1 /* 2 * This is the new netlink-based wireless configuration interface. 3 * 4 * Copyright 2006-2010 Johannes Berg <johannes@sipsolutions.net> 5 * Copyright 2013-2014 Intel Mobile Communications GmbH 6 * Copyright 2015-2017 Intel Deutschland GmbH 7 * Copyright (C) 2018 Intel Corporation 8 */ 9 10 #include <linux/if.h> 11 #include <linux/module.h> 12 #include <linux/err.h> 13 #include <linux/slab.h> 14 #include <linux/list.h> 15 #include <linux/if_ether.h> 16 #include <linux/ieee80211.h> 17 #include <linux/nl80211.h> 18 #include <linux/rtnetlink.h> 19 #include <linux/netlink.h> 20 #include <linux/nospec.h> 21 #include <linux/etherdevice.h> 22 #include <net/net_namespace.h> 23 #include <net/genetlink.h> 24 #include <net/cfg80211.h> 25 #include <net/sock.h> 26 #include <net/inet_connection_sock.h> 27 #include "core.h" 28 #include "nl80211.h" 29 #include "reg.h" 30 #include "rdev-ops.h" 31 32 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev, 33 struct genl_info *info, 34 struct cfg80211_crypto_settings *settings, 35 int cipher_limit); 36 37 /* the netlink family */ 38 static struct genl_family nl80211_fam; 39 40 /* multicast groups */ 41 enum nl80211_multicast_groups { 42 NL80211_MCGRP_CONFIG, 43 NL80211_MCGRP_SCAN, 44 NL80211_MCGRP_REGULATORY, 45 NL80211_MCGRP_MLME, 46 NL80211_MCGRP_VENDOR, 47 NL80211_MCGRP_NAN, 48 NL80211_MCGRP_TESTMODE /* keep last - ifdef! */ 49 }; 50 51 static const struct genl_multicast_group nl80211_mcgrps[] = { 52 [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG }, 53 [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN }, 54 [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG }, 55 [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME }, 56 [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR }, 57 [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN }, 58 #ifdef CONFIG_NL80211_TESTMODE 59 [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE } 60 #endif 61 }; 62 63 /* returns ERR_PTR values */ 64 static struct wireless_dev * 65 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs) 66 { 67 struct cfg80211_registered_device *rdev; 68 struct wireless_dev *result = NULL; 69 bool have_ifidx = attrs[NL80211_ATTR_IFINDEX]; 70 bool have_wdev_id = attrs[NL80211_ATTR_WDEV]; 71 u64 wdev_id; 72 int wiphy_idx = -1; 73 int ifidx = -1; 74 75 ASSERT_RTNL(); 76 77 if (!have_ifidx && !have_wdev_id) 78 return ERR_PTR(-EINVAL); 79 80 if (have_ifidx) 81 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]); 82 if (have_wdev_id) { 83 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]); 84 wiphy_idx = wdev_id >> 32; 85 } 86 87 list_for_each_entry(rdev, &cfg80211_rdev_list, list) { 88 struct wireless_dev *wdev; 89 90 if (wiphy_net(&rdev->wiphy) != netns) 91 continue; 92 93 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx) 94 continue; 95 96 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { 97 if (have_ifidx && wdev->netdev && 98 wdev->netdev->ifindex == ifidx) { 99 result = wdev; 100 break; 101 } 102 if (have_wdev_id && wdev->identifier == (u32)wdev_id) { 103 result = wdev; 104 break; 105 } 106 } 107 108 if (result) 109 break; 110 } 111 112 if (result) 113 return result; 114 return ERR_PTR(-ENODEV); 115 } 116 117 static struct cfg80211_registered_device * 118 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs) 119 { 120 struct cfg80211_registered_device *rdev = NULL, *tmp; 121 struct net_device *netdev; 122 123 ASSERT_RTNL(); 124 125 if (!attrs[NL80211_ATTR_WIPHY] && 126 !attrs[NL80211_ATTR_IFINDEX] && 127 !attrs[NL80211_ATTR_WDEV]) 128 return ERR_PTR(-EINVAL); 129 130 if (attrs[NL80211_ATTR_WIPHY]) 131 rdev = cfg80211_rdev_by_wiphy_idx( 132 nla_get_u32(attrs[NL80211_ATTR_WIPHY])); 133 134 if (attrs[NL80211_ATTR_WDEV]) { 135 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]); 136 struct wireless_dev *wdev; 137 bool found = false; 138 139 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32); 140 if (tmp) { 141 /* make sure wdev exists */ 142 list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) { 143 if (wdev->identifier != (u32)wdev_id) 144 continue; 145 found = true; 146 break; 147 } 148 149 if (!found) 150 tmp = NULL; 151 152 if (rdev && tmp != rdev) 153 return ERR_PTR(-EINVAL); 154 rdev = tmp; 155 } 156 } 157 158 if (attrs[NL80211_ATTR_IFINDEX]) { 159 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]); 160 161 netdev = __dev_get_by_index(netns, ifindex); 162 if (netdev) { 163 if (netdev->ieee80211_ptr) 164 tmp = wiphy_to_rdev( 165 netdev->ieee80211_ptr->wiphy); 166 else 167 tmp = NULL; 168 169 /* not wireless device -- return error */ 170 if (!tmp) 171 return ERR_PTR(-EINVAL); 172 173 /* mismatch -- return error */ 174 if (rdev && tmp != rdev) 175 return ERR_PTR(-EINVAL); 176 177 rdev = tmp; 178 } 179 } 180 181 if (!rdev) 182 return ERR_PTR(-ENODEV); 183 184 if (netns != wiphy_net(&rdev->wiphy)) 185 return ERR_PTR(-ENODEV); 186 187 return rdev; 188 } 189 190 /* 191 * This function returns a pointer to the driver 192 * that the genl_info item that is passed refers to. 193 * 194 * The result of this can be a PTR_ERR and hence must 195 * be checked with IS_ERR() for errors. 196 */ 197 static struct cfg80211_registered_device * 198 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info) 199 { 200 return __cfg80211_rdev_from_attrs(netns, info->attrs); 201 } 202 203 static int validate_ie_attr(const struct nlattr *attr, 204 struct netlink_ext_ack *extack) 205 { 206 const u8 *pos; 207 int len; 208 209 pos = nla_data(attr); 210 len = nla_len(attr); 211 212 while (len) { 213 u8 elemlen; 214 215 if (len < 2) 216 goto error; 217 len -= 2; 218 219 elemlen = pos[1]; 220 if (elemlen > len) 221 goto error; 222 223 len -= elemlen; 224 pos += 2 + elemlen; 225 } 226 227 return 0; 228 error: 229 NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements"); 230 return -EINVAL; 231 } 232 233 /* policy for the attributes */ 234 static const struct nla_policy 235 nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = { 236 [NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, }, 237 [NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY, 238 .len = U8_MAX }, 239 [NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY, 240 .len = U8_MAX }, 241 }; 242 243 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { 244 [NL80211_ATTR_WIPHY] = { .type = NLA_U32 }, 245 [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING, 246 .len = 20-1 }, 247 [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED }, 248 249 [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 }, 250 [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 }, 251 [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 }, 252 [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 }, 253 [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 }, 254 255 [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1), 256 [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1), 257 [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 }, 258 [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 }, 259 [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 }, 260 [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG }, 261 262 [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX), 263 [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 }, 264 [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 }, 265 266 [NL80211_ATTR_MAC] = { .len = ETH_ALEN }, 267 [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN }, 268 269 [NL80211_ATTR_KEY] = { .type = NLA_NESTED, }, 270 [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY, 271 .len = WLAN_MAX_KEY_LEN }, 272 [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 5), 273 [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 }, 274 [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG }, 275 [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 }, 276 [NL80211_ATTR_KEY_TYPE] = 277 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES), 278 279 [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 }, 280 [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 }, 281 [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY, 282 .len = IEEE80211_MAX_DATA_LEN }, 283 [NL80211_ATTR_BEACON_TAIL] = 284 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 285 IEEE80211_MAX_DATA_LEN), 286 [NL80211_ATTR_STA_AID] = 287 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID), 288 [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED }, 289 [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 }, 290 [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY, 291 .len = NL80211_MAX_SUPP_RATES }, 292 [NL80211_ATTR_STA_PLINK_ACTION] = 293 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1), 294 [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 }, 295 [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ }, 296 [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY, 297 .len = IEEE80211_MAX_MESH_ID_LEN }, 298 [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 }, 299 300 [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 }, 301 [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED }, 302 303 [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 }, 304 [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 }, 305 [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 }, 306 [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY, 307 .len = NL80211_MAX_SUPP_RATES }, 308 [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 }, 309 310 [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED }, 311 [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG }, 312 313 [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN }, 314 315 [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 }, 316 [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY, 317 validate_ie_attr, 318 IEEE80211_MAX_DATA_LEN), 319 [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED }, 320 [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED }, 321 322 [NL80211_ATTR_SSID] = { .type = NLA_BINARY, 323 .len = IEEE80211_MAX_SSID_LEN }, 324 [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 }, 325 [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 }, 326 [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG }, 327 [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG }, 328 [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32, 329 NL80211_MFP_NO, 330 NL80211_MFP_OPTIONAL), 331 [NL80211_ATTR_STA_FLAGS2] = { 332 .len = sizeof(struct nl80211_sta_flag_update), 333 }, 334 [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG }, 335 [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 }, 336 [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG }, 337 [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG }, 338 [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG }, 339 [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 }, 340 [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 }, 341 [NL80211_ATTR_PID] = { .type = NLA_U32 }, 342 [NL80211_ATTR_4ADDR] = { .type = NLA_U8 }, 343 [NL80211_ATTR_PMKID] = { .len = WLAN_PMKID_LEN }, 344 [NL80211_ATTR_DURATION] = { .type = NLA_U32 }, 345 [NL80211_ATTR_COOKIE] = { .type = NLA_U64 }, 346 [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED }, 347 [NL80211_ATTR_FRAME] = { .type = NLA_BINARY, 348 .len = IEEE80211_MAX_DATA_LEN }, 349 [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, }, 350 [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32, 351 NL80211_PS_DISABLED, 352 NL80211_PS_ENABLED), 353 [NL80211_ATTR_CQM] = { .type = NLA_NESTED, }, 354 [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG }, 355 [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 }, 356 [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 }, 357 [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 }, 358 [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 }, 359 [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 }, 360 [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 }, 361 [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 }, 362 [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG }, 363 [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED }, 364 [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED }, 365 [NL80211_ATTR_STA_PLINK_STATE] = 366 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1), 367 [NL80211_ATTR_MESH_PEER_AID] = 368 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID), 369 [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 }, 370 [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED }, 371 [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED }, 372 [NL80211_ATTR_HIDDEN_SSID] = 373 NLA_POLICY_RANGE(NLA_U32, 374 NL80211_HIDDEN_SSID_NOT_IN_USE, 375 NL80211_HIDDEN_SSID_ZERO_CONTENTS), 376 [NL80211_ATTR_IE_PROBE_RESP] = 377 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 378 IEEE80211_MAX_DATA_LEN), 379 [NL80211_ATTR_IE_ASSOC_RESP] = 380 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 381 IEEE80211_MAX_DATA_LEN), 382 [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG }, 383 [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED }, 384 [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG }, 385 [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 }, 386 [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 }, 387 [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 }, 388 [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG }, 389 [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG }, 390 [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG }, 391 [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG }, 392 [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY, 393 .len = IEEE80211_MAX_DATA_LEN }, 394 [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 }, 395 [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG }, 396 [NL80211_ATTR_HT_CAPABILITY_MASK] = { 397 .len = NL80211_HT_CAPABILITY_LEN 398 }, 399 [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 }, 400 [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 }, 401 [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 }, 402 [NL80211_ATTR_WDEV] = { .type = NLA_U64 }, 403 [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 }, 404 [NL80211_ATTR_AUTH_DATA] = { .type = NLA_BINARY, }, 405 [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN }, 406 [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 }, 407 [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127), 408 [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1), 409 [NL80211_ATTR_LOCAL_MESH_POWER_MODE] = 410 NLA_POLICY_RANGE(NLA_U32, 411 NL80211_MESH_POWER_UNKNOWN + 1, 412 NL80211_MESH_POWER_MAX), 413 [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 }, 414 [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED }, 415 [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 }, 416 [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, }, 417 [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, }, 418 [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG }, 419 [NL80211_ATTR_VHT_CAPABILITY_MASK] = { 420 .len = NL80211_VHT_CAPABILITY_LEN, 421 }, 422 [NL80211_ATTR_MDID] = { .type = NLA_U16 }, 423 [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY, 424 .len = IEEE80211_MAX_DATA_LEN }, 425 [NL80211_ATTR_PEER_AID] = 426 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID), 427 [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 }, 428 [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG }, 429 [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED }, 430 [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY }, 431 [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY }, 432 [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY }, 433 [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY }, 434 [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG }, 435 [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 }, 436 [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 }, 437 [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 }, 438 [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY }, 439 [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY, 440 .len = IEEE80211_QOS_MAP_LEN_MAX }, 441 [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN }, 442 [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 }, 443 [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 }, 444 [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG }, 445 [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY }, 446 [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG }, 447 [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1), 448 [NL80211_ATTR_USER_PRIO] = 449 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1), 450 [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 }, 451 [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 }, 452 [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN }, 453 [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG }, 454 [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 }, 455 [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 }, 456 [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG }, 457 [NL80211_ATTR_PBSS] = { .type = NLA_FLAG }, 458 [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED }, 459 [NL80211_ATTR_STA_SUPPORT_P2P_PS] = 460 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1), 461 [NL80211_ATTR_MU_MIMO_GROUP_DATA] = { 462 .len = VHT_MUMIMO_GROUPS_DATA_LEN 463 }, 464 [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = { .len = ETH_ALEN }, 465 [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1), 466 [NL80211_ATTR_BANDS] = { .type = NLA_U32 }, 467 [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED }, 468 [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY, 469 .len = FILS_MAX_KEK_LEN }, 470 [NL80211_ATTR_FILS_NONCES] = { .len = 2 * FILS_NONCE_LEN }, 471 [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, }, 472 [NL80211_ATTR_BSSID] = { .len = ETH_ALEN }, 473 [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 }, 474 [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = { 475 .len = sizeof(struct nl80211_bss_select_rssi_adjust) 476 }, 477 [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 }, 478 [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY, 479 .len = FILS_ERP_MAX_USERNAME_LEN }, 480 [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY, 481 .len = FILS_ERP_MAX_REALM_LEN }, 482 [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 }, 483 [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY, 484 .len = FILS_ERP_MAX_RRK_LEN }, 485 [NL80211_ATTR_FILS_CACHE_ID] = { .len = 2 }, 486 [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN }, 487 [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG }, 488 [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG }, 489 490 [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 }, 491 [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 }, 492 [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 }, 493 [NL80211_ATTR_HE_CAPABILITY] = { .type = NLA_BINARY, 494 .len = NL80211_HE_MAX_CAPABILITY_LEN }, 495 496 [NL80211_ATTR_FTM_RESPONDER] = { 497 .type = NLA_NESTED, 498 .validation_data = nl80211_ftm_responder_policy, 499 }, 500 }; 501 502 /* policy for the key attributes */ 503 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = { 504 [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN }, 505 [NL80211_KEY_IDX] = { .type = NLA_U8 }, 506 [NL80211_KEY_CIPHER] = { .type = NLA_U32 }, 507 [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 }, 508 [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG }, 509 [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG }, 510 [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1), 511 [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED }, 512 }; 513 514 /* policy for the key default flags */ 515 static const struct nla_policy 516 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = { 517 [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG }, 518 [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG }, 519 }; 520 521 #ifdef CONFIG_PM 522 /* policy for WoWLAN attributes */ 523 static const struct nla_policy 524 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = { 525 [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG }, 526 [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG }, 527 [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG }, 528 [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED }, 529 [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG }, 530 [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG }, 531 [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG }, 532 [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG }, 533 [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED }, 534 [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED }, 535 }; 536 537 static const struct nla_policy 538 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = { 539 [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 }, 540 [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 }, 541 [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN }, 542 [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 }, 543 [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 }, 544 [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 }, 545 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = { 546 .len = sizeof(struct nl80211_wowlan_tcp_data_seq) 547 }, 548 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = { 549 .len = sizeof(struct nl80211_wowlan_tcp_data_token) 550 }, 551 [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 }, 552 [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 }, 553 [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 }, 554 }; 555 #endif /* CONFIG_PM */ 556 557 /* policy for coalesce rule attributes */ 558 static const struct nla_policy 559 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = { 560 [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 }, 561 [NL80211_ATTR_COALESCE_RULE_CONDITION] = 562 NLA_POLICY_RANGE(NLA_U32, 563 NL80211_COALESCE_CONDITION_MATCH, 564 NL80211_COALESCE_CONDITION_NO_MATCH), 565 [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED }, 566 }; 567 568 /* policy for GTK rekey offload attributes */ 569 static const struct nla_policy 570 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = { 571 [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN }, 572 [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN }, 573 [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN }, 574 }; 575 576 static const struct nla_policy 577 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = { 578 [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY, 579 .len = IEEE80211_MAX_SSID_LEN }, 580 [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = { .len = ETH_ALEN }, 581 [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 }, 582 }; 583 584 static const struct nla_policy 585 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = { 586 [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 }, 587 [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 }, 588 }; 589 590 static const struct nla_policy 591 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = { 592 [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG }, 593 [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 }, 594 [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = { 595 .len = sizeof(struct nl80211_bss_select_rssi_adjust) 596 }, 597 }; 598 599 /* policy for NAN function attributes */ 600 static const struct nla_policy 601 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = { 602 [NL80211_NAN_FUNC_TYPE] = { .type = NLA_U8 }, 603 [NL80211_NAN_FUNC_SERVICE_ID] = { 604 .len = NL80211_NAN_FUNC_SERVICE_ID_LEN }, 605 [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 }, 606 [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG }, 607 [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG }, 608 [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 }, 609 [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 }, 610 [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = { .len = ETH_ALEN }, 611 [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG }, 612 [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 }, 613 [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY, 614 .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN }, 615 [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED }, 616 [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED }, 617 [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED }, 618 [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 }, 619 [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 }, 620 }; 621 622 /* policy for Service Response Filter attributes */ 623 static const struct nla_policy 624 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = { 625 [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG }, 626 [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY, 627 .len = NL80211_NAN_FUNC_SRF_MAX_LEN }, 628 [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 }, 629 [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED }, 630 }; 631 632 /* policy for packet pattern attributes */ 633 static const struct nla_policy 634 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = { 635 [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, }, 636 [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, }, 637 [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 }, 638 }; 639 640 static int nl80211_prepare_wdev_dump(struct netlink_callback *cb, 641 struct cfg80211_registered_device **rdev, 642 struct wireless_dev **wdev) 643 { 644 int err; 645 646 if (!cb->args[0]) { 647 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, 648 genl_family_attrbuf(&nl80211_fam), 649 nl80211_fam.maxattr, nl80211_policy, NULL); 650 if (err) 651 return err; 652 653 *wdev = __cfg80211_wdev_from_attrs( 654 sock_net(cb->skb->sk), 655 genl_family_attrbuf(&nl80211_fam)); 656 if (IS_ERR(*wdev)) 657 return PTR_ERR(*wdev); 658 *rdev = wiphy_to_rdev((*wdev)->wiphy); 659 /* 0 is the first index - add 1 to parse only once */ 660 cb->args[0] = (*rdev)->wiphy_idx + 1; 661 cb->args[1] = (*wdev)->identifier; 662 } else { 663 /* subtract the 1 again here */ 664 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1); 665 struct wireless_dev *tmp; 666 667 if (!wiphy) 668 return -ENODEV; 669 *rdev = wiphy_to_rdev(wiphy); 670 *wdev = NULL; 671 672 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) { 673 if (tmp->identifier == cb->args[1]) { 674 *wdev = tmp; 675 break; 676 } 677 } 678 679 if (!*wdev) 680 return -ENODEV; 681 } 682 683 return 0; 684 } 685 686 /* message building helper */ 687 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq, 688 int flags, u8 cmd) 689 { 690 /* since there is no private header just add the generic one */ 691 return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd); 692 } 693 694 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg, 695 const struct ieee80211_reg_rule *rule) 696 { 697 int j; 698 struct nlattr *nl_wmm_rules = 699 nla_nest_start(msg, NL80211_FREQUENCY_ATTR_WMM); 700 701 if (!nl_wmm_rules) 702 goto nla_put_failure; 703 704 for (j = 0; j < IEEE80211_NUM_ACS; j++) { 705 struct nlattr *nl_wmm_rule = nla_nest_start(msg, j); 706 707 if (!nl_wmm_rule) 708 goto nla_put_failure; 709 710 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN, 711 rule->wmm_rule.client[j].cw_min) || 712 nla_put_u16(msg, NL80211_WMMR_CW_MAX, 713 rule->wmm_rule.client[j].cw_max) || 714 nla_put_u8(msg, NL80211_WMMR_AIFSN, 715 rule->wmm_rule.client[j].aifsn) || 716 nla_put_u16(msg, NL80211_WMMR_TXOP, 717 rule->wmm_rule.client[j].cot)) 718 goto nla_put_failure; 719 720 nla_nest_end(msg, nl_wmm_rule); 721 } 722 nla_nest_end(msg, nl_wmm_rules); 723 724 return 0; 725 726 nla_put_failure: 727 return -ENOBUFS; 728 } 729 730 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy, 731 struct ieee80211_channel *chan, 732 bool large) 733 { 734 /* Some channels must be completely excluded from the 735 * list to protect old user-space tools from breaking 736 */ 737 if (!large && chan->flags & 738 (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ)) 739 return 0; 740 741 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ, 742 chan->center_freq)) 743 goto nla_put_failure; 744 745 if ((chan->flags & IEEE80211_CHAN_DISABLED) && 746 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED)) 747 goto nla_put_failure; 748 if (chan->flags & IEEE80211_CHAN_NO_IR) { 749 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR)) 750 goto nla_put_failure; 751 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS)) 752 goto nla_put_failure; 753 } 754 if (chan->flags & IEEE80211_CHAN_RADAR) { 755 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR)) 756 goto nla_put_failure; 757 if (large) { 758 u32 time; 759 760 time = elapsed_jiffies_msecs(chan->dfs_state_entered); 761 762 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE, 763 chan->dfs_state)) 764 goto nla_put_failure; 765 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME, 766 time)) 767 goto nla_put_failure; 768 if (nla_put_u32(msg, 769 NL80211_FREQUENCY_ATTR_DFS_CAC_TIME, 770 chan->dfs_cac_ms)) 771 goto nla_put_failure; 772 } 773 } 774 775 if (large) { 776 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) && 777 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS)) 778 goto nla_put_failure; 779 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) && 780 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS)) 781 goto nla_put_failure; 782 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) && 783 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ)) 784 goto nla_put_failure; 785 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) && 786 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ)) 787 goto nla_put_failure; 788 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) && 789 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY)) 790 goto nla_put_failure; 791 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) && 792 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT)) 793 goto nla_put_failure; 794 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) && 795 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ)) 796 goto nla_put_failure; 797 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) && 798 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ)) 799 goto nla_put_failure; 800 } 801 802 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER, 803 DBM_TO_MBM(chan->max_power))) 804 goto nla_put_failure; 805 806 if (large) { 807 const struct ieee80211_reg_rule *rule = 808 freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq)); 809 810 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) { 811 if (nl80211_msg_put_wmm_rules(msg, rule)) 812 goto nla_put_failure; 813 } 814 } 815 816 return 0; 817 818 nla_put_failure: 819 return -ENOBUFS; 820 } 821 822 static bool nl80211_put_txq_stats(struct sk_buff *msg, 823 struct cfg80211_txq_stats *txqstats, 824 int attrtype) 825 { 826 struct nlattr *txqattr; 827 828 #define PUT_TXQVAL_U32(attr, memb) do { \ 829 if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) && \ 830 nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \ 831 return false; \ 832 } while (0) 833 834 txqattr = nla_nest_start(msg, attrtype); 835 if (!txqattr) 836 return false; 837 838 PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes); 839 PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets); 840 PUT_TXQVAL_U32(FLOWS, flows); 841 PUT_TXQVAL_U32(DROPS, drops); 842 PUT_TXQVAL_U32(ECN_MARKS, ecn_marks); 843 PUT_TXQVAL_U32(OVERLIMIT, overlimit); 844 PUT_TXQVAL_U32(OVERMEMORY, overmemory); 845 PUT_TXQVAL_U32(COLLISIONS, collisions); 846 PUT_TXQVAL_U32(TX_BYTES, tx_bytes); 847 PUT_TXQVAL_U32(TX_PACKETS, tx_packets); 848 PUT_TXQVAL_U32(MAX_FLOWS, max_flows); 849 nla_nest_end(msg, txqattr); 850 851 #undef PUT_TXQVAL_U32 852 return true; 853 } 854 855 /* netlink command implementations */ 856 857 struct key_parse { 858 struct key_params p; 859 int idx; 860 int type; 861 bool def, defmgmt; 862 bool def_uni, def_multi; 863 }; 864 865 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key, 866 struct key_parse *k) 867 { 868 struct nlattr *tb[NL80211_KEY_MAX + 1]; 869 int err = nla_parse_nested(tb, NL80211_KEY_MAX, key, 870 nl80211_key_policy, info->extack); 871 if (err) 872 return err; 873 874 k->def = !!tb[NL80211_KEY_DEFAULT]; 875 k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT]; 876 877 if (k->def) { 878 k->def_uni = true; 879 k->def_multi = true; 880 } 881 if (k->defmgmt) 882 k->def_multi = true; 883 884 if (tb[NL80211_KEY_IDX]) 885 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]); 886 887 if (tb[NL80211_KEY_DATA]) { 888 k->p.key = nla_data(tb[NL80211_KEY_DATA]); 889 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]); 890 } 891 892 if (tb[NL80211_KEY_SEQ]) { 893 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]); 894 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]); 895 } 896 897 if (tb[NL80211_KEY_CIPHER]) 898 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]); 899 900 if (tb[NL80211_KEY_TYPE]) 901 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]); 902 903 if (tb[NL80211_KEY_DEFAULT_TYPES]) { 904 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES]; 905 906 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1, 907 tb[NL80211_KEY_DEFAULT_TYPES], 908 nl80211_key_default_policy, 909 info->extack); 910 if (err) 911 return err; 912 913 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST]; 914 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST]; 915 } 916 917 return 0; 918 } 919 920 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k) 921 { 922 if (info->attrs[NL80211_ATTR_KEY_DATA]) { 923 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]); 924 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]); 925 } 926 927 if (info->attrs[NL80211_ATTR_KEY_SEQ]) { 928 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]); 929 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]); 930 } 931 932 if (info->attrs[NL80211_ATTR_KEY_IDX]) 933 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]); 934 935 if (info->attrs[NL80211_ATTR_KEY_CIPHER]) 936 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]); 937 938 k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT]; 939 k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]; 940 941 if (k->def) { 942 k->def_uni = true; 943 k->def_multi = true; 944 } 945 if (k->defmgmt) 946 k->def_multi = true; 947 948 if (info->attrs[NL80211_ATTR_KEY_TYPE]) 949 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]); 950 951 if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) { 952 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES]; 953 int err = nla_parse_nested(kdt, 954 NUM_NL80211_KEY_DEFAULT_TYPES - 1, 955 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES], 956 nl80211_key_default_policy, 957 info->extack); 958 if (err) 959 return err; 960 961 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST]; 962 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST]; 963 } 964 965 return 0; 966 } 967 968 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k) 969 { 970 int err; 971 972 memset(k, 0, sizeof(*k)); 973 k->idx = -1; 974 k->type = -1; 975 976 if (info->attrs[NL80211_ATTR_KEY]) 977 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k); 978 else 979 err = nl80211_parse_key_old(info, k); 980 981 if (err) 982 return err; 983 984 if (k->def && k->defmgmt) { 985 GENL_SET_ERR_MSG(info, "key with def && defmgmt is invalid"); 986 return -EINVAL; 987 } 988 989 if (k->defmgmt) { 990 if (k->def_uni || !k->def_multi) { 991 GENL_SET_ERR_MSG(info, "defmgmt key must be mcast"); 992 return -EINVAL; 993 } 994 } 995 996 if (k->idx != -1) { 997 if (k->defmgmt) { 998 if (k->idx < 4 || k->idx > 5) { 999 GENL_SET_ERR_MSG(info, 1000 "defmgmt key idx not 4 or 5"); 1001 return -EINVAL; 1002 } 1003 } else if (k->def) { 1004 if (k->idx < 0 || k->idx > 3) { 1005 GENL_SET_ERR_MSG(info, "def key idx not 0-3"); 1006 return -EINVAL; 1007 } 1008 } else { 1009 if (k->idx < 0 || k->idx > 5) { 1010 GENL_SET_ERR_MSG(info, "key idx not 0-5"); 1011 return -EINVAL; 1012 } 1013 } 1014 } 1015 1016 return 0; 1017 } 1018 1019 static struct cfg80211_cached_keys * 1020 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev, 1021 struct genl_info *info, bool *no_ht) 1022 { 1023 struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS]; 1024 struct key_parse parse; 1025 struct nlattr *key; 1026 struct cfg80211_cached_keys *result; 1027 int rem, err, def = 0; 1028 bool have_key = false; 1029 1030 nla_for_each_nested(key, keys, rem) { 1031 have_key = true; 1032 break; 1033 } 1034 1035 if (!have_key) 1036 return NULL; 1037 1038 result = kzalloc(sizeof(*result), GFP_KERNEL); 1039 if (!result) 1040 return ERR_PTR(-ENOMEM); 1041 1042 result->def = -1; 1043 1044 nla_for_each_nested(key, keys, rem) { 1045 memset(&parse, 0, sizeof(parse)); 1046 parse.idx = -1; 1047 1048 err = nl80211_parse_key_new(info, key, &parse); 1049 if (err) 1050 goto error; 1051 err = -EINVAL; 1052 if (!parse.p.key) 1053 goto error; 1054 if (parse.idx < 0 || parse.idx > 3) { 1055 GENL_SET_ERR_MSG(info, "key index out of range [0-3]"); 1056 goto error; 1057 } 1058 if (parse.def) { 1059 if (def) { 1060 GENL_SET_ERR_MSG(info, 1061 "only one key can be default"); 1062 goto error; 1063 } 1064 def = 1; 1065 result->def = parse.idx; 1066 if (!parse.def_uni || !parse.def_multi) 1067 goto error; 1068 } else if (parse.defmgmt) 1069 goto error; 1070 err = cfg80211_validate_key_settings(rdev, &parse.p, 1071 parse.idx, false, NULL); 1072 if (err) 1073 goto error; 1074 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 && 1075 parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) { 1076 GENL_SET_ERR_MSG(info, "connect key must be WEP"); 1077 err = -EINVAL; 1078 goto error; 1079 } 1080 result->params[parse.idx].cipher = parse.p.cipher; 1081 result->params[parse.idx].key_len = parse.p.key_len; 1082 result->params[parse.idx].key = result->data[parse.idx]; 1083 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len); 1084 1085 /* must be WEP key if we got here */ 1086 if (no_ht) 1087 *no_ht = true; 1088 } 1089 1090 if (result->def < 0) { 1091 err = -EINVAL; 1092 GENL_SET_ERR_MSG(info, "need a default/TX key"); 1093 goto error; 1094 } 1095 1096 return result; 1097 error: 1098 kfree(result); 1099 return ERR_PTR(err); 1100 } 1101 1102 static int nl80211_key_allowed(struct wireless_dev *wdev) 1103 { 1104 ASSERT_WDEV_LOCK(wdev); 1105 1106 switch (wdev->iftype) { 1107 case NL80211_IFTYPE_AP: 1108 case NL80211_IFTYPE_AP_VLAN: 1109 case NL80211_IFTYPE_P2P_GO: 1110 case NL80211_IFTYPE_MESH_POINT: 1111 break; 1112 case NL80211_IFTYPE_ADHOC: 1113 case NL80211_IFTYPE_STATION: 1114 case NL80211_IFTYPE_P2P_CLIENT: 1115 if (!wdev->current_bss) 1116 return -ENOLINK; 1117 break; 1118 case NL80211_IFTYPE_UNSPECIFIED: 1119 case NL80211_IFTYPE_OCB: 1120 case NL80211_IFTYPE_MONITOR: 1121 case NL80211_IFTYPE_NAN: 1122 case NL80211_IFTYPE_P2P_DEVICE: 1123 case NL80211_IFTYPE_WDS: 1124 case NUM_NL80211_IFTYPES: 1125 return -EINVAL; 1126 } 1127 1128 return 0; 1129 } 1130 1131 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy, 1132 struct nlattr *tb) 1133 { 1134 struct ieee80211_channel *chan; 1135 1136 if (tb == NULL) 1137 return NULL; 1138 chan = ieee80211_get_channel(wiphy, nla_get_u32(tb)); 1139 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) 1140 return NULL; 1141 return chan; 1142 } 1143 1144 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes) 1145 { 1146 struct nlattr *nl_modes = nla_nest_start(msg, attr); 1147 int i; 1148 1149 if (!nl_modes) 1150 goto nla_put_failure; 1151 1152 i = 0; 1153 while (ifmodes) { 1154 if ((ifmodes & 1) && nla_put_flag(msg, i)) 1155 goto nla_put_failure; 1156 ifmodes >>= 1; 1157 i++; 1158 } 1159 1160 nla_nest_end(msg, nl_modes); 1161 return 0; 1162 1163 nla_put_failure: 1164 return -ENOBUFS; 1165 } 1166 1167 static int nl80211_put_iface_combinations(struct wiphy *wiphy, 1168 struct sk_buff *msg, 1169 bool large) 1170 { 1171 struct nlattr *nl_combis; 1172 int i, j; 1173 1174 nl_combis = nla_nest_start(msg, 1175 NL80211_ATTR_INTERFACE_COMBINATIONS); 1176 if (!nl_combis) 1177 goto nla_put_failure; 1178 1179 for (i = 0; i < wiphy->n_iface_combinations; i++) { 1180 const struct ieee80211_iface_combination *c; 1181 struct nlattr *nl_combi, *nl_limits; 1182 1183 c = &wiphy->iface_combinations[i]; 1184 1185 nl_combi = nla_nest_start(msg, i + 1); 1186 if (!nl_combi) 1187 goto nla_put_failure; 1188 1189 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS); 1190 if (!nl_limits) 1191 goto nla_put_failure; 1192 1193 for (j = 0; j < c->n_limits; j++) { 1194 struct nlattr *nl_limit; 1195 1196 nl_limit = nla_nest_start(msg, j + 1); 1197 if (!nl_limit) 1198 goto nla_put_failure; 1199 if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX, 1200 c->limits[j].max)) 1201 goto nla_put_failure; 1202 if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES, 1203 c->limits[j].types)) 1204 goto nla_put_failure; 1205 nla_nest_end(msg, nl_limit); 1206 } 1207 1208 nla_nest_end(msg, nl_limits); 1209 1210 if (c->beacon_int_infra_match && 1211 nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH)) 1212 goto nla_put_failure; 1213 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS, 1214 c->num_different_channels) || 1215 nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM, 1216 c->max_interfaces)) 1217 goto nla_put_failure; 1218 if (large && 1219 (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS, 1220 c->radar_detect_widths) || 1221 nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS, 1222 c->radar_detect_regions))) 1223 goto nla_put_failure; 1224 if (c->beacon_int_min_gcd && 1225 nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD, 1226 c->beacon_int_min_gcd)) 1227 goto nla_put_failure; 1228 1229 nla_nest_end(msg, nl_combi); 1230 } 1231 1232 nla_nest_end(msg, nl_combis); 1233 1234 return 0; 1235 nla_put_failure: 1236 return -ENOBUFS; 1237 } 1238 1239 #ifdef CONFIG_PM 1240 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev, 1241 struct sk_buff *msg) 1242 { 1243 const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp; 1244 struct nlattr *nl_tcp; 1245 1246 if (!tcp) 1247 return 0; 1248 1249 nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION); 1250 if (!nl_tcp) 1251 return -ENOBUFS; 1252 1253 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD, 1254 tcp->data_payload_max)) 1255 return -ENOBUFS; 1256 1257 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD, 1258 tcp->data_payload_max)) 1259 return -ENOBUFS; 1260 1261 if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ)) 1262 return -ENOBUFS; 1263 1264 if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN, 1265 sizeof(*tcp->tok), tcp->tok)) 1266 return -ENOBUFS; 1267 1268 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL, 1269 tcp->data_interval_max)) 1270 return -ENOBUFS; 1271 1272 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD, 1273 tcp->wake_payload_max)) 1274 return -ENOBUFS; 1275 1276 nla_nest_end(msg, nl_tcp); 1277 return 0; 1278 } 1279 1280 static int nl80211_send_wowlan(struct sk_buff *msg, 1281 struct cfg80211_registered_device *rdev, 1282 bool large) 1283 { 1284 struct nlattr *nl_wowlan; 1285 1286 if (!rdev->wiphy.wowlan) 1287 return 0; 1288 1289 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED); 1290 if (!nl_wowlan) 1291 return -ENOBUFS; 1292 1293 if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) && 1294 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) || 1295 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) && 1296 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) || 1297 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) && 1298 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) || 1299 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) && 1300 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) || 1301 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) && 1302 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) || 1303 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) && 1304 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) || 1305 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) && 1306 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) || 1307 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) && 1308 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))) 1309 return -ENOBUFS; 1310 1311 if (rdev->wiphy.wowlan->n_patterns) { 1312 struct nl80211_pattern_support pat = { 1313 .max_patterns = rdev->wiphy.wowlan->n_patterns, 1314 .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len, 1315 .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len, 1316 .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset, 1317 }; 1318 1319 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN, 1320 sizeof(pat), &pat)) 1321 return -ENOBUFS; 1322 } 1323 1324 if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) && 1325 nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT, 1326 rdev->wiphy.wowlan->max_nd_match_sets)) 1327 return -ENOBUFS; 1328 1329 if (large && nl80211_send_wowlan_tcp_caps(rdev, msg)) 1330 return -ENOBUFS; 1331 1332 nla_nest_end(msg, nl_wowlan); 1333 1334 return 0; 1335 } 1336 #endif 1337 1338 static int nl80211_send_coalesce(struct sk_buff *msg, 1339 struct cfg80211_registered_device *rdev) 1340 { 1341 struct nl80211_coalesce_rule_support rule; 1342 1343 if (!rdev->wiphy.coalesce) 1344 return 0; 1345 1346 rule.max_rules = rdev->wiphy.coalesce->n_rules; 1347 rule.max_delay = rdev->wiphy.coalesce->max_delay; 1348 rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns; 1349 rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len; 1350 rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len; 1351 rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset; 1352 1353 if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule)) 1354 return -ENOBUFS; 1355 1356 return 0; 1357 } 1358 1359 static int 1360 nl80211_send_iftype_data(struct sk_buff *msg, 1361 const struct ieee80211_sband_iftype_data *iftdata) 1362 { 1363 const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap; 1364 1365 if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES, 1366 iftdata->types_mask)) 1367 return -ENOBUFS; 1368 1369 if (he_cap->has_he) { 1370 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC, 1371 sizeof(he_cap->he_cap_elem.mac_cap_info), 1372 he_cap->he_cap_elem.mac_cap_info) || 1373 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY, 1374 sizeof(he_cap->he_cap_elem.phy_cap_info), 1375 he_cap->he_cap_elem.phy_cap_info) || 1376 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET, 1377 sizeof(he_cap->he_mcs_nss_supp), 1378 &he_cap->he_mcs_nss_supp) || 1379 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE, 1380 sizeof(he_cap->ppe_thres), he_cap->ppe_thres)) 1381 return -ENOBUFS; 1382 } 1383 1384 return 0; 1385 } 1386 1387 static int nl80211_send_band_rateinfo(struct sk_buff *msg, 1388 struct ieee80211_supported_band *sband) 1389 { 1390 struct nlattr *nl_rates, *nl_rate; 1391 struct ieee80211_rate *rate; 1392 int i; 1393 1394 /* add HT info */ 1395 if (sband->ht_cap.ht_supported && 1396 (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET, 1397 sizeof(sband->ht_cap.mcs), 1398 &sband->ht_cap.mcs) || 1399 nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA, 1400 sband->ht_cap.cap) || 1401 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR, 1402 sband->ht_cap.ampdu_factor) || 1403 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY, 1404 sband->ht_cap.ampdu_density))) 1405 return -ENOBUFS; 1406 1407 /* add VHT info */ 1408 if (sband->vht_cap.vht_supported && 1409 (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET, 1410 sizeof(sband->vht_cap.vht_mcs), 1411 &sband->vht_cap.vht_mcs) || 1412 nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA, 1413 sband->vht_cap.cap))) 1414 return -ENOBUFS; 1415 1416 if (sband->n_iftype_data) { 1417 struct nlattr *nl_iftype_data = 1418 nla_nest_start(msg, NL80211_BAND_ATTR_IFTYPE_DATA); 1419 int err; 1420 1421 if (!nl_iftype_data) 1422 return -ENOBUFS; 1423 1424 for (i = 0; i < sband->n_iftype_data; i++) { 1425 struct nlattr *iftdata; 1426 1427 iftdata = nla_nest_start(msg, i + 1); 1428 if (!iftdata) 1429 return -ENOBUFS; 1430 1431 err = nl80211_send_iftype_data(msg, 1432 &sband->iftype_data[i]); 1433 if (err) 1434 return err; 1435 1436 nla_nest_end(msg, iftdata); 1437 } 1438 1439 nla_nest_end(msg, nl_iftype_data); 1440 } 1441 1442 /* add bitrates */ 1443 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES); 1444 if (!nl_rates) 1445 return -ENOBUFS; 1446 1447 for (i = 0; i < sband->n_bitrates; i++) { 1448 nl_rate = nla_nest_start(msg, i); 1449 if (!nl_rate) 1450 return -ENOBUFS; 1451 1452 rate = &sband->bitrates[i]; 1453 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE, 1454 rate->bitrate)) 1455 return -ENOBUFS; 1456 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) && 1457 nla_put_flag(msg, 1458 NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE)) 1459 return -ENOBUFS; 1460 1461 nla_nest_end(msg, nl_rate); 1462 } 1463 1464 nla_nest_end(msg, nl_rates); 1465 1466 return 0; 1467 } 1468 1469 static int 1470 nl80211_send_mgmt_stypes(struct sk_buff *msg, 1471 const struct ieee80211_txrx_stypes *mgmt_stypes) 1472 { 1473 u16 stypes; 1474 struct nlattr *nl_ftypes, *nl_ifs; 1475 enum nl80211_iftype ift; 1476 int i; 1477 1478 if (!mgmt_stypes) 1479 return 0; 1480 1481 nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES); 1482 if (!nl_ifs) 1483 return -ENOBUFS; 1484 1485 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) { 1486 nl_ftypes = nla_nest_start(msg, ift); 1487 if (!nl_ftypes) 1488 return -ENOBUFS; 1489 i = 0; 1490 stypes = mgmt_stypes[ift].tx; 1491 while (stypes) { 1492 if ((stypes & 1) && 1493 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE, 1494 (i << 4) | IEEE80211_FTYPE_MGMT)) 1495 return -ENOBUFS; 1496 stypes >>= 1; 1497 i++; 1498 } 1499 nla_nest_end(msg, nl_ftypes); 1500 } 1501 1502 nla_nest_end(msg, nl_ifs); 1503 1504 nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES); 1505 if (!nl_ifs) 1506 return -ENOBUFS; 1507 1508 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) { 1509 nl_ftypes = nla_nest_start(msg, ift); 1510 if (!nl_ftypes) 1511 return -ENOBUFS; 1512 i = 0; 1513 stypes = mgmt_stypes[ift].rx; 1514 while (stypes) { 1515 if ((stypes & 1) && 1516 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE, 1517 (i << 4) | IEEE80211_FTYPE_MGMT)) 1518 return -ENOBUFS; 1519 stypes >>= 1; 1520 i++; 1521 } 1522 nla_nest_end(msg, nl_ftypes); 1523 } 1524 nla_nest_end(msg, nl_ifs); 1525 1526 return 0; 1527 } 1528 1529 #define CMD(op, n) \ 1530 do { \ 1531 if (rdev->ops->op) { \ 1532 i++; \ 1533 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \ 1534 goto nla_put_failure; \ 1535 } \ 1536 } while (0) 1537 1538 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev, 1539 struct sk_buff *msg) 1540 { 1541 int i = 0; 1542 1543 /* 1544 * do *NOT* add anything into this function, new things need to be 1545 * advertised only to new versions of userspace that can deal with 1546 * the split (and they can't possibly care about new features... 1547 */ 1548 CMD(add_virtual_intf, NEW_INTERFACE); 1549 CMD(change_virtual_intf, SET_INTERFACE); 1550 CMD(add_key, NEW_KEY); 1551 CMD(start_ap, START_AP); 1552 CMD(add_station, NEW_STATION); 1553 CMD(add_mpath, NEW_MPATH); 1554 CMD(update_mesh_config, SET_MESH_CONFIG); 1555 CMD(change_bss, SET_BSS); 1556 CMD(auth, AUTHENTICATE); 1557 CMD(assoc, ASSOCIATE); 1558 CMD(deauth, DEAUTHENTICATE); 1559 CMD(disassoc, DISASSOCIATE); 1560 CMD(join_ibss, JOIN_IBSS); 1561 CMD(join_mesh, JOIN_MESH); 1562 CMD(set_pmksa, SET_PMKSA); 1563 CMD(del_pmksa, DEL_PMKSA); 1564 CMD(flush_pmksa, FLUSH_PMKSA); 1565 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) 1566 CMD(remain_on_channel, REMAIN_ON_CHANNEL); 1567 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK); 1568 CMD(mgmt_tx, FRAME); 1569 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL); 1570 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) { 1571 i++; 1572 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS)) 1573 goto nla_put_failure; 1574 } 1575 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap || 1576 rdev->ops->join_mesh) { 1577 i++; 1578 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL)) 1579 goto nla_put_failure; 1580 } 1581 CMD(set_wds_peer, SET_WDS_PEER); 1582 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) { 1583 CMD(tdls_mgmt, TDLS_MGMT); 1584 CMD(tdls_oper, TDLS_OPER); 1585 } 1586 if (rdev->wiphy.max_sched_scan_reqs) 1587 CMD(sched_scan_start, START_SCHED_SCAN); 1588 CMD(probe_client, PROBE_CLIENT); 1589 CMD(set_noack_map, SET_NOACK_MAP); 1590 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) { 1591 i++; 1592 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS)) 1593 goto nla_put_failure; 1594 } 1595 CMD(start_p2p_device, START_P2P_DEVICE); 1596 CMD(set_mcast_rate, SET_MCAST_RATE); 1597 #ifdef CONFIG_NL80211_TESTMODE 1598 CMD(testmode_cmd, TESTMODE); 1599 #endif 1600 1601 if (rdev->ops->connect || rdev->ops->auth) { 1602 i++; 1603 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT)) 1604 goto nla_put_failure; 1605 } 1606 1607 if (rdev->ops->disconnect || rdev->ops->deauth) { 1608 i++; 1609 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT)) 1610 goto nla_put_failure; 1611 } 1612 1613 return i; 1614 nla_put_failure: 1615 return -ENOBUFS; 1616 } 1617 1618 struct nl80211_dump_wiphy_state { 1619 s64 filter_wiphy; 1620 long start; 1621 long split_start, band_start, chan_start, capa_start; 1622 bool split; 1623 }; 1624 1625 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev, 1626 enum nl80211_commands cmd, 1627 struct sk_buff *msg, u32 portid, u32 seq, 1628 int flags, struct nl80211_dump_wiphy_state *state) 1629 { 1630 void *hdr; 1631 struct nlattr *nl_bands, *nl_band; 1632 struct nlattr *nl_freqs, *nl_freq; 1633 struct nlattr *nl_cmds; 1634 enum nl80211_band band; 1635 struct ieee80211_channel *chan; 1636 int i; 1637 const struct ieee80211_txrx_stypes *mgmt_stypes = 1638 rdev->wiphy.mgmt_stypes; 1639 u32 features; 1640 1641 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 1642 if (!hdr) 1643 return -ENOBUFS; 1644 1645 if (WARN_ON(!state)) 1646 return -EINVAL; 1647 1648 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 1649 nla_put_string(msg, NL80211_ATTR_WIPHY_NAME, 1650 wiphy_name(&rdev->wiphy)) || 1651 nla_put_u32(msg, NL80211_ATTR_GENERATION, 1652 cfg80211_rdev_list_generation)) 1653 goto nla_put_failure; 1654 1655 if (cmd != NL80211_CMD_NEW_WIPHY) 1656 goto finish; 1657 1658 switch (state->split_start) { 1659 case 0: 1660 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT, 1661 rdev->wiphy.retry_short) || 1662 nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG, 1663 rdev->wiphy.retry_long) || 1664 nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD, 1665 rdev->wiphy.frag_threshold) || 1666 nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD, 1667 rdev->wiphy.rts_threshold) || 1668 nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS, 1669 rdev->wiphy.coverage_class) || 1670 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS, 1671 rdev->wiphy.max_scan_ssids) || 1672 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS, 1673 rdev->wiphy.max_sched_scan_ssids) || 1674 nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN, 1675 rdev->wiphy.max_scan_ie_len) || 1676 nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN, 1677 rdev->wiphy.max_sched_scan_ie_len) || 1678 nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS, 1679 rdev->wiphy.max_match_sets) || 1680 nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS, 1681 rdev->wiphy.max_sched_scan_plans) || 1682 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL, 1683 rdev->wiphy.max_sched_scan_plan_interval) || 1684 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS, 1685 rdev->wiphy.max_sched_scan_plan_iterations)) 1686 goto nla_put_failure; 1687 1688 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) && 1689 nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN)) 1690 goto nla_put_failure; 1691 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) && 1692 nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH)) 1693 goto nla_put_failure; 1694 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) && 1695 nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD)) 1696 goto nla_put_failure; 1697 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) && 1698 nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT)) 1699 goto nla_put_failure; 1700 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) && 1701 nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT)) 1702 goto nla_put_failure; 1703 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) && 1704 nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP)) 1705 goto nla_put_failure; 1706 state->split_start++; 1707 if (state->split) 1708 break; 1709 case 1: 1710 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES, 1711 sizeof(u32) * rdev->wiphy.n_cipher_suites, 1712 rdev->wiphy.cipher_suites)) 1713 goto nla_put_failure; 1714 1715 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS, 1716 rdev->wiphy.max_num_pmkids)) 1717 goto nla_put_failure; 1718 1719 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) && 1720 nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE)) 1721 goto nla_put_failure; 1722 1723 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX, 1724 rdev->wiphy.available_antennas_tx) || 1725 nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX, 1726 rdev->wiphy.available_antennas_rx)) 1727 goto nla_put_failure; 1728 1729 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) && 1730 nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD, 1731 rdev->wiphy.probe_resp_offload)) 1732 goto nla_put_failure; 1733 1734 if ((rdev->wiphy.available_antennas_tx || 1735 rdev->wiphy.available_antennas_rx) && 1736 rdev->ops->get_antenna) { 1737 u32 tx_ant = 0, rx_ant = 0; 1738 int res; 1739 1740 res = rdev_get_antenna(rdev, &tx_ant, &rx_ant); 1741 if (!res) { 1742 if (nla_put_u32(msg, 1743 NL80211_ATTR_WIPHY_ANTENNA_TX, 1744 tx_ant) || 1745 nla_put_u32(msg, 1746 NL80211_ATTR_WIPHY_ANTENNA_RX, 1747 rx_ant)) 1748 goto nla_put_failure; 1749 } 1750 } 1751 1752 state->split_start++; 1753 if (state->split) 1754 break; 1755 case 2: 1756 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES, 1757 rdev->wiphy.interface_modes)) 1758 goto nla_put_failure; 1759 state->split_start++; 1760 if (state->split) 1761 break; 1762 case 3: 1763 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS); 1764 if (!nl_bands) 1765 goto nla_put_failure; 1766 1767 for (band = state->band_start; 1768 band < NUM_NL80211_BANDS; band++) { 1769 struct ieee80211_supported_band *sband; 1770 1771 sband = rdev->wiphy.bands[band]; 1772 1773 if (!sband) 1774 continue; 1775 1776 nl_band = nla_nest_start(msg, band); 1777 if (!nl_band) 1778 goto nla_put_failure; 1779 1780 switch (state->chan_start) { 1781 case 0: 1782 if (nl80211_send_band_rateinfo(msg, sband)) 1783 goto nla_put_failure; 1784 state->chan_start++; 1785 if (state->split) 1786 break; 1787 default: 1788 /* add frequencies */ 1789 nl_freqs = nla_nest_start( 1790 msg, NL80211_BAND_ATTR_FREQS); 1791 if (!nl_freqs) 1792 goto nla_put_failure; 1793 1794 for (i = state->chan_start - 1; 1795 i < sband->n_channels; 1796 i++) { 1797 nl_freq = nla_nest_start(msg, i); 1798 if (!nl_freq) 1799 goto nla_put_failure; 1800 1801 chan = &sband->channels[i]; 1802 1803 if (nl80211_msg_put_channel( 1804 msg, &rdev->wiphy, chan, 1805 state->split)) 1806 goto nla_put_failure; 1807 1808 nla_nest_end(msg, nl_freq); 1809 if (state->split) 1810 break; 1811 } 1812 if (i < sband->n_channels) 1813 state->chan_start = i + 2; 1814 else 1815 state->chan_start = 0; 1816 nla_nest_end(msg, nl_freqs); 1817 } 1818 1819 nla_nest_end(msg, nl_band); 1820 1821 if (state->split) { 1822 /* start again here */ 1823 if (state->chan_start) 1824 band--; 1825 break; 1826 } 1827 } 1828 nla_nest_end(msg, nl_bands); 1829 1830 if (band < NUM_NL80211_BANDS) 1831 state->band_start = band + 1; 1832 else 1833 state->band_start = 0; 1834 1835 /* if bands & channels are done, continue outside */ 1836 if (state->band_start == 0 && state->chan_start == 0) 1837 state->split_start++; 1838 if (state->split) 1839 break; 1840 case 4: 1841 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS); 1842 if (!nl_cmds) 1843 goto nla_put_failure; 1844 1845 i = nl80211_add_commands_unsplit(rdev, msg); 1846 if (i < 0) 1847 goto nla_put_failure; 1848 if (state->split) { 1849 CMD(crit_proto_start, CRIT_PROTOCOL_START); 1850 CMD(crit_proto_stop, CRIT_PROTOCOL_STOP); 1851 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH) 1852 CMD(channel_switch, CHANNEL_SWITCH); 1853 CMD(set_qos_map, SET_QOS_MAP); 1854 if (rdev->wiphy.features & 1855 NL80211_FEATURE_SUPPORTS_WMM_ADMISSION) 1856 CMD(add_tx_ts, ADD_TX_TS); 1857 CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST); 1858 CMD(update_connect_params, UPDATE_CONNECT_PARAMS); 1859 } 1860 #undef CMD 1861 1862 nla_nest_end(msg, nl_cmds); 1863 state->split_start++; 1864 if (state->split) 1865 break; 1866 case 5: 1867 if (rdev->ops->remain_on_channel && 1868 (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) && 1869 nla_put_u32(msg, 1870 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION, 1871 rdev->wiphy.max_remain_on_channel_duration)) 1872 goto nla_put_failure; 1873 1874 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) && 1875 nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK)) 1876 goto nla_put_failure; 1877 1878 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes)) 1879 goto nla_put_failure; 1880 state->split_start++; 1881 if (state->split) 1882 break; 1883 case 6: 1884 #ifdef CONFIG_PM 1885 if (nl80211_send_wowlan(msg, rdev, state->split)) 1886 goto nla_put_failure; 1887 state->split_start++; 1888 if (state->split) 1889 break; 1890 #else 1891 state->split_start++; 1892 #endif 1893 case 7: 1894 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES, 1895 rdev->wiphy.software_iftypes)) 1896 goto nla_put_failure; 1897 1898 if (nl80211_put_iface_combinations(&rdev->wiphy, msg, 1899 state->split)) 1900 goto nla_put_failure; 1901 1902 state->split_start++; 1903 if (state->split) 1904 break; 1905 case 8: 1906 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) && 1907 nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME, 1908 rdev->wiphy.ap_sme_capa)) 1909 goto nla_put_failure; 1910 1911 features = rdev->wiphy.features; 1912 /* 1913 * We can only add the per-channel limit information if the 1914 * dump is split, otherwise it makes it too big. Therefore 1915 * only advertise it in that case. 1916 */ 1917 if (state->split) 1918 features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS; 1919 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features)) 1920 goto nla_put_failure; 1921 1922 if (rdev->wiphy.ht_capa_mod_mask && 1923 nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK, 1924 sizeof(*rdev->wiphy.ht_capa_mod_mask), 1925 rdev->wiphy.ht_capa_mod_mask)) 1926 goto nla_put_failure; 1927 1928 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME && 1929 rdev->wiphy.max_acl_mac_addrs && 1930 nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX, 1931 rdev->wiphy.max_acl_mac_addrs)) 1932 goto nla_put_failure; 1933 1934 /* 1935 * Any information below this point is only available to 1936 * applications that can deal with it being split. This 1937 * helps ensure that newly added capabilities don't break 1938 * older tools by overrunning their buffers. 