1 /* 2 * This is the new netlink-based wireless configuration interface. 3 * 4 * Copyright 2006-2010 Johannes Berg <johannes@sipsolutions.net> 5 * Copyright 2013-2014 Intel Mobile Communications GmbH 6 * Copyright 2015-2017 Intel Deutschland GmbH 7 */ 8 9 #include <linux/if.h> 10 #include <linux/module.h> 11 #include <linux/err.h> 12 #include <linux/slab.h> 13 #include <linux/list.h> 14 #include <linux/if_ether.h> 15 #include <linux/ieee80211.h> 16 #include <linux/nl80211.h> 17 #include <linux/rtnetlink.h> 18 #include <linux/netlink.h> 19 #include <linux/etherdevice.h> 20 #include <net/net_namespace.h> 21 #include <net/genetlink.h> 22 #include <net/cfg80211.h> 23 #include <net/sock.h> 24 #include <net/inet_connection_sock.h> 25 #include "core.h" 26 #include "nl80211.h" 27 #include "reg.h" 28 #include "rdev-ops.h" 29 30 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev, 31 struct genl_info *info, 32 struct cfg80211_crypto_settings *settings, 33 int cipher_limit); 34 35 /* the netlink family */ 36 static struct genl_family nl80211_fam; 37 38 /* multicast groups */ 39 enum nl80211_multicast_groups { 40 NL80211_MCGRP_CONFIG, 41 NL80211_MCGRP_SCAN, 42 NL80211_MCGRP_REGULATORY, 43 NL80211_MCGRP_MLME, 44 NL80211_MCGRP_VENDOR, 45 NL80211_MCGRP_NAN, 46 NL80211_MCGRP_TESTMODE /* keep last - ifdef! */ 47 }; 48 49 static const struct genl_multicast_group nl80211_mcgrps[] = { 50 [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG }, 51 [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN }, 52 [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG }, 53 [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME }, 54 [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR }, 55 [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN }, 56 #ifdef CONFIG_NL80211_TESTMODE 57 [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE } 58 #endif 59 }; 60 61 /* returns ERR_PTR values */ 62 static struct wireless_dev * 63 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs) 64 { 65 struct cfg80211_registered_device *rdev; 66 struct wireless_dev *result = NULL; 67 bool have_ifidx = attrs[NL80211_ATTR_IFINDEX]; 68 bool have_wdev_id = attrs[NL80211_ATTR_WDEV]; 69 u64 wdev_id; 70 int wiphy_idx = -1; 71 int ifidx = -1; 72 73 ASSERT_RTNL(); 74 75 if (!have_ifidx && !have_wdev_id) 76 return ERR_PTR(-EINVAL); 77 78 if (have_ifidx) 79 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]); 80 if (have_wdev_id) { 81 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]); 82 wiphy_idx = wdev_id >> 32; 83 } 84 85 list_for_each_entry(rdev, &cfg80211_rdev_list, list) { 86 struct wireless_dev *wdev; 87 88 if (wiphy_net(&rdev->wiphy) != netns) 89 continue; 90 91 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx) 92 continue; 93 94 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { 95 if (have_ifidx && wdev->netdev && 96 wdev->netdev->ifindex == ifidx) { 97 result = wdev; 98 break; 99 } 100 if (have_wdev_id && wdev->identifier == (u32)wdev_id) { 101 result = wdev; 102 break; 103 } 104 } 105 106 if (result) 107 break; 108 } 109 110 if (result) 111 return result; 112 return ERR_PTR(-ENODEV); 113 } 114 115 static struct cfg80211_registered_device * 116 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs) 117 { 118 struct cfg80211_registered_device *rdev = NULL, *tmp; 119 struct net_device *netdev; 120 121 ASSERT_RTNL(); 122 123 if (!attrs[NL80211_ATTR_WIPHY] && 124 !attrs[NL80211_ATTR_IFINDEX] && 125 !attrs[NL80211_ATTR_WDEV]) 126 return ERR_PTR(-EINVAL); 127 128 if (attrs[NL80211_ATTR_WIPHY]) 129 rdev = cfg80211_rdev_by_wiphy_idx( 130 nla_get_u32(attrs[NL80211_ATTR_WIPHY])); 131 132 if (attrs[NL80211_ATTR_WDEV]) { 133 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]); 134 struct wireless_dev *wdev; 135 bool found = false; 136 137 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32); 138 if (tmp) { 139 /* make sure wdev exists */ 140 list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) { 141 if (wdev->identifier != (u32)wdev_id) 142 continue; 143 found = true; 144 break; 145 } 146 147 if (!found) 148 tmp = NULL; 149 150 if (rdev && tmp != rdev) 151 return ERR_PTR(-EINVAL); 152 rdev = tmp; 153 } 154 } 155 156 if (attrs[NL80211_ATTR_IFINDEX]) { 157 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]); 158 159 netdev = __dev_get_by_index(netns, ifindex); 160 if (netdev) { 161 if (netdev->ieee80211_ptr) 162 tmp = wiphy_to_rdev( 163 netdev->ieee80211_ptr->wiphy); 164 else 165 tmp = NULL; 166 167 /* not wireless device -- return error */ 168 if (!tmp) 169 return ERR_PTR(-EINVAL); 170 171 /* mismatch -- return error */ 172 if (rdev && tmp != rdev) 173 return ERR_PTR(-EINVAL); 174 175 rdev = tmp; 176 } 177 } 178 179 if (!rdev) 180 return ERR_PTR(-ENODEV); 181 182 if (netns != wiphy_net(&rdev->wiphy)) 183 return ERR_PTR(-ENODEV); 184 185 return rdev; 186 } 187 188 /* 189 * This function returns a pointer to the driver 190 * that the genl_info item that is passed refers to. 191 * 192 * The result of this can be a PTR_ERR and hence must 193 * be checked with IS_ERR() for errors. 194 */ 195 static struct cfg80211_registered_device * 196 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info) 197 { 198 return __cfg80211_rdev_from_attrs(netns, info->attrs); 199 } 200 201 /* policy for the attributes */ 202 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { 203 [NL80211_ATTR_WIPHY] = { .type = NLA_U32 }, 204 [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING, 205 .len = 20-1 }, 206 [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED }, 207 208 [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 }, 209 [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 }, 210 [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 }, 211 [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 }, 212 [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 }, 213 214 [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 }, 215 [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 }, 216 [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 }, 217 [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 }, 218 [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 }, 219 [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG }, 220 221 [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 }, 222 [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 }, 223 [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 }, 224 225 [NL80211_ATTR_MAC] = { .len = ETH_ALEN }, 226 [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN }, 227 228 [NL80211_ATTR_KEY] = { .type = NLA_NESTED, }, 229 [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY, 230 .len = WLAN_MAX_KEY_LEN }, 231 [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 }, 232 [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 }, 233 [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG }, 234 [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 }, 235 [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 }, 236 237 [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 }, 238 [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 }, 239 [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY, 240 .len = IEEE80211_MAX_DATA_LEN }, 241 [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY, 242 .len = IEEE80211_MAX_DATA_LEN }, 243 [NL80211_ATTR_STA_AID] = { .type = NLA_U16 }, 244 [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED }, 245 [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 }, 246 [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY, 247 .len = NL80211_MAX_SUPP_RATES }, 248 [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 }, 249 [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 }, 250 [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ }, 251 [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY, 252 .len = IEEE80211_MAX_MESH_ID_LEN }, 253 [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 }, 254 255 [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 }, 256 [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED }, 257 258 [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 }, 259 [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 }, 260 [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 }, 261 [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY, 262 .len = NL80211_MAX_SUPP_RATES }, 263 [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 }, 264 265 [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED }, 266 [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG }, 267 268 [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN }, 269 270 [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 }, 271 [NL80211_ATTR_IE] = { .type = NLA_BINARY, 272 .len = IEEE80211_MAX_DATA_LEN }, 273 [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED }, 274 [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED }, 275 276 [NL80211_ATTR_SSID] = { .type = NLA_BINARY, 277 .len = IEEE80211_MAX_SSID_LEN }, 278 [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 }, 279 [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 }, 280 [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG }, 281 [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG }, 282 [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 }, 283 [NL80211_ATTR_STA_FLAGS2] = { 284 .len = sizeof(struct nl80211_sta_flag_update), 285 }, 286 [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG }, 287 [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 }, 288 [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG }, 289 [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG }, 290 [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 }, 291 [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 }, 292 [NL80211_ATTR_PID] = { .type = NLA_U32 }, 293 [NL80211_ATTR_4ADDR] = { .type = NLA_U8 }, 294 [NL80211_ATTR_PMKID] = { .len = WLAN_PMKID_LEN }, 295 [NL80211_ATTR_DURATION] = { .type = NLA_U32 }, 296 [NL80211_ATTR_COOKIE] = { .type = NLA_U64 }, 297 [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED }, 298 [NL80211_ATTR_FRAME] = { .type = NLA_BINARY, 299 .len = IEEE80211_MAX_DATA_LEN }, 300 [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, }, 301 [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 }, 302 [NL80211_ATTR_CQM] = { .type = NLA_NESTED, }, 303 [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG }, 304 [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 }, 305 [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 }, 306 [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 }, 307 [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 }, 308 [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 }, 309 [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 }, 310 [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 }, 311 [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG }, 312 [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED }, 313 [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED }, 314 [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 }, 315 [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 }, 316 [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED }, 317 [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED }, 318 [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 }, 319 [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY, 320 .len = IEEE80211_MAX_DATA_LEN }, 321 [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY, 322 .len = IEEE80211_MAX_DATA_LEN }, 323 [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG }, 324 [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED }, 325 [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG }, 326 [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 }, 327 [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 }, 328 [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 }, 329 [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG }, 330 [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG }, 331 [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG }, 332 [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG }, 333 [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY, 334 .len = IEEE80211_MAX_DATA_LEN }, 335 [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 }, 336 [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG }, 337 [NL80211_ATTR_HT_CAPABILITY_MASK] = { 338 .len = NL80211_HT_CAPABILITY_LEN 339 }, 340 [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 }, 341 [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 }, 342 [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 }, 343 [NL80211_ATTR_WDEV] = { .type = NLA_U64 }, 344 [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 }, 345 [NL80211_ATTR_AUTH_DATA] = { .type = NLA_BINARY, }, 346 [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN }, 347 [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 }, 348 [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 }, 349 [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 }, 350 [NL80211_ATTR_LOCAL_MESH_POWER_MODE] = {. type = NLA_U32 }, 351 [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 }, 352 [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED }, 353 [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 }, 354 [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, }, 355 [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, }, 356 [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG }, 357 [NL80211_ATTR_VHT_CAPABILITY_MASK] = { 358 .len = NL80211_VHT_CAPABILITY_LEN, 359 }, 360 [NL80211_ATTR_MDID] = { .type = NLA_U16 }, 361 [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY, 362 .len = IEEE80211_MAX_DATA_LEN }, 363 [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 }, 364 [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 }, 365 [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG }, 366 [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED }, 367 [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY }, 368 [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY }, 369 [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY }, 370 [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY }, 371 [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG }, 372 [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 }, 373 [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 }, 374 [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 }, 375 [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY }, 376 [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY, 377 .len = IEEE80211_QOS_MAP_LEN_MAX }, 378 [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN }, 379 [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 }, 380 [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 }, 381 [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG }, 382 [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY }, 383 [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG }, 384 [NL80211_ATTR_TSID] = { .type = NLA_U8 }, 385 [NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 }, 386 [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 }, 387 [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 }, 388 [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN }, 389 [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG }, 390 [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 }, 391 [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 }, 392 [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG }, 393 [NL80211_ATTR_PBSS] = { .type = NLA_FLAG }, 394 [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED }, 395 [NL80211_ATTR_STA_SUPPORT_P2P_PS] = { .type = NLA_U8 }, 396 [NL80211_ATTR_MU_MIMO_GROUP_DATA] = { 397 .len = VHT_MUMIMO_GROUPS_DATA_LEN 398 }, 399 [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = { .len = ETH_ALEN }, 400 [NL80211_ATTR_NAN_MASTER_PREF] = { .type = NLA_U8 }, 401 [NL80211_ATTR_BANDS] = { .type = NLA_U32 }, 402 [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED }, 403 [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY, 404 .len = FILS_MAX_KEK_LEN }, 405 [NL80211_ATTR_FILS_NONCES] = { .len = 2 * FILS_NONCE_LEN }, 406 [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, }, 407 [NL80211_ATTR_BSSID] = { .len = ETH_ALEN }, 408 [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 }, 409 [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = { 410 .len = sizeof(struct nl80211_bss_select_rssi_adjust) 411 }, 412 [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 }, 413 [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY, 414 .len = FILS_ERP_MAX_USERNAME_LEN }, 415 [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY, 416 .len = FILS_ERP_MAX_REALM_LEN }, 417 [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 }, 418 [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY, 419 .len = FILS_ERP_MAX_RRK_LEN }, 420 [NL80211_ATTR_FILS_CACHE_ID] = { .len = 2 }, 421 [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN }, 422 [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG }, 423 }; 424 425 /* policy for the key attributes */ 426 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = { 427 [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN }, 428 [NL80211_KEY_IDX] = { .type = NLA_U8 }, 429 [NL80211_KEY_CIPHER] = { .type = NLA_U32 }, 430 [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 }, 431 [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG }, 432 [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG }, 433 [NL80211_KEY_TYPE] = { .type = NLA_U32 }, 434 [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED }, 435 }; 436 437 /* policy for the key default flags */ 438 static const struct nla_policy 439 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = { 440 [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG }, 441 [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG }, 442 }; 443 444 #ifdef CONFIG_PM 445 /* policy for WoWLAN attributes */ 446 static const struct nla_policy 447 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = { 448 [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG }, 449 [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG }, 450 [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG }, 451 [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED }, 452 [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG }, 453 [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG }, 454 [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG }, 455 [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG }, 456 [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED }, 457 [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED }, 458 }; 459 460 static const struct nla_policy 461 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = { 462 [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 }, 463 [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 }, 464 [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN }, 465 [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 }, 466 [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 }, 467 [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 }, 468 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = { 469 .len = sizeof(struct nl80211_wowlan_tcp_data_seq) 470 }, 471 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = { 472 .len = sizeof(struct nl80211_wowlan_tcp_data_token) 473 }, 474 [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 }, 475 [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 }, 476 [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 }, 477 }; 478 #endif /* CONFIG_PM */ 479 480 /* policy for coalesce rule attributes */ 481 static const struct nla_policy 482 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = { 483 [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 }, 484 [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 }, 485 [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED }, 486 }; 487 488 /* policy for GTK rekey offload attributes */ 489 static const struct nla_policy 490 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = { 491 [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN }, 492 [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN }, 493 [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN }, 494 }; 495 496 static const struct nla_policy 497 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = { 498 [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY, 499 .len = IEEE80211_MAX_SSID_LEN }, 500 [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = { .len = ETH_ALEN }, 501 [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 }, 502 }; 503 504 static const struct nla_policy 505 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = { 506 [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 }, 507 [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 }, 508 }; 509 510 static const struct nla_policy 511 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = { 512 [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG }, 513 [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 }, 514 [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = { 515 .len = sizeof(struct nl80211_bss_select_rssi_adjust) 516 }, 517 }; 518 519 /* policy for NAN function attributes */ 520 static const struct nla_policy 521 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = { 522 [NL80211_NAN_FUNC_TYPE] = { .type = NLA_U8 }, 523 [NL80211_NAN_FUNC_SERVICE_ID] = { 524 .len = NL80211_NAN_FUNC_SERVICE_ID_LEN }, 525 [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 }, 526 [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG }, 527 [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG }, 528 [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 }, 529 [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 }, 530 [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = { .len = ETH_ALEN }, 531 [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG }, 532 [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 }, 533 [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY, 534 .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN }, 535 [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED }, 536 [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED }, 537 [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED }, 538 [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 }, 539 [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 }, 540 }; 541 542 /* policy for Service Response Filter attributes */ 543 static const struct nla_policy 544 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = { 545 [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG }, 546 [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY, 547 .len = NL80211_NAN_FUNC_SRF_MAX_LEN }, 548 [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 }, 549 [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED }, 550 }; 551 552 /* policy for packet pattern attributes */ 553 static const struct nla_policy 554 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = { 555 [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, }, 556 [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, }, 557 [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 }, 558 }; 559 560 static int nl80211_prepare_wdev_dump(struct sk_buff *skb, 561 struct netlink_callback *cb, 562 struct cfg80211_registered_device **rdev, 563 struct wireless_dev **wdev) 564 { 565 int err; 566 567 if (!cb->args[0]) { 568 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, 569 genl_family_attrbuf(&nl80211_fam), 570 nl80211_fam.maxattr, nl80211_policy, NULL); 571 if (err) 572 return err; 573 574 *wdev = __cfg80211_wdev_from_attrs( 575 sock_net(skb->sk), 576 genl_family_attrbuf(&nl80211_fam)); 577 if (IS_ERR(*wdev)) 578 return PTR_ERR(*wdev); 579 *rdev = wiphy_to_rdev((*wdev)->wiphy); 580 /* 0 is the first index - add 1 to parse only once */ 581 cb->args[0] = (*rdev)->wiphy_idx + 1; 582 cb->args[1] = (*wdev)->identifier; 583 } else { 584 /* subtract the 1 again here */ 585 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1); 586 struct wireless_dev *tmp; 587 588 if (!wiphy) 589 return -ENODEV; 590 *rdev = wiphy_to_rdev(wiphy); 591 *wdev = NULL; 592 593 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) { 594 if (tmp->identifier == cb->args[1]) { 595 *wdev = tmp; 596 break; 597 } 598 } 599 600 if (!*wdev) 601 return -ENODEV; 602 } 603 604 return 0; 605 } 606 607 /* IE validation */ 608 static bool is_valid_ie_attr(const struct nlattr *attr) 609 { 610 const u8 *pos; 611 int len; 612 613 if (!attr) 614 return true; 615 616 pos = nla_data(attr); 617 len = nla_len(attr); 618 619 while (len) { 620 u8 elemlen; 621 622 if (len < 2) 623 return false; 624 len -= 2; 625 626 elemlen = pos[1]; 627 if (elemlen > len) 628 return false; 629 630 len -= elemlen; 631 pos += 2 + elemlen; 632 } 633 634 return true; 635 } 636 637 /* message building helper */ 638 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq, 639 int flags, u8 cmd) 640 { 641 /* since there is no private header just add the generic one */ 642 return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd); 643 } 644 645 static int nl80211_msg_put_channel(struct sk_buff *msg, 646 struct ieee80211_channel *chan, 647 bool large) 648 { 649 /* Some channels must be completely excluded from the 650 * list to protect old user-space tools from breaking 651 */ 652 if (!large && chan->flags & 653 (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ)) 654 return 0; 655 656 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ, 657 chan->center_freq)) 658 goto nla_put_failure; 659 660 if ((chan->flags & IEEE80211_CHAN_DISABLED) && 661 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED)) 662 goto nla_put_failure; 663 if (chan->flags & IEEE80211_CHAN_NO_IR) { 664 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR)) 665 goto nla_put_failure; 666 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS)) 667 goto nla_put_failure; 668 } 669 if (chan->flags & IEEE80211_CHAN_RADAR) { 670 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR)) 671 goto nla_put_failure; 672 if (large) { 673 u32 time; 674 675 time = elapsed_jiffies_msecs(chan->dfs_state_entered); 676 677 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE, 678 chan->dfs_state)) 679 goto nla_put_failure; 680 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME, 681 time)) 682 goto nla_put_failure; 683 if (nla_put_u32(msg, 684 NL80211_FREQUENCY_ATTR_DFS_CAC_TIME, 685 chan->dfs_cac_ms)) 686 goto nla_put_failure; 687 } 688 } 689 690 if (large) { 691 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) && 692 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS)) 693 goto nla_put_failure; 694 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) && 695 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS)) 696 goto nla_put_failure; 697 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) && 698 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ)) 699 goto nla_put_failure; 700 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) && 701 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ)) 702 goto nla_put_failure; 703 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) && 704 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY)) 705 goto nla_put_failure; 706 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) && 707 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT)) 708 goto nla_put_failure; 709 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) && 710 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ)) 711 goto nla_put_failure; 712 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) && 713 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ)) 714 goto nla_put_failure; 715 } 716 717 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER, 718 DBM_TO_MBM(chan->max_power))) 719 goto nla_put_failure; 720 721 return 0; 722 723 nla_put_failure: 724 return -ENOBUFS; 725 } 726 727 /* netlink command implementations */ 728 729 struct key_parse { 730 struct key_params p; 731 int idx; 732 int type; 733 bool def, defmgmt; 734 bool def_uni, def_multi; 735 }; 736 737 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k) 738 { 739 struct nlattr *tb[NL80211_KEY_MAX + 1]; 740 int err = nla_parse_nested(tb, NL80211_KEY_MAX, key, 741 nl80211_key_policy, NULL); 742 if (err) 743 return err; 744 745 k->def = !!tb[NL80211_KEY_DEFAULT]; 746 k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT]; 747 748 if (k->def) { 749 k->def_uni = true; 750 k->def_multi = true; 751 } 752 if (k->defmgmt) 753 k->def_multi = true; 754 755 if (tb[NL80211_KEY_IDX]) 756 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]); 757 758 if (tb[NL80211_KEY_DATA]) { 759 k->p.key = nla_data(tb[NL80211_KEY_DATA]); 760 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]); 761 } 762 763 if (tb[NL80211_KEY_SEQ]) { 764 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]); 765 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]); 766 } 767 768 if (tb[NL80211_KEY_CIPHER]) 769 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]); 770 771 if (tb[NL80211_KEY_TYPE]) { 772 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]); 773 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES) 774 return -EINVAL; 775 } 776 777 if (tb[NL80211_KEY_DEFAULT_TYPES]) { 778 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES]; 779 780 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1, 781 tb[NL80211_KEY_DEFAULT_TYPES], 782 nl80211_key_default_policy, NULL); 783 if (err) 784 return err; 785 786 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST]; 787 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST]; 788 } 789 790 return 0; 791 } 792 793 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k) 794 { 795 if (info->attrs[NL80211_ATTR_KEY_DATA]) { 796 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]); 797 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]); 798 } 799 800 if (info->attrs[NL80211_ATTR_KEY_SEQ]) { 801 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]); 802 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]); 803 } 804 805 if (info->attrs[NL80211_ATTR_KEY_IDX]) 806 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]); 807 808 if (info->attrs[NL80211_ATTR_KEY_CIPHER]) 809 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]); 810 811 k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT]; 812 k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]; 813 814 if (k->def) { 815 k->def_uni = true; 816 k->def_multi = true; 817 } 818 if (k->defmgmt) 819 k->def_multi = true; 820 821 if (info->attrs[NL80211_ATTR_KEY_TYPE]) { 822 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]); 823 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES) 824 return -EINVAL; 825 } 826 827 if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) { 828 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES]; 829 int err = nla_parse_nested(kdt, 830 NUM_NL80211_KEY_DEFAULT_TYPES - 1, 831 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES], 832 nl80211_key_default_policy, 833 info->extack); 834 if (err) 835 return err; 836 837 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST]; 838 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST]; 839 } 840 841 return 0; 842 } 843 844 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k) 845 { 846 int err; 847 848 memset(k, 0, sizeof(*k)); 849 k->idx = -1; 850 k->type = -1; 851 852 if (info->attrs[NL80211_ATTR_KEY]) 853 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k); 854 else 855 err = nl80211_parse_key_old(info, k); 856 857 if (err) 858 return err; 859 860 if (k->def && k->defmgmt) 861 return -EINVAL; 862 863 if (k->defmgmt) { 864 if (k->def_uni || !k->def_multi) 865 return -EINVAL; 866 } 867 868 if (k->idx != -1) { 869 if (k->defmgmt) { 870 if (k->idx < 4 || k->idx > 5) 871 return -EINVAL; 872 } else if (k->def) { 873 if (k->idx < 0 || k->idx > 3) 874 return -EINVAL; 875 } else { 876 if (k->idx < 0 || k->idx > 5) 877 return -EINVAL; 878 } 879 } 880 881 return 0; 882 } 883 884 static struct cfg80211_cached_keys * 885 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev, 886 struct nlattr *keys, bool *no_ht) 887 { 888 struct key_parse parse; 889 struct nlattr *key; 890 struct cfg80211_cached_keys *result; 891 int rem, err, def = 0; 892 bool have_key = false; 893 894 nla_for_each_nested(key, keys, rem) { 895 have_key = true; 896 break; 897 } 898 899 if (!have_key) 900 return NULL; 901 902 result = kzalloc(sizeof(*result), GFP_KERNEL); 903 if (!result) 904 return ERR_PTR(-ENOMEM); 905 906 result->def = -1; 907 908 nla_for_each_nested(key, keys, rem) { 909 memset(&parse, 0, sizeof(parse)); 910 parse.idx = -1; 911 912 err = nl80211_parse_key_new(key, &parse); 913 if (err) 914 goto error; 915 err = -EINVAL; 916 if (!parse.p.key) 917 goto error; 918 if (parse.idx < 0 || parse.idx > 3) 919 goto error; 920 if (parse.def) { 921 if (def) 922 goto error; 923 def = 1; 924 result->def = parse.idx; 925 if (!parse.def_uni || !parse.def_multi) 926 goto error; 927 } else if (parse.defmgmt) 928 goto error; 929 err = cfg80211_validate_key_settings(rdev, &parse.p, 930 parse.idx, false, NULL); 931 if (err) 932 goto error; 933 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 && 934 parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) { 935 err = -EINVAL; 936 goto error; 937 } 938 result->params[parse.idx].cipher = parse.p.cipher; 939 result->params[parse.idx].key_len = parse.p.key_len; 940 result->params[parse.idx].key = result->data[parse.idx]; 941 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len); 942 943 /* must be WEP key if we got here */ 944 if (no_ht) 945 *no_ht = true; 946 } 947 948 if (result->def < 0) { 949 err = -EINVAL; 950 goto error; 951 } 952 953 return result; 954 error: 955 kfree(result); 956 return ERR_PTR(err); 957 } 958 959 static int nl80211_key_allowed(struct wireless_dev *wdev) 960 { 961 ASSERT_WDEV_LOCK(wdev); 962 963 switch (wdev->iftype) { 964 case NL80211_IFTYPE_AP: 965 case NL80211_IFTYPE_AP_VLAN: 966 case NL80211_IFTYPE_P2P_GO: 967 case NL80211_IFTYPE_MESH_POINT: 968 break; 969 case NL80211_IFTYPE_ADHOC: 970 case NL80211_IFTYPE_STATION: 971 case NL80211_IFTYPE_P2P_CLIENT: 972 if (!wdev->current_bss) 973 return -ENOLINK; 974 break; 975 case NL80211_IFTYPE_UNSPECIFIED: 976 case NL80211_IFTYPE_OCB: 977 case NL80211_IFTYPE_MONITOR: 978 case NL80211_IFTYPE_NAN: 979 case NL80211_IFTYPE_P2P_DEVICE: 980 case NL80211_IFTYPE_WDS: 981 case NUM_NL80211_IFTYPES: 982 return -EINVAL; 983 } 984 985 return 0; 986 } 987 988 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy, 989 struct nlattr *tb) 990 { 991 struct ieee80211_channel *chan; 992 993 if (tb == NULL) 994 return NULL; 995 chan = ieee80211_get_channel(wiphy, nla_get_u32(tb)); 996 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) 997 return NULL; 998 return chan; 999 } 1000 1001 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes) 1002 { 1003 struct nlattr *nl_modes = nla_nest_start(msg, attr); 1004 int i; 1005 1006 if (!nl_modes) 1007 goto nla_put_failure; 1008 1009 i = 0; 1010 while (ifmodes) { 1011 if ((ifmodes & 1) && nla_put_flag(msg, i)) 1012 goto nla_put_failure; 1013 ifmodes >>= 1; 1014 i++; 1015 } 1016 1017 nla_nest_end(msg, nl_modes); 1018 return 0; 1019 1020 nla_put_failure: 1021 return -ENOBUFS; 1022 } 1023 1024 static int nl80211_put_iface_combinations(struct wiphy *wiphy, 1025 struct sk_buff *msg, 1026 bool large) 1027 { 1028 struct nlattr *nl_combis; 1029 int i, j; 1030 1031 nl_combis = nla_nest_start(msg, 1032 NL80211_ATTR_INTERFACE_COMBINATIONS); 1033 if (!nl_combis) 1034 goto nla_put_failure; 1035 1036 for (i = 0; i < wiphy->n_iface_combinations; i++) { 1037 const struct ieee80211_iface_combination *c; 1038 struct nlattr *nl_combi, *nl_limits; 1039 1040 c = &wiphy->iface_combinations[i]; 1041 1042 nl_combi = nla_nest_start(msg, i + 1); 1043 if (!nl_combi) 1044 goto nla_put_failure; 1045 1046 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS); 1047 if (!nl_limits) 1048 goto nla_put_failure; 1049 1050 for (j = 0; j < c->n_limits; j++) { 1051 struct nlattr *nl_limit; 1052 1053 nl_limit = nla_nest_start(msg, j + 1); 1054 if (!nl_limit) 1055 goto nla_put_failure; 1056 if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX, 1057 c->limits[j].max)) 1058 goto nla_put_failure; 1059 if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES, 1060 c->limits[j].types)) 1061 goto nla_put_failure; 1062 nla_nest_end(msg, nl_limit); 1063 } 1064 1065 nla_nest_end(msg, nl_limits); 1066 1067 if (c->beacon_int_infra_match && 1068 nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH)) 1069 goto nla_put_failure; 1070 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS, 1071 c->num_different_channels) || 1072 nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM, 1073 c->max_interfaces)) 1074 goto nla_put_failure; 1075 if (large && 1076 (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS, 1077 c->radar_detect_widths) || 1078 nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS, 1079 c->radar_detect_regions))) 1080 goto nla_put_failure; 1081 if (c->beacon_int_min_gcd && 1082 nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD, 1083 c->beacon_int_min_gcd)) 1084 goto nla_put_failure; 1085 1086 nla_nest_end(msg, nl_combi); 1087 } 1088 1089 nla_nest_end(msg, nl_combis); 1090 1091 return 0; 1092 nla_put_failure: 1093 return -ENOBUFS; 1094 } 1095 1096 #ifdef CONFIG_PM 1097 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev, 1098 struct sk_buff *msg) 1099 { 1100 const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp; 1101 struct nlattr *nl_tcp; 1102 1103 if (!tcp) 1104 return 0; 1105 1106 nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION); 1107 if (!nl_tcp) 1108 return -ENOBUFS; 1109 1110 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD, 1111 tcp->data_payload_max)) 1112 return -ENOBUFS; 1113 1114 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD, 1115 tcp->data_payload_max)) 1116 return -ENOBUFS; 1117 1118 if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ)) 1119 return -ENOBUFS; 1120 1121 if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN, 1122 sizeof(*tcp->tok), tcp->tok)) 1123 return -ENOBUFS; 1124 1125 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL, 1126 tcp->data_interval_max)) 1127 return -ENOBUFS; 1128 1129 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD, 1130 tcp->wake_payload_max)) 1131 return -ENOBUFS; 1132 1133 nla_nest_end(msg, nl_tcp); 1134 return 0; 1135 } 1136 1137 static int nl80211_send_wowlan(struct sk_buff *msg, 1138 struct cfg80211_registered_device *rdev, 1139 bool large) 1140 { 1141 struct nlattr *nl_wowlan; 1142 1143 if (!rdev->wiphy.wowlan) 1144 return 0; 1145 1146 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED); 1147 if (!nl_wowlan) 1148 return -ENOBUFS; 1149 1150 if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) && 1151 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) || 1152 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) && 1153 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) || 1154 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) && 1155 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) || 1156 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) && 1157 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) || 1158 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) && 1159 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) || 1160 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) && 1161 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) || 1162 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) && 1163 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) || 1164 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) && 1165 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))) 1166 return -ENOBUFS; 1167 1168 if (rdev->wiphy.wowlan->n_patterns) { 1169 struct nl80211_pattern_support pat = { 1170 .max_patterns = rdev->wiphy.wowlan->n_patterns, 1171 .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len, 1172 .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len, 1173 .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset, 1174 }; 1175 1176 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN, 1177 sizeof(pat), &pat)) 1178 return -ENOBUFS; 1179 } 1180 1181 if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) && 1182 nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT, 1183 rdev->wiphy.wowlan->max_nd_match_sets)) 1184 return -ENOBUFS; 1185 1186 if (large && nl80211_send_wowlan_tcp_caps(rdev, msg)) 1187 return -ENOBUFS; 1188 1189 nla_nest_end(msg, nl_wowlan); 1190 1191 return 0; 1192 } 1193 #endif 1194 1195 static int nl80211_send_coalesce(struct sk_buff *msg, 1196 struct cfg80211_registered_device *rdev) 1197 { 1198 struct nl80211_coalesce_rule_support rule; 1199 1200 if (!rdev->wiphy.coalesce) 1201 return 0; 1202 1203 rule.max_rules = rdev->wiphy.coalesce->n_rules; 1204 rule.max_delay = rdev->wiphy.coalesce->max_delay; 1205 rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns; 1206 rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len; 1207 rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len; 1208 rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset; 1209 1210 if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule)) 1211 return -ENOBUFS; 1212 1213 return 0; 1214 } 1215 1216 static int nl80211_send_band_rateinfo(struct sk_buff *msg, 1217 struct ieee80211_supported_band *sband) 1218 { 1219 struct nlattr *nl_rates, *nl_rate; 1220 struct ieee80211_rate *rate; 1221 int i; 1222 1223 /* add HT info */ 1224 if (sband->ht_cap.ht_supported && 1225 (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET, 1226 sizeof(sband->ht_cap.mcs), 1227 &sband->ht_cap.mcs) || 1228 nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA, 1229 sband->ht_cap.cap) || 1230 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR, 1231 sband->ht_cap.ampdu_factor) || 1232 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY, 1233 sband->ht_cap.ampdu_density))) 1234 return -ENOBUFS; 1235 1236 /* add VHT info */ 1237 if (sband->vht_cap.vht_supported && 1238 (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET, 1239 sizeof(sband->vht_cap.vht_mcs), 1240 &sband->vht_cap.vht_mcs) || 1241 nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA, 1242 sband->vht_cap.cap))) 1243 return -ENOBUFS; 1244 1245 /* add bitrates */ 1246 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES); 1247 if (!nl_rates) 1248 return -ENOBUFS; 1249 1250 for (i = 0; i < sband->n_bitrates; i++) { 1251 nl_rate = nla_nest_start(msg, i); 1252 if (!nl_rate) 1253 return -ENOBUFS; 1254 1255 rate = &sband->bitrates[i]; 1256 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE, 1257 rate->bitrate)) 1258 return -ENOBUFS; 1259 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) && 1260 nla_put_flag(msg, 1261 NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE)) 1262 return -ENOBUFS; 1263 1264 nla_nest_end(msg, nl_rate); 1265 } 1266 1267 nla_nest_end(msg, nl_rates); 1268 1269 return 0; 1270 } 1271 1272 static int 1273 nl80211_send_mgmt_stypes(struct sk_buff *msg, 1274 const struct ieee80211_txrx_stypes *mgmt_stypes) 1275 { 1276 u16 stypes; 1277 struct nlattr *nl_ftypes, *nl_ifs; 1278 enum nl80211_iftype ift; 1279 int i; 1280 1281 if (!mgmt_stypes) 1282 return 0; 1283 1284 nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES); 1285 if (!nl_ifs) 1286 return -ENOBUFS; 1287 1288 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) { 1289 nl_ftypes = nla_nest_start(msg, ift); 1290 if (!nl_ftypes) 1291 return -ENOBUFS; 1292 i = 0; 1293 stypes = mgmt_stypes[ift].tx; 1294 while (stypes) { 1295 if ((stypes & 1) && 1296 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE, 1297 (i << 4) | IEEE80211_FTYPE_MGMT)) 1298 return -ENOBUFS; 1299 stypes >>= 1; 1300 i++; 1301 } 1302 nla_nest_end(msg, nl_ftypes); 1303 } 1304 1305 nla_nest_end(msg, nl_ifs); 1306 1307 nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES); 1308 if (!nl_ifs) 1309 return -ENOBUFS; 1310 1311 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) { 1312 nl_ftypes = nla_nest_start(msg, ift); 1313 if (!nl_ftypes) 1314 return -ENOBUFS; 1315 i = 0; 1316 stypes = mgmt_stypes[ift].rx; 1317 while (stypes) { 1318 if ((stypes & 1) && 1319 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE, 1320 (i << 4) | IEEE80211_FTYPE_MGMT)) 1321 return -ENOBUFS; 1322 stypes >>= 1; 1323 i++; 1324 } 1325 nla_nest_end(msg, nl_ftypes); 1326 } 1327 nla_nest_end(msg, nl_ifs); 1328 1329 return 0; 1330 } 1331 1332 #define CMD(op, n) \ 1333 do { \ 1334 if (rdev->ops->op) { \ 1335 i++; \ 1336 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \ 1337 goto nla_put_failure; \ 1338 } \ 1339 } while (0) 1340 1341 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev, 1342 struct sk_buff *msg) 1343 { 1344 int i = 0; 1345 1346 /* 1347 * do *NOT* add anything into this function, new things need to be 1348 * advertised only to new versions of userspace that can deal with 1349 * the split (and they can't possibly care about new features... 1350 */ 1351 CMD(add_virtual_intf, NEW_INTERFACE); 1352 CMD(change_virtual_intf, SET_INTERFACE); 1353 CMD(add_key, NEW_KEY); 1354 CMD(start_ap, START_AP); 1355 CMD(add_station, NEW_STATION); 1356 CMD(add_mpath, NEW_MPATH); 1357 CMD(update_mesh_config, SET_MESH_CONFIG); 1358 CMD(change_bss, SET_BSS); 1359 CMD(auth, AUTHENTICATE); 1360 CMD(assoc, ASSOCIATE); 1361 CMD(deauth, DEAUTHENTICATE); 1362 CMD(disassoc, DISASSOCIATE); 1363 CMD(join_ibss, JOIN_IBSS); 1364 CMD(join_mesh, JOIN_MESH); 1365 CMD(set_pmksa, SET_PMKSA); 1366 CMD(del_pmksa, DEL_PMKSA); 1367 CMD(flush_pmksa, FLUSH_PMKSA); 1368 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) 1369 CMD(remain_on_channel, REMAIN_ON_CHANNEL); 1370 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK); 1371 CMD(mgmt_tx, FRAME); 1372 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL); 1373 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) { 1374 i++; 1375 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS)) 1376 goto nla_put_failure; 1377 } 1378 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap || 1379 rdev->ops->join_mesh) { 1380 i++; 1381 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL)) 1382 goto nla_put_failure; 1383 } 1384 CMD(set_wds_peer, SET_WDS_PEER); 1385 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) { 1386 CMD(tdls_mgmt, TDLS_MGMT); 1387 CMD(tdls_oper, TDLS_OPER); 1388 } 1389 if (rdev->wiphy.max_sched_scan_reqs) 1390 CMD(sched_scan_start, START_SCHED_SCAN); 1391 CMD(probe_client, PROBE_CLIENT); 1392 CMD(set_noack_map, SET_NOACK_MAP); 1393 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) { 1394 i++; 1395 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS)) 1396 goto nla_put_failure; 1397 } 1398 CMD(start_p2p_device, START_P2P_DEVICE); 1399 CMD(set_mcast_rate, SET_MCAST_RATE); 1400 #ifdef CONFIG_NL80211_TESTMODE 1401 CMD(testmode_cmd, TESTMODE); 1402 #endif 1403 1404 if (rdev->ops->connect || rdev->ops->auth) { 1405 i++; 1406 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT)) 1407 goto nla_put_failure; 1408 } 1409 1410 if (rdev->ops->disconnect || rdev->ops->deauth) { 1411 i++; 1412 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT)) 1413 goto nla_put_failure; 1414 } 1415 1416 return i; 1417 nla_put_failure: 1418 return -ENOBUFS; 1419 } 1420 1421 struct nl80211_dump_wiphy_state { 1422 s64 filter_wiphy; 1423 long start; 1424 long split_start, band_start, chan_start, capa_start; 1425 bool split; 1426 }; 1427 1428 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev, 1429 enum nl80211_commands cmd, 1430 struct sk_buff *msg, u32 portid, u32 seq, 1431 int flags, struct nl80211_dump_wiphy_state *state) 1432 { 1433 void *hdr; 1434 struct nlattr *nl_bands, *nl_band; 1435 struct nlattr *nl_freqs, *nl_freq; 1436 struct nlattr *nl_cmds; 1437 enum nl80211_band band; 1438 struct ieee80211_channel *chan; 1439 int i; 1440 const struct ieee80211_txrx_stypes *mgmt_stypes = 1441 rdev->wiphy.mgmt_stypes; 1442 u32 features; 1443 1444 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 1445 if (!hdr) 1446 return -ENOBUFS; 1447 1448 if (WARN_ON(!state)) 1449 return -EINVAL; 1450 1451 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 1452 nla_put_string(msg, NL80211_ATTR_WIPHY_NAME, 1453 wiphy_name(&rdev->wiphy)) || 1454 nla_put_u32(msg, NL80211_ATTR_GENERATION, 1455 cfg80211_rdev_list_generation)) 1456 goto nla_put_failure; 1457 1458 if (cmd != NL80211_CMD_NEW_WIPHY) 1459 goto finish; 1460 1461 switch (state->split_start) { 1462 case 0: 1463 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT, 1464 rdev->wiphy.retry_short) || 1465 nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG, 1466 rdev->wiphy.retry_long) || 1467 nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD, 1468 rdev->wiphy.frag_threshold) || 1469 nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD, 1470 rdev->wiphy.rts_threshold) || 1471 nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS, 1472 rdev->wiphy.coverage_class) || 1473 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS, 1474 rdev->wiphy.max_scan_ssids) || 1475 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS, 1476 rdev->wiphy.max_sched_scan_ssids) || 1477 nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN, 1478 rdev->wiphy.max_scan_ie_len) || 1479 nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN, 1480 rdev->wiphy.max_sched_scan_ie_len) || 1481 nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS, 1482 rdev->wiphy.max_match_sets) || 1483 nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS, 1484 rdev->wiphy.max_sched_scan_plans) || 1485 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL, 1486 rdev->wiphy.max_sched_scan_plan_interval) || 1487 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS, 1488 rdev->wiphy.max_sched_scan_plan_iterations)) 1489 goto nla_put_failure; 1490 1491 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) && 1492 nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN)) 1493 goto nla_put_failure; 1494 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) && 1495 nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH)) 1496 goto nla_put_failure; 1497 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) && 1498 nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD)) 1499 goto nla_put_failure; 1500 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) && 1501 nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT)) 1502 goto nla_put_failure; 1503 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) && 1504 nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT)) 1505 goto nla_put_failure; 1506 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) && 1507 nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP)) 1508 goto nla_put_failure; 1509 state->split_start++; 1510 if (state->split) 1511 break; 1512 case 1: 1513 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES, 1514 sizeof(u32) * rdev->wiphy.n_cipher_suites, 1515 rdev->wiphy.cipher_suites)) 1516 goto nla_put_failure; 1517 1518 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS, 1519 rdev->wiphy.max_num_pmkids)) 1520 goto nla_put_failure; 1521 1522 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) && 1523 nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE)) 1524 goto nla_put_failure; 1525 1526 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX, 1527 rdev->wiphy.available_antennas_tx) || 1528 nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX, 1529 rdev->wiphy.available_antennas_rx)) 1530 goto nla_put_failure; 1531 1532 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) && 1533 nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD, 1534 rdev->wiphy.probe_resp_offload)) 1535 goto nla_put_failure; 1536 1537 if ((rdev->wiphy.available_antennas_tx || 1538 rdev->wiphy.available_antennas_rx) && 1539 rdev->ops->get_antenna) { 1540 u32 tx_ant = 0, rx_ant = 0; 1541 int res; 1542 1543 res = rdev_get_antenna(rdev, &tx_ant, &rx_ant); 1544 if (!res) { 1545 if (nla_put_u32(msg, 1546 NL80211_ATTR_WIPHY_ANTENNA_TX, 1547 tx_ant) || 1548 nla_put_u32(msg, 1549 NL80211_ATTR_WIPHY_ANTENNA_RX, 1550 rx_ant)) 1551 goto nla_put_failure; 1552 } 1553 } 1554 1555 state->split_start++; 1556 if (state->split) 1557 break; 1558 case 2: 1559 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES, 1560 rdev->wiphy.interface_modes)) 1561 goto nla_put_failure; 1562 state->split_start++; 1563 if (state->split) 1564 break; 1565 case 3: 1566 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS); 1567 if (!nl_bands) 1568 goto nla_put_failure; 1569 1570 for (band = state->band_start; 1571 band < NUM_NL80211_BANDS; band++) { 1572 struct ieee80211_supported_band *sband; 1573 1574 sband = rdev->wiphy.bands[band]; 1575 1576 if (!sband) 1577 continue; 1578 1579 nl_band = nla_nest_start(msg, band); 1580 if (!nl_band) 1581 goto nla_put_failure; 1582 1583 switch (state->chan_start) { 1584 case 0: 1585 if (nl80211_send_band_rateinfo(msg, sband)) 1586 goto nla_put_failure; 1587 state->chan_start++; 1588 if (state->split) 1589 break; 1590 default: 1591 /* add frequencies */ 1592 nl_freqs = nla_nest_start( 1593 msg, NL80211_BAND_ATTR_FREQS); 1594 if (!nl_freqs) 1595 goto nla_put_failure; 1596 1597 for (i = state->chan_start - 1; 1598 i < sband->n_channels; 1599 i++) { 1600 nl_freq = nla_nest_start(msg, i); 1601 if (!nl_freq) 1602 goto nla_put_failure; 1603 1604 chan = &sband->channels[i]; 1605 1606 if (nl80211_msg_put_channel( 1607 msg, chan, 1608 state->split)) 1609 goto nla_put_failure; 1610 1611 nla_nest_end(msg, nl_freq); 1612 if (state->split) 1613 break; 1614 } 1615 if (i < sband->n_channels) 1616 state->chan_start = i + 2; 1617 else 1618 state->chan_start = 0; 1619 nla_nest_end(msg, nl_freqs); 1620 } 1621 1622 nla_nest_end(msg, nl_band); 1623 1624 if (state->split) { 1625 /* start again here */ 1626 if (state->chan_start) 1627 band--; 1628 break; 1629 } 1630 } 1631 nla_nest_end(msg, nl_bands); 1632 1633 if (band < NUM_NL80211_BANDS) 1634 state->band_start = band + 1; 1635 else 1636 state->band_start = 0; 1637 1638 /* if bands & channels are done, continue outside */ 1639 if (state->band_start == 0 && state->chan_start == 0) 1640 state->split_start++; 1641 if (state->split) 1642 break; 1643 case 4: 1644 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS); 1645 if (!nl_cmds) 1646 goto nla_put_failure; 1647 1648 i = nl80211_add_commands_unsplit(rdev, msg); 1649 if (i < 0) 1650 goto nla_put_failure; 1651 if (state->split) { 1652 CMD(crit_proto_start, CRIT_PROTOCOL_START); 1653 CMD(crit_proto_stop, CRIT_PROTOCOL_STOP); 1654 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH) 1655 CMD(channel_switch, CHANNEL_SWITCH); 1656 CMD(set_qos_map, SET_QOS_MAP); 1657 if (rdev->wiphy.features & 1658 NL80211_FEATURE_SUPPORTS_WMM_ADMISSION) 1659 CMD(add_tx_ts, ADD_TX_TS); 1660 CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST); 1661 CMD(update_connect_params, UPDATE_CONNECT_PARAMS); 1662 } 1663 #undef CMD 1664 1665 nla_nest_end(msg, nl_cmds); 1666 state->split_start++; 1667 if (state->split) 1668 break; 1669 case 5: 1670 if (rdev->ops->remain_on_channel && 1671 (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) && 1672 nla_put_u32(msg, 1673 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION, 1674 rdev->wiphy.max_remain_on_channel_duration)) 1675 goto nla_put_failure; 1676 1677 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) && 1678 nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK)) 1679 goto nla_put_failure; 1680 1681 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes)) 1682 goto nla_put_failure; 1683 state->split_start++; 1684 if (state->split) 1685 break; 1686 case 6: 1687 #ifdef CONFIG_PM 1688 if (nl80211_send_wowlan(msg, rdev, state->split)) 1689 goto nla_put_failure; 1690 state->split_start++; 1691 if (state->split) 1692 break; 1693 #else 1694 state->split_start++; 1695 #endif 1696 case 7: 1697 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES, 1698 rdev->wiphy.software_iftypes)) 1699 goto nla_put_failure; 1700 1701 if (nl80211_put_iface_combinations(&rdev->wiphy, msg, 1702 state->split)) 1703 goto nla_put_failure; 1704 1705 state->split_start++; 1706 if (state->split) 1707 break; 1708 case 8: 1709 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) && 1710 nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME, 1711 rdev->wiphy.ap_sme_capa)) 1712 goto nla_put_failure; 1713 1714 features = rdev->wiphy.features; 1715 /* 1716 * We can only add the per-channel limit information if the 1717 * dump is split, otherwise it makes it too big. Therefore 1718 * only advertise it in that case. 1719 */ 1720 if (state->split) 1721 features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS; 1722 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features)) 1723 goto nla_put_failure; 1724 1725 if (rdev->wiphy.ht_capa_mod_mask && 1726 nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK, 1727 sizeof(*rdev->wiphy.ht_capa_mod_mask), 1728 rdev->wiphy.ht_capa_mod_mask)) 1729 goto nla_put_failure; 1730 1731 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME && 1732 rdev->wiphy.max_acl_mac_addrs && 1733 nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX, 1734 rdev->wiphy.max_acl_mac_addrs)) 1735 goto nla_put_failure; 1736 1737 /* 1738 * Any information below this point is only available to 1739 * applications that can deal with it being split. This 1740 * helps ensure that newly added capabilities don't break 1741 * older tools by overrunning their buffers. 