1 /* 2 * This is the new netlink-based wireless configuration interface. 3 * 4 * Copyright 2006-2010 Johannes Berg <johannes@sipsolutions.net> 5 * Copyright 2013-2014 Intel Mobile Communications GmbH 6 * Copyright 2015-2017 Intel Deutschland GmbH 7 * Copyright (C) 2018 Intel Corporation 8 */ 9 10 #include <linux/if.h> 11 #include <linux/module.h> 12 #include <linux/err.h> 13 #include <linux/slab.h> 14 #include <linux/list.h> 15 #include <linux/if_ether.h> 16 #include <linux/ieee80211.h> 17 #include <linux/nl80211.h> 18 #include <linux/rtnetlink.h> 19 #include <linux/netlink.h> 20 #include <linux/nospec.h> 21 #include <linux/etherdevice.h> 22 #include <net/net_namespace.h> 23 #include <net/genetlink.h> 24 #include <net/cfg80211.h> 25 #include <net/sock.h> 26 #include <net/inet_connection_sock.h> 27 #include "core.h" 28 #include "nl80211.h" 29 #include "reg.h" 30 #include "rdev-ops.h" 31 32 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev, 33 struct genl_info *info, 34 struct cfg80211_crypto_settings *settings, 35 int cipher_limit); 36 37 /* the netlink family */ 38 static struct genl_family nl80211_fam; 39 40 /* multicast groups */ 41 enum nl80211_multicast_groups { 42 NL80211_MCGRP_CONFIG, 43 NL80211_MCGRP_SCAN, 44 NL80211_MCGRP_REGULATORY, 45 NL80211_MCGRP_MLME, 46 NL80211_MCGRP_VENDOR, 47 NL80211_MCGRP_NAN, 48 NL80211_MCGRP_TESTMODE /* keep last - ifdef! */ 49 }; 50 51 static const struct genl_multicast_group nl80211_mcgrps[] = { 52 [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG }, 53 [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN }, 54 [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG }, 55 [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME }, 56 [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR }, 57 [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN }, 58 #ifdef CONFIG_NL80211_TESTMODE 59 [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE } 60 #endif 61 }; 62 63 /* returns ERR_PTR values */ 64 static struct wireless_dev * 65 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs) 66 { 67 struct cfg80211_registered_device *rdev; 68 struct wireless_dev *result = NULL; 69 bool have_ifidx = attrs[NL80211_ATTR_IFINDEX]; 70 bool have_wdev_id = attrs[NL80211_ATTR_WDEV]; 71 u64 wdev_id; 72 int wiphy_idx = -1; 73 int ifidx = -1; 74 75 ASSERT_RTNL(); 76 77 if (!have_ifidx && !have_wdev_id) 78 return ERR_PTR(-EINVAL); 79 80 if (have_ifidx) 81 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]); 82 if (have_wdev_id) { 83 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]); 84 wiphy_idx = wdev_id >> 32; 85 } 86 87 list_for_each_entry(rdev, &cfg80211_rdev_list, list) { 88 struct wireless_dev *wdev; 89 90 if (wiphy_net(&rdev->wiphy) != netns) 91 continue; 92 93 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx) 94 continue; 95 96 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { 97 if (have_ifidx && wdev->netdev && 98 wdev->netdev->ifindex == ifidx) { 99 result = wdev; 100 break; 101 } 102 if (have_wdev_id && wdev->identifier == (u32)wdev_id) { 103 result = wdev; 104 break; 105 } 106 } 107 108 if (result) 109 break; 110 } 111 112 if (result) 113 return result; 114 return ERR_PTR(-ENODEV); 115 } 116 117 static struct cfg80211_registered_device * 118 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs) 119 { 120 struct cfg80211_registered_device *rdev = NULL, *tmp; 121 struct net_device *netdev; 122 123 ASSERT_RTNL(); 124 125 if (!attrs[NL80211_ATTR_WIPHY] && 126 !attrs[NL80211_ATTR_IFINDEX] && 127 !attrs[NL80211_ATTR_WDEV]) 128 return ERR_PTR(-EINVAL); 129 130 if (attrs[NL80211_ATTR_WIPHY]) 131 rdev = cfg80211_rdev_by_wiphy_idx( 132 nla_get_u32(attrs[NL80211_ATTR_WIPHY])); 133 134 if (attrs[NL80211_ATTR_WDEV]) { 135 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]); 136 struct wireless_dev *wdev; 137 bool found = false; 138 139 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32); 140 if (tmp) { 141 /* make sure wdev exists */ 142 list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) { 143 if (wdev->identifier != (u32)wdev_id) 144 continue; 145 found = true; 146 break; 147 } 148 149 if (!found) 150 tmp = NULL; 151 152 if (rdev && tmp != rdev) 153 return ERR_PTR(-EINVAL); 154 rdev = tmp; 155 } 156 } 157 158 if (attrs[NL80211_ATTR_IFINDEX]) { 159 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]); 160 161 netdev = __dev_get_by_index(netns, ifindex); 162 if (netdev) { 163 if (netdev->ieee80211_ptr) 164 tmp = wiphy_to_rdev( 165 netdev->ieee80211_ptr->wiphy); 166 else 167 tmp = NULL; 168 169 /* not wireless device -- return error */ 170 if (!tmp) 171 return ERR_PTR(-EINVAL); 172 173 /* mismatch -- return error */ 174 if (rdev && tmp != rdev) 175 return ERR_PTR(-EINVAL); 176 177 rdev = tmp; 178 } 179 } 180 181 if (!rdev) 182 return ERR_PTR(-ENODEV); 183 184 if (netns != wiphy_net(&rdev->wiphy)) 185 return ERR_PTR(-ENODEV); 186 187 return rdev; 188 } 189 190 /* 191 * This function returns a pointer to the driver 192 * that the genl_info item that is passed refers to. 193 * 194 * The result of this can be a PTR_ERR and hence must 195 * be checked with IS_ERR() for errors. 196 */ 197 static struct cfg80211_registered_device * 198 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info) 199 { 200 return __cfg80211_rdev_from_attrs(netns, info->attrs); 201 } 202 203 /* policy for the attributes */ 204 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { 205 [NL80211_ATTR_WIPHY] = { .type = NLA_U32 }, 206 [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING, 207 .len = 20-1 }, 208 [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED }, 209 210 [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 }, 211 [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 }, 212 [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 }, 213 [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 }, 214 [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 }, 215 216 [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 }, 217 [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 }, 218 [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 }, 219 [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 }, 220 [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 }, 221 [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG }, 222 223 [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 }, 224 [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 }, 225 [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 }, 226 227 [NL80211_ATTR_MAC] = { .len = ETH_ALEN }, 228 [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN }, 229 230 [NL80211_ATTR_KEY] = { .type = NLA_NESTED, }, 231 [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY, 232 .len = WLAN_MAX_KEY_LEN }, 233 [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 }, 234 [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 }, 235 [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG }, 236 [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 }, 237 [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 }, 238 239 [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 }, 240 [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 }, 241 [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY, 242 .len = IEEE80211_MAX_DATA_LEN }, 243 [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY, 244 .len = IEEE80211_MAX_DATA_LEN }, 245 [NL80211_ATTR_STA_AID] = { .type = NLA_U16 }, 246 [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED }, 247 [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 }, 248 [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY, 249 .len = NL80211_MAX_SUPP_RATES }, 250 [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 }, 251 [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 }, 252 [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ }, 253 [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY, 254 .len = IEEE80211_MAX_MESH_ID_LEN }, 255 [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 }, 256 257 [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 }, 258 [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED }, 259 260 [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 }, 261 [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 }, 262 [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 }, 263 [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY, 264 .len = NL80211_MAX_SUPP_RATES }, 265 [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 }, 266 267 [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED }, 268 [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG }, 269 270 [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN }, 271 272 [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 }, 273 [NL80211_ATTR_IE] = { .type = NLA_BINARY, 274 .len = IEEE80211_MAX_DATA_LEN }, 275 [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED }, 276 [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED }, 277 278 [NL80211_ATTR_SSID] = { .type = NLA_BINARY, 279 .len = IEEE80211_MAX_SSID_LEN }, 280 [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 }, 281 [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 }, 282 [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG }, 283 [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG }, 284 [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 }, 285 [NL80211_ATTR_STA_FLAGS2] = { 286 .len = sizeof(struct nl80211_sta_flag_update), 287 }, 288 [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG }, 289 [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 }, 290 [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG }, 291 [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG }, 292 [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG }, 293 [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 }, 294 [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 }, 295 [NL80211_ATTR_PID] = { .type = NLA_U32 }, 296 [NL80211_ATTR_4ADDR] = { .type = NLA_U8 }, 297 [NL80211_ATTR_PMKID] = { .len = WLAN_PMKID_LEN }, 298 [NL80211_ATTR_DURATION] = { .type = NLA_U32 }, 299 [NL80211_ATTR_COOKIE] = { .type = NLA_U64 }, 300 [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED }, 301 [NL80211_ATTR_FRAME] = { .type = NLA_BINARY, 302 .len = IEEE80211_MAX_DATA_LEN }, 303 [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, }, 304 [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 }, 305 [NL80211_ATTR_CQM] = { .type = NLA_NESTED, }, 306 [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG }, 307 [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 }, 308 [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 }, 309 [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 }, 310 [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 }, 311 [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 }, 312 [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 }, 313 [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 }, 314 [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG }, 315 [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED }, 316 [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED }, 317 [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 }, 318 [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 }, 319 [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED }, 320 [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED }, 321 [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 }, 322 [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY, 323 .len = IEEE80211_MAX_DATA_LEN }, 324 [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY, 325 .len = IEEE80211_MAX_DATA_LEN }, 326 [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG }, 327 [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED }, 328 [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG }, 329 [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 }, 330 [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 }, 331 [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 }, 332 [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG }, 333 [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG }, 334 [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG }, 335 [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG }, 336 [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY, 337 .len = IEEE80211_MAX_DATA_LEN }, 338 [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 }, 339 [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG }, 340 [NL80211_ATTR_HT_CAPABILITY_MASK] = { 341 .len = NL80211_HT_CAPABILITY_LEN 342 }, 343 [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 }, 344 [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 }, 345 [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 }, 346 [NL80211_ATTR_WDEV] = { .type = NLA_U64 }, 347 [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 }, 348 [NL80211_ATTR_AUTH_DATA] = { .type = NLA_BINARY, }, 349 [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN }, 350 [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 }, 351 [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 }, 352 [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 }, 353 [NL80211_ATTR_LOCAL_MESH_POWER_MODE] = {. type = NLA_U32 }, 354 [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 }, 355 [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED }, 356 [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 }, 357 [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, }, 358 [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, }, 359 [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG }, 360 [NL80211_ATTR_VHT_CAPABILITY_MASK] = { 361 .len = NL80211_VHT_CAPABILITY_LEN, 362 }, 363 [NL80211_ATTR_MDID] = { .type = NLA_U16 }, 364 [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY, 365 .len = IEEE80211_MAX_DATA_LEN }, 366 [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 }, 367 [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 }, 368 [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG }, 369 [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED }, 370 [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY }, 371 [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY }, 372 [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY }, 373 [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY }, 374 [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG }, 375 [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 }, 376 [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 }, 377 [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 }, 378 [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY }, 379 [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY, 380 .len = IEEE80211_QOS_MAP_LEN_MAX }, 381 [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN }, 382 [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 }, 383 [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 }, 384 [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG }, 385 [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY }, 386 [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG }, 387 [NL80211_ATTR_TSID] = { .type = NLA_U8 }, 388 [NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 }, 389 [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 }, 390 [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 }, 391 [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN }, 392 [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG }, 393 [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 }, 394 [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 }, 395 [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG }, 396 [NL80211_ATTR_PBSS] = { .type = NLA_FLAG }, 397 [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED }, 398 [NL80211_ATTR_STA_SUPPORT_P2P_PS] = { .type = NLA_U8 }, 399 [NL80211_ATTR_MU_MIMO_GROUP_DATA] = { 400 .len = VHT_MUMIMO_GROUPS_DATA_LEN 401 }, 402 [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = { .len = ETH_ALEN }, 403 [NL80211_ATTR_NAN_MASTER_PREF] = { .type = NLA_U8 }, 404 [NL80211_ATTR_BANDS] = { .type = NLA_U32 }, 405 [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED }, 406 [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY, 407 .len = FILS_MAX_KEK_LEN }, 408 [NL80211_ATTR_FILS_NONCES] = { .len = 2 * FILS_NONCE_LEN }, 409 [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, }, 410 [NL80211_ATTR_BSSID] = { .len = ETH_ALEN }, 411 [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 }, 412 [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = { 413 .len = sizeof(struct nl80211_bss_select_rssi_adjust) 414 }, 415 [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 }, 416 [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY, 417 .len = FILS_ERP_MAX_USERNAME_LEN }, 418 [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY, 419 .len = FILS_ERP_MAX_REALM_LEN }, 420 [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 }, 421 [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY, 422 .len = FILS_ERP_MAX_RRK_LEN }, 423 [NL80211_ATTR_FILS_CACHE_ID] = { .len = 2 }, 424 [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN }, 425 [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG }, 426 [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG }, 427 428 [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 }, 429 [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 }, 430 [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 }, 431 [NL80211_ATTR_HE_CAPABILITY] = { .type = NLA_BINARY, 432 .len = NL80211_HE_MAX_CAPABILITY_LEN }, 433 }; 434 435 /* policy for the key attributes */ 436 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = { 437 [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN }, 438 [NL80211_KEY_IDX] = { .type = NLA_U8 }, 439 [NL80211_KEY_CIPHER] = { .type = NLA_U32 }, 440 [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 }, 441 [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG }, 442 [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG }, 443 [NL80211_KEY_TYPE] = { .type = NLA_U32 }, 444 [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED }, 445 }; 446 447 /* policy for the key default flags */ 448 static const struct nla_policy 449 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = { 450 [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG }, 451 [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG }, 452 }; 453 454 #ifdef CONFIG_PM 455 /* policy for WoWLAN attributes */ 456 static const struct nla_policy 457 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = { 458 [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG }, 459 [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG }, 460 [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG }, 461 [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED }, 462 [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG }, 463 [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG }, 464 [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG }, 465 [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG }, 466 [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED }, 467 [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED }, 468 }; 469 470 static const struct nla_policy 471 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = { 472 [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 }, 473 [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 }, 474 [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN }, 475 [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 }, 476 [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 }, 477 [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 }, 478 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = { 479 .len = sizeof(struct nl80211_wowlan_tcp_data_seq) 480 }, 481 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = { 482 .len = sizeof(struct nl80211_wowlan_tcp_data_token) 483 }, 484 [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 }, 485 [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 }, 486 [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 }, 487 }; 488 #endif /* CONFIG_PM */ 489 490 /* policy for coalesce rule attributes */ 491 static const struct nla_policy 492 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = { 493 [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 }, 494 [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 }, 495 [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED }, 496 }; 497 498 /* policy for GTK rekey offload attributes */ 499 static const struct nla_policy 500 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = { 501 [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN }, 502 [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN }, 503 [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN }, 504 }; 505 506 static const struct nla_policy 507 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = { 508 [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY, 509 .len = IEEE80211_MAX_SSID_LEN }, 510 [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = { .len = ETH_ALEN }, 511 [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 }, 512 }; 513 514 static const struct nla_policy 515 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = { 516 [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 }, 517 [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 }, 518 }; 519 520 static const struct nla_policy 521 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = { 522 [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG }, 523 [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 }, 524 [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = { 525 .len = sizeof(struct nl80211_bss_select_rssi_adjust) 526 }, 527 }; 528 529 /* policy for NAN function attributes */ 530 static const struct nla_policy 531 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = { 532 [NL80211_NAN_FUNC_TYPE] = { .type = NLA_U8 }, 533 [NL80211_NAN_FUNC_SERVICE_ID] = { 534 .len = NL80211_NAN_FUNC_SERVICE_ID_LEN }, 535 [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 }, 536 [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG }, 537 [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG }, 538 [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 }, 539 [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 }, 540 [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = { .len = ETH_ALEN }, 541 [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG }, 542 [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 }, 543 [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY, 544 .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN }, 545 [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED }, 546 [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED }, 547 [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED }, 548 [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 }, 549 [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 }, 550 }; 551 552 /* policy for Service Response Filter attributes */ 553 static const struct nla_policy 554 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = { 555 [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG }, 556 [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY, 557 .len = NL80211_NAN_FUNC_SRF_MAX_LEN }, 558 [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 }, 559 [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED }, 560 }; 561 562 /* policy for packet pattern attributes */ 563 static const struct nla_policy 564 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = { 565 [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, }, 566 [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, }, 567 [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 }, 568 }; 569 570 static int nl80211_prepare_wdev_dump(struct sk_buff *skb, 571 struct netlink_callback *cb, 572 struct cfg80211_registered_device **rdev, 573 struct wireless_dev **wdev) 574 { 575 int err; 576 577 if (!cb->args[0]) { 578 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, 579 genl_family_attrbuf(&nl80211_fam), 580 nl80211_fam.maxattr, nl80211_policy, NULL); 581 if (err) 582 return err; 583 584 *wdev = __cfg80211_wdev_from_attrs( 585 sock_net(skb->sk), 586 genl_family_attrbuf(&nl80211_fam)); 587 if (IS_ERR(*wdev)) 588 return PTR_ERR(*wdev); 589 *rdev = wiphy_to_rdev((*wdev)->wiphy); 590 /* 0 is the first index - add 1 to parse only once */ 591 cb->args[0] = (*rdev)->wiphy_idx + 1; 592 cb->args[1] = (*wdev)->identifier; 593 } else { 594 /* subtract the 1 again here */ 595 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1); 596 struct wireless_dev *tmp; 597 598 if (!wiphy) 599 return -ENODEV; 600 *rdev = wiphy_to_rdev(wiphy); 601 *wdev = NULL; 602 603 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) { 604 if (tmp->identifier == cb->args[1]) { 605 *wdev = tmp; 606 break; 607 } 608 } 609 610 if (!*wdev) 611 return -ENODEV; 612 } 613 614 return 0; 615 } 616 617 /* IE validation */ 618 static bool is_valid_ie_attr(const struct nlattr *attr) 619 { 620 const u8 *pos; 621 int len; 622 623 if (!attr) 624 return true; 625 626 pos = nla_data(attr); 627 len = nla_len(attr); 628 629 while (len) { 630 u8 elemlen; 631 632 if (len < 2) 633 return false; 634 len -= 2; 635 636 elemlen = pos[1]; 637 if (elemlen > len) 638 return false; 639 640 len -= elemlen; 641 pos += 2 + elemlen; 642 } 643 644 return true; 645 } 646 647 /* message building helper */ 648 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq, 649 int flags, u8 cmd) 650 { 651 /* since there is no private header just add the generic one */ 652 return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd); 653 } 654 655 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg, 656 const struct ieee80211_reg_rule *rule) 657 { 658 int j; 659 struct nlattr *nl_wmm_rules = 660 nla_nest_start(msg, NL80211_FREQUENCY_ATTR_WMM); 661 662 if (!nl_wmm_rules) 663 goto nla_put_failure; 664 665 for (j = 0; j < IEEE80211_NUM_ACS; j++) { 666 struct nlattr *nl_wmm_rule = nla_nest_start(msg, j); 667 668 if (!nl_wmm_rule) 669 goto nla_put_failure; 670 671 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN, 672 rule->wmm_rule.client[j].cw_min) || 673 nla_put_u16(msg, NL80211_WMMR_CW_MAX, 674 rule->wmm_rule.client[j].cw_max) || 675 nla_put_u8(msg, NL80211_WMMR_AIFSN, 676 rule->wmm_rule.client[j].aifsn) || 677 nla_put_u16(msg, NL80211_WMMR_TXOP, 678 rule->wmm_rule.client[j].cot)) 679 goto nla_put_failure; 680 681 nla_nest_end(msg, nl_wmm_rule); 682 } 683 nla_nest_end(msg, nl_wmm_rules); 684 685 return 0; 686 687 nla_put_failure: 688 return -ENOBUFS; 689 } 690 691 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy, 692 struct ieee80211_channel *chan, 693 bool large) 694 { 695 /* Some channels must be completely excluded from the 696 * list to protect old user-space tools from breaking 697 */ 698 if (!large && chan->flags & 699 (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ)) 700 return 0; 701 702 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ, 703 chan->center_freq)) 704 goto nla_put_failure; 705 706 if ((chan->flags & IEEE80211_CHAN_DISABLED) && 707 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED)) 708 goto nla_put_failure; 709 if (chan->flags & IEEE80211_CHAN_NO_IR) { 710 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR)) 711 goto nla_put_failure; 712 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS)) 713 goto nla_put_failure; 714 } 715 if (chan->flags & IEEE80211_CHAN_RADAR) { 716 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR)) 717 goto nla_put_failure; 718 if (large) { 719 u32 time; 720 721 time = elapsed_jiffies_msecs(chan->dfs_state_entered); 722 723 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE, 724 chan->dfs_state)) 725 goto nla_put_failure; 726 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME, 727 time)) 728 goto nla_put_failure; 729 if (nla_put_u32(msg, 730 NL80211_FREQUENCY_ATTR_DFS_CAC_TIME, 731 chan->dfs_cac_ms)) 732 goto nla_put_failure; 733 } 734 } 735 736 if (large) { 737 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) && 738 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS)) 739 goto nla_put_failure; 740 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) && 741 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS)) 742 goto nla_put_failure; 743 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) && 744 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ)) 745 goto nla_put_failure; 746 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) && 747 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ)) 748 goto nla_put_failure; 749 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) && 750 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY)) 751 goto nla_put_failure; 752 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) && 753 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT)) 754 goto nla_put_failure; 755 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) && 756 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ)) 757 goto nla_put_failure; 758 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) && 759 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ)) 760 goto nla_put_failure; 761 } 762 763 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER, 764 DBM_TO_MBM(chan->max_power))) 765 goto nla_put_failure; 766 767 if (large) { 768 const struct ieee80211_reg_rule *rule = 769 freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq)); 770 771 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) { 772 if (nl80211_msg_put_wmm_rules(msg, rule)) 773 goto nla_put_failure; 774 } 775 } 776 777 return 0; 778 779 nla_put_failure: 780 return -ENOBUFS; 781 } 782 783 static bool nl80211_put_txq_stats(struct sk_buff *msg, 784 struct cfg80211_txq_stats *txqstats, 785 int attrtype) 786 { 787 struct nlattr *txqattr; 788 789 #define PUT_TXQVAL_U32(attr, memb) do { \ 790 if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) && \ 791 nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \ 792 return false; \ 793 } while (0) 794 795 txqattr = nla_nest_start(msg, attrtype); 796 if (!txqattr) 797 return false; 798 799 PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes); 800 PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets); 801 PUT_TXQVAL_U32(FLOWS, flows); 802 PUT_TXQVAL_U32(DROPS, drops); 803 PUT_TXQVAL_U32(ECN_MARKS, ecn_marks); 804 PUT_TXQVAL_U32(OVERLIMIT, overlimit); 805 PUT_TXQVAL_U32(OVERMEMORY, overmemory); 806 PUT_TXQVAL_U32(COLLISIONS, collisions); 807 PUT_TXQVAL_U32(TX_BYTES, tx_bytes); 808 PUT_TXQVAL_U32(TX_PACKETS, tx_packets); 809 PUT_TXQVAL_U32(MAX_FLOWS, max_flows); 810 nla_nest_end(msg, txqattr); 811 812 #undef PUT_TXQVAL_U32 813 return true; 814 } 815 816 /* netlink command implementations */ 817 818 struct key_parse { 819 struct key_params p; 820 int idx; 821 int type; 822 bool def, defmgmt; 823 bool def_uni, def_multi; 824 }; 825 826 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key, 827 struct key_parse *k) 828 { 829 struct nlattr *tb[NL80211_KEY_MAX + 1]; 830 int err = nla_parse_nested(tb, NL80211_KEY_MAX, key, 831 nl80211_key_policy, info->extack); 832 if (err) 833 return err; 834 835 k->def = !!tb[NL80211_KEY_DEFAULT]; 836 k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT]; 837 838 if (k->def) { 839 k->def_uni = true; 840 k->def_multi = true; 841 } 842 if (k->defmgmt) 843 k->def_multi = true; 844 845 if (tb[NL80211_KEY_IDX]) 846 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]); 847 848 if (tb[NL80211_KEY_DATA]) { 849 k->p.key = nla_data(tb[NL80211_KEY_DATA]); 850 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]); 851 } 852 853 if (tb[NL80211_KEY_SEQ]) { 854 