1 /* 2 * This is the new netlink-based wireless configuration interface. 3 * 4 * Copyright 2006-2010 Johannes Berg <johannes@sipsolutions.net> 5 * Copyright 2013-2014 Intel Mobile Communications GmbH 6 * Copyright 2015-2017 Intel Deutschland GmbH 7 */ 8 9 #include <linux/if.h> 10 #include <linux/module.h> 11 #include <linux/err.h> 12 #include <linux/slab.h> 13 #include <linux/list.h> 14 #include <linux/if_ether.h> 15 #include <linux/ieee80211.h> 16 #include <linux/nl80211.h> 17 #include <linux/rtnetlink.h> 18 #include <linux/netlink.h> 19 #include <linux/etherdevice.h> 20 #include <net/net_namespace.h> 21 #include <net/genetlink.h> 22 #include <net/cfg80211.h> 23 #include <net/sock.h> 24 #include <net/inet_connection_sock.h> 25 #include "core.h" 26 #include "nl80211.h" 27 #include "reg.h" 28 #include "rdev-ops.h" 29 30 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev, 31 struct genl_info *info, 32 struct cfg80211_crypto_settings *settings, 33 int cipher_limit); 34 35 /* the netlink family */ 36 static struct genl_family nl80211_fam; 37 38 /* multicast groups */ 39 enum nl80211_multicast_groups { 40 NL80211_MCGRP_CONFIG, 41 NL80211_MCGRP_SCAN, 42 NL80211_MCGRP_REGULATORY, 43 NL80211_MCGRP_MLME, 44 NL80211_MCGRP_VENDOR, 45 NL80211_MCGRP_NAN, 46 NL80211_MCGRP_TESTMODE /* keep last - ifdef! */ 47 }; 48 49 static const struct genl_multicast_group nl80211_mcgrps[] = { 50 [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG }, 51 [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN }, 52 [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG }, 53 [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME }, 54 [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR }, 55 [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN }, 56 #ifdef CONFIG_NL80211_TESTMODE 57 [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE } 58 #endif 59 }; 60 61 /* returns ERR_PTR values */ 62 static struct wireless_dev * 63 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs) 64 { 65 struct cfg80211_registered_device *rdev; 66 struct wireless_dev *result = NULL; 67 bool have_ifidx = attrs[NL80211_ATTR_IFINDEX]; 68 bool have_wdev_id = attrs[NL80211_ATTR_WDEV]; 69 u64 wdev_id; 70 int wiphy_idx = -1; 71 int ifidx = -1; 72 73 ASSERT_RTNL(); 74 75 if (!have_ifidx && !have_wdev_id) 76 return ERR_PTR(-EINVAL); 77 78 if (have_ifidx) 79 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]); 80 if (have_wdev_id) { 81 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]); 82 wiphy_idx = wdev_id >> 32; 83 } 84 85 list_for_each_entry(rdev, &cfg80211_rdev_list, list) { 86 struct wireless_dev *wdev; 87 88 if (wiphy_net(&rdev->wiphy) != netns) 89 continue; 90 91 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx) 92 continue; 93 94 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { 95 if (have_ifidx && wdev->netdev && 96 wdev->netdev->ifindex == ifidx) { 97 result = wdev; 98 break; 99 } 100 if (have_wdev_id && wdev->identifier == (u32)wdev_id) { 101 result = wdev; 102 break; 103 } 104 } 105 106 if (result) 107 break; 108 } 109 110 if (result) 111 return result; 112 return ERR_PTR(-ENODEV); 113 } 114 115 static struct cfg80211_registered_device * 116 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs) 117 { 118 struct cfg80211_registered_device *rdev = NULL, *tmp; 119 struct net_device *netdev; 120 121 ASSERT_RTNL(); 122 123 if (!attrs[NL80211_ATTR_WIPHY] && 124 !attrs[NL80211_ATTR_IFINDEX] && 125 !attrs[NL80211_ATTR_WDEV]) 126 return ERR_PTR(-EINVAL); 127 128 if (attrs[NL80211_ATTR_WIPHY]) 129 rdev = cfg80211_rdev_by_wiphy_idx( 130 nla_get_u32(attrs[NL80211_ATTR_WIPHY])); 131 132 if (attrs[NL80211_ATTR_WDEV]) { 133 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]); 134 struct wireless_dev *wdev; 135 bool found = false; 136 137 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32); 138 if (tmp) { 139 /* make sure wdev exists */ 140 list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) { 141 if (wdev->identifier != (u32)wdev_id) 142 continue; 143 found = true; 144 break; 145 } 146 147 if (!found) 148 tmp = NULL; 149 150 if (rdev && tmp != rdev) 151 return ERR_PTR(-EINVAL); 152 rdev = tmp; 153 } 154 } 155 156 if (attrs[NL80211_ATTR_IFINDEX]) { 157 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]); 158 159 netdev = __dev_get_by_index(netns, ifindex); 160 if (netdev) { 161 if (netdev->ieee80211_ptr) 162 tmp = wiphy_to_rdev( 163 netdev->ieee80211_ptr->wiphy); 164 else 165 tmp = NULL; 166 167 /* not wireless device -- return error */ 168 if (!tmp) 169 return ERR_PTR(-EINVAL); 170 171 /* mismatch -- return error */ 172 if (rdev && tmp != rdev) 173 return ERR_PTR(-EINVAL); 174 175 rdev = tmp; 176 } 177 } 178 179 if (!rdev) 180 return ERR_PTR(-ENODEV); 181 182 if (netns != wiphy_net(&rdev->wiphy)) 183 return ERR_PTR(-ENODEV); 184 185 return rdev; 186 } 187 188 /* 189 * This function returns a pointer to the driver 190 * that the genl_info item that is passed refers to. 191 * 192 * The result of this can be a PTR_ERR and hence must 193 * be checked with IS_ERR() for errors. 194 */ 195 static struct cfg80211_registered_device * 196 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info) 197 { 198 return __cfg80211_rdev_from_attrs(netns, info->attrs); 199 } 200 201 /* policy for the attributes */ 202 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { 203 [NL80211_ATTR_WIPHY] = { .type = NLA_U32 }, 204 [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING, 205 .len = 20-1 }, 206 [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED }, 207 208 [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 }, 209 [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 }, 210 [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 }, 211 [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 }, 212 [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 }, 213 214 [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 }, 215 [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 }, 216 [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 }, 217 [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 }, 218 [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 }, 219 [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG }, 220 221 [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 }, 222 [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 }, 223 [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 }, 224 225 [NL80211_ATTR_MAC] = { .len = ETH_ALEN }, 226 [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN }, 227 228 [NL80211_ATTR_KEY] = { .type = NLA_NESTED, }, 229 [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY, 230 .len = WLAN_MAX_KEY_LEN }, 231 [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 }, 232 [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 }, 233 [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG }, 234 [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 }, 235 [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 }, 236 237 [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 }, 238 [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 }, 239 [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY, 240 .len = IEEE80211_MAX_DATA_LEN }, 241 [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY, 242 .len = IEEE80211_MAX_DATA_LEN }, 243 [NL80211_ATTR_STA_AID] = { .type = NLA_U16 }, 244 [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED }, 245 [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 }, 246 [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY, 247 .len = NL80211_MAX_SUPP_RATES }, 248 [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 }, 249 [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 }, 250 [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ }, 251 [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY, 252 .len = IEEE80211_MAX_MESH_ID_LEN }, 253 [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 }, 254 255 [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 }, 256 [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED }, 257 258 [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 }, 259 [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 }, 260 [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 }, 261 [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY, 262 .len = NL80211_MAX_SUPP_RATES }, 263 [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 }, 264 265 [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED }, 266 [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG }, 267 268 [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN }, 269 270 [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 }, 271 [NL80211_ATTR_IE] = { .type = NLA_BINARY, 272 .len = IEEE80211_MAX_DATA_LEN }, 273 [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED }, 274 [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED }, 275 276 [NL80211_ATTR_SSID] = { .type = NLA_BINARY, 277 .len = IEEE80211_MAX_SSID_LEN }, 278 [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 }, 279 [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 }, 280 [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG }, 281 [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG }, 282 [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 }, 283 [NL80211_ATTR_STA_FLAGS2] = { 284 .len = sizeof(struct nl80211_sta_flag_update), 285 }, 286 [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG }, 287 [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 }, 288 [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG }, 289 [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG }, 290 [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 }, 291 [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 }, 292 [NL80211_ATTR_PID] = { .type = NLA_U32 }, 293 [NL80211_ATTR_4ADDR] = { .type = NLA_U8 }, 294 [NL80211_ATTR_PMKID] = { .len = WLAN_PMKID_LEN }, 295 [NL80211_ATTR_DURATION] = { .type = NLA_U32 }, 296 [NL80211_ATTR_COOKIE] = { .type = NLA_U64 }, 297 [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED }, 298 [NL80211_ATTR_FRAME] = { .type = NLA_BINARY, 299 .len = IEEE80211_MAX_DATA_LEN }, 300 [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, }, 301 [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 }, 302 [NL80211_ATTR_CQM] = { .type = NLA_NESTED, }, 303 [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG }, 304 [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 }, 305 [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 }, 306 [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 }, 307 [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 }, 308 [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 }, 309 [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 }, 310 [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 }, 311 [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG }, 312 [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED }, 313 [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED }, 314 [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 }, 315 [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 }, 316 [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED }, 317 [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED }, 318 [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 }, 319 [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY, 320 .len = IEEE80211_MAX_DATA_LEN }, 321 [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY, 322 .len = IEEE80211_MAX_DATA_LEN }, 323 [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG }, 324 [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED }, 325 [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG }, 326 [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 }, 327 [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 }, 328 [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 }, 329 [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG }, 330 [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG }, 331 [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG }, 332 [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG }, 333 [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY, 334 .len = IEEE80211_MAX_DATA_LEN }, 335 [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 }, 336 [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG }, 337 [NL80211_ATTR_HT_CAPABILITY_MASK] = { 338 .len = NL80211_HT_CAPABILITY_LEN 339 }, 340 [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 }, 341 [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 }, 342 [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 }, 343 [NL80211_ATTR_WDEV] = { .type = NLA_U64 }, 344 [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 }, 345 [NL80211_ATTR_AUTH_DATA] = { .type = NLA_BINARY, }, 346 [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN }, 347 [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 }, 348 [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 }, 349 [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 }, 350 [NL80211_ATTR_LOCAL_MESH_POWER_MODE] = {. type = NLA_U32 }, 351 [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 }, 352 [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED }, 353 [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 }, 354 [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, }, 355 [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, }, 356 [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG }, 357 [NL80211_ATTR_VHT_CAPABILITY_MASK] = { 358 .len = NL80211_VHT_CAPABILITY_LEN, 359 }, 360 [NL80211_ATTR_MDID] = { .type = NLA_U16 }, 361 [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY, 362 .len = IEEE80211_MAX_DATA_LEN }, 363 [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 }, 364 [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 }, 365 [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG }, 366 [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED }, 367 [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY }, 368 [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY }, 369 [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY }, 370 [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY }, 371 [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG }, 372 [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 }, 373 [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 }, 374 [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 }, 375 [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY }, 376 [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY, 377 .len = IEEE80211_QOS_MAP_LEN_MAX }, 378 [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN }, 379 [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 }, 380 [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 }, 381 [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG }, 382 [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY }, 383 [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG }, 384 [NL80211_ATTR_TSID] = { .type = NLA_U8 }, 385 [NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 }, 386 [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 }, 387 [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 }, 388 [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN }, 389 [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG }, 390 [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 }, 391 [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 }, 392 [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG }, 393 [NL80211_ATTR_PBSS] = { .type = NLA_FLAG }, 394 [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED }, 395 [NL80211_ATTR_STA_SUPPORT_P2P_PS] = { .type = NLA_U8 }, 396 [NL80211_ATTR_MU_MIMO_GROUP_DATA] = { 397 .len = VHT_MUMIMO_GROUPS_DATA_LEN 398 }, 399 [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = { .len = ETH_ALEN }, 400 [NL80211_ATTR_NAN_MASTER_PREF] = { .type = NLA_U8 }, 401 [NL80211_ATTR_BANDS] = { .type = NLA_U32 }, 402 [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED }, 403 [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY, 404 .len = FILS_MAX_KEK_LEN }, 405 [NL80211_ATTR_FILS_NONCES] = { .len = 2 * FILS_NONCE_LEN }, 406 [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, }, 407 [NL80211_ATTR_BSSID] = { .len = ETH_ALEN }, 408 [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 }, 409 [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = { 410 .len = sizeof(struct nl80211_bss_select_rssi_adjust) 411 }, 412 [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 }, 413 [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY, 414 .len = FILS_ERP_MAX_USERNAME_LEN }, 415 [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY, 416 .len = FILS_ERP_MAX_REALM_LEN }, 417 [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 }, 418 [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY, 419 .len = FILS_ERP_MAX_RRK_LEN }, 420 [NL80211_ATTR_FILS_CACHE_ID] = { .len = 2 }, 421 [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN }, 422 [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG }, 423 }; 424 425 /* policy for the key attributes */ 426 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = { 427 [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN }, 428 [NL80211_KEY_IDX] = { .type = NLA_U8 }, 429 [NL80211_KEY_CIPHER] = { .type = NLA_U32 }, 430 [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 }, 431 [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG }, 432 [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG }, 433 [NL80211_KEY_TYPE] = { .type = NLA_U32 }, 434 [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED }, 435 }; 436 437 /* policy for the key default flags */ 438 static const struct nla_policy 439 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = { 440 [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG }, 441 [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG }, 442 }; 443 444 #ifdef CONFIG_PM 445 /* policy for WoWLAN attributes */ 446 static const struct nla_policy 447 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = { 448 [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG }, 449 [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG }, 450 [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG }, 451 [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED }, 452 [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG }, 453 [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG }, 454 [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG }, 455 [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG }, 456 [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED }, 457 [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED }, 458 }; 459 460 static const struct nla_policy 461 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = { 462 [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 }, 463 [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 }, 464 [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN }, 465 [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 }, 466 [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 }, 467 [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 }, 468 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = { 469 .len = sizeof(struct nl80211_wowlan_tcp_data_seq) 470 }, 471 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = { 472 .len = sizeof(struct nl80211_wowlan_tcp_data_token) 473 }, 474 [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 }, 475 [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 }, 476 [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 }, 477 }; 478 #endif /* CONFIG_PM */ 479 480 /* policy for coalesce rule attributes */ 481 static const struct nla_policy 482 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = { 483 [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 }, 484 [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 }, 485 [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED }, 486 }; 487 488 /* policy for GTK rekey offload attributes */ 489 static const struct nla_policy 490 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = { 491 [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN }, 492 [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN }, 493 [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN }, 494 }; 495 496 static const struct nla_policy 497 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = { 498 [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY, 499 .len = IEEE80211_MAX_SSID_LEN }, 500 [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = { .len = ETH_ALEN }, 501 [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 }, 502 }; 503 504 static const struct nla_policy 505 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = { 506 [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 }, 507 [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 }, 508 }; 509 510 static const struct nla_policy 511 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = { 512 [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG }, 513 [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 }, 514 [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = { 515 .len = sizeof(struct nl80211_bss_select_rssi_adjust) 516 }, 517 }; 518 519 /* policy for NAN function attributes */ 520 static const struct nla_policy 521 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = { 522 [NL80211_NAN_FUNC_TYPE] = { .type = NLA_U8 }, 523 [NL80211_NAN_FUNC_SERVICE_ID] = { 524 .len = NL80211_NAN_FUNC_SERVICE_ID_LEN }, 525 [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 }, 526 [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG }, 527 [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG }, 528 [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 }, 529 [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 }, 530 [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = { .len = ETH_ALEN }, 531 [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG }, 532 [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 }, 533 [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY, 534 .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN }, 535 [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED }, 536 [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED }, 537 [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED }, 538 [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 }, 539 [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 }, 540 }; 541 542 /* policy for Service Response Filter attributes */ 543 static const struct nla_policy 544 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = { 545 [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG }, 546 [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY, 547 .len = NL80211_NAN_FUNC_SRF_MAX_LEN }, 548 [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 }, 549 [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED }, 550 }; 551 552 /* policy for packet pattern attributes */ 553 static const struct nla_policy 554 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = { 555 [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, }, 556 [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, }, 557 [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 }, 558 }; 559 560 static int nl80211_prepare_wdev_dump(struct sk_buff *skb, 561 struct netlink_callback *cb, 562 struct cfg80211_registered_device **rdev, 563 struct wireless_dev **wdev) 564 { 565 int err; 566 567 if (!cb->args[0]) { 568 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, 569 genl_family_attrbuf(&nl80211_fam), 570 nl80211_fam.maxattr, nl80211_policy, NULL); 571 if (err) 572 return err; 573 574 *wdev = __cfg80211_wdev_from_attrs( 575 sock_net(skb->sk), 576 genl_family_attrbuf(&nl80211_fam)); 577 if (IS_ERR(*wdev)) 578 return PTR_ERR(*wdev); 579 *rdev = wiphy_to_rdev((*wdev)->wiphy); 580 /* 0 is the first index - add 1 to parse only once */ 581 cb->args[0] = (*rdev)->wiphy_idx + 1; 582 cb->args[1] = (*wdev)->identifier; 583 } else { 584 /* subtract the 1 again here */ 585 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1); 586 struct wireless_dev *tmp; 587 588 if (!wiphy) 589 return -ENODEV; 590 *rdev = wiphy_to_rdev(wiphy); 591 *wdev = NULL; 592 593 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) { 594 if (tmp->identifier == cb->args[1]) { 595 *wdev = tmp; 596 break; 597 } 598 } 599 600 if (!*wdev) 601 return -ENODEV; 602 } 603 604 return 0; 605 } 606 607 /* IE validation */ 608 static bool is_valid_ie_attr(const struct nlattr *attr) 609 { 610 const u8 *pos; 611 int len; 612 613 if (!attr) 614 return true; 615 616 pos = nla_data(attr); 617 len = nla_len(attr); 618 619 while (len) { 620 u8 elemlen; 621 622 if (len < 2) 623 return false; 624 len -= 2; 625 626 elemlen = pos[1]; 627 if (elemlen > len) 628 return false; 629 630 len -= elemlen; 631 pos += 2 + elemlen; 632 } 633 634 return true; 635 } 636 637 /* message building helper */ 638 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq, 639 int flags, u8 cmd) 640 { 641 /* since there is no private header just add the generic one */ 642 return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd); 643 } 644 645 static int nl80211_msg_put_channel(struct sk_buff *msg, 646 struct ieee80211_channel *chan, 647 bool large) 648 { 649 /* Some channels must be completely excluded from the 650 * list to protect old user-space tools from breaking 651 */ 652 if (!large && chan->flags & 653 (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ)) 654 return 0; 655 656 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ, 657 chan->center_freq)) 658 goto nla_put_failure; 659 660 if ((chan->flags & IEEE80211_CHAN_DISABLED) && 661 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED)) 662 goto nla_put_failure; 663 if (chan->flags & IEEE80211_CHAN_NO_IR) { 664 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR)) 665 goto nla_put_failure; 666 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS)) 667 goto nla_put_failure; 668 } 669 if (chan->flags & IEEE80211_CHAN_RADAR) { 670 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR)) 671 goto nla_put_failure; 672 if (large) { 673 u32 time; 674 675 time = elapsed_jiffies_msecs(chan->dfs_state_entered); 676 677 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE, 678 chan->dfs_state)) 679 goto nla_put_failure; 680 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME, 681 time)) 682 goto nla_put_failure; 683 if (nla_put_u32(msg, 684 NL80211_FREQUENCY_ATTR_DFS_CAC_TIME, 685 chan->dfs_cac_ms)) 686 goto nla_put_failure; 687 } 688 } 689 690 if (large) { 691 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) && 692 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS)) 693 goto nla_put_failure; 694 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) && 695 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS)) 696 goto nla_put_failure; 697 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) && 698 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ)) 699 goto nla_put_failure; 700 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) && 701 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ)) 702 goto nla_put_failure; 703 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) && 704 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY)) 705 goto nla_put_failure; 706 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) && 707 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT)) 708 goto nla_put_failure; 709 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) && 710 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ)) 711 goto nla_put_failure; 712 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) && 713 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ)) 714 goto nla_put_failure; 715 } 716 717 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER, 718 DBM_TO_MBM(chan->max_power))) 719 goto nla_put_failure; 720 721 return 0; 722 723 nla_put_failure: 724 return -ENOBUFS; 725 } 726 727 /* netlink command implementations */ 728 729 struct key_parse { 730 struct key_params p; 731 int idx; 732 int type; 733 bool def, defmgmt; 734 bool def_uni, def_multi; 735 }; 736 737 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k) 738 { 739 struct nlattr *tb[NL80211_KEY_MAX + 1]; 740 int err = nla_parse_nested(tb, NL80211_KEY_MAX, key, 741 nl80211_key_policy, NULL); 742 if (err) 743 return err; 744 745 k->def = !!tb[NL80211_KEY_DEFAULT]; 746 k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT]; 747 748 if (k->def) { 749 k->def_uni = true; 750 k->def_multi = true; 751 } 752 if (k->defmgmt) 753 k->def_multi = true; 754 755 if (tb[NL80211_KEY_IDX]) 756 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]); 757 758 if (tb[NL80211_KEY_DATA]) { 759 k->p.key = nla_data(tb[NL80211_KEY_DATA]); 760 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]); 761 } 762 763 if (tb[NL80211_KEY_SEQ]) { 764 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]); 765 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]); 766 } 767 768 if (tb[NL80211_KEY_CIPHER]) 769 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]); 770 771 if (tb[NL80211_KEY_TYPE]) { 772 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]); 773 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES) 774 return -EINVAL; 775 } 776 777 if (tb[NL80211_KEY_DEFAULT_TYPES]) { 778 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES]; 779 780 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1, 781 tb[NL80211_KEY_DEFAULT_TYPES], 782 nl80211_key_default_policy, NULL); 783 if (err) 784 return err; 785 786 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST]; 787 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST]; 788 } 789 790 return 0; 791 } 792 793 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k) 794 { 795 if (info->attrs[NL80211_ATTR_KEY_DATA]) { 796 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]); 797 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]); 798 } 799 800 if (info->attrs[NL80211_ATTR_KEY_SEQ]) { 801 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]); 802 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]); 803 } 804 805 if (info->attrs[NL80211_ATTR_KEY_IDX]) 806 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]); 807 808 if (info->attrs[NL80211_ATTR_KEY_CIPHER]) 809 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]); 810 811 k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT]; 812 k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]; 813 814 if (k->def) { 815 k->def_uni = true; 816 k->def_multi = true; 817 } 818 if (k->defmgmt) 819 k->def_multi = true; 820 821 if (info->attrs[NL80211_ATTR_KEY_TYPE]) { 822 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]); 823 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES) 824 return -EINVAL; 825 } 826 827 if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) { 828 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES]; 829 int err = nla_parse_nested(kdt, 830 NUM_NL80211_KEY_DEFAULT_TYPES - 1, 831 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES], 832 nl80211_key_default_policy, 833 info->extack); 834 if (err) 835 return err; 836 837 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST]; 838 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST]; 839 } 840 841 return 0; 842 } 843 844 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k) 845 { 846 int err; 847 848 memset(k, 0, sizeof(*k)); 849 k->idx = -1; 850 k->type = -1; 851 852 if (info->attrs[NL80211_ATTR_KEY]) 853 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k); 854 else 855 err = nl80211_parse_key_old(info, k); 856 857 if (err) 858 return err; 859 860 if (k->def && k->defmgmt) 861 return -EINVAL; 862 863 if (k->defmgmt) { 864 if (k->def_uni || !k->def_multi) 865 return -EINVAL; 866 } 867 868 if (k->idx != -1) { 869 if (k->defmgmt) { 870 if (k->idx < 4 || k->idx > 5) 871 return -EINVAL; 872 } else if (k->def) { 873 if (k->idx < 0 || k->idx > 3) 874 return -EINVAL; 875 } else { 876 if (k->idx < 0 || k->idx > 5) 877 return -EINVAL; 878 } 879 } 880 881 return 0; 882 } 883 884 static struct cfg80211_cached_keys * 885 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev, 886 struct nlattr *keys, bool *no_ht) 887 { 888 struct key_parse parse; 889 struct nlattr *key; 890 struct cfg80211_cached_keys *result; 891 int rem, err, def = 0; 892 bool have_key = false; 893 894 nla_for_each_nested(key, keys, rem) { 895 have_key = true; 896 break; 897 } 898 899 if (!have_key) 900 return NULL; 901 902 result = kzalloc(sizeof(*result), GFP_KERNEL); 903 if (!result) 904 return ERR_PTR(-ENOMEM); 905 906 result->def = -1; 907 908 nla_for_each_nested(key, keys, rem) { 909 memset(&parse, 0, sizeof(parse)); 910 parse.idx = -1; 911 912 err = nl80211_parse_key_new(key, &parse); 913 if (err) 914 goto error; 915 err = -EINVAL; 916 if (!parse.p.key) 917 goto error; 918 if (parse.idx < 0 || parse.idx > 3) 919 goto error; 920 if (parse.def) { 921 if (def) 922 goto error; 923 def = 1; 924 result->def = parse.idx; 925 if (!parse.def_uni || !parse.def_multi) 926 goto error; 927 } else if (parse.defmgmt) 928 goto error; 929 err = cfg80211_validate_key_settings(rdev, &parse.p, 930 parse.idx, false, NULL); 931 if (err) 932 goto error; 933 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 && 934 parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) { 935 err = -EINVAL; 936 goto error; 937 } 938 result->params[parse.idx].cipher = parse.p.cipher; 939 result->params[parse.idx].key_len = parse.p.key_len; 940 result->params[parse.idx].key = result->data[parse.idx]; 941 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len); 942 943 /* must be WEP key if we got here */ 944 if (no_ht) 945 *no_ht = true; 946 } 947 948 if (result->def < 0) { 949 err = -EINVAL; 950 goto error; 951 } 952 953 return result; 954 error: 955 kfree(result); 956 return ERR_PTR(err); 957 } 958 959 static int nl80211_key_allowed(struct wireless_dev *wdev) 960 { 961 ASSERT_WDEV_LOCK(wdev); 962 963 switch (wdev->iftype) { 964 case NL80211_IFTYPE_AP: 965 case NL80211_IFTYPE_AP_VLAN: 966 case NL80211_IFTYPE_P2P_GO: 967 case NL80211_IFTYPE_MESH_POINT: 968 break; 969 case NL80211_IFTYPE_ADHOC: 970 case NL80211_IFTYPE_STATION: 971 case NL80211_IFTYPE_P2P_CLIENT: 972 if (!wdev->current_bss) 973 return -ENOLINK; 974 break; 975 case NL80211_IFTYPE_UNSPECIFIED: 976 case NL80211_IFTYPE_OCB: 977 case NL80211_IFTYPE_MONITOR: 978 case NL80211_IFTYPE_NAN: 979 case NL80211_IFTYPE_P2P_DEVICE: 980 case NL80211_IFTYPE_WDS: 981 case NUM_NL80211_IFTYPES: 982 return -EINVAL; 983 } 984 985 return 0; 986 } 987 988 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy, 989 struct nlattr *tb) 990 { 991 struct ieee80211_channel *chan; 992 993 if (tb == NULL) 994 return NULL; 995 chan = ieee80211_get_channel(wiphy, nla_get_u32(tb)); 996 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) 997 return NULL; 998 return chan; 999 } 1000 1001 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes) 1002 { 1003 struct nlattr *nl_modes = nla_nest_start(msg, attr); 1004 int i; 1005 1006 if (!nl_modes) 1007 goto nla_put_failure; 1008 1009 i = 0; 1010 while (ifmodes) { 1011 if ((ifmodes & 1) && nla_put_flag(msg, i)) 1012 goto nla_put_failure; 1013 ifmodes >>= 1; 1014 i++; 1015 } 1016 1017 nla_nest_end(msg, nl_modes); 1018 return 0; 1019 1020 nla_put_failure: 1021 return -ENOBUFS; 1022 } 1023 1024 static int nl80211_put_iface_combinations(struct wiphy *wiphy, 1025 struct sk_buff *msg, 1026 bool large) 1027 { 1028 struct nlattr *nl_combis; 1029 int i, j; 1030 1031 nl_combis = nla_nest_start(msg, 1032 NL80211_ATTR_INTERFACE_COMBINATIONS); 1033 if (!nl_combis) 1034 goto nla_put_failure; 1035 1036 for (i = 0; i < wiphy->n_iface_combinations; i++) { 1037 const struct ieee80211_iface_combination *c; 1038 struct nlattr *nl_combi, *nl_limits; 1039 1040 c = &wiphy->iface_combinations[i]; 1041 1042 nl_combi = nla_nest_start(msg, i + 1); 1043 if (!nl_combi) 1044 goto nla_put_failure; 1045 1046 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS); 1047 if (!nl_limits) 1048 goto nla_put_failure; 1049 1050 for (j = 0; j < c->n_limits; j++) { 1051 struct nlattr *nl_limit; 1052 1053 nl_limit = nla_nest_start(msg, j + 1); 1054 if (!nl_limit) 1055 goto nla_put_failure; 1056 if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX, 1057 c->limits[j].max)) 1058 goto nla_put_failure; 1059 if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES, 1060 c->limits[j].types)) 1061 goto nla_put_failure; 1062 nla_nest_end(msg, nl_limit); 1063 } 1064 1065 nla_nest_end(msg, nl_limits); 1066 1067 if (c->beacon_int_infra_match && 1068 nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH)) 1069 goto nla_put_failure; 1070 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS, 1071 c->num_different_channels) || 1072 nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM, 1073 c->max_interfaces)) 1074 goto nla_put_failure; 1075 if (large && 1076 (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS, 1077 c->radar_detect_widths) || 1078 nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS, 1079 c->radar_detect_regions))) 1080 goto nla_put_failure; 1081 if (c->beacon_int_min_gcd && 1082 nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD, 1083 c->beacon_int_min_gcd)) 1084 goto nla_put_failure; 1085 1086 nla_nest_end(msg, nl_combi); 1087 } 1088 1089 nla_nest_end(msg, nl_combis); 1090 1091 return 0; 1092 nla_put_failure: 1093 return -ENOBUFS; 1094 } 1095 1096 #ifdef CONFIG_PM 1097 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev, 1098 struct sk_buff *msg) 1099 { 1100 const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp; 1101 struct nlattr *nl_tcp; 1102 1103 if (!tcp) 1104 return 0; 1105 1106 nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION); 1107 if (!nl_tcp) 1108 return -ENOBUFS; 1109 1110 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD, 1111 tcp->data_payload_max)) 1112 return -ENOBUFS; 1113 1114 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD, 1115 tcp->data_payload_max)) 1116 return -ENOBUFS; 1117 1118 if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ)) 1119 return -ENOBUFS; 1120 1121 if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN, 1122 sizeof(*tcp->tok), tcp->tok)) 1123 return -ENOBUFS; 1124 1125 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL, 1126 tcp->data_interval_max)) 1127 return -ENOBUFS; 1128 1129 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD, 1130 tcp->wake_payload_max)) 1131 return -ENOBUFS; 1132 1133 nla_nest_end(msg, nl_tcp); 1134 return 0; 1135 } 1136 1137 static int nl80211_send_wowlan(struct sk_buff *msg, 1138 struct cfg80211_registered_device *rdev, 1139 bool large) 1140 { 1141 struct nlattr *nl_wowlan; 1142 1143 if (!rdev->wiphy.wowlan) 1144 return 0; 1145 1146 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED); 1147 if (!nl_wowlan) 1148 return -ENOBUFS; 1149 1150 if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) && 1151 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) || 1152 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) && 1153 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) || 1154 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) && 1155 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) || 1156 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) && 1157 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) || 1158 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) && 1159 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) || 1160 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) && 1161 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) || 1162 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) && 1163 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) || 1164 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) && 1165 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))) 1166 return -ENOBUFS; 1167 1168 if (rdev->wiphy.wowlan->n_patterns) { 1169 struct nl80211_pattern_support pat = { 1170 .max_patterns = rdev->wiphy.wowlan->n_patterns, 1171 .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len, 1172 .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len, 1173 .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset, 1174 }; 1175 1176 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN, 1177 sizeof(pat), &pat)) 1178 return -ENOBUFS; 1179 } 1180 1181 if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) && 1182 nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT, 1183 rdev->wiphy.wowlan->max_nd_match_sets)) 1184 return -ENOBUFS; 1185 1186 if (large && nl80211_send_wowlan_tcp_caps(rdev, msg)) 1187 return -ENOBUFS; 1188 1189 nla_nest_end(msg, nl_wowlan); 1190 1191 return 0; 1192 } 1193 #endif 1194 1195 static int nl80211_send_coalesce(struct sk_buff *msg, 1196 struct cfg80211_registered_device *rdev) 1197 { 1198 struct nl80211_coalesce_rule_support rule; 1199 1200 if (!rdev->wiphy.coalesce) 1201 return 0; 1202 1203 rule.max_rules = rdev->wiphy.coalesce->n_rules; 1204 rule.max_delay = rdev->wiphy.coalesce->max_delay; 1205 rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns; 1206 rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len; 1207 rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len; 1208 rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset; 1209 1210 if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule)) 1211 return -ENOBUFS; 1212 1213 return 0; 1214 } 1215 1216 static int nl80211_send_band_rateinfo(struct sk_buff *msg, 1217 struct ieee80211_supported_band *sband) 1218 { 1219 struct nlattr *nl_rates, *nl_rate; 1220 struct ieee80211_rate *rate; 1221 int i; 1222 1223 /* add HT info */ 1224 if (sband->ht_cap.ht_supported && 1225 (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET, 1226 sizeof(sband->ht_cap.mcs), 1227 &sband->ht_cap.mcs) || 1228 nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA, 1229 sband->ht_cap.cap) || 1230 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR, 1231 sband->ht_cap.ampdu_factor) || 1232 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY, 1233 sband->ht_cap.ampdu_density))) 1234 return -ENOBUFS; 1235 1236 /* add VHT info */ 1237 if (sband->vht_cap.vht_supported && 1238 (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET, 1239 sizeof(sband->vht_cap.vht_mcs), 1240 &sband->vht_cap.vht_mcs) || 1241 nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA, 1242 sband->vht_cap.cap))) 1243 return -ENOBUFS; 1244 1245 /* add bitrates */ 1246 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES); 1247 if (!nl_rates) 1248 return -ENOBUFS; 1249 1250 for (i = 0; i < sband->n_bitrates; i++) { 1251 nl_rate = nla_nest_start(msg, i); 1252 if (!nl_rate) 1253 return -ENOBUFS; 1254 1255 rate = &sband->bitrates[i]; 1256 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE, 1257 rate->bitrate)) 1258 return -ENOBUFS; 1259 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) && 1260 nla_put_flag(msg, 1261 NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE)) 1262 return -ENOBUFS; 1263 1264 nla_nest_end(msg, nl_rate); 1265 } 1266 1267 nla_nest_end(msg, nl_rates); 1268 1269 return 0; 1270 } 1271 1272 static int 1273 nl80211_send_mgmt_stypes(struct sk_buff *msg, 1274 const struct ieee80211_txrx_stypes *mgmt_stypes) 1275 { 1276 u16 stypes; 1277 struct nlattr *nl_ftypes, *nl_ifs; 1278 enum nl80211_iftype ift; 1279 int i; 1280 1281 if (!mgmt_stypes) 1282 return 0; 1283 1284 nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES); 1285 if (!nl_ifs) 1286 return -ENOBUFS; 1287 1288 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) { 1289 nl_ftypes = nla_nest_start(msg, ift); 1290 if (!nl_ftypes) 1291 return -ENOBUFS; 1292 i = 0; 1293 stypes = mgmt_stypes[ift].tx; 1294 while (stypes) { 1295 if ((stypes & 1) && 1296 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE, 1297 (i << 4) | IEEE80211_FTYPE_MGMT)) 1298 return -ENOBUFS; 1299 stypes >>= 1; 1300 i++; 1301 } 1302 nla_nest_end(msg, nl_ftypes); 1303 } 1304 1305 nla_nest_end(msg, nl_ifs); 1306 1307 nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES); 1308 if (!nl_ifs) 1309 return -ENOBUFS; 1310 1311 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) { 1312 nl_ftypes = nla_nest_start(msg, ift); 1313 if (!nl_ftypes) 1314 return -ENOBUFS; 1315 i = 0; 1316 stypes = mgmt_stypes[ift].rx; 1317 while (stypes) { 1318 if ((stypes & 1) && 1319 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE, 1320 (i << 4) | IEEE80211_FTYPE_MGMT)) 1321 return -ENOBUFS; 1322 stypes >>= 1; 1323 i++; 1324 } 1325 nla_nest_end(msg, nl_ftypes); 1326 } 1327 nla_nest_end(msg, nl_ifs); 1328 1329 return 0; 1330 } 1331 1332 #define CMD(op, n) \ 1333 do { \ 1334 if (rdev->ops->op) { \ 1335 i++; \ 1336 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \ 1337 goto nla_put_failure; \ 1338 } \ 1339 } while (0) 1340 1341 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev, 1342 struct sk_buff *msg) 1343 { 1344 int i = 0; 1345 1346 /* 1347 * do *NOT* add anything into this function, new things need to be 1348 * advertised only to new versions of userspace that can deal with 1349 * the split (and they can't possibly care about new features... 1350 */ 1351 CMD(add_virtual_intf, NEW_INTERFACE); 1352 CMD(change_virtual_intf, SET_INTERFACE); 1353 CMD(add_key, NEW_KEY); 1354 CMD(start_ap, START_AP); 1355 CMD(add_station, NEW_STATION); 1356 CMD(add_mpath, NEW_MPATH); 1357 CMD(update_mesh_config, SET_MESH_CONFIG); 1358 CMD(change_bss, SET_BSS); 1359 CMD(auth, AUTHENTICATE); 1360 CMD(assoc, ASSOCIATE); 1361 CMD(deauth, DEAUTHENTICATE); 1362 CMD(disassoc, DISASSOCIATE); 1363 CMD(join_ibss, JOIN_IBSS); 1364 CMD(join_mesh, JOIN_MESH); 1365 CMD(set_pmksa, SET_PMKSA); 1366 CMD(del_pmksa, DEL_PMKSA); 1367 CMD(flush_pmksa, FLUSH_PMKSA); 1368 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) 1369 CMD(remain_on_channel, REMAIN_ON_CHANNEL); 1370 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK); 1371 CMD(mgmt_tx, FRAME); 1372 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL); 1373 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) { 1374 i++; 1375 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS)) 1376 goto nla_put_failure; 1377 } 1378 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap || 1379 rdev->ops->join_mesh) { 1380 i++; 1381 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL)) 1382 goto nla_put_failure; 1383 } 1384 CMD(set_wds_peer, SET_WDS_PEER); 1385 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) { 1386 CMD(tdls_mgmt, TDLS_MGMT); 1387 CMD(tdls_oper, TDLS_OPER); 1388 } 1389 if (rdev->wiphy.max_sched_scan_reqs) 1390 CMD(sched_scan_start, START_SCHED_SCAN); 1391 CMD(probe_client, PROBE_CLIENT); 1392 CMD(set_noack_map, SET_NOACK_MAP); 1393 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) { 1394 i++; 1395 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS)) 1396 goto nla_put_failure; 1397 } 1398 CMD(start_p2p_device, START_P2P_DEVICE); 1399 CMD(set_mcast_rate, SET_MCAST_RATE); 1400 #ifdef CONFIG_NL80211_TESTMODE 1401 CMD(testmode_cmd, TESTMODE); 1402 #endif 1403 1404 if (rdev->ops->connect || rdev->ops->auth) { 1405 i++; 1406 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT)) 1407 goto nla_put_failure; 1408 } 1409 1410 if (rdev->ops->disconnect || rdev->ops->deauth) { 1411 i++; 1412 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT)) 1413 goto nla_put_failure; 1414 } 1415 1416 return i; 1417 nla_put_failure: 1418 return -ENOBUFS; 1419 } 1420 1421 struct nl80211_dump_wiphy_state { 1422 s64 filter_wiphy; 1423 long start; 1424 long split_start, band_start, chan_start, capa_start; 1425 bool split; 1426 }; 1427 1428 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev, 1429 enum nl80211_commands cmd, 1430 struct sk_buff *msg, u32 portid, u32 seq, 1431 int flags, struct nl80211_dump_wiphy_state *state) 1432 { 1433 void *hdr; 1434 struct nlattr *nl_bands, *nl_band; 1435 struct nlattr *nl_freqs, *nl_freq; 1436 struct nlattr *nl_cmds; 1437 enum nl80211_band band; 1438 struct ieee80211_channel *chan; 1439 int i; 1440 const struct ieee80211_txrx_stypes *mgmt_stypes = 1441 rdev->wiphy.mgmt_stypes; 1442 u32 features; 1443 1444 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 1445 if (!hdr) 1446 return -ENOBUFS; 1447 1448 if (WARN_ON(!state)) 1449 return -EINVAL; 1450 1451 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 1452 nla_put_string(msg, NL80211_ATTR_WIPHY_NAME, 1453 wiphy_name(&rdev->wiphy)) || 1454 nla_put_u32(msg, NL80211_ATTR_GENERATION, 1455 cfg80211_rdev_list_generation)) 1456 goto nla_put_failure; 1457 1458 if (cmd != NL80211_CMD_NEW_WIPHY) 1459 goto finish; 1460 1461 switch (state->split_start) { 1462 case 0: 1463 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT, 1464 rdev->wiphy.retry_short) || 1465 nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG, 1466 rdev->wiphy.retry_long) || 1467 nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD, 1468 rdev->wiphy.frag_threshold) || 1469 nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD, 1470 rdev->wiphy.rts_threshold) || 1471 nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS, 1472 rdev->wiphy.coverage_class) || 1473 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS, 1474 rdev->wiphy.max_scan_ssids) || 1475 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS, 1476 rdev->wiphy.max_sched_scan_ssids) || 1477 nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN, 1478 rdev->wiphy.max_scan_ie_len) || 1479 nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN, 1480 rdev->wiphy.max_sched_scan_ie_len) || 1481 nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS, 1482 rdev->wiphy.max_match_sets) || 1483 nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS, 1484 rdev->wiphy.max_sched_scan_plans) || 1485 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL, 1486 rdev->wiphy.max_sched_scan_plan_interval) || 1487 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS, 1488 rdev->wiphy.max_sched_scan_plan_iterations)) 1489 goto nla_put_failure; 1490 1491 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) && 1492 nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN)) 1493 goto nla_put_failure; 1494 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) && 1495 nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH)) 1496 goto nla_put_failure; 1497 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) && 1498 nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD)) 1499 goto nla_put_failure; 1500 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) && 1501 nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT)) 1502 goto nla_put_failure; 1503 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) && 1504 nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT)) 1505 goto nla_put_failure; 1506 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) && 1507 nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP)) 1508 goto nla_put_failure; 1509 state->split_start++; 1510 if (state->split) 1511 break; 1512 case 1: 1513 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES, 1514 sizeof(u32) * rdev->wiphy.n_cipher_suites, 1515 rdev->wiphy.cipher_suites)) 1516 goto nla_put_failure; 1517 1518 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS, 1519 rdev->wiphy.max_num_pmkids)) 1520 goto nla_put_failure; 1521 1522 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) && 1523 nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE)) 1524 goto nla_put_failure; 1525 1526 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX, 1527 rdev->wiphy.available_antennas_tx) || 1528 nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX, 1529 rdev->wiphy.available_antennas_rx)) 1530 goto nla_put_failure; 1531 1532 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) && 1533 nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD, 1534 rdev->wiphy.probe_resp_offload)) 1535 goto nla_put_failure; 1536 1537 if ((rdev->wiphy.available_antennas_tx || 1538 rdev->wiphy.available_antennas_rx) && 1539 rdev->ops->get_antenna) { 1540 u32 tx_ant = 0, rx_ant = 0; 1541 int res; 1542 1543 res = rdev_get_antenna(rdev, &tx_ant, &rx_ant); 1544 if (!res) { 1545 if (nla_put_u32(msg, 1546 NL80211_ATTR_WIPHY_ANTENNA_TX, 1547 tx_ant) || 1548 nla_put_u32(msg, 1549 NL80211_ATTR_WIPHY_ANTENNA_RX, 1550 rx_ant)) 1551 goto nla_put_failure; 1552 } 1553 } 1554 1555 state->split_start++; 1556 if (state->split) 1557 break; 1558 case 2: 1559 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES, 1560 rdev->wiphy.interface_modes)) 1561 goto nla_put_failure; 1562 state->split_start++; 1563 if (state->split) 1564 break; 1565 case 3: 1566 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS); 1567 if (!nl_bands) 1568 goto nla_put_failure; 1569 1570 for (band = state->band_start; 1571 band < NUM_NL80211_BANDS; band++) { 1572 struct ieee80211_supported_band *sband; 1573 1574 sband = rdev->wiphy.bands[band]; 1575 1576 if (!sband) 1577 continue; 1578 1579 nl_band = nla_nest_start(msg, band); 1580 if (!nl_band) 1581 goto nla_put_failure; 1582 1583 switch (state->chan_start) { 1584 case 0: 1585 if (nl80211_send_band_rateinfo(msg, sband)) 1586 goto nla_put_failure; 1587 state->chan_start++; 1588 if (state->split) 1589 break; 1590 default: 1591 /* add frequencies */ 1592 nl_freqs = nla_nest_start( 1593 msg, NL80211_BAND_ATTR_FREQS); 1594 if (!nl_freqs) 1595 goto nla_put_failure; 1596 1597 for (i = state->chan_start - 1; 1598 i < sband->n_channels; 1599 i++) { 1600 nl_freq = nla_nest_start(msg, i); 1601 if (!nl_freq) 1602 goto nla_put_failure; 1603 1604 chan = &sband->channels[i]; 1605 1606 if (nl80211_msg_put_channel( 1607 msg, chan, 1608 state->split)) 1609 goto nla_put_failure; 1610 1611 nla_nest_end(msg, nl_freq); 1612 if (state->split) 1613 break; 1614 } 1615 if (i < sband->n_channels) 1616 state->chan_start = i + 2; 1617 else 1618 state->chan_start = 0; 1619 nla_nest_end(msg, nl_freqs); 1620 } 1621 1622 nla_nest_end(msg, nl_band); 1623 1624 if (state->split) { 1625 /* start again here */ 1626 if (state->chan_start) 1627 band--; 1628 break; 1629 } 1630 } 1631 nla_nest_end(msg, nl_bands); 1632 1633 if (band < NUM_NL80211_BANDS) 1634 state->band_start = band + 1; 1635 else 1636 state->band_start = 0; 1637 1638 /* if bands & channels are done, continue outside */ 1639 if (state->band_start == 0 && state->chan_start == 0) 1640 state->split_start++; 1641 if (state->split) 1642 break; 1643 case 4: 1644 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS); 1645 if (!nl_cmds) 1646 goto nla_put_failure; 1647 1648 i = nl80211_add_commands_unsplit(rdev, msg); 1649 if (i < 0) 1650 goto nla_put_failure; 1651 if (state->split) { 1652 CMD(crit_proto_start, CRIT_PROTOCOL_START); 1653 CMD(crit_proto_stop, CRIT_PROTOCOL_STOP); 1654 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH) 1655 CMD(channel_switch, CHANNEL_SWITCH); 1656 CMD(set_qos_map, SET_QOS_MAP); 1657 if (rdev->wiphy.features & 1658 NL80211_FEATURE_SUPPORTS_WMM_ADMISSION) 1659 CMD(add_tx_ts, ADD_TX_TS); 1660 CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST); 1661 CMD(update_connect_params, UPDATE_CONNECT_PARAMS); 1662 } 1663 #undef CMD 1664 1665 nla_nest_end(msg, nl_cmds); 1666 state->split_start++; 1667 if (state->split) 1668 break; 1669 case 5: 1670 if (rdev->ops->remain_on_channel && 1671 (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) && 1672 nla_put_u32(msg, 1673 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION, 1674 rdev->wiphy.max_remain_on_channel_duration)) 1675 goto nla_put_failure; 1676 1677 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) && 1678 nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK)) 1679 goto nla_put_failure; 1680 1681 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes)) 1682 goto nla_put_failure; 1683 state->split_start++; 1684 if (state->split) 1685 break; 1686 case 6: 1687 #ifdef CONFIG_PM 1688 if (nl80211_send_wowlan(msg, rdev, state->split)) 1689 goto nla_put_failure; 1690 state->split_start++; 1691 if (state->split) 1692 break; 1693 #else 1694 state->split_start++; 1695 #endif 1696 case 7: 1697 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES, 1698 rdev->wiphy.software_iftypes)) 1699 goto nla_put_failure; 1700 1701 if (nl80211_put_iface_combinations(&rdev->wiphy, msg, 1702 state->split)) 1703 goto nla_put_failure; 1704 1705 state->split_start++; 1706 if (state->split) 1707 break; 1708 case 8: 1709 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) && 1710 nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME, 1711 rdev->wiphy.ap_sme_capa)) 1712 goto nla_put_failure; 1713 1714 features = rdev->wiphy.features; 1715 /* 1716 * We can only add the per-channel limit information if the 1717 * dump is split, otherwise it makes it too big. Therefore 1718 * only advertise it in that case. 1719 */ 1720 if (state->split) 1721 features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS; 1722 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features)) 1723 goto nla_put_failure; 1724 1725 if (rdev->wiphy.ht_capa_mod_mask && 1726 nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK, 1727 sizeof(*rdev->wiphy.ht_capa_mod_mask), 1728 rdev->wiphy.ht_capa_mod_mask)) 1729 goto nla_put_failure; 1730 1731 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME && 1732 rdev->wiphy.max_acl_mac_addrs && 1733 nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX, 1734 rdev->wiphy.max_acl_mac_addrs)) 1735 goto nla_put_failure; 1736 1737 /* 1738 * Any information below this point is only available to 1739 * applications that can deal with it being split. This 1740 * helps ensure that newly added capabilities don't break 1741 * older tools by overrunning their buffers. 