ATTR_CWMIN]		= { .type = NLA_U16 },
342 	[NL80211_TXQ_ATTR_CWMAX]		= { .type = NLA_U16 },
343 	[NL80211_TXQ_ATTR_AIFS]			= { .type = NLA_U8 },
344 };
345 
346 static int parse_txq_params(struct nlattr *tb[],
347 			    struct ieee80211_txq_params *txq_params)
348 {
349 	if (!tb[NL80211_TXQ_ATTR_QUEUE] || !tb[NL80211_TXQ_ATTR_TXOP] ||
350 	    !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
351 	    !tb[NL80211_TXQ_ATTR_AIFS])
352 		return -EINVAL;
353 
354 	txq_params->queue = nla_get_u8(tb[NL80211_TXQ_ATTR_QUEUE]);
355 	txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
356 	txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
357 	txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
358 	txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
359 
360 	return 0;
361 }
362 
363 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
364 {
365 	struct cfg80211_registered_device *rdev;
366 	int result = 0, rem_txq_params = 0;
367 	struct nlattr *nl_txq_params;
368 
369 	rtnl_lock();
370 
371 	mutex_lock(&cfg80211_mutex);
372 
373 	rdev = __cfg80211_drv_from_info(info);
374 	if (IS_ERR(rdev)) {
375 		result = PTR_ERR(rdev);
376 		goto unlock;
377 	}
378 
379 	mutex_lock(&rdev->mtx);
380 
381 	if (info->attrs[NL80211_ATTR_WIPHY_NAME])
382 		result = cfg80211_dev_rename(
383 			rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
384 
385 	mutex_unlock(&cfg80211_mutex);
386 
387 	if (result)
388 		goto bad_res;
389 
390 	if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
391 		struct ieee80211_txq_params txq_params;
392 		struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
393 
394 		if (!rdev->ops->set_txq_params) {
395 			result = -EOPNOTSUPP;
396 			goto bad_res;
397 		}
398 
399 		nla_for_each_nested(nl_txq_params,
400 				    info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
401 				    rem_txq_params) {
402 			nla_parse(tb, NL80211_TXQ_ATTR_MAX,
403 				  nla_data(nl_txq_params),
404 				  nla_len(nl_txq_params),
405 				  txq_params_policy);
406 			result = parse_txq_params(tb, &txq_params);
407 			if (result)
408 				goto bad_res;
409 
410 			result = rdev->ops->set_txq_params(&rdev->wiphy,
411 							   &txq_params);
412 			if (result)
413 				goto bad_res;
414 		}
415 	}
416 
417 	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
418 		enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
419 		struct ieee80211_channel *chan;
420 		struct ieee80211_sta_ht_cap *ht_cap;
421 		u32 freq, sec_freq;
422 
423 		if (!rdev->ops->set_channel) {
424 			result = -EOPNOTSUPP;
425 			goto bad_res;
426 		}
427 
428 		result = -EINVAL;
429 
430 		if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
431 			channel_type = nla_get_u32(info->attrs[
432 					   NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
433 			if (channel_type != NL80211_CHAN_NO_HT &&
434 			    channel_type != NL80211_CHAN_HT20 &&
435 			    channel_type != NL80211_CHAN_HT40PLUS &&
436 			    channel_type != NL80211_CHAN_HT40MINUS)
437 				goto bad_res;
438 		}
439 
440 		freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
441 		chan = ieee80211_get_channel(&rdev->wiphy, freq);
442 
443 		/* Primary channel not allowed */
444 		if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
445 			goto bad_res;
446 
447 		if (channel_type == NL80211_CHAN_HT40MINUS)
448 			sec_freq = freq - 20;
449 		else if (channel_type == NL80211_CHAN_HT40PLUS)
450 			sec_freq = freq + 20;
451 		else
452 			sec_freq = 0;
453 
454 		ht_cap = &rdev->wiphy.bands[chan->band]->ht_cap;
455 
456 		/* no HT capabilities */
457 		if (channel_type != NL80211_CHAN_NO_HT &&
458 		    !ht_cap->ht_supported)
459 			goto bad_res;
460 
461 		if (sec_freq) {
462 			struct ieee80211_channel *schan;
463 
464 			/* no 40 MHz capabilities */
465 			if (!(ht_cap->cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) ||
466 			    (ht_cap->cap & IEEE80211_HT_CAP_40MHZ_INTOLERANT))
467 				goto bad_res;
468 
469 			schan = ieee80211_get_channel(&rdev->wiphy, sec_freq);
470 
471 			/* Secondary channel not allowed */
472 			if (!schan || schan->flags & IEEE80211_CHAN_DISABLED)
473 				goto bad_res;
474 		}
475 
476 		result = rdev->ops->set_channel(&rdev->wiphy, chan,
477 						channel_type);
478 		if (result)
479 			goto bad_res;
480 	}
481 
482 
483  bad_res:
484 	mutex_unlock(&rdev->mtx);
485  unlock:
486 	rtnl_unlock();
487 	return result;
488 }
489 
490 
491 static int nl80211_send_iface(struct sk_buff *msg, u32 pid, u32 seq, int flags,
492 			      struct net_device *dev)
493 {
494 	void *hdr;
495 
496 	hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_INTERFACE);
497 	if (!hdr)
498 		return -1;
499 
500 	NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
501 	NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, dev->name);
502 	NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, dev->ieee80211_ptr->iftype);
503 	return genlmsg_end(msg, hdr);
504 
505  nla_put_failure:
506 	genlmsg_cancel(msg, hdr);
507 	return -EMSGSIZE;
508 }
509 
510 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
511 {
512 	int wp_idx = 0;
513 	int if_idx = 0;
514 	int wp_start = cb->args[0];
515 	int if_start = cb->args[1];
516 	struct cfg80211_registered_device *dev;
517 	struct wireless_dev *wdev;
518 
519 	mutex_lock(&cfg80211_mutex);
520 	list_for_each_entry(dev, &cfg80211_drv_list, list) {
521 		if (wp_idx < wp_start) {
522 			wp_idx++;
523 			continue;
524 		}
525 		if_idx = 0;
526 
527 		mutex_lock(&dev->devlist_mtx);
528 		list_for_each_entry(wdev, &dev->netdev_list, list) {
529 			if (if_idx < if_start) {
530 				if_idx++;
531 				continue;
532 			}
533 			if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).pid,
534 					       cb->nlh->nlmsg_seq, NLM_F_MULTI,
535 					       wdev->netdev) < 0) {
536 				mutex_unlock(&dev->devlist_mtx);
537 				goto out;
538 			}
539 			if_idx++;
540 		}
541 		mutex_unlock(&dev->devlist_mtx);
542 
543 		wp_idx++;
544 	}
545  out:
546 	mutex_unlock(&cfg80211_mutex);
547 
548 	cb->args[0] = wp_idx;
549 	cb->args[1] = if_idx;
550 
551 	return skb->len;
552 }
553 
554 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
555 {
556 	struct sk_buff *msg;
557 	struct cfg80211_registered_device *dev;
558 	struct net_device *netdev;
559 	int err;
560 
561 	err = get_drv_dev_by_info_ifindex(info->attrs, &dev, &netdev);
562 	if (err)
563 		return err;
564 
565 	msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
566 	if (!msg)
567 		goto out_err;
568 
569 	if (nl80211_send_iface(msg, info->snd_pid, info->snd_seq, 0, netdev) < 0)
570 		goto out_free;
571 
572 	dev_put(netdev);
573 	cfg80211_put_dev(dev);
574 
575 	return genlmsg_unicast(msg, info->snd_pid);
576 
577  out_free:
578 	nlmsg_free(msg);
579  out_err:
580 	dev_put(netdev);
581 	cfg80211_put_dev(dev);
582 	return -ENOBUFS;
583 }
584 
585 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
586 	[NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
587 	[NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
588 	[NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
589 	[NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
590 	[NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
591 };
592 
593 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
594 {
595 	struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
596 	int flag;
597 
598 	*mntrflags = 0;
599 
600 	if (!nla)
601 		return -EINVAL;
602 
603 	if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
604 			     nla, mntr_flags_policy))
605 		return -EINVAL;
606 
607 	for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
608 		if (flags[flag])
609 			*mntrflags |= (1<<flag);
610 
611 	return 0;
612 }
613 
614 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
615 {
616 	struct cfg80211_registered_device *drv;
617 	struct vif_params params;
618 	int err, ifindex;
619 	enum nl80211_iftype type;
620 	struct net_device *dev;
621 	u32 _flags, *flags = NULL;
622 	bool change = false;
623 
624 	memset(&params, 0, sizeof(params));
625 
626 	rtnl_lock();
627 
628 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
629 	if (err)
630 		goto unlock_rtnl;
631 
632 	ifindex = dev->ifindex;
633 	type = dev->ieee80211_ptr->iftype;
634 	dev_put(dev);
635 
636 	if (info->attrs[NL80211_ATTR_IFTYPE]) {
637 		enum nl80211_iftype ntype;
638 
639 		ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
640 		if (type != ntype)
641 			change = true;
642 		type = ntype;
643 		if (type > NL80211_IFTYPE_MAX) {
644 			err = -EINVAL;
645 			goto unlock;
646 		}
647 	}
648 
649 	if (!drv->ops->change_virtual_intf ||
650 	    !(drv->wiphy.interface_modes & (1 << type))) {
651 		err = -EOPNOTSUPP;
652 		goto unlock;
653 	}
654 
655 	if (info->attrs[NL80211_ATTR_MESH_ID]) {
656 		if (type != NL80211_IFTYPE_MESH_POINT) {
657 			err = -EINVAL;
658 			goto unlock;
659 		}
660 		params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
661 		params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
662 		change = true;
663 	}
664 
665 	if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
666 		if (type != NL80211_IFTYPE_MONITOR) {
667 			err = -EINVAL;
668 			goto unlock;
669 		}
670 		err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
671 					  &_flags);
672 		if (err)
673 			goto unlock;
674 
675 		flags = &_flags;
676 		change = true;
677 	}
678 
679 	if (change)
680 		err = drv->ops->change_virtual_intf(&drv->wiphy, ifindex,
681 						    type, flags, &params);
682 	else
683 		err = 0;
684 
685 	dev = __dev_get_by_index(&init_net, ifindex);
686 	WARN_ON(!dev || (!err && dev->ieee80211_ptr->iftype != type));
687 
688  unlock:
689 	cfg80211_put_dev(drv);
690  unlock_rtnl:
691 	rtnl_unlock();
692 	return err;
693 }
694 
695 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
696 {
697 	struct cfg80211_registered_device *drv;
698 	struct vif_params params;
699 	int err;
700 	enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
701 	u32 flags;
702 
703 	memset(&params, 0, sizeof(params));
704 
705 	if (!info->attrs[NL80211_ATTR_IFNAME])
706 		return -EINVAL;
707 
708 	if (info->attrs[NL80211_ATTR_IFTYPE]) {
709 		type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
710 		if (type > NL80211_IFTYPE_MAX)
711 			return -EINVAL;
712 	}
713 
714 	rtnl_lock();
715 
716 	drv = cfg80211_get_dev_from_info(info);
717 	if (IS_ERR(drv)) {
718 		err = PTR_ERR(drv);
719 		goto unlock_rtnl;
720 	}
721 
722 	if (!drv->ops->add_virtual_intf ||
723 	    !(drv->wiphy.interface_modes & (1 << type))) {
724 		err = -EOPNOTSUPP;
725 		goto unlock;
726 	}
727 
728 	if (type == NL80211_IFTYPE_MESH_POINT &&
729 	    info->attrs[NL80211_ATTR_MESH_ID]) {
730 		params.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
731 		params.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
732 	}
733 
734 	err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
735 				  info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
736 				  &flags);
737 	err = drv->ops->add_virtual_intf(&drv->wiphy,
738 		nla_data(info->attrs[NL80211_ATTR_IFNAME]),
739 		type, err ? NULL : &flags, &params);
740 
741  unlock:
742 	cfg80211_put_dev(drv);
743  unlock_rtnl:
744 	rtnl_unlock();
745 	return err;
746 }
747 
748 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
749 {
750 	struct cfg80211_registered_device *drv;
751 	int ifindex, err;
752 	struct net_device *dev;
753 
754 	rtnl_lock();
755 
756 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
757 	if (err)
758 		goto unlock_rtnl;
759 	ifindex = dev->ifindex;
760 	dev_put(dev);
761 
762 	if (!drv->ops->del_virtual_intf) {
763 		err = -EOPNOTSUPP;
764 		goto out;
765 	}
766 
767 	err = drv->ops->del_virtual_intf(&drv->wiphy, ifindex);