1939 * 1940 * We still increment split_start so that in the split 1941 * case we'll continue with more data in the next round, 1942 * but break unconditionally so unsplit data stops here. 1943 */ 1944 state->split_start++; 1945 break; 1946 case 9: 1947 if (rdev->wiphy.extended_capabilities && 1948 (nla_put(msg, NL80211_ATTR_EXT_CAPA, 1949 rdev->wiphy.extended_capabilities_len, 1950 rdev->wiphy.extended_capabilities) || 1951 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK, 1952 rdev->wiphy.extended_capabilities_len, 1953 rdev->wiphy.extended_capabilities_mask))) 1954 goto nla_put_failure; 1955 1956 if (rdev->wiphy.vht_capa_mod_mask && 1957 nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK, 1958 sizeof(*rdev->wiphy.vht_capa_mod_mask), 1959 rdev->wiphy.vht_capa_mod_mask)) 1960 goto nla_put_failure; 1961 1962 state->split_start++; 1963 break; 1964 case 10: 1965 if (nl80211_send_coalesce(msg, rdev)) 1966 goto nla_put_failure; 1967 1968 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) && 1969 (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) || 1970 nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ))) 1971 goto nla_put_failure; 1972 1973 if (rdev->wiphy.max_ap_assoc_sta && 1974 nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA, 1975 rdev->wiphy.max_ap_assoc_sta)) 1976 goto nla_put_failure; 1977 1978 state->split_start++; 1979 break; 1980 case 11: 1981 if (rdev->wiphy.n_vendor_commands) { 1982 const struct nl80211_vendor_cmd_info *info; 1983 struct nlattr *nested; 1984 1985 nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA); 1986 if (!nested) 1987 goto nla_put_failure; 1988 1989 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) { 1990 info = &rdev->wiphy.vendor_commands[i].info; 1991 if (nla_put(msg, i + 1, sizeof(*info), info)) 1992 goto nla_put_failure; 1993 } 1994 nla_nest_end(msg, nested); 1995 } 1996 1997 if (rdev->wiphy.n_vendor_events) { 1998 const struct nl80211_vendor_cmd_info *info; 1999 struct nlattr *nested; 2000 2001 nested = nla_nest_start(msg, 2002 NL80211_ATTR_VENDOR_EVENTS); 2003 if (!nested) 2004 goto nla_put_failure; 2005 2006 for (i = 0; i < rdev->wiphy.n_vendor_events; i++) { 2007 info = &rdev->wiphy.vendor_events[i]; 2008 if (nla_put(msg, i + 1, sizeof(*info), info)) 2009 goto nla_put_failure; 2010 } 2011 nla_nest_end(msg, nested); 2012 } 2013 state->split_start++; 2014 break; 2015 case 12: 2016 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH && 2017 nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS, 2018 rdev->wiphy.max_num_csa_counters)) 2019 goto nla_put_failure; 2020 2021 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED && 2022 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG)) 2023 goto nla_put_failure; 2024 2025 if (rdev->wiphy.max_sched_scan_reqs && 2026 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS, 2027 rdev->wiphy.max_sched_scan_reqs)) 2028 goto nla_put_failure; 2029 2030 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES, 2031 sizeof(rdev->wiphy.ext_features), 2032 rdev->wiphy.ext_features)) 2033 goto nla_put_failure; 2034 2035 if (rdev->wiphy.bss_select_support) { 2036 struct nlattr *nested; 2037 u32 bss_select_support = rdev->wiphy.bss_select_support; 2038 2039 nested = nla_nest_start(msg, NL80211_ATTR_BSS_SELECT); 2040 if (!nested) 2041 goto nla_put_failure; 2042 2043 i = 0; 2044 while (bss_select_support) { 2045 if ((bss_select_support & 1) && 2046 nla_put_flag(msg, i)) 2047 goto nla_put_failure; 2048 i++; 2049 bss_select_support >>= 1; 2050 } 2051 nla_nest_end(msg, nested); 2052 } 2053 2054 state->split_start++; 2055 break; 2056 case 13: 2057 if (rdev->wiphy.num_iftype_ext_capab && 2058 rdev->wiphy.iftype_ext_capab) { 2059 struct nlattr *nested_ext_capab, *nested; 2060 2061 nested = nla_nest_start(msg, 2062 NL80211_ATTR_IFTYPE_EXT_CAPA); 2063 if (!nested) 2064 goto nla_put_failure; 2065 2066 for (i = state->capa_start; 2067 i < rdev->wiphy.num_iftype_ext_capab; i++) { 2068 const struct wiphy_iftype_ext_capab *capab; 2069 2070 capab = &rdev->wiphy.iftype_ext_capab[i]; 2071 2072 nested_ext_capab = nla_nest_start(msg, i); 2073 if (!nested_ext_capab || 2074 nla_put_u32(msg, NL80211_ATTR_IFTYPE, 2075 capab->iftype) || 2076 nla_put(msg, NL80211_ATTR_EXT_CAPA, 2077 capab->extended_capabilities_len, 2078 capab->extended_capabilities) || 2079 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK, 2080 capab->extended_capabilities_len, 2081 capab->extended_capabilities_mask)) 2082 goto nla_put_failure; 2083 2084 nla_nest_end(msg, nested_ext_capab); 2085 if (state->split) 2086 break; 2087 } 2088 nla_nest_end(msg, nested); 2089 if (i < rdev->wiphy.num_iftype_ext_capab) { 2090 state->capa_start = i + 1; 2091 break; 2092 } 2093 } 2094 2095 if (nla_put_u32(msg, NL80211_ATTR_BANDS, 2096 rdev->wiphy.nan_supported_bands)) 2097 goto nla_put_failure; 2098 2099 if (wiphy_ext_feature_isset(&rdev->wiphy, 2100 NL80211_EXT_FEATURE_TXQS)) { 2101 struct cfg80211_txq_stats txqstats = {}; 2102 int res; 2103 2104 res = rdev_get_txq_stats(rdev, NULL, &txqstats); 2105 if (!res && 2106 !nl80211_put_txq_stats(msg, &txqstats, 2107 NL80211_ATTR_TXQ_STATS)) 2108 goto nla_put_failure; 2109 2110 if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT, 2111 rdev->wiphy.txq_limit)) 2112 goto nla_put_failure; 2113 if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT, 2114 rdev->wiphy.txq_memory_limit)) 2115 goto nla_put_failure; 2116 if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM, 2117 rdev->wiphy.txq_quantum)) 2118 goto nla_put_failure; 2119 } 2120 2121 /* done */ 2122 state->split_start = 0; 2123 break; 2124 } 2125 finish: 2126 genlmsg_end(msg, hdr); 2127 return 0; 2128 2129 nla_put_failure: 2130 genlmsg_cancel(msg, hdr); 2131 return -EMSGSIZE; 2132 } 2133 2134 static int nl80211_dump_wiphy_parse(struct sk_buff *skb, 2135 struct netlink_callback *cb, 2136 struct nl80211_dump_wiphy_state *state) 2137 { 2138 struct nlattr **tb = genl_family_attrbuf(&nl80211_fam); 2139 int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, tb, 2140 nl80211_fam.maxattr, nl80211_policy, NULL); 2141 /* ignore parse errors for backward compatibility */ 2142 if (ret) 2143 return 0; 2144 2145 state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP]; 2146 if (tb[NL80211_ATTR_WIPHY]) 2147 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]); 2148 if (tb[NL80211_ATTR_WDEV]) 2149 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32; 2150 if (tb[NL80211_ATTR_IFINDEX]) { 2151 struct net_device *netdev; 2152 struct cfg80211_registered_device *rdev; 2153 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]); 2154 2155 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx); 2156 if (!netdev) 2157 return -ENODEV; 2158 if (netdev->ieee80211_ptr) { 2159 rdev = wiphy_to_rdev( 2160 netdev->ieee80211_ptr->wiphy); 2161 state->filter_wiphy = rdev->wiphy_idx; 2162 } 2163 } 2164 2165 return 0; 2166 } 2167 2168 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb) 2169 { 2170 int idx = 0, ret; 2171 struct nl80211_dump_wiphy_state *state = (void *)cb->args[0]; 2172 struct cfg80211_registered_device *rdev; 2173 2174 rtnl_lock(); 2175 if (!state) { 2176 state = kzalloc(sizeof(*state), GFP_KERNEL); 2177 if (!state) { 2178 rtnl_unlock(); 2179 return -ENOMEM; 2180 } 2181 state->filter_wiphy = -1; 2182 ret = nl80211_dump_wiphy_parse(skb, cb, state); 2183 if (ret) { 2184 kfree(state); 2185 rtnl_unlock(); 2186 return ret; 2187 } 2188 cb->args[0] = (long)state; 2189 } 2190 2191 list_for_each_entry(rdev, &cfg80211_rdev_list, list) { 2192 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk))) 2193 continue; 2194 if (++idx <= state->start) 2195 continue; 2196 if (state->filter_wiphy != -1 && 2197 state->filter_wiphy != rdev->wiphy_idx) 2198 continue; 2199 /* attempt to fit multiple wiphy data chunks into the skb */ 2200 do { 2201 ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, 2202 skb, 2203 NETLINK_CB(cb->skb).portid, 2204 cb->nlh->nlmsg_seq, 2205 NLM_F_MULTI, state); 2206 if (ret < 0) { 2207 /* 2208 * If sending the wiphy data didn't fit (ENOBUFS 2209 * or EMSGSIZE returned), this SKB is still 2210 * empty (so it's not too big because another 2211 * wiphy dataset is already in the skb) and 2212 * we've not tried to adjust the dump allocation 2213 * yet ... then adjust the alloc size to be 2214 * bigger, and return 1 but with the empty skb. 2215 * This results in an empty message being RX'ed 2216 * in userspace, but that is ignored. 2217 * 2218 * We can then retry with the larger buffer. 2219 */ 2220 if ((ret == -ENOBUFS || ret == -EMSGSIZE) && 2221 !skb->len && !state->split && 2222 cb->min_dump_alloc < 4096) { 2223 cb->min_dump_alloc = 4096; 2224 state->split_start = 0; 2225 rtnl_unlock(); 2226 return 1; 2227 } 2228 idx--; 2229 break; 2230 } 2231 } while (state->split_start > 0); 2232 break; 2233 } 2234 rtnl_unlock(); 2235 2236 state->start = idx; 2237 2238 return skb->len; 2239 } 2240 2241 static int nl80211_dump_wiphy_done(struct netlink_callback *cb) 2242 { 2243 kfree((void *)cb->args[0]); 2244 return 0; 2245 } 2246 2247 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info) 2248 { 2249 struct sk_buff *msg; 2250 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 2251 struct nl80211_dump_wiphy_state state = {}; 2252 2253 msg = nlmsg_new(4096, GFP_KERNEL); 2254 if (!msg) 2255 return -ENOMEM; 2256 2257 if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg, 2258 info->snd_portid, info->snd_seq, 0, 2259 &state) < 0) { 2260 nlmsg_free(msg); 2261 return -ENOBUFS; 2262 } 2263 2264 return genlmsg_reply(msg, info); 2265 } 2266 2267 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = { 2268 [NL80211_TXQ_ATTR_QUEUE] = { .type = NLA_U8 }, 2269 [NL80211_TXQ_ATTR_TXOP] = { .type = NLA_U16 }, 2270 [NL80211_TXQ_ATTR_CWMIN] = { .type = NLA_U16 }, 2271 [NL80211_TXQ_ATTR_CWMAX] = { .type = NLA_U16 }, 2272 [NL80211_TXQ_ATTR_AIFS] = { .type = NLA_U8 }, 2273 }; 2274 2275 static int parse_txq_params(struct nlattr *tb[], 2276 struct ieee80211_txq_params *txq_params) 2277 { 2278 u8 ac; 2279 2280 if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] || 2281 !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] || 2282 !tb[NL80211_TXQ_ATTR_AIFS]) 2283 return -EINVAL; 2284 2285 ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]); 2286 txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]); 2287 txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]); 2288 txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]); 2289 txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]); 2290 2291 if (ac >= NL80211_NUM_ACS) 2292 return -EINVAL; 2293 txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS); 2294 return 0; 2295 } 2296 2297 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev) 2298 { 2299 /* 2300 * You can only set the channel explicitly for WDS interfaces, 2301 * all others have their channel managed via their respective 2302 * "establish a connection" command (connect, join, ...) 2303 * 2304 * For AP/GO and mesh mode, the channel can be set with the 2305 * channel userspace API, but is only stored and passed to the 2306 * low-level driver when the AP starts or the mesh is joined. 2307 * This is for backward compatibility, userspace can also give 2308 * the channel in the start-ap or join-mesh commands instead. 2309 * 2310 * Monitors are special as they are normally slaved to 2311 * whatever else is going on, so they have their own special 2312 * operation to set the monitor channel if possible. 2313 */ 2314 return !wdev || 2315 wdev->iftype == NL80211_IFTYPE_AP || 2316 wdev->iftype == NL80211_IFTYPE_MESH_POINT || 2317 wdev->iftype == NL80211_IFTYPE_MONITOR || 2318 wdev->iftype == NL80211_IFTYPE_P2P_GO; 2319 } 2320 2321 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev, 2322 struct genl_info *info, 2323 struct cfg80211_chan_def *chandef) 2324 { 2325 struct netlink_ext_ack *extack = info->extack; 2326 struct nlattr **attrs = info->attrs; 2327 u32 control_freq; 2328 2329 if (!attrs[NL80211_ATTR_WIPHY_FREQ]) 2330 return -EINVAL; 2331 2332 control_freq = nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ]); 2333 2334 chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq); 2335 chandef->width = NL80211_CHAN_WIDTH_20_NOHT; 2336 chandef->center_freq1 = control_freq; 2337 chandef->center_freq2 = 0; 2338 2339 /* Primary channel not allowed */ 2340 if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED) { 2341 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ], 2342 "Channel is disabled"); 2343 return -EINVAL; 2344 } 2345 2346 if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) { 2347 enum nl80211_channel_type chantype; 2348 2349 chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]); 2350 2351 switch (chantype) { 2352 case NL80211_CHAN_NO_HT: 2353 case NL80211_CHAN_HT20: 2354 case NL80211_CHAN_HT40PLUS: 2355 case NL80211_CHAN_HT40MINUS: 2356 cfg80211_chandef_create(chandef, chandef->chan, 2357 chantype); 2358 /* user input for center_freq is incorrect */ 2359 if (attrs[NL80211_ATTR_CENTER_FREQ1] && 2360 chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) { 2361 NL_SET_ERR_MSG_ATTR(extack, 2362 attrs[NL80211_ATTR_CENTER_FREQ1], 2363 "bad center frequency 1"); 2364 return -EINVAL; 2365 } 2366 /* center_freq2 must be zero */ 2367 if (attrs[NL80211_ATTR_CENTER_FREQ2] && 2368 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) { 2369 NL_SET_ERR_MSG_ATTR(extack, 2370 attrs[NL80211_ATTR_CENTER_FREQ2], 2371 "center frequency 2 can't be used"); 2372 return -EINVAL; 2373 } 2374 break; 2375 default: 2376 NL_SET_ERR_MSG_ATTR(extack, 2377 attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE], 2378 "invalid channel type"); 2379 return -EINVAL; 2380 } 2381 } else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) { 2382 chandef->width = 2383 nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]); 2384 if (attrs[NL80211_ATTR_CENTER_FREQ1]) 2385 chandef->center_freq1 = 2386 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]); 2387 if (attrs[NL80211_ATTR_CENTER_FREQ2]) 2388 chandef->center_freq2 = 2389 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]); 2390 } 2391 2392 if (!cfg80211_chandef_valid(chandef)) { 2393 NL_SET_ERR_MSG(extack, "invalid channel definition"); 2394 return -EINVAL; 2395 } 2396 2397 if (!cfg80211_chandef_usable(&rdev->wiphy, chandef, 2398 IEEE80211_CHAN_DISABLED)) { 2399 NL_SET_ERR_MSG(extack, "(extension) channel is disabled"); 2400 return -EINVAL; 2401 } 2402 2403 if ((chandef->width == NL80211_CHAN_WIDTH_5 || 2404 chandef->width == NL80211_CHAN_WIDTH_10) && 2405 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) { 2406 NL_SET_ERR_MSG(extack, "5/10 MHz not supported"); 2407 return -EINVAL; 2408 } 2409 2410 return 0; 2411 } 2412 2413 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev, 2414 struct net_device *dev, 2415 struct genl_info *info) 2416 { 2417 struct cfg80211_chan_def chandef; 2418 int result; 2419 enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR; 2420 struct wireless_dev *wdev = NULL; 2421 2422 if (dev) 2423 wdev = dev->ieee80211_ptr; 2424 if (!nl80211_can_set_dev_channel(wdev)) 2425 return -EOPNOTSUPP; 2426 if (wdev) 2427 iftype = wdev->iftype; 2428 2429 result = nl80211_parse_chandef(rdev, info, &chandef); 2430 if (result) 2431 return result; 2432 2433 switch (iftype) { 2434 case NL80211_IFTYPE_AP: 2435 case NL80211_IFTYPE_P2P_GO: 2436 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef, 2437 iftype)) { 2438 result = -EINVAL; 2439 break; 2440 } 2441 if (wdev->beacon_interval) { 2442 if (!dev || !rdev->ops->set_ap_chanwidth || 2443 !(rdev->wiphy.features & 2444 NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) { 2445 result = -EBUSY; 2446 break; 2447 } 2448 2449 /* Only allow dynamic channel width changes */ 2450 if (chandef.chan != wdev->preset_chandef.chan) { 2451 result = -EBUSY; 2452 break; 2453 } 2454 result = rdev_set_ap_chanwidth(rdev, dev, &chandef); 2455 if (result) 2456 break; 2457 } 2458 wdev->preset_chandef = chandef; 2459 result = 0; 2460 break; 2461 case NL80211_IFTYPE_MESH_POINT: 2462 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef); 2463 break; 2464 case NL80211_IFTYPE_MONITOR: 2465 result = cfg80211_set_monitor_channel(rdev, &chandef); 2466 break; 2467 default: 2468 result = -EINVAL; 2469 } 2470 2471 return result; 2472 } 2473 2474 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info) 2475 { 2476 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 2477 struct net_device *netdev = info->user_ptr[1]; 2478 2479 return __nl80211_set_channel(rdev, netdev, info); 2480 } 2481 2482 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info) 2483 { 2484 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 2485 struct net_device *dev = info->user_ptr[1]; 2486 struct wireless_dev *wdev = dev->ieee80211_ptr; 2487 const u8 *bssid; 2488 2489 if (!info->attrs[NL80211_ATTR_MAC]) 2490 return -EINVAL; 2491 2492 if (netif_running(dev)) 2493 return -EBUSY; 2494 2495 if (!rdev->ops->set_wds_peer) 2496 return -EOPNOTSUPP; 2497 2498 if (wdev->iftype != NL80211_IFTYPE_WDS) 2499 return -EOPNOTSUPP; 2500 2501 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 2502 return rdev_set_wds_peer(rdev, dev, bssid); 2503 } 2504 2505 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info) 2506 { 2507 struct cfg80211_registered_device *rdev; 2508 struct net_device *netdev = NULL; 2509 struct wireless_dev *wdev; 2510 int result = 0, rem_txq_params = 0; 2511 struct nlattr *nl_txq_params; 2512 u32 changed; 2513 u8 retry_short = 0, retry_long = 0; 2514 u32 frag_threshold = 0, rts_threshold = 0; 2515 u8 coverage_class = 0; 2516 u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0; 2517 2518 ASSERT_RTNL(); 2519 2520 /* 2521 * Try to find the wiphy and netdev. Normally this 2522 * function shouldn't need the netdev, but this is 2523 * done for backward compatibility -- previously 2524 * setting the channel was done per wiphy, but now 2525 * it is per netdev. Previous userland like hostapd 2526 * also passed a netdev to set_wiphy, so that it is 2527 * possible to let that go to the right netdev! 2528 */ 2529 2530 if (info->attrs[NL80211_ATTR_IFINDEX]) { 2531 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]); 2532 2533 netdev = __dev_get_by_index(genl_info_net(info), ifindex); 2534 if (netdev && netdev->ieee80211_ptr) 2535 rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy); 2536 else 2537 netdev = NULL; 2538 } 2539 2540 if (!netdev) { 2541 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info), 2542 info->attrs); 2543 if (IS_ERR(rdev)) 2544 return PTR_ERR(rdev); 2545 wdev = NULL; 2546 netdev = NULL; 2547 result = 0; 2548 } else 2549 wdev = netdev->ieee80211_ptr; 2550 2551 /* 2552 * end workaround code, by now the rdev is available 2553 * and locked, and wdev may or may not be NULL. 2554 */ 2555 2556 if (info->attrs[NL80211_ATTR_WIPHY_NAME]) 2557 result = cfg80211_dev_rename( 2558 rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME])); 2559 2560 if (result) 2561 return result; 2562 2563 if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) { 2564 struct ieee80211_txq_params txq_params; 2565 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1]; 2566 2567 if (!rdev->ops->set_txq_params) 2568 return -EOPNOTSUPP; 2569 2570 if (!netdev) 2571 return -EINVAL; 2572 2573 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 2574 netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 2575 return -EINVAL; 2576 2577 if (!netif_running(netdev)) 2578 return -ENETDOWN; 2579 2580 nla_for_each_nested(nl_txq_params, 2581 info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS], 2582 rem_txq_params) { 2583 result = nla_parse_nested(tb, NL80211_TXQ_ATTR_MAX, 2584 nl_txq_params, 2585 txq_params_policy, 2586 info->extack); 2587 if (result) 2588 return result; 2589 result = parse_txq_params(tb, &txq_params); 2590 if (result) 2591 return result; 2592 2593 result = rdev_set_txq_params(rdev, netdev, 2594 &txq_params); 2595 if (result) 2596 return result; 2597 } 2598 } 2599 2600 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 2601 result = __nl80211_set_channel( 2602 rdev, 2603 nl80211_can_set_dev_channel(wdev) ? netdev : NULL, 2604 info); 2605 if (result) 2606 return result; 2607 } 2608 2609 if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) { 2610 struct wireless_dev *txp_wdev = wdev; 2611 enum nl80211_tx_power_setting type; 2612 int idx, mbm = 0; 2613 2614 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER)) 2615 txp_wdev = NULL; 2616 2617 if (!rdev->ops->set_tx_power) 2618 return -EOPNOTSUPP; 2619 2620 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING; 2621 type = nla_get_u32(info->attrs[idx]); 2622 2623 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] && 2624 (type != NL80211_TX_POWER_AUTOMATIC)) 2625 return -EINVAL; 2626 2627 if (type != NL80211_TX_POWER_AUTOMATIC) { 2628 idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL; 2629 mbm = nla_get_u32(info->attrs[idx]); 2630 } 2631 2632 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm); 2633 if (result) 2634 return result; 2635 } 2636 2637 if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] && 2638 info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) { 2639 u32 tx_ant, rx_ant; 2640 2641 if ((!rdev->wiphy.available_antennas_tx && 2642 !rdev->wiphy.available_antennas_rx) || 2643 !rdev->ops->set_antenna) 2644 return -EOPNOTSUPP; 2645 2646 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]); 2647 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]); 2648 2649 /* reject antenna configurations which don't match the 2650 * available antenna masks, except for the "all" mask */ 2651 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) || 2652 (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) 2653 return -EINVAL; 2654 2655 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx; 2656 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx; 2657 2658 result = rdev_set_antenna(rdev, tx_ant, rx_ant); 2659 if (result) 2660 return result; 2661 } 2662 2663 changed = 0; 2664 2665 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) { 2666 retry_short = nla_get_u8( 2667 info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]); 2668 2669 changed |= WIPHY_PARAM_RETRY_SHORT; 2670 } 2671 2672 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) { 2673 retry_long = nla_get_u8( 2674 info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]); 2675 2676 changed |= WIPHY_PARAM_RETRY_LONG; 2677 } 2678 2679 if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) { 2680 frag_threshold = nla_get_u32( 2681 info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]); 2682 if (frag_threshold < 256) 2683 return -EINVAL; 2684 2685 if (frag_threshold != (u32) -1) { 2686 /* 2687 * Fragments (apart from the last one) are required to 2688 * have even length. Make the fragmentation code 2689 * simpler by stripping LSB should someone try to use 2690 * odd threshold value. 2691 */ 2692 frag_threshold &= ~0x1; 2693 } 2694 changed |= WIPHY_PARAM_FRAG_THRESHOLD; 2695 } 2696 2697 if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) { 2698 rts_threshold = nla_get_u32( 2699 info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]); 2700 changed |= WIPHY_PARAM_RTS_THRESHOLD; 2701 } 2702 2703 if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) { 2704 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) 2705 return -EINVAL; 2706 2707 coverage_class = nla_get_u8( 2708 info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]); 2709 changed |= WIPHY_PARAM_COVERAGE_CLASS; 2710 } 2711 2712 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) { 2713 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION)) 2714 return -EOPNOTSUPP; 2715 2716 changed |= WIPHY_PARAM_DYN_ACK; 2717 } 2718 2719 if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) { 2720 if (!wiphy_ext_feature_isset(&rdev->wiphy, 2721 NL80211_EXT_FEATURE_TXQS)) 2722 return -EOPNOTSUPP; 2723 txq_limit = nla_get_u32( 2724 info->attrs[NL80211_ATTR_TXQ_LIMIT]); 2725 changed |= WIPHY_PARAM_TXQ_LIMIT; 2726 } 2727 2728 if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) { 2729 if (!wiphy_ext_feature_isset(&rdev->wiphy, 2730 NL80211_EXT_FEATURE_TXQS)) 2731 return -EOPNOTSUPP; 2732 txq_memory_limit = nla_get_u32( 2733 info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]); 2734 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT; 2735 } 2736 2737 if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) { 2738 if (!wiphy_ext_feature_isset(&rdev->wiphy, 2739 NL80211_EXT_FEATURE_TXQS)) 2740 return -EOPNOTSUPP; 2741 txq_quantum = nla_get_u32( 2742 info->attrs[NL80211_ATTR_TXQ_QUANTUM]); 2743 changed |= WIPHY_PARAM_TXQ_QUANTUM; 2744 } 2745 2746 if (changed) { 2747 u8 old_retry_short, old_retry_long; 2748 u32 old_frag_threshold, old_rts_threshold; 2749 u8 old_coverage_class; 2750 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum; 2751 2752 if (!rdev->ops->set_wiphy_params) 2753 return -EOPNOTSUPP; 2754 2755 old_retry_short = rdev->wiphy.retry_short; 2756 old_retry_long = rdev->wiphy.retry_long; 2757 old_frag_threshold = rdev->wiphy.frag_threshold; 2758 old_rts_threshold = rdev->wiphy.rts_threshold; 2759 old_coverage_class = rdev->wiphy.coverage_class; 2760 old_txq_limit = rdev->wiphy.txq_limit; 2761 old_txq_memory_limit = rdev->wiphy.txq_memory_limit; 2762 old_txq_quantum = rdev->wiphy.txq_quantum; 2763 2764 if (changed & WIPHY_PARAM_RETRY_SHORT) 2765 rdev->wiphy.retry_short = retry_short; 2766 if (changed & WIPHY_PARAM_RETRY_LONG) 2767 rdev->wiphy.retry_long = retry_long; 2768 if (changed & WIPHY_PARAM_FRAG_THRESHOLD) 2769 rdev->wiphy.frag_threshold = frag_threshold; 2770 if (changed & WIPHY_PARAM_RTS_THRESHOLD) 2771 rdev->wiphy.rts_threshold = rts_threshold; 2772 if (changed & WIPHY_PARAM_COVERAGE_CLASS) 2773 rdev->wiphy.coverage_class = coverage_class; 2774 if (changed & WIPHY_PARAM_TXQ_LIMIT) 2775 rdev->wiphy.txq_limit = txq_limit; 2776 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT) 2777 rdev->wiphy.txq_memory_limit = txq_memory_limit; 2778 if (changed & WIPHY_PARAM_TXQ_QUANTUM) 2779 rdev->wiphy.txq_quantum = txq_quantum; 2780 2781 result = rdev_set_wiphy_params(rdev, changed); 2782 if (result) { 2783 rdev->wiphy.retry_short = old_retry_short; 2784 rdev->wiphy.retry_long = old_retry_long; 2785 rdev->wiphy.frag_threshold = old_frag_threshold; 2786 rdev->wiphy.rts_threshold = old_rts_threshold; 2787 rdev->wiphy.coverage_class = old_coverage_class; 2788 rdev->wiphy.txq_limit = old_txq_limit; 2789 rdev->wiphy.txq_memory_limit = old_txq_memory_limit; 2790 rdev->wiphy.txq_quantum = old_txq_quantum; 2791 return result; 2792 } 2793 } 2794 return 0; 2795 } 2796 2797 static inline u64 wdev_id(struct wireless_dev *wdev) 2798 { 2799 return (u64)wdev->identifier | 2800 ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32); 2801 } 2802 2803 static int nl80211_send_chandef(struct sk_buff *msg, 2804 const struct cfg80211_chan_def *chandef) 2805 { 2806 if (WARN_ON(!cfg80211_chandef_valid(chandef))) 2807 return -EINVAL; 2808 2809 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, 2810 chandef->chan->center_freq)) 2811 return -ENOBUFS; 2812 switch (chandef->width) { 2813 case NL80211_CHAN_WIDTH_20_NOHT: 2814 case NL80211_CHAN_WIDTH_20: 2815 case NL80211_CHAN_WIDTH_40: 2816 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, 2817 cfg80211_get_chandef_type(chandef))) 2818 return -ENOBUFS; 2819 break; 2820 default: 2821 break; 2822 } 2823 if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width)) 2824 return -ENOBUFS; 2825 if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1)) 2826 return -ENOBUFS; 2827 if (chandef->center_freq2 && 2828 nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2)) 2829 return -ENOBUFS; 2830 return 0; 2831 } 2832 2833 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags, 2834 struct cfg80211_registered_device *rdev, 2835 struct wireless_dev *wdev, bool removal) 2836 { 2837 struct net_device *dev = wdev->netdev; 2838 u8 cmd = NL80211_CMD_NEW_INTERFACE; 2839 void *hdr; 2840 2841 if (removal) 2842 cmd = NL80211_CMD_DEL_INTERFACE; 2843 2844 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 2845 if (!hdr) 2846 return -1; 2847 2848 if (dev && 2849 (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 2850 nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name))) 2851 goto nla_put_failure; 2852 2853 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 2854 nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) || 2855 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 2856 NL80211_ATTR_PAD) || 2857 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) || 2858 nla_put_u32(msg, NL80211_ATTR_GENERATION, 2859 rdev->devlist_generation ^ 2860 (cfg80211_rdev_list_generation << 2)) || 2861 nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr)) 2862 goto nla_put_failure; 2863 2864 if (rdev->ops->get_channel) { 2865 int ret; 2866 struct cfg80211_chan_def chandef; 2867 2868 ret = rdev_get_channel(rdev, wdev, &chandef); 2869 if (ret == 0) { 2870 if (nl80211_send_chandef(msg, &chandef)) 2871 goto nla_put_failure; 2872 } 2873 } 2874 2875 if (rdev->ops->get_tx_power) { 2876 int dbm, ret; 2877 2878 ret = rdev_get_tx_power(rdev, wdev, &dbm); 2879 if (ret == 0 && 2880 nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL, 2881 DBM_TO_MBM(dbm))) 2882 goto nla_put_failure; 2883 } 2884 2885 wdev_lock(wdev); 2886 switch (wdev->iftype) { 2887 case NL80211_IFTYPE_AP: 2888 if (wdev->ssid_len && 2889 nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid)) 2890 goto nla_put_failure_locked; 2891 break; 2892 case NL80211_IFTYPE_STATION: 2893 case NL80211_IFTYPE_P2P_CLIENT: 2894 case NL80211_IFTYPE_ADHOC: { 2895 const u8 *ssid_ie; 2896 if (!wdev->current_bss) 2897 break; 2898 rcu_read_lock(); 2899 ssid_ie = ieee80211_bss_get_ie(&wdev->current_bss->pub, 2900 WLAN_EID_SSID); 2901 if (ssid_ie && 2902 nla_put(msg, NL80211_ATTR_SSID, ssid_ie[1], ssid_ie + 2)) 2903 goto nla_put_failure_rcu_locked; 2904 rcu_read_unlock(); 2905 break; 2906 } 2907 default: 2908 /* nothing */ 2909 break; 2910 } 2911 wdev_unlock(wdev); 2912 2913 if (rdev->ops->get_txq_stats) { 2914 struct cfg80211_txq_stats txqstats = {}; 2915 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats); 2916 2917 if (ret == 0 && 2918 !nl80211_put_txq_stats(msg, &txqstats, 2919 NL80211_ATTR_TXQ_STATS)) 2920 goto nla_put_failure; 2921 } 2922 2923 genlmsg_end(msg, hdr); 2924 return 0; 2925 2926 nla_put_failure_rcu_locked: 2927 rcu_read_unlock(); 2928 nla_put_failure_locked: 2929 wdev_unlock(wdev); 2930 nla_put_failure: 2931 genlmsg_cancel(msg, hdr); 2932 return -EMSGSIZE; 2933 } 2934 2935 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb) 2936 { 2937 int wp_idx = 0; 2938 int if_idx = 0; 2939 int wp_start = cb->args[0]; 2940 int if_start = cb->args[1]; 2941 int filter_wiphy = -1; 2942 struct cfg80211_registered_device *rdev; 2943 struct wireless_dev *wdev; 2944 int ret; 2945 2946 rtnl_lock(); 2947 if (!cb->args[2]) { 2948 struct nl80211_dump_wiphy_state state = { 2949 .filter_wiphy = -1, 2950 }; 2951 2952 ret = nl80211_dump_wiphy_parse(skb, cb, &state); 2953 if (ret) 2954 goto out_unlock; 2955 2956 filter_wiphy = state.filter_wiphy; 2957 2958 /* 2959 * if filtering, set cb->args[2] to +1 since 0 is the default 2960 * value needed to determine that parsing is necessary. 2961 */ 2962 if (filter_wiphy >= 0) 2963 cb->args[2] = filter_wiphy + 1; 2964 else 2965 cb->args[2] = -1; 2966 } else if (cb->args[2] > 0) { 2967 filter_wiphy = cb->args[2] - 1; 2968 } 2969 2970 list_for_each_entry(rdev, &cfg80211_rdev_list, list) { 2971 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk))) 2972 continue; 2973 if (wp_idx < wp_start) { 2974 wp_idx++; 2975 continue; 2976 } 2977 2978 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx) 2979 continue; 2980 2981 if_idx = 0; 2982 2983 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { 2984 if (if_idx < if_start) { 2985 if_idx++; 2986 continue; 2987 } 2988 if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid, 2989 cb->nlh->nlmsg_seq, NLM_F_MULTI, 2990 rdev, wdev, false) < 0) { 2991 goto out; 2992 } 2993 if_idx++; 2994 } 2995 2996 wp_idx++; 2997 } 2998 out: 2999 cb->args[0] = wp_idx; 3000 cb->args[1] = if_idx; 3001 3002 ret = skb->len; 3003 out_unlock: 3004 rtnl_unlock(); 3005 3006 return ret; 3007 } 3008 3009 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info) 3010 { 3011 struct sk_buff *msg; 3012 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3013 struct wireless_dev *wdev = info->user_ptr[1]; 3014 3015 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 3016 if (!msg) 3017 return -ENOMEM; 3018 3019 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0, 3020 rdev, wdev, false) < 0) { 3021 nlmsg_free(msg); 3022 return -ENOBUFS; 3023 } 3024 3025 return genlmsg_reply(msg, info); 3026 } 3027 3028 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = { 3029 [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG }, 3030 [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG }, 3031 [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG }, 3032 [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG }, 3033 [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG }, 3034 [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG }, 3035 }; 3036 3037 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags) 3038 { 3039 struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1]; 3040 int flag; 3041 3042 *mntrflags = 0; 3043 3044 if (!nla) 3045 return -EINVAL; 3046 3047 if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX, nla, 3048 mntr_flags_policy, NULL)) 3049 return -EINVAL; 3050 3051 for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++) 3052 if (flags[flag]) 3053 *mntrflags |= (1<<flag); 3054 3055 *mntrflags |= MONITOR_FLAG_CHANGED; 3056 3057 return 0; 3058 } 3059 3060 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev, 3061 enum nl80211_iftype type, 3062 struct genl_info *info, 3063 struct vif_params *params) 3064 { 3065 bool change = false; 3066 int err; 3067 3068 if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) { 3069 if (type != NL80211_IFTYPE_MONITOR) 3070 return -EINVAL; 3071 3072 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS], 3073 ¶ms->flags); 3074 if (err) 3075 return err; 3076 3077 change = true; 3078 } 3079 3080 if (params->flags & MONITOR_FLAG_ACTIVE && 3081 !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR)) 3082 return -EOPNOTSUPP; 3083 3084 if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) { 3085 const u8 *mumimo_groups; 3086 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER; 3087 3088 if (type != NL80211_IFTYPE_MONITOR) 3089 return -EINVAL; 3090 3091 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag)) 3092 return -EOPNOTSUPP; 3093 3094 mumimo_groups = 3095 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]); 3096 3097 /* bits 0 and 63 are reserved and must be zero */ 3098 if ((mumimo_groups[0] & BIT(0)) || 3099 (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7))) 3100 return -EINVAL; 3101 3102 params->vht_mumimo_groups = mumimo_groups; 3103 change = true; 3104 } 3105 3106 if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) { 3107 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER; 3108 3109 if (type != NL80211_IFTYPE_MONITOR) 3110 return -EINVAL; 3111 3112 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag)) 3113 return -EOPNOTSUPP; 3114 3115 params->vht_mumimo_follow_addr = 3116 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]); 3117 change = true; 3118 } 3119 3120 return change ? 1 : 0; 3121 } 3122 3123 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev, 3124 struct net_device *netdev, u8 use_4addr, 3125 enum nl80211_iftype iftype) 3126 { 3127 if (!use_4addr) { 3128 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT)) 3129 return -EBUSY; 3130 return 0; 3131 } 3132 3133 switch (iftype) { 3134 case NL80211_IFTYPE_AP_VLAN: 3135 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP) 3136 return 0; 3137 break; 3138 case NL80211_IFTYPE_STATION: 3139 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION) 3140 return 0; 3141 break; 3142 default: 3143 break; 3144 } 3145 3146 return -EOPNOTSUPP; 3147 } 3148 3149 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info) 3150 { 3151 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3152 struct vif_params params; 3153 int err; 3154 enum nl80211_iftype otype, ntype; 3155 struct net_device *dev = info->user_ptr[1]; 3156 bool change = false; 3157 3158 memset(¶ms, 0, sizeof(params)); 3159 3160 otype = ntype = dev->ieee80211_ptr->iftype; 3161 3162 if (info->attrs[NL80211_ATTR_IFTYPE]) { 3163 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]); 3164 if (otype != ntype) 3165 change = true; 3166 } 3167 3168 if (info->attrs[NL80211_ATTR_MESH_ID]) { 3169 struct wireless_dev *wdev = dev->ieee80211_ptr; 3170 3171 if (ntype != NL80211_IFTYPE_MESH_POINT) 3172 return -EINVAL; 3173 if (netif_running(dev)) 3174 return -EBUSY; 3175 3176 wdev_lock(wdev); 3177 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN != 3178 IEEE80211_MAX_MESH_ID_LEN); 3179 wdev->mesh_id_up_len = 3180 nla_len(info->attrs[NL80211_ATTR_MESH_ID]); 3181 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]), 3182 wdev->mesh_id_up_len); 3183 wdev_unlock(wdev); 3184 } 3185 3186 if (info->attrs[NL80211_ATTR_4ADDR]) { 3187 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]); 3188 change = true; 3189 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype); 3190 if (err) 3191 return err; 3192 } else { 3193 params.use_4addr = -1; 3194 } 3195 3196 err = nl80211_parse_mon_options(rdev, ntype, info, ¶ms); 3197 if (err < 0) 3198 return err; 3199 if (err > 0) 3200 change = true; 3201 3202 if (change) 3203 err = cfg80211_change_iface(rdev, dev, ntype, ¶ms); 3204 else 3205 err = 0; 3206 3207 if (!err && params.use_4addr != -1) 3208 dev->ieee80211_ptr->use_4addr = params.use_4addr; 3209 3210 return err; 3211 } 3212 3213 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info) 3214 { 3215 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3216 struct vif_params params; 3217 struct wireless_dev *wdev; 3218 struct sk_buff *msg; 3219 int err; 3220 enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED; 3221 3222 /* to avoid failing a new interface creation due to pending removal */ 3223 cfg80211_destroy_ifaces(rdev); 3224 3225 memset(¶ms, 0, sizeof(params)); 3226 3227 if (!info->attrs[NL80211_ATTR_IFNAME]) 3228 return -EINVAL; 3229 3230 if (info->attrs[NL80211_ATTR_IFTYPE]) 3231 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]); 3232 3233 if (!rdev->ops->add_virtual_intf || 3234 !(rdev->wiphy.interface_modes & (1 << type))) 3235 return -EOPNOTSUPP; 3236 3237 if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN || 3238 rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) && 3239 info->attrs[NL80211_ATTR_MAC]) { 3240 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC], 3241 ETH_ALEN); 3242 if (!is_valid_ether_addr(params.macaddr)) 3243 return -EADDRNOTAVAIL; 3244 } 3245 3246 if (info->attrs[NL80211_ATTR_4ADDR]) { 3247 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]); 3248 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type); 3249 if (err) 3250 return err; 3251 } 3252 3253 err = nl80211_parse_mon_options(rdev, type, info, ¶ms); 3254 if (err < 0) 3255 return err; 3256 3257 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 3258 if (!msg) 3259 return -ENOMEM; 3260 3261 wdev = rdev_add_virtual_intf(rdev, 3262 nla_data(info->attrs[NL80211_ATTR_IFNAME]), 3263 NET_NAME_USER, type, ¶ms); 3264 if (WARN_ON(!wdev)) { 3265 nlmsg_free(msg); 3266 return -EPROTO; 3267 } else if (IS_ERR(wdev)) { 3268 nlmsg_free(msg); 3269 return PTR_ERR(wdev); 3270 } 3271 3272 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 3273 wdev->owner_nlportid = info->snd_portid; 3274 3275 switch (type) { 3276 case NL80211_IFTYPE_MESH_POINT: 3277 if (!info->attrs[NL80211_ATTR_MESH_ID]) 3278 break; 3279 wdev_lock(wdev); 3280 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN != 3281 IEEE80211_MAX_MESH_ID_LEN); 3282 wdev->mesh_id_up_len = 3283 nla_len(info->attrs[NL80211_ATTR_MESH_ID]); 3284 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]), 3285 wdev->mesh_id_up_len); 3286 wdev_unlock(wdev); 3287 break; 3288 case NL80211_IFTYPE_NAN: 3289 case NL80211_IFTYPE_P2P_DEVICE: 3290 /* 3291 * P2P Device and NAN do not have a netdev, so don't go 3292 * through the netdev notifier and must be added here 3293 */ 3294 cfg80211_init_wdev(rdev, wdev); 3295 break; 3296 default: 3297 break; 3298 } 3299 3300 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0, 3301 rdev, wdev, false) < 0) { 3302 nlmsg_free(msg); 3303 return -ENOBUFS; 3304 } 3305 3306 return genlmsg_reply(msg, info); 3307 } 3308 3309 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info) 3310 { 3311 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3312 struct wireless_dev *wdev = info->user_ptr[1]; 3313 3314 if (!rdev->ops->del_virtual_intf) 3315 return -EOPNOTSUPP; 3316 3317 /* 3318 * If we remove a wireless device without a netdev then clear 3319 * user_ptr[1] so that nl80211_post_doit won't dereference it 3320 * to check if it needs to do dev_put(). Otherwise it crashes 3321 * since the wdev has been freed, unlike with a netdev where 3322 * we need the dev_put() for the netdev to really be freed. 3323 */ 3324 if (!wdev->netdev) 3325 info->user_ptr[1] = NULL; 3326 3327 return rdev_del_virtual_intf(rdev, wdev); 3328 } 3329 3330 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info) 3331 { 3332 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3333 struct net_device *dev = info->user_ptr[1]; 3334 u16 noack_map; 3335 3336 if (!info->attrs[NL80211_ATTR_NOACK_MAP]) 3337 return -EINVAL; 3338 3339 if (!rdev->ops->set_noack_map) 3340 return -EOPNOTSUPP; 3341 3342 noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]); 3343 3344 return rdev_set_noack_map(rdev, dev, noack_map); 3345 } 3346 3347 struct get_key_cookie { 3348 struct sk_buff *msg; 3349 int error; 3350 int idx; 3351 }; 3352 3353 static void get_key_callback(void *c, struct key_params *params) 3354 { 3355 struct nlattr *key; 3356 struct get_key_cookie *cookie = c; 3357 3358 if ((params->key && 3359 nla_put(cookie->msg, NL80211_ATTR_KEY_DATA, 3360 params->key_len, params->key)) || 3361 (params->seq && 3362 nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ, 3363 params->seq_len, params->seq)) || 3364 (params->cipher && 3365 nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER, 3366 params->cipher))) 3367 goto nla_put_failure; 3368 3369 key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY); 3370 if (!key) 3371 goto nla_put_failure; 3372 3373 if ((params->key && 3374 nla_put(cookie->msg, NL80211_KEY_DATA, 3375 params->key_len, params->key)) || 3376 (params->seq && 3377 nla_put(cookie->msg, NL80211_KEY_SEQ, 3378 params->seq_len, params->seq)) || 3379 (params->cipher && 3380 nla_put_u32(cookie->msg, NL80211_KEY_CIPHER, 3381 params->cipher))) 3382 goto nla_put_failure; 3383 3384 if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx)) 3385 goto nla_put_failure; 3386 3387 nla_nest_end(cookie->msg, key); 3388 3389 return; 3390 nla_put_failure: 3391 cookie->error = 1; 3392 } 3393 3394 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info) 3395 { 3396 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3397 int err; 3398 struct net_device *dev = info->user_ptr[1]; 3399 u8 key_idx = 0; 3400 const u8 *mac_addr = NULL; 3401 bool pairwise; 3402 struct get_key_cookie cookie = { 3403 .error = 0, 3404 }; 3405 void *hdr; 3406 struct sk_buff *msg; 3407 3408 if (info->attrs[NL80211_ATTR_KEY_IDX]) 3409 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]); 3410 3411 if (info->attrs[NL80211_ATTR_MAC]) 3412 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 3413 3414 pairwise = !!mac_addr; 3415 if (info->attrs[NL80211_ATTR_KEY_TYPE]) { 3416 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]); 3417 3418 if (kt != NL80211_KEYTYPE_GROUP && 3419 kt != NL80211_KEYTYPE_PAIRWISE) 3420 return -EINVAL; 3421 pairwise = kt == NL80211_KEYTYPE_PAIRWISE; 3422 } 3423 3424 if (!rdev->ops->get_key) 3425 return -EOPNOTSUPP; 3426 3427 if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)) 3428 return -ENOENT; 3429 3430 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 3431 if (!msg) 3432 return -ENOMEM; 3433 3434 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 3435 NL80211_CMD_NEW_KEY); 3436 if (!hdr) 3437 goto nla_put_failure; 3438 3439 cookie.msg = msg; 3440 cookie.idx = key_idx; 3441 3442 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 3443 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx)) 3444 goto nla_put_failure; 3445 if (mac_addr && 3446 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr)) 3447 goto nla_put_failure; 3448 3449 err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie, 3450 get_key_callback); 3451 3452 if (err) 3453 goto free_msg; 3454 3455 if (cookie.error) 3456 goto nla_put_failure; 3457 3458 genlmsg_end(msg, hdr); 3459 return genlmsg_reply(msg, info); 3460 3461 nla_put_failure: 3462 err = -ENOBUFS; 3463 free_msg: 3464 nlmsg_free(msg); 3465 return err; 3466 } 3467 3468 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info) 3469 { 3470 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3471 struct key_parse key; 3472 int err; 3473 struct net_device *dev = info->user_ptr[1]; 3474 3475 err = nl80211_parse_key(info, &key); 3476 if (err) 3477 return err; 3478 3479 if (key.idx < 0) 3480 return -EINVAL; 3481 3482 /* only support setting default key */ 3483 if (!key.def && !key.defmgmt) 3484 return -EINVAL; 3485 3486 wdev_lock(dev->ieee80211_ptr); 3487 3488 if (key.def) { 3489 if (!rdev->ops->set_default_key) { 3490 err = -EOPNOTSUPP; 3491 goto out; 3492 } 3493 3494 err = nl80211_key_allowed(dev->ieee80211_ptr); 3495 if (err) 3496 goto out; 3497 3498 err = rdev_set_default_key(rdev, dev, key.idx, 3499 key.def_uni, key.def_multi); 3500 3501 if (err) 3502 goto out; 3503 3504 #ifdef CONFIG_CFG80211_WEXT 3505 dev->ieee80211_ptr->wext.default_key = key.idx; 3506 #endif 3507 } else { 3508 if (key.def_uni || !key.def_multi) { 3509 err = -EINVAL; 3510 goto out; 3511 } 3512 3513 if (!rdev->ops->set_default_mgmt_key) { 3514 err = -EOPNOTSUPP; 3515 goto out; 3516 } 3517 3518 err = nl80211_key_allowed(dev->ieee80211_ptr); 3519 if (err) 3520 goto out; 3521 3522 err = rdev_set_default_mgmt_key(rdev, dev, key.idx); 3523 if (err) 3524 goto out; 3525 3526 #ifdef CONFIG_CFG80211_WEXT 3527 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx; 3528 #endif 3529 } 3530 3531 out: 3532 wdev_unlock(dev->ieee80211_ptr); 3533 3534 return err; 3535 } 3536 3537 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info) 3538 { 3539 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3540 int err; 3541 struct net_device *dev = info->user_ptr[1]; 3542 struct key_parse key; 3543 const u8 *mac_addr = NULL; 3544 3545 err = nl80211_parse_key(info, &key); 3546 if (err) 3547 return err; 3548 3549 if (!key.p.key) 3550 return -EINVAL; 3551 3552 if (info->attrs[NL80211_ATTR_MAC]) 3553 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 3554 3555 if (key.type == -1) { 3556 if (mac_addr) 3557 key.type = NL80211_KEYTYPE_PAIRWISE; 3558 else 3559 key.type = NL80211_KEYTYPE_GROUP; 3560 } 3561 3562 /* for now */ 3563 if (key.type != NL80211_KEYTYPE_PAIRWISE && 3564 key.type != NL80211_KEYTYPE_GROUP) 3565 return -EINVAL; 3566 3567 if (!rdev->ops->add_key) 3568 return -EOPNOTSUPP; 3569 3570 if (cfg80211_validate_key_settings(rdev, &key.p, key.idx, 3571 key.type == NL80211_KEYTYPE_PAIRWISE, 3572 mac_addr)) 3573 return -EINVAL; 3574 3575 wdev_lock(dev->ieee80211_ptr); 3576 err = nl80211_key_allowed(dev->ieee80211_ptr); 3577 if (!err) 3578 err = rdev_add_key(rdev, dev, key.idx, 3579 key.type == NL80211_KEYTYPE_PAIRWISE, 3580 mac_addr, &key.p); 3581 wdev_unlock(dev->ieee80211_ptr); 3582 3583 return err; 3584 } 3585 3586 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info) 3587 { 3588 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3589 int err; 3590 struct net_device *dev = info->user_ptr[1]; 3591 u8 *mac_addr = NULL; 3592 struct key_parse key; 3593 3594 err = nl80211_parse_key(info, &key); 3595 if (err) 3596 return err; 3597 3598 if (info->attrs[NL80211_ATTR_MAC]) 3599 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 3600 3601 if (key.type == -1) { 3602 if (mac_addr) 3603 key.type = NL80211_KEYTYPE_PAIRWISE; 3604 else 3605 key.type = NL80211_KEYTYPE_GROUP; 3606 } 3607 3608 /* for now */ 3609 if (key.type != NL80211_KEYTYPE_PAIRWISE && 3610 key.type != NL80211_KEYTYPE_GROUP) 3611 return -EINVAL; 3612 3613 if (!rdev->ops->del_key) 3614 return -EOPNOTSUPP; 3615 3616 wdev_lock(dev->ieee80211_ptr); 3617 err = nl80211_key_allowed(dev->ieee80211_ptr); 3618 3619 if (key.type == NL80211_KEYTYPE_GROUP && mac_addr && 3620 !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)) 3621 err = -ENOENT; 3622 3623 if (!err) 3624 err = rdev_del_key(rdev, dev, key.idx, 3625 key.type == NL80211_KEYTYPE_PAIRWISE, 3626 mac_addr); 3627 3628 #ifdef CONFIG_CFG80211_WEXT 3629 if (!err) { 3630 if (key.idx == dev->ieee80211_ptr->wext.default_key) 3631 dev->ieee80211_ptr->wext.default_key = -1; 3632 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key) 3633 dev->ieee80211_ptr->wext.default_mgmt_key = -1; 3634 } 3635 #endif 3636 wdev_unlock(dev->ieee80211_ptr); 3637 3638 return err; 3639 } 3640 3641 /* This function returns an error or the number of nested attributes */ 3642 static int validate_acl_mac_addrs(struct nlattr *nl_attr) 3643 { 3644 struct nlattr *attr; 3645 int n_entries = 0, tmp; 3646 3647 nla_for_each_nested(attr, nl_attr, tmp) { 3648 if (nla_len(attr) != ETH_ALEN) 3649 return -EINVAL; 3650 3651 n_entries++; 3652 } 3653 3654 return n_entries; 3655 } 3656 3657 /* 3658 * This function parses ACL information and allocates memory for ACL data. 3659 * On successful return, the calling function is responsible to free the 3660 * ACL buffer returned by this function. 3661 */ 3662 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy, 3663 struct genl_info *info) 3664 { 3665 enum nl80211_acl_policy acl_policy; 3666 struct nlattr *attr; 3667 struct cfg80211_acl_data *acl; 3668 int i = 0, n_entries, tmp; 3669 3670 if (!wiphy->max_acl_mac_addrs) 3671 return ERR_PTR(-EOPNOTSUPP); 3672 3673 if (!info->attrs[NL80211_ATTR_ACL_POLICY]) 3674 return ERR_PTR(-EINVAL); 3675 3676 acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]); 3677 if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED && 3678 acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED) 3679 return ERR_PTR(-EINVAL); 3680 3681 if (!info->attrs[NL80211_ATTR_MAC_ADDRS]) 3682 return ERR_PTR(-EINVAL); 3683 3684 n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]); 3685 if (n_entries < 0) 3686 return ERR_PTR(n_entries); 3687 3688 if (n_entries > wiphy->max_acl_mac_addrs) 3689 return ERR_PTR(-ENOTSUPP); 3690 3691 acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries), 3692 GFP_KERNEL); 3693 if (!acl) 3694 return ERR_PTR(-ENOMEM); 3695 3696 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) { 3697 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN); 3698 i++; 3699 } 3700 3701 acl->n_acl_entries = n_entries; 3702 acl->acl_policy = acl_policy; 3703 3704 return acl; 3705 } 3706 3707 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info) 3708 { 3709 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3710 struct net_device *dev = info->user_ptr[1]; 3711 struct cfg80211_acl_data *acl; 3712 int err; 3713 3714 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 3715 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 3716 return -EOPNOTSUPP; 3717 3718 if (!dev->ieee80211_ptr->beacon_interval) 3719 return -EINVAL; 3720 3721 acl = parse_acl_data(&rdev->wiphy, info); 3722 if (IS_ERR(acl)) 3723 return PTR_ERR(acl); 3724 3725 err = rdev_set_mac_acl(rdev, dev, acl); 3726 3727 kfree(acl); 3728 3729 return err; 3730 } 3731 3732 static u32 rateset_to_mask(struct ieee80211_supported_band *sband, 3733 u8 *rates, u8 rates_len) 3734 { 3735 u8 i; 3736 u32 mask = 0; 3737 3738 for (i = 0; i < rates_len; i++) { 3739 int rate = (rates[i] & 0x7f) * 5; 3740 int ridx; 3741 3742 for (ridx = 0; ridx < sband->n_bitrates; ridx++) { 3743 struct ieee80211_rate *srate = 3744 &sband->bitrates[ridx]; 3745 if (rate == srate->bitrate) { 3746 mask |= 1 << ridx; 3747 break; 3748 } 3749 } 3750 if (ridx == sband->n_bitrates) 3751 return 0; /* rate not found */ 3752 } 3753 3754 return mask; 3755 } 3756 3757 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband, 3758 u8 *rates, u8 rates_len, 3759 u8 mcs[IEEE80211_HT_MCS_MASK_LEN]) 3760 { 3761 u8 i; 3762 3763 memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN); 3764 3765 for (i = 0; i < rates_len; i++) { 3766 int ridx, rbit; 3767 3768 ridx = rates[i] / 8; 3769 rbit = BIT(rates[i] % 8); 3770 3771 /* check validity */ 3772 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN)) 3773 return false; 3774 3775 /* check availability */ 3776 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN); 3777 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit) 3778 mcs[ridx] |= rbit; 3779 else 3780 return false; 3781 } 3782 3783 return true; 3784 } 3785 3786 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map) 3787 { 3788 u16 mcs_mask = 0; 3789 3790 switch (vht_mcs_map) { 3791 case IEEE80211_VHT_MCS_NOT_SUPPORTED: 3792 break; 3793 case IEEE80211_VHT_MCS_SUPPORT_0_7: 3794 mcs_mask = 0x00FF; 3795 break; 3796 case IEEE80211_VHT_MCS_SUPPORT_0_8: 3797 mcs_mask = 0x01FF; 3798 break; 3799 case IEEE80211_VHT_MCS_SUPPORT_0_9: 3800 mcs_mask = 0x03FF; 3801 break; 3802 default: 3803 break; 3804 } 3805 3806 return mcs_mask; 3807 } 3808 3809 static void vht_build_mcs_mask(u16 vht_mcs_map, 3810 u16 vht_mcs_mask[NL80211_VHT_NSS_MAX]) 3811 { 3812 u8 nss; 3813 3814 for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) { 3815 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03); 3816 vht_mcs_map >>= 2; 3817 } 3818 } 3819 3820 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband, 3821 struct nl80211_txrate_vht *txrate, 3822 u16 mcs[NL80211_VHT_NSS_MAX]) 3823 { 3824 u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map); 3825 u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {}; 3826 u8 i; 3827 3828 if (!sband->vht_cap.vht_supported) 3829 return false; 3830 3831 memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX); 3832 3833 /* Build vht_mcs_mask from VHT capabilities */ 3834 vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask); 3835 3836 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) { 3837 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i]) 3838 mcs[i] = txrate->mcs[i]; 3839 else 3840 return false; 3841 } 3842 3843 return true; 3844 } 3845 3846 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = { 3847 [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY, 3848 .len = NL80211_MAX_SUPP_RATES }, 3849 [NL80211_TXRATE_HT] = { .type = NLA_BINARY, 3850 .len = NL80211_MAX_SUPP_HT_RATES }, 3851 [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)}, 3852 [NL80211_TXRATE_GI] = { .type = NLA_U8 }, 3853 }; 3854 3855 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info, 3856 struct cfg80211_bitrate_mask *mask) 3857 { 3858 struct nlattr *tb[NL80211_TXRATE_MAX + 1]; 3859 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3860 int rem, i; 3861 struct nlattr *tx_rates; 3862 struct ieee80211_supported_band *sband; 3863 u16 vht_tx_mcs_map; 3864 3865 memset(mask, 0, sizeof(*mask)); 3866 /* Default to all rates enabled */ 3867 for (i = 0; i < NUM_NL80211_BANDS; i++) { 3868 sband = rdev->wiphy.bands[i]; 3869 3870 if (!sband) 3871 continue; 3872 3873 mask->control[i].legacy = (1 << sband->n_bitrates) - 1; 3874 memcpy(mask->control[i].ht_mcs, 3875 sband->ht_cap.mcs.rx_mask, 3876 sizeof(mask->control[i].ht_mcs)); 3877 3878 if (!sband->vht_cap.vht_supported) 3879 continue; 3880 3881 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map); 3882 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs); 3883 } 3884 3885 /* if no rates are given set it back to the defaults */ 3886 if (!info->attrs[NL80211_ATTR_TX_RATES]) 3887 goto out; 3888 3889 /* The nested attribute uses enum nl80211_band as the index. This maps 3890 * directly to the enum nl80211_band values used in cfg80211. 3891 */ 3892 BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8); 3893 nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) { 3894 enum nl80211_band band = nla_type(tx_rates); 3895 int err; 3896 3897 if (band < 0 || band >= NUM_NL80211_BANDS) 3898 return -EINVAL; 3899 sband = rdev->wiphy.bands[band]; 3900 if (sband == NULL) 3901 return -EINVAL; 3902 err = nla_parse_nested(tb, NL80211_TXRATE_MAX, tx_rates, 3903 nl80211_txattr_policy, info->extack); 3904 if (err) 3905 return err; 3906 if (tb[NL80211_TXRATE_LEGACY]) { 3907 mask->control[band].legacy = rateset_to_mask( 3908 sband, 3909 nla_data(tb[NL80211_TXRATE_LEGACY]), 3910 nla_len(tb[NL80211_TXRATE_LEGACY])); 3911 if ((mask->control[band].legacy == 0) && 3912 nla_len(tb[NL80211_TXRATE_LEGACY])) 3913 return -EINVAL; 3914 } 3915 if (tb[NL80211_TXRATE_HT]) { 3916 if (!ht_rateset_to_mask( 3917 sband, 3918 nla_data(tb[NL80211_TXRATE_HT]), 3919 nla_len(tb[NL80211_TXRATE_HT]), 3920 mask->control[band].ht_mcs)) 3921 return -EINVAL; 3922 } 3923 if (tb[NL80211_TXRATE_VHT]) { 3924 if (!vht_set_mcs_mask( 3925 sband, 3926 nla_data(tb[NL80211_TXRATE_VHT]), 3927 mask->control[band].vht_mcs)) 3928 return -EINVAL; 3929 } 3930 if (tb[NL80211_TXRATE_GI]) { 3931 mask->control[band].gi = 3932 nla_get_u8(tb[NL80211_TXRATE_GI]); 3933 if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI) 3934 return -EINVAL; 3935 } 3936 3937 if (mask->control[band].legacy == 0) { 3938 /* don't allow empty legacy rates if HT or VHT 3939 * are not even supported. 