1742 * 1743 * We still increment split_start so that in the split 1744 * case we'll continue with more data in the next round, 1745 * but break unconditionally so unsplit data stops here. 1746 */ 1747 state->split_start++; 1748 break; 1749 case 9: 1750 if (rdev->wiphy.extended_capabilities && 1751 (nla_put(msg, NL80211_ATTR_EXT_CAPA, 1752 rdev->wiphy.extended_capabilities_len, 1753 rdev->wiphy.extended_capabilities) || 1754 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK, 1755 rdev->wiphy.extended_capabilities_len, 1756 rdev->wiphy.extended_capabilities_mask))) 1757 goto nla_put_failure; 1758 1759 if (rdev->wiphy.vht_capa_mod_mask && 1760 nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK, 1761 sizeof(*rdev->wiphy.vht_capa_mod_mask), 1762 rdev->wiphy.vht_capa_mod_mask)) 1763 goto nla_put_failure; 1764 1765 state->split_start++; 1766 break; 1767 case 10: 1768 if (nl80211_send_coalesce(msg, rdev)) 1769 goto nla_put_failure; 1770 1771 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) && 1772 (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) || 1773 nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ))) 1774 goto nla_put_failure; 1775 1776 if (rdev->wiphy.max_ap_assoc_sta && 1777 nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA, 1778 rdev->wiphy.max_ap_assoc_sta)) 1779 goto nla_put_failure; 1780 1781 state->split_start++; 1782 break; 1783 case 11: 1784 if (rdev->wiphy.n_vendor_commands) { 1785 const struct nl80211_vendor_cmd_info *info; 1786 struct nlattr *nested; 1787 1788 nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA); 1789 if (!nested) 1790 goto nla_put_failure; 1791 1792 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) { 1793 info = &rdev->wiphy.vendor_commands[i].info; 1794 if (nla_put(msg, i + 1, sizeof(*info), info)) 1795 goto nla_put_failure; 1796 } 1797 nla_nest_end(msg, nested); 1798 } 1799 1800 if (rdev->wiphy.n_vendor_events) { 1801 const struct nl80211_vendor_cmd_info *info; 1802 struct nlattr *nested; 1803 1804 nested = nla_nest_start(msg, 1805 NL80211_ATTR_VENDOR_EVENTS); 1806 if (!nested) 1807 goto nla_put_failure; 1808 1809 for (i = 0; i < rdev->wiphy.n_vendor_events; i++) { 1810 info = &rdev->wiphy.vendor_events[i]; 1811 if (nla_put(msg, i + 1, sizeof(*info), info)) 1812 goto nla_put_failure; 1813 } 1814 nla_nest_end(msg, nested); 1815 } 1816 state->split_start++; 1817 break; 1818 case 12: 1819 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH && 1820 nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS, 1821 rdev->wiphy.max_num_csa_counters)) 1822 goto nla_put_failure; 1823 1824 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED && 1825 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG)) 1826 goto nla_put_failure; 1827 1828 if (rdev->wiphy.max_sched_scan_reqs && 1829 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS, 1830 rdev->wiphy.max_sched_scan_reqs)) 1831 goto nla_put_failure; 1832 1833 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES, 1834 sizeof(rdev->wiphy.ext_features), 1835 rdev->wiphy.ext_features)) 1836 goto nla_put_failure; 1837 1838 if (rdev->wiphy.bss_select_support) { 1839 struct nlattr *nested; 1840 u32 bss_select_support = rdev->wiphy.bss_select_support; 1841 1842 nested = nla_nest_start(msg, NL80211_ATTR_BSS_SELECT); 1843 if (!nested) 1844 goto nla_put_failure; 1845 1846 i = 0; 1847 while (bss_select_support) { 1848 if ((bss_select_support & 1) && 1849 nla_put_flag(msg, i)) 1850 goto nla_put_failure; 1851 i++; 1852 bss_select_support >>= 1; 1853 } 1854 nla_nest_end(msg, nested); 1855 } 1856 1857 state->split_start++; 1858 break; 1859 case 13: 1860 if (rdev->wiphy.num_iftype_ext_capab && 1861 rdev->wiphy.iftype_ext_capab) { 1862 struct nlattr *nested_ext_capab, *nested; 1863 1864 nested = nla_nest_start(msg, 1865 NL80211_ATTR_IFTYPE_EXT_CAPA); 1866 if (!nested) 1867 goto nla_put_failure; 1868 1869 for (i = state->capa_start; 1870 i < rdev->wiphy.num_iftype_ext_capab; i++) { 1871 const struct wiphy_iftype_ext_capab *capab; 1872 1873 capab = &rdev->wiphy.iftype_ext_capab[i]; 1874 1875 nested_ext_capab = nla_nest_start(msg, i); 1876 if (!nested_ext_capab || 1877 nla_put_u32(msg, NL80211_ATTR_IFTYPE, 1878 capab->iftype) || 1879 nla_put(msg, NL80211_ATTR_EXT_CAPA, 1880 capab->extended_capabilities_len, 1881 capab->extended_capabilities) || 1882 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK, 1883 capab->extended_capabilities_len, 1884 capab->extended_capabilities_mask)) 1885 goto nla_put_failure; 1886 1887 nla_nest_end(msg, nested_ext_capab); 1888 if (state->split) 1889 break; 1890 } 1891 nla_nest_end(msg, nested); 1892 if (i < rdev->wiphy.num_iftype_ext_capab) { 1893 state->capa_start = i + 1; 1894 break; 1895 } 1896 } 1897 1898 if (nla_put_u32(msg, NL80211_ATTR_BANDS, 1899 rdev->wiphy.nan_supported_bands)) 1900 goto nla_put_failure; 1901 1902 /* done */ 1903 state->split_start = 0; 1904 break; 1905 } 1906 finish: 1907 genlmsg_end(msg, hdr); 1908 return 0; 1909 1910 nla_put_failure: 1911 genlmsg_cancel(msg, hdr); 1912 return -EMSGSIZE; 1913 } 1914 1915 static int nl80211_dump_wiphy_parse(struct sk_buff *skb, 1916 struct netlink_callback *cb, 1917 struct nl80211_dump_wiphy_state *state) 1918 { 1919 struct nlattr **tb = genl_family_attrbuf(&nl80211_fam); 1920 int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, tb, 1921 nl80211_fam.maxattr, nl80211_policy, NULL); 1922 /* ignore parse errors for backward compatibility */ 1923 if (ret) 1924 return 0; 1925 1926 state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP]; 1927 if (tb[NL80211_ATTR_WIPHY]) 1928 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]); 1929 if (tb[NL80211_ATTR_WDEV]) 1930 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32; 1931 if (tb[NL80211_ATTR_IFINDEX]) { 1932 struct net_device *netdev; 1933 struct cfg80211_registered_device *rdev; 1934 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]); 1935 1936 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx); 1937 if (!netdev) 1938 return -ENODEV; 1939 if (netdev->ieee80211_ptr) { 1940 rdev = wiphy_to_rdev( 1941 netdev->ieee80211_ptr->wiphy); 1942 state->filter_wiphy = rdev->wiphy_idx; 1943 } 1944 } 1945 1946 return 0; 1947 } 1948 1949 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb) 1950 { 1951 int idx = 0, ret; 1952 struct nl80211_dump_wiphy_state *state = (void *)cb->args[0]; 1953 struct cfg80211_registered_device *rdev; 1954 1955 rtnl_lock(); 1956 if (!state) { 1957 state = kzalloc(sizeof(*state), GFP_KERNEL); 1958 if (!state) { 1959 rtnl_unlock(); 1960 return -ENOMEM; 1961 } 1962 state->filter_wiphy = -1; 1963 ret = nl80211_dump_wiphy_parse(skb, cb, state); 1964 if (ret) { 1965 kfree(state); 1966 rtnl_unlock(); 1967 return ret; 1968 } 1969 cb->args[0] = (long)state; 1970 } 1971 1972 list_for_each_entry(rdev, &cfg80211_rdev_list, list) { 1973 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk))) 1974 continue; 1975 if (++idx <= state->start) 1976 continue; 1977 if (state->filter_wiphy != -1 && 1978 state->filter_wiphy != rdev->wiphy_idx) 1979 continue; 1980 /* attempt to fit multiple wiphy data chunks into the skb */ 1981 do { 1982 ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, 1983 skb, 1984 NETLINK_CB(cb->skb).portid, 1985 cb->nlh->nlmsg_seq, 1986 NLM_F_MULTI, state); 1987 if (ret < 0) { 1988 /* 1989 * If sending the wiphy data didn't fit (ENOBUFS 1990 * or EMSGSIZE returned), this SKB is still 1991 * empty (so it's not too big because another 1992 * wiphy dataset is already in the skb) and 1993 * we've not tried to adjust the dump allocation 1994 * yet ... then adjust the alloc size to be 1995 * bigger, and return 1 but with the empty skb. 1996 * This results in an empty message being RX'ed 1997 * in userspace, but that is ignored. 1998 * 1999 * We can then retry with the larger buffer. 2000 */ 2001 if ((ret == -ENOBUFS || ret == -EMSGSIZE) && 2002 !skb->len && !state->split && 2003 cb->min_dump_alloc < 4096) { 2004 cb->min_dump_alloc = 4096; 2005 state->split_start = 0; 2006 rtnl_unlock(); 2007 return 1; 2008 } 2009 idx--; 2010 break; 2011 } 2012 } while (state->split_start > 0); 2013 break; 2014 } 2015 rtnl_unlock(); 2016 2017 state->start = idx; 2018 2019 return skb->len; 2020 } 2021 2022 static int nl80211_dump_wiphy_done(struct netlink_callback *cb) 2023 { 2024 kfree((void *)cb->args[0]); 2025 return 0; 2026 } 2027 2028 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info) 2029 { 2030 struct sk_buff *msg; 2031 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 2032 struct nl80211_dump_wiphy_state state = {}; 2033 2034 msg = nlmsg_new(4096, GFP_KERNEL); 2035 if (!msg) 2036 return -ENOMEM; 2037 2038 if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg, 2039 info->snd_portid, info->snd_seq, 0, 2040 &state) < 0) { 2041 nlmsg_free(msg); 2042 return -ENOBUFS; 2043 } 2044 2045 return genlmsg_reply(msg, info); 2046 } 2047 2048 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = { 2049 [NL80211_TXQ_ATTR_QUEUE] = { .type = NLA_U8 }, 2050 [NL80211_TXQ_ATTR_TXOP] = { .type = NLA_U16 }, 2051 [NL80211_TXQ_ATTR_CWMIN] = { .type = NLA_U16 }, 2052 [NL80211_TXQ_ATTR_CWMAX] = { .type = NLA_U16 }, 2053 [NL80211_TXQ_ATTR_AIFS] = { .type = NLA_U8 }, 2054 }; 2055 2056 static int parse_txq_params(struct nlattr *tb[], 2057 struct ieee80211_txq_params *txq_params) 2058 { 2059 if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] || 2060 !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] || 2061 !tb[NL80211_TXQ_ATTR_AIFS]) 2062 return -EINVAL; 2063 2064 txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]); 2065 txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]); 2066 txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]); 2067 txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]); 2068 txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]); 2069 2070 if (txq_params->ac >= NL80211_NUM_ACS) 2071 return -EINVAL; 2072 2073 return 0; 2074 } 2075 2076 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev) 2077 { 2078 /* 2079 * You can only set the channel explicitly for WDS interfaces, 2080 * all others have their channel managed via their respective 2081 * "establish a connection" command (connect, join, ...) 2082 * 2083 * For AP/GO and mesh mode, the channel can be set with the 2084 * channel userspace API, but is only stored and passed to the 2085 * low-level driver when the AP starts or the mesh is joined. 2086 * This is for backward compatibility, userspace can also give 2087 * the channel in the start-ap or join-mesh commands instead. 2088 * 2089 * Monitors are special as they are normally slaved to 2090 * whatever else is going on, so they have their own special 2091 * operation to set the monitor channel if possible. 2092 */ 2093 return !wdev || 2094 wdev->iftype == NL80211_IFTYPE_AP || 2095 wdev->iftype == NL80211_IFTYPE_MESH_POINT || 2096 wdev->iftype == NL80211_IFTYPE_MONITOR || 2097 wdev->iftype == NL80211_IFTYPE_P2P_GO; 2098 } 2099 2100 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev, 2101 struct genl_info *info, 2102 struct cfg80211_chan_def *chandef) 2103 { 2104 u32 control_freq; 2105 2106 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ]) 2107 return -EINVAL; 2108 2109 control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]); 2110 2111 chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq); 2112 chandef->width = NL80211_CHAN_WIDTH_20_NOHT; 2113 chandef->center_freq1 = control_freq; 2114 chandef->center_freq2 = 0; 2115 2116 /* Primary channel not allowed */ 2117 if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED) 2118 return -EINVAL; 2119 2120 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) { 2121 enum nl80211_channel_type chantype; 2122 2123 chantype = nla_get_u32( 2124 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]); 2125 2126 switch (chantype) { 2127 case NL80211_CHAN_NO_HT: 2128 case NL80211_CHAN_HT20: 2129 case NL80211_CHAN_HT40PLUS: 2130 case NL80211_CHAN_HT40MINUS: 2131 cfg80211_chandef_create(chandef, chandef->chan, 2132 chantype); 2133 /* user input for center_freq is incorrect */ 2134 if (info->attrs[NL80211_ATTR_CENTER_FREQ1] && 2135 chandef->center_freq1 != nla_get_u32( 2136 info->attrs[NL80211_ATTR_CENTER_FREQ1])) 2137 return -EINVAL; 2138 /* center_freq2 must be zero */ 2139 if (info->attrs[NL80211_ATTR_CENTER_FREQ2] && 2140 nla_get_u32(info->attrs[NL80211_ATTR_CENTER_FREQ2])) 2141 return -EINVAL; 2142 break; 2143 default: 2144 return -EINVAL; 2145 } 2146 } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) { 2147 chandef->width = 2148 nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]); 2149 if (info->attrs[NL80211_ATTR_CENTER_FREQ1]) 2150 chandef->center_freq1 = 2151 nla_get_u32( 2152 info->attrs[NL80211_ATTR_CENTER_FREQ1]); 2153 if (info->attrs[NL80211_ATTR_CENTER_FREQ2]) 2154 chandef->center_freq2 = 2155 nla_get_u32( 2156 info->attrs[NL80211_ATTR_CENTER_FREQ2]); 2157 } 2158 2159 if (!cfg80211_chandef_valid(chandef)) 2160 return -EINVAL; 2161 2162 if (!cfg80211_chandef_usable(&rdev->wiphy, chandef, 2163 IEEE80211_CHAN_DISABLED)) 2164 return -EINVAL; 2165 2166 if ((chandef->width == NL80211_CHAN_WIDTH_5 || 2167 chandef->width == NL80211_CHAN_WIDTH_10) && 2168 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) 2169 return -EINVAL; 2170 2171 return 0; 2172 } 2173 2174 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev, 2175 struct net_device *dev, 2176 struct genl_info *info) 2177 { 2178 struct cfg80211_chan_def chandef; 2179 int result; 2180 enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR; 2181 struct wireless_dev *wdev = NULL; 2182 2183 if (dev) 2184 wdev = dev->ieee80211_ptr; 2185 if (!nl80211_can_set_dev_channel(wdev)) 2186 return -EOPNOTSUPP; 2187 if (wdev) 2188 iftype = wdev->iftype; 2189 2190 result = nl80211_parse_chandef(rdev, info, &chandef); 2191 if (result) 2192 return result; 2193 2194 switch (iftype) { 2195 case NL80211_IFTYPE_AP: 2196 case NL80211_IFTYPE_P2P_GO: 2197 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef, 2198 iftype)) { 2199 result = -EINVAL; 2200 break; 2201 } 2202 if (wdev->beacon_interval) { 2203 if (!dev || !rdev->ops->set_ap_chanwidth || 2204 !(rdev->wiphy.features & 2205 NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) { 2206 result = -EBUSY; 2207 break; 2208 } 2209 2210 /* Only allow dynamic channel width changes */ 2211 if (chandef.chan != wdev->preset_chandef.chan) { 2212 result = -EBUSY; 2213 break; 2214 } 2215 result = rdev_set_ap_chanwidth(rdev, dev, &chandef); 2216 if (result) 2217 break; 2218 } 2219 wdev->preset_chandef = chandef; 2220 result = 0; 2221 break; 2222 case NL80211_IFTYPE_MESH_POINT: 2223 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef); 2224 break; 2225 case NL80211_IFTYPE_MONITOR: 2226 result = cfg80211_set_monitor_channel(rdev, &chandef); 2227 break; 2228 default: 2229 result = -EINVAL; 2230 } 2231 2232 return result; 2233 } 2234 2235 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info) 2236 { 2237 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 2238 struct net_device *netdev = info->user_ptr[1]; 2239 2240 return __nl80211_set_channel(rdev, netdev, info); 2241 } 2242 2243 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info) 2244 { 2245 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 2246 struct net_device *dev = info->user_ptr[1]; 2247 struct wireless_dev *wdev = dev->ieee80211_ptr; 2248 const u8 *bssid; 2249 2250 if (!info->attrs[NL80211_ATTR_MAC]) 2251 return -EINVAL; 2252 2253 if (netif_running(dev)) 2254 return -EBUSY; 2255 2256 if (!rdev->ops->set_wds_peer) 2257 return -EOPNOTSUPP; 2258 2259 if (wdev->iftype != NL80211_IFTYPE_WDS) 2260 return -EOPNOTSUPP; 2261 2262 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 2263 return rdev_set_wds_peer(rdev, dev, bssid); 2264 } 2265 2266 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info) 2267 { 2268 struct cfg80211_registered_device *rdev; 2269 struct net_device *netdev = NULL; 2270 struct wireless_dev *wdev; 2271 int result = 0, rem_txq_params = 0; 2272 struct nlattr *nl_txq_params; 2273 u32 changed; 2274 u8 retry_short = 0, retry_long = 0; 2275 u32 frag_threshold = 0, rts_threshold = 0; 2276 u8 coverage_class = 0; 2277 2278 ASSERT_RTNL(); 2279 2280 /* 2281 * Try to find the wiphy and netdev. Normally this 2282 * function shouldn't need the netdev, but this is 2283 * done for backward compatibility -- previously 2284 * setting the channel was done per wiphy, but now 2285 * it is per netdev. Previous userland like hostapd 2286 * also passed a netdev to set_wiphy, so that it is 2287 * possible to let that go to the right netdev! 2288 */ 2289 2290 if (info->attrs[NL80211_ATTR_IFINDEX]) { 2291 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]); 2292 2293 netdev = __dev_get_by_index(genl_info_net(info), ifindex); 2294 if (netdev && netdev->ieee80211_ptr) 2295 rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy); 2296 else 2297 netdev = NULL; 2298 } 2299 2300 if (!netdev) { 2301 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info), 2302 info->attrs); 2303 if (IS_ERR(rdev)) 2304 return PTR_ERR(rdev); 2305 wdev = NULL; 2306 netdev = NULL; 2307 result = 0; 2308 } else 2309 wdev = netdev->ieee80211_ptr; 2310 2311 /* 2312 * end workaround code, by now the rdev is available 2313 * and locked, and wdev may or may not be NULL. 2314 */ 2315 2316 if (info->attrs[NL80211_ATTR_WIPHY_NAME]) 2317 result = cfg80211_dev_rename( 2318 rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME])); 2319 2320 if (result) 2321 return result; 2322 2323 if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) { 2324 struct ieee80211_txq_params txq_params; 2325 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1]; 2326 2327 if (!rdev->ops->set_txq_params) 2328 return -EOPNOTSUPP; 2329 2330 if (!netdev) 2331 return -EINVAL; 2332 2333 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 2334 netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 2335 return -EINVAL; 2336 2337 if (!netif_running(netdev)) 2338 return -ENETDOWN; 2339 2340 nla_for_each_nested(nl_txq_params, 2341 info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS], 2342 rem_txq_params) { 2343 result = nla_parse_nested(tb, NL80211_TXQ_ATTR_MAX, 2344 nl_txq_params, 2345 txq_params_policy, 2346 info->extack); 2347 if (result) 2348 return result; 2349 result = parse_txq_params(tb, &txq_params); 2350 if (result) 2351 return result; 2352 2353 result = rdev_set_txq_params(rdev, netdev, 2354 &txq_params); 2355 if (result) 2356 return result; 2357 } 2358 } 2359 2360 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 2361 result = __nl80211_set_channel( 2362 rdev, 2363 nl80211_can_set_dev_channel(wdev) ? netdev : NULL, 2364 info); 2365 if (result) 2366 return result; 2367 } 2368 2369 if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) { 2370 struct wireless_dev *txp_wdev = wdev; 2371 enum nl80211_tx_power_setting type; 2372 int idx, mbm = 0; 2373 2374 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER)) 2375 txp_wdev = NULL; 2376 2377 if (!rdev->ops->set_tx_power) 2378 return -EOPNOTSUPP; 2379 2380 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING; 2381 type = nla_get_u32(info->attrs[idx]); 2382 2383 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] && 2384 (type != NL80211_TX_POWER_AUTOMATIC)) 2385 return -EINVAL; 2386 2387 if (type != NL80211_TX_POWER_AUTOMATIC) { 2388 idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL; 2389 mbm = nla_get_u32(info->attrs[idx]); 2390 } 2391 2392 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm); 2393 if (result) 2394 return result; 2395 } 2396 2397 if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] && 2398 info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) { 2399 u32 tx_ant, rx_ant; 2400 2401 if ((!rdev->wiphy.available_antennas_tx && 2402 !rdev->wiphy.available_antennas_rx) || 2403 !rdev->ops->set_antenna) 2404 return -EOPNOTSUPP; 2405 2406 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]); 2407 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]); 2408 2409 /* reject antenna configurations which don't match the 2410 * available antenna masks, except for the "all" mask */ 2411 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) || 2412 (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) 2413 return -EINVAL; 2414 2415 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx; 2416 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx; 2417 2418 result = rdev_set_antenna(rdev, tx_ant, rx_ant); 2419 if (result) 2420 return result; 2421 } 2422 2423 changed = 0; 2424 2425 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) { 2426 retry_short = nla_get_u8( 2427 info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]); 2428 if (retry_short == 0) 2429 return -EINVAL; 2430 2431 changed |= WIPHY_PARAM_RETRY_SHORT; 2432 } 2433 2434 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) { 2435 retry_long = nla_get_u8( 2436 info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]); 2437 if (retry_long == 0) 2438 return -EINVAL; 2439 2440 changed |= WIPHY_PARAM_RETRY_LONG; 2441 } 2442 2443 if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) { 2444 frag_threshold = nla_get_u32( 2445 info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]); 2446 if (frag_threshold < 256) 2447 return -EINVAL; 2448 2449 if (frag_threshold != (u32) -1) { 2450 /* 2451 * Fragments (apart from the last one) are required to 2452 * have even length. Make the fragmentation code 2453 * simpler by stripping LSB should someone try to use 2454 * odd threshold value. 2455 */ 2456 frag_threshold &= ~0x1; 2457 } 2458 changed |= WIPHY_PARAM_FRAG_THRESHOLD; 2459 } 2460 2461 if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) { 2462 rts_threshold = nla_get_u32( 2463 info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]); 2464 changed |= WIPHY_PARAM_RTS_THRESHOLD; 2465 } 2466 2467 if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) { 2468 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) 2469 return -EINVAL; 2470 2471 coverage_class = nla_get_u8( 2472 info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]); 2473 changed |= WIPHY_PARAM_COVERAGE_CLASS; 2474 } 2475 2476 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) { 2477 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION)) 2478 return -EOPNOTSUPP; 2479 2480 changed |= WIPHY_PARAM_DYN_ACK; 2481 } 2482 2483 if (changed) { 2484 u8 old_retry_short, old_retry_long; 2485 u32 old_frag_threshold, old_rts_threshold; 2486 u8 old_coverage_class; 2487 2488 if (!rdev->ops->set_wiphy_params) 2489 return -EOPNOTSUPP; 2490 2491 old_retry_short = rdev->wiphy.retry_short; 2492 old_retry_long = rdev->wiphy.retry_long; 2493 old_frag_threshold = rdev->wiphy.frag_threshold; 2494 old_rts_threshold = rdev->wiphy.rts_threshold; 2495 old_coverage_class = rdev->wiphy.coverage_class; 2496 2497 if (changed & WIPHY_PARAM_RETRY_SHORT) 2498 rdev->wiphy.retry_short = retry_short; 2499 if (changed & WIPHY_PARAM_RETRY_LONG) 2500 rdev->wiphy.retry_long = retry_long; 2501 if (changed & WIPHY_PARAM_FRAG_THRESHOLD) 2502 rdev->wiphy.frag_threshold = frag_threshold; 2503 if (changed & WIPHY_PARAM_RTS_THRESHOLD) 2504 rdev->wiphy.rts_threshold = rts_threshold; 2505 if (changed & WIPHY_PARAM_COVERAGE_CLASS) 2506 rdev->wiphy.coverage_class = coverage_class; 2507 2508 result = rdev_set_wiphy_params(rdev, changed); 2509 if (result) { 2510 rdev->wiphy.retry_short = old_retry_short; 2511 rdev->wiphy.retry_long = old_retry_long; 2512 rdev->wiphy.frag_threshold = old_frag_threshold; 2513 rdev->wiphy.rts_threshold = old_rts_threshold; 2514 rdev->wiphy.coverage_class = old_coverage_class; 2515 return result; 2516 } 2517 } 2518 return 0; 2519 } 2520 2521 static inline u64 wdev_id(struct wireless_dev *wdev) 2522 { 2523 return (u64)wdev->identifier | 2524 ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32); 2525 } 2526 2527 static int nl80211_send_chandef(struct sk_buff *msg, 2528 const struct cfg80211_chan_def *chandef) 2529 { 2530 if (WARN_ON(!cfg80211_chandef_valid(chandef))) 2531 return -EINVAL; 2532 2533 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, 2534 chandef->chan->center_freq)) 2535 return -ENOBUFS; 2536 switch (chandef->width) { 2537 case NL80211_CHAN_WIDTH_20_NOHT: 2538 case NL80211_CHAN_WIDTH_20: 2539 case NL80211_CHAN_WIDTH_40: 2540 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, 2541 cfg80211_get_chandef_type(chandef))) 2542 return -ENOBUFS; 2543 break; 2544 default: 2545 break; 2546 } 2547 if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width)) 2548 return -ENOBUFS; 2549 if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1)) 2550 return -ENOBUFS; 2551 if (chandef->center_freq2 && 2552 nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2)) 2553 return -ENOBUFS; 2554 return 0; 2555 } 2556 2557 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags, 2558 struct cfg80211_registered_device *rdev, 2559 struct wireless_dev *wdev, bool removal) 2560 { 2561 struct net_device *dev = wdev->netdev; 2562 u8 cmd = NL80211_CMD_NEW_INTERFACE; 2563 void *hdr; 2564 2565 if (removal) 2566 cmd = NL80211_CMD_DEL_INTERFACE; 2567 2568 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 2569 if (!hdr) 2570 return -1; 2571 2572 if (dev && 2573 (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 2574 nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name))) 2575 goto nla_put_failure; 2576 2577 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 2578 nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) || 2579 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 2580 NL80211_ATTR_PAD) || 2581 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) || 2582 nla_put_u32(msg, NL80211_ATTR_GENERATION, 2583 rdev->devlist_generation ^ 2584 (cfg80211_rdev_list_generation << 2))) 2585 goto nla_put_failure; 2586 2587 if (rdev->ops->get_channel) { 2588 int ret; 2589 struct cfg80211_chan_def chandef; 2590 2591 ret = rdev_get_channel(rdev, wdev, &chandef); 2592 if (ret == 0) { 2593 if (nl80211_send_chandef(msg, &chandef)) 2594 goto nla_put_failure; 2595 } 2596 } 2597 2598 if (rdev->ops->get_tx_power) { 2599 int dbm, ret; 2600 2601 ret = rdev_get_tx_power(rdev, wdev, &dbm); 2602 if (ret == 0 && 2603 nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL, 2604 DBM_TO_MBM(dbm))) 2605 goto nla_put_failure; 2606 } 2607 2608 wdev_lock(wdev); 2609 switch (wdev->iftype) { 2610 case NL80211_IFTYPE_AP: 2611 if (wdev->ssid_len && 2612 nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid)) 2613 goto nla_put_failure; 2614 break; 2615 case NL80211_IFTYPE_STATION: 2616 case NL80211_IFTYPE_P2P_CLIENT: 2617 case NL80211_IFTYPE_ADHOC: { 2618 const u8 *ssid_ie; 2619 if (!wdev->current_bss) 2620 break; 2621 ssid_ie = ieee80211_bss_get_ie(&wdev->current_bss->pub, 2622 WLAN_EID_SSID); 2623 if (!ssid_ie) 2624 break; 2625 if (nla_put(msg, NL80211_ATTR_SSID, ssid_ie[1], ssid_ie + 2)) 2626 goto nla_put_failure; 2627 break; 2628 } 2629 default: 2630 /* nothing */ 2631 break; 2632 } 2633 wdev_unlock(wdev); 2634 2635 genlmsg_end(msg, hdr); 2636 return 0; 2637 2638 nla_put_failure: 2639 genlmsg_cancel(msg, hdr); 2640 return -EMSGSIZE; 2641 } 2642 2643 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb) 2644 { 2645 int wp_idx = 0; 2646 int if_idx = 0; 2647 int wp_start = cb->args[0]; 2648 int if_start = cb->args[1]; 2649 int filter_wiphy = -1; 2650 struct cfg80211_registered_device *rdev; 2651 struct wireless_dev *wdev; 2652 int ret; 2653 2654 rtnl_lock(); 2655 if (!cb->args[2]) { 2656 struct nl80211_dump_wiphy_state state = { 2657 .filter_wiphy = -1, 2658 }; 2659 2660 ret = nl80211_dump_wiphy_parse(skb, cb, &state); 2661 if (ret) 2662 goto out_unlock; 2663 2664 filter_wiphy = state.filter_wiphy; 2665 2666 /* 2667 * if filtering, set cb->args[2] to +1 since 0 is the default 2668 * value needed to determine that parsing is necessary. 2669 */ 2670 if (filter_wiphy >= 0) 2671 cb->args[2] = filter_wiphy + 1; 2672 else 2673 cb->args[2] = -1; 2674 } else if (cb->args[2] > 0) { 2675 filter_wiphy = cb->args[2] - 1; 2676 } 2677 2678 list_for_each_entry(rdev, &cfg80211_rdev_list, list) { 2679 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk))) 2680 continue; 2681 if (wp_idx < wp_start) { 2682 wp_idx++; 2683 continue; 2684 } 2685 2686 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx) 2687 continue; 2688 2689 if_idx = 0; 2690 2691 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { 2692 if (if_idx < if_start) { 2693 if_idx++; 2694 continue; 2695 } 2696 if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid, 2697 cb->nlh->nlmsg_seq, NLM_F_MULTI, 2698 rdev, wdev, false) < 0) { 2699 goto out; 2700 } 2701 if_idx++; 2702 } 2703 2704 wp_idx++; 2705 } 2706 out: 2707 cb->args[0] = wp_idx; 2708 cb->args[1] = if_idx; 2709 2710 ret = skb->len; 2711 out_unlock: 2712 rtnl_unlock(); 2713 2714 return ret; 2715 } 2716 2717 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info) 2718 { 2719 struct sk_buff *msg; 2720 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 2721 struct wireless_dev *wdev = info->user_ptr[1]; 2722 2723 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 2724 if (!msg) 2725 return -ENOMEM; 2726 2727 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0, 2728 rdev, wdev, false) < 0) { 2729 nlmsg_free(msg); 2730 return -ENOBUFS; 2731 } 2732 2733 return genlmsg_reply(msg, info); 2734 } 2735 2736 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = { 2737 [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG }, 2738 [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG }, 2739 [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG }, 2740 [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG }, 2741 [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG }, 2742 [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG }, 2743 }; 2744 2745 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags) 2746 { 2747 struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1]; 2748 int flag; 2749 2750 *mntrflags = 0; 2751 2752 if (!nla) 2753 return -EINVAL; 2754 2755 if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX, nla, 2756 mntr_flags_policy, NULL)) 2757 return -EINVAL; 2758 2759 for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++) 2760 if (flags[flag]) 2761 *mntrflags |= (1<<flag); 2762 2763 *mntrflags |= MONITOR_FLAG_CHANGED; 2764 2765 return 0; 2766 } 2767 2768 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev, 2769 enum nl80211_iftype type, 2770 struct genl_info *info, 2771 struct vif_params *params) 2772 { 2773 bool change = false; 2774 int err; 2775 2776 if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) { 2777 if (type != NL80211_IFTYPE_MONITOR) 2778 return -EINVAL; 2779 2780 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS], 2781 ¶ms->flags); 2782 if (err) 2783 return err; 2784 2785 change = true; 2786 } 2787 2788 if (params->flags & MONITOR_FLAG_ACTIVE && 2789 !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR)) 2790 return -EOPNOTSUPP; 2791 2792 if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) { 2793 const u8 *mumimo_groups; 2794 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER; 2795 2796 if (type != NL80211_IFTYPE_MONITOR) 2797 return -EINVAL; 2798 2799 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag)) 2800 return -EOPNOTSUPP; 2801 2802 mumimo_groups = 2803 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]); 2804 2805 /* bits 0 and 63 are reserved and must be zero */ 2806 if ((mumimo_groups[0] & BIT(0)) || 2807 (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7))) 2808 return -EINVAL; 2809 2810 params->vht_mumimo_groups = mumimo_groups; 2811 change = true; 2812 } 2813 2814 if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) { 2815 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER; 2816 2817 if (type != NL80211_IFTYPE_MONITOR) 2818 return -EINVAL; 2819 2820 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag)) 2821 return -EOPNOTSUPP; 2822 2823 params->vht_mumimo_follow_addr = 2824 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]); 2825 change = true; 2826 } 2827 2828 return change ? 1 : 0; 2829 } 2830 2831 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev, 2832 struct net_device *netdev, u8 use_4addr, 2833 enum nl80211_iftype iftype) 2834 { 2835 if (!use_4addr) { 2836 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT)) 2837 return -EBUSY; 2838 return 0; 2839 } 2840 2841 switch (iftype) { 2842 case NL80211_IFTYPE_AP_VLAN: 2843 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP) 2844 return 0; 2845 break; 2846 case NL80211_IFTYPE_STATION: 2847 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION) 2848 return 0; 2849 break; 2850 default: 2851 break; 2852 } 2853 2854 return -EOPNOTSUPP; 2855 } 2856 2857 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info) 2858 { 2859 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 2860 struct vif_params params; 2861 int err; 2862 enum nl80211_iftype otype, ntype; 2863 struct net_device *dev = info->user_ptr[1]; 2864 bool change = false; 2865 2866 memset(¶ms, 0, sizeof(params)); 2867 2868 otype = ntype = dev->ieee80211_ptr->iftype; 2869 2870 if (info->attrs[NL80211_ATTR_IFTYPE]) { 2871 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]); 2872 if (otype != ntype) 2873 change = true; 2874 if (ntype > NL80211_IFTYPE_MAX) 2875 return -EINVAL; 2876 } 2877 2878 if (info->attrs[NL80211_ATTR_MESH_ID]) { 2879 struct wireless_dev *wdev = dev->ieee80211_ptr; 2880 2881 if (ntype != NL80211_IFTYPE_MESH_POINT) 2882 return -EINVAL; 2883 if (netif_running(dev)) 2884 return -EBUSY; 2885 2886 wdev_lock(wdev); 2887 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN != 2888 IEEE80211_MAX_MESH_ID_LEN); 2889 wdev->mesh_id_up_len = 2890 nla_len(info->attrs[NL80211_ATTR_MESH_ID]); 2891 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]), 2892 wdev->mesh_id_up_len); 2893 wdev_unlock(wdev); 2894 } 2895 2896 if (info->attrs[NL80211_ATTR_4ADDR]) { 2897 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]); 2898 change = true; 2899 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype); 2900 if (err) 2901 return err; 2902 } else { 2903 params.use_4addr = -1; 2904 } 2905 2906 err = nl80211_parse_mon_options(rdev, ntype, info, ¶ms); 2907 if (err < 0) 2908 return err; 2909 if (err > 0) 2910 change = true; 2911 2912 if (change) 2913 err = cfg80211_change_iface(rdev, dev, ntype, ¶ms); 2914 else 2915 err = 0; 2916 2917 if (!err && params.use_4addr != -1) 2918 dev->ieee80211_ptr->use_4addr = params.use_4addr; 2919 2920 return err; 2921 } 2922 2923 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info) 2924 { 2925 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 2926 struct vif_params params; 2927 struct wireless_dev *wdev; 2928 struct sk_buff *msg; 2929 int err; 2930 enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED; 2931 2932 /* to avoid failing a new interface creation due to pending removal */ 2933 cfg80211_destroy_ifaces(rdev); 2934 2935 memset(¶ms, 0, sizeof(params)); 2936 2937 if (!info->attrs[NL80211_ATTR_IFNAME]) 2938 return -EINVAL; 2939 2940 if (info->attrs[NL80211_ATTR_IFTYPE]) { 2941 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]); 2942 if (type > NL80211_IFTYPE_MAX) 2943 return -EINVAL; 2944 } 2945 2946 if (!rdev->ops->add_virtual_intf || 2947 !(rdev->wiphy.interface_modes & (1 << type))) 2948 return -EOPNOTSUPP; 2949 2950 if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN || 2951 rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) && 2952 info->attrs[NL80211_ATTR_MAC]) { 2953 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC], 2954 ETH_ALEN); 2955 if (!is_valid_ether_addr(params.macaddr)) 2956 return -EADDRNOTAVAIL; 2957 } 2958 2959 if (info->attrs[NL80211_ATTR_4ADDR]) { 2960 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]); 2961 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type); 2962 if (err) 2963 return err; 2964 } 2965 2966 err = nl80211_parse_mon_options(rdev, type, info, ¶ms); 2967 if (err < 0) 2968 return err; 2969 2970 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 2971 if (!msg) 2972 return -ENOMEM; 2973 2974 wdev = rdev_add_virtual_intf(rdev, 2975 nla_data(info->attrs[NL80211_ATTR_IFNAME]), 2976 NET_NAME_USER, type, ¶ms); 2977 if (WARN_ON(!wdev)) { 2978 nlmsg_free(msg); 2979 return -EPROTO; 2980 } else if (IS_ERR(wdev)) { 2981 nlmsg_free(msg); 2982 return PTR_ERR(wdev); 2983 } 2984 2985 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 2986 wdev->owner_nlportid = info->snd_portid; 2987 2988 switch (type) { 2989 case NL80211_IFTYPE_MESH_POINT: 2990 if (!info->attrs[NL80211_ATTR_MESH_ID]) 2991 break; 2992 wdev_lock(wdev); 2993 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN != 2994 IEEE80211_MAX_MESH_ID_LEN); 2995 wdev->mesh_id_up_len = 2996 nla_len(info->attrs[NL80211_ATTR_MESH_ID]); 2997 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]), 2998 wdev->mesh_id_up_len); 2999 wdev_unlock(wdev); 3000 break; 3001 case NL80211_IFTYPE_NAN: 3002 case NL80211_IFTYPE_P2P_DEVICE: 3003 /* 3004 * P2P Device and NAN do not have a netdev, so don't go 3005 * through the netdev notifier and must be added here 3006 */ 3007 mutex_init(&wdev->mtx); 3008 INIT_LIST_HEAD(&wdev->event_list); 3009 spin_lock_init(&wdev->event_lock); 3010 INIT_LIST_HEAD(&wdev->mgmt_registrations); 3011 spin_lock_init(&wdev->mgmt_registrations_lock); 3012 3013 wdev->identifier = ++rdev->wdev_id; 3014 list_add_rcu(&wdev->list, &rdev->wiphy.wdev_list); 3015 rdev->devlist_generation++; 3016 break; 3017 default: 3018 break; 3019 } 3020 3021 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0, 3022 rdev, wdev, false) < 0) { 3023 nlmsg_free(msg); 3024 return -ENOBUFS; 3025 } 3026 3027 /* 3028 * For wdevs which have no associated netdev object (e.g. of type 3029 * NL80211_IFTYPE_P2P_DEVICE), emit the NEW_INTERFACE event here. 3030 * For all other types, the event will be generated from the 3031 * netdev notifier 3032 */ 3033 if (!wdev->netdev) 3034 nl80211_notify_iface(rdev, wdev, NL80211_CMD_NEW_INTERFACE); 3035 3036 return genlmsg_reply(msg, info); 3037 } 3038 3039 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info) 3040 { 3041 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3042 struct wireless_dev *wdev = info->user_ptr[1]; 3043 3044 if (!rdev->ops->del_virtual_intf) 3045 return -EOPNOTSUPP; 3046 3047 /* 3048 * If we remove a wireless device without a netdev then clear 3049 * user_ptr[1] so that nl80211_post_doit won't dereference it 3050 * to check if it needs to do dev_put(). Otherwise it crashes 3051 * since the wdev has been freed, unlike with a netdev where 3052 * we need the dev_put() for the netdev to really be freed. 3053 */ 3054 if (!wdev->netdev) 3055 info->user_ptr[1] = NULL; 3056 3057 return rdev_del_virtual_intf(rdev, wdev); 3058 } 3059 3060 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info) 3061 { 3062 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3063 struct net_device *dev = info->user_ptr[1]; 3064 u16 noack_map; 3065 3066 if (!info->attrs[NL80211_ATTR_NOACK_MAP]) 3067 return -EINVAL; 3068 3069 if (!rdev->ops->set_noack_map) 3070 return -EOPNOTSUPP; 3071 3072 noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]); 3073 3074 return rdev_set_noack_map(rdev, dev, noack_map); 3075 } 3076 3077 struct get_key_cookie { 3078 struct sk_buff *msg; 3079 int error; 3080 int idx; 3081 }; 3082 3083 static void get_key_callback(void *c, struct key_params *params) 3084 { 3085 struct nlattr *key; 3086 struct get_key_cookie *cookie = c; 3087 3088 if ((params->key && 3089 nla_put(cookie->msg, NL80211_ATTR_KEY_DATA, 3090 params->key_len, params->key)) || 3091 (params->seq && 3092 nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ, 3093 params->seq_len, params->seq)) || 3094 (params->cipher && 3095 nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER, 3096 params->cipher))) 3097 goto nla_put_failure; 3098 3099 key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY); 3100 if (!key) 3101 goto nla_put_failure; 3102 3103 if ((params->key && 3104 nla_put(cookie->msg, NL80211_KEY_DATA, 3105 params->key_len, params->key)) || 3106 (params->seq && 3107 nla_put(cookie->msg, NL80211_KEY_SEQ, 3108 params->seq_len, params->seq)) || 3109 (params->cipher && 3110 nla_put_u32(cookie->msg, NL80211_KEY_CIPHER, 3111 params->cipher))) 3112 goto nla_put_failure; 3113 3114 if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx)) 3115 goto nla_put_failure; 3116 3117 nla_nest_end(cookie->msg, key); 3118 3119 return; 3120 nla_put_failure: 3121 cookie->error = 1; 3122 } 3123 3124 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info) 3125 { 3126 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3127 int err; 3128 struct net_device *dev = info->user_ptr[1]; 3129 u8 key_idx = 0; 3130 const u8 *mac_addr = NULL; 3131 bool pairwise; 3132 struct get_key_cookie cookie = { 3133 .error = 0, 3134 }; 3135 void *hdr; 3136 struct sk_buff *msg; 3137 3138 if (info->attrs[NL80211_ATTR_KEY_IDX]) 3139 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]); 3140 3141 if (key_idx > 5) 3142 return -EINVAL; 3143 3144 if (info->attrs[NL80211_ATTR_MAC]) 3145 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 3146 3147 pairwise = !!mac_addr; 3148 if (info->attrs[NL80211_ATTR_KEY_TYPE]) { 3149 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]); 3150 3151 if (kt >= NUM_NL80211_KEYTYPES) 3152 return -EINVAL; 3153 if (kt != NL80211_KEYTYPE_GROUP && 3154 kt != NL80211_KEYTYPE_PAIRWISE) 3155 return -EINVAL; 3156 pairwise = kt == NL80211_KEYTYPE_PAIRWISE; 3157 } 3158 3159 if (!rdev->ops->get_key) 3160 return -EOPNOTSUPP; 3161 3162 if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)) 3163 return -ENOENT; 3164 3165 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 3166 if (!msg) 3167 return -ENOMEM; 3168 3169 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 3170 NL80211_CMD_NEW_KEY); 3171 if (!hdr) 3172 goto nla_put_failure; 3173 3174 cookie.msg = msg; 3175 cookie.idx = key_idx; 3176 3177 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 3178 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx)) 3179 goto nla_put_failure; 3180 if (mac_addr && 3181 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr)) 3182 goto nla_put_failure; 3183 3184 err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie, 3185 get_key_callback); 3186 3187 if (err) 3188 goto free_msg; 3189 3190 if (cookie.error) 3191 goto nla_put_failure; 3192 3193 genlmsg_end(msg, hdr); 3194 return genlmsg_reply(msg, info); 3195 3196 nla_put_failure: 3197 err = -ENOBUFS; 3198 free_msg: 3199 nlmsg_free(msg); 3200 return err; 3201 } 3202 3203 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info) 3204 { 3205 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3206 struct key_parse key; 3207 int err; 3208 struct net_device *dev = info->user_ptr[1]; 3209 3210 err = nl80211_parse_key(info, &key); 3211 if (err) 3212 return err; 3213 3214 if (key.idx < 0) 3215 return -EINVAL; 3216 3217 /* only support setting default key */ 3218 if (!key.def && !key.defmgmt) 3219 return -EINVAL; 3220 3221 wdev_lock(dev->ieee80211_ptr); 3222 3223 if (key.def) { 3224 if (!rdev->ops->set_default_key) { 3225 err = -EOPNOTSUPP; 3226 goto out; 3227 } 3228 3229 err = nl80211_key_allowed(dev->ieee80211_ptr); 3230 if (err) 3231 goto out; 3232 3233 err = rdev_set_default_key(rdev, dev, key.idx, 3234 key.def_uni, key.def_multi); 3235 3236 if (err) 3237 goto out; 3238 3239 #ifdef CONFIG_CFG80211_WEXT 3240 dev->ieee80211_ptr->wext.default_key = key.idx; 3241 #endif 3242 } else { 3243 if (key.def_uni || !key.def_multi) { 3244 err = -EINVAL; 3245 goto out; 3246 } 3247 3248 if (!rdev->ops->set_default_mgmt_key) { 3249 err = -EOPNOTSUPP; 3250 goto out; 3251 } 3252 3253 err = nl80211_key_allowed(dev->ieee80211_ptr); 3254 if (err) 3255 goto out; 3256 3257 err = rdev_set_default_mgmt_key(rdev, dev, key.idx); 3258 if (err) 3259 goto out; 3260 3261 #ifdef CONFIG_CFG80211_WEXT 3262 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx; 3263 #endif 3264 } 3265 3266 out: 3267 wdev_unlock(dev->ieee80211_ptr); 3268 3269 return err; 3270 } 3271 3272 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info) 3273 { 3274 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3275 int err; 3276 struct net_device *dev = info->user_ptr[1]; 3277 struct key_parse key; 3278 const u8 *mac_addr = NULL; 3279 3280 err = nl80211_parse_key(info, &key); 3281 if (err) 3282 return err; 3283 3284 if (!key.p.key) 3285 return -EINVAL; 3286 3287 if (info->attrs[NL80211_ATTR_MAC]) 3288 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 3289 3290 if (key.type == -1) { 3291 if (mac_addr) 3292 key.type = NL80211_KEYTYPE_PAIRWISE; 3293 else 3294 key.type = NL80211_KEYTYPE_GROUP; 3295 } 3296 3297 /* for now */ 3298 if (key.type != NL80211_KEYTYPE_PAIRWISE && 3299 key.type != NL80211_KEYTYPE_GROUP) 3300 return -EINVAL; 3301 3302 if (!rdev->ops->add_key) 3303 return -EOPNOTSUPP; 3304 3305 if (cfg80211_validate_key_settings(rdev, &key.p, key.idx, 3306 key.type == NL80211_KEYTYPE_PAIRWISE, 3307 mac_addr)) 3308 return -EINVAL; 3309 3310 wdev_lock(dev->ieee80211_ptr); 3311 err = nl80211_key_allowed(dev->ieee80211_ptr); 3312 if (!err) 3313 err = rdev_add_key(rdev, dev, key.idx, 3314 key.type == NL80211_KEYTYPE_PAIRWISE, 3315 mac_addr, &key.p); 3316 wdev_unlock(dev->ieee80211_ptr); 3317 3318 return err; 3319 } 3320 3321 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info) 3322 { 3323 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3324 int err; 3325 struct net_device *dev = info->user_ptr[1]; 3326 u8 *mac_addr = NULL; 3327 struct key_parse key; 3328 3329 err = nl80211_parse_key(info, &key); 3330 if (err) 3331 return err; 3332 3333 if (info->attrs[NL80211_ATTR_MAC]) 3334 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 3335 3336 if (key.type == -1) { 3337 if (mac_addr) 3338 key.type = NL80211_KEYTYPE_PAIRWISE; 3339 else 3340 key.type = NL80211_KEYTYPE_GROUP; 3341 } 3342 3343 /* for now */ 3344 if (key.type != NL80211_KEYTYPE_PAIRWISE && 3345 key.type != NL80211_KEYTYPE_GROUP) 3346 return -EINVAL; 3347 3348 if (!rdev->ops->del_key) 3349 return -EOPNOTSUPP; 3350 3351 wdev_lock(dev->ieee80211_ptr); 3352 err = nl80211_key_allowed(dev->ieee80211_ptr); 3353 3354 if (key.type == NL80211_KEYTYPE_GROUP && mac_addr && 3355 !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)) 3356 err = -ENOENT; 3357 3358 if (!err) 3359 err = rdev_del_key(rdev, dev, key.idx, 3360 key.type == NL80211_KEYTYPE_PAIRWISE, 3361 mac_addr); 3362 3363 #ifdef CONFIG_CFG80211_WEXT 3364 if (!err) { 3365 if (key.idx == dev->ieee80211_ptr->wext.default_key) 3366 dev->ieee80211_ptr->wext.default_key = -1; 3367 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key) 3368 dev->ieee80211_ptr->wext.default_mgmt_key = -1; 3369 } 3370 #endif 3371 wdev_unlock(dev->ieee80211_ptr); 3372 3373 return err; 3374 } 3375 3376 /* This function returns an error or the number of nested attributes */ 3377 static int validate_acl_mac_addrs(struct nlattr *nl_attr) 3378 { 3379 struct nlattr *attr; 3380 int n_entries = 0, tmp; 3381 3382 nla_for_each_nested(attr, nl_attr, tmp) { 3383 if (nla_len(attr) != ETH_ALEN) 3384 return -EINVAL; 3385 3386 n_entries++; 3387 } 3388 3389 return n_entries; 3390 } 3391 3392 /* 3393 * This function parses ACL information and allocates memory for ACL data. 3394 * On successful return, the calling function is responsible to free the 3395 * ACL buffer returned by this function. 3396 */ 3397 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy, 3398 struct genl_info *info) 3399 { 3400 enum nl80211_acl_policy acl_policy; 3401 struct nlattr *attr; 3402 struct cfg80211_acl_data *acl; 3403 int i = 0, n_entries, tmp; 3404 3405 if (!wiphy->max_acl_mac_addrs) 3406 return ERR_PTR(-EOPNOTSUPP); 3407 3408 if (!info->attrs[NL80211_ATTR_ACL_POLICY]) 3409 return ERR_PTR(-EINVAL); 3410 3411 acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]); 3412 if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED && 3413 acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED) 3414 return ERR_PTR(-EINVAL); 3415 3416 if (!info->attrs[NL80211_ATTR_MAC_ADDRS]) 3417 return ERR_PTR(-EINVAL); 3418 3419 n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]); 3420 if (n_entries < 0) 3421 return ERR_PTR(n_entries); 3422 3423 if (n_entries > wiphy->max_acl_mac_addrs) 3424 return ERR_PTR(-ENOTSUPP); 3425 3426 acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries), 3427 GFP_KERNEL); 3428 if (!acl) 3429 return ERR_PTR(-ENOMEM); 3430 3431 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) { 3432 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN); 3433 i++; 3434 } 3435 3436 acl->n_acl_entries = n_entries; 3437 acl->acl_policy = acl_policy; 3438 3439 return acl; 3440 } 3441 3442 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info) 3443 { 3444 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3445 struct net_device *dev = info->user_ptr[1]; 3446 struct cfg80211_acl_data *acl; 3447 int err; 3448 3449 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 3450 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 3451 return -EOPNOTSUPP; 3452 3453 if (!dev->ieee80211_ptr->beacon_interval) 3454 return -EINVAL; 3455 3456 acl = parse_acl_data(&rdev->wiphy, info); 3457 if (IS_ERR(acl)) 3458 return PTR_ERR(acl); 3459 3460 err = rdev_set_mac_acl(rdev, dev, acl); 3461 3462 kfree(acl); 3463 3464 return err; 3465 } 3466 3467 static u32 rateset_to_mask(struct ieee80211_supported_band *sband, 3468 u8 *rates, u8 rates_len) 3469 { 3470 u8 i; 3471 u32 mask = 0; 3472 3473 for (i = 0; i < rates_len; i++) { 3474 int rate = (rates[i] & 0x7f) * 5; 3475 int ridx; 3476 3477 for (ridx = 0; ridx < sband->n_bitrates; ridx++) { 3478 struct ieee80211_rate *srate = 3479 &sband->bitrates[ridx]; 3480 if (rate == srate->bitrate) { 3481 mask |= 1 << ridx; 3482 break; 3483 } 3484 } 3485 if (ridx == sband->n_bitrates) 3486 return 0; /* rate not found */ 3487 } 3488 3489 return mask; 3490 } 3491 3492 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband, 3493 u8 *rates, u8 rates_len, 3494 u8 mcs[IEEE80211_HT_MCS_MASK_LEN]) 3495 { 3496 u8 i; 3497 3498 memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN); 3499 3500 for (i = 0; i < rates_len; i++) { 3501 int ridx, rbit; 3502 3503 ridx = rates[i] / 8; 3504 rbit = BIT(rates[i] % 8); 3505 3506 /* check validity */ 3507 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN)) 3508 return false; 3509 3510 /* check availability */ 3511 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit) 3512 mcs[ridx] |= rbit; 3513 else 3514 return false; 3515 } 3516 3517 return true; 3518 } 3519 3520 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map) 3521 { 3522 u16 mcs_mask = 0; 3523 3524 switch (vht_mcs_map) { 3525 case IEEE80211_VHT_MCS_NOT_SUPPORTED: 3526 break; 3527 case IEEE80211_VHT_MCS_SUPPORT_0_7: 3528 mcs_mask = 0x00FF; 3529 break; 3530 case IEEE80211_VHT_MCS_SUPPORT_0_8: 3531 mcs_mask = 0x01FF; 3532 break; 3533 case IEEE80211_VHT_MCS_SUPPORT_0_9: 3534 mcs_mask = 0x03FF; 3535 break; 3536 default: 3537 break; 3538 } 3539 3540 return mcs_mask; 3541 } 3542 3543 static void vht_build_mcs_mask(u16 vht_mcs_map, 3544 u16 vht_mcs_mask[NL80211_VHT_NSS_MAX]) 3545 { 3546 u8 nss; 3547 3548 for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) { 3549 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03); 3550 vht_mcs_map >>= 2; 3551 } 3552 } 3553 3554 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband, 3555 struct nl80211_txrate_vht *txrate, 3556 u16 mcs[NL80211_VHT_NSS_MAX]) 3557 { 3558 u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map); 3559 u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {}; 3560 u8 i; 3561 3562 if (!sband->vht_cap.vht_supported) 3563 return false; 3564 3565 memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX); 3566 3567 /* Build vht_mcs_mask from VHT capabilities */ 3568 vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask); 3569 3570 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) { 3571 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i]) 3572 mcs[i] = txrate->mcs[i]; 3573 else 3574 return false; 3575 } 3576 3577 return true; 3578 } 3579 3580 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = { 3581 [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY, 3582 .len = NL80211_MAX_SUPP_RATES }, 3583 [NL80211_TXRATE_HT] = { .type = NLA_BINARY, 3584 .len = NL80211_MAX_SUPP_HT_RATES }, 3585 [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)}, 3586 [NL80211_TXRATE_GI] = { .type = NLA_U8 }, 3587 }; 3588 3589 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info, 3590 struct cfg80211_bitrate_mask *mask) 3591 { 3592 struct nlattr *tb[NL80211_TXRATE_MAX + 1]; 3593 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3594 int rem, i; 3595 struct nlattr *tx_rates; 3596 struct ieee80211_supported_band *sband; 3597 u16 vht_tx_mcs_map; 3598 3599 memset(mask, 0, sizeof(*mask)); 3600 /* Default to all rates enabled */ 3601 for (i = 0; i < NUM_NL80211_BANDS; i++) { 3602 sband = rdev->wiphy.bands[i]; 3603 3604 if (!sband) 3605 continue; 3606 3607 mask->control[i].legacy = (1 << sband->n_bitrates) - 1; 3608 memcpy(mask->control[i].ht_mcs, 3609 sband->ht_cap.mcs.rx_mask, 3610 sizeof(mask->control[i].ht_mcs)); 3611 3612 if (!sband->vht_cap.vht_supported) 3613 continue; 3614 3615 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map); 3616 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs); 3617 } 3618 3619 /* if no rates are given set it back to the defaults */ 3620 if (!info->attrs[NL80211_ATTR_TX_RATES]) 3621 goto out; 3622 3623 /* The nested attribute uses enum nl80211_band as the index. This maps 3624 * directly to the enum nl80211_band values used in cfg80211. 3625 */ 3626 BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8); 3627 nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) { 3628 enum nl80211_band band = nla_type(tx_rates); 3629 int err; 3630 3631 if (band < 0 || band >= NUM_NL80211_BANDS) 3632 return -EINVAL; 3633 sband = rdev->wiphy.bands[band]; 3634 if (sband == NULL) 3635 return -EINVAL; 3636 err = nla_parse_nested(tb, NL80211_TXRATE_MAX, tx_rates, 3637 nl80211_txattr_policy, info->extack); 3638 if (err) 3639 return err; 3640 if (tb[NL80211_TXRATE_LEGACY]) { 3641 mask->control[band].legacy = rateset_to_mask( 3642 sband, 3643 nla_data(tb[NL80211_TXRATE_LEGACY]), 3644 nla_len(tb[NL80211_TXRATE_LEGACY])); 3645 if ((mask->control[band].legacy == 0) && 3646 nla_len(tb[NL80211_TXRATE_LEGACY])) 3647 return -EINVAL; 3648 } 3649 if (tb[NL80211_TXRATE_HT]) { 3650 if (!ht_rateset_to_mask( 3651 sband, 3652 nla_data(tb[NL80211_TXRATE_HT]), 3653 nla_len(tb[NL80211_TXRATE_HT]), 3654 mask->control[band].ht_mcs)) 3655 return -EINVAL; 3656 } 3657 if (tb[NL80211_TXRATE_VHT]) { 3658 if (!vht_set_mcs_mask( 3659 sband, 3660 nla_data(tb[NL80211_TXRATE_VHT]), 3661 mask->control[band].vht_mcs)) 3662 return -EINVAL; 3663 } 3664 if (tb[NL80211_TXRATE_GI]) { 3665 mask->control[band].gi = 3666 nla_get_u8(tb[NL80211_TXRATE_GI]); 3667 if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI) 3668 return -EINVAL; 3669 } 3670 3671 if (mask->control[band].legacy == 0) { 3672 /* don't allow empty legacy rates if HT or VHT 3673 * are not even supported. 3674 */ 3675 if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported || 3676 rdev->wiphy.bands[band]->vht_cap.vht_supported)) 3677 return -EINVAL; 3678 3679 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) 3680 if (mask->control[band].ht_mcs[i]) 3681 goto out; 3682 3683 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) 3684 if (mask->control[band].vht_mcs[i]) 3685 goto out; 3686 3687 /* legacy and mcs rates may not be both empty */ 3688 return -EINVAL; 3689 } 3690 } 3691 3692 out: 3693 return 0; 3694 } 3695 3696 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev, 3697 enum nl80211_band band, 3698 struct cfg80211_bitrate_mask *beacon_rate) 3699 { 3700 u32 count_ht, count_vht, i; 3701 u32 rate = beacon_rate->control[band].legacy; 3702 3703 /* Allow only one rate */ 3704 if (hweight32(rate) > 1) 3705 return -EINVAL; 3706 3707 count_ht = 0; 3708 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) { 3709 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) { 3710 return -EINVAL; 3711 } else if (beacon_rate->control[band].ht_mcs[i]) { 3712 count_ht++; 3713 if (count_ht > 1) 3714 return -EINVAL; 3715 } 3716 if (count_ht && rate) 3717 return -EINVAL; 3718 } 3719 3720 count_vht = 0; 3721 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) { 3722 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) { 3723 return -EINVAL; 3724 } else if (beacon_rate->control[band].vht_mcs[i]) { 3725 count_vht++; 3726 if (count_vht > 1) 3727 return -EINVAL; 3728 } 3729 if (count_vht && rate) 3730 return -EINVAL; 3731 } 3732 3733 if ((count_ht && count_vht) || (!rate && !count_ht && !count_vht)) 3734 return -EINVAL; 3735 3736 if (rate && 3737 !wiphy_ext_feature_isset(&rdev->wiphy, 3738 NL80211_EXT_FEATURE_BEACON_RATE_LEGACY)) 3739 return -EINVAL; 3740 if (count_ht && 3741 !wiphy_ext_feature_isset(&rdev->wiphy, 3742 NL80211_EXT_FEATURE_BEACON_RATE_HT)) 3743 return -EINVAL; 3744 if (count_vht && 3745 !wiphy_ext_feature_isset(&rdev->wiphy, 3746 NL80211_EXT_FEATURE_BEACON_RATE_VHT)) 3747 return -EINVAL; 3748 3749 return 0; 3750 } 3751 3752 static int nl80211_parse_beacon(struct nlattr *attrs[], 3753 struct cfg80211_beacon_data *bcn) 3754 { 3755 bool haveinfo = false; 3756 3757 if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) || 3758 !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) || 3759 !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) || 3760 !