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]); 855 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]); 856 } 857 858 if (tb[NL80211_KEY_CIPHER]) 859 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]); 860 861 if (tb[NL80211_KEY_TYPE]) { 862 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]); 863 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES) 864 return genl_err_attr(info, -EINVAL, 865 tb[NL80211_KEY_TYPE]); 866 } 867 868 if (tb[NL80211_KEY_DEFAULT_TYPES]) { 869 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES]; 870 871 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1, 872 tb[NL80211_KEY_DEFAULT_TYPES], 873 nl80211_key_default_policy, 874 info->extack); 875 if (err) 876 return err; 877 878 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST]; 879 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST]; 880 } 881 882 return 0; 883 } 884 885 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k) 886 { 887 if (info->attrs[NL80211_ATTR_KEY_DATA]) { 888 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]); 889 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]); 890 } 891 892 if (info->attrs[NL80211_ATTR_KEY_SEQ]) { 893 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]); 894 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]); 895 } 896 897 if (info->attrs[NL80211_ATTR_KEY_IDX]) 898 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]); 899 900 if (info->attrs[NL80211_ATTR_KEY_CIPHER]) 901 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]); 902 903 k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT]; 904 k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]; 905 906 if (k->def) { 907 k->def_uni = true; 908 k->def_multi = true; 909 } 910 if (k->defmgmt) 911 k->def_multi = true; 912 913 if (info->attrs[NL80211_ATTR_KEY_TYPE]) { 914 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]); 915 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES) { 916 GENL_SET_ERR_MSG(info, "key type out of range"); 917 return -EINVAL; 918 } 919 } 920 921 if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) { 922 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES]; 923 int err = nla_parse_nested(kdt, 924 NUM_NL80211_KEY_DEFAULT_TYPES - 1, 925 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES], 926 nl80211_key_default_policy, 927 info->extack); 928 if (err) 929 return err; 930 931 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST]; 932 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST]; 933 } 934 935 return 0; 936 } 937 938 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k) 939 { 940 int err; 941 942 memset(k, 0, sizeof(*k)); 943 k->idx = -1; 944 k->type = -1; 945 946 if (info->attrs[NL80211_ATTR_KEY]) 947 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k); 948 else 949 err = nl80211_parse_key_old(info, k); 950 951 if (err) 952 return err; 953 954 if (k->def && k->defmgmt) { 955 GENL_SET_ERR_MSG(info, "key with def && defmgmt is invalid"); 956 return -EINVAL; 957 } 958 959 if (k->defmgmt) { 960 if (k->def_uni || !k->def_multi) { 961 GENL_SET_ERR_MSG(info, "defmgmt key must be mcast"); 962 return -EINVAL; 963 } 964 } 965 966 if (k->idx != -1) { 967 if (k->defmgmt) { 968 if (k->idx < 4 || k->idx > 5) { 969 GENL_SET_ERR_MSG(info, 970 "defmgmt key idx not 4 or 5"); 971 return -EINVAL; 972 } 973 } else if (k->def) { 974 if (k->idx < 0 || k->idx > 3) { 975 GENL_SET_ERR_MSG(info, "def key idx not 0-3"); 976 return -EINVAL; 977 } 978 } else { 979 if (k->idx < 0 || k->idx > 5) { 980 GENL_SET_ERR_MSG(info, "key idx not 0-5"); 981 return -EINVAL; 982 } 983 } 984 } 985 986 return 0; 987 } 988 989 static struct cfg80211_cached_keys * 990 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev, 991 struct genl_info *info, bool *no_ht) 992 { 993 struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS]; 994 struct key_parse parse; 995 struct nlattr *key; 996 struct cfg80211_cached_keys *result; 997 int rem, err, def = 0; 998 bool have_key = false; 999 1000 nla_for_each_nested(key, keys, rem) { 1001 have_key = true; 1002 break; 1003 } 1004 1005 if (!have_key) 1006 return NULL; 1007 1008 result = kzalloc(sizeof(*result), GFP_KERNEL); 1009 if (!result) 1010 return ERR_PTR(-ENOMEM); 1011 1012 result->def = -1; 1013 1014 nla_for_each_nested(key, keys, rem) { 1015 memset(&parse, 0, sizeof(parse)); 1016 parse.idx = -1; 1017 1018 err = nl80211_parse_key_new(info, key, &parse); 1019 if (err) 1020 goto error; 1021 err = -EINVAL; 1022 if (!parse.p.key) 1023 goto error; 1024 if (parse.idx < 0 || parse.idx > 3) { 1025 GENL_SET_ERR_MSG(info, "key index out of range [0-3]"); 1026 goto error; 1027 } 1028 if (parse.def) { 1029 if (def) { 1030 GENL_SET_ERR_MSG(info, 1031 "only one key can be default"); 1032 goto error; 1033 } 1034 def = 1; 1035 result->def = parse.idx; 1036 if (!parse.def_uni || !parse.def_multi) 1037 goto error; 1038 } else if (parse.defmgmt) 1039 goto error; 1040 err = cfg80211_validate_key_settings(rdev, &parse.p, 1041 parse.idx, false, NULL); 1042 if (err) 1043 goto error; 1044 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 && 1045 parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) { 1046 GENL_SET_ERR_MSG(info, "connect key must be WEP"); 1047 err = -EINVAL; 1048 goto error; 1049 } 1050 result->params[parse.idx].cipher = parse.p.cipher; 1051 result->params[parse.idx].key_len = parse.p.key_len; 1052 result->params[parse.idx].key = result->data[parse.idx]; 1053 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len); 1054 1055 /* must be WEP key if we got here */ 1056 if (no_ht) 1057 *no_ht = true; 1058 } 1059 1060 if (result->def < 0) { 1061 err = -EINVAL; 1062 GENL_SET_ERR_MSG(info, "need a default/TX key"); 1063 goto error; 1064 } 1065 1066 return result; 1067 error: 1068 kfree(result); 1069 return ERR_PTR(err); 1070 } 1071 1072 static int nl80211_key_allowed(struct wireless_dev *wdev) 1073 { 1074 ASSERT_WDEV_LOCK(wdev); 1075 1076 switch (wdev->iftype) { 1077 case NL80211_IFTYPE_AP: 1078 case NL80211_IFTYPE_AP_VLAN: 1079 case NL80211_IFTYPE_P2P_GO: 1080 case NL80211_IFTYPE_MESH_POINT: 1081 break; 1082 case NL80211_IFTYPE_ADHOC: 1083 case NL80211_IFTYPE_STATION: 1084 case NL80211_IFTYPE_P2P_CLIENT: 1085 if (!wdev->current_bss) 1086 return -ENOLINK; 1087 break; 1088 case NL80211_IFTYPE_UNSPECIFIED: 1089 case NL80211_IFTYPE_OCB: 1090 case NL80211_IFTYPE_MONITOR: 1091 case NL80211_IFTYPE_NAN: 1092 case NL80211_IFTYPE_P2P_DEVICE: 1093 case NL80211_IFTYPE_WDS: 1094 case NUM_NL80211_IFTYPES: 1095 return -EINVAL; 1096 } 1097 1098 return 0; 1099 } 1100 1101 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy, 1102 struct nlattr *tb) 1103 { 1104 struct ieee80211_channel *chan; 1105 1106 if (tb == NULL) 1107 return NULL; 1108 chan = ieee80211_get_channel(wiphy, nla_get_u32(tb)); 1109 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) 1110 return NULL; 1111 return chan; 1112 } 1113 1114 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes) 1115 { 1116 struct nlattr *nl_modes = nla_nest_start(msg, attr); 1117 int i; 1118 1119 if (!nl_modes) 1120 goto nla_put_failure; 1121 1122 i = 0; 1123 while (ifmodes) { 1124 if ((ifmodes & 1) && nla_put_flag(msg, i)) 1125 goto nla_put_failure; 1126 ifmodes >>= 1; 1127 i++; 1128 } 1129 1130 nla_nest_end(msg, nl_modes); 1131 return 0; 1132 1133 nla_put_failure: 1134 return -ENOBUFS; 1135 } 1136 1137 static int nl80211_put_iface_combinations(struct wiphy *wiphy, 1138 struct sk_buff *msg, 1139 bool large) 1140 { 1141 struct nlattr *nl_combis; 1142 int i, j; 1143 1144 nl_combis = nla_nest_start(msg, 1145 NL80211_ATTR_INTERFACE_COMBINATIONS); 1146 if (!nl_combis) 1147 goto nla_put_failure; 1148 1149 for (i = 0; i < wiphy->n_iface_combinations; i++) { 1150 const struct ieee80211_iface_combination *c; 1151 struct nlattr *nl_combi, *nl_limits; 1152 1153 c = &wiphy->iface_combinations[i]; 1154 1155 nl_combi = nla_nest_start(msg, i + 1); 1156 if (!nl_combi) 1157 goto nla_put_failure; 1158 1159 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS); 1160 if (!nl_limits) 1161 goto nla_put_failure; 1162 1163 for (j = 0; j < c->n_limits; j++) { 1164 struct nlattr *nl_limit; 1165 1166 nl_limit = nla_nest_start(msg, j + 1); 1167 if (!nl_limit) 1168 goto nla_put_failure; 1169 if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX, 1170 c->limits[j].max)) 1171 goto nla_put_failure; 1172 if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES, 1173 c->limits[j].types)) 1174 goto nla_put_failure; 1175 nla_nest_end(msg, nl_limit); 1176 } 1177 1178 nla_nest_end(msg, nl_limits); 1179 1180 if (c->beacon_int_infra_match && 1181 nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH)) 1182 goto nla_put_failure; 1183 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS, 1184 c->num_different_channels) || 1185 nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM, 1186 c->max_interfaces)) 1187 goto nla_put_failure; 1188 if (large && 1189 (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS, 1190 c->radar_detect_widths) || 1191 nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS, 1192 c->radar_detect_regions))) 1193 goto nla_put_failure; 1194 if (c->beacon_int_min_gcd && 1195 nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD, 1196 c->beacon_int_min_gcd)) 1197 goto nla_put_failure; 1198 1199 nla_nest_end(msg, nl_combi); 1200 } 1201 1202 nla_nest_end(msg, nl_combis); 1203 1204 return 0; 1205 nla_put_failure: 1206 return -ENOBUFS; 1207 } 1208 1209 #ifdef CONFIG_PM 1210 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev, 1211 struct sk_buff *msg) 1212 { 1213 const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp; 1214 struct nlattr *nl_tcp; 1215 1216 if (!tcp) 1217 return 0; 1218 1219 nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION); 1220 if (!nl_tcp) 1221 return -ENOBUFS; 1222 1223 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD, 1224 tcp->data_payload_max)) 1225 return -ENOBUFS; 1226 1227 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD, 1228 tcp->data_payload_max)) 1229 return -ENOBUFS; 1230 1231 if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ)) 1232 return -ENOBUFS; 1233 1234 if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN, 1235 sizeof(*tcp->tok), tcp->tok)) 1236 return -ENOBUFS; 1237 1238 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL, 1239 tcp->data_interval_max)) 1240 return -ENOBUFS; 1241 1242 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD, 1243 tcp->wake_payload_max)) 1244 return -ENOBUFS; 1245 1246 nla_nest_end(msg, nl_tcp); 1247 return 0; 1248 } 1249 1250 static int nl80211_send_wowlan(struct sk_buff *msg, 1251 struct cfg80211_registered_device *rdev, 1252 bool large) 1253 { 1254 struct nlattr *nl_wowlan; 1255 1256 if (!rdev->wiphy.wowlan) 1257 return 0; 1258 1259 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED); 1260 if (!nl_wowlan) 1261 return -ENOBUFS; 1262 1263 if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) && 1264 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) || 1265 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) && 1266 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) || 1267 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) && 1268 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) || 1269 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) && 1270 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) || 1271 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) && 1272 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) || 1273 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) && 1274 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) || 1275 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) && 1276 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) || 1277 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) && 1278 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))) 1279 return -ENOBUFS; 1280 1281 if (rdev->wiphy.wowlan->n_patterns) { 1282 struct nl80211_pattern_support pat = { 1283 .max_patterns = rdev->wiphy.wowlan->n_patterns, 1284 .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len, 1285 .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len, 1286 .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset, 1287 }; 1288 1289 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN, 1290 sizeof(pat), &pat)) 1291 return -ENOBUFS; 1292 } 1293 1294 if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) && 1295 nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT, 1296 rdev->wiphy.wowlan->max_nd_match_sets)) 1297 return -ENOBUFS; 1298 1299 if (large && nl80211_send_wowlan_tcp_caps(rdev, msg)) 1300 return -ENOBUFS; 1301 1302 nla_nest_end(msg, nl_wowlan); 1303 1304 return 0; 1305 } 1306 #endif 1307 1308 static int nl80211_send_coalesce(struct sk_buff *msg, 1309 struct cfg80211_registered_device *rdev) 1310 { 1311 struct nl80211_coalesce_rule_support rule; 1312 1313 if (!rdev->wiphy.coalesce) 1314 return 0; 1315 1316 rule.max_rules = rdev->wiphy.coalesce->n_rules; 1317 rule.max_delay = rdev->wiphy.coalesce->max_delay; 1318 rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns; 1319 rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len; 1320 rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len; 1321 rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset; 1322 1323 if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule)) 1324 return -ENOBUFS; 1325 1326 return 0; 1327 } 1328 1329 static int 1330 nl80211_send_iftype_data(struct sk_buff *msg, 1331 const struct ieee80211_sband_iftype_data *iftdata) 1332 { 1333 const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap; 1334 1335 if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES, 1336 iftdata->types_mask)) 1337 return -ENOBUFS; 1338 1339 if (he_cap->has_he) { 1340 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC, 1341 sizeof(he_cap->he_cap_elem.mac_cap_info), 1342 he_cap->he_cap_elem.mac_cap_info) || 1343 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY, 1344 sizeof(he_cap->he_cap_elem.phy_cap_info), 1345 he_cap->he_cap_elem.phy_cap_info) || 1346 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET, 1347 sizeof(he_cap->he_mcs_nss_supp), 1348 &he_cap->he_mcs_nss_supp) || 1349 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE, 1350 sizeof(he_cap->ppe_thres), he_cap->ppe_thres)) 1351 return -ENOBUFS; 1352 } 1353 1354 return 0; 1355 } 1356 1357 static int nl80211_send_band_rateinfo(struct sk_buff *msg, 1358 struct ieee80211_supported_band *sband) 1359 { 1360 struct nlattr *nl_rates, *nl_rate; 1361 struct ieee80211_rate *rate; 1362 int i; 1363 1364 /* add HT info */ 1365 if (sband->ht_cap.ht_supported && 1366 (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET, 1367 sizeof(sband->ht_cap.mcs), 1368 &sband->ht_cap.mcs) || 1369 nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA, 1370 sband->ht_cap.cap) || 1371 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR, 1372 sband->ht_cap.ampdu_factor) || 1373 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY, 1374 sband->ht_cap.ampdu_density))) 1375 return -ENOBUFS; 1376 1377 /* add VHT info */ 1378 if (sband->vht_cap.vht_supported && 1379 (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET, 1380 sizeof(sband->vht_cap.vht_mcs), 1381 &sband->vht_cap.vht_mcs) || 1382 nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA, 1383 sband->vht_cap.cap))) 1384 return -ENOBUFS; 1385 1386 if (sband->n_iftype_data) { 1387 struct nlattr *nl_iftype_data = 1388 nla_nest_start(msg, NL80211_BAND_ATTR_IFTYPE_DATA); 1389 int err; 1390 1391 if (!nl_iftype_data) 1392 return -ENOBUFS; 1393 1394 for (i = 0; i < sband->n_iftype_data; i++) { 1395 struct nlattr *iftdata; 1396 1397 iftdata = nla_nest_start(msg, i + 1); 1398 if (!iftdata) 1399 return -ENOBUFS; 1400 1401 err = nl80211_send_iftype_data(msg, 1402 &sband->iftype_data[i]); 1403 if (err) 1404 return err; 1405 1406 nla_nest_end(msg, iftdata); 