3940 */ 3941 if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported || 3942 rdev->wiphy.bands[band]->vht_cap.vht_supported)) 3943 return -EINVAL; 3944 3945 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) 3946 if (mask->control[band].ht_mcs[i]) 3947 goto out; 3948 3949 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) 3950 if (mask->control[band].vht_mcs[i]) 3951 goto out; 3952 3953 /* legacy and mcs rates may not be both empty */ 3954 return -EINVAL; 3955 } 3956 } 3957 3958 out: 3959 return 0; 3960 } 3961 3962 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev, 3963 enum nl80211_band band, 3964 struct cfg80211_bitrate_mask *beacon_rate) 3965 { 3966 u32 count_ht, count_vht, i; 3967 u32 rate = beacon_rate->control[band].legacy; 3968 3969 /* Allow only one rate */ 3970 if (hweight32(rate) > 1) 3971 return -EINVAL; 3972 3973 count_ht = 0; 3974 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) { 3975 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) { 3976 return -EINVAL; 3977 } else if (beacon_rate->control[band].ht_mcs[i]) { 3978 count_ht++; 3979 if (count_ht > 1) 3980 return -EINVAL; 3981 } 3982 if (count_ht && rate) 3983 return -EINVAL; 3984 } 3985 3986 count_vht = 0; 3987 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) { 3988 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) { 3989 return -EINVAL; 3990 } else if (beacon_rate->control[band].vht_mcs[i]) { 3991 count_vht++; 3992 if (count_vht > 1) 3993 return -EINVAL; 3994 } 3995 if (count_vht && rate) 3996 return -EINVAL; 3997 } 3998 3999 if ((count_ht && count_vht) || (!rate && !count_ht && !count_vht)) 4000 return -EINVAL; 4001 4002 if (rate && 4003 !wiphy_ext_feature_isset(&rdev->wiphy, 4004 NL80211_EXT_FEATURE_BEACON_RATE_LEGACY)) 4005 return -EINVAL; 4006 if (count_ht && 4007 !wiphy_ext_feature_isset(&rdev->wiphy, 4008 NL80211_EXT_FEATURE_BEACON_RATE_HT)) 4009 return -EINVAL; 4010 if (count_vht && 4011 !wiphy_ext_feature_isset(&rdev->wiphy, 4012 NL80211_EXT_FEATURE_BEACON_RATE_VHT)) 4013 return -EINVAL; 4014 4015 return 0; 4016 } 4017 4018 static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev, 4019 struct nlattr *attrs[], 4020 struct cfg80211_beacon_data *bcn) 4021 { 4022 bool haveinfo = false; 4023 int err; 4024 4025 memset(bcn, 0, sizeof(*bcn)); 4026 4027 if (attrs[NL80211_ATTR_BEACON_HEAD]) { 4028 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]); 4029 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]); 4030 if (!bcn->head_len) 4031 return -EINVAL; 4032 haveinfo = true; 4033 } 4034 4035 if (attrs[NL80211_ATTR_BEACON_TAIL]) { 4036 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]); 4037 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]); 4038 haveinfo = true; 4039 } 4040 4041 if (!haveinfo) 4042 return -EINVAL; 4043 4044 if (attrs[NL80211_ATTR_IE]) { 4045 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]); 4046 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]); 4047 } 4048 4049 if (attrs[NL80211_ATTR_IE_PROBE_RESP]) { 4050 bcn->proberesp_ies = 4051 nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]); 4052 bcn->proberesp_ies_len = 4053 nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]); 4054 } 4055 4056 if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) { 4057 bcn->assocresp_ies = 4058 nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]); 4059 bcn->assocresp_ies_len = 4060 nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]); 4061 } 4062 4063 if (attrs[NL80211_ATTR_PROBE_RESP]) { 4064 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]); 4065 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]); 4066 } 4067 4068 if (attrs[NL80211_ATTR_FTM_RESPONDER]) { 4069 struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1]; 4070 4071 err = nla_parse_nested(tb, NL80211_FTM_RESP_ATTR_MAX, 4072 attrs[NL80211_ATTR_FTM_RESPONDER], 4073 NULL, NULL); 4074 if (err) 4075 return err; 4076 4077 if (tb[NL80211_FTM_RESP_ATTR_ENABLED] && 4078 wiphy_ext_feature_isset(&rdev->wiphy, 4079 NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER)) 4080 bcn->ftm_responder = 1; 4081 else 4082 return -EOPNOTSUPP; 4083 4084 if (tb[NL80211_FTM_RESP_ATTR_LCI]) { 4085 bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]); 4086 bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]); 4087 } 4088 4089 if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) { 4090 bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]); 4091 bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]); 4092 } 4093 } else { 4094 bcn->ftm_responder = -1; 4095 } 4096 4097 return 0; 4098 } 4099 4100 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params, 4101 const u8 *rates) 4102 { 4103 int i; 4104 4105 if (!rates) 4106 return; 4107 4108 for (i = 0; i < rates[1]; i++) { 4109 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY) 4110 params->ht_required = true; 4111 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY) 4112 params->vht_required = true; 4113 } 4114 } 4115 4116 /* 4117 * Since the nl80211 API didn't include, from the beginning, attributes about 4118 * HT/VHT requirements/capabilities, we parse them out of the IEs for the 4119 * benefit of drivers that rebuild IEs in the firmware. 4120 */ 4121 static void nl80211_calculate_ap_params(struct cfg80211_ap_settings *params) 4122 { 4123 const struct cfg80211_beacon_data *bcn = ¶ms->beacon; 4124 size_t ies_len = bcn->tail_len; 4125 const u8 *ies = bcn->tail; 4126 const u8 *rates; 4127 const u8 *cap; 4128 4129 rates = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies, ies_len); 4130 nl80211_check_ap_rate_selectors(params, rates); 4131 4132 rates = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, ies, ies_len); 4133 nl80211_check_ap_rate_selectors(params, rates); 4134 4135 cap = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies, ies_len); 4136 if (cap && cap[1] >= sizeof(*params->ht_cap)) 4137 params->ht_cap = (void *)(cap + 2); 4138 cap = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, ies, ies_len); 4139 if (cap && cap[1] >= sizeof(*params->vht_cap)) 4140 params->vht_cap = (void *)(cap + 2); 4141 cap = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len); 4142 if (cap && cap[1] >= sizeof(*params->he_cap) + 1) 4143 params->he_cap = (void *)(cap + 3); 4144 } 4145 4146 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev, 4147 struct cfg80211_ap_settings *params) 4148 { 4149 struct wireless_dev *wdev; 4150 bool ret = false; 4151 4152 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { 4153 if (wdev->iftype != NL80211_IFTYPE_AP && 4154 wdev->iftype != NL80211_IFTYPE_P2P_GO) 4155 continue; 4156 4157 if (!wdev->preset_chandef.chan) 4158 continue; 4159 4160 params->chandef = wdev->preset_chandef; 4161 ret = true; 4162 break; 4163 } 4164 4165 return ret; 4166 } 4167 4168 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev, 4169 enum nl80211_auth_type auth_type, 4170 enum nl80211_commands cmd) 4171 { 4172 if (auth_type > NL80211_AUTHTYPE_MAX) 4173 return false; 4174 4175 switch (cmd) { 4176 case NL80211_CMD_AUTHENTICATE: 4177 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) && 4178 auth_type == NL80211_AUTHTYPE_SAE) 4179 return false; 4180 if (!wiphy_ext_feature_isset(&rdev->wiphy, 4181 NL80211_EXT_FEATURE_FILS_STA) && 4182 (auth_type == NL80211_AUTHTYPE_FILS_SK || 4183 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 4184 auth_type == NL80211_AUTHTYPE_FILS_PK)) 4185 return false; 4186 return true; 4187 case NL80211_CMD_CONNECT: 4188 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) && 4189 auth_type == NL80211_AUTHTYPE_SAE) 4190 return false; 4191 4192 /* FILS with SK PFS or PK not supported yet */ 4193 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 4194 auth_type == NL80211_AUTHTYPE_FILS_PK) 4195 return false; 4196 if (!wiphy_ext_feature_isset( 4197 &rdev->wiphy, 4198 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) && 4199 auth_type == NL80211_AUTHTYPE_FILS_SK) 4200 return false; 4201 return true; 4202 case NL80211_CMD_START_AP: 4203 /* SAE not supported yet */ 4204 if (auth_type == NL80211_AUTHTYPE_SAE) 4205 return false; 4206 /* FILS not supported yet */ 4207 if (auth_type == NL80211_AUTHTYPE_FILS_SK || 4208 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 4209 auth_type == NL80211_AUTHTYPE_FILS_PK) 4210 return false; 4211 return true; 4212 default: 4213 return false; 4214 } 4215 } 4216 4217 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info) 4218 { 4219 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4220 struct net_device *dev = info->user_ptr[1]; 4221 struct wireless_dev *wdev = dev->ieee80211_ptr; 4222 struct cfg80211_ap_settings params; 4223 int err; 4224 4225 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 4226 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 4227 return -EOPNOTSUPP; 4228 4229 if (!rdev->ops->start_ap) 4230 return -EOPNOTSUPP; 4231 4232 if (wdev->beacon_interval) 4233 return -EALREADY; 4234 4235 memset(¶ms, 0, sizeof(params)); 4236 4237 /* these are required for START_AP */ 4238 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] || 4239 !info->attrs[NL80211_ATTR_DTIM_PERIOD] || 4240 !info->attrs[NL80211_ATTR_BEACON_HEAD]) 4241 return -EINVAL; 4242 4243 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms.beacon); 4244 if (err) 4245 return err; 4246 4247 params.beacon_interval = 4248 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]); 4249 params.dtim_period = 4250 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]); 4251 4252 err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype, 4253 params.beacon_interval); 4254 if (err) 4255 return err; 4256 4257 /* 4258 * In theory, some of these attributes should be required here 4259 * but since they were not used when the command was originally 4260 * added, keep them optional for old user space programs to let 4261 * them continue to work with drivers that do not need the 4262 * additional information -- drivers must check! 4263 */ 4264 if (info->attrs[NL80211_ATTR_SSID]) { 4265 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 4266 params.ssid_len = 4267 nla_len(info->attrs[NL80211_ATTR_SSID]); 4268 if (params.ssid_len == 0 || 4269 params.ssid_len > IEEE80211_MAX_SSID_LEN) 4270 return -EINVAL; 4271 } 4272 4273 if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) 4274 params.hidden_ssid = nla_get_u32( 4275 info->attrs[NL80211_ATTR_HIDDEN_SSID]); 4276 4277 params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY]; 4278 4279 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) { 4280 params.auth_type = nla_get_u32( 4281 info->attrs[NL80211_ATTR_AUTH_TYPE]); 4282 if (!nl80211_valid_auth_type(rdev, params.auth_type, 4283 NL80211_CMD_START_AP)) 4284 return -EINVAL; 4285 } else 4286 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC; 4287 4288 err = nl80211_crypto_settings(rdev, info, ¶ms.crypto, 4289 NL80211_MAX_NR_CIPHER_SUITES); 4290 if (err) 4291 return err; 4292 4293 if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) { 4294 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER)) 4295 return -EOPNOTSUPP; 4296 params.inactivity_timeout = nla_get_u16( 4297 info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]); 4298 } 4299 4300 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) { 4301 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 4302 return -EINVAL; 4303 params.p2p_ctwindow = 4304 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]); 4305 if (params.p2p_ctwindow != 0 && 4306 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) 4307 return -EINVAL; 4308 } 4309 4310 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) { 4311 u8 tmp; 4312 4313 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 4314 return -EINVAL; 4315 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]); 4316 params.p2p_opp_ps = tmp; 4317 if (params.p2p_opp_ps != 0 && 4318 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) 4319 return -EINVAL; 4320 } 4321 4322 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 4323 err = nl80211_parse_chandef(rdev, info, ¶ms.chandef); 4324 if (err) 4325 return err; 4326 } else if (wdev->preset_chandef.chan) { 4327 params.chandef = wdev->preset_chandef; 4328 } else if (!nl80211_get_ap_channel(rdev, ¶ms)) 4329 return -EINVAL; 4330 4331 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms.chandef, 4332 wdev->iftype)) 4333 return -EINVAL; 4334 4335 if (info->attrs[NL80211_ATTR_TX_RATES]) { 4336 err = nl80211_parse_tx_bitrate_mask(info, ¶ms.beacon_rate); 4337 if (err) 4338 return err; 4339 4340 err = validate_beacon_tx_rate(rdev, params.chandef.chan->band, 4341 ¶ms.beacon_rate); 4342 if (err) 4343 return err; 4344 } 4345 4346 if (info->attrs[NL80211_ATTR_SMPS_MODE]) { 4347 params.smps_mode = 4348 nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]); 4349 switch (params.smps_mode) { 4350 case NL80211_SMPS_OFF: 4351 break; 4352 case NL80211_SMPS_STATIC: 4353 if (!(rdev->wiphy.features & 4354 NL80211_FEATURE_STATIC_SMPS)) 4355 return -EINVAL; 4356 break; 4357 case NL80211_SMPS_DYNAMIC: 4358 if (!(rdev->wiphy.features & 4359 NL80211_FEATURE_DYNAMIC_SMPS)) 4360 return -EINVAL; 4361 break; 4362 default: 4363 return -EINVAL; 4364 } 4365 } else { 4366 params.smps_mode = NL80211_SMPS_OFF; 4367 } 4368 4369 params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]); 4370 if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) 4371 return -EOPNOTSUPP; 4372 4373 if (info->attrs[NL80211_ATTR_ACL_POLICY]) { 4374 params.acl = parse_acl_data(&rdev->wiphy, info); 4375 if (IS_ERR(params.acl)) 4376 return PTR_ERR(params.acl); 4377 } 4378 4379 nl80211_calculate_ap_params(¶ms); 4380 4381 wdev_lock(wdev); 4382 err = rdev_start_ap(rdev, dev, ¶ms); 4383 if (!err) { 4384 wdev->preset_chandef = params.chandef; 4385 wdev->beacon_interval = params.beacon_interval; 4386 wdev->chandef = params.chandef; 4387 wdev->ssid_len = params.ssid_len; 4388 memcpy(wdev->ssid, params.ssid, wdev->ssid_len); 4389 4390 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 4391 wdev->conn_owner_nlportid = info->snd_portid; 4392 } 4393 wdev_unlock(wdev); 4394 4395 kfree(params.acl); 4396 4397 return err; 4398 } 4399 4400 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info) 4401 { 4402 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4403 struct net_device *dev = info->user_ptr[1]; 4404 struct wireless_dev *wdev = dev->ieee80211_ptr; 4405 struct cfg80211_beacon_data params; 4406 int err; 4407 4408 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 4409 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 4410 return -EOPNOTSUPP; 4411 4412 if (!rdev->ops->change_beacon) 4413 return -EOPNOTSUPP; 4414 4415 if (!wdev->beacon_interval) 4416 return -EINVAL; 4417 4418 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms); 4419 if (err) 4420 return err; 4421 4422 wdev_lock(wdev); 4423 err = rdev_change_beacon(rdev, dev, ¶ms); 4424 wdev_unlock(wdev); 4425 4426 return err; 4427 } 4428 4429 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info) 4430 { 4431 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4432 struct net_device *dev = info->user_ptr[1]; 4433 4434 return cfg80211_stop_ap(rdev, dev, false); 4435 } 4436 4437 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = { 4438 [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG }, 4439 [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG }, 4440 [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG }, 4441 [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG }, 4442 [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG }, 4443 [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG }, 4444 }; 4445 4446 static int parse_station_flags(struct genl_info *info, 4447 enum nl80211_iftype iftype, 4448 struct station_parameters *params) 4449 { 4450 struct nlattr *flags[NL80211_STA_FLAG_MAX + 1]; 4451 struct nlattr *nla; 4452 int flag; 4453 4454 /* 4455 * Try parsing the new attribute first so userspace 4456 * can specify both for older kernels. 4457 */ 4458 nla = info->attrs[NL80211_ATTR_STA_FLAGS2]; 4459 if (nla) { 4460 struct nl80211_sta_flag_update *sta_flags; 4461 4462 sta_flags = nla_data(nla); 4463 params->sta_flags_mask = sta_flags->mask; 4464 params->sta_flags_set = sta_flags->set; 4465 params->sta_flags_set &= params->sta_flags_mask; 4466 if ((params->sta_flags_mask | 4467 params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID)) 4468 return -EINVAL; 4469 return 0; 4470 } 4471 4472 /* if present, parse the old attribute */ 4473 4474 nla = info->attrs[NL80211_ATTR_STA_FLAGS]; 4475 if (!nla) 4476 return 0; 4477 4478 if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX, nla, 4479 sta_flags_policy, info->extack)) 4480 return -EINVAL; 4481 4482 /* 4483 * Only allow certain flags for interface types so that 4484 * other attributes are silently ignored. Remember that 4485 * this is backward compatibility code with old userspace 4486 * and shouldn't be hit in other cases anyway. 4487 */ 4488 switch (iftype) { 4489 case NL80211_IFTYPE_AP: 4490 case NL80211_IFTYPE_AP_VLAN: 4491 case NL80211_IFTYPE_P2P_GO: 4492 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) | 4493 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) | 4494 BIT(NL80211_STA_FLAG_WME) | 4495 BIT(NL80211_STA_FLAG_MFP); 4496 break; 4497 case NL80211_IFTYPE_P2P_CLIENT: 4498 case NL80211_IFTYPE_STATION: 4499 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) | 4500 BIT(NL80211_STA_FLAG_TDLS_PEER); 4501 break; 4502 case NL80211_IFTYPE_MESH_POINT: 4503 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) | 4504 BIT(NL80211_STA_FLAG_MFP) | 4505 BIT(NL80211_STA_FLAG_AUTHORIZED); 4506 break; 4507 default: 4508 return -EINVAL; 4509 } 4510 4511 for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) { 4512 if (flags[flag]) { 4513 params->sta_flags_set |= (1<<flag); 4514 4515 /* no longer support new API additions in old API */ 4516 if (flag > NL80211_STA_FLAG_MAX_OLD_API) 4517 return -EINVAL; 4518 } 4519 } 4520 4521 return 0; 4522 } 4523 4524 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, 4525 int attr) 4526 { 4527 struct nlattr *rate; 4528 u32 bitrate; 4529 u16 bitrate_compat; 4530 enum nl80211_rate_info rate_flg; 4531 4532 rate = nla_nest_start(msg, attr); 4533 if (!rate) 4534 return false; 4535 4536 /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */ 4537 bitrate = cfg80211_calculate_bitrate(info); 4538 /* report 16-bit bitrate only if we can */ 4539 bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0; 4540 if (bitrate > 0 && 4541 nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate)) 4542 return false; 4543 if (bitrate_compat > 0 && 4544 nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat)) 4545 return false; 4546 4547 switch (info->bw) { 4548 case RATE_INFO_BW_5: 4549 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH; 4550 break; 4551 case RATE_INFO_BW_10: 4552 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH; 4553 break; 4554 default: 4555 WARN_ON(1); 4556 /* fall through */ 4557 case RATE_INFO_BW_20: 4558 rate_flg = 0; 4559 break; 4560 case RATE_INFO_BW_40: 4561 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH; 4562 break; 4563 case RATE_INFO_BW_80: 4564 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH; 4565 break; 4566 case RATE_INFO_BW_160: 4567 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH; 4568 break; 4569 case RATE_INFO_BW_HE_RU: 4570 rate_flg = 0; 4571 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS)); 4572 } 4573 4574 if (rate_flg && nla_put_flag(msg, rate_flg)) 4575 return false; 4576 4577 if (info->flags & RATE_INFO_FLAGS_MCS) { 4578 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs)) 4579 return false; 4580 if (info->flags & RATE_INFO_FLAGS_SHORT_GI && 4581 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI)) 4582 return false; 4583 } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) { 4584 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs)) 4585 return false; 4586 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss)) 4587 return false; 4588 if (info->flags & RATE_INFO_FLAGS_SHORT_GI && 4589 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI)) 4590 return false; 4591 } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) { 4592 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs)) 4593 return false; 4594 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss)) 4595 return false; 4596 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi)) 4597 return false; 4598 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm)) 4599 return false; 4600 if (info->bw == RATE_INFO_BW_HE_RU && 4601 nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC, 4602 info->he_ru_alloc)) 4603 return false; 4604 } 4605 4606 nla_nest_end(msg, rate); 4607 return true; 4608 } 4609 4610 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal, 4611 int id) 4612 { 4613 void *attr; 4614 int i = 0; 4615 4616 if (!mask) 4617 return true; 4618 4619 attr = nla_nest_start(msg, id); 4620 if (!attr) 4621 return false; 4622 4623 for (i = 0; i < IEEE80211_MAX_CHAINS; i++) { 4624 if (!(mask & BIT(i))) 4625 continue; 4626 4627 if (nla_put_u8(msg, i, signal[i])) 4628 return false; 4629 } 4630 4631 nla_nest_end(msg, attr); 4632 4633 return true; 4634 } 4635 4636 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid, 4637 u32 seq, int flags, 4638 struct cfg80211_registered_device *rdev, 4639 struct net_device *dev, 4640 const u8 *mac_addr, struct station_info *sinfo) 4641 { 4642 void *hdr; 4643 struct nlattr *sinfoattr, *bss_param; 4644 4645 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 4646 if (!hdr) 4647 return -1; 4648 4649 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 4650 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) || 4651 nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation)) 4652 goto nla_put_failure; 4653 4654 sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO); 4655 if (!sinfoattr) 4656 goto nla_put_failure; 4657 4658 #define PUT_SINFO(attr, memb, type) do { \ 4659 BUILD_BUG_ON(sizeof(type) == sizeof(u64)); \ 4660 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \ 4661 nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr, \ 4662 sinfo->memb)) \ 4663 goto nla_put_failure; \ 4664 } while (0) 4665 #define PUT_SINFO_U64(attr, memb) do { \ 4666 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \ 4667 nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr, \ 4668 sinfo->memb, NL80211_STA_INFO_PAD)) \ 4669 goto nla_put_failure; \ 4670 } while (0) 4671 4672 PUT_SINFO(CONNECTED_TIME, connected_time, u32); 4673 PUT_SINFO(INACTIVE_TIME, inactive_time, u32); 4674 4675 if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) | 4676 BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) && 4677 nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES, 4678 (u32)sinfo->rx_bytes)) 4679 goto nla_put_failure; 4680 4681 if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) | 4682 BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) && 4683 nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES, 4684 (u32)sinfo->tx_bytes)) 4685 goto nla_put_failure; 4686 4687 PUT_SINFO_U64(RX_BYTES64, rx_bytes); 4688 PUT_SINFO_U64(TX_BYTES64, tx_bytes); 4689 PUT_SINFO(LLID, llid, u16); 4690 PUT_SINFO(PLID, plid, u16); 4691 PUT_SINFO(PLINK_STATE, plink_state, u8); 4692 PUT_SINFO_U64(RX_DURATION, rx_duration); 4693 4694 switch (rdev->wiphy.signal_type) { 4695 case CFG80211_SIGNAL_TYPE_MBM: 4696 PUT_SINFO(SIGNAL, signal, u8); 4697 PUT_SINFO(SIGNAL_AVG, signal_avg, u8); 4698 break; 4699 default: 4700 break; 4701 } 4702 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) { 4703 if (!nl80211_put_signal(msg, sinfo->chains, 4704 sinfo->chain_signal, 4705 NL80211_STA_INFO_CHAIN_SIGNAL)) 4706 goto nla_put_failure; 4707 } 4708 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) { 4709 if (!nl80211_put_signal(msg, sinfo->chains, 4710 sinfo->chain_signal_avg, 4711 NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) 4712 goto nla_put_failure; 4713 } 4714 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) { 4715 if (!nl80211_put_sta_rate(msg, &sinfo->txrate, 4716 NL80211_STA_INFO_TX_BITRATE)) 4717 goto nla_put_failure; 4718 } 4719 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) { 4720 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate, 4721 NL80211_STA_INFO_RX_BITRATE)) 4722 goto nla_put_failure; 4723 } 4724 4725 PUT_SINFO(RX_PACKETS, rx_packets, u32); 4726 PUT_SINFO(TX_PACKETS, tx_packets, u32); 4727 PUT_SINFO(TX_RETRIES, tx_retries, u32); 4728 PUT_SINFO(TX_FAILED, tx_failed, u32); 4729 PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32); 4730 PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32); 4731 PUT_SINFO(LOCAL_PM, local_pm, u32); 4732 PUT_SINFO(PEER_PM, peer_pm, u32); 4733 PUT_SINFO(NONPEER_PM, nonpeer_pm, u32); 4734 4735 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) { 4736 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM); 4737 if (!bss_param) 4738 goto nla_put_failure; 4739 4740 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) && 4741 nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) || 4742 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) && 4743 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) || 4744 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) && 4745 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) || 4746 nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD, 4747 sinfo->bss_param.dtim_period) || 4748 nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL, 4749 sinfo->bss_param.beacon_interval)) 4750 goto nla_put_failure; 4751 4752 nla_nest_end(msg, bss_param); 4753 } 4754 if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) && 4755 nla_put(msg, NL80211_STA_INFO_STA_FLAGS, 4756 sizeof(struct nl80211_sta_flag_update), 4757 &sinfo->sta_flags)) 4758 goto nla_put_failure; 4759 4760 PUT_SINFO_U64(T_OFFSET, t_offset); 4761 PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc); 4762 PUT_SINFO_U64(BEACON_RX, rx_beacon); 4763 PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8); 4764 PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32); 4765 PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32); 4766 if (wiphy_ext_feature_isset(&rdev->wiphy, 4767 NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) { 4768 PUT_SINFO(ACK_SIGNAL, ack_signal, u8); 4769 PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8); 4770 } 4771 4772 #undef PUT_SINFO 4773 #undef PUT_SINFO_U64 4774 4775 if (sinfo->pertid) { 4776 struct nlattr *tidsattr; 4777 int tid; 4778 4779 tidsattr = nla_nest_start(msg, NL80211_STA_INFO_TID_STATS); 4780 if (!tidsattr) 4781 goto nla_put_failure; 4782 4783 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) { 4784 struct cfg80211_tid_stats *tidstats; 4785 struct nlattr *tidattr; 4786 4787 tidstats = &sinfo->pertid[tid]; 4788 4789 if (!tidstats->filled) 4790 continue; 4791 4792 tidattr = nla_nest_start(msg, tid + 1); 4793 if (!tidattr) 4794 goto nla_put_failure; 4795 4796 #define PUT_TIDVAL_U64(attr, memb) do { \ 4797 if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) && \ 4798 nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr, \ 4799 tidstats->memb, NL80211_TID_STATS_PAD)) \ 4800 goto nla_put_failure; \ 4801 } while (0) 4802 4803 PUT_TIDVAL_U64(RX_MSDU, rx_msdu); 4804 PUT_TIDVAL_U64(TX_MSDU, tx_msdu); 4805 PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries); 4806 PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed); 4807 4808 #undef PUT_TIDVAL_U64 4809 if ((tidstats->filled & 4810 BIT(NL80211_TID_STATS_TXQ_STATS)) && 4811 !nl80211_put_txq_stats(msg, &tidstats->txq_stats, 4812 NL80211_TID_STATS_TXQ_STATS)) 4813 goto nla_put_failure; 4814 4815 nla_nest_end(msg, tidattr); 4816 } 4817 4818 nla_nest_end(msg, tidsattr); 4819 } 4820 4821 nla_nest_end(msg, sinfoattr); 4822 4823 if (sinfo->assoc_req_ies_len && 4824 nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len, 4825 sinfo->assoc_req_ies)) 4826 goto nla_put_failure; 4827 4828 cfg80211_sinfo_release_content(sinfo); 4829 genlmsg_end(msg, hdr); 4830 return 0; 4831 4832 nla_put_failure: 4833 cfg80211_sinfo_release_content(sinfo); 4834 genlmsg_cancel(msg, hdr); 4835 return -EMSGSIZE; 4836 } 4837 4838 static int nl80211_dump_station(struct sk_buff *skb, 4839 struct netlink_callback *cb) 4840 { 4841 struct station_info sinfo; 4842 struct cfg80211_registered_device *rdev; 4843 struct wireless_dev *wdev; 4844 u8 mac_addr[ETH_ALEN]; 4845 int sta_idx = cb->args[2]; 4846 int err; 4847 4848 rtnl_lock(); 4849 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev); 4850 if (err) 4851 goto out_err; 4852 4853 if (!wdev->netdev) { 4854 err = -EINVAL; 4855 goto out_err; 4856 } 4857 4858 if (!rdev->ops->dump_station) { 4859 err = -EOPNOTSUPP; 4860 goto out_err; 4861 } 4862 4863 while (1) { 4864 memset(&sinfo, 0, sizeof(sinfo)); 4865 err = rdev_dump_station(rdev, wdev->netdev, sta_idx, 4866 mac_addr, &sinfo); 4867 if (err == -ENOENT) 4868 break; 4869 if (err) 4870 goto out_err; 4871 4872 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION, 4873 NETLINK_CB(cb->skb).portid, 4874 cb->nlh->nlmsg_seq, NLM_F_MULTI, 4875 rdev, wdev->netdev, mac_addr, 4876 &sinfo) < 0) 4877 goto out; 4878 4879 sta_idx++; 4880 } 4881 4882 out: 4883 cb->args[2] = sta_idx; 4884 err = skb->len; 4885 out_err: 4886 rtnl_unlock(); 4887 4888 return err; 4889 } 4890 4891 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info) 4892 { 4893 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4894 struct net_device *dev = info->user_ptr[1]; 4895 struct station_info sinfo; 4896 struct sk_buff *msg; 4897 u8 *mac_addr = NULL; 4898 int err; 4899 4900 memset(&sinfo, 0, sizeof(sinfo)); 4901 4902 if (!info->attrs[NL80211_ATTR_MAC]) 4903 return -EINVAL; 4904 4905 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 4906 4907 if (!rdev->ops->get_station) 4908 return -EOPNOTSUPP; 4909 4910 err = rdev_get_station(rdev, dev, mac_addr, &sinfo); 4911 if (err) 4912 return err; 4913 4914 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 4915 if (!msg) { 4916 cfg80211_sinfo_release_content(&sinfo); 4917 return -ENOMEM; 4918 } 4919 4920 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 4921 info->snd_portid, info->snd_seq, 0, 4922 rdev, dev, mac_addr, &sinfo) < 0) { 4923 nlmsg_free(msg); 4924 return -ENOBUFS; 4925 } 4926 4927 return genlmsg_reply(msg, info); 4928 } 4929 4930 int cfg80211_check_station_change(struct wiphy *wiphy, 4931 struct station_parameters *params, 4932 enum cfg80211_station_type statype) 4933 { 4934 if (params->listen_interval != -1 && 4935 statype != CFG80211_STA_AP_CLIENT_UNASSOC) 4936 return -EINVAL; 4937 4938 if (params->support_p2p_ps != -1 && 4939 statype != CFG80211_STA_AP_CLIENT_UNASSOC) 4940 return -EINVAL; 4941 4942 if (params->aid && 4943 !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) && 4944 statype != CFG80211_STA_AP_CLIENT_UNASSOC) 4945 return -EINVAL; 4946 4947 /* When you run into this, adjust the code below for the new flag */ 4948 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7); 4949 4950 switch (statype) { 4951 case CFG80211_STA_MESH_PEER_KERNEL: 4952 case CFG80211_STA_MESH_PEER_USER: 4953 /* 4954 * No ignoring the TDLS flag here -- the userspace mesh 4955 * code doesn't have the bug of including TDLS in the 4956 * mask everywhere. 4957 */ 4958 if (params->sta_flags_mask & 4959 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) | 4960 BIT(NL80211_STA_FLAG_MFP) | 4961 BIT(NL80211_STA_FLAG_AUTHORIZED))) 4962 return -EINVAL; 4963 break; 4964 case CFG80211_STA_TDLS_PEER_SETUP: 4965 case CFG80211_STA_TDLS_PEER_ACTIVE: 4966 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))) 4967 return -EINVAL; 4968 /* ignore since it can't change */ 4969 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER); 4970 break; 4971 default: 4972 /* disallow mesh-specific things */ 4973 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION) 4974 return -EINVAL; 4975 if (params->local_pm) 4976 return -EINVAL; 4977 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE) 4978 return -EINVAL; 4979 } 4980 4981 if (statype != CFG80211_STA_TDLS_PEER_SETUP && 4982 statype != CFG80211_STA_TDLS_PEER_ACTIVE) { 4983 /* TDLS can't be set, ... */ 4984 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) 4985 return -EINVAL; 4986 /* 4987 * ... but don't bother the driver with it. This works around 4988 * a hostapd/wpa_supplicant issue -- it always includes the 4989 * TLDS_PEER flag in the mask even for AP mode. 4990 */ 4991 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER); 4992 } 4993 4994 if (statype != CFG80211_STA_TDLS_PEER_SETUP && 4995 statype != CFG80211_STA_AP_CLIENT_UNASSOC) { 4996 /* reject other things that can't change */ 4997 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD) 4998 return -EINVAL; 4999 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY) 5000 return -EINVAL; 5001 if (params->supported_rates) 5002 return -EINVAL; 5003 if (params->ext_capab || params->ht_capa || params->vht_capa || 5004 params->he_capa) 5005 return -EINVAL; 5006 } 5007 5008 if (statype != CFG80211_STA_AP_CLIENT && 5009 statype != CFG80211_STA_AP_CLIENT_UNASSOC) { 5010 if (params->vlan) 5011 return -EINVAL; 5012 } 5013 5014 switch (statype) { 5015 case CFG80211_STA_AP_MLME_CLIENT: 5016 /* Use this only for authorizing/unauthorizing a station */ 5017 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED))) 5018 return -EOPNOTSUPP; 5019 break; 5020 case CFG80211_STA_AP_CLIENT: 5021 case CFG80211_STA_AP_CLIENT_UNASSOC: 5022 /* accept only the listed bits */ 5023 if (params->sta_flags_mask & 5024 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) | 5025 BIT(NL80211_STA_FLAG_AUTHENTICATED) | 5026 BIT(NL80211_STA_FLAG_ASSOCIATED) | 5027 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) | 5028 BIT(NL80211_STA_FLAG_WME) | 5029 BIT(NL80211_STA_FLAG_MFP))) 5030 return -EINVAL; 5031 5032 /* but authenticated/associated only if driver handles it */ 5033 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) && 5034 params->sta_flags_mask & 5035 (BIT(NL80211_STA_FLAG_AUTHENTICATED) | 5036 BIT(NL80211_STA_FLAG_ASSOCIATED))) 5037 return -EINVAL; 5038 break; 5039 case CFG80211_STA_IBSS: 5040 case CFG80211_STA_AP_STA: 5041 /* reject any changes other than AUTHORIZED */ 5042 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED)) 5043 return -EINVAL; 5044 break; 5045 case CFG80211_STA_TDLS_PEER_SETUP: 5046 /* reject any changes other than AUTHORIZED or WME */ 5047 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) | 5048 BIT(NL80211_STA_FLAG_WME))) 5049 return -EINVAL; 5050 /* force (at least) rates when authorizing */ 5051 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) && 5052 !params->supported_rates) 5053 return -EINVAL; 5054 break; 5055 case CFG80211_STA_TDLS_PEER_ACTIVE: 5056 /* reject any changes */ 5057 return -EINVAL; 5058 case CFG80211_STA_MESH_PEER_KERNEL: 5059 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE) 5060 return -EINVAL; 5061 break; 5062 case CFG80211_STA_MESH_PEER_USER: 5063 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION && 5064 params->plink_action != NL80211_PLINK_ACTION_BLOCK) 5065 return -EINVAL; 5066 break; 5067 } 5068 5069 /* 5070 * Older kernel versions ignored this attribute entirely, so don't 5071 * reject attempts to update it but mark it as unused instead so the 5072 * driver won't look at the data. 5073 */ 5074 if (statype != CFG80211_STA_AP_CLIENT_UNASSOC && 5075 statype != CFG80211_STA_TDLS_PEER_SETUP) 5076 params->opmode_notif_used = false; 5077 5078 return 0; 5079 } 5080 EXPORT_SYMBOL(cfg80211_check_station_change); 5081 5082 /* 5083 * Get vlan interface making sure it is running and on the right wiphy. 5084 */ 5085 static struct net_device *get_vlan(struct genl_info *info, 5086 struct cfg80211_registered_device *rdev) 5087 { 5088 struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN]; 5089 struct net_device *v; 5090 int ret; 5091 5092 if (!vlanattr) 5093 return NULL; 5094 5095 v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr)); 5096 if (!v) 5097 return ERR_PTR(-ENODEV); 5098 5099 if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) { 5100 ret = -EINVAL; 5101 goto error; 5102 } 5103 5104 if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN && 5105 v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 5106 v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) { 5107 ret = -EINVAL; 5108 goto error; 5109 } 5110 5111 if (!netif_running(v)) { 5112 ret = -ENETDOWN; 5113 goto error; 5114 } 5115 5116 return v; 5117 error: 5118 dev_put(v); 5119 return ERR_PTR(ret); 5120 } 5121 5122 static const struct nla_policy 5123 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = { 5124 [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 }, 5125 [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 }, 5126 }; 5127 5128 static int nl80211_parse_sta_wme(struct genl_info *info, 5129 struct station_parameters *params) 5130 { 5131 struct nlattr *tb[NL80211_STA_WME_MAX + 1]; 5132 struct nlattr *nla; 5133 int err; 5134 5135 /* parse WME attributes if present */ 5136 if (!info->attrs[NL80211_ATTR_STA_WME]) 5137 return 0; 5138 5139 nla = info->attrs[NL80211_ATTR_STA_WME]; 5140 err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla, 5141 nl80211_sta_wme_policy, info->extack); 5142 if (err) 5143 return err; 5144 5145 if (tb[NL80211_STA_WME_UAPSD_QUEUES]) 5146 params->uapsd_queues = nla_get_u8( 5147 tb[NL80211_STA_WME_UAPSD_QUEUES]); 5148 if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK) 5149 return -EINVAL; 5150 5151 if (tb[NL80211_STA_WME_MAX_SP]) 5152 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]); 5153 5154 if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK) 5155 return -EINVAL; 5156 5157 params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD; 5158 5159 return 0; 5160 } 5161 5162 static int nl80211_parse_sta_channel_info(struct genl_info *info, 5163 struct station_parameters *params) 5164 { 5165 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) { 5166 params->supported_channels = 5167 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]); 5168 params->supported_channels_len = 5169 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]); 5170 /* 5171 * Need to include at least one (first channel, number of 5172 * channels) tuple for each subband, and must have proper 5173 * tuples for the rest of the data as well. 5174 */ 5175 if (params->supported_channels_len < 2) 5176 return -EINVAL; 5177 if (params->supported_channels_len % 2) 5178 return -EINVAL; 5179 } 5180 5181 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) { 5182 params->supported_oper_classes = 5183 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]); 5184 params->supported_oper_classes_len = 5185 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]); 5186 /* 5187 * The value of the Length field of the Supported Operating 5188 * Classes element is between 2 and 253. 5189 */ 5190 if (params->supported_oper_classes_len < 2 || 5191 params->supported_oper_classes_len > 253) 5192 return -EINVAL; 5193 } 5194 return 0; 5195 } 5196 5197 static int nl80211_set_station_tdls(struct genl_info *info, 5198 struct station_parameters *params) 5199 { 5200 int err; 5201 /* Dummy STA entry gets updated once the peer capabilities are known */ 5202 if (info->attrs[NL80211_ATTR_PEER_AID]) 5203 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]); 5204 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) 5205 params->ht_capa = 5206 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]); 5207 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) 5208 params->vht_capa = 5209 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]); 5210 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) { 5211 params->he_capa = 5212 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 5213 params->he_capa_len = 5214 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 5215 5216 if (params->he_capa_len < NL80211_HE_MIN_CAPABILITY_LEN) 5217 return -EINVAL; 5218 } 5219 5220 err = nl80211_parse_sta_channel_info(info, params); 5221 if (err) 5222 return err; 5223 5224 return nl80211_parse_sta_wme(info, params); 5225 } 5226 5227 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info) 5228 { 5229 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5230 struct net_device *dev = info->user_ptr[1]; 5231 struct station_parameters params; 5232 u8 *mac_addr; 5233 int err; 5234 5235 memset(¶ms, 0, sizeof(params)); 5236 5237 if (!rdev->ops->change_station) 5238 return -EOPNOTSUPP; 5239 5240 /* 5241 * AID and listen_interval properties can be set only for unassociated 5242 * station. Include these parameters here and will check them in 5243 * cfg80211_check_station_change(). 5244 */ 5245 if (info->attrs[NL80211_ATTR_STA_AID]) 5246 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]); 5247 5248 if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]) 5249 params.listen_interval = 5250 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]); 5251 else 5252 params.listen_interval = -1; 5253 5254 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) 5255 params.support_p2p_ps = 5256 nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]); 5257 else 5258 params.support_p2p_ps = -1; 5259 5260 if (!info->attrs[NL80211_ATTR_MAC]) 5261 return -EINVAL; 5262 5263 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 5264 5265 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) { 5266 params.supported_rates = 5267 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 5268 params.supported_rates_len = 5269 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 5270 } 5271 5272 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) { 5273 params.capability = 5274 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]); 5275 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY; 5276 } 5277 5278 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) { 5279 params.ext_capab = 5280 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 5281 params.ext_capab_len = 5282 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 5283 } 5284 5285 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms)) 5286 return -EINVAL; 5287 5288 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) 5289 params.plink_action = 5290 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]); 5291 5292 if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) { 5293 params.plink_state = 5294 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]); 5295 if (info->attrs[NL80211_ATTR_MESH_PEER_AID]) 5296 params.peer_aid = nla_get_u16( 5297 info->attrs[NL80211_ATTR_MESH_PEER_AID]); 5298 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE; 5299 } 5300 5301 if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) 5302 params.local_pm = nla_get_u32( 5303 info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]); 5304 5305 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) { 5306 params.opmode_notif_used = true; 5307 params.opmode_notif = 5308 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]); 5309 } 5310 5311 /* Include parameters for TDLS peer (will check later) */ 5312 err = nl80211_set_station_tdls(info, ¶ms); 5313 if (err) 5314 return err; 5315 5316 params.vlan = get_vlan(info, rdev); 5317 if (IS_ERR(params.vlan)) 5318 return PTR_ERR(params.vlan); 5319 5320 switch (dev->ieee80211_ptr->iftype) { 5321 case NL80211_IFTYPE_AP: 5322 case NL80211_IFTYPE_AP_VLAN: 5323 case NL80211_IFTYPE_P2P_GO: 5324 case NL80211_IFTYPE_P2P_CLIENT: 5325 case NL80211_IFTYPE_STATION: 5326 case NL80211_IFTYPE_ADHOC: 5327 case NL80211_IFTYPE_MESH_POINT: 5328 break; 5329 default: 5330 err = -EOPNOTSUPP; 5331 goto out_put_vlan; 5332 } 5333 5334 /* driver will call cfg80211_check_station_change() */ 5335 err = rdev_change_station(rdev, dev, mac_addr, ¶ms); 5336 5337 out_put_vlan: 5338 if (params.vlan) 5339 dev_put(params.vlan); 5340 5341 return err; 5342 } 5343 5344 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info) 5345 { 5346 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5347 int err; 5348 struct net_device *dev = info->user_ptr[1]; 5349 struct station_parameters params; 5350 u8 *mac_addr = NULL; 5351 u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) | 5352 BIT(NL80211_STA_FLAG_ASSOCIATED); 5353 5354 memset(¶ms, 0, sizeof(params)); 5355 5356 if (!rdev->ops->add_station) 5357 return -EOPNOTSUPP; 5358 5359 if (!info->attrs[NL80211_ATTR_MAC]) 5360 return -EINVAL; 5361 5362 if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]) 5363 return -EINVAL; 5364 5365 if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) 5366 return -EINVAL; 5367 5368 if (!info->attrs[NL80211_ATTR_STA_AID] && 5369 !info->attrs[NL80211_ATTR_PEER_AID]) 5370 return -EINVAL; 5371 5372 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 5373 params.supported_rates = 5374 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 5375 params.supported_rates_len = 5376 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 5377 params.listen_interval = 5378 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]); 5379 5380 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) { 5381 params.support_p2p_ps = 5382 nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]); 5383 } else { 5384 /* 5385 * if not specified, assume it's supported for P2P GO interface, 5386 * and is NOT supported for AP interface 5387 */ 5388 params.support_p2p_ps = 5389 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO; 5390 } 5391 5392 if (info->attrs[NL80211_ATTR_PEER_AID]) 5393 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]); 5394 else 5395 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]); 5396 5397 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) { 5398 params.capability = 5399 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]); 5400 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY; 5401 } 5402 5403 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) { 5404 params.ext_capab = 5405 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 5406 params.ext_capab_len = 5407 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 5408 } 5409 5410 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) 5411 params.ht_capa = 5412 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]); 5413 5414 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) 5415 params.vht_capa = 5416 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]); 5417 5418 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) { 5419 params.he_capa = 5420 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 5421 params.he_capa_len = 5422 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 5423 5424 /* max len is validated in nla policy */ 5425 if (params.he_capa_len < NL80211_HE_MIN_CAPABILITY_LEN) 5426 return -EINVAL; 5427 } 5428 5429 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) { 5430 params.opmode_notif_used = true; 5431 params.opmode_notif = 5432 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]); 5433 } 5434 5435 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) 5436 params.plink_action = 5437 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]); 5438 5439 err = nl80211_parse_sta_channel_info(info, ¶ms); 5440 if (err) 5441 return err; 5442 5443 err = nl80211_parse_sta_wme(info, ¶ms); 5444 if (err) 5445 return err; 5446 5447 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms)) 5448 return -EINVAL; 5449 5450 /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT 5451 * as userspace might just pass through the capabilities from the IEs 5452 * directly, rather than enforcing this restriction and returning an 5453 * error in this case. 5454 */ 5455 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) { 5456 params.ht_capa = NULL; 5457 params.vht_capa = NULL; 5458 5459 /* HE requires WME */ 5460 if (params.he_capa_len) 5461 return -EINVAL; 5462 } 5463 5464 /* When you run into this, adjust the code below for the new flag */ 5465 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7); 5466 5467 switch (dev->ieee80211_ptr->iftype) { 5468 case NL80211_IFTYPE_AP: 5469 case NL80211_IFTYPE_AP_VLAN: 5470 case NL80211_IFTYPE_P2P_GO: 5471 /* ignore WME attributes if iface/sta is not capable */ 5472 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) || 5473 !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) 5474 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD; 5475 5476 /* TDLS peers cannot be added */ 5477 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) || 5478 info->attrs[NL80211_ATTR_PEER_AID]) 5479 return -EINVAL; 5480 /* but don't bother the driver with it */ 5481 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER); 5482 5483 /* allow authenticated/associated only if driver handles it */ 5484 if (!(rdev->wiphy.features & 5485 NL80211_FEATURE_FULL_AP_CLIENT_STATE) && 5486 params.sta_flags_mask & auth_assoc) 5487 return -EINVAL; 5488 5489 /* Older userspace, or userspace wanting to be compatible with 5490 * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth 5491 * and assoc flags in the mask, but assumes the station will be 5492 * added as associated anyway since this was the required driver 5493 * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was 5494 * introduced. 5495 * In order to not bother drivers with this quirk in the API 5496 * set the flags in both the mask and set for new stations in 5497 * this case. 5498 */ 5499 if (!(params.sta_flags_mask & auth_assoc)) { 5500 params.sta_flags_mask |= auth_assoc; 5501 params.sta_flags_set |= auth_assoc; 5502 } 5503 5504 /* must be last in here for error handling */ 5505 params.vlan = get_vlan(info, rdev); 5506 if (IS_ERR(params.vlan)) 5507 return PTR_ERR(params.vlan); 5508 break; 5509 case NL80211_IFTYPE_MESH_POINT: 5510 /* ignore uAPSD data */ 5511 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD; 5512 5513 /* associated is disallowed */ 5514 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED)) 5515 return -EINVAL; 5516 /* TDLS peers cannot be added */ 5517 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) || 5518 info->attrs[NL80211_ATTR_PEER_AID]) 5519 return -EINVAL; 5520 break; 5521 case NL80211_IFTYPE_STATION: 5522 case NL80211_IFTYPE_P2P_CLIENT: 5523 /* ignore uAPSD data */ 5524 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD; 5525 5526 /* these are disallowed */ 5527 if (params.sta_flags_mask & 5528 (BIT(NL80211_STA_FLAG_ASSOCIATED) | 5529 BIT(NL80211_STA_FLAG_AUTHENTICATED))) 5530 return -EINVAL; 5531 /* Only TDLS peers can be added */ 5532 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))) 5533 return -EINVAL; 5534 /* Can only add if TDLS ... */ 5535 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS)) 5536 return -EOPNOTSUPP; 5537 /* ... with external setup is supported */ 5538 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP)) 5539 return -EOPNOTSUPP; 5540 /* 5541 * Older wpa_supplicant versions always mark the TDLS peer 5542 * as authorized, but it shouldn't yet be. 5543 */ 5544 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED); 5545 break; 5546 default: 5547 return -EOPNOTSUPP; 5548 } 5549 5550 /* be aware of params.vlan when changing code here */ 5551 5552 err = rdev_add_station(rdev, dev, mac_addr, ¶ms); 5553 5554 if (params.vlan) 5555 dev_put(params.vlan); 5556 return err; 5557 } 5558 5559 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info) 5560 { 5561 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5562 struct net_device *dev = info->user_ptr[1]; 5563 struct station_del_parameters params; 5564 5565 memset(¶ms, 0, sizeof(params)); 5566 5567 if (info->attrs[NL80211_ATTR_MAC]) 5568 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]); 5569 5570 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 5571 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN && 5572 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT && 5573 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 5574 return -EINVAL; 5575 5576 if (!rdev->ops->del_station) 5577 return -EOPNOTSUPP; 5578 5579 if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) { 5580 params.subtype = 5581 nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]); 5582 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 && 5583 params.subtype != IEEE80211_STYPE_DEAUTH >> 4) 5584 return -EINVAL; 5585 } else { 5586 /* Default to Deauthentication frame */ 5587 params.subtype = IEEE80211_STYPE_DEAUTH >> 4; 5588 } 5589 5590 if (info->attrs[NL80211_ATTR_REASON_CODE]) { 5591 params.reason_code = 5592 nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 5593 if (params.reason_code == 0) 5594 return -EINVAL; /* 0 is reserved */ 5595 } else { 5596 /* Default to reason code 2 */ 5597 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID; 5598 } 5599 5600 return rdev_del_station(rdev, dev, ¶ms); 5601 } 5602 5603 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq, 5604 int flags, struct net_device *dev, 5605 u8 *dst, u8 *next_hop, 5606 struct mpath_info *pinfo) 5607 { 5608 void *hdr; 5609 struct nlattr *pinfoattr; 5610 5611 hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH); 5612 if (!hdr) 5613 return -1; 5614 5615 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 5616 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) || 5617 nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) || 5618 nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation)) 5619 goto nla_put_failure; 5620 5621 pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO); 5622 if (!pinfoattr) 5623 goto nla_put_failure; 5624 if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) && 5625 nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN, 5626 pinfo->frame_qlen)) 5627 goto nla_put_failure; 5628 if (((pinfo->filled & MPATH_INFO_SN) && 5629 nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) || 5630 ((pinfo->filled & MPATH_INFO_METRIC) && 5631 nla_put_u32(msg, NL80211_MPATH_INFO_METRIC, 5632 pinfo->metric)) || 5633 ((pinfo->filled & MPATH_INFO_EXPTIME) && 5634 nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME, 5635 pinfo->exptime)) || 5636 ((pinfo->filled & MPATH_INFO_FLAGS) && 5637 nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS, 5638 pinfo->flags)) || 5639 ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) && 5640 nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT, 5641 pinfo->discovery_timeout)) || 5642 ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) && 5643 nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES, 5644 pinfo->discovery_retries))) 5645 goto nla_put_failure; 5646 5647 nla_nest_end(msg, pinfoattr); 5648 5649 genlmsg_end(msg, hdr); 5650 return 0; 5651 5652 nla_put_failure: 5653 genlmsg_cancel(msg, hdr); 5654 return -EMSGSIZE; 5655 } 5656 5657 static int nl80211_dump_mpath(struct sk_buff *skb, 5658 struct netlink_callback *cb) 5659 { 5660 struct mpath_info pinfo; 5661 struct cfg80211_registered_device *rdev; 5662 struct wireless_dev *wdev; 5663 u8 dst[ETH_ALEN]; 5664 u8 next_hop[ETH_ALEN]; 5665 int path_idx = cb->args[2]; 5666 int err; 5667 5668 rtnl_lock(); 5669 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev); 5670 if (err) 5671 goto out_err; 5672 5673 if (!rdev->ops->dump_mpath) { 5674 err = -EOPNOTSUPP; 5675 goto out_err; 5676 } 5677 5678 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) { 5679 err = -EOPNOTSUPP; 5680 goto out_err; 5681 } 5682 5683 while (1) { 5684 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst, 5685 next_hop, &pinfo); 5686 if (err == -ENOENT) 5687 break; 5688 if (err) 5689 goto out_err; 5690 5691 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid, 5692 cb->nlh->nlmsg_seq, NLM_F_MULTI, 5693 wdev->netdev, dst, next_hop, 5694 &pinfo) < 0) 5695 goto out; 5696 5697 path_idx++; 5698 } 5699 5700 out: 5701 cb->args[2] = path_idx; 5702 err = skb->len; 5703 out_err: 5704 rtnl_unlock(); 5705 return err; 5706 } 5707 5708 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info) 5709 { 5710 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5711 int err; 5712 struct net_device *dev = info->user_ptr[1]; 5713 struct mpath_info pinfo; 5714 struct sk_buff *msg; 5715 u8 *dst = NULL; 5716 u8 next_hop[ETH_ALEN]; 5717 5718 memset(&pinfo, 0, sizeof(pinfo)); 5719 5720 if (!info->attrs[NL80211_ATTR_MAC]) 5721 return -EINVAL; 5722 5723 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 5724 5725 if (!rdev->ops->get_mpath) 5726 return -EOPNOTSUPP; 5727 5728 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 5729 return -EOPNOTSUPP; 5730 5731 err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo); 5732 if (err) 5733 return err; 5734 5735 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 5736 if (!msg) 5737 return -ENOMEM; 5738 5739 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0, 5740 dev, dst, next_hop, &pinfo) < 0) { 5741 nlmsg_free(msg); 5742 return -ENOBUFS; 5743 } 5744 5745 return genlmsg_reply(msg, info); 5746 } 5747 5748 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info) 5749 { 5750 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5751 struct net_device *dev = info->user_ptr[1]; 5752 u8 *dst = NULL; 5753 u8 *next_hop = NULL; 5754 5755 if (!info->attrs[NL80211_ATTR_MAC]) 5756 return -EINVAL; 5757 5758 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]) 5759 return -EINVAL; 5760 5761 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 5762 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]); 5763 5764 if (!rdev->ops->change_mpath) 5765 return -EOPNOTSUPP; 5766 5767 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 5768 return -EOPNOTSUPP; 5769 5770 return rdev_change_mpath(rdev, dev, dst, next_hop); 5771 } 5772 5773 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info) 5774 { 5775 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5776 struct net_device *dev = info->user_ptr[1]; 5777 u8 *dst = NULL; 5778 u8 *next_hop = NULL; 5779 5780 if (!info->attrs[NL80211_ATTR_MAC]) 5781 return -EINVAL; 5782 5783 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]) 5784 return -EINVAL; 5785 5786 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 5787 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]); 5788 5789 if (!rdev->ops->add_mpath) 5790 return -EOPNOTSUPP; 5791 5792 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 5793 return -EOPNOTSUPP; 5794 5795 return rdev_add_mpath(rdev, dev, dst, next_hop); 5796 } 5797 5798 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info) 5799 { 5800 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5801 struct net_device *dev = info->user_ptr[1]; 5802 u8 *dst = NULL; 5803 5804 if (info->attrs[NL80211_ATTR_MAC]) 5805 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 5806 5807 if (!rdev->ops->del_mpath) 5808 return -EOPNOTSUPP; 5809 5810 return rdev_del_mpath(rdev, dev, dst); 5811 } 5812 5813 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info) 5814 { 5815 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5816 int err; 5817 struct net_device *dev = info->user_ptr[1]; 5818 struct mpath_info pinfo; 5819 struct sk_buff *msg; 5820 u8 *dst = NULL; 5821 u8 mpp[ETH_ALEN]; 5822 5823 memset(&pinfo, 0, sizeof(pinfo)); 5824 5825 if (!info->attrs[NL80211_ATTR_MAC]) 5826 return -EINVAL; 5827 5828 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 5829 5830 if (!rdev->ops->get_mpp) 5831 return -EOPNOTSUPP; 5832 5833 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 5834 return -EOPNOTSUPP; 5835 5836 err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo); 5837 if (err) 5838 return err; 5839 5840 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 5841 if (!msg) 5842 return -ENOMEM; 5843 5844 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0, 5845 dev, dst, mpp, &pinfo) < 0) { 5846 nlmsg_free(msg); 5847 return -ENOBUFS; 5848 } 5849 5850 return genlmsg_reply(msg, info); 5851 } 5852 5853 static int nl80211_dump_mpp(struct sk_buff *skb, 5854 struct netlink_callback *cb) 5855 { 5856 struct mpath_info pinfo; 5857 struct cfg80211_registered_device *rdev; 5858 struct wireless_dev *wdev; 5859 u8 dst[ETH_ALEN]; 5860 u8 mpp[ETH_ALEN]; 5861 int path_idx = cb->args[2]; 5862 int err; 5863 5864 rtnl_lock(); 5865 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev); 5866 if (err) 5867 goto out_err; 5868 5869 if (!rdev->ops->dump_mpp) { 5870 err = -EOPNOTSUPP; 5871 goto out_err; 5872 } 5873 5874 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) { 5875 err = -EOPNOTSUPP; 5876 goto out_err; 5877 } 5878 5879 while (1) { 5880 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst, 5881 mpp, &pinfo); 5882 if (err == -ENOENT) 5883 break; 5884 if (err) 5885 goto out_err; 5886 5887 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid, 5888 cb->nlh->nlmsg_seq, NLM_F_MULTI, 5889 wdev->netdev, dst, mpp, 5890 &pinfo) < 0) 5891 goto out; 5892 5893 path_idx++; 5894 } 5895 5896 out: 5897 cb->args[2] = path_idx; 5898 err = skb->len; 5899 out_err: 5900 rtnl_unlock(); 5901 return err; 5902 } 5903 5904 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info) 5905 { 5906 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5907 struct net_device *dev = info->user_ptr[1]; 5908 struct wireless_dev *wdev = dev->ieee80211_ptr; 5909 struct bss_parameters params; 5910 int err; 5911 5912 memset(¶ms, 0, sizeof(params)); 5913 /* default to not changing parameters */ 5914 params.use_cts_prot = -1; 5915 params.use_short_preamble = -1; 5916 params.use_short_slot_time = -1; 5917 params.ap_isolate = -1; 5918 params.ht_opmode = -1; 5919 params.p2p_ctwindow = -1; 5920 params.p2p_opp_ps = -1; 5921 5922 if (info->attrs[NL80211_ATTR_BSS_CTS_PROT]) 5923 params.use_cts_prot = 5924 nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]); 5925 if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]) 5926 params.use_short_preamble = 5927 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]); 5928 if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]) 5929 params.use_short_slot_time = 5930 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]); 5931 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) { 5932 params.basic_rates = 5933 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 5934 params.basic_rates_len = 5935 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 5936 } 5937 if (info->attrs[NL80211_ATTR_AP_ISOLATE]) 5938 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]); 5939 if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE]) 5940 params.ht_opmode = 5941 nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]); 5942 5943 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) { 5944 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 5945 return -EINVAL; 5946 params.p2p_ctwindow = 5947 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]); 5948 if (params.p2p_ctwindow != 0 && 5949 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) 5950 return -EINVAL; 5951 } 5952 5953 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) { 5954 u8 tmp; 5955 5956 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 5957 return -EINVAL; 5958 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]); 5959 params.p2p_opp_ps = tmp; 5960 if (params.p2p_opp_ps && 5961 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) 5962 return -EINVAL; 5963 } 5964 5965 if (!rdev->ops->change_bss) 5966 return -EOPNOTSUPP; 5967 5968 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 5969 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 5970 return -EOPNOTSUPP; 5971 5972 wdev_lock(wdev); 5973 err = rdev_change_bss(rdev, dev, ¶ms); 5974 wdev_unlock(wdev); 5975 5976 return err; 5977 } 5978 5979 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info) 5980 { 5981 char *data = NULL; 5982 bool is_indoor; 5983 enum nl80211_user_reg_hint_type user_reg_hint_type; 5984 u32 owner_nlportid; 5985 5986 /* 5987 * You should only get this when cfg80211 hasn't yet initialized 5988 * completely when built-in to the kernel right between the time 5989 * window between nl80211_init() and regulatory_init(), if that is 5990 * even possible. 