1742 * 1743 * We still increment split_start so that in the split 1744 * case we'll continue with more data in the next round, 1745 * but break unconditionally so unsplit data stops here. 1746 */ 1747 state->split_start++; 1748 break; 1749 case 9: 1750 if (rdev->wiphy.extended_capabilities && 1751 (nla_put(msg, NL80211_ATTR_EXT_CAPA, 1752 rdev->wiphy.extended_capabilities_len, 1753 rdev->wiphy.extended_capabilities) || 1754 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK, 1755 rdev->wiphy.extended_capabilities_len, 1756 rdev->wiphy.extended_capabilities_mask))) 1757 goto nla_put_failure; 1758 1759 if (rdev->wiphy.vht_capa_mod_mask && 1760 nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK, 1761 sizeof(*rdev->wiphy.vht_capa_mod_mask), 1762 rdev->wiphy.vht_capa_mod_mask)) 1763 goto nla_put_failure; 1764 1765 state->split_start++; 1766 break; 1767 case 10: 1768 if (nl80211_send_coalesce(msg, rdev)) 1769 goto nla_put_failure; 1770 1771 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) && 1772 (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) || 1773 nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ))) 1774 goto nla_put_failure; 1775 1776 if (rdev->wiphy.max_ap_assoc_sta && 1777 nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA, 1778 rdev->wiphy.max_ap_assoc_sta)) 1779 goto nla_put_failure; 1780 1781 state->split_start++; 1782 break; 1783 case 11: 1784 if (rdev->wiphy.n_vendor_commands) { 1785 const struct nl80211_vendor_cmd_info *info; 1786 struct nlattr *nested; 1787 1788 nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA); 1789 if (!nested) 1790 goto nla_put_failure; 1791 1792 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) { 1793 info = &rdev->wiphy.vendor_commands[i].info; 1794 if (nla_put(msg, i + 1, sizeof(*info), info)) 1795 goto nla_put_failure; 1796 } 1797 nla_nest_end(msg, nested); 1798 } 1799 1800 if (rdev->wiphy.n_vendor_events) { 1801 const struct nl80211_vendor_cmd_info *info; 1802 struct nlattr *nested; 1803 1804 nested = nla_nest_start(msg, 1805 NL80211_ATTR_VENDOR_EVENTS); 1806 if (!nested) 1807 goto nla_put_failure; 1808 1809 for (i = 0; i < rdev->wiphy.n_vendor_events; i++) { 1810 info = &rdev->wiphy.vendor_events[i]; 1811 if (nla_put(msg, i + 1, sizeof(*info), info)) 1812 goto nla_put_failure; 1813 } 1814 nla_nest_end(msg, nested); 1815 } 1816 state->split_start++; 1817 break; 1818 case 12: 1819 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH && 1820 nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS, 1821 rdev->wiphy.max_num_csa_counters)) 1822 goto nla_put_failure; 1823 1824 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED && 1825 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG)) 1826 goto nla_put_failure; 1827 1828 if (rdev->wiphy.max_sched_scan_reqs && 1829 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS, 1830 rdev->wiphy.max_sched_scan_reqs)) 1831 goto nla_put_failure; 1832 1833 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES, 1834 sizeof(rdev->wiphy.ext_features), 1835 rdev->wiphy.ext_features)) 1836 goto nla_put_failure; 1837 1838 if (rdev->wiphy.bss_select_support) { 1839 struct nlattr *nested; 1840 u32 bss_select_support = rdev->wiphy.bss_select_support; 1841 1842 nested = nla_nest_start(msg, NL80211_ATTR_BSS_SELECT); 1843 if (!nested) 1844 goto nla_put_failure; 1845 1846 i = 0; 1847 while (bss_select_support) { 1848 if ((bss_select_support & 1) && 1849 nla_put_flag(msg, i)) 1850 goto nla_put_failure; 1851 i++; 1852 bss_select_support >>= 1; 1853 } 1854 nla_nest_end(msg, nested); 1855 } 1856 1857 state->split_start++; 1858 break; 1859 case 13: 1860 if (rdev->wiphy.num_iftype_ext_capab && 1861 rdev->wiphy.iftype_ext_capab) { 1862 struct nlattr *nested_ext_capab, *nested; 1863 1864 nested = nla_nest_start(msg, 1865 NL80211_ATTR_IFTYPE_EXT_CAPA); 1866 if (!nested) 1867 goto nla_put_failure; 1868 1869 for (i = state->capa_start; 1870 i < rdev->wiphy.num_iftype_ext_capab; i++) { 1871 const struct wiphy_iftype_ext_capab *capab; 1872 1873 capab = &rdev->wiphy.iftype_ext_capab[i]; 1874 1875 nested_ext_capab = nla_nest_start(msg, i); 1876 if (!nested_ext_capab || 1877 nla_put_u32(msg, NL80211_ATTR_IFTYPE, 1878 capab->iftype) || 1879 nla_put(msg, NL80211_ATTR_EXT_CAPA, 1880 capab->extended_capabilities_len, 1881 capab->extended_capabilities) || 1882 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK, 1883 capab->extended_capabilities_len, 1884 capab->extended_capabilities_mask)) 1885 goto nla_put_failure; 1886 1887 nla_nest_end(msg, nested_ext_capab); 1888 if (state->split) 1889 break; 1890 } 1891 nla_nest_end(msg, nested); 1892 if (i < rdev->wiphy.num_iftype_ext_capab) { 1893 state->capa_start = i + 1; 1894 break; 1895 } 1896 } 1897 1898 if (nla_put_u32(msg, NL80211_ATTR_BANDS, 1899 rdev->wiphy.nan_supported_bands)) 1900 goto nla_put_failure; 1901 1902 /* done */ 1903 state->split_start = 0; 1904 break; 1905 } 1906 finish: 1907 genlmsg_end(msg, hdr); 1908 return 0; 1909 1910 nla_put_failure: 1911 genlmsg_cancel(msg, hdr); 1912 return -EMSGSIZE; 1913 } 1914 1915 static int nl80211_dump_wiphy_parse(struct sk_buff *skb, 1916 struct netlink_callback *cb, 1917 struct nl80211_dump_wiphy_state *state) 1918 { 1919 struct nlattr **tb = genl_family_attrbuf(&nl80211_fam); 1920 int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, tb, 1921 nl80211_fam.maxattr, nl80211_policy, NULL); 1922 /* ignore parse errors for backward compatibility */ 1923 if (ret) 1924 return 0; 1925 1926 state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP]; 1927 if (tb[NL80211_ATTR_WIPHY]) 1928 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]); 1929 if (tb[NL80211_ATTR_WDEV]) 1930 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32; 1931 if (tb[NL80211_ATTR_IFINDEX]) { 1932 struct net_device *netdev; 1933 struct cfg80211_registered_device *rdev; 1934 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]); 1935 1936 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx); 1937 if (!netdev) 1938 return -ENODEV; 1939 if (netdev->ieee80211_ptr) { 1940 rdev = wiphy_to_rdev( 1941 netdev->ieee80211_ptr->wiphy); 1942 state->filter_wiphy = rdev->wiphy_idx; 1943 } 1944 } 1945 1946 return 0; 1947 } 1948 1949 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb) 1950 { 1951 int idx = 0, ret; 1952 struct nl80211_dump_wiphy_state *state = (void *)cb->args[0]; 1953 struct cfg80211_registered_device *rdev; 1954 1955 rtnl_lock(); 1956 if (!state) { 1957 state = kzalloc(sizeof(*state), GFP_KERNEL); 1958 if (!state) { 1959 rtnl_unlock(); 1960 return -ENOMEM; 1961 } 1962 state->filter_wiphy = -1; 1963 ret = nl80211_dump_wiphy_parse(skb, cb, state); 1964 if (ret) { 1965 kfree(state); 1966 rtnl_unlock(); 1967 return ret; 1968 } 1969 cb->args[0] = (long)state; 1970 } 1971 1972 list_for_each_entry(rdev, &cfg80211_rdev_list, list) { 1973 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk))) 1974 continue; 1975 if (++idx <= state->start) 1976 continue; 1977 if (state->filter_wiphy != -1 && 1978 state->filter_wiphy != rdev->wiphy_idx) 1979 continue; 1980 /* attempt to fit multiple wiphy data chunks into the skb */ 1981 do { 1982 ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, 1983 skb, 1984 NETLINK_CB(cb->skb).portid, 1985 cb->nlh->nlmsg_seq, 1986 NLM_F_MULTI, state); 1987 if (ret < 0) { 1988 /* 1989 * If sending the wiphy data didn't fit (ENOBUFS 1990 * or EMSGSIZE returned), this SKB is still 1991 * empty (so it's not too big because another 1992 * wiphy dataset is already in the skb) and 1993 * we've not tried to adjust the dump allocation 1994 * yet ... then adjust the alloc size to be 1995 * bigger, and return 1 but with the empty skb. 1996 * This results in an empty message being RX'ed 1997 * in userspace, but that is ignored. 1998 * 1999 * We can then retry with the larger buffer. 2000 */ 2001 if ((ret == -ENOBUFS || ret == -EMSGSIZE) && 2002 !skb->len && !state->split && 2003 cb->min_dump_alloc < 4096) { 2004 cb->min_dump_alloc = 4096; 2005 state->split_start = 0; 2006 rtnl_unlock(); 2007 return 1; 2008 } 2009 idx--; 2010 break; 2011 } 2012 } while (state->split_start > 0); 2013 break; 2014 } 2015 rtnl_unlock(); 2016 2017 state->start = idx; 2018 2019 return skb->len; 2020 } 2021 2022 static int nl80211_dump_wiphy_done(struct netlink_callback *cb) 2023 { 2024 kfree((void *)cb->args[0]); 2025 return 0; 2026 } 2027 2028 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info) 2029 { 2030 struct sk_buff *msg; 2031 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 2032 struct nl80211_dump_wiphy_state state = {}; 2033 2034 msg = nlmsg_new(4096, GFP_KERNEL); 2035 if (!msg) 2036 return -ENOMEM; 2037 2038 if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg, 2039 info->snd_portid, info->snd_seq, 0, 2040 &state) < 0) { 2041 nlmsg_free(msg); 2042 return -ENOBUFS; 2043 } 2044 2045 return genlmsg_reply(msg, info); 2046 } 2047 2048 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = { 2049 [NL80211_TXQ_ATTR_QUEUE] = { .type = NLA_U8 }, 2050 [NL80211_TXQ_ATTR_TXOP] = { .type = NLA_U16 }, 2051 [NL80211_TXQ_ATTR_CWMIN] = { .type = NLA_U16 }, 2052 [NL80211_TXQ_ATTR_CWMAX] = { .type = NLA_U16 }, 2053 [NL80211_TXQ_ATTR_AIFS] = { .type = NLA_U8 }, 2054 }; 2055 2056 static int parse_txq_params(struct nlattr *tb[], 2057 struct ieee80211_txq_params *txq_params) 2058 { 2059 if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] || 2060 !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] || 2061 !tb[NL80211_TXQ_ATTR_AIFS]) 2062 return -EINVAL; 2063 2064 txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]); 2065 txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]); 2066 txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]); 2067 txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]); 2068 txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]); 2069 2070 if (txq_params->ac >= NL80211_NUM_ACS) 2071 return -EINVAL; 2072 2073 return 0; 2074 } 2075 2076 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev) 2077 { 2078 /* 2079 * You can only set the channel explicitly for WDS interfaces, 2080 * all others have their channel managed via their respective 2081 * "establish a connection" command (connect, join, ...) 2082 * 2083 * For AP/GO and mesh mode, the channel can be set with the 2084 * channel userspace API, but is only stored and passed to the 2085 * low-level driver when the AP starts or the mesh is joined. 2086 * This is for backward compatibility, userspace can also give 2087 * the channel in the start-ap or join-mesh commands instead. 2088 * 2089 * Monitors are special as they are normally slaved to 2090 * whatever else is going on, so they have their own special 2091 * operation to set the monitor channel if possible. 2092 */ 2093 return !wdev || 2094 wdev->iftype == NL80211_IFTYPE_AP || 2095 wdev->iftype == NL80211_IFTYPE_MESH_POINT || 2096 wdev->iftype == NL80211_IFTYPE_MONITOR || 2097 wdev->iftype == NL80211_IFTYPE_P2P_GO; 2098 } 2099 2100 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev, 2101 struct genl_info *info, 2102 struct cfg80211_chan_def *chandef) 2103 { 2104 u32 control_freq; 2105 2106 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ]) 2107 return -EINVAL; 2108 2109 control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]); 2110 2111 chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq); 2112 chandef->width = NL80211_CHAN_WIDTH_20_NOHT; 2113 chandef->center_freq1 = control_freq; 2114 chandef->center_freq2 = 0; 2115 2116 /* Primary channel not allowed */ 2117 if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED) 2118 return -EINVAL; 2119 2120 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) { 2121 enum nl80211_channel_type chantype; 2122 2123 chantype = nla_get_u32( 2124 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]); 2125 2126 switch (chantype) { 2127 case NL80211_CHAN_NO_HT: 2128 case NL80211_CHAN_HT20: 2129 case NL80211_CHAN_HT40PLUS: 2130 case NL80211_CHAN_HT40MINUS: 2131 cfg80211_chandef_create(chandef, chandef->chan, 2132 chantype); 2133 /* user input for center_freq is incorrect */ 2134 if (info->attrs[NL80211_ATTR_CENTER_FREQ1] && 2135 chandef->center_freq1 != nla_get_u32( 2136 info->attrs[NL80211_ATTR_CENTER_FREQ1])) 2137 return -EINVAL; 2138 /* center_freq2 must be zero */ 2139 if (info->attrs[NL80211_ATTR_CENTER_FREQ2] && 2140 nla_get_u32(info->attrs[NL80211_ATTR_CENTER_FREQ2])) 2141 return -EINVAL; 2142 break; 2143 default: 2144 return -EINVAL; 2145 } 2146 } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) { 2147 chandef->width = 2148 nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]); 2149 if (info->attrs[NL80211_ATTR_CENTER_FREQ1]) 2150 chandef->center_freq1 = 2151 nla_get_u32( 2152 info->attrs[NL80211_ATTR_CENTER_FREQ1]); 2153 if (info->attrs[NL80211_ATTR_CENTER_FREQ2]) 2154 chandef->center_freq2 = 2155 nla_get_u32( 2156 info->attrs[NL80211_ATTR_CENTER_FREQ2]); 2157 } 2158 2159 if (!cfg80211_chandef_valid(chandef)) 2160 return -EINVAL; 2161 2162 if (!cfg80211_chandef_usable(&rdev->wiphy, chandef, 2163 IEEE80211_CHAN_DISABLED)) 2164 return -EINVAL; 2165 2166 if ((chandef->width == NL80211_CHAN_WIDTH_5 || 2167 chandef->width == NL80211_CHAN_WIDTH_10) && 2168 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) 2169 return -EINVAL; 2170 2171 return 0; 2172 } 2173 2174 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev, 2175 struct net_device *dev, 2176 struct genl_info *info) 2177 { 2178 struct cfg80211_chan_def chandef; 2179 int result; 2180 enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR; 2181 struct wireless_dev *wdev = NULL; 2182 2183 if (dev) 2184 wdev = dev->ieee80211_ptr; 2185 if (!nl80211_can_set_dev_channel(wdev)) 2186 return -EOPNOTSUPP; 2187 if (wdev) 2188 iftype = wdev->iftype; 2189 2190 result = nl80211_parse_chandef(rdev, info, &chandef); 2191 if (result) 2192 return result; 2193 2194 switch (iftype) { 2195 case NL80211_IFTYPE_AP: 2196 case NL80211_IFTYPE_P2P_GO: 2197 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef, 2198 iftype)) { 2199 result = -EINVAL; 2200 break; 2201 } 2202 if (wdev->beacon_interval) { 2203 if (!dev || !rdev->ops->set_ap_chanwidth || 2204 !(rdev->wiphy.features & 2205 NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) { 2206 result = -EBUSY; 2207 break; 2208 } 2209 2210 /* Only allow dynamic channel width changes */ 2211 if (chandef.chan != wdev->preset_chandef.chan) { 2212 result = -EBUSY; 2213 break; 2214 } 2215 result = rdev_set_ap_chanwidth(rdev, dev, &chandef); 2216 if (result) 2217 break; 2218 } 2219 wdev->preset_chandef = chandef; 2220 result = 0; 2221 break; 2222 case NL80211_IFTYPE_MESH_POINT: 2223 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef); 2224 break; 2225 case NL80211_IFTYPE_MONITOR: 2226 result = cfg80211_set_monitor_channel(rdev, &chandef); 2227 break; 2228 default: 2229 result = -EINVAL; 2230 } 2231 2232 return result; 2233 } 2234 2235 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info) 2236 { 2237 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 2238 struct net_device *netdev = info->user_ptr[1]; 2239 2240 return __nl80211_set_channel(rdev, netdev, info); 2241 } 2242 2243 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info) 2244 { 2245 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 2246 struct net_device *dev = info->user_ptr[1]; 2247 struct wireless_dev *wdev = dev->ieee80211_ptr; 2248 const u8 *bssid; 2249 2250 if (!info->attrs[NL80211_ATTR_MAC]) 2251 return -EINVAL; 2252 2253 if (netif_running(dev)) 2254 return -EBUSY; 2255 2256 if (!rdev->ops->set_wds_peer) 2257 return -EOPNOTSUPP; 2258 2259 if (wdev->iftype != NL80211_IFTYPE_WDS) 2260 return -EOPNOTSUPP; 2261 2262 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 2263 return rdev_set_wds_peer(rdev, dev, bssid); 2264 } 2265 2266 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info) 2267 { 2268 struct cfg80211_registered_device *rdev; 2269 struct net_device *netdev = NULL; 2270 struct wireless_dev *wdev; 2271 int result = 0, rem_txq_params = 0; 2272 struct nlattr *nl_txq_params; 2273 u32 changed; 2274 u8 retry_short = 0, retry_long = 0; 2275 u32 frag_threshold = 0, rts_threshold = 0; 2276 u8 coverage_class = 0; 2277 2278 ASSERT_RTNL(); 2279 2280 /* 2281 * Try to find the wiphy and netdev. Normally this 2282 * function shouldn't need the netdev, but this is 2283 * done for backward compatibility -- previously 2284 * setting the channel was done per wiphy, but now 2285 * it is per netdev. Previous userland like hostapd 2286 * also passed a netdev to set_wiphy, so that it is 2287 * possible to let that go to the right netdev! 2288 */ 2289 2290 if (info->attrs[NL80211_ATTR_IFINDEX]) { 2291 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]); 2292 2293 netdev = __dev_get_by_index(genl_info_net(info), ifindex); 2294 if (netdev && netdev->ieee80211_ptr) 2295 rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy); 2296 else 2297 netdev = NULL; 2298 } 2299 2300 if (!netdev) { 2301 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info), 2302 info->attrs); 2303 if (IS_ERR(rdev)) 2304 return PTR_ERR(rdev); 2305 wdev = NULL; 2306 netdev = NULL; 2307 result = 0; 2308 } else 2309 wdev = netdev->ieee80211_ptr; 2310 2311 /* 2312 * end workaround code, by now the rdev is available 2313 * and locked, and wdev may or may not be NULL. 2314 */ 2315 2316 if (info->attrs[NL80211_ATTR_WIPHY_NAME]) 2317 result = cfg80211_dev_rename( 2318 rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME])); 2319 2320 if (result) 2321 return result; 2322 2323 if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) { 2324 struct ieee80211_txq_params txq_params; 2325 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1]; 2326 2327 if (!rdev->ops->set_txq_params) 2328 return -EOPNOTSUPP; 2329 2330 if (!netdev) 2331 return -EINVAL; 2332 2333 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 2334 netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 2335 return -EINVAL; 2336 2337 if (!netif_running(netdev)) 2338 return -ENETDOWN; 2339 2340 nla_for_each_nested(nl_txq_params, 2341 info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS], 2342 rem_txq_params) { 2343 result = nla_parse_nested(tb, NL80211_TXQ_ATTR_MAX, 2344 nl_txq_params, 2345 txq_params_policy, 2346 info->extack); 2347 if (result) 2348 return result; 2349 result = parse_txq_params(tb, &txq_params); 2350 if (result) 2351 return result; 2352 2353 result = rdev_set_txq_params(rdev, netdev, 2354 &txq_params); 2355 if (result) 2356 return result; 2357 } 2358 } 2359 2360 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 2361 result = __nl80211_set_channel( 2362 rdev, 2363 nl80211_can_set_dev_channel(wdev) ? netdev : NULL, 2364 info); 2365 if (result) 2366 return result; 2367 } 2368 2369 if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) { 2370 struct wireless_dev *txp_wdev = wdev; 2371 enum nl80211_tx_power_setting type; 2372 int idx, mbm = 0; 2373 2374 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER)) 2375 txp_wdev = NULL; 2376 2377 if (!rdev->ops->set_tx_power) 2378 return -EOPNOTSUPP; 2379 2380 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING; 2381 type = nla_get_u32(info->attrs[idx]); 2382 2383 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] && 2384 (type != NL80211_TX_POWER_AUTOMATIC)) 2385 return -EINVAL; 2386 2387 if (type != NL80211_TX_POWER_AUTOMATIC) { 2388 idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL; 2389 mbm = nla_get_u32(info->attrs[idx]); 2390 } 2391 2392 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm); 2393 if (result) 2394 return result; 2395 } 2396 2397 if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] && 2398 info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) { 2399 u32 tx_ant, rx_ant; 2400 2401 if ((!rdev->wiphy.available_antennas_tx && 2402 !rdev->wiphy.available_antennas_rx) || 2403 !rdev->ops->set_antenna) 2404 return -EOPNOTSUPP; 2405 2406 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]); 2407 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]); 2408 2409 /* reject antenna configurations which don't match the 2410 * available antenna masks, except for the "all" mask */ 2411 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) || 2412 (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) 2413 return -EINVAL; 2414 2415 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx; 2416 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx; 2417 2418 result = rdev_set_antenna(rdev, tx_ant, rx_ant); 2419 if (result) 2420 return result; 2421 } 2422 2423 changed = 0; 2424 2425 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) { 2426 retry_short = nla_get_u8( 2427 info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]); 2428 if (retry_short == 0) 2429 return -EINVAL; 2430 2431 changed |= WIPHY_PARAM_RETRY_SHORT; 2432 } 2433 2434 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) { 2435 retry_long = nla_get_u8( 2436 info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]); 2437 if (retry_long == 0) 2438 return -EINVAL; 2439 2440 changed |= WIPHY_PARAM_RETRY_LONG; 2441 } 2442 2443 if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) { 2444 frag_threshold = nla_get_u32( 2445 info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]); 2446 if (frag_threshold < 256) 2447 return -EINVAL; 2448 2449 if (frag_threshold != (u32) -1) { 2450 /* 2451 * Fragments (apart from the last one) are required to 2452 * have even length. Make the fragmentation code 2453 * simpler by stripping LSB should someone try to use 2454 * odd threshold value. 2455 */ 2456 frag_threshold &= ~0x1; 2457 } 2458 changed |= WIPHY_PARAM_FRAG_THRESHOLD; 2459 } 2460 2461 if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) { 2462 rts_threshold = nla_get_u32( 2463 info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]); 2464 changed |= WIPHY_PARAM_RTS_THRESHOLD; 2465 } 2466 2467 if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) { 2468 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) 2469 return -EINVAL; 2470 2471 coverage_class = nla_get_u8( 2472 info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]); 2473 changed |= WIPHY_PARAM_COVERAGE_CLASS; 2474 } 2475 2476 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) { 2477 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION)) 2478 return -EOPNOTSUPP; 2479 2480 changed |= WIPHY_PARAM_DYN_ACK; 2481 } 2482 2483 if (changed) { 2484 u8 old_retry_short, old_retry_long; 2485 u32 old_frag_threshold, old_rts_threshold; 2486 u8 old_coverage_class; 2487 2488 if (!rdev->ops->set_wiphy_params) 2489 return -EOPNOTSUPP; 2490 2491 old_retry_short = rdev->wiphy.retry_short; 2492 old_retry_long = rdev->wiphy.retry_long; 2493 old_frag_threshold = rdev->wiphy.frag_threshold; 2494 old_rts_threshold = rdev->wiphy.rts_threshold; 2495 old_coverage_class = rdev->wiphy.coverage_class; 2496 2497 if (changed & WIPHY_PARAM_RETRY_SHORT) 2498 rdev->wiphy.retry_short = retry_short; 2499 if (changed & WIPHY_PARAM_RETRY_LONG) 2500 rdev->wiphy.retry_long = retry_long; 2501 if (changed & WIPHY_PARAM_FRAG_THRESHOLD) 2502 rdev->wiphy.frag_threshold = frag_threshold; 2503 if (changed & WIPHY_PARAM_RTS_THRESHOLD) 2504 rdev->wiphy.rts_threshold = rts_threshold; 2505 if (changed & WIPHY_PARAM_COVERAGE_CLASS) 2506 rdev->wiphy.coverage_class = coverage_class; 2507 2508 result = rdev_set_wiphy_params(rdev, changed); 2509 if (result) { 2510 rdev->wiphy.retry_short = old_retry_short; 2511 rdev->wiphy.retry_long = old_retry_long; 2512 rdev->wiphy.frag_threshold = old_frag_threshold; 2513 rdev->wiphy.rts_threshold = old_rts_threshold; 2514 rdev->wiphy.coverage_class = old_coverage_class; 2515 return result; 2516 } 2517 } 2518 return 0; 2519 } 2520 2521 static inline u64 wdev_id(struct wireless_dev *wdev) 2522 { 2523 return (u64)wdev->identifier | 2524 ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32); 2525 } 2526 2527 static int nl80211_send_chandef(struct sk_buff *msg, 2528 const struct cfg80211_chan_def *chandef) 2529 { 2530 if (WARN_ON(!cfg80211_chandef_valid(chandef))) 2531 return -EINVAL; 2532 2533 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, 2534 chandef->chan->center_freq)) 2535 return -ENOBUFS; 2536 switch (chandef->width) { 2537 case NL80211_CHAN_WIDTH_20_NOHT: 2538 case NL80211_CHAN_WIDTH_20: 2539 case NL80211_CHAN_WIDTH_40: 2540 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, 2541 cfg80211_get_chandef_type(chandef))) 2542 return -ENOBUFS; 2543 break; 2544 default: 2545 break; 2546 } 2547 if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width)) 2548 return -ENOBUFS; 2549 if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1)) 2550 return -ENOBUFS; 2551 if (chandef->center_freq2 && 2552 nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2)) 2553 return -ENOBUFS; 2554 return 0; 2555 } 2556 2557 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags, 2558 struct cfg80211_registered_device *rdev, 2559 struct wireless_dev *wdev, bool removal) 2560 { 2561 struct net_device *dev = wdev->netdev; 2562 u8 cmd = NL80211_CMD_NEW_INTERFACE; 2563 void *hdr; 2564 2565 if (removal) 2566 cmd = NL80211_CMD_DEL_INTERFACE; 2567 2568 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 2569 if (!hdr) 2570 return -1; 2571 2572 if (dev && 2573 (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 2574 nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name))) 2575 goto nla_put_failure; 2576 2577 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 2578 nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) || 2579 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 2580 NL80211_ATTR_PAD) || 2581 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) || 2582 nla_put_u32(msg, NL80211_ATTR_GENERATION, 2583 rdev->devlist_generation ^ 2584 (cfg80211_rdev_list_generation << 2))) 2585 goto nla_put_failure; 2586 2587 if (rdev->ops->get_channel) { 2588 int ret; 2589 struct cfg80211_chan_def chandef; 2590 2591 ret = rdev_get_channel(rdev, wdev, &chandef); 2592 if (ret == 0) { 2593 if (nl80211_send_chandef(msg, &chandef)) 2594 goto nla_put_failure; 2595 } 2596 } 2597 2598 if (rdev->ops->get_tx_power) { 2599 int dbm, ret; 2600 2601 ret = rdev_get_tx_power(rdev, wdev, &dbm); 2602 if (ret == 0 && 2603 nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL, 2604 DBM_TO_MBM(dbm))) 2605 goto nla_put_failure; 2606 } 2607 2608 if (wdev->ssid_len) { 2609 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid)) 2610 goto nla_put_failure; 2611 } 2612 2613 genlmsg_end(msg, hdr); 2614 return 0; 2615 2616 nla_put_failure: 2617 genlmsg_cancel(msg, hdr); 2618 return -EMSGSIZE; 2619 } 2620 2621 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb) 2622 { 2623 int wp_idx = 0; 2624 int if_idx = 0; 2625 int wp_start = cb->args[0]; 2626 int if_start = cb->args[1]; 2627 int filter_wiphy = -1; 2628 struct cfg80211_registered_device *rdev; 2629 struct wireless_dev *wdev; 2630 int ret; 2631 2632 rtnl_lock(); 2633 if (!cb->args[2]) { 2634 struct nl80211_dump_wiphy_state state = { 2635 .filter_wiphy = -1, 2636 }; 2637 2638 ret = nl80211_dump_wiphy_parse(skb, cb, &state); 2639 if (ret) 2640 goto out_unlock; 2641 2642 filter_wiphy = state.filter_wiphy; 2643 2644 /* 2645 * if filtering, set cb->args[2] to +1 since 0 is the default 2646 * value needed to determine that parsing is necessary. 2647 */ 2648 if (filter_wiphy >= 0) 2649 cb->args[2] = filter_wiphy + 1; 2650 else 2651 cb->args[2] = -1; 2652 } else if (cb->args[2] > 0) { 2653 filter_wiphy = cb->args[2] - 1; 2654 } 2655 2656 list_for_each_entry(rdev, &cfg80211_rdev_list, list) { 2657 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk))) 2658 continue; 2659 if (wp_idx < wp_start) { 2660 wp_idx++; 2661 continue; 2662 } 2663 2664 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx) 2665 continue; 2666 2667 if_idx = 0; 2668 2669 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { 2670 if (if_idx < if_start) { 2671 if_idx++; 2672 continue; 2673 } 2674 if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid, 2675 cb->nlh->nlmsg_seq, NLM_F_MULTI, 2676 rdev, wdev, false) < 0) { 2677 goto out; 2678 } 2679 if_idx++; 2680 } 2681 2682 wp_idx++; 2683 } 2684 out: 2685 cb->args[0] = wp_idx; 2686 cb->args[1] = if_idx; 2687 2688 ret = skb->len; 2689 out_unlock: 2690 rtnl_unlock(); 2691 2692 return ret; 2693 } 2694 2695 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info) 2696 { 2697 struct sk_buff *msg; 2698 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 2699 struct wireless_dev *wdev = info->user_ptr[1]; 2700 2701 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 2702 if (!msg) 2703 return -ENOMEM; 2704 2705 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0, 2706 rdev, wdev, false) < 0) { 2707 nlmsg_free(msg); 2708 return -ENOBUFS; 2709 } 2710 2711 return genlmsg_reply(msg, info); 2712 } 2713 2714 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = { 2715 [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG }, 2716 [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG }, 2717 [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG }, 2718 [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG }, 2719 [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG }, 2720 [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG }, 2721 }; 2722 2723 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags) 2724 { 2725 struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1]; 2726 int flag; 2727 2728 *mntrflags = 0; 2729 2730 if (!nla) 2731 return -EINVAL; 2732 2733 if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX, nla, 2734 mntr_flags_policy, NULL)) 2735 return -EINVAL; 2736 2737 for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++) 2738 if (flags[flag]) 2739 *mntrflags |= (1<<flag); 2740 2741 *mntrflags |= MONITOR_FLAG_CHANGED; 2742 2743 return 0; 2744 } 2745 2746 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev, 2747 enum nl80211_iftype type, 2748 struct genl_info *info, 2749 struct vif_params *params) 2750 { 2751 bool change = false; 2752 int err; 2753 2754 if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) { 2755 if (type != NL80211_IFTYPE_MONITOR) 2756 return -EINVAL; 2757 2758 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS], 2759 ¶ms->flags); 2760 if (err) 2761 return err; 2762 2763 change = true; 2764 } 2765 2766 if (params->flags & MONITOR_FLAG_ACTIVE && 2767 !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR)) 2768 return -EOPNOTSUPP; 2769 2770 if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) { 2771 const u8 *mumimo_groups; 2772 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER; 2773 2774 if (type != NL80211_IFTYPE_MONITOR) 2775 return -EINVAL; 2776 2777 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag)) 2778 return -EOPNOTSUPP; 2779 2780 mumimo_groups = 2781 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]); 2782 2783 /* bits 0 and 63 are reserved and must be zero */ 2784 if ((mumimo_groups[0] & BIT(0)) || 2785 (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7))) 2786 return -EINVAL; 2787 2788 params->vht_mumimo_groups = mumimo_groups; 2789 change = true; 2790 } 2791 2792 if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) { 2793 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER; 2794 2795 if (type != NL80211_IFTYPE_MONITOR) 2796 return -EINVAL; 2797 2798 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag)) 2799 return -EOPNOTSUPP; 2800 2801 params->vht_mumimo_follow_addr = 2802 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]); 2803 change = true; 2804 } 2805 2806 return change ? 1 : 0; 2807 } 2808 2809 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev, 2810 struct net_device *netdev, u8 use_4addr, 2811 enum nl80211_iftype iftype) 2812 { 2813 if (!use_4addr) { 2814 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT)) 2815 return -EBUSY; 2816 return 0; 2817 } 2818 2819 switch (iftype) { 2820 case NL80211_IFTYPE_AP_VLAN: 2821 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP) 2822 return 0; 2823 break; 2824 case NL80211_IFTYPE_STATION: 2825 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION) 2826 return 0; 2827 break; 2828 default: 2829 break; 2830 } 2831 2832 return -EOPNOTSUPP; 2833 } 2834 2835 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info) 2836 { 2837 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 2838 struct vif_params params; 2839 int err; 2840 enum nl80211_iftype otype, ntype; 2841 struct net_device *dev = info->user_ptr[1]; 2842 bool change = false; 2843 2844 memset(¶ms, 0, sizeof(params)); 2845 2846 otype = ntype = dev->ieee80211_ptr->iftype; 2847 2848 if (info->attrs[NL80211_ATTR_IFTYPE]) { 2849 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]); 2850 if (otype != ntype) 2851 change = true; 2852 if (ntype > NL80211_IFTYPE_MAX) 2853 return -EINVAL; 2854 } 2855 2856 if (info->attrs[NL80211_ATTR_MESH_ID]) { 2857 struct wireless_dev *wdev = dev->ieee80211_ptr; 2858 2859 if (ntype != NL80211_IFTYPE_MESH_POINT) 2860 return -EINVAL; 2861 if (netif_running(dev)) 2862 return -EBUSY; 2863 2864 wdev_lock(wdev); 2865 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN != 2866 IEEE80211_MAX_MESH_ID_LEN); 2867 wdev->mesh_id_up_len = 2868 nla_len(info->attrs[NL80211_ATTR_MESH_ID]); 2869 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]), 2870 wdev->mesh_id_up_len); 2871 wdev_unlock(wdev); 2872 } 2873 2874 if (info->attrs[NL80211_ATTR_4ADDR]) { 2875 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]); 2876 change = true; 2877 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype); 2878 if (err) 2879 return err; 2880 } else { 2881 params.use_4addr = -1; 2882 } 2883 2884 err = nl80211_parse_mon_options(rdev, ntype, info, ¶ms); 2885 if (err < 0) 2886 return err; 2887 if (err > 0) 2888 change = true; 2889 2890 if (change) 2891 err = cfg80211_change_iface(rdev, dev, ntype, ¶ms); 2892 else 2893 err = 0; 2894 2895 if (!err && params.use_4addr != -1) 2896 dev->ieee80211_ptr->use_4addr = params.use_4addr; 2897 2898 return err; 2899 } 2900 2901 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info) 2902 { 2903 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 2904 struct vif_params params; 2905 struct wireless_dev *wdev; 2906 struct sk_buff *msg; 2907 int err; 2908 enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED; 2909 2910 /* to avoid failing a new interface creation due to pending removal */ 2911 cfg80211_destroy_ifaces(rdev); 2912 2913 memset(¶ms, 0, sizeof(params)); 2914 2915 if (!info->attrs[NL80211_ATTR_IFNAME]) 2916 return -EINVAL; 2917 2918 if (info->attrs[NL80211_ATTR_IFTYPE]) { 2919 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]); 2920 if (type > NL80211_IFTYPE_MAX) 2921 return -EINVAL; 2922 } 2923 2924 if (!rdev->ops->add_virtual_intf || 2925 !(rdev->wiphy.interface_modes & (1 << type))) 2926 return -EOPNOTSUPP; 2927 2928 if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN || 2929 rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) && 2930 info->attrs[NL80211_ATTR_MAC]) { 2931 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC], 2932 ETH_ALEN); 2933 if (!is_valid_ether_addr(params.macaddr)) 2934 return -EADDRNOTAVAIL; 2935 } 2936 2937 if (info->attrs[NL80211_ATTR_4ADDR]) { 2938 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]); 2939 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type); 2940 if (err) 2941 return err; 2942 } 2943 2944 err = nl80211_parse_mon_options(rdev, type, info, ¶ms); 2945 if (err < 0) 2946 return err; 2947 2948 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 2949 if (!msg) 2950 return -ENOMEM; 2951 2952 wdev = rdev_add_virtual_intf(rdev, 2953 nla_data(info->attrs[NL80211_ATTR_IFNAME]), 2954 NET_NAME_USER, type, ¶ms); 2955 if (WARN_ON(!wdev)) { 2956 nlmsg_free(msg); 2957 return -EPROTO; 2958 } else if (IS_ERR(wdev)) { 2959 nlmsg_free(msg); 2960 return PTR_ERR(wdev); 2961 } 2962 2963 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 2964 wdev->owner_nlportid = info->snd_portid; 2965 2966 switch (type) { 2967 case NL80211_IFTYPE_MESH_POINT: 2968 if (!info->attrs[NL80211_ATTR_MESH_ID]) 2969 break; 2970 wdev_lock(wdev); 2971 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN != 2972 IEEE80211_MAX_MESH_ID_LEN); 2973 wdev->mesh_id_up_len = 2974 nla_len(info->attrs[NL80211_ATTR_MESH_ID]); 2975 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]), 2976 wdev->mesh_id_up_len); 2977 wdev_unlock(wdev); 2978 break; 2979 case NL80211_IFTYPE_NAN: 2980 case NL80211_IFTYPE_P2P_DEVICE: 2981 /* 2982 * P2P Device and NAN do not have a netdev, so don't go 2983 * through the netdev notifier and must be added here 2984 */ 2985 mutex_init(&wdev->mtx); 2986 INIT_LIST_HEAD(&wdev->event_list); 2987 spin_lock_init(&wdev->event_lock); 2988 INIT_LIST_HEAD(&wdev->mgmt_registrations); 2989 spin_lock_init(&wdev->mgmt_registrations_lock); 2990 2991 wdev->identifier = ++rdev->wdev_id; 2992 list_add_rcu(&wdev->list, &rdev->wiphy.wdev_list); 2993 rdev->devlist_generation++; 2994 break; 2995 default: 2996 break; 2997 } 2998 2999 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0, 3000 rdev, wdev, false) < 0) { 3001 nlmsg_free(msg); 3002 return -ENOBUFS; 3003 } 3004 3005 /* 3006 * For wdevs which have no associated netdev object (e.g. of type 3007 * NL80211_IFTYPE_P2P_DEVICE), emit the NEW_INTERFACE event here. 3008 * For all other types, the event will be generated from the 3009 * netdev notifier 3010 */ 3011 if (!wdev->netdev) 3012 nl80211_notify_iface(rdev, wdev, NL80211_CMD_NEW_INTERFACE); 3013 3014 return genlmsg_reply(msg, info); 3015 } 3016 3017 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info) 3018 { 3019 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3020 struct wireless_dev *wdev = info->user_ptr[1]; 3021 3022 if (!rdev->ops->del_virtual_intf) 3023 return -EOPNOTSUPP; 3024 3025 /* 3026 * If we remove a wireless device without a netdev then clear 3027 * user_ptr[1] so that nl80211_post_doit won't dereference it 3028 * to check if it needs to do dev_put(). Otherwise it crashes 3029 * since the wdev has been freed, unlike with a netdev where 3030 * we need the dev_put() for the netdev to really be freed. 3031 */ 3032 if (!wdev->netdev) 3033 info->user_ptr[1] = NULL; 3034 3035 return rdev_del_virtual_intf(rdev, wdev); 3036 } 3037 3038 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info) 3039 { 3040 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3041 struct net_device *dev = info->user_ptr[1]; 3042 u16 noack_map; 3043 3044 if (!info->attrs[NL80211_ATTR_NOACK_MAP]) 3045 return -EINVAL; 3046 3047 if (!rdev->ops->set_noack_map) 3048 return -EOPNOTSUPP; 3049 3050 noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]); 3051 3052 return rdev_set_noack_map(rdev, dev, noack_map); 3053 } 3054 3055 struct get_key_cookie { 3056 struct sk_buff *msg; 3057 int error; 3058 int idx; 3059 }; 3060 3061 static void get_key_callback(void *c, struct key_params *params) 3062 { 3063 struct nlattr *key; 3064 struct get_key_cookie *cookie = c; 3065 3066 if ((params->key && 3067 nla_put(cookie->msg, NL80211_ATTR_KEY_DATA, 3068 params->key_len, params->key)) || 3069 (params->seq && 3070 nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ, 3071 params->seq_len, params->seq)) || 3072 (params->cipher && 3073 nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER, 3074 params->cipher))) 3075 goto nla_put_failure; 3076 3077 key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY); 3078 if (!key) 3079 goto nla_put_failure; 3080 3081 if ((params->key && 3082 nla_put(cookie->msg, NL80211_KEY_DATA, 3083 params->key_len, params->key)) || 3084 (params->seq && 3085 nla_put(cookie->msg, NL80211_KEY_SEQ, 3086 params->seq_len, params->seq)) || 3087 (params->cipher && 3088 nla_put_u32(cookie->msg, NL80211_KEY_CIPHER, 3089 params->cipher))) 3090 goto nla_put_failure; 3091 3092 if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx)) 3093 goto nla_put_failure; 3094 3095 nla_nest_end(cookie->msg, key); 3096 3097 return; 3098 nla_put_failure: 3099 cookie->error = 1; 3100 } 3101 3102 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info) 3103 { 3104 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3105 int err; 3106 struct net_device *dev = info->user_ptr[1]; 3107 u8 key_idx = 0; 3108 const u8 *mac_addr = NULL; 3109 bool pairwise; 3110 struct get_key_cookie cookie = { 3111 .error = 0, 3112 }; 3113 void *hdr; 3114 struct sk_buff *msg; 3115 3116 if (info->attrs[NL80211_ATTR_KEY_IDX]) 3117 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]); 3118 3119 if (key_idx > 5) 3120 return -EINVAL; 3121 3122 if (info->attrs[NL80211_ATTR_MAC]) 3123 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 3124 3125 pairwise = !!mac_addr; 3126 if (info->attrs[NL80211_ATTR_KEY_TYPE]) { 3127 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]); 3128 3129 if (kt >= NUM_NL80211_KEYTYPES) 3130 return -EINVAL; 3131 if (kt != NL80211_KEYTYPE_GROUP && 3132 kt != NL80211_KEYTYPE_PAIRWISE) 3133 return -EINVAL; 3134 pairwise = kt == NL80211_KEYTYPE_PAIRWISE; 3135 } 3136 3137 if (!rdev->ops->get_key) 3138 return -EOPNOTSUPP; 3139 3140 if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)) 3141 return -ENOENT; 3142 3143 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 3144 if (!msg) 3145 return -ENOMEM; 3146 3147 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 3148 NL80211_CMD_NEW_KEY); 3149 if (!hdr) 3150 goto nla_put_failure; 3151 3152 cookie.msg = msg; 3153 cookie.idx = key_idx; 3154 3155 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 3156 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx)) 3157 goto nla_put_failure; 3158 if (mac_addr && 3159 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr)) 3160 goto nla_put_failure; 3161 3162 err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie, 3163 get_key_callback); 3164 3165 if (err) 3166 goto free_msg; 3167 3168 if (cookie.error) 3169 goto nla_put_failure; 3170 3171 genlmsg_end(msg, hdr); 3172 return genlmsg_reply(msg, info); 3173 3174 nla_put_failure: 3175 err = -ENOBUFS; 3176 free_msg: 3177 nlmsg_free(msg); 3178 return err; 3179 } 3180 3181 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info) 3182 { 3183 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3184 struct key_parse key; 3185 int err; 3186 struct net_device *dev = info->user_ptr[1]; 3187 3188 err = nl80211_parse_key(info, &key); 3189 if (err) 3190 return err; 3191 3192 if (key.idx < 0) 3193 return -EINVAL; 3194 3195 /* only support setting default key */ 3196 if (!key.def && !key.defmgmt) 3197 return -EINVAL; 3198 3199 wdev_lock(dev->ieee80211_ptr); 3200 3201 if (key.def) { 3202 if (!rdev->ops->set_default_key) { 3203 err = -EOPNOTSUPP; 3204 goto out; 3205 } 3206 3207 err = nl80211_key_allowed(dev->ieee80211_ptr); 3208 if (err) 3209 goto out; 3210 3211 err = rdev_set_default_key(rdev, dev, key.idx, 3212 key.def_uni, key.def_multi); 3213 3214 if (err) 3215 goto out; 3216 3217 #ifdef CONFIG_CFG80211_WEXT 3218 dev->ieee80211_ptr->wext.default_key = key.idx; 3219 #endif 3220 } else { 3221 if (key.def_uni || !key.def_multi) { 3222 err = -EINVAL; 3223 goto out; 3224 } 3225 3226 if (!rdev->ops->set_default_mgmt_key) { 3227 err = -EOPNOTSUPP; 3228 goto out; 3229 } 3230 3231 err = nl80211_key_allowed(dev->ieee80211_ptr); 3232 if (err) 3233 goto out; 3234 3235 err = rdev_set_default_mgmt_key(rdev, dev, key.idx); 3236 if (err) 3237 goto out; 3238 3239 #ifdef CONFIG_CFG80211_WEXT 3240 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx; 3241 #endif 3242 } 3243 3244 out: 3245 wdev_unlock(dev->ieee80211_ptr); 3246 3247 return err; 3248 } 3249 3250 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info) 3251 { 3252 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3253 int err; 3254 struct net_device *dev = info->user_ptr[1]; 3255 struct key_parse key; 3256 const u8 *mac_addr = NULL; 3257 3258 err = nl80211_parse_key(info, &key); 3259 if (err) 3260 return err; 3261 3262 if (!key.p.key) 3263 return -EINVAL; 3264 3265 if (info->attrs[NL80211_ATTR_MAC]) 3266 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 3267 3268 if (key.type == -1) { 3269 if (mac_addr) 3270 key.type = NL80211_KEYTYPE_PAIRWISE; 3271 else 3272 key.type = NL80211_KEYTYPE_GROUP; 3273 } 3274 3275 /* for now */ 3276 if (key.type != NL80211_KEYTYPE_PAIRWISE && 3277 key.type != NL80211_KEYTYPE_GROUP) 3278 return -EINVAL; 3279 3280 if (!rdev->ops->add_key) 3281 return -EOPNOTSUPP; 3282 3283 if (cfg80211_validate_key_settings(rdev, &key.p, key.idx, 3284 key.type == NL80211_KEYTYPE_PAIRWISE, 3285 mac_addr)) 3286 return -EINVAL; 3287 3288 wdev_lock(dev->ieee80211_ptr); 3289 err = nl80211_key_allowed(dev->ieee80211_ptr); 3290 if (!err) 3291 err = rdev_add_key(rdev, dev, key.idx, 3292 key.type == NL80211_KEYTYPE_PAIRWISE, 3293 mac_addr, &key.p); 3294 wdev_unlock(dev->ieee80211_ptr); 3295 3296 return err; 3297 } 3298 3299 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info) 3300 { 3301 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3302 int err; 3303 struct net_device *dev = info->user_ptr[1]; 3304 u8 *mac_addr = NULL; 3305 struct key_parse key; 3306 3307 err = nl80211_parse_key(info, &key); 3308 if (err) 3309 return err; 3310 3311 if (info->attrs[NL80211_ATTR_MAC]) 3312 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 3313 3314 if (key.type == -1) { 3315 if (mac_addr) 3316 key.type = NL80211_KEYTYPE_PAIRWISE; 3317 else 3318 key.type = NL80211_KEYTYPE_GROUP; 3319 } 3320 3321 /* for now */ 3322 if (key.type != NL80211_KEYTYPE_PAIRWISE && 3323 key.type != NL80211_KEYTYPE_GROUP) 3324 return -EINVAL; 3325 3326 if (!rdev->ops->del_key) 3327 return -EOPNOTSUPP; 3328 3329 wdev_lock(dev->ieee80211_ptr); 3330 err = nl80211_key_allowed(dev->ieee80211_ptr); 3331 3332 if (key.type == NL80211_KEYTYPE_GROUP && mac_addr && 3333 !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)) 3334 err = -ENOENT; 3335 3336 if (!err) 3337 err = rdev_del_key(rdev, dev, key.idx, 3338 key.type == NL80211_KEYTYPE_PAIRWISE, 3339 mac_addr); 3340 3341 #ifdef CONFIG_CFG80211_WEXT 3342 if (!err) { 3343 if (key.idx == dev->ieee80211_ptr->wext.default_key) 3344 dev->ieee80211_ptr->wext.default_key = -1; 3345 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key) 3346 dev->ieee80211_ptr->wext.default_mgmt_key = -1; 3347 } 3348 #endif 3349 wdev_unlock(dev->ieee80211_ptr); 3350 3351 return err; 3352 } 3353 3354 /* This function returns an error or the number of nested attributes */ 3355 static int validate_acl_mac_addrs(struct nlattr *nl_attr) 3356 { 3357 struct nlattr *attr; 3358 int n_entries = 0, tmp; 3359 3360 nla_for_each_nested(attr, nl_attr, tmp) { 3361 if (nla_len(attr) != ETH_ALEN) 3362 return -EINVAL; 3363 3364 n_entries++; 3365 } 3366 3367 return n_entries; 3368 } 3369 3370 /* 3371 * This function parses ACL information and allocates memory for ACL data. 3372 * On successful return, the calling function is responsible to free the 3373 * ACL buffer returned by this function. 3374 */ 3375 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy, 3376 struct genl_info *info) 3377 { 3378 enum nl80211_acl_policy acl_policy; 3379 struct nlattr *attr; 3380 struct cfg80211_acl_data *acl; 3381 int i = 0, n_entries, tmp; 3382 3383 if (!wiphy->max_acl_mac_addrs) 3384 return ERR_PTR(-EOPNOTSUPP); 3385 3386 if (!info->attrs[NL80211_ATTR_ACL_POLICY]) 3387 return ERR_PTR(-EINVAL); 3388 3389 acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]); 3390 if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED && 3391 acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED) 3392 return ERR_PTR(-EINVAL); 3393 3394 if (!info->attrs[NL80211_ATTR_MAC_ADDRS]) 3395 return ERR_PTR(-EINVAL); 3396 3397 n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]); 3398 if (n_entries < 0) 3399 return ERR_PTR(n_entries); 3400 3401 if (n_entries > wiphy->max_acl_mac_addrs) 3402 return ERR_PTR(-ENOTSUPP); 3403 3404 acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries), 3405 GFP_KERNEL); 3406 if (!acl) 3407 return ERR_PTR(-ENOMEM); 3408 3409 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) { 3410 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN); 3411 i++; 3412 } 3413 3414 acl->n_acl_entries = n_entries; 3415 acl->acl_policy = acl_policy; 3416 3417 return acl; 3418 } 3419 3420 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info) 3421 { 3422 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3423 struct net_device *dev = info->user_ptr[1]; 3424 struct cfg80211_acl_data *acl; 3425 int err; 3426 3427 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 3428 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 3429 return -EOPNOTSUPP; 3430 3431 if (!dev->ieee80211_ptr->beacon_interval) 3432 return -EINVAL; 3433 3434 acl = parse_acl_data(&rdev->wiphy, info); 3435 if (IS_ERR(acl)) 3436 return PTR_ERR(acl); 3437 3438 err = rdev_set_mac_acl(rdev, dev, acl); 3439 3440 kfree(acl); 3441 3442 return err; 3443 } 3444 3445 static u32 rateset_to_mask(struct ieee80211_supported_band *sband, 3446 u8 *rates, u8 rates_len) 3447 { 3448 u8 i; 3449 u32 mask = 0; 3450 3451 for (i = 0; i < rates_len; i++) { 3452 int rate = (rates[i] & 0x7f) * 5; 3453 int ridx; 3454 3455 for (ridx = 0; ridx < sband->n_bitrates; ridx++) { 3456 struct ieee80211_rate *srate = 3457 &sband->bitrates[ridx]; 3458 if (rate == srate->bitrate) { 3459 mask |= 1 << ridx; 3460 break; 3461 } 3462 } 3463 if (ridx == sband->n_bitrates) 3464 return 0; /* rate not found */ 3465 } 3466 3467 return mask; 3468 } 3469 3470 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband, 3471 u8 *rates, u8 rates_len, 3472 u8 mcs[IEEE80211_HT_MCS_MASK_LEN]) 3473 { 3474 u8 i; 3475 3476 memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN); 3477 3478 for (i = 0; i < rates_len; i++) { 3479 int ridx, rbit; 3480 3481 ridx = rates[i] / 8; 3482 rbit = BIT(rates[i] % 8); 3483 3484 /* check validity */ 3485 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN)) 3486 return false; 3487 3488 /* check availability */ 3489 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit) 3490 mcs[ridx] |= rbit; 3491 else 3492 return false; 3493 } 3494 3495 return true; 3496 } 3497 3498 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map) 3499 { 3500 u16 mcs_mask = 0; 3501 3502 switch (vht_mcs_map) { 3503 case IEEE80211_VHT_MCS_NOT_SUPPORTED: 3504 break; 3505 case IEEE80211_VHT_MCS_SUPPORT_0_7: 3506 mcs_mask = 0x00FF; 3507 break; 3508 case IEEE80211_VHT_MCS_SUPPORT_0_8: 3509 mcs_mask = 0x01FF; 3510 break; 3511 case IEEE80211_VHT_MCS_SUPPORT_0_9: 3512 mcs_mask = 0x03FF; 3513 break; 3514 default: 3515 break; 3516 } 3517 3518 return mcs_mask; 3519 } 3520 3521 static void vht_build_mcs_mask(u16 vht_mcs_map, 3522 u16 vht_mcs_mask[NL80211_VHT_NSS_MAX]) 3523 { 3524 u8 nss; 3525 3526 for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) { 3527 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03); 3528 vht_mcs_map >>= 2; 3529 } 3530 } 3531 3532 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband, 3533 struct nl80211_txrate_vht *txrate, 3534 u16 mcs[NL80211_VHT_NSS_MAX]) 3535 { 3536 u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map); 3537 u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {}; 3538 u8 i; 3539 3540 if (!sband->vht_cap.vht_supported) 3541 return false; 3542 3543 memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX); 3544 3545 /* Build vht_mcs_mask from VHT capabilities */ 3546 vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask); 3547 3548 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) { 3549 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i]) 3550 mcs[i] = txrate->mcs[i]; 3551 else 3552 return false; 3553 } 3554 3555 return true; 3556 } 3557 3558 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = { 3559 [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY, 3560 .len = NL80211_MAX_SUPP_RATES }, 3561 [NL80211_TXRATE_HT] = { .type = NLA_BINARY, 3562 .len = NL80211_MAX_SUPP_HT_RATES }, 3563 [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)}, 3564 [NL80211_TXRATE_GI] = { .type = NLA_U8 }, 3565 }; 3566 3567 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info, 3568 struct cfg80211_bitrate_mask *mask) 3569 { 3570 struct nlattr *tb[NL80211_TXRATE_MAX + 1]; 3571 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3572 int rem, i; 3573 struct nlattr *tx_rates; 3574 struct ieee80211_supported_band *sband; 3575 u16 vht_tx_mcs_map; 3576 3577 memset(mask, 0, sizeof(*mask)); 3578 /* Default to all rates enabled */ 3579 for (i = 0; i < NUM_NL80211_BANDS; i++) { 3580 sband = rdev->wiphy.bands[i]; 3581 3582 if (!sband) 3583 continue; 3584 3585 mask->control[i].legacy = (1 << sband->n_bitrates) - 1; 3586 memcpy(mask->control[i].ht_mcs, 3587 sband->ht_cap.mcs.rx_mask, 3588 sizeof(mask->control[i].ht_mcs)); 3589 3590 if (!sband->vht_cap.vht_supported) 3591 continue; 3592 3593 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map); 3594 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs); 3595 } 3596 3597 /* if no rates are given set it back to the defaults */ 3598 if (!info->attrs[NL80211_ATTR_TX_RATES]) 3599 goto out; 3600 3601 /* The nested attribute uses enum nl80211_band as the index. This maps 3602 * directly to the enum nl80211_band values used in cfg80211. 3603 */ 3604 BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8); 3605 nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) { 3606 enum nl80211_band band = nla_type(tx_rates); 3607 int err; 3608 3609 if (band < 0 || band >= NUM_NL80211_BANDS) 3610 return -EINVAL; 3611 sband = rdev->wiphy.bands[band]; 3612 if (sband == NULL) 3613 return -EINVAL; 3614 err = nla_parse_nested(tb, NL80211_TXRATE_MAX, tx_rates, 3615 nl80211_txattr_policy, info->extack); 3616 if (err) 3617 return err; 3618 if (tb[NL80211_TXRATE_LEGACY]) { 3619 mask->control[band].legacy = rateset_to_mask( 3620 sband, 3621 nla_data(tb[NL80211_TXRATE_LEGACY]), 3622 nla_len(tb[NL80211_TXRATE_LEGACY])); 3623 if ((mask->control[band].legacy == 0) && 3624 nla_len(tb[NL80211_TXRATE_LEGACY])) 3625 return -EINVAL; 3626 } 3627 if (tb[NL80211_TXRATE_HT]) { 3628 if (!ht_rateset_to_mask( 3629 sband, 3630 nla_data(tb[NL80211_TXRATE_HT]), 3631 nla_len(tb[NL80211_TXRATE_HT]), 3632 mask->control[band].ht_mcs)) 3633 return -EINVAL; 3634 } 3635 if (tb[NL80211_TXRATE_VHT]) { 3636 if (!vht_set_mcs_mask( 3637 sband, 3638 nla_data(tb[NL80211_TXRATE_VHT]), 3639 mask->control[band].vht_mcs)) 3640 return -EINVAL; 3641 } 3642 if (tb[NL80211_TXRATE_GI]) { 3643 mask->control[band].gi = 3644 nla_get_u8(tb[NL80211_TXRATE_GI]); 3645 if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI) 3646 return -EINVAL; 3647 } 3648 3649 if (mask->control[band].legacy == 0) { 3650 /* don't allow empty legacy rates if HT or VHT 3651 * are not even supported. 3652 */ 3653 if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported || 3654 rdev->wiphy.bands[band]->vht_cap.vht_supported)) 3655 return -EINVAL; 3656 3657 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) 3658 if (mask->control[band].ht_mcs[i]) 3659 goto out; 3660 3661 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) 3662 if (mask->control[band].vht_mcs[i]) 3663 goto out; 3664 3665 /* legacy and mcs rates may not be both empty */ 3666 return -EINVAL; 3667 } 3668 } 3669 3670 out: 3671 return 0; 3672 } 3673 3674 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev, 3675 enum nl80211_band band, 3676 struct cfg80211_bitrate_mask *beacon_rate) 3677 { 3678 u32 count_ht, count_vht, i; 3679 u32 rate = beacon_rate->control[band].legacy; 3680 3681 /* Allow only one rate */ 3682 if (hweight32(rate) > 1) 3683 return -EINVAL; 3684 3685 count_ht = 0; 3686 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) { 3687 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) { 3688 return -EINVAL; 3689 } else if (beacon_rate->control[band].ht_mcs[i]) { 3690 count_ht++; 3691 if (count_ht > 1) 3692 return -EINVAL; 3693 } 3694 if (count_ht && rate) 3695 return -EINVAL; 3696 } 3697 3698 count_vht = 0; 3699 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) { 3700 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) { 3701 return -EINVAL; 3702 } else if (beacon_rate->control[band].vht_mcs[i]) { 3703 count_vht++; 3704 if (count_vht > 1) 3705 return -EINVAL; 3706 } 3707 if (count_vht && rate) 3708 return -EINVAL; 3709 } 3710 3711 if ((count_ht && count_vht) || (!rate && !count_ht && !count_vht)) 3712 return -EINVAL; 3713 3714 if (rate && 3715 !wiphy_ext_feature_isset(&rdev->wiphy, 3716 NL80211_EXT_FEATURE_BEACON_RATE_LEGACY)) 3717 return -EINVAL; 3718 if (count_ht && 3719 !wiphy_ext_feature_isset(&rdev->wiphy, 3720 NL80211_EXT_FEATURE_BEACON_RATE_HT)) 3721 return -EINVAL; 3722 if (count_vht && 3723 !wiphy_ext_feature_isset(&rdev->wiphy, 3724 NL80211_EXT_FEATURE_BEACON_RATE_VHT)) 3725 return -EINVAL; 3726 3727 return 0; 3728 } 3729 3730 static int nl80211_parse_beacon(struct nlattr *attrs[], 3731 struct cfg80211_beacon_data *bcn) 3732 { 3733 bool haveinfo = false; 3734 3735 if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) || 3736 !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) || 3737 !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) || 3738 !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP])) 3739 return -EINVAL; 3740 3741 memset(bcn, 0, sizeof(*bcn)); 3742 3743 if (attrs[NL80211_ATTR_BEACON_HEAD]) { 3744 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]); 3745 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]); 3746 if (!bcn->head_len) 3747 return -EINVAL; 3748 haveinfo = true; 3749 } 3750 3751 if (attrs[NL80211_ATTR_BEACON_TAIL]) { 3752 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]); 3753 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]); 3754 haveinfo = true; 3755 } 3756 3757 if (!haveinfo) 3758 return -EINVAL; 3759 3760 if (attrs[NL80211_ATTR_IE]) { 3761 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]); 3762 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]); 3763 } 3764 3765 if (attrs[NL80211_ATTR_IE_PROBE_RESP]) { 3766 bcn->proberesp_ies = 3767 nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]); 3768 bcn->proberesp_ies_len = 3769 nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]); 3770 } 3771 3772 if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) { 3773 bcn->assocresp_ies = 3774 nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]); 3775 bcn->assocresp_ies_len = 3776 nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]); 3777 } 3778 3779 if (attrs[NL80211_ATTR_PROBE_RESP]) { 3780 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]); 3781 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]); 3782 } 3783 3784 return 0; 3785 } 3786 3787 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params, 3788 const u8 *rates) 3789 { 3790 int i; 3791 3792 if (!rates) 3793 return; 3794 3795 for (i = 0; i < rates[1]; i++) { 3796 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY) 3797 params->ht_required = true; 3798 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY) 3799 params->vht_required = true; 3800 } 3801 } 3802 3803 /* 3804 * Since the nl80211 API didn't include, from the beginning, attributes about 3805 * HT/VHT requirements/capabilities, we parse them out of the IEs for the 3806 * benefit of drivers that rebuild IEs in the firmware. 