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP])) 3761 return -EINVAL; 3762 3763 memset(bcn, 0, sizeof(*bcn)); 3764 3765 if (attrs[NL80211_ATTR_BEACON_HEAD]) { 3766 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]); 3767 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]); 3768 if (!bcn->head_len) 3769 return -EINVAL; 3770 haveinfo = true; 3771 } 3772 3773 if (attrs[NL80211_ATTR_BEACON_TAIL]) { 3774 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]); 3775 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]); 3776 haveinfo = true; 3777 } 3778 3779 if (!haveinfo) 3780 return -EINVAL; 3781 3782 if (attrs[NL80211_ATTR_IE]) { 3783 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]); 3784 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]); 3785 } 3786 3787 if (attrs[NL80211_ATTR_IE_PROBE_RESP]) { 3788 bcn->proberesp_ies = 3789 nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]); 3790 bcn->proberesp_ies_len = 3791 nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]); 3792 } 3793 3794 if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) { 3795 bcn->assocresp_ies = 3796 nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]); 3797 bcn->assocresp_ies_len = 3798 nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]); 3799 } 3800 3801 if (attrs[NL80211_ATTR_PROBE_RESP]) { 3802 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]); 3803 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]); 3804 } 3805 3806 return 0; 3807 } 3808 3809 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params, 3810 const u8 *rates) 3811 { 3812 int i; 3813 3814 if (!rates) 3815 return; 3816 3817 for (i = 0; i < rates[1]; i++) { 3818 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY) 3819 params->ht_required = true; 3820 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY) 3821 params->vht_required = true; 3822 } 3823 } 3824 3825 /* 3826 * Since the nl80211 API didn't include, from the beginning, attributes about 3827 * HT/VHT requirements/capabilities, we parse them out of the IEs for the 3828 * benefit of drivers that rebuild IEs in the firmware. 3829 */ 3830 static void nl80211_calculate_ap_params(struct cfg80211_ap_settings *params) 3831 { 3832 const struct cfg80211_beacon_data *bcn = ¶ms->beacon; 3833 size_t ies_len = bcn->tail_len; 3834 const u8 *ies = bcn->tail; 3835 const u8 *rates; 3836 const u8 *cap; 3837 3838 rates = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies, ies_len); 3839 nl80211_check_ap_rate_selectors(params, rates); 3840 3841 rates = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, ies, ies_len); 3842 nl80211_check_ap_rate_selectors(params, rates); 3843 3844 cap = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies, ies_len); 3845 if (cap && cap[1] >= sizeof(*params->ht_cap)) 3846 params->ht_cap = (void *)(cap + 2); 3847 cap = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, ies, ies_len); 3848 if (cap && cap[1] >= sizeof(*params->vht_cap)) 3849 params->vht_cap = (void *)(cap + 2); 3850 } 3851 3852 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev, 3853 struct cfg80211_ap_settings *params) 3854 { 3855 struct wireless_dev *wdev; 3856 bool ret = false; 3857 3858 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { 3859 if (wdev->iftype != NL80211_IFTYPE_AP && 3860 wdev->iftype != NL80211_IFTYPE_P2P_GO) 3861 continue; 3862 3863 if (!wdev->preset_chandef.chan) 3864 continue; 3865 3866 params->chandef = wdev->preset_chandef; 3867 ret = true; 3868 break; 3869 } 3870 3871 return ret; 3872 } 3873 3874 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev, 3875 enum nl80211_auth_type auth_type, 3876 enum nl80211_commands cmd) 3877 { 3878 if (auth_type > NL80211_AUTHTYPE_MAX) 3879 return false; 3880 3881 switch (cmd) { 3882 case NL80211_CMD_AUTHENTICATE: 3883 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) && 3884 auth_type == NL80211_AUTHTYPE_SAE) 3885 return false; 3886 if (!wiphy_ext_feature_isset(&rdev->wiphy, 3887 NL80211_EXT_FEATURE_FILS_STA) && 3888 (auth_type == NL80211_AUTHTYPE_FILS_SK || 3889 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 3890 auth_type == NL80211_AUTHTYPE_FILS_PK)) 3891 return false; 3892 return true; 3893 case NL80211_CMD_CONNECT: 3894 /* SAE not supported yet */ 3895 if (auth_type == NL80211_AUTHTYPE_SAE) 3896 return false; 3897 /* FILS with SK PFS or PK not supported yet */ 3898 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 3899 auth_type == NL80211_AUTHTYPE_FILS_PK) 3900 return false; 3901 if (!wiphy_ext_feature_isset( 3902 &rdev->wiphy, 3903 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) && 3904 auth_type == NL80211_AUTHTYPE_FILS_SK) 3905 return false; 3906 return true; 3907 case NL80211_CMD_START_AP: 3908 /* SAE not supported yet */ 3909 if (auth_type == NL80211_AUTHTYPE_SAE) 3910 return false; 3911 /* FILS not supported yet */ 3912 if (auth_type == NL80211_AUTHTYPE_FILS_SK || 3913 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 3914 auth_type == NL80211_AUTHTYPE_FILS_PK) 3915 return false; 3916 return true; 3917 default: 3918 return false; 3919 } 3920 } 3921 3922 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info) 3923 { 3924 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3925 struct net_device *dev = info->user_ptr[1]; 3926 struct wireless_dev *wdev = dev->ieee80211_ptr; 3927 struct cfg80211_ap_settings params; 3928 int err; 3929 3930 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 3931 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 3932 return -EOPNOTSUPP; 3933 3934 if (!rdev->ops->start_ap) 3935 return -EOPNOTSUPP; 3936 3937 if (wdev->beacon_interval) 3938 return -EALREADY; 3939 3940 memset(¶ms, 0, sizeof(params)); 3941 3942 /* these are required for START_AP */ 3943 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] || 3944 !info->attrs[NL80211_ATTR_DTIM_PERIOD] || 3945 !info->attrs[NL80211_ATTR_BEACON_HEAD]) 3946 return -EINVAL; 3947 3948 err = nl80211_parse_beacon(info->attrs, ¶ms.beacon); 3949 if (err) 3950 return err; 3951 3952 params.beacon_interval = 3953 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]); 3954 params.dtim_period = 3955 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]); 3956 3957 err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype, 3958 params.beacon_interval); 3959 if (err) 3960 return err; 3961 3962 /* 3963 * In theory, some of these attributes should be required here 3964 * but since they were not used when the command was originally 3965 * added, keep them optional for old user space programs to let 3966 * them continue to work with drivers that do not need the 3967 * additional information -- drivers must check! 3968 */ 3969 if (info->attrs[NL80211_ATTR_SSID]) { 3970 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 3971 params.ssid_len = 3972 nla_len(info->attrs[NL80211_ATTR_SSID]); 3973 if (params.ssid_len == 0 || 3974 params.ssid_len > IEEE80211_MAX_SSID_LEN) 3975 return -EINVAL; 3976 } 3977 3978 if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) { 3979 params.hidden_ssid = nla_get_u32( 3980 info->attrs[NL80211_ATTR_HIDDEN_SSID]); 3981 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE && 3982 params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN && 3983 params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS) 3984 return -EINVAL; 3985 } 3986 3987 params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY]; 3988 3989 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) { 3990 params.auth_type = nla_get_u32( 3991 info->attrs[NL80211_ATTR_AUTH_TYPE]); 3992 if (!nl80211_valid_auth_type(rdev, params.auth_type, 3993 NL80211_CMD_START_AP)) 3994 return -EINVAL; 3995 } else 3996 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC; 3997 3998 err = nl80211_crypto_settings(rdev, info, ¶ms.crypto, 3999 NL80211_MAX_NR_CIPHER_SUITES); 4000 if (err) 4001 return err; 4002 4003 if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) { 4004 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER)) 4005 return -EOPNOTSUPP; 4006 params.inactivity_timeout = nla_get_u16( 4007 info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]); 4008 } 4009 4010 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) { 4011 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 4012 return -EINVAL; 4013 params.p2p_ctwindow = 4014 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]); 4015 if (params.p2p_ctwindow > 127) 4016 return -EINVAL; 4017 if (params.p2p_ctwindow != 0 && 4018 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) 4019 return -EINVAL; 4020 } 4021 4022 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) { 4023 u8 tmp; 4024 4025 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 4026 return -EINVAL; 4027 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]); 4028 if (tmp > 1) 4029 return -EINVAL; 4030 params.p2p_opp_ps = tmp; 4031 if (params.p2p_opp_ps != 0 && 4032 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) 4033 return -EINVAL; 4034 } 4035 4036 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 4037 err = nl80211_parse_chandef(rdev, info, ¶ms.chandef); 4038 if (err) 4039 return err; 4040 } else if (wdev->preset_chandef.chan) { 4041 params.chandef = wdev->preset_chandef; 4042 } else if (!nl80211_get_ap_channel(rdev, ¶ms)) 4043 return -EINVAL; 4044 4045 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms.chandef, 4046 wdev->iftype)) 4047 return -EINVAL; 4048 4049 if (info->attrs[NL80211_ATTR_TX_RATES]) { 4050 err = nl80211_parse_tx_bitrate_mask(info, ¶ms.beacon_rate); 4051 if (err) 4052 return err; 4053 4054 err = validate_beacon_tx_rate(rdev, params.chandef.chan->band, 4055 ¶ms.beacon_rate); 4056 if (err) 4057 return err; 4058 } 4059 4060 if (info->attrs[NL80211_ATTR_SMPS_MODE]) { 4061 params.smps_mode = 4062 nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]); 4063 switch (params.smps_mode) { 4064 case NL80211_SMPS_OFF: 4065 break; 4066 case NL80211_SMPS_STATIC: 4067 if (!(rdev->wiphy.features & 4068 NL80211_FEATURE_STATIC_SMPS)) 4069 return -EINVAL; 4070 break; 4071 case NL80211_SMPS_DYNAMIC: 4072 if (!(rdev->wiphy.features & 4073 NL80211_FEATURE_DYNAMIC_SMPS)) 4074 return -EINVAL; 4075 break; 4076 default: 4077 return -EINVAL; 4078 } 4079 } else { 4080 params.smps_mode = NL80211_SMPS_OFF; 4081 } 4082 4083 params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]); 4084 if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) 4085 return -EOPNOTSUPP; 4086 4087 if (info->attrs[NL80211_ATTR_ACL_POLICY]) { 4088 params.acl = parse_acl_data(&rdev->wiphy, info); 4089 if (IS_ERR(params.acl)) 4090 return PTR_ERR(params.acl); 4091 } 4092 4093 nl80211_calculate_ap_params(¶ms); 4094 4095 wdev_lock(wdev); 4096 err = rdev_start_ap(rdev, dev, ¶ms); 4097 if (!err) { 4098 wdev->preset_chandef = params.chandef; 4099 wdev->beacon_interval = params.beacon_interval; 4100 wdev->chandef = params.chandef; 4101 wdev->ssid_len = params.ssid_len; 4102 memcpy(wdev->ssid, params.ssid, wdev->ssid_len); 4103 } 4104 wdev_unlock(wdev); 4105 4106 kfree(params.acl); 4107 4108 return err; 4109 } 4110 4111 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info) 4112 { 4113 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4114 struct net_device *dev = info->user_ptr[1]; 4115 struct wireless_dev *wdev = dev->ieee80211_ptr; 4116 struct cfg80211_beacon_data params; 4117 int err; 4118 4119 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 4120 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 4121 return -EOPNOTSUPP; 4122 4123 if (!rdev->ops->change_beacon) 4124 return -EOPNOTSUPP; 4125 4126 if (!wdev->beacon_interval) 4127 return -EINVAL; 4128 4129 err = nl80211_parse_beacon(info->attrs, ¶ms); 4130 if (err) 4131 return err; 4132 4133 wdev_lock(wdev); 4134 err = rdev_change_beacon(rdev, dev, ¶ms); 4135 wdev_unlock(wdev); 4136 4137 return err; 4138 } 4139 4140 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info) 4141 { 4142 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4143 struct net_device *dev = info->user_ptr[1]; 4144 4145 return cfg80211_stop_ap(rdev, dev, false); 4146 } 4147 4148 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = { 4149 [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG }, 4150 [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG }, 4151 [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG }, 4152 [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG }, 4153 [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG }, 4154 [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG }, 4155 }; 4156 4157 static int parse_station_flags(struct genl_info *info, 4158 enum nl80211_iftype iftype, 4159 struct station_parameters *params) 4160 { 4161 struct nlattr *flags[NL80211_STA_FLAG_MAX + 1]; 4162 struct nlattr *nla; 4163 int flag; 4164 4165 /* 4166 * Try parsing the new attribute first so userspace 4167 * can specify both for older kernels. 4168 */ 4169 nla = info->attrs[NL80211_ATTR_STA_FLAGS2]; 4170 if (nla) { 4171 struct nl80211_sta_flag_update *sta_flags; 4172 4173 sta_flags = nla_data(nla); 4174 params->sta_flags_mask = sta_flags->mask; 4175 params->sta_flags_set = sta_flags->set; 4176 params->sta_flags_set &= params->sta_flags_mask; 4177 if ((params->sta_flags_mask | 4178 params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID)) 4179 return -EINVAL; 4180 return 0; 4181 } 4182 4183 /* if present, parse the old attribute */ 4184 4185 nla = info->attrs[NL80211_ATTR_STA_FLAGS]; 4186 if (!nla) 4187 return 0; 4188 4189 if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX, nla, 4190 sta_flags_policy, info->extack)) 4191 return -EINVAL; 4192 4193 /* 4194 * Only allow certain flags for interface types so that 4195 * other attributes are silently ignored. Remember that 4196 * this is backward compatibility code with old userspace 4197 * and shouldn't be hit in other cases anyway. 4198 */ 4199 switch (iftype) { 4200 case NL80211_IFTYPE_AP: 4201 case NL80211_IFTYPE_AP_VLAN: 4202 case NL80211_IFTYPE_P2P_GO: 4203 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) | 4204 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) | 4205 BIT(NL80211_STA_FLAG_WME) | 4206 BIT(NL80211_STA_FLAG_MFP); 4207 break; 4208 case NL80211_IFTYPE_P2P_CLIENT: 4209 case NL80211_IFTYPE_STATION: 4210 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) | 4211 BIT(NL80211_STA_FLAG_TDLS_PEER); 4212 break; 4213 case NL80211_IFTYPE_MESH_POINT: 4214 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) | 4215 BIT(NL80211_STA_FLAG_MFP) | 4216 BIT(NL80211_STA_FLAG_AUTHORIZED); 4217 default: 4218 return -EINVAL; 4219 } 4220 4221 for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) { 4222 if (flags[flag]) { 4223 params->sta_flags_set |= (1<<flag); 4224 4225 /* no longer support new API additions in old API */ 4226 if (flag > NL80211_STA_FLAG_MAX_OLD_API) 4227 return -EINVAL; 4228 } 4229 } 4230 4231 return 0; 4232 } 4233 4234 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, 4235 int attr) 4236 { 4237 struct nlattr *rate; 4238 u32 bitrate; 4239 u16 bitrate_compat; 4240 enum nl80211_rate_info rate_flg; 4241 4242 rate = nla_nest_start(msg, attr); 4243 if (!rate) 4244 return false; 4245 4246 /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */ 4247 bitrate = cfg80211_calculate_bitrate(info); 4248 /* report 16-bit bitrate only if we can */ 4249 bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0; 4250 if (bitrate > 0 && 4251 nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate)) 4252 return false; 4253 if (bitrate_compat > 0 && 4254 nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat)) 4255 return false; 4256 4257 switch (info->bw) { 4258 case RATE_INFO_BW_5: 4259 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH; 4260 break; 4261 case RATE_INFO_BW_10: 4262 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH; 4263 break; 4264 default: 4265 WARN_ON(1); 4266 /* fall through */ 4267 case RATE_INFO_BW_20: 4268 rate_flg = 0; 4269 break; 4270 case RATE_INFO_BW_40: 4271 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH; 4272 break; 4273 case RATE_INFO_BW_80: 4274 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH; 4275 break; 4276 case RATE_INFO_BW_160: 4277 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH; 4278 break; 4279 } 4280 4281 if (rate_flg && nla_put_flag(msg, rate_flg)) 4282 return false; 4283 4284 if (info->flags & RATE_INFO_FLAGS_MCS) { 4285 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs)) 4286 return false; 4287 if (info->flags & RATE_INFO_FLAGS_SHORT_GI && 4288 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI)) 4289 return false; 4290 } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) { 4291 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs)) 4292 return false; 4293 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss)) 4294 return false; 4295 if (info->flags & RATE_INFO_FLAGS_SHORT_GI && 4296 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI)) 4297 return false; 4298 } 4299 4300 nla_nest_end(msg, rate); 4301 return true; 4302 } 4303 4304 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal, 4305 int id) 4306 { 4307 void *attr; 4308 int i = 0; 4309 4310 if (!mask) 4311 return true; 4312 4313 attr = nla_nest_start(msg, id); 4314 if (!attr) 4315 return false; 4316 4317 for (i = 0; i < IEEE80211_MAX_CHAINS; i++) { 4318 if (!(mask & BIT(i))) 4319 continue; 4320 4321 if (nla_put_u8(msg, i, signal[i])) 4322 return false; 4323 } 4324 4325 nla_nest_end(msg, attr); 4326 4327 return true; 4328 } 4329 4330 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid, 4331 u32 seq, int flags, 4332 struct cfg80211_registered_device *rdev, 4333 struct net_device *dev, 4334 const u8 *mac_addr, struct station_info *sinfo) 4335 { 4336 void *hdr; 4337 struct nlattr *sinfoattr, *bss_param; 4338 4339 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 4340 if (!hdr) 4341 return -1; 4342 4343 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 4344 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) || 4345 nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation)) 4346 goto nla_put_failure; 4347 4348 sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO); 4349 if (!sinfoattr) 4350 goto nla_put_failure; 4351 4352 #define PUT_SINFO(attr, memb, type) do { \ 4353 BUILD_BUG_ON(sizeof(type) == sizeof(u64)); \ 4354 if (sinfo->filled & (1ULL << NL80211_STA_INFO_ ## attr) && \ 4355 nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr, \ 4356 sinfo->memb)) \ 4357 goto nla_put_failure; \ 4358 } while (0) 4359 #define PUT_SINFO_U64(attr, memb) do { \ 4360 if (sinfo->filled & (1ULL << NL80211_STA_INFO_ ## attr) && \ 4361 nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr, \ 4362 sinfo->memb, NL80211_STA_INFO_PAD)) \ 4363 goto nla_put_failure; \ 4364 } while (0) 4365 4366 PUT_SINFO(CONNECTED_TIME, connected_time, u32); 4367 PUT_SINFO(INACTIVE_TIME, inactive_time, u32); 4368 4369 if (sinfo->filled & (BIT(NL80211_STA_INFO_RX_BYTES) | 4370 BIT(NL80211_STA_INFO_RX_BYTES64)) && 4371 nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES, 4372 (u32)sinfo->rx_bytes)) 4373 goto nla_put_failure; 4374 4375 if (sinfo->filled & (BIT(NL80211_STA_INFO_TX_BYTES) | 4376 BIT(NL80211_STA_INFO_TX_BYTES64)) && 4377 nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES, 4378 (u32)sinfo->tx_bytes)) 4379 goto nla_put_failure; 4380 4381 PUT_SINFO_U64(RX_BYTES64, rx_bytes); 4382 PUT_SINFO_U64(TX_BYTES64, tx_bytes); 4383 PUT_SINFO(LLID, llid, u16); 4384 PUT_SINFO(PLID, plid, u16); 4385 PUT_SINFO(PLINK_STATE, plink_state, u8); 4386 PUT_SINFO_U64(RX_DURATION, rx_duration); 4387 4388 switch (rdev->wiphy.signal_type) { 4389 case CFG80211_SIGNAL_TYPE_MBM: 4390 PUT_SINFO(SIGNAL, signal, u8); 4391 PUT_SINFO(SIGNAL_AVG, signal_avg, u8); 4392 break; 4393 default: 4394 break; 4395 } 4396 if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL)) { 4397 if (!nl80211_put_signal(msg, sinfo->chains, 4398 sinfo->chain_signal, 4399 NL80211_STA_INFO_CHAIN_SIGNAL)) 4400 goto nla_put_failure; 4401 } 4402 if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) { 4403 if (!nl80211_put_signal(msg, sinfo->chains, 4404 sinfo->chain_signal_avg, 4405 NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) 4406 goto nla_put_failure; 4407 } 4408 if (sinfo->filled & BIT(NL80211_STA_INFO_TX_BITRATE)) { 4409 if (!nl80211_put_sta_rate(msg, &sinfo->txrate, 4410 NL80211_STA_INFO_TX_BITRATE)) 4411 goto nla_put_failure; 4412 } 4413 if (sinfo->filled & BIT(NL80211_STA_INFO_RX_BITRATE)) { 4414 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate, 4415 NL80211_STA_INFO_RX_BITRATE)) 4416 goto nla_put_failure; 4417 } 4418 4419 PUT_SINFO(RX_PACKETS, rx_packets, u32); 4420 PUT_SINFO(TX_PACKETS, tx_packets, u32); 4421 PUT_SINFO(TX_RETRIES, tx_retries, u32); 4422 PUT_SINFO(TX_FAILED, tx_failed, u32); 4423 PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32); 4424 PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32); 4425 PUT_SINFO(LOCAL_PM, local_pm, u32); 4426 PUT_SINFO(PEER_PM, peer_pm, u32); 4427 PUT_SINFO(NONPEER_PM, nonpeer_pm, u32); 4428 4429 if (sinfo->filled & BIT(NL80211_STA_INFO_BSS_PARAM)) { 4430 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM); 4431 if (!bss_param) 4432 goto nla_put_failure; 4433 4434 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) && 4435 nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) || 4436 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) && 4437 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) || 4438 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) && 4439 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) || 4440 nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD, 4441 sinfo->bss_param.dtim_period) || 4442 nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL, 4443 sinfo->bss_param.beacon_interval)) 4444 goto nla_put_failure; 4445 4446 nla_nest_end(msg, bss_param); 4447 } 4448 if ((sinfo->filled & BIT(NL80211_STA_INFO_STA_FLAGS)) && 4449 nla_put(msg, NL80211_STA_INFO_STA_FLAGS, 4450 sizeof(struct nl80211_sta_flag_update), 4451 &sinfo->sta_flags)) 4452 goto nla_put_failure; 4453 4454 PUT_SINFO_U64(T_OFFSET, t_offset); 4455 PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc); 4456 PUT_SINFO_U64(BEACON_RX, rx_beacon); 4457 PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8); 4458 4459 #undef PUT_SINFO 4460 #undef PUT_SINFO_U64 4461 4462 if (sinfo->filled & BIT(NL80211_STA_INFO_TID_STATS)) { 4463 struct nlattr *tidsattr; 4464 int tid; 4465 4466 tidsattr = nla_nest_start(msg, NL80211_STA_INFO_TID_STATS); 4467 if (!tidsattr) 4468 goto nla_put_failure; 4469 4470 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) { 4471 struct cfg80211_tid_stats *tidstats; 4472 struct nlattr *tidattr; 4473 4474 tidstats = &sinfo->pertid[tid]; 4475 4476 if (!tidstats->filled) 4477 continue; 4478 4479 tidattr = nla_nest_start(msg, tid + 1); 4480 if (!tidattr) 4481 goto nla_put_failure; 4482 4483 #define PUT_TIDVAL_U64(attr, memb) do { \ 4484 if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) && \ 4485 nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr, \ 4486 tidstats->memb, NL80211_TID_STATS_PAD)) \ 4487 goto nla_put_failure; \ 4488 } while (0) 4489 4490 PUT_TIDVAL_U64(RX_MSDU, rx_msdu); 4491 PUT_TIDVAL_U64(TX_MSDU, tx_msdu); 4492 PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries); 4493 PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed); 4494 4495 #undef PUT_TIDVAL_U64 4496 nla_nest_end(msg, tidattr); 4497 } 4498 4499 nla_nest_end(msg, tidsattr); 4500 } 4501 4502 nla_nest_end(msg, sinfoattr); 4503 4504 if (sinfo->assoc_req_ies_len && 4505 nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len, 4506 sinfo->assoc_req_ies)) 4507 goto nla_put_failure; 4508 4509 genlmsg_end(msg, hdr); 4510 return 0; 4511 4512 nla_put_failure: 4513 genlmsg_cancel(msg, hdr); 4514 return -EMSGSIZE; 4515 } 4516 4517 static int nl80211_dump_station(struct sk_buff *skb, 4518 struct netlink_callback *cb) 4519 { 4520 struct station_info sinfo; 4521 struct cfg80211_registered_device *rdev; 4522 struct wireless_dev *wdev; 4523 u8 mac_addr[ETH_ALEN]; 4524 int sta_idx = cb->args[2]; 4525 int err; 4526 4527 rtnl_lock(); 4528 err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev); 4529 if (err) 4530 goto out_err; 4531 4532 if (!wdev->netdev) { 4533 err = -EINVAL; 4534 goto out_err; 4535 } 4536 4537 if (!rdev->ops->dump_station) { 4538 err = -EOPNOTSUPP; 4539 goto out_err; 4540 } 4541 4542 while (1) { 4543 memset(&sinfo, 0, sizeof(sinfo)); 4544 err = rdev_dump_station(rdev, wdev->netdev, sta_idx, 4545 mac_addr, &sinfo); 4546 if (err == -ENOENT) 4547 break; 4548 if (err) 4549 goto out_err; 4550 4551 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION, 4552 NETLINK_CB(cb->skb).portid, 4553 cb->nlh->nlmsg_seq, NLM_F_MULTI, 4554 rdev, wdev->netdev, mac_addr, 4555 &sinfo) < 0) 4556 goto out; 4557 4558 sta_idx++; 4559 } 4560 4561 out: 4562 cb->args[2] = sta_idx; 4563 err = skb->len; 4564 out_err: 4565 rtnl_unlock(); 4566 4567 return err; 4568 } 4569 4570 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info) 4571 { 4572 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4573 struct net_device *dev = info->user_ptr[1]; 4574 struct station_info sinfo; 4575 struct sk_buff *msg; 4576 u8 *mac_addr = NULL; 4577 int err; 4578 4579 memset(&sinfo, 0, sizeof(sinfo)); 4580 4581 if (!info->attrs[NL80211_ATTR_MAC]) 4582 return -EINVAL; 4583 4584 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 4585 4586 if (!rdev->ops->get_station) 4587 return -EOPNOTSUPP; 4588 4589 err = rdev_get_station(rdev, dev, mac_addr, &sinfo); 4590 if (err) 4591 return err; 4592 4593 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 4594 if (!msg) 4595 return -ENOMEM; 4596 4597 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 4598 info->snd_portid, info->snd_seq, 0, 4599 rdev, dev, mac_addr, &sinfo) < 0) { 4600 nlmsg_free(msg); 4601 return -ENOBUFS; 4602 } 4603 4604 return genlmsg_reply(msg, info); 4605 } 4606 4607 int cfg80211_check_station_change(struct wiphy *wiphy, 4608 struct station_parameters *params, 4609 enum cfg80211_station_type statype) 4610 { 4611 if (params->listen_interval != -1 && 4612 statype != CFG80211_STA_AP_CLIENT_UNASSOC) 4613 return -EINVAL; 4614 4615 if (params->support_p2p_ps != -1 && 4616 statype != CFG80211_STA_AP_CLIENT_UNASSOC) 4617 return -EINVAL; 4618 4619 if (params->aid && 4620 !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) && 4621 statype != CFG80211_STA_AP_CLIENT_UNASSOC) 4622 return -EINVAL; 4623 4624 /* When you run into this, adjust the code below for the new flag */ 4625 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7); 4626 4627 switch (statype) { 4628 case CFG80211_STA_MESH_PEER_KERNEL: 4629 case CFG80211_STA_MESH_PEER_USER: 4630 /* 4631 * No ignoring the TDLS flag here -- the userspace mesh 4632 * code doesn't have the bug of including TDLS in the 4633 * mask everywhere. 4634 */ 4635 if (params->sta_flags_mask & 4636 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) | 4637 BIT(NL80211_STA_FLAG_MFP) | 4638 BIT(NL80211_STA_FLAG_AUTHORIZED))) 4639 return -EINVAL; 4640 break; 4641 case CFG80211_STA_TDLS_PEER_SETUP: 4642 case CFG80211_STA_TDLS_PEER_ACTIVE: 4643 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))) 4644 return -EINVAL; 4645 /* ignore since it can't change */ 4646 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER); 4647 break; 4648 default: 4649 /* disallow mesh-specific things */ 4650 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION) 4651 return -EINVAL; 4652 if (params->local_pm) 4653 return -EINVAL; 4654 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE) 4655 return -EINVAL; 4656 } 4657 4658 if (statype != CFG80211_STA_TDLS_PEER_SETUP && 4659 statype != CFG80211_STA_TDLS_PEER_ACTIVE) { 4660 /* TDLS can't be set, ... */ 4661 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) 4662 return -EINVAL; 4663 /* 4664 * ... but don't bother the driver with it. This works around 4665 * a hostapd/wpa_supplicant issue -- it always includes the 4666 * TLDS_PEER flag in the mask even for AP mode. 4667 */ 4668 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER); 4669 } 4670 4671 if (statype != CFG80211_STA_TDLS_PEER_SETUP && 4672 statype != CFG80211_STA_AP_CLIENT_UNASSOC) { 4673 /* reject other things that can't change */ 4674 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD) 4675 return -EINVAL; 4676 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY) 4677 return -EINVAL; 4678 if (params->supported_rates) 4679 return -EINVAL; 4680 if (params->ext_capab || params->ht_capa || params->vht_capa) 4681 return -EINVAL; 4682 } 4683 4684 if (statype != CFG80211_STA_AP_CLIENT && 4685 statype != CFG80211_STA_AP_CLIENT_UNASSOC) { 4686 if (params->vlan) 4687 return -EINVAL; 4688 } 4689 4690 switch (statype) { 4691 case CFG80211_STA_AP_MLME_CLIENT: 4692 /* Use this only for authorizing/unauthorizing a station */ 4693 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED))) 4694 return -EOPNOTSUPP; 4695 break; 4696 case CFG80211_STA_AP_CLIENT: 4697 case CFG80211_STA_AP_CLIENT_UNASSOC: 4698 /* accept only the listed bits */ 4699 if (params->sta_flags_mask & 4700 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) | 4701 BIT(NL80211_STA_FLAG_AUTHENTICATED) | 4702 BIT(NL80211_STA_FLAG_ASSOCIATED) | 4703 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) | 4704 BIT(NL80211_STA_FLAG_WME) | 4705 BIT(NL80211_STA_FLAG_MFP))) 4706 return -EINVAL; 4707 4708 /* but authenticated/associated only if driver handles it */ 4709 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) && 4710 params->sta_flags_mask & 4711 (BIT(NL80211_STA_FLAG_AUTHENTICATED) | 4712 BIT(NL80211_STA_FLAG_ASSOCIATED))) 4713 return -EINVAL; 4714 break; 4715 case CFG80211_STA_IBSS: 4716 case CFG80211_STA_AP_STA: 4717 /* reject any changes other than AUTHORIZED */ 4718 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED)) 4719 return -EINVAL; 4720 break; 4721 case CFG80211_STA_TDLS_PEER_SETUP: 4722 /* reject any changes other than AUTHORIZED or WME */ 4723 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) | 4724 BIT(NL80211_STA_FLAG_WME))) 4725 return -EINVAL; 4726 /* force (at least) rates when authorizing */ 4727 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) && 4728 !params->supported_rates) 4729 return -EINVAL; 4730 break; 4731 case CFG80211_STA_TDLS_PEER_ACTIVE: 4732 /* reject any changes */ 4733 return -EINVAL; 4734 case CFG80211_STA_MESH_PEER_KERNEL: 4735 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE) 4736 return -EINVAL; 4737 break; 4738 case CFG80211_STA_MESH_PEER_USER: 4739 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION && 4740 params->plink_action != NL80211_PLINK_ACTION_BLOCK) 4741 return -EINVAL; 4742 break; 4743 } 4744 4745 /* 4746 * Older kernel versions ignored this attribute entirely, so don't 4747 * reject attempts to update it but mark it as unused instead so the 4748 * driver won't look at the data. 4749 */ 4750 if (statype != CFG80211_STA_AP_CLIENT_UNASSOC && 4751 statype != CFG80211_STA_TDLS_PEER_SETUP) 4752 params->opmode_notif_used = false; 4753 4754 return 0; 4755 } 4756 EXPORT_SYMBOL(cfg80211_check_station_change); 4757 4758 /* 4759 * Get vlan interface making sure it is running and on the right wiphy. 4760 */ 4761 static struct net_device *get_vlan(struct genl_info *info, 4762 struct cfg80211_registered_device *rdev) 4763 { 4764 struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN]; 4765 struct net_device *v; 4766 int ret; 4767 4768 if (!vlanattr) 4769 return NULL; 4770 4771 v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr)); 4772 if (!v) 4773 return ERR_PTR(-ENODEV); 4774 4775 if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) { 4776 ret = -EINVAL; 4777 goto error; 4778 } 4779 4780 if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN && 4781 v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 4782 v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) { 4783 ret = -EINVAL; 4784 goto error; 4785 } 4786 4787 if (!netif_running(v)) { 4788 ret = -ENETDOWN; 4789 goto error; 4790 } 4791 4792 return v; 4793 error: 4794 dev_put(v); 4795 return ERR_PTR(ret); 4796 } 4797 4798 static const struct nla_policy 4799 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = { 4800 [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 }, 4801 [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 }, 4802 }; 4803 4804 static int nl80211_parse_sta_wme(struct genl_info *info, 4805 struct station_parameters *params) 4806 { 4807 struct nlattr *tb[NL80211_STA_WME_MAX + 1]; 4808 struct nlattr *nla; 4809 int err; 4810 4811 /* parse WME attributes if present */ 4812 if (!info->attrs[NL80211_ATTR_STA_WME]) 4813 return 0; 4814 4815 nla = info->attrs[NL80211_ATTR_STA_WME]; 4816 err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla, 4817 nl80211_sta_wme_policy, info->extack); 4818 if (err) 4819 return err; 4820 4821 if (tb[NL80211_STA_WME_UAPSD_QUEUES]) 4822 params->uapsd_queues = nla_get_u8( 4823 tb[NL80211_STA_WME_UAPSD_QUEUES]); 4824 if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK) 4825 return -EINVAL; 4826 4827 if (tb[NL80211_STA_WME_MAX_SP]) 4828 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]); 4829 4830 if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK) 4831 return -EINVAL; 4832 4833 params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD; 4834 4835 return 0; 4836 } 4837 4838 static int nl80211_parse_sta_channel_info(struct genl_info *info, 4839 struct station_parameters *params) 4840 { 4841 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) { 4842 params->supported_channels = 4843 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]); 4844 params->supported_channels_len = 4845 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]); 4846 /* 4847 * Need to include at least one (first channel, number of 4848 * channels) tuple for each subband, and must have proper 4849 * tuples for the rest of the data as well. 4850 */ 4851 if (params->supported_channels_len < 2) 4852 return -EINVAL; 4853 if (params->supported_channels_len % 2) 4854 return -EINVAL; 4855 } 4856 4857 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) { 4858 params->supported_oper_classes = 4859 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]); 4860 params->supported_oper_classes_len = 4861 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]); 4862 /* 4863 * The value of the Length field of the Supported Operating 4864 * Classes element is between 2 and 253. 4865 */ 4866 if (params->supported_oper_classes_len < 2 || 4867 params->supported_oper_classes_len > 253) 4868 return -EINVAL; 4869 } 4870 return 0; 4871 } 4872 4873 static int nl80211_set_station_tdls(struct genl_info *info, 4874 struct station_parameters *params) 4875 { 4876 int err; 4877 /* Dummy STA entry gets updated once the peer capabilities are known */ 4878 if (info->attrs[NL80211_ATTR_PEER_AID]) 4879 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]); 4880 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) 4881 params->ht_capa = 4882 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]); 4883 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) 4884 params->vht_capa = 4885 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]); 4886 4887 err = nl80211_parse_sta_channel_info(info, params); 4888 if (err) 4889 return err; 4890 4891 return nl80211_parse_sta_wme(info, params); 4892 } 4893 4894 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info) 4895 { 4896 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4897 struct net_device *dev = info->user_ptr[1]; 4898 struct station_parameters params; 4899 u8 *mac_addr; 4900 int err; 4901 4902 memset(¶ms, 0, sizeof(params)); 4903 4904 if (!rdev->ops->change_station) 4905 return -EOPNOTSUPP; 4906 4907 /* 4908 * AID and listen_interval properties can be set only for unassociated 4909 * station. Include these parameters here and will check them in 4910 * cfg80211_check_station_change(). 4911 */ 4912 if (info->attrs[NL80211_ATTR_STA_AID]) 4913 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]); 4914 4915 if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]) 4916 params.listen_interval = 4917 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]); 4918 else 4919 params.listen_interval = -1; 4920 4921 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) { 4922 u8 tmp; 4923 4924 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]); 4925 if (tmp >= NUM_NL80211_P2P_PS_STATUS) 4926 return -EINVAL; 4927 4928 params.support_p2p_ps = tmp; 4929 } else { 4930 params.support_p2p_ps = -1; 4931 } 4932 4933 if (!info->attrs[NL80211_ATTR_MAC]) 4934 return -EINVAL; 4935 4936 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 4937 4938 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) { 4939 params.supported_rates = 4940 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 4941 params.supported_rates_len = 4942 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 4943 } 4944 4945 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) { 4946 params.capability = 4947 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]); 4948 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY; 4949 } 4950 4951 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) { 4952 params.ext_capab = 4953 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 4954 params.ext_capab_len = 4955 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 4956 } 4957 4958 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms)) 4959 return -EINVAL; 4960 4961 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) { 4962 params.plink_action = 4963 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]); 4964 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS) 4965 return -EINVAL; 4966 } 4967 4968 if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) { 4969 params.plink_state = 4970 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]); 4971 if (params.plink_state >= NUM_NL80211_PLINK_STATES) 4972 return -EINVAL; 4973 if (info->attrs[NL80211_ATTR_MESH_PEER_AID]) { 4974 params.peer_aid = nla_get_u16( 4975 info->attrs[NL80211_ATTR_MESH_PEER_AID]); 4976 if (params.peer_aid > IEEE80211_MAX_AID) 4977 return -EINVAL; 4978 } 4979 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE; 4980 } 4981 4982 if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) { 4983 enum nl80211_mesh_power_mode pm = nla_get_u32( 4984 info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]); 4985 4986 if (pm <= NL80211_MESH_POWER_UNKNOWN || 4987 pm > NL80211_MESH_POWER_MAX) 4988 return -EINVAL; 4989 4990 params.local_pm = pm; 4991 } 4992 4993 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) { 4994 params.opmode_notif_used = true; 4995 params.opmode_notif = 4996 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]); 4997 } 4998 4999 /* Include parameters for TDLS peer (will check later) */ 5000 err = nl80211_set_station_tdls(info, ¶ms); 5001 if (err) 5002 return err; 5003 5004 params.vlan = get_vlan(info, rdev); 5005 if (IS_ERR(params.vlan)) 5006 return PTR_ERR(params.vlan); 5007 5008 switch (dev->ieee80211_ptr->iftype) { 5009 case NL80211_IFTYPE_AP: 5010 case NL80211_IFTYPE_AP_VLAN: 5011 case NL80211_IFTYPE_P2P_GO: 5012 case NL80211_IFTYPE_P2P_CLIENT: 5013 case NL80211_IFTYPE_STATION: 5014 case NL80211_IFTYPE_ADHOC: 5015 case NL80211_IFTYPE_MESH_POINT: 5016 break; 5017 default: 5018 err = -EOPNOTSUPP; 5019 goto out_put_vlan; 5020 } 5021 5022 /* driver will call cfg80211_check_station_change() */ 5023 err = rdev_change_station(rdev, dev, mac_addr, ¶ms); 5024 5025 out_put_vlan: 5026 if (params.vlan) 5027 dev_put(params.vlan); 5028 5029 return err; 5030 } 5031 5032 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info) 5033 { 5034 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5035 int err; 5036 struct net_device *dev = info->user_ptr[1]; 5037 struct station_parameters params; 5038 u8 *mac_addr = NULL; 5039 u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) | 5040 BIT(NL80211_STA_FLAG_ASSOCIATED); 5041 5042 memset(¶ms, 0, sizeof(params)); 5043 5044 if (!rdev->ops->add_station) 5045 return -EOPNOTSUPP; 5046 5047 if (!info->attrs[NL80211_ATTR_MAC]) 5048 return -EINVAL; 5049 5050 if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]) 5051 return -EINVAL; 5052 5053 if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) 5054 return -EINVAL; 5055 5056 if (!info->attrs[NL80211_ATTR_STA_AID] && 5057 !info->attrs[NL80211_ATTR_PEER_AID]) 5058 return -EINVAL; 5059 5060 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 5061 params.supported_rates = 5062 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 5063 params.supported_rates_len = 5064 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 5065 params.listen_interval = 5066 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]); 5067 5068 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) { 5069 u8 tmp; 5070 5071 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]); 5072 if (tmp >= NUM_NL80211_P2P_PS_STATUS) 5073 return -EINVAL; 5074 5075 params.support_p2p_ps = tmp; 5076 } else { 5077 /* 5078 * if not specified, assume it's supported for P2P GO interface, 5079 * and is NOT supported for AP interface 5080 */ 5081 params.support_p2p_ps = 5082 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO; 5083 } 5084 5085 if (info->attrs[NL80211_ATTR_PEER_AID]) 5086 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]); 5087 else 5088 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]); 5089 if (!params.aid || params.aid > IEEE80211_MAX_AID) 5090 return -EINVAL; 5091 5092 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) { 5093 params.capability = 5094 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]); 5095 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY; 5096 } 5097 5098 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) { 5099 params.ext_capab = 5100 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 5101 params.ext_capab_len = 5102 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 5103 } 5104 5105 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) 5106 params.ht_capa = 5107 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]); 5108 5109 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) 5110 params.vht_capa = 5111 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]); 5112 5113 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) { 5114 params.opmode_notif_used = true; 5115 params.opmode_notif = 5116 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]); 5117 } 5118 5119 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) { 5120 params.plink_action = 5121 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]); 5122 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS) 5123 return -EINVAL; 5124 } 5125 5126 err = nl80211_parse_sta_channel_info(info, ¶ms); 5127 if (err) 5128 return err; 5129 5130 err = nl80211_parse_sta_wme(info, ¶ms); 5131 if (err) 5132 return err; 5133 5134 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms)) 5135 return -EINVAL; 5136 5137 /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT 5138 * as userspace might just pass through the capabilities from the IEs 5139 * directly, rather than enforcing this restriction and returning an 5140 * error in this case. 5141 */ 5142 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) { 5143 params.ht_capa = NULL; 5144 params.vht_capa = NULL; 5145 } 5146 5147 /* When you run into this, adjust the code below for the new flag */ 5148 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7); 5149 5150 switch (dev->ieee80211_ptr->iftype) { 5151 case NL80211_IFTYPE_AP: 5152 case NL80211_IFTYPE_AP_VLAN: 5153 case NL80211_IFTYPE_P2P_GO: 5154 /* ignore WME attributes if iface/sta is not capable */ 5155 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) || 5156 !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) 5157 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD; 5158 5159 /* TDLS peers cannot be added */ 5160 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) || 5161 info->attrs[NL80211_ATTR_PEER_AID]) 5162 return -EINVAL; 5163 /* but don't bother the driver with it */ 5164 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER); 5165 5166 /* allow authenticated/associated only if driver handles it */ 5167 if (!(rdev->wiphy.features & 5168 NL80211_FEATURE_FULL_AP_CLIENT_STATE) && 5169 params.sta_flags_mask & auth_assoc) 5170 return -EINVAL; 5171 5172 /* Older userspace, or userspace wanting to be compatible with 5173 * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth 5174 * and assoc flags in the mask, but assumes the station will be 5175 * added as associated anyway since this was the required driver 5176 * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was 5177 * introduced. 5178 * In order to not bother drivers with this quirk in the API 5179 * set the flags in both the mask and set for new stations in 5180 * this case. 5181 */ 5182 if (!(params.sta_flags_mask & auth_assoc)) { 5183 params.sta_flags_mask |= auth_assoc; 5184 params.sta_flags_set |= auth_assoc; 5185 } 5186 5187 /* must be last in here for error handling */ 5188 params.vlan = get_vlan(info, rdev); 5189 if (IS_ERR(params.vlan)) 5190 return PTR_ERR(params.vlan); 5191 break; 5192 case NL80211_IFTYPE_MESH_POINT: 5193 /* ignore uAPSD data */ 5194 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD; 5195 5196 /* associated is disallowed */ 5197 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED)) 5198 return -EINVAL; 5199 /* TDLS peers cannot be added */ 5200 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) || 5201 info->attrs[NL80211_ATTR_PEER_AID]) 5202 return -EINVAL; 5203 break; 5204 case NL80211_IFTYPE_STATION: 5205 case NL80211_IFTYPE_P2P_CLIENT: 5206 /* ignore uAPSD data */ 5207 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD; 5208 5209 /* these are disallowed */ 5210 if (params.sta_flags_mask & 5211 (BIT(NL80211_STA_FLAG_ASSOCIATED) | 5212 BIT(NL80211_STA_FLAG_AUTHENTICATED))) 5213 return -EINVAL; 5214 /* Only TDLS peers can be added */ 5215 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))) 5216 return -EINVAL; 5217 /* Can only add if TDLS ... */ 5218 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS)) 5219 return -EOPNOTSUPP; 5220 /* ... with external setup is supported */ 5221 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP)) 5222 return -EOPNOTSUPP; 5223 /* 5224 * Older wpa_supplicant versions always mark the TDLS peer 5225 * as authorized, but it shouldn't yet be. 5226 */ 5227 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED); 5228 break; 5229 default: 5230 return -EOPNOTSUPP; 5231 } 5232 5233 /* be aware of params.vlan when changing code here */ 5234 5235 err = rdev_add_station(rdev, dev, mac_addr, ¶ms); 5236 5237 if (params.vlan) 5238 dev_put(params.vlan); 5239 return err; 5240 } 5241 5242 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info) 5243 { 5244 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5245 struct net_device *dev = info->user_ptr[1]; 5246 struct station_del_parameters params; 5247 5248 memset(¶ms, 0, sizeof(params)); 5249 5250 if (info->attrs[NL80211_ATTR_MAC]) 5251 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]); 5252 5253 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 5254 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN && 5255 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT && 5256 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 5257 return -EINVAL; 5258 5259 if (!rdev->ops->del_station) 5260 return -EOPNOTSUPP; 5261 5262 if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) { 5263 params.subtype = 5264 nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]); 5265 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 && 5266 params.subtype != IEEE80211_STYPE_DEAUTH >> 4) 5267 return -EINVAL; 5268 } else { 5269 /* Default to Deauthentication frame */ 5270 params.subtype = IEEE80211_STYPE_DEAUTH >> 4; 5271 } 5272 5273 if (info->attrs[NL80211_ATTR_REASON_CODE]) { 5274 params.reason_code = 5275 nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 5276 if (params.reason_code == 0) 5277 return -EINVAL; /* 0 is reserved */ 5278 } else { 5279 /* Default to reason code 2 */ 5280 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID; 5281 } 5282 5283 return rdev_del_station(rdev, dev, ¶ms); 5284 } 5285 5286 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq, 5287 int flags, struct net_device *dev, 5288 u8 *dst, u8 *next_hop, 5289 struct mpath_info *pinfo) 5290 { 5291 void *hdr; 5292 struct nlattr *pinfoattr; 5293 5294 hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH); 5295 if (!hdr) 5296 return -1; 5297 5298 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 5299 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) || 5300 nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) || 5301 nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation)) 5302 goto nla_put_failure; 5303 5304 pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO); 5305 if (!pinfoattr) 5306 goto nla_put_failure; 5307 if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) && 5308 nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN, 5309 pinfo->frame_qlen)) 5310 goto nla_put_failure; 5311 if (((pinfo->filled & MPATH_INFO_SN) && 5312 nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) || 5313 ((pinfo->filled & MPATH_INFO_METRIC) && 5314 nla_put_u32(msg, NL80211_MPATH_INFO_METRIC, 5315 pinfo->metric)) || 5316 ((pinfo->filled & MPATH_INFO_EXPTIME) && 5317 nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME, 5318 pinfo->exptime)) || 5319 ((pinfo->filled & MPATH_INFO_FLAGS) && 5320 nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS, 5321 pinfo->flags)) || 5322 ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) && 5323 nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT, 5324 pinfo->discovery_timeout)) || 5325 ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) && 5326 nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES, 5327 pinfo->discovery_retries))) 5328 goto nla_put_failure; 5329 5330 nla_nest_end(msg, pinfoattr); 5331 5332 genlmsg_end(msg, hdr); 5333 return 0; 5334 5335 nla_put_failure: 5336 genlmsg_cancel(msg, hdr); 5337 return -EMSGSIZE; 5338 } 5339 5340 static int nl80211_dump_mpath(struct sk_buff *skb, 5341 struct netlink_callback *cb) 5342 { 5343 struct mpath_info pinfo; 5344 struct cfg80211_registered_device *rdev; 5345 struct wireless_dev *wdev; 5346 u8 dst[ETH_ALEN]; 5347 u8 next_hop[ETH_ALEN]; 5348 int path_idx = cb->args[2]; 5349 int err; 5350 5351 rtnl_lock(); 5352 err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev); 5353 if (err) 5354 goto out_err; 5355 5356 if (!rdev->ops->dump_mpath) { 5357 err = -EOPNOTSUPP; 5358 goto out_err; 5359 } 5360 5361 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) { 5362 err = -EOPNOTSUPP; 5363 goto out_err; 5364 } 5365 5366 while (1) { 5367 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst, 5368 next_hop, &pinfo); 5369 if (err == -ENOENT) 5370 break; 5371 if (err) 5372 goto out_err; 5373 5374 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid, 5375 cb->nlh->nlmsg_seq, NLM_F_MULTI, 5376 wdev->netdev, dst, next_hop, 5377 &pinfo) < 0) 5378 goto out; 5379 5380 path_idx++; 5381 } 5382 5383 out: 5384 cb->args[2] = path_idx; 5385 err = skb->len; 5386 out_err: 5387 rtnl_unlock(); 5388 return err; 5389 } 5390 5391 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info) 5392 { 5393 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5394 int err; 5395 struct net_device *dev = info->user_ptr[1]; 5396 struct mpath_info pinfo; 5397 struct sk_buff *msg; 5398 u8 *dst = NULL; 5399 u8 next_hop[ETH_ALEN]; 5400 5401 memset(&pinfo, 0, sizeof(pinfo)); 5402 5403 if (!info->attrs[NL80211_ATTR_MAC]) 5404 return -EINVAL; 5405 5406 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 5407 5408 if (!rdev->ops->get_mpath) 5409 return -EOPNOTSUPP; 5410 5411 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 5412 return -EOPNOTSUPP; 5413 5414 err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo); 5415 if (err) 5416 return err; 5417 5418 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 5419 if (!msg) 5420 return -ENOMEM; 5421 5422 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0, 5423 dev, dst, next_hop, &pinfo) < 0) { 5424 nlmsg_free(msg); 5425 return -ENOBUFS; 5426 } 5427 5428 return genlmsg_reply(msg, info); 5429 } 5430 5431 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info) 5432 { 5433 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5434 struct net_device *dev = info->user_ptr[1]; 5435 u8 *dst = NULL; 5436 u8 *next_hop = NULL; 5437 5438 if (!info->attrs[NL80211_ATTR_MAC]) 5439 return -EINVAL; 5440 5441 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]) 5442 return -EINVAL; 5443 5444 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 5445 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]); 5446 5447 if (!rdev->ops->change_mpath) 5448 return -EOPNOTSUPP; 5449 5450 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 5451 return -EOPNOTSUPP; 5452 5453 return rdev_change_mpath(rdev, dev, dst, next_hop); 5454 } 5455 5456 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info) 5457 { 5458 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5459 struct net_device *dev = info->user_ptr[1]; 5460 u8 *dst = NULL; 5461 u8 *next_hop = NULL; 5462 5463 if (!info->attrs[NL80211_ATTR_MAC]) 5464 return -EINVAL; 5465 5466 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]) 5467 return -EINVAL; 5468 5469 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 5470 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]); 5471 5472 if (!rdev->ops->add_mpath) 5473 return -EOPNOTSUPP; 5474 5475 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 5476 return -EOPNOTSUPP; 5477 5478 return rdev_add_mpath(rdev, dev, dst, next_hop); 5479 } 5480 5481 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info) 5482 { 5483 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5484 struct net_device *dev = info->user_ptr[1]; 5485 u8 *dst = NULL; 5486 5487 if (info->attrs[NL80211_ATTR_MAC]) 5488 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 5489 5490 if (!rdev->ops->del_mpath) 5491 return -EOPNOTSUPP; 5492 5493 return rdev_del_mpath(rdev, dev, dst); 5494 } 5495 5496 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info) 5497 { 5498 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5499 int err; 5500 struct net_device *dev = info->user_ptr[1]; 5501 struct mpath_info pinfo; 5502 struct sk_buff *msg; 5503 u8 *dst = NULL; 5504 u8 mpp[ETH_ALEN]; 5505 5506 memset(&pinfo, 0, sizeof(pinfo)); 5507 5508 if (!info->attrs[NL80211_ATTR_MAC]) 5509 return -EINVAL; 5510 5511 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 5512 5513 if (!rdev->ops->get_mpp) 5514 return -EOPNOTSUPP; 5515 5516 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 5517 return -EOPNOTSUPP; 5518 5519 err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo); 5520 if (err) 5521 return err; 5522 5523 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 5524 if (!msg) 5525 return -ENOMEM; 5526 5527 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0, 5528 dev, dst, mpp, &pinfo) < 0) { 5529 nlmsg_free(msg); 5530 return -ENOBUFS; 5531 } 5532 5533 return genlmsg_reply(msg, info); 5534 } 5535 5536 static int nl80211_dump_mpp(struct sk_buff *skb, 5537 struct netlink_callback *cb) 5538 { 5539 struct mpath_info pinfo; 5540 struct cfg80211_registered_device *rdev; 5541 struct wireless_dev *wdev; 5542 u8 dst[ETH_ALEN]; 5543 u8 mpp[ETH_ALEN]; 5544 int path_idx = cb->args[2]; 5545 int err; 5546 5547 rtnl_lock(); 5548 err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev); 5549 if (err) 5550 goto out_err; 5551 5552 if (!rdev->ops->dump_mpp) { 5553 err = -EOPNOTSUPP; 5554 goto out_err; 5555 } 5556 5557 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) { 5558 err = -EOPNOTSUPP; 5559 goto out_err; 5560 } 5561 5562 while (1) { 5563 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst, 5564 mpp, &pinfo); 5565 if (err == -ENOENT) 5566 break; 5567 if (err) 5568 goto out_err; 5569 5570 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid, 5571 cb->nlh->nlmsg_seq, NLM_F_MULTI, 5572 wdev->netdev, dst, mpp, 5573 &pinfo) < 0) 5574 goto out; 5575 5576 path_idx++; 5577 } 5578 5579 out: 5580 cb->args[2] = path_idx; 5581 err = skb->len; 5582 out_err: 5583 rtnl_unlock(); 5584 return err; 5585 } 5586 5587 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info) 5588 { 5589 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5590 struct net_device *dev = info->user_ptr[1]; 5591 struct wireless_dev *wdev = dev->ieee80211_ptr; 5592 struct bss_parameters params; 5593 int err; 5594 5595 memset(¶ms, 0, sizeof(params)); 5596 /* default to not changing parameters */ 5597 params.use_cts_prot = -1; 5598 params.use_short_preamble = -1; 5599 params.use_short_slot_time = -1; 5600 params.ap_isolate = -1; 5601 params.ht_opmode = -1; 5602 params.p2p_ctwindow = -1; 5603 params.p2p_opp_ps = -1; 5604 5605 if (info->attrs[NL80211_ATTR_BSS_CTS_PROT]) 5606 params.use_cts_prot = 5607 nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]); 5608 if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]) 5609 params.use_short_preamble = 5610 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]); 5611 if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]) 5612 params.use_short_slot_time = 5613 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]); 5614 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) { 5615 params.basic_rates = 5616 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 5617 params.basic_rates_len = 5618 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 5619 } 5620 if (info->attrs[NL80211_ATTR_AP_ISOLATE]) 5621 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]); 5622 if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE]) 5623 params.ht_opmode = 5624 nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]); 5625 5626 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) { 5627 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 5628 return -EINVAL; 5629 params.p2p_ctwindow = 5630 nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]); 5631 if (params.p2p_ctwindow < 0) 5632 return -EINVAL; 5633 if (params.p2p_ctwindow != 0 && 5634 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) 5635 return -EINVAL; 5636 } 5637 5638 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) { 5639 u8 tmp; 5640 5641 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 5642 return -EINVAL; 5643 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]); 5644 if (tmp > 1) 5645 return -EINVAL; 5646 params.p2p_opp_ps = tmp; 5647 if (params.p2p_opp_ps && 5648 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) 5649 return -EINVAL; 5650 } 5651 5652 if (!rdev->ops->change_bss) 5653 return -EOPNOTSUPP; 5654 5655 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 5656 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 5657 return -EOPNOTSUPP; 5658 5659 wdev_lock(wdev); 5660 err = rdev_change_bss(rdev, dev, ¶ms); 5661 wdev_unlock(wdev); 5662 5663 return err; 5664 } 5665 5666 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info) 5667 { 5668 char *data = NULL; 5669 bool is_indoor; 5670 enum nl80211_user_reg_hint_type user_reg_hint_type; 5671 u32 owner_nlportid; 5672 5673 /* 5674 * You should only get this when cfg80211 hasn't yet initialized 5675 * completely when built-in to the kernel right between the time 5676 * window between nl80211_init() and regulatory_init(), if that is 5677 * even possible. 