5991 */ 5992 if (unlikely(!rcu_access_pointer(cfg80211_regdomain))) 5993 return -EINPROGRESS; 5994 5995 if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]) 5996 user_reg_hint_type = 5997 nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]); 5998 else 5999 user_reg_hint_type = NL80211_USER_REG_HINT_USER; 6000 6001 switch (user_reg_hint_type) { 6002 case NL80211_USER_REG_HINT_USER: 6003 case NL80211_USER_REG_HINT_CELL_BASE: 6004 if (!info->attrs[NL80211_ATTR_REG_ALPHA2]) 6005 return -EINVAL; 6006 6007 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]); 6008 return regulatory_hint_user(data, user_reg_hint_type); 6009 case NL80211_USER_REG_HINT_INDOOR: 6010 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 6011 owner_nlportid = info->snd_portid; 6012 is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR]; 6013 } else { 6014 owner_nlportid = 0; 6015 is_indoor = true; 6016 } 6017 6018 return regulatory_hint_indoor(is_indoor, owner_nlportid); 6019 default: 6020 return -EINVAL; 6021 } 6022 } 6023 6024 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info) 6025 { 6026 return reg_reload_regdb(); 6027 } 6028 6029 static int nl80211_get_mesh_config(struct sk_buff *skb, 6030 struct genl_info *info) 6031 { 6032 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6033 struct net_device *dev = info->user_ptr[1]; 6034 struct wireless_dev *wdev = dev->ieee80211_ptr; 6035 struct mesh_config cur_params; 6036 int err = 0; 6037 void *hdr; 6038 struct nlattr *pinfoattr; 6039 struct sk_buff *msg; 6040 6041 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) 6042 return -EOPNOTSUPP; 6043 6044 if (!rdev->ops->get_mesh_config) 6045 return -EOPNOTSUPP; 6046 6047 wdev_lock(wdev); 6048 /* If not connected, get default parameters */ 6049 if (!wdev->mesh_id_len) 6050 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params)); 6051 else 6052 err = rdev_get_mesh_config(rdev, dev, &cur_params); 6053 wdev_unlock(wdev); 6054 6055 if (err) 6056 return err; 6057 6058 /* Draw up a netlink message to send back */ 6059 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 6060 if (!msg) 6061 return -ENOMEM; 6062 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 6063 NL80211_CMD_GET_MESH_CONFIG); 6064 if (!hdr) 6065 goto out; 6066 pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG); 6067 if (!pinfoattr) 6068 goto nla_put_failure; 6069 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 6070 nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT, 6071 cur_params.dot11MeshRetryTimeout) || 6072 nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT, 6073 cur_params.dot11MeshConfirmTimeout) || 6074 nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT, 6075 cur_params.dot11MeshHoldingTimeout) || 6076 nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS, 6077 cur_params.dot11MeshMaxPeerLinks) || 6078 nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES, 6079 cur_params.dot11MeshMaxRetries) || 6080 nla_put_u8(msg, NL80211_MESHCONF_TTL, 6081 cur_params.dot11MeshTTL) || 6082 nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL, 6083 cur_params.element_ttl) || 6084 nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS, 6085 cur_params.auto_open_plinks) || 6086 nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR, 6087 cur_params.dot11MeshNbrOffsetMaxNeighbor) || 6088 nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES, 6089 cur_params.dot11MeshHWMPmaxPREQretries) || 6090 nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME, 6091 cur_params.path_refresh_time) || 6092 nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT, 6093 cur_params.min_discovery_timeout) || 6094 nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT, 6095 cur_params.dot11MeshHWMPactivePathTimeout) || 6096 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL, 6097 cur_params.dot11MeshHWMPpreqMinInterval) || 6098 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL, 6099 cur_params.dot11MeshHWMPperrMinInterval) || 6100 nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME, 6101 cur_params.dot11MeshHWMPnetDiameterTraversalTime) || 6102 nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE, 6103 cur_params.dot11MeshHWMPRootMode) || 6104 nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL, 6105 cur_params.dot11MeshHWMPRannInterval) || 6106 nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS, 6107 cur_params.dot11MeshGateAnnouncementProtocol) || 6108 nla_put_u8(msg, NL80211_MESHCONF_FORWARDING, 6109 cur_params.dot11MeshForwarding) || 6110 nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD, 6111 cur_params.rssi_threshold) || 6112 nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE, 6113 cur_params.ht_opmode) || 6114 nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT, 6115 cur_params.dot11MeshHWMPactivePathToRootTimeout) || 6116 nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL, 6117 cur_params.dot11MeshHWMProotInterval) || 6118 nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL, 6119 cur_params.dot11MeshHWMPconfirmationInterval) || 6120 nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE, 6121 cur_params.power_mode) || 6122 nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW, 6123 cur_params.dot11MeshAwakeWindowDuration) || 6124 nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT, 6125 cur_params.plink_timeout)) 6126 goto nla_put_failure; 6127 nla_nest_end(msg, pinfoattr); 6128 genlmsg_end(msg, hdr); 6129 return genlmsg_reply(msg, info); 6130 6131 nla_put_failure: 6132 out: 6133 nlmsg_free(msg); 6134 return -ENOBUFS; 6135 } 6136 6137 static const struct nla_policy 6138 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = { 6139 [NL80211_MESHCONF_RETRY_TIMEOUT] = 6140 NLA_POLICY_RANGE(NLA_U16, 1, 255), 6141 [NL80211_MESHCONF_CONFIRM_TIMEOUT] = 6142 NLA_POLICY_RANGE(NLA_U16, 1, 255), 6143 [NL80211_MESHCONF_HOLDING_TIMEOUT] = 6144 NLA_POLICY_RANGE(NLA_U16, 1, 255), 6145 [NL80211_MESHCONF_MAX_PEER_LINKS] = 6146 NLA_POLICY_RANGE(NLA_U16, 0, 255), 6147 [NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16), 6148 [NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1), 6149 [NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1), 6150 [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1), 6151 [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = 6152 NLA_POLICY_RANGE(NLA_U32, 1, 255), 6153 [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 }, 6154 [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 }, 6155 [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1), 6156 [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 }, 6157 [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = 6158 NLA_POLICY_MIN(NLA_U16, 1), 6159 [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = 6160 NLA_POLICY_MIN(NLA_U16, 1), 6161 [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = 6162 NLA_POLICY_MIN(NLA_U16, 1), 6163 [NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4), 6164 [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = 6165 NLA_POLICY_MIN(NLA_U16, 1), 6166 [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1), 6167 [NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1), 6168 [NL80211_MESHCONF_RSSI_THRESHOLD] = 6169 NLA_POLICY_RANGE(NLA_S32, -255, 0), 6170 [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 }, 6171 [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 }, 6172 [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = 6173 NLA_POLICY_MIN(NLA_U16, 1), 6174 [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = 6175 NLA_POLICY_MIN(NLA_U16, 1), 6176 [NL80211_MESHCONF_POWER_MODE] = 6177 NLA_POLICY_RANGE(NLA_U32, 6178 NL80211_MESH_POWER_ACTIVE, 6179 NL80211_MESH_POWER_MAX), 6180 [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 }, 6181 [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 }, 6182 }; 6183 6184 static const struct nla_policy 6185 nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = { 6186 [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 }, 6187 [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 }, 6188 [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 }, 6189 [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG }, 6190 [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 }, 6191 [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG }, 6192 [NL80211_MESH_SETUP_IE] = 6193 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr, 6194 IEEE80211_MAX_DATA_LEN), 6195 [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG }, 6196 }; 6197 6198 static int nl80211_parse_mesh_config(struct genl_info *info, 6199 struct mesh_config *cfg, 6200 u32 *mask_out) 6201 { 6202 struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1]; 6203 u32 mask = 0; 6204 u16 ht_opmode; 6205 6206 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn) \ 6207 do { \ 6208 if (tb[attr]) { \ 6209 cfg->param = fn(tb[attr]); \ 6210 mask |= BIT((attr) - 1); \ 6211 } \ 6212 } while (0) 6213 6214 if (!info->attrs[NL80211_ATTR_MESH_CONFIG]) 6215 return -EINVAL; 6216 if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX, 6217 info->attrs[NL80211_ATTR_MESH_CONFIG], 6218 nl80211_meshconf_params_policy, info->extack)) 6219 return -EINVAL; 6220 6221 /* This makes sure that there aren't more than 32 mesh config 6222 * parameters (otherwise our bitfield scheme would not work.) */ 6223 BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32); 6224 6225 /* Fill in the params struct */ 6226 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask, 6227 NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16); 6228 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask, 6229 NL80211_MESHCONF_CONFIRM_TIMEOUT, 6230 nla_get_u16); 6231 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask, 6232 NL80211_MESHCONF_HOLDING_TIMEOUT, 6233 nla_get_u16); 6234 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask, 6235 NL80211_MESHCONF_MAX_PEER_LINKS, 6236 nla_get_u16); 6237 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask, 6238 NL80211_MESHCONF_MAX_RETRIES, nla_get_u8); 6239 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask, 6240 NL80211_MESHCONF_TTL, nla_get_u8); 6241 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask, 6242 NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8); 6243 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask, 6244 NL80211_MESHCONF_AUTO_OPEN_PLINKS, 6245 nla_get_u8); 6246 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor, 6247 mask, 6248 NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR, 6249 nla_get_u32); 6250 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask, 6251 NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES, 6252 nla_get_u8); 6253 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask, 6254 NL80211_MESHCONF_PATH_REFRESH_TIME, 6255 nla_get_u32); 6256 if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) && 6257 (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535)) 6258 return -EINVAL; 6259 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask, 6260 NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT, 6261 nla_get_u16); 6262 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout, 6263 mask, 6264 NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT, 6265 nla_get_u32); 6266 if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) && 6267 (cfg->dot11MeshHWMPactivePathTimeout < 1 || 6268 cfg->dot11MeshHWMPactivePathTimeout > 65535)) 6269 return -EINVAL; 6270 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask, 6271 NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL, 6272 nla_get_u16); 6273 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask, 6274 NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL, 6275 nla_get_u16); 6276 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, 6277 dot11MeshHWMPnetDiameterTraversalTime, mask, 6278 NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME, 6279 nla_get_u16); 6280 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask, 6281 NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8); 6282 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask, 6283 NL80211_MESHCONF_HWMP_RANN_INTERVAL, 6284 nla_get_u16); 6285 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol, 6286 mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS, 6287 nla_get_u8); 6288 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask, 6289 NL80211_MESHCONF_FORWARDING, nla_get_u8); 6290 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask, 6291 NL80211_MESHCONF_RSSI_THRESHOLD, 6292 nla_get_s32); 6293 /* 6294 * Check HT operation mode based on 6295 * IEEE 802.11-2016 9.4.2.57 HT Operation element. 6296 */ 6297 if (tb[NL80211_MESHCONF_HT_OPMODE]) { 6298 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]); 6299 6300 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION | 6301 IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT | 6302 IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)) 6303 return -EINVAL; 6304 6305 /* NON_HT_STA bit is reserved, but some programs set it */ 6306 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT; 6307 6308 cfg->ht_opmode = ht_opmode; 6309 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1)); 6310 } 6311 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, 6312 dot11MeshHWMPactivePathToRootTimeout, mask, 6313 NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT, 6314 nla_get_u32); 6315 if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) && 6316 (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 || 6317 cfg->dot11MeshHWMPactivePathToRootTimeout > 65535)) 6318 return -EINVAL; 6319 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask, 6320 NL80211_MESHCONF_HWMP_ROOT_INTERVAL, 6321 nla_get_u16); 6322 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval, 6323 mask, 6324 NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL, 6325 nla_get_u16); 6326 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask, 6327 NL80211_MESHCONF_POWER_MODE, nla_get_u32); 6328 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask, 6329 NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16); 6330 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask, 6331 NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32); 6332 if (mask_out) 6333 *mask_out = mask; 6334 6335 return 0; 6336 6337 #undef FILL_IN_MESH_PARAM_IF_SET 6338 } 6339 6340 static int nl80211_parse_mesh_setup(struct genl_info *info, 6341 struct mesh_setup *setup) 6342 { 6343 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6344 struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1]; 6345 6346 if (!info->attrs[NL80211_ATTR_MESH_SETUP]) 6347 return -EINVAL; 6348 if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX, 6349 info->attrs[NL80211_ATTR_MESH_SETUP], 6350 nl80211_mesh_setup_params_policy, info->extack)) 6351 return -EINVAL; 6352 6353 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC]) 6354 setup->sync_method = 6355 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ? 6356 IEEE80211_SYNC_METHOD_VENDOR : 6357 IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET; 6358 6359 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL]) 6360 setup->path_sel_proto = 6361 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ? 6362 IEEE80211_PATH_PROTOCOL_VENDOR : 6363 IEEE80211_PATH_PROTOCOL_HWMP; 6364 6365 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC]) 6366 setup->path_metric = 6367 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ? 6368 IEEE80211_PATH_METRIC_VENDOR : 6369 IEEE80211_PATH_METRIC_AIRTIME; 6370 6371 if (tb[NL80211_MESH_SETUP_IE]) { 6372 struct nlattr *ieattr = 6373 tb[NL80211_MESH_SETUP_IE]; 6374 setup->ie = nla_data(ieattr); 6375 setup->ie_len = nla_len(ieattr); 6376 } 6377 if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] && 6378 !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM)) 6379 return -EINVAL; 6380 setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]); 6381 setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]); 6382 setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]); 6383 if (setup->is_secure) 6384 setup->user_mpm = true; 6385 6386 if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) { 6387 if (!setup->user_mpm) 6388 return -EINVAL; 6389 setup->auth_id = 6390 nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]); 6391 } 6392 6393 return 0; 6394 } 6395 6396 static int nl80211_update_mesh_config(struct sk_buff *skb, 6397 struct genl_info *info) 6398 { 6399 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6400 struct net_device *dev = info->user_ptr[1]; 6401 struct wireless_dev *wdev = dev->ieee80211_ptr; 6402 struct mesh_config cfg; 6403 u32 mask; 6404 int err; 6405 6406 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) 6407 return -EOPNOTSUPP; 6408 6409 if (!rdev->ops->update_mesh_config) 6410 return -EOPNOTSUPP; 6411 6412 err = nl80211_parse_mesh_config(info, &cfg, &mask); 6413 if (err) 6414 return err; 6415 6416 wdev_lock(wdev); 6417 if (!wdev->mesh_id_len) 6418 err = -ENOLINK; 6419 6420 if (!err) 6421 err = rdev_update_mesh_config(rdev, dev, mask, &cfg); 6422 6423 wdev_unlock(wdev); 6424 6425 return err; 6426 } 6427 6428 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom, 6429 struct sk_buff *msg) 6430 { 6431 struct nlattr *nl_reg_rules; 6432 unsigned int i; 6433 6434 if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) || 6435 (regdom->dfs_region && 6436 nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region))) 6437 goto nla_put_failure; 6438 6439 nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES); 6440 if (!nl_reg_rules) 6441 goto nla_put_failure; 6442 6443 for (i = 0; i < regdom->n_reg_rules; i++) { 6444 struct nlattr *nl_reg_rule; 6445 const struct ieee80211_reg_rule *reg_rule; 6446 const struct ieee80211_freq_range *freq_range; 6447 const struct ieee80211_power_rule *power_rule; 6448 unsigned int max_bandwidth_khz; 6449 6450 reg_rule = ®dom->reg_rules[i]; 6451 freq_range = ®_rule->freq_range; 6452 power_rule = ®_rule->power_rule; 6453 6454 nl_reg_rule = nla_nest_start(msg, i); 6455 if (!nl_reg_rule) 6456 goto nla_put_failure; 6457 6458 max_bandwidth_khz = freq_range->max_bandwidth_khz; 6459 if (!max_bandwidth_khz) 6460 max_bandwidth_khz = reg_get_max_bandwidth(regdom, 6461 reg_rule); 6462 6463 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS, 6464 reg_rule->flags) || 6465 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START, 6466 freq_range->start_freq_khz) || 6467 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END, 6468 freq_range->end_freq_khz) || 6469 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW, 6470 max_bandwidth_khz) || 6471 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN, 6472 power_rule->max_antenna_gain) || 6473 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP, 6474 power_rule->max_eirp) || 6475 nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME, 6476 reg_rule->dfs_cac_ms)) 6477 goto nla_put_failure; 6478 6479 nla_nest_end(msg, nl_reg_rule); 6480 } 6481 6482 nla_nest_end(msg, nl_reg_rules); 6483 return 0; 6484 6485 nla_put_failure: 6486 return -EMSGSIZE; 6487 } 6488 6489 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info) 6490 { 6491 const struct ieee80211_regdomain *regdom = NULL; 6492 struct cfg80211_registered_device *rdev; 6493 struct wiphy *wiphy = NULL; 6494 struct sk_buff *msg; 6495 void *hdr; 6496 6497 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 6498 if (!msg) 6499 return -ENOBUFS; 6500 6501 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 6502 NL80211_CMD_GET_REG); 6503 if (!hdr) 6504 goto put_failure; 6505 6506 if (info->attrs[NL80211_ATTR_WIPHY]) { 6507 bool self_managed; 6508 6509 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info); 6510 if (IS_ERR(rdev)) { 6511 nlmsg_free(msg); 6512 return PTR_ERR(rdev); 6513 } 6514 6515 wiphy = &rdev->wiphy; 6516 self_managed = wiphy->regulatory_flags & 6517 REGULATORY_WIPHY_SELF_MANAGED; 6518 regdom = get_wiphy_regdom(wiphy); 6519 6520 /* a self-managed-reg device must have a private regdom */ 6521 if (WARN_ON(!regdom && self_managed)) { 6522 nlmsg_free(msg); 6523 return -EINVAL; 6524 } 6525 6526 if (regdom && 6527 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy))) 6528 goto nla_put_failure; 6529 } 6530 6531 if (!wiphy && reg_last_request_cell_base() && 6532 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE, 6533 NL80211_USER_REG_HINT_CELL_BASE)) 6534 goto nla_put_failure; 6535 6536 rcu_read_lock(); 6537 6538 if (!regdom) 6539 regdom = rcu_dereference(cfg80211_regdomain); 6540 6541 if (nl80211_put_regdom(regdom, msg)) 6542 goto nla_put_failure_rcu; 6543 6544 rcu_read_unlock(); 6545 6546 genlmsg_end(msg, hdr); 6547 return genlmsg_reply(msg, info); 6548 6549 nla_put_failure_rcu: 6550 rcu_read_unlock(); 6551 nla_put_failure: 6552 put_failure: 6553 nlmsg_free(msg); 6554 return -EMSGSIZE; 6555 } 6556 6557 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb, 6558 u32 seq, int flags, struct wiphy *wiphy, 6559 const struct ieee80211_regdomain *regdom) 6560 { 6561 void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags, 6562 NL80211_CMD_GET_REG); 6563 6564 if (!hdr) 6565 return -1; 6566 6567 genl_dump_check_consistent(cb, hdr); 6568 6569 if (nl80211_put_regdom(regdom, msg)) 6570 goto nla_put_failure; 6571 6572 if (!wiphy && reg_last_request_cell_base() && 6573 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE, 6574 NL80211_USER_REG_HINT_CELL_BASE)) 6575 goto nla_put_failure; 6576 6577 if (wiphy && 6578 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy))) 6579 goto nla_put_failure; 6580 6581 if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED && 6582 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG)) 6583 goto nla_put_failure; 6584 6585 genlmsg_end(msg, hdr); 6586 return 0; 6587 6588 nla_put_failure: 6589 genlmsg_cancel(msg, hdr); 6590 return -EMSGSIZE; 6591 } 6592 6593 static int nl80211_get_reg_dump(struct sk_buff *skb, 6594 struct netlink_callback *cb) 6595 { 6596 const struct ieee80211_regdomain *regdom = NULL; 6597 struct cfg80211_registered_device *rdev; 6598 int err, reg_idx, start = cb->args[2]; 6599 6600 rtnl_lock(); 6601 6602 if (cfg80211_regdomain && start == 0) { 6603 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq, 6604 NLM_F_MULTI, NULL, 6605 rtnl_dereference(cfg80211_regdomain)); 6606 if (err < 0) 6607 goto out_err; 6608 } 6609 6610 /* the global regdom is idx 0 */ 6611 reg_idx = 1; 6612 list_for_each_entry(rdev, &cfg80211_rdev_list, list) { 6613 regdom = get_wiphy_regdom(&rdev->wiphy); 6614 if (!regdom) 6615 continue; 6616 6617 if (++reg_idx <= start) 6618 continue; 6619 6620 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq, 6621 NLM_F_MULTI, &rdev->wiphy, regdom); 6622 if (err < 0) { 6623 reg_idx--; 6624 break; 6625 } 6626 } 6627 6628 cb->args[2] = reg_idx; 6629 err = skb->len; 6630 out_err: 6631 rtnl_unlock(); 6632 return err; 6633 } 6634 6635 #ifdef CONFIG_CFG80211_CRDA_SUPPORT 6636 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = { 6637 [NL80211_ATTR_REG_RULE_FLAGS] = { .type = NLA_U32 }, 6638 [NL80211_ATTR_FREQ_RANGE_START] = { .type = NLA_U32 }, 6639 [NL80211_ATTR_FREQ_RANGE_END] = { .type = NLA_U32 }, 6640 [NL80211_ATTR_FREQ_RANGE_MAX_BW] = { .type = NLA_U32 }, 6641 [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN] = { .type = NLA_U32 }, 6642 [NL80211_ATTR_POWER_RULE_MAX_EIRP] = { .type = NLA_U32 }, 6643 [NL80211_ATTR_DFS_CAC_TIME] = { .type = NLA_U32 }, 6644 }; 6645 6646 static int parse_reg_rule(struct nlattr *tb[], 6647 struct ieee80211_reg_rule *reg_rule) 6648 { 6649 struct ieee80211_freq_range *freq_range = ®_rule->freq_range; 6650 struct ieee80211_power_rule *power_rule = ®_rule->power_rule; 6651 6652 if (!tb[NL80211_ATTR_REG_RULE_FLAGS]) 6653 return -EINVAL; 6654 if (!tb[NL80211_ATTR_FREQ_RANGE_START]) 6655 return -EINVAL; 6656 if (!tb[NL80211_ATTR_FREQ_RANGE_END]) 6657 return -EINVAL; 6658 if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]) 6659 return -EINVAL; 6660 if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]) 6661 return -EINVAL; 6662 6663 reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]); 6664 6665 freq_range->start_freq_khz = 6666 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]); 6667 freq_range->end_freq_khz = 6668 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]); 6669 freq_range->max_bandwidth_khz = 6670 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]); 6671 6672 power_rule->max_eirp = 6673 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]); 6674 6675 if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]) 6676 power_rule->max_antenna_gain = 6677 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]); 6678 6679 if (tb[NL80211_ATTR_DFS_CAC_TIME]) 6680 reg_rule->dfs_cac_ms = 6681 nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]); 6682 6683 return 0; 6684 } 6685 6686 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info) 6687 { 6688 struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1]; 6689 struct nlattr *nl_reg_rule; 6690 char *alpha2; 6691 int rem_reg_rules, r; 6692 u32 num_rules = 0, rule_idx = 0, size_of_regd; 6693 enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET; 6694 struct ieee80211_regdomain *rd; 6695 6696 if (!info->attrs[NL80211_ATTR_REG_ALPHA2]) 6697 return -EINVAL; 6698 6699 if (!info->attrs[NL80211_ATTR_REG_RULES]) 6700 return -EINVAL; 6701 6702 alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]); 6703 6704 if (info->attrs[NL80211_ATTR_DFS_REGION]) 6705 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]); 6706 6707 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES], 6708 rem_reg_rules) { 6709 num_rules++; 6710 if (num_rules > NL80211_MAX_SUPP_REG_RULES) 6711 return -EINVAL; 6712 } 6713 6714 if (!reg_is_valid_request(alpha2)) 6715 return -EINVAL; 6716 6717 size_of_regd = sizeof(struct ieee80211_regdomain) + 6718 num_rules * sizeof(struct ieee80211_reg_rule); 6719 6720 rd = kzalloc(size_of_regd, GFP_KERNEL); 6721 if (!rd) 6722 return -ENOMEM; 6723 6724 rd->n_reg_rules = num_rules; 6725 rd->alpha2[0] = alpha2[0]; 6726 rd->alpha2[1] = alpha2[1]; 6727 6728 /* 6729 * Disable DFS master mode if the DFS region was 6730 * not supported or known on this kernel. 6731 */ 6732 if (reg_supported_dfs_region(dfs_region)) 6733 rd->dfs_region = dfs_region; 6734 6735 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES], 6736 rem_reg_rules) { 6737 r = nla_parse_nested(tb, NL80211_REG_RULE_ATTR_MAX, 6738 nl_reg_rule, reg_rule_policy, 6739 info->extack); 6740 if (r) 6741 goto bad_reg; 6742 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]); 6743 if (r) 6744 goto bad_reg; 6745 6746 rule_idx++; 6747 6748 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) { 6749 r = -EINVAL; 6750 goto bad_reg; 6751 } 6752 } 6753 6754 /* set_regdom takes ownership of rd */ 6755 return set_regdom(rd, REGD_SOURCE_CRDA); 6756 bad_reg: 6757 kfree(rd); 6758 return r; 6759 } 6760 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */ 6761 6762 static int validate_scan_freqs(struct nlattr *freqs) 6763 { 6764 struct nlattr *attr1, *attr2; 6765 int n_channels = 0, tmp1, tmp2; 6766 6767 nla_for_each_nested(attr1, freqs, tmp1) 6768 if (nla_len(attr1) != sizeof(u32)) 6769 return 0; 6770 6771 nla_for_each_nested(attr1, freqs, tmp1) { 6772 n_channels++; 6773 /* 6774 * Some hardware has a limited channel list for 6775 * scanning, and it is pretty much nonsensical 6776 * to scan for a channel twice, so disallow that 6777 * and don't require drivers to check that the 6778 * channel list they get isn't longer than what 6779 * they can scan, as long as they can scan all 6780 * the channels they registered at once. 6781 */ 6782 nla_for_each_nested(attr2, freqs, tmp2) 6783 if (attr1 != attr2 && 6784 nla_get_u32(attr1) == nla_get_u32(attr2)) 6785 return 0; 6786 } 6787 6788 return n_channels; 6789 } 6790 6791 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b) 6792 { 6793 return b < NUM_NL80211_BANDS && wiphy->bands[b]; 6794 } 6795 6796 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy, 6797 struct cfg80211_bss_selection *bss_select) 6798 { 6799 struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1]; 6800 struct nlattr *nest; 6801 int err; 6802 bool found = false; 6803 int i; 6804 6805 /* only process one nested attribute */ 6806 nest = nla_data(nla); 6807 if (!nla_ok(nest, nla_len(nest))) 6808 return -EINVAL; 6809 6810 err = nla_parse_nested(attr, NL80211_BSS_SELECT_ATTR_MAX, nest, 6811 nl80211_bss_select_policy, NULL); 6812 if (err) 6813 return err; 6814 6815 /* only one attribute may be given */ 6816 for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) { 6817 if (attr[i]) { 6818 if (found) 6819 return -EINVAL; 6820 found = true; 6821 } 6822 } 6823 6824 bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID; 6825 6826 if (attr[NL80211_BSS_SELECT_ATTR_RSSI]) 6827 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI; 6828 6829 if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) { 6830 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF; 6831 bss_select->param.band_pref = 6832 nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]); 6833 if (!is_band_valid(wiphy, bss_select->param.band_pref)) 6834 return -EINVAL; 6835 } 6836 6837 if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) { 6838 struct nl80211_bss_select_rssi_adjust *adj_param; 6839 6840 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]); 6841 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST; 6842 bss_select->param.adjust.band = adj_param->band; 6843 bss_select->param.adjust.delta = adj_param->delta; 6844 if (!is_band_valid(wiphy, bss_select->param.adjust.band)) 6845 return -EINVAL; 6846 } 6847 6848 /* user-space did not provide behaviour attribute */ 6849 if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID) 6850 return -EINVAL; 6851 6852 if (!(wiphy->bss_select_support & BIT(bss_select->behaviour))) 6853 return -EINVAL; 6854 6855 return 0; 6856 } 6857 6858 static int nl80211_parse_random_mac(struct nlattr **attrs, 6859 u8 *mac_addr, u8 *mac_addr_mask) 6860 { 6861 int i; 6862 6863 if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) { 6864 eth_zero_addr(mac_addr); 6865 eth_zero_addr(mac_addr_mask); 6866 mac_addr[0] = 0x2; 6867 mac_addr_mask[0] = 0x3; 6868 6869 return 0; 6870 } 6871 6872 /* need both or none */ 6873 if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK]) 6874 return -EINVAL; 6875 6876 memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN); 6877 memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN); 6878 6879 /* don't allow or configure an mcast address */ 6880 if (!is_multicast_ether_addr(mac_addr_mask) || 6881 is_multicast_ether_addr(mac_addr)) 6882 return -EINVAL; 6883 6884 /* 6885 * allow users to pass a MAC address that has bits set outside 6886 * of the mask, but don't bother drivers with having to deal 6887 * with such bits 6888 */ 6889 for (i = 0; i < ETH_ALEN; i++) 6890 mac_addr[i] &= mac_addr_mask[i]; 6891 6892 return 0; 6893 } 6894 6895 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev) 6896 { 6897 ASSERT_WDEV_LOCK(wdev); 6898 6899 if (!cfg80211_beaconing_iface_active(wdev)) 6900 return true; 6901 6902 if (!(wdev->chandef.chan->flags & IEEE80211_CHAN_RADAR)) 6903 return true; 6904 6905 return regulatory_pre_cac_allowed(wdev->wiphy); 6906 } 6907 6908 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag, 6909 enum nl80211_ext_feature_index feat) 6910 { 6911 if (!(flags & flag)) 6912 return true; 6913 if (wiphy_ext_feature_isset(wiphy, feat)) 6914 return true; 6915 return false; 6916 } 6917 6918 static int 6919 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev, 6920 void *request, struct nlattr **attrs, 6921 bool is_sched_scan) 6922 { 6923 u8 *mac_addr, *mac_addr_mask; 6924 u32 *flags; 6925 enum nl80211_feature_flags randomness_flag; 6926 6927 if (!attrs[NL80211_ATTR_SCAN_FLAGS]) 6928 return 0; 6929 6930 if (is_sched_scan) { 6931 struct cfg80211_sched_scan_request *req = request; 6932 6933 randomness_flag = wdev ? 6934 NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR : 6935 NL80211_FEATURE_ND_RANDOM_MAC_ADDR; 6936 flags = &req->flags; 6937 mac_addr = req->mac_addr; 6938 mac_addr_mask = req->mac_addr_mask; 6939 } else { 6940 struct cfg80211_scan_request *req = request; 6941 6942 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR; 6943 flags = &req->flags; 6944 mac_addr = req->mac_addr; 6945 mac_addr_mask = req->mac_addr_mask; 6946 } 6947 6948 *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]); 6949 6950 if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) && 6951 !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) || 6952 !nl80211_check_scan_feat(wiphy, *flags, 6953 NL80211_SCAN_FLAG_LOW_SPAN, 6954 NL80211_EXT_FEATURE_LOW_SPAN_SCAN) || 6955 !nl80211_check_scan_feat(wiphy, *flags, 6956 NL80211_SCAN_FLAG_LOW_POWER, 6957 NL80211_EXT_FEATURE_LOW_POWER_SCAN) || 6958 !nl80211_check_scan_feat(wiphy, *flags, 6959 NL80211_SCAN_FLAG_HIGH_ACCURACY, 6960 NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) || 6961 !nl80211_check_scan_feat(wiphy, *flags, 6962 NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME, 6963 NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) || 6964 !nl80211_check_scan_feat(wiphy, *flags, 6965 NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP, 6966 NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) || 6967 !nl80211_check_scan_feat(wiphy, *flags, 6968 NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION, 6969 NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) || 6970 !nl80211_check_scan_feat(wiphy, *flags, 6971 NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE, 6972 NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) || 6973 !nl80211_check_scan_feat(wiphy, *flags, 6974 NL80211_SCAN_FLAG_RANDOM_SN, 6975 NL80211_EXT_FEATURE_SCAN_RANDOM_SN) || 6976 !nl80211_check_scan_feat(wiphy, *flags, 6977 NL80211_SCAN_FLAG_MIN_PREQ_CONTENT, 6978 NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT)) 6979 return -EOPNOTSUPP; 6980 6981 if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) { 6982 int err; 6983 6984 if (!(wiphy->features & randomness_flag) || 6985 (wdev && wdev->current_bss)) 6986 return -EOPNOTSUPP; 6987 6988 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask); 6989 if (err) 6990 return err; 6991 } 6992 6993 return 0; 6994 } 6995 6996 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info) 6997 { 6998 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6999 struct wireless_dev *wdev = info->user_ptr[1]; 7000 struct cfg80211_scan_request *request; 7001 struct nlattr *attr; 7002 struct wiphy *wiphy; 7003 int err, tmp, n_ssids = 0, n_channels, i; 7004 size_t ie_len; 7005 7006 wiphy = &rdev->wiphy; 7007 7008 if (wdev->iftype == NL80211_IFTYPE_NAN) 7009 return -EOPNOTSUPP; 7010 7011 if (!rdev->ops->scan) 7012 return -EOPNOTSUPP; 7013 7014 if (rdev->scan_req || rdev->scan_msg) { 7015 err = -EBUSY; 7016 goto unlock; 7017 } 7018 7019 if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) { 7020 n_channels = validate_scan_freqs( 7021 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]); 7022 if (!n_channels) { 7023 err = -EINVAL; 7024 goto unlock; 7025 } 7026 } else { 7027 n_channels = ieee80211_get_num_supported_channels(wiphy); 7028 } 7029 7030 if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) 7031 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) 7032 n_ssids++; 7033 7034 if (n_ssids > wiphy->max_scan_ssids) { 7035 err = -EINVAL; 7036 goto unlock; 7037 } 7038 7039 if (info->attrs[NL80211_ATTR_IE]) 7040 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 7041 else 7042 ie_len = 0; 7043 7044 if (ie_len > wiphy->max_scan_ie_len) { 7045 err = -EINVAL; 7046 goto unlock; 7047 } 7048 7049 request = kzalloc(sizeof(*request) 7050 + sizeof(*request->ssids) * n_ssids 7051 + sizeof(*request->channels) * n_channels 7052 + ie_len, GFP_KERNEL); 7053 if (!request) { 7054 err = -ENOMEM; 7055 goto unlock; 7056 } 7057 7058 if (n_ssids) 7059 request->ssids = (void *)&request->channels[n_channels]; 7060 request->n_ssids = n_ssids; 7061 if (ie_len) { 7062 if (n_ssids) 7063 request->ie = (void *)(request->ssids + n_ssids); 7064 else 7065 request->ie = (void *)(request->channels + n_channels); 7066 } 7067 7068 i = 0; 7069 if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) { 7070 /* user specified, bail out if channel not found */ 7071 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) { 7072 struct ieee80211_channel *chan; 7073 7074 chan = ieee80211_get_channel(wiphy, nla_get_u32(attr)); 7075 7076 if (!chan) { 7077 err = -EINVAL; 7078 goto out_free; 7079 } 7080 7081 /* ignore disabled channels */ 7082 if (chan->flags & IEEE80211_CHAN_DISABLED) 7083 continue; 7084 7085 request->channels[i] = chan; 7086 i++; 7087 } 7088 } else { 7089 enum nl80211_band band; 7090 7091 /* all channels */ 7092 for (band = 0; band < NUM_NL80211_BANDS; band++) { 7093 int j; 7094 7095 if (!wiphy->bands[band]) 7096 continue; 7097 for (j = 0; j < wiphy->bands[band]->n_channels; j++) { 7098 struct ieee80211_channel *chan; 7099 7100 chan = &wiphy->bands[band]->channels[j]; 7101 7102 if (chan->flags & IEEE80211_CHAN_DISABLED) 7103 continue; 7104 7105 request->channels[i] = chan; 7106 i++; 7107 } 7108 } 7109 } 7110 7111 if (!i) { 7112 err = -EINVAL; 7113 goto out_free; 7114 } 7115 7116 request->n_channels = i; 7117 7118 wdev_lock(wdev); 7119 if (!cfg80211_off_channel_oper_allowed(wdev)) { 7120 struct ieee80211_channel *chan; 7121 7122 if (request->n_channels != 1) { 7123 wdev_unlock(wdev); 7124 err = -EBUSY; 7125 goto out_free; 7126 } 7127 7128 chan = request->channels[0]; 7129 if (chan->center_freq != wdev->chandef.chan->center_freq) { 7130 wdev_unlock(wdev); 7131 err = -EBUSY; 7132 goto out_free; 7133 } 7134 } 7135 wdev_unlock(wdev); 7136 7137 i = 0; 7138 if (n_ssids) { 7139 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) { 7140 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) { 7141 err = -EINVAL; 7142 goto out_free; 7143 } 7144 request->ssids[i].ssid_len = nla_len(attr); 7145 memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr)); 7146 i++; 7147 } 7148 } 7149 7150 if (info->attrs[NL80211_ATTR_IE]) { 7151 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 7152 memcpy((void *)request->ie, 7153 nla_data(info->attrs[NL80211_ATTR_IE]), 7154 request->ie_len); 7155 } 7156 7157 for (i = 0; i < NUM_NL80211_BANDS; i++) 7158 if (wiphy->bands[i]) 7159 request->rates[i] = 7160 (1 << wiphy->bands[i]->n_bitrates) - 1; 7161 7162 if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) { 7163 nla_for_each_nested(attr, 7164 info->attrs[NL80211_ATTR_SCAN_SUPP_RATES], 7165 tmp) { 7166 enum nl80211_band band = nla_type(attr); 7167 7168 if (band < 0 || band >= NUM_NL80211_BANDS) { 7169 err = -EINVAL; 7170 goto out_free; 7171 } 7172 7173 if (!wiphy->bands[band]) 7174 continue; 7175 7176 err = ieee80211_get_ratemask(wiphy->bands[band], 7177 nla_data(attr), 7178 nla_len(attr), 7179 &request->rates[band]); 7180 if (err) 7181 goto out_free; 7182 } 7183 } 7184 7185 if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) { 7186 if (!wiphy_ext_feature_isset(wiphy, 7187 NL80211_EXT_FEATURE_SET_SCAN_DWELL)) { 7188 err = -EOPNOTSUPP; 7189 goto out_free; 7190 } 7191 7192 request->duration = 7193 nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]); 7194 request->duration_mandatory = 7195 nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]); 7196 } 7197 7198 err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs, 7199 false); 7200 if (err) 7201 goto out_free; 7202 7203 request->no_cck = 7204 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]); 7205 7206 /* Initial implementation used NL80211_ATTR_MAC to set the specific 7207 * BSSID to scan for. This was problematic because that same attribute 7208 * was already used for another purpose (local random MAC address). The 7209 * NL80211_ATTR_BSSID attribute was added to fix this. For backwards 7210 * compatibility with older userspace components, also use the 7211 * NL80211_ATTR_MAC value here if it can be determined to be used for 7212 * the specific BSSID use case instead of the random MAC address 7213 * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use). 7214 */ 7215 if (info->attrs[NL80211_ATTR_BSSID]) 7216 memcpy(request->bssid, 7217 nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN); 7218 else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) && 7219 info->attrs[NL80211_ATTR_MAC]) 7220 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]), 7221 ETH_ALEN); 7222 else 7223 eth_broadcast_addr(request->bssid); 7224 7225 request->wdev = wdev; 7226 request->wiphy = &rdev->wiphy; 7227 request->scan_start = jiffies; 7228 7229 rdev->scan_req = request; 7230 err = rdev_scan(rdev, request); 7231 7232 if (!err) { 7233 nl80211_send_scan_start(rdev, wdev); 7234 if (wdev->netdev) 7235 dev_hold(wdev->netdev); 7236 } else { 7237 out_free: 7238 rdev->scan_req = NULL; 7239 kfree(request); 7240 } 7241 7242 unlock: 7243 return err; 7244 } 7245 7246 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info) 7247 { 7248 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7249 struct wireless_dev *wdev = info->user_ptr[1]; 7250 7251 if (!rdev->ops->abort_scan) 7252 return -EOPNOTSUPP; 7253 7254 if (rdev->scan_msg) 7255 return 0; 7256 7257 if (!rdev->scan_req) 7258 return -ENOENT; 7259 7260 rdev_abort_scan(rdev, wdev); 7261 return 0; 7262 } 7263 7264 static int 7265 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans, 7266 struct cfg80211_sched_scan_request *request, 7267 struct nlattr **attrs) 7268 { 7269 int tmp, err, i = 0; 7270 struct nlattr *attr; 7271 7272 if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) { 7273 u32 interval; 7274 7275 /* 7276 * If scan plans are not specified, 7277 * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this 7278 * case one scan plan will be set with the specified scan 7279 * interval and infinite number of iterations. 7280 */ 7281 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]); 7282 if (!interval) 7283 return -EINVAL; 7284 7285 request->scan_plans[0].interval = 7286 DIV_ROUND_UP(interval, MSEC_PER_SEC); 7287 if (!request->scan_plans[0].interval) 7288 return -EINVAL; 7289 7290 if (request->scan_plans[0].interval > 7291 wiphy->max_sched_scan_plan_interval) 7292 request->scan_plans[0].interval = 7293 wiphy->max_sched_scan_plan_interval; 7294 7295 return 0; 7296 } 7297 7298 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) { 7299 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1]; 7300 7301 if (WARN_ON(i >= n_plans)) 7302 return -EINVAL; 7303 7304 err = nla_parse_nested(plan, NL80211_SCHED_SCAN_PLAN_MAX, 7305 attr, nl80211_plan_policy, NULL); 7306 if (err) 7307 return err; 7308 7309 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]) 7310 return -EINVAL; 7311 7312 request->scan_plans[i].interval = 7313 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]); 7314 if (!request->scan_plans[i].interval || 7315 request->scan_plans[i].interval > 7316 wiphy->max_sched_scan_plan_interval) 7317 return -EINVAL; 7318 7319 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) { 7320 request->scan_plans[i].iterations = 7321 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]); 7322 if (!request->scan_plans[i].iterations || 7323 (request->scan_plans[i].iterations > 7324 wiphy->max_sched_scan_plan_iterations)) 7325 return -EINVAL; 7326 } else if (i < n_plans - 1) { 7327 /* 7328 * All scan plans but the last one must specify 7329 * a finite number of iterations 7330 */ 7331 return -EINVAL; 7332 } 7333 7334 i++; 7335 } 7336 7337 /* 7338 * The last scan plan must not specify the number of 7339 * iterations, it is supposed to run infinitely 7340 */ 7341 if (request->scan_plans[n_plans - 1].iterations) 7342 return -EINVAL; 7343 7344 return 0; 7345 } 7346 7347 static struct cfg80211_sched_scan_request * 7348 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev, 7349 struct nlattr **attrs, int max_match_sets) 7350 { 7351 struct cfg80211_sched_scan_request *request; 7352 struct nlattr *attr; 7353 int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0; 7354 enum nl80211_band band; 7355 size_t ie_len; 7356 struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1]; 7357 s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF; 7358 7359 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) { 7360 n_channels = validate_scan_freqs( 7361 attrs[NL80211_ATTR_SCAN_FREQUENCIES]); 7362 if (!n_channels) 7363 return ERR_PTR(-EINVAL); 7364 } else { 7365 n_channels = ieee80211_get_num_supported_channels(wiphy); 7366 } 7367 7368 if (attrs[NL80211_ATTR_SCAN_SSIDS]) 7369 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS], 7370 tmp) 7371 n_ssids++; 7372 7373 if (n_ssids > wiphy->max_sched_scan_ssids) 7374 return ERR_PTR(-EINVAL); 7375 7376 /* 7377 * First, count the number of 'real' matchsets. Due to an issue with 7378 * the old implementation, matchsets containing only the RSSI attribute 7379 * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default' 7380 * RSSI for all matchsets, rather than their own matchset for reporting 7381 * all APs with a strong RSSI. This is needed to be compatible with 7382 * older userspace that treated a matchset with only the RSSI as the 7383 * global RSSI for all other matchsets - if there are other matchsets. 7384 */ 7385 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) { 7386 nla_for_each_nested(attr, 7387 attrs[NL80211_ATTR_SCHED_SCAN_MATCH], 7388 tmp) { 7389 struct nlattr *rssi; 7390 7391 err = nla_parse_nested(tb, 7392 NL80211_SCHED_SCAN_MATCH_ATTR_MAX, 7393 attr, nl80211_match_policy, 7394 NULL); 7395 if (err) 7396 return ERR_PTR(err); 7397 7398 /* SSID and BSSID are mutually exclusive */ 7399 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] && 7400 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) 7401 return ERR_PTR(-EINVAL); 7402 7403 /* add other standalone attributes here */ 7404 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] || 7405 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) { 7406 n_match_sets++; 7407 continue; 7408 } 7409 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI]; 7410 if (rssi) 7411 default_match_rssi = nla_get_s32(rssi); 7412 } 7413 } 7414 7415 /* However, if there's no other matchset, add the RSSI one */ 7416 if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF) 7417 n_match_sets = 1; 7418 7419 if (n_match_sets > max_match_sets) 7420 return ERR_PTR(-EINVAL); 7421 7422 if (attrs[NL80211_ATTR_IE]) 7423 ie_len = nla_len(attrs[NL80211_ATTR_IE]); 7424 else 7425 ie_len = 0; 7426 7427 if (ie_len > wiphy->max_sched_scan_ie_len) 7428 return ERR_PTR(-EINVAL); 7429 7430 if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) { 7431 /* 7432 * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since 7433 * each scan plan already specifies its own interval 7434 */ 7435 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]) 7436 return ERR_PTR(-EINVAL); 7437 7438 nla_for_each_nested(attr, 7439 attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) 7440 n_plans++; 7441 } else { 7442 /* 7443 * The scan interval attribute is kept for backward 7444 * compatibility. If no scan plans are specified and sched scan 7445 * interval is specified, one scan plan will be set with this 7446 * scan interval and infinite number of iterations. 7447 */ 7448 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]) 7449 return ERR_PTR(-EINVAL); 7450 7451 n_plans = 1; 7452 } 7453 7454 if (!n_plans || n_plans > wiphy->max_sched_scan_plans) 7455 return ERR_PTR(-EINVAL); 7456 7457 if (!wiphy_ext_feature_isset( 7458 wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) && 7459 (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] || 7460 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST])) 7461 return ERR_PTR(-EINVAL); 7462 7463 request = kzalloc(sizeof(*request) 7464 + sizeof(*request->ssids) * n_ssids 7465 + sizeof(*request->match_sets) * n_match_sets 7466 + sizeof(*request->scan_plans) * n_plans 7467 + sizeof(*request->channels) * n_channels 7468 + ie_len, GFP_KERNEL); 7469 if (!request) 7470 return ERR_PTR(-ENOMEM); 7471 7472 if (n_ssids) 7473 request->ssids = (void *)&request->channels[n_channels]; 7474 request->n_ssids = n_ssids; 7475 if (ie_len) { 7476 if (n_ssids) 7477 request->ie = (void *)(request->ssids + n_ssids); 7478 else 7479 request->ie = (void *)(request->channels + n_channels); 7480 } 7481 7482 if (n_match_sets) { 7483 if (request->ie) 7484 request->match_sets = (void *)(request->ie + ie_len); 7485 else if (n_ssids) 7486 request->match_sets = 7487 (void *)(request->ssids + n_ssids); 7488 else 7489 request->match_sets = 7490 (void *)(request->channels + n_channels); 7491 } 7492 request->n_match_sets = n_match_sets; 7493 7494 if (n_match_sets) 7495 request->scan_plans = (void *)(request->match_sets + 7496 n_match_sets); 7497 else if (request->ie) 7498 request->scan_plans = (void *)(request->ie + ie_len); 7499 else if (n_ssids) 7500 request->scan_plans = (void *)(request->ssids + n_ssids); 7501 else 7502 request->scan_plans = (void *)(request->channels + n_channels); 7503 7504 request->n_scan_plans = n_plans; 7505 7506 i = 0; 7507 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) { 7508 /* user specified, bail out if channel not found */ 7509 nla_for_each_nested(attr, 7510 attrs[NL80211_ATTR_SCAN_FREQUENCIES], 7511 tmp) { 7512 struct ieee80211_channel *chan; 7513 7514 chan = ieee80211_get_channel(wiphy, nla_get_u32(attr)); 7515 7516 if (!chan) { 7517 err = -EINVAL; 7518 goto out_free; 7519 } 7520 7521 /* ignore disabled channels */ 7522 if (chan->flags & IEEE80211_CHAN_DISABLED) 7523 continue; 7524 7525 request->channels[i] = chan; 7526 i++; 7527 } 7528 } else { 7529 /* all channels */ 7530 for (band = 0; band < NUM_NL80211_BANDS; band++) { 7531 int j; 7532 7533 if (!wiphy->bands[band]) 7534 continue; 7535 for (j = 0; j < wiphy->bands[band]->n_channels; j++) { 7536 struct ieee80211_channel *chan; 7537 7538 chan = &wiphy->bands[band]->channels[j]; 7539 7540 if (chan->flags & IEEE80211_CHAN_DISABLED) 7541 continue; 7542 7543 request->channels[i] = chan; 7544 i++; 7545 } 7546 } 7547 } 7548 7549 if (!i) { 7550 err = -EINVAL; 7551 goto out_free; 7552 } 7553 7554 request->n_channels = i; 7555 7556 i = 0; 7557 if (n_ssids) { 7558 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS], 7559 tmp) { 7560 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) { 7561 err = -EINVAL; 7562 goto out_free; 7563 } 7564 request->ssids[i].ssid_len = nla_len(attr); 7565 memcpy(request->ssids[i].ssid, nla_data(attr), 7566 nla_len(attr)); 7567 i++; 7568 } 7569 } 7570 7571 i = 0; 7572 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) { 7573 nla_for_each_nested(attr, 7574 attrs[NL80211_ATTR_SCHED_SCAN_MATCH], 7575 tmp) { 7576 struct nlattr *ssid, *bssid, *rssi; 7577 7578 err = nla_parse_nested(tb, 7579 NL80211_SCHED_SCAN_MATCH_ATTR_MAX, 7580 attr, nl80211_match_policy, 7581 NULL); 7582 if (err) 7583 goto out_free; 7584 ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]; 7585 bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]; 7586 if (ssid || bssid) { 7587 if (WARN_ON(i >= n_match_sets)) { 7588 /* this indicates a programming error, 7589 * the loop above should have verified 7590 * things properly 7591 */ 7592 err = -EINVAL; 7593 goto out_free; 7594 } 7595 7596 if (ssid) { 7597 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) { 7598 err = -EINVAL; 7599 goto out_free; 7600 } 7601 memcpy(request->match_sets[i].ssid.ssid, 7602 nla_data(ssid), nla_len(ssid)); 7603 request->match_sets[i].ssid.ssid_len = 7604 nla_len(ssid); 7605 } 7606 if (bssid) { 7607 if (nla_len(bssid) != ETH_ALEN) { 7608 err = -EINVAL; 7609 goto out_free; 7610 } 7611 memcpy(request->match_sets[i].bssid, 7612 nla_data(bssid), ETH_ALEN); 7613 } 7614 7615 /* special attribute - old implementation w/a */ 7616 request->match_sets[i].rssi_thold = 7617 default_match_rssi; 7618 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI]; 7619 if (rssi) 7620 request->match_sets[i].rssi_thold = 7621 nla_get_s32(rssi); 7622 } 7623 i++; 7624 } 7625 7626 /* there was no other matchset, so the RSSI one is alone */ 7627 if (i == 0 && n_match_sets) 7628 request->match_sets[0].rssi_thold = default_match_rssi; 7629 7630 request->min_rssi_thold = INT_MAX; 7631 for (i = 0; i < n_match_sets; i++) 7632 request->min_rssi_thold = 7633 min(request->match_sets[i].rssi_thold, 7634 request->min_rssi_thold); 7635 } else { 7636 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF; 7637 } 7638 7639 if (ie_len) { 7640 request->ie_len = ie_len; 7641 memcpy((void *)request->ie, 7642 nla_data(attrs[NL80211_ATTR_IE]), 7643 request->ie_len); 7644 } 7645 7646 err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true); 7647 if (err) 7648 goto out_free; 7649 7650 if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY]) 7651 request->delay = 7652 nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]); 7653 7654 if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) { 7655 request->relative_rssi = nla_get_s8( 7656 attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]); 7657 request->relative_rssi_set = true; 7658 } 7659 7660 if (request->relative_rssi_set && 7661 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) { 7662 struct nl80211_bss_select_rssi_adjust *rssi_adjust; 7663 7664 rssi_adjust = nla_data( 7665 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]); 7666 request->rssi_adjust.band = rssi_adjust->band; 7667 request->rssi_adjust.delta = rssi_adjust->delta; 7668 if (!is_band_valid(wiphy, request->rssi_adjust.band)) { 7669 err = -EINVAL; 7670 goto out_free; 7671 } 7672 } 7673 7674 err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs); 7675 if (err) 7676 goto out_free; 7677 7678 request->scan_start = jiffies; 7679 7680 return request; 7681 7682 out_free: 7683 kfree(request); 7684 return ERR_PTR(err); 7685 } 7686 7687 static int nl80211_start_sched_scan(struct sk_buff *skb, 7688 struct genl_info *info) 7689 { 7690 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7691 struct net_device *dev = info->user_ptr[1]; 7692 struct wireless_dev *wdev = dev->ieee80211_ptr; 7693 struct cfg80211_sched_scan_request *sched_scan_req; 7694 bool want_multi; 7695 int err; 7696 7697 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start) 7698 return -EOPNOTSUPP; 7699 7700 want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI]; 7701 err = cfg80211_sched_scan_req_possible(rdev, want_multi); 7702 if (err) 7703 return err; 7704 7705 sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev, 7706 info->attrs, 7707 rdev->wiphy.max_match_sets); 7708 7709 err = PTR_ERR_OR_ZERO(sched_scan_req); 7710 if (err) 7711 goto out_err; 7712 7713 /* leave request id zero for legacy request 7714 * or if driver does not support multi-scheduled scan 7715 */ 7716 if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1) { 7717 while (!sched_scan_req->reqid) 7718 sched_scan_req->reqid = cfg80211_assign_cookie(rdev); 7719 } 7720 7721 err = rdev_sched_scan_start(rdev, dev, sched_scan_req); 7722 if (err) 7723 goto out_free; 7724 7725 sched_scan_req->dev = dev; 7726 sched_scan_req->wiphy = &rdev->wiphy; 7727 7728 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 7729 sched_scan_req->owner_nlportid = info->snd_portid; 7730 7731 cfg80211_add_sched_scan_req(rdev, sched_scan_req); 7732 7733 nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN); 7734 return 0; 7735 7736 out_free: 7737 kfree(sched_scan_req); 7738 out_err: 7739 return err; 7740 } 7741 7742 static int nl80211_stop_sched_scan(struct sk_buff *skb, 7743 struct genl_info *info) 7744 { 7745 struct cfg80211_sched_scan_request *req; 7746 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7747 u64 cookie; 7748 7749 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop) 7750 return -EOPNOTSUPP; 7751 7752 if (info->attrs[NL80211_ATTR_COOKIE]) { 7753 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 7754 return __cfg80211_stop_sched_scan(rdev, cookie, false); 7755 } 7756 7757 req = list_first_or_null_rcu(&rdev->sched_scan_req_list, 7758 struct cfg80211_sched_scan_request, 7759 list); 7760 if (!req || req->reqid || 7761 (req->owner_nlportid && 7762 req->owner_nlportid != info->snd_portid)) 7763 return -ENOENT; 7764 7765 return cfg80211_stop_sched_scan_req(rdev, req, false); 7766 } 7767 7768 static int nl80211_start_radar_detection(struct sk_buff *skb, 7769 struct genl_info *info) 7770 { 7771 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7772 struct net_device *dev = info->user_ptr[1]; 7773 struct wireless_dev *wdev = dev->ieee80211_ptr; 7774 struct wiphy *wiphy = wdev->wiphy; 7775 struct cfg80211_chan_def chandef; 7776 enum nl80211_dfs_regions dfs_region; 7777 unsigned int cac_time_ms; 7778 int err; 7779 7780 dfs_region = reg_get_dfs_region(wiphy); 7781 if (dfs_region == NL80211_DFS_UNSET) 7782 return -EINVAL; 7783 7784 err = nl80211_parse_chandef(rdev, info, &chandef); 7785 if (err) 7786 return err; 7787 7788 if (netif_carrier_ok(dev)) 7789 return -EBUSY; 7790 7791 if (wdev->cac_started) 7792 return -EBUSY; 7793 7794 err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype); 7795 if (err < 0) 7796 return err; 7797 7798 if (err == 0) 7799 return -EINVAL; 7800 7801 if (!cfg80211_chandef_dfs_usable(wiphy, &chandef)) 7802 return -EINVAL; 7803 7804 /* CAC start is offloaded to HW and can't be started manually */ 7805 if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD)) 7806 return -EOPNOTSUPP; 7807 7808 if (!rdev->ops->start_radar_detection) 7809 return -EOPNOTSUPP; 7810 7811 cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef); 7812 if (WARN_ON(!cac_time_ms)) 7813 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS; 7814 7815 err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms); 7816 if (!err) { 7817 wdev->chandef = chandef; 7818 wdev->cac_started = true; 7819 wdev->cac_start_time = jiffies; 7820 wdev->cac_time_ms = cac_time_ms; 7821 } 7822 return err; 7823 } 7824 7825 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info) 7826 { 7827 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7828 struct net_device *dev = info->user_ptr[1]; 7829 struct wireless_dev *wdev = dev->ieee80211_ptr; 7830 struct cfg80211_csa_settings params; 7831 /* csa_attrs is defined static to avoid waste of stack size - this 7832 * function is called under RTNL lock, so this should not be a problem. 7833 */ 7834 static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1]; 7835 int err; 7836 bool need_new_beacon = false; 7837 bool need_handle_dfs_flag = true; 7838 int len, i; 7839 u32 cs_count; 7840 7841 if (!rdev->ops->channel_switch || 7842 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)) 7843 return -EOPNOTSUPP; 7844 7845 switch (dev->ieee80211_ptr->iftype) { 7846 case NL80211_IFTYPE_AP: 7847 case NL80211_IFTYPE_P2P_GO: 7848 need_new_beacon = true; 7849 /* For all modes except AP the handle_dfs flag needs to be 7850 * supplied to tell the kernel that userspace will handle radar 7851 * events when they happen. Otherwise a switch to a channel 7852 * requiring DFS will be rejected. 7853 */ 7854 need_handle_dfs_flag = false; 7855 7856 /* useless if AP is not running */ 7857 if (!wdev->beacon_interval) 7858 return -ENOTCONN; 7859 break; 7860 case NL80211_IFTYPE_ADHOC: 7861 if (!wdev->ssid_len) 7862 return -ENOTCONN; 7863 break; 7864 case NL80211_IFTYPE_MESH_POINT: 7865 if (!wdev->mesh_id_len) 7866 return -ENOTCONN; 7867 break; 7868 default: 7869 return -EOPNOTSUPP; 7870 } 7871 7872 memset(¶ms, 0, sizeof(params)); 7873 params.beacon_csa.ftm_responder = -1; 7874 7875 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] || 7876 !