3807 */ 3808 static void nl80211_calculate_ap_params(struct cfg80211_ap_settings *params) 3809 { 3810 const struct cfg80211_beacon_data *bcn = ¶ms->beacon; 3811 size_t ies_len = bcn->tail_len; 3812 const u8 *ies = bcn->tail; 3813 const u8 *rates; 3814 const u8 *cap; 3815 3816 rates = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies, ies_len); 3817 nl80211_check_ap_rate_selectors(params, rates); 3818 3819 rates = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, ies, ies_len); 3820 nl80211_check_ap_rate_selectors(params, rates); 3821 3822 cap = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies, ies_len); 3823 if (cap && cap[1] >= sizeof(*params->ht_cap)) 3824 params->ht_cap = (void *)(cap + 2); 3825 cap = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, ies, ies_len); 3826 if (cap && cap[1] >= sizeof(*params->vht_cap)) 3827 params->vht_cap = (void *)(cap + 2); 3828 } 3829 3830 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev, 3831 struct cfg80211_ap_settings *params) 3832 { 3833 struct wireless_dev *wdev; 3834 bool ret = false; 3835 3836 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { 3837 if (wdev->iftype != NL80211_IFTYPE_AP && 3838 wdev->iftype != NL80211_IFTYPE_P2P_GO) 3839 continue; 3840 3841 if (!wdev->preset_chandef.chan) 3842 continue; 3843 3844 params->chandef = wdev->preset_chandef; 3845 ret = true; 3846 break; 3847 } 3848 3849 return ret; 3850 } 3851 3852 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev, 3853 enum nl80211_auth_type auth_type, 3854 enum nl80211_commands cmd) 3855 { 3856 if (auth_type > NL80211_AUTHTYPE_MAX) 3857 return false; 3858 3859 switch (cmd) { 3860 case NL80211_CMD_AUTHENTICATE: 3861 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) && 3862 auth_type == NL80211_AUTHTYPE_SAE) 3863 return false; 3864 if (!wiphy_ext_feature_isset(&rdev->wiphy, 3865 NL80211_EXT_FEATURE_FILS_STA) && 3866 (auth_type == NL80211_AUTHTYPE_FILS_SK || 3867 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 3868 auth_type == NL80211_AUTHTYPE_FILS_PK)) 3869 return false; 3870 return true; 3871 case NL80211_CMD_CONNECT: 3872 /* SAE not supported yet */ 3873 if (auth_type == NL80211_AUTHTYPE_SAE) 3874 return false; 3875 /* FILS with SK PFS or PK not supported yet */ 3876 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 3877 auth_type == NL80211_AUTHTYPE_FILS_PK) 3878 return false; 3879 if (!wiphy_ext_feature_isset( 3880 &rdev->wiphy, 3881 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) && 3882 auth_type == NL80211_AUTHTYPE_FILS_SK) 3883 return false; 3884 return true; 3885 case NL80211_CMD_START_AP: 3886 /* SAE not supported yet */ 3887 if (auth_type == NL80211_AUTHTYPE_SAE) 3888 return false; 3889 /* FILS not supported yet */ 3890 if (auth_type == NL80211_AUTHTYPE_FILS_SK || 3891 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 3892 auth_type == NL80211_AUTHTYPE_FILS_PK) 3893 return false; 3894 return true; 3895 default: 3896 return false; 3897 } 3898 } 3899 3900 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info) 3901 { 3902 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3903 struct net_device *dev = info->user_ptr[1]; 3904 struct wireless_dev *wdev = dev->ieee80211_ptr; 3905 struct cfg80211_ap_settings params; 3906 int err; 3907 3908 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 3909 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 3910 return -EOPNOTSUPP; 3911 3912 if (!rdev->ops->start_ap) 3913 return -EOPNOTSUPP; 3914 3915 if (wdev->beacon_interval) 3916 return -EALREADY; 3917 3918 memset(¶ms, 0, sizeof(params)); 3919 3920 /* these are required for START_AP */ 3921 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] || 3922 !info->attrs[NL80211_ATTR_DTIM_PERIOD] || 3923 !info->attrs[NL80211_ATTR_BEACON_HEAD]) 3924 return -EINVAL; 3925 3926 err = nl80211_parse_beacon(info->attrs, ¶ms.beacon); 3927 if (err) 3928 return err; 3929 3930 params.beacon_interval = 3931 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]); 3932 params.dtim_period = 3933 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]); 3934 3935 err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype, 3936 params.beacon_interval); 3937 if (err) 3938 return err; 3939 3940 /* 3941 * In theory, some of these attributes should be required here 3942 * but since they were not used when the command was originally 3943 * added, keep them optional for old user space programs to let 3944 * them continue to work with drivers that do not need the 3945 * additional information -- drivers must check! 3946 */ 3947 if (info->attrs[NL80211_ATTR_SSID]) { 3948 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 3949 params.ssid_len = 3950 nla_len(info->attrs[NL80211_ATTR_SSID]); 3951 if (params.ssid_len == 0 || 3952 params.ssid_len > IEEE80211_MAX_SSID_LEN) 3953 return -EINVAL; 3954 } 3955 3956 if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) { 3957 params.hidden_ssid = nla_get_u32( 3958 info->attrs[NL80211_ATTR_HIDDEN_SSID]); 3959 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE && 3960 params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN && 3961 params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS) 3962 return -EINVAL; 3963 } 3964 3965 params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY]; 3966 3967 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) { 3968 params.auth_type = nla_get_u32( 3969 info->attrs[NL80211_ATTR_AUTH_TYPE]); 3970 if (!nl80211_valid_auth_type(rdev, params.auth_type, 3971 NL80211_CMD_START_AP)) 3972 return -EINVAL; 3973 } else 3974 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC; 3975 3976 err = nl80211_crypto_settings(rdev, info, ¶ms.crypto, 3977 NL80211_MAX_NR_CIPHER_SUITES); 3978 if (err) 3979 return err; 3980 3981 if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) { 3982 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER)) 3983 return -EOPNOTSUPP; 3984 params.inactivity_timeout = nla_get_u16( 3985 info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]); 3986 } 3987 3988 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) { 3989 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 3990 return -EINVAL; 3991 params.p2p_ctwindow = 3992 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]); 3993 if (params.p2p_ctwindow > 127) 3994 return -EINVAL; 3995 if (params.p2p_ctwindow != 0 && 3996 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) 3997 return -EINVAL; 3998 } 3999 4000 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) { 4001 u8 tmp; 4002 4003 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 4004 return -EINVAL; 4005 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]); 4006 if (tmp > 1) 4007 return -EINVAL; 4008 params.p2p_opp_ps = tmp; 4009 if (params.p2p_opp_ps != 0 && 4010 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) 4011 return -EINVAL; 4012 } 4013 4014 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 4015 err = nl80211_parse_chandef(rdev, info, ¶ms.chandef); 4016 if (err) 4017 return err; 4018 } else if (wdev->preset_chandef.chan) { 4019 params.chandef = wdev->preset_chandef; 4020 } else if (!nl80211_get_ap_channel(rdev, ¶ms)) 4021 return -EINVAL; 4022 4023 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms.chandef, 4024 wdev->iftype)) 4025 return -EINVAL; 4026 4027 if (info->attrs[NL80211_ATTR_TX_RATES]) { 4028 err = nl80211_parse_tx_bitrate_mask(info, ¶ms.beacon_rate); 4029 if (err) 4030 return err; 4031 4032 err = validate_beacon_tx_rate(rdev, params.chandef.chan->band, 4033 ¶ms.beacon_rate); 4034 if (err) 4035 return err; 4036 } 4037 4038 if (info->attrs[NL80211_ATTR_SMPS_MODE]) { 4039 params.smps_mode = 4040 nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]); 4041 switch (params.smps_mode) { 4042 case NL80211_SMPS_OFF: 4043 break; 4044 case NL80211_SMPS_STATIC: 4045 if (!(rdev->wiphy.features & 4046 NL80211_FEATURE_STATIC_SMPS)) 4047 return -EINVAL; 4048 break; 4049 case NL80211_SMPS_DYNAMIC: 4050 if (!(rdev->wiphy.features & 4051 NL80211_FEATURE_DYNAMIC_SMPS)) 4052 return -EINVAL; 4053 break; 4054 default: 4055 return -EINVAL; 4056 } 4057 } else { 4058 params.smps_mode = NL80211_SMPS_OFF; 4059 } 4060 4061 params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]); 4062 if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) 4063 return -EOPNOTSUPP; 4064 4065 if (info->attrs[NL80211_ATTR_ACL_POLICY]) { 4066 params.acl = parse_acl_data(&rdev->wiphy, info); 4067 if (IS_ERR(params.acl)) 4068 return PTR_ERR(params.acl); 4069 } 4070 4071 nl80211_calculate_ap_params(¶ms); 4072 4073 wdev_lock(wdev); 4074 err = rdev_start_ap(rdev, dev, ¶ms); 4075 if (!err) { 4076 wdev->preset_chandef = params.chandef; 4077 wdev->beacon_interval = params.beacon_interval; 4078 wdev->chandef = params.chandef; 4079 wdev->ssid_len = params.ssid_len; 4080 memcpy(wdev->ssid, params.ssid, wdev->ssid_len); 4081 } 4082 wdev_unlock(wdev); 4083 4084 kfree(params.acl); 4085 4086 return err; 4087 } 4088 4089 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info) 4090 { 4091 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4092 struct net_device *dev = info->user_ptr[1]; 4093 struct wireless_dev *wdev = dev->ieee80211_ptr; 4094 struct cfg80211_beacon_data params; 4095 int err; 4096 4097 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 4098 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 4099 return -EOPNOTSUPP; 4100 4101 if (!rdev->ops->change_beacon) 4102 return -EOPNOTSUPP; 4103 4104 if (!wdev->beacon_interval) 4105 return -EINVAL; 4106 4107 err = nl80211_parse_beacon(info->attrs, ¶ms); 4108 if (err) 4109 return err; 4110 4111 wdev_lock(wdev); 4112 err = rdev_change_beacon(rdev, dev, ¶ms); 4113 wdev_unlock(wdev); 4114 4115 return err; 4116 } 4117 4118 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info) 4119 { 4120 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4121 struct net_device *dev = info->user_ptr[1]; 4122 4123 return cfg80211_stop_ap(rdev, dev, false); 4124 } 4125 4126 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = { 4127 [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG }, 4128 [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG }, 4129 [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG }, 4130 [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG }, 4131 [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG }, 4132 [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG }, 4133 }; 4134 4135 static int parse_station_flags(struct genl_info *info, 4136 enum nl80211_iftype iftype, 4137 struct station_parameters *params) 4138 { 4139 struct nlattr *flags[NL80211_STA_FLAG_MAX + 1]; 4140 struct nlattr *nla; 4141 int flag; 4142 4143 /* 4144 * Try parsing the new attribute first so userspace 4145 * can specify both for older kernels. 4146 */ 4147 nla = info->attrs[NL80211_ATTR_STA_FLAGS2]; 4148 if (nla) { 4149 struct nl80211_sta_flag_update *sta_flags; 4150 4151 sta_flags = nla_data(nla); 4152 params->sta_flags_mask = sta_flags->mask; 4153 params->sta_flags_set = sta_flags->set; 4154 params->sta_flags_set &= params->sta_flags_mask; 4155 if ((params->sta_flags_mask | 4156 params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID)) 4157 return -EINVAL; 4158 return 0; 4159 } 4160 4161 /* if present, parse the old attribute */ 4162 4163 nla = info->attrs[NL80211_ATTR_STA_FLAGS]; 4164 if (!nla) 4165 return 0; 4166 4167 if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX, nla, 4168 sta_flags_policy, info->extack)) 4169 return -EINVAL; 4170 4171 /* 4172 * Only allow certain flags for interface types so that 4173 * other attributes are silently ignored. Remember that 4174 * this is backward compatibility code with old userspace 4175 * and shouldn't be hit in other cases anyway. 4176 */ 4177 switch (iftype) { 4178 case NL80211_IFTYPE_AP: 4179 case NL80211_IFTYPE_AP_VLAN: 4180 case NL80211_IFTYPE_P2P_GO: 4181 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) | 4182 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) | 4183 BIT(NL80211_STA_FLAG_WME) | 4184 BIT(NL80211_STA_FLAG_MFP); 4185 break; 4186 case NL80211_IFTYPE_P2P_CLIENT: 4187 case NL80211_IFTYPE_STATION: 4188 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) | 4189 BIT(NL80211_STA_FLAG_TDLS_PEER); 4190 break; 4191 case NL80211_IFTYPE_MESH_POINT: 4192 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) | 4193 BIT(NL80211_STA_FLAG_MFP) | 4194 BIT(NL80211_STA_FLAG_AUTHORIZED); 4195 default: 4196 return -EINVAL; 4197 } 4198 4199 for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) { 4200 if (flags[flag]) { 4201 params->sta_flags_set |= (1<<flag); 4202 4203 /* no longer support new API additions in old API */ 4204 if (flag > NL80211_STA_FLAG_MAX_OLD_API) 4205 return -EINVAL; 4206 } 4207 } 4208 4209 return 0; 4210 } 4211 4212 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, 4213 int attr) 4214 { 4215 struct nlattr *rate; 4216 u32 bitrate; 4217 u16 bitrate_compat; 4218 enum nl80211_rate_info rate_flg; 4219 4220 rate = nla_nest_start(msg, attr); 4221 if (!rate) 4222 return false; 4223 4224 /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */ 4225 bitrate = cfg80211_calculate_bitrate(info); 4226 /* report 16-bit bitrate only if we can */ 4227 bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0; 4228 if (bitrate > 0 && 4229 nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate)) 4230 return false; 4231 if (bitrate_compat > 0 && 4232 nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat)) 4233 return false; 4234 4235 switch (info->bw) { 4236 case RATE_INFO_BW_5: 4237 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH; 4238 break; 4239 case RATE_INFO_BW_10: 4240 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH; 4241 break; 4242 default: 4243 WARN_ON(1); 4244 /* fall through */ 4245 case RATE_INFO_BW_20: 4246 rate_flg = 0; 4247 break; 4248 case RATE_INFO_BW_40: 4249 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH; 4250 break; 4251 case RATE_INFO_BW_80: 4252 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH; 4253 break; 4254 case RATE_INFO_BW_160: 4255 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH; 4256 break; 4257 } 4258 4259 if (rate_flg && nla_put_flag(msg, rate_flg)) 4260 return false; 4261 4262 if (info->flags & RATE_INFO_FLAGS_MCS) { 4263 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs)) 4264 return false; 4265 if (info->flags & RATE_INFO_FLAGS_SHORT_GI && 4266 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI)) 4267 return false; 4268 } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) { 4269 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs)) 4270 return false; 4271 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss)) 4272 return false; 4273 if (info->flags & RATE_INFO_FLAGS_SHORT_GI && 4274 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI)) 4275 return false; 4276 } 4277 4278 nla_nest_end(msg, rate); 4279 return true; 4280 } 4281 4282 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal, 4283 int id) 4284 { 4285 void *attr; 4286 int i = 0; 4287 4288 if (!mask) 4289 return true; 4290 4291 attr = nla_nest_start(msg, id); 4292 if (!attr) 4293 return false; 4294 4295 for (i = 0; i < IEEE80211_MAX_CHAINS; i++) { 4296 if (!(mask & BIT(i))) 4297 continue; 4298 4299 if (nla_put_u8(msg, i, signal[i])) 4300 return false; 4301 } 4302 4303 nla_nest_end(msg, attr); 4304 4305 return true; 4306 } 4307 4308 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid, 4309 u32 seq, int flags, 4310 struct cfg80211_registered_device *rdev, 4311 struct net_device *dev, 4312 const u8 *mac_addr, struct station_info *sinfo) 4313 { 4314 void *hdr; 4315 struct nlattr *sinfoattr, *bss_param; 4316 4317 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 4318 if (!hdr) 4319 return -1; 4320 4321 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 4322 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) || 4323 nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation)) 4324 goto nla_put_failure; 4325 4326 sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO); 4327 if (!sinfoattr) 4328 goto nla_put_failure; 4329 4330 #define PUT_SINFO(attr, memb, type) do { \ 4331 BUILD_BUG_ON(sizeof(type) == sizeof(u64)); \ 4332 if (sinfo->filled & (1ULL << NL80211_STA_INFO_ ## attr) && \ 4333 nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr, \ 4334 sinfo->memb)) \ 4335 goto nla_put_failure; \ 4336 } while (0) 4337 #define PUT_SINFO_U64(attr, memb) do { \ 4338 if (sinfo->filled & (1ULL << NL80211_STA_INFO_ ## attr) && \ 4339 nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr, \ 4340 sinfo->memb, NL80211_STA_INFO_PAD)) \ 4341 goto nla_put_failure; \ 4342 } while (0) 4343 4344 PUT_SINFO(CONNECTED_TIME, connected_time, u32); 4345 PUT_SINFO(INACTIVE_TIME, inactive_time, u32); 4346 4347 if (sinfo->filled & (BIT(NL80211_STA_INFO_RX_BYTES) | 4348 BIT(NL80211_STA_INFO_RX_BYTES64)) && 4349 nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES, 4350 (u32)sinfo->rx_bytes)) 4351 goto nla_put_failure; 4352 4353 if (sinfo->filled & (BIT(NL80211_STA_INFO_TX_BYTES) | 4354 BIT(NL80211_STA_INFO_TX_BYTES64)) && 4355 nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES, 4356 (u32)sinfo->tx_bytes)) 4357 goto nla_put_failure; 4358 4359 PUT_SINFO_U64(RX_BYTES64, rx_bytes); 4360 PUT_SINFO_U64(TX_BYTES64, tx_bytes); 4361 PUT_SINFO(LLID, llid, u16); 4362 PUT_SINFO(PLID, plid, u16); 4363 PUT_SINFO(PLINK_STATE, plink_state, u8); 4364 PUT_SINFO_U64(RX_DURATION, rx_duration); 4365 4366 switch (rdev->wiphy.signal_type) { 4367 case CFG80211_SIGNAL_TYPE_MBM: 4368 PUT_SINFO(SIGNAL, signal, u8); 4369 PUT_SINFO(SIGNAL_AVG, signal_avg, u8); 4370 break; 4371 default: 4372 break; 4373 } 4374 if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL)) { 4375 if (!nl80211_put_signal(msg, sinfo->chains, 4376 sinfo->chain_signal, 4377 NL80211_STA_INFO_CHAIN_SIGNAL)) 4378 goto nla_put_failure; 4379 } 4380 if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) { 4381 if (!nl80211_put_signal(msg, sinfo->chains, 4382 sinfo->chain_signal_avg, 4383 NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) 4384 goto nla_put_failure; 4385 } 4386 if (sinfo->filled & BIT(NL80211_STA_INFO_TX_BITRATE)) { 4387 if (!nl80211_put_sta_rate(msg, &sinfo->txrate, 4388 NL80211_STA_INFO_TX_BITRATE)) 4389 goto nla_put_failure; 4390 } 4391 if (sinfo->filled & BIT(NL80211_STA_INFO_RX_BITRATE)) { 4392 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate, 4393 NL80211_STA_INFO_RX_BITRATE)) 4394 goto nla_put_failure; 4395 } 4396 4397 PUT_SINFO(RX_PACKETS, rx_packets, u32); 4398 PUT_SINFO(TX_PACKETS, tx_packets, u32); 4399 PUT_SINFO(TX_RETRIES, tx_retries, u32); 4400 PUT_SINFO(TX_FAILED, tx_failed, u32); 4401 PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32); 4402 PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32); 4403 PUT_SINFO(LOCAL_PM, local_pm, u32); 4404 PUT_SINFO(PEER_PM, peer_pm, u32); 4405 PUT_SINFO(NONPEER_PM, nonpeer_pm, u32); 4406 4407 if (sinfo->filled & BIT(NL80211_STA_INFO_BSS_PARAM)) { 4408 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM); 4409 if (!bss_param) 4410 goto nla_put_failure; 4411 4412 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) && 4413 nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) || 4414 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) && 4415 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) || 4416 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) && 4417 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) || 4418 nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD, 4419 sinfo->bss_param.dtim_period) || 4420 nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL, 4421 sinfo->bss_param.beacon_interval)) 4422 goto nla_put_failure; 4423 4424 nla_nest_end(msg, bss_param); 4425 } 4426 if ((sinfo->filled & BIT(NL80211_STA_INFO_STA_FLAGS)) && 4427 nla_put(msg, NL80211_STA_INFO_STA_FLAGS, 4428 sizeof(struct nl80211_sta_flag_update), 4429 &sinfo->sta_flags)) 4430 goto nla_put_failure; 4431 4432 PUT_SINFO_U64(T_OFFSET, t_offset); 4433 PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc); 4434 PUT_SINFO_U64(BEACON_RX, rx_beacon); 4435 PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8); 4436 4437 #undef PUT_SINFO 4438 #undef PUT_SINFO_U64 4439 4440 if (sinfo->filled & BIT(NL80211_STA_INFO_TID_STATS)) { 4441 struct nlattr *tidsattr; 4442 int tid; 4443 4444 tidsattr = nla_nest_start(msg, NL80211_STA_INFO_TID_STATS); 4445 if (!tidsattr) 4446 goto nla_put_failure; 4447 4448 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) { 4449 struct cfg80211_tid_stats *tidstats; 4450 struct nlattr *tidattr; 4451 4452 tidstats = &sinfo->pertid[tid]; 4453 4454 if (!tidstats->filled) 4455 continue; 4456 4457 tidattr = nla_nest_start(msg, tid + 1); 4458 if (!tidattr) 4459 goto nla_put_failure; 4460 4461 #define PUT_TIDVAL_U64(attr, memb) do { \ 4462 if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) && \ 4463 nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr, \ 4464 tidstats->memb, NL80211_TID_STATS_PAD)) \ 4465 goto nla_put_failure; \ 4466 } while (0) 4467 4468 PUT_TIDVAL_U64(RX_MSDU, rx_msdu); 4469 PUT_TIDVAL_U64(TX_MSDU, tx_msdu); 4470 PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries); 4471 PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed); 4472 4473 #undef PUT_TIDVAL_U64 4474 nla_nest_end(msg, tidattr); 4475 } 4476 4477 nla_nest_end(msg, tidsattr); 4478 } 4479 4480 nla_nest_end(msg, sinfoattr); 4481 4482 if (sinfo->assoc_req_ies_len && 4483 nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len, 4484 sinfo->assoc_req_ies)) 4485 goto nla_put_failure; 4486 4487 genlmsg_end(msg, hdr); 4488 return 0; 4489 4490 nla_put_failure: 4491 genlmsg_cancel(msg, hdr); 4492 return -EMSGSIZE; 4493 } 4494 4495 static int nl80211_dump_station(struct sk_buff *skb, 4496 struct netlink_callback *cb) 4497 { 4498 struct station_info sinfo; 4499 struct cfg80211_registered_device *rdev; 4500 struct wireless_dev *wdev; 4501 u8 mac_addr[ETH_ALEN]; 4502 int sta_idx = cb->args[2]; 4503 int err; 4504 4505 rtnl_lock(); 4506 err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev); 4507 if (err) 4508 goto out_err; 4509 4510 if (!wdev->netdev) { 4511 err = -EINVAL; 4512 goto out_err; 4513 } 4514 4515 if (!rdev->ops->dump_station) { 4516 err = -EOPNOTSUPP; 4517 goto out_err; 4518 } 4519 4520 while (1) { 4521 memset(&sinfo, 0, sizeof(sinfo)); 4522 err = rdev_dump_station(rdev, wdev->netdev, sta_idx, 4523 mac_addr, &sinfo); 4524 if (err == -ENOENT) 4525 break; 4526 if (err) 4527 goto out_err; 4528 4529 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION, 4530 NETLINK_CB(cb->skb).portid, 4531 cb->nlh->nlmsg_seq, NLM_F_MULTI, 4532 rdev, wdev->netdev, mac_addr, 4533 &sinfo) < 0) 4534 goto out; 4535 4536 sta_idx++; 4537 } 4538 4539 out: 4540 cb->args[2] = sta_idx; 4541 err = skb->len; 4542 out_err: 4543 rtnl_unlock(); 4544 4545 return err; 4546 } 4547 4548 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info) 4549 { 4550 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4551 struct net_device *dev = info->user_ptr[1]; 4552 struct station_info sinfo; 4553 struct sk_buff *msg; 4554 u8 *mac_addr = NULL; 4555 int err; 4556 4557 memset(&sinfo, 0, sizeof(sinfo)); 4558 4559 if (!info->attrs[NL80211_ATTR_MAC]) 4560 return -EINVAL; 4561 4562 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 4563 4564 if (!rdev->ops->get_station) 4565 return -EOPNOTSUPP; 4566 4567 err = rdev_get_station(rdev, dev, mac_addr, &sinfo); 4568 if (err) 4569 return err; 4570 4571 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 4572 if (!msg) 4573 return -ENOMEM; 4574 4575 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 4576 info->snd_portid, info->snd_seq, 0, 4577 rdev, dev, mac_addr, &sinfo) < 0) { 4578 nlmsg_free(msg); 4579 return -ENOBUFS; 4580 } 4581 4582 return genlmsg_reply(msg, info); 4583 } 4584 4585 int cfg80211_check_station_change(struct wiphy *wiphy, 4586 struct station_parameters *params, 4587 enum cfg80211_station_type statype) 4588 { 4589 if (params->listen_interval != -1 && 4590 statype != CFG80211_STA_AP_CLIENT_UNASSOC) 4591 return -EINVAL; 4592 4593 if (params->support_p2p_ps != -1 && 4594 statype != CFG80211_STA_AP_CLIENT_UNASSOC) 4595 return -EINVAL; 4596 4597 if (params->aid && 4598 !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) && 4599 statype != CFG80211_STA_AP_CLIENT_UNASSOC) 4600 return -EINVAL; 4601 4602 /* When you run into this, adjust the code below for the new flag */ 4603 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7); 4604 4605 switch (statype) { 4606 case CFG80211_STA_MESH_PEER_KERNEL: 4607 case CFG80211_STA_MESH_PEER_USER: 4608 /* 4609 * No ignoring the TDLS flag here -- the userspace mesh 4610 * code doesn't have the bug of including TDLS in the 4611 * mask everywhere. 4612 */ 4613 if (params->sta_flags_mask & 4614 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) | 4615 BIT(NL80211_STA_FLAG_MFP) | 4616 BIT(NL80211_STA_FLAG_AUTHORIZED))) 4617 return -EINVAL; 4618 break; 4619 case CFG80211_STA_TDLS_PEER_SETUP: 4620 case CFG80211_STA_TDLS_PEER_ACTIVE: 4621 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))) 4622 return -EINVAL; 4623 /* ignore since it can't change */ 4624 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER); 4625 break; 4626 default: 4627 /* disallow mesh-specific things */ 4628 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION) 4629 return -EINVAL; 4630 if (params->local_pm) 4631 return -EINVAL; 4632 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE) 4633 return -EINVAL; 4634 } 4635 4636 if (statype != CFG80211_STA_TDLS_PEER_SETUP && 4637 statype != CFG80211_STA_TDLS_PEER_ACTIVE) { 4638 /* TDLS can't be set, ... */ 4639 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) 4640 return -EINVAL; 4641 /* 4642 * ... but don't bother the driver with it. This works around 4643 * a hostapd/wpa_supplicant issue -- it always includes the 4644 * TLDS_PEER flag in the mask even for AP mode. 4645 */ 4646 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER); 4647 } 4648 4649 if (statype != CFG80211_STA_TDLS_PEER_SETUP && 4650 statype != CFG80211_STA_AP_CLIENT_UNASSOC) { 4651 /* reject other things that can't change */ 4652 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD) 4653 return -EINVAL; 4654 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY) 4655 return -EINVAL; 4656 if (params->supported_rates) 4657 return -EINVAL; 4658 if (params->ext_capab || params->ht_capa || params->vht_capa) 4659 return -EINVAL; 4660 } 4661 4662 if (statype != CFG80211_STA_AP_CLIENT && 4663 statype != CFG80211_STA_AP_CLIENT_UNASSOC) { 4664 if (params->vlan) 4665 return -EINVAL; 4666 } 4667 4668 switch (statype) { 4669 case CFG80211_STA_AP_MLME_CLIENT: 4670 /* Use this only for authorizing/unauthorizing a station */ 4671 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED))) 4672 return -EOPNOTSUPP; 4673 break; 4674 case CFG80211_STA_AP_CLIENT: 4675 case CFG80211_STA_AP_CLIENT_UNASSOC: 4676 /* accept only the listed bits */ 4677 if (params->sta_flags_mask & 4678 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) | 4679 BIT(NL80211_STA_FLAG_AUTHENTICATED) | 4680 BIT(NL80211_STA_FLAG_ASSOCIATED) | 4681 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) | 4682 BIT(NL80211_STA_FLAG_WME) | 4683 BIT(NL80211_STA_FLAG_MFP))) 4684 return -EINVAL; 4685 4686 /* but authenticated/associated only if driver handles it */ 4687 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) && 4688 params->sta_flags_mask & 4689 (BIT(NL80211_STA_FLAG_AUTHENTICATED) | 4690 BIT(NL80211_STA_FLAG_ASSOCIATED))) 4691 return -EINVAL; 4692 break; 4693 case CFG80211_STA_IBSS: 4694 case CFG80211_STA_AP_STA: 4695 /* reject any changes other than AUTHORIZED */ 4696 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED)) 4697 return -EINVAL; 4698 break; 4699 case CFG80211_STA_TDLS_PEER_SETUP: 4700 /* reject any changes other than AUTHORIZED or WME */ 4701 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) | 4702 BIT(NL80211_STA_FLAG_WME))) 4703 return -EINVAL; 4704 /* force (at least) rates when authorizing */ 4705 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) && 4706 !params->supported_rates) 4707 return -EINVAL; 4708 break; 4709 case CFG80211_STA_TDLS_PEER_ACTIVE: 4710 /* reject any changes */ 4711 return -EINVAL; 4712 case CFG80211_STA_MESH_PEER_KERNEL: 4713 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE) 4714 return -EINVAL; 4715 break; 4716 case CFG80211_STA_MESH_PEER_USER: 4717 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION && 4718 params->plink_action != NL80211_PLINK_ACTION_BLOCK) 4719 return -EINVAL; 4720 break; 4721 } 4722 4723 /* 4724 * Older kernel versions ignored this attribute entirely, so don't 4725 * reject attempts to update it but mark it as unused instead so the 4726 * driver won't look at the data. 4727 */ 4728 if (statype != CFG80211_STA_AP_CLIENT_UNASSOC && 4729 statype != CFG80211_STA_TDLS_PEER_SETUP) 4730 params->opmode_notif_used = false; 4731 4732 return 0; 4733 } 4734 EXPORT_SYMBOL(cfg80211_check_station_change); 4735 4736 /* 4737 * Get vlan interface making sure it is running and on the right wiphy. 4738 */ 4739 static struct net_device *get_vlan(struct genl_info *info, 4740 struct cfg80211_registered_device *rdev) 4741 { 4742 struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN]; 4743 struct net_device *v; 4744 int ret; 4745 4746 if (!vlanattr) 4747 return NULL; 4748 4749 v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr)); 4750 if (!v) 4751 return ERR_PTR(-ENODEV); 4752 4753 if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) { 4754 ret = -EINVAL; 4755 goto error; 4756 } 4757 4758 if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN && 4759 v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 4760 v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) { 4761 ret = -EINVAL; 4762 goto error; 4763 } 4764 4765 if (!netif_running(v)) { 4766 ret = -ENETDOWN; 4767 goto error; 4768 } 4769 4770 return v; 4771 error: 4772 dev_put(v); 4773 return ERR_PTR(ret); 4774 } 4775 4776 static const struct nla_policy 4777 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = { 4778 [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 }, 4779 [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 }, 4780 }; 4781 4782 static int nl80211_parse_sta_wme(struct genl_info *info, 4783 struct station_parameters *params) 4784 { 4785 struct nlattr *tb[NL80211_STA_WME_MAX + 1]; 4786 struct nlattr *nla; 4787 int err; 4788 4789 /* parse WME attributes if present */ 4790 if (!info->attrs[NL80211_ATTR_STA_WME]) 4791 return 0; 4792 4793 nla = info->attrs[NL80211_ATTR_STA_WME]; 4794 err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla, 4795 nl80211_sta_wme_policy, info->extack); 4796 if (err) 4797 return err; 4798 4799 if (tb[NL80211_STA_WME_UAPSD_QUEUES]) 4800 params->uapsd_queues = nla_get_u8( 4801 tb[NL80211_STA_WME_UAPSD_QUEUES]); 4802 if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK) 4803 return -EINVAL; 4804 4805 if (tb[NL80211_STA_WME_MAX_SP]) 4806 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]); 4807 4808 if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK) 4809 return -EINVAL; 4810 4811 params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD; 4812 4813 return 0; 4814 } 4815 4816 static int nl80211_parse_sta_channel_info(struct genl_info *info, 4817 struct station_parameters *params) 4818 { 4819 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) { 4820 params->supported_channels = 4821 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]); 4822 params->supported_channels_len = 4823 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]); 4824 /* 4825 * Need to include at least one (first channel, number of 4826 * channels) tuple for each subband, and must have proper 4827 * tuples for the rest of the data as well. 4828 */ 4829 if (params->supported_channels_len < 2) 4830 return -EINVAL; 4831 if (params->supported_channels_len % 2) 4832 return -EINVAL; 4833 } 4834 4835 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) { 4836 params->supported_oper_classes = 4837 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]); 4838 params->supported_oper_classes_len = 4839 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]); 4840 /* 4841 * The value of the Length field of the Supported Operating 4842 * Classes element is between 2 and 253. 4843 */ 4844 if (params->supported_oper_classes_len < 2 || 4845 params->supported_oper_classes_len > 253) 4846 return -EINVAL; 4847 } 4848 return 0; 4849 } 4850 4851 static int nl80211_set_station_tdls(struct genl_info *info, 4852 struct station_parameters *params) 4853 { 4854 int err; 4855 /* Dummy STA entry gets updated once the peer capabilities are known */ 4856 if (info->attrs[NL80211_ATTR_PEER_AID]) 4857 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]); 4858 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) 4859 params->ht_capa = 4860 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]); 4861 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) 4862 params->vht_capa = 4863 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]); 4864 4865 err = nl80211_parse_sta_channel_info(info, params); 4866 if (err) 4867 return err; 4868 4869 return nl80211_parse_sta_wme(info, params); 4870 } 4871 4872 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info) 4873 { 4874 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4875 struct net_device *dev = info->user_ptr[1]; 4876 struct station_parameters params; 4877 u8 *mac_addr; 4878 int err; 4879 4880 memset(¶ms, 0, sizeof(params)); 4881 4882 if (!rdev->ops->change_station) 4883 return -EOPNOTSUPP; 4884 4885 /* 4886 * AID and listen_interval properties can be set only for unassociated 4887 * station. Include these parameters here and will check them in 4888 * cfg80211_check_station_change(). 4889 */ 4890 if (info->attrs[NL80211_ATTR_STA_AID]) 4891 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]); 4892 4893 if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]) 4894 params.listen_interval = 4895 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]); 4896 else 4897 params.listen_interval = -1; 4898 4899 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) { 4900 u8 tmp; 4901 4902 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]); 4903 if (tmp >= NUM_NL80211_P2P_PS_STATUS) 4904 return -EINVAL; 4905 4906 params.support_p2p_ps = tmp; 4907 } else { 4908 params.support_p2p_ps = -1; 4909 } 4910 4911 if (!info->attrs[NL80211_ATTR_MAC]) 4912 return -EINVAL; 4913 4914 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 4915 4916 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) { 4917 params.supported_rates = 4918 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 4919 params.supported_rates_len = 4920 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 4921 } 4922 4923 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) { 4924 params.capability = 4925 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]); 4926 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY; 4927 } 4928 4929 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) { 4930 params.ext_capab = 4931 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 4932 params.ext_capab_len = 4933 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 4934 } 4935 4936 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms)) 4937 return -EINVAL; 4938 4939 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) { 4940 params.plink_action = 4941 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]); 4942 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS) 4943 return -EINVAL; 4944 } 4945 4946 if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) { 4947 params.plink_state = 4948 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]); 4949 if (params.plink_state >= NUM_NL80211_PLINK_STATES) 4950 return -EINVAL; 4951 if (info->attrs[NL80211_ATTR_MESH_PEER_AID]) { 4952 params.peer_aid = nla_get_u16( 4953 info->attrs[NL80211_ATTR_MESH_PEER_AID]); 4954 if (params.peer_aid > IEEE80211_MAX_AID) 4955 return -EINVAL; 4956 } 4957 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE; 4958 } 4959 4960 if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) { 4961 enum nl80211_mesh_power_mode pm = nla_get_u32( 4962 info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]); 4963 4964 if (pm <= NL80211_MESH_POWER_UNKNOWN || 4965 pm > NL80211_MESH_POWER_MAX) 4966 return -EINVAL; 4967 4968 params.local_pm = pm; 4969 } 4970 4971 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) { 4972 params.opmode_notif_used = true; 4973 params.opmode_notif = 4974 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]); 4975 } 4976 4977 /* Include parameters for TDLS peer (will check later) */ 4978 err = nl80211_set_station_tdls(info, ¶ms); 4979 if (err) 4980 return err; 4981 4982 params.vlan = get_vlan(info, rdev); 4983 if (IS_ERR(params.vlan)) 4984 return PTR_ERR(params.vlan); 4985 4986 switch (dev->ieee80211_ptr->iftype) { 4987 case NL80211_IFTYPE_AP: 4988 case NL80211_IFTYPE_AP_VLAN: 4989 case NL80211_IFTYPE_P2P_GO: 4990 case NL80211_IFTYPE_P2P_CLIENT: 4991 case NL80211_IFTYPE_STATION: 4992 case NL80211_IFTYPE_ADHOC: 4993 case NL80211_IFTYPE_MESH_POINT: 4994 break; 4995 default: 4996 err = -EOPNOTSUPP; 4997 goto out_put_vlan; 4998 } 4999 5000 /* driver will call cfg80211_check_station_change() */ 5001 err = rdev_change_station(rdev, dev, mac_addr, ¶ms); 5002 5003 out_put_vlan: 5004 if (params.vlan) 5005 dev_put(params.vlan); 5006 5007 return err; 5008 } 5009 5010 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info) 5011 { 5012 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5013 int err; 5014 struct net_device *dev = info->user_ptr[1]; 5015 struct station_parameters params; 5016 u8 *mac_addr = NULL; 5017 u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) | 5018 BIT(NL80211_STA_FLAG_ASSOCIATED); 5019 5020 memset(¶ms, 0, sizeof(params)); 5021 5022 if (!rdev->ops->add_station) 5023 return -EOPNOTSUPP; 5024 5025 if (!info->attrs[NL80211_ATTR_MAC]) 5026 return -EINVAL; 5027 5028 if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]) 5029 return -EINVAL; 5030 5031 if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) 5032 return -EINVAL; 5033 5034 if (!info->attrs[NL80211_ATTR_STA_AID] && 5035 !info->attrs[NL80211_ATTR_PEER_AID]) 5036 return -EINVAL; 5037 5038 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 5039 params.supported_rates = 5040 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 5041 params.supported_rates_len = 5042 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 5043 params.listen_interval = 5044 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]); 5045 5046 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) { 5047 u8 tmp; 5048 5049 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]); 5050 if (tmp >= NUM_NL80211_P2P_PS_STATUS) 5051 return -EINVAL; 5052 5053 params.support_p2p_ps = tmp; 5054 } else { 5055 /* 5056 * if not specified, assume it's supported for P2P GO interface, 5057 * and is NOT supported for AP interface 5058 */ 5059 params.support_p2p_ps = 5060 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO; 5061 } 5062 5063 if (info->attrs[NL80211_ATTR_PEER_AID]) 5064 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]); 5065 else 5066 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]); 5067 if (!params.aid || params.aid > IEEE80211_MAX_AID) 5068 return -EINVAL; 5069 5070 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) { 5071 params.capability = 5072 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]); 5073 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY; 5074 } 5075 5076 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) { 5077 params.ext_capab = 5078 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 5079 params.ext_capab_len = 5080 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 5081 } 5082 5083 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) 5084 params.ht_capa = 5085 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]); 5086 5087 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) 5088 params.vht_capa = 5089 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]); 5090 5091 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) { 5092 params.opmode_notif_used = true; 5093 params.opmode_notif = 5094 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]); 5095 } 5096 5097 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) { 5098 params.plink_action = 5099 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]); 5100 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS) 5101 return -EINVAL; 5102 } 5103 5104 err = nl80211_parse_sta_channel_info(info, ¶ms); 5105 if (err) 5106 return err; 5107 5108 err = nl80211_parse_sta_wme(info, ¶ms); 5109 if (err) 5110 return err; 5111 5112 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms)) 5113 return -EINVAL; 5114 5115 /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT 5116 * as userspace might just pass through the capabilities from the IEs 5117 * directly, rather than enforcing this restriction and returning an 5118 * error in this case. 5119 */ 5120 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) { 5121 params.ht_capa = NULL; 5122 params.vht_capa = NULL; 5123 } 5124 5125 /* When you run into this, adjust the code below for the new flag */ 5126 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7); 5127 5128 switch (dev->ieee80211_ptr->iftype) { 5129 case NL80211_IFTYPE_AP: 5130 case NL80211_IFTYPE_AP_VLAN: 5131 case NL80211_IFTYPE_P2P_GO: 5132 /* ignore WME attributes if iface/sta is not capable */ 5133 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) || 5134 !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) 5135 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD; 5136 5137 /* TDLS peers cannot be added */ 5138 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) || 5139 info->attrs[NL80211_ATTR_PEER_AID]) 5140 return -EINVAL; 5141 /* but don't bother the driver with it */ 5142 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER); 5143 5144 /* allow authenticated/associated only if driver handles it */ 5145 if (!(rdev->wiphy.features & 5146 NL80211_FEATURE_FULL_AP_CLIENT_STATE) && 5147 params.sta_flags_mask & auth_assoc) 5148 return -EINVAL; 5149 5150 /* Older userspace, or userspace wanting to be compatible with 5151 * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth 5152 * and assoc flags in the mask, but assumes the station will be 5153 * added as associated anyway since this was the required driver 5154 * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was 5155 * introduced. 5156 * In order to not bother drivers with this quirk in the API 5157 * set the flags in both the mask and set for new stations in 5158 * this case. 5159 */ 5160 if (!(params.sta_flags_mask & auth_assoc)) { 5161 params.sta_flags_mask |= auth_assoc; 5162 params.sta_flags_set |= auth_assoc; 5163 } 5164 5165 /* must be last in here for error handling */ 5166 params.vlan = get_vlan(info, rdev); 5167 if (IS_ERR(params.vlan)) 5168 return PTR_ERR(params.vlan); 5169 break; 5170 case NL80211_IFTYPE_MESH_POINT: 5171 /* ignore uAPSD data */ 5172 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD; 5173 5174 /* associated is disallowed */ 5175 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED)) 5176 return -EINVAL; 5177 /* TDLS peers cannot be added */ 5178 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) || 5179 info->attrs[NL80211_ATTR_PEER_AID]) 5180 return -EINVAL; 5181 break; 5182 case NL80211_IFTYPE_STATION: 5183 case NL80211_IFTYPE_P2P_CLIENT: 5184 /* ignore uAPSD data */ 5185 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD; 5186 5187 /* these are disallowed */ 5188 if (params.sta_flags_mask & 5189 (BIT(NL80211_STA_FLAG_ASSOCIATED) | 5190 BIT(NL80211_STA_FLAG_AUTHENTICATED))) 5191 return -EINVAL; 5192 /* Only TDLS peers can be added */ 5193 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))) 5194 return -EINVAL; 5195 /* Can only add if TDLS ... */ 5196 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS)) 5197 return -EOPNOTSUPP; 5198 /* ... with external setup is supported */ 5199 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP)) 5200 return -EOPNOTSUPP; 5201 /* 5202 * Older wpa_supplicant versions always mark the TDLS peer 5203 * as authorized, but it shouldn't yet be. 5204 */ 5205 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED); 5206 break; 5207 default: 5208 return -EOPNOTSUPP; 5209 } 5210 5211 /* be aware of params.vlan when changing code here */ 5212 5213 err = rdev_add_station(rdev, dev, mac_addr, ¶ms); 5214 5215 if (params.vlan) 5216 dev_put(params.vlan); 5217 return err; 5218 } 5219 5220 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info) 5221 { 5222 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5223 struct net_device *dev = info->user_ptr[1]; 5224 struct station_del_parameters params; 5225 5226 memset(¶ms, 0, sizeof(params)); 5227 5228 if (info->attrs[NL80211_ATTR_MAC]) 5229 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]); 5230 5231 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 5232 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN && 5233 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT && 5234 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 5235 return -EINVAL; 5236 5237 if (!rdev->ops->del_station) 5238 return -EOPNOTSUPP; 5239 5240 if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) { 5241 params.subtype = 5242 nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]); 5243 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 && 5244 params.subtype != IEEE80211_STYPE_DEAUTH >> 4) 5245 return -EINVAL; 5246 } else { 5247 /* Default to Deauthentication frame */ 5248 params.subtype = IEEE80211_STYPE_DEAUTH >> 4; 5249 } 5250 5251 if (info->attrs[NL80211_ATTR_REASON_CODE]) { 5252 params.reason_code = 5253 nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 5254 if (params.reason_code == 0) 5255 return -EINVAL; /* 0 is reserved */ 5256 } else { 5257 /* Default to reason code 2 */ 5258 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID; 5259 } 5260 5261 return rdev_del_station(rdev, dev, ¶ms); 5262 } 5263 5264 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq, 5265 int flags, struct net_device *dev, 5266 u8 *dst, u8 *next_hop, 5267 struct mpath_info *pinfo) 5268 { 5269 void *hdr; 5270 struct nlattr *pinfoattr; 5271 5272 hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH); 5273 if (!hdr) 5274 return -1; 5275 5276 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 5277 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) || 5278 nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) || 5279 nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation)) 5280 goto nla_put_failure; 5281 5282 pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO); 5283 if (!pinfoattr) 5284 goto nla_put_failure; 5285 if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) && 5286 nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN, 5287 pinfo->frame_qlen)) 5288 goto nla_put_failure; 5289 if (((pinfo->filled & MPATH_INFO_SN) && 5290 nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) || 5291 ((pinfo->filled & MPATH_INFO_METRIC) && 5292 nla_put_u32(msg, NL80211_MPATH_INFO_METRIC, 5293 pinfo->metric)) || 5294 ((pinfo->filled & MPATH_INFO_EXPTIME) && 5295 nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME, 5296 pinfo->exptime)) || 5297 ((pinfo->filled & MPATH_INFO_FLAGS) && 5298 nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS, 5299 pinfo->flags)) || 5300 ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) && 5301 nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT, 5302 pinfo->discovery_timeout)) || 5303 ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) && 5304 nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES, 5305 pinfo->discovery_retries))) 5306 goto nla_put_failure; 5307 5308 nla_nest_end(msg, pinfoattr); 5309 5310 genlmsg_end(msg, hdr); 5311 return 0; 5312 5313 nla_put_failure: 5314 genlmsg_cancel(msg, hdr); 5315 return -EMSGSIZE; 5316 } 5317 5318 static int nl80211_dump_mpath(struct sk_buff *skb, 5319 struct netlink_callback *cb) 5320 { 5321 struct mpath_info pinfo; 5322 struct cfg80211_registered_device *rdev; 5323 struct wireless_dev *wdev; 5324 u8 dst[ETH_ALEN]; 5325 u8 next_hop[ETH_ALEN]; 5326 int path_idx = cb->args[2]; 5327 int err; 5328 5329 rtnl_lock(); 5330 err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev); 5331 if (err) 5332 goto out_err; 5333 5334 if (!rdev->ops->dump_mpath) { 5335 err = -EOPNOTSUPP; 5336 goto out_err; 5337 } 5338 5339 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) { 5340 err = -EOPNOTSUPP; 5341 goto out_err; 5342 } 5343 5344 while (1) { 5345 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst, 5346 next_hop, &pinfo); 5347 if (err == -ENOENT) 5348 break; 5349 if (err) 5350 goto out_err; 5351 5352 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid, 5353 cb->nlh->nlmsg_seq, NLM_F_MULTI, 5354 wdev->netdev, dst, next_hop, 5355 &pinfo) < 0) 5356 goto out; 5357 5358 path_idx++; 5359 } 5360 5361 out: 5362 cb->args[2] = path_idx; 5363 err = skb->len; 5364 out_err: 5365 rtnl_unlock(); 5366 return err; 5367 } 5368 5369 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info) 5370 { 5371 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5372 int err; 5373 struct net_device *dev = info->user_ptr[1]; 5374 struct mpath_info pinfo; 5375 struct sk_buff *msg; 5376 u8 *dst = NULL; 5377 u8 next_hop[ETH_ALEN]; 5378 5379 memset(&pinfo, 0, sizeof(pinfo)); 5380 5381 if (!info->attrs[NL80211_ATTR_MAC]) 5382 return -EINVAL; 5383 5384 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 5385 5386 if (!rdev->ops->get_mpath) 5387 return -EOPNOTSUPP; 5388 5389 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 5390 return -EOPNOTSUPP; 5391 5392 err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo); 5393 if (err) 5394 return err; 5395 5396 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 5397 if (!msg) 5398 return -ENOMEM; 5399 5400 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0, 5401 dev, dst, next_hop, &pinfo) < 0) { 5402 nlmsg_free(msg); 5403 return -ENOBUFS; 5404 } 5405 5406 return genlmsg_reply(msg, info); 5407 } 5408 5409 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info) 5410 { 5411 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5412 struct net_device *dev = info->user_ptr[1]; 5413 u8 *dst = NULL; 5414 u8 *next_hop = NULL; 5415 5416 if (!info->attrs[NL80211_ATTR_MAC]) 5417 return -EINVAL; 5418 5419 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]) 5420 return -EINVAL; 5421 5422 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 5423 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]); 5424 5425 if (!rdev->ops->change_mpath) 5426 return -EOPNOTSUPP; 5427 5428 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 5429 return -EOPNOTSUPP; 5430 5431 return rdev_change_mpath(rdev, dev, dst, next_hop); 5432 } 5433 5434 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info) 5435 { 5436 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5437 struct net_device *dev = info->user_ptr[1]; 5438 u8 *dst = NULL; 5439 u8 *next_hop = NULL; 5440 5441 if (!info->attrs[NL80211_ATTR_MAC]) 5442 return -EINVAL; 5443 5444 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]) 5445 return -EINVAL; 5446 5447 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 5448 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]); 5449 5450 if (!rdev->ops->add_mpath) 5451 return -EOPNOTSUPP; 5452 5453 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 5454 return -EOPNOTSUPP; 5455 5456 return rdev_add_mpath(rdev, dev, dst, next_hop); 5457 } 5458 5459 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info) 5460 { 5461 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5462 struct net_device *dev = info->user_ptr[1]; 5463 u8 *dst = NULL; 5464 5465 if (info->attrs[NL80211_ATTR_MAC]) 5466 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 5467 5468 if (!rdev->ops->del_mpath) 5469 return -EOPNOTSUPP; 5470 5471 return rdev_del_mpath(rdev, dev, dst); 5472 } 5473 5474 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info) 5475 { 5476 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5477 int err; 5478 struct net_device *dev = info->user_ptr[1]; 5479 struct mpath_info pinfo; 5480 struct sk_buff *msg; 5481 u8 *dst = NULL; 5482 u8 mpp[ETH_ALEN]; 5483 5484 memset(&pinfo, 0, sizeof(pinfo)); 5485 5486 if (!info->attrs[NL80211_ATTR_MAC]) 5487 return -EINVAL; 5488 5489 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 5490 5491 if (!rdev->ops->get_mpp) 5492 return -EOPNOTSUPP; 5493 5494 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 5495 return -EOPNOTSUPP; 5496 5497 err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo); 5498 if (err) 5499 return err; 5500 5501 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 5502 if (!msg) 5503 return -ENOMEM; 5504 5505 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0, 5506 dev, dst, mpp, &pinfo) < 0) { 5507 nlmsg_free(msg); 5508 return -ENOBUFS; 5509 } 5510 5511 return genlmsg_reply(msg, info); 5512 } 5513 5514 static int nl80211_dump_mpp(struct sk_buff *skb, 5515 struct netlink_callback *cb) 5516 { 5517 struct mpath_info pinfo; 5518 struct cfg80211_registered_device *rdev; 5519 struct wireless_dev *wdev; 5520 u8 dst[ETH_ALEN]; 5521 u8 mpp[ETH_ALEN]; 5522 int path_idx = cb->args[2]; 5523 int err; 5524 5525 rtnl_lock(); 5526 err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev); 5527 if (err) 5528 goto out_err; 5529 5530 if (!rdev->ops->dump_mpp) { 5531 err = -EOPNOTSUPP; 5532 goto out_err; 5533 } 5534 5535 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) { 5536 err = -EOPNOTSUPP; 5537 goto out_err; 5538 } 5539 5540 while (1) { 5541 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst, 5542 mpp, &pinfo); 5543 if (err == -ENOENT) 5544 break; 5545 if (err) 5546 goto out_err; 5547 5548 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid, 5549 cb->nlh->nlmsg_seq, NLM_F_MULTI, 5550 wdev->netdev, dst, mpp, 5551 &pinfo) < 0) 5552 goto out; 5553 5554 path_idx++; 5555 } 5556 5557 out: 5558 cb->args[2] = path_idx; 5559 err = skb->len; 5560 out_err: 5561 rtnl_unlock(); 5562 return err; 5563 } 5564 5565 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info) 5566 { 5567 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5568 struct net_device *dev = info->user_ptr[1]; 5569 struct wireless_dev *wdev = dev->ieee80211_ptr; 5570 struct bss_parameters params; 5571 int err; 5572 5573 memset(¶ms, 0, sizeof(params)); 5574 /* default to not changing parameters */ 5575 params.use_cts_prot = -1; 5576 params.use_short_preamble = -1; 5577 params.use_short_slot_time = -1; 5578 params.ap_isolate = -1; 5579 params.ht_opmode = -1; 5580 params.p2p_ctwindow = -1; 5581 params.p2p_opp_ps = -1; 5582 5583 if (info->attrs[NL80211_ATTR_BSS_CTS_PROT]) 5584 params.use_cts_prot = 5585 nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]); 5586 if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]) 5587 params.use_short_preamble = 5588 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]); 5589 if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]) 5590 params.use_short_slot_time = 5591 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]); 5592 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) { 5593 params.basic_rates = 5594 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 5595 params.basic_rates_len = 5596 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 5597 } 5598 if (info->attrs[NL80211_ATTR_AP_ISOLATE]) 5599 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]); 5600 if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE]) 5601 params.ht_opmode = 5602 nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]); 5603 5604 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) { 5605 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 5606 return -EINVAL; 5607 params.p2p_ctwindow = 5608 nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]); 5609 if (params.p2p_ctwindow < 0) 5610 return -EINVAL; 5611 if (params.p2p_ctwindow != 0 && 5612 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) 5613 return -EINVAL; 5614 } 5615 5616 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) { 5617 u8 tmp; 5618 5619 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 5620 return -EINVAL; 5621 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]); 5622 if (tmp > 1) 5623 return -EINVAL; 5624 params.p2p_opp_ps = tmp; 5625 if (params.p2p_opp_ps && 5626 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) 5627 return -EINVAL; 5628 } 5629 5630 if (!rdev->ops->change_bss) 5631 return -EOPNOTSUPP; 5632 5633 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 5634 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 5635 return -EOPNOTSUPP; 5636 5637 wdev_lock(wdev); 5638 err = rdev_change_bss(rdev, dev, ¶ms); 5639 wdev_unlock(wdev); 5640 5641 return err; 5642 } 5643 5644 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info) 5645 { 5646 char *data = NULL; 5647 bool is_indoor; 5648 enum nl80211_user_reg_hint_type user_reg_hint_type; 5649 u32 owner_nlportid; 5650 5651 /* 5652 * You should only get this when cfg80211 hasn't yet initialized 5653 * completely when built-in to the kernel right between the time 5654 * window between nl80211_init() and regulatory_init(), if that is 5655 * even possible. 