1407 } 1408 1409 nla_nest_end(msg, nl_iftype_data); 1410 } 1411 1412 /* add bitrates */ 1413 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES); 1414 if (!nl_rates) 1415 return -ENOBUFS; 1416 1417 for (i = 0; i < sband->n_bitrates; i++) { 1418 nl_rate = nla_nest_start(msg, i); 1419 if (!nl_rate) 1420 return -ENOBUFS; 1421 1422 rate = &sband->bitrates[i]; 1423 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE, 1424 rate->bitrate)) 1425 return -ENOBUFS; 1426 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) && 1427 nla_put_flag(msg, 1428 NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE)) 1429 return -ENOBUFS; 1430 1431 nla_nest_end(msg, nl_rate); 1432 } 1433 1434 nla_nest_end(msg, nl_rates); 1435 1436 return 0; 1437 } 1438 1439 static int 1440 nl80211_send_mgmt_stypes(struct sk_buff *msg, 1441 const struct ieee80211_txrx_stypes *mgmt_stypes) 1442 { 1443 u16 stypes; 1444 struct nlattr *nl_ftypes, *nl_ifs; 1445 enum nl80211_iftype ift; 1446 int i; 1447 1448 if (!mgmt_stypes) 1449 return 0; 1450 1451 nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES); 1452 if (!nl_ifs) 1453 return -ENOBUFS; 1454 1455 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) { 1456 nl_ftypes = nla_nest_start(msg, ift); 1457 if (!nl_ftypes) 1458 return -ENOBUFS; 1459 i = 0; 1460 stypes = mgmt_stypes[ift].tx; 1461 while (stypes) { 1462 if ((stypes & 1) && 1463 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE, 1464 (i << 4) | IEEE80211_FTYPE_MGMT)) 1465 return -ENOBUFS; 1466 stypes >>= 1; 1467 i++; 1468 } 1469 nla_nest_end(msg, nl_ftypes); 1470 } 1471 1472 nla_nest_end(msg, nl_ifs); 1473 1474 nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES); 1475 if (!nl_ifs) 1476 return -ENOBUFS; 1477 1478 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) { 1479 nl_ftypes = nla_nest_start(msg, ift); 1480 if (!nl_ftypes) 1481 return -ENOBUFS; 1482 i = 0; 1483 stypes = mgmt_stypes[ift].rx; 1484 while (stypes) { 1485 if ((stypes & 1) && 1486 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE, 1487 (i << 4) | IEEE80211_FTYPE_MGMT)) 1488 return -ENOBUFS; 1489 stypes >>= 1; 1490 i++; 1491 } 1492 nla_nest_end(msg, nl_ftypes); 1493 } 1494 nla_nest_end(msg, nl_ifs); 1495 1496 return 0; 1497 } 1498 1499 #define CMD(op, n) \ 1500 do { \ 1501 if (rdev->ops->op) { \ 1502 i++; \ 1503 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \ 1504 goto nla_put_failure; \ 1505 } \ 1506 } while (0) 1507 1508 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev, 1509 struct sk_buff *msg) 1510 { 1511 int i = 0; 1512 1513 /* 1514 * do *NOT* add anything into this function, new things need to be 1515 * advertised only to new versions of userspace that can deal with 1516 * the split (and they can't possibly care about new features... 1517 */ 1518 CMD(add_virtual_intf, NEW_INTERFACE); 1519 CMD(change_virtual_intf, SET_INTERFACE); 1520 CMD(add_key, NEW_KEY); 1521 CMD(start_ap, START_AP); 1522 CMD(add_station, NEW_STATION); 1523 CMD(add_mpath, NEW_MPATH); 1524 CMD(update_mesh_config, SET_MESH_CONFIG); 1525 CMD(change_bss, SET_BSS); 1526 CMD(auth, AUTHENTICATE); 1527 CMD(assoc, ASSOCIATE); 1528 CMD(deauth, DEAUTHENTICATE); 1529 CMD(disassoc, DISASSOCIATE); 1530 CMD(join_ibss, JOIN_IBSS); 1531 CMD(join_mesh, JOIN_MESH); 1532 CMD(set_pmksa, SET_PMKSA); 1533 CMD(del_pmksa, DEL_PMKSA); 1534 CMD(flush_pmksa, FLUSH_PMKSA); 1535 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) 1536 CMD(remain_on_channel, REMAIN_ON_CHANNEL); 1537 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK); 1538 CMD(mgmt_tx, FRAME); 1539 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL); 1540 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) { 1541 i++; 1542 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS)) 1543 goto nla_put_failure; 1544 } 1545 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap || 1546 rdev->ops->join_mesh) { 1547 i++; 1548 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL)) 1549 goto nla_put_failure; 1550 } 1551 CMD(set_wds_peer, SET_WDS_PEER); 1552 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) { 1553 CMD(tdls_mgmt, TDLS_MGMT); 1554 CMD(tdls_oper, TDLS_OPER); 1555 } 1556 if (rdev->wiphy.max_sched_scan_reqs) 1557 CMD(sched_scan_start, START_SCHED_SCAN); 1558 CMD(probe_client, PROBE_CLIENT); 1559 CMD(set_noack_map, SET_NOACK_MAP); 1560 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) { 1561 i++; 1562 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS)) 1563 goto nla_put_failure; 1564 } 1565 CMD(start_p2p_device, START_P2P_DEVICE); 1566 CMD(set_mcast_rate, SET_MCAST_RATE); 1567 #ifdef CONFIG_NL80211_TESTMODE 1568 CMD(testmode_cmd, TESTMODE); 1569 #endif 1570 1571 if (rdev->ops->connect || rdev->ops->auth) { 1572 i++; 1573 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT)) 1574 goto nla_put_failure; 1575 } 1576 1577 if (rdev->ops->disconnect || rdev->ops->deauth) { 1578 i++; 1579 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT)) 1580 goto nla_put_failure; 1581 } 1582 1583 return i; 1584 nla_put_failure: 1585 return -ENOBUFS; 1586 } 1587 1588 struct nl80211_dump_wiphy_state { 1589 s64 filter_wiphy; 1590 long start; 1591 long split_start, band_start, chan_start, capa_start; 1592 bool split; 1593 }; 1594 1595 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev, 1596 enum nl80211_commands cmd, 1597 struct sk_buff *msg, u32 portid, u32 seq, 1598 int flags, struct nl80211_dump_wiphy_state *state) 1599 { 1600 void *hdr; 1601 struct nlattr *nl_bands, *nl_band; 1602 struct nlattr *nl_freqs, *nl_freq; 1603 struct nlattr *nl_cmds; 1604 enum nl80211_band band; 1605 struct ieee80211_channel *chan; 1606 int i; 1607 const struct ieee80211_txrx_stypes *mgmt_stypes = 1608 rdev->wiphy.mgmt_stypes; 1609 u32 features; 1610 1611 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 1612 if (!hdr) 1613 return -ENOBUFS; 1614 1615 if (WARN_ON(!state)) 1616 return -EINVAL; 1617 1618 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 1619 nla_put_string(msg, NL80211_ATTR_WIPHY_NAME, 1620 wiphy_name(&rdev->wiphy)) || 1621 nla_put_u32(msg, NL80211_ATTR_GENERATION, 1622 cfg80211_rdev_list_generation)) 1623 goto nla_put_failure; 1624 1625 if (cmd != NL80211_CMD_NEW_WIPHY) 1626 goto finish; 1627 1628 switch (state->split_start) { 1629 case 0: 1630 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT, 1631 rdev->wiphy.retry_short) || 1632 nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG, 1633 rdev->wiphy.retry_long) || 1634 nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD, 1635 rdev->wiphy.frag_threshold) || 1636 nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD, 1637 rdev->wiphy.rts_threshold) || 1638 nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS, 1639 rdev->wiphy.coverage_class) || 1640 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS, 1641 rdev->wiphy.max_scan_ssids) || 1642 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS, 1643 rdev->wiphy.max_sched_scan_ssids) || 1644 nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN, 1645 rdev->wiphy.max_scan_ie_len) || 1646 nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN, 1647 rdev->wiphy.max_sched_scan_ie_len) || 1648 nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS, 1649 rdev->wiphy.max_match_sets) || 1650 nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS, 1651 rdev->wiphy.max_sched_scan_plans) || 1652 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL, 1653 rdev->wiphy.max_sched_scan_plan_interval) || 1654 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS, 1655 rdev->wiphy.max_sched_scan_plan_iterations)) 1656 goto nla_put_failure; 1657 1658 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) && 1659 nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN)) 1660 goto nla_put_failure; 1661 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) && 1662 nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH)) 1663 goto nla_put_failure; 1664 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) && 1665 nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD)) 1666 goto nla_put_failure; 1667 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) && 1668 nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT)) 1669 goto nla_put_failure; 1670 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) && 1671 nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT)) 1672 goto nla_put_failure; 1673 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) && 1674 nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP)) 1675 goto nla_put_failure; 1676 state->split_start++; 1677 if (state->split) 1678 break; 1679 case 1: 1680 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES, 1681 sizeof(u32) * rdev->wiphy.n_cipher_suites, 1682 rdev->wiphy.cipher_suites)) 1683 goto nla_put_failure; 1684 1685 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS, 1686 rdev->wiphy.max_num_pmkids)) 1687 goto nla_put_failure; 1688 1689 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) && 1690 nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE)) 1691 goto nla_put_failure; 1692 1693 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX, 1694 rdev->wiphy.available_antennas_tx) || 1695 nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX, 1696 rdev->wiphy.available_antennas_rx)) 1697 goto nla_put_failure; 1698 1699 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) && 1700 nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD, 1701 rdev->wiphy.probe_resp_offload)) 1702 goto nla_put_failure; 1703 1704 if ((rdev->wiphy.available_antennas_tx || 1705 rdev->wiphy.available_antennas_rx) && 1706 rdev->ops->get_antenna) { 1707 u32 tx_ant = 0, rx_ant = 0; 1708 int res; 1709 1710 res = rdev_get_antenna(rdev, &tx_ant, &rx_ant); 1711 if (!res) { 1712 if (nla_put_u32(msg, 1713 NL80211_ATTR_WIPHY_ANTENNA_TX, 1714 tx_ant) || 1715 nla_put_u32(msg, 1716 NL80211_ATTR_WIPHY_ANTENNA_RX, 1717 rx_ant)) 1718 goto nla_put_failure; 1719 } 1720 } 1721 1722 state->split_start++; 1723 if (state->split) 1724 break; 1725 case 2: 1726 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES, 1727 rdev->wiphy.interface_modes)) 1728 goto nla_put_failure; 1729 state->split_start++; 1730 if (state->split) 1731 break; 1732 case 3: 1733 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS); 1734 if (!nl_bands) 1735 goto nla_put_failure; 1736 1737 for (band = state->band_start; 1738 band < NUM_NL80211_BANDS; band++) { 1739 struct ieee80211_supported_band *sband; 1740 1741 sband = rdev->wiphy.bands[band]; 1742 1743 if (!sband) 1744 continue; 1745 1746 nl_band = nla_nest_start(msg, band); 1747 if (!nl_band) 1748 goto nla_put_failure; 1749 1750 switch (state->chan_start) { 1751 case 0: 1752 if (nl80211_send_band_rateinfo(msg, sband)) 1753 goto nla_put_failure; 1754 state->chan_start++; 1755 if (state->split) 1756 break; 1757 default: 1758 /* add frequencies */ 1759 nl_freqs = nla_nest_start( 1760 msg, NL80211_BAND_ATTR_FREQS); 1761 if (!nl_freqs) 1762 goto nla_put_failure; 1763 1764 for (i = state->chan_start - 1; 1765 i < sband->n_channels; 1766 i++) { 1767 nl_freq = nla_nest_start(msg, i); 1768 if (!nl_freq) 1769 goto nla_put_failure; 1770 1771 chan = &sband->channels[i]; 1772 1773 if (nl80211_msg_put_channel( 1774 msg, &rdev->wiphy, chan, 1775 state->split)) 1776 goto nla_put_failure; 1777 1778 nla_nest_end(msg, nl_freq); 1779 if (state->split) 1780 break; 1781 } 1782 if (i < sband->n_channels) 1783 state->chan_start = i + 2; 1784 else 1785 state->chan_start = 0; 1786 nla_nest_end(msg, nl_freqs); 1787 } 1788 1789 nla_nest_end(msg, nl_band); 1790 1791 if (state->split) { 1792 /* start again here */ 1793 if (state->chan_start) 1794 band--; 1795 break; 1796 } 1797 } 1798 nla_nest_end(msg, nl_bands); 1799 1800 if (band < NUM_NL80211_BANDS) 1801 state->band_start = band + 1; 1802 else 1803 state->band_start = 0; 1804 1805 /* if bands & channels are done, continue outside */ 1806 if (state->band_start == 0 && state->chan_start == 0) 1807 state->split_start++; 1808 if (state->split) 1809 break; 1810 case 4: 1811 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS); 1812 if (!nl_cmds) 1813 goto nla_put_failure; 1814 1815 i = nl80211_add_commands_unsplit(rdev, msg); 1816 if (i < 0) 1817 goto nla_put_failure; 1818 if (state->split) { 1819 CMD(crit_proto_start, CRIT_PROTOCOL_START); 1820 CMD(crit_proto_stop, CRIT_PROTOCOL_STOP); 1821 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH) 1822 CMD(channel_switch, CHANNEL_SWITCH); 1823 CMD(set_qos_map, SET_QOS_MAP); 1824 if (rdev->wiphy.features & 1825 NL80211_FEATURE_SUPPORTS_WMM_ADMISSION) 1826 CMD(add_tx_ts, ADD_TX_TS); 1827 CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST); 1828 CMD(update_connect_params, UPDATE_CONNECT_PARAMS); 1829 } 1830 #undef CMD 1831 1832 nla_nest_end(msg, nl_cmds); 1833 state->split_start++; 1834 if (state->split) 1835 break; 1836 case 5: 1837 if (rdev->ops->remain_on_channel && 1838 (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) && 1839 nla_put_u32(msg, 1840 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION, 1841 rdev->wiphy.max_remain_on_channel_duration)) 1842 goto nla_put_failure; 1843 1844 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) && 1845 nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK)) 1846 goto nla_put_failure; 1847 1848 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes)) 1849 goto nla_put_failure; 1850 state->split_start++; 1851 if (state->split) 1852 break; 1853 case 6: 1854 #ifdef CONFIG_PM 1855 if (nl80211_send_wowlan(msg, rdev, state->split)) 1856 goto nla_put_failure; 1857 state->split_start++; 1858 if (state->split) 1859 break; 1860 #else 1861 state->split_start++; 1862 #endif 1863 case 7: 1864 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES, 1865 rdev->wiphy.software_iftypes)) 1866 goto nla_put_failure; 1867 1868 if (nl80211_put_iface_combinations(&rdev->wiphy, msg, 1869 state->split)) 1870 goto nla_put_failure; 1871 1872 state->split_start++; 1873 if (state->split) 1874 break; 1875 case 8: 1876 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) && 1877 nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME, 1878 rdev->wiphy.ap_sme_capa)) 1879 goto nla_put_failure; 1880 1881 features = rdev->wiphy.features; 1882 /* 1883 * We can only add the per-channel limit information if the 1884 * dump is split, otherwise it makes it too big. Therefore 1885 * only advertise it in that case. 1886 */ 1887 if (state->split) 1888 features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS; 1889 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features)) 1890 goto nla_put_failure; 1891 1892 if (rdev->wiphy.ht_capa_mod_mask && 1893 nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK, 1894 sizeof(*rdev->wiphy.ht_capa_mod_mask), 1895 rdev->wiphy.ht_capa_mod_mask)) 1896 goto nla_put_failure; 1897 1898 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME && 1899 rdev->wiphy.max_acl_mac_addrs && 1900 nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX, 1901 rdev->wiphy.max_acl_mac_addrs)) 1902 goto nla_put_failure; 1903 1904 /* 1905 * Any information below this point is only available to 1906 * applications that can deal with it being split. This 1907 * helps ensure that newly added capabilities don't break 1908 * older tools by overrunning their buffers. 