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]) 7877 return -EINVAL; 7878 7879 /* only important for AP, IBSS and mesh create IEs internally */ 7880 if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES]) 7881 return -EINVAL; 7882 7883 /* Even though the attribute is u32, the specification says 7884 * u8, so let's make sure we don't overflow. 7885 */ 7886 cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]); 7887 if (cs_count > 255) 7888 return -EINVAL; 7889 7890 params.count = cs_count; 7891 7892 if (!need_new_beacon) 7893 goto skip_beacons; 7894 7895 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms.beacon_after); 7896 if (err) 7897 return err; 7898 7899 err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX, 7900 info->attrs[NL80211_ATTR_CSA_IES], 7901 nl80211_policy, info->extack); 7902 if (err) 7903 return err; 7904 7905 err = nl80211_parse_beacon(rdev, csa_attrs, ¶ms.beacon_csa); 7906 if (err) 7907 return err; 7908 7909 if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]) 7910 return -EINVAL; 7911 7912 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]); 7913 if (!len || (len % sizeof(u16))) 7914 return -EINVAL; 7915 7916 params.n_counter_offsets_beacon = len / sizeof(u16); 7917 if (rdev->wiphy.max_num_csa_counters && 7918 (params.n_counter_offsets_beacon > 7919 rdev->wiphy.max_num_csa_counters)) 7920 return -EINVAL; 7921 7922 params.counter_offsets_beacon = 7923 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]); 7924 7925 /* sanity checks - counters should fit and be the same */ 7926 for (i = 0; i < params.n_counter_offsets_beacon; i++) { 7927 u16 offset = params.counter_offsets_beacon[i]; 7928 7929 if (offset >= params.beacon_csa.tail_len) 7930 return -EINVAL; 7931 7932 if (params.beacon_csa.tail[offset] != params.count) 7933 return -EINVAL; 7934 } 7935 7936 if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) { 7937 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]); 7938 if (!len || (len % sizeof(u16))) 7939 return -EINVAL; 7940 7941 params.n_counter_offsets_presp = len / sizeof(u16); 7942 if (rdev->wiphy.max_num_csa_counters && 7943 (params.n_counter_offsets_presp > 7944 rdev->wiphy.max_num_csa_counters)) 7945 return -EINVAL; 7946 7947 params.counter_offsets_presp = 7948 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]); 7949 7950 /* sanity checks - counters should fit and be the same */ 7951 for (i = 0; i < params.n_counter_offsets_presp; i++) { 7952 u16 offset = params.counter_offsets_presp[i]; 7953 7954 if (offset >= params.beacon_csa.probe_resp_len) 7955 return -EINVAL; 7956 7957 if (params.beacon_csa.probe_resp[offset] != 7958 params.count) 7959 return -EINVAL; 7960 } 7961 } 7962 7963 skip_beacons: 7964 err = nl80211_parse_chandef(rdev, info, ¶ms.chandef); 7965 if (err) 7966 return err; 7967 7968 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms.chandef, 7969 wdev->iftype)) 7970 return -EINVAL; 7971 7972 err = cfg80211_chandef_dfs_required(wdev->wiphy, 7973 ¶ms.chandef, 7974 wdev->iftype); 7975 if (err < 0) 7976 return err; 7977 7978 if (err > 0) { 7979 params.radar_required = true; 7980 if (need_handle_dfs_flag && 7981 !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) { 7982 return -EINVAL; 7983 } 7984 } 7985 7986 if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX]) 7987 params.block_tx = true; 7988 7989 wdev_lock(wdev); 7990 err = rdev_channel_switch(rdev, dev, ¶ms); 7991 wdev_unlock(wdev); 7992 7993 return err; 7994 } 7995 7996 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb, 7997 u32 seq, int flags, 7998 struct cfg80211_registered_device *rdev, 7999 struct wireless_dev *wdev, 8000 struct cfg80211_internal_bss *intbss) 8001 { 8002 struct cfg80211_bss *res = &intbss->pub; 8003 const struct cfg80211_bss_ies *ies; 8004 void *hdr; 8005 struct nlattr *bss; 8006 8007 ASSERT_WDEV_LOCK(wdev); 8008 8009 hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags, 8010 NL80211_CMD_NEW_SCAN_RESULTS); 8011 if (!hdr) 8012 return -1; 8013 8014 genl_dump_check_consistent(cb, hdr); 8015 8016 if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation)) 8017 goto nla_put_failure; 8018 if (wdev->netdev && 8019 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex)) 8020 goto nla_put_failure; 8021 if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 8022 NL80211_ATTR_PAD)) 8023 goto nla_put_failure; 8024 8025 bss = nla_nest_start(msg, NL80211_ATTR_BSS); 8026 if (!bss) 8027 goto nla_put_failure; 8028 if ((!is_zero_ether_addr(res->bssid) && 8029 nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid))) 8030 goto nla_put_failure; 8031 8032 rcu_read_lock(); 8033 /* indicate whether we have probe response data or not */ 8034 if (rcu_access_pointer(res->proberesp_ies) && 8035 nla_put_flag(msg, NL80211_BSS_PRESP_DATA)) 8036 goto fail_unlock_rcu; 8037 8038 /* this pointer prefers to be pointed to probe response data 8039 * but is always valid 8040 */ 8041 ies = rcu_dereference(res->ies); 8042 if (ies) { 8043 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf, 8044 NL80211_BSS_PAD)) 8045 goto fail_unlock_rcu; 8046 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS, 8047 ies->len, ies->data)) 8048 goto fail_unlock_rcu; 8049 } 8050 8051 /* and this pointer is always (unless driver didn't know) beacon data */ 8052 ies = rcu_dereference(res->beacon_ies); 8053 if (ies && ies->from_beacon) { 8054 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf, 8055 NL80211_BSS_PAD)) 8056 goto fail_unlock_rcu; 8057 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES, 8058 ies->len, ies->data)) 8059 goto fail_unlock_rcu; 8060 } 8061 rcu_read_unlock(); 8062 8063 if (res->beacon_interval && 8064 nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval)) 8065 goto nla_put_failure; 8066 if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) || 8067 nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) || 8068 nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) || 8069 nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO, 8070 jiffies_to_msecs(jiffies - intbss->ts))) 8071 goto nla_put_failure; 8072 8073 if (intbss->parent_tsf && 8074 (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF, 8075 intbss->parent_tsf, NL80211_BSS_PAD) || 8076 nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN, 8077 intbss->parent_bssid))) 8078 goto nla_put_failure; 8079 8080 if (intbss->ts_boottime && 8081 nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME, 8082 intbss->ts_boottime, NL80211_BSS_PAD)) 8083 goto nla_put_failure; 8084 8085 if (!nl80211_put_signal(msg, intbss->pub.chains, 8086 intbss->pub.chain_signal, 8087 NL80211_BSS_CHAIN_SIGNAL)) 8088 goto nla_put_failure; 8089 8090 switch (rdev->wiphy.signal_type) { 8091 case CFG80211_SIGNAL_TYPE_MBM: 8092 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal)) 8093 goto nla_put_failure; 8094 break; 8095 case CFG80211_SIGNAL_TYPE_UNSPEC: 8096 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal)) 8097 goto nla_put_failure; 8098 break; 8099 default: 8100 break; 8101 } 8102 8103 switch (wdev->iftype) { 8104 case NL80211_IFTYPE_P2P_CLIENT: 8105 case NL80211_IFTYPE_STATION: 8106 if (intbss == wdev->current_bss && 8107 nla_put_u32(msg, NL80211_BSS_STATUS, 8108 NL80211_BSS_STATUS_ASSOCIATED)) 8109 goto nla_put_failure; 8110 break; 8111 case NL80211_IFTYPE_ADHOC: 8112 if (intbss == wdev->current_bss && 8113 nla_put_u32(msg, NL80211_BSS_STATUS, 8114 NL80211_BSS_STATUS_IBSS_JOINED)) 8115 goto nla_put_failure; 8116 break; 8117 default: 8118 break; 8119 } 8120 8121 nla_nest_end(msg, bss); 8122 8123 genlmsg_end(msg, hdr); 8124 return 0; 8125 8126 fail_unlock_rcu: 8127 rcu_read_unlock(); 8128 nla_put_failure: 8129 genlmsg_cancel(msg, hdr); 8130 return -EMSGSIZE; 8131 } 8132 8133 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb) 8134 { 8135 struct cfg80211_registered_device *rdev; 8136 struct cfg80211_internal_bss *scan; 8137 struct wireless_dev *wdev; 8138 int start = cb->args[2], idx = 0; 8139 int err; 8140 8141 rtnl_lock(); 8142 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev); 8143 if (err) { 8144 rtnl_unlock(); 8145 return err; 8146 } 8147 8148 wdev_lock(wdev); 8149 spin_lock_bh(&rdev->bss_lock); 8150 8151 /* 8152 * dump_scan will be called multiple times to break up the scan results 8153 * into multiple messages. It is unlikely that any more bss-es will be 8154 * expired after the first call, so only call only call this on the 8155 * first dump_scan invocation. 8156 */ 8157 if (start == 0) 8158 cfg80211_bss_expire(rdev); 8159 8160 cb->seq = rdev->bss_generation; 8161 8162 list_for_each_entry(scan, &rdev->bss_list, list) { 8163 if (++idx <= start) 8164 continue; 8165 if (nl80211_send_bss(skb, cb, 8166 cb->nlh->nlmsg_seq, NLM_F_MULTI, 8167 rdev, wdev, scan) < 0) { 8168 idx--; 8169 break; 8170 } 8171 } 8172 8173 spin_unlock_bh(&rdev->bss_lock); 8174 wdev_unlock(wdev); 8175 8176 cb->args[2] = idx; 8177 rtnl_unlock(); 8178 8179 return skb->len; 8180 } 8181 8182 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq, 8183 int flags, struct net_device *dev, 8184 bool allow_radio_stats, 8185 struct survey_info *survey) 8186 { 8187 void *hdr; 8188 struct nlattr *infoattr; 8189 8190 /* skip radio stats if userspace didn't request them */ 8191 if (!survey->channel && !allow_radio_stats) 8192 return 0; 8193 8194 hdr = nl80211hdr_put(msg, portid, seq, flags, 8195 NL80211_CMD_NEW_SURVEY_RESULTS); 8196 if (!hdr) 8197 return -ENOMEM; 8198 8199 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 8200 goto nla_put_failure; 8201 8202 infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO); 8203 if (!infoattr) 8204 goto nla_put_failure; 8205 8206 if (survey->channel && 8207 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY, 8208 survey->channel->center_freq)) 8209 goto nla_put_failure; 8210 8211 if ((survey->filled & SURVEY_INFO_NOISE_DBM) && 8212 nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise)) 8213 goto nla_put_failure; 8214 if ((survey->filled & SURVEY_INFO_IN_USE) && 8215 nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE)) 8216 goto nla_put_failure; 8217 if ((survey->filled & SURVEY_INFO_TIME) && 8218 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME, 8219 survey->time, NL80211_SURVEY_INFO_PAD)) 8220 goto nla_put_failure; 8221 if ((survey->filled & SURVEY_INFO_TIME_BUSY) && 8222 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY, 8223 survey->time_busy, NL80211_SURVEY_INFO_PAD)) 8224 goto nla_put_failure; 8225 if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) && 8226 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY, 8227 survey->time_ext_busy, NL80211_SURVEY_INFO_PAD)) 8228 goto nla_put_failure; 8229 if ((survey->filled & SURVEY_INFO_TIME_RX) && 8230 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX, 8231 survey->time_rx, NL80211_SURVEY_INFO_PAD)) 8232 goto nla_put_failure; 8233 if ((survey->filled & SURVEY_INFO_TIME_TX) && 8234 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX, 8235 survey->time_tx, NL80211_SURVEY_INFO_PAD)) 8236 goto nla_put_failure; 8237 if ((survey->filled & SURVEY_INFO_TIME_SCAN) && 8238 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN, 8239 survey->time_scan, NL80211_SURVEY_INFO_PAD)) 8240 goto nla_put_failure; 8241 8242 nla_nest_end(msg, infoattr); 8243 8244 genlmsg_end(msg, hdr); 8245 return 0; 8246 8247 nla_put_failure: 8248 genlmsg_cancel(msg, hdr); 8249 return -EMSGSIZE; 8250 } 8251 8252 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb) 8253 { 8254 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam); 8255 struct survey_info survey; 8256 struct cfg80211_registered_device *rdev; 8257 struct wireless_dev *wdev; 8258 int survey_idx = cb->args[2]; 8259 int res; 8260 bool radio_stats; 8261 8262 rtnl_lock(); 8263 res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev); 8264 if (res) 8265 goto out_err; 8266 8267 /* prepare_wdev_dump parsed the attributes */ 8268 radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS]; 8269 8270 if (!wdev->netdev) { 8271 res = -EINVAL; 8272 goto out_err; 8273 } 8274 8275 if (!rdev->ops->dump_survey) { 8276 res = -EOPNOTSUPP; 8277 goto out_err; 8278 } 8279 8280 while (1) { 8281 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey); 8282 if (res == -ENOENT) 8283 break; 8284 if (res) 8285 goto out_err; 8286 8287 /* don't send disabled channels, but do send non-channel data */ 8288 if (survey.channel && 8289 survey.channel->flags & IEEE80211_CHAN_DISABLED) { 8290 survey_idx++; 8291 continue; 8292 } 8293 8294 if (nl80211_send_survey(skb, 8295 NETLINK_CB(cb->skb).portid, 8296 cb->nlh->nlmsg_seq, NLM_F_MULTI, 8297 wdev->netdev, radio_stats, &survey) < 0) 8298 goto out; 8299 survey_idx++; 8300 } 8301 8302 out: 8303 cb->args[2] = survey_idx; 8304 res = skb->len; 8305 out_err: 8306 rtnl_unlock(); 8307 return res; 8308 } 8309 8310 static bool nl80211_valid_wpa_versions(u32 wpa_versions) 8311 { 8312 return !(wpa_versions & ~(NL80211_WPA_VERSION_1 | 8313 NL80211_WPA_VERSION_2)); 8314 } 8315 8316 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info) 8317 { 8318 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8319 struct net_device *dev = info->user_ptr[1]; 8320 struct ieee80211_channel *chan; 8321 const u8 *bssid, *ssid, *ie = NULL, *auth_data = NULL; 8322 int err, ssid_len, ie_len = 0, auth_data_len = 0; 8323 enum nl80211_auth_type auth_type; 8324 struct key_parse key; 8325 bool local_state_change; 8326 8327 if (!info->attrs[NL80211_ATTR_MAC]) 8328 return -EINVAL; 8329 8330 if (!info->attrs[NL80211_ATTR_AUTH_TYPE]) 8331 return -EINVAL; 8332 8333 if (!info->attrs[NL80211_ATTR_SSID]) 8334 return -EINVAL; 8335 8336 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ]) 8337 return -EINVAL; 8338 8339 err = nl80211_parse_key(info, &key); 8340 if (err) 8341 return err; 8342 8343 if (key.idx >= 0) { 8344 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP) 8345 return -EINVAL; 8346 if (!key.p.key || !key.p.key_len) 8347 return -EINVAL; 8348 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 || 8349 key.p.key_len != WLAN_KEY_LEN_WEP40) && 8350 (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 || 8351 key.p.key_len != WLAN_KEY_LEN_WEP104)) 8352 return -EINVAL; 8353 if (key.idx > 3) 8354 return -EINVAL; 8355 } else { 8356 key.p.key_len = 0; 8357 key.p.key = NULL; 8358 } 8359 8360 if (key.idx >= 0) { 8361 int i; 8362 bool ok = false; 8363 8364 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) { 8365 if (key.p.cipher == rdev->wiphy.cipher_suites[i]) { 8366 ok = true; 8367 break; 8368 } 8369 } 8370 if (!ok) 8371 return -EINVAL; 8372 } 8373 8374 if (!rdev->ops->auth) 8375 return -EOPNOTSUPP; 8376 8377 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 8378 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 8379 return -EOPNOTSUPP; 8380 8381 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 8382 chan = nl80211_get_valid_chan(&rdev->wiphy, 8383 info->attrs[NL80211_ATTR_WIPHY_FREQ]); 8384 if (!chan) 8385 return -EINVAL; 8386 8387 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 8388 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 8389 8390 if (info->attrs[NL80211_ATTR_IE]) { 8391 ie = nla_data(info->attrs[NL80211_ATTR_IE]); 8392 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 8393 } 8394 8395 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]); 8396 if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE)) 8397 return -EINVAL; 8398 8399 if ((auth_type == NL80211_AUTHTYPE_SAE || 8400 auth_type == NL80211_AUTHTYPE_FILS_SK || 8401 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 8402 auth_type == NL80211_AUTHTYPE_FILS_PK) && 8403 !info->attrs[NL80211_ATTR_AUTH_DATA]) 8404 return -EINVAL; 8405 8406 if (info->attrs[NL80211_ATTR_AUTH_DATA]) { 8407 if (auth_type != NL80211_AUTHTYPE_SAE && 8408 auth_type != NL80211_AUTHTYPE_FILS_SK && 8409 auth_type != NL80211_AUTHTYPE_FILS_SK_PFS && 8410 auth_type != NL80211_AUTHTYPE_FILS_PK) 8411 return -EINVAL; 8412 auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]); 8413 auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]); 8414 /* need to include at least Auth Transaction and Status Code */ 8415 if (auth_data_len < 4) 8416 return -EINVAL; 8417 } 8418 8419 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE]; 8420 8421 /* 8422 * Since we no longer track auth state, ignore 8423 * requests to only change local state. 8424 */ 8425 if (local_state_change) 8426 return 0; 8427 8428 wdev_lock(dev->ieee80211_ptr); 8429 err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid, 8430 ssid, ssid_len, ie, ie_len, 8431 key.p.key, key.p.key_len, key.idx, 8432 auth_data, auth_data_len); 8433 wdev_unlock(dev->ieee80211_ptr); 8434 return err; 8435 } 8436 8437 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev, 8438 struct genl_info *info) 8439 { 8440 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 8441 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set"); 8442 return -EINVAL; 8443 } 8444 8445 if (!rdev->ops->tx_control_port || 8446 !wiphy_ext_feature_isset(&rdev->wiphy, 8447 NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211)) 8448 return -EOPNOTSUPP; 8449 8450 return 0; 8451 } 8452 8453 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev, 8454 struct genl_info *info, 8455 struct cfg80211_crypto_settings *settings, 8456 int cipher_limit) 8457 { 8458 memset(settings, 0, sizeof(*settings)); 8459 8460 settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT]; 8461 8462 if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) { 8463 u16 proto; 8464 8465 proto = nla_get_u16( 8466 info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]); 8467 settings->control_port_ethertype = cpu_to_be16(proto); 8468 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) && 8469 proto != ETH_P_PAE) 8470 return -EINVAL; 8471 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]) 8472 settings->control_port_no_encrypt = true; 8473 } else 8474 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE); 8475 8476 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) { 8477 int r = validate_pae_over_nl80211(rdev, info); 8478 8479 if (r < 0) 8480 return r; 8481 8482 settings->control_port_over_nl80211 = true; 8483 } 8484 8485 if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) { 8486 void *data; 8487 int len, i; 8488 8489 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]); 8490 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]); 8491 settings->n_ciphers_pairwise = len / sizeof(u32); 8492 8493 if (len % sizeof(u32)) 8494 return -EINVAL; 8495 8496 if (settings->n_ciphers_pairwise > cipher_limit) 8497 return -EINVAL; 8498 8499 memcpy(settings->ciphers_pairwise, data, len); 8500 8501 for (i = 0; i < settings->n_ciphers_pairwise; i++) 8502 if (!cfg80211_supported_cipher_suite( 8503 &rdev->wiphy, 8504 settings->ciphers_pairwise[i])) 8505 return -EINVAL; 8506 } 8507 8508 if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) { 8509 settings->cipher_group = 8510 nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]); 8511 if (!cfg80211_supported_cipher_suite(&rdev->wiphy, 8512 settings->cipher_group)) 8513 return -EINVAL; 8514 } 8515 8516 if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) { 8517 settings->wpa_versions = 8518 nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]); 8519 if (!nl80211_valid_wpa_versions(settings->wpa_versions)) 8520 return -EINVAL; 8521 } 8522 8523 if (info->attrs[NL80211_ATTR_AKM_SUITES]) { 8524 void *data; 8525 int len; 8526 8527 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]); 8528 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]); 8529 settings->n_akm_suites = len / sizeof(u32); 8530 8531 if (len % sizeof(u32)) 8532 return -EINVAL; 8533 8534 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES) 8535 return -EINVAL; 8536 8537 memcpy(settings->akm_suites, data, len); 8538 } 8539 8540 if (info->attrs[NL80211_ATTR_PMK]) { 8541 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN) 8542 return -EINVAL; 8543 if (!wiphy_ext_feature_isset(&rdev->wiphy, 8544 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK)) 8545 return -EINVAL; 8546 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]); 8547 } 8548 8549 return 0; 8550 } 8551 8552 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info) 8553 { 8554 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8555 struct net_device *dev = info->user_ptr[1]; 8556 struct ieee80211_channel *chan; 8557 struct cfg80211_assoc_request req = {}; 8558 const u8 *bssid, *ssid; 8559 int err, ssid_len = 0; 8560 8561 if (dev->ieee80211_ptr->conn_owner_nlportid && 8562 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid) 8563 return -EPERM; 8564 8565 if (!info->attrs[NL80211_ATTR_MAC] || 8566 !info->attrs[NL80211_ATTR_SSID] || 8567 !info->attrs[NL80211_ATTR_WIPHY_FREQ]) 8568 return -EINVAL; 8569 8570 if (!rdev->ops->assoc) 8571 return -EOPNOTSUPP; 8572 8573 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 8574 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 8575 return -EOPNOTSUPP; 8576 8577 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 8578 8579 chan = nl80211_get_valid_chan(&rdev->wiphy, 8580 info->attrs[NL80211_ATTR_WIPHY_FREQ]); 8581 if (!chan) 8582 return -EINVAL; 8583 8584 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 8585 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 8586 8587 if (info->attrs[NL80211_ATTR_IE]) { 8588 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 8589 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 8590 } 8591 8592 if (info->attrs[NL80211_ATTR_USE_MFP]) { 8593 enum nl80211_mfp mfp = 8594 nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]); 8595 if (mfp == NL80211_MFP_REQUIRED) 8596 req.use_mfp = true; 8597 else if (mfp != NL80211_MFP_NO) 8598 return -EINVAL; 8599 } 8600 8601 if (info->attrs[NL80211_ATTR_PREV_BSSID]) 8602 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]); 8603 8604 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT])) 8605 req.flags |= ASSOC_REQ_DISABLE_HT; 8606 8607 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 8608 memcpy(&req.ht_capa_mask, 8609 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]), 8610 sizeof(req.ht_capa_mask)); 8611 8612 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) { 8613 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 8614 return -EINVAL; 8615 memcpy(&req.ht_capa, 8616 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]), 8617 sizeof(req.ht_capa)); 8618 } 8619 8620 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT])) 8621 req.flags |= ASSOC_REQ_DISABLE_VHT; 8622 8623 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) 8624 memcpy(&req.vht_capa_mask, 8625 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]), 8626 sizeof(req.vht_capa_mask)); 8627 8628 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) { 8629 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) 8630 return -EINVAL; 8631 memcpy(&req.vht_capa, 8632 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]), 8633 sizeof(req.vht_capa)); 8634 } 8635 8636 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) { 8637 if (!((rdev->wiphy.features & 8638 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) && 8639 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) && 8640 !wiphy_ext_feature_isset(&rdev->wiphy, 8641 NL80211_EXT_FEATURE_RRM)) 8642 return -EINVAL; 8643 req.flags |= ASSOC_REQ_USE_RRM; 8644 } 8645 8646 if (info->attrs[NL80211_ATTR_FILS_KEK]) { 8647 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]); 8648 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]); 8649 if (!info->attrs[NL80211_ATTR_FILS_NONCES]) 8650 return -EINVAL; 8651 req.fils_nonces = 8652 nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]); 8653 } 8654 8655 err = nl80211_crypto_settings(rdev, info, &req.crypto, 1); 8656 if (!err) { 8657 wdev_lock(dev->ieee80211_ptr); 8658 8659 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, 8660 ssid, ssid_len, &req); 8661 8662 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 8663 dev->ieee80211_ptr->conn_owner_nlportid = 8664 info->snd_portid; 8665 memcpy(dev->ieee80211_ptr->disconnect_bssid, 8666 bssid, ETH_ALEN); 8667 } 8668 8669 wdev_unlock(dev->ieee80211_ptr); 8670 } 8671 8672 return err; 8673 } 8674 8675 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info) 8676 { 8677 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8678 struct net_device *dev = info->user_ptr[1]; 8679 const u8 *ie = NULL, *bssid; 8680 int ie_len = 0, err; 8681 u16 reason_code; 8682 bool local_state_change; 8683 8684 if (dev->ieee80211_ptr->conn_owner_nlportid && 8685 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid) 8686 return -EPERM; 8687 8688 if (!info->attrs[NL80211_ATTR_MAC]) 8689 return -EINVAL; 8690 8691 if (!info->attrs[NL80211_ATTR_REASON_CODE]) 8692 return -EINVAL; 8693 8694 if (!rdev->ops->deauth) 8695 return -EOPNOTSUPP; 8696 8697 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 8698 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 8699 return -EOPNOTSUPP; 8700 8701 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 8702 8703 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 8704 if (reason_code == 0) { 8705 /* Reason Code 0 is reserved */ 8706 return -EINVAL; 8707 } 8708 8709 if (info->attrs[NL80211_ATTR_IE]) { 8710 ie = nla_data(info->attrs[NL80211_ATTR_IE]); 8711 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 8712 } 8713 8714 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE]; 8715 8716 wdev_lock(dev->ieee80211_ptr); 8717 err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code, 8718 local_state_change); 8719 wdev_unlock(dev->ieee80211_ptr); 8720 return err; 8721 } 8722 8723 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info) 8724 { 8725 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8726 struct net_device *dev = info->user_ptr[1]; 8727 const u8 *ie = NULL, *bssid; 8728 int ie_len = 0, err; 8729 u16 reason_code; 8730 bool local_state_change; 8731 8732 if (dev->ieee80211_ptr->conn_owner_nlportid && 8733 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid) 8734 return -EPERM; 8735 8736 if (!info->attrs[NL80211_ATTR_MAC]) 8737 return -EINVAL; 8738 8739 if (!info->attrs[NL80211_ATTR_REASON_CODE]) 8740 return -EINVAL; 8741 8742 if (!rdev->ops->disassoc) 8743 return -EOPNOTSUPP; 8744 8745 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 8746 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 8747 return -EOPNOTSUPP; 8748 8749 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 8750 8751 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 8752 if (reason_code == 0) { 8753 /* Reason Code 0 is reserved */ 8754 return -EINVAL; 8755 } 8756 8757 if (info->attrs[NL80211_ATTR_IE]) { 8758 ie = nla_data(info->attrs[NL80211_ATTR_IE]); 8759 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 8760 } 8761 8762 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE]; 8763 8764 wdev_lock(dev->ieee80211_ptr); 8765 err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code, 8766 local_state_change); 8767 wdev_unlock(dev->ieee80211_ptr); 8768 return err; 8769 } 8770 8771 static bool 8772 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev, 8773 int mcast_rate[NUM_NL80211_BANDS], 8774 int rateval) 8775 { 8776 struct wiphy *wiphy = &rdev->wiphy; 8777 bool found = false; 8778 int band, i; 8779 8780 for (band = 0; band < NUM_NL80211_BANDS; band++) { 8781 struct ieee80211_supported_band *sband; 8782 8783 sband = wiphy->bands[band]; 8784 if (!sband) 8785 continue; 8786 8787 for (i = 0; i < sband->n_bitrates; i++) { 8788 if (sband->bitrates[i].bitrate == rateval) { 8789 mcast_rate[band] = i + 1; 8790 found = true; 8791 break; 8792 } 8793 } 8794 } 8795 8796 return found; 8797 } 8798 8799 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info) 8800 { 8801 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8802 struct net_device *dev = info->user_ptr[1]; 8803 struct cfg80211_ibss_params ibss; 8804 struct wiphy *wiphy; 8805 struct cfg80211_cached_keys *connkeys = NULL; 8806 int err; 8807 8808 memset(&ibss, 0, sizeof(ibss)); 8809 8810 if (!info->attrs[NL80211_ATTR_SSID] || 8811 !nla_len(info->attrs[NL80211_ATTR_SSID])) 8812 return -EINVAL; 8813 8814 ibss.beacon_interval = 100; 8815 8816 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) 8817 ibss.beacon_interval = 8818 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]); 8819 8820 err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC, 8821 ibss.beacon_interval); 8822 if (err) 8823 return err; 8824 8825 if (!rdev->ops->join_ibss) 8826 return -EOPNOTSUPP; 8827 8828 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) 8829 return -EOPNOTSUPP; 8830 8831 wiphy = &rdev->wiphy; 8832 8833 if (info->attrs[NL80211_ATTR_MAC]) { 8834 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 8835 8836 if (!is_valid_ether_addr(ibss.bssid)) 8837 return -EINVAL; 8838 } 8839 ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 8840 ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 8841 8842 if (info->attrs[NL80211_ATTR_IE]) { 8843 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 8844 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 8845 } 8846 8847 err = nl80211_parse_chandef(rdev, info, &ibss.chandef); 8848 if (err) 8849 return err; 8850 8851 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef, 8852 NL80211_IFTYPE_ADHOC)) 8853 return -EINVAL; 8854 8855 switch (ibss.chandef.width) { 8856 case NL80211_CHAN_WIDTH_5: 8857 case NL80211_CHAN_WIDTH_10: 8858 case NL80211_CHAN_WIDTH_20_NOHT: 8859 break; 8860 case NL80211_CHAN_WIDTH_20: 8861 case NL80211_CHAN_WIDTH_40: 8862 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)) 8863 return -EINVAL; 8864 break; 8865 case NL80211_CHAN_WIDTH_80: 8866 case NL80211_CHAN_WIDTH_80P80: 8867 case NL80211_CHAN_WIDTH_160: 8868 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)) 8869 return -EINVAL; 8870 if (!wiphy_ext_feature_isset(&rdev->wiphy, 8871 NL80211_EXT_FEATURE_VHT_IBSS)) 8872 return -EINVAL; 8873 break; 8874 default: 8875 return -EINVAL; 8876 } 8877 8878 ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED]; 8879 ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY]; 8880 8881 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) { 8882 u8 *rates = 8883 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 8884 int n_rates = 8885 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 8886 struct ieee80211_supported_band *sband = 8887 wiphy->bands[ibss.chandef.chan->band]; 8888 8889 err = ieee80211_get_ratemask(sband, rates, n_rates, 8890 &ibss.basic_rates); 8891 if (err) 8892 return err; 8893 } 8894 8895 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 8896 memcpy(&ibss.ht_capa_mask, 8897 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]), 8898 sizeof(ibss.ht_capa_mask)); 8899 8900 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) { 8901 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 8902 return -EINVAL; 8903 memcpy(&ibss.ht_capa, 8904 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]), 8905 sizeof(ibss.ht_capa)); 8906 } 8907 8908 if (info->attrs[NL80211_ATTR_MCAST_RATE] && 8909 !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate, 8910 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]))) 8911 return -EINVAL; 8912 8913 if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) { 8914 bool no_ht = false; 8915 8916 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht); 8917 if (IS_ERR(connkeys)) 8918 return PTR_ERR(connkeys); 8919 8920 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) && 8921 no_ht) { 8922 kzfree(connkeys); 8923 return -EINVAL; 8924 } 8925 } 8926 8927 ibss.control_port = 8928 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]); 8929 8930 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) { 8931 int r = validate_pae_over_nl80211(rdev, info); 8932 8933 if (r < 0) { 8934 kzfree(connkeys); 8935 return r; 8936 } 8937 8938 ibss.control_port_over_nl80211 = true; 8939 } 8940 8941 ibss.userspace_handles_dfs = 8942 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]); 8943 8944 wdev_lock(dev->ieee80211_ptr); 8945 err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys); 8946 if (err) 8947 kzfree(connkeys); 8948 else if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 8949 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid; 8950 wdev_unlock(dev->ieee80211_ptr); 8951 8952 return err; 8953 } 8954 8955 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info) 8956 { 8957 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8958 struct net_device *dev = info->user_ptr[1]; 8959 8960 if (!rdev->ops->leave_ibss) 8961 return -EOPNOTSUPP; 8962 8963 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) 8964 return -EOPNOTSUPP; 8965 8966 return cfg80211_leave_ibss(rdev, dev, false); 8967 } 8968 8969 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info) 8970 { 8971 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8972 struct net_device *dev = info->user_ptr[1]; 8973 int mcast_rate[NUM_NL80211_BANDS]; 8974 u32 nla_rate; 8975 int err; 8976 8977 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC && 8978 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT && 8979 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB) 8980 return -EOPNOTSUPP; 8981 8982 if (!rdev->ops->set_mcast_rate) 8983 return -EOPNOTSUPP; 8984 8985 memset(mcast_rate, 0, sizeof(mcast_rate)); 8986 8987 if (!info->attrs[NL80211_ATTR_MCAST_RATE]) 8988 return -EINVAL; 8989 8990 nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]); 8991 if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate)) 8992 return -EINVAL; 8993 8994 err = rdev_set_mcast_rate(rdev, dev, mcast_rate); 8995 8996 return err; 8997 } 8998 8999 static struct sk_buff * 9000 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev, 9001 struct wireless_dev *wdev, int approxlen, 9002 u32 portid, u32 seq, enum nl80211_commands cmd, 9003 enum nl80211_attrs attr, 9004 const struct nl80211_vendor_cmd_info *info, 9005 gfp_t gfp) 9006 { 9007 struct sk_buff *skb; 9008 void *hdr; 9009 struct nlattr *data; 9010 9011 skb = nlmsg_new(approxlen + 100, gfp); 9012 if (!skb) 9013 return NULL; 9014 9015 hdr = nl80211hdr_put(skb, portid, seq, 0, cmd); 9016 if (!hdr) { 9017 kfree_skb(skb); 9018 return NULL; 9019 } 9020 9021 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx)) 9022 goto nla_put_failure; 9023 9024 if (info) { 9025 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID, 9026 info->vendor_id)) 9027 goto nla_put_failure; 9028 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD, 9029 info->subcmd)) 9030 goto nla_put_failure; 9031 } 9032 9033 if (wdev) { 9034 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV, 9035 wdev_id(wdev), NL80211_ATTR_PAD)) 9036 goto nla_put_failure; 9037 if (wdev->netdev && 9038 nla_put_u32(skb, NL80211_ATTR_IFINDEX, 9039 wdev->netdev->ifindex)) 9040 goto nla_put_failure; 9041 } 9042 9043 data = nla_nest_start(skb, attr); 9044 if (!data) 9045 goto nla_put_failure; 9046 9047 ((void **)skb->cb)[0] = rdev; 9048 ((void **)skb->cb)[1] = hdr; 9049 ((void **)skb->cb)[2] = data; 9050 9051 return skb; 9052 9053 nla_put_failure: 9054 kfree_skb(skb); 9055 return NULL; 9056 } 9057 9058 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy, 9059 struct wireless_dev *wdev, 9060 enum nl80211_commands cmd, 9061 enum nl80211_attrs attr, 9062 int vendor_event_idx, 9063 int approxlen, gfp_t gfp) 9064 { 9065 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 9066 const struct nl80211_vendor_cmd_info *info; 9067 9068 switch (cmd) { 9069 case NL80211_CMD_TESTMODE: 9070 if (WARN_ON(vendor_event_idx != -1)) 9071 return NULL; 9072 info = NULL; 9073 break; 9074 case NL80211_CMD_VENDOR: 9075 if (WARN_ON(vendor_event_idx < 0 || 9076 vendor_event_idx >= wiphy->n_vendor_events)) 9077 return NULL; 9078 info = &wiphy->vendor_events[vendor_event_idx]; 9079 break; 9080 default: 9081 WARN_ON(1); 9082 return NULL; 9083 } 9084 9085 return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, 0, 0, 9086 cmd, attr, info, gfp); 9087 } 9088 EXPORT_SYMBOL(__cfg80211_alloc_event_skb); 9089 9090 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp) 9091 { 9092 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0]; 9093 void *hdr = ((void **)skb->cb)[1]; 9094 struct nlattr *data = ((void **)skb->cb)[2]; 9095 enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE; 9096 9097 /* clear CB data for netlink core to own from now on */ 9098 memset(skb->cb, 0, sizeof(skb->cb)); 9099 9100 nla_nest_end(skb, data); 9101 genlmsg_end(skb, hdr); 9102 9103 if (data->nla_type == NL80211_ATTR_VENDOR_DATA) 9104 mcgrp = NL80211_MCGRP_VENDOR; 9105 9106 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0, 9107 mcgrp, gfp); 9108 } 9109 EXPORT_SYMBOL(__cfg80211_send_event_skb); 9110 9111 #ifdef CONFIG_NL80211_TESTMODE 9112 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info) 9113 { 9114 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9115 struct wireless_dev *wdev = 9116 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs); 9117 int err; 9118 9119 if (!rdev->ops->testmode_cmd) 9120 return -EOPNOTSUPP; 9121 9122 if (IS_ERR(wdev)) { 9123 err = PTR_ERR(wdev); 9124 if (err != -EINVAL) 9125 return err; 9126 wdev = NULL; 9127 } else if (wdev->wiphy != &rdev->wiphy) { 9128 return -EINVAL; 9129 } 9130 9131 if (!info->attrs[NL80211_ATTR_TESTDATA]) 9132 return -EINVAL; 9133 9134 rdev->cur_cmd_info = info; 9135 err = rdev_testmode_cmd(rdev, wdev, 9136 nla_data(info->attrs[NL80211_ATTR_TESTDATA]), 9137 nla_len(info->attrs[NL80211_ATTR_TESTDATA])); 9138 rdev->cur_cmd_info = NULL; 9139 9140 return err; 9141 } 9142 9143 static int nl80211_testmode_dump(struct sk_buff *skb, 9144 struct netlink_callback *cb) 9145 { 9146 struct cfg80211_registered_device *rdev; 9147 int err; 9148 long phy_idx; 9149 void *data = NULL; 9150 int data_len = 0; 9151 9152 rtnl_lock(); 9153 9154 if (cb->args[0]) { 9155 /* 9156 * 0 is a valid index, but not valid for args[0], 9157 * so we need to offset by 1. 9158 */ 9159 phy_idx = cb->args[0] - 1; 9160 9161 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx); 9162 if (!rdev) { 9163 err = -ENOENT; 9164 goto out_err; 9165 } 9166 } else { 9167 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam); 9168 9169 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, 9170 attrbuf, nl80211_fam.maxattr, 9171 nl80211_policy, NULL); 9172 if (err) 9173 goto out_err; 9174 9175 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf); 9176 if (IS_ERR(rdev)) { 9177 err = PTR_ERR(rdev); 9178 goto out_err; 9179 } 9180 phy_idx = rdev->wiphy_idx; 9181 9182 if (attrbuf[NL80211_ATTR_TESTDATA]) 9183 cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA]; 9184 } 9185 9186 if (cb->args[1]) { 9187 data = nla_data((void *)cb->args[1]); 9188 data_len = nla_len((void *)cb->args[1]); 9189 } 9190 9191 if (!rdev->ops->testmode_dump) { 9192 err = -EOPNOTSUPP; 9193 goto out_err; 9194 } 9195 9196 while (1) { 9197 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid, 9198 cb->nlh->nlmsg_seq, NLM_F_MULTI, 9199 NL80211_CMD_TESTMODE); 9200 struct nlattr *tmdata; 9201 9202 if (!hdr) 9203 break; 9204 9205 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) { 9206 genlmsg_cancel(skb, hdr); 9207 break; 9208 } 9209 9210 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA); 9211 if (!tmdata) { 9212 genlmsg_cancel(skb, hdr); 9213 break; 9214 } 9215 err = rdev_testmode_dump(rdev, skb, cb, data, data_len); 9216 nla_nest_end(skb, tmdata); 9217 9218 if (err == -ENOBUFS || err == -ENOENT) { 9219 genlmsg_cancel(skb, hdr); 9220 break; 9221 } else if (err) { 9222 genlmsg_cancel(skb, hdr); 9223 goto out_err; 9224 } 9225 9226 genlmsg_end(skb, hdr); 9227 } 9228 9229 err = skb->len; 9230 /* see above */ 9231 cb->args[0] = phy_idx + 1; 9232 out_err: 9233 rtnl_unlock(); 9234 return err; 9235 } 9236 #endif 9237 9238 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info) 9239 { 9240 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9241 struct net_device *dev = info->user_ptr[1]; 9242 struct cfg80211_connect_params connect; 9243 struct wiphy *wiphy; 9244 struct cfg80211_cached_keys *connkeys = NULL; 9245 int err; 9246 9247 memset(&connect, 0, sizeof(connect)); 9248 9249 if (!info->attrs[NL80211_ATTR_SSID] || 9250 !nla_len(info->attrs[NL80211_ATTR_SSID])) 9251 return -EINVAL; 9252 9253 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) { 9254 connect.auth_type = 9255 nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]); 9256 if (!nl80211_valid_auth_type(rdev, connect.auth_type, 9257 NL80211_CMD_CONNECT)) 9258 return -EINVAL; 9259 } else 9260 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC; 9261 9262 connect.privacy = info->attrs[NL80211_ATTR_PRIVACY]; 9263 9264 if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] && 9265 !wiphy_ext_feature_isset(&rdev->wiphy, 9266 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X)) 9267 return -EINVAL; 9268 connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS]; 9269 9270 err = nl80211_crypto_settings(rdev, info, &connect.crypto, 9271 NL80211_MAX_NR_CIPHER_SUITES); 9272 if (err) 9273 return err; 9274 9275 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 9276 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 9277 return -EOPNOTSUPP; 9278 9279 wiphy = &rdev->wiphy; 9280 9281 connect.bg_scan_period = -1; 9282 if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] && 9283 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) { 9284 connect.bg_scan_period = 9285 nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]); 9286 } 9287 9288 if (info->attrs[NL80211_ATTR_MAC]) 9289 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 9290 else if (info->attrs[NL80211_ATTR_MAC_HINT]) 9291 connect.bssid_hint = 9292 nla_data(info->attrs[NL80211_ATTR_MAC_HINT]); 9293 connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 9294 connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 9295 9296 if (info->attrs[NL80211_ATTR_IE]) { 9297 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 9298 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 9299 } 9300 9301 if (info->attrs[NL80211_ATTR_USE_MFP]) { 9302 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]); 9303 if (connect.mfp == NL80211_MFP_OPTIONAL && 9304 !wiphy_ext_feature_isset(&rdev->wiphy, 9305 NL80211_EXT_FEATURE_MFP_OPTIONAL)) 9306 return -EOPNOTSUPP; 9307 } else { 9308 connect.mfp = NL80211_MFP_NO; 9309 } 9310 9311 if (info->attrs[NL80211_ATTR_PREV_BSSID]) 9312 connect.prev_bssid = 9313 nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]); 9314 9315 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 9316 connect.channel = nl80211_get_valid_chan( 9317 wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]); 9318 if (!connect.channel) 9319 return -EINVAL; 9320 } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) { 9321 connect.channel_hint = nl80211_get_valid_chan( 9322 wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]); 9323 if (!connect.channel_hint) 9324 return -EINVAL; 9325 } 9326 9327 if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) { 9328 connkeys = nl80211_parse_connkeys(rdev, info, NULL); 9329 if (IS_ERR(connkeys)) 9330 return PTR_ERR(connkeys); 9331 } 9332 9333 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT])) 9334 connect.flags |= ASSOC_REQ_DISABLE_HT; 9335 9336 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 9337 memcpy(&connect.ht_capa_mask, 9338 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]), 9339 sizeof(connect.ht_capa_mask)); 9340 9341 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) { 9342 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) { 9343 kzfree(connkeys); 9344 return -EINVAL; 9345 } 9346 memcpy(&connect.ht_capa, 9347 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]), 9348 sizeof(connect.ht_capa)); 9349 } 9350 9351 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT])) 9352 connect.flags |= ASSOC_REQ_DISABLE_VHT; 9353 9354 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) 9355 memcpy(&connect.vht_capa_mask, 9356 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]), 9357 sizeof(connect.vht_capa_mask)); 9358 9359 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) { 9360 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) { 9361 kzfree(connkeys); 9362 return -EINVAL; 9363 } 9364 memcpy(&connect.vht_capa, 9365 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]), 9366 sizeof(connect.vht_capa)); 9367 } 9368 9369 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) { 9370 if (!((rdev->wiphy.features & 9371 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) && 9372 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) && 9373 !wiphy_ext_feature_isset(&rdev->wiphy, 9374 NL80211_EXT_FEATURE_RRM)) { 9375 kzfree(connkeys); 9376 return -EINVAL; 9377 } 9378 connect.flags |= ASSOC_REQ_USE_RRM; 9379 } 9380 9381 connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]); 9382 if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) { 9383 kzfree(connkeys); 9384 return -EOPNOTSUPP; 9385 } 9386 9387 if (info->attrs[NL80211_ATTR_BSS_SELECT]) { 9388 /* bss selection makes no sense if bssid is set */ 9389 if (connect.bssid) { 9390 kzfree(connkeys); 9391 return -EINVAL; 9392 } 9393 9394 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT], 9395 wiphy, &connect.bss_select); 9396 if (err) { 9397 kzfree(connkeys); 9398 return err; 9399 } 9400 } 9401 9402 if (wiphy_ext_feature_isset(&rdev->wiphy, 9403 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) && 9404 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] && 9405 info->attrs[NL80211_ATTR_FILS_ERP_REALM] && 9406 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] && 9407 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 9408 connect.fils_erp_username = 9409 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 9410 connect.fils_erp_username_len = 9411 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 9412 connect.fils_erp_realm = 9413 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 9414 connect.fils_erp_realm_len = 9415 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 9416 connect.fils_erp_next_seq_num = 9417 nla_get_u16( 9418 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]); 9419 connect.fils_erp_rrk = 9420 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 9421 connect.fils_erp_rrk_len = 9422 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 9423 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] || 9424 info->attrs[NL80211_ATTR_FILS_ERP_REALM] || 9425 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] || 9426 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 9427 kzfree(connkeys); 9428 return -EINVAL; 9429 } 9430 9431 if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) { 9432 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 9433 kzfree(connkeys); 9434 GENL_SET_ERR_MSG(info, 9435 "external auth requires connection ownership"); 9436 return -EINVAL; 9437 } 9438 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT; 9439 } 9440 9441 wdev_lock(dev->ieee80211_ptr); 9442 9443 err = cfg80211_connect(rdev, dev, &connect, connkeys, 9444 connect.prev_bssid); 9445 if (err) 9446 kzfree(connkeys); 9447 9448 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 9449 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid; 9450 if (connect.bssid) 9451 memcpy(dev->ieee80211_ptr->disconnect_bssid, 9452 connect.bssid, ETH_ALEN); 9453 else 9454 memset(dev->ieee80211_ptr->disconnect_bssid, 9455 0, ETH_ALEN); 9456 } 9457 9458 wdev_unlock(dev->ieee80211_ptr); 9459 9460 return err; 9461 } 9462 9463 static int nl80211_update_connect_params(struct sk_buff *skb, 9464 struct genl_info *info) 9465 { 9466 struct cfg80211_connect_params connect = {}; 9467 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9468 struct net_device *dev = info->user_ptr[1]; 9469 struct wireless_dev *wdev = dev->ieee80211_ptr; 9470 bool fils_sk_offload; 9471 u32 auth_type; 9472 u32 changed = 0; 9473 int ret; 9474 9475 if (!rdev->ops->update_connect_params) 9476 return -EOPNOTSUPP; 9477 9478 if (info->attrs[NL80211_ATTR_IE]) { 9479 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 9480 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 9481 changed |= UPDATE_ASSOC_IES; 9482 } 9483 9484 fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy, 9485 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD); 9486 9487 /* 9488 * when driver supports fils-sk offload all attributes must be 9489 * provided. So the else covers "fils-sk-not-all" and 9490 * "no-fils-sk-any". 9491 */ 9492 if (fils_sk_offload && 9493 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] && 9494 info->attrs[NL80211_ATTR_FILS_ERP_REALM] && 9495 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] && 9496 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 9497 connect.fils_erp_username = 9498 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 9499 connect.fils_erp_username_len = 9500 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 9501 connect.fils_erp_realm = 9502 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 9503 connect.fils_erp_realm_len = 9504 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 9505 connect.fils_erp_next_seq_num = 9506 nla_get_u16( 9507 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]); 9508 connect.fils_erp_rrk = 9509 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 9510 connect.fils_erp_rrk_len = 9511 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 9512 changed |= UPDATE_FILS_ERP_INFO; 9513 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] || 9514 info->attrs[NL80211_ATTR_FILS_ERP_REALM] || 9515 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] || 9516 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 9517 return -EINVAL; 9518 } 9519 9520 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) { 9521 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]); 9522 if (!nl80211_valid_auth_type(rdev, auth_type, 9523 NL80211_CMD_CONNECT)) 9524 return -EINVAL; 9525 9526 if (auth_type == NL80211_AUTHTYPE_FILS_SK && 9527 fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO)) 9528 return -EINVAL; 9529 9530 connect.auth_type = auth_type; 9531 changed |= UPDATE_AUTH_TYPE; 9532 } 9533 9534 wdev_lock(dev->ieee80211_ptr); 9535 if (!wdev->current_bss) 9536 ret = -ENOLINK; 9537 else 9538 ret = rdev_update_connect_params(rdev, dev, &connect, changed); 9539 wdev_unlock(dev->ieee80211_ptr); 9540 9541 return ret; 9542 } 9543 9544 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info) 9545 { 9546 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9547 struct net_device *dev = info->user_ptr[1]; 9548 u16 reason; 9549 int ret; 9550 9551 if (dev->ieee80211_ptr->conn_owner_nlportid && 9552 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid) 9553 return -EPERM; 9554 9555 if (!info->attrs[NL80211_ATTR_REASON_CODE]) 9556 reason = WLAN_REASON_DEAUTH_LEAVING; 9557 else 9558 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 9559 9560 if (reason == 0) 9561 return -EINVAL; 9562 9563 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 9564 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 9565 return -EOPNOTSUPP; 9566 9567 wdev_lock(dev->ieee80211_ptr); 9568 ret = cfg80211_disconnect(rdev, dev, reason, true); 9569 wdev_unlock(dev->ieee80211_ptr); 9570 return ret; 9571 } 9572 9573 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info) 9574 { 9575 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9576 struct net *net; 9577 int err; 9578 9579 if (info->attrs[NL80211_ATTR_PID]) { 9580 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]); 9581 9582 net = get_net_ns_by_pid(pid); 9583 } else if (info->attrs[NL80211_ATTR_NETNS_FD]) { 9584 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]); 9585 9586 net = get_net_ns_by_fd(fd); 9587 } else { 9588 return -EINVAL; 9589 } 9590 9591 if (IS_ERR(net)) 9592 return PTR_ERR(net); 9593 9594 err = 0; 9595 9596 /* check if anything to do */ 9597 if (!net_eq(wiphy_net(&rdev->wiphy), net)) 9598 err = cfg80211_switch_netns(rdev, net); 9599 9600 put_net(net); 9601 return err; 9602 } 9603 9604 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info) 9605 { 9606 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9607 int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev, 9608 struct cfg80211_pmksa *pmksa) = NULL; 9609 struct net_device *dev = info->user_ptr[1]; 9610 struct cfg80211_pmksa pmksa; 9611 9612 memset(&pmksa, 0, sizeof(struct cfg80211_pmksa)); 9613 9614 if (!info->attrs[NL80211_ATTR_PMKID]) 9615 return -EINVAL; 9616 9617 pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]); 9618 9619 if (info->attrs[NL80211_ATTR_MAC]) { 9620 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 9621 } else if (info->attrs[NL80211_ATTR_SSID] && 9622 info->attrs[NL80211_ATTR_FILS_CACHE_ID] && 9623 (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA || 9624 info->attrs[NL80211_ATTR_PMK])) { 9625 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 9626 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 9627 pmksa.cache_id = 9628 nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]); 9629 } else { 9630 return -EINVAL; 9631 } 9632 if (info->attrs[NL80211_ATTR_PMK]) { 9633 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]); 9634 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]); 9635 } 9636 9637 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 9638 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 9639 return -EOPNOTSUPP; 9640 9641 switch (info->genlhdr->cmd) { 9642 case NL80211_CMD_SET_PMKSA: 9643 rdev_ops = rdev->ops->set_pmksa; 9644 break; 9645 case NL80211_CMD_DEL_PMKSA: 9646 rdev_ops = rdev->ops->del_pmksa; 9647 break; 9648 default: 9649 WARN_ON(1); 9650 break; 9651 } 9652 9653 if (!rdev_ops) 9654 return -EOPNOTSUPP; 9655 9656 return rdev_ops(&rdev->wiphy, dev, &pmksa); 9657 } 9658 9659 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info) 9660 { 9661 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9662 struct net_device *dev = info->user_ptr[1]; 9663 9664 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 9665 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 9666 return -EOPNOTSUPP; 9667 9668 if (!rdev->ops->flush_pmksa) 9669 return -EOPNOTSUPP; 9670 9671 return rdev_flush_pmksa(rdev, dev); 9672 } 9673 9674 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info) 9675 { 9676 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9677 struct net_device *dev = info->user_ptr[1]; 9678 u8 action_code, dialog_token; 9679 u32 peer_capability = 0; 9680 u16 status_code; 9681 u8 *peer; 9682 bool initiator; 9683 9684 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) || 9685 !rdev->ops->tdls_mgmt) 9686 return -EOPNOTSUPP; 9687 9688 if (!info->attrs[NL80211_ATTR_TDLS_ACTION] || 9689 !info->attrs[NL80211_ATTR_STATUS_CODE] || 9690 !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] || 9691 !info->attrs[NL80211_ATTR_IE] || 9692 !info->attrs[NL80211_ATTR_MAC]) 9693 return -EINVAL; 9694 9695 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 9696 action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]); 9697 status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]); 9698 dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]); 9699 initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]); 9700 if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]) 9701 peer_capability = 9702 nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]); 9703 9704 return rdev_tdls_mgmt(rdev, dev, peer, action_code, 9705 dialog_token, status_code, peer_capability, 9706 initiator, 9707 nla_data(info->attrs[NL80211_ATTR_IE]), 9708 nla_len(info->attrs[NL80211_ATTR_IE])); 9709 } 9710 9711 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info) 9712 { 9713 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9714 struct net_device *dev = info->user_ptr[1]; 9715 enum nl80211_tdls_operation operation; 9716 u8 *peer; 9717 9718 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) || 9719 !rdev->ops->tdls_oper) 9720 return -EOPNOTSUPP; 9721 9722 if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] || 9723 !info->attrs[NL80211_ATTR_MAC]) 9724 return -EINVAL; 9725 9726 operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]); 9727 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 9728 9729 return rdev_tdls_oper(rdev, dev, peer, operation); 9730 } 9731 9732 static int nl80211_remain_on_channel(struct sk_buff *skb, 9733 struct genl_info *info) 9734 { 9735 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9736 struct wireless_dev *wdev = info->user_ptr[1]; 9737 struct cfg80211_chan_def chandef; 9738 const struct cfg80211_chan_def *compat_chandef; 9739 struct sk_buff *msg; 9740 void *hdr; 9741 u64 cookie; 9742 u32 duration; 9743 int err; 9744 9745 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] || 9746 !info->attrs[NL80211_ATTR_DURATION]) 9747 return -EINVAL; 9748 9749 duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]); 9750 9751 if (!rdev->ops->remain_on_channel || 9752 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)) 9753 return -EOPNOTSUPP; 9754 9755 /* 9756 * We should be on that channel for at least a minimum amount of 9757 * time (10ms) but no longer than the driver supports. 9758 */ 9759 if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME || 9760 duration > rdev->wiphy.max_remain_on_channel_duration) 9761 return -EINVAL; 9762 9763 err = nl80211_parse_chandef(rdev, info, &chandef); 9764 if (err) 9765 return err; 9766 9767 wdev_lock(wdev); 9768 if (!cfg80211_off_channel_oper_allowed(wdev) && 9769 !cfg80211_chandef_identical(&wdev->chandef, &chandef)) { 9770 compat_chandef = cfg80211_chandef_compatible(&wdev->chandef, 9771 &chandef); 9772 if (compat_chandef != &chandef) { 9773 wdev_unlock(wdev); 9774 return -EBUSY; 9775 } 9776 } 9777 wdev_unlock(wdev); 9778 9779 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 9780 if (!msg) 9781 return -ENOMEM; 9782 9783 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 9784 NL80211_CMD_REMAIN_ON_CHANNEL); 9785 if (!hdr) { 9786 err = -ENOBUFS; 9787 goto free_msg; 9788 } 9789 9790 err = rdev_remain_on_channel(rdev, wdev, chandef.chan, 9791 duration, &cookie); 9792 9793 if (err) 9794 goto free_msg; 9795 9796 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 9797 NL80211_ATTR_PAD)) 9798 goto nla_put_failure; 9799 9800 genlmsg_end(msg, hdr); 9801 9802 return genlmsg_reply(msg, info); 9803 9804 nla_put_failure: 9805 err = -ENOBUFS; 9806 free_msg: 9807 nlmsg_free(msg); 9808 return err; 9809 } 9810 9811 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb, 9812 struct genl_info *info) 9813 { 9814 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9815 struct wireless_dev *wdev = info->user_ptr[1]; 9816 u64 cookie; 9817 9818 if (!info->attrs[NL80211_ATTR_COOKIE]) 9819 return -EINVAL; 9820 9821 if (!rdev->ops->cancel_remain_on_channel) 9822 return -EOPNOTSUPP; 9823 9824 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 9825 9826 return rdev_cancel_remain_on_channel(rdev, wdev, cookie); 9827 } 9828 9829 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb, 9830 struct genl_info *info) 9831 { 9832 struct cfg80211_bitrate_mask mask; 9833 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9834 struct net_device *dev = info->user_ptr[1]; 9835 int err; 9836 9837 if (!rdev->ops->set_bitrate_mask) 9838 return -EOPNOTSUPP; 9839 9840 err = nl80211_parse_tx_bitrate_mask(info, &mask); 9841 if (err) 9842 return err; 9843 9844 return rdev_set_bitrate_mask(rdev, dev, NULL, &mask); 9845 } 9846 9847 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info) 9848 { 9849 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9850 struct wireless_dev *wdev = info->user_ptr[1]; 9851 u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION; 9852 9853 if (!info->attrs[NL80211_ATTR_FRAME_MATCH]) 9854 return -EINVAL; 9855 9856 if (info->attrs[NL80211_ATTR_FRAME_TYPE]) 9857 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]); 9858 9859 switch (wdev->iftype) { 9860 case NL80211_IFTYPE_STATION: 9861 case NL80211_IFTYPE_ADHOC: 9862 case NL80211_IFTYPE_P2P_CLIENT: 9863 case NL80211_IFTYPE_AP: 9864 case NL80211_IFTYPE_AP_VLAN: 9865 case NL80211_IFTYPE_MESH_POINT: 9866 case NL80211_IFTYPE_P2P_GO: 9867 case NL80211_IFTYPE_P2P_DEVICE: 9868 break; 9869 case NL80211_IFTYPE_NAN: 9870 default: 9871 return -EOPNOTSUPP; 9872 } 9873 9874 /* not much point in registering if we can't reply */ 9875 if (!rdev->ops->mgmt_tx) 9876 return -EOPNOTSUPP; 9877 9878 return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type, 9879 nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]), 9880 nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH])); 9881 } 9882 9883 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info) 9884 { 9885 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9886 struct wireless_dev *wdev = info->user_ptr[1]; 9887 struct cfg80211_chan_def chandef; 9888 int err; 9889 void *hdr = NULL; 9890 u64 cookie; 9891 struct sk_buff *msg = NULL; 9892 struct cfg80211_mgmt_tx_params params = { 9893 .dont_wait_for_ack = 9894 info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK], 9895 }; 9896 9897 if (!info->attrs[NL80211_ATTR_FRAME]) 9898 return -EINVAL; 9899 9900 if (!rdev->ops->mgmt_tx) 9901 return -EOPNOTSUPP; 9902 9903 switch (wdev->iftype) { 9904 case NL80211_IFTYPE_P2P_DEVICE: 9905 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ]) 9906 return -EINVAL; 9907 case NL80211_IFTYPE_STATION: 9908 case NL80211_IFTYPE_ADHOC: 9909 case NL80211_IFTYPE_P2P_CLIENT: 9910 case NL80211_IFTYPE_AP: 9911 case NL80211_IFTYPE_AP_VLAN: 9912 case NL80211_IFTYPE_MESH_POINT: 9913 case NL80211_IFTYPE_P2P_GO: 9914 break; 9915 case NL80211_IFTYPE_NAN: 9916 default: 9917 return -EOPNOTSUPP; 9918 } 9919 9920 if (info->attrs[NL80211_ATTR_DURATION]) { 9921 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX)) 9922 return -EINVAL; 9923 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]); 9924 9925 /* 9926 * We should wait on the channel for at least a minimum amount 9927 * of time (10ms) but no longer than the driver supports. 