5656 */ 5657 if (unlikely(!rcu_access_pointer(cfg80211_regdomain))) 5658 return -EINPROGRESS; 5659 5660 if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]) 5661 user_reg_hint_type = 5662 nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]); 5663 else 5664 user_reg_hint_type = NL80211_USER_REG_HINT_USER; 5665 5666 switch (user_reg_hint_type) { 5667 case NL80211_USER_REG_HINT_USER: 5668 case NL80211_USER_REG_HINT_CELL_BASE: 5669 if (!info->attrs[NL80211_ATTR_REG_ALPHA2]) 5670 return -EINVAL; 5671 5672 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]); 5673 return regulatory_hint_user(data, user_reg_hint_type); 5674 case NL80211_USER_REG_HINT_INDOOR: 5675 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 5676 owner_nlportid = info->snd_portid; 5677 is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR]; 5678 } else { 5679 owner_nlportid = 0; 5680 is_indoor = true; 5681 } 5682 5683 return regulatory_hint_indoor(is_indoor, owner_nlportid); 5684 default: 5685 return -EINVAL; 5686 } 5687 } 5688 5689 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info) 5690 { 5691 return reg_reload_regdb(); 5692 } 5693 5694 static int nl80211_get_mesh_config(struct sk_buff *skb, 5695 struct genl_info *info) 5696 { 5697 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5698 struct net_device *dev = info->user_ptr[1]; 5699 struct wireless_dev *wdev = dev->ieee80211_ptr; 5700 struct mesh_config cur_params; 5701 int err = 0; 5702 void *hdr; 5703 struct nlattr *pinfoattr; 5704 struct sk_buff *msg; 5705 5706 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) 5707 return -EOPNOTSUPP; 5708 5709 if (!rdev->ops->get_mesh_config) 5710 return -EOPNOTSUPP; 5711 5712 wdev_lock(wdev); 5713 /* If not connected, get default parameters */ 5714 if (!wdev->mesh_id_len) 5715 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params)); 5716 else 5717 err = rdev_get_mesh_config(rdev, dev, &cur_params); 5718 wdev_unlock(wdev); 5719 5720 if (err) 5721 return err; 5722 5723 /* Draw up a netlink message to send back */ 5724 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 5725 if (!msg) 5726 return -ENOMEM; 5727 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 5728 NL80211_CMD_GET_MESH_CONFIG); 5729 if (!hdr) 5730 goto out; 5731 pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG); 5732 if (!pinfoattr) 5733 goto nla_put_failure; 5734 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 5735 nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT, 5736 cur_params.dot11MeshRetryTimeout) || 5737 nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT, 5738 cur_params.dot11MeshConfirmTimeout) || 5739 nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT, 5740 cur_params.dot11MeshHoldingTimeout) || 5741 nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS, 5742 cur_params.dot11MeshMaxPeerLinks) || 5743 nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES, 5744 cur_params.dot11MeshMaxRetries) || 5745 nla_put_u8(msg, NL80211_MESHCONF_TTL, 5746 cur_params.dot11MeshTTL) || 5747 nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL, 5748 cur_params.element_ttl) || 5749 nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS, 5750 cur_params.auto_open_plinks) || 5751 nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR, 5752 cur_params.dot11MeshNbrOffsetMaxNeighbor) || 5753 nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES, 5754 cur_params.dot11MeshHWMPmaxPREQretries) || 5755 nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME, 5756 cur_params.path_refresh_time) || 5757 nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT, 5758 cur_params.min_discovery_timeout) || 5759 nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT, 5760 cur_params.dot11MeshHWMPactivePathTimeout) || 5761 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL, 5762 cur_params.dot11MeshHWMPpreqMinInterval) || 5763 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL, 5764 cur_params.dot11MeshHWMPperrMinInterval) || 5765 nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME, 5766 cur_params.dot11MeshHWMPnetDiameterTraversalTime) || 5767 nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE, 5768 cur_params.dot11MeshHWMPRootMode) || 5769 nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL, 5770 cur_params.dot11MeshHWMPRannInterval) || 5771 nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS, 5772 cur_params.dot11MeshGateAnnouncementProtocol) || 5773 nla_put_u8(msg, NL80211_MESHCONF_FORWARDING, 5774 cur_params.dot11MeshForwarding) || 5775 nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD, 5776 cur_params.rssi_threshold) || 5777 nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE, 5778 cur_params.ht_opmode) || 5779 nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT, 5780 cur_params.dot11MeshHWMPactivePathToRootTimeout) || 5781 nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL, 5782 cur_params.dot11MeshHWMProotInterval) || 5783 nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL, 5784 cur_params.dot11MeshHWMPconfirmationInterval) || 5785 nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE, 5786 cur_params.power_mode) || 5787 nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW, 5788 cur_params.dot11MeshAwakeWindowDuration) || 5789 nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT, 5790 cur_params.plink_timeout)) 5791 goto nla_put_failure; 5792 nla_nest_end(msg, pinfoattr); 5793 genlmsg_end(msg, hdr); 5794 return genlmsg_reply(msg, info); 5795 5796 nla_put_failure: 5797 genlmsg_cancel(msg, hdr); 5798 out: 5799 nlmsg_free(msg); 5800 return -ENOBUFS; 5801 } 5802 5803 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = { 5804 [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 }, 5805 [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 }, 5806 [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 }, 5807 [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 }, 5808 [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 }, 5809 [NL80211_MESHCONF_TTL] = { .type = NLA_U8 }, 5810 [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 }, 5811 [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 }, 5812 [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 }, 5813 [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 }, 5814 [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 }, 5815 [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 }, 5816 [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 }, 5817 [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 }, 5818 [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 }, 5819 [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 }, 5820 [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 }, 5821 [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 }, 5822 [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 }, 5823 [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 }, 5824 [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 }, 5825 [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 }, 5826 [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 }, 5827 [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 }, 5828 [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 }, 5829 [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 }, 5830 [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 }, 5831 [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 }, 5832 }; 5833 5834 static const struct nla_policy 5835 nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = { 5836 [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 }, 5837 [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 }, 5838 [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 }, 5839 [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG }, 5840 [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 }, 5841 [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG }, 5842 [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY, 5843 .len = IEEE80211_MAX_DATA_LEN }, 5844 [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG }, 5845 }; 5846 5847 static int nl80211_check_bool(const struct nlattr *nla, u8 min, u8 max, bool *out) 5848 { 5849 u8 val = nla_get_u8(nla); 5850 if (val < min || val > max) 5851 return -EINVAL; 5852 *out = val; 5853 return 0; 5854 } 5855 5856 static int nl80211_check_u8(const struct nlattr *nla, u8 min, u8 max, u8 *out) 5857 { 5858 u8 val = nla_get_u8(nla); 5859 if (val < min || val > max) 5860 return -EINVAL; 5861 *out = val; 5862 return 0; 5863 } 5864 5865 static int nl80211_check_u16(const struct nlattr *nla, u16 min, u16 max, u16 *out) 5866 { 5867 u16 val = nla_get_u16(nla); 5868 if (val < min || val > max) 5869 return -EINVAL; 5870 *out = val; 5871 return 0; 5872 } 5873 5874 static int nl80211_check_u32(const struct nlattr *nla, u32 min, u32 max, u32 *out) 5875 { 5876 u32 val = nla_get_u32(nla); 5877 if (val < min || val > max) 5878 return -EINVAL; 5879 *out = val; 5880 return 0; 5881 } 5882 5883 static int nl80211_check_s32(const struct nlattr *nla, s32 min, s32 max, s32 *out) 5884 { 5885 s32 val = nla_get_s32(nla); 5886 if (val < min || val > max) 5887 return -EINVAL; 5888 *out = val; 5889 return 0; 5890 } 5891 5892 static int nl80211_check_power_mode(const struct nlattr *nla, 5893 enum nl80211_mesh_power_mode min, 5894 enum nl80211_mesh_power_mode max, 5895 enum nl80211_mesh_power_mode *out) 5896 { 5897 u32 val = nla_get_u32(nla); 5898 if (val < min || val > max) 5899 return -EINVAL; 5900 *out = val; 5901 return 0; 5902 } 5903 5904 static int nl80211_parse_mesh_config(struct genl_info *info, 5905 struct mesh_config *cfg, 5906 u32 *mask_out) 5907 { 5908 struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1]; 5909 u32 mask = 0; 5910 u16 ht_opmode; 5911 5912 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \ 5913 do { \ 5914 if (tb[attr]) { \ 5915 if (fn(tb[attr], min, max, &cfg->param)) \ 5916 return -EINVAL; \ 5917 mask |= (1 << (attr - 1)); \ 5918 } \ 5919 } while (0) 5920 5921 if (!info->attrs[NL80211_ATTR_MESH_CONFIG]) 5922 return -EINVAL; 5923 if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX, 5924 info->attrs[NL80211_ATTR_MESH_CONFIG], 5925 nl80211_meshconf_params_policy, info->extack)) 5926 return -EINVAL; 5927 5928 /* This makes sure that there aren't more than 32 mesh config 5929 * parameters (otherwise our bitfield scheme would not work.) */ 5930 BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32); 5931 5932 /* Fill in the params struct */ 5933 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255, 5934 mask, NL80211_MESHCONF_RETRY_TIMEOUT, 5935 nl80211_check_u16); 5936 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255, 5937 mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, 5938 nl80211_check_u16); 5939 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255, 5940 mask, NL80211_MESHCONF_HOLDING_TIMEOUT, 5941 nl80211_check_u16); 5942 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255, 5943 mask, NL80211_MESHCONF_MAX_PEER_LINKS, 5944 nl80211_check_u16); 5945 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16, 5946 mask, NL80211_MESHCONF_MAX_RETRIES, 5947 nl80211_check_u8); 5948 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255, 5949 mask, NL80211_MESHCONF_TTL, nl80211_check_u8); 5950 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255, 5951 mask, NL80211_MESHCONF_ELEMENT_TTL, 5952 nl80211_check_u8); 5953 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1, 5954 mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, 5955 nl80211_check_bool); 5956 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor, 5957 1, 255, mask, 5958 NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR, 5959 nl80211_check_u32); 5960 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255, 5961 mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES, 5962 nl80211_check_u8); 5963 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535, 5964 mask, NL80211_MESHCONF_PATH_REFRESH_TIME, 5965 nl80211_check_u32); 5966 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535, 5967 mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT, 5968 nl80211_check_u16); 5969 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout, 5970 1, 65535, mask, 5971 NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT, 5972 nl80211_check_u32); 5973 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, 5974 1, 65535, mask, 5975 NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL, 5976 nl80211_check_u16); 5977 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, 5978 1, 65535, mask, 5979 NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL, 5980 nl80211_check_u16); 5981 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, 5982 dot11MeshHWMPnetDiameterTraversalTime, 5983 1, 65535, mask, 5984 NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME, 5985 nl80211_check_u16); 5986 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4, 5987 mask, NL80211_MESHCONF_HWMP_ROOTMODE, 5988 nl80211_check_u8); 5989 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535, 5990 mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL, 5991 nl80211_check_u16); 5992 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, 5993 dot11MeshGateAnnouncementProtocol, 0, 1, 5994 mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS, 5995 nl80211_check_bool); 5996 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1, 5997 mask, NL80211_MESHCONF_FORWARDING, 5998 nl80211_check_bool); 5999 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0, 6000 mask, NL80211_MESHCONF_RSSI_THRESHOLD, 6001 nl80211_check_s32); 6002 /* 6003 * Check HT operation mode based on 6004 * IEEE 802.11 2012 8.4.2.59 HT Operation element. 6005 */ 6006 if (tb[NL80211_MESHCONF_HT_OPMODE]) { 6007 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]); 6008 6009 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION | 6010 IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT | 6011 IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)) 6012 return -EINVAL; 6013 6014 if ((ht_opmode & IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT) && 6015 (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)) 6016 return -EINVAL; 6017 6018 switch (ht_opmode & IEEE80211_HT_OP_MODE_PROTECTION) { 6019 case IEEE80211_HT_OP_MODE_PROTECTION_NONE: 6020 case IEEE80211_HT_OP_MODE_PROTECTION_20MHZ: 6021 if (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT) 6022 return -EINVAL; 6023 break; 6024 case IEEE80211_HT_OP_MODE_PROTECTION_NONMEMBER: 6025 case IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED: 6026 if (!(ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)) 6027 return -EINVAL; 6028 break; 6029 } 6030 cfg->ht_opmode = ht_opmode; 6031 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1)); 6032 } 6033 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout, 6034 1, 65535, mask, 6035 NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT, 6036 nl80211_check_u32); 6037 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535, 6038 mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL, 6039 nl80211_check_u16); 6040 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, 6041 dot11MeshHWMPconfirmationInterval, 6042 1, 65535, mask, 6043 NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL, 6044 nl80211_check_u16); 6045 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, 6046 NL80211_MESH_POWER_ACTIVE, 6047 NL80211_MESH_POWER_MAX, 6048 mask, NL80211_MESHCONF_POWER_MODE, 6049 nl80211_check_power_mode); 6050 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, 6051 0, 65535, mask, 6052 NL80211_MESHCONF_AWAKE_WINDOW, nl80211_check_u16); 6053 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 0, 0xffffffff, 6054 mask, NL80211_MESHCONF_PLINK_TIMEOUT, 6055 nl80211_check_u32); 6056 if (mask_out) 6057 *mask_out = mask; 6058 6059 return 0; 6060 6061 #undef FILL_IN_MESH_PARAM_IF_SET 6062 } 6063 6064 static int nl80211_parse_mesh_setup(struct genl_info *info, 6065 struct mesh_setup *setup) 6066 { 6067 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6068 struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1]; 6069 6070 if (!info->attrs[NL80211_ATTR_MESH_SETUP]) 6071 return -EINVAL; 6072 if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX, 6073 info->attrs[NL80211_ATTR_MESH_SETUP], 6074 nl80211_mesh_setup_params_policy, info->extack)) 6075 return -EINVAL; 6076 6077 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC]) 6078 setup->sync_method = 6079 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ? 6080 IEEE80211_SYNC_METHOD_VENDOR : 6081 IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET; 6082 6083 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL]) 6084 setup->path_sel_proto = 6085 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ? 6086 IEEE80211_PATH_PROTOCOL_VENDOR : 6087 IEEE80211_PATH_PROTOCOL_HWMP; 6088 6089 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC]) 6090 setup->path_metric = 6091 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ? 6092 IEEE80211_PATH_METRIC_VENDOR : 6093 IEEE80211_PATH_METRIC_AIRTIME; 6094 6095 if (tb[NL80211_MESH_SETUP_IE]) { 6096 struct nlattr *ieattr = 6097 tb[NL80211_MESH_SETUP_IE]; 6098 if (!is_valid_ie_attr(ieattr)) 6099 return -EINVAL; 6100 setup->ie = nla_data(ieattr); 6101 setup->ie_len = nla_len(ieattr); 6102 } 6103 if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] && 6104 !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM)) 6105 return -EINVAL; 6106 setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]); 6107 setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]); 6108 setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]); 6109 if (setup->is_secure) 6110 setup->user_mpm = true; 6111 6112 if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) { 6113 if (!setup->user_mpm) 6114 return -EINVAL; 6115 setup->auth_id = 6116 nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]); 6117 } 6118 6119 return 0; 6120 } 6121 6122 static int nl80211_update_mesh_config(struct sk_buff *skb, 6123 struct genl_info *info) 6124 { 6125 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6126 struct net_device *dev = info->user_ptr[1]; 6127 struct wireless_dev *wdev = dev->ieee80211_ptr; 6128 struct mesh_config cfg; 6129 u32 mask; 6130 int err; 6131 6132 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) 6133 return -EOPNOTSUPP; 6134 6135 if (!rdev->ops->update_mesh_config) 6136 return -EOPNOTSUPP; 6137 6138 err = nl80211_parse_mesh_config(info, &cfg, &mask); 6139 if (err) 6140 return err; 6141 6142 wdev_lock(wdev); 6143 if (!wdev->mesh_id_len) 6144 err = -ENOLINK; 6145 6146 if (!err) 6147 err = rdev_update_mesh_config(rdev, dev, mask, &cfg); 6148 6149 wdev_unlock(wdev); 6150 6151 return err; 6152 } 6153 6154 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom, 6155 struct sk_buff *msg) 6156 { 6157 struct nlattr *nl_reg_rules; 6158 unsigned int i; 6159 6160 if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) || 6161 (regdom->dfs_region && 6162 nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region))) 6163 goto nla_put_failure; 6164 6165 nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES); 6166 if (!nl_reg_rules) 6167 goto nla_put_failure; 6168 6169 for (i = 0; i < regdom->n_reg_rules; i++) { 6170 struct nlattr *nl_reg_rule; 6171 const struct ieee80211_reg_rule *reg_rule; 6172 const struct ieee80211_freq_range *freq_range; 6173 const struct ieee80211_power_rule *power_rule; 6174 unsigned int max_bandwidth_khz; 6175 6176 reg_rule = ®dom->reg_rules[i]; 6177 freq_range = ®_rule->freq_range; 6178 power_rule = ®_rule->power_rule; 6179 6180 nl_reg_rule = nla_nest_start(msg, i); 6181 if (!nl_reg_rule) 6182 goto nla_put_failure; 6183 6184 max_bandwidth_khz = freq_range->max_bandwidth_khz; 6185 if (!max_bandwidth_khz) 6186 max_bandwidth_khz = reg_get_max_bandwidth(regdom, 6187 reg_rule); 6188 6189 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS, 6190 reg_rule->flags) || 6191 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START, 6192 freq_range->start_freq_khz) || 6193 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END, 6194 freq_range->end_freq_khz) || 6195 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW, 6196 max_bandwidth_khz) || 6197 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN, 6198 power_rule->max_antenna_gain) || 6199 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP, 6200 power_rule->max_eirp) || 6201 nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME, 6202 reg_rule->dfs_cac_ms)) 6203 goto nla_put_failure; 6204 6205 nla_nest_end(msg, nl_reg_rule); 6206 } 6207 6208 nla_nest_end(msg, nl_reg_rules); 6209 return 0; 6210 6211 nla_put_failure: 6212 return -EMSGSIZE; 6213 } 6214 6215 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info) 6216 { 6217 const struct ieee80211_regdomain *regdom = NULL; 6218 struct cfg80211_registered_device *rdev; 6219 struct wiphy *wiphy = NULL; 6220 struct sk_buff *msg; 6221 void *hdr; 6222 6223 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 6224 if (!msg) 6225 return -ENOBUFS; 6226 6227 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 6228 NL80211_CMD_GET_REG); 6229 if (!hdr) 6230 goto put_failure; 6231 6232 if (info->attrs[NL80211_ATTR_WIPHY]) { 6233 bool self_managed; 6234 6235 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info); 6236 if (IS_ERR(rdev)) { 6237 nlmsg_free(msg); 6238 return PTR_ERR(rdev); 6239 } 6240 6241 wiphy = &rdev->wiphy; 6242 self_managed = wiphy->regulatory_flags & 6243 REGULATORY_WIPHY_SELF_MANAGED; 6244 regdom = get_wiphy_regdom(wiphy); 6245 6246 /* a self-managed-reg device must have a private regdom */ 6247 if (WARN_ON(!regdom && self_managed)) { 6248 nlmsg_free(msg); 6249 return -EINVAL; 6250 } 6251 6252 if (regdom && 6253 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy))) 6254 goto nla_put_failure; 6255 } 6256 6257 if (!wiphy && reg_last_request_cell_base() && 6258 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE, 6259 NL80211_USER_REG_HINT_CELL_BASE)) 6260 goto nla_put_failure; 6261 6262 rcu_read_lock(); 6263 6264 if (!regdom) 6265 regdom = rcu_dereference(cfg80211_regdomain); 6266 6267 if (nl80211_put_regdom(regdom, msg)) 6268 goto nla_put_failure_rcu; 6269 6270 rcu_read_unlock(); 6271 6272 genlmsg_end(msg, hdr); 6273 return genlmsg_reply(msg, info); 6274 6275 nla_put_failure_rcu: 6276 rcu_read_unlock(); 6277 nla_put_failure: 6278 genlmsg_cancel(msg, hdr); 6279 put_failure: 6280 nlmsg_free(msg); 6281 return -EMSGSIZE; 6282 } 6283 6284 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb, 6285 u32 seq, int flags, struct wiphy *wiphy, 6286 const struct ieee80211_regdomain *regdom) 6287 { 6288 void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags, 6289 NL80211_CMD_GET_REG); 6290 6291 if (!hdr) 6292 return -1; 6293 6294 genl_dump_check_consistent(cb, hdr, &nl80211_fam); 6295 6296 if (nl80211_put_regdom(regdom, msg)) 6297 goto nla_put_failure; 6298 6299 if (!wiphy && reg_last_request_cell_base() && 6300 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE, 6301 NL80211_USER_REG_HINT_CELL_BASE)) 6302 goto nla_put_failure; 6303 6304 if (wiphy && 6305 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy))) 6306 goto nla_put_failure; 6307 6308 if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED && 6309 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG)) 6310 goto nla_put_failure; 6311 6312 genlmsg_end(msg, hdr); 6313 return 0; 6314 6315 nla_put_failure: 6316 genlmsg_cancel(msg, hdr); 6317 return -EMSGSIZE; 6318 } 6319 6320 static int nl80211_get_reg_dump(struct sk_buff *skb, 6321 struct netlink_callback *cb) 6322 { 6323 const struct ieee80211_regdomain *regdom = NULL; 6324 struct cfg80211_registered_device *rdev; 6325 int err, reg_idx, start = cb->args[2]; 6326 6327 rtnl_lock(); 6328 6329 if (cfg80211_regdomain && start == 0) { 6330 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq, 6331 NLM_F_MULTI, NULL, 6332 rtnl_dereference(cfg80211_regdomain)); 6333 if (err < 0) 6334 goto out_err; 6335 } 6336 6337 /* the global regdom is idx 0 */ 6338 reg_idx = 1; 6339 list_for_each_entry(rdev, &cfg80211_rdev_list, list) { 6340 regdom = get_wiphy_regdom(&rdev->wiphy); 6341 if (!regdom) 6342 continue; 6343 6344 if (++reg_idx <= start) 6345 continue; 6346 6347 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq, 6348 NLM_F_MULTI, &rdev->wiphy, regdom); 6349 if (err < 0) { 6350 reg_idx--; 6351 break; 6352 } 6353 } 6354 6355 cb->args[2] = reg_idx; 6356 err = skb->len; 6357 out_err: 6358 rtnl_unlock(); 6359 return err; 6360 } 6361 6362 #ifdef CONFIG_CFG80211_CRDA_SUPPORT 6363 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = { 6364 [NL80211_ATTR_REG_RULE_FLAGS] = { .type = NLA_U32 }, 6365 [NL80211_ATTR_FREQ_RANGE_START] = { .type = NLA_U32 }, 6366 [NL80211_ATTR_FREQ_RANGE_END] = { .type = NLA_U32 }, 6367 [NL80211_ATTR_FREQ_RANGE_MAX_BW] = { .type = NLA_U32 }, 6368 [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN] = { .type = NLA_U32 }, 6369 [NL80211_ATTR_POWER_RULE_MAX_EIRP] = { .type = NLA_U32 }, 6370 [NL80211_ATTR_DFS_CAC_TIME] = { .type = NLA_U32 }, 6371 }; 6372 6373 static int parse_reg_rule(struct nlattr *tb[], 6374 struct ieee80211_reg_rule *reg_rule) 6375 { 6376 struct ieee80211_freq_range *freq_range = ®_rule->freq_range; 6377 struct ieee80211_power_rule *power_rule = ®_rule->power_rule; 6378 6379 if (!tb[NL80211_ATTR_REG_RULE_FLAGS]) 6380 return -EINVAL; 6381 if (!tb[NL80211_ATTR_FREQ_RANGE_START]) 6382 return -EINVAL; 6383 if (!tb[NL80211_ATTR_FREQ_RANGE_END]) 6384 return -EINVAL; 6385 if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]) 6386 return -EINVAL; 6387 if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]) 6388 return -EINVAL; 6389 6390 reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]); 6391 6392 freq_range->start_freq_khz = 6393 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]); 6394 freq_range->end_freq_khz = 6395 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]); 6396 freq_range->max_bandwidth_khz = 6397 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]); 6398 6399 power_rule->max_eirp = 6400 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]); 6401 6402 if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]) 6403 power_rule->max_antenna_gain = 6404 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]); 6405 6406 if (tb[NL80211_ATTR_DFS_CAC_TIME]) 6407 reg_rule->dfs_cac_ms = 6408 nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]); 6409 6410 return 0; 6411 } 6412 6413 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info) 6414 { 6415 struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1]; 6416 struct nlattr *nl_reg_rule; 6417 char *alpha2; 6418 int rem_reg_rules, r; 6419 u32 num_rules = 0, rule_idx = 0, size_of_regd; 6420 enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET; 6421 struct ieee80211_regdomain *rd; 6422 6423 if (!info->attrs[NL80211_ATTR_REG_ALPHA2]) 6424 return -EINVAL; 6425 6426 if (!info->attrs[NL80211_ATTR_REG_RULES]) 6427 return -EINVAL; 6428 6429 alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]); 6430 6431 if (info->attrs[NL80211_ATTR_DFS_REGION]) 6432 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]); 6433 6434 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES], 6435 rem_reg_rules) { 6436 num_rules++; 6437 if (num_rules > NL80211_MAX_SUPP_REG_RULES) 6438 return -EINVAL; 6439 } 6440 6441 if (!reg_is_valid_request(alpha2)) 6442 return -EINVAL; 6443 6444 size_of_regd = sizeof(struct ieee80211_regdomain) + 6445 num_rules * sizeof(struct ieee80211_reg_rule); 6446 6447 rd = kzalloc(size_of_regd, GFP_KERNEL); 6448 if (!rd) 6449 return -ENOMEM; 6450 6451 rd->n_reg_rules = num_rules; 6452 rd->alpha2[0] = alpha2[0]; 6453 rd->alpha2[1] = alpha2[1]; 6454 6455 /* 6456 * Disable DFS master mode if the DFS region was 6457 * not supported or known on this kernel. 6458 */ 6459 if (reg_supported_dfs_region(dfs_region)) 6460 rd->dfs_region = dfs_region; 6461 6462 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES], 6463 rem_reg_rules) { 6464 r = nla_parse_nested(tb, NL80211_REG_RULE_ATTR_MAX, 6465 nl_reg_rule, reg_rule_policy, 6466 info->extack); 6467 if (r) 6468 goto bad_reg; 6469 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]); 6470 if (r) 6471 goto bad_reg; 6472 6473 rule_idx++; 6474 6475 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) { 6476 r = -EINVAL; 6477 goto bad_reg; 6478 } 6479 } 6480 6481 /* set_regdom takes ownership of rd */ 6482 return set_regdom(rd, REGD_SOURCE_CRDA); 6483 bad_reg: 6484 kfree(rd); 6485 return r; 6486 } 6487 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */ 6488 6489 static int validate_scan_freqs(struct nlattr *freqs) 6490 { 6491 struct nlattr *attr1, *attr2; 6492 int n_channels = 0, tmp1, tmp2; 6493 6494 nla_for_each_nested(attr1, freqs, tmp1) 6495 if (nla_len(attr1) != sizeof(u32)) 6496 return 0; 6497 6498 nla_for_each_nested(attr1, freqs, tmp1) { 6499 n_channels++; 6500 /* 6501 * Some hardware has a limited channel list for 6502 * scanning, and it is pretty much nonsensical 6503 * to scan for a channel twice, so disallow that 6504 * and don't require drivers to check that the 6505 * channel list they get isn't longer than what 6506 * they can scan, as long as they can scan all 6507 * the channels they registered at once. 6508 */ 6509 nla_for_each_nested(attr2, freqs, tmp2) 6510 if (attr1 != attr2 && 6511 nla_get_u32(attr1) == nla_get_u32(attr2)) 6512 return 0; 6513 } 6514 6515 return n_channels; 6516 } 6517 6518 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b) 6519 { 6520 return b < NUM_NL80211_BANDS && wiphy->bands[b]; 6521 } 6522 6523 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy, 6524 struct cfg80211_bss_selection *bss_select) 6525 { 6526 struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1]; 6527 struct nlattr *nest; 6528 int err; 6529 bool found = false; 6530 int i; 6531 6532 /* only process one nested attribute */ 6533 nest = nla_data(nla); 6534 if (!nla_ok(nest, nla_len(nest))) 6535 return -EINVAL; 6536 6537 err = nla_parse_nested(attr, NL80211_BSS_SELECT_ATTR_MAX, nest, 6538 nl80211_bss_select_policy, NULL); 6539 if (err) 6540 return err; 6541 6542 /* only one attribute may be given */ 6543 for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) { 6544 if (attr[i]) { 6545 if (found) 6546 return -EINVAL; 6547 found = true; 6548 } 6549 } 6550 6551 bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID; 6552 6553 if (attr[NL80211_BSS_SELECT_ATTR_RSSI]) 6554 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI; 6555 6556 if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) { 6557 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF; 6558 bss_select->param.band_pref = 6559 nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]); 6560 if (!is_band_valid(wiphy, bss_select->param.band_pref)) 6561 return -EINVAL; 6562 } 6563 6564 if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) { 6565 struct nl80211_bss_select_rssi_adjust *adj_param; 6566 6567 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]); 6568 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST; 6569 bss_select->param.adjust.band = adj_param->band; 6570 bss_select->param.adjust.delta = adj_param->delta; 6571 if (!is_band_valid(wiphy, bss_select->param.adjust.band)) 6572 return -EINVAL; 6573 } 6574 6575 /* user-space did not provide behaviour attribute */ 6576 if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID) 6577 return -EINVAL; 6578 6579 if (!(wiphy->bss_select_support & BIT(bss_select->behaviour))) 6580 return -EINVAL; 6581 6582 return 0; 6583 } 6584 6585 static int nl80211_parse_random_mac(struct nlattr **attrs, 6586 u8 *mac_addr, u8 *mac_addr_mask) 6587 { 6588 int i; 6589 6590 if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) { 6591 eth_zero_addr(mac_addr); 6592 eth_zero_addr(mac_addr_mask); 6593 mac_addr[0] = 0x2; 6594 mac_addr_mask[0] = 0x3; 6595 6596 return 0; 6597 } 6598 6599 /* need both or none */ 6600 if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK]) 6601 return -EINVAL; 6602 6603 memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN); 6604 memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN); 6605 6606 /* don't allow or configure an mcast address */ 6607 if (!is_multicast_ether_addr(mac_addr_mask) || 6608 is_multicast_ether_addr(mac_addr)) 6609 return -EINVAL; 6610 6611 /* 6612 * allow users to pass a MAC address that has bits set outside 6613 * of the mask, but don't bother drivers with having to deal 6614 * with such bits 6615 */ 6616 for (i = 0; i < ETH_ALEN; i++) 6617 mac_addr[i] &= mac_addr_mask[i]; 6618 6619 return 0; 6620 } 6621 6622 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev) 6623 { 6624 ASSERT_WDEV_LOCK(wdev); 6625 6626 if (!cfg80211_beaconing_iface_active(wdev)) 6627 return true; 6628 6629 if (!(wdev->chandef.chan->flags & IEEE80211_CHAN_RADAR)) 6630 return true; 6631 6632 return regulatory_pre_cac_allowed(wdev->wiphy); 6633 } 6634 6635 static int 6636 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev, 6637 void *request, struct nlattr **attrs, 6638 bool is_sched_scan) 6639 { 6640 u8 *mac_addr, *mac_addr_mask; 6641 u32 *flags; 6642 enum nl80211_feature_flags randomness_flag; 6643 6644 if (!attrs[NL80211_ATTR_SCAN_FLAGS]) 6645 return 0; 6646 6647 if (is_sched_scan) { 6648 struct cfg80211_sched_scan_request *req = request; 6649 6650 randomness_flag = wdev ? 6651 NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR : 6652 NL80211_FEATURE_ND_RANDOM_MAC_ADDR; 6653 flags = &req->flags; 6654 mac_addr = req->mac_addr; 6655 mac_addr_mask = req->mac_addr_mask; 6656 } else { 6657 struct cfg80211_scan_request *req = request; 6658 6659 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR; 6660 flags = &req->flags; 6661 mac_addr = req->mac_addr; 6662 mac_addr_mask = req->mac_addr_mask; 6663 } 6664 6665 *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]); 6666 6667 if ((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) && 6668 !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) 6669 return -EOPNOTSUPP; 6670 6671 if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) { 6672 int err; 6673 6674 if (!(wiphy->features & randomness_flag) || 6675 (wdev && wdev->current_bss)) 6676 return -EOPNOTSUPP; 6677 6678 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask); 6679 if (err) 6680 return err; 6681 } 6682 6683 if ((*flags & NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME) && 6684 !wiphy_ext_feature_isset(wiphy, 6685 NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME)) 6686 return -EOPNOTSUPP; 6687 6688 if ((*flags & NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP) && 6689 !wiphy_ext_feature_isset(wiphy, 6690 NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP)) 6691 return -EOPNOTSUPP; 6692 6693 if ((*flags & NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) && 6694 !wiphy_ext_feature_isset(wiphy, 6695 NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION)) 6696 return -EOPNOTSUPP; 6697 6698 if ((*flags & NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE) && 6699 !wiphy_ext_feature_isset(wiphy, 6700 NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE)) 6701 return -EOPNOTSUPP; 6702 6703 return 0; 6704 } 6705 6706 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info) 6707 { 6708 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6709 struct wireless_dev *wdev = info->user_ptr[1]; 6710 struct cfg80211_scan_request *request; 6711 struct nlattr *attr; 6712 struct wiphy *wiphy; 6713 int err, tmp, n_ssids = 0, n_channels, i; 6714 size_t ie_len; 6715 6716 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) 6717 return -EINVAL; 6718 6719 wiphy = &rdev->wiphy; 6720 6721 if (wdev->iftype == NL80211_IFTYPE_NAN) 6722 return -EOPNOTSUPP; 6723 6724 if (!rdev->ops->scan) 6725 return -EOPNOTSUPP; 6726 6727 if (rdev->scan_req || rdev->scan_msg) { 6728 err = -EBUSY; 6729 goto unlock; 6730 } 6731 6732 if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) { 6733 n_channels = validate_scan_freqs( 6734 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]); 6735 if (!n_channels) { 6736 err = -EINVAL; 6737 goto unlock; 6738 } 6739 } else { 6740 n_channels = ieee80211_get_num_supported_channels(wiphy); 6741 } 6742 6743 if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) 6744 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) 6745 n_ssids++; 6746 6747 if (n_ssids > wiphy->max_scan_ssids) { 6748 err = -EINVAL; 6749 goto unlock; 6750 } 6751 6752 if (info->attrs[NL80211_ATTR_IE]) 6753 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 6754 else 6755 ie_len = 0; 6756 6757 if (ie_len > wiphy->max_scan_ie_len) { 6758 err = -EINVAL; 6759 goto unlock; 6760 } 6761 6762 request = kzalloc(sizeof(*request) 6763 + sizeof(*request->ssids) * n_ssids 6764 + sizeof(*request->channels) * n_channels 6765 + ie_len, GFP_KERNEL); 6766 if (!request) { 6767 err = -ENOMEM; 6768 goto unlock; 6769 } 6770 6771 if (n_ssids) 6772 request->ssids = (void *)&request->channels[n_channels]; 6773 request->n_ssids = n_ssids; 6774 if (ie_len) { 6775 if (n_ssids) 6776 request->ie = (void *)(request->ssids + n_ssids); 6777 else 6778 request->ie = (void *)(request->channels + n_channels); 6779 } 6780 6781 i = 0; 6782 if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) { 6783 /* user specified, bail out if channel not found */ 6784 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) { 6785 struct ieee80211_channel *chan; 6786 6787 chan = ieee80211_get_channel(wiphy, nla_get_u32(attr)); 6788 6789 if (!chan) { 6790 err = -EINVAL; 6791 goto out_free; 6792 } 6793 6794 /* ignore disabled channels */ 6795 if (chan->flags & IEEE80211_CHAN_DISABLED) 6796 continue; 6797 6798 request->channels[i] = chan; 6799 i++; 6800 } 6801 } else { 6802 enum nl80211_band band; 6803 6804 /* all channels */ 6805 for (band = 0; band < NUM_NL80211_BANDS; band++) { 6806 int j; 6807 6808 if (!wiphy->bands[band]) 6809 continue; 6810 for (j = 0; j < wiphy->bands[band]->n_channels; j++) { 6811 struct ieee80211_channel *chan; 6812 6813 chan = &wiphy->bands[band]->channels[j]; 6814 6815 if (chan->flags & IEEE80211_CHAN_DISABLED) 6816 continue; 6817 6818 request->channels[i] = chan; 6819 i++; 6820 } 6821 } 6822 } 6823 6824 if (!i) { 6825 err = -EINVAL; 6826 goto out_free; 6827 } 6828 6829 request->n_channels = i; 6830 6831 wdev_lock(wdev); 6832 if (!cfg80211_off_channel_oper_allowed(wdev)) { 6833 struct ieee80211_channel *chan; 6834 6835 if (request->n_channels != 1) { 6836 wdev_unlock(wdev); 6837 err = -EBUSY; 6838 goto out_free; 6839 } 6840 6841 chan = request->channels[0]; 6842 if (chan->center_freq != wdev->chandef.chan->center_freq) { 6843 wdev_unlock(wdev); 6844 err = -EBUSY; 6845 goto out_free; 6846 } 6847 } 6848 wdev_unlock(wdev); 6849 6850 i = 0; 6851 if (n_ssids) { 6852 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) { 6853 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) { 6854 err = -EINVAL; 6855 goto out_free; 6856 } 6857 request->ssids[i].ssid_len = nla_len(attr); 6858 memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr)); 6859 i++; 6860 } 6861 } 6862 6863 if (info->attrs[NL80211_ATTR_IE]) { 6864 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 6865 memcpy((void *)request->ie, 6866 nla_data(info->attrs[NL80211_ATTR_IE]), 6867 request->ie_len); 6868 } 6869 6870 for (i = 0; i < NUM_NL80211_BANDS; i++) 6871 if (wiphy->bands[i]) 6872 request->rates[i] = 6873 (1 << wiphy->bands[i]->n_bitrates) - 1; 6874 6875 if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) { 6876 nla_for_each_nested(attr, 6877 info->attrs[NL80211_ATTR_SCAN_SUPP_RATES], 6878 tmp) { 6879 enum nl80211_band band = nla_type(attr); 6880 6881 if (band < 0 || band >= NUM_NL80211_BANDS) { 6882 err = -EINVAL; 6883 goto out_free; 6884 } 6885 6886 if (!wiphy->bands[band]) 6887 continue; 6888 6889 err = ieee80211_get_ratemask(wiphy->bands[band], 6890 nla_data(attr), 6891 nla_len(attr), 6892 &request->rates[band]); 6893 if (err) 6894 goto out_free; 6895 } 6896 } 6897 6898 if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) { 6899 if (!wiphy_ext_feature_isset(wiphy, 6900 NL80211_EXT_FEATURE_SET_SCAN_DWELL)) { 6901 err = -EOPNOTSUPP; 6902 goto out_free; 6903 } 6904 6905 request->duration = 6906 nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]); 6907 request->duration_mandatory = 6908 nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]); 6909 } 6910 6911 err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs, 6912 false); 6913 if (err) 6914 goto out_free; 6915 6916 request->no_cck = 6917 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]); 6918 6919 /* Initial implementation used NL80211_ATTR_MAC to set the specific 6920 * BSSID to scan for. This was problematic because that same attribute 6921 * was already used for another purpose (local random MAC address). The 6922 * NL80211_ATTR_BSSID attribute was added to fix this. For backwards 6923 * compatibility with older userspace components, also use the 6924 * NL80211_ATTR_MAC value here if it can be determined to be used for 6925 * the specific BSSID use case instead of the random MAC address 6926 * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use). 6927 */ 6928 if (info->attrs[NL80211_ATTR_BSSID]) 6929 memcpy(request->bssid, 6930 nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN); 6931 else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) && 6932 info->attrs[NL80211_ATTR_MAC]) 6933 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]), 6934 ETH_ALEN); 6935 else 6936 eth_broadcast_addr(request->bssid); 6937 6938 request->wdev = wdev; 6939 request->wiphy = &rdev->wiphy; 6940 request->scan_start = jiffies; 6941 6942 rdev->scan_req = request; 6943 err = rdev_scan(rdev, request); 6944 6945 if (!err) { 6946 nl80211_send_scan_start(rdev, wdev); 6947 if (wdev->netdev) 6948 dev_hold(wdev->netdev); 6949 } else { 6950 out_free: 6951 rdev->scan_req = NULL; 6952 kfree(request); 6953 } 6954 6955 unlock: 6956 return err; 6957 } 6958 6959 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info) 6960 { 6961 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6962 struct wireless_dev *wdev = info->user_ptr[1]; 6963 6964 if (!rdev->ops->abort_scan) 6965 return -EOPNOTSUPP; 6966 6967 if (rdev->scan_msg) 6968 return 0; 6969 6970 if (!rdev->scan_req) 6971 return -ENOENT; 6972 6973 rdev_abort_scan(rdev, wdev); 6974 return 0; 6975 } 6976 6977 static int 6978 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans, 6979 struct cfg80211_sched_scan_request *request, 6980 struct nlattr **attrs) 6981 { 6982 int tmp, err, i = 0; 6983 struct nlattr *attr; 6984 6985 if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) { 6986 u32 interval; 6987 6988 /* 6989 * If scan plans are not specified, 6990 * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this 6991 * case one scan plan will be set with the specified scan 6992 * interval and infinite number of iterations. 6993 */ 6994 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]); 6995 if (!interval) 6996 return -EINVAL; 6997 6998 request->scan_plans[0].interval = 6999 DIV_ROUND_UP(interval, MSEC_PER_SEC); 7000 if (!request->scan_plans[0].interval) 7001 return -EINVAL; 7002 7003 if (request->scan_plans[0].interval > 7004 wiphy->max_sched_scan_plan_interval) 7005 request->scan_plans[0].interval = 7006 wiphy->max_sched_scan_plan_interval; 7007 7008 return 0; 7009 } 7010 7011 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) { 7012 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1]; 7013 7014 if (WARN_ON(i >= n_plans)) 7015 return -EINVAL; 7016 7017 err = nla_parse_nested(plan, NL80211_SCHED_SCAN_PLAN_MAX, 7018 attr, nl80211_plan_policy, NULL); 7019 if (err) 7020 return err; 7021 7022 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]) 7023 return -EINVAL; 7024 7025 request->scan_plans[i].interval = 7026 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]); 7027 if (!request->scan_plans[i].interval || 7028 request->scan_plans[i].interval > 7029 wiphy->max_sched_scan_plan_interval) 7030 return -EINVAL; 7031 7032 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) { 7033 request->scan_plans[i].iterations = 7034 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]); 7035 if (!request->scan_plans[i].iterations || 7036 (request->scan_plans[i].iterations > 7037 wiphy->max_sched_scan_plan_iterations)) 7038 return -EINVAL; 7039 } else if (i < n_plans - 1) { 7040 /* 7041 * All scan plans but the last one must specify 7042 * a finite number of iterations 7043 */ 7044 return -EINVAL; 7045 } 7046 7047 i++; 7048 } 7049 7050 /* 7051 * The last scan plan must not specify the number of 7052 * iterations, it is supposed to run infinitely 7053 */ 7054 if (request->scan_plans[n_plans - 1].iterations) 7055 return -EINVAL; 7056 7057 return 0; 7058 } 7059 7060 static struct cfg80211_sched_scan_request * 7061 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev, 7062 struct nlattr **attrs, int max_match_sets) 7063 { 7064 struct cfg80211_sched_scan_request *request; 7065 struct nlattr *attr; 7066 int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0; 7067 enum nl80211_band band; 7068 size_t ie_len; 7069 struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1]; 7070 s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF; 7071 7072 if (!is_valid_ie_attr(attrs[NL80211_ATTR_IE])) 7073 return ERR_PTR(-EINVAL); 7074 7075 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) { 7076 n_channels = validate_scan_freqs( 7077 attrs[NL80211_ATTR_SCAN_FREQUENCIES]); 7078 if (!n_channels) 7079 return ERR_PTR(-EINVAL); 7080 } else { 7081 n_channels = ieee80211_get_num_supported_channels(wiphy); 7082 } 7083 7084 if (attrs[NL80211_ATTR_SCAN_SSIDS]) 7085 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS], 7086 tmp) 7087 n_ssids++; 7088 7089 if (n_ssids > wiphy->max_sched_scan_ssids) 7090 return ERR_PTR(-EINVAL); 7091 7092 /* 7093 * First, count the number of 'real' matchsets. Due to an issue with 7094 * the old implementation, matchsets containing only the RSSI attribute 7095 * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default' 7096 * RSSI for all matchsets, rather than their own matchset for reporting 7097 * all APs with a strong RSSI. This is needed to be compatible with 7098 * older userspace that treated a matchset with only the RSSI as the 7099 * global RSSI for all other matchsets - if there are other matchsets. 7100 */ 7101 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) { 7102 nla_for_each_nested(attr, 7103 attrs[NL80211_ATTR_SCHED_SCAN_MATCH], 7104 tmp) { 7105 struct nlattr *rssi; 7106 7107 err = nla_parse_nested(tb, 7108 NL80211_SCHED_SCAN_MATCH_ATTR_MAX, 7109 attr, nl80211_match_policy, 7110 NULL); 7111 if (err) 7112 return ERR_PTR(err); 7113 7114 /* SSID and BSSID are mutually exclusive */ 7115 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] && 7116 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) 7117 return ERR_PTR(-EINVAL); 7118 7119 /* add other standalone attributes here */ 7120 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] || 7121 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) { 7122 n_match_sets++; 7123 continue; 7124 } 7125 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI]; 7126 if (rssi) 7127 default_match_rssi = nla_get_s32(rssi); 7128 } 7129 } 7130 7131 /* However, if there's no other matchset, add the RSSI one */ 7132 if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF) 7133 n_match_sets = 1; 7134 7135 if (n_match_sets > max_match_sets) 7136 return ERR_PTR(-EINVAL); 7137 7138 if (attrs[NL80211_ATTR_IE]) 7139 ie_len = nla_len(attrs[NL80211_ATTR_IE]); 7140 else 7141 ie_len = 0; 7142 7143 if (ie_len > wiphy->max_sched_scan_ie_len) 7144 return ERR_PTR(-EINVAL); 7145 7146 if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) { 7147 /* 7148 * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since 7149 * each scan plan already specifies its own interval 7150 */ 7151 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]) 7152 return ERR_PTR(-EINVAL); 7153 7154 nla_for_each_nested(attr, 7155 attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) 7156 n_plans++; 7157 } else { 7158 /* 7159 * The scan interval attribute is kept for backward 7160 * compatibility. If no scan plans are specified and sched scan 7161 * interval is specified, one scan plan will be set with this 7162 * scan interval and infinite number of iterations. 7163 */ 7164 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]) 7165 return ERR_PTR(-EINVAL); 7166 7167 n_plans = 1; 7168 } 7169 7170 if (!n_plans || n_plans > wiphy->max_sched_scan_plans) 7171 return ERR_PTR(-EINVAL); 7172 7173 if (!wiphy_ext_feature_isset( 7174 wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) && 7175 (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] || 7176 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST])) 7177 return ERR_PTR(-EINVAL); 7178 7179 request = kzalloc(sizeof(*request) 7180 + sizeof(*request->ssids) * n_ssids 7181 + sizeof(*request->match_sets) * n_match_sets 7182 + sizeof(*request->scan_plans) * n_plans 7183 + sizeof(*request->channels) * n_channels 7184 + ie_len, GFP_KERNEL); 7185 if (!request) 7186 return ERR_PTR(-ENOMEM); 7187 7188 if (n_ssids) 7189 request->ssids = (void *)&request->channels[n_channels]; 7190 request->n_ssids = n_ssids; 7191 if (ie_len) { 7192 if (n_ssids) 7193 request->ie = (void *)(request->ssids + n_ssids); 7194 else 7195 request->ie = (void *)(request->channels + n_channels); 7196 } 7197 7198 if (n_match_sets) { 7199 if (request->ie) 7200 request->match_sets = (void *)(request->ie + ie_len); 7201 else if (n_ssids) 7202 request->match_sets = 7203 (void *)(request->ssids + n_ssids); 7204 else 7205 request->match_sets = 7206 (void *)(request->channels + n_channels); 7207 } 7208 request->n_match_sets = n_match_sets; 7209 7210 if (n_match_sets) 7211 request->scan_plans = (void *)(request->match_sets + 7212 n_match_sets); 7213 else if (request->ie) 7214 request->scan_plans = (void *)(request->ie + ie_len); 7215 else if (n_ssids) 7216 request->scan_plans = (void *)(request->ssids + n_ssids); 7217 else 7218 request->scan_plans = (void *)(request->channels + n_channels); 7219 7220 request->n_scan_plans = n_plans; 7221 7222 i = 0; 7223 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) { 7224 /* user specified, bail out if channel not found */ 7225 nla_for_each_nested(attr, 7226 attrs[NL80211_ATTR_SCAN_FREQUENCIES], 7227 tmp) { 7228 struct ieee80211_channel *chan; 7229 7230 chan = ieee80211_get_channel(wiphy, nla_get_u32(attr)); 7231 7232 if (!chan) { 7233 err = -EINVAL; 7234 goto out_free; 7235 } 7236 7237 /* ignore disabled channels */ 7238 if (chan->flags & IEEE80211_CHAN_DISABLED) 7239 continue; 7240 7241 request->channels[i] = chan; 7242 i++; 7243 } 7244 } else { 7245 /* all channels */ 7246 for (band = 0; band < NUM_NL80211_BANDS; band++) { 7247 int j; 7248 7249 if (!wiphy->bands[band]) 7250 continue; 7251 for (j = 0; j < wiphy->bands[band]->n_channels; j++) { 7252 struct ieee80211_channel *chan; 7253 7254 chan = &wiphy->bands[band]->channels[j]; 7255 7256 if (chan->flags & IEEE80211_CHAN_DISABLED) 7257 continue; 7258 7259 request->channels[i] = chan; 7260 i++; 7261 } 7262 } 7263 } 7264 7265 if (!i) { 7266 err = -EINVAL; 7267 goto out_free; 7268 } 7269 7270 request->n_channels = i; 7271 7272 i = 0; 7273 if (n_ssids) { 7274 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS], 7275 tmp) { 7276 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) { 7277 err = -EINVAL; 7278 goto out_free; 7279 } 7280 request->ssids[i].ssid_len = nla_len(attr); 7281 memcpy(request->ssids[i].ssid, nla_data(attr), 7282 nla_len(attr)); 7283 i++; 7284 } 7285 } 7286 7287 i = 0; 7288 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) { 7289 nla_for_each_nested(attr, 7290 attrs[NL80211_ATTR_SCHED_SCAN_MATCH], 7291 tmp) { 7292 struct nlattr *ssid, *bssid, *rssi; 7293 7294 err = nla_parse_nested(tb, 7295 NL80211_SCHED_SCAN_MATCH_ATTR_MAX, 7296 attr, nl80211_match_policy, 7297 NULL); 7298 if (err) 7299 goto out_free; 7300 ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]; 7301 bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]; 7302 if (ssid || bssid) { 7303 if (WARN_ON(i >= n_match_sets)) { 7304 /* this indicates a programming error, 7305 * the loop above should have verified 7306 * things properly 7307 */ 7308 err = -EINVAL; 7309 goto out_free; 7310 } 7311 7312 if (ssid) { 7313 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) { 7314 err = -EINVAL; 7315 goto out_free; 7316 } 7317 memcpy(request->match_sets[i].ssid.ssid, 7318 nla_data(ssid), nla_len(ssid)); 7319 request->match_sets[i].ssid.ssid_len = 7320 nla_len(ssid); 7321 } 7322 if (bssid) { 7323 if (nla_len(bssid) != ETH_ALEN) { 7324 err = -EINVAL; 7325 goto out_free; 7326 } 7327 memcpy(request->match_sets[i].bssid, 7328 nla_data(bssid), ETH_ALEN); 7329 } 7330 7331 /* special attribute - old implementation w/a */ 7332 request->match_sets[i].rssi_thold = 7333 default_match_rssi; 7334 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI]; 7335 if (rssi) 7336 request->match_sets[i].rssi_thold = 7337 nla_get_s32(rssi); 7338 } 7339 i++; 7340 } 7341 7342 /* there was no other matchset, so the RSSI one is alone */ 7343 if (i == 0 && n_match_sets) 7344 request->match_sets[0].rssi_thold = default_match_rssi; 7345 7346 request->min_rssi_thold = INT_MAX; 7347 for (i = 0; i < n_match_sets; i++) 7348 request->min_rssi_thold = 7349 min(request->match_sets[i].rssi_thold, 7350 request->min_rssi_thold); 7351 } else { 7352 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF; 7353 } 7354 7355 if (ie_len) { 7356 request->ie_len = ie_len; 7357 memcpy((void *)request->ie, 7358 nla_data(attrs[NL80211_ATTR_IE]), 7359 request->ie_len); 7360 } 7361 7362 err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true); 7363 if (err) 7364 goto out_free; 7365 7366 if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY]) 7367 request->delay = 7368 nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]); 7369 7370 if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) { 7371 request->relative_rssi = nla_get_s8( 7372 attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]); 7373 request->relative_rssi_set = true; 7374 } 7375 7376 if (request->relative_rssi_set && 7377 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) { 7378 struct nl80211_bss_select_rssi_adjust *rssi_adjust; 7379 7380 rssi_adjust = nla_data( 7381 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]); 7382 request->rssi_adjust.band = rssi_adjust->band; 7383 request->rssi_adjust.delta = rssi_adjust->delta; 7384 if (!is_band_valid(wiphy, request->rssi_adjust.band)) { 7385 err = -EINVAL; 7386 goto out_free; 7387 } 7388 } 7389 7390 err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs); 7391 if (err) 7392 goto out_free; 7393 7394 request->scan_start = jiffies; 7395 7396 return request; 7397 7398 out_free: 7399 kfree(request); 7400 return ERR_PTR(err); 7401 } 7402 7403 static int nl80211_start_sched_scan(struct sk_buff *skb, 7404 struct genl_info *info) 7405 { 7406 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7407 struct net_device *dev = info->user_ptr[1]; 7408 struct wireless_dev *wdev = dev->ieee80211_ptr; 7409 struct cfg80211_sched_scan_request *sched_scan_req; 7410 bool want_multi; 7411 int err; 7412 7413 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start) 7414 return -EOPNOTSUPP; 7415 7416 want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI]; 7417 err = cfg80211_sched_scan_req_possible(rdev, want_multi); 7418 if (err) 7419 return err; 7420 7421 sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev, 7422 info->attrs, 7423 rdev->wiphy.max_match_sets); 7424 7425 err = PTR_ERR_OR_ZERO(sched_scan_req); 7426 if (err) 7427 goto out_err; 7428 7429 /* leave request id zero for legacy request 7430 * or if driver does not support multi-scheduled scan 7431 */ 7432 if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1) { 7433 while (!sched_scan_req->reqid) 7434 sched_scan_req->reqid = rdev->wiphy.cookie_counter++; 7435 } 7436 7437 err = rdev_sched_scan_start(rdev, dev, sched_scan_req); 7438 if (err) 7439 goto out_free; 7440 7441 sched_scan_req->dev = dev; 7442 sched_scan_req->wiphy = &rdev->wiphy; 7443 7444 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 7445 sched_scan_req->owner_nlportid = info->snd_portid; 7446 7447 cfg80211_add_sched_scan_req(rdev, sched_scan_req); 7448 7449 nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN); 7450 return 0; 7451 7452 out_free: 7453 kfree(sched_scan_req); 7454 out_err: 7455 return err; 7456 } 7457 7458 static int nl80211_stop_sched_scan(struct sk_buff *skb, 7459 struct genl_info *info) 7460 { 7461 struct cfg80211_sched_scan_request *req; 7462 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7463 u64 cookie; 7464 7465 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop) 7466 return -EOPNOTSUPP; 7467 7468 if (info->attrs[NL80211_ATTR_COOKIE]) { 7469 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 7470 return __cfg80211_stop_sched_scan(rdev, cookie, false); 7471 } 7472 7473 req = list_first_or_null_rcu(&rdev->sched_scan_req_list, 7474 struct cfg80211_sched_scan_request, 7475 list); 7476 if (!req || req->reqid || 7477 (req->owner_nlportid && 7478 req->owner_nlportid != info->snd_portid)) 7479 return -ENOENT; 7480 7481 return cfg80211_stop_sched_scan_req(rdev, req, false); 7482 } 7483 7484 static int nl80211_start_radar_detection(struct sk_buff *skb, 7485 struct genl_info *info) 7486 { 7487 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7488 struct net_device *dev = info->user_ptr[1]; 7489 struct wireless_dev *wdev = dev->ieee80211_ptr; 7490 struct cfg80211_chan_def chandef; 7491 enum nl80211_dfs_regions dfs_region; 7492 unsigned int cac_time_ms; 7493 int err; 7494 7495 dfs_region = reg_get_dfs_region(wdev->wiphy); 7496 if (dfs_region == NL80211_DFS_UNSET) 7497 return -EINVAL; 7498 7499 err = nl80211_parse_chandef(rdev, info, &chandef); 7500 if (err) 7501 return err; 7502 7503 if (netif_carrier_ok(dev)) 7504 return -EBUSY; 7505 7506 if (wdev->cac_started) 7507 return -EBUSY; 7508 7509 err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, 7510 wdev->iftype); 7511 if (err < 0) 7512 return err; 7513 7514 if (err == 0) 7515 return -EINVAL; 7516 7517 if (!cfg80211_chandef_dfs_usable(wdev->wiphy, &chandef)) 7518 return -EINVAL; 7519 7520 if (!rdev->ops->start_radar_detection) 7521 return -EOPNOTSUPP; 7522 7523 cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef); 7524 if (WARN_ON(!cac_time_ms)) 7525 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS; 7526 7527 err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms); 7528 if (!err) { 7529 wdev->chandef = chandef; 7530 wdev->cac_started = true; 7531 wdev->cac_start_time = jiffies; 7532 wdev->cac_time_ms = cac_time_ms; 7533 } 7534 return err; 7535 } 7536 7537 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info) 7538 { 7539 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7540 struct net_device *dev = info->user_ptr[1]; 7541 struct wireless_dev *wdev = dev->ieee80211_ptr; 7542 struct cfg80211_csa_settings params; 7543 /* csa_attrs is defined static to avoid waste of stack size - this 7544 * function is called under RTNL lock, so this should not be a problem. 