768 
769  out:
770 	cfg80211_put_dev(drv);
771  unlock_rtnl:
772 	rtnl_unlock();
773 	return err;
774 }
775 
776 struct get_key_cookie {
777 	struct sk_buff *msg;
778 	int error;
779 };
780 
781 static void get_key_callback(void *c, struct key_params *params)
782 {
783 	struct get_key_cookie *cookie = c;
784 
785 	if (params->key)
786 		NLA_PUT(cookie->msg, NL80211_ATTR_KEY_DATA,
787 			params->key_len, params->key);
788 
789 	if (params->seq)
790 		NLA_PUT(cookie->msg, NL80211_ATTR_KEY_SEQ,
791 			params->seq_len, params->seq);
792 
793 	if (params->cipher)
794 		NLA_PUT_U32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
795 			    params->cipher);
796 
797 	return;
798  nla_put_failure:
799 	cookie->error = 1;
800 }
801 
802 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
803 {
804 	struct cfg80211_registered_device *drv;
805 	int err;
806 	struct net_device *dev;
807 	u8 key_idx = 0;
808 	u8 *mac_addr = NULL;
809 	struct get_key_cookie cookie = {
810 		.error = 0,
811 	};
812 	void *hdr;
813 	struct sk_buff *msg;
814 
815 	if (info->attrs[NL80211_ATTR_KEY_IDX])
816 		key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
817 
818 	if (key_idx > 5)
819 		return -EINVAL;
820 
821 	if (info->attrs[NL80211_ATTR_MAC])
822 		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
823 
824 	rtnl_lock();
825 
826 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
827 	if (err)
828 		goto unlock_rtnl;
829 
830 	if (!drv->ops->get_key) {
831 		err = -EOPNOTSUPP;
832 		goto out;
833 	}
834 
835 	msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
836 	if (!msg) {
837 		err = -ENOMEM;
838 		goto out;
839 	}
840 
841 	hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
842 			     NL80211_CMD_NEW_KEY);
843 
844 	if (IS_ERR(hdr)) {
845 		err = PTR_ERR(hdr);
846 		goto out;
847 	}
848 
849 	cookie.msg = msg;
850 
851 	NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
852 	NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
853 	if (mac_addr)
854 		NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
855 
856 	err = drv->ops->get_key(&drv->wiphy, dev, key_idx, mac_addr,
857 				&cookie, get_key_callback);
858 
859 	if (err)
860 		goto out;
861 
862 	if (cookie.error)
863 		goto nla_put_failure;
864 
865 	genlmsg_end(msg, hdr);
866 	err = genlmsg_unicast(msg, info->snd_pid);
867 	goto out;
868 
869  nla_put_failure:
870 	err = -ENOBUFS;
871 	nlmsg_free(msg);
872  out:
873 	cfg80211_put_dev(drv);
874 	dev_put(dev);
875  unlock_rtnl:
876 	rtnl_unlock();
877 
878 	return err;
879 }
880 
881 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
882 {
883 	struct cfg80211_registered_device *drv;
884 	int err;
885 	struct net_device *dev;
886 	u8 key_idx;
887 	int (*func)(struct wiphy *wiphy, struct net_device *netdev,
888 		    u8 key_index);
889 
890 	if (!info->attrs[NL80211_ATTR_KEY_IDX])
891 		return -EINVAL;
892 
893 	key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
894 
895 	if (info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]) {
896 		if (key_idx < 4 || key_idx > 5)
897 			return -EINVAL;
898 	} else if (key_idx > 3)
899 		return -EINVAL;
900 
901 	/* currently only support setting default key */
902 	if (!info->attrs[NL80211_ATTR_KEY_DEFAULT] &&
903 	    !info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT])
904 		return -EINVAL;
905 
906 	rtnl_lock();
907 
908 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
909 	if (err)
910 		goto unlock_rtnl;
911 
912 	if (info->attrs[NL80211_ATTR_KEY_DEFAULT])
913 		func = drv->ops->set_default_key;
914 	else
915 		func = drv->ops->set_default_mgmt_key;
916 
917 	if (!func) {
918 		err = -EOPNOTSUPP;
919 		goto out;
920 	}
921 
922 	err = func(&drv->wiphy, dev, key_idx);
923 
924  out:
925 	cfg80211_put_dev(drv);
926 	dev_put(dev);
927 
928  unlock_rtnl:
929 	rtnl_unlock();
930 
931 	return err;
932 }
933 
934 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
935 {
936 	struct cfg80211_registered_device *drv;
937 	int err;
938 	struct net_device *dev;
939 	struct key_params params;
940 	u8 key_idx = 0;
941 	u8 *mac_addr = NULL;
942 
943 	memset(&params, 0, sizeof(params));
944 
945 	if (!info->attrs[NL80211_ATTR_KEY_CIPHER])
946 		return -EINVAL;
947 
948 	if (info->attrs[NL80211_ATTR_KEY_DATA]) {
949 		params.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
950 		params.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
951 	}
952 
953 	if (info->attrs[NL80211_ATTR_KEY_IDX])
954 		key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
955 
956 	params.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
957 
958 	if (info->attrs[NL80211_ATTR_MAC])
959 		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
960 
961 	if (key_idx > 5)
962 		return -EINVAL;
963 
964 	/*
965 	 * Disallow pairwise keys with non-zero index unless it's WEP
966 	 * (because current deployments use pairwise WEP keys with
967 	 * non-zero indizes but 802.11i clearly specifies to use zero)
968 	 */
969 	if (mac_addr && key_idx &&
970 	    params.cipher != WLAN_CIPHER_SUITE_WEP40 &&
971 	    params.cipher != WLAN_CIPHER_SUITE_WEP104)
972 		return -EINVAL;
973 
974 	/* TODO: add definitions for the lengths to linux/ieee80211.h */
975 	switch (params.cipher) {
976 	case WLAN_CIPHER_SUITE_WEP40:
977 		if (params.key_len != 5)
978 			return -EINVAL;
979 		break;
980 	case WLAN_CIPHER_SUITE_TKIP:
981 		if (params.key_len != 32)
982 			return -EINVAL;
983 		break;
984 	case WLAN_CIPHER_SUITE_CCMP:
985 		if (params.key_len != 16)
986 			return -EINVAL;
987 		break;
988 	case WLAN_CIPHER_SUITE_WEP104:
989 		if (params.key_len != 13)
990 			return -EINVAL;
991 		break;
992 	case WLAN_CIPHER_SUITE_AES_CMAC:
993 		if (params.key_len != 16)
994 			return -EINVAL;
995 		break;
996 	default:
997 		return -EINVAL;
998 	}
999 
1000 	rtnl_lock();
1001 
1002 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1003 	if (err)
1004 		goto unlock_rtnl;
1005 
1006 	if (!drv->ops->add_key) {
1007 		err = -EOPNOTSUPP;
1008 		goto out;
1009 	}
1010 
1011 	err = drv->ops->add_key(&drv->wiphy, dev, key_idx, mac_addr, &params);
1012 
1013  out:
1014 	cfg80211_put_dev(drv);
1015 	dev_put(dev);
1016  unlock_rtnl:
1017 	rtnl_unlock();
1018 
1019 	return err;
1020 }
1021 
1022 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
1023 {
1024 	struct cfg80211_registered_device *drv;
1025 	int err;
1026 	struct net_device *dev;
1027 	u8 key_idx = 0;
1028 	u8 *mac_addr = NULL;
1029 
1030 	if (info->attrs[NL80211_ATTR_KEY_IDX])
1031 		key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1032 
1033 	if (key_idx > 5)
1034 		return -EINVAL;
1035 
1036 	if (info->attrs[NL80211_ATTR_MAC])
1037 		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1038 
1039 	rtnl_lock();
1040 
1041 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1042 	if (err)
1043 		goto unlock_rtnl;
1044 
1045 	if (!drv->ops->del_key) {
1046 		err = -EOPNOTSUPP;
1047 		goto out;
1048 	}
1049 
1050 	err = drv->ops->del_key(&drv->wiphy, dev, key_idx, mac_addr);
1051 
1052  out:
1053 	cfg80211_put_dev(drv);
1054 	dev_put(dev);
1055 
1056  unlock_rtnl:
1057 	rtnl_unlock();
1058 
1059 	return err;
1060 }
1061 
1062 static int nl80211_addset_beacon(struct sk_buff *skb, struct genl_info *info)
1063 {
1064         int (*call)(struct wiphy *wiphy, struct net_device *dev,
1065 		    struct beacon_parameters *info);
1066 	struct cfg80211_registered_device *drv;
1067 	int err;
1068 	struct net_device *dev;
1069 	struct beacon_parameters params;
1070 	int haveinfo = 0;
1071 
1072 	rtnl_lock();
1073 
1074 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1075 	if (err)
1076 		goto unlock_rtnl;
1077 
1078 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1079 		err = -EOPNOTSUPP;
1080 		goto out;
1081 	}
1082 
1083 	switch (info->genlhdr->cmd) {
1084 	case NL80211_CMD_NEW_BEACON:
1085 		/* these are required for NEW_BEACON */
1086 		if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
1087 		    !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
1088 		    !info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1089 			err = -EINVAL;
1090 			goto out;
1091 		}
1092 
1093 		call = drv->ops->add_beacon;
1094 		break;
1095 	case NL80211_CMD_SET_BEACON:
1096 		call = drv->ops->set_beacon;
1097 		break;
1098 	default:
1099 		WARN_ON(1);
1100 		err = -EOPNOTSUPP;
1101 		goto out;
1102 	}
1103 
1104 	if (!call) {
1105 		err = -EOPNOTSUPP;
1106 		goto out;
1107 	}
1108 
1109 	memset(&params, 0, sizeof(params));
1110 
1111 	if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
1112 		params.interval =
1113 		    nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
1114 		haveinfo = 1;
1115 	}
1116 
1117 	if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
1118 		params.dtim_period =
1119 		    nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
1120 		haveinfo = 1;
1121 	}
1122 
1123 	if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
1124 		params.head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1125 		params.head_len =
1126 		    nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
1127 		haveinfo = 1;
1128 	}
1129 
1130 	if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
1131 		params.tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1132 		params.tail_len =
1133 		    nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
1134 		haveinfo = 1;
1135 	}
1136 
1137 	if (!haveinfo) {
1138 		err = -EINVAL;
1139 		goto out;
1140 	}
1141 
1142 	err = call(&drv->wiphy, dev, &params);
1143 
1144  out:
1145 	cfg80211_put_dev(drv);
1146 	dev_put(dev);
1147  unlock_rtnl:
1148 	rtnl_unlock();
1149 
1150 	return err;
1151 }
1152 
1153 static int nl80211_del_beacon(struct sk_buff *skb, struct genl_info *info)
1154 {
1155 	struct cfg80211_registered_device *drv;
1156 	int err;
1157 	struct net_device *dev;
1158 
1159 	rtnl_lock();
1160 
1161 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1162 	if (err)
1163 		goto unlock_rtnl;
1164 
1165 	if (!drv->ops->del_beacon) {
1166 		err = -EOPNOTSUPP;
1167 		goto out;
1168 	}
1169 
1170 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
1171 		err = -EOPNOTSUPP;
1172 		goto out;
1173 	}
1174 	err = drv->ops->del_beacon(&drv->wiphy, dev);
1175 
1176  out:
1177 	cfg80211_put_dev(drv);
1178 	dev_put(dev);
1179  unlock_rtnl:
1180 	rtnl_unlock();
1181 
1182 	return err;
1183 }
1184 
1185 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
1186 	[NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
1187 	[NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
1188 	[NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
1189 };
1190 
1191 static int parse_station_flags(struct nlattr *nla, u32 *staflags)
1192 {
1193 	struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
1194 	int flag;
1195 
1196 	*staflags = 0;
1197 
1198 	if (!nla)
1199 		return 0;
1200 
1201 	if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
1202 			     nla, sta_flags_policy))
1203 		return -EINVAL;
1204 
1205 	*staflags = STATION_FLAG_CHANGED;
1206 
1207 	for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++)
1208 		if (flags[flag])
1209 			*staflags |= (1<<flag);
1210 
1211 	return 0;
1212 }
1213 
1214 static u16 nl80211_calculate_bitrate(struct rate_info *rate)
1215 {
1216 	int modulation, streams, bitrate;
1217 
1218 	if (!(rate->flags & RATE_INFO_FLAGS_MCS))
1219 		return rate->legacy;
1220 
1221 	/* the formula below does only work for MCS values smaller than 32 */
1222 	if (rate->mcs >= 32)
1223 		return 0;
1224 
1225 	modulation = rate->mcs & 7;
1226 	streams = (rate->mcs >> 3) + 1;
1227 
1228 	bitrate = (rate->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) ?