5678 */ 5679 if (unlikely(!rcu_access_pointer(cfg80211_regdomain))) 5680 return -EINPROGRESS; 5681 5682 if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]) 5683 user_reg_hint_type = 5684 nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]); 5685 else 5686 user_reg_hint_type = NL80211_USER_REG_HINT_USER; 5687 5688 switch (user_reg_hint_type) { 5689 case NL80211_USER_REG_HINT_USER: 5690 case NL80211_USER_REG_HINT_CELL_BASE: 5691 if (!info->attrs[NL80211_ATTR_REG_ALPHA2]) 5692 return -EINVAL; 5693 5694 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]); 5695 return regulatory_hint_user(data, user_reg_hint_type); 5696 case NL80211_USER_REG_HINT_INDOOR: 5697 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 5698 owner_nlportid = info->snd_portid; 5699 is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR]; 5700 } else { 5701 owner_nlportid = 0; 5702 is_indoor = true; 5703 } 5704 5705 return regulatory_hint_indoor(is_indoor, owner_nlportid); 5706 default: 5707 return -EINVAL; 5708 } 5709 } 5710 5711 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info) 5712 { 5713 return reg_reload_regdb(); 5714 } 5715 5716 static int nl80211_get_mesh_config(struct sk_buff *skb, 5717 struct genl_info *info) 5718 { 5719 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5720 struct net_device *dev = info->user_ptr[1]; 5721 struct wireless_dev *wdev = dev->ieee80211_ptr; 5722 struct mesh_config cur_params; 5723 int err = 0; 5724 void *hdr; 5725 struct nlattr *pinfoattr; 5726 struct sk_buff *msg; 5727 5728 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) 5729 return -EOPNOTSUPP; 5730 5731 if (!rdev->ops->get_mesh_config) 5732 return -EOPNOTSUPP; 5733 5734 wdev_lock(wdev); 5735 /* If not connected, get default parameters */ 5736 if (!wdev->mesh_id_len) 5737 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params)); 5738 else 5739 err = rdev_get_mesh_config(rdev, dev, &cur_params); 5740 wdev_unlock(wdev); 5741 5742 if (err) 5743 return err; 5744 5745 /* Draw up a netlink message to send back */ 5746 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 5747 if (!msg) 5748 return -ENOMEM; 5749 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 5750 NL80211_CMD_GET_MESH_CONFIG); 5751 if (!hdr) 5752 goto out; 5753 pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG); 5754 if (!pinfoattr) 5755 goto nla_put_failure; 5756 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 5757 nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT, 5758 cur_params.dot11MeshRetryTimeout) || 5759 nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT, 5760 cur_params.dot11MeshConfirmTimeout) || 5761 nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT, 5762 cur_params.dot11MeshHoldingTimeout) || 5763 nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS, 5764 cur_params.dot11MeshMaxPeerLinks) || 5765 nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES, 5766 cur_params.dot11MeshMaxRetries) || 5767 nla_put_u8(msg, NL80211_MESHCONF_TTL, 5768 cur_params.dot11MeshTTL) || 5769 nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL, 5770 cur_params.element_ttl) || 5771 nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS, 5772 cur_params.auto_open_plinks) || 5773 nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR, 5774 cur_params.dot11MeshNbrOffsetMaxNeighbor) || 5775 nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES, 5776 cur_params.dot11MeshHWMPmaxPREQretries) || 5777 nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME, 5778 cur_params.path_refresh_time) || 5779 nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT, 5780 cur_params.min_discovery_timeout) || 5781 nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT, 5782 cur_params.dot11MeshHWMPactivePathTimeout) || 5783 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL, 5784 cur_params.dot11MeshHWMPpreqMinInterval) || 5785 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL, 5786 cur_params.dot11MeshHWMPperrMinInterval) || 5787 nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME, 5788 cur_params.dot11MeshHWMPnetDiameterTraversalTime) || 5789 nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE, 5790 cur_params.dot11MeshHWMPRootMode) || 5791 nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL, 5792 cur_params.dot11MeshHWMPRannInterval) || 5793 nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS, 5794 cur_params.dot11MeshGateAnnouncementProtocol) || 5795 nla_put_u8(msg, NL80211_MESHCONF_FORWARDING, 5796 cur_params.dot11MeshForwarding) || 5797 nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD, 5798 cur_params.rssi_threshold) || 5799 nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE, 5800 cur_params.ht_opmode) || 5801 nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT, 5802 cur_params.dot11MeshHWMPactivePathToRootTimeout) || 5803 nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL, 5804 cur_params.dot11MeshHWMProotInterval) || 5805 nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL, 5806 cur_params.dot11MeshHWMPconfirmationInterval) || 5807 nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE, 5808 cur_params.power_mode) || 5809 nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW, 5810 cur_params.dot11MeshAwakeWindowDuration) || 5811 nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT, 5812 cur_params.plink_timeout)) 5813 goto nla_put_failure; 5814 nla_nest_end(msg, pinfoattr); 5815 genlmsg_end(msg, hdr); 5816 return genlmsg_reply(msg, info); 5817 5818 nla_put_failure: 5819 genlmsg_cancel(msg, hdr); 5820 out: 5821 nlmsg_free(msg); 5822 return -ENOBUFS; 5823 } 5824 5825 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = { 5826 [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 }, 5827 [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 }, 5828 [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 }, 5829 [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 }, 5830 [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 }, 5831 [NL80211_MESHCONF_TTL] = { .type = NLA_U8 }, 5832 [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 }, 5833 [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 }, 5834 [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 }, 5835 [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 }, 5836 [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 }, 5837 [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 }, 5838 [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 }, 5839 [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 }, 5840 [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 }, 5841 [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 }, 5842 [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 }, 5843 [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 }, 5844 [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 }, 5845 [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 }, 5846 [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 }, 5847 [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 }, 5848 [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 }, 5849 [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 }, 5850 [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 }, 5851 [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 }, 5852 [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 }, 5853 [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 }, 5854 }; 5855 5856 static const struct nla_policy 5857 nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = { 5858 [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 }, 5859 [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 }, 5860 [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 }, 5861 [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG }, 5862 [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 }, 5863 [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG }, 5864 [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY, 5865 .len = IEEE80211_MAX_DATA_LEN }, 5866 [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG }, 5867 }; 5868 5869 static int nl80211_check_bool(const struct nlattr *nla, u8 min, u8 max, bool *out) 5870 { 5871 u8 val = nla_get_u8(nla); 5872 if (val < min || val > max) 5873 return -EINVAL; 5874 *out = val; 5875 return 0; 5876 } 5877 5878 static int nl80211_check_u8(const struct nlattr *nla, u8 min, u8 max, u8 *out) 5879 { 5880 u8 val = nla_get_u8(nla); 5881 if (val < min || val > max) 5882 return -EINVAL; 5883 *out = val; 5884 return 0; 5885 } 5886 5887 static int nl80211_check_u16(const struct nlattr *nla, u16 min, u16 max, u16 *out) 5888 { 5889 u16 val = nla_get_u16(nla); 5890 if (val < min || val > max) 5891 return -EINVAL; 5892 *out = val; 5893 return 0; 5894 } 5895 5896 static int nl80211_check_u32(const struct nlattr *nla, u32 min, u32 max, u32 *out) 5897 { 5898 u32 val = nla_get_u32(nla); 5899 if (val < min || val > max) 5900 return -EINVAL; 5901 *out = val; 5902 return 0; 5903 } 5904 5905 static int nl80211_check_s32(const struct nlattr *nla, s32 min, s32 max, s32 *out) 5906 { 5907 s32 val = nla_get_s32(nla); 5908 if (val < min || val > max) 5909 return -EINVAL; 5910 *out = val; 5911 return 0; 5912 } 5913 5914 static int nl80211_check_power_mode(const struct nlattr *nla, 5915 enum nl80211_mesh_power_mode min, 5916 enum nl80211_mesh_power_mode max, 5917 enum nl80211_mesh_power_mode *out) 5918 { 5919 u32 val = nla_get_u32(nla); 5920 if (val < min || val > max) 5921 return -EINVAL; 5922 *out = val; 5923 return 0; 5924 } 5925 5926 static int nl80211_parse_mesh_config(struct genl_info *info, 5927 struct mesh_config *cfg, 5928 u32 *mask_out) 5929 { 5930 struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1]; 5931 u32 mask = 0; 5932 u16 ht_opmode; 5933 5934 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \ 5935 do { \ 5936 if (tb[attr]) { \ 5937 if (fn(tb[attr], min, max, &cfg->param)) \ 5938 return -EINVAL; \ 5939 mask |= (1 << (attr - 1)); \ 5940 } \ 5941 } while (0) 5942 5943 if (!info->attrs[NL80211_ATTR_MESH_CONFIG]) 5944 return -EINVAL; 5945 if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX, 5946 info->attrs[NL80211_ATTR_MESH_CONFIG], 5947 nl80211_meshconf_params_policy, info->extack)) 5948 return -EINVAL; 5949 5950 /* This makes sure that there aren't more than 32 mesh config 5951 * parameters (otherwise our bitfield scheme would not work.) */ 5952 BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32); 5953 5954 /* Fill in the params struct */ 5955 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255, 5956 mask, NL80211_MESHCONF_RETRY_TIMEOUT, 5957 nl80211_check_u16); 5958 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255, 5959 mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, 5960 nl80211_check_u16); 5961 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255, 5962 mask, NL80211_MESHCONF_HOLDING_TIMEOUT, 5963 nl80211_check_u16); 5964 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255, 5965 mask, NL80211_MESHCONF_MAX_PEER_LINKS, 5966 nl80211_check_u16); 5967 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16, 5968 mask, NL80211_MESHCONF_MAX_RETRIES, 5969 nl80211_check_u8); 5970 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255, 5971 mask, NL80211_MESHCONF_TTL, nl80211_check_u8); 5972 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255, 5973 mask, NL80211_MESHCONF_ELEMENT_TTL, 5974 nl80211_check_u8); 5975 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1, 5976 mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, 5977 nl80211_check_bool); 5978 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor, 5979 1, 255, mask, 5980 NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR, 5981 nl80211_check_u32); 5982 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255, 5983 mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES, 5984 nl80211_check_u8); 5985 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535, 5986 mask, NL80211_MESHCONF_PATH_REFRESH_TIME, 5987 nl80211_check_u32); 5988 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535, 5989 mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT, 5990 nl80211_check_u16); 5991 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout, 5992 1, 65535, mask, 5993 NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT, 5994 nl80211_check_u32); 5995 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, 5996 1, 65535, mask, 5997 NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL, 5998 nl80211_check_u16); 5999 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, 6000 1, 65535, mask, 6001 NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL, 6002 nl80211_check_u16); 6003 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, 6004 dot11MeshHWMPnetDiameterTraversalTime, 6005 1, 65535, mask, 6006 NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME, 6007 nl80211_check_u16); 6008 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4, 6009 mask, NL80211_MESHCONF_HWMP_ROOTMODE, 6010 nl80211_check_u8); 6011 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535, 6012 mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL, 6013 nl80211_check_u16); 6014 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, 6015 dot11MeshGateAnnouncementProtocol, 0, 1, 6016 mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS, 6017 nl80211_check_bool); 6018 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1, 6019 mask, NL80211_MESHCONF_FORWARDING, 6020 nl80211_check_bool); 6021 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0, 6022 mask, NL80211_MESHCONF_RSSI_THRESHOLD, 6023 nl80211_check_s32); 6024 /* 6025 * Check HT operation mode based on 6026 * IEEE 802.11 2012 8.4.2.59 HT Operation element. 6027 */ 6028 if (tb[NL80211_MESHCONF_HT_OPMODE]) { 6029 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]); 6030 6031 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION | 6032 IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT | 6033 IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)) 6034 return -EINVAL; 6035 6036 if ((ht_opmode & IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT) && 6037 (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)) 6038 return -EINVAL; 6039 6040 switch (ht_opmode & IEEE80211_HT_OP_MODE_PROTECTION) { 6041 case IEEE80211_HT_OP_MODE_PROTECTION_NONE: 6042 case IEEE80211_HT_OP_MODE_PROTECTION_20MHZ: 6043 if (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT) 6044 return -EINVAL; 6045 break; 6046 case IEEE80211_HT_OP_MODE_PROTECTION_NONMEMBER: 6047 case IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED: 6048 if (!(ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)) 6049 return -EINVAL; 6050 break; 6051 } 6052 cfg->ht_opmode = ht_opmode; 6053 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1)); 6054 } 6055 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout, 6056 1, 65535, mask, 6057 NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT, 6058 nl80211_check_u32); 6059 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535, 6060 mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL, 6061 nl80211_check_u16); 6062 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, 6063 dot11MeshHWMPconfirmationInterval, 6064 1, 65535, mask, 6065 NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL, 6066 nl80211_check_u16); 6067 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, 6068 NL80211_MESH_POWER_ACTIVE, 6069 NL80211_MESH_POWER_MAX, 6070 mask, NL80211_MESHCONF_POWER_MODE, 6071 nl80211_check_power_mode); 6072 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, 6073 0, 65535, mask, 6074 NL80211_MESHCONF_AWAKE_WINDOW, nl80211_check_u16); 6075 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 0, 0xffffffff, 6076 mask, NL80211_MESHCONF_PLINK_TIMEOUT, 6077 nl80211_check_u32); 6078 if (mask_out) 6079 *mask_out = mask; 6080 6081 return 0; 6082 6083 #undef FILL_IN_MESH_PARAM_IF_SET 6084 } 6085 6086 static int nl80211_parse_mesh_setup(struct genl_info *info, 6087 struct mesh_setup *setup) 6088 { 6089 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6090 struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1]; 6091 6092 if (!info->attrs[NL80211_ATTR_MESH_SETUP]) 6093 return -EINVAL; 6094 if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX, 6095 info->attrs[NL80211_ATTR_MESH_SETUP], 6096 nl80211_mesh_setup_params_policy, info->extack)) 6097 return -EINVAL; 6098 6099 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC]) 6100 setup->sync_method = 6101 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ? 6102 IEEE80211_SYNC_METHOD_VENDOR : 6103 IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET; 6104 6105 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL]) 6106 setup->path_sel_proto = 6107 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ? 6108 IEEE80211_PATH_PROTOCOL_VENDOR : 6109 IEEE80211_PATH_PROTOCOL_HWMP; 6110 6111 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC]) 6112 setup->path_metric = 6113 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ? 6114 IEEE80211_PATH_METRIC_VENDOR : 6115 IEEE80211_PATH_METRIC_AIRTIME; 6116 6117 if (tb[NL80211_MESH_SETUP_IE]) { 6118 struct nlattr *ieattr = 6119 tb[NL80211_MESH_SETUP_IE]; 6120 if (!is_valid_ie_attr(ieattr)) 6121 return -EINVAL; 6122 setup->ie = nla_data(ieattr); 6123 setup->ie_len = nla_len(ieattr); 6124 } 6125 if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] && 6126 !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM)) 6127 return -EINVAL; 6128 setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]); 6129 setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]); 6130 setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]); 6131 if (setup->is_secure) 6132 setup->user_mpm = true; 6133 6134 if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) { 6135 if (!setup->user_mpm) 6136 return -EINVAL; 6137 setup->auth_id = 6138 nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]); 6139 } 6140 6141 return 0; 6142 } 6143 6144 static int nl80211_update_mesh_config(struct sk_buff *skb, 6145 struct genl_info *info) 6146 { 6147 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6148 struct net_device *dev = info->user_ptr[1]; 6149 struct wireless_dev *wdev = dev->ieee80211_ptr; 6150 struct mesh_config cfg; 6151 u32 mask; 6152 int err; 6153 6154 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) 6155 return -EOPNOTSUPP; 6156 6157 if (!rdev->ops->update_mesh_config) 6158 return -EOPNOTSUPP; 6159 6160 err = nl80211_parse_mesh_config(info, &cfg, &mask); 6161 if (err) 6162 return err; 6163 6164 wdev_lock(wdev); 6165 if (!wdev->mesh_id_len) 6166 err = -ENOLINK; 6167 6168 if (!err) 6169 err = rdev_update_mesh_config(rdev, dev, mask, &cfg); 6170 6171 wdev_unlock(wdev); 6172 6173 return err; 6174 } 6175 6176 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom, 6177 struct sk_buff *msg) 6178 { 6179 struct nlattr *nl_reg_rules; 6180 unsigned int i; 6181 6182 if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) || 6183 (regdom->dfs_region && 6184 nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region))) 6185 goto nla_put_failure; 6186 6187 nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES); 6188 if (!nl_reg_rules) 6189 goto nla_put_failure; 6190 6191 for (i = 0; i < regdom->n_reg_rules; i++) { 6192 struct nlattr *nl_reg_rule; 6193 const struct ieee80211_reg_rule *reg_rule; 6194 const struct ieee80211_freq_range *freq_range; 6195 const struct ieee80211_power_rule *power_rule; 6196 unsigned int max_bandwidth_khz; 6197 6198 reg_rule = ®dom->reg_rules[i]; 6199 freq_range = ®_rule->freq_range; 6200 power_rule = ®_rule->power_rule; 6201 6202 nl_reg_rule = nla_nest_start(msg, i); 6203 if (!nl_reg_rule) 6204 goto nla_put_failure; 6205 6206 max_bandwidth_khz = freq_range->max_bandwidth_khz; 6207 if (!max_bandwidth_khz) 6208 max_bandwidth_khz = reg_get_max_bandwidth(regdom, 6209 reg_rule); 6210 6211 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS, 6212 reg_rule->flags) || 6213 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START, 6214 freq_range->start_freq_khz) || 6215 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END, 6216 freq_range->end_freq_khz) || 6217 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW, 6218 max_bandwidth_khz) || 6219 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN, 6220 power_rule->max_antenna_gain) || 6221 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP, 6222 power_rule->max_eirp) || 6223 nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME, 6224 reg_rule->dfs_cac_ms)) 6225 goto nla_put_failure; 6226 6227 nla_nest_end(msg, nl_reg_rule); 6228 } 6229 6230 nla_nest_end(msg, nl_reg_rules); 6231 return 0; 6232 6233 nla_put_failure: 6234 return -EMSGSIZE; 6235 } 6236 6237 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info) 6238 { 6239 const struct ieee80211_regdomain *regdom = NULL; 6240 struct cfg80211_registered_device *rdev; 6241 struct wiphy *wiphy = NULL; 6242 struct sk_buff *msg; 6243 void *hdr; 6244 6245 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 6246 if (!msg) 6247 return -ENOBUFS; 6248 6249 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 6250 NL80211_CMD_GET_REG); 6251 if (!hdr) 6252 goto put_failure; 6253 6254 if (info->attrs[NL80211_ATTR_WIPHY]) { 6255 bool self_managed; 6256 6257 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info); 6258 if (IS_ERR(rdev)) { 6259 nlmsg_free(msg); 6260 return PTR_ERR(rdev); 6261 } 6262 6263 wiphy = &rdev->wiphy; 6264 self_managed = wiphy->regulatory_flags & 6265 REGULATORY_WIPHY_SELF_MANAGED; 6266 regdom = get_wiphy_regdom(wiphy); 6267 6268 /* a self-managed-reg device must have a private regdom */ 6269 if (WARN_ON(!regdom && self_managed)) { 6270 nlmsg_free(msg); 6271 return -EINVAL; 6272 } 6273 6274 if (regdom && 6275 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy))) 6276 goto nla_put_failure; 6277 } 6278 6279 if (!wiphy && reg_last_request_cell_base() && 6280 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE, 6281 NL80211_USER_REG_HINT_CELL_BASE)) 6282 goto nla_put_failure; 6283 6284 rcu_read_lock(); 6285 6286 if (!regdom) 6287 regdom = rcu_dereference(cfg80211_regdomain); 6288 6289 if (nl80211_put_regdom(regdom, msg)) 6290 goto nla_put_failure_rcu; 6291 6292 rcu_read_unlock(); 6293 6294 genlmsg_end(msg, hdr); 6295 return genlmsg_reply(msg, info); 6296 6297 nla_put_failure_rcu: 6298 rcu_read_unlock(); 6299 nla_put_failure: 6300 genlmsg_cancel(msg, hdr); 6301 put_failure: 6302 nlmsg_free(msg); 6303 return -EMSGSIZE; 6304 } 6305 6306 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb, 6307 u32 seq, int flags, struct wiphy *wiphy, 6308 const struct ieee80211_regdomain *regdom) 6309 { 6310 void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags, 6311 NL80211_CMD_GET_REG); 6312 6313 if (!hdr) 6314 return -1; 6315 6316 genl_dump_check_consistent(cb, hdr); 6317 6318 if (nl80211_put_regdom(regdom, msg)) 6319 goto nla_put_failure; 6320 6321 if (!wiphy && reg_last_request_cell_base() && 6322 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE, 6323 NL80211_USER_REG_HINT_CELL_BASE)) 6324 goto nla_put_failure; 6325 6326 if (wiphy && 6327 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy))) 6328 goto nla_put_failure; 6329 6330 if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED && 6331 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG)) 6332 goto nla_put_failure; 6333 6334 genlmsg_end(msg, hdr); 6335 return 0; 6336 6337 nla_put_failure: 6338 genlmsg_cancel(msg, hdr); 6339 return -EMSGSIZE; 6340 } 6341 6342 static int nl80211_get_reg_dump(struct sk_buff *skb, 6343 struct netlink_callback *cb) 6344 { 6345 const struct ieee80211_regdomain *regdom = NULL; 6346 struct cfg80211_registered_device *rdev; 6347 int err, reg_idx, start = cb->args[2]; 6348 6349 rtnl_lock(); 6350 6351 if (cfg80211_regdomain && start == 0) { 6352 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq, 6353 NLM_F_MULTI, NULL, 6354 rtnl_dereference(cfg80211_regdomain)); 6355 if (err < 0) 6356 goto out_err; 6357 } 6358 6359 /* the global regdom is idx 0 */ 6360 reg_idx = 1; 6361 list_for_each_entry(rdev, &cfg80211_rdev_list, list) { 6362 regdom = get_wiphy_regdom(&rdev->wiphy); 6363 if (!regdom) 6364 continue; 6365 6366 if (++reg_idx <= start) 6367 continue; 6368 6369 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq, 6370 NLM_F_MULTI, &rdev->wiphy, regdom); 6371 if (err < 0) { 6372 reg_idx--; 6373 break; 6374 } 6375 } 6376 6377 cb->args[2] = reg_idx; 6378 err = skb->len; 6379 out_err: 6380 rtnl_unlock(); 6381 return err; 6382 } 6383 6384 #ifdef CONFIG_CFG80211_CRDA_SUPPORT 6385 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = { 6386 [NL80211_ATTR_REG_RULE_FLAGS] = { .type = NLA_U32 }, 6387 [NL80211_ATTR_FREQ_RANGE_START] = { .type = NLA_U32 }, 6388 [NL80211_ATTR_FREQ_RANGE_END] = { .type = NLA_U32 }, 6389 [NL80211_ATTR_FREQ_RANGE_MAX_BW] = { .type = NLA_U32 }, 6390 [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN] = { .type = NLA_U32 }, 6391 [NL80211_ATTR_POWER_RULE_MAX_EIRP] = { .type = NLA_U32 }, 6392 [NL80211_ATTR_DFS_CAC_TIME] = { .type = NLA_U32 }, 6393 }; 6394 6395 static int parse_reg_rule(struct nlattr *tb[], 6396 struct ieee80211_reg_rule *reg_rule) 6397 { 6398 struct ieee80211_freq_range *freq_range = ®_rule->freq_range; 6399 struct ieee80211_power_rule *power_rule = ®_rule->power_rule; 6400 6401 if (!tb[NL80211_ATTR_REG_RULE_FLAGS]) 6402 return -EINVAL; 6403 if (!tb[NL80211_ATTR_FREQ_RANGE_START]) 6404 return -EINVAL; 6405 if (!tb[NL80211_ATTR_FREQ_RANGE_END]) 6406 return -EINVAL; 6407 if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]) 6408 return -EINVAL; 6409 if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]) 6410 return -EINVAL; 6411 6412 reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]); 6413 6414 freq_range->start_freq_khz = 6415 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]); 6416 freq_range->end_freq_khz = 6417 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]); 6418 freq_range->max_bandwidth_khz = 6419 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]); 6420 6421 power_rule->max_eirp = 6422 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]); 6423 6424 if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]) 6425 power_rule->max_antenna_gain = 6426 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]); 6427 6428 if (tb[NL80211_ATTR_DFS_CAC_TIME]) 6429 reg_rule->dfs_cac_ms = 6430 nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]); 6431 6432 return 0; 6433 } 6434 6435 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info) 6436 { 6437 struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1]; 6438 struct nlattr *nl_reg_rule; 6439 char *alpha2; 6440 int rem_reg_rules, r; 6441 u32 num_rules = 0, rule_idx = 0, size_of_regd; 6442 enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET; 6443 struct ieee80211_regdomain *rd; 6444 6445 if (!info->attrs[NL80211_ATTR_REG_ALPHA2]) 6446 return -EINVAL; 6447 6448 if (!info->attrs[NL80211_ATTR_REG_RULES]) 6449 return -EINVAL; 6450 6451 alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]); 6452 6453 if (info->attrs[NL80211_ATTR_DFS_REGION]) 6454 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]); 6455 6456 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES], 6457 rem_reg_rules) { 6458 num_rules++; 6459 if (num_rules > NL80211_MAX_SUPP_REG_RULES) 6460 return -EINVAL; 6461 } 6462 6463 if (!reg_is_valid_request(alpha2)) 6464 return -EINVAL; 6465 6466 size_of_regd = sizeof(struct ieee80211_regdomain) + 6467 num_rules * sizeof(struct ieee80211_reg_rule); 6468 6469 rd = kzalloc(size_of_regd, GFP_KERNEL); 6470 if (!rd) 6471 return -ENOMEM; 6472 6473 rd->n_reg_rules = num_rules; 6474 rd->alpha2[0] = alpha2[0]; 6475 rd->alpha2[1] = alpha2[1]; 6476 6477 /* 6478 * Disable DFS master mode if the DFS region was 6479 * not supported or known on this kernel. 6480 */ 6481 if (reg_supported_dfs_region(dfs_region)) 6482 rd->dfs_region = dfs_region; 6483 6484 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES], 6485 rem_reg_rules) { 6486 r = nla_parse_nested(tb, NL80211_REG_RULE_ATTR_MAX, 6487 nl_reg_rule, reg_rule_policy, 6488 info->extack); 6489 if (r) 6490 goto bad_reg; 6491 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]); 6492 if (r) 6493 goto bad_reg; 6494 6495 rule_idx++; 6496 6497 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) { 6498 r = -EINVAL; 6499 goto bad_reg; 6500 } 6501 } 6502 6503 /* set_regdom takes ownership of rd */ 6504 return set_regdom(rd, REGD_SOURCE_CRDA); 6505 bad_reg: 6506 kfree(rd); 6507 return r; 6508 } 6509 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */ 6510 6511 static int validate_scan_freqs(struct nlattr *freqs) 6512 { 6513 struct nlattr *attr1, *attr2; 6514 int n_channels = 0, tmp1, tmp2; 6515 6516 nla_for_each_nested(attr1, freqs, tmp1) 6517 if (nla_len(attr1) != sizeof(u32)) 6518 return 0; 6519 6520 nla_for_each_nested(attr1, freqs, tmp1) { 6521 n_channels++; 6522 /* 6523 * Some hardware has a limited channel list for 6524 * scanning, and it is pretty much nonsensical 6525 * to scan for a channel twice, so disallow that 6526 * and don't require drivers to check that the 6527 * channel list they get isn't longer than what 6528 * they can scan, as long as they can scan all 6529 * the channels they registered at once. 6530 */ 6531 nla_for_each_nested(attr2, freqs, tmp2) 6532 if (attr1 != attr2 && 6533 nla_get_u32(attr1) == nla_get_u32(attr2)) 6534 return 0; 6535 } 6536 6537 return n_channels; 6538 } 6539 6540 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b) 6541 { 6542 return b < NUM_NL80211_BANDS && wiphy->bands[b]; 6543 } 6544 6545 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy, 6546 struct cfg80211_bss_selection *bss_select) 6547 { 6548 struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1]; 6549 struct nlattr *nest; 6550 int err; 6551 bool found = false; 6552 int i; 6553 6554 /* only process one nested attribute */ 6555 nest = nla_data(nla); 6556 if (!nla_ok(nest, nla_len(nest))) 6557 return -EINVAL; 6558 6559 err = nla_parse_nested(attr, NL80211_BSS_SELECT_ATTR_MAX, nest, 6560 nl80211_bss_select_policy, NULL); 6561 if (err) 6562 return err; 6563 6564 /* only one attribute may be given */ 6565 for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) { 6566 if (attr[i]) { 6567 if (found) 6568 return -EINVAL; 6569 found = true; 6570 } 6571 } 6572 6573 bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID; 6574 6575 if (attr[NL80211_BSS_SELECT_ATTR_RSSI]) 6576 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI; 6577 6578 if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) { 6579 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF; 6580 bss_select->param.band_pref = 6581 nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]); 6582 if (!is_band_valid(wiphy, bss_select->param.band_pref)) 6583 return -EINVAL; 6584 } 6585 6586 if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) { 6587 struct nl80211_bss_select_rssi_adjust *adj_param; 6588 6589 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]); 6590 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST; 6591 bss_select->param.adjust.band = adj_param->band; 6592 bss_select->param.adjust.delta = adj_param->delta; 6593 if (!is_band_valid(wiphy, bss_select->param.adjust.band)) 6594 return -EINVAL; 6595 } 6596 6597 /* user-space did not provide behaviour attribute */ 6598 if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID) 6599 return -EINVAL; 6600 6601 if (!(wiphy->bss_select_support & BIT(bss_select->behaviour))) 6602 return -EINVAL; 6603 6604 return 0; 6605 } 6606 6607 static int nl80211_parse_random_mac(struct nlattr **attrs, 6608 u8 *mac_addr, u8 *mac_addr_mask) 6609 { 6610 int i; 6611 6612 if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) { 6613 eth_zero_addr(mac_addr); 6614 eth_zero_addr(mac_addr_mask); 6615 mac_addr[0] = 0x2; 6616 mac_addr_mask[0] = 0x3; 6617 6618 return 0; 6619 } 6620 6621 /* need both or none */ 6622 if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK]) 6623 return -EINVAL; 6624 6625 memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN); 6626 memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN); 6627 6628 /* don't allow or configure an mcast address */ 6629 if (!is_multicast_ether_addr(mac_addr_mask) || 6630 is_multicast_ether_addr(mac_addr)) 6631 return -EINVAL; 6632 6633 /* 6634 * allow users to pass a MAC address that has bits set outside 6635 * of the mask, but don't bother drivers with having to deal 6636 * with such bits 6637 */ 6638 for (i = 0; i < ETH_ALEN; i++) 6639 mac_addr[i] &= mac_addr_mask[i]; 6640 6641 return 0; 6642 } 6643 6644 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev) 6645 { 6646 ASSERT_WDEV_LOCK(wdev); 6647 6648 if (!cfg80211_beaconing_iface_active(wdev)) 6649 return true; 6650 6651 if (!(wdev->chandef.chan->flags & IEEE80211_CHAN_RADAR)) 6652 return true; 6653 6654 return regulatory_pre_cac_allowed(wdev->wiphy); 6655 } 6656 6657 static int 6658 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev, 6659 void *request, struct nlattr **attrs, 6660 bool is_sched_scan) 6661 { 6662 u8 *mac_addr, *mac_addr_mask; 6663 u32 *flags; 6664 enum nl80211_feature_flags randomness_flag; 6665 6666 if (!attrs[NL80211_ATTR_SCAN_FLAGS]) 6667 return 0; 6668 6669 if (is_sched_scan) { 6670 struct cfg80211_sched_scan_request *req = request; 6671 6672 randomness_flag = wdev ? 6673 NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR : 6674 NL80211_FEATURE_ND_RANDOM_MAC_ADDR; 6675 flags = &req->flags; 6676 mac_addr = req->mac_addr; 6677 mac_addr_mask = req->mac_addr_mask; 6678 } else { 6679 struct cfg80211_scan_request *req = request; 6680 6681 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR; 6682 flags = &req->flags; 6683 mac_addr = req->mac_addr; 6684 mac_addr_mask = req->mac_addr_mask; 6685 } 6686 6687 *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]); 6688 6689 if ((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) && 6690 !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) 6691 return -EOPNOTSUPP; 6692 6693 if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) { 6694 int err; 6695 6696 if (!(wiphy->features & randomness_flag) || 6697 (wdev && wdev->current_bss)) 6698 return -EOPNOTSUPP; 6699 6700 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask); 6701 if (err) 6702 return err; 6703 } 6704 6705 if ((*flags & NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME) && 6706 !wiphy_ext_feature_isset(wiphy, 6707 NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME)) 6708 return -EOPNOTSUPP; 6709 6710 if ((*flags & NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP) && 6711 !wiphy_ext_feature_isset(wiphy, 6712 NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP)) 6713 return -EOPNOTSUPP; 6714 6715 if ((*flags & NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) && 6716 !wiphy_ext_feature_isset(wiphy, 6717 NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION)) 6718 return -EOPNOTSUPP; 6719 6720 if ((*flags & NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE) && 6721 !wiphy_ext_feature_isset(wiphy, 6722 NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE)) 6723 return -EOPNOTSUPP; 6724 6725 return 0; 6726 } 6727 6728 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info) 6729 { 6730 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6731 struct wireless_dev *wdev = info->user_ptr[1]; 6732 struct cfg80211_scan_request *request; 6733 struct nlattr *attr; 6734 struct wiphy *wiphy; 6735 int err, tmp, n_ssids = 0, n_channels, i; 6736 size_t ie_len; 6737 6738 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) 6739 return -EINVAL; 6740 6741 wiphy = &rdev->wiphy; 6742 6743 if (wdev->iftype == NL80211_IFTYPE_NAN) 6744 return -EOPNOTSUPP; 6745 6746 if (!rdev->ops->scan) 6747 return -EOPNOTSUPP; 6748 6749 if (rdev->scan_req || rdev->scan_msg) { 6750 err = -EBUSY; 6751 goto unlock; 6752 } 6753 6754 if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) { 6755 n_channels = validate_scan_freqs( 6756 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]); 6757 if (!n_channels) { 6758 err = -EINVAL; 6759 goto unlock; 6760 } 6761 } else { 6762 n_channels = ieee80211_get_num_supported_channels(wiphy); 6763 } 6764 6765 if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) 6766 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) 6767 n_ssids++; 6768 6769 if (n_ssids > wiphy->max_scan_ssids) { 6770 err = -EINVAL; 6771 goto unlock; 6772 } 6773 6774 if (info->attrs[NL80211_ATTR_IE]) 6775 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 6776 else 6777 ie_len = 0; 6778 6779 if (ie_len > wiphy->max_scan_ie_len) { 6780 err = -EINVAL; 6781 goto unlock; 6782 } 6783 6784 request = kzalloc(sizeof(*request) 6785 + sizeof(*request->ssids) * n_ssids 6786 + sizeof(*request->channels) * n_channels 6787 + ie_len, GFP_KERNEL); 6788 if (!request) { 6789 err = -ENOMEM; 6790 goto unlock; 6791 } 6792 6793 if (n_ssids) 6794 request->ssids = (void *)&request->channels[n_channels]; 6795 request->n_ssids = n_ssids; 6796 if (ie_len) { 6797 if (n_ssids) 6798 request->ie = (void *)(request->ssids + n_ssids); 6799 else 6800 request->ie = (void *)(request->channels + n_channels); 6801 } 6802 6803 i = 0; 6804 if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) { 6805 /* user specified, bail out if channel not found */ 6806 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) { 6807 struct ieee80211_channel *chan; 6808 6809 chan = ieee80211_get_channel(wiphy, nla_get_u32(attr)); 6810 6811 if (!chan) { 6812 err = -EINVAL; 6813 goto out_free; 6814 } 6815 6816 /* ignore disabled channels */ 6817 if (chan->flags & IEEE80211_CHAN_DISABLED) 6818 continue; 6819 6820 request->channels[i] = chan; 6821 i++; 6822 } 6823 } else { 6824 enum nl80211_band band; 6825 6826 /* all channels */ 6827 for (band = 0; band < NUM_NL80211_BANDS; band++) { 6828 int j; 6829 6830 if (!wiphy->bands[band]) 6831 continue; 6832 for (j = 0; j < wiphy->bands[band]->n_channels; j++) { 6833 struct ieee80211_channel *chan; 6834 6835 chan = &wiphy->bands[band]->channels[j]; 6836 6837 if (chan->flags & IEEE80211_CHAN_DISABLED) 6838 continue; 6839 6840 request->channels[i] = chan; 6841 i++; 6842 } 6843 } 6844 } 6845 6846 if (!i) { 6847 err = -EINVAL; 6848 goto out_free; 6849 } 6850 6851 request->n_channels = i; 6852 6853 wdev_lock(wdev); 6854 if (!cfg80211_off_channel_oper_allowed(wdev)) { 6855 struct ieee80211_channel *chan; 6856 6857 if (request->n_channels != 1) { 6858 wdev_unlock(wdev); 6859 err = -EBUSY; 6860 goto out_free; 6861 } 6862 6863 chan = request->channels[0]; 6864 if (chan->center_freq != wdev->chandef.chan->center_freq) { 6865 wdev_unlock(wdev); 6866 err = -EBUSY; 6867 goto out_free; 6868 } 6869 } 6870 wdev_unlock(wdev); 6871 6872 i = 0; 6873 if (n_ssids) { 6874 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) { 6875 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) { 6876 err = -EINVAL; 6877 goto out_free; 6878 } 6879 request->ssids[i].ssid_len = nla_len(attr); 6880 memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr)); 6881 i++; 6882 } 6883 } 6884 6885 if (info->attrs[NL80211_ATTR_IE]) { 6886 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 6887 memcpy((void *)request->ie, 6888 nla_data(info->attrs[NL80211_ATTR_IE]), 6889 request->ie_len); 6890 } 6891 6892 for (i = 0; i < NUM_NL80211_BANDS; i++) 6893 if (wiphy->bands[i]) 6894 request->rates[i] = 6895 (1 << wiphy->bands[i]->n_bitrates) - 1; 6896 6897 if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) { 6898 nla_for_each_nested(attr, 6899 info->attrs[NL80211_ATTR_SCAN_SUPP_RATES], 6900 tmp) { 6901 enum nl80211_band band = nla_type(attr); 6902 6903 if (band < 0 || band >= NUM_NL80211_BANDS) { 6904 err = -EINVAL; 6905 goto out_free; 6906 } 6907 6908 if (!wiphy->bands[band]) 6909 continue; 6910 6911 err = ieee80211_get_ratemask(wiphy->bands[band], 6912 nla_data(attr), 6913 nla_len(attr), 6914 &request->rates[band]); 6915 if (err) 6916 goto out_free; 6917 } 6918 } 6919 6920 if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) { 6921 if (!wiphy_ext_feature_isset(wiphy, 6922 NL80211_EXT_FEATURE_SET_SCAN_DWELL)) { 6923 err = -EOPNOTSUPP; 6924 goto out_free; 6925 } 6926 6927 request->duration = 6928 nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]); 6929 request->duration_mandatory = 6930 nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]); 6931 } 6932 6933 err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs, 6934 false); 6935 if (err) 6936 goto out_free; 6937 6938 request->no_cck = 6939 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]); 6940 6941 /* Initial implementation used NL80211_ATTR_MAC to set the specific 6942 * BSSID to scan for. This was problematic because that same attribute 6943 * was already used for another purpose (local random MAC address). The 6944 * NL80211_ATTR_BSSID attribute was added to fix this. For backwards 6945 * compatibility with older userspace components, also use the 6946 * NL80211_ATTR_MAC value here if it can be determined to be used for 6947 * the specific BSSID use case instead of the random MAC address 6948 * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use). 6949 */ 6950 if (info->attrs[NL80211_ATTR_BSSID]) 6951 memcpy(request->bssid, 6952 nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN); 6953 else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) && 6954 info->attrs[NL80211_ATTR_MAC]) 6955 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]), 6956 ETH_ALEN); 6957 else 6958 eth_broadcast_addr(request->bssid); 6959 6960 request->wdev = wdev; 6961 request->wiphy = &rdev->wiphy; 6962 request->scan_start = jiffies; 6963 6964 rdev->scan_req = request; 6965 err = rdev_scan(rdev, request); 6966 6967 if (!err) { 6968 nl80211_send_scan_start(rdev, wdev); 6969 if (wdev->netdev) 6970 dev_hold(wdev->netdev); 6971 } else { 6972 out_free: 6973 rdev->scan_req = NULL; 6974 kfree(request); 6975 } 6976 6977 unlock: 6978 return err; 6979 } 6980 6981 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info) 6982 { 6983 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6984 struct wireless_dev *wdev = info->user_ptr[1]; 6985 6986 if (!rdev->ops->abort_scan) 6987 return -EOPNOTSUPP; 6988 6989 if (rdev->scan_msg) 6990 return 0; 6991 6992 if (!rdev->scan_req) 6993 return -ENOENT; 6994 6995 rdev_abort_scan(rdev, wdev); 6996 return 0; 6997 } 6998 6999 static int 7000 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans, 7001 struct cfg80211_sched_scan_request *request, 7002 struct nlattr **attrs) 7003 { 7004 int tmp, err, i = 0; 7005 struct nlattr *attr; 7006 7007 if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) { 7008 u32 interval; 7009 7010 /* 7011 * If scan plans are not specified, 7012 * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this 7013 * case one scan plan will be set with the specified scan 7014 * interval and infinite number of iterations. 7015 */ 7016 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]); 7017 if (!interval) 7018 return -EINVAL; 7019 7020 request->scan_plans[0].interval = 7021 DIV_ROUND_UP(interval, MSEC_PER_SEC); 7022 if (!request->scan_plans[0].interval) 7023 return -EINVAL; 7024 7025 if (request->scan_plans[0].interval > 7026 wiphy->max_sched_scan_plan_interval) 7027 request->scan_plans[0].interval = 7028 wiphy->max_sched_scan_plan_interval; 7029 7030 return 0; 7031 } 7032 7033 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) { 7034 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1]; 7035 7036 if (WARN_ON(i >= n_plans)) 7037 return -EINVAL; 7038 7039 err = nla_parse_nested(plan, NL80211_SCHED_SCAN_PLAN_MAX, 7040 attr, nl80211_plan_policy, NULL); 7041 if (err) 7042 return err; 7043 7044 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]) 7045 return -EINVAL; 7046 7047 request->scan_plans[i].interval = 7048 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]); 7049 if (!request->scan_plans[i].interval || 7050 request->scan_plans[i].interval > 7051 wiphy->max_sched_scan_plan_interval) 7052 return -EINVAL; 7053 7054 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) { 7055 request->scan_plans[i].iterations = 7056 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]); 7057 if (!request->scan_plans[i].iterations || 7058 (request->scan_plans[i].iterations > 7059 wiphy->max_sched_scan_plan_iterations)) 7060 return -EINVAL; 7061 } else if (i < n_plans - 1) { 7062 /* 7063 * All scan plans but the last one must specify 7064 * a finite number of iterations 7065 */ 7066 return -EINVAL; 7067 } 7068 7069 i++; 7070 } 7071 7072 /* 7073 * The last scan plan must not specify the number of 7074 * iterations, it is supposed to run infinitely 7075 */ 7076 if (request->scan_plans[n_plans - 1].iterations) 7077 return -EINVAL; 7078 7079 return 0; 7080 } 7081 7082 static struct cfg80211_sched_scan_request * 7083 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev, 7084 struct nlattr **attrs, int max_match_sets) 7085 { 7086 struct cfg80211_sched_scan_request *request; 7087 struct nlattr *attr; 7088 int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0; 7089 enum nl80211_band band; 7090 size_t ie_len; 7091 struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1]; 7092 s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF; 7093 7094 if (!is_valid_ie_attr(attrs[NL80211_ATTR_IE])) 7095 return ERR_PTR(-EINVAL); 7096 7097 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) { 7098 n_channels = validate_scan_freqs( 7099 attrs[NL80211_ATTR_SCAN_FREQUENCIES]); 7100 if (!n_channels) 7101 return ERR_PTR(-EINVAL); 7102 } else { 7103 n_channels = ieee80211_get_num_supported_channels(wiphy); 7104 } 7105 7106 if (attrs[NL80211_ATTR_SCAN_SSIDS]) 7107 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS], 7108 tmp) 7109 n_ssids++; 7110 7111 if (n_ssids > wiphy->max_sched_scan_ssids) 7112 return ERR_PTR(-EINVAL); 7113 7114 /* 7115 * First, count the number of 'real' matchsets. Due to an issue with 7116 * the old implementation, matchsets containing only the RSSI attribute 7117 * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default' 7118 * RSSI for all matchsets, rather than their own matchset for reporting 7119 * all APs with a strong RSSI. This is needed to be compatible with 7120 * older userspace that treated a matchset with only the RSSI as the 7121 * global RSSI for all other matchsets - if there are other matchsets. 7122 */ 7123 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) { 7124 nla_for_each_nested(attr, 7125 attrs[NL80211_ATTR_SCHED_SCAN_MATCH], 7126 tmp) { 7127 struct nlattr *rssi; 7128 7129 err = nla_parse_nested(tb, 7130 NL80211_SCHED_SCAN_MATCH_ATTR_MAX, 7131 attr, nl80211_match_policy, 7132 NULL); 7133 if (err) 7134 return ERR_PTR(err); 7135 7136 /* SSID and BSSID are mutually exclusive */ 7137 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] && 7138 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) 7139 return ERR_PTR(-EINVAL); 7140 7141 /* add other standalone attributes here */ 7142 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] || 7143 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) { 7144 n_match_sets++; 7145 continue; 7146 } 7147 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI]; 7148 if (rssi) 7149 default_match_rssi = nla_get_s32(rssi); 7150 } 7151 } 7152 7153 /* However, if there's no other matchset, add the RSSI one */ 7154 if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF) 7155 n_match_sets = 1; 7156 7157 if (n_match_sets > max_match_sets) 7158 return ERR_PTR(-EINVAL); 7159 7160 if (attrs[NL80211_ATTR_IE]) 7161 ie_len = nla_len(attrs[NL80211_ATTR_IE]); 7162 else 7163 ie_len = 0; 7164 7165 if (ie_len > wiphy->max_sched_scan_ie_len) 7166 return ERR_PTR(-EINVAL); 7167 7168 if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) { 7169 /* 7170 * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since 7171 * each scan plan already specifies its own interval 7172 */ 7173 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]) 7174 return ERR_PTR(-EINVAL); 7175 7176 nla_for_each_nested(attr, 7177 attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) 7178 n_plans++; 7179 } else { 7180 /* 7181 * The scan interval attribute is kept for backward 7182 * compatibility. If no scan plans are specified and sched scan 7183 * interval is specified, one scan plan will be set with this 7184 * scan interval and infinite number of iterations. 7185 */ 7186 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]) 7187 return ERR_PTR(-EINVAL); 7188 7189 n_plans = 1; 7190 } 7191 7192 if (!n_plans || n_plans > wiphy->max_sched_scan_plans) 7193 return ERR_PTR(-EINVAL); 7194 7195 if (!wiphy_ext_feature_isset( 7196 wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) && 7197 (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] || 7198 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST])) 7199 return ERR_PTR(-EINVAL); 7200 7201 request = kzalloc(sizeof(*request) 7202 + sizeof(*request->ssids) * n_ssids 7203 + sizeof(*request->match_sets) * n_match_sets 7204 + sizeof(*request->scan_plans) * n_plans 7205 + sizeof(*request->channels) * n_channels 7206 + ie_len, GFP_KERNEL); 7207 if (!request) 7208 return ERR_PTR(-ENOMEM); 7209 7210 if (n_ssids) 7211 request->ssids = (void *)&request->channels[n_channels]; 7212 request->n_ssids = n_ssids; 7213 if (ie_len) { 7214 if (n_ssids) 7215 request->ie = (void *)(request->ssids + n_ssids); 7216 else 7217 request->ie = (void *)(request->channels + n_channels); 7218 } 7219 7220 if (n_match_sets) { 7221 if (request->ie) 7222 request->match_sets = (void *)(request->ie + ie_len); 7223 else if (n_ssids) 7224 request->match_sets = 7225 (void *)(request->ssids + n_ssids); 7226 else 7227 request->match_sets = 7228 (void *)(request->channels + n_channels); 7229 } 7230 request->n_match_sets = n_match_sets; 7231 7232 if (n_match_sets) 7233 request->scan_plans = (void *)(request->match_sets + 7234 n_match_sets); 7235 else if (request->ie) 7236 request->scan_plans = (void *)(request->ie + ie_len); 7237 else if (n_ssids) 7238 request->scan_plans = (void *)(request->ssids + n_ssids); 7239 else 7240 request->scan_plans = (void *)(request->channels + n_channels); 7241 7242 request->n_scan_plans = n_plans; 7243 7244 i = 0; 7245 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) { 7246 /* user specified, bail out if channel not found */ 7247 nla_for_each_nested(attr, 7248 attrs[NL80211_ATTR_SCAN_FREQUENCIES], 7249 tmp) { 7250 struct ieee80211_channel *chan; 7251 7252 chan = ieee80211_get_channel(wiphy, nla_get_u32(attr)); 7253 7254 if (!chan) { 7255 err = -EINVAL; 7256 goto out_free; 7257 } 7258 7259 /* ignore disabled channels */ 7260 if (chan->flags & IEEE80211_CHAN_DISABLED) 7261 continue; 7262 7263 request->channels[i] = chan; 7264 i++; 7265 } 7266 } else { 7267 /* all channels */ 7268 for (band = 0; band < NUM_NL80211_BANDS; band++) { 7269 int j; 7270 7271 if (!wiphy->bands[band]) 7272 continue; 7273 for (j = 0; j < wiphy->bands[band]->n_channels; j++) { 7274 struct ieee80211_channel *chan; 7275 7276 chan = &wiphy->bands[band]->channels[j]; 7277 7278 if (chan->flags & IEEE80211_CHAN_DISABLED) 7279 continue; 7280 7281 request->channels[i] = chan; 7282 i++; 7283 } 7284 } 7285 } 7286 7287 if (!i) { 7288 err = -EINVAL; 7289 goto out_free; 7290 } 7291 7292 request->n_channels = i; 7293 7294 i = 0; 7295 if (n_ssids) { 7296 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS], 7297 tmp) { 7298 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) { 7299 err = -EINVAL; 7300 goto out_free; 7301 } 7302 request->ssids[i].ssid_len = nla_len(attr); 7303 memcpy(request->ssids[i].ssid, nla_data(attr), 7304 nla_len(attr)); 7305 i++; 7306 } 7307 } 7308 7309 i = 0; 7310 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) { 7311 nla_for_each_nested(attr, 7312 attrs[NL80211_ATTR_SCHED_SCAN_MATCH], 7313 tmp) { 7314 struct nlattr *ssid, *bssid, *rssi; 7315 7316 err = nla_parse_nested(tb, 7317 NL80211_SCHED_SCAN_MATCH_ATTR_MAX, 7318 attr, nl80211_match_policy, 7319 NULL); 7320 if (err) 7321 goto out_free; 7322 ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]; 7323 bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]; 7324 if (ssid || bssid) { 7325 if (WARN_ON(i >= n_match_sets)) { 7326 /* this indicates a programming error, 7327 * the loop above should have verified 7328 * things properly 7329 */ 7330 err = -EINVAL; 7331 goto out_free; 7332 } 7333 7334 if (ssid) { 7335 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) { 7336 err = -EINVAL; 7337 goto out_free; 7338 } 7339 memcpy(request->match_sets[i].ssid.ssid, 7340 nla_data(ssid), nla_len(ssid)); 7341 request->match_sets[i].ssid.ssid_len = 7342 nla_len(ssid); 7343 } 7344 if (bssid) { 7345 if (nla_len(bssid) != ETH_ALEN) { 7346 err = -EINVAL; 7347 goto out_free; 7348 } 7349 memcpy(request->match_sets[i].bssid, 7350 nla_data(bssid), ETH_ALEN); 7351 } 7352 7353 /* special attribute - old implementation w/a */ 7354 request->match_sets[i].rssi_thold = 7355 default_match_rssi; 7356 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI]; 7357 if (rssi) 7358 request->match_sets[i].rssi_thold = 7359 nla_get_s32(rssi); 7360 } 7361 i++; 7362 } 7363 7364 /* there was no other matchset, so the RSSI one is alone */ 7365 if (i == 0 && n_match_sets) 7366 request->match_sets[0].rssi_thold = default_match_rssi; 7367 7368 request->min_rssi_thold = INT_MAX; 7369 for (i = 0; i < n_match_sets; i++) 7370 request->min_rssi_thold = 7371 min(request->match_sets[i].rssi_thold, 7372 request->min_rssi_thold); 7373 } else { 7374 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF; 7375 } 7376 7377 if (ie_len) { 7378 request->ie_len = ie_len; 7379 memcpy((void *)request->ie, 7380 nla_data(attrs[NL80211_ATTR_IE]), 7381 request->ie_len); 7382 } 7383 7384 err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true); 7385 if (err) 7386 goto out_free; 7387 7388 if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY]) 7389 request->delay = 7390 nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]); 7391 7392 if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) { 7393 request->relative_rssi = nla_get_s8( 7394 attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]); 7395 request->relative_rssi_set = true; 7396 } 7397 7398 if (request->relative_rssi_set && 7399 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) { 7400 struct nl80211_bss_select_rssi_adjust *rssi_adjust; 7401 7402 rssi_adjust = nla_data( 7403 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]); 7404 request->rssi_adjust.band = rssi_adjust->band; 7405 request->rssi_adjust.delta = rssi_adjust->delta; 7406 if (!is_band_valid(wiphy, request->rssi_adjust.band)) { 7407 err = -EINVAL; 7408 goto out_free; 7409 } 7410 } 7411 7412 err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs); 7413 if (err) 7414 goto out_free; 7415 7416 request->scan_start = jiffies; 7417 7418 return request; 7419 7420 out_free: 7421 kfree(request); 7422 return ERR_PTR(err); 7423 } 7424 7425 static int nl80211_start_sched_scan(struct sk_buff *skb, 7426 struct genl_info *info) 7427 { 7428 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7429 struct net_device *dev = info->user_ptr[1]; 7430 struct wireless_dev *wdev = dev->ieee80211_ptr; 7431 struct cfg80211_sched_scan_request *sched_scan_req; 7432 bool want_multi; 7433 int err; 7434 7435 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start) 7436 return -EOPNOTSUPP; 7437 7438 want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI]; 7439 err = cfg80211_sched_scan_req_possible(rdev, want_multi); 7440 if (err) 7441 return err; 7442 7443 sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev, 7444 info->attrs, 7445 rdev->wiphy.max_match_sets); 7446 7447 err = PTR_ERR_OR_ZERO(sched_scan_req); 7448 if (err) 7449 goto out_err; 7450 7451 /* leave request id zero for legacy request 7452 * or if driver does not support multi-scheduled scan 7453 */ 7454 if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1) { 7455 while (!sched_scan_req->reqid) 7456 sched_scan_req->reqid = rdev->wiphy.cookie_counter++; 7457 } 7458 7459 err = rdev_sched_scan_start(rdev, dev, sched_scan_req); 7460 if (err) 7461 goto out_free; 7462 7463 sched_scan_req->dev = dev; 7464 sched_scan_req->wiphy = &rdev->wiphy; 7465 7466 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 7467 sched_scan_req->owner_nlportid = info->snd_portid; 7468 7469 cfg80211_add_sched_scan_req(rdev, sched_scan_req); 7470 7471 nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN); 7472 return 0; 7473 7474 out_free: 7475 kfree(sched_scan_req); 7476 out_err: 7477 return err; 7478 } 7479 7480 static int nl80211_stop_sched_scan(struct sk_buff *skb, 7481 struct genl_info *info) 7482 { 7483 struct cfg80211_sched_scan_request *req; 7484 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7485 u64 cookie; 7486 7487 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop) 7488 return -EOPNOTSUPP; 7489 7490 if (info->attrs[NL80211_ATTR_COOKIE]) { 7491 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 7492 return __cfg80211_stop_sched_scan(rdev, cookie, false); 7493 } 7494 7495 req = list_first_or_null_rcu(&rdev->sched_scan_req_list, 7496 struct cfg80211_sched_scan_request, 7497 list); 7498 if (!req || req->reqid || 7499 (req->owner_nlportid && 7500 req->owner_nlportid != info->snd_portid)) 7501 return -ENOENT; 7502 7503 return cfg80211_stop_sched_scan_req(rdev, req, false); 7504 } 7505 7506 static int nl80211_start_radar_detection(struct sk_buff *skb, 7507 struct genl_info *info) 7508 { 7509 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7510 struct net_device *dev = info->user_ptr[1]; 7511 struct wireless_dev *wdev = dev->ieee80211_ptr; 7512 struct cfg80211_chan_def chandef; 7513 enum nl80211_dfs_regions dfs_region; 7514 unsigned int cac_time_ms; 7515 int err; 7516 7517 dfs_region = reg_get_dfs_region(wdev->wiphy); 7518 if (dfs_region == NL80211_DFS_UNSET) 7519 return -EINVAL; 7520 7521 err = nl80211_parse_chandef(rdev, info, &chandef); 7522 if (err) 7523 return err; 7524 7525 if (netif_carrier_ok(dev)) 7526 return -EBUSY; 7527 7528 if (wdev->cac_started) 7529 return -EBUSY; 7530 7531 err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, 7532 wdev->iftype); 7533 if (err < 0) 7534 return err; 7535 7536 if (err == 0) 7537 return -EINVAL; 7538 7539 if (!cfg80211_chandef_dfs_usable(wdev->wiphy, &chandef)) 7540 return -EINVAL; 7541 7542 if (!rdev->ops->start_radar_detection) 7543 return -EOPNOTSUPP; 7544 7545 cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef); 7546 if (WARN_ON(!cac_time_ms)) 7547 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS; 7548 7549 err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms); 7550 if (!err) { 7551 wdev->chandef = chandef; 7552 wdev->cac_started = true; 7553 wdev->cac_start_time = jiffies; 7554 wdev->cac_time_ms = cac_time_ms; 7555 } 7556 return err; 7557 } 7558 7559 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info) 7560 { 7561 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7562 struct net_device *dev = info->user_ptr[1]; 7563 struct wireless_dev *wdev = dev->ieee80211_ptr; 7564 struct cfg80211_csa_settings params; 7565 /* csa_attrs is defined static to avoid waste of stack size - this 7566 * function is called under RTNL lock, so this should not be a problem. 