7545 */ 7546 static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1]; 7547 int err; 7548 bool need_new_beacon = false; 7549 bool need_handle_dfs_flag = true; 7550 int len, i; 7551 u32 cs_count; 7552 7553 if (!rdev->ops->channel_switch || 7554 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)) 7555 return -EOPNOTSUPP; 7556 7557 switch (dev->ieee80211_ptr->iftype) { 7558 case NL80211_IFTYPE_AP: 7559 case NL80211_IFTYPE_P2P_GO: 7560 need_new_beacon = true; 7561 /* For all modes except AP the handle_dfs flag needs to be 7562 * supplied to tell the kernel that userspace will handle radar 7563 * events when they happen. Otherwise a switch to a channel 7564 * requiring DFS will be rejected. 7565 */ 7566 need_handle_dfs_flag = false; 7567 7568 /* useless if AP is not running */ 7569 if (!wdev->beacon_interval) 7570 return -ENOTCONN; 7571 break; 7572 case NL80211_IFTYPE_ADHOC: 7573 if (!wdev->ssid_len) 7574 return -ENOTCONN; 7575 break; 7576 case NL80211_IFTYPE_MESH_POINT: 7577 if (!wdev->mesh_id_len) 7578 return -ENOTCONN; 7579 break; 7580 default: 7581 return -EOPNOTSUPP; 7582 } 7583 7584 memset(¶ms, 0, sizeof(params)); 7585 7586 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] || 7587 !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]) 7588 return -EINVAL; 7589 7590 /* only important for AP, IBSS and mesh create IEs internally */ 7591 if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES]) 7592 return -EINVAL; 7593 7594 /* Even though the attribute is u32, the specification says 7595 * u8, so let's make sure we don't overflow. 7596 */ 7597 cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]); 7598 if (cs_count > 255) 7599 return -EINVAL; 7600 7601 params.count = cs_count; 7602 7603 if (!need_new_beacon) 7604 goto skip_beacons; 7605 7606 err = nl80211_parse_beacon(info->attrs, ¶ms.beacon_after); 7607 if (err) 7608 return err; 7609 7610 err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX, 7611 info->attrs[NL80211_ATTR_CSA_IES], 7612 nl80211_policy, info->extack); 7613 if (err) 7614 return err; 7615 7616 err = nl80211_parse_beacon(csa_attrs, ¶ms.beacon_csa); 7617 if (err) 7618 return err; 7619 7620 if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]) 7621 return -EINVAL; 7622 7623 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]); 7624 if (!len || (len % sizeof(u16))) 7625 return -EINVAL; 7626 7627 params.n_counter_offsets_beacon = len / sizeof(u16); 7628 if (rdev->wiphy.max_num_csa_counters && 7629 (params.n_counter_offsets_beacon > 7630 rdev->wiphy.max_num_csa_counters)) 7631 return -EINVAL; 7632 7633 params.counter_offsets_beacon = 7634 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]); 7635 7636 /* sanity checks - counters should fit and be the same */ 7637 for (i = 0; i < params.n_counter_offsets_beacon; i++) { 7638 u16 offset = params.counter_offsets_beacon[i]; 7639 7640 if (offset >= params.beacon_csa.tail_len) 7641 return -EINVAL; 7642 7643 if (params.beacon_csa.tail[offset] != params.count) 7644 return -EINVAL; 7645 } 7646 7647 if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) { 7648 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]); 7649 if (!len || (len % sizeof(u16))) 7650 return -EINVAL; 7651 7652 params.n_counter_offsets_presp = len / sizeof(u16); 7653 if (rdev->wiphy.max_num_csa_counters && 7654 (params.n_counter_offsets_presp > 7655 rdev->wiphy.max_num_csa_counters)) 7656 return -EINVAL; 7657 7658 params.counter_offsets_presp = 7659 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]); 7660 7661 /* sanity checks - counters should fit and be the same */ 7662 for (i = 0; i < params.n_counter_offsets_presp; i++) { 7663 u16 offset = params.counter_offsets_presp[i]; 7664 7665 if (offset >= params.beacon_csa.probe_resp_len) 7666 return -EINVAL; 7667 7668 if (params.beacon_csa.probe_resp[offset] != 7669 params.count) 7670 return -EINVAL; 7671 } 7672 } 7673 7674 skip_beacons: 7675 err = nl80211_parse_chandef(rdev, info, ¶ms.chandef); 7676 if (err) 7677 return err; 7678 7679 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms.chandef, 7680 wdev->iftype)) 7681 return -EINVAL; 7682 7683 err = cfg80211_chandef_dfs_required(wdev->wiphy, 7684 ¶ms.chandef, 7685 wdev->iftype); 7686 if (err < 0) 7687 return err; 7688 7689 if (err > 0) { 7690 params.radar_required = true; 7691 if (need_handle_dfs_flag && 7692 !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) { 7693 return -EINVAL; 7694 } 7695 } 7696 7697 if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX]) 7698 params.block_tx = true; 7699 7700 wdev_lock(wdev); 7701 err = rdev_channel_switch(rdev, dev, ¶ms); 7702 wdev_unlock(wdev); 7703 7704 return err; 7705 } 7706 7707 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb, 7708 u32 seq, int flags, 7709 struct cfg80211_registered_device *rdev, 7710 struct wireless_dev *wdev, 7711 struct cfg80211_internal_bss *intbss) 7712 { 7713 struct cfg80211_bss *res = &intbss->pub; 7714 const struct cfg80211_bss_ies *ies; 7715 void *hdr; 7716 struct nlattr *bss; 7717 7718 ASSERT_WDEV_LOCK(wdev); 7719 7720 hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags, 7721 NL80211_CMD_NEW_SCAN_RESULTS); 7722 if (!hdr) 7723 return -1; 7724 7725 genl_dump_check_consistent(cb, hdr, &nl80211_fam); 7726 7727 if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation)) 7728 goto nla_put_failure; 7729 if (wdev->netdev && 7730 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex)) 7731 goto nla_put_failure; 7732 if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 7733 NL80211_ATTR_PAD)) 7734 goto nla_put_failure; 7735 7736 bss = nla_nest_start(msg, NL80211_ATTR_BSS); 7737 if (!bss) 7738 goto nla_put_failure; 7739 if ((!is_zero_ether_addr(res->bssid) && 7740 nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid))) 7741 goto nla_put_failure; 7742 7743 rcu_read_lock(); 7744 /* indicate whether we have probe response data or not */ 7745 if (rcu_access_pointer(res->proberesp_ies) && 7746 nla_put_flag(msg, NL80211_BSS_PRESP_DATA)) 7747 goto fail_unlock_rcu; 7748 7749 /* this pointer prefers to be pointed to probe response data 7750 * but is always valid 7751 */ 7752 ies = rcu_dereference(res->ies); 7753 if (ies) { 7754 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf, 7755 NL80211_BSS_PAD)) 7756 goto fail_unlock_rcu; 7757 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS, 7758 ies->len, ies->data)) 7759 goto fail_unlock_rcu; 7760 } 7761 7762 /* and this pointer is always (unless driver didn't know) beacon data */ 7763 ies = rcu_dereference(res->beacon_ies); 7764 if (ies && ies->from_beacon) { 7765 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf, 7766 NL80211_BSS_PAD)) 7767 goto fail_unlock_rcu; 7768 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES, 7769 ies->len, ies->data)) 7770 goto fail_unlock_rcu; 7771 } 7772 rcu_read_unlock(); 7773 7774 if (res->beacon_interval && 7775 nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval)) 7776 goto nla_put_failure; 7777 if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) || 7778 nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) || 7779 nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) || 7780 nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO, 7781 jiffies_to_msecs(jiffies - intbss->ts))) 7782 goto nla_put_failure; 7783 7784 if (intbss->parent_tsf && 7785 (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF, 7786 intbss->parent_tsf, NL80211_BSS_PAD) || 7787 nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN, 7788 intbss->parent_bssid))) 7789 goto nla_put_failure; 7790 7791 if (intbss->ts_boottime && 7792 nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME, 7793 intbss->ts_boottime, NL80211_BSS_PAD)) 7794 goto nla_put_failure; 7795 7796 switch (rdev->wiphy.signal_type) { 7797 case CFG80211_SIGNAL_TYPE_MBM: 7798 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal)) 7799 goto nla_put_failure; 7800 break; 7801 case CFG80211_SIGNAL_TYPE_UNSPEC: 7802 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal)) 7803 goto nla_put_failure; 7804 break; 7805 default: 7806 break; 7807 } 7808 7809 switch (wdev->iftype) { 7810 case NL80211_IFTYPE_P2P_CLIENT: 7811 case NL80211_IFTYPE_STATION: 7812 if (intbss == wdev->current_bss && 7813 nla_put_u32(msg, NL80211_BSS_STATUS, 7814 NL80211_BSS_STATUS_ASSOCIATED)) 7815 goto nla_put_failure; 7816 break; 7817 case NL80211_IFTYPE_ADHOC: 7818 if (intbss == wdev->current_bss && 7819 nla_put_u32(msg, NL80211_BSS_STATUS, 7820 NL80211_BSS_STATUS_IBSS_JOINED)) 7821 goto nla_put_failure; 7822 break; 7823 default: 7824 break; 7825 } 7826 7827 nla_nest_end(msg, bss); 7828 7829 genlmsg_end(msg, hdr); 7830 return 0; 7831 7832 fail_unlock_rcu: 7833 rcu_read_unlock(); 7834 nla_put_failure: 7835 genlmsg_cancel(msg, hdr); 7836 return -EMSGSIZE; 7837 } 7838 7839 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb) 7840 { 7841 struct cfg80211_registered_device *rdev; 7842 struct cfg80211_internal_bss *scan; 7843 struct wireless_dev *wdev; 7844 int start = cb->args[2], idx = 0; 7845 int err; 7846 7847 rtnl_lock(); 7848 err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev); 7849 if (err) { 7850 rtnl_unlock(); 7851 return err; 7852 } 7853 7854 wdev_lock(wdev); 7855 spin_lock_bh(&rdev->bss_lock); 7856 cfg80211_bss_expire(rdev); 7857 7858 cb->seq = rdev->bss_generation; 7859 7860 list_for_each_entry(scan, &rdev->bss_list, list) { 7861 if (++idx <= start) 7862 continue; 7863 if (nl80211_send_bss(skb, cb, 7864 cb->nlh->nlmsg_seq, NLM_F_MULTI, 7865 rdev, wdev, scan) < 0) { 7866 idx--; 7867 break; 7868 } 7869 } 7870 7871 spin_unlock_bh(&rdev->bss_lock); 7872 wdev_unlock(wdev); 7873 7874 cb->args[2] = idx; 7875 rtnl_unlock(); 7876 7877 return skb->len; 7878 } 7879 7880 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq, 7881 int flags, struct net_device *dev, 7882 bool allow_radio_stats, 7883 struct survey_info *survey) 7884 { 7885 void *hdr; 7886 struct nlattr *infoattr; 7887 7888 /* skip radio stats if userspace didn't request them */ 7889 if (!survey->channel && !allow_radio_stats) 7890 return 0; 7891 7892 hdr = nl80211hdr_put(msg, portid, seq, flags, 7893 NL80211_CMD_NEW_SURVEY_RESULTS); 7894 if (!hdr) 7895 return -ENOMEM; 7896 7897 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 7898 goto nla_put_failure; 7899 7900 infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO); 7901 if (!infoattr) 7902 goto nla_put_failure; 7903 7904 if (survey->channel && 7905 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY, 7906 survey->channel->center_freq)) 7907 goto nla_put_failure; 7908 7909 if ((survey->filled & SURVEY_INFO_NOISE_DBM) && 7910 nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise)) 7911 goto nla_put_failure; 7912 if ((survey->filled & SURVEY_INFO_IN_USE) && 7913 nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE)) 7914 goto nla_put_failure; 7915 if ((survey->filled & SURVEY_INFO_TIME) && 7916 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME, 7917 survey->time, NL80211_SURVEY_INFO_PAD)) 7918 goto nla_put_failure; 7919 if ((survey->filled & SURVEY_INFO_TIME_BUSY) && 7920 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY, 7921 survey->time_busy, NL80211_SURVEY_INFO_PAD)) 7922 goto nla_put_failure; 7923 if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) && 7924 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY, 7925 survey->time_ext_busy, NL80211_SURVEY_INFO_PAD)) 7926 goto nla_put_failure; 7927 if ((survey->filled & SURVEY_INFO_TIME_RX) && 7928 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX, 7929 survey->time_rx, NL80211_SURVEY_INFO_PAD)) 7930 goto nla_put_failure; 7931 if ((survey->filled & SURVEY_INFO_TIME_TX) && 7932 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX, 7933 survey->time_tx, NL80211_SURVEY_INFO_PAD)) 7934 goto nla_put_failure; 7935 if ((survey->filled & SURVEY_INFO_TIME_SCAN) && 7936 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN, 7937 survey->time_scan, NL80211_SURVEY_INFO_PAD)) 7938 goto nla_put_failure; 7939 7940 nla_nest_end(msg, infoattr); 7941 7942 genlmsg_end(msg, hdr); 7943 return 0; 7944 7945 nla_put_failure: 7946 genlmsg_cancel(msg, hdr); 7947 return -EMSGSIZE; 7948 } 7949 7950 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb) 7951 { 7952 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam); 7953 struct survey_info survey; 7954 struct cfg80211_registered_device *rdev; 7955 struct wireless_dev *wdev; 7956 int survey_idx = cb->args[2]; 7957 int res; 7958 bool radio_stats; 7959 7960 rtnl_lock(); 7961 res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev); 7962 if (res) 7963 goto out_err; 7964 7965 /* prepare_wdev_dump parsed the attributes */ 7966 radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS]; 7967 7968 if (!wdev->netdev) { 7969 res = -EINVAL; 7970 goto out_err; 7971 } 7972 7973 if (!rdev->ops->dump_survey) { 7974 res = -EOPNOTSUPP; 7975 goto out_err; 7976 } 7977 7978 while (1) { 7979 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey); 7980 if (res == -ENOENT) 7981 break; 7982 if (res) 7983 goto out_err; 7984 7985 /* don't send disabled channels, but do send non-channel data */ 7986 if (survey.channel && 7987 survey.channel->flags & IEEE80211_CHAN_DISABLED) { 7988 survey_idx++; 7989 continue; 7990 } 7991 7992 if (nl80211_send_survey(skb, 7993 NETLINK_CB(cb->skb).portid, 7994 cb->nlh->nlmsg_seq, NLM_F_MULTI, 7995 wdev->netdev, radio_stats, &survey) < 0) 7996 goto out; 7997 survey_idx++; 7998 } 7999 8000 out: 8001 cb->args[2] = survey_idx; 8002 res = skb->len; 8003 out_err: 8004 rtnl_unlock(); 8005 return res; 8006 } 8007 8008 static bool nl80211_valid_wpa_versions(u32 wpa_versions) 8009 { 8010 return !(wpa_versions & ~(NL80211_WPA_VERSION_1 | 8011 NL80211_WPA_VERSION_2)); 8012 } 8013 8014 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info) 8015 { 8016 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8017 struct net_device *dev = info->user_ptr[1]; 8018 struct ieee80211_channel *chan; 8019 const u8 *bssid, *ssid, *ie = NULL, *auth_data = NULL; 8020 int err, ssid_len, ie_len = 0, auth_data_len = 0; 8021 enum nl80211_auth_type auth_type; 8022 struct key_parse key; 8023 bool local_state_change; 8024 8025 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) 8026 return -EINVAL; 8027 8028 if (!info->attrs[NL80211_ATTR_MAC]) 8029 return -EINVAL; 8030 8031 if (!info->attrs[NL80211_ATTR_AUTH_TYPE]) 8032 return -EINVAL; 8033 8034 if (!info->attrs[NL80211_ATTR_SSID]) 8035 return -EINVAL; 8036 8037 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ]) 8038 return -EINVAL; 8039 8040 err = nl80211_parse_key(info, &key); 8041 if (err) 8042 return err; 8043 8044 if (key.idx >= 0) { 8045 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP) 8046 return -EINVAL; 8047 if (!key.p.key || !key.p.key_len) 8048 return -EINVAL; 8049 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 || 8050 key.p.key_len != WLAN_KEY_LEN_WEP40) && 8051 (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 || 8052 key.p.key_len != WLAN_KEY_LEN_WEP104)) 8053 return -EINVAL; 8054 if (key.idx > 3) 8055 return -EINVAL; 8056 } else { 8057 key.p.key_len = 0; 8058 key.p.key = NULL; 8059 } 8060 8061 if (key.idx >= 0) { 8062 int i; 8063 bool ok = false; 8064 8065 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) { 8066 if (key.p.cipher == rdev->wiphy.cipher_suites[i]) { 8067 ok = true; 8068 break; 8069 } 8070 } 8071 if (!ok) 8072 return -EINVAL; 8073 } 8074 8075 if (!rdev->ops->auth) 8076 return -EOPNOTSUPP; 8077 8078 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 8079 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 8080 return -EOPNOTSUPP; 8081 8082 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 8083 chan = nl80211_get_valid_chan(&rdev->wiphy, 8084 info->attrs[NL80211_ATTR_WIPHY_FREQ]); 8085 if (!chan) 8086 return -EINVAL; 8087 8088 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 8089 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 8090 8091 if (info->attrs[NL80211_ATTR_IE]) { 8092 ie = nla_data(info->attrs[NL80211_ATTR_IE]); 8093 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 8094 } 8095 8096 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]); 8097 if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE)) 8098 return -EINVAL; 8099 8100 if ((auth_type == NL80211_AUTHTYPE_SAE || 8101 auth_type == NL80211_AUTHTYPE_FILS_SK || 8102 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 8103 auth_type == NL80211_AUTHTYPE_FILS_PK) && 8104 !info->attrs[NL80211_ATTR_AUTH_DATA]) 8105 return -EINVAL; 8106 8107 if (info->attrs[NL80211_ATTR_AUTH_DATA]) { 8108 if (auth_type != NL80211_AUTHTYPE_SAE && 8109 auth_type != NL80211_AUTHTYPE_FILS_SK && 8110 auth_type != NL80211_AUTHTYPE_FILS_SK_PFS && 8111 auth_type != NL80211_AUTHTYPE_FILS_PK) 8112 return -EINVAL; 8113 auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]); 8114 auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]); 8115 /* need to include at least Auth Transaction and Status Code */ 8116 if (auth_data_len < 4) 8117 return -EINVAL; 8118 } 8119 8120 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE]; 8121 8122 /* 8123 * Since we no longer track auth state, ignore 8124 * requests to only change local state. 8125 */ 8126 if (local_state_change) 8127 return 0; 8128 8129 wdev_lock(dev->ieee80211_ptr); 8130 err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid, 8131 ssid, ssid_len, ie, ie_len, 8132 key.p.key, key.p.key_len, key.idx, 8133 auth_data, auth_data_len); 8134 wdev_unlock(dev->ieee80211_ptr); 8135 return err; 8136 } 8137 8138 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev, 8139 struct genl_info *info, 8140 struct cfg80211_crypto_settings *settings, 8141 int cipher_limit) 8142 { 8143 memset(settings, 0, sizeof(*settings)); 8144 8145 settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT]; 8146 8147 if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) { 8148 u16 proto; 8149 8150 proto = nla_get_u16( 8151 info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]); 8152 settings->control_port_ethertype = cpu_to_be16(proto); 8153 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) && 8154 proto != ETH_P_PAE) 8155 return -EINVAL; 8156 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]) 8157 settings->control_port_no_encrypt = true; 8158 } else 8159 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE); 8160 8161 if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) { 8162 void *data; 8163 int len, i; 8164 8165 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]); 8166 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]); 8167 settings->n_ciphers_pairwise = len / sizeof(u32); 8168 8169 if (len % sizeof(u32)) 8170 return -EINVAL; 8171 8172 if (settings->n_ciphers_pairwise > cipher_limit) 8173 return -EINVAL; 8174 8175 memcpy(settings->ciphers_pairwise, data, len); 8176 8177 for (i = 0; i < settings->n_ciphers_pairwise; i++) 8178 if (!cfg80211_supported_cipher_suite( 8179 &rdev->wiphy, 8180 settings->ciphers_pairwise[i])) 8181 return -EINVAL; 8182 } 8183 8184 if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) { 8185 settings->cipher_group = 8186 nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]); 8187 if (!cfg80211_supported_cipher_suite(&rdev->wiphy, 8188 settings->cipher_group)) 8189 return -EINVAL; 8190 } 8191 8192 if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) { 8193 settings->wpa_versions = 8194 nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]); 8195 if (!nl80211_valid_wpa_versions(settings->wpa_versions)) 8196 return -EINVAL; 8197 } 8198 8199 if (info->attrs[NL80211_ATTR_AKM_SUITES]) { 8200 void *data; 8201 int len; 8202 8203 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]); 8204 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]); 8205 settings->n_akm_suites = len / sizeof(u32); 8206 8207 if (len % sizeof(u32)) 8208 return -EINVAL; 8209 8210 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES) 8211 return -EINVAL; 8212 8213 memcpy(settings->akm_suites, data, len); 8214 } 8215 8216 if (info->attrs[NL80211_ATTR_PMK]) { 8217 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN) 8218 return -EINVAL; 8219 if (!wiphy_ext_feature_isset(&rdev->wiphy, 8220 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK)) 8221 return -EINVAL; 8222 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]); 8223 } 8224 8225 return 0; 8226 } 8227 8228 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info) 8229 { 8230 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8231 struct net_device *dev = info->user_ptr[1]; 8232 struct ieee80211_channel *chan; 8233 struct cfg80211_assoc_request req = {}; 8234 const u8 *bssid, *ssid; 8235 int err, ssid_len = 0; 8236 8237 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) 8238 return -EINVAL; 8239 8240 if (!info->attrs[NL80211_ATTR_MAC] || 8241 !info->attrs[NL80211_ATTR_SSID] || 8242 !info->attrs[NL80211_ATTR_WIPHY_FREQ]) 8243 return -EINVAL; 8244 8245 if (!rdev->ops->assoc) 8246 return -EOPNOTSUPP; 8247 8248 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 8249 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 8250 return -EOPNOTSUPP; 8251 8252 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 8253 8254 chan = nl80211_get_valid_chan(&rdev->wiphy, 8255 info->attrs[NL80211_ATTR_WIPHY_FREQ]); 8256 if (!chan) 8257 return -EINVAL; 8258 8259 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 8260 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 8261 8262 if (info->attrs[NL80211_ATTR_IE]) { 8263 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 8264 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 8265 } 8266 8267 if (info->attrs[NL80211_ATTR_USE_MFP]) { 8268 enum nl80211_mfp mfp = 8269 nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]); 8270 if (mfp == NL80211_MFP_REQUIRED) 8271 req.use_mfp = true; 8272 else if (mfp != NL80211_MFP_NO) 8273 return -EINVAL; 8274 } 8275 8276 if (info->attrs[NL80211_ATTR_PREV_BSSID]) 8277 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]); 8278 8279 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT])) 8280 req.flags |= ASSOC_REQ_DISABLE_HT; 8281 8282 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 8283 memcpy(&req.ht_capa_mask, 8284 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]), 8285 sizeof(req.ht_capa_mask)); 8286 8287 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) { 8288 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 8289 return -EINVAL; 8290 memcpy(&req.ht_capa, 8291 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]), 8292 sizeof(req.ht_capa)); 8293 } 8294 8295 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT])) 8296 req.flags |= ASSOC_REQ_DISABLE_VHT; 8297 8298 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) 8299 memcpy(&req.vht_capa_mask, 8300 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]), 8301 sizeof(req.vht_capa_mask)); 8302 8303 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) { 8304 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) 8305 return -EINVAL; 8306 memcpy(&req.vht_capa, 8307 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]), 8308 sizeof(req.vht_capa)); 8309 } 8310 8311 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) { 8312 if (!((rdev->wiphy.features & 8313 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) && 8314 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) && 8315 !wiphy_ext_feature_isset(&rdev->wiphy, 8316 NL80211_EXT_FEATURE_RRM)) 8317 return -EINVAL; 8318 req.flags |= ASSOC_REQ_USE_RRM; 8319 } 8320 8321 if (info->attrs[NL80211_ATTR_FILS_KEK]) { 8322 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]); 8323 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]); 8324 if (!info->attrs[NL80211_ATTR_FILS_NONCES]) 8325 return -EINVAL; 8326 req.fils_nonces = 8327 nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]); 8328 } 8329 8330 err = nl80211_crypto_settings(rdev, info, &req.crypto, 1); 8331 if (!err) { 8332 wdev_lock(dev->ieee80211_ptr); 8333 8334 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, 8335 ssid, ssid_len, &req); 8336 8337 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 8338 dev->ieee80211_ptr->conn_owner_nlportid = 8339 info->snd_portid; 8340 memcpy(dev->ieee80211_ptr->disconnect_bssid, 8341 bssid, ETH_ALEN); 8342 } 8343 8344 wdev_unlock(dev->ieee80211_ptr); 8345 } 8346 8347 return err; 8348 } 8349 8350 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info) 8351 { 8352 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8353 struct net_device *dev = info->user_ptr[1]; 8354 const u8 *ie = NULL, *bssid; 8355 int ie_len = 0, err; 8356 u16 reason_code; 8357 bool local_state_change; 8358 8359 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) 8360 return -EINVAL; 8361 8362 if (!info->attrs[NL80211_ATTR_MAC]) 8363 return -EINVAL; 8364 8365 if (!info->attrs[NL80211_ATTR_REASON_CODE]) 8366 return -EINVAL; 8367 8368 if (!rdev->ops->deauth) 8369 return -EOPNOTSUPP; 8370 8371 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 8372 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 8373 return -EOPNOTSUPP; 8374 8375 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 8376 8377 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 8378 if (reason_code == 0) { 8379 /* Reason Code 0 is reserved */ 8380 return -EINVAL; 8381 } 8382 8383 if (info->attrs[NL80211_ATTR_IE]) { 8384 ie = nla_data(info->attrs[NL80211_ATTR_IE]); 8385 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 8386 } 8387 8388 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE]; 8389 8390 wdev_lock(dev->ieee80211_ptr); 8391 err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code, 8392 local_state_change); 8393 wdev_unlock(dev->ieee80211_ptr); 8394 return err; 8395 } 8396 8397 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info) 8398 { 8399 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8400 struct net_device *dev = info->user_ptr[1]; 8401 const u8 *ie = NULL, *bssid; 8402 int ie_len = 0, err; 8403 u16 reason_code; 8404 bool local_state_change; 8405 8406 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) 8407 return -EINVAL; 8408 8409 if (!info->attrs[NL80211_ATTR_MAC]) 8410 return -EINVAL; 8411 8412 if (!info->attrs[NL80211_ATTR_REASON_CODE]) 8413 return -EINVAL; 8414 8415 if (!rdev->ops->disassoc) 8416 return -EOPNOTSUPP; 8417 8418 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 8419 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 8420 return -EOPNOTSUPP; 8421 8422 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 8423 8424 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 8425 if (reason_code == 0) { 8426 /* Reason Code 0 is reserved */ 8427 return -EINVAL; 8428 } 8429 8430 if (info->attrs[NL80211_ATTR_IE]) { 8431 ie = nla_data(info->attrs[NL80211_ATTR_IE]); 8432 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 8433 } 8434 8435 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE]; 8436 8437 wdev_lock(dev->ieee80211_ptr); 8438 err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code, 8439 local_state_change); 8440 wdev_unlock(dev->ieee80211_ptr); 8441 return err; 8442 } 8443 8444 static bool 8445 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev, 8446 int mcast_rate[NUM_NL80211_BANDS], 8447 int rateval) 8448 { 8449 struct wiphy *wiphy = &rdev->wiphy; 8450 bool found = false; 8451 int band, i; 8452 8453 for (band = 0; band < NUM_NL80211_BANDS; band++) { 8454 struct ieee80211_supported_band *sband; 8455 8456 sband = wiphy->bands[band]; 8457 if (!sband) 8458 continue; 8459 8460 for (i = 0; i < sband->n_bitrates; i++) { 8461 if (sband->bitrates[i].bitrate == rateval) { 8462 mcast_rate[band] = i + 1; 8463 found = true; 8464 break; 8465 } 8466 } 8467 } 8468 8469 return found; 8470 } 8471 8472 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info) 8473 { 8474 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8475 struct net_device *dev = info->user_ptr[1]; 8476 struct cfg80211_ibss_params ibss; 8477 struct wiphy *wiphy; 8478 struct cfg80211_cached_keys *connkeys = NULL; 8479 int err; 8480 8481 memset(&ibss, 0, sizeof(ibss)); 8482 8483 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) 8484 return -EINVAL; 8485 8486 if (!info->attrs[NL80211_ATTR_SSID] || 8487 !nla_len(info->attrs[NL80211_ATTR_SSID])) 8488 return -EINVAL; 8489 8490 ibss.beacon_interval = 100; 8491 8492 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) 8493 ibss.beacon_interval = 8494 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]); 8495 8496 err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC, 8497 ibss.beacon_interval); 8498 if (err) 8499 return err; 8500 8501 if (!rdev->ops->join_ibss) 8502 return -EOPNOTSUPP; 8503 8504 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) 8505 return -EOPNOTSUPP; 8506 8507 wiphy = &rdev->wiphy; 8508 8509 if (info->attrs[NL80211_ATTR_MAC]) { 8510 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 8511 8512 if (!is_valid_ether_addr(ibss.bssid)) 8513 return -EINVAL; 8514 } 8515 ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 8516 ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 8517 8518 if (info->attrs[NL80211_ATTR_IE]) { 8519 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 8520 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 8521 } 8522 8523 err = nl80211_parse_chandef(rdev, info, &ibss.chandef); 8524 if (err) 8525 return err; 8526 8527 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef, 8528 NL80211_IFTYPE_ADHOC)) 8529 return -EINVAL; 8530 8531 switch (ibss.chandef.width) { 8532 case NL80211_CHAN_WIDTH_5: 8533 case NL80211_CHAN_WIDTH_10: 8534 case NL80211_CHAN_WIDTH_20_NOHT: 8535 break; 8536 case NL80211_CHAN_WIDTH_20: 8537 case NL80211_CHAN_WIDTH_40: 8538 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)) 8539 return -EINVAL; 8540 break; 8541 case NL80211_CHAN_WIDTH_80: 8542 case NL80211_CHAN_WIDTH_80P80: 8543 case NL80211_CHAN_WIDTH_160: 8544 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)) 8545 return -EINVAL; 8546 if (!wiphy_ext_feature_isset(&rdev->wiphy, 8547 NL80211_EXT_FEATURE_VHT_IBSS)) 8548 return -EINVAL; 8549 break; 8550 default: 8551 return -EINVAL; 8552 } 8553 8554 ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED]; 8555 ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY]; 8556 8557 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) { 8558 u8 *rates = 8559 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 8560 int n_rates = 8561 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 8562 struct ieee80211_supported_band *sband = 8563 wiphy->bands[ibss.chandef.chan->band]; 8564 8565 err = ieee80211_get_ratemask(sband, rates, n_rates, 8566 &ibss.basic_rates); 8567 if (err) 8568 return err; 8569 } 8570 8571 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 8572 memcpy(&ibss.ht_capa_mask, 8573 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]), 8574 sizeof(ibss.ht_capa_mask)); 8575 8576 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) { 8577 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 8578 return -EINVAL; 8579 memcpy(&ibss.ht_capa, 8580 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]), 8581 sizeof(ibss.ht_capa)); 8582 } 8583 8584 if (info->attrs[NL80211_ATTR_MCAST_RATE] && 8585 !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate, 8586 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]))) 8587 return -EINVAL; 8588 8589 if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) { 8590 bool no_ht = false; 8591 8592 connkeys = nl80211_parse_connkeys(rdev, 8593 info->attrs[NL80211_ATTR_KEYS], 8594 &no_ht); 8595 if (IS_ERR(connkeys)) 8596 return PTR_ERR(connkeys); 8597 8598 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) && 8599 no_ht) { 8600 kzfree(connkeys); 8601 return -EINVAL; 8602 } 8603 } 8604 8605 ibss.control_port = 8606 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]); 8607 8608 ibss.userspace_handles_dfs = 8609 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]); 8610 8611 err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys); 8612 if (err) 8613 kzfree(connkeys); 8614 return err; 8615 } 8616 8617 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info) 8618 { 8619 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8620 struct net_device *dev = info->user_ptr[1]; 8621 8622 if (!rdev->ops->leave_ibss) 8623 return -EOPNOTSUPP; 8624 8625 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) 8626 return -EOPNOTSUPP; 8627 8628 return cfg80211_leave_ibss(rdev, dev, false); 8629 } 8630 8631 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info) 8632 { 8633 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8634 struct net_device *dev = info->user_ptr[1]; 8635 int mcast_rate[NUM_NL80211_BANDS]; 8636 u32 nla_rate; 8637 int err; 8638 8639 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC && 8640 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT && 8641 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB) 8642 return -EOPNOTSUPP; 8643 8644 if (!rdev->ops->set_mcast_rate) 8645 return -EOPNOTSUPP; 8646 8647 memset(mcast_rate, 0, sizeof(mcast_rate)); 8648 8649 if (!info->attrs[NL80211_ATTR_MCAST_RATE]) 8650 return -EINVAL; 8651 8652 nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]); 8653 if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate)) 8654 return -EINVAL; 8655 8656 err = rdev_set_mcast_rate(rdev, dev, mcast_rate); 8657 8658 return err; 8659 } 8660 8661 static struct sk_buff * 8662 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev, 8663 struct wireless_dev *wdev, int approxlen, 8664 u32 portid, u32 seq, enum nl80211_commands cmd, 8665 enum nl80211_attrs attr, 8666 const struct nl80211_vendor_cmd_info *info, 8667 gfp_t gfp) 8668 { 8669 struct sk_buff *skb; 8670 void *hdr; 8671 struct nlattr *data; 8672 8673 skb = nlmsg_new(approxlen + 100, gfp); 8674 if (!skb) 8675 return NULL; 8676 8677 hdr = nl80211hdr_put(skb, portid, seq, 0, cmd); 8678 if (!hdr) { 8679 kfree_skb(skb); 8680 return NULL; 8681 } 8682 8683 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx)) 8684 goto nla_put_failure; 8685 8686 if (info) { 8687 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID, 8688 info->vendor_id)) 8689 goto nla_put_failure; 8690 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD, 8691 info->subcmd)) 8692 goto nla_put_failure; 8693 } 8694 8695 if (wdev) { 8696 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV, 8697 wdev_id(wdev), NL80211_ATTR_PAD)) 8698 goto nla_put_failure; 8699 if (wdev->netdev && 8700 nla_put_u32(skb, NL80211_ATTR_IFINDEX, 8701 wdev->netdev->ifindex)) 8702 goto nla_put_failure; 8703 } 8704 8705 data = nla_nest_start(skb, attr); 8706 if (!data) 8707 goto nla_put_failure; 8708 8709 ((void **)skb->cb)[0] = rdev; 8710 ((void **)skb->cb)[1] = hdr; 8711 ((void **)skb->cb)[2] = data; 8712 8713 return skb; 8714 8715 nla_put_failure: 8716 kfree_skb(skb); 8717 return NULL; 8718 } 8719 8720 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy, 8721 struct wireless_dev *wdev, 8722 enum nl80211_commands cmd, 8723 enum nl80211_attrs attr, 8724 int vendor_event_idx, 8725 int approxlen, gfp_t gfp) 8726 { 8727 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 8728 const struct nl80211_vendor_cmd_info *info; 8729 8730 switch (cmd) { 8731 case NL80211_CMD_TESTMODE: 8732 if (WARN_ON(vendor_event_idx != -1)) 8733 return NULL; 8734 info = NULL; 8735 break; 8736 case NL80211_CMD_VENDOR: 8737 if (WARN_ON(vendor_event_idx < 0 || 8738 vendor_event_idx >= wiphy->n_vendor_events)) 8739 return NULL; 8740 info = &wiphy->vendor_events[vendor_event_idx]; 8741 break; 8742 default: 8743 WARN_ON(1); 8744 return NULL; 8745 } 8746 8747 return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, 0, 0, 8748 cmd, attr, info, gfp); 8749 } 8750 EXPORT_SYMBOL(__cfg80211_alloc_event_skb); 8751 8752 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp) 8753 { 8754 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0]; 8755 void *hdr = ((void **)skb->cb)[1]; 8756 struct nlattr *data = ((void **)skb->cb)[2]; 8757 enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE; 8758 8759 /* clear CB data for netlink core to own from now on */ 8760 memset(skb->cb, 0, sizeof(skb->cb)); 8761 8762 nla_nest_end(skb, data); 8763 genlmsg_end(skb, hdr); 8764 8765 if (data->nla_type == NL80211_ATTR_VENDOR_DATA) 8766 mcgrp = NL80211_MCGRP_VENDOR; 8767 8768 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0, 8769 mcgrp, gfp); 8770 } 8771 EXPORT_SYMBOL(__cfg80211_send_event_skb); 8772 8773 #ifdef CONFIG_NL80211_TESTMODE 8774 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info) 8775 { 8776 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8777 struct wireless_dev *wdev = 8778 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs); 8779 int err; 8780 8781 if (!rdev->ops->testmode_cmd) 8782 return -EOPNOTSUPP; 8783 8784 if (IS_ERR(wdev)) { 8785 err = PTR_ERR(wdev); 8786 if (err != -EINVAL) 8787 return err; 8788 wdev = NULL; 8789 } else if (wdev->wiphy != &rdev->wiphy) { 8790 return -EINVAL; 8791 } 8792 8793 if (!info->attrs[NL80211_ATTR_TESTDATA]) 8794 return -EINVAL; 8795 8796 rdev->cur_cmd_info = info; 8797 err = rdev_testmode_cmd(rdev, wdev, 8798 nla_data(info->attrs[NL80211_ATTR_TESTDATA]), 8799 nla_len(info->attrs[NL80211_ATTR_TESTDATA])); 8800 rdev->cur_cmd_info = NULL; 8801 8802 return err; 8803 } 8804 8805 static int nl80211_testmode_dump(struct sk_buff *skb, 8806 struct netlink_callback *cb) 8807 { 8808 struct cfg80211_registered_device *rdev; 8809 int err; 8810 long phy_idx; 8811 void *data = NULL; 8812 int data_len = 0; 8813 8814 rtnl_lock(); 8815 8816 if (cb->args[0]) { 8817 /* 8818 * 0 is a valid index, but not valid for args[0], 8819 * so we need to offset by 1. 8820 */ 8821 phy_idx = cb->args[0] - 1; 8822 8823 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx); 8824 if (!rdev) { 8825 err = -ENOENT; 8826 goto out_err; 8827 } 8828 } else { 8829 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam); 8830 8831 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, 8832 attrbuf, nl80211_fam.maxattr, 8833 nl80211_policy, NULL); 8834 if (err) 8835 goto out_err; 8836 8837 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf); 8838 if (IS_ERR(rdev)) { 8839 err = PTR_ERR(rdev); 8840 goto out_err; 8841 } 8842 phy_idx = rdev->wiphy_idx; 8843 8844 if (attrbuf[NL80211_ATTR_TESTDATA]) 8845 cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA]; 8846 } 8847 8848 if (cb->args[1]) { 8849 data = nla_data((void *)cb->args[1]); 8850 data_len = nla_len((void *)cb->args[1]); 8851 } 8852 8853 if (!rdev->ops->testmode_dump) { 8854 err = -EOPNOTSUPP; 8855 goto out_err; 8856 } 8857 8858 while (1) { 8859 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid, 8860 cb->nlh->nlmsg_seq, NLM_F_MULTI, 8861 NL80211_CMD_TESTMODE); 8862 struct nlattr *tmdata; 8863 8864 if (!hdr) 8865 break; 8866 8867 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) { 8868 genlmsg_cancel(skb, hdr); 8869 break; 8870 } 8871 8872 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA); 8873 if (!tmdata) { 8874 genlmsg_cancel(skb, hdr); 8875 break; 8876 } 8877 err = rdev_testmode_dump(rdev, skb, cb, data, data_len); 8878 nla_nest_end(skb, tmdata); 8879 8880 if (err == -ENOBUFS || err == -ENOENT) { 8881 genlmsg_cancel(skb, hdr); 8882 break; 8883 } else if (err) { 8884 genlmsg_cancel(skb, hdr); 8885 goto out_err; 8886 } 8887 8888 genlmsg_end(skb, hdr); 8889 } 8890 8891 err = skb->len; 8892 /* see above */ 8893 cb->args[0] = phy_idx + 1; 8894 out_err: 8895 rtnl_unlock(); 8896 return err; 8897 } 8898 #endif 8899 8900 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info) 8901 { 8902 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8903 struct net_device *dev = info->user_ptr[1]; 8904 struct cfg80211_connect_params connect; 8905 struct wiphy *wiphy; 8906 struct cfg80211_cached_keys *connkeys = NULL; 8907 int err; 8908 8909 memset(&connect, 0, sizeof(connect)); 8910 8911 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) 8912 return -EINVAL; 8913 8914 if (!info->attrs[NL80211_ATTR_SSID] || 8915 !nla_len(info->attrs[NL80211_ATTR_SSID])) 8916 return -EINVAL; 8917 8918 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) { 8919 connect.auth_type = 8920 nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]); 8921 if (!nl80211_valid_auth_type(rdev, connect.auth_type, 8922 NL80211_CMD_CONNECT)) 8923 return -EINVAL; 8924 } else 8925 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC; 8926 8927 connect.privacy = info->attrs[NL80211_ATTR_PRIVACY]; 8928 8929 if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] && 8930 !wiphy_ext_feature_isset(&rdev->wiphy, 8931 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X)) 8932 return -EINVAL; 8933 connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS]; 8934 8935 err = nl80211_crypto_settings(rdev, info, &connect.crypto, 8936 NL80211_MAX_NR_CIPHER_SUITES); 8937 if (err) 8938 return err; 8939 8940 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 8941 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 8942 return -EOPNOTSUPP; 8943 8944 wiphy = &rdev->wiphy; 8945 8946 connect.bg_scan_period = -1; 8947 if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] && 8948 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) { 8949 connect.bg_scan_period = 8950 nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]); 8951 } 8952 8953 if (info->attrs[NL80211_ATTR_MAC]) 8954 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 8955 else if (info->attrs[NL80211_ATTR_MAC_HINT]) 8956 connect.bssid_hint = 8957 nla_data(info->attrs[NL80211_ATTR_MAC_HINT]); 8958 connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 8959 connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 8960 8961 if (info->attrs[NL80211_ATTR_IE]) { 8962 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 8963 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 8964 } 8965 8966 if (info->attrs[NL80211_ATTR_USE_MFP]) { 8967 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]); 8968 if (connect.mfp == NL80211_MFP_OPTIONAL && 8969 !wiphy_ext_feature_isset(&rdev->wiphy, 8970 NL80211_EXT_FEATURE_MFP_OPTIONAL)) 8971 return -EOPNOTSUPP; 8972 8973 if (connect.mfp != NL80211_MFP_REQUIRED && 8974 connect.mfp != NL80211_MFP_NO && 8975 connect.mfp != NL80211_MFP_OPTIONAL) 8976 return -EINVAL; 8977 } else { 8978 connect.mfp = NL80211_MFP_NO; 8979 } 8980 8981 if (info->attrs[NL80211_ATTR_PREV_BSSID]) 8982 connect.prev_bssid = 8983 nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]); 8984 8985 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 8986 connect.channel = nl80211_get_valid_chan( 8987 wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]); 8988 if (!connect.channel) 8989 return -EINVAL; 8990 } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) { 8991 connect.channel_hint = nl80211_get_valid_chan( 8992 wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]); 8993 if (!connect.channel_hint) 8994 return -EINVAL; 8995 } 8996 8997 if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) { 8998 connkeys = nl80211_parse_connkeys(rdev, 8999 info->attrs[NL80211_ATTR_KEYS], NULL); 9000 if (IS_ERR(connkeys)) 9001 return PTR_ERR(connkeys); 9002 } 9003 9004 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT])) 9005 connect.flags |= ASSOC_REQ_DISABLE_HT; 9006 9007 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 9008 memcpy(&connect.ht_capa_mask, 9009 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]), 9010 sizeof(connect.ht_capa_mask)); 9011 9012 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) { 9013 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) { 9014 kzfree(connkeys); 9015 return -EINVAL; 9016 } 9017 memcpy(&connect.ht_capa, 9018 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]), 9019 sizeof(connect.ht_capa)); 9020 } 9021 9022 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT])) 9023 connect.flags |= ASSOC_REQ_DISABLE_VHT; 9024 9025 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) 9026 memcpy(&connect.vht_capa_mask, 9027 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]), 9028 sizeof(connect.vht_capa_mask)); 9029 9030 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) { 9031 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) { 9032 kzfree(connkeys); 9033 return -EINVAL; 9034 } 9035 memcpy(&connect.vht_capa, 9036 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]), 9037 sizeof(connect.vht_capa)); 9038 } 9039 9040 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) { 9041 if (!((rdev->wiphy.features & 9042 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) && 9043 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) && 9044 !wiphy_ext_feature_isset(&rdev->wiphy, 9045 NL80211_EXT_FEATURE_RRM)) { 9046 kzfree(connkeys); 9047 return -EINVAL; 9048 } 9049 connect.flags |= ASSOC_REQ_USE_RRM; 9050 } 9051 9052 connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]); 9053 if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) { 9054 kzfree(connkeys); 9055 return -EOPNOTSUPP; 9056 } 9057 9058 if (info->attrs[NL80211_ATTR_BSS_SELECT]) { 9059 /* bss selection makes no sense if bssid is set */ 9060 if (connect.bssid) { 9061 kzfree(connkeys); 9062 return -EINVAL; 9063 } 9064 9065 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT], 9066 wiphy, &connect.bss_select); 9067 if (err) { 9068 kzfree(connkeys); 9069 return err; 9070 } 9071 } 9072 9073 if (wiphy_ext_feature_isset(&rdev->wiphy, 9074 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) && 9075 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] && 9076 info->attrs[NL80211_ATTR_FILS_ERP_REALM] && 9077 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] && 9078 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 9079 connect.fils_erp_username = 9080 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 9081 connect.fils_erp_username_len = 9082 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 9083 connect.fils_erp_realm = 9084 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 9085 connect.fils_erp_realm_len = 9086 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 9087 connect.fils_erp_next_seq_num = 9088 nla_get_u16( 9089 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]); 9090 connect.fils_erp_rrk = 9091 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 9092 connect.fils_erp_rrk_len = 9093 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 9094 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] || 9095 info->attrs[NL80211_ATTR_FILS_ERP_REALM] || 9096 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] || 9097 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 9098 kzfree(connkeys); 9099 return -EINVAL; 9100 } 9101 9102 wdev_lock(dev->ieee80211_ptr); 9103 9104 err = cfg80211_connect(rdev, dev, &connect, connkeys, 9105 connect.prev_bssid); 9106 if (err) 9107 kzfree(connkeys); 9108 9109 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 9110 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid; 9111 if (connect.bssid) 9112 memcpy(dev->ieee80211_ptr->disconnect_bssid, 9113 connect.bssid, ETH_ALEN); 9114 else 9115 memset(dev->ieee80211_ptr->disconnect_bssid, 9116 0, ETH_ALEN); 9117 } 9118 9119 wdev_unlock(dev->ieee80211_ptr); 9120 9121 return err; 9122 } 9123 9124 static int nl80211_update_connect_params(struct sk_buff *skb, 9125 struct genl_info *info) 9126 { 9127 struct cfg80211_connect_params connect = {}; 9128 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9129 struct net_device *dev = info->user_ptr[1]; 9130 struct wireless_dev *wdev = dev->ieee80211_ptr; 9131 u32 changed = 0; 9132 int ret; 9133 9134 if (!rdev->ops->update_connect_params) 9135 return -EOPNOTSUPP; 9136 9137 if (info->attrs[NL80211_ATTR_IE]) { 9138 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) 9139 return -EINVAL; 9140 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 9141 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 9142 changed |= UPDATE_ASSOC_IES; 9143 } 9144 9145 wdev_lock(dev->ieee80211_ptr); 9146 if (!wdev->current_bss) 9147 ret = -ENOLINK; 9148 else 9149 ret = rdev_update_connect_params(rdev, dev, &connect, changed); 9150 wdev_unlock(dev->ieee80211_ptr); 9151 9152 return ret; 9153 } 9154 9155 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info) 9156 { 9157 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9158 struct net_device *dev = info->user_ptr[1]; 9159 u16 reason; 9160 int ret; 9161 9162 if (!info->attrs[NL80211_ATTR_REASON_CODE]) 9163 reason = WLAN_REASON_DEAUTH_LEAVING; 9164 else 9165 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 9166 9167 if (reason == 0) 9168 return -EINVAL; 9169 9170 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 9171 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 9172 return -EOPNOTSUPP; 9173 9174 wdev_lock(dev->ieee80211_ptr); 9175 ret = cfg80211_disconnect(rdev, dev, reason, true); 9176 wdev_unlock(dev->ieee80211_ptr); 9177 return ret; 9178 } 9179 9180 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info) 9181 { 9182 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9183 struct net *net; 9184 int err; 9185 9186 if (info->attrs[NL80211_ATTR_PID]) { 9187 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]); 9188 9189 net = get_net_ns_by_pid(pid); 9190 } else if (info->attrs[NL80211_ATTR_NETNS_FD]) { 9191 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]); 9192 9193 net = get_net_ns_by_fd(fd); 9194 } else { 9195 return -EINVAL; 9196 } 9197 9198 if (IS_ERR(net)) 9199 return PTR_ERR(net); 9200 9201 err = 0; 9202 9203 /* check if anything to do */ 9204 if (!net_eq(wiphy_net(&rdev->wiphy), net)) 9205 err = cfg80211_switch_netns(rdev, net); 9206 9207 put_net(net); 9208 return err; 9209 } 9210 9211 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info) 9212 { 9213 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9214 int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev, 9215 struct cfg80211_pmksa *pmksa) = NULL; 9216 struct net_device *dev = info->user_ptr[1]; 9217 struct cfg80211_pmksa pmksa; 9218 9219 memset(&pmksa, 0, sizeof(struct cfg80211_pmksa)); 9220 9221 if (!info->attrs[NL80211_ATTR_PMKID]) 9222 return -EINVAL; 9223 9224 pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]); 9225 9226 if (info->attrs[NL80211_ATTR_MAC]) { 9227 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 9228 } else if (info->attrs[NL80211_ATTR_SSID] && 9229 info->attrs[NL80211_ATTR_FILS_CACHE_ID] && 9230 (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA || 9231 info->attrs[NL80211_ATTR_PMK])) { 9232 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 9233 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 9234 pmksa.cache_id = 9235 nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]); 9236 } else { 9237 return -EINVAL; 9238 } 9239 if (info->attrs[NL80211_ATTR_PMK]) { 9240 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]); 9241 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]); 9242 } 9243 9244 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 9245 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 9246 return -EOPNOTSUPP; 9247 9248 switch (info->genlhdr->cmd) { 9249 case NL80211_CMD_SET_PMKSA: 9250 rdev_ops = rdev->ops->set_pmksa; 9251 break; 9252 case NL80211_CMD_DEL_PMKSA: 9253 rdev_ops = rdev->ops->del_pmksa; 9254 break; 9255 default: 9256 WARN_ON(1); 9257 break; 9258 } 9259 9260 if (!rdev_ops) 9261 return -EOPNOTSUPP; 9262 9263 return rdev_ops(&rdev->wiphy, dev, &pmksa); 9264 } 9265 9266 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info) 9267 { 9268 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9269 struct net_device *dev = info->user_ptr[1]; 9270 9271 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 9272 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 9273 return -EOPNOTSUPP; 9274 9275 if (!rdev->ops->flush_pmksa) 9276 return -EOPNOTSUPP; 9277 9278 return rdev_flush_pmksa(rdev, dev); 9279 } 9280 9281 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info) 9282 { 9283 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9284 struct net_device *dev = info->user_ptr[1]; 9285 u8 action_code, dialog_token; 9286 u32 peer_capability = 0; 9287 u16 status_code; 9288 u8 *peer; 9289 bool initiator; 9290 9291 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) || 9292 !rdev->ops->tdls_mgmt) 9293 return -EOPNOTSUPP; 9294 9295 if (!info->attrs[NL80211_ATTR_TDLS_ACTION] || 9296 !info->attrs[NL80211_ATTR_STATUS_CODE] || 9297 !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] || 9298 !info->attrs[NL80211_ATTR_IE] || 9299 !info->attrs[NL80211_ATTR_MAC]) 9300 return -EINVAL; 9301 9302 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 9303 action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]); 9304 status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]); 9305 dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]); 9306 initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]); 9307 if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]) 9308 peer_capability = 9309 nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]); 9310 9311 return rdev_tdls_mgmt(rdev, dev, peer, action_code, 9312 dialog_token, status_code, peer_capability, 9313 initiator, 9314 nla_data(info->attrs[NL80211_ATTR_IE]), 9315 nla_len(info->attrs[NL80211_ATTR_IE])); 9316 } 9317 9318 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info) 9319 { 9320 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9321 struct net_device *dev = info->user_ptr[1]; 9322 enum nl80211_tdls_operation operation; 9323 u8 *peer; 9324 9325 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) || 9326 !rdev->ops->tdls_oper) 9327 return -EOPNOTSUPP; 9328 9329 if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] || 9330 !info->attrs[NL80211_ATTR_MAC]) 9331 return -EINVAL; 9332 9333 operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]); 9334 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 9335 9336 return rdev_tdls_oper(rdev, dev, peer, operation); 9337 } 9338 9339 static int nl80211_remain_on_channel(struct sk_buff *skb, 9340 struct genl_info *info) 9341 { 9342 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9343 struct wireless_dev *wdev = info->user_ptr[1]; 9344 struct cfg80211_chan_def chandef; 9345 const struct cfg80211_chan_def *compat_chandef; 9346 struct sk_buff *msg; 9347 void *hdr; 9348 u64 cookie; 9349 u32 duration; 9350 int err; 9351 9352 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] || 9353 !info->attrs[NL80211_ATTR_DURATION]) 9354 return -EINVAL; 9355 9356 duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]); 9357 9358 if (!rdev->ops->remain_on_channel || 9359 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)) 9360 return -EOPNOTSUPP; 9361 9362 /* 9363 * We should be on that channel for at least a minimum amount of 9364 * time (10ms) but no longer than the driver supports. 