9928 */ 9929 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME || 9930 params.wait > rdev->wiphy.max_remain_on_channel_duration) 9931 return -EINVAL; 9932 } 9933 9934 params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK]; 9935 9936 if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX)) 9937 return -EINVAL; 9938 9939 params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]); 9940 9941 /* get the channel if any has been specified, otherwise pass NULL to 9942 * the driver. The latter will use the current one 9943 */ 9944 chandef.chan = NULL; 9945 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 9946 err = nl80211_parse_chandef(rdev, info, &chandef); 9947 if (err) 9948 return err; 9949 } 9950 9951 if (!chandef.chan && params.offchan) 9952 return -EINVAL; 9953 9954 wdev_lock(wdev); 9955 if (params.offchan && !cfg80211_off_channel_oper_allowed(wdev)) { 9956 wdev_unlock(wdev); 9957 return -EBUSY; 9958 } 9959 wdev_unlock(wdev); 9960 9961 params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]); 9962 params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]); 9963 9964 if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) { 9965 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]); 9966 int i; 9967 9968 if (len % sizeof(u16)) 9969 return -EINVAL; 9970 9971 params.n_csa_offsets = len / sizeof(u16); 9972 params.csa_offsets = 9973 nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]); 9974 9975 /* check that all the offsets fit the frame */ 9976 for (i = 0; i < params.n_csa_offsets; i++) { 9977 if (params.csa_offsets[i] >= params.len) 9978 return -EINVAL; 9979 } 9980 } 9981 9982 if (!params.dont_wait_for_ack) { 9983 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 9984 if (!msg) 9985 return -ENOMEM; 9986 9987 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 9988 NL80211_CMD_FRAME); 9989 if (!hdr) { 9990 err = -ENOBUFS; 9991 goto free_msg; 9992 } 9993 } 9994 9995 params.chan = chandef.chan; 9996 err = cfg80211_mlme_mgmt_tx(rdev, wdev, ¶ms, &cookie); 9997 if (err) 9998 goto free_msg; 9999 10000 if (msg) { 10001 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 10002 NL80211_ATTR_PAD)) 10003 goto nla_put_failure; 10004 10005 genlmsg_end(msg, hdr); 10006 return genlmsg_reply(msg, info); 10007 } 10008 10009 return 0; 10010 10011 nla_put_failure: 10012 err = -ENOBUFS; 10013 free_msg: 10014 nlmsg_free(msg); 10015 return err; 10016 } 10017 10018 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info) 10019 { 10020 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10021 struct wireless_dev *wdev = info->user_ptr[1]; 10022 u64 cookie; 10023 10024 if (!info->attrs[NL80211_ATTR_COOKIE]) 10025 return -EINVAL; 10026 10027 if (!rdev->ops->mgmt_tx_cancel_wait) 10028 return -EOPNOTSUPP; 10029 10030 switch (wdev->iftype) { 10031 case NL80211_IFTYPE_STATION: 10032 case NL80211_IFTYPE_ADHOC: 10033 case NL80211_IFTYPE_P2P_CLIENT: 10034 case NL80211_IFTYPE_AP: 10035 case NL80211_IFTYPE_AP_VLAN: 10036 case NL80211_IFTYPE_P2P_GO: 10037 case NL80211_IFTYPE_P2P_DEVICE: 10038 break; 10039 case NL80211_IFTYPE_NAN: 10040 default: 10041 return -EOPNOTSUPP; 10042 } 10043 10044 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 10045 10046 return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie); 10047 } 10048 10049 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info) 10050 { 10051 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10052 struct wireless_dev *wdev; 10053 struct net_device *dev = info->user_ptr[1]; 10054 u8 ps_state; 10055 bool state; 10056 int err; 10057 10058 if (!info->attrs[NL80211_ATTR_PS_STATE]) 10059 return -EINVAL; 10060 10061 ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]); 10062 10063 wdev = dev->ieee80211_ptr; 10064 10065 if (!rdev->ops->set_power_mgmt) 10066 return -EOPNOTSUPP; 10067 10068 state = (ps_state == NL80211_PS_ENABLED) ? true : false; 10069 10070 if (state == wdev->ps) 10071 return 0; 10072 10073 err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout); 10074 if (!err) 10075 wdev->ps = state; 10076 return err; 10077 } 10078 10079 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info) 10080 { 10081 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10082 enum nl80211_ps_state ps_state; 10083 struct wireless_dev *wdev; 10084 struct net_device *dev = info->user_ptr[1]; 10085 struct sk_buff *msg; 10086 void *hdr; 10087 int err; 10088 10089 wdev = dev->ieee80211_ptr; 10090 10091 if (!rdev->ops->set_power_mgmt) 10092 return -EOPNOTSUPP; 10093 10094 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 10095 if (!msg) 10096 return -ENOMEM; 10097 10098 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 10099 NL80211_CMD_GET_POWER_SAVE); 10100 if (!hdr) { 10101 err = -ENOBUFS; 10102 goto free_msg; 10103 } 10104 10105 if (wdev->ps) 10106 ps_state = NL80211_PS_ENABLED; 10107 else 10108 ps_state = NL80211_PS_DISABLED; 10109 10110 if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state)) 10111 goto nla_put_failure; 10112 10113 genlmsg_end(msg, hdr); 10114 return genlmsg_reply(msg, info); 10115 10116 nla_put_failure: 10117 err = -ENOBUFS; 10118 free_msg: 10119 nlmsg_free(msg); 10120 return err; 10121 } 10122 10123 static const struct nla_policy 10124 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = { 10125 [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY }, 10126 [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 }, 10127 [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 }, 10128 [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 }, 10129 [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 }, 10130 [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 }, 10131 [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 }, 10132 }; 10133 10134 static int nl80211_set_cqm_txe(struct genl_info *info, 10135 u32 rate, u32 pkts, u32 intvl) 10136 { 10137 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10138 struct net_device *dev = info->user_ptr[1]; 10139 struct wireless_dev *wdev = dev->ieee80211_ptr; 10140 10141 if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL) 10142 return -EINVAL; 10143 10144 if (!rdev->ops->set_cqm_txe_config) 10145 return -EOPNOTSUPP; 10146 10147 if (wdev->iftype != NL80211_IFTYPE_STATION && 10148 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 10149 return -EOPNOTSUPP; 10150 10151 return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl); 10152 } 10153 10154 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev, 10155 struct net_device *dev) 10156 { 10157 struct wireless_dev *wdev = dev->ieee80211_ptr; 10158 s32 last, low, high; 10159 u32 hyst; 10160 int i, n, low_index; 10161 int err; 10162 10163 /* RSSI reporting disabled? */ 10164 if (!wdev->cqm_config) 10165 return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0); 10166 10167 /* 10168 * Obtain current RSSI value if possible, if not and no RSSI threshold 10169 * event has been received yet, we should receive an event after a 10170 * connection is established and enough beacons received to calculate 10171 * the average. 10172 */ 10173 if (!wdev->cqm_config->last_rssi_event_value && wdev->current_bss && 10174 rdev->ops->get_station) { 10175 struct station_info sinfo = {}; 10176 u8 *mac_addr; 10177 10178 mac_addr = wdev->current_bss->pub.bssid; 10179 10180 err = rdev_get_station(rdev, dev, mac_addr, &sinfo); 10181 if (err) 10182 return err; 10183 10184 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG)) 10185 wdev->cqm_config->last_rssi_event_value = 10186 (s8) sinfo.rx_beacon_signal_avg; 10187 } 10188 10189 last = wdev->cqm_config->last_rssi_event_value; 10190 hyst = wdev->cqm_config->rssi_hyst; 10191 n = wdev->cqm_config->n_rssi_thresholds; 10192 10193 for (i = 0; i < n; i++) 10194 if (last < wdev->cqm_config->rssi_thresholds[i]) 10195 break; 10196 10197 low_index = i - 1; 10198 if (low_index >= 0) { 10199 low_index = array_index_nospec(low_index, n); 10200 low = wdev->cqm_config->rssi_thresholds[low_index] - hyst; 10201 } else { 10202 low = S32_MIN; 10203 } 10204 if (i < n) { 10205 i = array_index_nospec(i, n); 10206 high = wdev->cqm_config->rssi_thresholds[i] + hyst - 1; 10207 } else { 10208 high = S32_MAX; 10209 } 10210 10211 return rdev_set_cqm_rssi_range_config(rdev, dev, low, high); 10212 } 10213 10214 static int nl80211_set_cqm_rssi(struct genl_info *info, 10215 const s32 *thresholds, int n_thresholds, 10216 u32 hysteresis) 10217 { 10218 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10219 struct net_device *dev = info->user_ptr[1]; 10220 struct wireless_dev *wdev = dev->ieee80211_ptr; 10221 int i, err; 10222 s32 prev = S32_MIN; 10223 10224 /* Check all values negative and sorted */ 10225 for (i = 0; i < n_thresholds; i++) { 10226 if (thresholds[i] > 0 || thresholds[i] <= prev) 10227 return -EINVAL; 10228 10229 prev = thresholds[i]; 10230 } 10231 10232 if (wdev->iftype != NL80211_IFTYPE_STATION && 10233 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 10234 return -EOPNOTSUPP; 10235 10236 wdev_lock(wdev); 10237 cfg80211_cqm_config_free(wdev); 10238 wdev_unlock(wdev); 10239 10240 if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) { 10241 if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */ 10242 return rdev_set_cqm_rssi_config(rdev, dev, 0, 0); 10243 10244 return rdev_set_cqm_rssi_config(rdev, dev, 10245 thresholds[0], hysteresis); 10246 } 10247 10248 if (!wiphy_ext_feature_isset(&rdev->wiphy, 10249 NL80211_EXT_FEATURE_CQM_RSSI_LIST)) 10250 return -EOPNOTSUPP; 10251 10252 if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */ 10253 n_thresholds = 0; 10254 10255 wdev_lock(wdev); 10256 if (n_thresholds) { 10257 struct cfg80211_cqm_config *cqm_config; 10258 10259 cqm_config = kzalloc(sizeof(struct cfg80211_cqm_config) + 10260 n_thresholds * sizeof(s32), GFP_KERNEL); 10261 if (!cqm_config) { 10262 err = -ENOMEM; 10263 goto unlock; 10264 } 10265 10266 cqm_config->rssi_hyst = hysteresis; 10267 cqm_config->n_rssi_thresholds = n_thresholds; 10268 memcpy(cqm_config->rssi_thresholds, thresholds, 10269 n_thresholds * sizeof(s32)); 10270 10271 wdev->cqm_config = cqm_config; 10272 } 10273 10274 err = cfg80211_cqm_rssi_update(rdev, dev); 10275 10276 unlock: 10277 wdev_unlock(wdev); 10278 10279 return err; 10280 } 10281 10282 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info) 10283 { 10284 struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1]; 10285 struct nlattr *cqm; 10286 int err; 10287 10288 cqm = info->attrs[NL80211_ATTR_CQM]; 10289 if (!cqm) 10290 return -EINVAL; 10291 10292 err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm, 10293 nl80211_attr_cqm_policy, info->extack); 10294 if (err) 10295 return err; 10296 10297 if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] && 10298 attrs[NL80211_ATTR_CQM_RSSI_HYST]) { 10299 const s32 *thresholds = 10300 nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]); 10301 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]); 10302 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]); 10303 10304 if (len % 4) 10305 return -EINVAL; 10306 10307 return nl80211_set_cqm_rssi(info, thresholds, len / 4, 10308 hysteresis); 10309 } 10310 10311 if (attrs[NL80211_ATTR_CQM_TXE_RATE] && 10312 attrs[NL80211_ATTR_CQM_TXE_PKTS] && 10313 attrs[NL80211_ATTR_CQM_TXE_INTVL]) { 10314 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]); 10315 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]); 10316 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]); 10317 10318 return nl80211_set_cqm_txe(info, rate, pkts, intvl); 10319 } 10320 10321 return -EINVAL; 10322 } 10323 10324 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info) 10325 { 10326 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10327 struct net_device *dev = info->user_ptr[1]; 10328 struct ocb_setup setup = {}; 10329 int err; 10330 10331 err = nl80211_parse_chandef(rdev, info, &setup.chandef); 10332 if (err) 10333 return err; 10334 10335 return cfg80211_join_ocb(rdev, dev, &setup); 10336 } 10337 10338 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info) 10339 { 10340 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10341 struct net_device *dev = info->user_ptr[1]; 10342 10343 return cfg80211_leave_ocb(rdev, dev); 10344 } 10345 10346 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info) 10347 { 10348 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10349 struct net_device *dev = info->user_ptr[1]; 10350 struct mesh_config cfg; 10351 struct mesh_setup setup; 10352 int err; 10353 10354 /* start with default */ 10355 memcpy(&cfg, &default_mesh_config, sizeof(cfg)); 10356 memcpy(&setup, &default_mesh_setup, sizeof(setup)); 10357 10358 if (info->attrs[NL80211_ATTR_MESH_CONFIG]) { 10359 /* and parse parameters if given */ 10360 err = nl80211_parse_mesh_config(info, &cfg, NULL); 10361 if (err) 10362 return err; 10363 } 10364 10365 if (!info->attrs[NL80211_ATTR_MESH_ID] || 10366 !nla_len(info->attrs[NL80211_ATTR_MESH_ID])) 10367 return -EINVAL; 10368 10369 setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]); 10370 setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]); 10371 10372 if (info->attrs[NL80211_ATTR_MCAST_RATE] && 10373 !nl80211_parse_mcast_rate(rdev, setup.mcast_rate, 10374 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]))) 10375 return -EINVAL; 10376 10377 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) { 10378 setup.beacon_interval = 10379 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]); 10380 10381 err = cfg80211_validate_beacon_int(rdev, 10382 NL80211_IFTYPE_MESH_POINT, 10383 setup.beacon_interval); 10384 if (err) 10385 return err; 10386 } 10387 10388 if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) { 10389 setup.dtim_period = 10390 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]); 10391 if (setup.dtim_period < 1 || setup.dtim_period > 100) 10392 return -EINVAL; 10393 } 10394 10395 if (info->attrs[NL80211_ATTR_MESH_SETUP]) { 10396 /* parse additional setup parameters if given */ 10397 err = nl80211_parse_mesh_setup(info, &setup); 10398 if (err) 10399 return err; 10400 } 10401 10402 if (setup.user_mpm) 10403 cfg.auto_open_plinks = false; 10404 10405 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 10406 err = nl80211_parse_chandef(rdev, info, &setup.chandef); 10407 if (err) 10408 return err; 10409 } else { 10410 /* __cfg80211_join_mesh() will sort it out */ 10411 setup.chandef.chan = NULL; 10412 } 10413 10414 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) { 10415 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 10416 int n_rates = 10417 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 10418 struct ieee80211_supported_band *sband; 10419 10420 if (!setup.chandef.chan) 10421 return -EINVAL; 10422 10423 sband = rdev->wiphy.bands[setup.chandef.chan->band]; 10424 10425 err = ieee80211_get_ratemask(sband, rates, n_rates, 10426 &setup.basic_rates); 10427 if (err) 10428 return err; 10429 } 10430 10431 if (info->attrs[NL80211_ATTR_TX_RATES]) { 10432 err = nl80211_parse_tx_bitrate_mask(info, &setup.beacon_rate); 10433 if (err) 10434 return err; 10435 10436 if (!setup.chandef.chan) 10437 return -EINVAL; 10438 10439 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band, 10440 &setup.beacon_rate); 10441 if (err) 10442 return err; 10443 } 10444 10445 setup.userspace_handles_dfs = 10446 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]); 10447 10448 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) { 10449 int r = validate_pae_over_nl80211(rdev, info); 10450 10451 if (r < 0) 10452 return r; 10453 10454 setup.control_port_over_nl80211 = true; 10455 } 10456 10457 wdev_lock(dev->ieee80211_ptr); 10458 err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg); 10459 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) 10460 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid; 10461 wdev_unlock(dev->ieee80211_ptr); 10462 10463 return err; 10464 } 10465 10466 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info) 10467 { 10468 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10469 struct net_device *dev = info->user_ptr[1]; 10470 10471 return cfg80211_leave_mesh(rdev, dev); 10472 } 10473 10474 #ifdef CONFIG_PM 10475 static int nl80211_send_wowlan_patterns(struct sk_buff *msg, 10476 struct cfg80211_registered_device *rdev) 10477 { 10478 struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config; 10479 struct nlattr *nl_pats, *nl_pat; 10480 int i, pat_len; 10481 10482 if (!wowlan->n_patterns) 10483 return 0; 10484 10485 nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN); 10486 if (!nl_pats) 10487 return -ENOBUFS; 10488 10489 for (i = 0; i < wowlan->n_patterns; i++) { 10490 nl_pat = nla_nest_start(msg, i + 1); 10491 if (!nl_pat) 10492 return -ENOBUFS; 10493 pat_len = wowlan->patterns[i].pattern_len; 10494 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8), 10495 wowlan->patterns[i].mask) || 10496 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len, 10497 wowlan->patterns[i].pattern) || 10498 nla_put_u32(msg, NL80211_PKTPAT_OFFSET, 10499 wowlan->patterns[i].pkt_offset)) 10500 return -ENOBUFS; 10501 nla_nest_end(msg, nl_pat); 10502 } 10503 nla_nest_end(msg, nl_pats); 10504 10505 return 0; 10506 } 10507 10508 static int nl80211_send_wowlan_tcp(struct sk_buff *msg, 10509 struct cfg80211_wowlan_tcp *tcp) 10510 { 10511 struct nlattr *nl_tcp; 10512 10513 if (!tcp) 10514 return 0; 10515 10516 nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION); 10517 if (!nl_tcp) 10518 return -ENOBUFS; 10519 10520 if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) || 10521 nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) || 10522 nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) || 10523 nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) || 10524 nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) || 10525 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD, 10526 tcp->payload_len, tcp->payload) || 10527 nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL, 10528 tcp->data_interval) || 10529 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD, 10530 tcp->wake_len, tcp->wake_data) || 10531 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK, 10532 DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask)) 10533 return -ENOBUFS; 10534 10535 if (tcp->payload_seq.len && 10536 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ, 10537 sizeof(tcp->payload_seq), &tcp->payload_seq)) 10538 return -ENOBUFS; 10539 10540 if (tcp->payload_tok.len && 10541 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN, 10542 sizeof(tcp->payload_tok) + tcp->tokens_size, 10543 &tcp->payload_tok)) 10544 return -ENOBUFS; 10545 10546 nla_nest_end(msg, nl_tcp); 10547 10548 return 0; 10549 } 10550 10551 static int nl80211_send_wowlan_nd(struct sk_buff *msg, 10552 struct cfg80211_sched_scan_request *req) 10553 { 10554 struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan; 10555 int i; 10556 10557 if (!req) 10558 return 0; 10559 10560 nd = nla_nest_start(msg, NL80211_WOWLAN_TRIG_NET_DETECT); 10561 if (!nd) 10562 return -ENOBUFS; 10563 10564 if (req->n_scan_plans == 1 && 10565 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL, 10566 req->scan_plans[0].interval * 1000)) 10567 return -ENOBUFS; 10568 10569 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay)) 10570 return -ENOBUFS; 10571 10572 if (req->relative_rssi_set) { 10573 struct nl80211_bss_select_rssi_adjust rssi_adjust; 10574 10575 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI, 10576 req->relative_rssi)) 10577 return -ENOBUFS; 10578 10579 rssi_adjust.band = req->rssi_adjust.band; 10580 rssi_adjust.delta = req->rssi_adjust.delta; 10581 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST, 10582 sizeof(rssi_adjust), &rssi_adjust)) 10583 return -ENOBUFS; 10584 } 10585 10586 freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES); 10587 if (!freqs) 10588 return -ENOBUFS; 10589 10590 for (i = 0; i < req->n_channels; i++) { 10591 if (nla_put_u32(msg, i, req->channels[i]->center_freq)) 10592 return -ENOBUFS; 10593 } 10594 10595 nla_nest_end(msg, freqs); 10596 10597 if (req->n_match_sets) { 10598 matches = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH); 10599 if (!matches) 10600 return -ENOBUFS; 10601 10602 for (i = 0; i < req->n_match_sets; i++) { 10603 match = nla_nest_start(msg, i); 10604 if (!match) 10605 return -ENOBUFS; 10606 10607 if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID, 10608 req->match_sets[i].ssid.ssid_len, 10609 req->match_sets[i].ssid.ssid)) 10610 return -ENOBUFS; 10611 nla_nest_end(msg, match); 10612 } 10613 nla_nest_end(msg, matches); 10614 } 10615 10616 scan_plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS); 10617 if (!scan_plans) 10618 return -ENOBUFS; 10619 10620 for (i = 0; i < req->n_scan_plans; i++) { 10621 scan_plan = nla_nest_start(msg, i + 1); 10622 if (!scan_plan) 10623 return -ENOBUFS; 10624 10625 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL, 10626 req->scan_plans[i].interval) || 10627 (req->scan_plans[i].iterations && 10628 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS, 10629 req->scan_plans[i].iterations))) 10630 return -ENOBUFS; 10631 nla_nest_end(msg, scan_plan); 10632 } 10633 nla_nest_end(msg, scan_plans); 10634 10635 nla_nest_end(msg, nd); 10636 10637 return 0; 10638 } 10639 10640 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info) 10641 { 10642 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10643 struct sk_buff *msg; 10644 void *hdr; 10645 u32 size = NLMSG_DEFAULT_SIZE; 10646 10647 if (!rdev->wiphy.wowlan) 10648 return -EOPNOTSUPP; 10649 10650 if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) { 10651 /* adjust size to have room for all the data */ 10652 size += rdev->wiphy.wowlan_config->tcp->tokens_size + 10653 rdev->wiphy.wowlan_config->tcp->payload_len + 10654 rdev->wiphy.wowlan_config->tcp->wake_len + 10655 rdev->wiphy.wowlan_config->tcp->wake_len / 8; 10656 } 10657 10658 msg = nlmsg_new(size, GFP_KERNEL); 10659 if (!msg) 10660 return -ENOMEM; 10661 10662 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 10663 NL80211_CMD_GET_WOWLAN); 10664 if (!hdr) 10665 goto nla_put_failure; 10666 10667 if (rdev->wiphy.wowlan_config) { 10668 struct nlattr *nl_wowlan; 10669 10670 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS); 10671 if (!nl_wowlan) 10672 goto nla_put_failure; 10673 10674 if ((rdev->wiphy.wowlan_config->any && 10675 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) || 10676 (rdev->wiphy.wowlan_config->disconnect && 10677 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) || 10678 (rdev->wiphy.wowlan_config->magic_pkt && 10679 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) || 10680 (rdev->wiphy.wowlan_config->gtk_rekey_failure && 10681 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) || 10682 (rdev->wiphy.wowlan_config->eap_identity_req && 10683 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) || 10684 (rdev->wiphy.wowlan_config->four_way_handshake && 10685 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) || 10686 (rdev->wiphy.wowlan_config->rfkill_release && 10687 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))) 10688 goto nla_put_failure; 10689 10690 if (nl80211_send_wowlan_patterns(msg, rdev)) 10691 goto nla_put_failure; 10692 10693 if (nl80211_send_wowlan_tcp(msg, 10694 rdev->wiphy.wowlan_config->tcp)) 10695 goto nla_put_failure; 10696 10697 if (nl80211_send_wowlan_nd( 10698 msg, 10699 rdev->wiphy.wowlan_config->nd_config)) 10700 goto nla_put_failure; 10701 10702 nla_nest_end(msg, nl_wowlan); 10703 } 10704 10705 genlmsg_end(msg, hdr); 10706 return genlmsg_reply(msg, info); 10707 10708 nla_put_failure: 10709 nlmsg_free(msg); 10710 return -ENOBUFS; 10711 } 10712 10713 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev, 10714 struct nlattr *attr, 10715 struct cfg80211_wowlan *trig) 10716 { 10717 struct nlattr *tb[NUM_NL80211_WOWLAN_TCP]; 10718 struct cfg80211_wowlan_tcp *cfg; 10719 struct nl80211_wowlan_tcp_data_token *tok = NULL; 10720 struct nl80211_wowlan_tcp_data_seq *seq = NULL; 10721 u32 size; 10722 u32 data_size, wake_size, tokens_size = 0, wake_mask_size; 10723 int err, port; 10724 10725 if (!rdev->wiphy.wowlan->tcp) 10726 return -EINVAL; 10727 10728 err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TCP, attr, 10729 nl80211_wowlan_tcp_policy, NULL); 10730 if (err) 10731 return err; 10732 10733 if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] || 10734 !tb[NL80211_WOWLAN_TCP_DST_IPV4] || 10735 !tb[NL80211_WOWLAN_TCP_DST_MAC] || 10736 !tb[NL80211_WOWLAN_TCP_DST_PORT] || 10737 !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] || 10738 !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] || 10739 !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] || 10740 !tb[NL80211_WOWLAN_TCP_WAKE_MASK]) 10741 return -EINVAL; 10742 10743 data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]); 10744 if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max) 10745 return -EINVAL; 10746 10747 if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) > 10748 rdev->wiphy.wowlan->tcp->data_interval_max || 10749 nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0) 10750 return -EINVAL; 10751 10752 wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]); 10753 if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max) 10754 return -EINVAL; 10755 10756 wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]); 10757 if (wake_mask_size != DIV_ROUND_UP(wake_size, 8)) 10758 return -EINVAL; 10759 10760 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) { 10761 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]); 10762 10763 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]); 10764 tokens_size = tokln - sizeof(*tok); 10765 10766 if (!tok->len || tokens_size % tok->len) 10767 return -EINVAL; 10768 if (!rdev->wiphy.wowlan->tcp->tok) 10769 return -EINVAL; 10770 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len) 10771 return -EINVAL; 10772 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len) 10773 return -EINVAL; 10774 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize) 10775 return -EINVAL; 10776 if (tok->offset + tok->len > data_size) 10777 return -EINVAL; 10778 } 10779 10780 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) { 10781 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]); 10782 if (!rdev->wiphy.wowlan->tcp->seq) 10783 return -EINVAL; 10784 if (seq->len == 0 || seq->len > 4) 10785 return -EINVAL; 10786 if (seq->len + seq->offset > data_size) 10787 return -EINVAL; 10788 } 10789 10790 size = sizeof(*cfg); 10791 size += data_size; 10792 size += wake_size + wake_mask_size; 10793 size += tokens_size; 10794 10795 cfg = kzalloc(size, GFP_KERNEL); 10796 if (!cfg) 10797 return -ENOMEM; 10798 cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]); 10799 cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]); 10800 memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]), 10801 ETH_ALEN); 10802 if (tb[NL80211_WOWLAN_TCP_SRC_PORT]) 10803 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]); 10804 else 10805 port = 0; 10806 #ifdef CONFIG_INET 10807 /* allocate a socket and port for it and use it */ 10808 err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM, 10809 IPPROTO_TCP, &cfg->sock, 1); 10810 if (err) { 10811 kfree(cfg); 10812 return err; 10813 } 10814 if (inet_csk_get_port(cfg->sock->sk, port)) { 10815 sock_release(cfg->sock); 10816 kfree(cfg); 10817 return -EADDRINUSE; 10818 } 10819 cfg->src_port = inet_sk(cfg->sock->sk)->inet_num; 10820 #else 10821 if (!port) { 10822 kfree(cfg); 10823 return -EINVAL; 10824 } 10825 cfg->src_port = port; 10826 #endif 10827 10828 cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]); 10829 cfg->payload_len = data_size; 10830 cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size; 10831 memcpy((void *)cfg->payload, 10832 nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]), 10833 data_size); 10834 if (seq) 10835 cfg->payload_seq = *seq; 10836 cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]); 10837 cfg->wake_len = wake_size; 10838 cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size; 10839 memcpy((void *)cfg->wake_data, 10840 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]), 10841 wake_size); 10842 cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size + 10843 data_size + wake_size; 10844 memcpy((void *)cfg->wake_mask, 10845 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]), 10846 wake_mask_size); 10847 if (tok) { 10848 cfg->tokens_size = tokens_size; 10849 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size); 10850 } 10851 10852 trig->tcp = cfg; 10853 10854 return 0; 10855 } 10856 10857 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev, 10858 const struct wiphy_wowlan_support *wowlan, 10859 struct nlattr *attr, 10860 struct cfg80211_wowlan *trig) 10861 { 10862 struct nlattr **tb; 10863 int err; 10864 10865 tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL); 10866 if (!tb) 10867 return -ENOMEM; 10868 10869 if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) { 10870 err = -EOPNOTSUPP; 10871 goto out; 10872 } 10873 10874 err = nla_parse_nested(tb, NL80211_ATTR_MAX, attr, nl80211_policy, 10875 NULL); 10876 if (err) 10877 goto out; 10878 10879 trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb, 10880 wowlan->max_nd_match_sets); 10881 err = PTR_ERR_OR_ZERO(trig->nd_config); 10882 if (err) 10883 trig->nd_config = NULL; 10884 10885 out: 10886 kfree(tb); 10887 return err; 10888 } 10889 10890 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info) 10891 { 10892 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10893 struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG]; 10894 struct cfg80211_wowlan new_triggers = {}; 10895 struct cfg80211_wowlan *ntrig; 10896 const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan; 10897 int err, i; 10898 bool prev_enabled = rdev->wiphy.wowlan_config; 10899 bool regular = false; 10900 10901 if (!wowlan) 10902 return -EOPNOTSUPP; 10903 10904 if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) { 10905 cfg80211_rdev_free_wowlan(rdev); 10906 rdev->wiphy.wowlan_config = NULL; 10907 goto set_wakeup; 10908 } 10909 10910 err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TRIG, 10911 info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS], 10912 nl80211_wowlan_policy, info->extack); 10913 if (err) 10914 return err; 10915 10916 if (tb[NL80211_WOWLAN_TRIG_ANY]) { 10917 if (!(wowlan->flags & WIPHY_WOWLAN_ANY)) 10918 return -EINVAL; 10919 new_triggers.any = true; 10920 } 10921 10922 if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) { 10923 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT)) 10924 return -EINVAL; 10925 new_triggers.disconnect = true; 10926 regular = true; 10927 } 10928 10929 if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) { 10930 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT)) 10931 return -EINVAL; 10932 new_triggers.magic_pkt = true; 10933 regular = true; 10934 } 10935 10936 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED]) 10937 return -EINVAL; 10938 10939 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) { 10940 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE)) 10941 return -EINVAL; 10942 new_triggers.gtk_rekey_failure = true; 10943 regular = true; 10944 } 10945 10946 if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) { 10947 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ)) 10948 return -EINVAL; 10949 new_triggers.eap_identity_req = true; 10950 regular = true; 10951 } 10952 10953 if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) { 10954 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE)) 10955 return -EINVAL; 10956 new_triggers.four_way_handshake = true; 10957 regular = true; 10958 } 10959 10960 if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) { 10961 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE)) 10962 return -EINVAL; 10963 new_triggers.rfkill_release = true; 10964 regular = true; 10965 } 10966 10967 if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) { 10968 struct nlattr *pat; 10969 int n_patterns = 0; 10970 int rem, pat_len, mask_len, pkt_offset; 10971 struct nlattr *pat_tb[NUM_NL80211_PKTPAT]; 10972 10973 regular = true; 10974 10975 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN], 10976 rem) 10977 n_patterns++; 10978 if (n_patterns > wowlan->n_patterns) 10979 return -EINVAL; 10980 10981 new_triggers.patterns = kcalloc(n_patterns, 10982 sizeof(new_triggers.patterns[0]), 10983 GFP_KERNEL); 10984 if (!new_triggers.patterns) 10985 return -ENOMEM; 10986 10987 new_triggers.n_patterns = n_patterns; 10988 i = 0; 10989 10990 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN], 10991 rem) { 10992 u8 *mask_pat; 10993 10994 err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat, 10995 nl80211_packet_pattern_policy, 10996 info->extack); 10997 if (err) 10998 goto error; 10999 11000 err = -EINVAL; 11001 if (!pat_tb[NL80211_PKTPAT_MASK] || 11002 !pat_tb[NL80211_PKTPAT_PATTERN]) 11003 goto error; 11004 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]); 11005 mask_len = DIV_ROUND_UP(pat_len, 8); 11006 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len) 11007 goto error; 11008 if (pat_len > wowlan->pattern_max_len || 11009 pat_len < wowlan->pattern_min_len) 11010 goto error; 11011 11012 if (!pat_tb[NL80211_PKTPAT_OFFSET]) 11013 pkt_offset = 0; 11014 else 11015 pkt_offset = nla_get_u32( 11016 pat_tb[NL80211_PKTPAT_OFFSET]); 11017 if (pkt_offset > wowlan->max_pkt_offset) 11018 goto error; 11019 new_triggers.patterns[i].pkt_offset = pkt_offset; 11020 11021 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL); 11022 if (!mask_pat) { 11023 err = -ENOMEM; 11024 goto error; 11025 } 11026 new_triggers.patterns[i].mask = mask_pat; 11027 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]), 11028 mask_len); 11029 mask_pat += mask_len; 11030 new_triggers.patterns[i].pattern = mask_pat; 11031 new_triggers.patterns[i].pattern_len = pat_len; 11032 memcpy(mask_pat, 11033 nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), 11034 pat_len); 11035 i++; 11036 } 11037 } 11038 11039 if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) { 11040 regular = true; 11041 err = nl80211_parse_wowlan_tcp( 11042 rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION], 11043 &new_triggers); 11044 if (err) 11045 goto error; 11046 } 11047 11048 if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) { 11049 regular = true; 11050 err = nl80211_parse_wowlan_nd( 11051 rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT], 11052 &new_triggers); 11053 if (err) 11054 goto error; 11055 } 11056 11057 /* The 'any' trigger means the device continues operating more or less 11058 * as in its normal operation mode and wakes up the host on most of the 11059 * normal interrupts (like packet RX, ...) 11060 * It therefore makes little sense to combine with the more constrained 11061 * wakeup trigger modes. 11062 */ 11063 if (new_triggers.any && regular) { 11064 err = -EINVAL; 11065 goto error; 11066 } 11067 11068 ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL); 11069 if (!ntrig) { 11070 err = -ENOMEM; 11071 goto error; 11072 } 11073 cfg80211_rdev_free_wowlan(rdev); 11074 rdev->wiphy.wowlan_config = ntrig; 11075 11076 set_wakeup: 11077 if (rdev->ops->set_wakeup && 11078 prev_enabled != !!rdev->wiphy.wowlan_config) 11079 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config); 11080 11081 return 0; 11082 error: 11083 for (i = 0; i < new_triggers.n_patterns; i++) 11084 kfree(new_triggers.patterns[i].mask); 11085 kfree(new_triggers.patterns); 11086 if (new_triggers.tcp && new_triggers.tcp->sock) 11087 sock_release(new_triggers.tcp->sock); 11088 kfree(new_triggers.tcp); 11089 kfree(new_triggers.nd_config); 11090 return err; 11091 } 11092 #endif 11093 11094 static int nl80211_send_coalesce_rules(struct sk_buff *msg, 11095 struct cfg80211_registered_device *rdev) 11096 { 11097 struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules; 11098 int i, j, pat_len; 11099 struct cfg80211_coalesce_rules *rule; 11100 11101 if (!rdev->coalesce->n_rules) 11102 return 0; 11103 11104 nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE); 11105 if (!nl_rules) 11106 return -ENOBUFS; 11107 11108 for (i = 0; i < rdev->coalesce->n_rules; i++) { 11109 nl_rule = nla_nest_start(msg, i + 1); 11110 if (!nl_rule) 11111 return -ENOBUFS; 11112 11113 rule = &rdev->coalesce->rules[i]; 11114 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY, 11115 rule->delay)) 11116 return -ENOBUFS; 11117 11118 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION, 11119 rule->condition)) 11120 return -ENOBUFS; 11121 11122 nl_pats = nla_nest_start(msg, 11123 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN); 11124 if (!nl_pats) 11125 return -ENOBUFS; 11126 11127 for (j = 0; j < rule->n_patterns; j++) { 11128 nl_pat = nla_nest_start(msg, j + 1); 11129 if (!nl_pat) 11130 return -ENOBUFS; 11131 pat_len = rule->patterns[j].pattern_len; 11132 if (nla_put(msg, NL80211_PKTPAT_MASK, 11133 DIV_ROUND_UP(pat_len, 8), 11134 rule->patterns[j].mask) || 11135 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len, 11136 rule->patterns[j].pattern) || 11137 nla_put_u32(msg, NL80211_PKTPAT_OFFSET, 11138 rule->patterns[j].pkt_offset)) 11139 return -ENOBUFS; 11140 nla_nest_end(msg, nl_pat); 11141 } 11142 nla_nest_end(msg, nl_pats); 11143 nla_nest_end(msg, nl_rule); 11144 } 11145 nla_nest_end(msg, nl_rules); 11146 11147 return 0; 11148 } 11149 11150 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info) 11151 { 11152 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11153 struct sk_buff *msg; 11154 void *hdr; 11155 11156 if (!rdev->wiphy.coalesce) 11157 return -EOPNOTSUPP; 11158 11159 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 11160 if (!msg) 11161 return -ENOMEM; 11162 11163 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 11164 NL80211_CMD_GET_COALESCE); 11165 if (!hdr) 11166 goto nla_put_failure; 11167 11168 if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev)) 11169 goto nla_put_failure; 11170 11171 genlmsg_end(msg, hdr); 11172 return genlmsg_reply(msg, info); 11173 11174 nla_put_failure: 11175 nlmsg_free(msg); 11176 return -ENOBUFS; 11177 } 11178 11179 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev) 11180 { 11181 struct cfg80211_coalesce *coalesce = rdev->coalesce; 11182 int i, j; 11183 struct cfg80211_coalesce_rules *rule; 11184 11185 if (!coalesce) 11186 return; 11187 11188 for (i = 0; i < coalesce->n_rules; i++) { 11189 rule = &coalesce->rules[i]; 11190 for (j = 0; j < rule->n_patterns; j++) 11191 kfree(rule->patterns[j].mask); 11192 kfree(rule->patterns); 11193 } 11194 kfree(coalesce->rules); 11195 kfree(coalesce); 11196 rdev->coalesce = NULL; 11197 } 11198 11199 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev, 11200 struct nlattr *rule, 11201 struct cfg80211_coalesce_rules *new_rule) 11202 { 11203 int err, i; 11204 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce; 11205 struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat; 11206 int rem, pat_len, mask_len, pkt_offset, n_patterns = 0; 11207 struct nlattr *pat_tb[NUM_NL80211_PKTPAT]; 11208 11209 err = nla_parse_nested(tb, NL80211_ATTR_COALESCE_RULE_MAX, rule, 11210 nl80211_coalesce_policy, NULL); 11211 if (err) 11212 return err; 11213 11214 if (tb[NL80211_ATTR_COALESCE_RULE_DELAY]) 11215 new_rule->delay = 11216 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]); 11217 if (new_rule->delay > coalesce->max_delay) 11218 return -EINVAL; 11219 11220 if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION]) 11221 new_rule->condition = 11222 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]); 11223 11224 if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN]) 11225 return -EINVAL; 11226 11227 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN], 11228 rem) 11229 n_patterns++; 11230 if (n_patterns > coalesce->n_patterns) 11231 return -EINVAL; 11232 11233 new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]), 11234 GFP_KERNEL); 11235 if (!new_rule->patterns) 11236 return -ENOMEM; 11237 11238 new_rule->n_patterns = n_patterns; 11239 i = 0; 11240 11241 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN], 11242 rem) { 11243 u8 *mask_pat; 11244 11245 err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat, 11246 nl80211_packet_pattern_policy, NULL); 11247 if (err) 11248 return err; 11249 11250 if (!pat_tb[NL80211_PKTPAT_MASK] || 11251 !pat_tb[NL80211_PKTPAT_PATTERN]) 11252 return -EINVAL; 11253 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]); 11254 mask_len = DIV_ROUND_UP(pat_len, 8); 11255 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len) 11256 return -EINVAL; 11257 if (pat_len > coalesce->pattern_max_len || 11258 pat_len < coalesce->pattern_min_len) 11259 return -EINVAL; 11260 11261 if (!pat_tb[NL80211_PKTPAT_OFFSET]) 11262 pkt_offset = 0; 11263 else 11264 pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]); 11265 if (pkt_offset > coalesce->max_pkt_offset) 11266 return -EINVAL; 11267 new_rule->patterns[i].pkt_offset = pkt_offset; 11268 11269 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL); 11270 if (!mask_pat) 11271 return -ENOMEM; 11272 11273 new_rule->patterns[i].mask = mask_pat; 11274 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]), 11275 mask_len); 11276 11277 mask_pat += mask_len; 11278 new_rule->patterns[i].pattern = mask_pat; 11279 new_rule->patterns[i].pattern_len = pat_len; 11280 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), 11281 pat_len); 11282 i++; 11283 } 11284 11285 return 0; 11286 } 11287 11288 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info) 11289 { 11290 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11291 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce; 11292 struct cfg80211_coalesce new_coalesce = {}; 11293 struct cfg80211_coalesce *n_coalesce; 11294 int err, rem_rule, n_rules = 0, i, j; 11295 struct nlattr *rule; 11296 struct cfg80211_coalesce_rules *tmp_rule; 11297 11298 if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce) 11299 return -EOPNOTSUPP; 11300 11301 if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) { 11302 cfg80211_rdev_free_coalesce(rdev); 11303 rdev_set_coalesce(rdev, NULL); 11304 return 0; 11305 } 11306 11307 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE], 11308 rem_rule) 11309 n_rules++; 11310 if (n_rules > coalesce->n_rules) 11311 return -EINVAL; 11312 11313 new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]), 11314 GFP_KERNEL); 11315 if (!new_coalesce.rules) 11316 return -ENOMEM; 11317 11318 new_coalesce.n_rules = n_rules; 11319 i = 0; 11320 11321 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE], 11322 rem_rule) { 11323 err = nl80211_parse_coalesce_rule(rdev, rule, 11324 &new_coalesce.rules[i]); 11325 if (err) 11326 goto error; 11327 11328 i++; 11329 } 11330 11331 err = rdev_set_coalesce(rdev, &new_coalesce); 11332 if (err) 11333 goto error; 11334 11335 n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL); 11336 if (!n_coalesce) { 11337 err = -ENOMEM; 11338 goto error; 11339 } 11340 cfg80211_rdev_free_coalesce(rdev); 11341 rdev->coalesce = n_coalesce; 11342 11343 return 0; 11344 error: 11345 for (i = 0; i < new_coalesce.n_rules; i++) { 11346 tmp_rule = &new_coalesce.rules[i]; 11347 for (j = 0; j < tmp_rule->n_patterns; j++) 11348 kfree(tmp_rule->patterns[j].mask); 11349 kfree(tmp_rule->patterns); 11350 } 11351 kfree(new_coalesce.rules); 11352 11353 return err; 11354 } 11355 11356 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info) 11357 { 11358 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11359 struct net_device *dev = info->user_ptr[1]; 11360 struct wireless_dev *wdev = dev->ieee80211_ptr; 11361 struct nlattr *tb[NUM_NL80211_REKEY_DATA]; 11362 struct cfg80211_gtk_rekey_data rekey_data; 11363 int err; 11364 11365 if (!info->attrs[NL80211_ATTR_REKEY_DATA]) 11366 return -EINVAL; 11367 11368 err = nla_parse_nested(tb, MAX_NL80211_REKEY_DATA, 11369 info->attrs[NL80211_ATTR_REKEY_DATA], 11370 nl80211_rekey_policy, info->extack); 11371 if (err) 11372 return err; 11373 11374 if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] || 11375 !tb[NL80211_REKEY_DATA_KCK]) 11376 return -EINVAL; 11377 if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN) 11378 return -ERANGE; 11379 if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN) 11380 return -ERANGE; 11381 if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN) 11382 return -ERANGE; 11383 11384 rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]); 11385 rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]); 11386 rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]); 11387 11388 wdev_lock(wdev); 11389 if (!wdev->current_bss) { 11390 err = -ENOTCONN; 11391 goto out; 11392 } 11393 11394 if (!rdev->ops->set_rekey_data) { 11395 err = -EOPNOTSUPP; 11396 goto out; 11397 } 11398 11399 err = rdev_set_rekey_data(rdev, dev, &rekey_data); 11400 out: 11401 wdev_unlock(wdev); 11402 return err; 11403 } 11404 11405 static int nl80211_register_unexpected_frame(struct sk_buff *skb, 11406 struct genl_info *info) 11407 { 11408 struct net_device *dev = info->user_ptr[1]; 11409 struct wireless_dev *wdev = dev->ieee80211_ptr; 11410 11411 if (wdev->iftype != NL80211_IFTYPE_AP && 11412 wdev->iftype != NL80211_IFTYPE_P2P_GO) 11413 return -EINVAL; 11414 11415 if (wdev->ap_unexpected_nlportid) 11416 return -EBUSY; 11417 11418 wdev->ap_unexpected_nlportid = info->snd_portid; 11419 return 0; 11420 } 11421 11422 static int nl80211_probe_client(struct sk_buff *skb, 11423 struct genl_info *info) 11424 { 11425 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11426 struct net_device *dev = info->user_ptr[1]; 11427 struct wireless_dev *wdev = dev->ieee80211_ptr; 11428 struct sk_buff *msg; 11429 void *hdr; 11430 const u8 *addr; 11431 u64 cookie; 11432 int err; 11433 11434 if (wdev->iftype != NL80211_IFTYPE_AP && 11435 wdev->iftype != NL80211_IFTYPE_P2P_GO) 11436 return -EOPNOTSUPP; 11437 11438 if (!info->attrs[NL80211_ATTR_MAC]) 11439 return -EINVAL; 11440 11441 if (!rdev->ops->probe_client) 11442 return -EOPNOTSUPP; 11443 11444 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 11445 if (!msg) 11446 return -ENOMEM; 11447 11448 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 11449 NL80211_CMD_PROBE_CLIENT); 11450 if (!hdr) { 11451 err = -ENOBUFS; 11452 goto free_msg; 11453 } 11454 11455 addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 11456 11457 err = rdev_probe_client(rdev, dev, addr, &cookie); 11458 if (err) 11459 goto free_msg; 11460 11461 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 11462 NL80211_ATTR_PAD)) 11463 goto nla_put_failure; 11464 11465 genlmsg_end(msg, hdr); 11466 11467 return genlmsg_reply(msg, info); 11468 11469 nla_put_failure: 11470 err = -ENOBUFS; 11471 free_msg: 11472 nlmsg_free(msg); 11473 return err; 11474 } 11475 11476 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info) 11477 { 11478 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11479 struct cfg80211_beacon_registration *reg, *nreg; 11480 int rv; 11481 11482 if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS)) 11483 return -EOPNOTSUPP; 11484 11485 nreg = kzalloc(sizeof(*nreg), GFP_KERNEL); 11486 if (!nreg) 11487 return -ENOMEM; 11488 11489 /* First, check if already registered. */ 11490 spin_lock_bh(&rdev->beacon_registrations_lock); 11491 list_for_each_entry(reg, &rdev->beacon_registrations, list) { 11492 if (reg->nlportid == info->snd_portid) { 11493 rv = -EALREADY; 11494 goto out_err; 11495 } 11496 } 11497 /* Add it to the list */ 11498 nreg->nlportid = info->snd_portid; 11499 list_add(&nreg->list, &rdev->beacon_registrations); 11500 11501 spin_unlock_bh(&rdev->beacon_registrations_lock); 11502 11503 return 0; 11504 out_err: 11505 spin_unlock_bh(&rdev->beacon_registrations_lock); 11506 kfree(nreg); 11507 return rv; 11508 } 11509 11510 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info) 11511 { 11512 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11513 struct wireless_dev *wdev = info->user_ptr[1]; 11514 int err; 11515 11516 if (!rdev->ops->start_p2p_device) 11517 return -EOPNOTSUPP; 11518 11519 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE) 11520 return -EOPNOTSUPP; 11521 11522 if (wdev_running(wdev)) 11523 return 0; 11524 11525 if (rfkill_blocked(rdev->rfkill)) 11526 return -ERFKILL; 11527 11528 err = rdev_start_p2p_device(rdev, wdev); 11529 if (err) 11530 return err; 11531 11532 wdev->is_running = true; 11533 rdev->opencount++; 11534 11535 return 0; 11536 } 11537 11538 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info) 11539 { 11540 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11541 struct wireless_dev *wdev = info->user_ptr[1]; 11542 11543 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE) 11544 return -EOPNOTSUPP; 11545 11546 if (!rdev->ops->stop_p2p_device) 11547 return -EOPNOTSUPP; 11548 11549 cfg80211_stop_p2p_device(rdev, wdev); 11550 11551 return 0; 11552 } 11553 11554 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info) 11555 { 11556 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11557 struct wireless_dev *wdev = info->user_ptr[1]; 11558 struct cfg80211_nan_conf conf = {}; 11559 int err; 11560 11561 if (wdev->iftype != NL80211_IFTYPE_NAN) 11562 return -EOPNOTSUPP; 11563 11564 if (wdev_running(wdev)) 11565 return -EEXIST; 11566 11567 if (rfkill_blocked(rdev->rfkill)) 11568 return -ERFKILL; 11569 11570 if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) 11571 return -EINVAL; 11572 11573 conf.master_pref = 11574 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]); 11575 11576 if (info->attrs[NL80211_ATTR_BANDS]) { 11577 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]); 11578 11579 if (bands & ~(u32)wdev->wiphy->nan_supported_bands) 11580 return -EOPNOTSUPP; 11581 11582 if (bands && !(bands & BIT(NL80211_BAND_2GHZ))) 11583 return -EINVAL; 11584 11585 conf.bands = bands; 11586 } 11587 11588 err = rdev_start_nan(rdev, wdev, &conf); 11589 if (err) 11590 return err; 11591 11592 wdev->is_running = true; 11593 rdev->opencount++; 11594 11595 return 0; 11596 } 11597 11598 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info) 11599 { 11600 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11601 struct wireless_dev *wdev = info->user_ptr[1]; 11602 11603 if (wdev->iftype != NL80211_IFTYPE_NAN) 11604 return -EOPNOTSUPP; 11605 11606 cfg80211_stop_nan(rdev, wdev); 11607 11608 return 0; 11609 } 11610 11611 static int validate_nan_filter(struct nlattr *filter_attr) 11612 { 11613 struct nlattr *attr; 11614 int len = 0, n_entries = 0, rem; 11615 11616 nla_for_each_nested(attr, filter_attr, rem) { 11617 len += nla_len(attr); 11618 n_entries++; 11619 } 11620 11621 if (len >= U8_MAX) 11622 return -EINVAL; 11623 11624 return n_entries; 11625 } 11626 11627 static int handle_nan_filter(struct nlattr *attr_filter, 11628 struct cfg80211_nan_func *func, 11629 bool tx) 11630 { 11631 struct nlattr *attr; 11632 int n_entries, rem, i; 11633 struct cfg80211_nan_func_filter *filter; 11634 11635 n_entries = validate_nan_filter(attr_filter); 11636 if (n_entries < 0) 11637 return n_entries; 11638 11639 BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters)); 11640 11641 filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL); 11642 if (!filter) 11643 return -ENOMEM; 11644 11645 i = 0; 11646 nla_for_each_nested(attr, attr_filter, rem) { 11647 filter[i].filter = nla_memdup(attr, GFP_KERNEL); 11648 filter[i].len = nla_len(attr); 11649 i++; 11650 } 11651 if (tx) { 11652 func->num_tx_filters = n_entries; 11653 func->tx_filters = filter; 11654 } else { 11655 func->num_rx_filters = n_entries; 11656 func->rx_filters = filter; 11657 } 11658 11659 return 0; 11660 } 11661 11662 static int nl80211_nan_add_func(struct sk_buff *skb, 11663 struct genl_info *info) 11664 { 11665 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11666 struct wireless_dev *wdev = info->user_ptr[1]; 11667 struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr; 11668 struct cfg80211_nan_func *func; 11669 struct sk_buff *msg = NULL; 11670 void *hdr = NULL; 11671 int err = 0; 11672 11673 if (wdev->iftype != NL80211_IFTYPE_NAN) 11674 return -EOPNOTSUPP; 11675 11676 if (!wdev_running(wdev)) 11677 return -ENOTCONN; 11678 11679 if (!info->attrs[NL80211_ATTR_NAN_FUNC]) 11680 return -EINVAL; 11681 11682 err = nla_parse_nested(tb, NL80211_NAN_FUNC_ATTR_MAX, 11683 info->attrs[NL80211_ATTR_NAN_FUNC], 11684 nl80211_nan_func_policy, info->extack); 11685 if (err) 11686 return err; 11687 11688 func = kzalloc(sizeof(*func), GFP_KERNEL); 11689 if (!func) 11690 return -ENOMEM; 11691 11692 func->cookie = cfg80211_assign_cookie(rdev); 11693 11694 if (!tb[NL80211_NAN_FUNC_TYPE] || 11695 nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]) > NL80211_NAN_FUNC_MAX_TYPE) { 11696 err = -EINVAL; 11697 goto out; 11698 } 11699 11700 11701 func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]); 11702 11703 if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) { 11704 err = -EINVAL; 11705 goto out; 11706 } 11707 11708 memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]), 11709 sizeof(func->service_id)); 11710 11711 func->close_range = 11712 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]); 11713 11714 if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) { 11715 func->serv_spec_info_len = 11716 nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]); 11717 func->serv_spec_info = 11718 kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]), 11719 func->serv_spec_info_len, 11720 GFP_KERNEL); 11721 if (!func->serv_spec_info) { 11722 err = -ENOMEM; 11723 goto out; 11724 } 11725 } 11726 11727 if (tb[NL80211_NAN_FUNC_TTL]) 11728 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]); 11729 11730 switch (func->type) { 11731 case NL80211_NAN_FUNC_PUBLISH: 11732 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) { 11733 err = -EINVAL; 11734 goto out; 11735 } 11736 11737 func->publish_type = 11738 nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]); 11739 func->publish_bcast = 11740 nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]); 11741 11742 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) && 11743 func->publish_bcast) { 11744 err = -EINVAL; 11745 goto out; 11746 } 11747 break; 11748 case NL80211_NAN_FUNC_SUBSCRIBE: 11749 func->subscribe_active = 11750 nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]); 11751 break; 11752 case NL80211_NAN_FUNC_FOLLOW_UP: 11753 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] || 11754 !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] || 11755 !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) { 11756 err = -EINVAL; 11757 goto out; 11758 } 11759 11760 func->followup_id = 11761 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]); 11762 func->followup_reqid = 11763 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]); 11764 memcpy(func->followup_dest.addr, 11765 nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]), 11766 sizeof(func->followup_dest.addr)); 11767 if (func->ttl) { 11768 err = -EINVAL; 11769 goto out; 11770 } 11771 break; 11772 default: 11773 err = -EINVAL; 11774 goto out; 11775 } 11776 11777 if (tb[NL80211_NAN_FUNC_SRF]) { 11778 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR]; 11779 11780 err = nla_parse_nested(srf_tb, NL80211_NAN_SRF_ATTR_MAX, 11781 tb[NL80211_NAN_FUNC_SRF], 11782 nl80211_nan_srf_policy, info->extack); 11783 if (err) 11784 goto out; 11785 11786 func->srf_include = 11787 nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]); 11788 11789 if (srf_tb[NL80211_NAN_SRF_BF]) { 11790 if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] || 11791 !srf_tb[NL80211_NAN_SRF_BF_IDX]) { 11792 err = -EINVAL; 11793 goto out; 11794 } 11795 11796 func->srf_bf_len = 11797 nla_len(srf_tb[NL80211_NAN_SRF_BF]); 11798 func->srf_bf = 11799 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]), 11800 func->srf_bf_len, GFP_KERNEL); 11801 if (!func->srf_bf) { 11802 err = -ENOMEM; 11803 goto out; 11804 } 11805 11806 func->srf_bf_idx = 11807 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]); 11808 } else { 11809 struct nlattr *attr, *mac_attr = 11810 srf_tb[NL80211_NAN_SRF_MAC_ADDRS]; 11811 int n_entries, rem, i = 0; 11812 11813 if (!mac_attr) { 11814 err = -EINVAL; 11815 goto out; 11816 } 11817 11818 n_entries = validate_acl_mac_addrs(mac_attr); 11819 if (n_entries <= 0) { 11820 err = -EINVAL; 11821 goto out; 11822 } 11823 11824 func->srf_num_macs = n_entries; 11825 func->srf_macs = 11826 kcalloc(n_entries, sizeof(*func->srf_macs), 11827 GFP_KERNEL); 11828 if (!func->srf_macs) { 11829 err = -ENOMEM; 11830 goto out; 11831 } 11832 11833 nla_for_each_nested(attr, mac_attr, rem) 11834 memcpy(func->srf_macs[i++].addr, nla_data(attr), 11835 sizeof(*func->srf_macs)); 11836 } 11837 } 11838 11839 if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) { 11840 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER], 11841 func, true); 11842 if (err) 11843 goto out; 11844 } 11845 11846 if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) { 11847 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER], 11848 func, false); 11849 if (err) 11850 goto out; 11851 } 11852 11853 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 11854 if (!msg) { 11855 err = -ENOMEM; 11856 goto out; 11857 } 11858 11859 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 11860 NL80211_CMD_ADD_NAN_FUNCTION); 11861 /* This can't really happen - we just allocated 4KB */ 11862 if (WARN_ON(!hdr)) { 11863 err = -ENOMEM; 11864 goto out; 11865 } 11866 11867 err = rdev_add_nan_func(rdev, wdev, func); 11868 out: 11869 if (err < 0) { 11870 cfg80211_free_nan_func(func); 11871 nlmsg_free(msg); 11872 return err; 11873 } 11874 11875 /* propagate the instance id and cookie to userspace */ 11876 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie, 11877 NL80211_ATTR_PAD)) 11878 goto nla_put_failure; 11879 11880 func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC); 11881 if (!func_attr) 11882 goto nla_put_failure; 11883 11884 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, 11885 func->instance_id)) 11886 goto nla_put_failure; 11887 11888 nla_nest_end(msg, func_attr); 11889 11890 genlmsg_end(msg, hdr); 11891 return genlmsg_reply(msg, info); 11892 11893 nla_put_failure: 11894 nlmsg_free(msg); 11895 return -ENOBUFS; 11896 } 11897 11898 static int nl80211_nan_del_func(struct sk_buff *skb, 11899 struct genl_info *info) 11900 { 11901 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11902 struct wireless_dev *wdev = info->user_ptr[1]; 11903 u64 cookie; 11904 11905 if (wdev->iftype != NL80211_IFTYPE_NAN) 11906 return -EOPNOTSUPP; 11907 11908 if (!wdev_running(wdev)) 11909 return -ENOTCONN; 11910 11911 if (!info->attrs[NL80211_ATTR_COOKIE]) 11912 return -EINVAL; 11913 11914 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 11915 11916 rdev_del_nan_func(rdev, wdev, cookie); 11917 11918 return 0; 11919 } 11920 11921 static int nl80211_nan_change_config(struct sk_buff *skb, 11922 struct genl_info *info) 11923 { 11924 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11925 struct wireless_dev *wdev = info->user_ptr[1]; 11926 struct cfg80211_nan_conf conf = {}; 11927 u32 changed = 0; 11928 11929 if (wdev->iftype != NL80211_IFTYPE_NAN) 11930 return -EOPNOTSUPP; 11931 11932 if (!wdev_running(wdev)) 11933 return -ENOTCONN; 11934 11935 if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) { 11936 conf.master_pref = 11937 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]); 11938 if (conf.master_pref <= 1 || conf.master_pref == 255) 11939 return -EINVAL; 11940 11941 changed |= CFG80211_NAN_CONF_CHANGED_PREF; 11942 } 11943 11944 if (info->attrs[NL80211_ATTR_BANDS]) { 11945 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]); 11946 11947 if (bands & ~(u32)wdev->wiphy->nan_supported_bands) 11948 return -EOPNOTSUPP; 11949 11950 if (bands && !