7567 */ 7568 static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1]; 7569 int err; 7570 bool need_new_beacon = false; 7571 bool need_handle_dfs_flag = true; 7572 int len, i; 7573 u32 cs_count; 7574 7575 if (!rdev->ops->channel_switch || 7576 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)) 7577 return -EOPNOTSUPP; 7578 7579 switch (dev->ieee80211_ptr->iftype) { 7580 case NL80211_IFTYPE_AP: 7581 case NL80211_IFTYPE_P2P_GO: 7582 need_new_beacon = true; 7583 /* For all modes except AP the handle_dfs flag needs to be 7584 * supplied to tell the kernel that userspace will handle radar 7585 * events when they happen. Otherwise a switch to a channel 7586 * requiring DFS will be rejected. 7587 */ 7588 need_handle_dfs_flag = false; 7589 7590 /* useless if AP is not running */ 7591 if (!wdev->beacon_interval) 7592 return -ENOTCONN; 7593 break; 7594 case NL80211_IFTYPE_ADHOC: 7595 if (!wdev->ssid_len) 7596 return -ENOTCONN; 7597 break; 7598 case NL80211_IFTYPE_MESH_POINT: 7599 if (!wdev->mesh_id_len) 7600 return -ENOTCONN; 7601 break; 7602 default: 7603 return -EOPNOTSUPP; 7604 } 7605 7606 memset(¶ms, 0, sizeof(params)); 7607 7608 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] || 7609 !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]) 7610 return -EINVAL; 7611 7612 /* only important for AP, IBSS and mesh create IEs internally */ 7613 if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES]) 7614 return -EINVAL; 7615 7616 /* Even though the attribute is u32, the specification says 7617 * u8, so let's make sure we don't overflow. 7618 */ 7619 cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]); 7620 if (cs_count > 255) 7621 return -EINVAL; 7622 7623 params.count = cs_count; 7624 7625 if (!need_new_beacon) 7626 goto skip_beacons; 7627 7628 err = nl80211_parse_beacon(info->attrs, ¶ms.beacon_after); 7629 if (err) 7630 return err; 7631 7632 err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX, 7633 info->attrs[NL80211_ATTR_CSA_IES], 7634 nl80211_policy, info->extack); 7635 if (err) 7636 return err; 7637 7638 err = nl80211_parse_beacon(csa_attrs, ¶ms.beacon_csa); 7639 if (err) 7640 return err; 7641 7642 if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]) 7643 return -EINVAL; 7644 7645 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]); 7646 if (!len || (len % sizeof(u16))) 7647 return -EINVAL; 7648 7649 params.n_counter_offsets_beacon = len / sizeof(u16); 7650 if (rdev->wiphy.max_num_csa_counters && 7651 (params.n_counter_offsets_beacon > 7652 rdev->wiphy.max_num_csa_counters)) 7653 return -EINVAL; 7654 7655 params.counter_offsets_beacon = 7656 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]); 7657 7658 /* sanity checks - counters should fit and be the same */ 7659 for (i = 0; i < params.n_counter_offsets_beacon; i++) { 7660 u16 offset = params.counter_offsets_beacon[i]; 7661 7662 if (offset >= params.beacon_csa.tail_len) 7663 return -EINVAL; 7664 7665 if (params.beacon_csa.tail[offset] != params.count) 7666 return -EINVAL; 7667 } 7668 7669 if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) { 7670 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]); 7671 if (!len || (len % sizeof(u16))) 7672 return -EINVAL; 7673 7674 params.n_counter_offsets_presp = len / sizeof(u16); 7675 if (rdev->wiphy.max_num_csa_counters && 7676 (params.n_counter_offsets_presp > 7677 rdev->wiphy.max_num_csa_counters)) 7678 return -EINVAL; 7679 7680 params.counter_offsets_presp = 7681 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]); 7682 7683 /* sanity checks - counters should fit and be the same */ 7684 for (i = 0; i < params.n_counter_offsets_presp; i++) { 7685 u16 offset = params.counter_offsets_presp[i]; 7686 7687 if (offset >= params.beacon_csa.probe_resp_len) 7688 return -EINVAL; 7689 7690 if (params.beacon_csa.probe_resp[offset] != 7691 params.count) 7692 return -EINVAL; 7693 } 7694 } 7695 7696 skip_beacons: 7697 err = nl80211_parse_chandef(rdev, info, ¶ms.chandef); 7698 if (err) 7699 return err; 7700 7701 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms.chandef, 7702 wdev->iftype)) 7703 return -EINVAL; 7704 7705 err = cfg80211_chandef_dfs_required(wdev->wiphy, 7706 ¶ms.chandef, 7707 wdev->iftype); 7708 if (err < 0) 7709 return err; 7710 7711 if (err > 0) { 7712 params.radar_required = true; 7713 if (need_handle_dfs_flag && 7714 !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) { 7715 return -EINVAL; 7716 } 7717 } 7718 7719 if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX]) 7720 params.block_tx = true; 7721 7722 wdev_lock(wdev); 7723 err = rdev_channel_switch(rdev, dev, ¶ms); 7724 wdev_unlock(wdev); 7725 7726 return err; 7727 } 7728 7729 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb, 7730 u32 seq, int flags, 7731 struct cfg80211_registered_device *rdev, 7732 struct wireless_dev *wdev, 7733 struct cfg80211_internal_bss *intbss) 7734 { 7735 struct cfg80211_bss *res = &intbss->pub; 7736 const struct cfg80211_bss_ies *ies; 7737 void *hdr; 7738 struct nlattr *bss; 7739 7740 ASSERT_WDEV_LOCK(wdev); 7741 7742 hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags, 7743 NL80211_CMD_NEW_SCAN_RESULTS); 7744 if (!hdr) 7745 return -1; 7746 7747 genl_dump_check_consistent(cb, hdr); 7748 7749 if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation)) 7750 goto nla_put_failure; 7751 if (wdev->netdev && 7752 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex)) 7753 goto nla_put_failure; 7754 if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 7755 NL80211_ATTR_PAD)) 7756 goto nla_put_failure; 7757 7758 bss = nla_nest_start(msg, NL80211_ATTR_BSS); 7759 if (!bss) 7760 goto nla_put_failure; 7761 if ((!is_zero_ether_addr(res->bssid) && 7762 nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid))) 7763 goto nla_put_failure; 7764 7765 rcu_read_lock(); 7766 /* indicate whether we have probe response data or not */ 7767 if (rcu_access_pointer(res->proberesp_ies) && 7768 nla_put_flag(msg, NL80211_BSS_PRESP_DATA)) 7769 goto fail_unlock_rcu; 7770 7771 /* this pointer prefers to be pointed to probe response data 7772 * but is always valid 7773 */ 7774 ies = rcu_dereference(res->ies); 7775 if (ies) { 7776 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf, 7777 NL80211_BSS_PAD)) 7778 goto fail_unlock_rcu; 7779 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS, 7780 ies->len, ies->data)) 7781 goto fail_unlock_rcu; 7782 } 7783 7784 /* and this pointer is always (unless driver didn't know) beacon data */ 7785 ies = rcu_dereference(res->beacon_ies); 7786 if (ies && ies->from_beacon) { 7787 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf, 7788 NL80211_BSS_PAD)) 7789 goto fail_unlock_rcu; 7790 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES, 7791 ies->len, ies->data)) 7792 goto fail_unlock_rcu; 7793 } 7794 rcu_read_unlock(); 7795 7796 if (res->beacon_interval && 7797 nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval)) 7798 goto nla_put_failure; 7799 if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) || 7800 nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) || 7801 nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) || 7802 nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO, 7803 jiffies_to_msecs(jiffies - intbss->ts))) 7804 goto nla_put_failure; 7805 7806 if (intbss->parent_tsf && 7807 (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF, 7808 intbss->parent_tsf, NL80211_BSS_PAD) || 7809 nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN, 7810 intbss->parent_bssid))) 7811 goto nla_put_failure; 7812 7813 if (intbss->ts_boottime && 7814 nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME, 7815 intbss->ts_boottime, NL80211_BSS_PAD)) 7816 goto nla_put_failure; 7817 7818 switch (rdev->wiphy.signal_type) { 7819 case CFG80211_SIGNAL_TYPE_MBM: 7820 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal)) 7821 goto nla_put_failure; 7822 break; 7823 case CFG80211_SIGNAL_TYPE_UNSPEC: 7824 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal)) 7825 goto nla_put_failure; 7826 break; 7827 default: 7828 break; 7829 } 7830 7831 switch (wdev->iftype) { 7832 case NL80211_IFTYPE_P2P_CLIENT: 7833 case NL80211_IFTYPE_STATION: 7834 if (intbss == wdev->current_bss && 7835 nla_put_u32(msg, NL80211_BSS_STATUS, 7836 NL80211_BSS_STATUS_ASSOCIATED)) 7837 goto nla_put_failure; 7838 break; 7839 case NL80211_IFTYPE_ADHOC: 7840 if (intbss == wdev->current_bss && 7841 nla_put_u32(msg, NL80211_BSS_STATUS, 7842 NL80211_BSS_STATUS_IBSS_JOINED)) 7843 goto nla_put_failure; 7844 break; 7845 default: 7846 break; 7847 } 7848 7849 nla_nest_end(msg, bss); 7850 7851 genlmsg_end(msg, hdr); 7852 return 0; 7853 7854 fail_unlock_rcu: 7855 rcu_read_unlock(); 7856 nla_put_failure: 7857 genlmsg_cancel(msg, hdr); 7858 return -EMSGSIZE; 7859 } 7860 7861 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb) 7862 { 7863 struct cfg80211_registered_device *rdev; 7864 struct cfg80211_internal_bss *scan; 7865 struct wireless_dev *wdev; 7866 int start = cb->args[2], idx = 0; 7867 int err; 7868 7869 rtnl_lock(); 7870 err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev); 7871 if (err) { 7872 rtnl_unlock(); 7873 return err; 7874 } 7875 7876 wdev_lock(wdev); 7877 spin_lock_bh(&rdev->bss_lock); 7878 cfg80211_bss_expire(rdev); 7879 7880 cb->seq = rdev->bss_generation; 7881 7882 list_for_each_entry(scan, &rdev->bss_list, list) { 7883 if (++idx <= start) 7884 continue; 7885 if (nl80211_send_bss(skb, cb, 7886 cb->nlh->nlmsg_seq, NLM_F_MULTI, 7887 rdev, wdev, scan) < 0) { 7888 idx--; 7889 break; 7890 } 7891 } 7892 7893 spin_unlock_bh(&rdev->bss_lock); 7894 wdev_unlock(wdev); 7895 7896 cb->args[2] = idx; 7897 rtnl_unlock(); 7898 7899 return skb->len; 7900 } 7901 7902 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq, 7903 int flags, struct net_device *dev, 7904 bool allow_radio_stats, 7905 struct survey_info *survey) 7906 { 7907 void *hdr; 7908 struct nlattr *infoattr; 7909 7910 /* skip radio stats if userspace didn't request them */ 7911 if (!survey->channel && !allow_radio_stats) 7912 return 0; 7913 7914 hdr = nl80211hdr_put(msg, portid, seq, flags, 7915 NL80211_CMD_NEW_SURVEY_RESULTS); 7916 if (!hdr) 7917 return -ENOMEM; 7918 7919 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 7920 goto nla_put_failure; 7921 7922 infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO); 7923 if (!infoattr) 7924 goto nla_put_failure; 7925 7926 if (survey->channel && 7927 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY, 7928 survey->channel->center_freq)) 7929 goto nla_put_failure; 7930 7931 if ((survey->filled & SURVEY_INFO_NOISE_DBM) && 7932 nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise)) 7933 goto nla_put_failure; 7934 if ((survey->filled & SURVEY_INFO_IN_USE) && 7935 nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE)) 7936 goto nla_put_failure; 7937 if ((survey->filled & SURVEY_INFO_TIME) && 7938 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME, 7939 survey->time, NL80211_SURVEY_INFO_PAD)) 7940 goto nla_put_failure; 7941 if ((survey->filled & SURVEY_INFO_TIME_BUSY) && 7942 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY, 7943 survey->time_busy, NL80211_SURVEY_INFO_PAD)) 7944 goto nla_put_failure; 7945 if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) && 7946 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY, 7947 survey->time_ext_busy, NL80211_SURVEY_INFO_PAD)) 7948 goto nla_put_failure; 7949 if ((survey->filled & SURVEY_INFO_TIME_RX) && 7950 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX, 7951 survey->time_rx, NL80211_SURVEY_INFO_PAD)) 7952 goto nla_put_failure; 7953 if ((survey->filled & SURVEY_INFO_TIME_TX) && 7954 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX, 7955 survey->time_tx, NL80211_SURVEY_INFO_PAD)) 7956 goto nla_put_failure; 7957 if ((survey->filled & SURVEY_INFO_TIME_SCAN) && 7958 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN, 7959 survey->time_scan, NL80211_SURVEY_INFO_PAD)) 7960 goto nla_put_failure; 7961 7962 nla_nest_end(msg, infoattr); 7963 7964 genlmsg_end(msg, hdr); 7965 return 0; 7966 7967 nla_put_failure: 7968 genlmsg_cancel(msg, hdr); 7969 return -EMSGSIZE; 7970 } 7971 7972 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb) 7973 { 7974 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam); 7975 struct survey_info survey; 7976 struct cfg80211_registered_device *rdev; 7977 struct wireless_dev *wdev; 7978 int survey_idx = cb->args[2]; 7979 int res; 7980 bool radio_stats; 7981 7982 rtnl_lock(); 7983 res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev); 7984 if (res) 7985 goto out_err; 7986 7987 /* prepare_wdev_dump parsed the attributes */ 7988 radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS]; 7989 7990 if (!wdev->netdev) { 7991 res = -EINVAL; 7992 goto out_err; 7993 } 7994 7995 if (!rdev->ops->dump_survey) { 7996 res = -EOPNOTSUPP; 7997 goto out_err; 7998 } 7999 8000 while (1) { 8001 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey); 8002 if (res == -ENOENT) 8003 break; 8004 if (res) 8005 goto out_err; 8006 8007 /* don't send disabled channels, but do send non-channel data */ 8008 if (survey.channel && 8009 survey.channel->flags & IEEE80211_CHAN_DISABLED) { 8010 survey_idx++; 8011 continue; 8012 } 8013 8014 if (nl80211_send_survey(skb, 8015 NETLINK_CB(cb->skb).portid, 8016 cb->nlh->nlmsg_seq, NLM_F_MULTI, 8017 wdev->netdev, radio_stats, &survey) < 0) 8018 goto out; 8019 survey_idx++; 8020 } 8021 8022 out: 8023 cb->args[2] = survey_idx; 8024 res = skb->len; 8025 out_err: 8026 rtnl_unlock(); 8027 return res; 8028 } 8029 8030 static bool nl80211_valid_wpa_versions(u32 wpa_versions) 8031 { 8032 return !(wpa_versions & ~(NL80211_WPA_VERSION_1 | 8033 NL80211_WPA_VERSION_2)); 8034 } 8035 8036 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info) 8037 { 8038 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8039 struct net_device *dev = info->user_ptr[1]; 8040 struct ieee80211_channel *chan; 8041 const u8 *bssid, *ssid, *ie = NULL, *auth_data = NULL; 8042 int err, ssid_len, ie_len = 0, auth_data_len = 0; 8043 enum nl80211_auth_type auth_type; 8044 struct key_parse key; 8045 bool local_state_change; 8046 8047 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) 8048 return -EINVAL; 8049 8050 if (!info->attrs[NL80211_ATTR_MAC]) 8051 return -EINVAL; 8052 8053 if (!info->attrs[NL80211_ATTR_AUTH_TYPE]) 8054 return -EINVAL; 8055 8056 if (!info->attrs[NL80211_ATTR_SSID]) 8057 return -EINVAL; 8058 8059 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ]) 8060 return -EINVAL; 8061 8062 err = nl80211_parse_key(info, &key); 8063 if (err) 8064 return err; 8065 8066 if (key.idx >= 0) { 8067 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP) 8068 return -EINVAL; 8069 if (!key.p.key || !key.p.key_len) 8070 return -EINVAL; 8071 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 || 8072 key.p.key_len != WLAN_KEY_LEN_WEP40) && 8073 (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 || 8074 key.p.key_len != WLAN_KEY_LEN_WEP104)) 8075 return -EINVAL; 8076 if (key.idx > 3) 8077 return -EINVAL; 8078 } else { 8079 key.p.key_len = 0; 8080 key.p.key = NULL; 8081 } 8082 8083 if (key.idx >= 0) { 8084 int i; 8085 bool ok = false; 8086 8087 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) { 8088 if (key.p.cipher == rdev->wiphy.cipher_suites[i]) { 8089 ok = true; 8090 break; 8091 } 8092 } 8093 if (!ok) 8094 return -EINVAL; 8095 } 8096 8097 if (!rdev->ops->auth) 8098 return -EOPNOTSUPP; 8099 8100 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 8101 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 8102 return -EOPNOTSUPP; 8103 8104 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 8105 chan = nl80211_get_valid_chan(&rdev->wiphy, 8106 info->attrs[NL80211_ATTR_WIPHY_FREQ]); 8107 if (!chan) 8108 return -EINVAL; 8109 8110 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 8111 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 8112 8113 if (info->attrs[NL80211_ATTR_IE]) { 8114 ie = nla_data(info->attrs[NL80211_ATTR_IE]); 8115 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 8116 } 8117 8118 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]); 8119 if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE)) 8120 return -EINVAL; 8121 8122 if ((auth_type == NL80211_AUTHTYPE_SAE || 8123 auth_type == NL80211_AUTHTYPE_FILS_SK || 8124 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 8125 auth_type == NL80211_AUTHTYPE_FILS_PK) && 8126 !info->attrs[NL80211_ATTR_AUTH_DATA]) 8127 return -EINVAL; 8128 8129 if (info->attrs[NL80211_ATTR_AUTH_DATA]) { 8130 if (auth_type != NL80211_AUTHTYPE_SAE && 8131 auth_type != NL80211_AUTHTYPE_FILS_SK && 8132 auth_type != NL80211_AUTHTYPE_FILS_SK_PFS && 8133 auth_type != NL80211_AUTHTYPE_FILS_PK) 8134 return -EINVAL; 8135 auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]); 8136 auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]); 8137 /* need to include at least Auth Transaction and Status Code */ 8138 if (auth_data_len < 4) 8139 return -EINVAL; 8140 } 8141 8142 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE]; 8143 8144 /* 8145 * Since we no longer track auth state, ignore 8146 * requests to only change local state. 8147 */ 8148 if (local_state_change) 8149 return 0; 8150 8151 wdev_lock(dev->ieee80211_ptr); 8152 err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid, 8153 ssid, ssid_len, ie, ie_len, 8154 key.p.key, key.p.key_len, key.idx, 8155 auth_data, auth_data_len); 8156 wdev_unlock(dev->ieee80211_ptr); 8157 return err; 8158 } 8159 8160 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev, 8161 struct genl_info *info, 8162 struct cfg80211_crypto_settings *settings, 8163 int cipher_limit) 8164 { 8165 memset(settings, 0, sizeof(*settings)); 8166 8167 settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT]; 8168 8169 if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) { 8170 u16 proto; 8171 8172 proto = nla_get_u16( 8173 info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]); 8174 settings->control_port_ethertype = cpu_to_be16(proto); 8175 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) && 8176 proto != ETH_P_PAE) 8177 return -EINVAL; 8178 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]) 8179 settings->control_port_no_encrypt = true; 8180 } else 8181 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE); 8182 8183 if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) { 8184 void *data; 8185 int len, i; 8186 8187 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]); 8188 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]); 8189 settings->n_ciphers_pairwise = len / sizeof(u32); 8190 8191 if (len % sizeof(u32)) 8192 return -EINVAL; 8193 8194 if (settings->n_ciphers_pairwise > cipher_limit) 8195 return -EINVAL; 8196 8197 memcpy(settings->ciphers_pairwise, data, len); 8198 8199 for (i = 0; i < settings->n_ciphers_pairwise; i++) 8200 if (!cfg80211_supported_cipher_suite( 8201 &rdev->wiphy, 8202 settings->ciphers_pairwise[i])) 8203 return -EINVAL; 8204 } 8205 8206 if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) { 8207 settings->cipher_group = 8208 nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]); 8209 if (!cfg80211_supported_cipher_suite(&rdev->wiphy, 8210 settings->cipher_group)) 8211 return -EINVAL; 8212 } 8213 8214 if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) { 8215 settings->wpa_versions = 8216 nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]); 8217 if (!nl80211_valid_wpa_versions(settings->wpa_versions)) 8218 return -EINVAL; 8219 } 8220 8221 if (info->attrs[NL80211_ATTR_AKM_SUITES]) { 8222 void *data; 8223 int len; 8224 8225 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]); 8226 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]); 8227 settings->n_akm_suites = len / sizeof(u32); 8228 8229 if (len % sizeof(u32)) 8230 return -EINVAL; 8231 8232 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES) 8233 return -EINVAL; 8234 8235 memcpy(settings->akm_suites, data, len); 8236 } 8237 8238 if (info->attrs[NL80211_ATTR_PMK]) { 8239 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN) 8240 return -EINVAL; 8241 if (!wiphy_ext_feature_isset(&rdev->wiphy, 8242 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK)) 8243 return -EINVAL; 8244 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]); 8245 } 8246 8247 return 0; 8248 } 8249 8250 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info) 8251 { 8252 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8253 struct net_device *dev = info->user_ptr[1]; 8254 struct ieee80211_channel *chan; 8255 struct cfg80211_assoc_request req = {}; 8256 const u8 *bssid, *ssid; 8257 int err, ssid_len = 0; 8258 8259 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) 8260 return -EINVAL; 8261 8262 if (!info->attrs[NL80211_ATTR_MAC] || 8263 !info->attrs[NL80211_ATTR_SSID] || 8264 !info->attrs[NL80211_ATTR_WIPHY_FREQ]) 8265 return -EINVAL; 8266 8267 if (!rdev->ops->assoc) 8268 return -EOPNOTSUPP; 8269 8270 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 8271 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 8272 return -EOPNOTSUPP; 8273 8274 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 8275 8276 chan = nl80211_get_valid_chan(&rdev->wiphy, 8277 info->attrs[NL80211_ATTR_WIPHY_FREQ]); 8278 if (!chan) 8279 return -EINVAL; 8280 8281 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 8282 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 8283 8284 if (info->attrs[NL80211_ATTR_IE]) { 8285 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 8286 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 8287 } 8288 8289 if (info->attrs[NL80211_ATTR_USE_MFP]) { 8290 enum nl80211_mfp mfp = 8291 nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]); 8292 if (mfp == NL80211_MFP_REQUIRED) 8293 req.use_mfp = true; 8294 else if (mfp != NL80211_MFP_NO) 8295 return -EINVAL; 8296 } 8297 8298 if (info->attrs[NL80211_ATTR_PREV_BSSID]) 8299 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]); 8300 8301 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT])) 8302 req.flags |= ASSOC_REQ_DISABLE_HT; 8303 8304 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 8305 memcpy(&req.ht_capa_mask, 8306 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]), 8307 sizeof(req.ht_capa_mask)); 8308 8309 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) { 8310 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 8311 return -EINVAL; 8312 memcpy(&req.ht_capa, 8313 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]), 8314 sizeof(req.ht_capa)); 8315 } 8316 8317 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT])) 8318 req.flags |= ASSOC_REQ_DISABLE_VHT; 8319 8320 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) 8321 memcpy(&req.vht_capa_mask, 8322 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]), 8323 sizeof(req.vht_capa_mask)); 8324 8325 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) { 8326 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) 8327 return -EINVAL; 8328 memcpy(&req.vht_capa, 8329 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]), 8330 sizeof(req.vht_capa)); 8331 } 8332 8333 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) { 8334 if (!((rdev->wiphy.features & 8335 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) && 8336 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) && 8337 !wiphy_ext_feature_isset(&rdev->wiphy, 8338 NL80211_EXT_FEATURE_RRM)) 8339 return -EINVAL; 8340 req.flags |= ASSOC_REQ_USE_RRM; 8341 } 8342 8343 if (info->attrs[NL80211_ATTR_FILS_KEK]) { 8344 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]); 8345 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]); 8346 if (!info->attrs[NL80211_ATTR_FILS_NONCES]) 8347 return -EINVAL; 8348 req.fils_nonces = 8349 nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]); 8350 } 8351 8352 err = nl80211_crypto_settings(rdev, info, &req.crypto, 1); 8353 if (!err) { 8354 wdev_lock(dev->ieee80211_ptr); 8355 8356 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, 8357 ssid, ssid_len, &req); 8358 8359 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 8360 dev->ieee80211_ptr->conn_owner_nlportid = 8361 info->snd_portid; 8362 memcpy(dev->ieee80211_ptr->disconnect_bssid, 8363 bssid, ETH_ALEN); 8364 } 8365 8366 wdev_unlock(dev->ieee80211_ptr); 8367 } 8368 8369 return err; 8370 } 8371 8372 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info) 8373 { 8374 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8375 struct net_device *dev = info->user_ptr[1]; 8376 const u8 *ie = NULL, *bssid; 8377 int ie_len = 0, err; 8378 u16 reason_code; 8379 bool local_state_change; 8380 8381 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) 8382 return -EINVAL; 8383 8384 if (!info->attrs[NL80211_ATTR_MAC]) 8385 return -EINVAL; 8386 8387 if (!info->attrs[NL80211_ATTR_REASON_CODE]) 8388 return -EINVAL; 8389 8390 if (!rdev->ops->deauth) 8391 return -EOPNOTSUPP; 8392 8393 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 8394 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 8395 return -EOPNOTSUPP; 8396 8397 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 8398 8399 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 8400 if (reason_code == 0) { 8401 /* Reason Code 0 is reserved */ 8402 return -EINVAL; 8403 } 8404 8405 if (info->attrs[NL80211_ATTR_IE]) { 8406 ie = nla_data(info->attrs[NL80211_ATTR_IE]); 8407 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 8408 } 8409 8410 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE]; 8411 8412 wdev_lock(dev->ieee80211_ptr); 8413 err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code, 8414 local_state_change); 8415 wdev_unlock(dev->ieee80211_ptr); 8416 return err; 8417 } 8418 8419 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info) 8420 { 8421 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8422 struct net_device *dev = info->user_ptr[1]; 8423 const u8 *ie = NULL, *bssid; 8424 int ie_len = 0, err; 8425 u16 reason_code; 8426 bool local_state_change; 8427 8428 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) 8429 return -EINVAL; 8430 8431 if (!info->attrs[NL80211_ATTR_MAC]) 8432 return -EINVAL; 8433 8434 if (!info->attrs[NL80211_ATTR_REASON_CODE]) 8435 return -EINVAL; 8436 8437 if (!rdev->ops->disassoc) 8438 return -EOPNOTSUPP; 8439 8440 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 8441 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 8442 return -EOPNOTSUPP; 8443 8444 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 8445 8446 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 8447 if (reason_code == 0) { 8448 /* Reason Code 0 is reserved */ 8449 return -EINVAL; 8450 } 8451 8452 if (info->attrs[NL80211_ATTR_IE]) { 8453 ie = nla_data(info->attrs[NL80211_ATTR_IE]); 8454 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 8455 } 8456 8457 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE]; 8458 8459 wdev_lock(dev->ieee80211_ptr); 8460 err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code, 8461 local_state_change); 8462 wdev_unlock(dev->ieee80211_ptr); 8463 return err; 8464 } 8465 8466 static bool 8467 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev, 8468 int mcast_rate[NUM_NL80211_BANDS], 8469 int rateval) 8470 { 8471 struct wiphy *wiphy = &rdev->wiphy; 8472 bool found = false; 8473 int band, i; 8474 8475 for (band = 0; band < NUM_NL80211_BANDS; band++) { 8476 struct ieee80211_supported_band *sband; 8477 8478 sband = wiphy->bands[band]; 8479 if (!sband) 8480 continue; 8481 8482 for (i = 0; i < sband->n_bitrates; i++) { 8483 if (sband->bitrates[i].bitrate == rateval) { 8484 mcast_rate[band] = i + 1; 8485 found = true; 8486 break; 8487 } 8488 } 8489 } 8490 8491 return found; 8492 } 8493 8494 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info) 8495 { 8496 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8497 struct net_device *dev = info->user_ptr[1]; 8498 struct cfg80211_ibss_params ibss; 8499 struct wiphy *wiphy; 8500 struct cfg80211_cached_keys *connkeys = NULL; 8501 int err; 8502 8503 memset(&ibss, 0, sizeof(ibss)); 8504 8505 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) 8506 return -EINVAL; 8507 8508 if (!info->attrs[NL80211_ATTR_SSID] || 8509 !nla_len(info->attrs[NL80211_ATTR_SSID])) 8510 return -EINVAL; 8511 8512 ibss.beacon_interval = 100; 8513 8514 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) 8515 ibss.beacon_interval = 8516 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]); 8517 8518 err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC, 8519 ibss.beacon_interval); 8520 if (err) 8521 return err; 8522 8523 if (!rdev->ops->join_ibss) 8524 return -EOPNOTSUPP; 8525 8526 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) 8527 return -EOPNOTSUPP; 8528 8529 wiphy = &rdev->wiphy; 8530 8531 if (info->attrs[NL80211_ATTR_MAC]) { 8532 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 8533 8534 if (!is_valid_ether_addr(ibss.bssid)) 8535 return -EINVAL; 8536 } 8537 ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 8538 ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 8539 8540 if (info->attrs[NL80211_ATTR_IE]) { 8541 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 8542 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 8543 } 8544 8545 err = nl80211_parse_chandef(rdev, info, &ibss.chandef); 8546 if (err) 8547 return err; 8548 8549 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef, 8550 NL80211_IFTYPE_ADHOC)) 8551 return -EINVAL; 8552 8553 switch (ibss.chandef.width) { 8554 case NL80211_CHAN_WIDTH_5: 8555 case NL80211_CHAN_WIDTH_10: 8556 case NL80211_CHAN_WIDTH_20_NOHT: 8557 break; 8558 case NL80211_CHAN_WIDTH_20: 8559 case NL80211_CHAN_WIDTH_40: 8560 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)) 8561 return -EINVAL; 8562 break; 8563 case NL80211_CHAN_WIDTH_80: 8564 case NL80211_CHAN_WIDTH_80P80: 8565 case NL80211_CHAN_WIDTH_160: 8566 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)) 8567 return -EINVAL; 8568 if (!wiphy_ext_feature_isset(&rdev->wiphy, 8569 NL80211_EXT_FEATURE_VHT_IBSS)) 8570 return -EINVAL; 8571 break; 8572 default: 8573 return -EINVAL; 8574 } 8575 8576 ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED]; 8577 ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY]; 8578 8579 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) { 8580 u8 *rates = 8581 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 8582 int n_rates = 8583 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 8584 struct ieee80211_supported_band *sband = 8585 wiphy->bands[ibss.chandef.chan->band]; 8586 8587 err = ieee80211_get_ratemask(sband, rates, n_rates, 8588 &ibss.basic_rates); 8589 if (err) 8590 return err; 8591 } 8592 8593 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 8594 memcpy(&ibss.ht_capa_mask, 8595 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]), 8596 sizeof(ibss.ht_capa_mask)); 8597 8598 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) { 8599 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 8600 return -EINVAL; 8601 memcpy(&ibss.ht_capa, 8602 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]), 8603 sizeof(ibss.ht_capa)); 8604 } 8605 8606 if (info->attrs[NL80211_ATTR_MCAST_RATE] && 8607 !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate, 8608 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]))) 8609 return -EINVAL; 8610 8611 if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) { 8612 bool no_ht = false; 8613 8614 connkeys = nl80211_parse_connkeys(rdev, 8615 info->attrs[NL80211_ATTR_KEYS], 8616 &no_ht); 8617 if (IS_ERR(connkeys)) 8618 return PTR_ERR(connkeys); 8619 8620 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) && 8621 no_ht) { 8622 kzfree(connkeys); 8623 return -EINVAL; 8624 } 8625 } 8626 8627 ibss.control_port = 8628 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]); 8629 8630 ibss.userspace_handles_dfs = 8631 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]); 8632 8633 err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys); 8634 if (err) 8635 kzfree(connkeys); 8636 return err; 8637 } 8638 8639 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info) 8640 { 8641 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8642 struct net_device *dev = info->user_ptr[1]; 8643 8644 if (!rdev->ops->leave_ibss) 8645 return -EOPNOTSUPP; 8646 8647 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) 8648 return -EOPNOTSUPP; 8649 8650 return cfg80211_leave_ibss(rdev, dev, false); 8651 } 8652 8653 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info) 8654 { 8655 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8656 struct net_device *dev = info->user_ptr[1]; 8657 int mcast_rate[NUM_NL80211_BANDS]; 8658 u32 nla_rate; 8659 int err; 8660 8661 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC && 8662 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT && 8663 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB) 8664 return -EOPNOTSUPP; 8665 8666 if (!rdev->ops->set_mcast_rate) 8667 return -EOPNOTSUPP; 8668 8669 memset(mcast_rate, 0, sizeof(mcast_rate)); 8670 8671 if (!info->attrs[NL80211_ATTR_MCAST_RATE]) 8672 return -EINVAL; 8673 8674 nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]); 8675 if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate)) 8676 return -EINVAL; 8677 8678 err = rdev_set_mcast_rate(rdev, dev, mcast_rate); 8679 8680 return err; 8681 } 8682 8683 static struct sk_buff * 8684 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev, 8685 struct wireless_dev *wdev, int approxlen, 8686 u32 portid, u32 seq, enum nl80211_commands cmd, 8687 enum nl80211_attrs attr, 8688 const struct nl80211_vendor_cmd_info *info, 8689 gfp_t gfp) 8690 { 8691 struct sk_buff *skb; 8692 void *hdr; 8693 struct nlattr *data; 8694 8695 skb = nlmsg_new(approxlen + 100, gfp); 8696 if (!skb) 8697 return NULL; 8698 8699 hdr = nl80211hdr_put(skb, portid, seq, 0, cmd); 8700 if (!hdr) { 8701 kfree_skb(skb); 8702 return NULL; 8703 } 8704 8705 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx)) 8706 goto nla_put_failure; 8707 8708 if (info) { 8709 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID, 8710 info->vendor_id)) 8711 goto nla_put_failure; 8712 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD, 8713 info->subcmd)) 8714 goto nla_put_failure; 8715 } 8716 8717 if (wdev) { 8718 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV, 8719 wdev_id(wdev), NL80211_ATTR_PAD)) 8720 goto nla_put_failure; 8721 if (wdev->netdev && 8722 nla_put_u32(skb, NL80211_ATTR_IFINDEX, 8723 wdev->netdev->ifindex)) 8724 goto nla_put_failure; 8725 } 8726 8727 data = nla_nest_start(skb, attr); 8728 if (!data) 8729 goto nla_put_failure; 8730 8731 ((void **)skb->cb)[0] = rdev; 8732 ((void **)skb->cb)[1] = hdr; 8733 ((void **)skb->cb)[2] = data; 8734 8735 return skb; 8736 8737 nla_put_failure: 8738 kfree_skb(skb); 8739 return NULL; 8740 } 8741 8742 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy, 8743 struct wireless_dev *wdev, 8744 enum nl80211_commands cmd, 8745 enum nl80211_attrs attr, 8746 int vendor_event_idx, 8747 int approxlen, gfp_t gfp) 8748 { 8749 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 8750 const struct nl80211_vendor_cmd_info *info; 8751 8752 switch (cmd) { 8753 case NL80211_CMD_TESTMODE: 8754 if (WARN_ON(vendor_event_idx != -1)) 8755 return NULL; 8756 info = NULL; 8757 break; 8758 case NL80211_CMD_VENDOR: 8759 if (WARN_ON(vendor_event_idx < 0 || 8760 vendor_event_idx >= wiphy->n_vendor_events)) 8761 return NULL; 8762 info = &wiphy->vendor_events[vendor_event_idx]; 8763 break; 8764 default: 8765 WARN_ON(1); 8766 return NULL; 8767 } 8768 8769 return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, 0, 0, 8770 cmd, attr, info, gfp); 8771 } 8772 EXPORT_SYMBOL(__cfg80211_alloc_event_skb); 8773 8774 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp) 8775 { 8776 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0]; 8777 void *hdr = ((void **)skb->cb)[1]; 8778 struct nlattr *data = ((void **)skb->cb)[2]; 8779 enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE; 8780 8781 /* clear CB data for netlink core to own from now on */ 8782 memset(skb->cb, 0, sizeof(skb->cb)); 8783 8784 nla_nest_end(skb, data); 8785 genlmsg_end(skb, hdr); 8786 8787 if (data->nla_type == NL80211_ATTR_VENDOR_DATA) 8788 mcgrp = NL80211_MCGRP_VENDOR; 8789 8790 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0, 8791 mcgrp, gfp); 8792 } 8793 EXPORT_SYMBOL(__cfg80211_send_event_skb); 8794 8795 #ifdef CONFIG_NL80211_TESTMODE 8796 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info) 8797 { 8798 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8799 struct wireless_dev *wdev = 8800 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs); 8801 int err; 8802 8803 if (!rdev->ops->testmode_cmd) 8804 return -EOPNOTSUPP; 8805 8806 if (IS_ERR(wdev)) { 8807 err = PTR_ERR(wdev); 8808 if (err != -EINVAL) 8809 return err; 8810 wdev = NULL; 8811 } else if (wdev->wiphy != &rdev->wiphy) { 8812 return -EINVAL; 8813 } 8814 8815 if (!info->attrs[NL80211_ATTR_TESTDATA]) 8816 return -EINVAL; 8817 8818 rdev->cur_cmd_info = info; 8819 err = rdev_testmode_cmd(rdev, wdev, 8820 nla_data(info->attrs[NL80211_ATTR_TESTDATA]), 8821 nla_len(info->attrs[NL80211_ATTR_TESTDATA])); 8822 rdev->cur_cmd_info = NULL; 8823 8824 return err; 8825 } 8826 8827 static int nl80211_testmode_dump(struct sk_buff *skb, 8828 struct netlink_callback *cb) 8829 { 8830 struct cfg80211_registered_device *rdev; 8831 int err; 8832 long phy_idx; 8833 void *data = NULL; 8834 int data_len = 0; 8835 8836 rtnl_lock(); 8837 8838 if (cb->args[0]) { 8839 /* 8840 * 0 is a valid index, but not valid for args[0], 8841 * so we need to offset by 1. 8842 */ 8843 phy_idx = cb->args[0] - 1; 8844 8845 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx); 8846 if (!rdev) { 8847 err = -ENOENT; 8848 goto out_err; 8849 } 8850 } else { 8851 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam); 8852 8853 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, 8854 attrbuf, nl80211_fam.maxattr, 8855 nl80211_policy, NULL); 8856 if (err) 8857 goto out_err; 8858 8859 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf); 8860 if (IS_ERR(rdev)) { 8861 err = PTR_ERR(rdev); 8862 goto out_err; 8863 } 8864 phy_idx = rdev->wiphy_idx; 8865 8866 if (attrbuf[NL80211_ATTR_TESTDATA]) 8867 cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA]; 8868 } 8869 8870 if (cb->args[1]) { 8871 data = nla_data((void *)cb->args[1]); 8872 data_len = nla_len((void *)cb->args[1]); 8873 } 8874 8875 if (!rdev->ops->testmode_dump) { 8876 err = -EOPNOTSUPP; 8877 goto out_err; 8878 } 8879 8880 while (1) { 8881 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid, 8882 cb->nlh->nlmsg_seq, NLM_F_MULTI, 8883 NL80211_CMD_TESTMODE); 8884 struct nlattr *tmdata; 8885 8886 if (!hdr) 8887 break; 8888 8889 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) { 8890 genlmsg_cancel(skb, hdr); 8891 break; 8892 } 8893 8894 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA); 8895 if (!tmdata) { 8896 genlmsg_cancel(skb, hdr); 8897 break; 8898 } 8899 err = rdev_testmode_dump(rdev, skb, cb, data, data_len); 8900 nla_nest_end(skb, tmdata); 8901 8902 if (err == -ENOBUFS || err == -ENOENT) { 8903 genlmsg_cancel(skb, hdr); 8904 break; 8905 } else if (err) { 8906 genlmsg_cancel(skb, hdr); 8907 goto out_err; 8908 } 8909 8910 genlmsg_end(skb, hdr); 8911 } 8912 8913 err = skb->len; 8914 /* see above */ 8915 cb->args[0] = phy_idx + 1; 8916 out_err: 8917 rtnl_unlock(); 8918 return err; 8919 } 8920 #endif 8921 8922 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info) 8923 { 8924 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8925 struct net_device *dev = info->user_ptr[1]; 8926 struct cfg80211_connect_params connect; 8927 struct wiphy *wiphy; 8928 struct cfg80211_cached_keys *connkeys = NULL; 8929 int err; 8930 8931 memset(&connect, 0, sizeof(connect)); 8932 8933 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) 8934 return -EINVAL; 8935 8936 if (!info->attrs[NL80211_ATTR_SSID] || 8937 !nla_len(info->attrs[NL80211_ATTR_SSID])) 8938 return -EINVAL; 8939 8940 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) { 8941 connect.auth_type = 8942 nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]); 8943 if (!nl80211_valid_auth_type(rdev, connect.auth_type, 8944 NL80211_CMD_CONNECT)) 8945 return -EINVAL; 8946 } else 8947 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC; 8948 8949 connect.privacy = info->attrs[NL80211_ATTR_PRIVACY]; 8950 8951 if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] && 8952 !wiphy_ext_feature_isset(&rdev->wiphy, 8953 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X)) 8954 return -EINVAL; 8955 connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS]; 8956 8957 err = nl80211_crypto_settings(rdev, info, &connect.crypto, 8958 NL80211_MAX_NR_CIPHER_SUITES); 8959 if (err) 8960 return err; 8961 8962 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 8963 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 8964 return -EOPNOTSUPP; 8965 8966 wiphy = &rdev->wiphy; 8967 8968 connect.bg_scan_period = -1; 8969 if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] && 8970 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) { 8971 connect.bg_scan_period = 8972 nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]); 8973 } 8974 8975 if (info->attrs[NL80211_ATTR_MAC]) 8976 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 8977 else if (info->attrs[NL80211_ATTR_MAC_HINT]) 8978 connect.bssid_hint = 8979 nla_data(info->attrs[NL80211_ATTR_MAC_HINT]); 8980 connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 8981 connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 8982 8983 if (info->attrs[NL80211_ATTR_IE]) { 8984 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 8985 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 8986 } 8987 8988 if (info->attrs[NL80211_ATTR_USE_MFP]) { 8989 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]); 8990 if (connect.mfp == NL80211_MFP_OPTIONAL && 8991 !wiphy_ext_feature_isset(&rdev->wiphy, 8992 NL80211_EXT_FEATURE_MFP_OPTIONAL)) 8993 return -EOPNOTSUPP; 8994 8995 if (connect.mfp != NL80211_MFP_REQUIRED && 8996 connect.mfp != NL80211_MFP_NO && 8997 connect.mfp != NL80211_MFP_OPTIONAL) 8998 return -EINVAL; 8999 } else { 9000 connect.mfp = NL80211_MFP_NO; 9001 } 9002 9003 if (info->attrs[NL80211_ATTR_PREV_BSSID]) 9004 connect.prev_bssid = 9005 nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]); 9006 9007 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 9008 connect.channel = nl80211_get_valid_chan( 9009 wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]); 9010 if (!connect.channel) 9011 return -EINVAL; 9012 } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) { 9013 connect.channel_hint = nl80211_get_valid_chan( 9014 wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]); 9015 if (!connect.channel_hint) 9016 return -EINVAL; 9017 } 9018 9019 if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) { 9020 connkeys = nl80211_parse_connkeys(rdev, 9021 info->attrs[NL80211_ATTR_KEYS], NULL); 9022 if (IS_ERR(connkeys)) 9023 return PTR_ERR(connkeys); 9024 } 9025 9026 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT])) 9027 connect.flags |= ASSOC_REQ_DISABLE_HT; 9028 9029 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 9030 memcpy(&connect.ht_capa_mask, 9031 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]), 9032 sizeof(connect.ht_capa_mask)); 9033 9034 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) { 9035 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) { 9036 kzfree(connkeys); 9037 return -EINVAL; 9038 } 9039 memcpy(&connect.ht_capa, 9040 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]), 9041 sizeof(connect.ht_capa)); 9042 } 9043 9044 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT])) 9045 connect.flags |= ASSOC_REQ_DISABLE_VHT; 9046 9047 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) 9048 memcpy(&connect.vht_capa_mask, 9049 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]), 9050 sizeof(connect.vht_capa_mask)); 9051 9052 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) { 9053 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) { 9054 kzfree(connkeys); 9055 return -EINVAL; 9056 } 9057 memcpy(&connect.vht_capa, 9058 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]), 9059 sizeof(connect.vht_capa)); 9060 } 9061 9062 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) { 9063 if (!((rdev->wiphy.features & 9064 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) && 9065 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) && 9066 !wiphy_ext_feature_isset(&rdev->wiphy, 9067 NL80211_EXT_FEATURE_RRM)) { 9068 kzfree(connkeys); 9069 return -EINVAL; 9070 } 9071 connect.flags |= ASSOC_REQ_USE_RRM; 9072 } 9073 9074 connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]); 9075 if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) { 9076 kzfree(connkeys); 9077 return -EOPNOTSUPP; 9078 } 9079 9080 if (info->attrs[NL80211_ATTR_BSS_SELECT]) { 9081 /* bss selection makes no sense if bssid is set */ 9082 if (connect.bssid) { 9083 kzfree(connkeys); 9084 return -EINVAL; 9085 } 9086 9087 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT], 9088 wiphy, &connect.bss_select); 9089 if (err) { 9090 kzfree(connkeys); 9091 return err; 9092 } 9093 } 9094 9095 if (wiphy_ext_feature_isset(&rdev->wiphy, 9096 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) && 9097 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] && 9098 info->attrs[NL80211_ATTR_FILS_ERP_REALM] && 9099 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] && 9100 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 9101 connect.fils_erp_username = 9102 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 9103 connect.fils_erp_username_len = 9104 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 9105 connect.fils_erp_realm = 9106 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 9107 connect.fils_erp_realm_len = 9108 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 9109 connect.fils_erp_next_seq_num = 9110 nla_get_u16( 9111 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]); 9112 connect.fils_erp_rrk = 9113 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 9114 connect.fils_erp_rrk_len = 9115 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 9116 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] || 9117 info->attrs[NL80211_ATTR_FILS_ERP_REALM] || 9118 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] || 9119 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 9120 kzfree(connkeys); 9121 return -EINVAL; 9122 } 9123 9124 wdev_lock(dev->ieee80211_ptr); 9125 9126 err = cfg80211_connect(rdev, dev, &connect, connkeys, 9127 connect.prev_bssid); 9128 if (err) 9129 kzfree(connkeys); 9130 9131 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 9132 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid; 9133 if (connect.bssid) 9134 memcpy(dev->ieee80211_ptr->disconnect_bssid, 9135 connect.bssid, ETH_ALEN); 9136 else 9137 memset(dev->ieee80211_ptr->disconnect_bssid, 9138 0, ETH_ALEN); 9139 } 9140 9141 wdev_unlock(dev->ieee80211_ptr); 9142 9143 return err; 9144 } 9145 9146 static int nl80211_update_connect_params(struct sk_buff *skb, 9147 struct genl_info *info) 9148 { 9149 struct cfg80211_connect_params connect = {}; 9150 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9151 struct net_device *dev = info->user_ptr[1]; 9152 struct wireless_dev *wdev = dev->ieee80211_ptr; 9153 u32 changed = 0; 9154 int ret; 9155 9156 if (!rdev->ops->update_connect_params) 9157 return -EOPNOTSUPP; 9158 9159 if (info->attrs[NL80211_ATTR_IE]) { 9160 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) 9161 return -EINVAL; 9162 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 9163 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 9164 changed |= UPDATE_ASSOC_IES; 9165 } 9166 9167 wdev_lock(dev->ieee80211_ptr); 9168 if (!wdev->current_bss) 9169 ret = -ENOLINK; 9170 else 9171 ret = rdev_update_connect_params(rdev, dev, &connect, changed); 9172 wdev_unlock(dev->ieee80211_ptr); 9173 9174 return ret; 9175 } 9176 9177 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info) 9178 { 9179 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9180 struct net_device *dev = info->user_ptr[1]; 9181 u16 reason; 9182 int ret; 9183 9184 if (!info->attrs[NL80211_ATTR_REASON_CODE]) 9185 reason = WLAN_REASON_DEAUTH_LEAVING; 9186 else 9187 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 9188 9189 if (reason == 0) 9190 return -EINVAL; 9191 9192 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 9193 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 9194 return -EOPNOTSUPP; 9195 9196 wdev_lock(dev->ieee80211_ptr); 9197 ret = cfg80211_disconnect(rdev, dev, reason, true); 9198 wdev_unlock(dev->ieee80211_ptr); 9199 return ret; 9200 } 9201 9202 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info) 9203 { 9204 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9205 struct net *net; 9206 int err; 9207 9208 if (info->attrs[NL80211_ATTR_PID]) { 9209 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]); 9210 9211 net = get_net_ns_by_pid(pid); 9212 } else if (info->attrs[NL80211_ATTR_NETNS_FD]) { 9213 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]); 9214 9215 net = get_net_ns_by_fd(fd); 9216 } else { 9217 return -EINVAL; 9218 } 9219 9220 if (IS_ERR(net)) 9221 return PTR_ERR(net); 9222 9223 err = 0; 9224 9225 /* check if anything to do */ 9226 if (!net_eq(wiphy_net(&rdev->wiphy), net)) 9227 err = cfg80211_switch_netns(rdev, net); 9228 9229 put_net(net); 9230 return err; 9231 } 9232 9233 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info) 9234 { 9235 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9236 int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev, 9237 struct cfg80211_pmksa *pmksa) = NULL; 9238 struct net_device *dev = info->user_ptr[1]; 9239 struct cfg80211_pmksa pmksa; 9240 9241 memset(&pmksa, 0, sizeof(struct cfg80211_pmksa)); 9242 9243 if (!info->attrs[NL80211_ATTR_PMKID]) 9244 return -EINVAL; 9245 9246 pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]); 9247 9248 if (info->attrs[NL80211_ATTR_MAC]) { 9249 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 9250 } else if (info->attrs[NL80211_ATTR_SSID] && 9251 info->attrs[NL80211_ATTR_FILS_CACHE_ID] && 9252 (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA || 9253 info->attrs[NL80211_ATTR_PMK])) { 9254 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 9255 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 9256 pmksa.cache_id = 9257 nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]); 9258 } else { 9259 return -EINVAL; 9260 } 9261 if (info->attrs[NL80211_ATTR_PMK]) { 9262 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]); 9263 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]); 9264 } 9265 9266 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 9267 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 9268 return -EOPNOTSUPP; 9269 9270 switch (info->genlhdr->cmd) { 9271 case NL80211_CMD_SET_PMKSA: 9272 rdev_ops = rdev->ops->set_pmksa; 9273 break; 9274 case NL80211_CMD_DEL_PMKSA: 9275 rdev_ops = rdev->ops->del_pmksa; 9276 break; 9277 default: 9278 WARN_ON(1); 9279 break; 9280 } 9281 9282 if (!rdev_ops) 9283 return -EOPNOTSUPP; 9284 9285 return rdev_ops(&rdev->wiphy, dev, &pmksa); 9286 } 9287 9288 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info) 9289 { 9290 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9291 struct net_device *dev = info->user_ptr[1]; 9292 9293 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 9294 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 9295 return -EOPNOTSUPP; 9296 9297 if (!rdev->ops->flush_pmksa) 9298 return -EOPNOTSUPP; 9299 9300 return rdev_flush_pmksa(rdev, dev); 9301 } 9302 9303 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info) 9304 { 9305 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9306 struct net_device *dev = info->user_ptr[1]; 9307 u8 action_code, dialog_token; 9308 u32 peer_capability = 0; 9309 u16 status_code; 9310 u8 *peer; 9311 bool initiator; 9312 9313 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) || 9314 !rdev->ops->tdls_mgmt) 9315 return -EOPNOTSUPP; 9316 9317 if (!info->attrs[NL80211_ATTR_TDLS_ACTION] || 9318 !info->attrs[NL80211_ATTR_STATUS_CODE] || 9319 !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] || 9320 !info->attrs[NL80211_ATTR_IE] || 9321 !info->attrs[NL80211_ATTR_MAC]) 9322 return -EINVAL; 9323 9324 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 9325 action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]); 9326 status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]); 9327 dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]); 9328 initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]); 9329 if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]) 9330 peer_capability = 9331 nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]); 9332 9333 return rdev_tdls_mgmt(rdev, dev, peer, action_code, 9334 dialog_token, status_code, peer_capability, 9335 initiator, 9336 nla_data(info->attrs[NL80211_ATTR_IE]), 9337 nla_len(info->attrs[NL80211_ATTR_IE])); 9338 } 9339 9340 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info) 9341 { 9342 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9343 struct net_device *dev = info->user_ptr[1]; 9344 enum nl80211_tdls_operation operation; 9345 u8 *peer; 9346 9347 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) || 9348 !rdev->ops->tdls_oper) 9349 return -EOPNOTSUPP; 9350 9351 if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] || 9352 !info->attrs[NL80211_ATTR_MAC]) 9353 return -EINVAL; 9354 9355 operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]); 9356 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 9357 9358 return rdev_tdls_oper(rdev, dev, peer, operation); 9359 } 9360 9361 static int nl80211_remain_on_channel(struct sk_buff *skb, 9362 struct genl_info *info) 9363 { 9364 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9365 struct wireless_dev *wdev = info->user_ptr[1]; 9366 struct cfg80211_chan_def chandef; 9367 const struct cfg80211_chan_def *compat_chandef; 9368 struct sk_buff *msg; 9369 void *hdr; 9370 u64 cookie; 9371 u32 duration; 9372 int err; 9373 9374 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] || 9375 !info->attrs[NL80211_ATTR_DURATION]) 9376 return -EINVAL; 9377 9378 duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]); 9379 9380 if (!rdev->ops->remain_on_channel || 9381 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)) 9382 return -EOPNOTSUPP; 9383 9384 /* 9385 * We should be on that channel for at least a minimum amount of 9386 * time (10ms) but no longer than the driver supports. 