1909 * 1910 * We still increment split_start so that in the split 1911 * case we'll continue with more data in the next round, 1912 * but break unconditionally so unsplit data stops here. 1913 */ 1914 state->split_start++; 1915 break; 1916 case 9: 1917 if (rdev->wiphy.extended_capabilities && 1918 (nla_put(msg, NL80211_ATTR_EXT_CAPA, 1919 rdev->wiphy.extended_capabilities_len, 1920 rdev->wiphy.extended_capabilities) || 1921 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK, 1922 rdev->wiphy.extended_capabilities_len, 1923 rdev->wiphy.extended_capabilities_mask))) 1924 goto nla_put_failure; 1925 1926 if (rdev->wiphy.vht_capa_mod_mask && 1927 nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK, 1928 sizeof(*rdev->wiphy.vht_capa_mod_mask), 1929 rdev->wiphy.vht_capa_mod_mask)) 1930 goto nla_put_failure; 1931 1932 state->split_start++; 1933 break; 1934 case 10: 1935 if (nl80211_send_coalesce(msg, rdev)) 1936 goto nla_put_failure; 1937 1938 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) && 1939 (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) || 1940 nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ))) 1941 goto nla_put_failure; 1942 1943 if (rdev->wiphy.max_ap_assoc_sta && 1944 nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA, 1945 rdev->wiphy.max_ap_assoc_sta)) 1946 goto nla_put_failure; 1947 1948 state->split_start++; 1949 break; 1950 case 11: 1951 if (rdev->wiphy.n_vendor_commands) { 1952 const struct nl80211_vendor_cmd_info *info; 1953 struct nlattr *nested; 1954 1955 nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA); 1956 if (!nested) 1957 goto nla_put_failure; 1958 1959 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) { 1960 info = &rdev->wiphy.vendor_commands[i].info; 1961 if (nla_put(msg, i + 1, sizeof(*info), info)) 1962 goto nla_put_failure; 1963 } 1964 nla_nest_end(msg, nested); 1965 } 1966 1967 if (rdev->wiphy.n_vendor_events) { 1968 const struct nl80211_vendor_cmd_info *info; 1969 struct nlattr *nested; 1970 1971 nested = nla_nest_start(msg, 1972 NL80211_ATTR_VENDOR_EVENTS); 1973 if (!nested) 1974 goto nla_put_failure; 1975 1976 for (i = 0; i < rdev->wiphy.n_vendor_events; i++) { 1977 info = &rdev->wiphy.vendor_events[i]; 1978 if (nla_put(msg, i + 1, sizeof(*info), info)) 1979 goto nla_put_failure; 1980 } 1981 nla_nest_end(msg, nested); 1982 } 1983 state->split_start++; 1984 break; 1985 case 12: 1986 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH && 1987 nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS, 1988 rdev->wiphy.max_num_csa_counters)) 1989 goto nla_put_failure; 1990 1991 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED && 1992 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG)) 1993 goto nla_put_failure; 1994 1995 if (rdev->wiphy.max_sched_scan_reqs && 1996 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS, 1997 rdev->wiphy.max_sched_scan_reqs)) 1998 goto nla_put_failure; 1999 2000 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES, 2001 sizeof(rdev->wiphy.ext_features), 2002 rdev->wiphy.ext_features)) 2003 goto nla_put_failure; 2004 2005 if (rdev->wiphy.bss_select_support) { 2006 struct nlattr *nested; 2007 u32 bss_select_support = rdev->wiphy.bss_select_support; 2008 2009 nested = nla_nest_start(msg, NL80211_ATTR_BSS_SELECT); 2010 if (!nested) 2011 goto nla_put_failure; 2012 2013 i = 0; 2014 while (bss_select_support) { 2015 if ((bss_select_support & 1) && 2016 nla_put_flag(msg, i)) 2017 goto nla_put_failure; 2018 i++; 2019 bss_select_support >>= 1; 2020 } 2021 nla_nest_end(msg, nested); 2022 } 2023 2024 state->split_start++; 2025 break; 2026 case 13: 2027 if (rdev->wiphy.num_iftype_ext_capab && 2028 rdev->wiphy.iftype_ext_capab) { 2029 struct nlattr *nested_ext_capab, *nested; 2030 2031 nested = nla_nest_start(msg, 2032 NL80211_ATTR_IFTYPE_EXT_CAPA); 2033 if (!nested) 2034 goto nla_put_failure; 2035 2036 for (i = state->capa_start; 2037 i < rdev->wiphy.num_iftype_ext_capab; i++) { 2038 const struct wiphy_iftype_ext_capab *capab; 2039 2040 capab = &rdev->wiphy.iftype_ext_capab[i]; 2041 2042 nested_ext_capab = nla_nest_start(msg, i); 2043 if (!nested_ext_capab || 2044 nla_put_u32(msg, NL80211_ATTR_IFTYPE, 2045 capab->iftype) || 2046 nla_put(msg, NL80211_ATTR_EXT_CAPA, 2047 capab->extended_capabilities_len, 2048 capab->extended_capabilities) || 2049 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK, 2050 capab->extended_capabilities_len, 2051 capab->extended_capabilities_mask)) 2052 goto nla_put_failure; 2053 2054 nla_nest_end(msg, nested_ext_capab); 2055 if (state->split) 2056 break; 2057 } 2058 nla_nest_end(msg, nested); 2059 if (i < rdev->wiphy.num_iftype_ext_capab) { 2060 state->capa_start = i + 1; 2061 break; 2062 } 2063 } 2064 2065 if (nla_put_u32(msg, NL80211_ATTR_BANDS, 2066 rdev->wiphy.nan_supported_bands)) 2067 goto nla_put_failure; 2068 2069 if (wiphy_ext_feature_isset(&rdev->wiphy, 2070 NL80211_EXT_FEATURE_TXQS)) { 2071 struct cfg80211_txq_stats txqstats = {}; 2072 int res; 2073 2074 res = rdev_get_txq_stats(rdev, NULL, &txqstats); 2075 if (!res && 2076 !nl80211_put_txq_stats(msg, &txqstats, 2077 NL80211_ATTR_TXQ_STATS)) 2078 goto nla_put_failure; 2079 2080 if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT, 2081 rdev->wiphy.txq_limit)) 2082 goto nla_put_failure; 2083 if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT, 2084 rdev->wiphy.txq_memory_limit)) 2085 goto nla_put_failure; 2086 if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM, 2087 rdev->wiphy.txq_quantum)) 2088 goto nla_put_failure; 2089 } 2090 2091 /* done */ 2092 state->split_start = 0; 2093 break; 2094 } 2095 finish: 2096 genlmsg_end(msg, hdr); 2097 return 0; 2098 2099 nla_put_failure: 2100 genlmsg_cancel(msg, hdr); 2101 return -EMSGSIZE; 2102 } 2103 2104 static int nl80211_dump_wiphy_parse(struct sk_buff *skb, 2105 struct netlink_callback *cb, 2106 struct nl80211_dump_wiphy_state *state) 2107 { 2108 struct nlattr **tb = genl_family_attrbuf(&nl80211_fam); 2109 int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, tb, 2110 nl80211_fam.maxattr, nl80211_policy, NULL); 2111 /* ignore parse errors for backward compatibility */ 2112 if (ret) 2113 return 0; 2114 2115 state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP]; 2116 if (tb[NL80211_ATTR_WIPHY]) 2117 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]); 2118 if (tb[NL80211_ATTR_WDEV]) 2119 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32; 2120 if (tb[NL80211_ATTR_IFINDEX]) { 2121 struct net_device *netdev; 2122 struct cfg80211_registered_device *rdev; 2123 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]); 2124 2125 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx); 2126 if (!netdev) 2127 return -ENODEV; 2128 if (netdev->ieee80211_ptr) { 2129 rdev = wiphy_to_rdev( 2130 netdev->ieee80211_ptr->wiphy); 2131 state->filter_wiphy = rdev->wiphy_idx; 2132 } 2133 } 2134 2135 return 0; 2136 } 2137 2138 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb) 2139 { 2140 int idx = 0, ret; 2141 struct nl80211_dump_wiphy_state *state = (void *)cb->args[0]; 2142 struct cfg80211_registered_device *rdev; 2143 2144 rtnl_lock(); 2145 if (!state) { 2146 state = kzalloc(sizeof(*state), GFP_KERNEL); 2147 if (!state) { 2148 rtnl_unlock(); 2149 return -ENOMEM; 2150 } 2151 state->filter_wiphy = -1; 2152 ret = nl80211_dump_wiphy_parse(skb, cb, state); 2153 if (ret) { 2154 kfree(state); 2155 rtnl_unlock(); 2156 return ret; 2157 } 2158 cb->args[0] = (long)state; 2159 } 2160 2161 list_for_each_entry(rdev, &cfg80211_rdev_list, list) { 2162 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk))) 2163 continue; 2164 if (++idx <= state->start) 2165 continue; 2166 if (state->filter_wiphy != -1 && 2167 state->filter_wiphy != rdev->wiphy_idx) 2168 continue; 2169 /* attempt to fit multiple wiphy data chunks into the skb */ 2170 do { 2171 ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, 2172 skb, 2173 NETLINK_CB(cb->skb).portid, 2174 cb->nlh->nlmsg_seq, 2175 NLM_F_MULTI, state); 2176 if (ret < 0) { 2177 /* 2178 * If sending the wiphy data didn't fit (ENOBUFS 2179 * or EMSGSIZE returned), this SKB is still 2180 * empty (so it's not too big because another 2181 * wiphy dataset is already in the skb) and 2182 * we've not tried to adjust the dump allocation 2183 * yet ... then adjust the alloc size to be 2184 * bigger, and return 1 but with the empty skb. 2185 * This results in an empty message being RX'ed 2186 * in userspace, but that is ignored. 2187 * 2188 * We can then retry with the larger buffer. 2189 */ 2190 if ((ret == -ENOBUFS || ret == -EMSGSIZE) && 2191 !skb->len && !state->split && 2192 cb->min_dump_alloc < 4096) { 2193 cb->min_dump_alloc = 4096; 2194 state->split_start = 0; 2195 rtnl_unlock(); 2196 return 1; 2197 } 2198 idx--; 2199 break; 2200 } 2201 } while (state->split_start > 0); 2202 break; 2203 } 2204 rtnl_unlock(); 2205 2206 state->start = idx; 2207 2208 return skb->len; 2209 } 2210 2211 static int nl80211_dump_wiphy_done(struct netlink_callback *cb) 2212 { 2213 kfree((void *)cb->args[0]); 2214 return 0; 2215 } 2216 2217 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info) 2218 { 2219 struct sk_buff *msg; 2220 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 2221 struct nl80211_dump_wiphy_state state = {}; 2222 2223 msg = nlmsg_new(4096, GFP_KERNEL); 2224 if (!msg) 2225 return -ENOMEM; 2226 2227 if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg, 2228 info->snd_portid, info->snd_seq, 0, 2229 &state) < 0) { 2230 nlmsg_free(msg); 2231 return -ENOBUFS; 2232 } 2233 2234 return genlmsg_reply(msg, info); 2235 } 2236 2237 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = { 2238 [NL80211_TXQ_ATTR_QUEUE] = { .type = NLA_U8 }, 2239 [NL80211_TXQ_ATTR_TXOP] = { .type = NLA_U16 }, 2240 [NL80211_TXQ_ATTR_CWMIN] = { .type = NLA_U16 }, 2241 [NL80211_TXQ_ATTR_CWMAX] = { .type = NLA_U16 }, 2242 [NL80211_TXQ_ATTR_AIFS] = { .type = NLA_U8 }, 2243 }; 2244 2245 static int parse_txq_params(struct nlattr *tb[], 2246 struct ieee80211_txq_params *txq_params) 2247 { 2248 u8 ac; 2249 2250 if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] || 2251 !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] || 2252 !tb[NL80211_TXQ_ATTR_AIFS]) 2253 return -EINVAL; 2254 2255 ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]); 2256 txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]); 2257 txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]); 2258 txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]); 2259 txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]); 2260 2261 if (ac >= NL80211_NUM_ACS) 2262 return -EINVAL; 2263 txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS); 2264 return 0; 2265 } 2266 2267 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev) 2268 { 2269 /* 2270 * You can only set the channel explicitly for WDS interfaces, 2271 * all others have their channel managed via their respective 2272 * "establish a connection" command (connect, join, ...) 2273 * 2274 * For AP/GO and mesh mode, the channel can be set with the 2275 * channel userspace API, but is only stored and passed to the 2276 * low-level driver when the AP starts or the mesh is joined. 2277 * This is for backward compatibility, userspace can also give 2278 * the channel in the start-ap or join-mesh commands instead. 2279 * 2280 * Monitors are special as they are normally slaved to 2281 * whatever else is going on, so they have their own special 2282 * operation to set the monitor channel if possible. 2283 */ 2284 return !wdev || 2285 wdev->iftype == NL80211_IFTYPE_AP || 2286 wdev->iftype == NL80211_IFTYPE_MESH_POINT || 2287 wdev->iftype == NL80211_IFTYPE_MONITOR || 2288 wdev->iftype == NL80211_IFTYPE_P2P_GO; 2289 } 2290 2291 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev, 2292 struct genl_info *info, 2293 struct cfg80211_chan_def *chandef) 2294 { 2295 u32 control_freq; 2296 2297 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ]) 2298 return -EINVAL; 2299 2300 control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]); 2301 2302 chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq); 2303 chandef->width = NL80211_CHAN_WIDTH_20_NOHT; 2304 chandef->center_freq1 = control_freq; 2305 chandef->center_freq2 = 0; 2306 2307 /* Primary channel not allowed */ 2308 if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED) 2309 return -EINVAL; 2310 2311 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) { 2312 enum nl80211_channel_type chantype; 2313 2314 chantype = nla_get_u32( 2315 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]); 2316 2317 switch (chantype) { 2318 case NL80211_CHAN_NO_HT: 2319 case NL80211_CHAN_HT20: 2320 case NL80211_CHAN_HT40PLUS: 2321 case NL80211_CHAN_HT40MINUS: 2322 cfg80211_chandef_create(chandef, chandef->chan, 2323 chantype); 2324 /* user input for center_freq is incorrect */ 2325 if (info->attrs[NL80211_ATTR_CENTER_FREQ1] && 2326 chandef->center_freq1 != nla_get_u32( 2327 info->attrs[NL80211_ATTR_CENTER_FREQ1])) 2328 return -EINVAL; 2329 /* center_freq2 must be zero */ 2330 if (info->attrs[NL80211_ATTR_CENTER_FREQ2] && 2331 nla_get_u32(info->attrs[NL80211_ATTR_CENTER_FREQ2])) 2332 return -EINVAL; 2333 break; 2334 default: 2335 return -EINVAL; 2336 } 2337 } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) { 2338 chandef->width = 2339 nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]); 2340 if (info->attrs[NL80211_ATTR_CENTER_FREQ1]) 2341 chandef->center_freq1 = 2342 nla_get_u32( 2343 info->attrs[NL80211_ATTR_CENTER_FREQ1]); 2344 if (info->attrs[NL80211_ATTR_CENTER_FREQ2]) 2345 chandef->center_freq2 = 2346 nla_get_u32( 2347 info->attrs[NL80211_ATTR_CENTER_FREQ2]); 2348 } 2349 2350 if (!cfg80211_chandef_valid(chandef)) 2351 return -EINVAL; 2352 2353 if (!cfg80211_chandef_usable(&rdev->wiphy, chandef, 2354 IEEE80211_CHAN_DISABLED)) 2355 return -EINVAL; 2356 2357 if ((chandef->width == NL80211_CHAN_WIDTH_5 || 2358 chandef->width == NL80211_CHAN_WIDTH_10) && 2359 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) 2360 return -EINVAL; 2361 2362 return 0; 2363 } 2364 2365 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev, 2366 struct net_device *dev, 2367 struct genl_info *info) 2368 { 2369 struct cfg80211_chan_def chandef; 2370 int result; 2371 enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR; 2372 struct wireless_dev *wdev = NULL; 2373 2374 if (dev) 2375 wdev = dev->ieee80211_ptr; 2376 if (!nl80211_can_set_dev_channel(wdev)) 2377 return -EOPNOTSUPP; 2378 if (wdev) 2379 iftype = wdev->iftype; 2380 2381 result = nl80211_parse_chandef(rdev, info, &chandef); 2382 if (result) 2383 return result; 2384 2385 switch (iftype) { 2386 case NL80211_IFTYPE_AP: 2387 case NL80211_IFTYPE_P2P_GO: 2388 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef, 2389 iftype)) { 2390 result = -EINVAL; 2391 break; 2392 } 2393 if (wdev->beacon_interval) { 2394 if (!dev || !rdev->ops->set_ap_chanwidth || 2395 !(rdev->wiphy.features & 2396 NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) { 2397 result = -EBUSY; 2398 break; 2399 } 2400 2401 /* Only allow dynamic channel width changes */ 2402 if (chandef.chan != wdev->preset_chandef.chan) { 2403 result = -EBUSY; 2404 break; 2405 } 2406 result = rdev_set_ap_chanwidth(rdev, dev, &chandef); 2407 if (result) 2408 break; 2409 } 2410 wdev->preset_chandef = chandef; 2411 result = 0; 2412 break; 2413 case NL80211_IFTYPE_MESH_POINT: 2414 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef); 2415 break; 2416 case NL80211_IFTYPE_MONITOR: 2417 result = cfg80211_set_monitor_channel(rdev, &chandef); 2418 break; 2419 default: 2420 result = -EINVAL; 2421 } 2422 2423 return result; 2424 } 2425 2426 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info) 2427 { 2428 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 2429 struct net_device *netdev = info->user_ptr[1]; 2430 2431 return __nl80211_set_channel(rdev, netdev, info); 2432 } 2433 2434 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info) 2435 { 2436 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 2437 struct net_device *dev = info->user_ptr[1]; 2438 struct wireless_dev *wdev = dev->ieee80211_ptr; 2439 const u8 *bssid; 2440 2441 if (!info->attrs[NL80211_ATTR_MAC]) 2442 return -EINVAL; 2443 2444 if (netif_running(dev)) 2445 return -EBUSY; 2446 2447 if (!rdev->ops->set_wds_peer) 2448 return -EOPNOTSUPP; 2449 2450 if (wdev->iftype != NL80211_IFTYPE_WDS) 2451 return -EOPNOTSUPP; 2452 2453 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 2454 return rdev_set_wds_peer(rdev, dev, bssid); 2455 } 2456 2457 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info) 2458 { 2459 struct cfg80211_registered_device *rdev; 2460 struct net_device *netdev = NULL; 2461 struct wireless_dev *wdev; 2462 int result = 0, rem_txq_params = 0; 2463 struct nlattr *nl_txq_params; 2464 u32 changed; 2465 u8 retry_short = 0, retry_long = 0; 2466 u32 frag_threshold = 0, rts_threshold = 0; 2467 u8 coverage_class = 0; 2468 u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0; 2469 2470 ASSERT_RTNL(); 2471 2472 /* 2473 * Try to find the wiphy and netdev. Normally this 2474 * function shouldn't need the netdev, but this is 2475 * done for backward compatibility -- previously 2476 * setting the channel was done per wiphy, but now 2477 * it is per netdev. Previous userland like hostapd 2478 * also passed a netdev to set_wiphy, so that it is 2479 * possible to let that go to the right netdev! 