1229 			13500000 : 6500000;
1230 
1231 	if (modulation < 4)
1232 		bitrate *= (modulation + 1);
1233 	else if (modulation == 4)
1234 		bitrate *= (modulation + 2);
1235 	else
1236 		bitrate *= (modulation + 3);
1237 
1238 	bitrate *= streams;
1239 
1240 	if (rate->flags & RATE_INFO_FLAGS_SHORT_GI)
1241 		bitrate = (bitrate / 9) * 10;
1242 
1243 	/* do NOT round down here */
1244 	return (bitrate + 50000) / 100000;
1245 }
1246 
1247 static int nl80211_send_station(struct sk_buff *msg, u32 pid, u32 seq,
1248 				int flags, struct net_device *dev,
1249 				u8 *mac_addr, struct station_info *sinfo)
1250 {
1251 	void *hdr;
1252 	struct nlattr *sinfoattr, *txrate;
1253 	u16 bitrate;
1254 
1255 	hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1256 	if (!hdr)
1257 		return -1;
1258 
1259 	NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1260 	NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
1261 
1262 	sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
1263 	if (!sinfoattr)
1264 		goto nla_put_failure;
1265 	if (sinfo->filled & STATION_INFO_INACTIVE_TIME)
1266 		NLA_PUT_U32(msg, NL80211_STA_INFO_INACTIVE_TIME,
1267 			    sinfo->inactive_time);
1268 	if (sinfo->filled & STATION_INFO_RX_BYTES)
1269 		NLA_PUT_U32(msg, NL80211_STA_INFO_RX_BYTES,
1270 			    sinfo->rx_bytes);
1271 	if (sinfo->filled & STATION_INFO_TX_BYTES)
1272 		NLA_PUT_U32(msg, NL80211_STA_INFO_TX_BYTES,
1273 			    sinfo->tx_bytes);
1274 	if (sinfo->filled & STATION_INFO_LLID)
1275 		NLA_PUT_U16(msg, NL80211_STA_INFO_LLID,
1276 			    sinfo->llid);
1277 	if (sinfo->filled & STATION_INFO_PLID)
1278 		NLA_PUT_U16(msg, NL80211_STA_INFO_PLID,
1279 			    sinfo->plid);
1280 	if (sinfo->filled & STATION_INFO_PLINK_STATE)
1281 		NLA_PUT_U8(msg, NL80211_STA_INFO_PLINK_STATE,
1282 			    sinfo->plink_state);
1283 	if (sinfo->filled & STATION_INFO_SIGNAL)
1284 		NLA_PUT_U8(msg, NL80211_STA_INFO_SIGNAL,
1285 			   sinfo->signal);
1286 	if (sinfo->filled & STATION_INFO_TX_BITRATE) {
1287 		txrate = nla_nest_start(msg, NL80211_STA_INFO_TX_BITRATE);
1288 		if (!txrate)
1289 			goto nla_put_failure;
1290 
1291 		/* nl80211_calculate_bitrate will return 0 for mcs >= 32 */
1292 		bitrate = nl80211_calculate_bitrate(&sinfo->txrate);
1293 		if (bitrate > 0)
1294 			NLA_PUT_U16(msg, NL80211_RATE_INFO_BITRATE, bitrate);
1295 
1296 		if (sinfo->txrate.flags & RATE_INFO_FLAGS_MCS)
1297 			NLA_PUT_U8(msg, NL80211_RATE_INFO_MCS,
1298 				    sinfo->txrate.mcs);
1299 		if (sinfo->txrate.flags & RATE_INFO_FLAGS_40_MHZ_WIDTH)
1300 			NLA_PUT_FLAG(msg, NL80211_RATE_INFO_40_MHZ_WIDTH);
1301 		if (sinfo->txrate.flags & RATE_INFO_FLAGS_SHORT_GI)
1302 			NLA_PUT_FLAG(msg, NL80211_RATE_INFO_SHORT_GI);
1303 
1304 		nla_nest_end(msg, txrate);
1305 	}
1306 	if (sinfo->filled & STATION_INFO_RX_PACKETS)
1307 		NLA_PUT_U32(msg, NL80211_STA_INFO_RX_PACKETS,
1308 			    sinfo->rx_packets);
1309 	if (sinfo->filled & STATION_INFO_TX_PACKETS)
1310 		NLA_PUT_U32(msg, NL80211_STA_INFO_TX_PACKETS,
1311 			    sinfo->tx_packets);
1312 	nla_nest_end(msg, sinfoattr);
1313 
1314 	return genlmsg_end(msg, hdr);
1315 
1316  nla_put_failure:
1317 	genlmsg_cancel(msg, hdr);
1318 	return -EMSGSIZE;
1319 }
1320 
1321 static int nl80211_dump_station(struct sk_buff *skb,
1322 				struct netlink_callback *cb)
1323 {
1324 	struct station_info sinfo;
1325 	struct cfg80211_registered_device *dev;
1326 	struct net_device *netdev;
1327 	u8 mac_addr[ETH_ALEN];
1328 	int ifidx = cb->args[0];
1329 	int sta_idx = cb->args[1];
1330 	int err;
1331 
1332 	if (!ifidx) {
1333 		err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1334 				  nl80211_fam.attrbuf, nl80211_fam.maxattr,
1335 				  nl80211_policy);
1336 		if (err)
1337 			return err;
1338 
1339 		if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1340 			return -EINVAL;
1341 
1342 		ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1343 		if (!ifidx)
1344 			return -EINVAL;
1345 	}
1346 
1347 	rtnl_lock();
1348 
1349 	netdev = __dev_get_by_index(&init_net, ifidx);
1350 	if (!netdev) {
1351 		err = -ENODEV;
1352 		goto out_rtnl;
1353 	}
1354 
1355 	dev = cfg80211_get_dev_from_ifindex(ifidx);
1356 	if (IS_ERR(dev)) {
1357 		err = PTR_ERR(dev);
1358 		goto out_rtnl;
1359 	}
1360 
1361 	if (!dev->ops->dump_station) {
1362 		err = -EOPNOTSUPP;
1363 		goto out_err;
1364 	}
1365 
1366 	while (1) {
1367 		err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
1368 					     mac_addr, &sinfo);
1369 		if (err == -ENOENT)
1370 			break;
1371 		if (err)
1372 			goto out_err;
1373 
1374 		if (nl80211_send_station(skb,
1375 				NETLINK_CB(cb->skb).pid,
1376 				cb->nlh->nlmsg_seq, NLM_F_MULTI,
1377 				netdev, mac_addr,
1378 				&sinfo) < 0)
1379 			goto out;
1380 
1381 		sta_idx++;
1382 	}
1383 
1384 
1385  out:
1386 	cb->args[1] = sta_idx;
1387 	err = skb->len;
1388  out_err:
1389 	cfg80211_put_dev(dev);
1390  out_rtnl:
1391 	rtnl_unlock();
1392 
1393 	return err;
1394 }
1395 
1396 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
1397 {
1398 	struct cfg80211_registered_device *drv;
1399 	int err;
1400 	struct net_device *dev;
1401 	struct station_info sinfo;
1402 	struct sk_buff *msg;
1403 	u8 *mac_addr = NULL;
1404 
1405 	memset(&sinfo, 0, sizeof(sinfo));
1406 
1407 	if (!info->attrs[NL80211_ATTR_MAC])
1408 		return -EINVAL;
1409 
1410 	mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1411 
1412 	rtnl_lock();
1413 
1414 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1415 	if (err)
1416 		goto out_rtnl;
1417 
1418 	if (!drv->ops->get_station) {
1419 		err = -EOPNOTSUPP;
1420 		goto out;
1421 	}
1422 
1423 	err = drv->ops->get_station(&drv->wiphy, dev, mac_addr, &sinfo);
1424 	if (err)
1425 		goto out;
1426 
1427 	msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1428 	if (!msg)
1429 		goto out;
1430 
1431 	if (nl80211_send_station(msg, info->snd_pid, info->snd_seq, 0,
1432 				 dev, mac_addr, &sinfo) < 0)
1433 		goto out_free;
1434 
1435 	err = genlmsg_unicast(msg, info->snd_pid);
1436 	goto out;
1437 
1438  out_free:
1439 	nlmsg_free(msg);
1440  out:
1441 	cfg80211_put_dev(drv);
1442 	dev_put(dev);
1443  out_rtnl:
1444 	rtnl_unlock();
1445 
1446 	return err;
1447 }
1448 
1449 /*
1450  * Get vlan interface making sure it is on the right wiphy.