9365 */ 9366 if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME || 9367 duration > rdev->wiphy.max_remain_on_channel_duration) 9368 return -EINVAL; 9369 9370 err = nl80211_parse_chandef(rdev, info, &chandef); 9371 if (err) 9372 return err; 9373 9374 wdev_lock(wdev); 9375 if (!cfg80211_off_channel_oper_allowed(wdev) && 9376 !cfg80211_chandef_identical(&wdev->chandef, &chandef)) { 9377 compat_chandef = cfg80211_chandef_compatible(&wdev->chandef, 9378 &chandef); 9379 if (compat_chandef != &chandef) { 9380 wdev_unlock(wdev); 9381 return -EBUSY; 9382 } 9383 } 9384 wdev_unlock(wdev); 9385 9386 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 9387 if (!msg) 9388 return -ENOMEM; 9389 9390 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 9391 NL80211_CMD_REMAIN_ON_CHANNEL); 9392 if (!hdr) { 9393 err = -ENOBUFS; 9394 goto free_msg; 9395 } 9396 9397 err = rdev_remain_on_channel(rdev, wdev, chandef.chan, 9398 duration, &cookie); 9399 9400 if (err) 9401 goto free_msg; 9402 9403 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 9404 NL80211_ATTR_PAD)) 9405 goto nla_put_failure; 9406 9407 genlmsg_end(msg, hdr); 9408 9409 return genlmsg_reply(msg, info); 9410 9411 nla_put_failure: 9412 err = -ENOBUFS; 9413 free_msg: 9414 nlmsg_free(msg); 9415 return err; 9416 } 9417 9418 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb, 9419 struct genl_info *info) 9420 { 9421 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9422 struct wireless_dev *wdev = info->user_ptr[1]; 9423 u64 cookie; 9424 9425 if (!info->attrs[NL80211_ATTR_COOKIE]) 9426 return -EINVAL; 9427 9428 if (!rdev->ops->cancel_remain_on_channel) 9429 return -EOPNOTSUPP; 9430 9431 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 9432 9433 return rdev_cancel_remain_on_channel(rdev, wdev, cookie); 9434 } 9435 9436 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb, 9437 struct genl_info *info) 9438 { 9439 struct cfg80211_bitrate_mask mask; 9440 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9441 struct net_device *dev = info->user_ptr[1]; 9442 int err; 9443 9444 if (!rdev->ops->set_bitrate_mask) 9445 return -EOPNOTSUPP; 9446 9447 err = nl80211_parse_tx_bitrate_mask(info, &mask); 9448 if (err) 9449 return err; 9450 9451 return rdev_set_bitrate_mask(rdev, dev, NULL, &mask); 9452 } 9453 9454 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info) 9455 { 9456 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9457 struct wireless_dev *wdev = info->user_ptr[1]; 9458 u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION; 9459 9460 if (!info->attrs[NL80211_ATTR_FRAME_MATCH]) 9461 return -EINVAL; 9462 9463 if (info->attrs[NL80211_ATTR_FRAME_TYPE]) 9464 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]); 9465 9466 switch (wdev->iftype) { 9467 case NL80211_IFTYPE_STATION: 9468 case NL80211_IFTYPE_ADHOC: 9469 case NL80211_IFTYPE_P2P_CLIENT: 9470 case NL80211_IFTYPE_AP: 9471 case NL80211_IFTYPE_AP_VLAN: 9472 case NL80211_IFTYPE_MESH_POINT: 9473 case NL80211_IFTYPE_P2P_GO: 9474 case NL80211_IFTYPE_P2P_DEVICE: 9475 break; 9476 case NL80211_IFTYPE_NAN: 9477 default: 9478 return -EOPNOTSUPP; 9479 } 9480 9481 /* not much point in registering if we can't reply */ 9482 if (!rdev->ops->mgmt_tx) 9483 return -EOPNOTSUPP; 9484 9485 return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type, 9486 nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]), 9487 nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH])); 9488 } 9489 9490 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info) 9491 { 9492 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9493 struct wireless_dev *wdev = info->user_ptr[1]; 9494 struct cfg80211_chan_def chandef; 9495 int err; 9496 void *hdr = NULL; 9497 u64 cookie; 9498 struct sk_buff *msg = NULL; 9499 struct cfg80211_mgmt_tx_params params = { 9500 .dont_wait_for_ack = 9501 info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK], 9502 }; 9503 9504 if (!info->attrs[NL80211_ATTR_FRAME]) 9505 return -EINVAL; 9506 9507 if (!rdev->ops->mgmt_tx) 9508 return -EOPNOTSUPP; 9509 9510 switch (wdev->iftype) { 9511 case NL80211_IFTYPE_P2P_DEVICE: 9512 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ]) 9513 return -EINVAL; 9514 case NL80211_IFTYPE_STATION: 9515 case NL80211_IFTYPE_ADHOC: 9516 case NL80211_IFTYPE_P2P_CLIENT: 9517 case NL80211_IFTYPE_AP: 9518 case NL80211_IFTYPE_AP_VLAN: 9519 case NL80211_IFTYPE_MESH_POINT: 9520 case NL80211_IFTYPE_P2P_GO: 9521 break; 9522 case NL80211_IFTYPE_NAN: 9523 default: 9524 return -EOPNOTSUPP; 9525 } 9526 9527 if (info->attrs[NL80211_ATTR_DURATION]) { 9528 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX)) 9529 return -EINVAL; 9530 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]); 9531 9532 /* 9533 * We should wait on the channel for at least a minimum amount 9534 * of time (10ms) but no longer than the driver supports. 9535 */ 9536 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME || 9537 params.wait > rdev->wiphy.max_remain_on_channel_duration) 9538 return -EINVAL; 9539 } 9540 9541 params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK]; 9542 9543 if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX)) 9544 return -EINVAL; 9545 9546 params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]); 9547 9548 /* get the channel if any has been specified, otherwise pass NULL to 9549 * the driver. The latter will use the current one 9550 */ 9551 chandef.chan = NULL; 9552 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 9553 err = nl80211_parse_chandef(rdev, info, &chandef); 9554 if (err) 9555 return err; 9556 } 9557 9558 if (!chandef.chan && params.offchan) 9559 return -EINVAL; 9560 9561 wdev_lock(wdev); 9562 if (params.offchan && !cfg80211_off_channel_oper_allowed(wdev)) { 9563 wdev_unlock(wdev); 9564 return -EBUSY; 9565 } 9566 wdev_unlock(wdev); 9567 9568 params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]); 9569 params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]); 9570 9571 if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) { 9572 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]); 9573 int i; 9574 9575 if (len % sizeof(u16)) 9576 return -EINVAL; 9577 9578 params.n_csa_offsets = len / sizeof(u16); 9579 params.csa_offsets = 9580 nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]); 9581 9582 /* check that all the offsets fit the frame */ 9583 for (i = 0; i < params.n_csa_offsets; i++) { 9584 if (params.csa_offsets[i] >= params.len) 9585 return -EINVAL; 9586 } 9587 } 9588 9589 if (!params.dont_wait_for_ack) { 9590 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 9591 if (!msg) 9592 return -ENOMEM; 9593 9594 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 9595 NL80211_CMD_FRAME); 9596 if (!hdr) { 9597 err = -ENOBUFS; 9598 goto free_msg; 9599 } 9600 } 9601 9602 params.chan = chandef.chan; 9603 err = cfg80211_mlme_mgmt_tx(rdev, wdev, ¶ms, &cookie); 9604 if (err) 9605 goto free_msg; 9606 9607 if (msg) { 9608 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 9609 NL80211_ATTR_PAD)) 9610 goto nla_put_failure; 9611 9612 genlmsg_end(msg, hdr); 9613 return genlmsg_reply(msg, info); 9614 } 9615 9616 return 0; 9617 9618 nla_put_failure: 9619 err = -ENOBUFS; 9620 free_msg: 9621 nlmsg_free(msg); 9622 return err; 9623 } 9624 9625 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info) 9626 { 9627 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9628 struct wireless_dev *wdev = info->user_ptr[1]; 9629 u64 cookie; 9630 9631 if (!info->attrs[NL80211_ATTR_COOKIE]) 9632 return -EINVAL; 9633 9634 if (!rdev->ops->mgmt_tx_cancel_wait) 9635 return -EOPNOTSUPP; 9636 9637 switch (wdev->iftype) { 9638 case NL80211_IFTYPE_STATION: 9639 case NL80211_IFTYPE_ADHOC: 9640 case NL80211_IFTYPE_P2P_CLIENT: 9641 case NL80211_IFTYPE_AP: 9642 case NL80211_IFTYPE_AP_VLAN: 9643 case NL80211_IFTYPE_P2P_GO: 9644 case NL80211_IFTYPE_P2P_DEVICE: 9645 break; 9646 case NL80211_IFTYPE_NAN: 9647 default: 9648 return -EOPNOTSUPP; 9649 } 9650 9651 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 9652 9653 return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie); 9654 } 9655 9656 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info) 9657 { 9658 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9659 struct wireless_dev *wdev; 9660 struct net_device *dev = info->user_ptr[1]; 9661 u8 ps_state; 9662 bool state; 9663 int err; 9664 9665 if (!info->attrs[NL80211_ATTR_PS_STATE]) 9666 return -EINVAL; 9667 9668 ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]); 9669 9670 if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED) 9671 return -EINVAL; 9672 9673 wdev = dev->ieee80211_ptr; 9674 9675 if (!rdev->ops->set_power_mgmt) 9676 return -EOPNOTSUPP; 9677 9678 state = (ps_state == NL80211_PS_ENABLED) ? true : false; 9679 9680 if (state == wdev->ps) 9681 return 0; 9682 9683 err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout); 9684 if (!err) 9685 wdev->ps = state; 9686 return err; 9687 } 9688 9689 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info) 9690 { 9691 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9692 enum nl80211_ps_state ps_state; 9693 struct wireless_dev *wdev; 9694 struct net_device *dev = info->user_ptr[1]; 9695 struct sk_buff *msg; 9696 void *hdr; 9697 int err; 9698 9699 wdev = dev->ieee80211_ptr; 9700 9701 if (!rdev->ops->set_power_mgmt) 9702 return -EOPNOTSUPP; 9703 9704 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 9705 if (!msg) 9706 return -ENOMEM; 9707 9708 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 9709 NL80211_CMD_GET_POWER_SAVE); 9710 if (!hdr) { 9711 err = -ENOBUFS; 9712 goto free_msg; 9713 } 9714 9715 if (wdev->ps) 9716 ps_state = NL80211_PS_ENABLED; 9717 else 9718 ps_state = NL80211_PS_DISABLED; 9719 9720 if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state)) 9721 goto nla_put_failure; 9722 9723 genlmsg_end(msg, hdr); 9724 return genlmsg_reply(msg, info); 9725 9726 nla_put_failure: 9727 err = -ENOBUFS; 9728 free_msg: 9729 nlmsg_free(msg); 9730 return err; 9731 } 9732 9733 static const struct nla_policy 9734 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = { 9735 [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY }, 9736 [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 }, 9737 [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 }, 9738 [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 }, 9739 [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 }, 9740 [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 }, 9741 [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 }, 9742 }; 9743 9744 static int nl80211_set_cqm_txe(struct genl_info *info, 9745 u32 rate, u32 pkts, u32 intvl) 9746 { 9747 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9748 struct net_device *dev = info->user_ptr[1]; 9749 struct wireless_dev *wdev = dev->ieee80211_ptr; 9750 9751 if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL) 9752 return -EINVAL; 9753 9754 if (!rdev->ops->set_cqm_txe_config) 9755 return -EOPNOTSUPP; 9756 9757 if (wdev->iftype != NL80211_IFTYPE_STATION && 9758 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 9759 return -EOPNOTSUPP; 9760 9761 return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl); 9762 } 9763 9764 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev, 9765 struct net_device *dev) 9766 { 9767 struct wireless_dev *wdev = dev->ieee80211_ptr; 9768 s32 last, low, high; 9769 u32 hyst; 9770 int i, n; 9771 int err; 9772 9773 /* RSSI reporting disabled? */ 9774 if (!wdev->cqm_config) 9775 return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0); 9776 9777 /* 9778 * Obtain current RSSI value if possible, if not and no RSSI threshold 9779 * event has been received yet, we should receive an event after a 9780 * connection is established and enough beacons received to calculate 9781 * the average. 9782 */ 9783 if (!wdev->cqm_config->last_rssi_event_value && wdev->current_bss && 9784 rdev->ops->get_station) { 9785 struct station_info sinfo; 9786 u8 *mac_addr; 9787 9788 mac_addr = wdev->current_bss->pub.bssid; 9789 9790 err = rdev_get_station(rdev, dev, mac_addr, &sinfo); 9791 if (err) 9792 return err; 9793 9794 if (sinfo.filled & BIT(NL80211_STA_INFO_BEACON_SIGNAL_AVG)) 9795 wdev->cqm_config->last_rssi_event_value = 9796 (s8) sinfo.rx_beacon_signal_avg; 9797 } 9798 9799 last = wdev->cqm_config->last_rssi_event_value; 9800 hyst = wdev->cqm_config->rssi_hyst; 9801 n = wdev->cqm_config->n_rssi_thresholds; 9802 9803 for (i = 0; i < n; i++) 9804 if (last < wdev->cqm_config->rssi_thresholds[i]) 9805 break; 9806 9807 low = i > 0 ? 9808 (wdev->cqm_config->rssi_thresholds[i - 1] - hyst) : S32_MIN; 9809 high = i < n ? 9810 (wdev->cqm_config->rssi_thresholds[i] + hyst - 1) : S32_MAX; 9811 9812 return rdev_set_cqm_rssi_range_config(rdev, dev, low, high); 9813 } 9814 9815 static int nl80211_set_cqm_rssi(struct genl_info *info, 9816 const s32 *thresholds, int n_thresholds, 9817 u32 hysteresis) 9818 { 9819 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9820 struct net_device *dev = info->user_ptr[1]; 9821 struct wireless_dev *wdev = dev->ieee80211_ptr; 9822 int i, err; 9823 s32 prev = S32_MIN; 9824 9825 /* Check all values negative and sorted */ 9826 for (i = 0; i < n_thresholds; i++) { 9827 if (thresholds[i] > 0 || thresholds[i] <= prev) 9828 return -EINVAL; 9829 9830 prev = thresholds[i]; 9831 } 9832 9833 if (wdev->iftype != NL80211_IFTYPE_STATION && 9834 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 9835 return -EOPNOTSUPP; 9836 9837 wdev_lock(wdev); 9838 cfg80211_cqm_config_free(wdev); 9839 wdev_unlock(wdev); 9840 9841 if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) { 9842 if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */ 9843 return rdev_set_cqm_rssi_config(rdev, dev, 0, 0); 9844 9845 return rdev_set_cqm_rssi_config(rdev, dev, 9846 thresholds[0], hysteresis); 9847 } 9848 9849 if (!wiphy_ext_feature_isset(&rdev->wiphy, 9850 NL80211_EXT_FEATURE_CQM_RSSI_LIST)) 9851 return -EOPNOTSUPP; 9852 9853 if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */ 9854 n_thresholds = 0; 9855 9856 wdev_lock(wdev); 9857 if (n_thresholds) { 9858 struct cfg80211_cqm_config *cqm_config; 9859 9860 cqm_config = kzalloc(sizeof(struct cfg80211_cqm_config) + 9861 n_thresholds * sizeof(s32), GFP_KERNEL); 9862 if (!cqm_config) { 9863 err = -ENOMEM; 9864 goto unlock; 9865 } 9866 9867 cqm_config->rssi_hyst = hysteresis; 9868 cqm_config->n_rssi_thresholds = n_thresholds; 9869 memcpy(cqm_config->rssi_thresholds, thresholds, 9870 n_thresholds * sizeof(s32)); 9871 9872 wdev->cqm_config = cqm_config; 9873 } 9874 9875 err = cfg80211_cqm_rssi_update(rdev, dev); 9876 9877 unlock: 9878 wdev_unlock(wdev); 9879 9880 return err; 9881 } 9882 9883 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info) 9884 { 9885 struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1]; 9886 struct nlattr *cqm; 9887 int err; 9888 9889 cqm = info->attrs[NL80211_ATTR_CQM]; 9890 if (!cqm) 9891 return -EINVAL; 9892 9893 err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm, 9894 nl80211_attr_cqm_policy, info->extack); 9895 if (err) 9896 return err; 9897 9898 if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] && 9899 attrs[NL80211_ATTR_CQM_RSSI_HYST]) { 9900 const s32 *thresholds = 9901 nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]); 9902 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]); 9903 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]); 9904 9905 if (len % 4) 9906 return -EINVAL; 9907 9908 return nl80211_set_cqm_rssi(info, thresholds, len / 4, 9909 hysteresis); 9910 } 9911 9912 if (attrs[NL80211_ATTR_CQM_TXE_RATE] && 9913 attrs[NL80211_ATTR_CQM_TXE_PKTS] && 9914 attrs[NL80211_ATTR_CQM_TXE_INTVL]) { 9915 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]); 9916 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]); 9917 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]); 9918 9919 return nl80211_set_cqm_txe(info, rate, pkts, intvl); 9920 } 9921 9922 return -EINVAL; 9923 } 9924 9925 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info) 9926 { 9927 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9928 struct net_device *dev = info->user_ptr[1]; 9929 struct ocb_setup setup = {}; 9930 int err; 9931 9932 err = nl80211_parse_chandef(rdev, info, &setup.chandef); 9933 if (err) 9934 return err; 9935 9936 return cfg80211_join_ocb(rdev, dev, &setup); 9937 } 9938 9939 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info) 9940 { 9941 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9942 struct net_device *dev = info->user_ptr[1]; 9943 9944 return cfg80211_leave_ocb(rdev, dev); 9945 } 9946 9947 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info) 9948 { 9949 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9950 struct net_device *dev = info->user_ptr[1]; 9951 struct mesh_config cfg; 9952 struct mesh_setup setup; 9953 int err; 9954 9955 /* start with default */ 9956 memcpy(&cfg, &default_mesh_config, sizeof(cfg)); 9957 memcpy(&setup, &default_mesh_setup, sizeof(setup)); 9958 9959 if (info->attrs[NL80211_ATTR_MESH_CONFIG]) { 9960 /* and parse parameters if given */ 9961 err = nl80211_parse_mesh_config(info, &cfg, NULL); 9962 if (err) 9963 return err; 9964 } 9965 9966 if (!info->attrs[NL80211_ATTR_MESH_ID] || 9967 !nla_len(info->attrs[NL80211_ATTR_MESH_ID])) 9968 return -EINVAL; 9969 9970 setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]); 9971 setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]); 9972 9973 if (info->attrs[NL80211_ATTR_MCAST_RATE] && 9974 !nl80211_parse_mcast_rate(rdev, setup.mcast_rate, 9975 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]))) 9976 return -EINVAL; 9977 9978 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) { 9979 setup.beacon_interval = 9980 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]); 9981 9982 err = cfg80211_validate_beacon_int(rdev, 9983 NL80211_IFTYPE_MESH_POINT, 9984 setup.beacon_interval); 9985 if (err) 9986 return err; 9987 } 9988 9989 if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) { 9990 setup.dtim_period = 9991 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]); 9992 if (setup.dtim_period < 1 || setup.dtim_period > 100) 9993 return -EINVAL; 9994 } 9995 9996 if (info->attrs[NL80211_ATTR_MESH_SETUP]) { 9997 /* parse additional setup parameters if given */ 9998 err = nl80211_parse_mesh_setup(info, &setup); 9999 if (err) 10000 return err; 10001 } 10002 10003 if (setup.user_mpm) 10004 cfg.auto_open_plinks = false; 10005 10006 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 10007 err = nl80211_parse_chandef(rdev, info, &setup.chandef); 10008 if (err) 10009 return err; 10010 } else { 10011 /* cfg80211_join_mesh() will sort it out */ 10012 setup.chandef.chan = NULL; 10013 } 10014 10015 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) { 10016 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 10017 int n_rates = 10018 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 10019 struct ieee80211_supported_band *sband; 10020 10021 if (!setup.chandef.chan) 10022 return -EINVAL; 10023 10024 sband = rdev->wiphy.bands[setup.chandef.chan->band]; 10025 10026 err = ieee80211_get_ratemask(sband, rates, n_rates, 10027 &setup.basic_rates); 10028 if (err) 10029 return err; 10030 } 10031 10032 if (info->attrs[NL80211_ATTR_TX_RATES]) { 10033 err = nl80211_parse_tx_bitrate_mask(info, &setup.beacon_rate); 10034 if (err) 10035 return err; 10036 10037 if (!setup.chandef.chan) 10038 return -EINVAL; 10039 10040 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band, 10041 &setup.beacon_rate); 10042 if (err) 10043 return err; 10044 } 10045 10046 setup.userspace_handles_dfs = 10047 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]); 10048 10049 return cfg80211_join_mesh(rdev, dev, &setup, &cfg); 10050 } 10051 10052 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info) 10053 { 10054 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10055 struct net_device *dev = info->user_ptr[1]; 10056 10057 return cfg80211_leave_mesh(rdev, dev); 10058 } 10059 10060 #ifdef CONFIG_PM 10061 static int nl80211_send_wowlan_patterns(struct sk_buff *msg, 10062 struct cfg80211_registered_device *rdev) 10063 { 10064 struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config; 10065 struct nlattr *nl_pats, *nl_pat; 10066 int i, pat_len; 10067 10068 if (!wowlan->n_patterns) 10069 return 0; 10070 10071 nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN); 10072 if (!nl_pats) 10073 return -ENOBUFS; 10074 10075 for (i = 0; i < wowlan->n_patterns; i++) { 10076 nl_pat = nla_nest_start(msg, i + 1); 10077 if (!nl_pat) 10078 return -ENOBUFS; 10079 pat_len = wowlan->patterns[i].pattern_len; 10080 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8), 10081 wowlan->patterns[i].mask) || 10082 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len, 10083 wowlan->patterns[i].pattern) || 10084 nla_put_u32(msg, NL80211_PKTPAT_OFFSET, 10085 wowlan->patterns[i].pkt_offset)) 10086 return -ENOBUFS; 10087 nla_nest_end(msg, nl_pat); 10088 } 10089 nla_nest_end(msg, nl_pats); 10090 10091 return 0; 10092 } 10093 10094 static int nl80211_send_wowlan_tcp(struct sk_buff *msg, 10095 struct cfg80211_wowlan_tcp *tcp) 10096 { 10097 struct nlattr *nl_tcp; 10098 10099 if (!tcp) 10100 return 0; 10101 10102 nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION); 10103 if (!nl_tcp) 10104 return -ENOBUFS; 10105 10106 if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) || 10107 nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) || 10108 nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) || 10109 nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) || 10110 nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) || 10111 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD, 10112 tcp->payload_len, tcp->payload) || 10113 nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL, 10114 tcp->data_interval) || 10115 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD, 10116 tcp->wake_len, tcp->wake_data) || 10117 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK, 10118 DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask)) 10119 return -ENOBUFS; 10120 10121 if (tcp->payload_seq.len && 10122 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ, 10123 sizeof(tcp->payload_seq), &tcp->payload_seq)) 10124 return -ENOBUFS; 10125 10126 if (tcp->payload_tok.len && 10127 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN, 10128 sizeof(tcp->payload_tok) + tcp->tokens_size, 10129 &tcp->payload_tok)) 10130 return -ENOBUFS; 10131 10132 nla_nest_end(msg, nl_tcp); 10133 10134 return 0; 10135 } 10136 10137 static int nl80211_send_wowlan_nd(struct sk_buff *msg, 10138 struct cfg80211_sched_scan_request *req) 10139 { 10140 struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan; 10141 int i; 10142 10143 if (!req) 10144 return 0; 10145 10146 nd = nla_nest_start(msg, NL80211_WOWLAN_TRIG_NET_DETECT); 10147 if (!nd) 10148 return -ENOBUFS; 10149 10150 if (req->n_scan_plans == 1 && 10151 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL, 10152 req->scan_plans[0].interval * 1000)) 10153 return -ENOBUFS; 10154 10155 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay)) 10156 return -ENOBUFS; 10157 10158 if (req->relative_rssi_set) { 10159 struct nl80211_bss_select_rssi_adjust rssi_adjust; 10160 10161 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI, 10162 req->relative_rssi)) 10163 return -ENOBUFS; 10164 10165 rssi_adjust.band = req->rssi_adjust.band; 10166 rssi_adjust.delta = req->rssi_adjust.delta; 10167 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST, 10168 sizeof(rssi_adjust), &rssi_adjust)) 10169 return -ENOBUFS; 10170 } 10171 10172 freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES); 10173 if (!freqs) 10174 return -ENOBUFS; 10175 10176 for (i = 0; i < req->n_channels; i++) { 10177 if (nla_put_u32(msg, i, req->channels[i]->center_freq)) 10178 return -ENOBUFS; 10179 } 10180 10181 nla_nest_end(msg, freqs); 10182 10183 if (req->n_match_sets) { 10184 matches = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH); 10185 if (!matches) 10186 return -ENOBUFS; 10187 10188 for (i = 0; i < req->n_match_sets; i++) { 10189 match = nla_nest_start(msg, i); 10190 if (!match) 10191 return -ENOBUFS; 10192 10193 if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID, 10194 req->match_sets[i].ssid.ssid_len, 10195 req->match_sets[i].ssid.ssid)) 10196 return -ENOBUFS; 10197 nla_nest_end(msg, match); 10198 } 10199 nla_nest_end(msg, matches); 10200 } 10201 10202 scan_plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS); 10203 if (!scan_plans) 10204 return -ENOBUFS; 10205 10206 for (i = 0; i < req->n_scan_plans; i++) { 10207 scan_plan = nla_nest_start(msg, i + 1); 10208 if (!scan_plan) 10209 return -ENOBUFS; 10210 10211 if (!scan_plan || 10212 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL, 10213 req->scan_plans[i].interval) || 10214 (req->scan_plans[i].iterations && 10215 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS, 10216 req->scan_plans[i].iterations))) 10217 return -ENOBUFS; 10218 nla_nest_end(msg, scan_plan); 10219 } 10220 nla_nest_end(msg, scan_plans); 10221 10222 nla_nest_end(msg, nd); 10223 10224 return 0; 10225 } 10226 10227 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info) 10228 { 10229 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10230 struct sk_buff *msg; 10231 void *hdr; 10232 u32 size = NLMSG_DEFAULT_SIZE; 10233 10234 if (!rdev->wiphy.wowlan) 10235 return -EOPNOTSUPP; 10236 10237 if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) { 10238 /* adjust size to have room for all the data */ 10239 size += rdev->wiphy.wowlan_config->tcp->tokens_size + 10240 rdev->wiphy.wowlan_config->tcp->payload_len + 10241 rdev->wiphy.wowlan_config->tcp->wake_len + 10242 rdev->wiphy.wowlan_config->tcp->wake_len / 8; 10243 } 10244 10245 msg = nlmsg_new(size, GFP_KERNEL); 10246 if (!msg) 10247 return -ENOMEM; 10248 10249 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 10250 NL80211_CMD_GET_WOWLAN); 10251 if (!hdr) 10252 goto nla_put_failure; 10253 10254 if (rdev->wiphy.wowlan_config) { 10255 struct nlattr *nl_wowlan; 10256 10257 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS); 10258 if (!nl_wowlan) 10259 goto nla_put_failure; 10260 10261 if ((rdev->wiphy.wowlan_config->any && 10262 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) || 10263 (rdev->wiphy.wowlan_config->disconnect && 10264 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) || 10265 (rdev->wiphy.wowlan_config->magic_pkt && 10266 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) || 10267 (rdev->wiphy.wowlan_config->gtk_rekey_failure && 10268 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) || 10269 (rdev->wiphy.wowlan_config->eap_identity_req && 10270 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) || 10271 (rdev->wiphy.wowlan_config->four_way_handshake && 10272 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) || 10273 (rdev->wiphy.wowlan_config->rfkill_release && 10274 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))) 10275 goto nla_put_failure; 10276 10277 if (nl80211_send_wowlan_patterns(msg, rdev)) 10278 goto nla_put_failure; 10279 10280 if (nl80211_send_wowlan_tcp(msg, 10281 rdev->wiphy.wowlan_config->tcp)) 10282 goto nla_put_failure; 10283 10284 if (nl80211_send_wowlan_nd( 10285 msg, 10286 rdev->wiphy.wowlan_config->nd_config)) 10287 goto nla_put_failure; 10288 10289 nla_nest_end(msg, nl_wowlan); 10290 } 10291 10292 genlmsg_end(msg, hdr); 10293 return genlmsg_reply(msg, info); 10294 10295 nla_put_failure: 10296 nlmsg_free(msg); 10297 return -ENOBUFS; 10298 } 10299 10300 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev, 10301 struct nlattr *attr, 10302 struct cfg80211_wowlan *trig) 10303 { 10304 struct nlattr *tb[NUM_NL80211_WOWLAN_TCP]; 10305 struct cfg80211_wowlan_tcp *cfg; 10306 struct nl80211_wowlan_tcp_data_token *tok = NULL; 10307 struct nl80211_wowlan_tcp_data_seq *seq = NULL; 10308 u32 size; 10309 u32 data_size, wake_size, tokens_size = 0, wake_mask_size; 10310 int err, port; 10311 10312 if (!rdev->wiphy.wowlan->tcp) 10313 return -EINVAL; 10314 10315 err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TCP, attr, 10316 nl80211_wowlan_tcp_policy, NULL); 10317 if (err) 10318 return err; 10319 10320 if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] || 10321 !tb[NL80211_WOWLAN_TCP_DST_IPV4] || 10322 !tb[NL80211_WOWLAN_TCP_DST_MAC] || 10323 !tb[NL80211_WOWLAN_TCP_DST_PORT] || 10324 !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] || 10325 !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] || 10326 !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] || 10327 !tb[NL80211_WOWLAN_TCP_WAKE_MASK]) 10328 return -EINVAL; 10329 10330 data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]); 10331 if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max) 10332 return -EINVAL; 10333 10334 if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) > 10335 rdev->wiphy.wowlan->tcp->data_interval_max || 10336 nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0) 10337 return -EINVAL; 10338 10339 wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]); 10340 if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max) 10341 return -EINVAL; 10342 10343 wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]); 10344 if (wake_mask_size != DIV_ROUND_UP(wake_size, 8)) 10345 return -EINVAL; 10346 10347 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) { 10348 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]); 10349 10350 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]); 10351 tokens_size = tokln - sizeof(*tok); 10352 10353 if (!tok->len || tokens_size % tok->len) 10354 return -EINVAL; 10355 if (!rdev->wiphy.wowlan->tcp->tok) 10356 return -EINVAL; 10357 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len) 10358 return -EINVAL; 10359 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len) 10360 return -EINVAL; 10361 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize) 10362 return -EINVAL; 10363 if (tok->offset + tok->len > data_size) 10364 return -EINVAL; 10365 } 10366 10367 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) { 10368 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]); 10369 if (!rdev->wiphy.wowlan->tcp->seq) 10370 return -EINVAL; 10371 if (seq->len == 0 || seq->len > 4) 10372 return -EINVAL; 10373 if (seq->len + seq->offset > data_size) 10374 return -EINVAL; 10375 } 10376 10377 size = sizeof(*cfg); 10378 size += data_size; 10379 size += wake_size + wake_mask_size; 10380 size += tokens_size; 10381 10382 cfg = kzalloc(size, GFP_KERNEL); 10383 if (!cfg) 10384 return -ENOMEM; 10385 cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]); 10386 cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]); 10387 memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]), 10388 ETH_ALEN); 10389 if (tb[NL80211_WOWLAN_TCP_SRC_PORT]) 10390 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]); 10391 else 10392 port = 0; 10393 #ifdef CONFIG_INET 10394 /* allocate a socket and port for it and use it */ 10395 err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM, 10396 IPPROTO_TCP, &cfg->sock, 1); 10397 if (err) { 10398 kfree(cfg); 10399 return err; 10400 } 10401 if (inet_csk_get_port(cfg->sock->sk, port)) { 10402 sock_release(cfg->sock); 10403 kfree(cfg); 10404 return -EADDRINUSE; 10405 } 10406 cfg->src_port = inet_sk(cfg->sock->sk)->inet_num; 10407 #else 10408 if (!port) { 10409 kfree(cfg); 10410 return -EINVAL; 10411 } 10412 cfg->src_port = port; 10413 #endif 10414 10415 cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]); 10416 cfg->payload_len = data_size; 10417 cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size; 10418 memcpy((void *)cfg->payload, 10419 nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]), 10420 data_size); 10421 if (seq) 10422 cfg->payload_seq = *seq; 10423 cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]); 10424 cfg->wake_len = wake_size; 10425 cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size; 10426 memcpy((void *)cfg->wake_data, 10427 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]), 10428 wake_size); 10429 cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size + 10430 data_size + wake_size; 10431 memcpy((void *)cfg->wake_mask, 10432 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]), 10433 wake_mask_size); 10434 if (tok) { 10435 cfg->tokens_size = tokens_size; 10436 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size); 10437 } 10438 10439 trig->tcp = cfg; 10440 10441 return 0; 10442 } 10443 10444 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev, 10445 const struct wiphy_wowlan_support *wowlan, 10446 struct nlattr *attr, 10447 struct cfg80211_wowlan *trig) 10448 { 10449 struct nlattr **tb; 10450 int err; 10451 10452 tb = kzalloc(NUM_NL80211_ATTR * sizeof(*tb), GFP_KERNEL); 10453 if (!tb) 10454 return -ENOMEM; 10455 10456 if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) { 10457 err = -EOPNOTSUPP; 10458 goto out; 10459 } 10460 10461 err = nla_parse_nested(tb, NL80211_ATTR_MAX, attr, nl80211_policy, 10462 NULL); 10463 if (err) 10464 goto out; 10465 10466 trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb, 10467 wowlan->max_nd_match_sets); 10468 err = PTR_ERR_OR_ZERO(trig->nd_config); 10469 if (err) 10470 trig->nd_config = NULL; 10471 10472 out: 10473 kfree(tb); 10474 return err; 10475 } 10476 10477 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info) 10478 { 10479 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10480 struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG]; 10481 struct cfg80211_wowlan new_triggers = {}; 10482 struct cfg80211_wowlan *ntrig; 10483 const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan; 10484 int err, i; 10485 bool prev_enabled = rdev->wiphy.wowlan_config; 10486 bool regular = false; 10487 10488 if (!wowlan) 10489 return -EOPNOTSUPP; 10490 10491 if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) { 10492 cfg80211_rdev_free_wowlan(rdev); 10493 rdev->wiphy.wowlan_config = NULL; 10494 goto set_wakeup; 10495 } 10496 10497 err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TRIG, 10498 info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS], 10499 nl80211_wowlan_policy, info->extack); 10500 if (err) 10501 return err; 10502 10503 if (tb[NL80211_WOWLAN_TRIG_ANY]) { 10504 if (!(wowlan->flags & WIPHY_WOWLAN_ANY)) 10505 return -EINVAL; 10506 new_triggers.any = true; 10507 } 10508 10509 if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) { 10510 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT)) 10511 return -EINVAL; 10512 new_triggers.disconnect = true; 10513 regular = true; 10514 } 10515 10516 if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) { 10517 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT)) 10518 return -EINVAL; 10519 new_triggers.magic_pkt = true; 10520 regular = true; 10521 } 10522 10523 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED]) 10524 return -EINVAL; 10525 10526 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) { 10527 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE)) 10528 return -EINVAL; 10529 new_triggers.gtk_rekey_failure = true; 10530 regular = true; 10531 } 10532 10533 if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) { 10534 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ)) 10535 return -EINVAL; 10536 new_triggers.eap_identity_req = true; 10537 regular = true; 10538 } 10539 10540 if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) { 10541 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE)) 10542 return -EINVAL; 10543 new_triggers.four_way_handshake = true; 10544 regular = true; 10545 } 10546 10547 if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) { 10548 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE)) 10549 return -EINVAL; 10550 new_triggers.rfkill_release = true; 10551 regular = true; 10552 } 10553 10554 if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) { 10555 struct nlattr *pat; 10556 int n_patterns = 0; 10557 int rem, pat_len, mask_len, pkt_offset; 10558 struct nlattr *pat_tb[NUM_NL80211_PKTPAT]; 10559 10560 regular = true; 10561 10562 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN], 10563 rem) 10564 n_patterns++; 10565 if (n_patterns > wowlan->n_patterns) 10566 return -EINVAL; 10567 10568 new_triggers.patterns = kcalloc(n_patterns, 10569 sizeof(new_triggers.patterns[0]), 10570 GFP_KERNEL); 10571 if (!new_triggers.patterns) 10572 return -ENOMEM; 10573 10574 new_triggers.n_patterns = n_patterns; 10575 i = 0; 10576 10577 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN], 10578 rem) { 10579 u8 *mask_pat; 10580 10581 nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat, 10582 nl80211_packet_pattern_policy, 10583 info->extack); 10584 err = -EINVAL; 10585 if (!pat_tb[NL80211_PKTPAT_MASK] || 10586 !pat_tb[NL80211_PKTPAT_PATTERN]) 10587 goto error; 10588 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]); 10589 mask_len = DIV_ROUND_UP(pat_len, 8); 10590 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len) 10591 goto error; 10592 if (pat_len > wowlan->pattern_max_len || 10593 pat_len < wowlan->pattern_min_len) 10594 goto error; 10595 10596 if (!pat_tb[NL80211_PKTPAT_OFFSET]) 10597 pkt_offset = 0; 10598 else 10599 pkt_offset = nla_get_u32( 10600 pat_tb[NL80211_PKTPAT_OFFSET]); 10601 if (pkt_offset > wowlan->max_pkt_offset) 10602 goto error; 10603 new_triggers.patterns[i].pkt_offset = pkt_offset; 10604 10605 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL); 10606 if (!mask_pat) { 10607 err = -ENOMEM; 10608 goto error; 10609 } 10610 new_triggers.patterns[i].mask = mask_pat; 10611 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]), 10612 mask_len); 10613 mask_pat += mask_len; 10614 new_triggers.patterns[i].pattern = mask_pat; 10615 new_triggers.patterns[i].pattern_len = pat_len; 10616 memcpy(mask_pat, 10617 nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), 10618 pat_len); 10619 i++; 10620 } 10621 } 10622 10623 if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) { 10624 regular = true; 10625 err = nl80211_parse_wowlan_tcp( 10626 rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION], 10627 &new_triggers); 10628 if (err) 10629 goto error; 10630 } 10631 10632 if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) { 10633 regular = true; 10634 err = nl80211_parse_wowlan_nd( 10635 rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT], 10636 &new_triggers); 10637 if (err) 10638 goto error; 10639 } 10640 10641 /* The 'any' trigger means the device continues operating more or less 10642 * as in its normal operation mode and wakes up the host on most of the 10643 * normal interrupts (like packet RX, ...) 10644 * It therefore makes little sense to combine with the more constrained 10645 * wakeup trigger modes. 10646 */ 10647 if (new_triggers.any && regular) { 10648 err = -EINVAL; 10649 goto error; 10650 } 10651 10652 ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL); 10653 if (!ntrig) { 10654 err = -ENOMEM; 10655 goto error; 10656 } 10657 cfg80211_rdev_free_wowlan(rdev); 10658 rdev->wiphy.wowlan_config = ntrig; 10659 10660 set_wakeup: 10661 if (rdev->ops->set_wakeup && 10662 prev_enabled != !!rdev->wiphy.wowlan_config) 10663 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config); 10664 10665 return 0; 10666 error: 10667 for (i = 0; i < new_triggers.n_patterns; i++) 10668 kfree(new_triggers.patterns[i].mask); 10669 kfree(new_triggers.patterns); 10670 if (new_triggers.tcp && new_triggers.tcp->sock) 10671 sock_release(new_triggers.tcp->sock); 10672 kfree(new_triggers.tcp); 10673 kfree(new_triggers.nd_config); 10674 return err; 10675 } 10676 #endif 10677 10678 static int nl80211_send_coalesce_rules(struct sk_buff *msg, 10679 struct cfg80211_registered_device *rdev) 10680 { 10681 struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules; 10682 int i, j, pat_len; 10683 struct cfg80211_coalesce_rules *rule; 10684 10685 if (!rdev->coalesce->n_rules) 10686 return 0; 10687 10688 nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE); 10689 if (!nl_rules) 10690 return -ENOBUFS; 10691 10692 for (i = 0; i < rdev->coalesce->n_rules; i++) { 10693 nl_rule = nla_nest_start(msg, i + 1); 10694 if (!nl_rule) 10695 return -ENOBUFS; 10696 10697 rule = &rdev->coalesce->rules[i]; 10698 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY, 10699 rule->delay)) 10700 return -ENOBUFS; 10701 10702 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION, 10703 rule->condition)) 10704 return -ENOBUFS; 10705 10706 nl_pats = nla_nest_start(msg, 10707 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN); 10708 if (!nl_pats) 10709 return -ENOBUFS; 10710 10711 for (j = 0; j < rule->n_patterns; j++) { 10712 nl_pat = nla_nest_start(msg, j + 1); 10713 if (!nl_pat) 10714 return -ENOBUFS; 10715 pat_len = rule->patterns[j].pattern_len; 10716 if (nla_put(msg, NL80211_PKTPAT_MASK, 10717 DIV_ROUND_UP(pat_len, 8), 10718 rule->patterns[j].mask) || 10719 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len, 10720 rule->patterns[j].pattern) || 10721 nla_put_u32(msg, NL80211_PKTPAT_OFFSET, 10722 rule->patterns[j].pkt_offset)) 10723 return -ENOBUFS; 10724 nla_nest_end(msg, nl_pat); 10725 } 10726 nla_nest_end(msg, nl_pats); 10727 nla_nest_end(msg, nl_rule); 10728 } 10729 nla_nest_end(msg, nl_rules); 10730 10731 return 0; 10732 } 10733 10734 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info) 10735 { 10736 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10737 struct sk_buff *msg; 10738 void *hdr; 10739 10740 if (!rdev->wiphy.coalesce) 10741 return -EOPNOTSUPP; 10742 10743 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 10744 if (!msg) 10745 return -ENOMEM; 10746 10747 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 10748 NL80211_CMD_GET_COALESCE); 10749 if (!hdr) 10750 goto nla_put_failure; 10751 10752 if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev)) 10753 goto nla_put_failure; 10754 10755 genlmsg_end(msg, hdr); 10756 return genlmsg_reply(msg, info); 10757 10758 nla_put_failure: 10759 nlmsg_free(msg); 10760 return -ENOBUFS; 10761 } 10762 10763 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev) 10764 { 10765 struct cfg80211_coalesce *coalesce = rdev->coalesce; 10766 int i, j; 10767 struct cfg80211_coalesce_rules *rule; 10768 10769 if (!coalesce) 10770 return; 10771 10772 for (i = 0; i < coalesce->n_rules; i++) { 10773 rule = &coalesce->rules[i]; 10774 for (j = 0; j < rule->n_patterns; j++) 10775 kfree(rule->patterns[j].mask); 10776 kfree(rule->patterns); 10777 } 10778 kfree(coalesce->rules); 10779 kfree(coalesce); 10780 rdev->coalesce = NULL; 10781 } 10782 10783 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev, 10784 struct nlattr *rule, 10785 struct cfg80211_coalesce_rules *new_rule) 10786 { 10787 int err, i; 10788 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce; 10789 struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat; 10790 int rem, pat_len, mask_len, pkt_offset, n_patterns = 0; 10791 struct nlattr *pat_tb[NUM_NL80211_PKTPAT]; 10792 10793 err = nla_parse_nested(tb, NL80211_ATTR_COALESCE_RULE_MAX, rule, 10794 nl80211_coalesce_policy, NULL); 10795 if (err) 10796 return err; 10797 10798 if (tb[NL80211_ATTR_COALESCE_RULE_DELAY]) 10799 new_rule->delay = 10800 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]); 10801 if (new_rule->delay > coalesce->max_delay) 10802 return -EINVAL; 10803 10804 if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION]) 10805 new_rule->condition = 10806 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]); 10807 if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH && 10808 new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH) 10809 return -EINVAL; 10810 10811 if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN]) 10812 return -EINVAL; 10813 10814 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN], 10815 rem) 10816 n_patterns++; 10817 if (n_patterns > coalesce->n_patterns) 10818 return -EINVAL; 10819 10820 new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]), 10821 GFP_KERNEL); 10822 if (!new_rule->patterns) 10823 return -ENOMEM; 10824 10825 new_rule->n_patterns = n_patterns; 10826 i = 0; 10827 10828 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN], 10829 rem) { 10830 u8 *mask_pat; 10831 10832 nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat, 10833 nl80211_packet_pattern_policy, NULL); 10834 if (!pat_tb[NL80211_PKTPAT_MASK] || 10835 !pat_tb[NL80211_PKTPAT_PATTERN]) 10836 return -EINVAL; 10837 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]); 10838 mask_len = DIV_ROUND_UP(pat_len, 8); 10839 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len) 10840 return -EINVAL; 10841 if (pat_len > coalesce->pattern_max_len || 10842 pat_len < coalesce->pattern_min_len) 10843 return -EINVAL; 10844 10845 if (!pat_tb[NL80211_PKTPAT_OFFSET]) 10846 pkt_offset = 0; 10847 else 10848 pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]); 10849 if (pkt_offset > coalesce->max_pkt_offset) 10850 return -EINVAL; 10851 new_rule->patterns[i].pkt_offset = pkt_offset; 10852 10853 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL); 10854 if (!mask_pat) 10855 return -ENOMEM; 10856 10857 new_rule->patterns[i].mask = mask_pat; 10858 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]), 10859 mask_len); 10860 10861 mask_pat += mask_len; 10862 new_rule->patterns[i].pattern = mask_pat; 10863 new_rule->patterns[i].pattern_len = pat_len; 10864 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), 10865 pat_len); 10866 i++; 10867 } 10868 10869 return 0; 10870 } 10871 10872 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info) 10873 { 10874 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10875 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce; 10876 struct cfg80211_coalesce new_coalesce = {}; 10877 struct cfg80211_coalesce *n_coalesce; 10878 int err, rem_rule, n_rules = 0, i, j; 10879 struct nlattr *rule; 10880 struct cfg80211_coalesce_rules *tmp_rule; 10881 10882 if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce) 10883 return -EOPNOTSUPP; 10884 10885 if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) { 10886 cfg80211_rdev_free_coalesce(rdev); 10887 rdev_set_coalesce(rdev, NULL); 10888 return 0; 10889 } 10890 10891 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE], 10892 rem_rule) 10893 n_rules++; 10894 if (n_rules > coalesce->n_rules) 10895 return -EINVAL; 10896 10897 new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]), 10898 GFP_KERNEL); 10899 if (!new_coalesce.rules) 10900 return -ENOMEM; 10901 10902 new_coalesce.n_rules = n_rules; 10903 i = 0; 10904 10905 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE], 10906 rem_rule) { 10907 err = nl80211_parse_coalesce_rule(rdev, rule, 10908 &new_coalesce.rules[i]); 10909 if (err) 10910 goto error; 10911 10912 i++; 10913 } 10914 10915 err = rdev_set_coalesce(rdev, &new_coalesce); 10916 if (err) 10917 goto error; 10918 10919 n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL); 10920 if (!n_coalesce) { 10921 err = -ENOMEM; 10922 goto error; 10923 } 10924 cfg80211_rdev_free_coalesce(rdev); 10925 rdev->coalesce = n_coalesce; 10926 10927 return 0; 10928 error: 10929 for (i = 0; i < new_coalesce.n_rules; i++) { 10930 tmp_rule = &new_coalesce.rules[i]; 10931 for (j = 0; j < tmp_rule->n_patterns; j++) 10932 kfree(tmp_rule->patterns[j].mask); 10933 kfree(tmp_rule->patterns); 10934 } 10935 kfree(new_coalesce.rules); 10936 10937 return err; 10938 } 10939 10940 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info) 10941 { 10942 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10943 struct net_device *dev = info->user_ptr[1]; 10944 struct wireless_dev *wdev = dev->ieee80211_ptr; 10945 struct nlattr *tb[NUM_NL80211_REKEY_DATA]; 10946 struct cfg80211_gtk_rekey_data rekey_data; 10947 int err; 10948 10949 if (!info->attrs[NL80211_ATTR_REKEY_DATA]) 10950 return -EINVAL; 10951 10952 err = nla_parse_nested(tb, MAX_NL80211_REKEY_DATA, 10953 info->attrs[NL80211_ATTR_REKEY_DATA], 10954 nl80211_rekey_policy, info->extack); 10955 if (err) 10956 return err; 10957 10958 if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] || 10959 !tb[NL80211_REKEY_DATA_KCK]) 10960 return -EINVAL; 10961 if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN) 10962 return -ERANGE; 10963 if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN) 10964 return -ERANGE; 10965 if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN) 10966 return -ERANGE; 10967 10968 rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]); 10969 rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]); 10970 rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]); 10971 10972 wdev_lock(wdev); 10973 if (!wdev->current_bss) { 10974 err = -ENOTCONN; 10975 goto out; 10976 } 10977 10978 if (!rdev->ops->set_rekey_data) { 10979 err = -EOPNOTSUPP; 10980 goto out; 10981 } 10982 10983 err = rdev_set_rekey_data(rdev, dev, &rekey_data); 10984 out: 10985 wdev_unlock(wdev); 10986 return err; 10987 } 10988 10989 static int nl80211_register_unexpected_frame(struct sk_buff *skb, 10990 struct genl_info *info) 10991 { 10992 struct net_device *dev = info->user_ptr[1]; 10993 struct wireless_dev *wdev = dev->ieee80211_ptr; 10994 10995 if (wdev->iftype != NL80211_IFTYPE_AP && 10996 wdev->iftype != NL80211_IFTYPE_P2P_GO) 10997 return -EINVAL; 10998 10999 if (wdev->ap_unexpected_nlportid) 11000 return -EBUSY; 11001 11002 wdev->ap_unexpected_nlportid = info->snd_portid; 11003 return 0; 11004 } 11005 11006 static int nl80211_probe_client(struct sk_buff *skb, 11007 struct genl_info *info) 11008 { 11009 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11010 struct net_device *dev = info->user_ptr[1]; 11011 struct wireless_dev *wdev = dev->ieee80211_ptr; 11012 struct sk_buff *msg; 11013 void *hdr; 11014 const u8 *addr; 11015 u64 cookie; 11016 int err; 11017 11018 if (wdev->iftype != NL80211_IFTYPE_AP && 11019 wdev->iftype != NL80211_IFTYPE_P2P_GO) 11020 return -EOPNOTSUPP; 11021 11022 if (!info->attrs[NL80211_ATTR_MAC]) 11023 return -EINVAL; 11024 11025 if (!rdev->ops->probe_client) 11026 return -EOPNOTSUPP; 11027 11028 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 11029 if (!msg) 11030 return -ENOMEM; 11031 11032 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 11033 NL80211_CMD_PROBE_CLIENT); 11034 if (!hdr) { 11035 err = -ENOBUFS; 11036 goto free_msg; 11037 } 11038 11039 addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 11040 11041 err = rdev_probe_client(rdev, dev, addr, &cookie); 11042 if (err) 11043 goto free_msg; 11044 11045 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 11046 NL80211_ATTR_PAD)) 11047 goto nla_put_failure; 11048 11049 genlmsg_end(msg, hdr); 11050 11051 return genlmsg_reply(msg, info); 11052 11053 nla_put_failure: 11054 err = -ENOBUFS; 11055 free_msg: 11056 nlmsg_free(msg); 11057 return err; 11058 } 11059 11060 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info) 11061 { 11062 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11063 struct cfg80211_beacon_registration *reg, *nreg; 11064 int rv; 11065 11066 if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS)) 11067 return -EOPNOTSUPP; 11068 11069 nreg = kzalloc(sizeof(*nreg), GFP_KERNEL); 11070 if (!nreg) 11071 return -ENOMEM; 11072 11073 /* First, check if already registered. */ 11074 spin_lock_bh(&rdev->beacon_registrations_lock); 11075 list_for_each_entry(reg, &rdev->beacon_registrations, list) { 11076 if (reg->nlportid == info->snd_portid) { 11077 rv = -EALREADY; 11078 goto out_err; 11079 } 11080 } 11081 /* Add it to the list */ 11082 nreg->nlportid = info->snd_portid; 11083 list_add(&nreg->list, &rdev->beacon_registrations); 11084 11085 spin_unlock_bh(&rdev->beacon_registrations_lock); 11086 11087 return 0; 11088 out_err: 11089 spin_unlock_bh(&rdev->beacon_registrations_lock); 11090 kfree(nreg); 11091 return rv; 11092 } 11093 11094 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info) 11095 { 11096 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11097 struct wireless_dev *wdev = info->user_ptr[1]; 11098 int err; 11099 11100 if (!rdev->ops->start_p2p_device) 11101 return -EOPNOTSUPP; 11102 11103 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE) 11104 return -EOPNOTSUPP; 11105 11106 if (wdev_running(wdev)) 11107 return 0; 11108 11109 if (rfkill_blocked(rdev->rfkill)) 11110 return -ERFKILL; 11111 11112 err = rdev_start_p2p_device(rdev, wdev); 11113 if (err) 11114 return err; 11115 11116 wdev->is_running = true; 11117 rdev->opencount++; 11118 11119 return 0; 11120 } 11121 11122 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info) 11123 { 11124 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11125 struct wireless_dev *wdev = info->user_ptr[1]; 11126 11127 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE) 11128 return -EOPNOTSUPP; 11129 11130 if (!rdev->ops->stop_p2p_device) 11131 return -EOPNOTSUPP; 11132 11133 cfg80211_stop_p2p_device(rdev, wdev); 11134 11135 return 0; 11136 } 11137 11138 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info) 11139 { 11140 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11141 struct wireless_dev *wdev = info->user_ptr[1]; 11142 struct cfg80211_nan_conf conf = {}; 11143 int err; 11144 11145 if (wdev->iftype != NL80211_IFTYPE_NAN) 11146 return -EOPNOTSUPP; 11147 11148 if (wdev_running(wdev)) 11149 return -EEXIST; 11150 11151 if (rfkill_blocked(rdev->rfkill)) 11152 return -ERFKILL; 11153 11154 if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) 11155 return -EINVAL; 11156 11157 conf.master_pref = 11158 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]); 11159 if (!conf.master_pref) 11160 return -EINVAL; 11161 11162 if (info->attrs[NL80211_ATTR_BANDS]) { 11163 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]); 11164 11165 if (bands & ~(u32)wdev->wiphy->nan_supported_bands) 11166 return -EOPNOTSUPP; 11167 11168 if (bands && !(bands & BIT(NL80211_BAND_2GHZ))) 11169 return -EINVAL; 11170 11171 conf.bands = bands; 11172 } 11173 11174 err = rdev_start_nan(rdev, wdev, &conf); 11175 if (err) 11176 return err; 11177 11178 wdev->is_running = true; 11179 rdev->opencount++; 11180 11181 return 0; 11182 } 11183 11184 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info) 11185 { 11186 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11187 struct wireless_dev *wdev = info->user_ptr[1]; 11188 11189 if (wdev->iftype != NL80211_IFTYPE_NAN) 11190 return -EOPNOTSUPP; 11191 11192 cfg80211_stop_nan(rdev, wdev); 11193 11194 return 0; 11195 } 11196 11197 static int validate_nan_filter(struct nlattr *filter_attr) 11198 { 11199 struct nlattr *attr; 11200 int len = 0, n_entries = 0, rem; 11201 11202 nla_for_each_nested(attr, filter_attr, rem) { 11203 len += nla_len(attr); 11204 n_entries++; 11205 } 11206 11207 if (len >= U8_MAX) 11208 return -EINVAL; 11209 11210 return n_entries; 11211 } 11212 11213 static int handle_nan_filter(struct nlattr *attr_filter, 11214 struct cfg80211_nan_func *func, 11215 bool tx) 11216 { 11217 struct nlattr *attr; 11218 int n_entries, rem, i; 11219 struct cfg80211_nan_func_filter *filter; 11220 11221 n_entries = validate_nan_filter(attr_filter); 11222 if (n_entries < 0) 11223 return n_entries; 11224 11225 BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters)); 11226 11227 filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL); 11228 if (!filter) 11229 return -ENOMEM; 11230 11231 i = 0; 11232 nla_for_each_nested(attr, attr_filter, rem) { 11233 filter[i].filter = nla_memdup(attr, GFP_KERNEL); 11234 filter[i].len = nla_len(attr); 11235 i++; 11236 } 11237 if (tx) { 11238 func->num_tx_filters = n_entries; 11239 func->tx_filters = filter; 11240 } else { 11241 func->num_rx_filters = n_entries; 11242 func->rx_filters = filter; 11243 } 11244 11245 return 0; 11246 } 11247 11248 static int nl80211_nan_add_func(struct sk_buff *skb, 11249 struct genl_info *info) 11250 { 11251 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11252 struct wireless_dev *wdev = info->user_ptr[1]; 11253 struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr; 11254 struct cfg80211_nan_func *func; 11255 struct sk_buff *msg = NULL; 11256 void *hdr = NULL; 11257 int err = 0; 11258 11259 if (wdev->iftype != NL80211_IFTYPE_NAN) 11260 return -EOPNOTSUPP; 11261 11262 if (!wdev_running(wdev)) 11263 return -ENOTCONN; 11264 11265 if (!info->attrs[NL80211_ATTR_NAN_FUNC]) 11266 return -EINVAL; 11267 11268 err = nla_parse_nested(tb, NL80211_NAN_FUNC_ATTR_MAX, 11269 info->attrs[NL80211_ATTR_NAN_FUNC], 11270 nl80211_nan_func_policy, info->extack); 11271 if (err) 11272 return err; 11273 11274 func = kzalloc(sizeof(*func), GFP_KERNEL); 11275 if (!func) 11276 return -ENOMEM; 11277 11278 func->cookie = wdev->wiphy->cookie_counter++; 11279 11280 if (!tb[NL80211_NAN_FUNC_TYPE] || 11281 nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]) > NL80211_NAN_FUNC_MAX_TYPE) { 11282 err = -EINVAL; 11283 goto out; 11284 } 11285 11286 11287 func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]); 11288 11289 if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) { 11290 err = -EINVAL; 11291 goto out; 11292 } 11293 11294 memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]), 11295 sizeof(func->service_id)); 11296 11297 func->close_range = 11298 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]); 11299 11300 if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) { 11301 func->serv_spec_info_len = 11302 nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]); 11303 func->serv_spec_info = 11304 kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]), 11305 func->serv_spec_info_len, 11306 GFP_KERNEL); 11307 if (!func->serv_spec_info) { 11308 err = -ENOMEM; 11309 goto out; 11310 } 11311 } 11312 11313 if (tb[NL80211_NAN_FUNC_TTL]) 11314 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]); 11315 11316 switch (func->type) { 11317 case NL80211_NAN_FUNC_PUBLISH: 11318 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) { 11319 err = -EINVAL; 11320 goto out; 11321 } 11322 11323 func->publish_type = 11324 nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]); 11325 func->publish_bcast = 11326 nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]); 11327 11328 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) && 11329 func->publish_bcast) { 11330 err = -EINVAL; 11331 goto out; 11332 } 11333 break; 11334 case NL80211_NAN_FUNC_SUBSCRIBE: 11335 func->subscribe_active = 11336 nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]); 11337 break; 11338 case NL80211_NAN_FUNC_FOLLOW_UP: 11339 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] || 11340 !