2480 */ 2481 2482 if (info->attrs[NL80211_ATTR_IFINDEX]) { 2483 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]); 2484 2485 netdev = __dev_get_by_index(genl_info_net(info), ifindex); 2486 if (netdev && netdev->ieee80211_ptr) 2487 rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy); 2488 else 2489 netdev = NULL; 2490 } 2491 2492 if (!netdev) { 2493 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info), 2494 info->attrs); 2495 if (IS_ERR(rdev)) 2496 return PTR_ERR(rdev); 2497 wdev = NULL; 2498 netdev = NULL; 2499 result = 0; 2500 } else 2501 wdev = netdev->ieee80211_ptr; 2502 2503 /* 2504 * end workaround code, by now the rdev is available 2505 * and locked, and wdev may or may not be NULL. 2506 */ 2507 2508 if (info->attrs[NL80211_ATTR_WIPHY_NAME]) 2509 result = cfg80211_dev_rename( 2510 rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME])); 2511 2512 if (result) 2513 return result; 2514 2515 if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) { 2516 struct ieee80211_txq_params txq_params; 2517 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1]; 2518 2519 if (!rdev->ops->set_txq_params) 2520 return -EOPNOTSUPP; 2521 2522 if (!netdev) 2523 return -EINVAL; 2524 2525 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 2526 netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 2527 return -EINVAL; 2528 2529 if (!netif_running(netdev)) 2530 return -ENETDOWN; 2531 2532 nla_for_each_nested(nl_txq_params, 2533 info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS], 2534 rem_txq_params) { 2535 result = nla_parse_nested(tb, NL80211_TXQ_ATTR_MAX, 2536 nl_txq_params, 2537 txq_params_policy, 2538 info->extack); 2539 if (result) 2540 return result; 2541 result = parse_txq_params(tb, &txq_params); 2542 if (result) 2543 return result; 2544 2545 result = rdev_set_txq_params(rdev, netdev, 2546 &txq_params); 2547 if (result) 2548 return result; 2549 } 2550 } 2551 2552 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 2553 result = __nl80211_set_channel( 2554 rdev, 2555 nl80211_can_set_dev_channel(wdev) ? netdev : NULL, 2556 info); 2557 if (result) 2558 return result; 2559 } 2560 2561 if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) { 2562 struct wireless_dev *txp_wdev = wdev; 2563 enum nl80211_tx_power_setting type; 2564 int idx, mbm = 0; 2565 2566 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER)) 2567 txp_wdev = NULL; 2568 2569 if (!rdev->ops->set_tx_power) 2570 return -EOPNOTSUPP; 2571 2572 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING; 2573 type = nla_get_u32(info->attrs[idx]); 2574 2575 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] && 2576 (type != NL80211_TX_POWER_AUTOMATIC)) 2577 return -EINVAL; 2578 2579 if (type != NL80211_TX_POWER_AUTOMATIC) { 2580 idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL; 2581 mbm = nla_get_u32(info->attrs[idx]); 2582 } 2583 2584 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm); 2585 if (result) 2586 return result; 2587 } 2588 2589 if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] && 2590 info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) { 2591 u32 tx_ant, rx_ant; 2592 2593 if ((!rdev->wiphy.available_antennas_tx && 2594 !rdev->wiphy.available_antennas_rx) || 2595 !rdev->ops->set_antenna) 2596 return -EOPNOTSUPP; 2597 2598 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]); 2599 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]); 2600 2601 /* reject antenna configurations which don't match the 2602 * available antenna masks, except for the "all" mask */ 2603 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) || 2604 (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) 2605 return -EINVAL; 2606 2607 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx; 2608 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx; 2609 2610 result = rdev_set_antenna(rdev, tx_ant, rx_ant); 2611 if (result) 2612 return result; 2613 } 2614 2615 changed = 0; 2616 2617 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) { 2618 retry_short = nla_get_u8( 2619 info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]); 2620 if (retry_short == 0) 2621 return -EINVAL; 2622 2623 changed |= WIPHY_PARAM_RETRY_SHORT; 2624 } 2625 2626 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) { 2627 retry_long = nla_get_u8( 2628 info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]); 2629 if (retry_long == 0) 2630 return -EINVAL; 2631 2632 changed |= WIPHY_PARAM_RETRY_LONG; 2633 } 2634 2635 if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) { 2636 frag_threshold = nla_get_u32( 2637 info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]); 2638 if (frag_threshold < 256) 2639 return -EINVAL; 2640 2641 if (frag_threshold != (u32) -1) { 2642 /* 2643 * Fragments (apart from the last one) are required to 2644 * have even length. Make the fragmentation code 2645 * simpler by stripping LSB should someone try to use 2646 * odd threshold value. 2647 */ 2648 frag_threshold &= ~0x1; 2649 } 2650 changed |= WIPHY_PARAM_FRAG_THRESHOLD; 2651 } 2652 2653 if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) { 2654 rts_threshold = nla_get_u32( 2655 info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]); 2656 changed |= WIPHY_PARAM_RTS_THRESHOLD; 2657 } 2658 2659 if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) { 2660 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) 2661 return -EINVAL; 2662 2663 coverage_class = nla_get_u8( 2664 info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]); 2665 changed |= WIPHY_PARAM_COVERAGE_CLASS; 2666 } 2667 2668 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) { 2669 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION)) 2670 return -EOPNOTSUPP; 2671 2672 changed |= WIPHY_PARAM_DYN_ACK; 2673 } 2674 2675 if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) { 2676 if (!wiphy_ext_feature_isset(&rdev->wiphy, 2677 NL80211_EXT_FEATURE_TXQS)) 2678 return -EOPNOTSUPP; 2679 txq_limit = nla_get_u32( 2680 info->attrs[NL80211_ATTR_TXQ_LIMIT]); 2681 changed |= WIPHY_PARAM_TXQ_LIMIT; 2682 } 2683 2684 if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) { 2685 if (!wiphy_ext_feature_isset(&rdev->wiphy, 2686 NL80211_EXT_FEATURE_TXQS)) 2687 return -EOPNOTSUPP; 2688 txq_memory_limit = nla_get_u32( 2689 info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]); 2690 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT; 2691 } 2692 2693 if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) { 2694 if (!wiphy_ext_feature_isset(&rdev->wiphy, 2695 NL80211_EXT_FEATURE_TXQS)) 2696 return -EOPNOTSUPP; 2697 txq_quantum = nla_get_u32( 2698 info->attrs[NL80211_ATTR_TXQ_QUANTUM]); 2699 changed |= WIPHY_PARAM_TXQ_QUANTUM; 2700 } 2701 2702 if (changed) { 2703 u8 old_retry_short, old_retry_long; 2704 u32 old_frag_threshold, old_rts_threshold; 2705 u8 old_coverage_class; 2706 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum; 2707 2708 if (!rdev->ops->set_wiphy_params) 2709 return -EOPNOTSUPP; 2710 2711 old_retry_short = rdev->wiphy.retry_short; 2712 old_retry_long = rdev->wiphy.retry_long; 2713 old_frag_threshold = rdev->wiphy.frag_threshold; 2714 old_rts_threshold = rdev->wiphy.rts_threshold; 2715 old_coverage_class = rdev->wiphy.coverage_class; 2716 old_txq_limit = rdev->wiphy.txq_limit; 2717 old_txq_memory_limit = rdev->wiphy.txq_memory_limit; 2718 old_txq_quantum = rdev->wiphy.txq_quantum; 2719 2720 if (changed & WIPHY_PARAM_RETRY_SHORT) 2721 rdev->wiphy.retry_short = retry_short; 2722 if (changed & WIPHY_PARAM_RETRY_LONG) 2723 rdev->wiphy.retry_long = retry_long; 2724 if (changed & WIPHY_PARAM_FRAG_THRESHOLD) 2725 rdev->wiphy.frag_threshold = frag_threshold; 2726 if (changed & WIPHY_PARAM_RTS_THRESHOLD) 2727 rdev->wiphy.rts_threshold = rts_threshold; 2728 if (changed & WIPHY_PARAM_COVERAGE_CLASS) 2729 rdev->wiphy.coverage_class = coverage_class; 2730 if (changed & WIPHY_PARAM_TXQ_LIMIT) 2731 rdev->wiphy.txq_limit = txq_limit; 2732 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT) 2733 rdev->wiphy.txq_memory_limit = txq_memory_limit; 2734 if (changed & WIPHY_PARAM_TXQ_QUANTUM) 2735 rdev->wiphy.txq_quantum = txq_quantum; 2736 2737 result = rdev_set_wiphy_params(rdev, changed); 2738 if (result) { 2739 rdev->wiphy.retry_short = old_retry_short; 2740 rdev->wiphy.retry_long = old_retry_long; 2741 rdev->wiphy.frag_threshold = old_frag_threshold; 2742 rdev->wiphy.rts_threshold = old_rts_threshold; 2743 rdev->wiphy.coverage_class = old_coverage_class; 2744 rdev->wiphy.txq_limit = old_txq_limit; 2745 rdev->wiphy.txq_memory_limit = old_txq_memory_limit; 2746 rdev->wiphy.txq_quantum = old_txq_quantum; 2747 return result; 2748 } 2749 } 2750 return 0; 2751 } 2752 2753 static inline u64 wdev_id(struct wireless_dev *wdev) 2754 { 2755 return (u64)wdev->identifier | 2756 ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32); 2757 } 2758 2759 static int nl80211_send_chandef(struct sk_buff *msg, 2760 const struct cfg80211_chan_def *chandef) 2761 { 2762 if (WARN_ON(!cfg80211_chandef_valid(chandef))) 2763 return -EINVAL; 2764 2765 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, 2766 chandef->chan->center_freq)) 2767 return -ENOBUFS; 2768 switch (chandef->width) { 2769 case NL80211_CHAN_WIDTH_20_NOHT: 2770 case NL80211_CHAN_WIDTH_20: 2771 case NL80211_CHAN_WIDTH_40: 2772 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, 2773 cfg80211_get_chandef_type(chandef))) 2774 return -ENOBUFS; 2775 break; 2776 default: 2777 break; 2778 } 2779 if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width)) 2780 return -ENOBUFS; 2781 if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1)) 2782 return -ENOBUFS; 2783 if (chandef->center_freq2 && 2784 nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2)) 2785 return -ENOBUFS; 2786 return 0; 2787 } 2788 2789 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags, 2790 struct cfg80211_registered_device *rdev, 2791 struct wireless_dev *wdev, bool removal) 2792 { 2793 struct net_device *dev = wdev->netdev; 2794 u8 cmd = NL80211_CMD_NEW_INTERFACE; 2795 void *hdr; 2796 2797 if (removal) 2798 cmd = NL80211_CMD_DEL_INTERFACE; 2799 2800 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 2801 if (!hdr) 2802 return -1; 2803 2804 if (dev && 2805 (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 2806 nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name))) 2807 goto nla_put_failure; 2808 2809 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 2810 nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) || 2811 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 2812 NL80211_ATTR_PAD) || 2813 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) || 2814 nla_put_u32(msg, NL80211_ATTR_GENERATION, 2815 rdev->devlist_generation ^ 2816 (cfg80211_rdev_list_generation << 2)) || 2817 nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr)) 2818 goto nla_put_failure; 2819 2820 if (rdev->ops->get_channel) { 2821 int ret; 2822 struct cfg80211_chan_def chandef; 2823 2824 ret = rdev_get_channel(rdev, wdev, &chandef); 2825 if (ret == 0) { 2826 if (nl80211_send_chandef(msg, &chandef)) 2827 goto nla_put_failure; 2828 } 2829 } 2830 2831 if (rdev->ops->get_tx_power) { 2832 int dbm, ret; 2833 2834 ret = rdev_get_tx_power(rdev, wdev, &dbm); 2835 if (ret == 0 && 2836 nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL, 2837 DBM_TO_MBM(dbm))) 2838 goto nla_put_failure; 2839 } 2840 2841 wdev_lock(wdev); 2842 switch (wdev->iftype) { 2843 case NL80211_IFTYPE_AP: 2844 if (wdev->ssid_len && 2845 nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid)) 2846 goto nla_put_failure_locked; 2847 break; 2848 case NL80211_IFTYPE_STATION: 2849 case NL80211_IFTYPE_P2P_CLIENT: 2850 case NL80211_IFTYPE_ADHOC: { 2851 const u8 *ssid_ie; 2852 if (!wdev->current_bss) 2853 break; 2854 rcu_read_lock(); 2855 ssid_ie = ieee80211_bss_get_ie(&wdev->current_bss->pub, 2856 WLAN_EID_SSID); 2857 if (ssid_ie && 2858 nla_put(msg, NL80211_ATTR_SSID, ssid_ie[1], ssid_ie + 2)) 2859 goto nla_put_failure_rcu_locked; 2860 rcu_read_unlock(); 2861 break; 2862 } 2863 default: 2864 /* nothing */ 2865 break; 2866 } 2867 wdev_unlock(wdev); 2868 2869 if (rdev->ops->get_txq_stats) { 2870 struct cfg80211_txq_stats txqstats = {}; 2871 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats); 2872 2873 if (ret == 0 && 2874 !nl80211_put_txq_stats(msg, &txqstats, 2875 NL80211_ATTR_TXQ_STATS)) 2876 goto nla_put_failure; 2877 } 2878 2879 genlmsg_end(msg, hdr); 2880 return 0; 2881 2882 nla_put_failure_rcu_locked: 2883 rcu_read_unlock(); 2884 nla_put_failure_locked: 2885 wdev_unlock(wdev); 2886 nla_put_failure: 2887 genlmsg_cancel(msg, hdr); 2888 return -EMSGSIZE; 2889 } 2890 2891 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb) 2892 { 2893 int wp_idx = 0; 2894 int if_idx = 0; 2895 int wp_start = cb->args[0]; 2896 int if_start = cb->args[1]; 2897 int filter_wiphy = -1; 2898 struct cfg80211_registered_device *rdev; 2899 struct wireless_dev *wdev; 2900 int ret; 2901 2902 rtnl_lock(); 2903 if (!cb->args[2]) { 2904 struct nl80211_dump_wiphy_state state = { 2905 .filter_wiphy = -1, 2906 }; 2907 2908 ret = nl80211_dump_wiphy_parse(skb, cb, &state); 2909 if (ret) 2910 goto out_unlock; 2911 2912 filter_wiphy = state.filter_wiphy; 2913 2914 /* 2915 * if filtering, set cb->args[2] to +1 since 0 is the default 2916 * value needed to determine that parsing is necessary. 2917 */ 2918 if (filter_wiphy >= 0) 2919 cb->args[2] = filter_wiphy + 1; 2920 else 2921 cb->args[2] = -1; 2922 } else if (cb->args[2] > 0) { 2923 filter_wiphy = cb->args[2] - 1; 2924 } 2925 2926 list_for_each_entry(rdev, &cfg80211_rdev_list, list) { 2927 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk))) 2928 continue; 2929 if (wp_idx < wp_start) { 2930 wp_idx++; 2931 continue; 2932 } 2933 2934 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx) 2935 continue; 2936 2937 if_idx = 0; 2938 2939 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { 2940 if (if_idx < if_start) { 2941 if_idx++; 2942 continue; 2943 } 2944 if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid, 2945 cb->nlh->nlmsg_seq, NLM_F_MULTI, 2946 rdev, wdev, false) < 0) { 2947 goto out; 2948 } 2949 if_idx++; 2950 } 2951 2952 wp_idx++; 2953 } 2954 out: 2955 cb->args[0] = wp_idx; 2956 cb->args[1] = if_idx; 2957 2958 ret = skb->len; 2959 out_unlock: 2960 rtnl_unlock(); 2961 2962 return ret; 2963 } 2964 2965 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info) 2966 { 2967 struct sk_buff *msg; 2968 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 2969 struct wireless_dev *wdev = info->user_ptr[1]; 2970 2971 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 2972 if (!msg) 2973 return -ENOMEM; 2974 2975 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0, 2976 rdev, wdev, false) < 0) { 2977 nlmsg_free(msg); 2978 return -ENOBUFS; 2979 } 2980 2981 return genlmsg_reply(msg, info); 2982 } 2983 2984 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = { 2985 [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG }, 2986 [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG }, 2987 [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG }, 2988 [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG }, 2989 [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG }, 2990 [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG }, 2991 }; 2992 2993 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags) 2994 { 2995 struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1]; 2996 int flag; 2997 2998 *mntrflags = 0; 2999 3000 if (!nla) 3001 return -EINVAL; 3002 3003 if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX, nla, 3004 mntr_flags_policy, NULL)) 3005 return -EINVAL; 3006 3007 for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++) 3008 if (flags[flag]) 3009 *mntrflags |= (1<<flag); 3010 3011 *mntrflags |= MONITOR_FLAG_CHANGED; 3012 3013 return 0; 3014 } 3015 3016 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev, 3017 enum nl80211_iftype type, 3018 struct genl_info *info, 3019 struct vif_params *params) 3020 { 3021 bool change = false; 3022 int err; 3023 3024 if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) { 3025 if (type != NL80211_IFTYPE_MONITOR) 3026 return -EINVAL; 3027 3028 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS], 3029 ¶ms->flags); 3030 if (err) 3031 return err; 3032 3033 change = true; 3034 } 3035 3036 if (params->flags & MONITOR_FLAG_ACTIVE && 3037 !