9387 */ 9388 if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME || 9389 duration > rdev->wiphy.max_remain_on_channel_duration) 9390 return -EINVAL; 9391 9392 err = nl80211_parse_chandef(rdev, info, &chandef); 9393 if (err) 9394 return err; 9395 9396 wdev_lock(wdev); 9397 if (!cfg80211_off_channel_oper_allowed(wdev) && 9398 !cfg80211_chandef_identical(&wdev->chandef, &chandef)) { 9399 compat_chandef = cfg80211_chandef_compatible(&wdev->chandef, 9400 &chandef); 9401 if (compat_chandef != &chandef) { 9402 wdev_unlock(wdev); 9403 return -EBUSY; 9404 } 9405 } 9406 wdev_unlock(wdev); 9407 9408 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 9409 if (!msg) 9410 return -ENOMEM; 9411 9412 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 9413 NL80211_CMD_REMAIN_ON_CHANNEL); 9414 if (!hdr) { 9415 err = -ENOBUFS; 9416 goto free_msg; 9417 } 9418 9419 err = rdev_remain_on_channel(rdev, wdev, chandef.chan, 9420 duration, &cookie); 9421 9422 if (err) 9423 goto free_msg; 9424 9425 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 9426 NL80211_ATTR_PAD)) 9427 goto nla_put_failure; 9428 9429 genlmsg_end(msg, hdr); 9430 9431 return genlmsg_reply(msg, info); 9432 9433 nla_put_failure: 9434 err = -ENOBUFS; 9435 free_msg: 9436 nlmsg_free(msg); 9437 return err; 9438 } 9439 9440 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb, 9441 struct genl_info *info) 9442 { 9443 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9444 struct wireless_dev *wdev = info->user_ptr[1]; 9445 u64 cookie; 9446 9447 if (!info->attrs[NL80211_ATTR_COOKIE]) 9448 return -EINVAL; 9449 9450 if (!rdev->ops->cancel_remain_on_channel) 9451 return -EOPNOTSUPP; 9452 9453 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 9454 9455 return rdev_cancel_remain_on_channel(rdev, wdev, cookie); 9456 } 9457 9458 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb, 9459 struct genl_info *info) 9460 { 9461 struct cfg80211_bitrate_mask mask; 9462 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9463 struct net_device *dev = info->user_ptr[1]; 9464 int err; 9465 9466 if (!rdev->ops->set_bitrate_mask) 9467 return -EOPNOTSUPP; 9468 9469 err = nl80211_parse_tx_bitrate_mask(info, &mask); 9470 if (err) 9471 return err; 9472 9473 return rdev_set_bitrate_mask(rdev, dev, NULL, &mask); 9474 } 9475 9476 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info) 9477 { 9478 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9479 struct wireless_dev *wdev = info->user_ptr[1]; 9480 u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION; 9481 9482 if (!info->attrs[NL80211_ATTR_FRAME_MATCH]) 9483 return -EINVAL; 9484 9485 if (info->attrs[NL80211_ATTR_FRAME_TYPE]) 9486 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]); 9487 9488 switch (wdev->iftype) { 9489 case NL80211_IFTYPE_STATION: 9490 case NL80211_IFTYPE_ADHOC: 9491 case NL80211_IFTYPE_P2P_CLIENT: 9492 case NL80211_IFTYPE_AP: 9493 case NL80211_IFTYPE_AP_VLAN: 9494 case NL80211_IFTYPE_MESH_POINT: 9495 case NL80211_IFTYPE_P2P_GO: 9496 case NL80211_IFTYPE_P2P_DEVICE: 9497 break; 9498 case NL80211_IFTYPE_NAN: 9499 default: 9500 return -EOPNOTSUPP; 9501 } 9502 9503 /* not much point in registering if we can't reply */ 9504 if (!rdev->ops->mgmt_tx) 9505 return -EOPNOTSUPP; 9506 9507 return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type, 9508 nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]), 9509 nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH])); 9510 } 9511 9512 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info) 9513 { 9514 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9515 struct wireless_dev *wdev = info->user_ptr[1]; 9516 struct cfg80211_chan_def chandef; 9517 int err; 9518 void *hdr = NULL; 9519 u64 cookie; 9520 struct sk_buff *msg = NULL; 9521 struct cfg80211_mgmt_tx_params params = { 9522 .dont_wait_for_ack = 9523 info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK], 9524 }; 9525 9526 if (!info->attrs[NL80211_ATTR_FRAME]) 9527 return -EINVAL; 9528 9529 if (!rdev->ops->mgmt_tx) 9530 return -EOPNOTSUPP; 9531 9532 switch (wdev->iftype) { 9533 case NL80211_IFTYPE_P2P_DEVICE: 9534 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ]) 9535 return -EINVAL; 9536 case NL80211_IFTYPE_STATION: 9537 case NL80211_IFTYPE_ADHOC: 9538 case NL80211_IFTYPE_P2P_CLIENT: 9539 case NL80211_IFTYPE_AP: 9540 case NL80211_IFTYPE_AP_VLAN: 9541 case NL80211_IFTYPE_MESH_POINT: 9542 case NL80211_IFTYPE_P2P_GO: 9543 break; 9544 case NL80211_IFTYPE_NAN: 9545 default: 9546 return -EOPNOTSUPP; 9547 } 9548 9549 if (info->attrs[NL80211_ATTR_DURATION]) { 9550 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX)) 9551 return -EINVAL; 9552 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]); 9553 9554 /* 9555 * We should wait on the channel for at least a minimum amount 9556 * of time (10ms) but no longer than the driver supports. 9557 */ 9558 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME || 9559 params.wait > rdev->wiphy.max_remain_on_channel_duration) 9560 return -EINVAL; 9561 } 9562 9563 params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK]; 9564 9565 if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX)) 9566 return -EINVAL; 9567 9568 params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]); 9569 9570 /* get the channel if any has been specified, otherwise pass NULL to 9571 * the driver. The latter will use the current one 9572 */ 9573 chandef.chan = NULL; 9574 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 9575 err = nl80211_parse_chandef(rdev, info, &chandef); 9576 if (err) 9577 return err; 9578 } 9579 9580 if (!chandef.chan && params.offchan) 9581 return -EINVAL; 9582 9583 wdev_lock(wdev); 9584 if (params.offchan && !cfg80211_off_channel_oper_allowed(wdev)) { 9585 wdev_unlock(wdev); 9586 return -EBUSY; 9587 } 9588 wdev_unlock(wdev); 9589 9590 params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]); 9591 params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]); 9592 9593 if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) { 9594 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]); 9595 int i; 9596 9597 if (len % sizeof(u16)) 9598 return -EINVAL; 9599 9600 params.n_csa_offsets = len / sizeof(u16); 9601 params.csa_offsets = 9602 nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]); 9603 9604 /* check that all the offsets fit the frame */ 9605 for (i = 0; i < params.n_csa_offsets; i++) { 9606 if (params.csa_offsets[i] >= params.len) 9607 return -EINVAL; 9608 } 9609 } 9610 9611 if (!params.dont_wait_for_ack) { 9612 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 9613 if (!msg) 9614 return -ENOMEM; 9615 9616 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 9617 NL80211_CMD_FRAME); 9618 if (!hdr) { 9619 err = -ENOBUFS; 9620 goto free_msg; 9621 } 9622 } 9623 9624 params.chan = chandef.chan; 9625 err = cfg80211_mlme_mgmt_tx(rdev, wdev, ¶ms, &cookie); 9626 if (err) 9627 goto free_msg; 9628 9629 if (msg) { 9630 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 9631 NL80211_ATTR_PAD)) 9632 goto nla_put_failure; 9633 9634 genlmsg_end(msg, hdr); 9635 return genlmsg_reply(msg, info); 9636 } 9637 9638 return 0; 9639 9640 nla_put_failure: 9641 err = -ENOBUFS; 9642 free_msg: 9643 nlmsg_free(msg); 9644 return err; 9645 } 9646 9647 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info) 9648 { 9649 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9650 struct wireless_dev *wdev = info->user_ptr[1]; 9651 u64 cookie; 9652 9653 if (!info->attrs[NL80211_ATTR_COOKIE]) 9654 return -EINVAL; 9655 9656 if (!rdev->ops->mgmt_tx_cancel_wait) 9657 return -EOPNOTSUPP; 9658 9659 switch (wdev->iftype) { 9660 case NL80211_IFTYPE_STATION: 9661 case NL80211_IFTYPE_ADHOC: 9662 case NL80211_IFTYPE_P2P_CLIENT: 9663 case NL80211_IFTYPE_AP: 9664 case NL80211_IFTYPE_AP_VLAN: 9665 case NL80211_IFTYPE_P2P_GO: 9666 case NL80211_IFTYPE_P2P_DEVICE: 9667 break; 9668 case NL80211_IFTYPE_NAN: 9669 default: 9670 return -EOPNOTSUPP; 9671 } 9672 9673 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 9674 9675 return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie); 9676 } 9677 9678 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info) 9679 { 9680 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9681 struct wireless_dev *wdev; 9682 struct net_device *dev = info->user_ptr[1]; 9683 u8 ps_state; 9684 bool state; 9685 int err; 9686 9687 if (!info->attrs[NL80211_ATTR_PS_STATE]) 9688 return -EINVAL; 9689 9690 ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]); 9691 9692 if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED) 9693 return -EINVAL; 9694 9695 wdev = dev->ieee80211_ptr; 9696 9697 if (!rdev->ops->set_power_mgmt) 9698 return -EOPNOTSUPP; 9699 9700 state = (ps_state == NL80211_PS_ENABLED) ? true : false; 9701 9702 if (state == wdev->ps) 9703 return 0; 9704 9705 err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout); 9706 if (!err) 9707 wdev->ps = state; 9708 return err; 9709 } 9710 9711 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info) 9712 { 9713 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9714 enum nl80211_ps_state ps_state; 9715 struct wireless_dev *wdev; 9716 struct net_device *dev = info->user_ptr[1]; 9717 struct sk_buff *msg; 9718 void *hdr; 9719 int err; 9720 9721 wdev = dev->ieee80211_ptr; 9722 9723 if (!rdev->ops->set_power_mgmt) 9724 return -EOPNOTSUPP; 9725 9726 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 9727 if (!msg) 9728 return -ENOMEM; 9729 9730 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 9731 NL80211_CMD_GET_POWER_SAVE); 9732 if (!hdr) { 9733 err = -ENOBUFS; 9734 goto free_msg; 9735 } 9736 9737 if (wdev->ps) 9738 ps_state = NL80211_PS_ENABLED; 9739 else 9740 ps_state = NL80211_PS_DISABLED; 9741 9742 if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state)) 9743 goto nla_put_failure; 9744 9745 genlmsg_end(msg, hdr); 9746 return genlmsg_reply(msg, info); 9747 9748 nla_put_failure: 9749 err = -ENOBUFS; 9750 free_msg: 9751 nlmsg_free(msg); 9752 return err; 9753 } 9754 9755 static const struct nla_policy 9756 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = { 9757 [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY }, 9758 [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 }, 9759 [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 }, 9760 [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 }, 9761 [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 }, 9762 [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 }, 9763 [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 }, 9764 }; 9765 9766 static int nl80211_set_cqm_txe(struct genl_info *info, 9767 u32 rate, u32 pkts, u32 intvl) 9768 { 9769 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9770 struct net_device *dev = info->user_ptr[1]; 9771 struct wireless_dev *wdev = dev->ieee80211_ptr; 9772 9773 if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL) 9774 return -EINVAL; 9775 9776 if (!rdev->ops->set_cqm_txe_config) 9777 return -EOPNOTSUPP; 9778 9779 if (wdev->iftype != NL80211_IFTYPE_STATION && 9780 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 9781 return -EOPNOTSUPP; 9782 9783 return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl); 9784 } 9785 9786 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev, 9787 struct net_device *dev) 9788 { 9789 struct wireless_dev *wdev = dev->ieee80211_ptr; 9790 s32 last, low, high; 9791 u32 hyst; 9792 int i, n; 9793 int err; 9794 9795 /* RSSI reporting disabled? */ 9796 if (!wdev->cqm_config) 9797 return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0); 9798 9799 /* 9800 * Obtain current RSSI value if possible, if not and no RSSI threshold 9801 * event has been received yet, we should receive an event after a 9802 * connection is established and enough beacons received to calculate 9803 * the average. 9804 */ 9805 if (!wdev->cqm_config->last_rssi_event_value && wdev->current_bss && 9806 rdev->ops->get_station) { 9807 struct station_info sinfo; 9808 u8 *mac_addr; 9809 9810 mac_addr = wdev->current_bss->pub.bssid; 9811 9812 err = rdev_get_station(rdev, dev, mac_addr, &sinfo); 9813 if (err) 9814 return err; 9815 9816 if (sinfo.filled & BIT(NL80211_STA_INFO_BEACON_SIGNAL_AVG)) 9817 wdev->cqm_config->last_rssi_event_value = 9818 (s8) sinfo.rx_beacon_signal_avg; 9819 } 9820 9821 last = wdev->cqm_config->last_rssi_event_value; 9822 hyst = wdev->cqm_config->rssi_hyst; 9823 n = wdev->cqm_config->n_rssi_thresholds; 9824 9825 for (i = 0; i < n; i++) 9826 if (last < wdev->cqm_config->rssi_thresholds[i]) 9827 break; 9828 9829 low = i > 0 ? 9830 (wdev->cqm_config->rssi_thresholds[i - 1] - hyst) : S32_MIN; 9831 high = i < n ? 9832 (wdev->cqm_config->rssi_thresholds[i] + hyst - 1) : S32_MAX; 9833 9834 return rdev_set_cqm_rssi_range_config(rdev, dev, low, high); 9835 } 9836 9837 static int nl80211_set_cqm_rssi(struct genl_info *info, 9838 const s32 *thresholds, int n_thresholds, 9839 u32 hysteresis) 9840 { 9841 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9842 struct net_device *dev = info->user_ptr[1]; 9843 struct wireless_dev *wdev = dev->ieee80211_ptr; 9844 int i, err; 9845 s32 prev = S32_MIN; 9846 9847 /* Check all values negative and sorted */ 9848 for (i = 0; i < n_thresholds; i++) { 9849 if (thresholds[i] > 0 || thresholds[i] <= prev) 9850 return -EINVAL; 9851 9852 prev = thresholds[i]; 9853 } 9854 9855 if (wdev->iftype != NL80211_IFTYPE_STATION && 9856 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 9857 return -EOPNOTSUPP; 9858 9859 wdev_lock(wdev); 9860 cfg80211_cqm_config_free(wdev); 9861 wdev_unlock(wdev); 9862 9863 if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) { 9864 if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */ 9865 return rdev_set_cqm_rssi_config(rdev, dev, 0, 0); 9866 9867 return rdev_set_cqm_rssi_config(rdev, dev, 9868 thresholds[0], hysteresis); 9869 } 9870 9871 if (!wiphy_ext_feature_isset(&rdev->wiphy, 9872 NL80211_EXT_FEATURE_CQM_RSSI_LIST)) 9873 return -EOPNOTSUPP; 9874 9875 if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */ 9876 n_thresholds = 0; 9877 9878 wdev_lock(wdev); 9879 if (n_thresholds) { 9880 struct cfg80211_cqm_config *cqm_config; 9881 9882 cqm_config = kzalloc(sizeof(struct cfg80211_cqm_config) + 9883 n_thresholds * sizeof(s32), GFP_KERNEL); 9884 if (!cqm_config) { 9885 err = -ENOMEM; 9886 goto unlock; 9887 } 9888 9889 cqm_config->rssi_hyst = hysteresis; 9890 cqm_config->n_rssi_thresholds = n_thresholds; 9891 memcpy(cqm_config->rssi_thresholds, thresholds, 9892 n_thresholds * sizeof(s32)); 9893 9894 wdev->cqm_config = cqm_config; 9895 } 9896 9897 err = cfg80211_cqm_rssi_update(rdev, dev); 9898 9899 unlock: 9900 wdev_unlock(wdev); 9901 9902 return err; 9903 } 9904 9905 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info) 9906 { 9907 struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1]; 9908 struct nlattr *cqm; 9909 int err; 9910 9911 cqm = info->attrs[NL80211_ATTR_CQM]; 9912 if (!cqm) 9913 return -EINVAL; 9914 9915 err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm, 9916 nl80211_attr_cqm_policy, info->extack); 9917 if (err) 9918 return err; 9919 9920 if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] && 9921 attrs[NL80211_ATTR_CQM_RSSI_HYST]) { 9922 const s32 *thresholds = 9923 nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]); 9924 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]); 9925 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]); 9926 9927 if (len % 4) 9928 return -EINVAL; 9929 9930 return nl80211_set_cqm_rssi(info, thresholds, len / 4, 9931 hysteresis); 9932 } 9933 9934 if (attrs[NL80211_ATTR_CQM_TXE_RATE] && 9935 attrs[NL80211_ATTR_CQM_TXE_PKTS] && 9936 attrs[NL80211_ATTR_CQM_TXE_INTVL]) { 9937 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]); 9938 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]); 9939 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]); 9940 9941 return nl80211_set_cqm_txe(info, rate, pkts, intvl); 9942 } 9943 9944 return -EINVAL; 9945 } 9946 9947 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info) 9948 { 9949 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9950 struct net_device *dev = info->user_ptr[1]; 9951 struct ocb_setup setup = {}; 9952 int err; 9953 9954 err = nl80211_parse_chandef(rdev, info, &setup.chandef); 9955 if (err) 9956 return err; 9957 9958 return cfg80211_join_ocb(rdev, dev, &setup); 9959 } 9960 9961 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info) 9962 { 9963 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9964 struct net_device *dev = info->user_ptr[1]; 9965 9966 return cfg80211_leave_ocb(rdev, dev); 9967 } 9968 9969 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info) 9970 { 9971 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9972 struct net_device *dev = info->user_ptr[1]; 9973 struct mesh_config cfg; 9974 struct mesh_setup setup; 9975 int err; 9976 9977 /* start with default */ 9978 memcpy(&cfg, &default_mesh_config, sizeof(cfg)); 9979 memcpy(&setup, &default_mesh_setup, sizeof(setup)); 9980 9981 if (info->attrs[NL80211_ATTR_MESH_CONFIG]) { 9982 /* and parse parameters if given */ 9983 err = nl80211_parse_mesh_config(info, &cfg, NULL); 9984 if (err) 9985 return err; 9986 } 9987 9988 if (!info->attrs[NL80211_ATTR_MESH_ID] || 9989 !nla_len(info->attrs[NL80211_ATTR_MESH_ID])) 9990 return -EINVAL; 9991 9992 setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]); 9993 setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]); 9994 9995 if (info->attrs[NL80211_ATTR_MCAST_RATE] && 9996 !nl80211_parse_mcast_rate(rdev, setup.mcast_rate, 9997 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]))) 9998 return -EINVAL; 9999 10000 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) { 10001 setup.beacon_interval = 10002 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]); 10003 10004 err = cfg80211_validate_beacon_int(rdev, 10005 NL80211_IFTYPE_MESH_POINT, 10006 setup.beacon_interval); 10007 if (err) 10008 return err; 10009 } 10010 10011 if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) { 10012 setup.dtim_period = 10013 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]); 10014 if (setup.dtim_period < 1 || setup.dtim_period > 100) 10015 return -EINVAL; 10016 } 10017 10018 if (info->attrs[NL80211_ATTR_MESH_SETUP]) { 10019 /* parse additional setup parameters if given */ 10020 err = nl80211_parse_mesh_setup(info, &setup); 10021 if (err) 10022 return err; 10023 } 10024 10025 if (setup.user_mpm) 10026 cfg.auto_open_plinks = false; 10027 10028 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 10029 err = nl80211_parse_chandef(rdev, info, &setup.chandef); 10030 if (err) 10031 return err; 10032 } else { 10033 /* cfg80211_join_mesh() will sort it out */ 10034 setup.chandef.chan = NULL; 10035 } 10036 10037 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) { 10038 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 10039 int n_rates = 10040 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 10041 struct ieee80211_supported_band *sband; 10042 10043 if (!setup.chandef.chan) 10044 return -EINVAL; 10045 10046 sband = rdev->wiphy.bands[setup.chandef.chan->band]; 10047 10048 err = ieee80211_get_ratemask(sband, rates, n_rates, 10049 &setup.basic_rates); 10050 if (err) 10051 return err; 10052 } 10053 10054 if (info->attrs[NL80211_ATTR_TX_RATES]) { 10055 err = nl80211_parse_tx_bitrate_mask(info, &setup.beacon_rate); 10056 if (err) 10057 return err; 10058 10059 if (!setup.chandef.chan) 10060 return -EINVAL; 10061 10062 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band, 10063 &setup.beacon_rate); 10064 if (err) 10065 return err; 10066 } 10067 10068 setup.userspace_handles_dfs = 10069 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]); 10070 10071 return cfg80211_join_mesh(rdev, dev, &setup, &cfg); 10072 } 10073 10074 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info) 10075 { 10076 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10077 struct net_device *dev = info->user_ptr[1]; 10078 10079 return cfg80211_leave_mesh(rdev, dev); 10080 } 10081 10082 #ifdef CONFIG_PM 10083 static int nl80211_send_wowlan_patterns(struct sk_buff *msg, 10084 struct cfg80211_registered_device *rdev) 10085 { 10086 struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config; 10087 struct nlattr *nl_pats, *nl_pat; 10088 int i, pat_len; 10089 10090 if (!wowlan->n_patterns) 10091 return 0; 10092 10093 nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN); 10094 if (!nl_pats) 10095 return -ENOBUFS; 10096 10097 for (i = 0; i < wowlan->n_patterns; i++) { 10098 nl_pat = nla_nest_start(msg, i + 1); 10099 if (!nl_pat) 10100 return -ENOBUFS; 10101 pat_len = wowlan->patterns[i].pattern_len; 10102 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8), 10103 wowlan->patterns[i].mask) || 10104 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len, 10105 wowlan->patterns[i].pattern) || 10106 nla_put_u32(msg, NL80211_PKTPAT_OFFSET, 10107 wowlan->patterns[i].pkt_offset)) 10108 return -ENOBUFS; 10109 nla_nest_end(msg, nl_pat); 10110 } 10111 nla_nest_end(msg, nl_pats); 10112 10113 return 0; 10114 } 10115 10116 static int nl80211_send_wowlan_tcp(struct sk_buff *msg, 10117 struct cfg80211_wowlan_tcp *tcp) 10118 { 10119 struct nlattr *nl_tcp; 10120 10121 if (!tcp) 10122 return 0; 10123 10124 nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION); 10125 if (!nl_tcp) 10126 return -ENOBUFS; 10127 10128 if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) || 10129 nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) || 10130 nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) || 10131 nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) || 10132 nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) || 10133 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD, 10134 tcp->payload_len, tcp->payload) || 10135 nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL, 10136 tcp->data_interval) || 10137 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD, 10138 tcp->wake_len, tcp->wake_data) || 10139 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK, 10140 DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask)) 10141 return -ENOBUFS; 10142 10143 if (tcp->payload_seq.len && 10144 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ, 10145 sizeof(tcp->payload_seq), &tcp->payload_seq)) 10146 return -ENOBUFS; 10147 10148 if (tcp->payload_tok.len && 10149 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN, 10150 sizeof(tcp->payload_tok) + tcp->tokens_size, 10151 &tcp->payload_tok)) 10152 return -ENOBUFS; 10153 10154 nla_nest_end(msg, nl_tcp); 10155 10156 return 0; 10157 } 10158 10159 static int nl80211_send_wowlan_nd(struct sk_buff *msg, 10160 struct cfg80211_sched_scan_request *req) 10161 { 10162 struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan; 10163 int i; 10164 10165 if (!req) 10166 return 0; 10167 10168 nd = nla_nest_start(msg, NL80211_WOWLAN_TRIG_NET_DETECT); 10169 if (!nd) 10170 return -ENOBUFS; 10171 10172 if (req->n_scan_plans == 1 && 10173 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL, 10174 req->scan_plans[0].interval * 1000)) 10175 return -ENOBUFS; 10176 10177 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay)) 10178 return -ENOBUFS; 10179 10180 if (req->relative_rssi_set) { 10181 struct nl80211_bss_select_rssi_adjust rssi_adjust; 10182 10183 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI, 10184 req->relative_rssi)) 10185 return -ENOBUFS; 10186 10187 rssi_adjust.band = req->rssi_adjust.band; 10188 rssi_adjust.delta = req->rssi_adjust.delta; 10189 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST, 10190 sizeof(rssi_adjust), &rssi_adjust)) 10191 return -ENOBUFS; 10192 } 10193 10194 freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES); 10195 if (!freqs) 10196 return -ENOBUFS; 10197 10198 for (i = 0; i < req->n_channels; i++) { 10199 if (nla_put_u32(msg, i, req->channels[i]->center_freq)) 10200 return -ENOBUFS; 10201 } 10202 10203 nla_nest_end(msg, freqs); 10204 10205 if (req->n_match_sets) { 10206 matches = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH); 10207 if (!matches) 10208 return -ENOBUFS; 10209 10210 for (i = 0; i < req->n_match_sets; i++) { 10211 match = nla_nest_start(msg, i); 10212 if (!match) 10213 return -ENOBUFS; 10214 10215 if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID, 10216 req->match_sets[i].ssid.ssid_len, 10217 req->match_sets[i].ssid.ssid)) 10218 return -ENOBUFS; 10219 nla_nest_end(msg, match); 10220 } 10221 nla_nest_end(msg, matches); 10222 } 10223 10224 scan_plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS); 10225 if (!scan_plans) 10226 return -ENOBUFS; 10227 10228 for (i = 0; i < req->n_scan_plans; i++) { 10229 scan_plan = nla_nest_start(msg, i + 1); 10230 if (!scan_plan) 10231 return -ENOBUFS; 10232 10233 if (!scan_plan || 10234 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL, 10235 req->scan_plans[i].interval) || 10236 (req->scan_plans[i].iterations && 10237 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS, 10238 req->scan_plans[i].iterations))) 10239 return -ENOBUFS; 10240 nla_nest_end(msg, scan_plan); 10241 } 10242 nla_nest_end(msg, scan_plans); 10243 10244 nla_nest_end(msg, nd); 10245 10246 return 0; 10247 } 10248 10249 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info) 10250 { 10251 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10252 struct sk_buff *msg; 10253 void *hdr; 10254 u32 size = NLMSG_DEFAULT_SIZE; 10255 10256 if (!rdev->wiphy.wowlan) 10257 return -EOPNOTSUPP; 10258 10259 if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) { 10260 /* adjust size to have room for all the data */ 10261 size += rdev->wiphy.wowlan_config->tcp->tokens_size + 10262 rdev->wiphy.wowlan_config->tcp->payload_len + 10263 rdev->wiphy.wowlan_config->tcp->wake_len + 10264 rdev->wiphy.wowlan_config->tcp->wake_len / 8; 10265 } 10266 10267 msg = nlmsg_new(size, GFP_KERNEL); 10268 if (!msg) 10269 return -ENOMEM; 10270 10271 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 10272 NL80211_CMD_GET_WOWLAN); 10273 if (!hdr) 10274 goto nla_put_failure; 10275 10276 if (rdev->wiphy.wowlan_config) { 10277 struct nlattr *nl_wowlan; 10278 10279 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS); 10280 if (!nl_wowlan) 10281 goto nla_put_failure; 10282 10283 if ((rdev->wiphy.wowlan_config->any && 10284 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) || 10285 (rdev->wiphy.wowlan_config->disconnect && 10286 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) || 10287 (rdev->wiphy.wowlan_config->magic_pkt && 10288 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) || 10289 (rdev->wiphy.wowlan_config->gtk_rekey_failure && 10290 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) || 10291 (rdev->wiphy.wowlan_config->eap_identity_req && 10292 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) || 10293 (rdev->wiphy.wowlan_config->four_way_handshake && 10294 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) || 10295 (rdev->wiphy.wowlan_config->rfkill_release && 10296 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))) 10297 goto nla_put_failure; 10298 10299 if (nl80211_send_wowlan_patterns(msg, rdev)) 10300 goto nla_put_failure; 10301 10302 if (nl80211_send_wowlan_tcp(msg, 10303 rdev->wiphy.wowlan_config->tcp)) 10304 goto nla_put_failure; 10305 10306 if (nl80211_send_wowlan_nd( 10307 msg, 10308 rdev->wiphy.wowlan_config->nd_config)) 10309 goto nla_put_failure; 10310 10311 nla_nest_end(msg, nl_wowlan); 10312 } 10313 10314 genlmsg_end(msg, hdr); 10315 return genlmsg_reply(msg, info); 10316 10317 nla_put_failure: 10318 nlmsg_free(msg); 10319 return -ENOBUFS; 10320 } 10321 10322 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev, 10323 struct nlattr *attr, 10324 struct cfg80211_wowlan *trig) 10325 { 10326 struct nlattr *tb[NUM_NL80211_WOWLAN_TCP]; 10327 struct cfg80211_wowlan_tcp *cfg; 10328 struct nl80211_wowlan_tcp_data_token *tok = NULL; 10329 struct nl80211_wowlan_tcp_data_seq *seq = NULL; 10330 u32 size; 10331 u32 data_size, wake_size, tokens_size = 0, wake_mask_size; 10332 int err, port; 10333 10334 if (!rdev->wiphy.wowlan->tcp) 10335 return -EINVAL; 10336 10337 err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TCP, attr, 10338 nl80211_wowlan_tcp_policy, NULL); 10339 if (err) 10340 return err; 10341 10342 if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] || 10343 !tb[NL80211_WOWLAN_TCP_DST_IPV4] || 10344 !tb[NL80211_WOWLAN_TCP_DST_MAC] || 10345 !tb[NL80211_WOWLAN_TCP_DST_PORT] || 10346 !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] || 10347 !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] || 10348 !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] || 10349 !tb[NL80211_WOWLAN_TCP_WAKE_MASK]) 10350 return -EINVAL; 10351 10352 data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]); 10353 if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max) 10354 return -EINVAL; 10355 10356 if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) > 10357 rdev->wiphy.wowlan->tcp->data_interval_max || 10358 nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0) 10359 return -EINVAL; 10360 10361 wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]); 10362 if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max) 10363 return -EINVAL; 10364 10365 wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]); 10366 if (wake_mask_size != DIV_ROUND_UP(wake_size, 8)) 10367 return -EINVAL; 10368 10369 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) { 10370 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]); 10371 10372 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]); 10373 tokens_size = tokln - sizeof(*tok); 10374 10375 if (!tok->len || tokens_size % tok->len) 10376 return -EINVAL; 10377 if (!rdev->wiphy.wowlan->tcp->tok) 10378 return -EINVAL; 10379 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len) 10380 return -EINVAL; 10381 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len) 10382 return -EINVAL; 10383 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize) 10384 return -EINVAL; 10385 if (tok->offset + tok->len > data_size) 10386 return -EINVAL; 10387 } 10388 10389 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) { 10390 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]); 10391 if (!rdev->wiphy.wowlan->tcp->seq) 10392 return -EINVAL; 10393 if (seq->len == 0 || seq->len > 4) 10394 return -EINVAL; 10395 if (seq->len + seq->offset > data_size) 10396 return -EINVAL; 10397 } 10398 10399 size = sizeof(*cfg); 10400 size += data_size; 10401 size += wake_size + wake_mask_size; 10402 size += tokens_size; 10403 10404 cfg = kzalloc(size, GFP_KERNEL); 10405 if (!cfg) 10406 return -ENOMEM; 10407 cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]); 10408 cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]); 10409 memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]), 10410 ETH_ALEN); 10411 if (tb[NL80211_WOWLAN_TCP_SRC_PORT]) 10412 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]); 10413 else 10414 port = 0; 10415 #ifdef CONFIG_INET 10416 /* allocate a socket and port for it and use it */ 10417 err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM, 10418 IPPROTO_TCP, &cfg->sock, 1); 10419 if (err) { 10420 kfree(cfg); 10421 return err; 10422 } 10423 if (inet_csk_get_port(cfg->sock->sk, port)) { 10424 sock_release(cfg->sock); 10425 kfree(cfg); 10426 return -EADDRINUSE; 10427 } 10428 cfg->src_port = inet_sk(cfg->sock->sk)->inet_num; 10429 #else 10430 if (!port) { 10431 kfree(cfg); 10432 return -EINVAL; 10433 } 10434 cfg->src_port = port; 10435 #endif 10436 10437 cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]); 10438 cfg->payload_len = data_size; 10439 cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size; 10440 memcpy((void *)cfg->payload, 10441 nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]), 10442 data_size); 10443 if (seq) 10444 cfg->payload_seq = *seq; 10445 cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]); 10446 cfg->wake_len = wake_size; 10447 cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size; 10448 memcpy((void *)cfg->wake_data, 10449 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]), 10450 wake_size); 10451 cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size + 10452 data_size + wake_size; 10453 memcpy((void *)cfg->wake_mask, 10454 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]), 10455 wake_mask_size); 10456 if (tok) { 10457 cfg->tokens_size = tokens_size; 10458 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size); 10459 } 10460 10461 trig->tcp = cfg; 10462 10463 return 0; 10464 } 10465 10466 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev, 10467 const struct wiphy_wowlan_support *wowlan, 10468 struct nlattr *attr, 10469 struct cfg80211_wowlan *trig) 10470 { 10471 struct nlattr **tb; 10472 int err; 10473 10474 tb = kzalloc(NUM_NL80211_ATTR * sizeof(*tb), GFP_KERNEL); 10475 if (!tb) 10476 return -ENOMEM; 10477 10478 if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) { 10479 err = -EOPNOTSUPP; 10480 goto out; 10481 } 10482 10483 err = nla_parse_nested(tb, NL80211_ATTR_MAX, attr, nl80211_policy, 10484 NULL); 10485 if (err) 10486 goto out; 10487 10488 trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb, 10489 wowlan->max_nd_match_sets); 10490 err = PTR_ERR_OR_ZERO(trig->nd_config); 10491 if (err) 10492 trig->nd_config = NULL; 10493 10494 out: 10495 kfree(tb); 10496 return err; 10497 } 10498 10499 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info) 10500 { 10501 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10502 struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG]; 10503 struct cfg80211_wowlan new_triggers = {}; 10504 struct cfg80211_wowlan *ntrig; 10505 const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan; 10506 int err, i; 10507 bool prev_enabled = rdev->wiphy.wowlan_config; 10508 bool regular = false; 10509 10510 if (!wowlan) 10511 return -EOPNOTSUPP; 10512 10513 if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) { 10514 cfg80211_rdev_free_wowlan(rdev); 10515 rdev->wiphy.wowlan_config = NULL; 10516 goto set_wakeup; 10517 } 10518 10519 err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TRIG, 10520 info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS], 10521 nl80211_wowlan_policy, info->extack); 10522 if (err) 10523 return err; 10524 10525 if (tb[NL80211_WOWLAN_TRIG_ANY]) { 10526 if (!(wowlan->flags & WIPHY_WOWLAN_ANY)) 10527 return -EINVAL; 10528 new_triggers.any = true; 10529 } 10530 10531 if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) { 10532 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT)) 10533 return -EINVAL; 10534 new_triggers.disconnect = true; 10535 regular = true; 10536 } 10537 10538 if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) { 10539 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT)) 10540 return -EINVAL; 10541 new_triggers.magic_pkt = true; 10542 regular = true; 10543 } 10544 10545 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED]) 10546 return -EINVAL; 10547 10548 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) { 10549 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE)) 10550 return -EINVAL; 10551 new_triggers.gtk_rekey_failure = true; 10552 regular = true; 10553 } 10554 10555 if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) { 10556 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ)) 10557 return -EINVAL; 10558 new_triggers.eap_identity_req = true; 10559 regular = true; 10560 } 10561 10562 if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) { 10563 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE)) 10564 return -EINVAL; 10565 new_triggers.four_way_handshake = true; 10566 regular = true; 10567 } 10568 10569 if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) { 10570 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE)) 10571 return -EINVAL; 10572 new_triggers.rfkill_release = true; 10573 regular = true; 10574 } 10575 10576 if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) { 10577 struct nlattr *pat; 10578 int n_patterns = 0; 10579 int rem, pat_len, mask_len, pkt_offset; 10580 struct nlattr *pat_tb[NUM_NL80211_PKTPAT]; 10581 10582 regular = true; 10583 10584 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN], 10585 rem) 10586 n_patterns++; 10587 if (n_patterns > wowlan->n_patterns) 10588 return -EINVAL; 10589 10590 new_triggers.patterns = kcalloc(n_patterns, 10591 sizeof(new_triggers.patterns[0]), 10592 GFP_KERNEL); 10593 if (!new_triggers.patterns) 10594 return -ENOMEM; 10595 10596 new_triggers.n_patterns = n_patterns; 10597 i = 0; 10598 10599 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN], 10600 rem) { 10601 u8 *mask_pat; 10602 10603 nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat, 10604 nl80211_packet_pattern_policy, 10605 info->extack); 10606 err = -EINVAL; 10607 if (!pat_tb[NL80211_PKTPAT_MASK] || 10608 !pat_tb[NL80211_PKTPAT_PATTERN]) 10609 goto error; 10610 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]); 10611 mask_len = DIV_ROUND_UP(pat_len, 8); 10612 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len) 10613 goto error; 10614 if (pat_len > wowlan->pattern_max_len || 10615 pat_len < wowlan->pattern_min_len) 10616 goto error; 10617 10618 if (!pat_tb[NL80211_PKTPAT_OFFSET]) 10619 pkt_offset = 0; 10620 else 10621 pkt_offset = nla_get_u32( 10622 pat_tb[NL80211_PKTPAT_OFFSET]); 10623 if (pkt_offset > wowlan->max_pkt_offset) 10624 goto error; 10625 new_triggers.patterns[i].pkt_offset = pkt_offset; 10626 10627 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL); 10628 if (!mask_pat) { 10629 err = -ENOMEM; 10630 goto error; 10631 } 10632 new_triggers.patterns[i].mask = mask_pat; 10633 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]), 10634 mask_len); 10635 mask_pat += mask_len; 10636 new_triggers.patterns[i].pattern = mask_pat; 10637 new_triggers.patterns[i].pattern_len = pat_len; 10638 memcpy(mask_pat, 10639 nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), 10640 pat_len); 10641 i++; 10642 } 10643 } 10644 10645 if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) { 10646 regular = true; 10647 err = nl80211_parse_wowlan_tcp( 10648 rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION], 10649 &new_triggers); 10650 if (err) 10651 goto error; 10652 } 10653 10654 if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) { 10655 regular = true; 10656 err = nl80211_parse_wowlan_nd( 10657 rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT], 10658 &new_triggers); 10659 if (err) 10660 goto error; 10661 } 10662 10663 /* The 'any' trigger means the device continues operating more or less 10664 * as in its normal operation mode and wakes up the host on most of the 10665 * normal interrupts (like packet RX, ...) 10666 * It therefore makes little sense to combine with the more constrained 10667 * wakeup trigger modes. 10668 */ 10669 if (new_triggers.any && regular) { 10670 err = -EINVAL; 10671 goto error; 10672 } 10673 10674 ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL); 10675 if (!ntrig) { 10676 err = -ENOMEM; 10677 goto error; 10678 } 10679 cfg80211_rdev_free_wowlan(rdev); 10680 rdev->wiphy.wowlan_config = ntrig; 10681 10682 set_wakeup: 10683 if (rdev->ops->set_wakeup && 10684 prev_enabled != !!rdev->wiphy.wowlan_config) 10685 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config); 10686 10687 return 0; 10688 error: 10689 for (i = 0; i < new_triggers.n_patterns; i++) 10690 kfree(new_triggers.patterns[i].mask); 10691 kfree(new_triggers.patterns); 10692 if (new_triggers.tcp && new_triggers.tcp->sock) 10693 sock_release(new_triggers.tcp->sock); 10694 kfree(new_triggers.tcp); 10695 kfree(new_triggers.nd_config); 10696 return err; 10697 } 10698 #endif 10699 10700 static int nl80211_send_coalesce_rules(struct sk_buff *msg, 10701 struct cfg80211_registered_device *rdev) 10702 { 10703 struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules; 10704 int i, j, pat_len; 10705 struct cfg80211_coalesce_rules *rule; 10706 10707 if (!rdev->coalesce->n_rules) 10708 return 0; 10709 10710 nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE); 10711 if (!nl_rules) 10712 return -ENOBUFS; 10713 10714 for (i = 0; i < rdev->coalesce->n_rules; i++) { 10715 nl_rule = nla_nest_start(msg, i + 1); 10716 if (!nl_rule) 10717 return -ENOBUFS; 10718 10719 rule = &rdev->coalesce->rules[i]; 10720 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY, 10721 rule->delay)) 10722 return -ENOBUFS; 10723 10724 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION, 10725 rule->condition)) 10726 return -ENOBUFS; 10727 10728 nl_pats = nla_nest_start(msg, 10729 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN); 10730 if (!nl_pats) 10731 return -ENOBUFS; 10732 10733 for (j = 0; j < rule->n_patterns; j++) { 10734 nl_pat = nla_nest_start(msg, j + 1); 10735 if (!nl_pat) 10736 return -ENOBUFS; 10737 pat_len = rule->patterns[j].pattern_len; 10738 if (nla_put(msg, NL80211_PKTPAT_MASK, 10739 DIV_ROUND_UP(pat_len, 8), 10740 rule->patterns[j].mask) || 10741 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len, 10742 rule->patterns[j].pattern) || 10743 nla_put_u32(msg, NL80211_PKTPAT_OFFSET, 10744 rule->patterns[j].pkt_offset)) 10745 return -ENOBUFS; 10746 nla_nest_end(msg, nl_pat); 10747 } 10748 nla_nest_end(msg, nl_pats); 10749 nla_nest_end(msg, nl_rule); 10750 } 10751 nla_nest_end(msg, nl_rules); 10752 10753 return 0; 10754 } 10755 10756 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info) 10757 { 10758 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10759 struct sk_buff *msg; 10760 void *hdr; 10761 10762 if (!rdev->wiphy.coalesce) 10763 return -EOPNOTSUPP; 10764 10765 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 10766 if (!msg) 10767 return -ENOMEM; 10768 10769 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 10770 NL80211_CMD_GET_COALESCE); 10771 if (!hdr) 10772 goto nla_put_failure; 10773 10774 if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev)) 10775 goto nla_put_failure; 10776 10777 genlmsg_end(msg, hdr); 10778 return genlmsg_reply(msg, info); 10779 10780 nla_put_failure: 10781 nlmsg_free(msg); 10782 return -ENOBUFS; 10783 } 10784 10785 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev) 10786 { 10787 struct cfg80211_coalesce *coalesce = rdev->coalesce; 10788 int i, j; 10789 struct cfg80211_coalesce_rules *rule; 10790 10791 if (!coalesce) 10792 return; 10793 10794 for (i = 0; i < coalesce->n_rules; i++) { 10795 rule = &coalesce->rules[i]; 10796 for (j = 0; j < rule->n_patterns; j++) 10797 kfree(rule->patterns[j].mask); 10798 kfree(rule->patterns); 10799 } 10800 kfree(coalesce->rules); 10801 kfree(coalesce); 10802 rdev->coalesce = NULL; 10803 } 10804 10805 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev, 10806 struct nlattr *rule, 10807 struct cfg80211_coalesce_rules *new_rule) 10808 { 10809 int err, i; 10810 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce; 10811 struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat; 10812 int rem, pat_len, mask_len, pkt_offset, n_patterns = 0; 10813 struct nlattr *pat_tb[NUM_NL80211_PKTPAT]; 10814 10815 err = nla_parse_nested(tb, NL80211_ATTR_COALESCE_RULE_MAX, rule, 10816 nl80211_coalesce_policy, NULL); 10817 if (err) 10818 return err; 10819 10820 if (tb[NL80211_ATTR_COALESCE_RULE_DELAY]) 10821 new_rule->delay = 10822 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]); 10823 if (new_rule->delay > coalesce->max_delay) 10824 return -EINVAL; 10825 10826 if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION]) 10827 new_rule->condition = 10828 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]); 10829 if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH && 10830 new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH) 10831 return -EINVAL; 10832 10833 if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN]) 10834 return -EINVAL; 10835 10836 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN], 10837 rem) 10838 n_patterns++; 10839 if (n_patterns > coalesce->n_patterns) 10840 return -EINVAL; 10841 10842 new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]), 10843 GFP_KERNEL); 10844 if (!new_rule->patterns) 10845 return -ENOMEM; 10846 10847 new_rule->n_patterns = n_patterns; 10848 i = 0; 10849 10850 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN], 10851 rem) { 10852 u8 *mask_pat; 10853 10854 nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat, 10855 nl80211_packet_pattern_policy, NULL); 10856 if (!pat_tb[NL80211_PKTPAT_MASK] || 10857 !pat_tb[NL80211_PKTPAT_PATTERN]) 10858 return -EINVAL; 10859 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]); 10860 mask_len = DIV_ROUND_UP(pat_len, 8); 10861 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len) 10862 return -EINVAL; 10863 if (pat_len > coalesce->pattern_max_len || 10864 pat_len < coalesce->pattern_min_len) 10865 return -EINVAL; 10866 10867 if (!pat_tb[NL80211_PKTPAT_OFFSET]) 10868 pkt_offset = 0; 10869 else 10870 pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]); 10871 if (pkt_offset > coalesce->max_pkt_offset) 10872 return -EINVAL; 10873 new_rule->patterns[i].pkt_offset = pkt_offset; 10874 10875 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL); 10876 if (!mask_pat) 10877 return -ENOMEM; 10878 10879 new_rule->patterns[i].mask = mask_pat; 10880 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]), 10881 mask_len); 10882 10883 mask_pat += mask_len; 10884 new_rule->patterns[i].pattern = mask_pat; 10885 new_rule->patterns[i].pattern_len = pat_len; 10886 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), 10887 pat_len); 10888 i++; 10889 } 10890 10891 return 0; 10892 } 10893 10894 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info) 10895 { 10896 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10897 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce; 10898 struct cfg80211_coalesce new_coalesce = {}; 10899 struct cfg80211_coalesce *n_coalesce; 10900 int err, rem_rule, n_rules = 0, i, j; 10901 struct nlattr *rule; 10902 struct cfg80211_coalesce_rules *tmp_rule; 10903 10904 if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce) 10905 return -EOPNOTSUPP; 10906 10907 if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) { 10908 cfg80211_rdev_free_coalesce(rdev); 10909 rdev_set_coalesce(rdev, NULL); 10910 return 0; 10911 } 10912 10913 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE], 10914 rem_rule) 10915 n_rules++; 10916 if (n_rules > coalesce->n_rules) 10917 return -EINVAL; 10918 10919 new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]), 10920 GFP_KERNEL); 10921 if (!new_coalesce.rules) 10922 return -ENOMEM; 10923 10924 new_coalesce.n_rules = n_rules; 10925 i = 0; 10926 10927 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE], 10928 rem_rule) { 10929 err = nl80211_parse_coalesce_rule(rdev, rule, 10930 &new_coalesce.rules[i]); 10931 if (err) 10932 goto error; 10933 10934 i++; 10935 } 10936 10937 err = rdev_set_coalesce(rdev, &new_coalesce); 10938 if (err) 10939 goto error; 10940 10941 n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL); 10942 if (!n_coalesce) { 10943 err = -ENOMEM; 10944 goto error; 10945 } 10946 cfg80211_rdev_free_coalesce(rdev); 10947 rdev->coalesce = n_coalesce; 10948 10949 return 0; 10950 error: 10951 for (i = 0; i < new_coalesce.n_rules; i++) { 10952 tmp_rule = &new_coalesce.rules[i]; 10953 for (j = 0; j < tmp_rule->n_patterns; j++) 10954 kfree(tmp_rule->patterns[j].mask); 10955 kfree(tmp_rule->patterns); 10956 } 10957 kfree(new_coalesce.rules); 10958 10959 return err; 10960 } 10961 10962 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info) 10963 { 10964 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10965 struct net_device *dev = info->user_ptr[1]; 10966 struct wireless_dev *wdev = dev->ieee80211_ptr; 10967 struct nlattr *tb[NUM_NL80211_REKEY_DATA]; 10968 struct cfg80211_gtk_rekey_data rekey_data; 10969 int err; 10970 10971 if (!info->attrs[NL80211_ATTR_REKEY_DATA]) 10972 return -EINVAL; 10973 10974 err = nla_parse_nested(tb, MAX_NL80211_REKEY_DATA, 10975 info->attrs[NL80211_ATTR_REKEY_DATA], 10976 nl80211_rekey_policy, info->extack); 10977 if (err) 10978 return err; 10979 10980 if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] || 10981 !tb[NL80211_REKEY_DATA_KCK]) 10982 return -EINVAL; 10983 if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN) 10984 return -ERANGE; 10985 if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN) 10986 return -ERANGE; 10987 if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN) 10988 return -ERANGE; 10989 10990 rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]); 10991 rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]); 10992 rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]); 10993 10994 wdev_lock(wdev); 10995 if (!wdev->current_bss) { 10996 err = -ENOTCONN; 10997 goto out; 10998 } 10999 11000 if (!rdev->ops->set_rekey_data) { 11001 err = -EOPNOTSUPP; 11002 goto out; 11003 } 11004 11005 err = rdev_set_rekey_data(rdev, dev, &rekey_data); 11006 out: 11007 wdev_unlock(wdev); 11008 return err; 11009 } 11010 11011 static int nl80211_register_unexpected_frame(struct sk_buff *skb, 11012 struct genl_info *info) 11013 { 11014 struct net_device *dev = info->user_ptr[1]; 11015 struct wireless_dev *wdev = dev->ieee80211_ptr; 11016 11017 if (wdev->iftype != NL80211_IFTYPE_AP && 11018 wdev->iftype != NL80211_IFTYPE_P2P_GO) 11019 return -EINVAL; 11020 11021 if (wdev->ap_unexpected_nlportid) 11022 return -EBUSY; 11023 11024 wdev->ap_unexpected_nlportid = info->snd_portid; 11025 return 0; 11026 } 11027 11028 static int nl80211_probe_client(struct sk_buff *skb, 11029 struct genl_info *info) 11030 { 11031 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11032 struct net_device *dev = info->user_ptr[1]; 11033 struct wireless_dev *wdev = dev->ieee80211_ptr; 11034 struct sk_buff *msg; 11035 void *hdr; 11036 const u8 *addr; 11037 u64 cookie; 11038 int err; 11039 11040 if (wdev->iftype != NL80211_IFTYPE_AP && 11041 wdev->iftype != NL80211_IFTYPE_P2P_GO) 11042 return -EOPNOTSUPP; 11043 11044 if (!info->attrs[NL80211_ATTR_MAC]) 11045 return -EINVAL; 11046 11047 if (!rdev->ops->probe_client) 11048 return -EOPNOTSUPP; 11049 11050 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 11051 if (!msg) 11052 return -ENOMEM; 11053 11054 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 11055 NL80211_CMD_PROBE_CLIENT); 11056 if (!hdr) { 11057 err = -ENOBUFS; 11058 goto free_msg; 11059 } 11060 11061 addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 11062 11063 err = rdev_probe_client(rdev, dev, addr, &cookie); 11064 if (err) 11065 goto free_msg; 11066 11067 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 11068 NL80211_ATTR_PAD)) 11069 goto nla_put_failure; 11070 11071 genlmsg_end(msg, hdr); 11072 11073 return genlmsg_reply(msg, info); 11074 11075 nla_put_failure: 11076 err = -ENOBUFS; 11077 free_msg: 11078 nlmsg_free(msg); 11079 return err; 11080 } 11081 11082 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info) 11083 { 11084 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11085 struct cfg80211_beacon_registration *reg, *nreg; 11086 int rv; 11087 11088 if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS)) 11089 return -EOPNOTSUPP; 11090 11091 nreg = kzalloc(sizeof(*nreg), GFP_KERNEL); 11092 if (!nreg) 11093 return -ENOMEM; 11094 11095 /* First, check if already registered. */ 11096 spin_lock_bh(&rdev->beacon_registrations_lock); 11097 list_for_each_entry(reg, &rdev->beacon_registrations, list) { 11098 if (reg->nlportid == info->snd_portid) { 11099 rv = -EALREADY; 11100 goto out_err; 11101 } 11102 } 11103 /* Add it to the list */ 11104 nreg->nlportid = info->snd_portid; 11105 list_add(&nreg->list, &rdev->beacon_registrations); 11106 11107 spin_unlock_bh(&rdev->beacon_registrations_lock); 11108 11109 return 0; 11110 out_err: 11111 spin_unlock_bh(&rdev->beacon_registrations_lock); 11112 kfree(nreg); 11113 return rv; 11114 } 11115 11116 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info) 11117 { 11118 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11119 struct wireless_dev *wdev = info->user_ptr[1]; 11120 int err; 11121 11122 if (!rdev->ops->start_p2p_device) 11123 return -EOPNOTSUPP; 11124 11125 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE) 11126 return -EOPNOTSUPP; 11127 11128 if (wdev_running(wdev)) 11129 return 0; 11130 11131 if (rfkill_blocked(rdev->rfkill)) 11132 return -ERFKILL; 11133 11134 err = rdev_start_p2p_device(rdev, wdev); 11135 if (err) 11136 return err; 11137 11138 wdev->is_running = true; 11139 rdev->opencount++; 11140 11141 return 0; 11142 } 11143 11144 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info) 11145 { 11146 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11147 struct wireless_dev *wdev = info->user_ptr[1]; 11148 11149 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE) 11150 return -EOPNOTSUPP; 11151 11152 if (!rdev->ops->stop_p2p_device) 11153 return -EOPNOTSUPP; 11154 11155 cfg80211_stop_p2p_device(rdev, wdev); 11156 11157 return 0; 11158 } 11159 11160 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info) 11161 { 11162 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11163 struct wireless_dev *wdev = info->user_ptr[1]; 11164 struct cfg80211_nan_conf conf = {}; 11165 int err; 11166 11167 if (wdev->iftype != NL80211_IFTYPE_NAN) 11168 return -EOPNOTSUPP; 11169 11170 if (wdev_running(wdev)) 11171 return -EEXIST; 11172 11173 if (rfkill_blocked(rdev->rfkill)) 11174 return -ERFKILL; 11175 11176 if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) 11177 return -EINVAL; 11178 11179 conf.master_pref = 11180 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]); 11181 if (!conf.master_pref) 11182 return -EINVAL; 11183 11184 if (info->attrs[NL80211_ATTR_BANDS]) { 11185 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]); 11186 11187 if (bands & ~(u32)wdev->wiphy->nan_supported_bands) 11188 return -EOPNOTSUPP; 11189 11190 if (bands && !(bands & BIT(NL80211_BAND_2GHZ))) 11191 return -EINVAL; 11192 11193 conf.bands = bands; 11194 } 11195 11196 err = rdev_start_nan(rdev, wdev, &conf); 11197 if (err) 11198 return err; 11199 11200 wdev->is_running = true; 11201 rdev->opencount++; 11202 11203 return 0; 11204 } 11205 11206 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info) 11207 { 11208 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11209 struct wireless_dev *wdev = info->user_ptr[1]; 11210 11211 if (wdev->iftype != NL80211_IFTYPE_NAN) 11212 return -EOPNOTSUPP; 11213 11214 cfg80211_stop_nan(rdev, wdev); 11215 11216 return 0; 11217 } 11218 11219 static int validate_nan_filter(struct nlattr *filter_attr) 11220 { 11221 struct nlattr *attr; 11222 int len = 0, n_entries = 0, rem; 11223 11224 nla_for_each_nested(attr, filter_attr, rem) { 11225 len += nla_len(attr); 11226 n_entries++; 11227 } 11228 11229 if (len >= U8_MAX) 11230 return -EINVAL; 11231 11232 return n_entries; 11233 } 11234 11235 static int handle_nan_filter(struct nlattr *attr_filter, 11236 struct cfg80211_nan_func *func, 11237 bool tx) 11238 { 11239 struct nlattr *attr; 11240 int n_entries, rem, i; 11241 struct cfg80211_nan_func_filter *filter; 11242 11243 n_entries = validate_nan_filter(attr_filter); 11244 if (n_entries < 0) 11245 return n_entries; 11246 11247 BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters)); 11248 11249 filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL); 11250 if (!filter) 11251 return -ENOMEM; 11252 11253 i = 0; 11254 nla_for_each_nested(attr, attr_filter, rem) { 11255 filter[i].filter = nla_memdup(attr, GFP_KERNEL); 11256 filter[i].len = nla_len(attr); 11257 i++; 11258 } 11259 if (tx) { 11260 func->num_tx_filters = n_entries; 11261 func->tx_filters = filter; 11262 } else { 11263 func->num_rx_filters = n_entries; 11264 func->rx_filters = filter; 11265 } 11266 11267 return 0; 11268 } 11269 11270 static int nl80211_nan_add_func(struct sk_buff *skb, 11271 struct genl_info *info) 11272 { 11273 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11274 struct wireless_dev *wdev = info->user_ptr[1]; 11275 struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr; 11276 struct cfg80211_nan_func *func; 11277 struct sk_buff *msg = NULL; 11278 void *hdr = NULL; 11279 int err = 0; 11280 11281 if (wdev->iftype != NL80211_IFTYPE_NAN) 11282 return -EOPNOTSUPP; 11283 11284 if (!wdev_running(wdev)) 11285 return -ENOTCONN; 11286 11287 if (!info->attrs[NL80211_ATTR_NAN_FUNC]) 11288 return -EINVAL; 11289 11290 err = nla_parse_nested(tb, NL80211_NAN_FUNC_ATTR_MAX, 11291 info->attrs[NL80211_ATTR_NAN_FUNC], 11292 nl80211_nan_func_policy, info->extack); 11293 if (err) 11294 return err; 11295 11296 func = kzalloc(sizeof(*func), GFP_KERNEL); 11297 if (!func) 11298 return -ENOMEM; 11299 11300 func->cookie = wdev->wiphy->cookie_counter++; 11301 11302 if (!tb[NL80211_NAN_FUNC_TYPE] || 11303 nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]) > NL80211_NAN_FUNC_MAX_TYPE) { 11304 err = -EINVAL; 11305 goto out; 11306 } 11307 11308 11309 func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]); 11310 11311 if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) { 11312 err = -EINVAL; 11313 goto out; 11314 } 11315 11316 memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]), 11317 sizeof(func->service_id)); 11318 11319 func->close_range = 11320 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]); 11321 11322 if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) { 11323 func->serv_spec_info_len = 11324 nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]); 11325 func->serv_spec_info = 11326 kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]), 11327 func->serv_spec_info_len, 11328 GFP_KERNEL); 11329 if (!func->serv_spec_info) { 11330 err = -ENOMEM; 11331 goto out; 11332 } 11333 } 11334 11335 if (tb[NL80211_NAN_FUNC_TTL]) 11336 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]); 11337 11338 switch (func->type) { 11339 case NL80211_NAN_FUNC_PUBLISH: 11340 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) { 11341 err = -EINVAL; 11342 goto out; 11343 } 11344 11345 func->publish_type = 11346 nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]); 11347 func->publish_bcast = 11348 nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]); 11349 11350 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) && 11351 func->publish_bcast) { 11352 err = -EINVAL; 11353 goto out; 11354 } 11355 break; 11356 case NL80211_NAN_FUNC_SUBSCRIBE: 11357 func->subscribe_active = 11358 nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]); 11359 break; 11360 case NL80211_NAN_FUNC_FOLLOW_UP: 11361 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] || 11362 !