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]) { 11341 err = -EINVAL; 11342 goto out; 11343 } 11344 11345 func->followup_id = 11346 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]); 11347 func->followup_reqid = 11348 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]); 11349 memcpy(func->followup_dest.addr, 11350 nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]), 11351 sizeof(func->followup_dest.addr)); 11352 if (func->ttl) { 11353 err = -EINVAL; 11354 goto out; 11355 } 11356 break; 11357 default: 11358 err = -EINVAL; 11359 goto out; 11360 } 11361 11362 if (tb[NL80211_NAN_FUNC_SRF]) { 11363 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR]; 11364 11365 err = nla_parse_nested(srf_tb, NL80211_NAN_SRF_ATTR_MAX, 11366 tb[NL80211_NAN_FUNC_SRF], 11367 nl80211_nan_srf_policy, info->extack); 11368 if (err) 11369 goto out; 11370 11371 func->srf_include = 11372 nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]); 11373 11374 if (srf_tb[NL80211_NAN_SRF_BF]) { 11375 if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] || 11376 !srf_tb[NL80211_NAN_SRF_BF_IDX]) { 11377 err = -EINVAL; 11378 goto out; 11379 } 11380 11381 func->srf_bf_len = 11382 nla_len(srf_tb[NL80211_NAN_SRF_BF]); 11383 func->srf_bf = 11384 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]), 11385 func->srf_bf_len, GFP_KERNEL); 11386 if (!func->srf_bf) { 11387 err = -ENOMEM; 11388 goto out; 11389 } 11390 11391 func->srf_bf_idx = 11392 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]); 11393 } else { 11394 struct nlattr *attr, *mac_attr = 11395 srf_tb[NL80211_NAN_SRF_MAC_ADDRS]; 11396 int n_entries, rem, i = 0; 11397 11398 if (!mac_attr) { 11399 err = -EINVAL; 11400 goto out; 11401 } 11402 11403 n_entries = validate_acl_mac_addrs(mac_attr); 11404 if (n_entries <= 0) { 11405 err = -EINVAL; 11406 goto out; 11407 } 11408 11409 func->srf_num_macs = n_entries; 11410 func->srf_macs = 11411 kzalloc(sizeof(*func->srf_macs) * n_entries, 11412 GFP_KERNEL); 11413 if (!func->srf_macs) { 11414 err = -ENOMEM; 11415 goto out; 11416 } 11417 11418 nla_for_each_nested(attr, mac_attr, rem) 11419 memcpy(func->srf_macs[i++].addr, nla_data(attr), 11420 sizeof(*func->srf_macs)); 11421 } 11422 } 11423 11424 if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) { 11425 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER], 11426 func, true); 11427 if (err) 11428 goto out; 11429 } 11430 11431 if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) { 11432 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER], 11433 func, false); 11434 if (err) 11435 goto out; 11436 } 11437 11438 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 11439 if (!msg) { 11440 err = -ENOMEM; 11441 goto out; 11442 } 11443 11444 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 11445 NL80211_CMD_ADD_NAN_FUNCTION); 11446 /* This can't really happen - we just allocated 4KB */ 11447 if (WARN_ON(!hdr)) { 11448 err = -ENOMEM; 11449 goto out; 11450 } 11451 11452 err = rdev_add_nan_func(rdev, wdev, func); 11453 out: 11454 if (err < 0) { 11455 cfg80211_free_nan_func(func); 11456 nlmsg_free(msg); 11457 return err; 11458 } 11459 11460 /* propagate the instance id and cookie to userspace */ 11461 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie, 11462 NL80211_ATTR_PAD)) 11463 goto nla_put_failure; 11464 11465 func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC); 11466 if (!func_attr) 11467 goto nla_put_failure; 11468 11469 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, 11470 func->instance_id)) 11471 goto nla_put_failure; 11472 11473 nla_nest_end(msg, func_attr); 11474 11475 genlmsg_end(msg, hdr); 11476 return genlmsg_reply(msg, info); 11477 11478 nla_put_failure: 11479 nlmsg_free(msg); 11480 return -ENOBUFS; 11481 } 11482 11483 static int nl80211_nan_del_func(struct sk_buff *skb, 11484 struct genl_info *info) 11485 { 11486 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11487 struct wireless_dev *wdev = info->user_ptr[1]; 11488 u64 cookie; 11489 11490 if (wdev->iftype != NL80211_IFTYPE_NAN) 11491 return -EOPNOTSUPP; 11492 11493 if (!wdev_running(wdev)) 11494 return -ENOTCONN; 11495 11496 if (!info->attrs[NL80211_ATTR_COOKIE]) 11497 return -EINVAL; 11498 11499 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 11500 11501 rdev_del_nan_func(rdev, wdev, cookie); 11502 11503 return 0; 11504 } 11505 11506 static int nl80211_nan_change_config(struct sk_buff *skb, 11507 struct genl_info *info) 11508 { 11509 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11510 struct wireless_dev *wdev = info->user_ptr[1]; 11511 struct cfg80211_nan_conf conf = {}; 11512 u32 changed = 0; 11513 11514 if (wdev->iftype != NL80211_IFTYPE_NAN) 11515 return -EOPNOTSUPP; 11516 11517 if (!wdev_running(wdev)) 11518 return -ENOTCONN; 11519 11520 if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) { 11521 conf.master_pref = 11522 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]); 11523 if (conf.master_pref <= 1 || conf.master_pref == 255) 11524 return -EINVAL; 11525 11526 changed |= CFG80211_NAN_CONF_CHANGED_PREF; 11527 } 11528 11529 if (info->attrs[NL80211_ATTR_BANDS]) { 11530 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]); 11531 11532 if (bands & ~(u32)wdev->wiphy->nan_supported_bands) 11533 return -EOPNOTSUPP; 11534 11535 if (bands && !(bands & BIT(NL80211_BAND_2GHZ))) 11536 return -EINVAL; 11537 11538 conf.bands = bands; 11539 changed |= CFG80211_NAN_CONF_CHANGED_BANDS; 11540 } 11541 11542 if (!changed) 11543 return -EINVAL; 11544 11545 return rdev_nan_change_conf(rdev, wdev, &conf, changed); 11546 } 11547 11548 void cfg80211_nan_match(struct wireless_dev *wdev, 11549 struct cfg80211_nan_match_params *match, gfp_t gfp) 11550 { 11551 struct wiphy *wiphy = wdev->wiphy; 11552 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 11553 struct nlattr *match_attr, *local_func_attr, *peer_func_attr; 11554 struct sk_buff *msg; 11555 void *hdr; 11556 11557 if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr)) 11558 return; 11559 11560 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 11561 if (!msg) 11562 return; 11563 11564 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH); 11565 if (!hdr) { 11566 nlmsg_free(msg); 11567 return; 11568 } 11569 11570 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 11571 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 11572 wdev->netdev->ifindex)) || 11573 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 11574 NL80211_ATTR_PAD)) 11575 goto nla_put_failure; 11576 11577 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie, 11578 NL80211_ATTR_PAD) || 11579 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr)) 11580 goto nla_put_failure; 11581 11582 match_attr = nla_nest_start(msg, NL80211_ATTR_NAN_MATCH); 11583 if (!match_attr) 11584 goto nla_put_failure; 11585 11586 local_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_LOCAL); 11587 if (!local_func_attr) 11588 goto nla_put_failure; 11589 11590 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id)) 11591 goto nla_put_failure; 11592 11593 nla_nest_end(msg, local_func_attr); 11594 11595 peer_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_PEER); 11596 if (!peer_func_attr) 11597 goto nla_put_failure; 11598 11599 if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) || 11600 nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id)) 11601 goto nla_put_failure; 11602 11603 if (match->info && match->info_len && 11604 nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len, 11605 match->info)) 11606 goto nla_put_failure; 11607 11608 nla_nest_end(msg, peer_func_attr); 11609 nla_nest_end(msg, match_attr); 11610 genlmsg_end(msg, hdr); 11611 11612 if (!wdev->owner_nlportid) 11613 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), 11614 msg, 0, NL80211_MCGRP_NAN, gfp); 11615 else 11616 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, 11617 wdev->owner_nlportid); 11618 11619 return; 11620 11621 nla_put_failure: 11622 nlmsg_free(msg); 11623 } 11624 EXPORT_SYMBOL(cfg80211_nan_match); 11625 11626 void cfg80211_nan_func_terminated(struct wireless_dev *wdev, 11627 u8 inst_id, 11628 enum nl80211_nan_func_term_reason reason, 11629 u64 cookie, gfp_t gfp) 11630 { 11631 struct wiphy *wiphy = wdev->wiphy; 11632 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 11633 struct sk_buff *msg; 11634 struct nlattr *func_attr; 11635 void *hdr; 11636 11637 if (WARN_ON(!inst_id)) 11638 return; 11639 11640 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 11641 if (!msg) 11642 return; 11643 11644 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION); 11645 if (!hdr) { 11646 nlmsg_free(msg); 11647 return; 11648 } 11649 11650 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 11651 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 11652 wdev->netdev->ifindex)) || 11653 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 11654 NL80211_ATTR_PAD)) 11655 goto nla_put_failure; 11656 11657 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 11658 NL80211_ATTR_PAD)) 11659 goto nla_put_failure; 11660 11661 func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC); 11662 if (!func_attr) 11663 goto nla_put_failure; 11664 11665 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) || 11666 nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason)) 11667 goto nla_put_failure; 11668 11669 nla_nest_end(msg, func_attr); 11670 genlmsg_end(msg, hdr); 11671 11672 if (!wdev->owner_nlportid) 11673 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), 11674 msg, 0, NL80211_MCGRP_NAN, gfp); 11675 else 11676 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, 11677 wdev->owner_nlportid); 11678 11679 return; 11680 11681 nla_put_failure: 11682 nlmsg_free(msg); 11683 } 11684 EXPORT_SYMBOL(cfg80211_nan_func_terminated); 11685 11686 static int nl80211_get_protocol_features(struct sk_buff *skb, 11687 struct genl_info *info) 11688 { 11689 void *hdr; 11690 struct sk_buff *msg; 11691 11692 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 11693 if (!msg) 11694 return -ENOMEM; 11695 11696 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 11697 NL80211_CMD_GET_PROTOCOL_FEATURES); 11698 if (!hdr) 11699 goto nla_put_failure; 11700 11701 if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES, 11702 NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP)) 11703 goto nla_put_failure; 11704 11705 genlmsg_end(msg, hdr); 11706 return genlmsg_reply(msg, info); 11707 11708 nla_put_failure: 11709 kfree_skb(msg); 11710 return -ENOBUFS; 11711 } 11712 11713 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info) 11714 { 11715 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11716 struct cfg80211_update_ft_ies_params ft_params; 11717 struct net_device *dev = info->user_ptr[1]; 11718 11719 if (!rdev->ops->update_ft_ies) 11720 return -EOPNOTSUPP; 11721 11722 if (!info->attrs[NL80211_ATTR_MDID] || 11723 !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) 11724 return -EINVAL; 11725 11726 memset(&ft_params, 0, sizeof(ft_params)); 11727 ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]); 11728 ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 11729 ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 11730 11731 return rdev_update_ft_ies(rdev, dev, &ft_params); 11732 } 11733 11734 static int nl80211_crit_protocol_start(struct sk_buff *skb, 11735 struct genl_info *info) 11736 { 11737 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11738 struct wireless_dev *wdev = info->user_ptr[1]; 11739 enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC; 11740 u16 duration; 11741 int ret; 11742 11743 if (!rdev->ops->crit_proto_start) 11744 return -EOPNOTSUPP; 11745 11746 if (WARN_ON(!rdev->ops->crit_proto_stop)) 11747 return -EINVAL; 11748 11749 if (rdev->crit_proto_nlportid) 11750 return -EBUSY; 11751 11752 /* determine protocol if provided */ 11753 if (info->attrs[NL80211_ATTR_CRIT_PROT_ID]) 11754 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]); 11755 11756 if (proto >= NUM_NL80211_CRIT_PROTO) 11757 return -EINVAL; 11758 11759 /* timeout must be provided */ 11760 if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]) 11761 return -EINVAL; 11762 11763 duration = 11764 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]); 11765 11766 if (duration > NL80211_CRIT_PROTO_MAX_DURATION) 11767 return -ERANGE; 11768 11769 ret = rdev_crit_proto_start(rdev, wdev, proto, duration); 11770 if (!ret) 11771 rdev->crit_proto_nlportid = info->snd_portid; 11772 11773 return ret; 11774 } 11775 11776 static int nl80211_crit_protocol_stop(struct sk_buff *skb, 11777 struct genl_info *info) 11778 { 11779 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11780 struct wireless_dev *wdev = info->user_ptr[1]; 11781 11782 if (!rdev->ops->crit_proto_stop) 11783 return -EOPNOTSUPP; 11784 11785 if (rdev->crit_proto_nlportid) { 11786 rdev->crit_proto_nlportid = 0; 11787 rdev_crit_proto_stop(rdev, wdev); 11788 } 11789 return 0; 11790 } 11791 11792 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info) 11793 { 11794 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11795 struct wireless_dev *wdev = 11796 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs); 11797 int i, err; 11798 u32 vid, subcmd; 11799 11800 if (!rdev->wiphy.vendor_commands) 11801 return -EOPNOTSUPP; 11802 11803 if (IS_ERR(wdev)) { 11804 err = PTR_ERR(wdev); 11805 if (err != -EINVAL) 11806 return err; 11807 wdev = NULL; 11808 } else if (wdev->wiphy != &rdev->wiphy) { 11809 return -EINVAL; 11810 } 11811 11812 if (!info->attrs[NL80211_ATTR_VENDOR_ID] || 11813 !info->attrs[NL80211_ATTR_VENDOR_SUBCMD]) 11814 return -EINVAL; 11815 11816 vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]); 11817 subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]); 11818 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) { 11819 const struct wiphy_vendor_command *vcmd; 11820 void *data = NULL; 11821 int len = 0; 11822 11823 vcmd = &rdev->wiphy.vendor_commands[i]; 11824 11825 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd) 11826 continue; 11827 11828 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV | 11829 WIPHY_VENDOR_CMD_NEED_NETDEV)) { 11830 if (!wdev) 11831 return -EINVAL; 11832 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV && 11833 !wdev->netdev) 11834 return -EINVAL; 11835 11836 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) { 11837 if (!wdev_running(wdev)) 11838 return -ENETDOWN; 11839 } 11840 11841 if (!vcmd->doit) 11842 return -EOPNOTSUPP; 11843 } else { 11844 wdev = NULL; 11845 } 11846 11847 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) { 11848 data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]); 11849 len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]); 11850 } 11851 11852 rdev->cur_cmd_info = info; 11853 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev, 11854 data, len); 11855 rdev->cur_cmd_info = NULL; 11856 return err; 11857 } 11858 11859 return -EOPNOTSUPP; 11860 } 11861 11862 static int nl80211_prepare_vendor_dump(struct sk_buff *skb, 11863 struct netlink_callback *cb, 11864 struct cfg80211_registered_device **rdev, 11865 struct wireless_dev **wdev) 11866 { 11867 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam); 11868 u32 vid, subcmd; 11869 unsigned int i; 11870 int vcmd_idx = -1; 11871 int err; 11872 void *data = NULL; 11873 unsigned int data_len = 0; 11874 11875 if (cb->args[0]) { 11876 /* subtract the 1 again here */ 11877 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1); 11878 struct wireless_dev *tmp; 11879 11880 if (!wiphy) 11881 return -ENODEV; 11882 *rdev = wiphy_to_rdev(wiphy); 11883 *wdev = NULL; 11884 11885 if (cb->args[1]) { 11886 list_for_each_entry(tmp, &wiphy->wdev_list, list) { 11887 if (tmp->identifier == cb->args[1] - 1) { 11888 *wdev = tmp; 11889 break; 11890 } 11891 } 11892 } 11893 11894 /* keep rtnl locked in successful case */ 11895 return 0; 11896 } 11897 11898 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, attrbuf, 11899 nl80211_fam.maxattr, nl80211_policy, NULL); 11900 if (err) 11901 return err; 11902 11903 if (!attrbuf[NL80211_ATTR_VENDOR_ID] || 11904 !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) 11905 return -EINVAL; 11906 11907 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk), attrbuf); 11908 if (IS_ERR(*wdev)) 11909 *wdev = NULL; 11910 11911 *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf); 11912 if (IS_ERR(*rdev)) 11913 return PTR_ERR(*rdev); 11914 11915 vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]); 11916 subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]); 11917 11918 for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) { 11919 const struct wiphy_vendor_command *vcmd; 11920 11921 vcmd = &(*rdev)->wiphy.vendor_commands[i]; 11922 11923 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd) 11924 continue; 11925 11926 if (!vcmd->dumpit) 11927 return -EOPNOTSUPP; 11928 11929 vcmd_idx = i; 11930 break; 11931 } 11932 11933 if (vcmd_idx < 0) 11934 return -EOPNOTSUPP; 11935 11936 if (attrbuf[NL80211_ATTR_VENDOR_DATA]) { 11937 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]); 11938 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]); 11939 } 11940 11941 /* 0 is the first index - add 1 to parse only once */ 11942 cb->args[0] = (*rdev)->wiphy_idx + 1; 11943 /* add 1 to know if it was NULL */ 11944 cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0; 11945 cb->args[2] = vcmd_idx; 11946 cb->args[3] = (unsigned long)data; 11947 cb->args[4] = data_len; 11948 11949 /* keep rtnl locked in successful case */ 11950 return 0; 11951 } 11952 11953 static int nl80211_vendor_cmd_dump(struct sk_buff *skb, 11954 struct netlink_callback *cb) 11955 { 11956 struct cfg80211_registered_device *rdev; 11957 struct wireless_dev *wdev; 11958 unsigned int vcmd_idx; 11959 const struct wiphy_vendor_command *vcmd; 11960 void *data; 11961 int data_len; 11962 int err; 11963 struct nlattr *vendor_data; 11964 11965 rtnl_lock(); 11966 err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev); 11967 if (err) 11968 goto out; 11969 11970 vcmd_idx = cb->args[2]; 11971 data = (void *)cb->args[3]; 11972 data_len = cb->args[4]; 11973 vcmd = &rdev->wiphy.vendor_commands[vcmd_idx]; 11974 11975 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV | 11976 WIPHY_VENDOR_CMD_NEED_NETDEV)) { 11977 if (!wdev) { 11978 err = -EINVAL; 11979 goto out; 11980 } 11981 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV && 11982 !wdev->netdev) { 11983 err = -EINVAL; 11984 goto out; 11985 } 11986 11987 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) { 11988 if (!wdev_running(wdev)) { 11989 err = -ENETDOWN; 11990 goto out; 11991 } 11992 } 11993 } 11994 11995 while (1) { 11996 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid, 11997 cb->nlh->nlmsg_seq, NLM_F_MULTI, 11998 NL80211_CMD_VENDOR); 11999 if (!hdr) 12000 break; 12001 12002 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 12003 (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV, 12004 wdev_id(wdev), 12005 NL80211_ATTR_PAD))) { 12006 genlmsg_cancel(skb, hdr); 12007 break; 12008 } 12009 12010 vendor_data = nla_nest_start(skb, NL80211_ATTR_VENDOR_DATA); 12011 if (!vendor_data) { 12012 genlmsg_cancel(skb, hdr); 12013 break; 12014 } 12015 12016 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len, 12017 (unsigned long *)&cb->args[5]); 12018 nla_nest_end(skb, vendor_data); 12019 12020 if (err == -ENOBUFS || err == -ENOENT) { 12021 genlmsg_cancel(skb, hdr); 12022 break; 12023 } else if (err) { 12024 genlmsg_cancel(skb, hdr); 12025 goto out; 12026 } 12027 12028 genlmsg_end(skb, hdr); 12029 } 12030 12031 err = skb->len; 12032 out: 12033 rtnl_unlock(); 12034 return err; 12035 } 12036 12037 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy, 12038 enum nl80211_commands cmd, 12039 enum nl80211_attrs attr, 12040 int approxlen) 12041 { 12042 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 12043 12044 if (WARN_ON(!rdev->cur_cmd_info)) 12045 return NULL; 12046 12047 return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen, 12048 rdev->cur_cmd_info->snd_portid, 12049 rdev->cur_cmd_info->snd_seq, 12050 cmd, attr, NULL, GFP_KERNEL); 12051 } 12052 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb); 12053 12054 int cfg80211_vendor_cmd_reply(struct sk_buff *skb) 12055 { 12056 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0]; 12057 void *hdr = ((void **)skb->cb)[1]; 12058 struct nlattr *data = ((void **)skb->cb)[2]; 12059 12060 /* clear CB data for netlink core to own from now on */ 12061 memset(skb->cb, 0, sizeof(skb->cb)); 12062 12063 if (WARN_ON(!rdev->cur_cmd_info)) { 12064 kfree_skb(skb); 12065 return -EINVAL; 12066 } 12067 12068 nla_nest_end(skb, data); 12069 genlmsg_end(skb, hdr); 12070 return genlmsg_reply(skb, rdev->cur_cmd_info); 12071 } 12072 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply); 12073 12074 static int nl80211_set_qos_map(struct sk_buff *skb, 12075 struct genl_info *info) 12076 { 12077 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12078 struct cfg80211_qos_map *qos_map = NULL; 12079 struct net_device *dev = info->user_ptr[1]; 12080 u8 *pos, len, num_des, des_len, des; 12081 int ret; 12082 12083 if (!rdev->ops->set_qos_map) 12084 return -EOPNOTSUPP; 12085 12086 if (info->attrs[NL80211_ATTR_QOS_MAP]) { 12087 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]); 12088 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]); 12089 12090 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN || 12091 len > IEEE80211_QOS_MAP_LEN_MAX) 12092 return -EINVAL; 12093 12094 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL); 12095 if (!qos_map) 12096 return -ENOMEM; 12097 12098 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1; 12099 if (num_des) { 12100 des_len = num_des * 12101 sizeof(struct cfg80211_dscp_exception); 12102 memcpy(qos_map->dscp_exception, pos, des_len); 12103 qos_map->num_des = num_des; 12104 for (des = 0; des < num_des; des++) { 12105 if (qos_map->dscp_exception[des].up > 7) { 12106 kfree(qos_map); 12107 return -EINVAL; 12108 } 12109 } 12110 pos += des_len; 12111 } 12112 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN); 12113 } 12114 12115 wdev_lock(dev->ieee80211_ptr); 12116 ret = nl80211_key_allowed(dev->ieee80211_ptr); 12117 if (!ret) 12118 ret = rdev_set_qos_map(rdev, dev, qos_map); 12119 wdev_unlock(dev->ieee80211_ptr); 12120 12121 kfree(qos_map); 12122 return ret; 12123 } 12124 12125 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info) 12126 { 12127 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12128 struct net_device *dev = info->user_ptr[1]; 12129 struct wireless_dev *wdev = dev->ieee80211_ptr; 12130 const u8 *peer; 12131 u8 tsid, up; 12132 u16 admitted_time = 0; 12133 int err; 12134 12135 if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)) 12136 return -EOPNOTSUPP; 12137 12138 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] || 12139 !info->attrs[NL80211_ATTR_USER_PRIO]) 12140 return -EINVAL; 12141 12142 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]); 12143 if (tsid >= IEEE80211_NUM_TIDS) 12144 return -EINVAL; 12145 12146 up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]); 12147 if (up >= IEEE80211_NUM_UPS) 12148 return -EINVAL; 12149 12150 /* WMM uses TIDs 0-7 even for TSPEC */ 12151 if (tsid >= IEEE80211_FIRST_TSPEC_TSID) { 12152 /* TODO: handle 802.11 TSPEC/admission control 12153 * need more attributes for that (e.g. BA session requirement); 12154 * change the WMM adminssion test above to allow both then 12155 */ 12156 return -EINVAL; 12157 } 12158 12159 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 12160 12161 if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) { 12162 admitted_time = 12163 nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]); 12164 if (!admitted_time) 12165 return -EINVAL; 12166 } 12167 12168 wdev_lock(wdev); 12169 switch (wdev->iftype) { 12170 case NL80211_IFTYPE_STATION: 12171 case NL80211_IFTYPE_P2P_CLIENT: 12172 if (wdev->current_bss) 12173 break; 12174 err = -ENOTCONN; 12175 goto out; 12176 default: 12177 err = -EOPNOTSUPP; 12178 goto out; 12179 } 12180 12181 err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time); 12182 12183 out: 12184 wdev_unlock(wdev); 12185 return err; 12186 } 12187 12188 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info) 12189 { 12190 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12191 struct net_device *dev = info->user_ptr[1]; 12192 struct wireless_dev *wdev = dev->ieee80211_ptr; 12193 const u8 *peer; 12194 u8 tsid; 12195 int err; 12196 12197 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC]) 12198 return -EINVAL; 12199 12200 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]); 12201 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 12202 12203 wdev_lock(wdev); 12204 err = rdev_del_tx_ts(rdev, dev, tsid, peer); 12205 wdev_unlock(wdev); 12206 12207 return err; 12208 } 12209 12210 static int nl80211_tdls_channel_switch(struct sk_buff *skb, 12211 struct genl_info *info) 12212 { 12213 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12214 struct net_device *dev = info->user_ptr[1]; 12215 struct wireless_dev *wdev = dev->ieee80211_ptr; 12216 struct cfg80211_chan_def chandef = {}; 12217 const u8 *addr; 12218 u8 oper_class; 12219 int err; 12220 12221 if (!rdev->ops->tdls_channel_switch || 12222 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH)) 12223 return -EOPNOTSUPP; 12224 12225 switch (dev->ieee80211_ptr->iftype) { 12226 case NL80211_IFTYPE_STATION: 12227 case NL80211_IFTYPE_P2P_CLIENT: 12228 break; 12229 default: 12230 return -EOPNOTSUPP; 12231 } 12232 12233 if (!info->attrs[NL80211_ATTR_MAC] || 12234 !info->attrs[NL80211_ATTR_OPER_CLASS]) 12235 return -EINVAL; 12236 12237 err = nl80211_parse_chandef(rdev, info, &chandef); 12238 if (err) 12239 return err; 12240 12241 /* 12242 * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012 12243 * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the 12244 * specification is not defined for them. 12245 */ 12246 if (chandef.chan->band == NL80211_BAND_2GHZ && 12247 chandef.width != NL80211_CHAN_WIDTH_20_NOHT && 12248 chandef.width != NL80211_CHAN_WIDTH_20) 12249 return -EINVAL; 12250 12251 /* we will be active on the TDLS link */ 12252 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef, 12253 wdev->iftype)) 12254 return -EINVAL; 12255 12256 /* don't allow switching to DFS channels */ 12257 if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype)) 12258 return -EINVAL; 12259 12260 addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 12261 oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]); 12262 12263 wdev_lock(wdev); 12264 err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef); 12265 wdev_unlock(wdev); 12266 12267 return err; 12268 } 12269 12270 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb, 12271 struct genl_info *info) 12272 { 12273 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12274 struct net_device *dev = info->user_ptr[1]; 12275 struct wireless_dev *wdev = dev->ieee80211_ptr; 12276 const u8 *addr; 12277 12278 if (!rdev->ops->tdls_channel_switch || 12279 !rdev->ops->tdls_cancel_channel_switch || 12280 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH)) 12281 return -EOPNOTSUPP; 12282 12283 switch (dev->ieee80211_ptr->iftype) { 12284 case NL80211_IFTYPE_STATION: 12285 case NL80211_IFTYPE_P2P_CLIENT: 12286 break; 12287 default: 12288 return -EOPNOTSUPP; 12289 } 12290 12291 if (!info->attrs[NL80211_ATTR_MAC]) 12292 return -EINVAL; 12293 12294 addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 12295 12296 wdev_lock(wdev); 12297 rdev_tdls_cancel_channel_switch(rdev, dev, addr); 12298 wdev_unlock(wdev); 12299 12300 return 0; 12301 } 12302 12303 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb, 12304 struct genl_info *info) 12305 { 12306 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12307 struct net_device *dev = info->user_ptr[1]; 12308 struct wireless_dev *wdev = dev->ieee80211_ptr; 12309 const struct nlattr *nla; 12310 bool enabled; 12311 12312 if (!rdev->ops->set_multicast_to_unicast) 12313 return -EOPNOTSUPP; 12314 12315 if (wdev->iftype != NL80211_IFTYPE_AP && 12316 wdev->iftype != NL80211_IFTYPE_P2P_GO) 12317 return -EOPNOTSUPP; 12318 12319 nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED]; 12320 enabled = nla_get_flag(nla); 12321 12322 return rdev_set_multicast_to_unicast(rdev, dev, enabled); 12323 } 12324 12325 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info) 12326 { 12327 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12328 struct net_device *dev = info->user_ptr[1]; 12329 struct wireless_dev *wdev = dev->ieee80211_ptr; 12330 struct cfg80211_pmk_conf pmk_conf = {}; 12331 int ret; 12332 12333 if (wdev->iftype != NL80211_IFTYPE_STATION && 12334 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 12335 return -EOPNOTSUPP; 12336 12337 if (!wiphy_ext_feature_isset(&rdev->wiphy, 12338 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X)) 12339 return -EOPNOTSUPP; 12340 12341 if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK]) 12342 return -EINVAL; 12343 12344 wdev_lock(wdev); 12345 if (!wdev->current_bss) { 12346 ret = -ENOTCONN; 12347 goto out; 12348 } 12349 12350 pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]); 12351 if (memcmp(pmk_conf.aa, wdev->current_bss->pub.bssid, ETH_ALEN)) { 12352 ret = -EINVAL; 12353 goto out; 12354 } 12355 12356 pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]); 12357 pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]); 12358 if (pmk_conf.pmk_len != WLAN_PMK_LEN && 12359 pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) { 12360 ret = -EINVAL; 12361 goto out; 12362 } 12363 12364 if (info->attrs[NL80211_ATTR_PMKR0_NAME]) { 12365 int r0_name_len = nla_len(info->attrs[NL80211_ATTR_PMKR0_NAME]); 12366 12367 if (r0_name_len != WLAN_PMK_NAME_LEN) { 12368 ret = -EINVAL; 12369 goto out; 12370 } 12371 12372 pmk_conf.pmk_r0_name = 12373 nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]); 12374 } 12375 12376 ret = rdev_set_pmk(rdev, dev, &pmk_conf); 12377 out: 12378 wdev_unlock(wdev); 12379 return ret; 12380 } 12381 12382 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info) 12383 { 12384 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12385 struct net_device *dev = info->user_ptr[1]; 12386 struct wireless_dev *wdev = dev->ieee80211_ptr; 12387 const u8 *aa; 12388 int ret; 12389 12390 if (wdev->iftype != NL80211_IFTYPE_STATION && 12391 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 12392 return -EOPNOTSUPP; 12393 12394 if (!wiphy_ext_feature_isset(&rdev->wiphy, 12395 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X)) 12396 return -EOPNOTSUPP; 12397 12398 if (!info->attrs[NL80211_ATTR_MAC]) 12399 return -EINVAL; 12400 12401 wdev_lock(wdev); 12402 aa = nla_data(info->attrs[NL80211_ATTR_MAC]); 12403 ret = rdev_del_pmk(rdev, dev, aa); 12404 wdev_unlock(wdev); 12405 12406 return ret; 12407 } 12408 12409 #define NL80211_FLAG_NEED_WIPHY 0x01 12410 #define NL80211_FLAG_NEED_NETDEV 0x02 12411 #define NL80211_FLAG_NEED_RTNL 0x04 12412 #define NL80211_FLAG_CHECK_NETDEV_UP 0x08 12413 #define NL80211_FLAG_NEED_NETDEV_UP (NL80211_FLAG_NEED_NETDEV |\ 12414 NL80211_FLAG_CHECK_NETDEV_UP) 12415 #define NL80211_FLAG_NEED_WDEV 0x10 12416 /* If a netdev is associated, it must be UP, P2P must be started */ 12417 #define NL80211_FLAG_NEED_WDEV_UP (NL80211_FLAG_NEED_WDEV |\ 12418 NL80211_FLAG_CHECK_NETDEV_UP) 12419 #define NL80211_FLAG_CLEAR_SKB 0x20 12420 12421 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb, 12422 struct genl_info *info) 12423 { 12424 struct cfg80211_registered_device *rdev; 12425 struct wireless_dev *wdev; 12426 struct net_device *dev; 12427 bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL; 12428 12429 if (rtnl) 12430 rtnl_lock(); 12431 12432 if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) { 12433 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info); 12434 if (IS_ERR(rdev)) { 12435 if (rtnl) 12436 rtnl_unlock(); 12437 return PTR_ERR(rdev); 12438 } 12439 info->user_ptr[0] = rdev; 12440 } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV || 12441 ops->internal_flags & NL80211_FLAG_NEED_WDEV) { 12442 ASSERT_RTNL(); 12443 12444 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info), 12445 info->attrs); 12446 if (IS_ERR(wdev)) { 12447 if (rtnl) 12448 rtnl_unlock(); 12449 return PTR_ERR(wdev); 12450 } 12451 12452 dev = wdev->netdev; 12453 rdev = wiphy_to_rdev(wdev->wiphy); 12454 12455 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) { 12456 if (!dev) { 12457 if (rtnl) 12458 rtnl_unlock(); 12459 return -EINVAL; 12460 } 12461 12462 info->user_ptr[1] = dev; 12463 } else { 12464 info->user_ptr[1] = wdev; 12465 } 12466 12467 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP && 12468 !wdev_running(wdev)) { 12469 if (rtnl) 12470 rtnl_unlock(); 12471 return -ENETDOWN; 12472 } 12473 12474 if (dev) 12475 dev_hold(dev); 12476 12477 info->user_ptr[0] = rdev; 12478 } 12479 12480 return 0; 12481 } 12482 12483 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb, 12484 struct genl_info *info) 12485 { 12486 if (info->user_ptr[1]) { 12487 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) { 12488 struct wireless_dev *wdev = info->user_ptr[1]; 12489 12490 if (wdev->netdev) 12491 dev_put(wdev->netdev); 12492 } else { 12493 dev_put(info->user_ptr[1]); 12494 } 12495 } 12496 12497 if (ops->internal_flags & NL80211_FLAG_NEED_RTNL) 12498 rtnl_unlock(); 12499 12500 /* If needed, clear the netlink message payload from the SKB 12501 * as it might contain key data that shouldn't stick around on 12502 * the heap after the SKB is freed. The netlink message header 12503 * is still needed for further processing, so leave it intact. 12504 */ 12505 if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) { 12506 struct nlmsghdr *nlh = nlmsg_hdr(skb); 12507 12508 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh)); 12509 } 12510 } 12511 12512 static const struct genl_ops nl80211_ops[] = { 12513 { 12514 .cmd = NL80211_CMD_GET_WIPHY, 12515 .doit = nl80211_get_wiphy, 12516 .dumpit = nl80211_dump_wiphy, 12517 .done = nl80211_dump_wiphy_done, 12518 .policy = nl80211_policy, 12519 /* can be retrieved by unprivileged users */ 12520 .internal_flags = NL80211_FLAG_NEED_WIPHY | 12521 NL80211_FLAG_NEED_RTNL, 12522 }, 12523 { 12524 .cmd = NL80211_CMD_SET_WIPHY, 12525 .doit = nl80211_set_wiphy, 12526 .policy = nl80211_policy, 12527 .flags = GENL_UNS_ADMIN_PERM, 12528 .internal_flags = NL80211_FLAG_NEED_RTNL, 12529 }, 12530 { 12531 .cmd = NL80211_CMD_GET_INTERFACE, 12532 .doit = nl80211_get_interface, 12533 .dumpit = nl80211_dump_interface, 12534 .policy = nl80211_policy, 12535 /* can be retrieved by unprivileged users */ 12536 .internal_flags = NL80211_FLAG_NEED_WDEV | 12537 NL80211_FLAG_NEED_RTNL, 12538 }, 12539 { 12540 .cmd = NL80211_CMD_SET_INTERFACE, 12541 .doit = nl80211_set_interface, 12542 .policy = nl80211_policy, 12543 .flags = GENL_UNS_ADMIN_PERM, 12544 .internal_flags = NL80211_FLAG_NEED_NETDEV | 12545 NL80211_FLAG_NEED_RTNL, 12546 }, 12547 { 12548 .cmd = NL80211_CMD_NEW_INTERFACE, 12549 .doit = nl80211_new_interface, 12550 .policy = nl80211_policy, 12551 .flags = GENL_UNS_ADMIN_PERM, 12552 .internal_flags = NL80211_FLAG_NEED_WIPHY | 12553 NL80211_FLAG_NEED_RTNL, 12554 }, 12555 { 12556 .cmd = NL80211_CMD_DEL_INTERFACE, 12557 .doit = nl80211_del_interface, 12558 .policy = nl80211_policy, 12559 .flags = GENL_UNS_ADMIN_PERM, 12560 .internal_flags = NL80211_FLAG_NEED_WDEV | 12561 NL80211_FLAG_NEED_RTNL, 12562 }, 12563 { 12564 .cmd = NL80211_CMD_GET_KEY, 12565 .doit = nl80211_get_key, 12566 .policy = nl80211_policy, 12567 .flags = GENL_UNS_ADMIN_PERM, 12568 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12569 NL80211_FLAG_NEED_RTNL, 12570 }, 12571 { 12572 .cmd = NL80211_CMD_SET_KEY, 12573 .doit = nl80211_set_key, 12574 .policy = nl80211_policy, 12575 .flags = GENL_UNS_ADMIN_PERM, 12576 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12577 NL80211_FLAG_NEED_RTNL | 12578 NL80211_FLAG_CLEAR_SKB, 12579 }, 12580 { 12581 .cmd = NL80211_CMD_NEW_KEY, 12582 .doit = nl80211_new_key, 12583 .policy = nl80211_policy, 12584 .flags = GENL_UNS_ADMIN_PERM, 12585 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12586 NL80211_FLAG_NEED_RTNL | 12587 NL80211_FLAG_CLEAR_SKB, 12588 }, 12589 { 12590 .cmd = NL80211_CMD_DEL_KEY, 12591 .doit = nl80211_del_key, 12592 .policy = nl80211_policy, 12593 .flags = GENL_UNS_ADMIN_PERM, 12594 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12595 NL80211_FLAG_NEED_RTNL, 12596 }, 12597 { 12598 .cmd = NL80211_CMD_SET_BEACON, 12599 .policy = nl80211_policy, 12600 .flags = GENL_UNS_ADMIN_PERM, 12601 .doit = nl80211_set_beacon, 12602 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12603 NL80211_FLAG_NEED_RTNL, 12604 }, 12605 { 12606 .cmd = NL80211_CMD_START_AP, 12607 .policy = nl80211_policy, 12608 .flags = GENL_UNS_ADMIN_PERM, 12609 .doit = nl80211_start_ap, 12610 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12611 NL80211_FLAG_NEED_RTNL, 12612 }, 12613 { 12614 .cmd = NL80211_CMD_STOP_AP, 12615 .policy = nl80211_policy, 12616 .flags = GENL_UNS_ADMIN_PERM, 12617 .doit = nl80211_stop_ap, 12618 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12619 NL80211_FLAG_NEED_RTNL, 12620 }, 12621 { 12622 .cmd = NL80211_CMD_GET_STATION, 12623 .doit = nl80211_get_station, 12624 .dumpit = nl80211_dump_station, 12625 .policy = nl80211_policy, 12626 .internal_flags = NL80211_FLAG_NEED_NETDEV | 12627 NL80211_FLAG_NEED_RTNL, 12628 }, 12629 { 12630 .cmd = NL80211_CMD_SET_STATION, 12631 .doit = nl80211_set_station, 12632 .policy = nl80211_policy, 12633 .flags = GENL_UNS_ADMIN_PERM, 12634 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12635 NL80211_FLAG_NEED_RTNL, 12636 }, 12637 { 12638 .cmd = NL80211_CMD_NEW_STATION, 12639 .doit = nl80211_new_station, 12640 .policy = nl80211_policy, 12641 .flags = GENL_UNS_ADMIN_PERM, 12642 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12643 NL80211_FLAG_NEED_RTNL, 12644 }, 12645 { 12646 .cmd = NL80211_CMD_DEL_STATION, 12647 .doit = nl80211_del_station, 12648 .policy = nl80211_policy, 12649 .flags = GENL_UNS_ADMIN_PERM, 12650 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12651 NL80211_FLAG_NEED_RTNL, 12652 }, 12653 { 12654 .cmd = NL80211_CMD_GET_MPATH, 12655 .doit = nl80211_get_mpath, 12656 .dumpit = nl80211_dump_mpath, 12657 .policy = nl80211_policy, 12658 .flags = GENL_UNS_ADMIN_PERM, 12659 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12660 NL80211_FLAG_NEED_RTNL, 12661 }, 12662 { 12663 .cmd = NL80211_CMD_GET_MPP, 12664 .doit = nl80211_get_mpp, 12665 .dumpit = nl80211_dump_mpp, 12666 .policy = nl80211_policy, 12667 .flags = GENL_UNS_ADMIN_PERM, 12668 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12669 NL80211_FLAG_NEED_RTNL, 12670 }, 12671 { 12672 .cmd = NL80211_CMD_SET_MPATH, 12673 .doit = nl80211_set_mpath, 12674 .policy = nl80211_policy, 12675 .flags = GENL_UNS_ADMIN_PERM, 12676 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12677 NL80211_FLAG_NEED_RTNL, 12678 }, 12679 { 12680 .cmd = NL80211_CMD_NEW_MPATH, 12681 .doit = nl80211_new_mpath, 12682 .policy = nl80211_policy, 12683 .flags = GENL_UNS_ADMIN_PERM, 12684 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12685 NL80211_FLAG_NEED_RTNL, 12686 }, 12687 { 12688 .cmd = NL80211_CMD_DEL_MPATH, 12689 .doit = nl80211_del_mpath, 12690 .policy = nl80211_policy, 12691 .flags = GENL_UNS_ADMIN_PERM, 12692 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12693 NL80211_FLAG_NEED_RTNL, 12694 }, 12695 { 12696 .cmd = NL80211_CMD_SET_BSS, 12697 .doit = nl80211_set_bss, 12698 .policy = nl80211_policy, 12699 .flags = GENL_UNS_ADMIN_PERM, 12700 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12701 NL80211_FLAG_NEED_RTNL, 12702 }, 12703 { 12704 .cmd = NL80211_CMD_GET_REG, 12705 .doit = nl80211_get_reg_do, 12706 .dumpit = nl80211_get_reg_dump, 12707 .policy = nl80211_policy, 12708 .internal_flags = NL80211_FLAG_NEED_RTNL, 12709 /* can be retrieved by unprivileged users */ 12710 }, 12711 #ifdef CONFIG_CFG80211_CRDA_SUPPORT 12712 { 12713 .cmd = NL80211_CMD_SET_REG, 12714 .doit = nl80211_set_reg, 12715 .policy = nl80211_policy, 12716 .flags = GENL_ADMIN_PERM, 12717 .internal_flags = NL80211_FLAG_NEED_RTNL, 12718 }, 12719 #endif 12720 { 12721 .cmd = NL80211_CMD_REQ_SET_REG, 12722 .doit = nl80211_req_set_reg, 12723 .policy = nl80211_policy, 12724 .flags = GENL_ADMIN_PERM, 12725 }, 12726 { 12727 .cmd = NL80211_CMD_RELOAD_REGDB, 12728 .doit = nl80211_reload_regdb, 12729 .policy = nl80211_policy, 12730 .flags = GENL_ADMIN_PERM, 12731 }, 12732 { 12733 .cmd = NL80211_CMD_GET_MESH_CONFIG, 12734 .doit = nl80211_get_mesh_config, 12735 .policy = nl80211_policy, 12736 /* can be retrieved by unprivileged users */ 12737 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12738 NL80211_FLAG_NEED_RTNL, 12739 }, 12740 { 12741 .cmd = NL80211_CMD_SET_MESH_CONFIG, 12742 .doit = nl80211_update_mesh_config, 12743 .policy = nl80211_policy, 12744 .flags = GENL_UNS_ADMIN_PERM, 12745 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12746 NL80211_FLAG_NEED_RTNL, 12747 }, 12748 { 12749 .cmd = NL80211_CMD_TRIGGER_SCAN, 12750 .doit = nl80211_trigger_scan, 12751 .policy = nl80211_policy, 12752 .flags = GENL_UNS_ADMIN_PERM, 12753 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 12754 NL80211_FLAG_NEED_RTNL, 12755 }, 12756 { 12757 .cmd = NL80211_CMD_ABORT_SCAN, 12758 .doit = nl80211_abort_scan, 12759 .policy = nl80211_policy, 12760 .flags = GENL_UNS_ADMIN_PERM, 12761 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 12762 NL80211_FLAG_NEED_RTNL, 12763 }, 12764 { 12765 .cmd = NL80211_CMD_GET_SCAN, 12766 .policy = nl80211_policy, 12767 .dumpit = nl80211_dump_scan, 12768 }, 12769 { 12770 .cmd = NL80211_CMD_START_SCHED_SCAN, 12771 .doit = nl80211_start_sched_scan, 12772 .policy = nl80211_policy, 12773 .flags = GENL_UNS_ADMIN_PERM, 12774 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12775 NL80211_FLAG_NEED_RTNL, 12776 }, 12777 { 12778 .cmd = NL80211_CMD_STOP_SCHED_SCAN, 12779 .doit = nl80211_stop_sched_scan, 12780 .policy = nl80211_policy, 12781 .flags = GENL_UNS_ADMIN_PERM, 12782 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12783 NL80211_FLAG_NEED_RTNL, 12784 }, 12785 { 12786 .cmd = NL80211_CMD_AUTHENTICATE, 12787 .doit = nl80211_authenticate, 12788 .policy = nl80211_policy, 12789 .flags = GENL_UNS_ADMIN_PERM, 12790 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12791 NL80211_FLAG_NEED_RTNL | 12792 NL80211_FLAG_CLEAR_SKB, 12793 }, 12794 { 12795 .cmd = NL80211_CMD_ASSOCIATE, 12796 .doit = nl80211_associate, 12797 .policy = nl80211_policy, 12798 .flags = GENL_UNS_ADMIN_PERM, 12799 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12800 NL80211_FLAG_NEED_RTNL, 12801 }, 12802 { 12803 .cmd = NL80211_CMD_DEAUTHENTICATE, 12804 .doit = nl80211_deauthenticate, 12805 .policy = nl80211_policy, 12806 .flags = GENL_UNS_ADMIN_PERM, 12807 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12808 NL80211_FLAG_NEED_RTNL, 12809 }, 12810 { 12811 .cmd = NL80211_CMD_DISASSOCIATE, 12812 .doit = nl80211_disassociate, 12813 .policy = nl80211_policy, 12814 .flags = GENL_UNS_ADMIN_PERM, 12815 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12816 NL80211_FLAG_NEED_RTNL, 12817 }, 12818 { 12819 .cmd = NL80211_CMD_JOIN_IBSS, 12820 .doit = nl80211_join_ibss, 12821 .policy = nl80211_policy, 12822 .flags = GENL_UNS_ADMIN_PERM, 12823 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12824 NL80211_FLAG_NEED_RTNL, 12825 }, 12826 { 12827 .cmd = NL80211_CMD_LEAVE_IBSS, 12828 .doit = nl80211_leave_ibss, 12829 .policy = nl80211_policy, 12830 .flags = GENL_UNS_ADMIN_PERM, 12831 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12832 NL80211_FLAG_NEED_RTNL, 12833 }, 12834 #ifdef CONFIG_NL80211_TESTMODE 12835 { 12836 .cmd = NL80211_CMD_TESTMODE, 12837 .doit = nl80211_testmode_do, 12838 .dumpit = nl80211_testmode_dump, 12839 .policy = nl80211_policy, 12840 .flags = GENL_UNS_ADMIN_PERM, 12841 .internal_flags = NL80211_FLAG_NEED_WIPHY | 12842 NL80211_FLAG_NEED_RTNL, 12843 }, 12844 #endif 12845 { 12846 .cmd = NL80211_CMD_CONNECT, 12847 .doit = nl80211_connect, 12848 .policy = nl80211_policy, 12849 .flags = GENL_UNS_ADMIN_PERM, 12850 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12851 NL80211_FLAG_NEED_RTNL, 12852 }, 12853 { 12854 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS, 12855 .doit = nl80211_update_connect_params, 12856 .policy = nl80211_policy, 12857 .flags = GENL_ADMIN_PERM, 12858 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12859 NL80211_FLAG_NEED_RTNL, 12860 }, 12861 { 12862 .cmd = NL80211_CMD_DISCONNECT, 12863 .doit = nl80211_disconnect, 12864 .policy = nl80211_policy, 12865 .flags = GENL_UNS_ADMIN_PERM, 12866 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12867 NL80211_FLAG_NEED_RTNL, 12868 }, 12869 { 12870 .cmd = NL80211_CMD_SET_WIPHY_NETNS, 12871 .doit = nl80211_wiphy_netns, 12872 .policy = nl80211_policy, 12873 .flags = GENL_UNS_ADMIN_PERM, 12874 .internal_flags = NL80211_FLAG_NEED_WIPHY | 12875 NL80211_FLAG_NEED_RTNL, 12876 }, 12877 { 12878 .cmd = NL80211_CMD_GET_SURVEY, 12879 .policy = nl80211_policy, 12880 .dumpit = nl80211_dump_survey, 12881 }, 12882 { 12883 .cmd = NL80211_CMD_SET_PMKSA, 12884 .doit = nl80211_setdel_pmksa, 12885 .policy = nl80211_policy, 12886 .flags = GENL_UNS_ADMIN_PERM, 12887 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12888 NL80211_FLAG_NEED_RTNL, 12889 }, 12890 { 12891 .cmd = NL80211_CMD_DEL_PMKSA, 12892 .doit = nl80211_setdel_pmksa, 12893 .policy = nl80211_policy, 12894 .flags = GENL_UNS_ADMIN_PERM, 12895 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12896 NL80211_FLAG_NEED_RTNL, 12897 }, 12898 { 12899 .cmd = NL80211_CMD_FLUSH_PMKSA, 12900 .doit = nl80211_flush_pmksa, 12901 .policy = nl80211_policy, 12902 .flags = GENL_UNS_ADMIN_PERM, 12903 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12904 NL80211_FLAG_NEED_RTNL, 12905 }, 12906 { 12907 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL, 12908 .doit = nl80211_remain_on_channel, 12909 .policy = nl80211_policy, 12910 .flags = GENL_UNS_ADMIN_PERM, 12911 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 12912 NL80211_FLAG_NEED_RTNL, 12913 }, 12914 { 12915 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL, 12916 .doit = nl80211_cancel_remain_on_channel, 12917 .policy = nl80211_policy, 12918 .flags = GENL_UNS_ADMIN_PERM, 12919 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 12920 NL80211_FLAG_NEED_RTNL, 12921 }, 12922 { 12923 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK, 12924 .doit = nl80211_set_tx_bitrate_mask, 12925 .policy = nl80211_policy, 12926 .flags = GENL_UNS_ADMIN_PERM, 12927 .internal_flags = NL80211_FLAG_NEED_NETDEV | 12928 NL80211_FLAG_NEED_RTNL, 12929 }, 12930 { 12931 .cmd = NL80211_CMD_REGISTER_FRAME, 12932 .doit = nl80211_register_mgmt, 12933 .policy = nl80211_policy, 12934 .flags = GENL_UNS_ADMIN_PERM, 12935 .internal_flags = NL80211_FLAG_NEED_WDEV | 12936 NL80211_FLAG_NEED_RTNL, 12937 }, 12938 { 12939 .cmd = NL80211_CMD_FRAME, 12940 .doit = nl80211_tx_mgmt, 12941 .policy = nl80211_policy, 12942 .flags = GENL_UNS_ADMIN_PERM, 12943 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 12944 NL80211_FLAG_NEED_RTNL, 12945 }, 12946 { 12947 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL, 12948 .doit = nl80211_tx_mgmt_cancel_wait, 12949 .policy = nl80211_policy, 12950 .flags = GENL_UNS_ADMIN_PERM, 12951 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 12952 NL80211_FLAG_NEED_RTNL, 12953 }, 12954 { 12955 .cmd = NL80211_CMD_SET_POWER_SAVE, 12956 .doit = nl80211_set_power_save, 12957 .policy = nl80211_policy, 12958 .flags = GENL_UNS_ADMIN_PERM, 12959 .internal_flags = NL80211_FLAG_NEED_NETDEV | 12960 NL80211_FLAG_NEED_RTNL, 12961 }, 12962 { 12963 .cmd = NL80211_CMD_GET_POWER_SAVE, 12964 .doit = nl80211_get_power_save, 12965 .policy = nl80211_policy, 12966 /* can be retrieved by unprivileged users */ 12967 .internal_flags = NL80211_FLAG_NEED_NETDEV | 12968 NL80211_FLAG_NEED_RTNL, 12969 }, 12970 { 12971 .cmd = NL80211_CMD_SET_CQM, 12972 .doit = nl80211_set_cqm, 12973 .policy = nl80211_policy, 12974 .flags = GENL_UNS_ADMIN_PERM, 12975 .internal_flags = NL80211_FLAG_NEED_NETDEV | 12976 NL80211_FLAG_NEED_RTNL, 12977 }, 12978 { 12979 .cmd = NL80211_CMD_SET_CHANNEL, 12980 .doit = nl80211_set_channel, 12981 .policy = nl80211_policy, 12982 .flags = GENL_UNS_ADMIN_PERM, 12983 .internal_flags = NL80211_FLAG_NEED_NETDEV | 12984 NL80211_FLAG_NEED_RTNL, 12985 }, 12986 { 12987 .cmd = NL80211_CMD_SET_WDS_PEER, 12988 .doit = nl80211_set_wds_peer, 12989 .policy = nl80211_policy, 12990 .flags = GENL_UNS_ADMIN_PERM, 12991 .internal_flags = NL80211_FLAG_NEED_NETDEV | 12992 NL80211_FLAG_NEED_RTNL, 12993 }, 12994 { 12995 .cmd = NL80211_CMD_JOIN_MESH, 12996 .doit = nl80211_join_mesh, 12997 .policy = nl80211_policy, 12998 .flags = GENL_UNS_ADMIN_PERM, 12999 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13000 NL80211_FLAG_NEED_RTNL, 13001 }, 13002 { 13003 .cmd = NL80211_CMD_LEAVE_MESH, 13004 .doit = nl80211_leave_mesh, 13005 .policy = nl80211_policy, 13006 .flags = GENL_UNS_ADMIN_PERM, 13007 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13008 NL80211_FLAG_NEED_RTNL, 13009 }, 13010 { 13011 .cmd = NL80211_CMD_JOIN_OCB, 13012 .doit = nl80211_join_ocb, 13013 .policy = nl80211_policy, 13014 .flags = GENL_UNS_ADMIN_PERM, 13015 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13016 NL80211_FLAG_NEED_RTNL, 13017 }, 13018 { 13019 .cmd = NL80211_CMD_LEAVE_OCB, 13020 .doit = nl80211_leave_ocb, 13021 .policy = nl80211_policy, 13022 .flags = GENL_UNS_ADMIN_PERM, 13023 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13024 NL80211_FLAG_NEED_RTNL, 13025 }, 13026 #ifdef CONFIG_PM 13027 { 13028 .cmd = NL80211_CMD_GET_WOWLAN, 13029 .doit = nl80211_get_wowlan, 13030 .policy = nl80211_policy, 13031 /* can be retrieved by unprivileged users */ 13032 .internal_flags = NL80211_FLAG_NEED_WIPHY | 13033 NL80211_FLAG_NEED_RTNL, 13034 }, 13035 { 13036 .cmd = NL80211_CMD_SET_WOWLAN, 13037 .doit = nl80211_set_wowlan, 13038 .policy = nl80211_policy, 13039 .flags = GENL_UNS_ADMIN_PERM, 13040 .internal_flags = NL80211_FLAG_NEED_WIPHY | 13041 NL80211_FLAG_NEED_RTNL, 13042 }, 13043 #endif 13044 { 13045 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD, 13046 .doit = nl80211_set_rekey_data, 13047 .policy = nl80211_policy, 13048 .flags = GENL_UNS_ADMIN_PERM, 13049 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13050 NL80211_FLAG_NEED_RTNL | 13051 NL80211_FLAG_CLEAR_SKB, 13052 }, 13053 { 13054 .cmd = NL80211_CMD_TDLS_MGMT, 13055 .doit = nl80211_tdls_mgmt, 13056 .policy = nl80211_policy, 13057 .flags = GENL_UNS_ADMIN_PERM, 13058 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13059 NL80211_FLAG_NEED_RTNL, 13060 }, 13061 { 13062 .cmd = NL80211_CMD_TDLS_OPER, 13063 .doit = nl80211_tdls_oper, 13064 .policy = nl80211_policy, 13065 .flags = GENL_UNS_ADMIN_PERM, 13066 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13067 NL80211_FLAG_NEED_RTNL, 13068 }, 13069 { 13070 .cmd = NL80211_CMD_UNEXPECTED_FRAME, 13071 .doit = nl80211_register_unexpected_frame, 13072 .policy = nl80211_policy, 13073 .flags = GENL_UNS_ADMIN_PERM, 13074 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13075 NL80211_FLAG_NEED_RTNL, 13076 }, 13077 { 13078 .cmd = NL80211_CMD_PROBE_CLIENT, 13079 .doit = nl80211_probe_client, 13080 .policy = nl80211_policy, 13081 .flags = GENL_UNS_ADMIN_PERM, 13082 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13083 NL80211_FLAG_NEED_RTNL, 13084 }, 13085 { 13086 .cmd = NL80211_CMD_REGISTER_BEACONS, 13087 .doit = nl80211_register_beacons, 13088 .policy = nl80211_policy, 13089 .flags = GENL_UNS_ADMIN_PERM, 13090 .internal_flags = NL80211_FLAG_NEED_WIPHY | 13091 NL80211_FLAG_NEED_RTNL, 13092 }, 13093 { 13094 .cmd = NL80211_CMD_SET_NOACK_MAP, 13095 .doit = nl80211_set_noack_map, 13096 .policy = nl80211_policy, 13097 .flags = GENL_UNS_ADMIN_PERM, 13098 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13099 NL80211_FLAG_NEED_RTNL, 13100 }, 13101 { 13102 .cmd = NL80211_CMD_START_P2P_DEVICE, 13103 .doit = nl80211_start_p2p_device, 13104 .policy = nl80211_policy, 13105 .flags = GENL_UNS_ADMIN_PERM, 13106 .internal_flags = NL80211_FLAG_NEED_WDEV | 13107 NL80211_FLAG_NEED_RTNL, 13108 }, 13109 { 13110 .cmd = NL80211_CMD_STOP_P2P_DEVICE, 13111 .doit = nl80211_stop_p2p_device, 13112 .policy = nl80211_policy, 13113 .flags = GENL_UNS_ADMIN_PERM, 13114 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13115 NL80211_FLAG_NEED_RTNL, 13116 }, 13117 { 13118 .cmd = NL80211_CMD_START_NAN, 13119 .doit = nl80211_start_nan, 13120 .policy = nl80211_policy, 13121 .flags = GENL_ADMIN_PERM, 13122 .internal_flags = NL80211_FLAG_NEED_WDEV | 13123 NL80211_FLAG_NEED_RTNL, 13124 }, 13125 { 13126 .cmd = NL80211_CMD_STOP_NAN, 13127 .doit = nl80211_stop_nan, 13128 .policy = nl80211_policy, 13129 .flags = GENL_ADMIN_PERM, 13130 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13131 NL80211_FLAG_NEED_RTNL, 13132 }, 13133 { 13134 .cmd = NL80211_CMD_ADD_NAN_FUNCTION, 13135 .doit = nl80211_nan_add_func, 13136 .policy = nl80211_policy, 13137 .flags = GENL_ADMIN_PERM, 13138 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13139 NL80211_FLAG_NEED_RTNL, 13140 }, 13141 { 13142 .cmd = NL80211_CMD_DEL_NAN_FUNCTION, 13143 .doit = nl80211_nan_del_func, 13144 .policy = nl80211_policy, 13145 .flags = GENL_ADMIN_PERM, 13146 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13147 NL80211_FLAG_NEED_RTNL, 13148 }, 13149 { 13150 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG, 13151 .doit = nl80211_nan_change_config, 13152 .policy = nl80211_policy, 13153 .flags = GENL_ADMIN_PERM, 13154 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13155 NL80211_FLAG_NEED_RTNL, 13156 }, 13157 { 13158 .cmd = NL80211_CMD_SET_MCAST_RATE, 13159 .doit = nl80211_set_mcast_rate, 13160 .policy = nl80211_policy, 13161 .flags = GENL_UNS_ADMIN_PERM, 13162 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13163 NL80211_FLAG_NEED_RTNL, 13164 }, 13165 { 13166 .cmd = NL80211_CMD_SET_MAC_ACL, 13167 .doit = nl80211_set_mac_acl, 13168 .policy = nl80211_policy, 13169 .flags = GENL_UNS_ADMIN_PERM, 13170 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13171 NL80211_FLAG_NEED_RTNL, 13172 }, 13173 { 13174 .cmd = NL80211_CMD_RADAR_DETECT, 13175 .doit = nl80211_start_radar_detection, 13176 .policy = nl80211_policy, 13177 .flags = GENL_UNS_ADMIN_PERM, 13178 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13179 NL80211_FLAG_NEED_RTNL, 13180 }, 13181 { 13182 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES, 13183 .doit = nl80211_get_protocol_features, 13184 .policy = nl80211_policy, 13185 }, 13186 { 13187 .cmd = NL80211_CMD_UPDATE_FT_IES, 13188 .doit = nl80211_update_ft_ies, 13189 .policy = nl80211_policy, 13190 .flags = GENL_UNS_ADMIN_PERM, 13191 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13192 NL80211_FLAG_NEED_RTNL, 13193 }, 13194 { 13195 .cmd = NL80211_CMD_CRIT_PROTOCOL_START, 13196 .doit = nl80211_crit_protocol_start, 13197 .policy = nl80211_policy, 13198 .flags = GENL_UNS_ADMIN_PERM, 13199 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13200 NL80211_FLAG_NEED_RTNL, 13201 }, 13202 { 13203 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP, 13204 .doit = nl80211_crit_protocol_stop, 13205 .policy = nl80211_policy, 13206 .flags = GENL_UNS_ADMIN_PERM, 13207 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13208 NL80211_FLAG_NEED_RTNL, 13209 }, 13210 { 13211 .cmd = NL80211_CMD_GET_COALESCE, 13212 .doit = nl80211_get_coalesce, 13213 .policy = nl80211_policy, 13214 .internal_flags = NL80211_FLAG_NEED_WIPHY | 13215 NL80211_FLAG_NEED_RTNL, 13216 }, 13217 { 13218 .cmd = NL80211_CMD_SET_COALESCE, 13219 .doit = nl80211_set_coalesce, 13220 .policy = nl80211_policy, 13221 .flags = GENL_UNS_ADMIN_PERM, 13222 .internal_flags = NL80211_FLAG_NEED_WIPHY | 13223 NL80211_FLAG_NEED_RTNL, 13224 }, 13225 { 13226 .cmd = NL80211_CMD_CHANNEL_SWITCH, 13227 .doit = nl80211_channel_switch, 13228 .policy = nl80211_policy, 13229 .flags = GENL_UNS_ADMIN_PERM, 13230 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13231 NL80211_FLAG_NEED_RTNL, 13232 }, 13233 { 13234 .cmd = NL80211_CMD_VENDOR, 13235 .doit = nl80211_vendor_cmd, 13236 .dumpit = nl80211_vendor_cmd_dump, 13237 .policy = nl80211_policy, 13238 .flags = GENL_UNS_ADMIN_PERM, 13239 .internal_flags = NL80211_FLAG_NEED_WIPHY | 13240 NL80211_FLAG_NEED_RTNL, 13241 }, 13242 { 13243 .cmd = NL80211_CMD_SET_QOS_MAP, 13244 .doit = nl80211_set_qos_map, 13245 .policy = nl80211_policy, 13246 .flags = GENL_UNS_ADMIN_PERM, 13247 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13248 NL80211_FLAG_NEED_RTNL, 13249 }, 13250 { 13251 .cmd = NL80211_CMD_ADD_TX_TS, 13252 .doit = nl80211_add_tx_ts, 13253 .policy = nl80211_policy, 13254 .flags = GENL_UNS_ADMIN_PERM, 13255 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13256 NL80211_FLAG_NEED_RTNL, 13257 }, 13258 { 13259 .cmd = NL80211_CMD_DEL_TX_TS, 13260 .doit = nl80211_del_tx_ts, 13261 .policy = nl80211_policy, 13262 .flags = GENL_UNS_ADMIN_PERM, 13263 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13264 NL80211_FLAG_NEED_RTNL, 13265 }, 13266 { 13267 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH, 13268 .doit = nl80211_tdls_channel_switch, 13269 .policy = nl80211_policy, 13270 .flags = GENL_UNS_ADMIN_PERM, 13271 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13272 NL80211_FLAG_NEED_RTNL, 13273 }, 13274 { 13275 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH, 13276 .doit = nl80211_tdls_cancel_channel_switch, 13277 .policy = nl80211_policy, 13278 .flags = GENL_UNS_ADMIN_PERM, 13279 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13280 NL80211_FLAG_NEED_RTNL, 13281 }, 13282 { 13283 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST, 13284 .doit = nl80211_set_multicast_to_unicast, 13285 .policy = nl80211_policy, 13286 .flags = GENL_UNS_ADMIN_PERM, 13287 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13288 NL80211_FLAG_NEED_RTNL, 13289 }, 13290 { 13291 .cmd = NL80211_CMD_SET_PMK, 13292 .doit = nl80211_set_pmk, 13293 .policy = nl80211_policy, 13294 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13295 NL80211_FLAG_NEED_RTNL, 13296 }, 13297 { 13298 .cmd = NL80211_CMD_DEL_PMK, 13299 .doit = nl80211_del_pmk, 13300 .policy = nl80211_policy, 13301 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13302 NL80211_FLAG_NEED_RTNL, 13303 }, 13304 13305 }; 13306 13307 static struct genl_family nl80211_fam __ro_after_init = { 13308 .name = NL80211_GENL_NAME, /* have users key off the name instead */ 13309 .hdrsize = 0, /* no private header */ 13310 .version = 1, /* no particular meaning now */ 13311 .maxattr = NL80211_ATTR_MAX, 13312 .netnsok = true, 13313 .pre_doit = nl80211_pre_doit, 13314 .post_doit = nl80211_post_doit, 13315 .module = THIS_MODULE, 13316 .ops = nl80211_ops, 13317 .n_ops = ARRAY_SIZE(nl80211_ops), 13318 .mcgrps = nl80211_mcgrps, 13319 .