1451  */
1452 static int get_vlan(struct nlattr *vlanattr,
1453 		    struct cfg80211_registered_device *rdev,
1454 		    struct net_device **vlan)
1455 {
1456 	*vlan = NULL;
1457 
1458 	if (vlanattr) {
1459 		*vlan = dev_get_by_index(&init_net, nla_get_u32(vlanattr));
1460 		if (!*vlan)
1461 			return -ENODEV;
1462 		if (!(*vlan)->ieee80211_ptr)
1463 			return -EINVAL;
1464 		if ((*vlan)->ieee80211_ptr->wiphy != &rdev->wiphy)
1465 			return -EINVAL;
1466 	}
1467 	return 0;
1468 }
1469 
1470 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
1471 {
1472 	struct cfg80211_registered_device *drv;
1473 	int err;
1474 	struct net_device *dev;
1475 	struct station_parameters params;
1476 	u8 *mac_addr = NULL;
1477 
1478 	memset(&params, 0, sizeof(params));
1479 
1480 	params.listen_interval = -1;
1481 
1482 	if (info->attrs[NL80211_ATTR_STA_AID])
1483 		return -EINVAL;
1484 
1485 	if (!info->attrs[NL80211_ATTR_MAC])
1486 		return -EINVAL;
1487 
1488 	mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1489 
1490 	if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
1491 		params.supported_rates =
1492 			nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1493 		params.supported_rates_len =
1494 			nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1495 	}
1496 
1497 	if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1498 		params.listen_interval =
1499 		    nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1500 
1501 	if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1502 		params.ht_capa =
1503 			nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1504 
1505 	if (parse_station_flags(info->attrs[NL80211_ATTR_STA_FLAGS],
1506 				&params.station_flags))
1507 		return -EINVAL;
1508 
1509 	if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
1510 		params.plink_action =
1511 		    nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
1512 
1513 	rtnl_lock();
1514 
1515 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1516 	if (err)
1517 		goto out_rtnl;
1518 
1519 	err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1520 	if (err)
1521 		goto out;
1522 
1523 	if (!drv->ops->change_station) {
1524 		err = -EOPNOTSUPP;
1525 		goto out;
1526 	}
1527 
1528 	err = drv->ops->change_station(&drv->wiphy, dev, mac_addr, &params);
1529 
1530  out:
1531 	if (params.vlan)
1532 		dev_put(params.vlan);
1533 	cfg80211_put_dev(drv);
1534 	dev_put(dev);
1535  out_rtnl:
1536 	rtnl_unlock();
1537 
1538 	return err;
1539 }
1540 
1541 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
1542 {
1543 	struct cfg80211_registered_device *drv;
1544 	int err;
1545 	struct net_device *dev;
1546 	struct station_parameters params;
1547 	u8 *mac_addr = NULL;
1548 
1549 	memset(&params, 0, sizeof(params));
1550 
1551 	if (!info->attrs[NL80211_ATTR_MAC])
1552 		return -EINVAL;
1553 
1554 	if (!info->attrs[NL80211_ATTR_STA_AID])
1555 		return -EINVAL;
1556 
1557 	if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
1558 		return -EINVAL;
1559 
1560 	if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
1561 		return -EINVAL;
1562 
1563 	mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1564 	params.supported_rates =
1565 		nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1566 	params.supported_rates_len =
1567 		nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1568 	params.listen_interval =
1569 		nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1570 	params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
1571 	if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
1572 		params.ht_capa =
1573 			nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
1574 
1575 	if (parse_station_flags(info->attrs[NL80211_ATTR_STA_FLAGS],
1576 				&params.station_flags))
1577 		return -EINVAL;
1578 
1579 	rtnl_lock();
1580 
1581 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1582 	if (err)
1583 		goto out_rtnl;
1584 
1585 	err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
1586 	if (err)
1587 		goto out;
1588 
1589 	if (!drv->ops->add_station) {
1590 		err = -EOPNOTSUPP;
1591 		goto out;
1592 	}
1593 
1594 	if (!netif_running(dev)) {
1595 		err = -ENETDOWN;
1596 		goto out;
1597 	}
1598 
1599 	err = drv->ops->add_station(&drv->wiphy, dev, mac_addr, &params);
1600 
1601  out:
1602 	if (params.vlan)
1603 		dev_put(params.vlan);
1604 	cfg80211_put_dev(drv);
1605 	dev_put(dev);
1606  out_rtnl:
1607 	rtnl_unlock();
1608 
1609 	return err;
1610 }
1611 
1612 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
1613 {
1614 	struct cfg80211_registered_device *drv;
1615 	int err;
1616 	struct net_device *dev;
1617 	u8 *mac_addr = NULL;
1618 
1619 	if (info->attrs[NL80211_ATTR_MAC])
1620 		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
1621 
1622 	rtnl_lock();
1623 
1624 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1625 	if (err)
1626 		goto out_rtnl;
1627 
1628 	if (!drv->ops->del_station) {
1629 		err = -EOPNOTSUPP;
1630 		goto out;
1631 	}
1632 
1633 	err = drv->ops->del_station(&drv->wiphy, dev, mac_addr);
1634 
1635  out:
1636 	cfg80211_put_dev(drv);
1637 	dev_put(dev);
1638  out_rtnl:
1639 	rtnl_unlock();
1640 
1641 	return err;
1642 }
1643 
1644 static int nl80211_send_mpath(struct sk_buff *msg, u32 pid, u32 seq,
1645 				int flags, struct net_device *dev,
1646 				u8 *dst, u8 *next_hop,
1647 				struct mpath_info *pinfo)
1648 {
1649 	void *hdr;
1650 	struct nlattr *pinfoattr;
1651 
1652 	hdr = nl80211hdr_put(msg, pid, seq, flags, NL80211_CMD_NEW_STATION);
1653 	if (!hdr)
1654 		return -1;
1655 
1656 	NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
1657 	NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
1658 	NLA_PUT(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop);
1659 
1660 	pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
1661 	if (!pinfoattr)
1662 		goto nla_put_failure;
1663 	if (pinfo->filled & MPATH_INFO_FRAME_QLEN)
1664 		NLA_PUT_U32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
1665 			    pinfo->frame_qlen);
1666 	if (pinfo->filled & MPATH_INFO_DSN)
1667 		NLA_PUT_U32(msg, NL80211_MPATH_INFO_DSN,
1668 			    pinfo->dsn);
1669 	if (pinfo->filled & MPATH_INFO_METRIC)
1670 		NLA_PUT_U32(msg, NL80211_MPATH_INFO_METRIC,
1671 			    pinfo->metric);
1672 	if (pinfo->filled & MPATH_INFO_EXPTIME)
1673 		NLA_PUT_U32(msg, NL80211_MPATH_INFO_EXPTIME,
1674 			    pinfo->exptime);
1675 	if (pinfo->filled & MPATH_INFO_FLAGS)
1676 		NLA_PUT_U8(msg, NL80211_MPATH_INFO_FLAGS,
1677 			    pinfo->flags);
1678 	if (pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT)
1679 		NLA_PUT_U32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
1680 			    pinfo->discovery_timeout);
1681 	if (pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES)
1682 		NLA_PUT_U8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
1683 			    pinfo->discovery_retries);
1684 
1685 	nla_nest_end(msg, pinfoattr);
1686 
1687 	return genlmsg_end(msg, hdr);
1688 
1689  nla_put_failure:
1690 	genlmsg_cancel(msg, hdr);
1691 	return -EMSGSIZE;
1692 }
1693 
1694 static int nl80211_dump_mpath(struct sk_buff *skb,
1695 			      struct netlink_callback *cb)
1696 {
1697 	struct mpath_info pinfo;
1698 	struct cfg80211_registered_device *dev;
1699 	struct net_device *netdev;
1700 	u8 dst[ETH_ALEN];
1701 	u8 next_hop[ETH_ALEN];
1702 	int ifidx = cb->args[0];
1703 	int path_idx = cb->args[1];
1704 	int err;
1705 
1706 	if (!ifidx) {
1707 		err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1708 				  nl80211_fam.attrbuf, nl80211_fam.maxattr,
1709 				  nl80211_policy);
1710 		if (err)
1711 			return err;
1712 
1713 		if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
1714 			return -EINVAL;
1715 
1716 		ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
1717 		if (!ifidx)
1718 			return -EINVAL;
1719 	}
1720 
1721 	rtnl_lock();
1722 
1723 	netdev = __dev_get_by_index(&init_net, ifidx);
1724 	if (!netdev) {
1725 		err = -ENODEV;
1726 		goto out_rtnl;
1727 	}
1728 
1729 	dev = cfg80211_get_dev_from_ifindex(ifidx);
1730 	if (IS_ERR(dev)) {
1731 		err = PTR_ERR(dev);
1732 		goto out_rtnl;
1733 	}
1734 
1735 	if (!dev->ops->dump_mpath) {
1736 		err = -EOPNOTSUPP;
1737 		goto out_err;
1738 	}
1739 
1740 	if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1741 		err = -EOPNOTSUPP;
1742 		goto out;
1743 	}
1744 
1745 	while (1) {
1746 		err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
1747 					   dst, next_hop, &pinfo);
1748 		if (err == -ENOENT)
1749 			break;
1750 		if (err)
1751 			goto out_err;
1752 
1753 		if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).pid,
1754 				       cb->nlh->nlmsg_seq, NLM_F_MULTI,
1755 				       netdev, dst, next_hop,
1756 				       &pinfo) < 0)
1757 			goto out;
1758 
1759 		path_idx++;
1760 	}
1761 
1762 
1763  out:
1764 	cb->args[1] = path_idx;
1765 	err = skb->len;
1766  out_err:
1767 	cfg80211_put_dev(dev);
1768  out_rtnl:
1769 	rtnl_unlock();
1770 
1771 	return err;
1772 }
1773 
1774 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
1775 {
1776 	struct cfg80211_registered_device *drv;
1777 	int err;
1778 	struct net_device *dev;
1779 	struct mpath_info pinfo;
1780 	struct sk_buff *msg;
1781 	u8 *dst = NULL;
1782 	u8 next_hop[ETH_ALEN];
1783 
1784 	memset(&pinfo, 0, sizeof(pinfo));
1785 
1786 	if (!info->attrs[NL80211_ATTR_MAC])
1787 		return -EINVAL;
1788 
1789 	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1790 
1791 	rtnl_lock();
1792 
1793 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1794 	if (err)
1795 		goto out_rtnl;
1796 
1797 	if (!drv->ops->get_mpath) {
1798 		err = -EOPNOTSUPP;
1799 		goto out;
1800 	}
1801 
1802 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1803 		err = -EOPNOTSUPP;
1804 		goto out;
1805 	}
1806 
1807 	err = drv->ops->get_mpath(&drv->wiphy, dev, dst, next_hop, &pinfo);
1808 	if (err)
1809 		goto out;
1810 
1811 	msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
1812 	if (!msg)
1813 		goto out;
1814 
1815 	if (nl80211_send_mpath(msg, info->snd_pid, info->snd_seq, 0,
1816 				 dev, dst, next_hop, &pinfo) < 0)
1817 		goto out_free;
1818 
1819 	err = genlmsg_unicast(msg, info->snd_pid);
1820 	goto out;
1821 
1822  out_free:
1823 	nlmsg_free(msg);
1824  out:
1825 	cfg80211_put_dev(drv);
1826 	dev_put(dev);
1827  out_rtnl:
1828 	rtnl_unlock();
1829 
1830 	return err;
1831 }
1832 
1833 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
1834 {
1835 	struct cfg80211_registered_device *drv;
1836 	int err;
1837 	struct net_device *dev;
1838 	u8 *dst = NULL;
1839 	u8 *next_hop = NULL;
1840 
1841 	if (!info->attrs[NL80211_ATTR_MAC])
1842 		return -EINVAL;
1843 
1844 	if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
1845 		return -EINVAL;
1846 
1847 	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1848 	next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
1849 
1850 	rtnl_lock();
1851 
1852 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1853 	if (err)
1854 		goto out_rtnl;
1855 
1856 	if (!drv->ops->change_mpath) {
1857 		err = -EOPNOTSUPP;
1858 		goto out;
1859 	}
1860 
1861 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1862 		err = -EOPNOTSUPP;
1863 		goto out;
1864 	}
1865 
1866 	if (!netif_running(dev)) {
1867 		err = -ENETDOWN;
1868 		goto out;
1869 	}
1870 