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR)) 3038 return -EOPNOTSUPP; 3039 3040 if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) { 3041 const u8 *mumimo_groups; 3042 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER; 3043 3044 if (type != NL80211_IFTYPE_MONITOR) 3045 return -EINVAL; 3046 3047 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag)) 3048 return -EOPNOTSUPP; 3049 3050 mumimo_groups = 3051 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]); 3052 3053 /* bits 0 and 63 are reserved and must be zero */ 3054 if ((mumimo_groups[0] & BIT(0)) || 3055 (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7))) 3056 return -EINVAL; 3057 3058 params->vht_mumimo_groups = mumimo_groups; 3059 change = true; 3060 } 3061 3062 if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) { 3063 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER; 3064 3065 if (type != NL80211_IFTYPE_MONITOR) 3066 return -EINVAL; 3067 3068 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag)) 3069 return -EOPNOTSUPP; 3070 3071 params->vht_mumimo_follow_addr = 3072 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]); 3073 change = true; 3074 } 3075 3076 return change ? 1 : 0; 3077 } 3078 3079 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev, 3080 struct net_device *netdev, u8 use_4addr, 3081 enum nl80211_iftype iftype) 3082 { 3083 if (!use_4addr) { 3084 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT)) 3085 return -EBUSY; 3086 return 0; 3087 } 3088 3089 switch (iftype) { 3090 case NL80211_IFTYPE_AP_VLAN: 3091 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP) 3092 return 0; 3093 break; 3094 case NL80211_IFTYPE_STATION: 3095 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION) 3096 return 0; 3097 break; 3098 default: 3099 break; 3100 } 3101 3102 return -EOPNOTSUPP; 3103 } 3104 3105 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info) 3106 { 3107 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3108 struct vif_params params; 3109 int err; 3110 enum nl80211_iftype otype, ntype; 3111 struct net_device *dev = info->user_ptr[1]; 3112 bool change = false; 3113 3114 memset(¶ms, 0, sizeof(params)); 3115 3116 otype = ntype = dev->ieee80211_ptr->iftype; 3117 3118 if (info->attrs[NL80211_ATTR_IFTYPE]) { 3119 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]); 3120 if (otype != ntype) 3121 change = true; 3122 if (ntype > NL80211_IFTYPE_MAX) 3123 return -EINVAL; 3124 } 3125 3126 if (info->attrs[NL80211_ATTR_MESH_ID]) { 3127 struct wireless_dev *wdev = dev->ieee80211_ptr; 3128 3129 if (ntype != NL80211_IFTYPE_MESH_POINT) 3130 return -EINVAL; 3131 if (netif_running(dev)) 3132 return -EBUSY; 3133 3134 wdev_lock(wdev); 3135 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN != 3136 IEEE80211_MAX_MESH_ID_LEN); 3137 wdev->mesh_id_up_len = 3138 nla_len(info->attrs[NL80211_ATTR_MESH_ID]); 3139 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]), 3140 wdev->mesh_id_up_len); 3141 wdev_unlock(wdev); 3142 } 3143 3144 if (info->attrs[NL80211_ATTR_4ADDR]) { 3145 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]); 3146 change = true; 3147 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype); 3148 if (err) 3149 return err; 3150 } else { 3151 params.use_4addr = -1; 3152 } 3153 3154 err = nl80211_parse_mon_options(rdev, ntype, info, ¶ms); 3155 if (err < 0) 3156 return err; 3157 if (err > 0) 3158 change = true; 3159 3160 if (change) 3161 err = cfg80211_change_iface(rdev, dev, ntype, ¶ms); 3162 else 3163 err = 0; 3164 3165 if (!err && params.use_4addr != -1) 3166 dev->ieee80211_ptr->use_4addr = params.use_4addr; 3167 3168 return err; 3169 } 3170 3171 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info) 3172 { 3173 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3174 struct vif_params params; 3175 struct wireless_dev *wdev; 3176 struct sk_buff *msg; 3177 int err; 3178 enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED; 3179 3180 /* to avoid failing a new interface creation due to pending removal */ 3181 cfg80211_destroy_ifaces(rdev); 3182 3183 memset(¶ms, 0, sizeof(params)); 3184 3185 if (!info->attrs[NL80211_ATTR_IFNAME]) 3186 return -EINVAL; 3187 3188 if (info->attrs[NL80211_ATTR_IFTYPE]) { 3189 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]); 3190 if (type > NL80211_IFTYPE_MAX) 3191 return -EINVAL; 3192 } 3193 3194 if (!rdev->ops->add_virtual_intf || 3195 !(rdev->wiphy.interface_modes & (1 << type))) 3196 return -EOPNOTSUPP; 3197 3198 if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN || 3199 rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) && 3200 info->attrs[NL80211_ATTR_MAC]) { 3201 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC], 3202 ETH_ALEN); 3203 if (!is_valid_ether_addr(params.macaddr)) 3204 return -EADDRNOTAVAIL; 3205 } 3206 3207 if (info->attrs[NL80211_ATTR_4ADDR]) { 3208 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]); 3209 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type); 3210 if (err) 3211 return err; 3212 } 3213 3214 err = nl80211_parse_mon_options(rdev, type, info, ¶ms); 3215 if (err < 0) 3216 return err; 3217 3218 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 3219 if (!msg) 3220 return -ENOMEM; 3221 3222 wdev = rdev_add_virtual_intf(rdev, 3223 nla_data(info->attrs[NL80211_ATTR_IFNAME]), 3224 NET_NAME_USER, type, ¶ms); 3225 if (WARN_ON(!wdev)) { 3226 nlmsg_free(msg); 3227 return -EPROTO; 3228 } else if (IS_ERR(wdev)) { 3229 nlmsg_free(msg); 3230 return PTR_ERR(wdev); 3231 } 3232 3233 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 3234 wdev->owner_nlportid = info->snd_portid; 3235 3236 switch (type) { 3237 case NL80211_IFTYPE_MESH_POINT: 3238 if (!info->attrs[NL80211_ATTR_MESH_ID]) 3239 break; 3240 wdev_lock(wdev); 3241 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN != 3242 IEEE80211_MAX_MESH_ID_LEN); 3243 wdev->mesh_id_up_len = 3244 nla_len(info->attrs[NL80211_ATTR_MESH_ID]); 3245 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]), 3246 wdev->mesh_id_up_len); 3247 wdev_unlock(wdev); 3248 break; 3249 case NL80211_IFTYPE_NAN: 3250 case NL80211_IFTYPE_P2P_DEVICE: 3251 /* 3252 * P2P Device and NAN do not have a netdev, so don't go 3253 * through the netdev notifier and must be added here 3254 */ 3255 mutex_init(&wdev->mtx); 3256 INIT_LIST_HEAD(&wdev->event_list); 3257 spin_lock_init(&wdev->event_lock); 3258 INIT_LIST_HEAD(&wdev->mgmt_registrations); 3259 spin_lock_init(&wdev->mgmt_registrations_lock); 3260 3261 wdev->identifier = ++rdev->wdev_id; 3262 list_add_rcu(&wdev->list, &rdev->wiphy.wdev_list); 3263 rdev->devlist_generation++; 3264 break; 3265 default: 3266 break; 3267 } 3268 3269 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0, 3270 rdev, wdev, false) < 0) { 3271 nlmsg_free(msg); 3272 return -ENOBUFS; 3273 } 3274 3275 /* 3276 * For wdevs which have no associated netdev object (e.g. of type 3277 * NL80211_IFTYPE_P2P_DEVICE), emit the NEW_INTERFACE event here. 3278 * For all other types, the event will be generated from the 3279 * netdev notifier 3280 */ 3281 if (!wdev->netdev) 3282 nl80211_notify_iface(rdev, wdev, NL80211_CMD_NEW_INTERFACE); 3283 3284 return genlmsg_reply(msg, info); 3285 } 3286 3287 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info) 3288 { 3289 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3290 struct wireless_dev *wdev = info->user_ptr[1]; 3291 3292 if (!rdev->ops->del_virtual_intf) 3293 return -EOPNOTSUPP; 3294 3295 /* 3296 * If we remove a wireless device without a netdev then clear 3297 * user_ptr[1] so that nl80211_post_doit won't dereference it 3298 * to check if it needs to do dev_put(). Otherwise it crashes 3299 * since the wdev has been freed, unlike with a netdev where 3300 * we need the dev_put() for the netdev to really be freed. 3301 */ 3302 if (!wdev->netdev) 3303 info->user_ptr[1] = NULL; 3304 3305 return rdev_del_virtual_intf(rdev, wdev); 3306 } 3307 3308 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info) 3309 { 3310 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3311 struct net_device *dev = info->user_ptr[1]; 3312 u16 noack_map; 3313 3314 if (!info->attrs[NL80211_ATTR_NOACK_MAP]) 3315 return -EINVAL; 3316 3317 if (!rdev->ops->set_noack_map) 3318 return -EOPNOTSUPP; 3319 3320 noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]); 3321 3322 return rdev_set_noack_map(rdev, dev, noack_map); 3323 } 3324 3325 struct get_key_cookie { 3326 struct sk_buff *msg; 3327 int error; 3328 int idx; 3329 }; 3330 3331 static void get_key_callback(void *c, struct key_params *params) 3332 { 3333 struct nlattr *key; 3334 struct get_key_cookie *cookie = c; 3335 3336 if ((params->key && 3337 nla_put(cookie->msg, NL80211_ATTR_KEY_DATA, 3338 params->key_len, params->key)) || 3339 (params->seq && 3340 nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ, 3341 params->seq_len, params->seq)) || 3342 (params->cipher && 3343 nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER, 3344 params->cipher))) 3345 goto nla_put_failure; 3346 3347 key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY); 3348 if (!key) 3349 goto nla_put_failure; 3350 3351 if ((params->key && 3352 nla_put(cookie->msg, NL80211_KEY_DATA, 3353 params->key_len, params->key)) || 3354 (params->seq && 3355 nla_put(cookie->msg, NL80211_KEY_SEQ, 3356 params->seq_len, params->seq)) || 3357 (params->cipher && 3358 nla_put_u32(cookie->msg, NL80211_KEY_CIPHER, 3359 params->cipher))) 3360 goto nla_put_failure; 3361 3362 if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx)) 3363 goto nla_put_failure; 3364 3365 nla_nest_end(cookie->msg, key); 3366 3367 return; 3368 nla_put_failure: 3369 cookie->error = 1; 3370 } 3371 3372 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info) 3373 { 3374 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3375 int err; 3376 struct net_device *dev = info->user_ptr[1]; 3377 u8 key_idx = 0; 3378 const u8 *mac_addr = NULL; 3379 bool pairwise; 3380 struct get_key_cookie cookie = { 3381 .error = 0, 3382 }; 3383 void *hdr; 3384 struct sk_buff *msg; 3385 3386 if (info->attrs[NL80211_ATTR_KEY_IDX]) 3387 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]); 3388 3389 if (key_idx > 5) 3390 return -EINVAL; 3391 3392 if (info->attrs[NL80211_ATTR_MAC]) 3393 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 3394 3395 pairwise = !!mac_addr; 3396 if (info->attrs[NL80211_ATTR_KEY_TYPE]) { 3397 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]); 3398 3399 if (kt >= NUM_NL80211_KEYTYPES) 3400 return -EINVAL; 3401 if (kt != NL80211_KEYTYPE_GROUP && 3402 kt != NL80211_KEYTYPE_PAIRWISE) 3403 return -EINVAL; 3404 pairwise = kt == NL80211_KEYTYPE_PAIRWISE; 3405 } 3406 3407 if (!rdev->ops->get_key) 3408 return -EOPNOTSUPP; 3409 3410 if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)) 3411 return -ENOENT; 3412 3413 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 3414 if (!msg) 3415 return -ENOMEM; 3416 3417 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 3418 NL80211_CMD_NEW_KEY); 3419 if (!hdr) 3420 goto nla_put_failure; 3421 3422 cookie.msg = msg; 3423 cookie.idx = key_idx; 3424 3425 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 3426 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx)) 3427 goto nla_put_failure; 3428 if (mac_addr && 3429 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr)) 3430 goto nla_put_failure; 3431 3432 err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie, 3433 get_key_callback); 3434 3435 if (err) 3436 goto free_msg; 3437 3438 if (cookie.error) 3439 goto nla_put_failure; 3440 3441 genlmsg_end(msg, hdr); 3442 return genlmsg_reply(msg, info); 3443 3444 nla_put_failure: 3445 err = -ENOBUFS; 3446 free_msg: 3447 nlmsg_free(msg); 3448 return err; 3449 } 3450 3451 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info) 3452 { 3453 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3454 struct key_parse key; 3455 int err; 3456 struct net_device *dev = info->user_ptr[1]; 3457 3458 err = nl80211_parse_key(info, &key); 3459 if (err) 3460 return err; 3461 3462 if (key.idx < 0) 3463 return -EINVAL; 3464 3465 /* only support setting default key */ 3466 if (!key.def && !key.defmgmt) 3467 return -EINVAL; 3468 3469 wdev_lock(dev->ieee80211_ptr); 3470 3471 if (key.def) { 3472 if (!rdev->ops->set_default_key) { 3473 err = -EOPNOTSUPP; 3474 goto out; 3475 } 3476 3477 err = nl80211_key_allowed(dev->ieee80211_ptr); 3478 if (err) 3479 goto out; 3480 3481 err = rdev_set_default_key(rdev, dev, key.idx, 3482 key.def_uni, key.def_multi); 3483 3484 if (err) 3485 goto out; 3486 3487 #ifdef CONFIG_CFG80211_WEXT 3488 dev->ieee80211_ptr->wext.default_key = key.idx; 3489 #endif 3490 } else { 3491 if (key.def_uni || !key.def_multi) { 3492 err = -EINVAL; 3493 goto out; 3494 } 3495 3496 if (!rdev->ops->set_default_mgmt_key) { 3497 err = -EOPNOTSUPP; 3498 goto out; 3499 } 3500 3501 err = nl80211_key_allowed(dev->ieee80211_ptr); 3502 if (err) 3503 goto out; 3504 3505 err = rdev_set_default_mgmt_key(rdev, dev, key.idx); 3506 if (err) 3507 goto out; 3508 3509 #ifdef CONFIG_CFG80211_WEXT 3510 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx; 3511 #endif 3512 } 3513 3514 out: 3515 wdev_unlock(dev->ieee80211_ptr); 3516 3517 return err; 3518 } 3519 3520 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info) 3521 { 3522 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3523 int err; 3524 struct net_device *dev = info->user_ptr[1]; 3525 struct key_parse key; 3526 const u8 *mac_addr = NULL; 3527 3528 err = nl80211_parse_key(info, &key); 3529 if (err) 3530 return err; 3531 3532 if (!key.p.key) 3533 return -EINVAL; 3534 3535 if (info->attrs[NL80211_ATTR_MAC]) 3536 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 3537 3538 if (key.type == -1) { 3539 if (mac_addr) 3540 key.type = NL80211_KEYTYPE_PAIRWISE; 3541 else 3542 key.type = NL80211_KEYTYPE_GROUP; 3543 } 3544 3545 /* for now */ 3546 if (key.type != NL80211_KEYTYPE_PAIRWISE && 3547 key.type != NL80211_KEYTYPE_GROUP) 3548 return -EINVAL; 3549 3550 if (!rdev->ops->add_key) 3551 return -EOPNOTSUPP; 3552 3553 if (cfg80211_validate_key_settings(rdev, &key.p, key.idx, 3554 key.type == NL80211_KEYTYPE_PAIRWISE, 3555 mac_addr)) 3556 return -EINVAL; 3557 3558 wdev_lock(dev->ieee80211_ptr); 3559 err = nl80211_key_allowed(dev->ieee80211_ptr); 3560 if (!err) 3561 err = rdev_add_key(rdev, dev, key.idx, 3562 key.type == NL80211_KEYTYPE_PAIRWISE, 3563 mac_addr, &key.p); 3564 wdev_unlock(dev->ieee80211_ptr); 3565 3566 return err; 3567 } 3568 3569 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info) 3570 { 3571 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3572 int err; 3573 struct net_device *dev = info->user_ptr[1]; 3574 u8 *mac_addr = NULL; 3575 struct key_parse key; 3576 3577 err = nl80211_parse_key(info, &key); 3578 if (err) 3579 return err; 3580 3581 if (info->attrs[NL80211_ATTR_MAC]) 3582 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 3583 3584 if (key.type == -1) { 3585 if (mac_addr) 3586 key.type = NL80211_KEYTYPE_PAIRWISE; 3587 else 3588 key.type = NL80211_KEYTYPE_GROUP; 3589 } 3590 3591 /* for now */ 3592 if (key.type != NL80211_KEYTYPE_PAIRWISE && 3593 key.type != NL80211_KEYTYPE_GROUP) 3594 return -EINVAL; 3595 3596 if (!rdev->ops->del_key) 3597 return -EOPNOTSUPP; 3598 3599 wdev_lock(dev->ieee80211_ptr); 3600 err = nl80211_key_allowed(dev->ieee80211_ptr); 3601 3602 if (key.type == NL80211_KEYTYPE_GROUP && mac_addr && 3603 !