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]) { 11363 err = -EINVAL; 11364 goto out; 11365 } 11366 11367 func->followup_id = 11368 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]); 11369 func->followup_reqid = 11370 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]); 11371 memcpy(func->followup_dest.addr, 11372 nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]), 11373 sizeof(func->followup_dest.addr)); 11374 if (func->ttl) { 11375 err = -EINVAL; 11376 goto out; 11377 } 11378 break; 11379 default: 11380 err = -EINVAL; 11381 goto out; 11382 } 11383 11384 if (tb[NL80211_NAN_FUNC_SRF]) { 11385 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR]; 11386 11387 err = nla_parse_nested(srf_tb, NL80211_NAN_SRF_ATTR_MAX, 11388 tb[NL80211_NAN_FUNC_SRF], 11389 nl80211_nan_srf_policy, info->extack); 11390 if (err) 11391 goto out; 11392 11393 func->srf_include = 11394 nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]); 11395 11396 if (srf_tb[NL80211_NAN_SRF_BF]) { 11397 if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] || 11398 !srf_tb[NL80211_NAN_SRF_BF_IDX]) { 11399 err = -EINVAL; 11400 goto out; 11401 } 11402 11403 func->srf_bf_len = 11404 nla_len(srf_tb[NL80211_NAN_SRF_BF]); 11405 func->srf_bf = 11406 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]), 11407 func->srf_bf_len, GFP_KERNEL); 11408 if (!func->srf_bf) { 11409 err = -ENOMEM; 11410 goto out; 11411 } 11412 11413 func->srf_bf_idx = 11414 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]); 11415 } else { 11416 struct nlattr *attr, *mac_attr = 11417 srf_tb[NL80211_NAN_SRF_MAC_ADDRS]; 11418 int n_entries, rem, i = 0; 11419 11420 if (!mac_attr) { 11421 err = -EINVAL; 11422 goto out; 11423 } 11424 11425 n_entries = validate_acl_mac_addrs(mac_attr); 11426 if (n_entries <= 0) { 11427 err = -EINVAL; 11428 goto out; 11429 } 11430 11431 func->srf_num_macs = n_entries; 11432 func->srf_macs = 11433 kzalloc(sizeof(*func->srf_macs) * n_entries, 11434 GFP_KERNEL); 11435 if (!func->srf_macs) { 11436 err = -ENOMEM; 11437 goto out; 11438 } 11439 11440 nla_for_each_nested(attr, mac_attr, rem) 11441 memcpy(func->srf_macs[i++].addr, nla_data(attr), 11442 sizeof(*func->srf_macs)); 11443 } 11444 } 11445 11446 if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) { 11447 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER], 11448 func, true); 11449 if (err) 11450 goto out; 11451 } 11452 11453 if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) { 11454 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER], 11455 func, false); 11456 if (err) 11457 goto out; 11458 } 11459 11460 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 11461 if (!msg) { 11462 err = -ENOMEM; 11463 goto out; 11464 } 11465 11466 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 11467 NL80211_CMD_ADD_NAN_FUNCTION); 11468 /* This can't really happen - we just allocated 4KB */ 11469 if (WARN_ON(!hdr)) { 11470 err = -ENOMEM; 11471 goto out; 11472 } 11473 11474 err = rdev_add_nan_func(rdev, wdev, func); 11475 out: 11476 if (err < 0) { 11477 cfg80211_free_nan_func(func); 11478 nlmsg_free(msg); 11479 return err; 11480 } 11481 11482 /* propagate the instance id and cookie to userspace */ 11483 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie, 11484 NL80211_ATTR_PAD)) 11485 goto nla_put_failure; 11486 11487 func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC); 11488 if (!func_attr) 11489 goto nla_put_failure; 11490 11491 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, 11492 func->instance_id)) 11493 goto nla_put_failure; 11494 11495 nla_nest_end(msg, func_attr); 11496 11497 genlmsg_end(msg, hdr); 11498 return genlmsg_reply(msg, info); 11499 11500 nla_put_failure: 11501 nlmsg_free(msg); 11502 return -ENOBUFS; 11503 } 11504 11505 static int nl80211_nan_del_func(struct sk_buff *skb, 11506 struct genl_info *info) 11507 { 11508 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11509 struct wireless_dev *wdev = info->user_ptr[1]; 11510 u64 cookie; 11511 11512 if (wdev->iftype != NL80211_IFTYPE_NAN) 11513 return -EOPNOTSUPP; 11514 11515 if (!wdev_running(wdev)) 11516 return -ENOTCONN; 11517 11518 if (!info->attrs[NL80211_ATTR_COOKIE]) 11519 return -EINVAL; 11520 11521 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 11522 11523 rdev_del_nan_func(rdev, wdev, cookie); 11524 11525 return 0; 11526 } 11527 11528 static int nl80211_nan_change_config(struct sk_buff *skb, 11529 struct genl_info *info) 11530 { 11531 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11532 struct wireless_dev *wdev = info->user_ptr[1]; 11533 struct cfg80211_nan_conf conf = {}; 11534 u32 changed = 0; 11535 11536 if (wdev->iftype != NL80211_IFTYPE_NAN) 11537 return -EOPNOTSUPP; 11538 11539 if (!wdev_running(wdev)) 11540 return -ENOTCONN; 11541 11542 if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) { 11543 conf.master_pref = 11544 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]); 11545 if (conf.master_pref <= 1 || conf.master_pref == 255) 11546 return -EINVAL; 11547 11548 changed |= CFG80211_NAN_CONF_CHANGED_PREF; 11549 } 11550 11551 if (info->attrs[NL80211_ATTR_BANDS]) { 11552 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]); 11553 11554 if (bands & ~(u32)wdev->wiphy->nan_supported_bands) 11555 return -EOPNOTSUPP; 11556 11557 if (bands && !(bands & BIT(NL80211_BAND_2GHZ))) 11558 return -EINVAL; 11559 11560 conf.bands = bands; 11561 changed |= CFG80211_NAN_CONF_CHANGED_BANDS; 11562 } 11563 11564 if (!changed) 11565 return -EINVAL; 11566 11567 return rdev_nan_change_conf(rdev, wdev, &conf, changed); 11568 } 11569 11570 void cfg80211_nan_match(struct wireless_dev *wdev, 11571 struct cfg80211_nan_match_params *match, gfp_t gfp) 11572 { 11573 struct wiphy *wiphy = wdev->wiphy; 11574 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 11575 struct nlattr *match_attr, *local_func_attr, *peer_func_attr; 11576 struct sk_buff *msg; 11577 void *hdr; 11578 11579 if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr)) 11580 return; 11581 11582 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 11583 if (!msg) 11584 return; 11585 11586 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH); 11587 if (!hdr) { 11588 nlmsg_free(msg); 11589 return; 11590 } 11591 11592 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 11593 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 11594 wdev->netdev->ifindex)) || 11595 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 11596 NL80211_ATTR_PAD)) 11597 goto nla_put_failure; 11598 11599 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie, 11600 NL80211_ATTR_PAD) || 11601 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr)) 11602 goto nla_put_failure; 11603 11604 match_attr = nla_nest_start(msg, NL80211_ATTR_NAN_MATCH); 11605 if (!match_attr) 11606 goto nla_put_failure; 11607 11608 local_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_LOCAL); 11609 if (!local_func_attr) 11610 goto nla_put_failure; 11611 11612 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id)) 11613 goto nla_put_failure; 11614 11615 nla_nest_end(msg, local_func_attr); 11616 11617 peer_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_PEER); 11618 if (!peer_func_attr) 11619 goto nla_put_failure; 11620 11621 if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) || 11622 nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id)) 11623 goto nla_put_failure; 11624 11625 if (match->info && match->info_len && 11626 nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len, 11627 match->info)) 11628 goto nla_put_failure; 11629 11630 nla_nest_end(msg, peer_func_attr); 11631 nla_nest_end(msg, match_attr); 11632 genlmsg_end(msg, hdr); 11633 11634 if (!wdev->owner_nlportid) 11635 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), 11636 msg, 0, NL80211_MCGRP_NAN, gfp); 11637 else 11638 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, 11639 wdev->owner_nlportid); 11640 11641 return; 11642 11643 nla_put_failure: 11644 nlmsg_free(msg); 11645 } 11646 EXPORT_SYMBOL(cfg80211_nan_match); 11647 11648 void cfg80211_nan_func_terminated(struct wireless_dev *wdev, 11649 u8 inst_id, 11650 enum nl80211_nan_func_term_reason reason, 11651 u64 cookie, gfp_t gfp) 11652 { 11653 struct wiphy *wiphy = wdev->wiphy; 11654 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 11655 struct sk_buff *msg; 11656 struct nlattr *func_attr; 11657 void *hdr; 11658 11659 if (WARN_ON(!inst_id)) 11660 return; 11661 11662 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 11663 if (!msg) 11664 return; 11665 11666 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION); 11667 if (!hdr) { 11668 nlmsg_free(msg); 11669 return; 11670 } 11671 11672 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 11673 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 11674 wdev->netdev->ifindex)) || 11675 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 11676 NL80211_ATTR_PAD)) 11677 goto nla_put_failure; 11678 11679 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 11680 NL80211_ATTR_PAD)) 11681 goto nla_put_failure; 11682 11683 func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC); 11684 if (!func_attr) 11685 goto nla_put_failure; 11686 11687 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) || 11688 nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason)) 11689 goto nla_put_failure; 11690 11691 nla_nest_end(msg, func_attr); 11692 genlmsg_end(msg, hdr); 11693 11694 if (!wdev->owner_nlportid) 11695 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), 11696 msg, 0, NL80211_MCGRP_NAN, gfp); 11697 else 11698 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, 11699 wdev->owner_nlportid); 11700 11701 return; 11702 11703 nla_put_failure: 11704 nlmsg_free(msg); 11705 } 11706 EXPORT_SYMBOL(cfg80211_nan_func_terminated); 11707 11708 static int nl80211_get_protocol_features(struct sk_buff *skb, 11709 struct genl_info *info) 11710 { 11711 void *hdr; 11712 struct sk_buff *msg; 11713 11714 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 11715 if (!msg) 11716 return -ENOMEM; 11717 11718 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 11719 NL80211_CMD_GET_PROTOCOL_FEATURES); 11720 if (!hdr) 11721 goto nla_put_failure; 11722 11723 if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES, 11724 NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP)) 11725 goto nla_put_failure; 11726 11727 genlmsg_end(msg, hdr); 11728 return genlmsg_reply(msg, info); 11729 11730 nla_put_failure: 11731 kfree_skb(msg); 11732 return -ENOBUFS; 11733 } 11734 11735 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info) 11736 { 11737 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11738 struct cfg80211_update_ft_ies_params ft_params; 11739 struct net_device *dev = info->user_ptr[1]; 11740 11741 if (!rdev->ops->update_ft_ies) 11742 return -EOPNOTSUPP; 11743 11744 if (!info->attrs[NL80211_ATTR_MDID] || 11745 !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) 11746 return -EINVAL; 11747 11748 memset(&ft_params, 0, sizeof(ft_params)); 11749 ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]); 11750 ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 11751 ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 11752 11753 return rdev_update_ft_ies(rdev, dev, &ft_params); 11754 } 11755 11756 static int nl80211_crit_protocol_start(struct sk_buff *skb, 11757 struct genl_info *info) 11758 { 11759 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11760 struct wireless_dev *wdev = info->user_ptr[1]; 11761 enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC; 11762 u16 duration; 11763 int ret; 11764 11765 if (!rdev->ops->crit_proto_start) 11766 return -EOPNOTSUPP; 11767 11768 if (WARN_ON(!rdev->ops->crit_proto_stop)) 11769 return -EINVAL; 11770 11771 if (rdev->crit_proto_nlportid) 11772 return -EBUSY; 11773 11774 /* determine protocol if provided */ 11775 if (info->attrs[NL80211_ATTR_CRIT_PROT_ID]) 11776 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]); 11777 11778 if (proto >= NUM_NL80211_CRIT_PROTO) 11779 return -EINVAL; 11780 11781 /* timeout must be provided */ 11782 if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]) 11783 return -EINVAL; 11784 11785 duration = 11786 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]); 11787 11788 if (duration > NL80211_CRIT_PROTO_MAX_DURATION) 11789 return -ERANGE; 11790 11791 ret = rdev_crit_proto_start(rdev, wdev, proto, duration); 11792 if (!ret) 11793 rdev->crit_proto_nlportid = info->snd_portid; 11794 11795 return ret; 11796 } 11797 11798 static int nl80211_crit_protocol_stop(struct sk_buff *skb, 11799 struct genl_info *info) 11800 { 11801 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11802 struct wireless_dev *wdev = info->user_ptr[1]; 11803 11804 if (!rdev->ops->crit_proto_stop) 11805 return -EOPNOTSUPP; 11806 11807 if (rdev->crit_proto_nlportid) { 11808 rdev->crit_proto_nlportid = 0; 11809 rdev_crit_proto_stop(rdev, wdev); 11810 } 11811 return 0; 11812 } 11813 11814 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info) 11815 { 11816 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11817 struct wireless_dev *wdev = 11818 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs); 11819 int i, err; 11820 u32 vid, subcmd; 11821 11822 if (!rdev->wiphy.vendor_commands) 11823 return -EOPNOTSUPP; 11824 11825 if (IS_ERR(wdev)) { 11826 err = PTR_ERR(wdev); 11827 if (err != -EINVAL) 11828 return err; 11829 wdev = NULL; 11830 } else if (wdev->wiphy != &rdev->wiphy) { 11831 return -EINVAL; 11832 } 11833 11834 if (!info->attrs[NL80211_ATTR_VENDOR_ID] || 11835 !info->attrs[NL80211_ATTR_VENDOR_SUBCMD]) 11836 return -EINVAL; 11837 11838 vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]); 11839 subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]); 11840 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) { 11841 const struct wiphy_vendor_command *vcmd; 11842 void *data = NULL; 11843 int len = 0; 11844 11845 vcmd = &rdev->wiphy.vendor_commands[i]; 11846 11847 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd) 11848 continue; 11849 11850 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV | 11851 WIPHY_VENDOR_CMD_NEED_NETDEV)) { 11852 if (!wdev) 11853 return -EINVAL; 11854 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV && 11855 !wdev->netdev) 11856 return -EINVAL; 11857 11858 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) { 11859 if (!wdev_running(wdev)) 11860 return -ENETDOWN; 11861 } 11862 11863 if (!vcmd->doit) 11864 return -EOPNOTSUPP; 11865 } else { 11866 wdev = NULL; 11867 } 11868 11869 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) { 11870 data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]); 11871 len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]); 11872 } 11873 11874 rdev->cur_cmd_info = info; 11875 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev, 11876 data, len); 11877 rdev->cur_cmd_info = NULL; 11878 return err; 11879 } 11880 11881 return -EOPNOTSUPP; 11882 } 11883 11884 static int nl80211_prepare_vendor_dump(struct sk_buff *skb, 11885 struct netlink_callback *cb, 11886 struct cfg80211_registered_device **rdev, 11887 struct wireless_dev **wdev) 11888 { 11889 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam); 11890 u32 vid, subcmd; 11891 unsigned int i; 11892 int vcmd_idx = -1; 11893 int err; 11894 void *data = NULL; 11895 unsigned int data_len = 0; 11896 11897 if (cb->args[0]) { 11898 /* subtract the 1 again here */ 11899 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1); 11900 struct wireless_dev *tmp; 11901 11902 if (!wiphy) 11903 return -ENODEV; 11904 *rdev = wiphy_to_rdev(wiphy); 11905 *wdev = NULL; 11906 11907 if (cb->args[1]) { 11908 list_for_each_entry(tmp, &wiphy->wdev_list, list) { 11909 if (tmp->identifier == cb->args[1] - 1) { 11910 *wdev = tmp; 11911 break; 11912 } 11913 } 11914 } 11915 11916 /* keep rtnl locked in successful case */ 11917 return 0; 11918 } 11919 11920 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, attrbuf, 11921 nl80211_fam.maxattr, nl80211_policy, NULL); 11922 if (err) 11923 return err; 11924 11925 if (!attrbuf[NL80211_ATTR_VENDOR_ID] || 11926 !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) 11927 return -EINVAL; 11928 11929 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk), attrbuf); 11930 if (IS_ERR(*wdev)) 11931 *wdev = NULL; 11932 11933 *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf); 11934 if (IS_ERR(*rdev)) 11935 return PTR_ERR(*rdev); 11936 11937 vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]); 11938 subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]); 11939 11940 for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) { 11941 const struct wiphy_vendor_command *vcmd; 11942 11943 vcmd = &(*rdev)->wiphy.vendor_commands[i]; 11944 11945 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd) 11946 continue; 11947 11948 if (!vcmd->dumpit) 11949 return -EOPNOTSUPP; 11950 11951 vcmd_idx = i; 11952 break; 11953 } 11954 11955 if (vcmd_idx < 0) 11956 return -EOPNOTSUPP; 11957 11958 if (attrbuf[NL80211_ATTR_VENDOR_DATA]) { 11959 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]); 11960 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]); 11961 } 11962 11963 /* 0 is the first index - add 1 to parse only once */ 11964 cb->args[0] = (*rdev)->wiphy_idx + 1; 11965 /* add 1 to know if it was NULL */ 11966 cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0; 11967 cb->args[2] = vcmd_idx; 11968 cb->args[3] = (unsigned long)data; 11969 cb->args[4] = data_len; 11970 11971 /* keep rtnl locked in successful case */ 11972 return 0; 11973 } 11974 11975 static int nl80211_vendor_cmd_dump(struct sk_buff *skb, 11976 struct netlink_callback *cb) 11977 { 11978 struct cfg80211_registered_device *rdev; 11979 struct wireless_dev *wdev; 11980 unsigned int vcmd_idx; 11981 const struct wiphy_vendor_command *vcmd; 11982 void *data; 11983 int data_len; 11984 int err; 11985 struct nlattr *vendor_data; 11986 11987 rtnl_lock(); 11988 err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev); 11989 if (err) 11990 goto out; 11991 11992 vcmd_idx = cb->args[2]; 11993 data = (void *)cb->args[3]; 11994 data_len = cb->args[4]; 11995 vcmd = &rdev->wiphy.vendor_commands[vcmd_idx]; 11996 11997 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV | 11998 WIPHY_VENDOR_CMD_NEED_NETDEV)) { 11999 if (!wdev) { 12000 err = -EINVAL; 12001 goto out; 12002 } 12003 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV && 12004 !wdev->netdev) { 12005 err = -EINVAL; 12006 goto out; 12007 } 12008 12009 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) { 12010 if (!wdev_running(wdev)) { 12011 err = -ENETDOWN; 12012 goto out; 12013 } 12014 } 12015 } 12016 12017 while (1) { 12018 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid, 12019 cb->nlh->nlmsg_seq, NLM_F_MULTI, 12020 NL80211_CMD_VENDOR); 12021 if (!hdr) 12022 break; 12023 12024 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 12025 (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV, 12026 wdev_id(wdev), 12027 NL80211_ATTR_PAD))) { 12028 genlmsg_cancel(skb, hdr); 12029 break; 12030 } 12031 12032 vendor_data = nla_nest_start(skb, NL80211_ATTR_VENDOR_DATA); 12033 if (!vendor_data) { 12034 genlmsg_cancel(skb, hdr); 12035 break; 12036 } 12037 12038 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len, 12039 (unsigned long *)&cb->args[5]); 12040 nla_nest_end(skb, vendor_data); 12041 12042 if (err == -ENOBUFS || err == -ENOENT) { 12043 genlmsg_cancel(skb, hdr); 12044 break; 12045 } else if (err) { 12046 genlmsg_cancel(skb, hdr); 12047 goto out; 12048 } 12049 12050 genlmsg_end(skb, hdr); 12051 } 12052 12053 err = skb->len; 12054 out: 12055 rtnl_unlock(); 12056 return err; 12057 } 12058 12059 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy, 12060 enum nl80211_commands cmd, 12061 enum nl80211_attrs attr, 12062 int approxlen) 12063 { 12064 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 12065 12066 if (WARN_ON(!rdev->cur_cmd_info)) 12067 return NULL; 12068 12069 return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen, 12070 rdev->cur_cmd_info->snd_portid, 12071 rdev->cur_cmd_info->snd_seq, 12072 cmd, attr, NULL, GFP_KERNEL); 12073 } 12074 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb); 12075 12076 int cfg80211_vendor_cmd_reply(struct sk_buff *skb) 12077 { 12078 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0]; 12079 void *hdr = ((void **)skb->cb)[1]; 12080 struct nlattr *data = ((void **)skb->cb)[2]; 12081 12082 /* clear CB data for netlink core to own from now on */ 12083 memset(skb->cb, 0, sizeof(skb->cb)); 12084 12085 if (WARN_ON(!rdev->cur_cmd_info)) { 12086 kfree_skb(skb); 12087 return -EINVAL; 12088 } 12089 12090 nla_nest_end(skb, data); 12091 genlmsg_end(skb, hdr); 12092 return genlmsg_reply(skb, rdev->cur_cmd_info); 12093 } 12094 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply); 12095 12096 static int nl80211_set_qos_map(struct sk_buff *skb, 12097 struct genl_info *info) 12098 { 12099 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12100 struct cfg80211_qos_map *qos_map = NULL; 12101 struct net_device *dev = info->user_ptr[1]; 12102 u8 *pos, len, num_des, des_len, des; 12103 int ret; 12104 12105 if (!rdev->ops->set_qos_map) 12106 return -EOPNOTSUPP; 12107 12108 if (info->attrs[NL80211_ATTR_QOS_MAP]) { 12109 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]); 12110 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]); 12111 12112 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN || 12113 len > IEEE80211_QOS_MAP_LEN_MAX) 12114 return -EINVAL; 12115 12116 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL); 12117 if (!qos_map) 12118 return -ENOMEM; 12119 12120 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1; 12121 if (num_des) { 12122 des_len = num_des * 12123 sizeof(struct cfg80211_dscp_exception); 12124 memcpy(qos_map->dscp_exception, pos, des_len); 12125 qos_map->num_des = num_des; 12126 for (des = 0; des < num_des; des++) { 12127 if (qos_map->dscp_exception[des].up > 7) { 12128 kfree(qos_map); 12129 return -EINVAL; 12130 } 12131 } 12132 pos += des_len; 12133 } 12134 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN); 12135 } 12136 12137 wdev_lock(dev->ieee80211_ptr); 12138 ret = nl80211_key_allowed(dev->ieee80211_ptr); 12139 if (!ret) 12140 ret = rdev_set_qos_map(rdev, dev, qos_map); 12141 wdev_unlock(dev->ieee80211_ptr); 12142 12143 kfree(qos_map); 12144 return ret; 12145 } 12146 12147 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info) 12148 { 12149 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12150 struct net_device *dev = info->user_ptr[1]; 12151 struct wireless_dev *wdev = dev->ieee80211_ptr; 12152 const u8 *peer; 12153 u8 tsid, up; 12154 u16 admitted_time = 0; 12155 int err; 12156 12157 if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)) 12158 return -EOPNOTSUPP; 12159 12160 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] || 12161 !info->attrs[NL80211_ATTR_USER_PRIO]) 12162 return -EINVAL; 12163 12164 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]); 12165 if (tsid >= IEEE80211_NUM_TIDS) 12166 return -EINVAL; 12167 12168 up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]); 12169 if (up >= IEEE80211_NUM_UPS) 12170 return -EINVAL; 12171 12172 /* WMM uses TIDs 0-7 even for TSPEC */ 12173 if (tsid >= IEEE80211_FIRST_TSPEC_TSID) { 12174 /* TODO: handle 802.11 TSPEC/admission control 12175 * need more attributes for that (e.g. BA session requirement); 12176 * change the WMM adminssion test above to allow both then 12177 */ 12178 return -EINVAL; 12179 } 12180 12181 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 12182 12183 if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) { 12184 admitted_time = 12185 nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]); 12186 if (!admitted_time) 12187 return -EINVAL; 12188 } 12189 12190 wdev_lock(wdev); 12191 switch (wdev->iftype) { 12192 case NL80211_IFTYPE_STATION: 12193 case NL80211_IFTYPE_P2P_CLIENT: 12194 if (wdev->current_bss) 12195 break; 12196 err = -ENOTCONN; 12197 goto out; 12198 default: 12199 err = -EOPNOTSUPP; 12200 goto out; 12201 } 12202 12203 err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time); 12204 12205 out: 12206 wdev_unlock(wdev); 12207 return err; 12208 } 12209 12210 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info) 12211 { 12212 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12213 struct net_device *dev = info->user_ptr[1]; 12214 struct wireless_dev *wdev = dev->ieee80211_ptr; 12215 const u8 *peer; 12216 u8 tsid; 12217 int err; 12218 12219 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC]) 12220 return -EINVAL; 12221 12222 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]); 12223 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 12224 12225 wdev_lock(wdev); 12226 err = rdev_del_tx_ts(rdev, dev, tsid, peer); 12227 wdev_unlock(wdev); 12228 12229 return err; 12230 } 12231 12232 static int nl80211_tdls_channel_switch(struct sk_buff *skb, 12233 struct genl_info *info) 12234 { 12235 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12236 struct net_device *dev = info->user_ptr[1]; 12237 struct wireless_dev *wdev = dev->ieee80211_ptr; 12238 struct cfg80211_chan_def chandef = {}; 12239 const u8 *addr; 12240 u8 oper_class; 12241 int err; 12242 12243 if (!rdev->ops->tdls_channel_switch || 12244 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH)) 12245 return -EOPNOTSUPP; 12246 12247 switch (dev->ieee80211_ptr->iftype) { 12248 case NL80211_IFTYPE_STATION: 12249 case NL80211_IFTYPE_P2P_CLIENT: 12250 break; 12251 default: 12252 return -EOPNOTSUPP; 12253 } 12254 12255 if (!info->attrs[NL80211_ATTR_MAC] || 12256 !info->attrs[NL80211_ATTR_OPER_CLASS]) 12257 return -EINVAL; 12258 12259 err = nl80211_parse_chandef(rdev, info, &chandef); 12260 if (err) 12261 return err; 12262 12263 /* 12264 * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012 12265 * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the 12266 * specification is not defined for them. 12267 */ 12268 if (chandef.chan->band == NL80211_BAND_2GHZ && 12269 chandef.width != NL80211_CHAN_WIDTH_20_NOHT && 12270 chandef.width != NL80211_CHAN_WIDTH_20) 12271 return -EINVAL; 12272 12273 /* we will be active on the TDLS link */ 12274 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef, 12275 wdev->iftype)) 12276 return -EINVAL; 12277 12278 /* don't allow switching to DFS channels */ 12279 if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype)) 12280 return -EINVAL; 12281 12282 addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 12283 oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]); 12284 12285 wdev_lock(wdev); 12286 err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef); 12287 wdev_unlock(wdev); 12288 12289 return err; 12290 } 12291 12292 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb, 12293 struct genl_info *info) 12294 { 12295 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12296 struct net_device *dev = info->user_ptr[1]; 12297 struct wireless_dev *wdev = dev->ieee80211_ptr; 12298 const u8 *addr; 12299 12300 if (!rdev->ops->tdls_channel_switch || 12301 !rdev->ops->tdls_cancel_channel_switch || 12302 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH)) 12303 return -EOPNOTSUPP; 12304 12305 switch (dev->ieee80211_ptr->iftype) { 12306 case NL80211_IFTYPE_STATION: 12307 case NL80211_IFTYPE_P2P_CLIENT: 12308 break; 12309 default: 12310 return -EOPNOTSUPP; 12311 } 12312 12313 if (!info->attrs[NL80211_ATTR_MAC]) 12314 return -EINVAL; 12315 12316 addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 12317 12318 wdev_lock(wdev); 12319 rdev_tdls_cancel_channel_switch(rdev, dev, addr); 12320 wdev_unlock(wdev); 12321 12322 return 0; 12323 } 12324 12325 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb, 12326 struct genl_info *info) 12327 { 12328 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12329 struct net_device *dev = info->user_ptr[1]; 12330 struct wireless_dev *wdev = dev->ieee80211_ptr; 12331 const struct nlattr *nla; 12332 bool enabled; 12333 12334 if (!rdev->ops->set_multicast_to_unicast) 12335 return -EOPNOTSUPP; 12336 12337 if (wdev->iftype != NL80211_IFTYPE_AP && 12338 wdev->iftype != NL80211_IFTYPE_P2P_GO) 12339 return -EOPNOTSUPP; 12340 12341 nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED]; 12342 enabled = nla_get_flag(nla); 12343 12344 return rdev_set_multicast_to_unicast(rdev, dev, enabled); 12345 } 12346 12347 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info) 12348 { 12349 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12350 struct net_device *dev = info->user_ptr[1]; 12351 struct wireless_dev *wdev = dev->ieee80211_ptr; 12352 struct cfg80211_pmk_conf pmk_conf = {}; 12353 int ret; 12354 12355 if (wdev->iftype != NL80211_IFTYPE_STATION && 12356 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 12357 return -EOPNOTSUPP; 12358 12359 if (!wiphy_ext_feature_isset(&rdev->wiphy, 12360 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X)) 12361 return -EOPNOTSUPP; 12362 12363 if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK]) 12364 return -EINVAL; 12365 12366 wdev_lock(wdev); 12367 if (!wdev->current_bss) { 12368 ret = -ENOTCONN; 12369 goto out; 12370 } 12371 12372 pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]); 12373 if (memcmp(pmk_conf.aa, wdev->current_bss->pub.bssid, ETH_ALEN)) { 12374 ret = -EINVAL; 12375 goto out; 12376 } 12377 12378 pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]); 12379 pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]); 12380 if (pmk_conf.pmk_len != WLAN_PMK_LEN && 12381 pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) { 12382 ret = -EINVAL; 12383 goto out; 12384 } 12385 12386 if (info->attrs[NL80211_ATTR_PMKR0_NAME]) { 12387 int r0_name_len = nla_len(info->attrs[NL80211_ATTR_PMKR0_NAME]); 12388 12389 if (r0_name_len != WLAN_PMK_NAME_LEN) { 12390 ret = -EINVAL; 12391 goto out; 12392 } 12393 12394 pmk_conf.pmk_r0_name = 12395 nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]); 12396 } 12397 12398 ret = rdev_set_pmk(rdev, dev, &pmk_conf); 12399 out: 12400 wdev_unlock(wdev); 12401 return ret; 12402 } 12403 12404 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info) 12405 { 12406 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12407 struct net_device *dev = info->user_ptr[1]; 12408 struct wireless_dev *wdev = dev->ieee80211_ptr; 12409 const u8 *aa; 12410 int ret; 12411 12412 if (wdev->iftype != NL80211_IFTYPE_STATION && 12413 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 12414 return -EOPNOTSUPP; 12415 12416 if (!wiphy_ext_feature_isset(&rdev->wiphy, 12417 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X)) 12418 return -EOPNOTSUPP; 12419 12420 if (!info->attrs[NL80211_ATTR_MAC]) 12421 return -EINVAL; 12422 12423 wdev_lock(wdev); 12424 aa = nla_data(info->attrs[NL80211_ATTR_MAC]); 12425 ret = rdev_del_pmk(rdev, dev, aa); 12426 wdev_unlock(wdev); 12427 12428 return ret; 12429 } 12430 12431 #define NL80211_FLAG_NEED_WIPHY 0x01 12432 #define NL80211_FLAG_NEED_NETDEV 0x02 12433 #define NL80211_FLAG_NEED_RTNL 0x04 12434 #define NL80211_FLAG_CHECK_NETDEV_UP 0x08 12435 #define NL80211_FLAG_NEED_NETDEV_UP (NL80211_FLAG_NEED_NETDEV |\ 12436 NL80211_FLAG_CHECK_NETDEV_UP) 12437 #define NL80211_FLAG_NEED_WDEV 0x10 12438 /* If a netdev is associated, it must be UP, P2P must be started */ 12439 #define NL80211_FLAG_NEED_WDEV_UP (NL80211_FLAG_NEED_WDEV |\ 12440 NL80211_FLAG_CHECK_NETDEV_UP) 12441 #define NL80211_FLAG_CLEAR_SKB 0x20 12442 12443 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb, 12444 struct genl_info *info) 12445 { 12446 struct cfg80211_registered_device *rdev; 12447 struct wireless_dev *wdev; 12448 struct net_device *dev; 12449 bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL; 12450 12451 if (rtnl) 12452 rtnl_lock(); 12453 12454 if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) { 12455 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info); 12456 if (IS_ERR(rdev)) { 12457 if (rtnl) 12458 rtnl_unlock(); 12459 return PTR_ERR(rdev); 12460 } 12461 info->user_ptr[0] = rdev; 12462 } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV || 12463 ops->internal_flags & NL80211_FLAG_NEED_WDEV) { 12464 ASSERT_RTNL(); 12465 12466 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info), 12467 info->attrs); 12468 if (IS_ERR(wdev)) { 12469 if (rtnl) 12470 rtnl_unlock(); 12471 return PTR_ERR(wdev); 12472 } 12473 12474 dev = wdev->netdev; 12475 rdev = wiphy_to_rdev(wdev->wiphy); 12476 12477 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) { 12478 if (!dev) { 12479 if (rtnl) 12480 rtnl_unlock(); 12481 return -EINVAL; 12482 } 12483 12484 info->user_ptr[1] = dev; 12485 } else { 12486 info->user_ptr[1] = wdev; 12487 } 12488 12489 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP && 12490 !wdev_running(wdev)) { 12491 if (rtnl) 12492 rtnl_unlock(); 12493 return -ENETDOWN; 12494 } 12495 12496 if (dev) 12497 dev_hold(dev); 12498 12499 info->user_ptr[0] = rdev; 12500 } 12501 12502 return 0; 12503 } 12504 12505 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb, 12506 struct genl_info *info) 12507 { 12508 if (info->user_ptr[1]) { 12509 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) { 12510 struct wireless_dev *wdev = info->user_ptr[1]; 12511 12512 if (wdev->netdev) 12513 dev_put(wdev->netdev); 12514 } else { 12515 dev_put(info->user_ptr[1]); 12516 } 12517 } 12518 12519 if (ops->internal_flags & NL80211_FLAG_NEED_RTNL) 12520 rtnl_unlock(); 12521 12522 /* If needed, clear the netlink message payload from the SKB 12523 * as it might contain key data that shouldn't stick around on 12524 * the heap after the SKB is freed. The netlink message header 12525 * is still needed for further processing, so leave it intact. 12526 */ 12527 if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) { 12528 struct nlmsghdr *nlh = nlmsg_hdr(skb); 12529 12530 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh)); 12531 } 12532 } 12533 12534 static const struct genl_ops nl80211_ops[] = { 12535 { 12536 .cmd = NL80211_CMD_GET_WIPHY, 12537 .doit = nl80211_get_wiphy, 12538 .dumpit = nl80211_dump_wiphy, 12539 .done = nl80211_dump_wiphy_done, 12540 .policy = nl80211_policy, 12541 /* can be retrieved by unprivileged users */ 12542 .internal_flags = NL80211_FLAG_NEED_WIPHY | 12543 NL80211_FLAG_NEED_RTNL, 12544 }, 12545 { 12546 .cmd = NL80211_CMD_SET_WIPHY, 12547 .doit = nl80211_set_wiphy, 12548 .policy = nl80211_policy, 12549 .flags = GENL_UNS_ADMIN_PERM, 12550 .internal_flags = NL80211_FLAG_NEED_RTNL, 12551 }, 12552 { 12553 .cmd = NL80211_CMD_GET_INTERFACE, 12554 .doit = nl80211_get_interface, 12555 .dumpit = nl80211_dump_interface, 12556 .policy = nl80211_policy, 12557 /* can be retrieved by unprivileged users */ 12558 .internal_flags = NL80211_FLAG_NEED_WDEV | 12559 NL80211_FLAG_NEED_RTNL, 12560 }, 12561 { 12562 .cmd = NL80211_CMD_SET_INTERFACE, 12563 .doit = nl80211_set_interface, 12564 .policy = nl80211_policy, 12565 .flags = GENL_UNS_ADMIN_PERM, 12566 .internal_flags = NL80211_FLAG_NEED_NETDEV | 12567 NL80211_FLAG_NEED_RTNL, 12568 }, 12569 { 12570 .cmd = NL80211_CMD_NEW_INTERFACE, 12571 .doit = nl80211_new_interface, 12572 .policy = nl80211_policy, 12573 .flags = GENL_UNS_ADMIN_PERM, 12574 .internal_flags = NL80211_FLAG_NEED_WIPHY | 12575 NL80211_FLAG_NEED_RTNL, 12576 }, 12577 { 12578 .cmd = NL80211_CMD_DEL_INTERFACE, 12579 .doit = nl80211_del_interface, 12580 .policy = nl80211_policy, 12581 .flags = GENL_UNS_ADMIN_PERM, 12582 .internal_flags = NL80211_FLAG_NEED_WDEV | 12583 NL80211_FLAG_NEED_RTNL, 12584 }, 12585 { 12586 .cmd = NL80211_CMD_GET_KEY, 12587 .doit = nl80211_get_key, 12588 .policy = nl80211_policy, 12589 .flags = GENL_UNS_ADMIN_PERM, 12590 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12591 NL80211_FLAG_NEED_RTNL, 12592 }, 12593 { 12594 .cmd = NL80211_CMD_SET_KEY, 12595 .doit = nl80211_set_key, 12596 .policy = nl80211_policy, 12597 .flags = GENL_UNS_ADMIN_PERM, 12598 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12599 NL80211_FLAG_NEED_RTNL | 12600 NL80211_FLAG_CLEAR_SKB, 12601 }, 12602 { 12603 .cmd = NL80211_CMD_NEW_KEY, 12604 .doit = nl80211_new_key, 12605 .policy = nl80211_policy, 12606 .flags = GENL_UNS_ADMIN_PERM, 12607 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12608 NL80211_FLAG_NEED_RTNL | 12609 NL80211_FLAG_CLEAR_SKB, 12610 }, 12611 { 12612 .cmd = NL80211_CMD_DEL_KEY, 12613 .doit = nl80211_del_key, 12614 .policy = nl80211_policy, 12615 .flags = GENL_UNS_ADMIN_PERM, 12616 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12617 NL80211_FLAG_NEED_RTNL, 12618 }, 12619 { 12620 .cmd = NL80211_CMD_SET_BEACON, 12621 .policy = nl80211_policy, 12622 .flags = GENL_UNS_ADMIN_PERM, 12623 .doit = nl80211_set_beacon, 12624 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12625 NL80211_FLAG_NEED_RTNL, 12626 }, 12627 { 12628 .cmd = NL80211_CMD_START_AP, 12629 .policy = nl80211_policy, 12630 .flags = GENL_UNS_ADMIN_PERM, 12631 .doit = nl80211_start_ap, 12632 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12633 NL80211_FLAG_NEED_RTNL, 12634 }, 12635 { 12636 .cmd = NL80211_CMD_STOP_AP, 12637 .policy = nl80211_policy, 12638 .flags = GENL_UNS_ADMIN_PERM, 12639 .doit = nl80211_stop_ap, 12640 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12641 NL80211_FLAG_NEED_RTNL, 12642 }, 12643 { 12644 .cmd = NL80211_CMD_GET_STATION, 12645 .doit = nl80211_get_station, 12646 .dumpit = nl80211_dump_station, 12647 .policy = nl80211_policy, 12648 .internal_flags = NL80211_FLAG_NEED_NETDEV | 12649 NL80211_FLAG_NEED_RTNL, 12650 }, 12651 { 12652 .cmd = NL80211_CMD_SET_STATION, 12653 .doit = nl80211_set_station, 12654 .policy = nl80211_policy, 12655 .flags = GENL_UNS_ADMIN_PERM, 12656 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12657 NL80211_FLAG_NEED_RTNL, 12658 }, 12659 { 12660 .cmd = NL80211_CMD_NEW_STATION, 12661 .doit = nl80211_new_station, 12662 .policy = nl80211_policy, 12663 .flags = GENL_UNS_ADMIN_PERM, 12664 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12665 NL80211_FLAG_NEED_RTNL, 12666 }, 12667 { 12668 .cmd = NL80211_CMD_DEL_STATION, 12669 .doit = nl80211_del_station, 12670 .policy = nl80211_policy, 12671 .flags = GENL_UNS_ADMIN_PERM, 12672 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12673 NL80211_FLAG_NEED_RTNL, 12674 }, 12675 { 12676 .cmd = NL80211_CMD_GET_MPATH, 12677 .doit = nl80211_get_mpath, 12678 .dumpit = nl80211_dump_mpath, 12679 .policy = nl80211_policy, 12680 .flags = GENL_UNS_ADMIN_PERM, 12681 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12682 NL80211_FLAG_NEED_RTNL, 12683 }, 12684 { 12685 .cmd = NL80211_CMD_GET_MPP, 12686 .doit = nl80211_get_mpp, 12687 .dumpit = nl80211_dump_mpp, 12688 .policy = nl80211_policy, 12689 .flags = GENL_UNS_ADMIN_PERM, 12690 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12691 NL80211_FLAG_NEED_RTNL, 12692 }, 12693 { 12694 .cmd = NL80211_CMD_SET_MPATH, 12695 .doit = nl80211_set_mpath, 12696 .policy = nl80211_policy, 12697 .flags = GENL_UNS_ADMIN_PERM, 12698 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12699 NL80211_FLAG_NEED_RTNL, 12700 }, 12701 { 12702 .cmd = NL80211_CMD_NEW_MPATH, 12703 .doit = nl80211_new_mpath, 12704 .policy = nl80211_policy, 12705 .flags = GENL_UNS_ADMIN_PERM, 12706 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12707 NL80211_FLAG_NEED_RTNL, 12708 }, 12709 { 12710 .cmd = NL80211_CMD_DEL_MPATH, 12711 .doit = nl80211_del_mpath, 12712 .policy = nl80211_policy, 12713 .flags = GENL_UNS_ADMIN_PERM, 12714 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12715 NL80211_FLAG_NEED_RTNL, 12716 }, 12717 { 12718 .cmd = NL80211_CMD_SET_BSS, 12719 .doit = nl80211_set_bss, 12720 .policy = nl80211_policy, 12721 .flags = GENL_UNS_ADMIN_PERM, 12722 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12723 NL80211_FLAG_NEED_RTNL, 12724 }, 12725 { 12726 .cmd = NL80211_CMD_GET_REG, 12727 .doit = nl80211_get_reg_do, 12728 .dumpit = nl80211_get_reg_dump, 12729 .policy = nl80211_policy, 12730 .internal_flags = NL80211_FLAG_NEED_RTNL, 12731 /* can be retrieved by unprivileged users */ 12732 }, 12733 #ifdef CONFIG_CFG80211_CRDA_SUPPORT 12734 { 12735 .cmd = NL80211_CMD_SET_REG, 12736 .doit = nl80211_set_reg, 12737 .policy = nl80211_policy, 12738 .flags = GENL_ADMIN_PERM, 12739 .internal_flags = NL80211_FLAG_NEED_RTNL, 12740 }, 12741 #endif 12742 { 12743 .cmd = NL80211_CMD_REQ_SET_REG, 12744 .doit = nl80211_req_set_reg, 12745 .policy = nl80211_policy, 12746 .flags = GENL_ADMIN_PERM, 12747 }, 12748 { 12749 .cmd = NL80211_CMD_RELOAD_REGDB, 12750 .doit = nl80211_reload_regdb, 12751 .policy = nl80211_policy, 12752 .flags = GENL_ADMIN_PERM, 12753 }, 12754 { 12755 .cmd = NL80211_CMD_GET_MESH_CONFIG, 12756 .doit = nl80211_get_mesh_config, 12757 .policy = nl80211_policy, 12758 /* can be retrieved by unprivileged users */ 12759 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12760 NL80211_FLAG_NEED_RTNL, 12761 }, 12762 { 12763 .cmd = NL80211_CMD_SET_MESH_CONFIG, 12764 .doit = nl80211_update_mesh_config, 12765 .policy = nl80211_policy, 12766 .flags = GENL_UNS_ADMIN_PERM, 12767 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12768 NL80211_FLAG_NEED_RTNL, 12769 }, 12770 { 12771 .cmd = NL80211_CMD_TRIGGER_SCAN, 12772 .doit = nl80211_trigger_scan, 12773 .policy = nl80211_policy, 12774 .flags = GENL_UNS_ADMIN_PERM, 12775 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 12776 NL80211_FLAG_NEED_RTNL, 12777 }, 12778 { 12779 .cmd = NL80211_CMD_ABORT_SCAN, 12780 .doit = nl80211_abort_scan, 12781 .policy = nl80211_policy, 12782 .flags = GENL_UNS_ADMIN_PERM, 12783 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 12784 NL80211_FLAG_NEED_RTNL, 12785 }, 12786 { 12787 .cmd = NL80211_CMD_GET_SCAN, 12788 .policy = nl80211_policy, 12789 .dumpit = nl80211_dump_scan, 12790 }, 12791 { 12792 .cmd = NL80211_CMD_START_SCHED_SCAN, 12793 .doit = nl80211_start_sched_scan, 12794 .policy = nl80211_policy, 12795 .flags = GENL_UNS_ADMIN_PERM, 12796 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12797 NL80211_FLAG_NEED_RTNL, 12798 }, 12799 { 12800 .cmd = NL80211_CMD_STOP_SCHED_SCAN, 12801 .doit = nl80211_stop_sched_scan, 12802 .policy = nl80211_policy, 12803 .flags = GENL_UNS_ADMIN_PERM, 12804 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12805 NL80211_FLAG_NEED_RTNL, 12806 }, 12807 { 12808 .cmd = NL80211_CMD_AUTHENTICATE, 12809 .doit = nl80211_authenticate, 12810 .policy = nl80211_policy, 12811 .flags = GENL_UNS_ADMIN_PERM, 12812 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12813 NL80211_FLAG_NEED_RTNL | 12814 NL80211_FLAG_CLEAR_SKB, 12815 }, 12816 { 12817 .cmd = NL80211_CMD_ASSOCIATE, 12818 .doit = nl80211_associate, 12819 .policy = nl80211_policy, 12820 .flags = GENL_UNS_ADMIN_PERM, 12821 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12822 NL80211_FLAG_NEED_RTNL, 12823 }, 12824 { 12825 .cmd = NL80211_CMD_DEAUTHENTICATE, 12826 .doit = nl80211_deauthenticate, 12827 .policy = nl80211_policy, 12828 .flags = GENL_UNS_ADMIN_PERM, 12829 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12830 NL80211_FLAG_NEED_RTNL, 12831 }, 12832 { 12833 .cmd = NL80211_CMD_DISASSOCIATE, 12834 .doit = nl80211_disassociate, 12835 .policy = nl80211_policy, 12836 .flags = GENL_UNS_ADMIN_PERM, 12837 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12838 NL80211_FLAG_NEED_RTNL, 12839 }, 12840 { 12841 .cmd = NL80211_CMD_JOIN_IBSS, 12842 .doit = nl80211_join_ibss, 12843 .policy = nl80211_policy, 12844 .flags = GENL_UNS_ADMIN_PERM, 12845 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12846 NL80211_FLAG_NEED_RTNL, 12847 }, 12848 { 12849 .cmd = NL80211_CMD_LEAVE_IBSS, 12850 .doit = nl80211_leave_ibss, 12851 .policy = nl80211_policy, 12852 .flags = GENL_UNS_ADMIN_PERM, 12853 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12854 NL80211_FLAG_NEED_RTNL, 12855 }, 12856 #ifdef CONFIG_NL80211_TESTMODE 12857 { 12858 .cmd = NL80211_CMD_TESTMODE, 12859 .doit = nl80211_testmode_do, 12860 .dumpit = nl80211_testmode_dump, 12861 .policy = nl80211_policy, 12862 .flags = GENL_UNS_ADMIN_PERM, 12863 .internal_flags = NL80211_FLAG_NEED_WIPHY | 12864 NL80211_FLAG_NEED_RTNL, 12865 }, 12866 #endif 12867 { 12868 .cmd = NL80211_CMD_CONNECT, 12869 .doit = nl80211_connect, 12870 .policy = nl80211_policy, 12871 .flags = GENL_UNS_ADMIN_PERM, 12872 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12873 NL80211_FLAG_NEED_RTNL, 12874 }, 12875 { 12876 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS, 12877 .doit = nl80211_update_connect_params, 12878 .policy = nl80211_policy, 12879 .flags = GENL_ADMIN_PERM, 12880 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12881 NL80211_FLAG_NEED_RTNL, 12882 }, 12883 { 12884 .cmd = NL80211_CMD_DISCONNECT, 12885 .doit = nl80211_disconnect, 12886 .policy = nl80211_policy, 12887 .flags = GENL_UNS_ADMIN_PERM, 12888 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12889 NL80211_FLAG_NEED_RTNL, 12890 }, 12891 { 12892 .cmd = NL80211_CMD_SET_WIPHY_NETNS, 12893 .doit = nl80211_wiphy_netns, 12894 .policy = nl80211_policy, 12895 .flags = GENL_UNS_ADMIN_PERM, 12896 .internal_flags = NL80211_FLAG_NEED_WIPHY | 12897 NL80211_FLAG_NEED_RTNL, 12898 }, 12899 { 12900 .cmd = NL80211_CMD_GET_SURVEY, 12901 .policy = nl80211_policy, 12902 .dumpit = nl80211_dump_survey, 12903 }, 12904 { 12905 .cmd = NL80211_CMD_SET_PMKSA, 12906 .doit = nl80211_setdel_pmksa, 12907 .policy = nl80211_policy, 12908 .flags = GENL_UNS_ADMIN_PERM, 12909 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12910 NL80211_FLAG_NEED_RTNL, 12911 }, 12912 { 12913 .cmd = NL80211_CMD_DEL_PMKSA, 12914 .doit = nl80211_setdel_pmksa, 12915 .policy = nl80211_policy, 12916 .flags = GENL_UNS_ADMIN_PERM, 12917 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12918 NL80211_FLAG_NEED_RTNL, 12919 }, 12920 { 12921 .cmd = NL80211_CMD_FLUSH_PMKSA, 12922 .doit = nl80211_flush_pmksa, 12923 .policy = nl80211_policy, 12924 .flags = GENL_UNS_ADMIN_PERM, 12925 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12926 NL80211_FLAG_NEED_RTNL, 12927 }, 12928 { 12929 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL, 12930 .doit = nl80211_remain_on_channel, 12931 .policy = nl80211_policy, 12932 .flags = GENL_UNS_ADMIN_PERM, 12933 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 12934 NL80211_FLAG_NEED_RTNL, 12935 }, 12936 { 12937 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL, 12938 .doit = nl80211_cancel_remain_on_channel, 12939 .policy = nl80211_policy, 12940 .flags = GENL_UNS_ADMIN_PERM, 12941 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 12942 NL80211_FLAG_NEED_RTNL, 12943 }, 12944 { 12945 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK, 12946 .doit = nl80211_set_tx_bitrate_mask, 12947 .policy = nl80211_policy, 12948 .flags = GENL_UNS_ADMIN_PERM, 12949 .internal_flags = NL80211_FLAG_NEED_NETDEV | 12950 NL80211_FLAG_NEED_RTNL, 12951 }, 12952 { 12953 .cmd = NL80211_CMD_REGISTER_FRAME, 12954 .doit = nl80211_register_mgmt, 12955 .policy = nl80211_policy, 12956 .flags = GENL_UNS_ADMIN_PERM, 12957 .internal_flags = NL80211_FLAG_NEED_WDEV | 12958 NL80211_FLAG_NEED_RTNL, 12959 }, 12960 { 12961 .cmd = NL80211_CMD_FRAME, 12962 .doit = nl80211_tx_mgmt, 12963 .policy = nl80211_policy, 12964 .flags = GENL_UNS_ADMIN_PERM, 12965 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 12966 NL80211_FLAG_NEED_RTNL, 12967 }, 12968 { 12969 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL, 12970 .doit = nl80211_tx_mgmt_cancel_wait, 12971 .policy = nl80211_policy, 12972 .flags = GENL_UNS_ADMIN_PERM, 12973 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 12974 NL80211_FLAG_NEED_RTNL, 12975 }, 12976 { 12977 .cmd = NL80211_CMD_SET_POWER_SAVE, 12978 .doit = nl80211_set_power_save, 12979 .policy = nl80211_policy, 12980 .flags = GENL_UNS_ADMIN_PERM, 12981 .internal_flags = NL80211_FLAG_NEED_NETDEV | 12982 NL80211_FLAG_NEED_RTNL, 12983 }, 12984 { 12985 .cmd = NL80211_CMD_GET_POWER_SAVE, 12986 .doit = nl80211_get_power_save, 12987 .policy = nl80211_policy, 12988 /* can be retrieved by unprivileged users */ 12989 .internal_flags = NL80211_FLAG_NEED_NETDEV | 12990 NL80211_FLAG_NEED_RTNL, 12991 }, 12992 { 12993 .cmd = NL80211_CMD_SET_CQM, 12994 .doit = nl80211_set_cqm, 12995 .policy = nl80211_policy, 12996 .flags = GENL_UNS_ADMIN_PERM, 12997 .internal_flags = NL80211_FLAG_NEED_NETDEV | 12998 NL80211_FLAG_NEED_RTNL, 12999 }, 13000 { 13001 .cmd = NL80211_CMD_SET_CHANNEL, 13002 .doit = nl80211_set_channel, 13003 .policy = nl80211_policy, 13004 .flags = GENL_UNS_ADMIN_PERM, 13005 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13006 NL80211_FLAG_NEED_RTNL, 13007 }, 13008 { 13009 .cmd = NL80211_CMD_SET_WDS_PEER, 13010 .doit = nl80211_set_wds_peer, 13011 .policy = nl80211_policy, 13012 .flags = GENL_UNS_ADMIN_PERM, 13013 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13014 NL80211_FLAG_NEED_RTNL, 13015 }, 13016 { 13017 .cmd = NL80211_CMD_JOIN_MESH, 13018 .doit = nl80211_join_mesh, 13019 .policy = nl80211_policy, 13020 .flags = GENL_UNS_ADMIN_PERM, 13021 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13022 NL80211_FLAG_NEED_RTNL, 13023 }, 13024 { 13025 .cmd = NL80211_CMD_LEAVE_MESH, 13026 .doit = nl80211_leave_mesh, 13027 .policy = nl80211_policy, 13028 .flags = GENL_UNS_ADMIN_PERM, 13029 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13030 NL80211_FLAG_NEED_RTNL, 13031 }, 13032 { 13033 .cmd = NL80211_CMD_JOIN_OCB, 13034 .doit = nl80211_join_ocb, 13035 .policy = nl80211_policy, 13036 .flags = GENL_UNS_ADMIN_PERM, 13037 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13038 NL80211_FLAG_NEED_RTNL, 13039 }, 13040 { 13041 .cmd = NL80211_CMD_LEAVE_OCB, 13042 .doit = nl80211_leave_ocb, 13043 .policy = nl80211_policy, 13044 .flags = GENL_UNS_ADMIN_PERM, 13045 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13046 NL80211_FLAG_NEED_RTNL, 13047 }, 13048 #ifdef CONFIG_PM 13049 { 13050 .cmd = NL80211_CMD_GET_WOWLAN, 13051 .doit = nl80211_get_wowlan, 13052 .policy = nl80211_policy, 13053 /* can be retrieved by unprivileged users */ 13054 .internal_flags = NL80211_FLAG_NEED_WIPHY | 13055 NL80211_FLAG_NEED_RTNL, 13056 }, 13057 { 13058 .cmd = NL80211_CMD_SET_WOWLAN, 13059 .doit = nl80211_set_wowlan, 13060 .policy = nl80211_policy, 13061 .flags = GENL_UNS_ADMIN_PERM, 13062 .internal_flags = NL80211_FLAG_NEED_WIPHY | 13063 NL80211_FLAG_NEED_RTNL, 13064 }, 13065 #endif 13066 { 13067 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD, 13068 .doit = nl80211_set_rekey_data, 13069 .policy = nl80211_policy, 13070 .flags = GENL_UNS_ADMIN_PERM, 13071 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13072 NL80211_FLAG_NEED_RTNL | 13073 NL80211_FLAG_CLEAR_SKB, 13074 }, 13075 { 13076 .cmd = NL80211_CMD_TDLS_MGMT, 13077 .doit = nl80211_tdls_mgmt, 13078 .policy = nl80211_policy, 13079 .flags = GENL_UNS_ADMIN_PERM, 13080 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13081 NL80211_FLAG_NEED_RTNL, 13082 }, 13083 { 13084 .cmd = NL80211_CMD_TDLS_OPER, 13085 .doit = nl80211_tdls_oper, 13086 .policy = nl80211_policy, 13087 .flags = GENL_UNS_ADMIN_PERM, 13088 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13089 NL80211_FLAG_NEED_RTNL, 13090 }, 13091 { 13092 .cmd = NL80211_CMD_UNEXPECTED_FRAME, 13093 .doit = nl80211_register_unexpected_frame, 13094 .policy = nl80211_policy, 13095 .flags = GENL_UNS_ADMIN_PERM, 13096 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13097 NL80211_FLAG_NEED_RTNL, 13098 }, 13099 { 13100 .cmd = NL80211_CMD_PROBE_CLIENT, 13101 .doit = nl80211_probe_client, 13102 .policy = nl80211_policy, 13103 .flags = GENL_UNS_ADMIN_PERM, 13104 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13105 NL80211_FLAG_NEED_RTNL, 13106 }, 13107 { 13108 .cmd = NL80211_CMD_REGISTER_BEACONS, 13109 .doit = nl80211_register_beacons, 13110 .policy = nl80211_policy, 13111 .flags = GENL_UNS_ADMIN_PERM, 13112 .internal_flags = NL80211_FLAG_NEED_WIPHY | 13113 NL80211_FLAG_NEED_RTNL, 13114 }, 13115 { 13116 .cmd = NL80211_CMD_SET_NOACK_MAP, 13117 .doit = nl80211_set_noack_map, 13118 .policy = nl80211_policy, 13119 .flags = GENL_UNS_ADMIN_PERM, 13120 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13121 NL80211_FLAG_NEED_RTNL, 13122 }, 13123 { 13124 .cmd = NL80211_CMD_START_P2P_DEVICE, 13125 .doit = nl80211_start_p2p_device, 13126 .policy = nl80211_policy, 13127 .flags = GENL_UNS_ADMIN_PERM, 13128 .internal_flags = NL80211_FLAG_NEED_WDEV | 13129 NL80211_FLAG_NEED_RTNL, 13130 }, 13131 { 13132 .cmd = NL80211_CMD_STOP_P2P_DEVICE, 13133 .doit = nl80211_stop_p2p_device, 13134 .policy = nl80211_policy, 13135 .flags = GENL_UNS_ADMIN_PERM, 13136 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13137 NL80211_FLAG_NEED_RTNL, 13138 }, 13139 { 13140 .cmd = NL80211_CMD_START_NAN, 13141 .doit = nl80211_start_nan, 13142 .policy = nl80211_policy, 13143 .flags = GENL_ADMIN_PERM, 13144 .internal_flags = NL80211_FLAG_NEED_WDEV | 13145 NL80211_FLAG_NEED_RTNL, 13146 }, 13147 { 13148 .cmd = NL80211_CMD_STOP_NAN, 13149 .doit = nl80211_stop_nan, 13150 .policy = nl80211_policy, 13151 .flags = GENL_ADMIN_PERM, 13152 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13153 NL80211_FLAG_NEED_RTNL, 13154 }, 13155 { 13156 .cmd = NL80211_CMD_ADD_NAN_FUNCTION, 13157 .doit = nl80211_nan_add_func, 13158 .policy = nl80211_policy, 13159 .flags = GENL_ADMIN_PERM, 13160 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13161 NL80211_FLAG_NEED_RTNL, 13162 }, 13163 { 13164 .cmd = NL80211_CMD_DEL_NAN_FUNCTION, 13165 .doit = nl80211_nan_del_func, 13166 .policy = nl80211_policy, 13167 .flags = GENL_ADMIN_PERM, 13168 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13169 NL80211_FLAG_NEED_RTNL, 13170 }, 13171 { 13172 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG, 13173 .doit = nl80211_nan_change_config, 13174 .policy = nl80211_policy, 13175 .flags = GENL_ADMIN_PERM, 13176 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13177 NL80211_FLAG_NEED_RTNL, 13178 }, 13179 { 13180 .cmd = NL80211_CMD_SET_MCAST_RATE, 13181 .doit = nl80211_set_mcast_rate, 13182 .policy = nl80211_policy, 13183 .flags = GENL_UNS_ADMIN_PERM, 13184 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13185 NL80211_FLAG_NEED_RTNL, 13186 }, 13187 { 13188 .cmd = NL80211_CMD_SET_MAC_ACL, 13189 .doit = nl80211_set_mac_acl, 13190 .policy = nl80211_policy, 13191 .flags = GENL_UNS_ADMIN_PERM, 13192 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13193 NL80211_FLAG_NEED_RTNL, 13194 }, 13195 { 13196 .cmd = NL80211_CMD_RADAR_DETECT, 13197 .doit = nl80211_start_radar_detection, 13198 .policy = nl80211_policy, 13199 .flags = GENL_UNS_ADMIN_PERM, 13200 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13201 NL80211_FLAG_NEED_RTNL, 13202 }, 13203 { 13204 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES, 13205 .doit = nl80211_get_protocol_features, 13206 .policy = nl80211_policy, 13207 }, 13208 { 13209 .cmd = NL80211_CMD_UPDATE_FT_IES, 13210 .doit = nl80211_update_ft_ies, 13211 .policy = nl80211_policy, 13212 .flags = GENL_UNS_ADMIN_PERM, 13213 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13214 NL80211_FLAG_NEED_RTNL, 13215 }, 13216 { 13217 .cmd = NL80211_CMD_CRIT_PROTOCOL_START, 13218 .doit = nl80211_crit_protocol_start, 13219 .policy = nl80211_policy, 13220 .flags = GENL_UNS_ADMIN_PERM, 13221 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13222 NL80211_FLAG_NEED_RTNL, 13223 }, 13224 { 13225 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP, 13226 .doit = nl80211_crit_protocol_stop, 13227 .policy = nl80211_policy, 13228 .flags = GENL_UNS_ADMIN_PERM, 13229 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13230 NL80211_FLAG_NEED_RTNL, 13231 }, 13232 { 13233 .cmd = NL80211_CMD_GET_COALESCE, 13234 .doit = nl80211_get_coalesce, 13235 .policy = nl80211_policy, 13236 .internal_flags = NL80211_FLAG_NEED_WIPHY | 13237 NL80211_FLAG_NEED_RTNL, 13238 }, 13239 { 13240 .cmd = NL80211_CMD_SET_COALESCE, 13241 .doit = nl80211_set_coalesce, 13242 .policy = nl80211_policy, 13243 .flags = GENL_UNS_ADMIN_PERM, 13244 .internal_flags = NL80211_FLAG_NEED_WIPHY | 13245 NL80211_FLAG_NEED_RTNL, 13246 }, 13247 { 13248 .cmd = NL80211_CMD_CHANNEL_SWITCH, 13249 .doit = nl80211_channel_switch, 13250 .policy = nl80211_policy, 13251 .flags = GENL_UNS_ADMIN_PERM, 13252 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13253 NL80211_FLAG_NEED_RTNL, 13254 }, 13255 { 13256 .cmd = NL80211_CMD_VENDOR, 13257 .doit = nl80211_vendor_cmd, 13258 .dumpit = nl80211_vendor_cmd_dump, 13259 .policy = nl80211_policy, 13260 .flags = GENL_UNS_ADMIN_PERM, 13261 .internal_flags = NL80211_FLAG_NEED_WIPHY | 13262 NL80211_FLAG_NEED_RTNL, 13263 }, 13264 { 13265 .cmd = NL80211_CMD_SET_QOS_MAP, 13266 .doit = nl80211_set_qos_map, 13267 .policy = nl80211_policy, 13268 .flags = GENL_UNS_ADMIN_PERM, 13269 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13270 NL80211_FLAG_NEED_RTNL, 13271 }, 13272 { 13273 .cmd = NL80211_CMD_ADD_TX_TS, 13274 .doit = nl80211_add_tx_ts, 13275 .policy = nl80211_policy, 13276 .flags = GENL_UNS_ADMIN_PERM, 13277 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13278 NL80211_FLAG_NEED_RTNL, 13279 }, 13280 { 13281 .cmd = NL80211_CMD_DEL_TX_TS, 13282 .doit = nl80211_del_tx_ts, 13283 .policy = nl80211_policy, 13284 .flags = GENL_UNS_ADMIN_PERM, 13285 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13286 NL80211_FLAG_NEED_RTNL, 13287 }, 13288 { 13289 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH, 13290 .doit = nl80211_tdls_channel_switch, 13291 .policy = nl80211_policy, 13292 .flags = GENL_UNS_ADMIN_PERM, 13293 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13294 NL80211_FLAG_NEED_RTNL, 13295 }, 13296 { 13297 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH, 13298 .doit = nl80211_tdls_cancel_channel_switch, 13299 .policy = nl80211_policy, 13300 .flags = GENL_UNS_ADMIN_PERM, 13301 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13302 NL80211_FLAG_NEED_RTNL, 13303 }, 13304 { 13305 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST, 13306 .doit = nl80211_set_multicast_to_unicast, 13307 .policy = nl80211_policy, 13308 .flags = GENL_UNS_ADMIN_PERM, 13309 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13310 NL80211_FLAG_NEED_RTNL, 13311 }, 13312 { 13313 .cmd = NL80211_CMD_SET_PMK, 13314 .doit = nl80211_set_pmk, 13315 .policy = nl80211_policy, 13316 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13317 NL80211_FLAG_NEED_RTNL, 13318 }, 13319 { 13320 .cmd = NL80211_CMD_DEL_PMK, 13321 .doit = nl80211_del_pmk, 13322 .policy = nl80211_policy, 13323 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13324 NL80211_FLAG_NEED_RTNL, 13325 }, 13326 13327 }; 13328 13329 static struct genl_family nl80211_fam __ro_after_init = { 13330 .name = NL80211_GENL_NAME, /* have users key off the name instead */ 13331 .hdrsize = 0, /* no private header */ 13332 .version = 1, /* no particular meaning now */ 13333 .maxattr = NL80211_ATTR_MAX, 13334 .netnsok = true, 13335 .pre_doit = nl80211_pre_doit, 13336 .post_doit = nl80211_post_doit, 13337 .module = THIS_MODULE, 13338 .ops = nl80211_ops, 13339 .n_ops = ARRAY_SIZE(nl80211_ops), 13340 .mcgrps = nl80211_mcgrps, 13341 .