1871 	err = drv->ops->change_mpath(&drv->wiphy, dev, dst, next_hop);
1872 
1873  out:
1874 	cfg80211_put_dev(drv);
1875 	dev_put(dev);
1876  out_rtnl:
1877 	rtnl_unlock();
1878 
1879 	return err;
1880 }
1881 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
1882 {
1883 	struct cfg80211_registered_device *drv;
1884 	int err;
1885 	struct net_device *dev;
1886 	u8 *dst = NULL;
1887 	u8 *next_hop = NULL;
1888 
1889 	if (!info->attrs[NL80211_ATTR_MAC])
1890 		return -EINVAL;
1891 
1892 	if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
1893 		return -EINVAL;
1894 
1895 	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1896 	next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
1897 
1898 	rtnl_lock();
1899 
1900 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1901 	if (err)
1902 		goto out_rtnl;
1903 
1904 	if (!drv->ops->add_mpath) {
1905 		err = -EOPNOTSUPP;
1906 		goto out;
1907 	}
1908 
1909 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
1910 		err = -EOPNOTSUPP;
1911 		goto out;
1912 	}
1913 
1914 	if (!netif_running(dev)) {
1915 		err = -ENETDOWN;
1916 		goto out;
1917 	}
1918 
1919 	err = drv->ops->add_mpath(&drv->wiphy, dev, dst, next_hop);
1920 
1921  out:
1922 	cfg80211_put_dev(drv);
1923 	dev_put(dev);
1924  out_rtnl:
1925 	rtnl_unlock();
1926 
1927 	return err;
1928 }
1929 
1930 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
1931 {
1932 	struct cfg80211_registered_device *drv;
1933 	int err;
1934 	struct net_device *dev;
1935 	u8 *dst = NULL;
1936 
1937 	if (info->attrs[NL80211_ATTR_MAC])
1938 		dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
1939 
1940 	rtnl_lock();
1941 
1942 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1943 	if (err)
1944 		goto out_rtnl;
1945 
1946 	if (!drv->ops->del_mpath) {
1947 		err = -EOPNOTSUPP;
1948 		goto out;
1949 	}
1950 
1951 	err = drv->ops->del_mpath(&drv->wiphy, dev, dst);
1952 
1953  out:
1954 	cfg80211_put_dev(drv);
1955 	dev_put(dev);
1956  out_rtnl:
1957 	rtnl_unlock();
1958 
1959 	return err;
1960 }
1961 
1962 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
1963 {
1964 	struct cfg80211_registered_device *drv;
1965 	int err;
1966 	struct net_device *dev;
1967 	struct bss_parameters params;
1968 
1969 	memset(&params, 0, sizeof(params));
1970 	/* default to not changing parameters */
1971 	params.use_cts_prot = -1;
1972 	params.use_short_preamble = -1;
1973 	params.use_short_slot_time = -1;
1974 
1975 	if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
1976 		params.use_cts_prot =
1977 		    nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
1978 	if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
1979 		params.use_short_preamble =
1980 		    nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
1981 	if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
1982 		params.use_short_slot_time =
1983 		    nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
1984 	if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
1985 		params.basic_rates =
1986 			nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
1987 		params.basic_rates_len =
1988 			nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
1989 	}
1990 
1991 	rtnl_lock();
1992 
1993 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
1994 	if (err)
1995 		goto out_rtnl;
1996 
1997 	if (!drv->ops->change_bss) {
1998 		err = -EOPNOTSUPP;
1999 		goto out;
2000 	}
2001 
2002 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP) {
2003 		err = -EOPNOTSUPP;
2004 		goto out;
2005 	}
2006 
2007 	err = drv->ops->change_bss(&drv->wiphy, dev, &params);
2008 
2009  out:
2010 	cfg80211_put_dev(drv);
2011 	dev_put(dev);
2012  out_rtnl:
2013 	rtnl_unlock();
2014 
2015 	return err;
2016 }
2017 
2018 static const struct nla_policy
2019 	reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
2020 	[NL80211_ATTR_REG_RULE_FLAGS]		= { .type = NLA_U32 },
2021 	[NL80211_ATTR_FREQ_RANGE_START]		= { .type = NLA_U32 },
2022 	[NL80211_ATTR_FREQ_RANGE_END]		= { .type = NLA_U32 },
2023 	[NL80211_ATTR_FREQ_RANGE_MAX_BW]	= { .type = NLA_U32 },
2024 	[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]	= { .type = NLA_U32 },
2025 	[NL80211_ATTR_POWER_RULE_MAX_EIRP]	= { .type = NLA_U32 },
2026 };
2027 
2028 static int parse_reg_rule(struct nlattr *tb[],
2029 	struct ieee80211_reg_rule *reg_rule)
2030 {
2031 	struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
2032 	struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
2033 
2034 	if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
2035 		return -EINVAL;
2036 	if (!tb[NL80211_ATTR_FREQ_RANGE_START])
2037 		return -EINVAL;
2038 	if (!tb[NL80211_ATTR_FREQ_RANGE_END])
2039 		return -EINVAL;
2040 	if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
2041 		return -EINVAL;
2042 	if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
2043 		return -EINVAL;
2044 
2045 	reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
2046 
2047 	freq_range->start_freq_khz =
2048 		nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
2049 	freq_range->end_freq_khz =
2050 		nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
2051 	freq_range->max_bandwidth_khz =
2052 		nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
2053 
2054 	power_rule->max_eirp =
2055 		nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
2056 
2057 	if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
2058 		power_rule->max_antenna_gain =
2059 			nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
2060 
2061 	return 0;
2062 }
2063 
2064 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
2065 {
2066 	int r;
2067 	char *data = NULL;
2068 
2069 	/*
2070 	 * You should only get this when cfg80211 hasn't yet initialized
2071 	 * completely when built-in to the kernel right between the time
2072 	 * window between nl80211_init() and regulatory_init(), if that is
2073 	 * even possible.
2074 	 */
2075 	mutex_lock(&cfg80211_mutex);
2076 	if (unlikely(!cfg80211_regdomain)) {
2077 		mutex_unlock(&cfg80211_mutex);
2078 		return -EINPROGRESS;
2079 	}
2080 	mutex_unlock(&cfg80211_mutex);
2081 
2082 	if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2083 		return -EINVAL;
2084 
2085 	data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2086 
2087 #ifdef CONFIG_WIRELESS_OLD_REGULATORY
2088 	/* We ignore world regdom requests with the old regdom setup */
2089 	if (is_world_regdom(data))
2090 		return -EINVAL;
2091 #endif
2092 
2093 	r = regulatory_hint_user(data);
2094 
2095 	return r;
2096 }
2097 
2098 static int nl80211_get_mesh_params(struct sk_buff *skb,
2099 	struct genl_info *info)
2100 {
2101 	struct cfg80211_registered_device *drv;
2102 	struct mesh_config cur_params;
2103 	int err;
2104 	struct net_device *dev;
2105 	void *hdr;
2106 	struct nlattr *pinfoattr;
2107 	struct sk_buff *msg;
2108 
2109 	rtnl_lock();
2110 
2111 	/* Look up our device */
2112 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2113 	if (err)
2114 		goto out_rtnl;
2115 
2116 	if (!drv->ops->get_mesh_params) {
2117 		err = -EOPNOTSUPP;
2118 		goto out;
2119 	}
2120 
2121 	/* Get the mesh params */
2122 	err = drv->ops->get_mesh_params(&drv->wiphy, dev, &cur_params);
2123 	if (err)
2124 		goto out;
2125 
2126 	/* Draw up a netlink message to send back */
2127 	msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2128 	if (!msg) {
2129 		err = -ENOBUFS;
2130 		goto out;
2131 	}
2132 	hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2133 			     NL80211_CMD_GET_MESH_PARAMS);
2134 	if (!hdr)
2135 		goto nla_put_failure;
2136 	pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_PARAMS);
2137 	if (!pinfoattr)
2138 		goto nla_put_failure;
2139 	NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2140 	NLA_PUT_U16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
2141 			cur_params.dot11MeshRetryTimeout);
2142 	NLA_PUT_U16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
2143 			cur_params.dot11MeshConfirmTimeout);
2144 	NLA_PUT_U16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
2145 			cur_params.dot11MeshHoldingTimeout);
2146 	NLA_PUT_U16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
2147 			cur_params.dot11MeshMaxPeerLinks);
2148 	NLA_PUT_U8(msg, NL80211_MESHCONF_MAX_RETRIES,
2149 			cur_params.dot11MeshMaxRetries);
2150 	NLA_PUT_U8(msg, NL80211_MESHCONF_TTL,
2151 			cur_params.dot11MeshTTL);
2152 	NLA_PUT_U8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
2153 			cur_params.auto_open_plinks);
2154 	NLA_PUT_U8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2155 			cur_params.dot11MeshHWMPmaxPREQretries);
2156 	NLA_PUT_U32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
2157 			cur_params.path_refresh_time);
2158 	NLA_PUT_U16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2159 			cur_params.min_discovery_timeout);
2160 	NLA_PUT_U32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2161 			cur_params.dot11MeshHWMPactivePathTimeout);
2162 	NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2163 			cur_params.dot11MeshHWMPpreqMinInterval);
2164 	NLA_PUT_U16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2165 			cur_params.dot11MeshHWMPnetDiameterTraversalTime);
2166 	nla_nest_end(msg, pinfoattr);
2167 	genlmsg_end(msg, hdr);
2168 	err = genlmsg_unicast(msg, info->snd_pid);
2169 	goto out;
2170 
2171  nla_put_failure:
2172 	genlmsg_cancel(msg, hdr);
2173 	err = -EMSGSIZE;
2174  out:
2175 	/* Cleanup */
2176 	cfg80211_put_dev(drv);
2177 	dev_put(dev);
2178  out_rtnl:
2179 	rtnl_unlock();
2180 
2181 	return err;
2182 }
2183 
2184 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
2185 do {\
2186 	if (table[attr_num]) {\
2187 		cfg.param = nla_fn(table[attr_num]); \
2188 		mask |= (1 << (attr_num - 1)); \
2189 	} \
2190 } while (0);\
2191 
2192 static struct nla_policy
2193 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] __read_mostly = {
2194 	[NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
2195 	[NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
2196 	[NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
2197 	[NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
2198 	[NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
2199 	[NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
2200 	[NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
2201 
2202 	[NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
2203 	[NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
2204 	[NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
2205 	[NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
2206 	[NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
2207 	[NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
2208 };
2209 
2210 static int nl80211_set_mesh_params(struct sk_buff *skb, struct genl_info *info)
2211 {
2212 	int err;
2213 	u32 mask;
2214 	struct cfg80211_registered_device *drv;
2215 	struct net_device *dev;
2216 	struct mesh_config cfg;
2217 	struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
2218 	struct nlattr *parent_attr;
2219 
2220 	parent_attr = info->attrs[NL80211_ATTR_MESH_PARAMS];
2221 	if (!parent_attr)
2222 		return -EINVAL;
2223 	if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
2224 			parent_attr, nl80211_meshconf_params_policy))
2225 		return -EINVAL;
2226 
2227 	rtnl_lock();