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps), 13320 }; 13321 13322 /* notification functions */ 13323 13324 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev, 13325 enum nl80211_commands cmd) 13326 { 13327 struct sk_buff *msg; 13328 struct nl80211_dump_wiphy_state state = {}; 13329 13330 WARN_ON(cmd != NL80211_CMD_NEW_WIPHY && 13331 cmd != NL80211_CMD_DEL_WIPHY); 13332 13333 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 13334 if (!msg) 13335 return; 13336 13337 if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) { 13338 nlmsg_free(msg); 13339 return; 13340 } 13341 13342 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13343 NL80211_MCGRP_CONFIG, GFP_KERNEL); 13344 } 13345 13346 void nl80211_notify_iface(struct cfg80211_registered_device *rdev, 13347 struct wireless_dev *wdev, 13348 enum nl80211_commands cmd) 13349 { 13350 struct sk_buff *msg; 13351 13352 WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE && 13353 cmd != NL80211_CMD_DEL_INTERFACE); 13354 13355 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 13356 if (!msg) 13357 return; 13358 13359 if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, 13360 cmd == NL80211_CMD_DEL_INTERFACE) < 0) { 13361 nlmsg_free(msg); 13362 return; 13363 } 13364 13365 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13366 NL80211_MCGRP_CONFIG, GFP_KERNEL); 13367 } 13368 13369 static int nl80211_add_scan_req(struct sk_buff *msg, 13370 struct cfg80211_registered_device *rdev) 13371 { 13372 struct cfg80211_scan_request *req = rdev->scan_req; 13373 struct nlattr *nest; 13374 int i; 13375 13376 if (WARN_ON(!req)) 13377 return 0; 13378 13379 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS); 13380 if (!nest) 13381 goto nla_put_failure; 13382 for (i = 0; i < req->n_ssids; i++) { 13383 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid)) 13384 goto nla_put_failure; 13385 } 13386 nla_nest_end(msg, nest); 13387 13388 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES); 13389 if (!nest) 13390 goto nla_put_failure; 13391 for (i = 0; i < req->n_channels; i++) { 13392 if (nla_put_u32(msg, i, req->channels[i]->center_freq)) 13393 goto nla_put_failure; 13394 } 13395 nla_nest_end(msg, nest); 13396 13397 if (req->ie && 13398 nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie)) 13399 goto nla_put_failure; 13400 13401 if (req->flags && 13402 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags)) 13403 goto nla_put_failure; 13404 13405 if (req->info.scan_start_tsf && 13406 (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF, 13407 req->info.scan_start_tsf, NL80211_BSS_PAD) || 13408 nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN, 13409 req->info.tsf_bssid))) 13410 goto nla_put_failure; 13411 13412 return 0; 13413 nla_put_failure: 13414 return -ENOBUFS; 13415 } 13416 13417 static int nl80211_prep_scan_msg(struct sk_buff *msg, 13418 struct cfg80211_registered_device *rdev, 13419 struct wireless_dev *wdev, 13420 u32 portid, u32 seq, int flags, 13421 u32 cmd) 13422 { 13423 void *hdr; 13424 13425 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 13426 if (!hdr) 13427 return -1; 13428 13429 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 13430 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 13431 wdev->netdev->ifindex)) || 13432 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 13433 NL80211_ATTR_PAD)) 13434 goto nla_put_failure; 13435 13436 /* ignore errors and send incomplete event anyway */ 13437 nl80211_add_scan_req(msg, rdev); 13438 13439 genlmsg_end(msg, hdr); 13440 return 0; 13441 13442 nla_put_failure: 13443 genlmsg_cancel(msg, hdr); 13444 return -EMSGSIZE; 13445 } 13446 13447 static int 13448 nl80211_prep_sched_scan_msg(struct sk_buff *msg, 13449 struct cfg80211_sched_scan_request *req, u32 cmd) 13450 { 13451 void *hdr; 13452 13453 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 13454 if (!hdr) 13455 return -1; 13456 13457 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, 13458 wiphy_to_rdev(req->wiphy)->wiphy_idx) || 13459 nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) || 13460 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid, 13461 NL80211_ATTR_PAD)) 13462 goto nla_put_failure; 13463 13464 genlmsg_end(msg, hdr); 13465 return 0; 13466 13467 nla_put_failure: 13468 genlmsg_cancel(msg, hdr); 13469 return -EMSGSIZE; 13470 } 13471 13472 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev, 13473 struct wireless_dev *wdev) 13474 { 13475 struct sk_buff *msg; 13476 13477 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 13478 if (!msg) 13479 return; 13480 13481 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0, 13482 NL80211_CMD_TRIGGER_SCAN) < 0) { 13483 nlmsg_free(msg); 13484 return; 13485 } 13486 13487 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13488 NL80211_MCGRP_SCAN, GFP_KERNEL); 13489 } 13490 13491 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev, 13492 struct wireless_dev *wdev, bool aborted) 13493 { 13494 struct sk_buff *msg; 13495 13496 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 13497 if (!msg) 13498 return NULL; 13499 13500 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0, 13501 aborted ? NL80211_CMD_SCAN_ABORTED : 13502 NL80211_CMD_NEW_SCAN_RESULTS) < 0) { 13503 nlmsg_free(msg); 13504 return NULL; 13505 } 13506 13507 return msg; 13508 } 13509 13510 /* send message created by nl80211_build_scan_msg() */ 13511 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev, 13512 struct sk_buff *msg) 13513 { 13514 if (!msg) 13515 return; 13516 13517 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13518 NL80211_MCGRP_SCAN, GFP_KERNEL); 13519 } 13520 13521 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd) 13522 { 13523 struct sk_buff *msg; 13524 13525 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 13526 if (!msg) 13527 return; 13528 13529 if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) { 13530 nlmsg_free(msg); 13531 return; 13532 } 13533 13534 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0, 13535 NL80211_MCGRP_SCAN, GFP_KERNEL); 13536 } 13537 13538 static bool nl80211_reg_change_event_fill(struct sk_buff *msg, 13539 struct regulatory_request *request) 13540 { 13541 /* Userspace can always count this one always being set */ 13542 if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator)) 13543 goto nla_put_failure; 13544 13545 if (request->alpha2[0] == '0' && request->alpha2[1] == '0') { 13546 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 13547 NL80211_REGDOM_TYPE_WORLD)) 13548 goto nla_put_failure; 13549 } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') { 13550 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 13551 NL80211_REGDOM_TYPE_CUSTOM_WORLD)) 13552 goto nla_put_failure; 13553 } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') || 13554 request->intersect) { 13555 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 13556 NL80211_REGDOM_TYPE_INTERSECTION)) 13557 goto nla_put_failure; 13558 } else { 13559 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 13560 NL80211_REGDOM_TYPE_COUNTRY) || 13561 nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, 13562 request->alpha2)) 13563 goto nla_put_failure; 13564 } 13565 13566 if (request->wiphy_idx != WIPHY_IDX_INVALID) { 13567 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx); 13568 13569 if (wiphy && 13570 nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx)) 13571 goto nla_put_failure; 13572 13573 if (wiphy && 13574 wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED && 13575 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG)) 13576 goto nla_put_failure; 13577 } 13578 13579 return true; 13580 13581 nla_put_failure: 13582 return false; 13583 } 13584 13585 /* 13586 * This can happen on global regulatory changes or device specific settings 13587 * based on custom regulatory domains. 13588 */ 13589 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id, 13590 struct regulatory_request *request) 13591 { 13592 struct sk_buff *msg; 13593 void *hdr; 13594 13595 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 13596 if (!msg) 13597 return; 13598 13599 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id); 13600 if (!hdr) { 13601 nlmsg_free(msg); 13602 return; 13603 } 13604 13605 if (nl80211_reg_change_event_fill(msg, request) == false) 13606 goto nla_put_failure; 13607 13608 genlmsg_end(msg, hdr); 13609 13610 rcu_read_lock(); 13611 genlmsg_multicast_allns(&nl80211_fam, msg, 0, 13612 NL80211_MCGRP_REGULATORY, GFP_ATOMIC); 13613 rcu_read_unlock(); 13614 13615 return; 13616 13617 nla_put_failure: 13618 genlmsg_cancel(msg, hdr); 13619 nlmsg_free(msg); 13620 } 13621 13622 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev, 13623 struct net_device *netdev, 13624 const u8 *buf, size_t len, 13625 enum nl80211_commands cmd, gfp_t gfp, 13626 int uapsd_queues) 13627 { 13628 struct sk_buff *msg; 13629 void *hdr; 13630 13631 msg = nlmsg_new(100 + len, gfp); 13632 if (!msg) 13633 return; 13634 13635 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 13636 if (!hdr) { 13637 nlmsg_free(msg); 13638 return; 13639 } 13640 13641 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 13642 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 13643 nla_put(msg, NL80211_ATTR_FRAME, len, buf)) 13644 goto nla_put_failure; 13645 13646 if (uapsd_queues >= 0) { 13647 struct nlattr *nla_wmm = 13648 nla_nest_start(msg, NL80211_ATTR_STA_WME); 13649 if (!nla_wmm) 13650 goto nla_put_failure; 13651 13652 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES, 13653 uapsd_queues)) 13654 goto nla_put_failure; 13655 13656 nla_nest_end(msg, nla_wmm); 13657 } 13658 13659 genlmsg_end(msg, hdr); 13660 13661 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13662 NL80211_MCGRP_MLME, gfp); 13663 return; 13664 13665 nla_put_failure: 13666 genlmsg_cancel(msg, hdr); 13667 nlmsg_free(msg); 13668 } 13669 13670 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev, 13671 struct net_device *netdev, const u8 *buf, 13672 size_t len, gfp_t gfp) 13673 { 13674 nl80211_send_mlme_event(rdev, netdev, buf, len, 13675 NL80211_CMD_AUTHENTICATE, gfp, -1); 13676 } 13677 13678 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev, 13679 struct net_device *netdev, const u8 *buf, 13680 size_t len, gfp_t gfp, int uapsd_queues) 13681 { 13682 nl80211_send_mlme_event(rdev, netdev, buf, len, 13683 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues); 13684 } 13685 13686 void nl80211_send_deauth(struct cfg80211_registered_device *rdev, 13687 struct net_device *netdev, const u8 *buf, 13688 size_t len, gfp_t gfp) 13689 { 13690 nl80211_send_mlme_event(rdev, netdev, buf, len, 13691 NL80211_CMD_DEAUTHENTICATE, gfp, -1); 13692 } 13693 13694 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev, 13695 struct net_device *netdev, const u8 *buf, 13696 size_t len, gfp_t gfp) 13697 { 13698 nl80211_send_mlme_event(rdev, netdev, buf, len, 13699 NL80211_CMD_DISASSOCIATE, gfp, -1); 13700 } 13701 13702 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf, 13703 size_t len) 13704 { 13705 struct wireless_dev *wdev = dev->ieee80211_ptr; 13706 struct wiphy *wiphy = wdev->wiphy; 13707 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 13708 const struct ieee80211_mgmt *mgmt = (void *)buf; 13709 u32 cmd; 13710 13711 if (WARN_ON(len < 2)) 13712 return; 13713 13714 if (ieee80211_is_deauth(mgmt->frame_control)) 13715 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE; 13716 else 13717 cmd = NL80211_CMD_UNPROT_DISASSOCIATE; 13718 13719 trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len); 13720 nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1); 13721 } 13722 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt); 13723 13724 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev, 13725 struct net_device *netdev, int cmd, 13726 const u8 *addr, gfp_t gfp) 13727 { 13728 struct sk_buff *msg; 13729 void *hdr; 13730 13731 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 13732 if (!msg) 13733 return; 13734 13735 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 13736 if (!hdr) { 13737 nlmsg_free(msg); 13738 return; 13739 } 13740 13741 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 13742 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 13743 nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) || 13744 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) 13745 goto nla_put_failure; 13746 13747 genlmsg_end(msg, hdr); 13748 13749 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13750 NL80211_MCGRP_MLME, gfp); 13751 return; 13752 13753 nla_put_failure: 13754 genlmsg_cancel(msg, hdr); 13755 nlmsg_free(msg); 13756 } 13757 13758 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev, 13759 struct net_device *netdev, const u8 *addr, 13760 gfp_t gfp) 13761 { 13762 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE, 13763 addr, gfp); 13764 } 13765 13766 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev, 13767 struct net_device *netdev, const u8 *addr, 13768 gfp_t gfp) 13769 { 13770 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE, 13771 addr, gfp); 13772 } 13773 13774 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev, 13775 struct net_device *netdev, 13776 struct cfg80211_connect_resp_params *cr, 13777 gfp_t gfp) 13778 { 13779 struct sk_buff *msg; 13780 void *hdr; 13781 13782 msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len + 13783 cr->fils_kek_len + cr->pmk_len + 13784 (cr->pmkid ? WLAN_PMKID_LEN : 0), gfp); 13785 if (!msg) 13786 return; 13787 13788 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT); 13789 if (!hdr) { 13790 nlmsg_free(msg); 13791 return; 13792 } 13793 13794 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 13795 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 13796 (cr->bssid && 13797 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cr->bssid)) || 13798 nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, 13799 cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE : 13800 cr->status) || 13801 (cr->status < 0 && 13802 (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) || 13803 nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON, 13804 cr->timeout_reason))) || 13805 (cr->req_ie && 13806 nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) || 13807 (cr->resp_ie && 13808 nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len, 13809 cr->resp_ie)) || 13810 (cr->update_erp_next_seq_num && 13811 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM, 13812 cr->fils_erp_next_seq_num)) || 13813 (cr->status == WLAN_STATUS_SUCCESS && 13814 ((cr->fils_kek && 13815 nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils_kek_len, 13816 cr->fils_kek)) || 13817 (cr->pmk && 13818 nla_put(msg, NL80211_ATTR_PMK, cr->pmk_len, cr->pmk)) || 13819 (cr->pmkid && 13820 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->pmkid))))) 13821 goto nla_put_failure; 13822 13823 genlmsg_end(msg, hdr); 13824 13825 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13826 NL80211_MCGRP_MLME, gfp); 13827 return; 13828 13829 nla_put_failure: 13830 genlmsg_cancel(msg, hdr); 13831 nlmsg_free(msg); 13832 } 13833 13834 void nl80211_send_roamed(struct cfg80211_registered_device *rdev, 13835 struct net_device *netdev, 13836 struct cfg80211_roam_info *info, gfp_t gfp) 13837 { 13838 struct sk_buff *msg; 13839 void *hdr; 13840 const u8 *bssid = info->bss ? info->bss->bssid : info->bssid; 13841 13842 msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len, gfp); 13843 if (!msg) 13844 return; 13845 13846 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM); 13847 if (!hdr) { 13848 nlmsg_free(msg); 13849 return; 13850 } 13851 13852 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 13853 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 13854 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) || 13855 (info->req_ie && 13856 nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len, 13857 info->req_ie)) || 13858 (info->resp_ie && 13859 nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len, 13860 info->resp_ie))) 13861 goto nla_put_failure; 13862 13863 genlmsg_end(msg, hdr); 13864 13865 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13866 NL80211_MCGRP_MLME, gfp); 13867 return; 13868 13869 nla_put_failure: 13870 genlmsg_cancel(msg, hdr); 13871 nlmsg_free(msg); 13872 } 13873 13874 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev, 13875 struct net_device *netdev, const u8 *bssid) 13876 { 13877 struct sk_buff *msg; 13878 void *hdr; 13879 13880 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 13881 if (!msg) 13882 return; 13883 13884 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED); 13885 if (!hdr) { 13886 nlmsg_free(msg); 13887 return; 13888 } 13889 13890 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) 13891 goto nla_put_failure; 13892 13893 genlmsg_end(msg, hdr); 13894 13895 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13896 NL80211_MCGRP_MLME, GFP_KERNEL); 13897 return; 13898 13899 nla_put_failure: 13900 genlmsg_cancel(msg, hdr); 13901 nlmsg_free(msg); 13902 } 13903 13904 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev, 13905 struct net_device *netdev, u16 reason, 13906 const u8 *ie, size_t ie_len, bool from_ap) 13907 { 13908 struct sk_buff *msg; 13909 void *hdr; 13910 13911 msg = nlmsg_new(100 + ie_len, GFP_KERNEL); 13912 if (!msg) 13913 return; 13914 13915 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT); 13916 if (!hdr) { 13917 nlmsg_free(msg); 13918 return; 13919 } 13920 13921 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 13922 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 13923 (from_ap && reason && 13924 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) || 13925 (from_ap && 13926 nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) || 13927 (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie))) 13928 goto nla_put_failure; 13929 13930 genlmsg_end(msg, hdr); 13931 13932 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13933 NL80211_MCGRP_MLME, GFP_KERNEL); 13934 return; 13935 13936 nla_put_failure: 13937 genlmsg_cancel(msg, hdr); 13938 nlmsg_free(msg); 13939 } 13940 13941 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev, 13942 struct net_device *netdev, const u8 *bssid, 13943 gfp_t gfp) 13944 { 13945 struct sk_buff *msg; 13946 void *hdr; 13947 13948 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 13949 if (!msg) 13950 return; 13951 13952 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS); 13953 if (!hdr) { 13954 nlmsg_free(msg); 13955 return; 13956 } 13957 13958 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 13959 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 13960 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) 13961 goto nla_put_failure; 13962 13963 genlmsg_end(msg, hdr); 13964 13965 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13966 NL80211_MCGRP_MLME, gfp); 13967 return; 13968 13969 nla_put_failure: 13970 genlmsg_cancel(msg, hdr); 13971 nlmsg_free(msg); 13972 } 13973 13974 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr, 13975 const u8* ie, u8 ie_len, gfp_t gfp) 13976 { 13977 struct wireless_dev *wdev = dev->ieee80211_ptr; 13978 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 13979 struct sk_buff *msg; 13980 void *hdr; 13981 13982 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT)) 13983 return; 13984 13985 trace_cfg80211_notify_new_peer_candidate(dev, addr); 13986 13987 msg = nlmsg_new(100 + ie_len, gfp); 13988 if (!msg) 13989 return; 13990 13991 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE); 13992 if (!hdr) { 13993 nlmsg_free(msg); 13994 return; 13995 } 13996 13997 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 13998 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 13999 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) || 14000 (ie_len && ie && 14001 nla_put(msg, NL80211_ATTR_IE, ie_len , ie))) 14002 goto nla_put_failure; 14003 14004 genlmsg_end(msg, hdr); 14005 14006 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14007 NL80211_MCGRP_MLME, gfp); 14008 return; 14009 14010 nla_put_failure: 14011 genlmsg_cancel(msg, hdr); 14012 nlmsg_free(msg); 14013 } 14014 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate); 14015 14016 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev, 14017 struct net_device *netdev, const u8 *addr, 14018 enum nl80211_key_type key_type, int key_id, 14019 const u8 *tsc, gfp_t gfp) 14020 { 14021 struct sk_buff *msg; 14022 void *hdr; 14023 14024 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14025 if (!msg) 14026 return; 14027 14028 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE); 14029 if (!hdr) { 14030 nlmsg_free(msg); 14031 return; 14032 } 14033 14034 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14035 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 14036 (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) || 14037 nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) || 14038 (key_id != -1 && 14039 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) || 14040 (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc))) 14041 goto nla_put_failure; 14042 14043 genlmsg_end(msg, hdr); 14044 14045 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14046 NL80211_MCGRP_MLME, gfp); 14047 return; 14048 14049 nla_put_failure: 14050 genlmsg_cancel(msg, hdr); 14051 nlmsg_free(msg); 14052 } 14053 14054 void nl80211_send_beacon_hint_event(struct wiphy *wiphy, 14055 struct ieee80211_channel *channel_before, 14056 struct ieee80211_channel *channel_after) 14057 { 14058 struct sk_buff *msg; 14059 void *hdr; 14060 struct nlattr *nl_freq; 14061 14062 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); 14063 if (!msg) 14064 return; 14065 14066 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT); 14067 if (!hdr) { 14068 nlmsg_free(msg); 14069 return; 14070 } 14071 14072 /* 14073 * Since we are applying the beacon hint to a wiphy we know its 14074 * wiphy_idx is valid 14075 */ 14076 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy))) 14077 goto nla_put_failure; 14078 14079 /* Before */ 14080 nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE); 14081 if (!nl_freq) 14082 goto nla_put_failure; 14083 if (nl80211_msg_put_channel(msg, channel_before, false)) 14084 goto nla_put_failure; 14085 nla_nest_end(msg, nl_freq); 14086 14087 /* After */ 14088 nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER); 14089 if (!nl_freq) 14090 goto nla_put_failure; 14091 if (nl80211_msg_put_channel(msg, channel_after, false)) 14092 goto nla_put_failure; 14093 nla_nest_end(msg, nl_freq); 14094 14095 genlmsg_end(msg, hdr); 14096 14097 rcu_read_lock(); 14098 genlmsg_multicast_allns(&nl80211_fam, msg, 0, 14099 NL80211_MCGRP_REGULATORY, GFP_ATOMIC); 14100 rcu_read_unlock(); 14101 14102 return; 14103 14104 nla_put_failure: 14105 genlmsg_cancel(msg, hdr); 14106 nlmsg_free(msg); 14107 } 14108 14109 static void nl80211_send_remain_on_chan_event( 14110 int cmd, struct cfg80211_registered_device *rdev, 14111 struct wireless_dev *wdev, u64 cookie, 14112 struct ieee80211_channel *chan, 14113 unsigned int duration, gfp_t gfp) 14114 { 14115 struct sk_buff *msg; 14116 void *hdr; 14117 14118 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14119 if (!msg) 14120 return; 14121 14122 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 14123 if (!hdr) { 14124 nlmsg_free(msg); 14125 return; 14126 } 14127 14128 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14129 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 14130 wdev->netdev->ifindex)) || 14131 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 14132 NL80211_ATTR_PAD) || 14133 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) || 14134 nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, 14135 NL80211_CHAN_NO_HT) || 14136 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 14137 NL80211_ATTR_PAD)) 14138 goto nla_put_failure; 14139 14140 if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL && 14141 nla_put_u32(msg, NL80211_ATTR_DURATION, duration)) 14142 goto nla_put_failure; 14143 14144 genlmsg_end(msg, hdr); 14145 14146 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14147 NL80211_MCGRP_MLME, gfp); 14148 return; 14149 14150 nla_put_failure: 14151 genlmsg_cancel(msg, hdr); 14152 nlmsg_free(msg); 14153 } 14154 14155 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie, 14156 struct ieee80211_channel *chan, 14157 unsigned int duration, gfp_t gfp) 14158 { 14159 struct wiphy *wiphy = wdev->wiphy; 14160 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14161 14162 trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration); 14163 nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL, 14164 rdev, wdev, cookie, chan, 14165 duration, gfp); 14166 } 14167 EXPORT_SYMBOL(cfg80211_ready_on_channel); 14168 14169 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie, 14170 struct ieee80211_channel *chan, 14171 gfp_t gfp) 14172 { 14173 struct wiphy *wiphy = wdev->wiphy; 14174 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14175 14176 trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan); 14177 nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL, 14178 rdev, wdev, cookie, chan, 0, gfp); 14179 } 14180 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired); 14181 14182 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr, 14183 struct station_info *sinfo, gfp_t gfp) 14184 { 14185 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy; 14186 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14187 struct sk_buff *msg; 14188 14189 trace_cfg80211_new_sta(dev, mac_addr, sinfo); 14190 14191 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14192 if (!msg) 14193 return; 14194 14195 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0, 14196 rdev, dev, mac_addr, sinfo) < 0) { 14197 nlmsg_free(msg); 14198 return; 14199 } 14200 14201 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14202 NL80211_MCGRP_MLME, gfp); 14203 } 14204 EXPORT_SYMBOL(cfg80211_new_sta); 14205 14206 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr, 14207 struct station_info *sinfo, gfp_t gfp) 14208 { 14209 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy; 14210 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14211 struct sk_buff *msg; 14212 struct station_info empty_sinfo = {}; 14213 14214 if (!sinfo) 14215 sinfo = &empty_sinfo; 14216 14217 trace_cfg80211_del_sta(dev, mac_addr); 14218 14219 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14220 if (!msg) 14221 return; 14222 14223 if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0, 14224 rdev, dev, mac_addr, sinfo) < 0) { 14225 nlmsg_free(msg); 14226 return; 14227 } 14228 14229 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14230 NL80211_MCGRP_MLME, gfp); 14231 } 14232 EXPORT_SYMBOL(cfg80211_del_sta_sinfo); 14233 14234 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr, 14235 enum nl80211_connect_failed_reason reason, 14236 gfp_t gfp) 14237 { 14238 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy; 14239 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14240 struct sk_buff *msg; 14241 void *hdr; 14242 14243 msg = nlmsg_new(NLMSG_GOODSIZE, gfp); 14244 if (!msg) 14245 return; 14246 14247 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED); 14248 if (!hdr) { 14249 nlmsg_free(msg); 14250 return; 14251 } 14252 14253 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 14254 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) || 14255 nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason)) 14256 goto nla_put_failure; 14257 14258 genlmsg_end(msg, hdr); 14259 14260 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14261 NL80211_MCGRP_MLME, gfp); 14262 return; 14263 14264 nla_put_failure: 14265 genlmsg_cancel(msg, hdr); 14266 nlmsg_free(msg); 14267 } 14268 EXPORT_SYMBOL(cfg80211_conn_failed); 14269 14270 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd, 14271 const u8 *addr, gfp_t gfp) 14272 { 14273 struct wireless_dev *wdev = dev->ieee80211_ptr; 14274 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 14275 struct sk_buff *msg; 14276 void *hdr; 14277 u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid); 14278 14279 if (!nlportid) 14280 return false; 14281 14282 msg = nlmsg_new(100, gfp); 14283 if (!msg) 14284 return true; 14285 14286 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 14287 if (!hdr) { 14288 nlmsg_free(msg); 14289 return true; 14290 } 14291 14292 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14293 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 14294 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) 14295 goto nla_put_failure; 14296 14297 genlmsg_end(msg, hdr); 14298 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 14299 return true; 14300 14301 nla_put_failure: 14302 genlmsg_cancel(msg, hdr); 14303 nlmsg_free(msg); 14304 return true; 14305 } 14306 14307 bool cfg80211_rx_spurious_frame(struct net_device *dev, 14308 const u8 *addr, gfp_t gfp) 14309 { 14310 struct wireless_dev *wdev = dev->ieee80211_ptr; 14311 bool ret; 14312 14313 trace_cfg80211_rx_spurious_frame(dev, addr); 14314 14315 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP && 14316 wdev->iftype != NL80211_IFTYPE_P2P_GO)) { 14317 trace_cfg80211_return_bool(false); 14318 return false; 14319 } 14320 ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME, 14321 addr, gfp); 14322 trace_cfg80211_return_bool(ret); 14323 return ret; 14324 } 14325 EXPORT_SYMBOL(cfg80211_rx_spurious_frame); 14326 14327 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev, 14328 const u8 *addr, gfp_t gfp) 14329 { 14330 struct wireless_dev *wdev = dev->ieee80211_ptr; 14331 bool ret; 14332 14333 trace_cfg80211_rx_unexpected_4addr_frame(dev, addr); 14334 14335 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP && 14336 wdev->iftype != NL80211_IFTYPE_P2P_GO && 14337 wdev->iftype != NL80211_IFTYPE_AP_VLAN)) { 14338 trace_cfg80211_return_bool(false); 14339 return false; 14340 } 14341 ret = __nl80211_unexpected_frame(dev, 14342 NL80211_CMD_UNEXPECTED_4ADDR_FRAME, 14343 addr, gfp); 14344 trace_cfg80211_return_bool(ret); 14345 return ret; 14346 } 14347 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame); 14348 14349 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev, 14350 struct wireless_dev *wdev, u32 nlportid, 14351 int freq, int sig_dbm, 14352 const u8 *buf, size_t len, u32 flags, gfp_t gfp) 14353 { 14354 struct net_device *netdev = wdev->netdev; 14355 struct sk_buff *msg; 14356 void *hdr; 14357 14358 msg = nlmsg_new(100 + len, gfp); 14359 if (!msg) 14360 return -ENOMEM; 14361 14362 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME); 14363 if (!hdr) { 14364 nlmsg_free(msg); 14365 return -ENOMEM; 14366 } 14367 14368 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14369 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 14370 netdev->ifindex)) || 14371 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 14372 NL80211_ATTR_PAD) || 14373 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) || 14374 (sig_dbm && 14375 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) || 14376 nla_put(msg, NL80211_ATTR_FRAME, len, buf) || 14377 (flags && 14378 nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags))) 14379 goto nla_put_failure; 14380 14381 genlmsg_end(msg, hdr); 14382 14383 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 14384 14385 nla_put_failure: 14386 genlmsg_cancel(msg, hdr); 14387 nlmsg_free(msg); 14388 return -ENOBUFS; 14389 } 14390 14391 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie, 14392 const u8 *buf, size_t len, bool ack, gfp_t gfp) 14393 { 14394 struct wiphy *wiphy = wdev->wiphy; 14395 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14396 struct net_device *netdev = wdev->netdev; 14397 struct sk_buff *msg; 14398 void *hdr; 14399 14400 trace_cfg80211_mgmt_tx_status(wdev, cookie, ack); 14401 14402 msg = nlmsg_new(100 + len, gfp); 14403 if (!msg) 14404 return; 14405 14406 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS); 14407 if (!hdr) { 14408 nlmsg_free(msg); 14409 return; 14410 } 14411 14412 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14413 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 14414 netdev->ifindex)) || 14415 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 14416 NL80211_ATTR_PAD) || 14417 nla_put(msg, NL80211_ATTR_FRAME, len, buf) || 14418 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 14419 NL80211_ATTR_PAD) || 14420 (ack && nla_put_flag(msg, NL80211_ATTR_ACK))) 14421 goto nla_put_failure; 14422 14423 genlmsg_end(msg, hdr); 14424 14425 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14426 NL80211_MCGRP_MLME, gfp); 14427 return; 14428 14429 nla_put_failure: 14430 genlmsg_cancel(msg, hdr); 14431 nlmsg_free(msg); 14432 } 14433 EXPORT_SYMBOL(cfg80211_mgmt_tx_status); 14434 14435 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev, 14436 const char *mac, gfp_t gfp) 14437 { 14438 struct wireless_dev *wdev = dev->ieee80211_ptr; 14439 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 14440 struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14441 void **cb; 14442 14443 if (!msg) 14444 return NULL; 14445 14446 cb = (void **)msg->cb; 14447 14448 cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM); 14449 if (!cb[0]) { 14450 nlmsg_free(msg); 14451 return NULL; 14452 } 14453 14454 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14455 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 14456 goto nla_put_failure; 14457 14458 if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac)) 14459 goto nla_put_failure; 14460 14461 cb[1] = nla_nest_start(msg, NL80211_ATTR_CQM); 14462 if (!cb[1]) 14463 goto nla_put_failure; 14464 14465 cb[2] = rdev; 14466 14467 return msg; 14468 nla_put_failure: 14469 nlmsg_free(msg); 14470 return NULL; 14471 } 14472 14473 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp) 14474 { 14475 void **cb = (void **)msg->cb; 14476 struct cfg80211_registered_device *rdev = cb[2]; 14477 14478 nla_nest_end(msg, cb[1]); 14479 genlmsg_end(msg, cb[0]); 14480 14481 memset(msg->cb, 0, sizeof(msg->cb)); 14482 14483 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14484 NL80211_MCGRP_MLME, gfp); 14485 } 14486 14487 void cfg80211_cqm_rssi_notify(struct net_device *dev, 14488 enum nl80211_cqm_rssi_threshold_event rssi_event, 14489 s32 rssi_level, gfp_t gfp) 14490 { 14491 struct sk_buff *msg; 14492 struct wireless_dev *wdev = dev->ieee80211_ptr; 14493 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 14494 14495 trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level); 14496 14497 if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW && 14498 rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH)) 14499 return; 14500 14501 if (wdev->cqm_config) { 14502 wdev->cqm_config->last_rssi_event_value = rssi_level; 14503 14504 cfg80211_cqm_rssi_update(rdev, dev); 14505 14506 if (rssi_level == 0) 14507 rssi_level = wdev->cqm_config->last_rssi_event_value; 14508 } 14509 14510 msg = cfg80211_prepare_cqm(dev, NULL, gfp); 14511 if (!msg) 14512 return; 14513 14514 if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT, 14515 rssi_event)) 14516 goto nla_put_failure; 14517 14518 if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL, 14519 rssi_level)) 14520 goto nla_put_failure; 14521 14522 cfg80211_send_cqm(msg, gfp); 14523 14524 return; 14525 14526 nla_put_failure: 14527 nlmsg_free(msg); 14528 } 14529 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify); 14530 14531 void cfg80211_cqm_txe_notify(struct net_device *dev, 14532 const u8 *peer, u32 num_packets, 14533 u32 rate, u32 intvl, gfp_t gfp) 14534 { 14535 struct sk_buff *msg; 14536 14537 msg = cfg80211_prepare_cqm(dev, peer, gfp); 14538 if (!msg) 14539 return; 14540 14541 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets)) 14542 goto nla_put_failure; 14543 14544 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate)) 14545 goto nla_put_failure; 14546 14547 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl)) 14548 goto nla_put_failure; 14549 14550 cfg80211_send_cqm(msg, gfp); 14551 return; 14552 14553 nla_put_failure: 14554 nlmsg_free(msg); 14555 } 14556 EXPORT_SYMBOL(cfg80211_cqm_txe_notify); 14557 14558 void cfg80211_cqm_pktloss_notify(struct net_device *dev, 14559 const u8 *peer, u32 num_packets, gfp_t gfp) 14560 { 14561 struct sk_buff *msg; 14562 14563 trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets); 14564 14565 msg = cfg80211_prepare_cqm(dev, peer, gfp); 14566 if (!msg) 14567 return; 14568 14569 if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets)) 14570 goto nla_put_failure; 14571 14572 cfg80211_send_cqm(msg, gfp); 14573 return; 14574 14575 nla_put_failure: 14576 nlmsg_free(msg); 14577 } 14578 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify); 14579 14580 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp) 14581 { 14582 struct sk_buff *msg; 14583 14584 msg = cfg80211_prepare_cqm(dev, NULL, gfp); 14585 if (!msg) 14586 return; 14587 14588 if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT)) 14589 goto nla_put_failure; 14590 14591 cfg80211_send_cqm(msg, gfp); 14592 return; 14593 14594 nla_put_failure: 14595 nlmsg_free(msg); 14596 } 14597 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify); 14598 14599 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev, 14600 struct net_device *netdev, const u8 *bssid, 14601 const u8 *replay_ctr, gfp_t gfp) 14602 { 14603 struct sk_buff *msg; 14604 struct nlattr *rekey_attr; 14605 void *hdr; 14606 14607 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14608 if (!msg) 14609 return; 14610 14611 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD); 14612 if (!hdr) { 14613 nlmsg_free(msg); 14614 return; 14615 } 14616 14617 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14618 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 14619 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) 14620 goto nla_put_failure; 14621 14622 rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA); 14623 if (!rekey_attr) 14624 goto nla_put_failure; 14625 14626 if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR, 14627 NL80211_REPLAY_CTR_LEN, replay_ctr)) 14628 goto nla_put_failure; 14629 14630 nla_nest_end(msg, rekey_attr); 14631 14632 genlmsg_end(msg, hdr); 14633 14634 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14635 NL80211_MCGRP_MLME, gfp); 14636 return; 14637 14638 nla_put_failure: 14639 genlmsg_cancel(msg, hdr); 14640 nlmsg_free(msg); 14641 } 14642 14643 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid, 14644 const u8 *replay_ctr, gfp_t gfp) 14645 { 14646 struct wireless_dev *wdev = dev->ieee80211_ptr; 14647 struct wiphy *wiphy = wdev->wiphy; 14648 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14649 14650 trace_cfg80211_gtk_rekey_notify(dev, bssid); 14651 nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp); 14652 } 14653 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify); 14654 14655 static void 14656 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev, 14657 struct net_device *netdev, int index, 14658 const u8 *bssid, bool preauth, gfp_t gfp) 14659 { 14660 struct sk_buff *msg; 14661 struct nlattr *attr; 14662 void *hdr; 14663 14664 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14665 if (!msg) 14666 return; 14667 14668 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE); 14669 if (!hdr) { 14670 nlmsg_free(msg); 14671 return; 14672 } 14673 14674 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14675 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex)) 14676 goto nla_put_failure; 14677 14678 attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE); 14679 if (!attr) 14680 goto nla_put_failure; 14681 14682 if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) || 14683 nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) || 14684 (preauth && 14685 nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH))) 14686 goto nla_put_failure; 14687 14688 nla_nest_end(msg, attr); 14689 14690 genlmsg_end(msg, hdr); 14691 14692 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14693 NL80211_MCGRP_MLME, gfp); 14694 return; 14695 14696 nla_put_failure: 14697 genlmsg_cancel(msg, hdr); 14698 nlmsg_free(msg); 14699 } 14700 14701 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index, 14702 const u8 *bssid, bool preauth, gfp_t gfp) 14703 { 14704 struct wireless_dev *wdev = dev->ieee80211_ptr; 14705 struct wiphy *wiphy = wdev->wiphy; 14706 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14707 14708 trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth); 14709 nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp); 14710 } 14711 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify); 14712 14713 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev, 14714 struct net_device *netdev, 14715 struct cfg80211_chan_def *chandef, 14716 gfp_t gfp, 14717 enum nl80211_commands notif, 14718 u8 count) 14719 { 14720 struct sk_buff *msg; 14721 void *hdr; 14722 14723 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14724 if (!msg) 14725 return; 14726 14727 hdr = nl80211hdr_put(msg, 0, 0, 0, notif); 14728 if (!hdr) { 14729 nlmsg_free(msg); 14730 return; 14731 } 14732 14733 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex)) 14734 goto nla_put_failure; 14735 14736 if (nl80211_send_chandef(msg, chandef)) 14737 goto nla_put_failure; 14738 14739 if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) && 14740 (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count))) 14741 goto nla_put_failure; 14742 14743 genlmsg_end(msg, hdr); 14744 14745 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14746 NL80211_MCGRP_MLME, gfp); 14747 return; 14748 14749 nla_put_failure: 14750 genlmsg_cancel(msg, hdr); 14751 nlmsg_free(msg); 14752 } 14753 14754 void cfg80211_ch_switch_notify(struct net_device *dev, 14755 struct cfg80211_chan_def *chandef) 14756 { 14757 struct wireless_dev *wdev = dev->ieee80211_ptr; 14758 struct wiphy *wiphy = wdev->wiphy; 14759 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14760 14761 ASSERT_WDEV_LOCK(wdev); 14762 14763 trace_cfg80211_ch_switch_notify(dev, chandef); 14764 14765 wdev->chandef = *chandef; 14766 wdev->preset_chandef = *chandef; 14767 nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL, 14768 NL80211_CMD_CH_SWITCH_NOTIFY, 0); 14769 } 14770 EXPORT_SYMBOL(cfg80211_ch_switch_notify); 14771 14772 void cfg80211_ch_switch_started_notify(struct net_device *dev, 14773 struct cfg80211_chan_def *chandef, 14774 u8 count) 14775 { 14776 struct wireless_dev *wdev = dev->ieee80211_ptr; 14777 struct wiphy *wiphy = wdev->wiphy; 14778 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14779 14780 trace_cfg80211_ch_switch_started_notify(dev, chandef); 14781 14782 nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL, 14783 NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count); 14784 } 14785 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify); 14786 14787 void 14788 nl80211_radar_notify(struct cfg80211_registered_device *rdev, 14789 const struct cfg80211_chan_def *chandef, 14790 enum nl80211_radar_event event, 14791 struct net_device *netdev, gfp_t gfp) 14792 { 14793 struct sk_buff *msg; 14794 void *hdr; 14795 14796 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14797 if (!msg) 14798 return; 14799 14800 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT); 14801 if (!hdr) { 14802 nlmsg_free(msg); 14803 return; 14804 } 14805 14806 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx)) 14807 goto nla_put_failure; 14808 14809 /* NOP and radar events don't need a netdev parameter */ 14810 if (netdev) { 14811 struct wireless_dev *wdev = netdev->ieee80211_ptr; 14812 14813 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 14814 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 14815 NL80211_ATTR_PAD)) 14816 goto nla_put_failure; 14817 } 14818 14819 if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event)) 14820 goto nla_put_failure; 14821 14822 if (nl80211_send_chandef(msg, chandef)) 14823 goto nla_put_failure; 14824 14825 genlmsg_end(msg, hdr); 14826 14827 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14828 NL80211_MCGRP_MLME, gfp); 14829 return; 14830 14831 nla_put_failure: 14832 genlmsg_cancel(msg, hdr); 14833 nlmsg_free(msg); 14834 } 14835 14836 void cfg80211_probe_status(struct net_device *dev, const u8 *addr, 14837 u64 cookie, bool acked, gfp_t gfp) 14838 { 14839 struct wireless_dev *wdev = dev->ieee80211_ptr; 14840 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 14841 struct sk_buff *msg; 14842 void *hdr; 14843 14844 trace_cfg80211_probe_status(dev, addr, cookie, acked); 14845 14846 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14847 14848 if (!msg) 14849 return; 14850 14851 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT); 14852 if (!hdr) { 14853 nlmsg_free(msg); 14854 return; 14855 } 14856 14857 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14858 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 14859 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) || 14860 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 14861 NL80211_ATTR_PAD) || 14862 (acked && nla_put_flag(msg, NL80211_ATTR_ACK))) 14863 goto nla_put_failure; 14864 14865 genlmsg_end(msg, hdr); 14866 14867 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14868 NL80211_MCGRP_MLME, gfp); 14869 return; 14870 14871 nla_put_failure: 14872 genlmsg_cancel(msg, hdr); 14873 nlmsg_free(msg); 14874 } 14875 EXPORT_SYMBOL(cfg80211_probe_status); 14876 14877 void cfg80211_report_obss_beacon(struct wiphy *wiphy, 14878 const u8 *frame, size_t len, 14879 int freq, int sig_dbm) 14880 { 14881 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14882 struct sk_buff *msg; 14883 void *hdr; 14884 struct cfg80211_beacon_registration *reg; 14885 14886 trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm); 14887 14888 spin_lock_bh(&rdev->beacon_registrations_lock); 14889 list_for_each_entry(reg, &rdev->beacon_registrations, list) { 14890 msg = nlmsg_new(len + 100, GFP_ATOMIC); 14891 if (!msg) { 14892 spin_unlock_bh(&rdev->beacon_registrations_lock); 14893 return; 14894 } 14895 14896 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME); 14897 if (!hdr) 14898 goto nla_put_failure; 14899 14900 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14901 (freq && 14902 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) || 14903 (sig_dbm && 14904 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) || 14905 nla_put(msg, NL80211_ATTR_FRAME, len, frame)) 14906 goto nla_put_failure; 14907 14908 genlmsg_end(msg, hdr); 14909 14910 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid); 14911 } 14912 spin_unlock_bh(&rdev->beacon_registrations_lock); 14913 return; 14914 14915 nla_put_failure: 14916 spin_unlock_bh(&rdev->beacon_registrations_lock); 14917 if (hdr) 14918 genlmsg_cancel(msg, hdr); 14919 nlmsg_free(msg); 14920 } 14921 EXPORT_SYMBOL(cfg80211_report_obss_beacon); 14922 14923 #ifdef CONFIG_PM 14924 static int cfg80211_net_detect_results(struct sk_buff *msg, 14925 struct cfg80211_wowlan_wakeup *wakeup) 14926 { 14927 struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect; 14928 struct nlattr *nl_results, *nl_match, *nl_freqs; 14929 int i, j; 14930 14931 nl_results = nla_nest_start( 14932 msg, NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS); 14933 if (!nl_results) 14934 return -EMSGSIZE; 14935 14936 for (i = 0; i < nd->n_matches; i++) { 14937 struct cfg80211_wowlan_nd_match *match = nd->matches[i]; 14938 14939 nl_match = nla_nest_start(msg, i); 14940 if (!nl_match) 14941 break; 14942 14943 /* The SSID attribute is optional in nl80211, but for 14944 * simplicity reasons it's always present in the 14945 * cfg80211 structure. If a driver can't pass the 14946 * SSID, that needs to be changed. A zero length SSID 14947 * is still a valid SSID (wildcard), so it cannot be 14948 * used for this purpose. 14949 */ 14950 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len, 14951 match->ssid.ssid)) { 14952 nla_nest_cancel(msg, nl_match); 14953 goto out; 14954 } 14955 14956 if (match->n_channels) { 14957 nl_freqs = nla_nest_start( 14958 msg, NL80211_ATTR_SCAN_FREQUENCIES); 14959 if (!nl_freqs) { 14960 nla_nest_cancel(msg, nl_match); 14961 goto out; 14962 } 14963 14964 for (j = 0; j < match->n_channels; j++) { 14965 if (nla_put_u32(msg, j, match->channels[j])) { 14966 nla_nest_cancel(msg, nl_freqs); 14967 nla_nest_cancel(msg, nl_match); 14968 goto out; 14969 } 14970 } 14971 14972 nla_nest_end(msg, nl_freqs); 14973 } 14974 14975 nla_nest_end(msg, nl_match); 14976 } 14977 14978 out: 14979 nla_nest_end(msg, nl_results); 14980 return 0; 14981 } 14982 14983 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev, 14984 struct cfg80211_wowlan_wakeup *wakeup, 14985 gfp_t gfp) 14986 { 14987 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 14988 struct sk_buff *msg; 14989 void *hdr; 14990 int size = 200; 14991 14992 trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup); 14993 14994 if (wakeup) 14995 size += wakeup->packet_present_len; 14996 14997 msg = nlmsg_new(size, gfp); 14998 if (!msg) 14999 return; 15000 15001 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN); 15002 if (!hdr) 15003 goto free_msg; 15004 15005 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15006 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 15007 NL80211_ATTR_PAD)) 15008 goto free_msg; 15009 15010 if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 15011 wdev->netdev->ifindex)) 15012 goto free_msg; 15013 15014 if (wakeup) { 15015 struct nlattr *reasons; 15016 15017 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS); 15018 if (!reasons) 15019 goto free_msg; 15020 15021 if (wakeup->disconnect && 15022 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) 15023 goto free_msg; 15024 if (wakeup->magic_pkt && 15025 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) 15026 goto free_msg; 15027 if (wakeup->gtk_rekey_failure && 15028 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) 15029 goto free_msg; 15030 if (wakeup->eap_identity_req && 15031 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) 15032 goto free_msg; 15033 if (wakeup->four_way_handshake && 15034 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) 15035 goto free_msg; 15036 if (wakeup->rfkill_release && 15037 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)) 15038 goto free_msg; 15039 15040 if (wakeup->pattern_idx >= 0 && 15041 nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN, 15042 wakeup->pattern_idx)) 15043 goto free_msg; 15044 15045 if (wakeup->tcp_match && 15046 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH)) 15047 goto free_msg; 15048 15049 if (wakeup->tcp_connlost && 15050 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST)) 15051 goto free_msg; 15052 15053 if (wakeup->tcp_nomoretokens && 15054 nla_put_flag(msg, 15055 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS)) 15056 goto free_msg; 15057 15058 if (wakeup->packet) { 15059 u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211; 15060 u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN; 15061 15062 if (!wakeup->packet_80211) { 15063 pkt_attr = 15064 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023; 15065 len_attr = 15066 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN; 15067 } 15068 15069 if (wakeup->packet_len && 15070 nla_put_u32(msg, len_attr, wakeup->packet_len)) 15071 goto free_msg; 15072 15073 if (nla_put(msg, pkt_attr, wakeup->packet_present_len, 15074 wakeup->packet)) 15075 goto free_msg; 15076 } 15077 15078 if (wakeup->net_detect && 15079 cfg80211_net_detect_results(msg, wakeup)) 15080 goto free_msg; 15081 15082 nla_nest_end(msg, reasons); 15083 } 15084 15085 genlmsg_end(msg, hdr); 15086 15087 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15088 NL80211_MCGRP_MLME, gfp); 15089 return; 15090 15091 free_msg: 15092 nlmsg_free(msg); 15093 } 15094 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup); 15095 #endif 15096 15097 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer, 15098 enum nl80211_tdls_operation oper, 15099 u16 reason_code, gfp_t gfp) 15100 { 15101 struct wireless_dev *wdev = dev->ieee80211_ptr; 15102 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 15103 struct sk_buff *msg; 15104 void *hdr; 15105 15106 trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper, 15107 reason_code); 15108 15109 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 15110 if (!msg) 15111 return; 15112 15113 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER); 15114 if (!hdr) { 15115 nlmsg_free(msg); 15116 return; 15117 } 15118 15119 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15120 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 15121 nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) || 15122 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) || 15123 (reason_code > 0 && 15124 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code))) 15125 goto nla_put_failure; 15126 15127 genlmsg_end(msg, hdr); 15128 15129 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15130 NL80211_MCGRP_MLME, gfp); 15131 return; 15132 15133 nla_put_failure: 15134 genlmsg_cancel(msg, hdr); 15135 nlmsg_free(msg); 15136 } 15137 EXPORT_SYMBOL(cfg80211_tdls_oper_request); 15138 15139 static int nl80211_netlink_notify(struct notifier_block * nb, 15140 unsigned long state, 15141 void *_notify) 15142 { 15143 struct netlink_notify *notify = _notify; 15144 struct cfg80211_registered_device *rdev; 15145 struct wireless_dev *wdev; 15146 struct cfg80211_beacon_registration *reg, *tmp; 15147 15148 if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC) 15149 return NOTIFY_DONE; 15150 15151 rcu_read_lock(); 15152 15153 list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) { 15154 struct cfg80211_sched_scan_request *sched_scan_req; 15155 15156 list_for_each_entry_rcu(sched_scan_req, 15157 &rdev->sched_scan_req_list, 15158 list) { 15159 if (sched_scan_req->owner_nlportid == notify->portid) { 15160 sched_scan_req->nl_owner_dead = true; 15161 schedule_work(&rdev->sched_scan_stop_wk); 15162 } 15163 } 15164 15165 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) { 15166 cfg80211_mlme_unregister_socket(wdev, notify->portid); 15167 15168 if (wdev->owner_nlportid == notify->portid) { 15169 wdev->nl_owner_dead = true; 15170 schedule_work(&rdev->destroy_work); 15171 } else if (wdev->conn_owner_nlportid == notify->portid) { 15172 schedule_work(&wdev->disconnect_wk); 15173 } 15174 } 15175 15176 spin_lock_bh(&rdev->beacon_registrations_lock); 15177 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations, 15178 list) { 15179 if (reg->nlportid == notify->portid) { 15180 list_del(®->list); 15181 kfree(reg); 15182 break; 15183 } 15184 } 15185 spin_unlock_bh(&rdev->beacon_registrations_lock); 15186 } 15187 15188 rcu_read_unlock(); 15189 15190 /* 15191 * It is possible that the user space process that is controlling the 15192 * indoor setting disappeared, so notify the regulatory core. 15193 */ 15194 regulatory_netlink_notify(notify->portid); 15195 return NOTIFY_OK; 15196 } 15197 15198 static struct notifier_block nl80211_netlink_notifier = { 15199 .notifier_call = nl80211_netlink_notify, 15200 }; 15201 15202 void cfg80211_ft_event(struct net_device *netdev, 15203 struct cfg80211_ft_event_params *ft_event) 15204 { 15205 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy; 15206 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 15207 struct sk_buff *msg; 15208 void *hdr; 15209 15210 trace_cfg80211_ft_event(wiphy, netdev, ft_event); 15211 15212 if (!ft_event->target_ap) 15213 return; 15214 15215 msg = nlmsg_new(100 + ft_event->ric_ies_len, GFP_KERNEL); 15216 if (!msg) 15217 return; 15218 15219 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT); 15220 if (!hdr) 15221 goto out; 15222 15223 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15224 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 15225 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap)) 15226 goto out; 15227 15228 if (ft_event->ies && 15229 nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies)) 15230 goto out; 15231 if (ft_event->ric_ies && 15232 nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len, 15233 ft_event->ric_ies)) 15234 goto out; 15235 15236 genlmsg_end(msg, hdr); 15237 15238 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15239 NL80211_MCGRP_MLME, GFP_KERNEL); 15240 return; 15241 out: 15242 nlmsg_free(msg); 15243 } 15244 EXPORT_SYMBOL(cfg80211_ft_event); 15245 15246 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp) 15247 { 15248 struct cfg80211_registered_device *rdev; 15249 struct sk_buff *msg; 15250 void *hdr; 15251 u32 nlportid; 15252 15253 rdev = wiphy_to_rdev(wdev->wiphy); 15254 if (!rdev->crit_proto_nlportid) 15255 return; 15256 15257 nlportid = rdev->crit_proto_nlportid; 15258 rdev->crit_proto_nlportid = 0; 15259 15260 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 15261 if (!msg) 15262 return; 15263 15264 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP); 15265 if (!hdr) 15266 goto nla_put_failure; 15267 15268 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15269 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 15270 NL80211_ATTR_PAD)) 15271 goto nla_put_failure; 15272 15273 genlmsg_end(msg, hdr); 15274 15275 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 15276 return; 15277 15278 nla_put_failure: 15279 if (hdr) 15280 genlmsg_cancel(msg, hdr); 15281 nlmsg_free(msg); 15282 } 15283 EXPORT_SYMBOL(cfg80211_crit_proto_stopped); 15284 15285 void nl80211_send_ap_stopped(struct wireless_dev *wdev) 15286 { 15287 struct wiphy *wiphy = wdev->wiphy; 15288 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 15289 struct sk_buff *msg; 15290 void *hdr; 15291 15292 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 15293 if (!msg) 15294 return; 15295 15296 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP); 15297 if (!hdr) 15298 goto out; 15299 15300 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15301 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) || 15302 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 15303 NL80211_ATTR_PAD)) 15304 goto out; 15305 15306 genlmsg_end(msg, hdr); 15307 15308 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0, 15309 NL80211_MCGRP_MLME, GFP_KERNEL); 15310 return; 15311 out: 15312 nlmsg_free(msg); 15313 } 15314 15315 /* initialisation/exit functions */ 15316 15317 int __init nl80211_init(void) 15318 { 15319 int err; 15320 15321 err = genl_register_family(&nl80211_fam); 15322 if (err) 15323 return err; 15324 15325 err = netlink_register_notifier(&nl80211_netlink_notifier); 15326 if (err) 15327 goto err_out; 15328 15329 return 0; 15330 err_out: 15331 genl_unregister_family(&nl80211_fam); 15332 return err; 15333 } 15334 15335 void nl80211_exit(void) 15336 { 15337 netlink_unregister_notifier(&nl80211_netlink_notifier); 15338 genl_unregister_family(&nl80211_fam); 15339 } 15340