(bands & BIT(NL80211_BAND_2GHZ))) 11951 return -EINVAL; 11952 11953 conf.bands = bands; 11954 changed |= CFG80211_NAN_CONF_CHANGED_BANDS; 11955 } 11956 11957 if (!changed) 11958 return -EINVAL; 11959 11960 return rdev_nan_change_conf(rdev, wdev, &conf, changed); 11961 } 11962 11963 void cfg80211_nan_match(struct wireless_dev *wdev, 11964 struct cfg80211_nan_match_params *match, gfp_t gfp) 11965 { 11966 struct wiphy *wiphy = wdev->wiphy; 11967 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 11968 struct nlattr *match_attr, *local_func_attr, *peer_func_attr; 11969 struct sk_buff *msg; 11970 void *hdr; 11971 11972 if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr)) 11973 return; 11974 11975 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 11976 if (!msg) 11977 return; 11978 11979 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH); 11980 if (!hdr) { 11981 nlmsg_free(msg); 11982 return; 11983 } 11984 11985 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 11986 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 11987 wdev->netdev->ifindex)) || 11988 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 11989 NL80211_ATTR_PAD)) 11990 goto nla_put_failure; 11991 11992 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie, 11993 NL80211_ATTR_PAD) || 11994 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr)) 11995 goto nla_put_failure; 11996 11997 match_attr = nla_nest_start(msg, NL80211_ATTR_NAN_MATCH); 11998 if (!match_attr) 11999 goto nla_put_failure; 12000 12001 local_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_LOCAL); 12002 if (!local_func_attr) 12003 goto nla_put_failure; 12004 12005 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id)) 12006 goto nla_put_failure; 12007 12008 nla_nest_end(msg, local_func_attr); 12009 12010 peer_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_PEER); 12011 if (!peer_func_attr) 12012 goto nla_put_failure; 12013 12014 if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) || 12015 nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id)) 12016 goto nla_put_failure; 12017 12018 if (match->info && match->info_len && 12019 nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len, 12020 match->info)) 12021 goto nla_put_failure; 12022 12023 nla_nest_end(msg, peer_func_attr); 12024 nla_nest_end(msg, match_attr); 12025 genlmsg_end(msg, hdr); 12026 12027 if (!wdev->owner_nlportid) 12028 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), 12029 msg, 0, NL80211_MCGRP_NAN, gfp); 12030 else 12031 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, 12032 wdev->owner_nlportid); 12033 12034 return; 12035 12036 nla_put_failure: 12037 nlmsg_free(msg); 12038 } 12039 EXPORT_SYMBOL(cfg80211_nan_match); 12040 12041 void cfg80211_nan_func_terminated(struct wireless_dev *wdev, 12042 u8 inst_id, 12043 enum nl80211_nan_func_term_reason reason, 12044 u64 cookie, gfp_t gfp) 12045 { 12046 struct wiphy *wiphy = wdev->wiphy; 12047 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 12048 struct sk_buff *msg; 12049 struct nlattr *func_attr; 12050 void *hdr; 12051 12052 if (WARN_ON(!inst_id)) 12053 return; 12054 12055 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 12056 if (!msg) 12057 return; 12058 12059 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION); 12060 if (!hdr) { 12061 nlmsg_free(msg); 12062 return; 12063 } 12064 12065 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 12066 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 12067 wdev->netdev->ifindex)) || 12068 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 12069 NL80211_ATTR_PAD)) 12070 goto nla_put_failure; 12071 12072 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 12073 NL80211_ATTR_PAD)) 12074 goto nla_put_failure; 12075 12076 func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC); 12077 if (!func_attr) 12078 goto nla_put_failure; 12079 12080 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) || 12081 nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason)) 12082 goto nla_put_failure; 12083 12084 nla_nest_end(msg, func_attr); 12085 genlmsg_end(msg, hdr); 12086 12087 if (!wdev->owner_nlportid) 12088 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), 12089 msg, 0, NL80211_MCGRP_NAN, gfp); 12090 else 12091 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, 12092 wdev->owner_nlportid); 12093 12094 return; 12095 12096 nla_put_failure: 12097 nlmsg_free(msg); 12098 } 12099 EXPORT_SYMBOL(cfg80211_nan_func_terminated); 12100 12101 static int nl80211_get_protocol_features(struct sk_buff *skb, 12102 struct genl_info *info) 12103 { 12104 void *hdr; 12105 struct sk_buff *msg; 12106 12107 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 12108 if (!msg) 12109 return -ENOMEM; 12110 12111 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 12112 NL80211_CMD_GET_PROTOCOL_FEATURES); 12113 if (!hdr) 12114 goto nla_put_failure; 12115 12116 if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES, 12117 NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP)) 12118 goto nla_put_failure; 12119 12120 genlmsg_end(msg, hdr); 12121 return genlmsg_reply(msg, info); 12122 12123 nla_put_failure: 12124 kfree_skb(msg); 12125 return -ENOBUFS; 12126 } 12127 12128 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info) 12129 { 12130 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12131 struct cfg80211_update_ft_ies_params ft_params; 12132 struct net_device *dev = info->user_ptr[1]; 12133 12134 if (!rdev->ops->update_ft_ies) 12135 return -EOPNOTSUPP; 12136 12137 if (!info->attrs[NL80211_ATTR_MDID] || 12138 !info->attrs[NL80211_ATTR_IE]) 12139 return -EINVAL; 12140 12141 memset(&ft_params, 0, sizeof(ft_params)); 12142 ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]); 12143 ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 12144 ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 12145 12146 return rdev_update_ft_ies(rdev, dev, &ft_params); 12147 } 12148 12149 static int nl80211_crit_protocol_start(struct sk_buff *skb, 12150 struct genl_info *info) 12151 { 12152 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12153 struct wireless_dev *wdev = info->user_ptr[1]; 12154 enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC; 12155 u16 duration; 12156 int ret; 12157 12158 if (!rdev->ops->crit_proto_start) 12159 return -EOPNOTSUPP; 12160 12161 if (WARN_ON(!rdev->ops->crit_proto_stop)) 12162 return -EINVAL; 12163 12164 if (rdev->crit_proto_nlportid) 12165 return -EBUSY; 12166 12167 /* determine protocol if provided */ 12168 if (info->attrs[NL80211_ATTR_CRIT_PROT_ID]) 12169 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]); 12170 12171 if (proto >= NUM_NL80211_CRIT_PROTO) 12172 return -EINVAL; 12173 12174 /* timeout must be provided */ 12175 if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]) 12176 return -EINVAL; 12177 12178 duration = 12179 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]); 12180 12181 if (duration > NL80211_CRIT_PROTO_MAX_DURATION) 12182 return -ERANGE; 12183 12184 ret = rdev_crit_proto_start(rdev, wdev, proto, duration); 12185 if (!ret) 12186 rdev->crit_proto_nlportid = info->snd_portid; 12187 12188 return ret; 12189 } 12190 12191 static int nl80211_crit_protocol_stop(struct sk_buff *skb, 12192 struct genl_info *info) 12193 { 12194 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12195 struct wireless_dev *wdev = info->user_ptr[1]; 12196 12197 if (!rdev->ops->crit_proto_stop) 12198 return -EOPNOTSUPP; 12199 12200 if (rdev->crit_proto_nlportid) { 12201 rdev->crit_proto_nlportid = 0; 12202 rdev_crit_proto_stop(rdev, wdev); 12203 } 12204 return 0; 12205 } 12206 12207 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info) 12208 { 12209 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12210 struct wireless_dev *wdev = 12211 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs); 12212 int i, err; 12213 u32 vid, subcmd; 12214 12215 if (!rdev->wiphy.vendor_commands) 12216 return -EOPNOTSUPP; 12217 12218 if (IS_ERR(wdev)) { 12219 err = PTR_ERR(wdev); 12220 if (err != -EINVAL) 12221 return err; 12222 wdev = NULL; 12223 } else if (wdev->wiphy != &rdev->wiphy) { 12224 return -EINVAL; 12225 } 12226 12227 if (!info->attrs[NL80211_ATTR_VENDOR_ID] || 12228 !info->attrs[NL80211_ATTR_VENDOR_SUBCMD]) 12229 return -EINVAL; 12230 12231 vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]); 12232 subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]); 12233 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) { 12234 const struct wiphy_vendor_command *vcmd; 12235 void *data = NULL; 12236 int len = 0; 12237 12238 vcmd = &rdev->wiphy.vendor_commands[i]; 12239 12240 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd) 12241 continue; 12242 12243 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV | 12244 WIPHY_VENDOR_CMD_NEED_NETDEV)) { 12245 if (!wdev) 12246 return -EINVAL; 12247 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV && 12248 !wdev->netdev) 12249 return -EINVAL; 12250 12251 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) { 12252 if (!wdev_running(wdev)) 12253 return -ENETDOWN; 12254 } 12255 12256 if (!vcmd->doit) 12257 return -EOPNOTSUPP; 12258 } else { 12259 wdev = NULL; 12260 } 12261 12262 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) { 12263 data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]); 12264 len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]); 12265 } 12266 12267 rdev->cur_cmd_info = info; 12268 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev, 12269 data, len); 12270 rdev->cur_cmd_info = NULL; 12271 return err; 12272 } 12273 12274 return -EOPNOTSUPP; 12275 } 12276 12277 static int nl80211_prepare_vendor_dump(struct sk_buff *skb, 12278 struct netlink_callback *cb, 12279 struct cfg80211_registered_device **rdev, 12280 struct wireless_dev **wdev) 12281 { 12282 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam); 12283 u32 vid, subcmd; 12284 unsigned int i; 12285 int vcmd_idx = -1; 12286 int err; 12287 void *data = NULL; 12288 unsigned int data_len = 0; 12289 12290 if (cb->args[0]) { 12291 /* subtract the 1 again here */ 12292 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1); 12293 struct wireless_dev *tmp; 12294 12295 if (!wiphy) 12296 return -ENODEV; 12297 *rdev = wiphy_to_rdev(wiphy); 12298 *wdev = NULL; 12299 12300 if (cb->args[1]) { 12301 list_for_each_entry(tmp, &wiphy->wdev_list, list) { 12302 if (tmp->identifier == cb->args[1] - 1) { 12303 *wdev = tmp; 12304 break; 12305 } 12306 } 12307 } 12308 12309 /* keep rtnl locked in successful case */ 12310 return 0; 12311 } 12312 12313 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, attrbuf, 12314 nl80211_fam.maxattr, nl80211_policy, NULL); 12315 if (err) 12316 return err; 12317 12318 if (!attrbuf[NL80211_ATTR_VENDOR_ID] || 12319 !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) 12320 return -EINVAL; 12321 12322 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk), attrbuf); 12323 if (IS_ERR(*wdev)) 12324 *wdev = NULL; 12325 12326 *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf); 12327 if (IS_ERR(*rdev)) 12328 return PTR_ERR(*rdev); 12329 12330 vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]); 12331 subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]); 12332 12333 for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) { 12334 const struct wiphy_vendor_command *vcmd; 12335 12336 vcmd = &(*rdev)->wiphy.vendor_commands[i]; 12337 12338 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd) 12339 continue; 12340 12341 if (!vcmd->dumpit) 12342 return -EOPNOTSUPP; 12343 12344 vcmd_idx = i; 12345 break; 12346 } 12347 12348 if (vcmd_idx < 0) 12349 return -EOPNOTSUPP; 12350 12351 if (attrbuf[NL80211_ATTR_VENDOR_DATA]) { 12352 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]); 12353 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]); 12354 } 12355 12356 /* 0 is the first index - add 1 to parse only once */ 12357 cb->args[0] = (*rdev)->wiphy_idx + 1; 12358 /* add 1 to know if it was NULL */ 12359 cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0; 12360 cb->args[2] = vcmd_idx; 12361 cb->args[3] = (unsigned long)data; 12362 cb->args[4] = data_len; 12363 12364 /* keep rtnl locked in successful case */ 12365 return 0; 12366 } 12367 12368 static int nl80211_vendor_cmd_dump(struct sk_buff *skb, 12369 struct netlink_callback *cb) 12370 { 12371 struct cfg80211_registered_device *rdev; 12372 struct wireless_dev *wdev; 12373 unsigned int vcmd_idx; 12374 const struct wiphy_vendor_command *vcmd; 12375 void *data; 12376 int data_len; 12377 int err; 12378 struct nlattr *vendor_data; 12379 12380 rtnl_lock(); 12381 err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev); 12382 if (err) 12383 goto out; 12384 12385 vcmd_idx = cb->args[2]; 12386 data = (void *)cb->args[3]; 12387 data_len = cb->args[4]; 12388 vcmd = &rdev->wiphy.vendor_commands[vcmd_idx]; 12389 12390 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV | 12391 WIPHY_VENDOR_CMD_NEED_NETDEV)) { 12392 if (!wdev) { 12393 err = -EINVAL; 12394 goto out; 12395 } 12396 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV && 12397 !wdev->netdev) { 12398 err = -EINVAL; 12399 goto out; 12400 } 12401 12402 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) { 12403 if (!wdev_running(wdev)) { 12404 err = -ENETDOWN; 12405 goto out; 12406 } 12407 } 12408 } 12409 12410 while (1) { 12411 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid, 12412 cb->nlh->nlmsg_seq, NLM_F_MULTI, 12413 NL80211_CMD_VENDOR); 12414 if (!hdr) 12415 break; 12416 12417 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 12418 (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV, 12419 wdev_id(wdev), 12420 NL80211_ATTR_PAD))) { 12421 genlmsg_cancel(skb, hdr); 12422 break; 12423 } 12424 12425 vendor_data = nla_nest_start(skb, NL80211_ATTR_VENDOR_DATA); 12426 if (!vendor_data) { 12427 genlmsg_cancel(skb, hdr); 12428 break; 12429 } 12430 12431 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len, 12432 (unsigned long *)&cb->args[5]); 12433 nla_nest_end(skb, vendor_data); 12434 12435 if (err == -ENOBUFS || err == -ENOENT) { 12436 genlmsg_cancel(skb, hdr); 12437 break; 12438 } else if (err) { 12439 genlmsg_cancel(skb, hdr); 12440 goto out; 12441 } 12442 12443 genlmsg_end(skb, hdr); 12444 } 12445 12446 err = skb->len; 12447 out: 12448 rtnl_unlock(); 12449 return err; 12450 } 12451 12452 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy, 12453 enum nl80211_commands cmd, 12454 enum nl80211_attrs attr, 12455 int approxlen) 12456 { 12457 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 12458 12459 if (WARN_ON(!rdev->cur_cmd_info)) 12460 return NULL; 12461 12462 return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen, 12463 rdev->cur_cmd_info->snd_portid, 12464 rdev->cur_cmd_info->snd_seq, 12465 cmd, attr, NULL, GFP_KERNEL); 12466 } 12467 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb); 12468 12469 int cfg80211_vendor_cmd_reply(struct sk_buff *skb) 12470 { 12471 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0]; 12472 void *hdr = ((void **)skb->cb)[1]; 12473 struct nlattr *data = ((void **)skb->cb)[2]; 12474 12475 /* clear CB data for netlink core to own from now on */ 12476 memset(skb->cb, 0, sizeof(skb->cb)); 12477 12478 if (WARN_ON(!rdev->cur_cmd_info)) { 12479 kfree_skb(skb); 12480 return -EINVAL; 12481 } 12482 12483 nla_nest_end(skb, data); 12484 genlmsg_end(skb, hdr); 12485 return genlmsg_reply(skb, rdev->cur_cmd_info); 12486 } 12487 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply); 12488 12489 static int nl80211_set_qos_map(struct sk_buff *skb, 12490 struct genl_info *info) 12491 { 12492 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12493 struct cfg80211_qos_map *qos_map = NULL; 12494 struct net_device *dev = info->user_ptr[1]; 12495 u8 *pos, len, num_des, des_len, des; 12496 int ret; 12497 12498 if (!rdev->ops->set_qos_map) 12499 return -EOPNOTSUPP; 12500 12501 if (info->attrs[NL80211_ATTR_QOS_MAP]) { 12502 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]); 12503 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]); 12504 12505 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN || 12506 len > IEEE80211_QOS_MAP_LEN_MAX) 12507 return -EINVAL; 12508 12509 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL); 12510 if (!qos_map) 12511 return -ENOMEM; 12512 12513 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1; 12514 if (num_des) { 12515 des_len = num_des * 12516 sizeof(struct cfg80211_dscp_exception); 12517 memcpy(qos_map->dscp_exception, pos, des_len); 12518 qos_map->num_des = num_des; 12519 for (des = 0; des < num_des; des++) { 12520 if (qos_map->dscp_exception[des].up > 7) { 12521 kfree(qos_map); 12522 return -EINVAL; 12523 } 12524 } 12525 pos += des_len; 12526 } 12527 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN); 12528 } 12529 12530 wdev_lock(dev->ieee80211_ptr); 12531 ret = nl80211_key_allowed(dev->ieee80211_ptr); 12532 if (!ret) 12533 ret = rdev_set_qos_map(rdev, dev, qos_map); 12534 wdev_unlock(dev->ieee80211_ptr); 12535 12536 kfree(qos_map); 12537 return ret; 12538 } 12539 12540 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info) 12541 { 12542 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12543 struct net_device *dev = info->user_ptr[1]; 12544 struct wireless_dev *wdev = dev->ieee80211_ptr; 12545 const u8 *peer; 12546 u8 tsid, up; 12547 u16 admitted_time = 0; 12548 int err; 12549 12550 if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)) 12551 return -EOPNOTSUPP; 12552 12553 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] || 12554 !info->attrs[NL80211_ATTR_USER_PRIO]) 12555 return -EINVAL; 12556 12557 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]); 12558 up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]); 12559 12560 /* WMM uses TIDs 0-7 even for TSPEC */ 12561 if (tsid >= IEEE80211_FIRST_TSPEC_TSID) { 12562 /* TODO: handle 802.11 TSPEC/admission control 12563 * need more attributes for that (e.g. BA session requirement); 12564 * change the WMM adminssion test above to allow both then 12565 */ 12566 return -EINVAL; 12567 } 12568 12569 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 12570 12571 if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) { 12572 admitted_time = 12573 nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]); 12574 if (!admitted_time) 12575 return -EINVAL; 12576 } 12577 12578 wdev_lock(wdev); 12579 switch (wdev->iftype) { 12580 case NL80211_IFTYPE_STATION: 12581 case NL80211_IFTYPE_P2P_CLIENT: 12582 if (wdev->current_bss) 12583 break; 12584 err = -ENOTCONN; 12585 goto out; 12586 default: 12587 err = -EOPNOTSUPP; 12588 goto out; 12589 } 12590 12591 err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time); 12592 12593 out: 12594 wdev_unlock(wdev); 12595 return err; 12596 } 12597 12598 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info) 12599 { 12600 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12601 struct net_device *dev = info->user_ptr[1]; 12602 struct wireless_dev *wdev = dev->ieee80211_ptr; 12603 const u8 *peer; 12604 u8 tsid; 12605 int err; 12606 12607 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC]) 12608 return -EINVAL; 12609 12610 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]); 12611 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 12612 12613 wdev_lock(wdev); 12614 err = rdev_del_tx_ts(rdev, dev, tsid, peer); 12615 wdev_unlock(wdev); 12616 12617 return err; 12618 } 12619 12620 static int nl80211_tdls_channel_switch(struct sk_buff *skb, 12621 struct genl_info *info) 12622 { 12623 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12624 struct net_device *dev = info->user_ptr[1]; 12625 struct wireless_dev *wdev = dev->ieee80211_ptr; 12626 struct cfg80211_chan_def chandef = {}; 12627 const u8 *addr; 12628 u8 oper_class; 12629 int err; 12630 12631 if (!rdev->ops->tdls_channel_switch || 12632 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH)) 12633 return -EOPNOTSUPP; 12634 12635 switch (dev->ieee80211_ptr->iftype) { 12636 case NL80211_IFTYPE_STATION: 12637 case NL80211_IFTYPE_P2P_CLIENT: 12638 break; 12639 default: 12640 return -EOPNOTSUPP; 12641 } 12642 12643 if (!info->attrs[NL80211_ATTR_MAC] || 12644 !info->attrs[NL80211_ATTR_OPER_CLASS]) 12645 return -EINVAL; 12646 12647 err = nl80211_parse_chandef(rdev, info, &chandef); 12648 if (err) 12649 return err; 12650 12651 /* 12652 * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012 12653 * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the 12654 * specification is not defined for them. 12655 */ 12656 if (chandef.chan->band == NL80211_BAND_2GHZ && 12657 chandef.width != NL80211_CHAN_WIDTH_20_NOHT && 12658 chandef.width != NL80211_CHAN_WIDTH_20) 12659 return -EINVAL; 12660 12661 /* we will be active on the TDLS link */ 12662 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef, 12663 wdev->iftype)) 12664 return -EINVAL; 12665 12666 /* don't allow switching to DFS channels */ 12667 if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype)) 12668 return -EINVAL; 12669 12670 addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 12671 oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]); 12672 12673 wdev_lock(wdev); 12674 err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef); 12675 wdev_unlock(wdev); 12676 12677 return err; 12678 } 12679 12680 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb, 12681 struct genl_info *info) 12682 { 12683 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12684 struct net_device *dev = info->user_ptr[1]; 12685 struct wireless_dev *wdev = dev->ieee80211_ptr; 12686 const u8 *addr; 12687 12688 if (!rdev->ops->tdls_channel_switch || 12689 !rdev->ops->tdls_cancel_channel_switch || 12690 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH)) 12691 return -EOPNOTSUPP; 12692 12693 switch (dev->ieee80211_ptr->iftype) { 12694 case NL80211_IFTYPE_STATION: 12695 case NL80211_IFTYPE_P2P_CLIENT: 12696 break; 12697 default: 12698 return -EOPNOTSUPP; 12699 } 12700 12701 if (!info->attrs[NL80211_ATTR_MAC]) 12702 return -EINVAL; 12703 12704 addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 12705 12706 wdev_lock(wdev); 12707 rdev_tdls_cancel_channel_switch(rdev, dev, addr); 12708 wdev_unlock(wdev); 12709 12710 return 0; 12711 } 12712 12713 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb, 12714 struct genl_info *info) 12715 { 12716 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12717 struct net_device *dev = info->user_ptr[1]; 12718 struct wireless_dev *wdev = dev->ieee80211_ptr; 12719 const struct nlattr *nla; 12720 bool enabled; 12721 12722 if (!rdev->ops->set_multicast_to_unicast) 12723 return -EOPNOTSUPP; 12724 12725 if (wdev->iftype != NL80211_IFTYPE_AP && 12726 wdev->iftype != NL80211_IFTYPE_P2P_GO) 12727 return -EOPNOTSUPP; 12728 12729 nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED]; 12730 enabled = nla_get_flag(nla); 12731 12732 return rdev_set_multicast_to_unicast(rdev, dev, enabled); 12733 } 12734 12735 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info) 12736 { 12737 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12738 struct net_device *dev = info->user_ptr[1]; 12739 struct wireless_dev *wdev = dev->ieee80211_ptr; 12740 struct cfg80211_pmk_conf pmk_conf = {}; 12741 int ret; 12742 12743 if (wdev->iftype != NL80211_IFTYPE_STATION && 12744 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 12745 return -EOPNOTSUPP; 12746 12747 if (!wiphy_ext_feature_isset(&rdev->wiphy, 12748 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X)) 12749 return -EOPNOTSUPP; 12750 12751 if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK]) 12752 return -EINVAL; 12753 12754 wdev_lock(wdev); 12755 if (!wdev->current_bss) { 12756 ret = -ENOTCONN; 12757 goto out; 12758 } 12759 12760 pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]); 12761 if (memcmp(pmk_conf.aa, wdev->current_bss->pub.bssid, ETH_ALEN)) { 12762 ret = -EINVAL; 12763 goto out; 12764 } 12765 12766 pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]); 12767 pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]); 12768 if (pmk_conf.pmk_len != WLAN_PMK_LEN && 12769 pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) { 12770 ret = -EINVAL; 12771 goto out; 12772 } 12773 12774 if (info->attrs[NL80211_ATTR_PMKR0_NAME]) { 12775 int r0_name_len = nla_len(info->attrs[NL80211_ATTR_PMKR0_NAME]); 12776 12777 if (r0_name_len != WLAN_PMK_NAME_LEN) { 12778 ret = -EINVAL; 12779 goto out; 12780 } 12781 12782 pmk_conf.pmk_r0_name = 12783 nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]); 12784 } 12785 12786 ret = rdev_set_pmk(rdev, dev, &pmk_conf); 12787 out: 12788 wdev_unlock(wdev); 12789 return ret; 12790 } 12791 12792 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info) 12793 { 12794 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12795 struct net_device *dev = info->user_ptr[1]; 12796 struct wireless_dev *wdev = dev->ieee80211_ptr; 12797 const u8 *aa; 12798 int ret; 12799 12800 if (wdev->iftype != NL80211_IFTYPE_STATION && 12801 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 12802 return -EOPNOTSUPP; 12803 12804 if (!wiphy_ext_feature_isset(&rdev->wiphy, 12805 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X)) 12806 return -EOPNOTSUPP; 12807 12808 if (!info->attrs[NL80211_ATTR_MAC]) 12809 return -EINVAL; 12810 12811 wdev_lock(wdev); 12812 aa = nla_data(info->attrs[NL80211_ATTR_MAC]); 12813 ret = rdev_del_pmk(rdev, dev, aa); 12814 wdev_unlock(wdev); 12815 12816 return ret; 12817 } 12818 12819 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info) 12820 { 12821 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12822 struct net_device *dev = info->user_ptr[1]; 12823 struct cfg80211_external_auth_params params; 12824 12825 if (!rdev->ops->external_auth) 12826 return -EOPNOTSUPP; 12827 12828 if (!info->attrs[NL80211_ATTR_SSID]) 12829 return -EINVAL; 12830 12831 if (!info->attrs[NL80211_ATTR_BSSID]) 12832 return -EINVAL; 12833 12834 if (!info->attrs[NL80211_ATTR_STATUS_CODE]) 12835 return -EINVAL; 12836 12837 memset(¶ms, 0, sizeof(params)); 12838 12839 params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 12840 if (params.ssid.ssid_len == 0 || 12841 params.ssid.ssid_len > IEEE80211_MAX_SSID_LEN) 12842 return -EINVAL; 12843 memcpy(params.ssid.ssid, nla_data(info->attrs[NL80211_ATTR_SSID]), 12844 params.ssid.ssid_len); 12845 12846 memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]), 12847 ETH_ALEN); 12848 12849 params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]); 12850 12851 return rdev_external_auth(rdev, dev, ¶ms); 12852 } 12853 12854 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info) 12855 { 12856 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12857 struct net_device *dev = info->user_ptr[1]; 12858 struct wireless_dev *wdev = dev->ieee80211_ptr; 12859 const u8 *buf; 12860 size_t len; 12861 u8 *dest; 12862 u16 proto; 12863 bool noencrypt; 12864 int err; 12865 12866 if (!wiphy_ext_feature_isset(&rdev->wiphy, 12867 NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211)) 12868 return -EOPNOTSUPP; 12869 12870 if (!rdev->ops->tx_control_port) 12871 return -EOPNOTSUPP; 12872 12873 if (!info->attrs[NL80211_ATTR_FRAME] || 12874 !info->attrs[NL80211_ATTR_MAC] || 12875 !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) { 12876 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing"); 12877 return -EINVAL; 12878 } 12879 12880 wdev_lock(wdev); 12881 12882 switch (wdev->iftype) { 12883 case NL80211_IFTYPE_AP: 12884 case NL80211_IFTYPE_P2P_GO: 12885 case NL80211_IFTYPE_MESH_POINT: 12886 break; 12887 case NL80211_IFTYPE_ADHOC: 12888 case NL80211_IFTYPE_STATION: 12889 case NL80211_IFTYPE_P2P_CLIENT: 12890 if (wdev->current_bss) 12891 break; 12892 err = -ENOTCONN; 12893 goto out; 12894 default: 12895 err = -EOPNOTSUPP; 12896 goto out; 12897 } 12898 12899 wdev_unlock(wdev); 12900 12901 buf = nla_data(info->attrs[NL80211_ATTR_FRAME]); 12902 len = nla_len(info->attrs[NL80211_ATTR_FRAME]); 12903 dest = nla_data(info->attrs[NL80211_ATTR_MAC]); 12904 proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]); 12905 noencrypt = 12906 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]); 12907 12908 return rdev_tx_control_port(rdev, dev, buf, len, 12909 dest, cpu_to_be16(proto), noencrypt); 12910 12911 out: 12912 wdev_unlock(wdev); 12913 return err; 12914 } 12915 12916 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb, 12917 struct genl_info *info) 12918 { 12919 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12920 struct net_device *dev = info->user_ptr[1]; 12921 struct wireless_dev *wdev = dev->ieee80211_ptr; 12922 struct cfg80211_ftm_responder_stats ftm_stats = {}; 12923 struct sk_buff *msg; 12924 void *hdr; 12925 struct nlattr *ftm_stats_attr; 12926 int err; 12927 12928 if (wdev->iftype != NL80211_IFTYPE_AP || !wdev->beacon_interval) 12929 return -EOPNOTSUPP; 12930 12931 err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats); 12932 if (err) 12933 return err; 12934 12935 if (!ftm_stats.filled) 12936 return -ENODATA; 12937 12938 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 12939 if (!msg) 12940 return -ENOMEM; 12941 12942 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 12943 NL80211_CMD_GET_FTM_RESPONDER_STATS); 12944 if (!hdr) 12945 return -ENOBUFS; 12946 12947 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 12948 goto nla_put_failure; 12949 12950 ftm_stats_attr = nla_nest_start(msg, NL80211_ATTR_FTM_RESPONDER_STATS); 12951 if (!ftm_stats_attr) 12952 goto nla_put_failure; 12953 12954 #define SET_FTM(field, name, type) \ 12955 do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \ 12956 nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name, \ 12957 ftm_stats.field)) \ 12958 goto nla_put_failure; } while (0) 12959 #define SET_FTM_U64(field, name) \ 12960 do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \ 12961 nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name, \ 12962 ftm_stats.field, NL80211_FTM_STATS_PAD)) \ 12963 goto nla_put_failure; } while (0) 12964 12965 SET_FTM(success_num, SUCCESS_NUM, u32); 12966 SET_FTM(partial_num, PARTIAL_NUM, u32); 12967 SET_FTM(failed_num, FAILED_NUM, u32); 12968 SET_FTM(asap_num, ASAP_NUM, u32); 12969 SET_FTM(non_asap_num, NON_ASAP_NUM, u32); 12970 SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC); 12971 SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32); 12972 SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32); 12973 SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32); 12974 #undef SET_FTM 12975 12976 nla_nest_end(msg, ftm_stats_attr); 12977 12978 genlmsg_end(msg, hdr); 12979 return genlmsg_reply(msg, info); 12980 12981 nla_put_failure: 12982 nlmsg_free(msg); 12983 return -ENOBUFS; 12984 } 12985 12986 #define NL80211_FLAG_NEED_WIPHY 0x01 12987 #define NL80211_FLAG_NEED_NETDEV 0x02 12988 #define NL80211_FLAG_NEED_RTNL 0x04 12989 #define NL80211_FLAG_CHECK_NETDEV_UP 0x08 12990 #define NL80211_FLAG_NEED_NETDEV_UP (NL80211_FLAG_NEED_NETDEV |\ 12991 NL80211_FLAG_CHECK_NETDEV_UP) 12992 #define NL80211_FLAG_NEED_WDEV 0x10 12993 /* If a netdev is associated, it must be UP, P2P must be started */ 12994 #define NL80211_FLAG_NEED_WDEV_UP (NL80211_FLAG_NEED_WDEV |\ 12995 NL80211_FLAG_CHECK_NETDEV_UP) 12996 #define NL80211_FLAG_CLEAR_SKB 0x20 12997 12998 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb, 12999 struct genl_info *info) 13000 { 13001 struct cfg80211_registered_device *rdev; 13002 struct wireless_dev *wdev; 13003 struct net_device *dev; 13004 bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL; 13005 13006 if (rtnl) 13007 rtnl_lock(); 13008 13009 if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) { 13010 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info); 13011 if (IS_ERR(rdev)) { 13012 if (rtnl) 13013 rtnl_unlock(); 13014 return PTR_ERR(rdev); 13015 } 13016 info->user_ptr[0] = rdev; 13017 } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV || 13018 ops->internal_flags & NL80211_FLAG_NEED_WDEV) { 13019 ASSERT_RTNL(); 13020 13021 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info), 13022 info->attrs); 13023 if (IS_ERR(wdev)) { 13024 if (rtnl) 13025 rtnl_unlock(); 13026 return PTR_ERR(wdev); 13027 } 13028 13029 dev = wdev->netdev; 13030 rdev = wiphy_to_rdev(wdev->wiphy); 13031 13032 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) { 13033 if (!dev) { 13034 if (rtnl) 13035 rtnl_unlock(); 13036 return -EINVAL; 13037 } 13038 13039 info->user_ptr[1] = dev; 13040 } else { 13041 info->user_ptr[1] = wdev; 13042 } 13043 13044 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP && 13045 !wdev_running(wdev)) { 13046 if (rtnl) 13047 rtnl_unlock(); 13048 return -ENETDOWN; 13049 } 13050 13051 if (dev) 13052 dev_hold(dev); 13053 13054 info->user_ptr[0] = rdev; 13055 } 13056 13057 return 0; 13058 } 13059 13060 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb, 13061 struct genl_info *info) 13062 { 13063 if (info->user_ptr[1]) { 13064 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) { 13065 struct wireless_dev *wdev = info->user_ptr[1]; 13066 13067 if (wdev->netdev) 13068 dev_put(wdev->netdev); 13069 } else { 13070 dev_put(info->user_ptr[1]); 13071 } 13072 } 13073 13074 if (ops->internal_flags & NL80211_FLAG_NEED_RTNL) 13075 rtnl_unlock(); 13076 13077 /* If needed, clear the netlink message payload from the SKB 13078 * as it might contain key data that shouldn't stick around on 13079 * the heap after the SKB is freed. The netlink message header 13080 * is still needed for further processing, so leave it intact. 13081 */ 13082 if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) { 13083 struct nlmsghdr *nlh = nlmsg_hdr(skb); 13084 13085 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh)); 13086 } 13087 } 13088 13089 static const struct genl_ops nl80211_ops[] = { 13090 { 13091 .cmd = NL80211_CMD_GET_WIPHY, 13092 .doit = nl80211_get_wiphy, 13093 .dumpit = nl80211_dump_wiphy, 13094 .done = nl80211_dump_wiphy_done, 13095 .policy = nl80211_policy, 13096 /* can be retrieved by unprivileged users */ 13097 .internal_flags = NL80211_FLAG_NEED_WIPHY | 13098 NL80211_FLAG_NEED_RTNL, 13099 }, 13100 { 13101 .cmd = NL80211_CMD_SET_WIPHY, 13102 .doit = nl80211_set_wiphy, 13103 .policy = nl80211_policy, 13104 .flags = GENL_UNS_ADMIN_PERM, 13105 .internal_flags = NL80211_FLAG_NEED_RTNL, 13106 }, 13107 { 13108 .cmd = NL80211_CMD_GET_INTERFACE, 13109 .doit = nl80211_get_interface, 13110 .dumpit = nl80211_dump_interface, 13111 .policy = nl80211_policy, 13112 /* can be retrieved by unprivileged users */ 13113 .internal_flags = NL80211_FLAG_NEED_WDEV | 13114 NL80211_FLAG_NEED_RTNL, 13115 }, 13116 { 13117 .cmd = NL80211_CMD_SET_INTERFACE, 13118 .doit = nl80211_set_interface, 13119 .policy = nl80211_policy, 13120 .flags = GENL_UNS_ADMIN_PERM, 13121 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13122 NL80211_FLAG_NEED_RTNL, 13123 }, 13124 { 13125 .cmd = NL80211_CMD_NEW_INTERFACE, 13126 .doit = nl80211_new_interface, 13127 .policy = nl80211_policy, 13128 .flags = GENL_UNS_ADMIN_PERM, 13129 .internal_flags = NL80211_FLAG_NEED_WIPHY | 13130 NL80211_FLAG_NEED_RTNL, 13131 }, 13132 { 13133 .cmd = NL80211_CMD_DEL_INTERFACE, 13134 .doit = nl80211_del_interface, 13135 .policy = nl80211_policy, 13136 .flags = GENL_UNS_ADMIN_PERM, 13137 .internal_flags = NL80211_FLAG_NEED_WDEV | 13138 NL80211_FLAG_NEED_RTNL, 13139 }, 13140 { 13141 .cmd = NL80211_CMD_GET_KEY, 13142 .doit = nl80211_get_key, 13143 .policy = nl80211_policy, 13144 .flags = GENL_UNS_ADMIN_PERM, 13145 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13146 NL80211_FLAG_NEED_RTNL, 13147 }, 13148 { 13149 .cmd = NL80211_CMD_SET_KEY, 13150 .doit = nl80211_set_key, 13151 .policy = nl80211_policy, 13152 .flags = GENL_UNS_ADMIN_PERM, 13153 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13154 NL80211_FLAG_NEED_RTNL | 13155 NL80211_FLAG_CLEAR_SKB, 13156 }, 13157 { 13158 .cmd = NL80211_CMD_NEW_KEY, 13159 .doit = nl80211_new_key, 13160 .policy = nl80211_policy, 13161 .flags = GENL_UNS_ADMIN_PERM, 13162 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13163 NL80211_FLAG_NEED_RTNL | 13164 NL80211_FLAG_CLEAR_SKB, 13165 }, 13166 { 13167 .cmd = NL80211_CMD_DEL_KEY, 13168 .doit = nl80211_del_key, 13169 .policy = nl80211_policy, 13170 .flags = GENL_UNS_ADMIN_PERM, 13171 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13172 NL80211_FLAG_NEED_RTNL, 13173 }, 13174 { 13175 .cmd = NL80211_CMD_SET_BEACON, 13176 .policy = nl80211_policy, 13177 .flags = GENL_UNS_ADMIN_PERM, 13178 .doit = nl80211_set_beacon, 13179 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13180 NL80211_FLAG_NEED_RTNL, 13181 }, 13182 { 13183 .cmd = NL80211_CMD_START_AP, 13184 .policy = nl80211_policy, 13185 .flags = GENL_UNS_ADMIN_PERM, 13186 .doit = nl80211_start_ap, 13187 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13188 NL80211_FLAG_NEED_RTNL, 13189 }, 13190 { 13191 .cmd = NL80211_CMD_STOP_AP, 13192 .policy = nl80211_policy, 13193 .flags = GENL_UNS_ADMIN_PERM, 13194 .doit = nl80211_stop_ap, 13195 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13196 NL80211_FLAG_NEED_RTNL, 13197 }, 13198 { 13199 .cmd = NL80211_CMD_GET_STATION, 13200 .doit = nl80211_get_station, 13201 .dumpit = nl80211_dump_station, 13202 .policy = nl80211_policy, 13203 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13204 NL80211_FLAG_NEED_RTNL, 13205 }, 13206 { 13207 .cmd = NL80211_CMD_SET_STATION, 13208 .doit = nl80211_set_station, 13209 .policy = nl80211_policy, 13210 .flags = GENL_UNS_ADMIN_PERM, 13211 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13212 NL80211_FLAG_NEED_RTNL, 13213 }, 13214 { 13215 .cmd = NL80211_CMD_NEW_STATION, 13216 .doit = nl80211_new_station, 13217 .policy = nl80211_policy, 13218 .flags = GENL_UNS_ADMIN_PERM, 13219 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13220 NL80211_FLAG_NEED_RTNL, 13221 }, 13222 { 13223 .cmd = NL80211_CMD_DEL_STATION, 13224 .doit = nl80211_del_station, 13225 .policy = nl80211_policy, 13226 .flags = GENL_UNS_ADMIN_PERM, 13227 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13228 NL80211_FLAG_NEED_RTNL, 13229 }, 13230 { 13231 .cmd = NL80211_CMD_GET_MPATH, 13232 .doit = nl80211_get_mpath, 13233 .dumpit = nl80211_dump_mpath, 13234 .policy = nl80211_policy, 13235 .flags = GENL_UNS_ADMIN_PERM, 13236 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13237 NL80211_FLAG_NEED_RTNL, 13238 }, 13239 { 13240 .cmd = NL80211_CMD_GET_MPP, 13241 .doit = nl80211_get_mpp, 13242 .dumpit = nl80211_dump_mpp, 13243 .policy = nl80211_policy, 13244 .flags = GENL_UNS_ADMIN_PERM, 13245 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13246 NL80211_FLAG_NEED_RTNL, 13247 }, 13248 { 13249 .cmd = NL80211_CMD_SET_MPATH, 13250 .doit = nl80211_set_mpath, 13251 .policy = nl80211_policy, 13252 .flags = GENL_UNS_ADMIN_PERM, 13253 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13254 NL80211_FLAG_NEED_RTNL, 13255 }, 13256 { 13257 .cmd = NL80211_CMD_NEW_MPATH, 13258 .doit = nl80211_new_mpath, 13259 .policy = nl80211_policy, 13260 .flags = GENL_UNS_ADMIN_PERM, 13261 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13262 NL80211_FLAG_NEED_RTNL, 13263 }, 13264 { 13265 .cmd = NL80211_CMD_DEL_MPATH, 13266 .doit = nl80211_del_mpath, 13267 .policy = nl80211_policy, 13268 .flags = GENL_UNS_ADMIN_PERM, 13269 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13270 NL80211_FLAG_NEED_RTNL, 13271 }, 13272 { 13273 .cmd = NL80211_CMD_SET_BSS, 13274 .doit = nl80211_set_bss, 13275 .policy = nl80211_policy, 13276 .flags = GENL_UNS_ADMIN_PERM, 13277 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13278 NL80211_FLAG_NEED_RTNL, 13279 }, 13280 { 13281 .cmd = NL80211_CMD_GET_REG, 13282 .doit = nl80211_get_reg_do, 13283 .dumpit = nl80211_get_reg_dump, 13284 .policy = nl80211_policy, 13285 .internal_flags = NL80211_FLAG_NEED_RTNL, 13286 /* can be retrieved by unprivileged users */ 13287 }, 13288 #ifdef CONFIG_CFG80211_CRDA_SUPPORT 13289 { 13290 .cmd = NL80211_CMD_SET_REG, 13291 .doit = nl80211_set_reg, 13292 .policy = nl80211_policy, 13293 .flags = GENL_ADMIN_PERM, 13294 .internal_flags = NL80211_FLAG_NEED_RTNL, 13295 }, 13296 #endif 13297 { 13298 .cmd = NL80211_CMD_REQ_SET_REG, 13299 .doit = nl80211_req_set_reg, 13300 .policy = nl80211_policy, 13301 .flags = GENL_ADMIN_PERM, 13302 }, 13303 { 13304 .cmd = NL80211_CMD_RELOAD_REGDB, 13305 .doit = nl80211_reload_regdb, 13306 .policy = nl80211_policy, 13307 .flags = GENL_ADMIN_PERM, 13308 }, 13309 { 13310 .cmd = NL80211_CMD_GET_MESH_CONFIG, 13311 .doit = nl80211_get_mesh_config, 13312 .policy = nl80211_policy, 13313 /* can be retrieved by unprivileged users */ 13314 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13315 NL80211_FLAG_NEED_RTNL, 13316 }, 13317 { 13318 .cmd = NL80211_CMD_SET_MESH_CONFIG, 13319 .doit = nl80211_update_mesh_config, 13320 .policy = nl80211_policy, 13321 .flags = GENL_UNS_ADMIN_PERM, 13322 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13323 NL80211_FLAG_NEED_RTNL, 13324 }, 13325 { 13326 .cmd = NL80211_CMD_TRIGGER_SCAN, 13327 .doit = nl80211_trigger_scan, 13328 .policy = nl80211_policy, 13329 .flags = GENL_UNS_ADMIN_PERM, 13330 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13331 NL80211_FLAG_NEED_RTNL, 13332 }, 13333 { 13334 .cmd = NL80211_CMD_ABORT_SCAN, 13335 .doit = nl80211_abort_scan, 13336 .policy = nl80211_policy, 13337 .flags = GENL_UNS_ADMIN_PERM, 13338 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13339 NL80211_FLAG_NEED_RTNL, 13340 }, 13341 { 13342 .cmd = NL80211_CMD_GET_SCAN, 13343 .policy = nl80211_policy, 13344 .dumpit = nl80211_dump_scan, 13345 }, 13346 { 13347 .cmd = NL80211_CMD_START_SCHED_SCAN, 13348 .doit = nl80211_start_sched_scan, 13349 .policy = nl80211_policy, 13350 .flags = GENL_UNS_ADMIN_PERM, 13351 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13352 NL80211_FLAG_NEED_RTNL, 13353 }, 13354 { 13355 .cmd = NL80211_CMD_STOP_SCHED_SCAN, 13356 .doit = nl80211_stop_sched_scan, 13357 .policy = nl80211_policy, 13358 .flags = GENL_UNS_ADMIN_PERM, 13359 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13360 NL80211_FLAG_NEED_RTNL, 13361 }, 13362 { 13363 .cmd = NL80211_CMD_AUTHENTICATE, 13364 .doit = nl80211_authenticate, 13365 .policy = nl80211_policy, 13366 .flags = GENL_UNS_ADMIN_PERM, 13367 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13368 NL80211_FLAG_NEED_RTNL | 13369 NL80211_FLAG_CLEAR_SKB, 13370 }, 13371 { 13372 .cmd = NL80211_CMD_ASSOCIATE, 13373 .doit = nl80211_associate, 13374 .policy = nl80211_policy, 13375 .flags = GENL_UNS_ADMIN_PERM, 13376 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13377 NL80211_FLAG_NEED_RTNL, 13378 }, 13379 { 13380 .cmd = NL80211_CMD_DEAUTHENTICATE, 13381 .doit = nl80211_deauthenticate, 13382 .policy = nl80211_policy, 13383 .flags = GENL_UNS_ADMIN_PERM, 13384 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13385 NL80211_FLAG_NEED_RTNL, 13386 }, 13387 { 13388 .cmd = NL80211_CMD_DISASSOCIATE, 13389 .doit = nl80211_disassociate, 13390 .policy = nl80211_policy, 13391 .flags = GENL_UNS_ADMIN_PERM, 13392 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13393 NL80211_FLAG_NEED_RTNL, 13394 }, 13395 { 13396 .cmd = NL80211_CMD_JOIN_IBSS, 13397 .doit = nl80211_join_ibss, 13398 .policy = nl80211_policy, 13399 .flags = GENL_UNS_ADMIN_PERM, 13400 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13401 NL80211_FLAG_NEED_RTNL, 13402 }, 13403 { 13404 .cmd = NL80211_CMD_LEAVE_IBSS, 13405 .doit = nl80211_leave_ibss, 13406 .policy = nl80211_policy, 13407 .flags = GENL_UNS_ADMIN_PERM, 13408 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13409 NL80211_FLAG_NEED_RTNL, 13410 }, 13411 #ifdef CONFIG_NL80211_TESTMODE 13412 { 13413 .cmd = NL80211_CMD_TESTMODE, 13414 .doit = nl80211_testmode_do, 13415 .dumpit = nl80211_testmode_dump, 13416 .policy = nl80211_policy, 13417 .flags = GENL_UNS_ADMIN_PERM, 13418 .internal_flags = NL80211_FLAG_NEED_WIPHY | 13419 NL80211_FLAG_NEED_RTNL, 13420 }, 13421 #endif 13422 { 13423 .cmd = NL80211_CMD_CONNECT, 13424 .doit = nl80211_connect, 13425 .policy = nl80211_policy, 13426 .flags = GENL_UNS_ADMIN_PERM, 13427 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13428 NL80211_FLAG_NEED_RTNL, 13429 }, 13430 { 13431 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS, 13432 .doit = nl80211_update_connect_params, 13433 .policy = nl80211_policy, 13434 .flags = GENL_ADMIN_PERM, 13435 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13436 NL80211_FLAG_NEED_RTNL, 13437 }, 13438 { 13439 .cmd = NL80211_CMD_DISCONNECT, 13440 .doit = nl80211_disconnect, 13441 .policy = nl80211_policy, 13442 .flags = GENL_UNS_ADMIN_PERM, 13443 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13444 NL80211_FLAG_NEED_RTNL, 13445 }, 13446 { 13447 .cmd = NL80211_CMD_SET_WIPHY_NETNS, 13448 .doit = nl80211_wiphy_netns, 13449 .policy = nl80211_policy, 13450 .flags = GENL_UNS_ADMIN_PERM, 13451 .internal_flags = NL80211_FLAG_NEED_WIPHY | 13452 NL80211_FLAG_NEED_RTNL, 13453 }, 13454 { 13455 .cmd = NL80211_CMD_GET_SURVEY, 13456 .policy = nl80211_policy, 13457 .dumpit = nl80211_dump_survey, 13458 }, 13459 { 13460 .cmd = NL80211_CMD_SET_PMKSA, 13461 .doit = nl80211_setdel_pmksa, 13462 .policy = nl80211_policy, 13463 .flags = GENL_UNS_ADMIN_PERM, 13464 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13465 NL80211_FLAG_NEED_RTNL, 13466 }, 13467 { 13468 .cmd = NL80211_CMD_DEL_PMKSA, 13469 .doit = nl80211_setdel_pmksa, 13470 .policy = nl80211_policy, 13471 .flags = GENL_UNS_ADMIN_PERM, 13472 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13473 NL80211_FLAG_NEED_RTNL, 13474 }, 13475 { 13476 .cmd = NL80211_CMD_FLUSH_PMKSA, 13477 .doit = nl80211_flush_pmksa, 13478 .policy = nl80211_policy, 13479 .flags = GENL_UNS_ADMIN_PERM, 13480 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13481 NL80211_FLAG_NEED_RTNL, 13482 }, 13483 { 13484 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL, 13485 .doit = nl80211_remain_on_channel, 13486 .policy = nl80211_policy, 13487 .flags = GENL_UNS_ADMIN_PERM, 13488 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13489 NL80211_FLAG_NEED_RTNL, 13490 }, 13491 { 13492 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL, 13493 .doit = nl80211_cancel_remain_on_channel, 13494 .policy = nl80211_policy, 13495 .flags = GENL_UNS_ADMIN_PERM, 13496 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13497 NL80211_FLAG_NEED_RTNL, 13498 }, 13499 { 13500 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK, 13501 .doit = nl80211_set_tx_bitrate_mask, 13502 .policy = nl80211_policy, 13503 .flags = GENL_UNS_ADMIN_PERM, 13504 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13505 NL80211_FLAG_NEED_RTNL, 13506 }, 13507 { 13508 .cmd = NL80211_CMD_REGISTER_FRAME, 13509 .doit = nl80211_register_mgmt, 13510 .policy = nl80211_policy, 13511 .flags = GENL_UNS_ADMIN_PERM, 13512 .internal_flags = NL80211_FLAG_NEED_WDEV | 13513 NL80211_FLAG_NEED_RTNL, 13514 }, 13515 { 13516 .cmd = NL80211_CMD_FRAME, 13517 .doit = nl80211_tx_mgmt, 13518 .policy = nl80211_policy, 13519 .flags = GENL_UNS_ADMIN_PERM, 13520 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13521 NL80211_FLAG_NEED_RTNL, 13522 }, 13523 { 13524 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL, 13525 .doit = nl80211_tx_mgmt_cancel_wait, 13526 .policy = nl80211_policy, 13527 .flags = GENL_UNS_ADMIN_PERM, 13528 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13529 NL80211_FLAG_NEED_RTNL, 13530 }, 13531 { 13532 .cmd = NL80211_CMD_SET_POWER_SAVE, 13533 .doit = nl80211_set_power_save, 13534 .policy = nl80211_policy, 13535 .flags = GENL_UNS_ADMIN_PERM, 13536 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13537 NL80211_FLAG_NEED_RTNL, 13538 }, 13539 { 13540 .cmd = NL80211_CMD_GET_POWER_SAVE, 13541 .doit = nl80211_get_power_save, 13542 .policy = nl80211_policy, 13543 /* can be retrieved by unprivileged users */ 13544 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13545 NL80211_FLAG_NEED_RTNL, 13546 }, 13547 { 13548 .cmd = NL80211_CMD_SET_CQM, 13549 .doit = nl80211_set_cqm, 13550 .policy = nl80211_policy, 13551 .flags = GENL_UNS_ADMIN_PERM, 13552 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13553 NL80211_FLAG_NEED_RTNL, 13554 }, 13555 { 13556 .cmd = NL80211_CMD_SET_CHANNEL, 13557 .doit = nl80211_set_channel, 13558 .policy = nl80211_policy, 13559 .flags = GENL_UNS_ADMIN_PERM, 13560 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13561 NL80211_FLAG_NEED_RTNL, 13562 }, 13563 { 13564 .cmd = NL80211_CMD_SET_WDS_PEER, 13565 .doit = nl80211_set_wds_peer, 13566 .policy = nl80211_policy, 13567 .flags = GENL_UNS_ADMIN_PERM, 13568 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13569 NL80211_FLAG_NEED_RTNL, 13570 }, 13571 { 13572 .cmd = NL80211_CMD_JOIN_MESH, 13573 .doit = nl80211_join_mesh, 13574 .policy = nl80211_policy, 13575 .flags = GENL_UNS_ADMIN_PERM, 13576 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13577 NL80211_FLAG_NEED_RTNL, 13578 }, 13579 { 13580 .cmd = NL80211_CMD_LEAVE_MESH, 13581 .doit = nl80211_leave_mesh, 13582 .policy = nl80211_policy, 13583 .flags = GENL_UNS_ADMIN_PERM, 13584 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13585 NL80211_FLAG_NEED_RTNL, 13586 }, 13587 { 13588 .cmd = NL80211_CMD_JOIN_OCB, 13589 .doit = nl80211_join_ocb, 13590 .policy = nl80211_policy, 13591 .flags = GENL_UNS_ADMIN_PERM, 13592 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13593 NL80211_FLAG_NEED_RTNL, 13594 }, 13595 { 13596 .cmd = NL80211_CMD_LEAVE_OCB, 13597 .doit = nl80211_leave_ocb, 13598 .policy = nl80211_policy, 13599 .flags = GENL_UNS_ADMIN_PERM, 13600 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13601 NL80211_FLAG_NEED_RTNL, 13602 }, 13603 #ifdef CONFIG_PM 13604 { 13605 .cmd = NL80211_CMD_GET_WOWLAN, 13606 .doit = nl80211_get_wowlan, 13607 .policy = nl80211_policy, 13608 /* can be retrieved by unprivileged users */ 13609 .internal_flags = NL80211_FLAG_NEED_WIPHY | 13610 NL80211_FLAG_NEED_RTNL, 13611 }, 13612 { 13613 .cmd = NL80211_CMD_SET_WOWLAN, 13614 .doit = nl80211_set_wowlan, 13615 .policy = nl80211_policy, 13616 .flags = GENL_UNS_ADMIN_PERM, 13617 .internal_flags = NL80211_FLAG_NEED_WIPHY | 13618 NL80211_FLAG_NEED_RTNL, 13619 }, 13620 #endif 13621 { 13622 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD, 13623 .doit = nl80211_set_rekey_data, 13624 .policy = nl80211_policy, 13625 .flags = GENL_UNS_ADMIN_PERM, 13626 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13627 NL80211_FLAG_NEED_RTNL | 13628 NL80211_FLAG_CLEAR_SKB, 13629 }, 13630 { 13631 .cmd = NL80211_CMD_TDLS_MGMT, 13632 .doit = nl80211_tdls_mgmt, 13633 .policy = nl80211_policy, 13634 .flags = GENL_UNS_ADMIN_PERM, 13635 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13636 NL80211_FLAG_NEED_RTNL, 13637 }, 13638 { 13639 .cmd = NL80211_CMD_TDLS_OPER, 13640 .doit = nl80211_tdls_oper, 13641 .policy = nl80211_policy, 13642 .flags = GENL_UNS_ADMIN_PERM, 13643 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13644 NL80211_FLAG_NEED_RTNL, 13645 }, 13646 { 13647 .cmd = NL80211_CMD_UNEXPECTED_FRAME, 13648 .doit = nl80211_register_unexpected_frame, 13649 .policy = nl80211_policy, 13650 .flags = GENL_UNS_ADMIN_PERM, 13651 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13652 NL80211_FLAG_NEED_RTNL, 13653 }, 13654 { 13655 .cmd = NL80211_CMD_PROBE_CLIENT, 13656 .doit = nl80211_probe_client, 13657 .policy = nl80211_policy, 13658 .flags = GENL_UNS_ADMIN_PERM, 13659 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13660 NL80211_FLAG_NEED_RTNL, 13661 }, 13662 { 13663 .cmd = NL80211_CMD_REGISTER_BEACONS, 13664 .doit = nl80211_register_beacons, 13665 .policy = nl80211_policy, 13666 .flags = GENL_UNS_ADMIN_PERM, 13667 .internal_flags = NL80211_FLAG_NEED_WIPHY | 13668 NL80211_FLAG_NEED_RTNL, 13669 }, 13670 { 13671 .cmd = NL80211_CMD_SET_NOACK_MAP, 13672 .doit = nl80211_set_noack_map, 13673 .policy = nl80211_policy, 13674 .flags = GENL_UNS_ADMIN_PERM, 13675 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13676 NL80211_FLAG_NEED_RTNL, 13677 }, 13678 { 13679 .cmd = NL80211_CMD_START_P2P_DEVICE, 13680 .doit = nl80211_start_p2p_device, 13681 .policy = nl80211_policy, 13682 .flags = GENL_UNS_ADMIN_PERM, 13683 .internal_flags = NL80211_FLAG_NEED_WDEV | 13684 NL80211_FLAG_NEED_RTNL, 13685 }, 13686 { 13687 .cmd = NL80211_CMD_STOP_P2P_DEVICE, 13688 .doit = nl80211_stop_p2p_device, 13689 .policy = nl80211_policy, 13690 .flags = GENL_UNS_ADMIN_PERM, 13691 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13692 NL80211_FLAG_NEED_RTNL, 13693 }, 13694 { 13695 .cmd = NL80211_CMD_START_NAN, 13696 .doit = nl80211_start_nan, 13697 .policy = nl80211_policy, 13698 .flags = GENL_ADMIN_PERM, 13699 .internal_flags = NL80211_FLAG_NEED_WDEV | 13700 NL80211_FLAG_NEED_RTNL, 13701 }, 13702 { 13703 .cmd = NL80211_CMD_STOP_NAN, 13704 .doit = nl80211_stop_nan, 13705 .policy = nl80211_policy, 13706 .flags = GENL_ADMIN_PERM, 13707 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13708 NL80211_FLAG_NEED_RTNL, 13709 }, 13710 { 13711 .cmd = NL80211_CMD_ADD_NAN_FUNCTION, 13712 .doit = nl80211_nan_add_func, 13713 .policy = nl80211_policy, 13714 .flags = GENL_ADMIN_PERM, 13715 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13716 NL80211_FLAG_NEED_RTNL, 13717 }, 13718 { 13719 .cmd = NL80211_CMD_DEL_NAN_FUNCTION, 13720 .doit = nl80211_nan_del_func, 13721 .policy = nl80211_policy, 13722 .flags = GENL_ADMIN_PERM, 13723 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13724 NL80211_FLAG_NEED_RTNL, 13725 }, 13726 { 13727 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG, 13728 .doit = nl80211_nan_change_config, 13729 .policy = nl80211_policy, 13730 .flags = GENL_ADMIN_PERM, 13731 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13732 NL80211_FLAG_NEED_RTNL, 13733 }, 13734 { 13735 .cmd = NL80211_CMD_SET_MCAST_RATE, 13736 .doit = nl80211_set_mcast_rate, 13737 .policy = nl80211_policy, 13738 .flags = GENL_UNS_ADMIN_PERM, 13739 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13740 NL80211_FLAG_NEED_RTNL, 13741 }, 13742 { 13743 .cmd = NL80211_CMD_SET_MAC_ACL, 13744 .doit = nl80211_set_mac_acl, 13745 .policy = nl80211_policy, 13746 .flags = GENL_UNS_ADMIN_PERM, 13747 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13748 NL80211_FLAG_NEED_RTNL, 13749 }, 13750 { 13751 .cmd = NL80211_CMD_RADAR_DETECT, 13752 .doit = nl80211_start_radar_detection, 13753 .policy = nl80211_policy, 13754 .flags = GENL_UNS_ADMIN_PERM, 13755 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13756 NL80211_FLAG_NEED_RTNL, 13757 }, 13758 { 13759 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES, 13760 .doit = nl80211_get_protocol_features, 13761 .policy = nl80211_policy, 13762 }, 13763 { 13764 .cmd = NL80211_CMD_UPDATE_FT_IES, 13765 .doit = nl80211_update_ft_ies, 13766 .policy = nl80211_policy, 13767 .flags = GENL_UNS_ADMIN_PERM, 13768 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13769 NL80211_FLAG_NEED_RTNL, 13770 }, 13771 { 13772 .cmd = NL80211_CMD_CRIT_PROTOCOL_START, 13773 .doit = nl80211_crit_protocol_start, 13774 .policy = nl80211_policy, 13775 .flags = GENL_UNS_ADMIN_PERM, 13776 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13777 NL80211_FLAG_NEED_RTNL, 13778 }, 13779 { 13780 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP, 13781 .doit = nl80211_crit_protocol_stop, 13782 .policy = nl80211_policy, 13783 .flags = GENL_UNS_ADMIN_PERM, 13784 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13785 NL80211_FLAG_NEED_RTNL, 13786 }, 13787 { 13788 .cmd = NL80211_CMD_GET_COALESCE, 13789 .doit = nl80211_get_coalesce, 13790 .policy = nl80211_policy, 13791 .internal_flags = NL80211_FLAG_NEED_WIPHY | 13792 NL80211_FLAG_NEED_RTNL, 13793 }, 13794 { 13795 .cmd = NL80211_CMD_SET_COALESCE, 13796 .doit = nl80211_set_coalesce, 13797 .policy = nl80211_policy, 13798 .flags = GENL_UNS_ADMIN_PERM, 13799 .internal_flags = NL80211_FLAG_NEED_WIPHY | 13800 NL80211_FLAG_NEED_RTNL, 13801 }, 13802 { 13803 .cmd = NL80211_CMD_CHANNEL_SWITCH, 13804 .doit = nl80211_channel_switch, 13805 .policy = nl80211_policy, 13806 .flags = GENL_UNS_ADMIN_PERM, 13807 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13808 NL80211_FLAG_NEED_RTNL, 13809 }, 13810 { 13811 .cmd = NL80211_CMD_VENDOR, 13812 .doit = nl80211_vendor_cmd, 13813 .dumpit = nl80211_vendor_cmd_dump, 13814 .policy = nl80211_policy, 13815 .flags = GENL_UNS_ADMIN_PERM, 13816 .internal_flags = NL80211_FLAG_NEED_WIPHY | 13817 NL80211_FLAG_NEED_RTNL, 13818 }, 13819 { 13820 .cmd = NL80211_CMD_SET_QOS_MAP, 13821 .doit = nl80211_set_qos_map, 13822 .policy = nl80211_policy, 13823 .flags = GENL_UNS_ADMIN_PERM, 13824 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13825 NL80211_FLAG_NEED_RTNL, 13826 }, 13827 { 13828 .cmd = NL80211_CMD_ADD_TX_TS, 13829 .doit = nl80211_add_tx_ts, 13830 .policy = nl80211_policy, 13831 .flags = GENL_UNS_ADMIN_PERM, 13832 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13833 NL80211_FLAG_NEED_RTNL, 13834 }, 13835 { 13836 .cmd = NL80211_CMD_DEL_TX_TS, 13837 .doit = nl80211_del_tx_ts, 13838 .policy = nl80211_policy, 13839 .flags = GENL_UNS_ADMIN_PERM, 13840 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13841 NL80211_FLAG_NEED_RTNL, 13842 }, 13843 { 13844 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH, 13845 .doit = nl80211_tdls_channel_switch, 13846 .policy = nl80211_policy, 13847 .flags = GENL_UNS_ADMIN_PERM, 13848 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13849 NL80211_FLAG_NEED_RTNL, 13850 }, 13851 { 13852 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH, 13853 .doit = nl80211_tdls_cancel_channel_switch, 13854 .policy = nl80211_policy, 13855 .flags = GENL_UNS_ADMIN_PERM, 13856 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13857 NL80211_FLAG_NEED_RTNL, 13858 }, 13859 { 13860 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST, 13861 .doit = nl80211_set_multicast_to_unicast, 13862 .policy = nl80211_policy, 13863 .flags = GENL_UNS_ADMIN_PERM, 13864 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13865 NL80211_FLAG_NEED_RTNL, 13866 }, 13867 { 13868 .cmd = NL80211_CMD_SET_PMK, 13869 .doit = nl80211_set_pmk, 13870 .policy = nl80211_policy, 13871 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13872 NL80211_FLAG_NEED_RTNL, 13873 }, 13874 { 13875 .cmd = NL80211_CMD_DEL_PMK, 13876 .doit = nl80211_del_pmk, 13877 .policy = nl80211_policy, 13878 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13879 NL80211_FLAG_NEED_RTNL, 13880 }, 13881 { 13882 .cmd = NL80211_CMD_EXTERNAL_AUTH, 13883 .doit = nl80211_external_auth, 13884 .policy = nl80211_policy, 13885 .flags = GENL_ADMIN_PERM, 13886 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13887 NL80211_FLAG_NEED_RTNL, 13888 }, 13889 { 13890 .cmd = NL80211_CMD_CONTROL_PORT_FRAME, 13891 .doit = nl80211_tx_control_port, 13892 .policy = nl80211_policy, 13893 .flags = GENL_UNS_ADMIN_PERM, 13894 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13895 NL80211_FLAG_NEED_RTNL, 13896 }, 13897 { 13898 .cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS, 13899 .doit = nl80211_get_ftm_responder_stats, 13900 .policy = nl80211_policy, 13901 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13902 NL80211_FLAG_NEED_RTNL, 13903 }, 13904 }; 13905 13906 static struct genl_family nl80211_fam __ro_after_init = { 13907 .name = NL80211_GENL_NAME, /* have users key off the name instead */ 13908 .hdrsize = 0, /* no private header */ 13909 .version = 1, /* no particular meaning now */ 13910 .maxattr = NL80211_ATTR_MAX, 13911 .netnsok = true, 13912 .pre_doit = nl80211_pre_doit, 13913 .post_doit = nl80211_post_doit, 13914 .module = THIS_MODULE, 13915 .ops = nl80211_ops, 13916 .n_ops = ARRAY_SIZE(nl80211_ops), 13917 .mcgrps = nl80211_mcgrps, 13918 .