2228 
2229 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2230 	if (err)
2231 		goto out_rtnl;
2232 
2233 	if (!drv->ops->set_mesh_params) {
2234 		err = -EOPNOTSUPP;
2235 		goto out;
2236 	}
2237 
2238 	/* This makes sure that there aren't more than 32 mesh config
2239 	 * parameters (otherwise our bitfield scheme would not work.) */
2240 	BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
2241 
2242 	/* Fill in the params struct */
2243 	mask = 0;
2244 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
2245 			mask, NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
2246 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
2247 			mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, nla_get_u16);
2248 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
2249 			mask, NL80211_MESHCONF_HOLDING_TIMEOUT, nla_get_u16);
2250 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
2251 			mask, NL80211_MESHCONF_MAX_PEER_LINKS, nla_get_u16);
2252 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
2253 			mask, NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
2254 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
2255 			mask, NL80211_MESHCONF_TTL, nla_get_u8);
2256 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
2257 			mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, nla_get_u8);
2258 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
2259 			mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
2260 			nla_get_u8);
2261 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
2262 			mask, NL80211_MESHCONF_PATH_REFRESH_TIME, nla_get_u32);
2263 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
2264 			mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
2265 			nla_get_u16);
2266 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
2267 			mask, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
2268 			nla_get_u32);
2269 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
2270 			mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
2271 			nla_get_u16);
2272 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
2273 			dot11MeshHWMPnetDiameterTraversalTime,
2274 			mask, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
2275 			nla_get_u16);
2276 
2277 	/* Apply changes */
2278 	err = drv->ops->set_mesh_params(&drv->wiphy, dev, &cfg, mask);
2279 
2280  out:
2281 	/* cleanup */
2282 	cfg80211_put_dev(drv);
2283 	dev_put(dev);
2284  out_rtnl:
2285 	rtnl_unlock();
2286 
2287 	return err;
2288 }
2289 
2290 #undef FILL_IN_MESH_PARAM_IF_SET
2291 
2292 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
2293 {
2294 	struct sk_buff *msg;
2295 	void *hdr = NULL;
2296 	struct nlattr *nl_reg_rules;
2297 	unsigned int i;
2298 	int err = -EINVAL;
2299 
2300 	mutex_lock(&cfg80211_mutex);
2301 
2302 	if (!cfg80211_regdomain)
2303 		goto out;
2304 
2305 	msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
2306 	if (!msg) {
2307 		err = -ENOBUFS;
2308 		goto out;
2309 	}
2310 
2311 	hdr = nl80211hdr_put(msg, info->snd_pid, info->snd_seq, 0,
2312 			     NL80211_CMD_GET_REG);
2313 	if (!hdr)
2314 		goto nla_put_failure;
2315 
2316 	NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2,
2317 		cfg80211_regdomain->alpha2);
2318 
2319 	nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
2320 	if (!nl_reg_rules)
2321 		goto nla_put_failure;
2322 
2323 	for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
2324 		struct nlattr *nl_reg_rule;
2325 		const struct ieee80211_reg_rule *reg_rule;
2326 		const struct ieee80211_freq_range *freq_range;
2327 		const struct ieee80211_power_rule *power_rule;
2328 
2329 		reg_rule = &cfg80211_regdomain->reg_rules[i];
2330 		freq_range = &reg_rule->freq_range;
2331 		power_rule = &reg_rule->power_rule;
2332 
2333 		nl_reg_rule = nla_nest_start(msg, i);
2334 		if (!nl_reg_rule)
2335 			goto nla_put_failure;
2336 
2337 		NLA_PUT_U32(msg, NL80211_ATTR_REG_RULE_FLAGS,
2338 			reg_rule->flags);
2339 		NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_START,
2340 			freq_range->start_freq_khz);
2341 		NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_END,
2342 			freq_range->end_freq_khz);
2343 		NLA_PUT_U32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
2344 			freq_range->max_bandwidth_khz);
2345 		NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
2346 			power_rule->max_antenna_gain);
2347 		NLA_PUT_U32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
2348 			power_rule->max_eirp);
2349 
2350 		nla_nest_end(msg, nl_reg_rule);
2351 	}
2352 
2353 	nla_nest_end(msg, nl_reg_rules);
2354 
2355 	genlmsg_end(msg, hdr);
2356 	err = genlmsg_unicast(msg, info->snd_pid);
2357 	goto out;
2358 
2359 nla_put_failure:
2360 	genlmsg_cancel(msg, hdr);
2361 	err = -EMSGSIZE;
2362 out:
2363 	mutex_unlock(&cfg80211_mutex);
2364 	return err;
2365 }
2366 
2367 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
2368 {
2369 	struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
2370 	struct nlattr *nl_reg_rule;
2371 	char *alpha2 = NULL;
2372 	int rem_reg_rules = 0, r = 0;
2373 	u32 num_rules = 0, rule_idx = 0, size_of_regd;
2374 	struct ieee80211_regdomain *rd = NULL;
2375 
2376 	if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
2377 		return -EINVAL;
2378 
2379 	if (!info->attrs[NL80211_ATTR_REG_RULES])
2380 		return -EINVAL;
2381 
2382 	alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
2383 
2384 	nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2385 			rem_reg_rules) {
2386 		num_rules++;
2387 		if (num_rules > NL80211_MAX_SUPP_REG_RULES)
2388 			goto bad_reg;
2389 	}
2390 
2391 	if (!reg_is_valid_request(alpha2))
2392 		return -EINVAL;
2393 
2394 	size_of_regd = sizeof(struct ieee80211_regdomain) +
2395 		(num_rules * sizeof(struct ieee80211_reg_rule));
2396 
2397 	rd = kzalloc(size_of_regd, GFP_KERNEL);
2398 	if (!rd)
2399 		return -ENOMEM;
2400 
2401 	rd->n_reg_rules = num_rules;
2402 	rd->alpha2[0] = alpha2[0];
2403 	rd->alpha2[1] = alpha2[1];
2404 
2405 	nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
2406 			rem_reg_rules) {
2407 		nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
2408 			nla_data(nl_reg_rule), nla_len(nl_reg_rule),
2409 			reg_rule_policy);
2410 		r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
2411 		if (r)
2412 			goto bad_reg;
2413 
2414 		rule_idx++;
2415 
2416 		if (rule_idx > NL80211_MAX_SUPP_REG_RULES)
2417 			goto bad_reg;
2418 	}
2419 
2420 	BUG_ON(rule_idx != num_rules);
2421 
2422 	mutex_lock(&cfg80211_mutex);
2423 	r = set_regdom(rd);
2424 	mutex_unlock(&cfg80211_mutex);
2425 	return r;
2426 
2427  bad_reg:
2428 	kfree(rd);
2429 	return -EINVAL;
2430 }
2431 
2432 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
2433 {
2434 	struct cfg80211_registered_device *drv;
2435 	struct net_device *dev;
2436 	struct cfg80211_scan_request *request;
2437 	struct cfg80211_ssid *ssid;
2438 	struct ieee80211_channel *channel;
2439 	struct nlattr *attr;
2440 	struct wiphy *wiphy;
2441 	int err, tmp, n_ssids = 0, n_channels = 0, i;
2442 	enum ieee80211_band band;
2443 	size_t ie_len;
2444 
2445 	rtnl_lock();
2446 
2447 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2448 	if (err)
2449 		goto out_rtnl;
2450 
2451 	wiphy = &drv->wiphy;
2452 
2453 	if (!drv->ops->scan) {
2454 		err = -EOPNOTSUPP;
2455 		goto out;
2456 	}
2457 
2458 	if (!netif_running(dev)) {
2459 		err = -ENETDOWN;
2460 		goto out;
2461 	}
2462 
2463 	if (drv->scan_req) {
2464 		err = -EBUSY;
2465 		goto out;
2466 	}
2467 
2468 	if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2469 		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp)
2470 			n_channels++;
2471 		if (!n_channels) {
2472 			err = -EINVAL;
2473 			goto out;
2474 		}
2475 	} else {
2476 		for (band = 0; band < IEEE80211_NUM_BANDS; band++)
2477 			if (wiphy->bands[band])
2478 				n_channels += wiphy->bands[band]->n_channels;
2479 	}
2480 
2481 	if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
2482 		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
2483 			n_ssids++;
2484 
2485 	if (n_ssids > wiphy->max_scan_ssids) {
2486 		err = -EINVAL;
2487 		goto out;
2488 	}
2489 
2490 	if (info->attrs[NL80211_ATTR_IE])
2491 		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2492 	else
2493 		ie_len = 0;
2494 
2495 	request = kzalloc(sizeof(*request)
2496 			+ sizeof(*ssid) * n_ssids
2497 			+ sizeof(channel) * n_channels
2498 			+ ie_len, GFP_KERNEL);
2499 	if (!request) {
2500 		err = -ENOMEM;
2501 		goto out;
2502 	}
2503 
2504 	request->channels = (void *)((char *)request + sizeof(*request));
2505 	request->n_channels = n_channels;
2506 	if (n_ssids)
2507 		request->ssids = (void *)(request->channels + n_channels);
2508 	request->n_ssids = n_ssids;
2509 	if (ie_len) {
2510 		if (request->ssids)
2511 			request->ie = (void *)(request->ssids + n_ssids);
2512 		else
2513 			request->ie = (void *)(request->channels + n_channels);
2514 	}
2515 
2516 	if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
2517 		/* user specified, bail out if channel not found */
2518 		request->n_channels = n_channels;
2519 		i = 0;
2520 		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
2521 			request->channels[i] = ieee80211_get_channel(wiphy, nla_get_u32(attr));
2522 			if (!request->channels[i]) {
2523 				err = -EINVAL;
2524 				goto out_free;
2525 			}
2526 			i++;
2527 		}
2528 	} else {
2529 		/* all channels */
2530 		i = 0;
2531 		for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
2532 			int j;
2533 			if (!wiphy->bands[band])
2534 				continue;
2535 			for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
2536 				request->channels[i] = &wiphy->bands[band]->channels[j];
2537 				i++;
2538 			}
2539 		}
2540 	}
2541 
2542 	i = 0;
2543 	if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
2544 		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
2545 			if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) {
2546 				err = -EINVAL;
2547 				goto out_free;
2548 			}
2549 			memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
2550 			request->ssids[i].ssid_len = nla_len(attr);
2551 			i++;
2552 		}
2553 	}
2554 
2555 	if (info->attrs[NL80211_ATTR_IE]) {
2556 		request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2557 		memcpy(request->ie, nla_data(info->attrs[NL80211_ATTR_IE]),
2558 		       request->ie_len);
2559 	}
2560 
2561 	request->ifidx = dev->ifindex;
2562 	request->wiphy = &drv->wiphy;
2563 
2564 	drv->scan_req = request;
2565 	err = drv->ops->scan(&drv->wiphy, dev, request);
2566 
2567  out_free:
2568 	if (err) {
2569 		drv->scan_req = NULL;
2570 		kfree(request);
2571 	}
2572  out:
2573 	cfg80211_put_dev(drv);
2574 	dev_put(dev);
2575  out_rtnl:
2576 	rtnl_unlock();
2577 
2578 	return err;
2579 }
2580 
2581 static int nl80211_send_bss(struct sk_buff *msg, u32 pid, u32 seq, int flags,
2582 			    struct cfg80211_registered_device *rdev,
2583 			    struct net_device *dev,
2584 			    struct cfg80211_bss *res)
2585 {
2586 	void *hdr;
2587 	struct nlattr *bss;
2588 
2589 	hdr = nl80211hdr_put(msg, pid, seq, flags,
2590 			     NL80211_CMD_NEW_SCAN_RESULTS);
2591 	if (!hdr)
2592 		return -1;
2593 
2594 	NLA_PUT_U32(msg, NL80211_ATTR_SCAN_GENERATION,
2595 		    rdev->bss_generation);