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps), 13342 }; 13343 13344 /* notification functions */ 13345 13346 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev, 13347 enum nl80211_commands cmd) 13348 { 13349 struct sk_buff *msg; 13350 struct nl80211_dump_wiphy_state state = {}; 13351 13352 WARN_ON(cmd != NL80211_CMD_NEW_WIPHY && 13353 cmd != NL80211_CMD_DEL_WIPHY); 13354 13355 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 13356 if (!msg) 13357 return; 13358 13359 if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) { 13360 nlmsg_free(msg); 13361 return; 13362 } 13363 13364 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13365 NL80211_MCGRP_CONFIG, GFP_KERNEL); 13366 } 13367 13368 void nl80211_notify_iface(struct cfg80211_registered_device *rdev, 13369 struct wireless_dev *wdev, 13370 enum nl80211_commands cmd) 13371 { 13372 struct sk_buff *msg; 13373 13374 WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE && 13375 cmd != NL80211_CMD_DEL_INTERFACE); 13376 13377 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 13378 if (!msg) 13379 return; 13380 13381 if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, 13382 cmd == NL80211_CMD_DEL_INTERFACE) < 0) { 13383 nlmsg_free(msg); 13384 return; 13385 } 13386 13387 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13388 NL80211_MCGRP_CONFIG, GFP_KERNEL); 13389 } 13390 13391 static int nl80211_add_scan_req(struct sk_buff *msg, 13392 struct cfg80211_registered_device *rdev) 13393 { 13394 struct cfg80211_scan_request *req = rdev->scan_req; 13395 struct nlattr *nest; 13396 int i; 13397 13398 if (WARN_ON(!req)) 13399 return 0; 13400 13401 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS); 13402 if (!nest) 13403 goto nla_put_failure; 13404 for (i = 0; i < req->n_ssids; i++) { 13405 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid)) 13406 goto nla_put_failure; 13407 } 13408 nla_nest_end(msg, nest); 13409 13410 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES); 13411 if (!nest) 13412 goto nla_put_failure; 13413 for (i = 0; i < req->n_channels; i++) { 13414 if (nla_put_u32(msg, i, req->channels[i]->center_freq)) 13415 goto nla_put_failure; 13416 } 13417 nla_nest_end(msg, nest); 13418 13419 if (req->ie && 13420 nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie)) 13421 goto nla_put_failure; 13422 13423 if (req->flags && 13424 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags)) 13425 goto nla_put_failure; 13426 13427 if (req->info.scan_start_tsf && 13428 (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF, 13429 req->info.scan_start_tsf, NL80211_BSS_PAD) || 13430 nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN, 13431 req->info.tsf_bssid))) 13432 goto nla_put_failure; 13433 13434 return 0; 13435 nla_put_failure: 13436 return -ENOBUFS; 13437 } 13438 13439 static int nl80211_prep_scan_msg(struct sk_buff *msg, 13440 struct cfg80211_registered_device *rdev, 13441 struct wireless_dev *wdev, 13442 u32 portid, u32 seq, int flags, 13443 u32 cmd) 13444 { 13445 void *hdr; 13446 13447 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 13448 if (!hdr) 13449 return -1; 13450 13451 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 13452 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 13453 wdev->netdev->ifindex)) || 13454 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 13455 NL80211_ATTR_PAD)) 13456 goto nla_put_failure; 13457 13458 /* ignore errors and send incomplete event anyway */ 13459 nl80211_add_scan_req(msg, rdev); 13460 13461 genlmsg_end(msg, hdr); 13462 return 0; 13463 13464 nla_put_failure: 13465 genlmsg_cancel(msg, hdr); 13466 return -EMSGSIZE; 13467 } 13468 13469 static int 13470 nl80211_prep_sched_scan_msg(struct sk_buff *msg, 13471 struct cfg80211_sched_scan_request *req, u32 cmd) 13472 { 13473 void *hdr; 13474 13475 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 13476 if (!hdr) 13477 return -1; 13478 13479 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, 13480 wiphy_to_rdev(req->wiphy)->wiphy_idx) || 13481 nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) || 13482 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid, 13483 NL80211_ATTR_PAD)) 13484 goto nla_put_failure; 13485 13486 genlmsg_end(msg, hdr); 13487 return 0; 13488 13489 nla_put_failure: 13490 genlmsg_cancel(msg, hdr); 13491 return -EMSGSIZE; 13492 } 13493 13494 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev, 13495 struct wireless_dev *wdev) 13496 { 13497 struct sk_buff *msg; 13498 13499 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 13500 if (!msg) 13501 return; 13502 13503 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0, 13504 NL80211_CMD_TRIGGER_SCAN) < 0) { 13505 nlmsg_free(msg); 13506 return; 13507 } 13508 13509 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13510 NL80211_MCGRP_SCAN, GFP_KERNEL); 13511 } 13512 13513 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev, 13514 struct wireless_dev *wdev, bool aborted) 13515 { 13516 struct sk_buff *msg; 13517 13518 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 13519 if (!msg) 13520 return NULL; 13521 13522 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0, 13523 aborted ? NL80211_CMD_SCAN_ABORTED : 13524 NL80211_CMD_NEW_SCAN_RESULTS) < 0) { 13525 nlmsg_free(msg); 13526 return NULL; 13527 } 13528 13529 return msg; 13530 } 13531 13532 /* send message created by nl80211_build_scan_msg() */ 13533 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev, 13534 struct sk_buff *msg) 13535 { 13536 if (!msg) 13537 return; 13538 13539 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13540 NL80211_MCGRP_SCAN, GFP_KERNEL); 13541 } 13542 13543 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd) 13544 { 13545 struct sk_buff *msg; 13546 13547 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 13548 if (!msg) 13549 return; 13550 13551 if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) { 13552 nlmsg_free(msg); 13553 return; 13554 } 13555 13556 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0, 13557 NL80211_MCGRP_SCAN, GFP_KERNEL); 13558 } 13559 13560 static bool nl80211_reg_change_event_fill(struct sk_buff *msg, 13561 struct regulatory_request *request) 13562 { 13563 /* Userspace can always count this one always being set */ 13564 if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator)) 13565 goto nla_put_failure; 13566 13567 if (request->alpha2[0] == '0' && request->alpha2[1] == '0') { 13568 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 13569 NL80211_REGDOM_TYPE_WORLD)) 13570 goto nla_put_failure; 13571 } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') { 13572 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 13573 NL80211_REGDOM_TYPE_CUSTOM_WORLD)) 13574 goto nla_put_failure; 13575 } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') || 13576 request->intersect) { 13577 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 13578 NL80211_REGDOM_TYPE_INTERSECTION)) 13579 goto nla_put_failure; 13580 } else { 13581 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 13582 NL80211_REGDOM_TYPE_COUNTRY) || 13583 nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, 13584 request->alpha2)) 13585 goto nla_put_failure; 13586 } 13587 13588 if (request->wiphy_idx != WIPHY_IDX_INVALID) { 13589 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx); 13590 13591 if (wiphy && 13592 nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx)) 13593 goto nla_put_failure; 13594 13595 if (wiphy && 13596 wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED && 13597 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG)) 13598 goto nla_put_failure; 13599 } 13600 13601 return true; 13602 13603 nla_put_failure: 13604 return false; 13605 } 13606 13607 /* 13608 * This can happen on global regulatory changes or device specific settings 13609 * based on custom regulatory domains. 13610 */ 13611 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id, 13612 struct regulatory_request *request) 13613 { 13614 struct sk_buff *msg; 13615 void *hdr; 13616 13617 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 13618 if (!msg) 13619 return; 13620 13621 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id); 13622 if (!hdr) { 13623 nlmsg_free(msg); 13624 return; 13625 } 13626 13627 if (nl80211_reg_change_event_fill(msg, request) == false) 13628 goto nla_put_failure; 13629 13630 genlmsg_end(msg, hdr); 13631 13632 rcu_read_lock(); 13633 genlmsg_multicast_allns(&nl80211_fam, msg, 0, 13634 NL80211_MCGRP_REGULATORY, GFP_ATOMIC); 13635 rcu_read_unlock(); 13636 13637 return; 13638 13639 nla_put_failure: 13640 genlmsg_cancel(msg, hdr); 13641 nlmsg_free(msg); 13642 } 13643 13644 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev, 13645 struct net_device *netdev, 13646 const u8 *buf, size_t len, 13647 enum nl80211_commands cmd, gfp_t gfp, 13648 int uapsd_queues) 13649 { 13650 struct sk_buff *msg; 13651 void *hdr; 13652 13653 msg = nlmsg_new(100 + len, gfp); 13654 if (!msg) 13655 return; 13656 13657 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 13658 if (!hdr) { 13659 nlmsg_free(msg); 13660 return; 13661 } 13662 13663 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 13664 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 13665 nla_put(msg, NL80211_ATTR_FRAME, len, buf)) 13666 goto nla_put_failure; 13667 13668 if (uapsd_queues >= 0) { 13669 struct nlattr *nla_wmm = 13670 nla_nest_start(msg, NL80211_ATTR_STA_WME); 13671 if (!nla_wmm) 13672 goto nla_put_failure; 13673 13674 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES, 13675 uapsd_queues)) 13676 goto nla_put_failure; 13677 13678 nla_nest_end(msg, nla_wmm); 13679 } 13680 13681 genlmsg_end(msg, hdr); 13682 13683 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13684 NL80211_MCGRP_MLME, gfp); 13685 return; 13686 13687 nla_put_failure: 13688 genlmsg_cancel(msg, hdr); 13689 nlmsg_free(msg); 13690 } 13691 13692 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev, 13693 struct net_device *netdev, const u8 *buf, 13694 size_t len, gfp_t gfp) 13695 { 13696 nl80211_send_mlme_event(rdev, netdev, buf, len, 13697 NL80211_CMD_AUTHENTICATE, gfp, -1); 13698 } 13699 13700 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev, 13701 struct net_device *netdev, const u8 *buf, 13702 size_t len, gfp_t gfp, int uapsd_queues) 13703 { 13704 nl80211_send_mlme_event(rdev, netdev, buf, len, 13705 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues); 13706 } 13707 13708 void nl80211_send_deauth(struct cfg80211_registered_device *rdev, 13709 struct net_device *netdev, const u8 *buf, 13710 size_t len, gfp_t gfp) 13711 { 13712 nl80211_send_mlme_event(rdev, netdev, buf, len, 13713 NL80211_CMD_DEAUTHENTICATE, gfp, -1); 13714 } 13715 13716 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev, 13717 struct net_device *netdev, const u8 *buf, 13718 size_t len, gfp_t gfp) 13719 { 13720 nl80211_send_mlme_event(rdev, netdev, buf, len, 13721 NL80211_CMD_DISASSOCIATE, gfp, -1); 13722 } 13723 13724 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf, 13725 size_t len) 13726 { 13727 struct wireless_dev *wdev = dev->ieee80211_ptr; 13728 struct wiphy *wiphy = wdev->wiphy; 13729 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 13730 const struct ieee80211_mgmt *mgmt = (void *)buf; 13731 u32 cmd; 13732 13733 if (WARN_ON(len < 2)) 13734 return; 13735 13736 if (ieee80211_is_deauth(mgmt->frame_control)) 13737 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE; 13738 else 13739 cmd = NL80211_CMD_UNPROT_DISASSOCIATE; 13740 13741 trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len); 13742 nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1); 13743 } 13744 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt); 13745 13746 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev, 13747 struct net_device *netdev, int cmd, 13748 const u8 *addr, gfp_t gfp) 13749 { 13750 struct sk_buff *msg; 13751 void *hdr; 13752 13753 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 13754 if (!msg) 13755 return; 13756 13757 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 13758 if (!hdr) { 13759 nlmsg_free(msg); 13760 return; 13761 } 13762 13763 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 13764 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 13765 nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) || 13766 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) 13767 goto nla_put_failure; 13768 13769 genlmsg_end(msg, hdr); 13770 13771 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13772 NL80211_MCGRP_MLME, gfp); 13773 return; 13774 13775 nla_put_failure: 13776 genlmsg_cancel(msg, hdr); 13777 nlmsg_free(msg); 13778 } 13779 13780 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev, 13781 struct net_device *netdev, const u8 *addr, 13782 gfp_t gfp) 13783 { 13784 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE, 13785 addr, gfp); 13786 } 13787 13788 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev, 13789 struct net_device *netdev, const u8 *addr, 13790 gfp_t gfp) 13791 { 13792 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE, 13793 addr, gfp); 13794 } 13795 13796 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev, 13797 struct net_device *netdev, 13798 struct cfg80211_connect_resp_params *cr, 13799 gfp_t gfp) 13800 { 13801 struct sk_buff *msg; 13802 void *hdr; 13803 13804 msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len + 13805 cr->fils_kek_len + cr->pmk_len + 13806 (cr->pmkid ? WLAN_PMKID_LEN : 0), gfp); 13807 if (!msg) 13808 return; 13809 13810 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT); 13811 if (!hdr) { 13812 nlmsg_free(msg); 13813 return; 13814 } 13815 13816 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 13817 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 13818 (cr->bssid && 13819 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cr->bssid)) || 13820 nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, 13821 cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE : 13822 cr->status) || 13823 (cr->status < 0 && 13824 (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) || 13825 nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON, 13826 cr->timeout_reason))) || 13827 (cr->req_ie && 13828 nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) || 13829 (cr->resp_ie && 13830 nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len, 13831 cr->resp_ie)) || 13832 (cr->update_erp_next_seq_num && 13833 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM, 13834 cr->fils_erp_next_seq_num)) || 13835 (cr->status == WLAN_STATUS_SUCCESS && 13836 ((cr->fils_kek && 13837 nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils_kek_len, 13838 cr->fils_kek)) || 13839 (cr->pmk && 13840 nla_put(msg, NL80211_ATTR_PMK, cr->pmk_len, cr->pmk)) || 13841 (cr->pmkid && 13842 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->pmkid))))) 13843 goto nla_put_failure; 13844 13845 genlmsg_end(msg, hdr); 13846 13847 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13848 NL80211_MCGRP_MLME, gfp); 13849 return; 13850 13851 nla_put_failure: 13852 genlmsg_cancel(msg, hdr); 13853 nlmsg_free(msg); 13854 } 13855 13856 void nl80211_send_roamed(struct cfg80211_registered_device *rdev, 13857 struct net_device *netdev, 13858 struct cfg80211_roam_info *info, gfp_t gfp) 13859 { 13860 struct sk_buff *msg; 13861 void *hdr; 13862 const u8 *bssid = info->bss ? info->bss->bssid : info->bssid; 13863 13864 msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len, gfp); 13865 if (!msg) 13866 return; 13867 13868 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM); 13869 if (!hdr) { 13870 nlmsg_free(msg); 13871 return; 13872 } 13873 13874 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 13875 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 13876 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) || 13877 (info->req_ie && 13878 nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len, 13879 info->req_ie)) || 13880 (info->resp_ie && 13881 nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len, 13882 info->resp_ie))) 13883 goto nla_put_failure; 13884 13885 genlmsg_end(msg, hdr); 13886 13887 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13888 NL80211_MCGRP_MLME, gfp); 13889 return; 13890 13891 nla_put_failure: 13892 genlmsg_cancel(msg, hdr); 13893 nlmsg_free(msg); 13894 } 13895 13896 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev, 13897 struct net_device *netdev, const u8 *bssid) 13898 { 13899 struct sk_buff *msg; 13900 void *hdr; 13901 13902 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 13903 if (!msg) 13904 return; 13905 13906 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED); 13907 if (!hdr) { 13908 nlmsg_free(msg); 13909 return; 13910 } 13911 13912 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) 13913 goto nla_put_failure; 13914 13915 genlmsg_end(msg, hdr); 13916 13917 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13918 NL80211_MCGRP_MLME, GFP_KERNEL); 13919 return; 13920 13921 nla_put_failure: 13922 genlmsg_cancel(msg, hdr); 13923 nlmsg_free(msg); 13924 } 13925 13926 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev, 13927 struct net_device *netdev, u16 reason, 13928 const u8 *ie, size_t ie_len, bool from_ap) 13929 { 13930 struct sk_buff *msg; 13931 void *hdr; 13932 13933 msg = nlmsg_new(100 + ie_len, GFP_KERNEL); 13934 if (!msg) 13935 return; 13936 13937 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT); 13938 if (!hdr) { 13939 nlmsg_free(msg); 13940 return; 13941 } 13942 13943 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 13944 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 13945 (from_ap && reason && 13946 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) || 13947 (from_ap && 13948 nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) || 13949 (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie))) 13950 goto nla_put_failure; 13951 13952 genlmsg_end(msg, hdr); 13953 13954 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13955 NL80211_MCGRP_MLME, GFP_KERNEL); 13956 return; 13957 13958 nla_put_failure: 13959 genlmsg_cancel(msg, hdr); 13960 nlmsg_free(msg); 13961 } 13962 13963 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev, 13964 struct net_device *netdev, const u8 *bssid, 13965 gfp_t gfp) 13966 { 13967 struct sk_buff *msg; 13968 void *hdr; 13969 13970 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 13971 if (!msg) 13972 return; 13973 13974 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS); 13975 if (!hdr) { 13976 nlmsg_free(msg); 13977 return; 13978 } 13979 13980 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 13981 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 13982 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) 13983 goto nla_put_failure; 13984 13985 genlmsg_end(msg, hdr); 13986 13987 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13988 NL80211_MCGRP_MLME, gfp); 13989 return; 13990 13991 nla_put_failure: 13992 genlmsg_cancel(msg, hdr); 13993 nlmsg_free(msg); 13994 } 13995 13996 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr, 13997 const u8* ie, u8 ie_len, gfp_t gfp) 13998 { 13999 struct wireless_dev *wdev = dev->ieee80211_ptr; 14000 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 14001 struct sk_buff *msg; 14002 void *hdr; 14003 14004 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT)) 14005 return; 14006 14007 trace_cfg80211_notify_new_peer_candidate(dev, addr); 14008 14009 msg = nlmsg_new(100 + ie_len, gfp); 14010 if (!msg) 14011 return; 14012 14013 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE); 14014 if (!hdr) { 14015 nlmsg_free(msg); 14016 return; 14017 } 14018 14019 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14020 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 14021 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) || 14022 (ie_len && ie && 14023 nla_put(msg, NL80211_ATTR_IE, ie_len , ie))) 14024 goto nla_put_failure; 14025 14026 genlmsg_end(msg, hdr); 14027 14028 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14029 NL80211_MCGRP_MLME, gfp); 14030 return; 14031 14032 nla_put_failure: 14033 genlmsg_cancel(msg, hdr); 14034 nlmsg_free(msg); 14035 } 14036 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate); 14037 14038 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev, 14039 struct net_device *netdev, const u8 *addr, 14040 enum nl80211_key_type key_type, int key_id, 14041 const u8 *tsc, gfp_t gfp) 14042 { 14043 struct sk_buff *msg; 14044 void *hdr; 14045 14046 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14047 if (!msg) 14048 return; 14049 14050 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE); 14051 if (!hdr) { 14052 nlmsg_free(msg); 14053 return; 14054 } 14055 14056 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14057 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 14058 (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) || 14059 nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) || 14060 (key_id != -1 && 14061 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) || 14062 (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc))) 14063 goto nla_put_failure; 14064 14065 genlmsg_end(msg, hdr); 14066 14067 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14068 NL80211_MCGRP_MLME, gfp); 14069 return; 14070 14071 nla_put_failure: 14072 genlmsg_cancel(msg, hdr); 14073 nlmsg_free(msg); 14074 } 14075 14076 void nl80211_send_beacon_hint_event(struct wiphy *wiphy, 14077 struct ieee80211_channel *channel_before, 14078 struct ieee80211_channel *channel_after) 14079 { 14080 struct sk_buff *msg; 14081 void *hdr; 14082 struct nlattr *nl_freq; 14083 14084 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); 14085 if (!msg) 14086 return; 14087 14088 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT); 14089 if (!hdr) { 14090 nlmsg_free(msg); 14091 return; 14092 } 14093 14094 /* 14095 * Since we are applying the beacon hint to a wiphy we know its 14096 * wiphy_idx is valid 14097 */ 14098 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy))) 14099 goto nla_put_failure; 14100 14101 /* Before */ 14102 nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE); 14103 if (!nl_freq) 14104 goto nla_put_failure; 14105 if (nl80211_msg_put_channel(msg, channel_before, false)) 14106 goto nla_put_failure; 14107 nla_nest_end(msg, nl_freq); 14108 14109 /* After */ 14110 nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER); 14111 if (!nl_freq) 14112 goto nla_put_failure; 14113 if (nl80211_msg_put_channel(msg, channel_after, false)) 14114 goto nla_put_failure; 14115 nla_nest_end(msg, nl_freq); 14116 14117 genlmsg_end(msg, hdr); 14118 14119 rcu_read_lock(); 14120 genlmsg_multicast_allns(&nl80211_fam, msg, 0, 14121 NL80211_MCGRP_REGULATORY, GFP_ATOMIC); 14122 rcu_read_unlock(); 14123 14124 return; 14125 14126 nla_put_failure: 14127 genlmsg_cancel(msg, hdr); 14128 nlmsg_free(msg); 14129 } 14130 14131 static void nl80211_send_remain_on_chan_event( 14132 int cmd, struct cfg80211_registered_device *rdev, 14133 struct wireless_dev *wdev, u64 cookie, 14134 struct ieee80211_channel *chan, 14135 unsigned int duration, gfp_t gfp) 14136 { 14137 struct sk_buff *msg; 14138 void *hdr; 14139 14140 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14141 if (!msg) 14142 return; 14143 14144 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 14145 if (!hdr) { 14146 nlmsg_free(msg); 14147 return; 14148 } 14149 14150 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14151 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 14152 wdev->netdev->ifindex)) || 14153 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 14154 NL80211_ATTR_PAD) || 14155 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) || 14156 nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, 14157 NL80211_CHAN_NO_HT) || 14158 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 14159 NL80211_ATTR_PAD)) 14160 goto nla_put_failure; 14161 14162 if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL && 14163 nla_put_u32(msg, NL80211_ATTR_DURATION, duration)) 14164 goto nla_put_failure; 14165 14166 genlmsg_end(msg, hdr); 14167 14168 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14169 NL80211_MCGRP_MLME, gfp); 14170 return; 14171 14172 nla_put_failure: 14173 genlmsg_cancel(msg, hdr); 14174 nlmsg_free(msg); 14175 } 14176 14177 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie, 14178 struct ieee80211_channel *chan, 14179 unsigned int duration, gfp_t gfp) 14180 { 14181 struct wiphy *wiphy = wdev->wiphy; 14182 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14183 14184 trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration); 14185 nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL, 14186 rdev, wdev, cookie, chan, 14187 duration, gfp); 14188 } 14189 EXPORT_SYMBOL(cfg80211_ready_on_channel); 14190 14191 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie, 14192 struct ieee80211_channel *chan, 14193 gfp_t gfp) 14194 { 14195 struct wiphy *wiphy = wdev->wiphy; 14196 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14197 14198 trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan); 14199 nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL, 14200 rdev, wdev, cookie, chan, 0, gfp); 14201 } 14202 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired); 14203 14204 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr, 14205 struct station_info *sinfo, gfp_t gfp) 14206 { 14207 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy; 14208 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14209 struct sk_buff *msg; 14210 14211 trace_cfg80211_new_sta(dev, mac_addr, sinfo); 14212 14213 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14214 if (!msg) 14215 return; 14216 14217 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0, 14218 rdev, dev, mac_addr, sinfo) < 0) { 14219 nlmsg_free(msg); 14220 return; 14221 } 14222 14223 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14224 NL80211_MCGRP_MLME, gfp); 14225 } 14226 EXPORT_SYMBOL(cfg80211_new_sta); 14227 14228 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr, 14229 struct station_info *sinfo, gfp_t gfp) 14230 { 14231 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy; 14232 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14233 struct sk_buff *msg; 14234 struct station_info empty_sinfo = {}; 14235 14236 if (!sinfo) 14237 sinfo = &empty_sinfo; 14238 14239 trace_cfg80211_del_sta(dev, mac_addr); 14240 14241 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14242 if (!msg) 14243 return; 14244 14245 if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0, 14246 rdev, dev, mac_addr, sinfo) < 0) { 14247 nlmsg_free(msg); 14248 return; 14249 } 14250 14251 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14252 NL80211_MCGRP_MLME, gfp); 14253 } 14254 EXPORT_SYMBOL(cfg80211_del_sta_sinfo); 14255 14256 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr, 14257 enum nl80211_connect_failed_reason reason, 14258 gfp_t gfp) 14259 { 14260 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy; 14261 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14262 struct sk_buff *msg; 14263 void *hdr; 14264 14265 msg = nlmsg_new(NLMSG_GOODSIZE, gfp); 14266 if (!msg) 14267 return; 14268 14269 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED); 14270 if (!hdr) { 14271 nlmsg_free(msg); 14272 return; 14273 } 14274 14275 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 14276 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) || 14277 nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason)) 14278 goto nla_put_failure; 14279 14280 genlmsg_end(msg, hdr); 14281 14282 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14283 NL80211_MCGRP_MLME, gfp); 14284 return; 14285 14286 nla_put_failure: 14287 genlmsg_cancel(msg, hdr); 14288 nlmsg_free(msg); 14289 } 14290 EXPORT_SYMBOL(cfg80211_conn_failed); 14291 14292 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd, 14293 const u8 *addr, gfp_t gfp) 14294 { 14295 struct wireless_dev *wdev = dev->ieee80211_ptr; 14296 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 14297 struct sk_buff *msg; 14298 void *hdr; 14299 u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid); 14300 14301 if (!nlportid) 14302 return false; 14303 14304 msg = nlmsg_new(100, gfp); 14305 if (!msg) 14306 return true; 14307 14308 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 14309 if (!hdr) { 14310 nlmsg_free(msg); 14311 return true; 14312 } 14313 14314 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14315 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 14316 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) 14317 goto nla_put_failure; 14318 14319 genlmsg_end(msg, hdr); 14320 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 14321 return true; 14322 14323 nla_put_failure: 14324 genlmsg_cancel(msg, hdr); 14325 nlmsg_free(msg); 14326 return true; 14327 } 14328 14329 bool cfg80211_rx_spurious_frame(struct net_device *dev, 14330 const u8 *addr, gfp_t gfp) 14331 { 14332 struct wireless_dev *wdev = dev->ieee80211_ptr; 14333 bool ret; 14334 14335 trace_cfg80211_rx_spurious_frame(dev, addr); 14336 14337 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP && 14338 wdev->iftype != NL80211_IFTYPE_P2P_GO)) { 14339 trace_cfg80211_return_bool(false); 14340 return false; 14341 } 14342 ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME, 14343 addr, gfp); 14344 trace_cfg80211_return_bool(ret); 14345 return ret; 14346 } 14347 EXPORT_SYMBOL(cfg80211_rx_spurious_frame); 14348 14349 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev, 14350 const u8 *addr, gfp_t gfp) 14351 { 14352 struct wireless_dev *wdev = dev->ieee80211_ptr; 14353 bool ret; 14354 14355 trace_cfg80211_rx_unexpected_4addr_frame(dev, addr); 14356 14357 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP && 14358 wdev->iftype != NL80211_IFTYPE_P2P_GO && 14359 wdev->iftype != NL80211_IFTYPE_AP_VLAN)) { 14360 trace_cfg80211_return_bool(false); 14361 return false; 14362 } 14363 ret = __nl80211_unexpected_frame(dev, 14364 NL80211_CMD_UNEXPECTED_4ADDR_FRAME, 14365 addr, gfp); 14366 trace_cfg80211_return_bool(ret); 14367 return ret; 14368 } 14369 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame); 14370 14371 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev, 14372 struct wireless_dev *wdev, u32 nlportid, 14373 int freq, int sig_dbm, 14374 const u8 *buf, size_t len, u32 flags, gfp_t gfp) 14375 { 14376 struct net_device *netdev = wdev->netdev; 14377 struct sk_buff *msg; 14378 void *hdr; 14379 14380 msg = nlmsg_new(100 + len, gfp); 14381 if (!msg) 14382 return -ENOMEM; 14383 14384 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME); 14385 if (!hdr) { 14386 nlmsg_free(msg); 14387 return -ENOMEM; 14388 } 14389 14390 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14391 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 14392 netdev->ifindex)) || 14393 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 14394 NL80211_ATTR_PAD) || 14395 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) || 14396 (sig_dbm && 14397 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) || 14398 nla_put(msg, NL80211_ATTR_FRAME, len, buf) || 14399 (flags && 14400 nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags))) 14401 goto nla_put_failure; 14402 14403 genlmsg_end(msg, hdr); 14404 14405 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 14406 14407 nla_put_failure: 14408 genlmsg_cancel(msg, hdr); 14409 nlmsg_free(msg); 14410 return -ENOBUFS; 14411 } 14412 14413 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie, 14414 const u8 *buf, size_t len, bool ack, gfp_t gfp) 14415 { 14416 struct wiphy *wiphy = wdev->wiphy; 14417 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14418 struct net_device *netdev = wdev->netdev; 14419 struct sk_buff *msg; 14420 void *hdr; 14421 14422 trace_cfg80211_mgmt_tx_status(wdev, cookie, ack); 14423 14424 msg = nlmsg_new(100 + len, gfp); 14425 if (!msg) 14426 return; 14427 14428 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS); 14429 if (!hdr) { 14430 nlmsg_free(msg); 14431 return; 14432 } 14433 14434 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14435 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 14436 netdev->ifindex)) || 14437 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 14438 NL80211_ATTR_PAD) || 14439 nla_put(msg, NL80211_ATTR_FRAME, len, buf) || 14440 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 14441 NL80211_ATTR_PAD) || 14442 (ack && nla_put_flag(msg, NL80211_ATTR_ACK))) 14443 goto nla_put_failure; 14444 14445 genlmsg_end(msg, hdr); 14446 14447 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14448 NL80211_MCGRP_MLME, gfp); 14449 return; 14450 14451 nla_put_failure: 14452 genlmsg_cancel(msg, hdr); 14453 nlmsg_free(msg); 14454 } 14455 EXPORT_SYMBOL(cfg80211_mgmt_tx_status); 14456 14457 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev, 14458 const char *mac, gfp_t gfp) 14459 { 14460 struct wireless_dev *wdev = dev->ieee80211_ptr; 14461 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 14462 struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14463 void **cb; 14464 14465 if (!msg) 14466 return NULL; 14467 14468 cb = (void **)msg->cb; 14469 14470 cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM); 14471 if (!cb[0]) { 14472 nlmsg_free(msg); 14473 return NULL; 14474 } 14475 14476 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14477 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 14478 goto nla_put_failure; 14479 14480 if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac)) 14481 goto nla_put_failure; 14482 14483 cb[1] = nla_nest_start(msg, NL80211_ATTR_CQM); 14484 if (!cb[1]) 14485 goto nla_put_failure; 14486 14487 cb[2] = rdev; 14488 14489 return msg; 14490 nla_put_failure: 14491 nlmsg_free(msg); 14492 return NULL; 14493 } 14494 14495 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp) 14496 { 14497 void **cb = (void **)msg->cb; 14498 struct cfg80211_registered_device *rdev = cb[2]; 14499 14500 nla_nest_end(msg, cb[1]); 14501 genlmsg_end(msg, cb[0]); 14502 14503 memset(msg->cb, 0, sizeof(msg->cb)); 14504 14505 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14506 NL80211_MCGRP_MLME, gfp); 14507 } 14508 14509 void cfg80211_cqm_rssi_notify(struct net_device *dev, 14510 enum nl80211_cqm_rssi_threshold_event rssi_event, 14511 s32 rssi_level, gfp_t gfp) 14512 { 14513 struct sk_buff *msg; 14514 struct wireless_dev *wdev = dev->ieee80211_ptr; 14515 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 14516 14517 trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level); 14518 14519 if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW && 14520 rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH)) 14521 return; 14522 14523 if (wdev->cqm_config) { 14524 wdev->cqm_config->last_rssi_event_value = rssi_level; 14525 14526 cfg80211_cqm_rssi_update(rdev, dev); 14527 14528 if (rssi_level == 0) 14529 rssi_level = wdev->cqm_config->last_rssi_event_value; 14530 } 14531 14532 msg = cfg80211_prepare_cqm(dev, NULL, gfp); 14533 if (!msg) 14534 return; 14535 14536 if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT, 14537 rssi_event)) 14538 goto nla_put_failure; 14539 14540 if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL, 14541 rssi_level)) 14542 goto nla_put_failure; 14543 14544 cfg80211_send_cqm(msg, gfp); 14545 14546 return; 14547 14548 nla_put_failure: 14549 nlmsg_free(msg); 14550 } 14551 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify); 14552 14553 void cfg80211_cqm_txe_notify(struct net_device *dev, 14554 const u8 *peer, u32 num_packets, 14555 u32 rate, u32 intvl, gfp_t gfp) 14556 { 14557 struct sk_buff *msg; 14558 14559 msg = cfg80211_prepare_cqm(dev, peer, gfp); 14560 if (!msg) 14561 return; 14562 14563 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets)) 14564 goto nla_put_failure; 14565 14566 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate)) 14567 goto nla_put_failure; 14568 14569 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl)) 14570 goto nla_put_failure; 14571 14572 cfg80211_send_cqm(msg, gfp); 14573 return; 14574 14575 nla_put_failure: 14576 nlmsg_free(msg); 14577 } 14578 EXPORT_SYMBOL(cfg80211_cqm_txe_notify); 14579 14580 void cfg80211_cqm_pktloss_notify(struct net_device *dev, 14581 const u8 *peer, u32 num_packets, gfp_t gfp) 14582 { 14583 struct sk_buff *msg; 14584 14585 trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets); 14586 14587 msg = cfg80211_prepare_cqm(dev, peer, gfp); 14588 if (!msg) 14589 return; 14590 14591 if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets)) 14592 goto nla_put_failure; 14593 14594 cfg80211_send_cqm(msg, gfp); 14595 return; 14596 14597 nla_put_failure: 14598 nlmsg_free(msg); 14599 } 14600 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify); 14601 14602 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp) 14603 { 14604 struct sk_buff *msg; 14605 14606 msg = cfg80211_prepare_cqm(dev, NULL, gfp); 14607 if (!msg) 14608 return; 14609 14610 if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT)) 14611 goto nla_put_failure; 14612 14613 cfg80211_send_cqm(msg, gfp); 14614 return; 14615 14616 nla_put_failure: 14617 nlmsg_free(msg); 14618 } 14619 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify); 14620 14621 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev, 14622 struct net_device *netdev, const u8 *bssid, 14623 const u8 *replay_ctr, gfp_t gfp) 14624 { 14625 struct sk_buff *msg; 14626 struct nlattr *rekey_attr; 14627 void *hdr; 14628 14629 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14630 if (!msg) 14631 return; 14632 14633 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD); 14634 if (!hdr) { 14635 nlmsg_free(msg); 14636 return; 14637 } 14638 14639 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14640 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 14641 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) 14642 goto nla_put_failure; 14643 14644 rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA); 14645 if (!rekey_attr) 14646 goto nla_put_failure; 14647 14648 if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR, 14649 NL80211_REPLAY_CTR_LEN, replay_ctr)) 14650 goto nla_put_failure; 14651 14652 nla_nest_end(msg, rekey_attr); 14653 14654 genlmsg_end(msg, hdr); 14655 14656 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14657 NL80211_MCGRP_MLME, gfp); 14658 return; 14659 14660 nla_put_failure: 14661 genlmsg_cancel(msg, hdr); 14662 nlmsg_free(msg); 14663 } 14664 14665 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid, 14666 const u8 *replay_ctr, gfp_t gfp) 14667 { 14668 struct wireless_dev *wdev = dev->ieee80211_ptr; 14669 struct wiphy *wiphy = wdev->wiphy; 14670 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14671 14672 trace_cfg80211_gtk_rekey_notify(dev, bssid); 14673 nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp); 14674 } 14675 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify); 14676 14677 static void 14678 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev, 14679 struct net_device *netdev, int index, 14680 const u8 *bssid, bool preauth, gfp_t gfp) 14681 { 14682 struct sk_buff *msg; 14683 struct nlattr *attr; 14684 void *hdr; 14685 14686 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14687 if (!msg) 14688 return; 14689 14690 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE); 14691 if (!hdr) { 14692 nlmsg_free(msg); 14693 return; 14694 } 14695 14696 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14697 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex)) 14698 goto nla_put_failure; 14699 14700 attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE); 14701 if (!attr) 14702 goto nla_put_failure; 14703 14704 if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) || 14705 nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) || 14706 (preauth && 14707 nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH))) 14708 goto nla_put_failure; 14709 14710 nla_nest_end(msg, attr); 14711 14712 genlmsg_end(msg, hdr); 14713 14714 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14715 NL80211_MCGRP_MLME, gfp); 14716 return; 14717 14718 nla_put_failure: 14719 genlmsg_cancel(msg, hdr); 14720 nlmsg_free(msg); 14721 } 14722 14723 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index, 14724 const u8 *bssid, bool preauth, gfp_t gfp) 14725 { 14726 struct wireless_dev *wdev = dev->ieee80211_ptr; 14727 struct wiphy *wiphy = wdev->wiphy; 14728 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14729 14730 trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth); 14731 nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp); 14732 } 14733 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify); 14734 14735 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev, 14736 struct net_device *netdev, 14737 struct cfg80211_chan_def *chandef, 14738 gfp_t gfp, 14739 enum nl80211_commands notif, 14740 u8 count) 14741 { 14742 struct sk_buff *msg; 14743 void *hdr; 14744 14745 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14746 if (!msg) 14747 return; 14748 14749 hdr = nl80211hdr_put(msg, 0, 0, 0, notif); 14750 if (!hdr) { 14751 nlmsg_free(msg); 14752 return; 14753 } 14754 14755 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex)) 14756 goto nla_put_failure; 14757 14758 if (nl80211_send_chandef(msg, chandef)) 14759 goto nla_put_failure; 14760 14761 if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) && 14762 (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count))) 14763 goto nla_put_failure; 14764 14765 genlmsg_end(msg, hdr); 14766 14767 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14768 NL80211_MCGRP_MLME, gfp); 14769 return; 14770 14771 nla_put_failure: 14772 genlmsg_cancel(msg, hdr); 14773 nlmsg_free(msg); 14774 } 14775 14776 void cfg80211_ch_switch_notify(struct net_device *dev, 14777 struct cfg80211_chan_def *chandef) 14778 { 14779 struct wireless_dev *wdev = dev->ieee80211_ptr; 14780 struct wiphy *wiphy = wdev->wiphy; 14781 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14782 14783 ASSERT_WDEV_LOCK(wdev); 14784 14785 trace_cfg80211_ch_switch_notify(dev, chandef); 14786 14787 wdev->chandef = *chandef; 14788 wdev->preset_chandef = *chandef; 14789 nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL, 14790 NL80211_CMD_CH_SWITCH_NOTIFY, 0); 14791 } 14792 EXPORT_SYMBOL(cfg80211_ch_switch_notify); 14793 14794 void cfg80211_ch_switch_started_notify(struct net_device *dev, 14795 struct cfg80211_chan_def *chandef, 14796 u8 count) 14797 { 14798 struct wireless_dev *wdev = dev->ieee80211_ptr; 14799 struct wiphy *wiphy = wdev->wiphy; 14800 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14801 14802 trace_cfg80211_ch_switch_started_notify(dev, chandef); 14803 14804 nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL, 14805 NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count); 14806 } 14807 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify); 14808 14809 void 14810 nl80211_radar_notify(struct cfg80211_registered_device *rdev, 14811 const struct cfg80211_chan_def *chandef, 14812 enum nl80211_radar_event event, 14813 struct net_device *netdev, gfp_t gfp) 14814 { 14815 struct sk_buff *msg; 14816 void *hdr; 14817 14818 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14819 if (!msg) 14820 return; 14821 14822 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT); 14823 if (!hdr) { 14824 nlmsg_free(msg); 14825 return; 14826 } 14827 14828 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx)) 14829 goto nla_put_failure; 14830 14831 /* NOP and radar events don't need a netdev parameter */ 14832 if (netdev) { 14833 struct wireless_dev *wdev = netdev->ieee80211_ptr; 14834 14835 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 14836 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 14837 NL80211_ATTR_PAD)) 14838 goto nla_put_failure; 14839 } 14840 14841 if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event)) 14842 goto nla_put_failure; 14843 14844 if (nl80211_send_chandef(msg, chandef)) 14845 goto nla_put_failure; 14846 14847 genlmsg_end(msg, hdr); 14848 14849 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14850 NL80211_MCGRP_MLME, gfp); 14851 return; 14852 14853 nla_put_failure: 14854 genlmsg_cancel(msg, hdr); 14855 nlmsg_free(msg); 14856 } 14857 14858 void cfg80211_probe_status(struct net_device *dev, const u8 *addr, 14859 u64 cookie, bool acked, gfp_t gfp) 14860 { 14861 struct wireless_dev *wdev = dev->ieee80211_ptr; 14862 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 14863 struct sk_buff *msg; 14864 void *hdr; 14865 14866 trace_cfg80211_probe_status(dev, addr, cookie, acked); 14867 14868 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14869 14870 if (!msg) 14871 return; 14872 14873 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT); 14874 if (!hdr) { 14875 nlmsg_free(msg); 14876 return; 14877 } 14878 14879 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14880 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 14881 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) || 14882 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 14883 NL80211_ATTR_PAD) || 14884 (acked && nla_put_flag(msg, NL80211_ATTR_ACK))) 14885 goto nla_put_failure; 14886 14887 genlmsg_end(msg, hdr); 14888 14889 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14890 NL80211_MCGRP_MLME, gfp); 14891 return; 14892 14893 nla_put_failure: 14894 genlmsg_cancel(msg, hdr); 14895 nlmsg_free(msg); 14896 } 14897 EXPORT_SYMBOL(cfg80211_probe_status); 14898 14899 void cfg80211_report_obss_beacon(struct wiphy *wiphy, 14900 const u8 *frame, size_t len, 14901 int freq, int sig_dbm) 14902 { 14903 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14904 struct sk_buff *msg; 14905 void *hdr; 14906 struct cfg80211_beacon_registration *reg; 14907 14908 trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm); 14909 14910 spin_lock_bh(&rdev->beacon_registrations_lock); 14911 list_for_each_entry(reg, &rdev->beacon_registrations, list) { 14912 msg = nlmsg_new(len + 100, GFP_ATOMIC); 14913 if (!msg) { 14914 spin_unlock_bh(&rdev->beacon_registrations_lock); 14915 return; 14916 } 14917 14918 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME); 14919 if (!hdr) 14920 goto nla_put_failure; 14921 14922 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14923 (freq && 14924 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) || 14925 (sig_dbm && 14926 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) || 14927 nla_put(msg, NL80211_ATTR_FRAME, len, frame)) 14928 goto nla_put_failure; 14929 14930 genlmsg_end(msg, hdr); 14931 14932 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid); 14933 } 14934 spin_unlock_bh(&rdev->beacon_registrations_lock); 14935 return; 14936 14937 nla_put_failure: 14938 spin_unlock_bh(&rdev->beacon_registrations_lock); 14939 if (hdr) 14940 genlmsg_cancel(msg, hdr); 14941 nlmsg_free(msg); 14942 } 14943 EXPORT_SYMBOL(cfg80211_report_obss_beacon); 14944 14945 #ifdef CONFIG_PM 14946 static int cfg80211_net_detect_results(struct sk_buff *msg, 14947 struct cfg80211_wowlan_wakeup *wakeup) 14948 { 14949 struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect; 14950 struct nlattr *nl_results, *nl_match, *nl_freqs; 14951 int i, j; 14952 14953 nl_results = nla_nest_start( 14954 msg, NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS); 14955 if (!nl_results) 14956 return -EMSGSIZE; 14957 14958 for (i = 0; i < nd->n_matches; i++) { 14959 struct cfg80211_wowlan_nd_match *match = nd->matches[i]; 14960 14961 nl_match = nla_nest_start(msg, i); 14962 if (!nl_match) 14963 break; 14964 14965 /* The SSID attribute is optional in nl80211, but for 14966 * simplicity reasons it's always present in the 14967 * cfg80211 structure. If a driver can't pass the 14968 * SSID, that needs to be changed. A zero length SSID 14969 * is still a valid SSID (wildcard), so it cannot be 14970 * used for this purpose. 14971 */ 14972 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len, 14973 match->ssid.ssid)) { 14974 nla_nest_cancel(msg, nl_match); 14975 goto out; 14976 } 14977 14978 if (match->n_channels) { 14979 nl_freqs = nla_nest_start( 14980 msg, NL80211_ATTR_SCAN_FREQUENCIES); 14981 if (!nl_freqs) { 14982 nla_nest_cancel(msg, nl_match); 14983 goto out; 14984 } 14985 14986 for (j = 0; j < match->n_channels; j++) { 14987 if (nla_put_u32(msg, j, match->channels[j])) { 14988 nla_nest_cancel(msg, nl_freqs); 14989 nla_nest_cancel(msg, nl_match); 14990 goto out; 14991 } 14992 } 14993 14994 nla_nest_end(msg, nl_freqs); 14995 } 14996 14997 nla_nest_end(msg, nl_match); 14998 } 14999 15000 out: 15001 nla_nest_end(msg, nl_results); 15002 return 0; 15003 } 15004 15005 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev, 15006 struct cfg80211_wowlan_wakeup *wakeup, 15007 gfp_t gfp) 15008 { 15009 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 15010 struct sk_buff *msg; 15011 void *hdr; 15012 int size = 200; 15013 15014 trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup); 15015 15016 if (wakeup) 15017 size += wakeup->packet_present_len; 15018 15019 msg = nlmsg_new(size, gfp); 15020 if (!msg) 15021 return; 15022 15023 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN); 15024 if (!hdr) 15025 goto free_msg; 15026 15027 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15028 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 15029 NL80211_ATTR_PAD)) 15030 goto free_msg; 15031 15032 if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 15033 wdev->netdev->ifindex)) 15034 goto free_msg; 15035 15036 if (wakeup) { 15037 struct nlattr *reasons; 15038 15039 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS); 15040 if (!reasons) 15041 goto free_msg; 15042 15043 if (wakeup->disconnect && 15044 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) 15045 goto free_msg; 15046 if (wakeup->magic_pkt && 15047 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) 15048 goto free_msg; 15049 if (wakeup->gtk_rekey_failure && 15050 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) 15051 goto free_msg; 15052 if (wakeup->eap_identity_req && 15053 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) 15054 goto free_msg; 15055 if (wakeup->four_way_handshake && 15056 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) 15057 goto free_msg; 15058 if (wakeup->rfkill_release && 15059 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)) 15060 goto free_msg; 15061 15062 if (wakeup->pattern_idx >= 0 && 15063 nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN, 15064 wakeup->pattern_idx)) 15065 goto free_msg; 15066 15067 if (wakeup->tcp_match && 15068 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH)) 15069 goto free_msg; 15070 15071 if (wakeup->tcp_connlost && 15072 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST)) 15073 goto free_msg; 15074 15075 if (wakeup->tcp_nomoretokens && 15076 nla_put_flag(msg, 15077 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS)) 15078 goto free_msg; 15079 15080 if (wakeup->packet) { 15081 u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211; 15082 u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN; 15083 15084 if (!wakeup->packet_80211) { 15085 pkt_attr = 15086 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023; 15087 len_attr = 15088 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN; 15089 } 15090 15091 if (wakeup->packet_len && 15092 nla_put_u32(msg, len_attr, wakeup->packet_len)) 15093 goto free_msg; 15094 15095 if (nla_put(msg, pkt_attr, wakeup->packet_present_len, 15096 wakeup->packet)) 15097 goto free_msg; 15098 } 15099 15100 if (wakeup->net_detect && 15101 cfg80211_net_detect_results(msg, wakeup)) 15102 goto free_msg; 15103 15104 nla_nest_end(msg, reasons); 15105 } 15106 15107 genlmsg_end(msg, hdr); 15108 15109 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15110 NL80211_MCGRP_MLME, gfp); 15111 return; 15112 15113 free_msg: 15114 nlmsg_free(msg); 15115 } 15116 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup); 15117 #endif 15118 15119 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer, 15120 enum nl80211_tdls_operation oper, 15121 u16 reason_code, gfp_t gfp) 15122 { 15123 struct wireless_dev *wdev = dev->ieee80211_ptr; 15124 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 15125 struct sk_buff *msg; 15126 void *hdr; 15127 15128 trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper, 15129 reason_code); 15130 15131 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 15132 if (!msg) 15133 return; 15134 15135 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER); 15136 if (!hdr) { 15137 nlmsg_free(msg); 15138 return; 15139 } 15140 15141 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15142 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 15143 nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) || 15144 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) || 15145 (reason_code > 0 && 15146 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code))) 15147 goto nla_put_failure; 15148 15149 genlmsg_end(msg, hdr); 15150 15151 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15152 NL80211_MCGRP_MLME, gfp); 15153 return; 15154 15155 nla_put_failure: 15156 genlmsg_cancel(msg, hdr); 15157 nlmsg_free(msg); 15158 } 15159 EXPORT_SYMBOL(cfg80211_tdls_oper_request); 15160 15161 static int nl80211_netlink_notify(struct notifier_block * nb, 15162 unsigned long state, 15163 void *_notify) 15164 { 15165 struct netlink_notify *notify = _notify; 15166 struct cfg80211_registered_device *rdev; 15167 struct wireless_dev *wdev; 15168 struct cfg80211_beacon_registration *reg, *tmp; 15169 15170 if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC) 15171 return NOTIFY_DONE; 15172 15173 rcu_read_lock(); 15174 15175 list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) { 15176 struct cfg80211_sched_scan_request *sched_scan_req; 15177 15178 list_for_each_entry_rcu(sched_scan_req, 15179 &rdev->sched_scan_req_list, 15180 list) { 15181 if (sched_scan_req->owner_nlportid == notify->portid) { 15182 sched_scan_req->nl_owner_dead = true; 15183 schedule_work(&rdev->sched_scan_stop_wk); 15184 } 15185 } 15186 15187 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) { 15188 cfg80211_mlme_unregister_socket(wdev, notify->portid); 15189 15190 if (wdev->owner_nlportid == notify->portid) { 15191 wdev->nl_owner_dead = true; 15192 schedule_work(&rdev->destroy_work); 15193 } else if (wdev->conn_owner_nlportid == notify->portid) { 15194 schedule_work(&wdev->disconnect_wk); 15195 } 15196 } 15197 15198 spin_lock_bh(&rdev->beacon_registrations_lock); 15199 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations, 15200 list) { 15201 if (reg->nlportid == notify->portid) { 15202 list_del(®->list); 15203 kfree(reg); 15204 break; 15205 } 15206 } 15207 spin_unlock_bh(&rdev->beacon_registrations_lock); 15208 } 15209 15210 rcu_read_unlock(); 15211 15212 /* 15213 * It is possible that the user space process that is controlling the 15214 * indoor setting disappeared, so notify the regulatory core. 15215 */ 15216 regulatory_netlink_notify(notify->portid); 15217 return NOTIFY_OK; 15218 } 15219 15220 static struct notifier_block nl80211_netlink_notifier = { 15221 .notifier_call = nl80211_netlink_notify, 15222 }; 15223 15224 void cfg80211_ft_event(struct net_device *netdev, 15225 struct cfg80211_ft_event_params *ft_event) 15226 { 15227 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy; 15228 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 15229 struct sk_buff *msg; 15230 void *hdr; 15231 15232 trace_cfg80211_ft_event(wiphy, netdev, ft_event); 15233 15234 if (!ft_event->target_ap) 15235 return; 15236 15237 msg = nlmsg_new(100 + ft_event->ric_ies_len, GFP_KERNEL); 15238 if (!msg) 15239 return; 15240 15241 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT); 15242 if (!hdr) 15243 goto out; 15244 15245 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15246 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 15247 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap)) 15248 goto out; 15249 15250 if (ft_event->ies && 15251 nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies)) 15252 goto out; 15253 if (ft_event->ric_ies && 15254 nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len, 15255 ft_event->ric_ies)) 15256 goto out; 15257 15258 genlmsg_end(msg, hdr); 15259 15260 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15261 NL80211_MCGRP_MLME, GFP_KERNEL); 15262 return; 15263 out: 15264 nlmsg_free(msg); 15265 } 15266 EXPORT_SYMBOL(cfg80211_ft_event); 15267 15268 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp) 15269 { 15270 struct cfg80211_registered_device *rdev; 15271 struct sk_buff *msg; 15272 void *hdr; 15273 u32 nlportid; 15274 15275 rdev = wiphy_to_rdev(wdev->wiphy); 15276 if (!rdev->crit_proto_nlportid) 15277 return; 15278 15279 nlportid = rdev->crit_proto_nlportid; 15280 rdev->crit_proto_nlportid = 0; 15281 15282 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 15283 if (!msg) 15284 return; 15285 15286 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP); 15287 if (!hdr) 15288 goto nla_put_failure; 15289 15290 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15291 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 15292 NL80211_ATTR_PAD)) 15293 goto nla_put_failure; 15294 15295 genlmsg_end(msg, hdr); 15296 15297 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 15298 return; 15299 15300 nla_put_failure: 15301 if (hdr) 15302 genlmsg_cancel(msg, hdr); 15303 nlmsg_free(msg); 15304 } 15305 EXPORT_SYMBOL(cfg80211_crit_proto_stopped); 15306 15307 void nl80211_send_ap_stopped(struct wireless_dev *wdev) 15308 { 15309 struct wiphy *wiphy = wdev->wiphy; 15310 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 15311 struct sk_buff *msg; 15312 void *hdr; 15313 15314 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 15315 if (!msg) 15316 return; 15317 15318 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP); 15319 if (!hdr) 15320 goto out; 15321 15322 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15323 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) || 15324 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 15325 NL80211_ATTR_PAD)) 15326 goto out; 15327 15328 genlmsg_end(msg, hdr); 15329 15330 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0, 15331 NL80211_MCGRP_MLME, GFP_KERNEL); 15332 return; 15333 out: 15334 nlmsg_free(msg); 15335 } 15336 15337 /* initialisation/exit functions */ 15338 15339 int __init nl80211_init(void) 15340 { 15341 int err; 15342 15343 err = genl_register_family(&nl80211_fam); 15344 if (err) 15345 return err; 15346 15347 err = netlink_register_notifier(&nl80211_netlink_notifier); 15348 if (err) 15349 goto err_out; 15350 15351 return 0; 15352 err_out: 15353 genl_unregister_family(&nl80211_fam); 15354 return err; 15355 } 15356 15357 void nl80211_exit(void) 15358 { 15359 netlink_unregister_notifier(&nl80211_netlink_notifier); 15360 genl_unregister_family(&nl80211_fam); 15361 } 15362