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps), 13919 }; 13920 13921 /* notification functions */ 13922 13923 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev, 13924 enum nl80211_commands cmd) 13925 { 13926 struct sk_buff *msg; 13927 struct nl80211_dump_wiphy_state state = {}; 13928 13929 WARN_ON(cmd != NL80211_CMD_NEW_WIPHY && 13930 cmd != NL80211_CMD_DEL_WIPHY); 13931 13932 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 13933 if (!msg) 13934 return; 13935 13936 if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) { 13937 nlmsg_free(msg); 13938 return; 13939 } 13940 13941 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13942 NL80211_MCGRP_CONFIG, GFP_KERNEL); 13943 } 13944 13945 void nl80211_notify_iface(struct cfg80211_registered_device *rdev, 13946 struct wireless_dev *wdev, 13947 enum nl80211_commands cmd) 13948 { 13949 struct sk_buff *msg; 13950 13951 WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE && 13952 cmd != NL80211_CMD_DEL_INTERFACE); 13953 13954 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 13955 if (!msg) 13956 return; 13957 13958 if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, 13959 cmd == NL80211_CMD_DEL_INTERFACE) < 0) { 13960 nlmsg_free(msg); 13961 return; 13962 } 13963 13964 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13965 NL80211_MCGRP_CONFIG, GFP_KERNEL); 13966 } 13967 13968 static int nl80211_add_scan_req(struct sk_buff *msg, 13969 struct cfg80211_registered_device *rdev) 13970 { 13971 struct cfg80211_scan_request *req = rdev->scan_req; 13972 struct nlattr *nest; 13973 int i; 13974 13975 if (WARN_ON(!req)) 13976 return 0; 13977 13978 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS); 13979 if (!nest) 13980 goto nla_put_failure; 13981 for (i = 0; i < req->n_ssids; i++) { 13982 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid)) 13983 goto nla_put_failure; 13984 } 13985 nla_nest_end(msg, nest); 13986 13987 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES); 13988 if (!nest) 13989 goto nla_put_failure; 13990 for (i = 0; i < req->n_channels; i++) { 13991 if (nla_put_u32(msg, i, req->channels[i]->center_freq)) 13992 goto nla_put_failure; 13993 } 13994 nla_nest_end(msg, nest); 13995 13996 if (req->ie && 13997 nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie)) 13998 goto nla_put_failure; 13999 14000 if (req->flags && 14001 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags)) 14002 goto nla_put_failure; 14003 14004 if (req->info.scan_start_tsf && 14005 (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF, 14006 req->info.scan_start_tsf, NL80211_BSS_PAD) || 14007 nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN, 14008 req->info.tsf_bssid))) 14009 goto nla_put_failure; 14010 14011 return 0; 14012 nla_put_failure: 14013 return -ENOBUFS; 14014 } 14015 14016 static int nl80211_prep_scan_msg(struct sk_buff *msg, 14017 struct cfg80211_registered_device *rdev, 14018 struct wireless_dev *wdev, 14019 u32 portid, u32 seq, int flags, 14020 u32 cmd) 14021 { 14022 void *hdr; 14023 14024 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 14025 if (!hdr) 14026 return -1; 14027 14028 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14029 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 14030 wdev->netdev->ifindex)) || 14031 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 14032 NL80211_ATTR_PAD)) 14033 goto nla_put_failure; 14034 14035 /* ignore errors and send incomplete event anyway */ 14036 nl80211_add_scan_req(msg, rdev); 14037 14038 genlmsg_end(msg, hdr); 14039 return 0; 14040 14041 nla_put_failure: 14042 genlmsg_cancel(msg, hdr); 14043 return -EMSGSIZE; 14044 } 14045 14046 static int 14047 nl80211_prep_sched_scan_msg(struct sk_buff *msg, 14048 struct cfg80211_sched_scan_request *req, u32 cmd) 14049 { 14050 void *hdr; 14051 14052 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 14053 if (!hdr) 14054 return -1; 14055 14056 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, 14057 wiphy_to_rdev(req->wiphy)->wiphy_idx) || 14058 nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) || 14059 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid, 14060 NL80211_ATTR_PAD)) 14061 goto nla_put_failure; 14062 14063 genlmsg_end(msg, hdr); 14064 return 0; 14065 14066 nla_put_failure: 14067 genlmsg_cancel(msg, hdr); 14068 return -EMSGSIZE; 14069 } 14070 14071 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev, 14072 struct wireless_dev *wdev) 14073 { 14074 struct sk_buff *msg; 14075 14076 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 14077 if (!msg) 14078 return; 14079 14080 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0, 14081 NL80211_CMD_TRIGGER_SCAN) < 0) { 14082 nlmsg_free(msg); 14083 return; 14084 } 14085 14086 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14087 NL80211_MCGRP_SCAN, GFP_KERNEL); 14088 } 14089 14090 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev, 14091 struct wireless_dev *wdev, bool aborted) 14092 { 14093 struct sk_buff *msg; 14094 14095 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 14096 if (!msg) 14097 return NULL; 14098 14099 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0, 14100 aborted ? NL80211_CMD_SCAN_ABORTED : 14101 NL80211_CMD_NEW_SCAN_RESULTS) < 0) { 14102 nlmsg_free(msg); 14103 return NULL; 14104 } 14105 14106 return msg; 14107 } 14108 14109 /* send message created by nl80211_build_scan_msg() */ 14110 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev, 14111 struct sk_buff *msg) 14112 { 14113 if (!msg) 14114 return; 14115 14116 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14117 NL80211_MCGRP_SCAN, GFP_KERNEL); 14118 } 14119 14120 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd) 14121 { 14122 struct sk_buff *msg; 14123 14124 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 14125 if (!msg) 14126 return; 14127 14128 if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) { 14129 nlmsg_free(msg); 14130 return; 14131 } 14132 14133 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0, 14134 NL80211_MCGRP_SCAN, GFP_KERNEL); 14135 } 14136 14137 static bool nl80211_reg_change_event_fill(struct sk_buff *msg, 14138 struct regulatory_request *request) 14139 { 14140 /* Userspace can always count this one always being set */ 14141 if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator)) 14142 goto nla_put_failure; 14143 14144 if (request->alpha2[0] == '0' && request->alpha2[1] == '0') { 14145 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 14146 NL80211_REGDOM_TYPE_WORLD)) 14147 goto nla_put_failure; 14148 } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') { 14149 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 14150 NL80211_REGDOM_TYPE_CUSTOM_WORLD)) 14151 goto nla_put_failure; 14152 } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') || 14153 request->intersect) { 14154 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 14155 NL80211_REGDOM_TYPE_INTERSECTION)) 14156 goto nla_put_failure; 14157 } else { 14158 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 14159 NL80211_REGDOM_TYPE_COUNTRY) || 14160 nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, 14161 request->alpha2)) 14162 goto nla_put_failure; 14163 } 14164 14165 if (request->wiphy_idx != WIPHY_IDX_INVALID) { 14166 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx); 14167 14168 if (wiphy && 14169 nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx)) 14170 goto nla_put_failure; 14171 14172 if (wiphy && 14173 wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED && 14174 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG)) 14175 goto nla_put_failure; 14176 } 14177 14178 return true; 14179 14180 nla_put_failure: 14181 return false; 14182 } 14183 14184 /* 14185 * This can happen on global regulatory changes or device specific settings 14186 * based on custom regulatory domains. 14187 */ 14188 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id, 14189 struct regulatory_request *request) 14190 { 14191 struct sk_buff *msg; 14192 void *hdr; 14193 14194 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 14195 if (!msg) 14196 return; 14197 14198 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id); 14199 if (!hdr) { 14200 nlmsg_free(msg); 14201 return; 14202 } 14203 14204 if (nl80211_reg_change_event_fill(msg, request) == false) 14205 goto nla_put_failure; 14206 14207 genlmsg_end(msg, hdr); 14208 14209 rcu_read_lock(); 14210 genlmsg_multicast_allns(&nl80211_fam, msg, 0, 14211 NL80211_MCGRP_REGULATORY, GFP_ATOMIC); 14212 rcu_read_unlock(); 14213 14214 return; 14215 14216 nla_put_failure: 14217 nlmsg_free(msg); 14218 } 14219 14220 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev, 14221 struct net_device *netdev, 14222 const u8 *buf, size_t len, 14223 enum nl80211_commands cmd, gfp_t gfp, 14224 int uapsd_queues) 14225 { 14226 struct sk_buff *msg; 14227 void *hdr; 14228 14229 msg = nlmsg_new(100 + len, gfp); 14230 if (!msg) 14231 return; 14232 14233 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 14234 if (!hdr) { 14235 nlmsg_free(msg); 14236 return; 14237 } 14238 14239 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14240 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 14241 nla_put(msg, NL80211_ATTR_FRAME, len, buf)) 14242 goto nla_put_failure; 14243 14244 if (uapsd_queues >= 0) { 14245 struct nlattr *nla_wmm = 14246 nla_nest_start(msg, NL80211_ATTR_STA_WME); 14247 if (!nla_wmm) 14248 goto nla_put_failure; 14249 14250 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES, 14251 uapsd_queues)) 14252 goto nla_put_failure; 14253 14254 nla_nest_end(msg, nla_wmm); 14255 } 14256 14257 genlmsg_end(msg, hdr); 14258 14259 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14260 NL80211_MCGRP_MLME, gfp); 14261 return; 14262 14263 nla_put_failure: 14264 nlmsg_free(msg); 14265 } 14266 14267 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev, 14268 struct net_device *netdev, const u8 *buf, 14269 size_t len, gfp_t gfp) 14270 { 14271 nl80211_send_mlme_event(rdev, netdev, buf, len, 14272 NL80211_CMD_AUTHENTICATE, gfp, -1); 14273 } 14274 14275 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev, 14276 struct net_device *netdev, const u8 *buf, 14277 size_t len, gfp_t gfp, int uapsd_queues) 14278 { 14279 nl80211_send_mlme_event(rdev, netdev, buf, len, 14280 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues); 14281 } 14282 14283 void nl80211_send_deauth(struct cfg80211_registered_device *rdev, 14284 struct net_device *netdev, const u8 *buf, 14285 size_t len, gfp_t gfp) 14286 { 14287 nl80211_send_mlme_event(rdev, netdev, buf, len, 14288 NL80211_CMD_DEAUTHENTICATE, gfp, -1); 14289 } 14290 14291 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev, 14292 struct net_device *netdev, const u8 *buf, 14293 size_t len, gfp_t gfp) 14294 { 14295 nl80211_send_mlme_event(rdev, netdev, buf, len, 14296 NL80211_CMD_DISASSOCIATE, gfp, -1); 14297 } 14298 14299 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf, 14300 size_t len) 14301 { 14302 struct wireless_dev *wdev = dev->ieee80211_ptr; 14303 struct wiphy *wiphy = wdev->wiphy; 14304 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14305 const struct ieee80211_mgmt *mgmt = (void *)buf; 14306 u32 cmd; 14307 14308 if (WARN_ON(len < 2)) 14309 return; 14310 14311 if (ieee80211_is_deauth(mgmt->frame_control)) 14312 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE; 14313 else 14314 cmd = NL80211_CMD_UNPROT_DISASSOCIATE; 14315 14316 trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len); 14317 nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1); 14318 } 14319 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt); 14320 14321 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev, 14322 struct net_device *netdev, int cmd, 14323 const u8 *addr, gfp_t gfp) 14324 { 14325 struct sk_buff *msg; 14326 void *hdr; 14327 14328 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14329 if (!msg) 14330 return; 14331 14332 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 14333 if (!hdr) { 14334 nlmsg_free(msg); 14335 return; 14336 } 14337 14338 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14339 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 14340 nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) || 14341 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) 14342 goto nla_put_failure; 14343 14344 genlmsg_end(msg, hdr); 14345 14346 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14347 NL80211_MCGRP_MLME, gfp); 14348 return; 14349 14350 nla_put_failure: 14351 nlmsg_free(msg); 14352 } 14353 14354 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev, 14355 struct net_device *netdev, const u8 *addr, 14356 gfp_t gfp) 14357 { 14358 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE, 14359 addr, gfp); 14360 } 14361 14362 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev, 14363 struct net_device *netdev, const u8 *addr, 14364 gfp_t gfp) 14365 { 14366 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE, 14367 addr, gfp); 14368 } 14369 14370 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev, 14371 struct net_device *netdev, 14372 struct cfg80211_connect_resp_params *cr, 14373 gfp_t gfp) 14374 { 14375 struct sk_buff *msg; 14376 void *hdr; 14377 14378 msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len + 14379 cr->fils.kek_len + cr->fils.pmk_len + 14380 (cr->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp); 14381 if (!msg) 14382 return; 14383 14384 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT); 14385 if (!hdr) { 14386 nlmsg_free(msg); 14387 return; 14388 } 14389 14390 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14391 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 14392 (cr->bssid && 14393 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cr->bssid)) || 14394 nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, 14395 cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE : 14396 cr->status) || 14397 (cr->status < 0 && 14398 (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) || 14399 nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON, 14400 cr->timeout_reason))) || 14401 (cr->req_ie && 14402 nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) || 14403 (cr->resp_ie && 14404 nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len, 14405 cr->resp_ie)) || 14406 (cr->fils.update_erp_next_seq_num && 14407 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM, 14408 cr->fils.erp_next_seq_num)) || 14409 (cr->status == WLAN_STATUS_SUCCESS && 14410 ((cr->fils.kek && 14411 nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len, 14412 cr->fils.kek)) || 14413 (cr->fils.pmk && 14414 nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) || 14415 (cr->fils.pmkid && 14416 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid))))) 14417 goto nla_put_failure; 14418 14419 genlmsg_end(msg, hdr); 14420 14421 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14422 NL80211_MCGRP_MLME, gfp); 14423 return; 14424 14425 nla_put_failure: 14426 nlmsg_free(msg); 14427 } 14428 14429 void nl80211_send_roamed(struct cfg80211_registered_device *rdev, 14430 struct net_device *netdev, 14431 struct cfg80211_roam_info *info, gfp_t gfp) 14432 { 14433 struct sk_buff *msg; 14434 void *hdr; 14435 const u8 *bssid = info->bss ? info->bss->bssid : info->bssid; 14436 14437 msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len + 14438 info->fils.kek_len + info->fils.pmk_len + 14439 (info->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp); 14440 if (!msg) 14441 return; 14442 14443 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM); 14444 if (!hdr) { 14445 nlmsg_free(msg); 14446 return; 14447 } 14448 14449 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14450 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 14451 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) || 14452 (info->req_ie && 14453 nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len, 14454 info->req_ie)) || 14455 (info->resp_ie && 14456 nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len, 14457 info->resp_ie)) || 14458 (info->fils.update_erp_next_seq_num && 14459 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM, 14460 info->fils.erp_next_seq_num)) || 14461 (info->fils.kek && 14462 nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len, 14463 info->fils.kek)) || 14464 (info->fils.pmk && 14465 nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) || 14466 (info->fils.pmkid && 14467 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid))) 14468 goto nla_put_failure; 14469 14470 genlmsg_end(msg, hdr); 14471 14472 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14473 NL80211_MCGRP_MLME, gfp); 14474 return; 14475 14476 nla_put_failure: 14477 nlmsg_free(msg); 14478 } 14479 14480 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev, 14481 struct net_device *netdev, const u8 *bssid) 14482 { 14483 struct sk_buff *msg; 14484 void *hdr; 14485 14486 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 14487 if (!msg) 14488 return; 14489 14490 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED); 14491 if (!hdr) { 14492 nlmsg_free(msg); 14493 return; 14494 } 14495 14496 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) 14497 goto nla_put_failure; 14498 14499 genlmsg_end(msg, hdr); 14500 14501 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14502 NL80211_MCGRP_MLME, GFP_KERNEL); 14503 return; 14504 14505 nla_put_failure: 14506 nlmsg_free(msg); 14507 } 14508 14509 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev, 14510 struct net_device *netdev, u16 reason, 14511 const u8 *ie, size_t ie_len, bool from_ap) 14512 { 14513 struct sk_buff *msg; 14514 void *hdr; 14515 14516 msg = nlmsg_new(100 + ie_len, GFP_KERNEL); 14517 if (!msg) 14518 return; 14519 14520 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT); 14521 if (!hdr) { 14522 nlmsg_free(msg); 14523 return; 14524 } 14525 14526 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14527 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 14528 (reason && 14529 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) || 14530 (from_ap && 14531 nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) || 14532 (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie))) 14533 goto nla_put_failure; 14534 14535 genlmsg_end(msg, hdr); 14536 14537 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14538 NL80211_MCGRP_MLME, GFP_KERNEL); 14539 return; 14540 14541 nla_put_failure: 14542 nlmsg_free(msg); 14543 } 14544 14545 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev, 14546 struct net_device *netdev, const u8 *bssid, 14547 gfp_t gfp) 14548 { 14549 struct sk_buff *msg; 14550 void *hdr; 14551 14552 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14553 if (!msg) 14554 return; 14555 14556 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS); 14557 if (!hdr) { 14558 nlmsg_free(msg); 14559 return; 14560 } 14561 14562 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14563 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 14564 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) 14565 goto nla_put_failure; 14566 14567 genlmsg_end(msg, hdr); 14568 14569 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14570 NL80211_MCGRP_MLME, gfp); 14571 return; 14572 14573 nla_put_failure: 14574 nlmsg_free(msg); 14575 } 14576 14577 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr, 14578 const u8* ie, u8 ie_len, gfp_t gfp) 14579 { 14580 struct wireless_dev *wdev = dev->ieee80211_ptr; 14581 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 14582 struct sk_buff *msg; 14583 void *hdr; 14584 14585 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT)) 14586 return; 14587 14588 trace_cfg80211_notify_new_peer_candidate(dev, addr); 14589 14590 msg = nlmsg_new(100 + ie_len, gfp); 14591 if (!msg) 14592 return; 14593 14594 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE); 14595 if (!hdr) { 14596 nlmsg_free(msg); 14597 return; 14598 } 14599 14600 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14601 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 14602 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) || 14603 (ie_len && ie && 14604 nla_put(msg, NL80211_ATTR_IE, ie_len , ie))) 14605 goto nla_put_failure; 14606 14607 genlmsg_end(msg, hdr); 14608 14609 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14610 NL80211_MCGRP_MLME, gfp); 14611 return; 14612 14613 nla_put_failure: 14614 nlmsg_free(msg); 14615 } 14616 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate); 14617 14618 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev, 14619 struct net_device *netdev, const u8 *addr, 14620 enum nl80211_key_type key_type, int key_id, 14621 const u8 *tsc, gfp_t gfp) 14622 { 14623 struct sk_buff *msg; 14624 void *hdr; 14625 14626 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14627 if (!msg) 14628 return; 14629 14630 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE); 14631 if (!hdr) { 14632 nlmsg_free(msg); 14633 return; 14634 } 14635 14636 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14637 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 14638 (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) || 14639 nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) || 14640 (key_id != -1 && 14641 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) || 14642 (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc))) 14643 goto nla_put_failure; 14644 14645 genlmsg_end(msg, hdr); 14646 14647 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14648 NL80211_MCGRP_MLME, gfp); 14649 return; 14650 14651 nla_put_failure: 14652 nlmsg_free(msg); 14653 } 14654 14655 void nl80211_send_beacon_hint_event(struct wiphy *wiphy, 14656 struct ieee80211_channel *channel_before, 14657 struct ieee80211_channel *channel_after) 14658 { 14659 struct sk_buff *msg; 14660 void *hdr; 14661 struct nlattr *nl_freq; 14662 14663 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); 14664 if (!msg) 14665 return; 14666 14667 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT); 14668 if (!hdr) { 14669 nlmsg_free(msg); 14670 return; 14671 } 14672 14673 /* 14674 * Since we are applying the beacon hint to a wiphy we know its 14675 * wiphy_idx is valid 14676 */ 14677 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy))) 14678 goto nla_put_failure; 14679 14680 /* Before */ 14681 nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE); 14682 if (!nl_freq) 14683 goto nla_put_failure; 14684 14685 if (nl80211_msg_put_channel(msg, wiphy, channel_before, false)) 14686 goto nla_put_failure; 14687 nla_nest_end(msg, nl_freq); 14688 14689 /* After */ 14690 nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER); 14691 if (!nl_freq) 14692 goto nla_put_failure; 14693 14694 if (nl80211_msg_put_channel(msg, wiphy, channel_after, false)) 14695 goto nla_put_failure; 14696 nla_nest_end(msg, nl_freq); 14697 14698 genlmsg_end(msg, hdr); 14699 14700 rcu_read_lock(); 14701 genlmsg_multicast_allns(&nl80211_fam, msg, 0, 14702 NL80211_MCGRP_REGULATORY, GFP_ATOMIC); 14703 rcu_read_unlock(); 14704 14705 return; 14706 14707 nla_put_failure: 14708 nlmsg_free(msg); 14709 } 14710 14711 static void nl80211_send_remain_on_chan_event( 14712 int cmd, struct cfg80211_registered_device *rdev, 14713 struct wireless_dev *wdev, u64 cookie, 14714 struct ieee80211_channel *chan, 14715 unsigned int duration, gfp_t gfp) 14716 { 14717 struct sk_buff *msg; 14718 void *hdr; 14719 14720 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14721 if (!msg) 14722 return; 14723 14724 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 14725 if (!hdr) { 14726 nlmsg_free(msg); 14727 return; 14728 } 14729 14730 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14731 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 14732 wdev->netdev->ifindex)) || 14733 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 14734 NL80211_ATTR_PAD) || 14735 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) || 14736 nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, 14737 NL80211_CHAN_NO_HT) || 14738 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 14739 NL80211_ATTR_PAD)) 14740 goto nla_put_failure; 14741 14742 if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL && 14743 nla_put_u32(msg, NL80211_ATTR_DURATION, duration)) 14744 goto nla_put_failure; 14745 14746 genlmsg_end(msg, hdr); 14747 14748 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14749 NL80211_MCGRP_MLME, gfp); 14750 return; 14751 14752 nla_put_failure: 14753 nlmsg_free(msg); 14754 } 14755 14756 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie, 14757 struct ieee80211_channel *chan, 14758 unsigned int duration, gfp_t gfp) 14759 { 14760 struct wiphy *wiphy = wdev->wiphy; 14761 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14762 14763 trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration); 14764 nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL, 14765 rdev, wdev, cookie, chan, 14766 duration, gfp); 14767 } 14768 EXPORT_SYMBOL(cfg80211_ready_on_channel); 14769 14770 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie, 14771 struct ieee80211_channel *chan, 14772 gfp_t gfp) 14773 { 14774 struct wiphy *wiphy = wdev->wiphy; 14775 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14776 14777 trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan); 14778 nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL, 14779 rdev, wdev, cookie, chan, 0, gfp); 14780 } 14781 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired); 14782 14783 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr, 14784 struct station_info *sinfo, gfp_t gfp) 14785 { 14786 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy; 14787 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14788 struct sk_buff *msg; 14789 14790 trace_cfg80211_new_sta(dev, mac_addr, sinfo); 14791 14792 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14793 if (!msg) 14794 return; 14795 14796 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0, 14797 rdev, dev, mac_addr, sinfo) < 0) { 14798 nlmsg_free(msg); 14799 return; 14800 } 14801 14802 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14803 NL80211_MCGRP_MLME, gfp); 14804 } 14805 EXPORT_SYMBOL(cfg80211_new_sta); 14806 14807 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr, 14808 struct station_info *sinfo, gfp_t gfp) 14809 { 14810 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy; 14811 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14812 struct sk_buff *msg; 14813 struct station_info empty_sinfo = {}; 14814 14815 if (!sinfo) 14816 sinfo = &empty_sinfo; 14817 14818 trace_cfg80211_del_sta(dev, mac_addr); 14819 14820 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14821 if (!msg) { 14822 cfg80211_sinfo_release_content(sinfo); 14823 return; 14824 } 14825 14826 if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0, 14827 rdev, dev, mac_addr, sinfo) < 0) { 14828 nlmsg_free(msg); 14829 return; 14830 } 14831 14832 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14833 NL80211_MCGRP_MLME, gfp); 14834 } 14835 EXPORT_SYMBOL(cfg80211_del_sta_sinfo); 14836 14837 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr, 14838 enum nl80211_connect_failed_reason reason, 14839 gfp_t gfp) 14840 { 14841 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy; 14842 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14843 struct sk_buff *msg; 14844 void *hdr; 14845 14846 msg = nlmsg_new(NLMSG_GOODSIZE, gfp); 14847 if (!msg) 14848 return; 14849 14850 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED); 14851 if (!hdr) { 14852 nlmsg_free(msg); 14853 return; 14854 } 14855 14856 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 14857 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) || 14858 nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason)) 14859 goto nla_put_failure; 14860 14861 genlmsg_end(msg, hdr); 14862 14863 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14864 NL80211_MCGRP_MLME, gfp); 14865 return; 14866 14867 nla_put_failure: 14868 nlmsg_free(msg); 14869 } 14870 EXPORT_SYMBOL(cfg80211_conn_failed); 14871 14872 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd, 14873 const u8 *addr, gfp_t gfp) 14874 { 14875 struct wireless_dev *wdev = dev->ieee80211_ptr; 14876 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 14877 struct sk_buff *msg; 14878 void *hdr; 14879 u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid); 14880 14881 if (!nlportid) 14882 return false; 14883 14884 msg = nlmsg_new(100, gfp); 14885 if (!msg) 14886 return true; 14887 14888 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 14889 if (!hdr) { 14890 nlmsg_free(msg); 14891 return true; 14892 } 14893 14894 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14895 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 14896 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) 14897 goto nla_put_failure; 14898 14899 genlmsg_end(msg, hdr); 14900 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 14901 return true; 14902 14903 nla_put_failure: 14904 nlmsg_free(msg); 14905 return true; 14906 } 14907 14908 bool cfg80211_rx_spurious_frame(struct net_device *dev, 14909 const u8 *addr, gfp_t gfp) 14910 { 14911 struct wireless_dev *wdev = dev->ieee80211_ptr; 14912 bool ret; 14913 14914 trace_cfg80211_rx_spurious_frame(dev, addr); 14915 14916 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP && 14917 wdev->iftype != NL80211_IFTYPE_P2P_GO)) { 14918 trace_cfg80211_return_bool(false); 14919 return false; 14920 } 14921 ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME, 14922 addr, gfp); 14923 trace_cfg80211_return_bool(ret); 14924 return ret; 14925 } 14926 EXPORT_SYMBOL(cfg80211_rx_spurious_frame); 14927 14928 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev, 14929 const u8 *addr, gfp_t gfp) 14930 { 14931 struct wireless_dev *wdev = dev->ieee80211_ptr; 14932 bool ret; 14933 14934 trace_cfg80211_rx_unexpected_4addr_frame(dev, addr); 14935 14936 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP && 14937 wdev->iftype != NL80211_IFTYPE_P2P_GO && 14938 wdev->iftype != NL80211_IFTYPE_AP_VLAN)) { 14939 trace_cfg80211_return_bool(false); 14940 return false; 14941 } 14942 ret = __nl80211_unexpected_frame(dev, 14943 NL80211_CMD_UNEXPECTED_4ADDR_FRAME, 14944 addr, gfp); 14945 trace_cfg80211_return_bool(ret); 14946 return ret; 14947 } 14948 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame); 14949 14950 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev, 14951 struct wireless_dev *wdev, u32 nlportid, 14952 int freq, int sig_dbm, 14953 const u8 *buf, size_t len, u32 flags, gfp_t gfp) 14954 { 14955 struct net_device *netdev = wdev->netdev; 14956 struct sk_buff *msg; 14957 void *hdr; 14958 14959 msg = nlmsg_new(100 + len, gfp); 14960 if (!msg) 14961 return -ENOMEM; 14962 14963 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME); 14964 if (!hdr) { 14965 nlmsg_free(msg); 14966 return -ENOMEM; 14967 } 14968 14969 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14970 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 14971 netdev->ifindex)) || 14972 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 14973 NL80211_ATTR_PAD) || 14974 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) || 14975 (sig_dbm && 14976 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) || 14977 nla_put(msg, NL80211_ATTR_FRAME, len, buf) || 14978 (flags && 14979 nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags))) 14980 goto nla_put_failure; 14981 14982 genlmsg_end(msg, hdr); 14983 14984 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 14985 14986 nla_put_failure: 14987 nlmsg_free(msg); 14988 return -ENOBUFS; 14989 } 14990 14991 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie, 14992 const u8 *buf, size_t len, bool ack, gfp_t gfp) 14993 { 14994 struct wiphy *wiphy = wdev->wiphy; 14995 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14996 struct net_device *netdev = wdev->netdev; 14997 struct sk_buff *msg; 14998 void *hdr; 14999 15000 trace_cfg80211_mgmt_tx_status(wdev, cookie, ack); 15001 15002 msg = nlmsg_new(100 + len, gfp); 15003 if (!msg) 15004 return; 15005 15006 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS); 15007 if (!hdr) { 15008 nlmsg_free(msg); 15009 return; 15010 } 15011 15012 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15013 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 15014 netdev->ifindex)) || 15015 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 15016 NL80211_ATTR_PAD) || 15017 nla_put(msg, NL80211_ATTR_FRAME, len, buf) || 15018 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 15019 NL80211_ATTR_PAD) || 15020 (ack && nla_put_flag(msg, NL80211_ATTR_ACK))) 15021 goto nla_put_failure; 15022 15023 genlmsg_end(msg, hdr); 15024 15025 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15026 NL80211_MCGRP_MLME, gfp); 15027 return; 15028 15029 nla_put_failure: 15030 nlmsg_free(msg); 15031 } 15032 EXPORT_SYMBOL(cfg80211_mgmt_tx_status); 15033 15034 static int __nl80211_rx_control_port(struct net_device *dev, 15035 struct sk_buff *skb, 15036 bool unencrypted, gfp_t gfp) 15037 { 15038 struct wireless_dev *wdev = dev->ieee80211_ptr; 15039 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 15040 struct ethhdr *ehdr = eth_hdr(skb); 15041 const u8 *addr = ehdr->h_source; 15042 u16 proto = be16_to_cpu(skb->protocol); 15043 struct sk_buff *msg; 15044 void *hdr; 15045 struct nlattr *frame; 15046 15047 u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid); 15048 15049 if (!nlportid) 15050 return -ENOENT; 15051 15052 msg = nlmsg_new(100 + skb->len, gfp); 15053 if (!msg) 15054 return -ENOMEM; 15055 15056 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME); 15057 if (!hdr) { 15058 nlmsg_free(msg); 15059 return -ENOBUFS; 15060 } 15061 15062 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15063 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 15064 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 15065 NL80211_ATTR_PAD) || 15066 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) || 15067 nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) || 15068 (unencrypted && nla_put_flag(msg, 15069 NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT))) 15070 goto nla_put_failure; 15071 15072 frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len); 15073 if (!frame) 15074 goto nla_put_failure; 15075 15076 skb_copy_bits(skb, 0, nla_data(frame), skb->len); 15077 genlmsg_end(msg, hdr); 15078 15079 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 15080 15081 nla_put_failure: 15082 nlmsg_free(msg); 15083 return -ENOBUFS; 15084 } 15085 15086 bool cfg80211_rx_control_port(struct net_device *dev, 15087 struct sk_buff *skb, bool unencrypted) 15088 { 15089 int ret; 15090 15091 trace_cfg80211_rx_control_port(dev, skb, unencrypted); 15092 ret = __nl80211_rx_control_port(dev, skb, unencrypted, GFP_ATOMIC); 15093 trace_cfg80211_return_bool(ret == 0); 15094 return ret == 0; 15095 } 15096 EXPORT_SYMBOL(cfg80211_rx_control_port); 15097 15098 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev, 15099 const char *mac, gfp_t gfp) 15100 { 15101 struct wireless_dev *wdev = dev->ieee80211_ptr; 15102 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 15103 struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 15104 void **cb; 15105 15106 if (!msg) 15107 return NULL; 15108 15109 cb = (void **)msg->cb; 15110 15111 cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM); 15112 if (!cb[0]) { 15113 nlmsg_free(msg); 15114 return NULL; 15115 } 15116 15117 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15118 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 15119 goto nla_put_failure; 15120 15121 if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac)) 15122 goto nla_put_failure; 15123 15124 cb[1] = nla_nest_start(msg, NL80211_ATTR_CQM); 15125 if (!cb[1]) 15126 goto nla_put_failure; 15127 15128 cb[2] = rdev; 15129 15130 return msg; 15131 nla_put_failure: 15132 nlmsg_free(msg); 15133 return NULL; 15134 } 15135 15136 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp) 15137 { 15138 void **cb = (void **)msg->cb; 15139 struct cfg80211_registered_device *rdev = cb[2]; 15140 15141 nla_nest_end(msg, cb[1]); 15142 genlmsg_end(msg, cb[0]); 15143 15144 memset(msg->cb, 0, sizeof(msg->cb)); 15145 15146 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15147 NL80211_MCGRP_MLME, gfp); 15148 } 15149 15150 void cfg80211_cqm_rssi_notify(struct net_device *dev, 15151 enum nl80211_cqm_rssi_threshold_event rssi_event, 15152 s32 rssi_level, gfp_t gfp) 15153 { 15154 struct sk_buff *msg; 15155 struct wireless_dev *wdev = dev->ieee80211_ptr; 15156 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 15157 15158 trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level); 15159 15160 if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW && 15161 rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH)) 15162 return; 15163 15164 if (wdev->cqm_config) { 15165 wdev->cqm_config->last_rssi_event_value = rssi_level; 15166 15167 cfg80211_cqm_rssi_update(rdev, dev); 15168 15169 if (rssi_level == 0) 15170 rssi_level = wdev->cqm_config->last_rssi_event_value; 15171 } 15172 15173 msg = cfg80211_prepare_cqm(dev, NULL, gfp); 15174 if (!msg) 15175 return; 15176 15177 if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT, 15178 rssi_event)) 15179 goto nla_put_failure; 15180 15181 if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL, 15182 rssi_level)) 15183 goto nla_put_failure; 15184 15185 cfg80211_send_cqm(msg, gfp); 15186 15187 return; 15188 15189 nla_put_failure: 15190 nlmsg_free(msg); 15191 } 15192 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify); 15193 15194 void cfg80211_cqm_txe_notify(struct net_device *dev, 15195 const u8 *peer, u32 num_packets, 15196 u32 rate, u32 intvl, gfp_t gfp) 15197 { 15198 struct sk_buff *msg; 15199 15200 msg = cfg80211_prepare_cqm(dev, peer, gfp); 15201 if (!msg) 15202 return; 15203 15204 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets)) 15205 goto nla_put_failure; 15206 15207 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate)) 15208 goto nla_put_failure; 15209 15210 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl)) 15211 goto nla_put_failure; 15212 15213 cfg80211_send_cqm(msg, gfp); 15214 return; 15215 15216 nla_put_failure: 15217 nlmsg_free(msg); 15218 } 15219 EXPORT_SYMBOL(cfg80211_cqm_txe_notify); 15220 15221 void cfg80211_cqm_pktloss_notify(struct net_device *dev, 15222 const u8 *peer, u32 num_packets, gfp_t gfp) 15223 { 15224 struct sk_buff *msg; 15225 15226 trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets); 15227 15228 msg = cfg80211_prepare_cqm(dev, peer, gfp); 15229 if (!msg) 15230 return; 15231 15232 if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets)) 15233 goto nla_put_failure; 15234 15235 cfg80211_send_cqm(msg, gfp); 15236 return; 15237 15238 nla_put_failure: 15239 nlmsg_free(msg); 15240 } 15241 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify); 15242 15243 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp) 15244 { 15245 struct sk_buff *msg; 15246 15247 msg = cfg80211_prepare_cqm(dev, NULL, gfp); 15248 if (!msg) 15249 return; 15250 15251 if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT)) 15252 goto nla_put_failure; 15253 15254 cfg80211_send_cqm(msg, gfp); 15255 return; 15256 15257 nla_put_failure: 15258 nlmsg_free(msg); 15259 } 15260 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify); 15261 15262 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev, 15263 struct net_device *netdev, const u8 *bssid, 15264 const u8 *replay_ctr, gfp_t gfp) 15265 { 15266 struct sk_buff *msg; 15267 struct nlattr *rekey_attr; 15268 void *hdr; 15269 15270 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 15271 if (!msg) 15272 return; 15273 15274 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD); 15275 if (!hdr) { 15276 nlmsg_free(msg); 15277 return; 15278 } 15279 15280 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15281 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 15282 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) 15283 goto nla_put_failure; 15284 15285 rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA); 15286 if (!rekey_attr) 15287 goto nla_put_failure; 15288 15289 if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR, 15290 NL80211_REPLAY_CTR_LEN, replay_ctr)) 15291 goto nla_put_failure; 15292 15293 nla_nest_end(msg, rekey_attr); 15294 15295 genlmsg_end(msg, hdr); 15296 15297 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15298 NL80211_MCGRP_MLME, gfp); 15299 return; 15300 15301 nla_put_failure: 15302 nlmsg_free(msg); 15303 } 15304 15305 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid, 15306 const u8 *replay_ctr, gfp_t gfp) 15307 { 15308 struct wireless_dev *wdev = dev->ieee80211_ptr; 15309 struct wiphy *wiphy = wdev->wiphy; 15310 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 15311 15312 trace_cfg80211_gtk_rekey_notify(dev, bssid); 15313 nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp); 15314 } 15315 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify); 15316 15317 static void 15318 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev, 15319 struct net_device *netdev, int index, 15320 const u8 *bssid, bool preauth, gfp_t gfp) 15321 { 15322 struct sk_buff *msg; 15323 struct nlattr *attr; 15324 void *hdr; 15325 15326 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 15327 if (!msg) 15328 return; 15329 15330 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE); 15331 if (!hdr) { 15332 nlmsg_free(msg); 15333 return; 15334 } 15335 15336 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15337 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex)) 15338 goto nla_put_failure; 15339 15340 attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE); 15341 if (!attr) 15342 goto nla_put_failure; 15343 15344 if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) || 15345 nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) || 15346 (preauth && 15347 nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH))) 15348 goto nla_put_failure; 15349 15350 nla_nest_end(msg, attr); 15351 15352 genlmsg_end(msg, hdr); 15353 15354 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15355 NL80211_MCGRP_MLME, gfp); 15356 return; 15357 15358 nla_put_failure: 15359 nlmsg_free(msg); 15360 } 15361 15362 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index, 15363 const u8 *bssid, bool preauth, gfp_t gfp) 15364 { 15365 struct wireless_dev *wdev = dev->ieee80211_ptr; 15366 struct wiphy *wiphy = wdev->wiphy; 15367 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 15368 15369 trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth); 15370 nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp); 15371 } 15372 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify); 15373 15374 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev, 15375 struct net_device *netdev, 15376 struct cfg80211_chan_def *chandef, 15377 gfp_t gfp, 15378 enum nl80211_commands notif, 15379 u8 count) 15380 { 15381 struct sk_buff *msg; 15382 void *hdr; 15383 15384 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 15385 if (!msg) 15386 return; 15387 15388 hdr = nl80211hdr_put(msg, 0, 0, 0, notif); 15389 if (!hdr) { 15390 nlmsg_free(msg); 15391 return; 15392 } 15393 15394 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex)) 15395 goto nla_put_failure; 15396 15397 if (nl80211_send_chandef(msg, chandef)) 15398 goto nla_put_failure; 15399 15400 if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) && 15401 (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count))) 15402 goto nla_put_failure; 15403 15404 genlmsg_end(msg, hdr); 15405 15406 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15407 NL80211_MCGRP_MLME, gfp); 15408 return; 15409 15410 nla_put_failure: 15411 nlmsg_free(msg); 15412 } 15413 15414 void cfg80211_ch_switch_notify(struct net_device *dev, 15415 struct cfg80211_chan_def *chandef) 15416 { 15417 struct wireless_dev *wdev = dev->ieee80211_ptr; 15418 struct wiphy *wiphy = wdev->wiphy; 15419 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 15420 15421 ASSERT_WDEV_LOCK(wdev); 15422 15423 trace_cfg80211_ch_switch_notify(dev, chandef); 15424 15425 wdev->chandef = *chandef; 15426 wdev->preset_chandef = *chandef; 15427 nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL, 15428 NL80211_CMD_CH_SWITCH_NOTIFY, 0); 15429 } 15430 EXPORT_SYMBOL(cfg80211_ch_switch_notify); 15431 15432 void cfg80211_ch_switch_started_notify(struct net_device *dev, 15433 struct cfg80211_chan_def *chandef, 15434 u8 count) 15435 { 15436 struct wireless_dev *wdev = dev->ieee80211_ptr; 15437 struct wiphy *wiphy = wdev->wiphy; 15438 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 15439 15440 trace_cfg80211_ch_switch_started_notify(dev, chandef); 15441 15442 nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL, 15443 NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count); 15444 } 15445 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify); 15446 15447 void 15448 nl80211_radar_notify(struct cfg80211_registered_device *rdev, 15449 const struct cfg80211_chan_def *chandef, 15450 enum nl80211_radar_event event, 15451 struct net_device *netdev, gfp_t gfp) 15452 { 15453 struct sk_buff *msg; 15454 void *hdr; 15455 15456 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 15457 if (!msg) 15458 return; 15459 15460 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT); 15461 if (!hdr) { 15462 nlmsg_free(msg); 15463 return; 15464 } 15465 15466 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx)) 15467 goto nla_put_failure; 15468 15469 /* NOP and radar events don't need a netdev parameter */ 15470 if (netdev) { 15471 struct wireless_dev *wdev = netdev->ieee80211_ptr; 15472 15473 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 15474 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 15475 NL80211_ATTR_PAD)) 15476 goto nla_put_failure; 15477 } 15478 15479 if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event)) 15480 goto nla_put_failure; 15481 15482 if (nl80211_send_chandef(msg, chandef)) 15483 goto nla_put_failure; 15484 15485 genlmsg_end(msg, hdr); 15486 15487 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15488 NL80211_MCGRP_MLME, gfp); 15489 return; 15490 15491 nla_put_failure: 15492 nlmsg_free(msg); 15493 } 15494 15495 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac, 15496 struct sta_opmode_info *sta_opmode, 15497 gfp_t gfp) 15498 { 15499 struct sk_buff *msg; 15500 struct wireless_dev *wdev = dev->ieee80211_ptr; 15501 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 15502 void *hdr; 15503 15504 if (WARN_ON(!mac)) 15505 return; 15506 15507 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 15508 if (!msg) 15509 return; 15510 15511 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED); 15512 if (!hdr) { 15513 nlmsg_free(msg); 15514 return; 15515 } 15516 15517 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx)) 15518 goto nla_put_failure; 15519 15520 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 15521 goto nla_put_failure; 15522 15523 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac)) 15524 goto nla_put_failure; 15525 15526 if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) && 15527 nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode)) 15528 goto nla_put_failure; 15529 15530 if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) && 15531 nla_put_u8(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw)) 15532 goto nla_put_failure; 15533 15534 if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) && 15535 nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss)) 15536 goto nla_put_failure; 15537 15538 genlmsg_end(msg, hdr); 15539 15540 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15541 NL80211_MCGRP_MLME, gfp); 15542 15543 return; 15544 15545 nla_put_failure: 15546 nlmsg_free(msg); 15547 } 15548 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify); 15549 15550 void cfg80211_probe_status(struct net_device *dev, const u8 *addr, 15551 u64 cookie, bool acked, s32 ack_signal, 15552 bool is_valid_ack_signal, gfp_t gfp) 15553 { 15554 struct wireless_dev *wdev = dev->ieee80211_ptr; 15555 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 15556 struct sk_buff *msg; 15557 void *hdr; 15558 15559 trace_cfg80211_probe_status(dev, addr, cookie, acked); 15560 15561 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 15562 15563 if (!msg) 15564 return; 15565 15566 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT); 15567 if (!hdr) { 15568 nlmsg_free(msg); 15569 return; 15570 } 15571 15572 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15573 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 15574 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) || 15575 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 15576 NL80211_ATTR_PAD) || 15577 (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) || 15578 (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL, 15579 ack_signal))) 15580 goto nla_put_failure; 15581 15582 genlmsg_end(msg, hdr); 15583 15584 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15585 NL80211_MCGRP_MLME, gfp); 15586 return; 15587 15588 nla_put_failure: 15589 nlmsg_free(msg); 15590 } 15591 EXPORT_SYMBOL(cfg80211_probe_status); 15592 15593 void cfg80211_report_obss_beacon(struct wiphy *wiphy, 15594 const u8 *frame, size_t len, 15595 int freq, int sig_dbm) 15596 { 15597 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 15598 struct sk_buff *msg; 15599 void *hdr; 15600 struct cfg80211_beacon_registration *reg; 15601 15602 trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm); 15603 15604 spin_lock_bh(&rdev->beacon_registrations_lock); 15605 list_for_each_entry(reg, &rdev->beacon_registrations, list) { 15606 msg = nlmsg_new(len + 100, GFP_ATOMIC); 15607 if (!msg) { 15608 spin_unlock_bh(&rdev->beacon_registrations_lock); 15609 return; 15610 } 15611 15612 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME); 15613 if (!hdr) 15614 goto nla_put_failure; 15615 15616 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15617 (freq && 15618 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) || 15619 (sig_dbm && 15620 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) || 15621 nla_put(msg, NL80211_ATTR_FRAME, len, frame)) 15622 goto nla_put_failure; 15623 15624 genlmsg_end(msg, hdr); 15625 15626 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid); 15627 } 15628 spin_unlock_bh(&rdev->beacon_registrations_lock); 15629 return; 15630 15631 nla_put_failure: 15632 spin_unlock_bh(&rdev->beacon_registrations_lock); 15633 nlmsg_free(msg); 15634 } 15635 EXPORT_SYMBOL(cfg80211_report_obss_beacon); 15636 15637 #ifdef CONFIG_PM 15638 static int cfg80211_net_detect_results(struct sk_buff *msg, 15639 struct cfg80211_wowlan_wakeup *wakeup) 15640 { 15641 struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect; 15642 struct nlattr *nl_results, *nl_match, *nl_freqs; 15643 int i, j; 15644 15645 nl_results = nla_nest_start( 15646 msg, NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS); 15647 if (!nl_results) 15648 return -EMSGSIZE; 15649 15650 for (i = 0; i < nd->n_matches; i++) { 15651 struct cfg80211_wowlan_nd_match *match = nd->matches[i]; 15652 15653 nl_match = nla_nest_start(msg, i); 15654 if (!nl_match) 15655 break; 15656 15657 /* The SSID attribute is optional in nl80211, but for 15658 * simplicity reasons it's always present in the 15659 * cfg80211 structure. If a driver can't pass the 15660 * SSID, that needs to be changed. A zero length SSID 15661 * is still a valid SSID (wildcard), so it cannot be 15662 * used for this purpose. 15663 */ 15664 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len, 15665 match->ssid.ssid)) { 15666 nla_nest_cancel(msg, nl_match); 15667 goto out; 15668 } 15669 15670 if (match->n_channels) { 15671 nl_freqs = nla_nest_start( 15672 msg, NL80211_ATTR_SCAN_FREQUENCIES); 15673 if (!nl_freqs) { 15674 nla_nest_cancel(msg, nl_match); 15675 goto out; 15676 } 15677 15678 for (j = 0; j < match->n_channels; j++) { 15679 if (nla_put_u32(msg, j, match->channels[j])) { 15680 nla_nest_cancel(msg, nl_freqs); 15681 nla_nest_cancel(msg, nl_match); 15682 goto out; 15683 } 15684 } 15685 15686 nla_nest_end(msg, nl_freqs); 15687 } 15688 15689 nla_nest_end(msg, nl_match); 15690 } 15691 15692 out: 15693 nla_nest_end(msg, nl_results); 15694 return 0; 15695 } 15696 15697 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev, 15698 struct cfg80211_wowlan_wakeup *wakeup, 15699 gfp_t gfp) 15700 { 15701 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 15702 struct sk_buff *msg; 15703 void *hdr; 15704 int size = 200; 15705 15706 trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup); 15707 15708 if (wakeup) 15709 size += wakeup->packet_present_len; 15710 15711 msg = nlmsg_new(size, gfp); 15712 if (!msg) 15713 return; 15714 15715 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN); 15716 if (!hdr) 15717 goto free_msg; 15718 15719 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15720 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 15721 NL80211_ATTR_PAD)) 15722 goto free_msg; 15723 15724 if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 15725 wdev->netdev->ifindex)) 15726 goto free_msg; 15727 15728 if (wakeup) { 15729 struct nlattr *reasons; 15730 15731 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS); 15732 if (!reasons) 15733 goto free_msg; 15734 15735 if (wakeup->disconnect && 15736 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) 15737 goto free_msg; 15738 if (wakeup->magic_pkt && 15739 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) 15740 goto free_msg; 15741 if (wakeup->gtk_rekey_failure && 15742 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) 15743 goto free_msg; 15744 if (wakeup->eap_identity_req && 15745 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) 15746 goto free_msg; 15747 if (wakeup->four_way_handshake && 15748 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) 15749 goto free_msg; 15750 if (wakeup->rfkill_release && 15751 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)) 15752 goto free_msg; 15753 15754 if (wakeup->pattern_idx >= 0 && 15755 nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN, 15756 wakeup->pattern_idx)) 15757 goto free_msg; 15758 15759 if (wakeup->tcp_match && 15760 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH)) 15761 goto free_msg; 15762 15763 if (wakeup->tcp_connlost && 15764 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST)) 15765 goto free_msg; 15766 15767 if (wakeup->tcp_nomoretokens && 15768 nla_put_flag(msg, 15769 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS)) 15770 goto free_msg; 15771 15772 if (wakeup->packet) { 15773 u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211; 15774 u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN; 15775 15776 if (!wakeup->packet_80211) { 15777 pkt_attr = 15778 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023; 15779 len_attr = 15780 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN; 15781 } 15782 15783 if (wakeup->packet_len && 15784 nla_put_u32(msg, len_attr, wakeup->packet_len)) 15785 goto free_msg; 15786 15787 if (nla_put(msg, pkt_attr, wakeup->packet_present_len, 15788 wakeup->packet)) 15789 goto free_msg; 15790 } 15791 15792 if (wakeup->net_detect && 15793 cfg80211_net_detect_results(msg, wakeup)) 15794 goto free_msg; 15795 15796 nla_nest_end(msg, reasons); 15797 } 15798 15799 genlmsg_end(msg, hdr); 15800 15801 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15802 NL80211_MCGRP_MLME, gfp); 15803 return; 15804 15805 free_msg: 15806 nlmsg_free(msg); 15807 } 15808 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup); 15809 #endif 15810 15811 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer, 15812 enum nl80211_tdls_operation oper, 15813 u16 reason_code, gfp_t gfp) 15814 { 15815 struct wireless_dev *wdev = dev->ieee80211_ptr; 15816 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 15817 struct sk_buff *msg; 15818 void *hdr; 15819 15820 trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper, 15821 reason_code); 15822 15823 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 15824 if (!msg) 15825 return; 15826 15827 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER); 15828 if (!hdr) { 15829 nlmsg_free(msg); 15830 return; 15831 } 15832 15833 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15834 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 15835 nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) || 15836 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) || 15837 (reason_code > 0 && 15838 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code))) 15839 goto nla_put_failure; 15840 15841 genlmsg_end(msg, hdr); 15842 15843 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15844 NL80211_MCGRP_MLME, gfp); 15845 return; 15846 15847 nla_put_failure: 15848 nlmsg_free(msg); 15849 } 15850 EXPORT_SYMBOL(cfg80211_tdls_oper_request); 15851 15852 static int nl80211_netlink_notify(struct notifier_block * nb, 15853 unsigned long state, 15854 void *_notify) 15855 { 15856 struct netlink_notify *notify = _notify; 15857 struct cfg80211_registered_device *rdev; 15858 struct wireless_dev *wdev; 15859 struct cfg80211_beacon_registration *reg, *tmp; 15860 15861 if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC) 15862 return NOTIFY_DONE; 15863 15864 rcu_read_lock(); 15865 15866 list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) { 15867 struct cfg80211_sched_scan_request *sched_scan_req; 15868 15869 list_for_each_entry_rcu(sched_scan_req, 15870 &rdev->sched_scan_req_list, 15871 list) { 15872 if (sched_scan_req->owner_nlportid == notify->portid) { 15873 sched_scan_req->nl_owner_dead = true; 15874 schedule_work(&rdev->sched_scan_stop_wk); 15875 } 15876 } 15877 15878 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) { 15879 cfg80211_mlme_unregister_socket(wdev, notify->portid); 15880 15881 if (wdev->owner_nlportid == notify->portid) { 15882 wdev->nl_owner_dead = true; 15883 schedule_work(&rdev->destroy_work); 15884 } else if (wdev->conn_owner_nlportid == notify->portid) { 15885 schedule_work(&wdev->disconnect_wk); 15886 } 15887 } 15888 15889 spin_lock_bh(&rdev->beacon_registrations_lock); 15890 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations, 15891 list) { 15892 if (reg->nlportid == notify->portid) { 15893 list_del(®->list); 15894 kfree(reg); 15895 break; 15896 } 15897 } 15898 spin_unlock_bh(&rdev->beacon_registrations_lock); 15899 } 15900 15901 rcu_read_unlock(); 15902 15903 /* 15904 * It is possible that the user space process that is controlling the 15905 * indoor setting disappeared, so notify the regulatory core. 15906 */ 15907 regulatory_netlink_notify(notify->portid); 15908 return NOTIFY_OK; 15909 } 15910 15911 static struct notifier_block nl80211_netlink_notifier = { 15912 .notifier_call = nl80211_netlink_notify, 15913 }; 15914 15915 void cfg80211_ft_event(struct net_device *netdev, 15916 struct cfg80211_ft_event_params *ft_event) 15917 { 15918 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy; 15919 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 15920 struct sk_buff *msg; 15921 void *hdr; 15922 15923 trace_cfg80211_ft_event(wiphy, netdev, ft_event); 15924 15925 if (!ft_event->target_ap) 15926 return; 15927 15928 msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len, 15929 GFP_KERNEL); 15930 if (!msg) 15931 return; 15932 15933 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT); 15934 if (!hdr) 15935 goto out; 15936 15937 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15938 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 15939 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap)) 15940 goto out; 15941 15942 if (ft_event->ies && 15943 nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies)) 15944 goto out; 15945 if (ft_event->ric_ies && 15946 nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len, 15947 ft_event->ric_ies)) 15948 goto out; 15949 15950 genlmsg_end(msg, hdr); 15951 15952 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15953 NL80211_MCGRP_MLME, GFP_KERNEL); 15954 return; 15955 out: 15956 nlmsg_free(msg); 15957 } 15958 EXPORT_SYMBOL(cfg80211_ft_event); 15959 15960 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp) 15961 { 15962 struct cfg80211_registered_device *rdev; 15963 struct sk_buff *msg; 15964 void *hdr; 15965 u32 nlportid; 15966 15967 rdev = wiphy_to_rdev(wdev->wiphy); 15968 if (!rdev->crit_proto_nlportid) 15969 return; 15970 15971 nlportid = rdev->crit_proto_nlportid; 15972 rdev->crit_proto_nlportid = 0; 15973 15974 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 15975 if (!msg) 15976 return; 15977 15978 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP); 15979 if (!hdr) 15980 goto nla_put_failure; 15981 15982 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15983 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 15984 NL80211_ATTR_PAD)) 15985 goto nla_put_failure; 15986 15987 genlmsg_end(msg, hdr); 15988 15989 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 15990 return; 15991 15992 nla_put_failure: 15993 nlmsg_free(msg); 15994 } 15995 EXPORT_SYMBOL(cfg80211_crit_proto_stopped); 15996 15997 void nl80211_send_ap_stopped(struct wireless_dev *wdev) 15998 { 15999 struct wiphy *wiphy = wdev->wiphy; 16000 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 16001 struct sk_buff *msg; 16002 void *hdr; 16003 16004 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 16005 if (!msg) 16006 return; 16007 16008 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP); 16009 if (!hdr) 16010 goto out; 16011 16012 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16013 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) || 16014 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 16015 NL80211_ATTR_PAD)) 16016 goto out; 16017 16018 genlmsg_end(msg, hdr); 16019 16020 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0, 16021 NL80211_MCGRP_MLME, GFP_KERNEL); 16022 return; 16023 out: 16024 nlmsg_free(msg); 16025 } 16026 16027 int cfg80211_external_auth_request(struct net_device *dev, 16028 struct cfg80211_external_auth_params *params, 16029 gfp_t gfp) 16030 { 16031 struct wireless_dev *wdev = dev->ieee80211_ptr; 16032 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 16033 struct sk_buff *msg; 16034 void *hdr; 16035 16036 if (!wdev->conn_owner_nlportid) 16037 return -EINVAL; 16038 16039 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 16040 if (!msg) 16041 return -ENOMEM; 16042 16043 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH); 16044 if (!hdr) 16045 goto nla_put_failure; 16046 16047 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16048 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 16049 nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, params->key_mgmt_suite) || 16050 nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION, 16051 params->action) || 16052 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) || 16053 nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len, 16054 params->ssid.ssid)) 16055 goto nla_put_failure; 16056 16057 genlmsg_end(msg, hdr); 16058 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, 16059 wdev->conn_owner_nlportid); 16060 return 0; 16061 16062 nla_put_failure: 16063 nlmsg_free(msg); 16064 return -ENOBUFS; 16065 } 16066 EXPORT_SYMBOL(cfg80211_external_auth_request); 16067 16068 /* initialisation/exit functions */ 16069 16070 int __init nl80211_init(void) 16071 { 16072 int err; 16073 16074 err = genl_register_family(&nl80211_fam); 16075 if (err) 16076 return err; 16077 16078 err = netlink_register_notifier(&nl80211_netlink_notifier); 16079 if (err) 16080 goto err_out; 16081 16082 return 0; 16083 err_out: 16084 genl_unregister_family(&nl80211_fam); 16085 return err; 16086 } 16087 16088 void nl80211_exit(void) 16089 { 16090 netlink_unregister_notifier(&nl80211_netlink_notifier); 16091 genl_unregister_family(&nl80211_fam); 16092 } 16093