2596 	NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, dev->ifindex);
2597 
2598 	bss = nla_nest_start(msg, NL80211_ATTR_BSS);
2599 	if (!bss)
2600 		goto nla_put_failure;
2601 	if (!is_zero_ether_addr(res->bssid))
2602 		NLA_PUT(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid);
2603 	if (res->information_elements && res->len_information_elements)
2604 		NLA_PUT(msg, NL80211_BSS_INFORMATION_ELEMENTS,
2605 			res->len_information_elements,
2606 			res->information_elements);
2607 	if (res->tsf)
2608 		NLA_PUT_U64(msg, NL80211_BSS_TSF, res->tsf);
2609 	if (res->beacon_interval)
2610 		NLA_PUT_U16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval);
2611 	NLA_PUT_U16(msg, NL80211_BSS_CAPABILITY, res->capability);
2612 	NLA_PUT_U32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq);
2613 
2614 	switch (rdev->wiphy.signal_type) {
2615 	case CFG80211_SIGNAL_TYPE_MBM:
2616 		NLA_PUT_U32(msg, NL80211_BSS_SIGNAL_MBM, res->signal);
2617 		break;
2618 	case CFG80211_SIGNAL_TYPE_UNSPEC:
2619 		NLA_PUT_U8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal);
2620 		break;
2621 	default:
2622 		break;
2623 	}
2624 
2625 	nla_nest_end(msg, bss);
2626 
2627 	return genlmsg_end(msg, hdr);
2628 
2629  nla_put_failure:
2630 	genlmsg_cancel(msg, hdr);
2631 	return -EMSGSIZE;
2632 }
2633 
2634 static int nl80211_dump_scan(struct sk_buff *skb,
2635 			     struct netlink_callback *cb)
2636 {
2637 	struct cfg80211_registered_device *dev;
2638 	struct net_device *netdev;
2639 	struct cfg80211_internal_bss *scan;
2640 	int ifidx = cb->args[0];
2641 	int start = cb->args[1], idx = 0;
2642 	int err;
2643 
2644 	if (!ifidx) {
2645 		err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
2646 				  nl80211_fam.attrbuf, nl80211_fam.maxattr,
2647 				  nl80211_policy);
2648 		if (err)
2649 			return err;
2650 
2651 		if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
2652 			return -EINVAL;
2653 
2654 		ifidx = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
2655 		if (!ifidx)
2656 			return -EINVAL;
2657 		cb->args[0] = ifidx;
2658 	}
2659 
2660 	netdev = dev_get_by_index(&init_net, ifidx);
2661 	if (!netdev)
2662 		return -ENODEV;
2663 
2664 	dev = cfg80211_get_dev_from_ifindex(ifidx);
2665 	if (IS_ERR(dev)) {
2666 		err = PTR_ERR(dev);
2667 		goto out_put_netdev;
2668 	}
2669 
2670 	spin_lock_bh(&dev->bss_lock);
2671 	cfg80211_bss_expire(dev);
2672 
2673 	list_for_each_entry(scan, &dev->bss_list, list) {
2674 		if (++idx <= start)
2675 			continue;
2676 		if (nl80211_send_bss(skb,
2677 				NETLINK_CB(cb->skb).pid,
2678 				cb->nlh->nlmsg_seq, NLM_F_MULTI,
2679 				dev, netdev, &scan->pub) < 0) {
2680 			idx--;
2681 			goto out;
2682 		}
2683 	}
2684 
2685  out:
2686 	spin_unlock_bh(&dev->bss_lock);
2687 
2688 	cb->args[1] = idx;
2689 	err = skb->len;
2690 	cfg80211_put_dev(dev);
2691  out_put_netdev:
2692 	dev_put(netdev);
2693 
2694 	return err;
2695 }
2696 
2697 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
2698 {
2699 	return auth_type == NL80211_AUTHTYPE_OPEN_SYSTEM ||
2700 		auth_type == NL80211_AUTHTYPE_SHARED_KEY ||
2701 		auth_type == NL80211_AUTHTYPE_FT ||
2702 		auth_type == NL80211_AUTHTYPE_NETWORK_EAP;
2703 }
2704 
2705 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
2706 {
2707 	struct cfg80211_registered_device *drv;
2708 	struct net_device *dev;
2709 	struct cfg80211_auth_request req;
2710 	struct wiphy *wiphy;
2711 	int err;
2712 
2713 	rtnl_lock();
2714 
2715 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2716 	if (err)
2717 		goto unlock_rtnl;
2718 
2719 	if (!drv->ops->auth) {
2720 		err = -EOPNOTSUPP;
2721 		goto out;
2722 	}
2723 
2724 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
2725 		err = -EOPNOTSUPP;
2726 		goto out;
2727 	}
2728 
2729 	if (!netif_running(dev)) {
2730 		err = -ENETDOWN;
2731 		goto out;
2732 	}
2733 
2734 	if (!info->attrs[NL80211_ATTR_MAC]) {
2735 		err = -EINVAL;
2736 		goto out;
2737 	}
2738 
2739 	wiphy = &drv->wiphy;
2740 	memset(&req, 0, sizeof(req));
2741 
2742 	req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2743 
2744 	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2745 		req.chan = ieee80211_get_channel(
2746 			wiphy,
2747 			nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
2748 		if (!req.chan) {
2749 			err = -EINVAL;
2750 			goto out;
2751 		}
2752 	}
2753 
2754 	if (info->attrs[NL80211_ATTR_SSID]) {
2755 		req.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2756 		req.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
2757 	}
2758 
2759 	if (info->attrs[NL80211_ATTR_IE]) {
2760 		req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
2761 		req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2762 	}
2763 
2764 	if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
2765 		req.auth_type =
2766 			nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
2767 		if (!nl80211_valid_auth_type(req.auth_type)) {
2768 			err = -EINVAL;
2769 			goto out;
2770 		}
2771 	}
2772 
2773 	err = drv->ops->auth(&drv->wiphy, dev, &req);
2774 
2775 out:
2776 	cfg80211_put_dev(drv);
2777 	dev_put(dev);
2778 unlock_rtnl:
2779 	rtnl_unlock();
2780 	return err;
2781 }
2782 
2783 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
2784 {
2785 	struct cfg80211_registered_device *drv;
2786 	struct net_device *dev;
2787 	struct cfg80211_assoc_request req;
2788 	struct wiphy *wiphy;
2789 	int err;
2790 
2791 	rtnl_lock();
2792 
2793 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2794 	if (err)
2795 		goto unlock_rtnl;
2796 
2797 	if (!drv->ops->assoc) {
2798 		err = -EOPNOTSUPP;
2799 		goto out;
2800 	}
2801 
2802 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
2803 		err = -EOPNOTSUPP;
2804 		goto out;
2805 	}
2806 
2807 	if (!netif_running(dev)) {
2808 		err = -ENETDOWN;
2809 		goto out;
2810 	}
2811 
2812 	if (!info->attrs[NL80211_ATTR_MAC] ||
2813 	    !info->attrs[NL80211_ATTR_SSID]) {
2814 		err = -EINVAL;
2815 		goto out;
2816 	}
2817 
2818 	wiphy = &drv->wiphy;
2819 	memset(&req, 0, sizeof(req));
2820 
2821 	req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2822 
2823 	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2824 		req.chan = ieee80211_get_channel(
2825 			wiphy,
2826 			nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
2827 		if (!req.chan) {
2828 			err = -EINVAL;
2829 			goto out;
2830 		}
2831 	}
2832 
2833 	req.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2834 	req.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
2835 
2836 	if (info->attrs[NL80211_ATTR_IE]) {
2837 		req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
2838 		req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2839 	}
2840 
2841 	err = drv->ops->assoc(&drv->wiphy, dev, &req);
2842 
2843 out:
2844 	cfg80211_put_dev(drv);
2845 	dev_put(dev);
2846 unlock_rtnl:
2847 	rtnl_unlock();
2848 	return err;
2849 }
2850 
2851 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
2852 {
2853 	struct cfg80211_registered_device *drv;
2854 	struct net_device *dev;
2855 	struct cfg80211_deauth_request req;
2856 	struct wiphy *wiphy;
2857 	int err;
2858 
2859 	rtnl_lock();
2860 
2861 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2862 	if (err)
2863 		goto unlock_rtnl;
2864 
2865 	if (!drv->ops->deauth) {
2866 		err = -EOPNOTSUPP;
2867 		goto out;
2868 	}
2869 
2870 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
2871 		err = -EOPNOTSUPP;
2872 		goto out;
2873 	}
2874 
2875 	if (!netif_running(dev)) {
2876 		err = -ENETDOWN;
2877 		goto out;
2878 	}
2879 
2880 	if (!info->attrs[NL80211_ATTR_MAC]) {
2881 		err = -EINVAL;
2882 		goto out;
2883 	}
2884 
2885 	wiphy = &drv->wiphy;
2886 	memset(&req, 0, sizeof(req));
2887 
2888 	req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2889 
2890 	if (info->attrs[NL80211_ATTR_REASON_CODE]) {
2891 		req.reason_code =
2892 			nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
2893 		if (req.reason_code == 0) {
2894 			/* Reason Code 0 is reserved */
2895 			err = -EINVAL;
2896 			goto out;
2897 		}
2898 	}
2899 
2900 	if (info->attrs[NL80211_ATTR_IE]) {
2901 		req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
2902 		req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2903 	}
2904 
2905 	err = drv->ops->deauth(&drv->wiphy, dev, &req);
2906 
2907 out:
2908 	cfg80211_put_dev(drv);
2909 	dev_put(dev);
2910 unlock_rtnl:
2911 	rtnl_unlock();
2912 	return err;
2913 }
2914 
2915 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
2916 {
2917 	struct cfg80211_registered_device *drv;
2918 	struct net_device *dev;
2919 	struct cfg80211_disassoc_request req;
2920 	struct wiphy *wiphy;
2921 	int err;
2922 
2923 	rtnl_lock();
2924 
2925 	err = get_drv_dev_by_info_ifindex(info->attrs, &drv, &dev);
2926 	if (err)
2927 		goto unlock_rtnl;
2928 
2929 	if (!drv->ops->disassoc) {
2930 		err = -EOPNOTSUPP;
2931 		goto out;
2932 	}
2933 
2934 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION) {
2935 		err = -EOPNOTSUPP;
2936 		goto out;
2937 	}
2938 
2939 	if (!netif_running(dev)) {
2940 		err = -ENETDOWN;
2941 		goto out;
2942 	}
2943 
2944 	if (!info->attrs[NL80211_ATTR_MAC]) {
2945 		err = -EINVAL;
2946 		goto out;
2947 	}
2948 
2949 	wiphy = &drv->wiphy;
2950 	memset(&req, 0, sizeof(req));
2951 
2952 	req.peer_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2953 
2954 	if (info->attrs[NL80211_ATTR_REASON_CODE]) {
2955 		req.reason_code =
2956 			nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
2957 		if (req.reason_code == 0) {
2958 			/* Reason Code 0 is reserved */
2959 			err = -EINVAL;
2960 			goto out;
2961 		}
2962 	}
2963 
2964 	if (info->attrs[NL80211_ATTR_IE]) {
2965 		req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
2966 		req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2967 	}
2968 
2969 	err = drv->ops->disassoc(&drv->wiphy, dev, &req);
2970 
2971 out:
2972 	cfg80211_put_dev(drv);
2973 	dev_put(dev);
2974 unlock_rtnl:
2975 	rtnl_unlock();
2976 	return err;
2977 }
2978 
2979 static struct genl_ops nl80211_ops[] = {
2980 	{
2981 		.cmd = NL80211_CMD_GET_WIPHY,
2982 		.doit = nl80211_get_wiphy,
2983 		.dumpit = nl80211_dump_wiphy,
2984 		.policy = nl80211_policy,
2985 		/* can be retrieved by unprivileged users */
2986 	},
2987 	{
2988 		.cmd = NL80211_CMD_SET_WIPHY,
2989 		.doit = nl80211_set_wiphy,
2990 		.policy = nl80211_policy,
2991 		.flags = GENL_ADMIN_PERM,
2992 	},
2993 	{
2994 		.cmd = NL80211_CMD_GET_INTERFACE,
2995 		.doit = nl80211_get_interface,
2996 		.dumpit = nl80211_dump_interface,
2997 		.policy = nl80211_policy,
2998 		/* can be retrieved by unprivileged users */
2999 	},
3000 	{
3001 		.cmd = NL80211_CMD_SET_INTERFACE,
3002 		.doit = nl80211_set_interface,
3003 		.policy = nl80211_policy,
3004 		.flags = GENL_ADMIN_PERM,
3005 	},
3006 	{
3007 		.cmd = NL80211_CMD_NEW_INTERFACE,
3008 		.doit = nl80211_new_interface,
3009 		.policy = nl80211_policy,
3010 		.flags = GENL_ADMIN_PERM,
3011 	},
3012 	{
3013 		.cmd = NL80211_CMD_DEL_INTERFACE,
3014 		.doit = nl80211_del_interface,
3015 		.policy = nl80211_policy,
3016 		.flags = GENL_ADMIN_PERM,
3017 	},
3018 	{
3019 		.cmd = NL80211_CMD_GET_KEY,
3020 		.doit = nl80211_get_key,
3021 		.policy = nl80211_policy,
3022 		.flags = GENL_ADMIN_PERM,
3023 	},
3024 	{
3025 		.cmd = NL80211_CMD_SET_KEY,
3026 		.doit = nl80211_set_key,
3027 		.policy = nl80211_policy,
3028 		.flags = GENL_ADMIN_PERM,
3029 	},
3030 	{
3031 		.cmd = NL80211_CMD_NEW_KEY,
3032 		.doit = nl80211_new_key,
3033 		.policy = nl80211_policy,
3034 		.flags = GENL_ADMIN_PERM,
3035 	},
3036 	{
3037 		.cmd = NL80211_CMD_DEL_KEY,
3038 		.doit = nl80211_del_key,
3039 		.policy = nl80211_policy,
3040 		.flags = GENL_ADMIN_PERM,
3041 	},
3042 	{
3043 		.cmd = NL80211_CMD_SET_BEACON,
3044 		.policy = nl80211_policy,
3045 		.flags = GENL_ADMIN_PERM,
3046 		.doit = nl80211_addset_beacon,
3047 	},
3048 	{
3049 		.cmd = NL80211_CMD_NEW_BEACON,
3050 		.policy = nl80211_policy,
3051 		.flags = GENL_ADMIN_PERM,
3052 		.doit = nl80211_addset_beacon,
3053 	},
3054 	{
3055 		.cmd = NL80211_CMD_DEL_BEACON,
3056 		.policy = nl80211_policy,
3057 		.flags = GENL_ADMIN_PERM,
3058 		.doit = nl80211_del_beacon,
3059 	},
3060 	{
3061 		.cmd = NL80211_CMD_GET_STATION,
3062 		.doit = nl80211_get_station,
3063 		.dumpit = nl80211_dump_station,
3064 		.policy = nl80211_policy,
3065 	},
3066 	{
3067 		.cmd = NL80211_CMD_SET_STATION,
3068 		.doit = nl80211_set_station,
3069 		.policy = nl80211_policy,
3070 		.flags = GENL_ADMIN_PERM,
3071 	},
3072 	{
3073 		.cmd = NL80211_CMD_NEW_STATION,
3074 		.doit = nl80211_new_station,
3075 		.policy = nl80211_policy,
3076 		.flags = GENL_ADMIN_PERM,
3077 	},
3078 	{
3079 		.cmd = NL80211_CMD_DEL_STATION,
3080 		.doit = nl80211_del_station,
3081 		.policy = nl80211_policy,
3082 		.flags = GENL_ADMIN_PERM,
3083 	},
3084 	{
3085 		.cmd = NL80211_CMD_GET_MPATH,
3086 		.doit = nl80211_get_mpath,
3087 		.dumpit = nl80211_dump_mpath,
3088 		.policy = nl80211_policy,
3089 		.flags = GENL_ADMIN_PERM,
3090 	},
3091 	{
3092 		.cmd = NL80211_CMD_SET_MPATH,
3093 		.doit = nl80211_set_mpath,
3094 		.policy = nl80211_policy,
3095 		.flags = GENL_ADMIN_PERM,
3096 	},
3097 	{
3098 		.cmd = NL80211_CMD_NEW_MPATH,
3099 		.doit = nl80211_new_mpath,
3100 		.policy = nl80211_policy,
3101 		.flags = GENL_ADMIN_PERM,
3102 	},
3103 	{
3104 		.cmd = NL80211_CMD_DEL_MPATH,
3105 		.doit = nl80211_del_mpath,
3106 		.policy = nl80211_policy,
3107 		.flags = GENL_ADMIN_PERM,
3108 	},
3109 	{
3110 		.cmd = NL80211_CMD_SET_BSS,
3111 		.doit = nl80211_set_bss,
3112 		.policy = nl80211_policy,
3113 		.flags = GENL_ADMIN_PERM,
3114 	},
3115 	{
3116 		.cmd = NL80211_CMD_GET_REG,
3117 		.doit = nl80211_get_reg,
3118 		.policy = nl80211_policy,
3119 		/* can be retrieved by unprivileged users */
3120 	},
3121 	{
3122 		.cmd = NL80211_CMD_SET_REG,
3123 		.doit = nl80211_set_reg,
3124 		.policy = nl80211_policy,
3125 		.flags = GENL_ADMIN_PERM,
3126 	},
3127 	{
3128 		.cmd = NL80211_CMD_REQ_SET_REG,
3129 		.doit = nl80211_req_set_reg,
3130 		.policy = nl80211_policy,
3131 		.flags = GENL_ADMIN_PERM,
3132 	},
3133 	{
3134 		.cmd = NL80211_CMD_GET_MESH_PARAMS,
3135 		.doit = nl80211_get_mesh_params,
3136 		.policy = nl80211_policy,
3137 		/* can be retrieved by unprivileged users */
3138 	},
3139 	{
3140 		.cmd = NL80211_CMD_SET_MESH_PARAMS,
3141 		.doit = nl80211_set_mesh_params,
3142 		.policy = nl80211_policy,
3143 		.flags = GENL_ADMIN_PERM,
3144 	},
3145 	{
3146 		.cmd = NL80211_CMD_TRIGGER_SCAN,
3147 		.doit = nl80211_trigger_scan,
3148 		.policy = nl80211_policy,
3149 		.flags = GENL_ADMIN_PERM,
3150 	},
3151 	{
3152 		.cmd = NL80211_CMD_GET_SCAN,
3153 		.policy = nl80211_policy,
3154 		.dumpit = nl80211_dump_scan,
3155 	},
3156 	{
3157 		.cmd = NL80211_CMD_AUTHENTICATE,
3158 		.doit = nl80211_authenticate,
3159 		.policy = nl80211_policy,
3160 		.flags = GENL_ADMIN_PERM,
3161 	},
3162 	{
3163 		.cmd = NL80211_CMD_ASSOCIATE,
3164 		.doit = nl80211_associate,
3165 		.policy = nl80211_policy,
3166 		.flags = GENL_ADMIN_PERM,
3167 	},
3168 	{
3169 		.cmd = NL80211_CMD_DEAUTHENTICATE,
3170 		.doit = nl80211_deauthenticate,
3171 		.policy = nl80211_policy,
3172 		.flags = GENL_ADMIN_PERM,
3173 	},
3174 	{
3175 		.cmd = NL80211_CMD_DISASSOCIATE,
3176 		.doit = nl80211_disassociate,
3177 		.policy = nl80211_policy,
3178 		.flags = GENL_ADMIN_PERM,
3179 	},
3180 };
3181 static struct genl_multicast_group nl80211_mlme_mcgrp = {
3182 	.name = "mlme",
3183 };
3184 
3185 /* multicast groups */
3186 static struct genl_multicast_group nl80211_config_mcgrp = {
3187 	.name = "config",
3188 };
3189 static struct genl_multicast_group nl80211_scan_mcgrp = {
3190 	.name = "scan",
3191 };
3192 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
3193 	.name = "regulatory",
3194 };
3195 
3196 /* notification functions */
3197 
3198 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
3199 {
3200 	struct sk_buff *msg;
3201 
3202 	msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3203 	if (!msg)
3204 		return;
3205 
3206 	if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
3207 		nlmsg_free(msg);
3208 		return;
3209 	}
3210 
3211 	genlmsg_multicast(msg, 0, nl80211_config_mcgrp.id, GFP_KERNEL);
3212 }
3213 
3214 static int nl80211_send_scan_donemsg(struct sk_buff *msg,
3215 				    struct cfg80211_registered_device *rdev,
3216 				    struct net_device *netdev,
3217 				    u32 pid, u32 seq, int flags,
3218 				    u32 cmd)
3219 {
3220 	void *hdr;
3221 
3222 	hdr = nl80211hdr_put(msg, pid, seq, flags, cmd);
3223 	if (!hdr)
3224 		return -1;
3225 
3226 	NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3227 	NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3228 
3229 	/* XXX: we should probably bounce back the request? */
3230 
3231 	return genlmsg_end(msg, hdr);
3232 
3233  nla_put_failure:
3234 	genlmsg_cancel(msg, hdr);
3235 	return -EMSGSIZE;
3236 }
3237 
3238 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
3239 			    struct net_device *netdev)
3240 {
3241 	struct sk_buff *msg;
3242 
3243 	msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3244 	if (!msg)
3245 		return;
3246 
3247 	if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
3248 				      NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
3249 		nlmsg_free(msg);
3250 		return;
3251 	}
3252 
3253 	genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
3254 }
3255 
3256 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
3257 			       struct net_device *netdev)
3258 {
3259 	struct sk_buff *msg;
3260 
3261 	msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3262 	if (!msg)
3263 		return;
3264 
3265 	if (nl80211_send_scan_donemsg(msg, rdev, netdev, 0, 0, 0,
3266 				      NL80211_CMD_SCAN_ABORTED) < 0) {
3267 		nlmsg_free(msg);
3268 		return;
3269 	}
3270 
3271 	genlmsg_multicast(msg, 0, nl80211_scan_mcgrp.id, GFP_KERNEL);
3272 }
3273 
3274 /*
3275  * This can happen on global regulatory changes or device specific settings
3276  * based on custom world regulatory domains.
3277  */
3278 void nl80211_send_reg_change_event(struct regulatory_request *request)
3279 {
3280 	struct sk_buff *msg;
3281 	void *hdr;
3282 
3283 	msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
3284 	if (!msg)
3285 		return;
3286 
3287 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
3288 	if (!hdr) {
3289 		nlmsg_free(msg);
3290 		return;
3291 	}
3292 
3293 	/* Userspace can always count this one always being set */
3294 	NLA_PUT_U8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator);
3295 
3296 	if (request->alpha2[0] == '0' && request->alpha2[1] == '0')
3297 		NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3298 			   NL80211_REGDOM_TYPE_WORLD);
3299 	else if (request->alpha2[0] == '9' && request->alpha2[1] == '9')
3300 		NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3301 			   NL80211_REGDOM_TYPE_CUSTOM_WORLD);
3302 	else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
3303 		 request->intersect)
3304 		NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3305 			   NL80211_REGDOM_TYPE_INTERSECTION);
3306 	else {
3307 		NLA_PUT_U8(msg, NL80211_ATTR_REG_TYPE,
3308 			   NL80211_REGDOM_TYPE_COUNTRY);
3309 		NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, request->alpha2);
3310 	}
3311 
3312 	if (wiphy_idx_valid(request->wiphy_idx))
3313 		NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx);
3314 
3315 	if (genlmsg_end(msg, hdr) < 0) {
3316 		nlmsg_free(msg);
3317 		return;
3318 	}
3319 
3320 	genlmsg_multicast(msg, 0, nl80211_regulatory_mcgrp.id, GFP_KERNEL);
3321 
3322 	return;
3323 
3324 nla_put_failure:
3325 	genlmsg_cancel(msg, hdr);
3326 	nlmsg_free(msg);
3327 }
3328 
3329 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
3330 				    struct net_device *netdev,
3331 				    const u8 *buf, size_t len,
3332 				    enum nl80211_commands cmd)
3333 {
3334 	struct sk_buff *msg;
3335 	void *hdr;
3336 
3337 	msg = nlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC);
3338 	if (!msg)
3339 		return;
3340 
3341 	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
3342 	if (!hdr) {
3343 		nlmsg_free(msg);
3344 		return;
3345 	}
3346 
3347 	NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
3348 	NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
3349 	NLA_PUT(msg, NL80211_ATTR_FRAME, len, buf);
3350 
3351 	if (genlmsg_end(msg, hdr) < 0) {
3352 		nlmsg_free(msg);
3353 		return;
3354 	}
3355 
3356 	genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_ATOMIC);
3357 	return;
3358 
3359  nla_put_failure:
3360 	genlmsg_cancel(msg, hdr);
3361 	nlmsg_free(msg);
3362 }
3363 
3364 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
3365 			  struct net_device *netdev, const u8 *buf, size_t len)
3366 {
3367 	nl80211_send_mlme_event(rdev, netdev, buf, len,
3368 				NL80211_CMD_AUTHENTICATE);
3369 }
3370 
3371 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
3372 			   struct net_device *netdev, const u8 *buf,
3373 			   size_t len)
3374 {
3375 	nl80211_send_mlme_event(rdev, netdev, buf, len, NL80211_CMD_ASSOCIATE);
3376 }
3377 
3378 void nl80211_send_rx_deauth(struct cfg80211_registered_device *rdev,
3379 			    struct net_device *netdev, const u8 *buf,
3380 			    size_t len)
3381 {
3382 	nl80211_send_mlme_event(rdev, netdev, buf, len,
3383 				NL80211_CMD_DEAUTHENTICATE);
3384 }
3385 
3386 void nl80211_send_rx_disassoc(struct cfg80211_registered_device *rdev,
3387 			      struct net_device *netdev, const u8 *buf,
3388 			      size_t len)
3389 {
3390 	nl80211_send_mlme_event(rdev, netdev, buf, len,
3391 				NL80211_CMD_DISASSOCIATE);
3392 }
3393 
3394 /* initialisation/exit functions */
3395 
3396 int nl80211_init(void)
3397 {
3398 	int err, i;
3399 
3400 	err = genl_register_family(&nl80211_fam);
3401 	if (err)
3402 		return err;
3403 
3404 	for (i = 0; i < ARRAY_SIZE(nl80211_ops); i++) {
3405 		err = genl_register_ops(&nl80211_fam, &nl80211_ops[i]);
3406 		if (err)
3407 			goto err_out;
3408 	}
3409 
3410 	err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
3411 	if (err)
3412 		goto err_out;
3413 
3414 	err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
3415 	if (err)
3416 		goto err_out;
3417 
3418 	err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
3419 	if (err)
3420 		goto err_out;
3421 
3422 	err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
3423 	if (err)
3424 		goto err_out;
3425 
3426 	return 0;
3427  err_out:
3428 	genl_unregister_family(&nl80211_fam);
3429 	return err;
3430 }
3431 
3432 void nl80211_exit(void)
3433 {
3434 	genl_unregister_family(&nl80211_fam);
3435 }
3436