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)) 3604 err = -ENOENT; 3605 3606 if (!err) 3607 err = rdev_del_key(rdev, dev, key.idx, 3608 key.type == NL80211_KEYTYPE_PAIRWISE, 3609 mac_addr); 3610 3611 #ifdef CONFIG_CFG80211_WEXT 3612 if (!err) { 3613 if (key.idx == dev->ieee80211_ptr->wext.default_key) 3614 dev->ieee80211_ptr->wext.default_key = -1; 3615 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key) 3616 dev->ieee80211_ptr->wext.default_mgmt_key = -1; 3617 } 3618 #endif 3619 wdev_unlock(dev->ieee80211_ptr); 3620 3621 return err; 3622 } 3623 3624 /* This function returns an error or the number of nested attributes */ 3625 static int validate_acl_mac_addrs(struct nlattr *nl_attr) 3626 { 3627 struct nlattr *attr; 3628 int n_entries = 0, tmp; 3629 3630 nla_for_each_nested(attr, nl_attr, tmp) { 3631 if (nla_len(attr) != ETH_ALEN) 3632 return -EINVAL; 3633 3634 n_entries++; 3635 } 3636 3637 return n_entries; 3638 } 3639 3640 /* 3641 * This function parses ACL information and allocates memory for ACL data. 3642 * On successful return, the calling function is responsible to free the 3643 * ACL buffer returned by this function. 3644 */ 3645 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy, 3646 struct genl_info *info) 3647 { 3648 enum nl80211_acl_policy acl_policy; 3649 struct nlattr *attr; 3650 struct cfg80211_acl_data *acl; 3651 int i = 0, n_entries, tmp; 3652 3653 if (!wiphy->max_acl_mac_addrs) 3654 return ERR_PTR(-EOPNOTSUPP); 3655 3656 if (!info->attrs[NL80211_ATTR_ACL_POLICY]) 3657 return ERR_PTR(-EINVAL); 3658 3659 acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]); 3660 if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED && 3661 acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED) 3662 return ERR_PTR(-EINVAL); 3663 3664 if (!info->attrs[NL80211_ATTR_MAC_ADDRS]) 3665 return ERR_PTR(-EINVAL); 3666 3667 n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]); 3668 if (n_entries < 0) 3669 return ERR_PTR(n_entries); 3670 3671 if (n_entries > wiphy->max_acl_mac_addrs) 3672 return ERR_PTR(-ENOTSUPP); 3673 3674 acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries), 3675 GFP_KERNEL); 3676 if (!acl) 3677 return ERR_PTR(-ENOMEM); 3678 3679 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) { 3680 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN); 3681 i++; 3682 } 3683 3684 acl->n_acl_entries = n_entries; 3685 acl->acl_policy = acl_policy; 3686 3687 return acl; 3688 } 3689 3690 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info) 3691 { 3692 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3693 struct net_device *dev = info->user_ptr[1]; 3694 struct cfg80211_acl_data *acl; 3695 int err; 3696 3697 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 3698 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 3699 return -EOPNOTSUPP; 3700 3701 if (!dev->ieee80211_ptr->beacon_interval) 3702 return -EINVAL; 3703 3704 acl = parse_acl_data(&rdev->wiphy, info); 3705 if (IS_ERR(acl)) 3706 return PTR_ERR(acl); 3707 3708 err = rdev_set_mac_acl(rdev, dev, acl); 3709 3710 kfree(acl); 3711 3712 return err; 3713 } 3714 3715 static u32 rateset_to_mask(struct ieee80211_supported_band *sband, 3716 u8 *rates, u8 rates_len) 3717 { 3718 u8 i; 3719 u32 mask = 0; 3720 3721 for (i = 0; i < rates_len; i++) { 3722 int rate = (rates[i] & 0x7f) * 5; 3723 int ridx; 3724 3725 for (ridx = 0; ridx < sband->n_bitrates; ridx++) { 3726 struct ieee80211_rate *srate = 3727 &sband->bitrates[ridx]; 3728 if (rate == srate->bitrate) { 3729 mask |= 1 << ridx; 3730 break; 3731 } 3732 } 3733 if (ridx == sband->n_bitrates) 3734 return 0; /* rate not found */ 3735 } 3736 3737 return mask; 3738 } 3739 3740 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband, 3741 u8 *rates, u8 rates_len, 3742 u8 mcs[IEEE80211_HT_MCS_MASK_LEN]) 3743 { 3744 u8 i; 3745 3746 memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN); 3747 3748 for (i = 0; i < rates_len; i++) { 3749 int ridx, rbit; 3750 3751 ridx = rates[i] / 8; 3752 rbit = BIT(rates[i] % 8); 3753 3754 /* check validity */ 3755 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN)) 3756 return false; 3757 3758 /* check availability */ 3759 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN); 3760 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit) 3761 mcs[ridx] |= rbit; 3762 else 3763 return false; 3764 } 3765 3766 return true; 3767 } 3768 3769 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map) 3770 { 3771 u16 mcs_mask = 0; 3772 3773 switch (vht_mcs_map) { 3774 case IEEE80211_VHT_MCS_NOT_SUPPORTED: 3775 break; 3776 case IEEE80211_VHT_MCS_SUPPORT_0_7: 3777 mcs_mask = 0x00FF; 3778 break; 3779 case IEEE80211_VHT_MCS_SUPPORT_0_8: 3780 mcs_mask = 0x01FF; 3781 break; 3782 case IEEE80211_VHT_MCS_SUPPORT_0_9: 3783 mcs_mask = 0x03FF; 3784 break; 3785 default: 3786 break; 3787 } 3788 3789 return mcs_mask; 3790 } 3791 3792 static void vht_build_mcs_mask(u16 vht_mcs_map, 3793 u16 vht_mcs_mask[NL80211_VHT_NSS_MAX]) 3794 { 3795 u8 nss; 3796 3797 for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) { 3798 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03); 3799 vht_mcs_map >>= 2; 3800 } 3801 } 3802 3803 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband, 3804 struct nl80211_txrate_vht *txrate, 3805 u16 mcs[NL80211_VHT_NSS_MAX]) 3806 { 3807 u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map); 3808 u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {}; 3809 u8 i; 3810 3811 if (!sband->vht_cap.vht_supported) 3812 return false; 3813 3814 memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX); 3815 3816 /* Build vht_mcs_mask from VHT capabilities */ 3817 vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask); 3818 3819 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) { 3820 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i]) 3821 mcs[i] = txrate->mcs[i]; 3822 else 3823 return false; 3824 } 3825 3826 return true; 3827 } 3828 3829 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = { 3830 [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY, 3831 .len = NL80211_MAX_SUPP_RATES }, 3832 [NL80211_TXRATE_HT] = { .type = NLA_BINARY, 3833 .len = NL80211_MAX_SUPP_HT_RATES }, 3834 [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)}, 3835 [NL80211_TXRATE_GI] = { .type = NLA_U8 }, 3836 }; 3837 3838 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info, 3839 struct cfg80211_bitrate_mask *mask) 3840 { 3841 struct nlattr *tb[NL80211_TXRATE_MAX + 1]; 3842 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3843 int rem, i; 3844 struct nlattr *tx_rates; 3845 struct ieee80211_supported_band *sband; 3846 u16 vht_tx_mcs_map; 3847 3848 memset(mask, 0, sizeof(*mask)); 3849 /* Default to all rates enabled */ 3850 for (i = 0; i < NUM_NL80211_BANDS; i++) { 3851 sband = rdev->wiphy.bands[i]; 3852 3853 if (!sband) 3854 continue; 3855 3856 mask->control[i].legacy = (1 << sband->n_bitrates) - 1; 3857 memcpy(mask->control[i].ht_mcs, 3858 sband->ht_cap.mcs.rx_mask, 3859 sizeof(mask->control[i].ht_mcs)); 3860 3861 if (!sband->vht_cap.vht_supported) 3862 continue; 3863 3864 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map); 3865 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs); 3866 } 3867 3868 /* if no rates are given set it back to the defaults */ 3869 if (!info->attrs[NL80211_ATTR_TX_RATES]) 3870 goto out; 3871 3872 /* The nested attribute uses enum nl80211_band as the index. This maps 3873 * directly to the enum nl80211_band values used in cfg80211. 3874 */ 3875 BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8); 3876 nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) { 3877 enum nl80211_band band = nla_type(tx_rates); 3878 int err; 3879 3880 if (band < 0 || band >= NUM_NL80211_BANDS) 3881 return -EINVAL; 3882 sband = rdev->wiphy.bands[band]; 3883 if (sband == NULL) 3884 return -EINVAL; 3885 err = nla_parse_nested(tb, NL80211_TXRATE_MAX, tx_rates, 3886 nl80211_txattr_policy, info->extack); 3887 if (err) 3888 return err; 3889 if (tb[NL80211_TXRATE_LEGACY]) { 3890 mask->control[band].legacy = rateset_to_mask( 3891 sband, 3892 nla_data(tb[NL80211_TXRATE_LEGACY]), 3893 nla_len(tb[NL80211_TXRATE_LEGACY])); 3894 if ((mask->control[band].legacy == 0) && 3895 nla_len(tb[NL80211_TXRATE_LEGACY])) 3896 return -EINVAL; 3897 } 3898 if (tb[NL80211_TXRATE_HT]) { 3899 if (!ht_rateset_to_mask( 3900 sband, 3901 nla_data(tb[NL80211_TXRATE_HT]), 3902 nla_len(tb[NL80211_TXRATE_HT]), 3903 mask->control[band].ht_mcs)) 3904 return -EINVAL; 3905 } 3906 if (tb[NL80211_TXRATE_VHT]) { 3907 if (!vht_set_mcs_mask( 3908 sband, 3909 nla_data(tb[NL80211_TXRATE_VHT]), 3910 mask->control[band].vht_mcs)) 3911 return -EINVAL; 3912 } 3913 if (tb[NL80211_TXRATE_GI]) { 3914 mask->control[band].gi = 3915 nla_get_u8(tb[NL80211_TXRATE_GI]); 3916 if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI) 3917 return -EINVAL; 3918 } 3919 3920 if (mask->control[band].legacy == 0) { 3921 /* don't allow empty legacy rates if HT or VHT 3922 * are not even supported. 3923 */ 3924 if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported || 3925 rdev->wiphy.bands[band]->vht_cap.vht_supported)) 3926 return -EINVAL; 3927 3928 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) 3929 if (mask->control[band].ht_mcs[i]) 3930 goto out; 3931 3932 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) 3933 if (mask->control[band].vht_mcs[i]) 3934 goto out; 3935 3936 /* legacy and mcs rates may not be both empty */ 3937 return -EINVAL; 3938 } 3939 } 3940 3941 out: 3942 return 0; 3943 } 3944 3945 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev, 3946 enum nl80211_band band, 3947 struct cfg80211_bitrate_mask *beacon_rate) 3948 { 3949 u32 count_ht, count_vht, i; 3950 u32 rate = beacon_rate->control[band].legacy; 3951 3952 /* Allow only one rate */ 3953 if (hweight32(rate) > 1) 3954 return -EINVAL; 3955 3956 count_ht = 0; 3957 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) { 3958 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) { 3959 return -EINVAL; 3960 } else if (beacon_rate->control[band].ht_mcs[i]) { 3961 count_ht++; 3962 if (count_ht > 1) 3963 return -EINVAL; 3964 } 3965 if (count_ht && rate) 3966 return -EINVAL; 3967 } 3968 3969 count_vht = 0; 3970 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) { 3971 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) { 3972 return -EINVAL; 3973 } else if (beacon_rate->control[band].vht_mcs[i]) { 3974 count_vht++; 3975 if (count_vht > 1) 3976 return -EINVAL; 3977 } 3978 if (count_vht && rate) 3979 return -EINVAL; 3980 } 3981 3982 if ((count_ht && count_vht) || (!rate && !count_ht && !count_vht)) 3983 return -EINVAL; 3984 3985 if (rate && 3986 !wiphy_ext_feature_isset(&rdev->wiphy, 3987 NL80211_EXT_FEATURE_BEACON_RATE_LEGACY)) 3988 return -EINVAL; 3989 if (count_ht && 3990 !wiphy_ext_feature_isset(&rdev->wiphy, 3991 NL80211_EXT_FEATURE_BEACON_RATE_HT)) 3992 return -EINVAL; 3993 if (count_vht && 3994 !wiphy_ext_feature_isset(&rdev->wiphy, 3995 NL80211_EXT_FEATURE_BEACON_RATE_VHT)) 3996 return -EINVAL; 3997 3998 return 0; 3999 } 4000 4001 static int nl80211_parse_beacon(struct nlattr *attrs[], 4002 struct cfg80211_beacon_data *bcn) 4003 { 4004 bool haveinfo = false; 4005 4006 if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) || 4007 !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) || 4008 !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) || 4009 !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP])) 4010 return -EINVAL; 4011 4012 memset(bcn, 0, sizeof(*bcn)); 4013 4014 if (attrs[NL80211_ATTR_BEACON_HEAD]) { 4015 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]); 4016 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]); 4017 if (!bcn->head_len) 4018 return -EINVAL; 4019 haveinfo = true; 4020 } 4021 4022 if (attrs[NL80211_ATTR_BEACON_TAIL]) { 4023 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]); 4024 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]); 4025 haveinfo = true; 4026 } 4027 4028 if (!haveinfo) 4029 return -EINVAL; 4030 4031 if (attrs[NL80211_ATTR_IE]) { 4032 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]); 4033 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]); 4034 } 4035 4036 if (attrs[NL80211_ATTR_IE_PROBE_RESP]) { 4037 bcn->proberesp_ies = 4038 nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]); 4039 bcn->proberesp_ies_len = 4040 nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]); 4041 } 4042 4043 if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) { 4044 bcn->assocresp_ies = 4045 nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]); 4046 bcn->assocresp_ies_len = 4047 nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]); 4048 } 4049 4050 if (attrs[NL80211_ATTR_PROBE_RESP]) { 4051 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]); 4052 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]); 4053 } 4054 4055 return 0; 4056 } 4057 4058 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params, 4059 const u8 *rates) 4060 { 4061 int i; 4062 4063 if (!rates) 4064 return; 4065 4066 for (i = 0; i < rates[1]; i++) { 4067 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY) 4068 params->ht_required = true; 4069 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY) 4070 params->vht_required = true; 4071 } 4072 } 4073 4074 /* 4075 * Since the nl80211 API didn't include, from the beginning, attributes about 4076 * HT/VHT requirements/capabilities, we parse them out of the IEs for the 4077 * benefit of drivers that rebuild IEs in the firmware. 4078 */ 4079 static void nl80211_calculate_ap_params(struct cfg80211_ap_settings *params) 4080 { 4081 const struct cfg80211_beacon_data *bcn = ¶ms->beacon; 4082 size_t ies_len = bcn->tail_len; 4083 const u8 *ies = bcn->tail; 4084 const u8 *rates; 4085 const u8 *cap; 4086 4087 rates = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies, ies_len); 4088 nl80211_check_ap_rate_selectors(params, rates); 4089 4090 rates = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, ies, ies_len); 4091 nl80211_check_ap_rate_selectors(params, rates); 4092 4093 cap = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies, ies_len); 4094 if (cap && cap[1] >= sizeof(*params->ht_cap)) 4095 params->ht_cap = (void *)(cap + 2); 4096 cap = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, ies, ies_len); 4097 if (cap && cap[1] >= sizeof(*params->vht_cap)) 4098 params->vht_cap = (void *)(cap + 2); 4099 cap = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len); 4100 if (cap && cap[1] >= sizeof(*params->he_cap) + 1) 4101 params->he_cap = (void *)(cap + 3); 4102 } 4103 4104 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev, 4105 struct cfg80211_ap_settings *params) 4106 { 4107 struct wireless_dev *wdev; 4108 bool ret = false; 4109 4110 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { 4111 if (wdev->iftype != NL80211_IFTYPE_AP && 4112 wdev->iftype != NL80211_IFTYPE_P2P_GO) 4113 continue; 4114 4115 if (!wdev->preset_chandef.chan) 4116 continue; 4117 4118 params->chandef = wdev->preset_chandef; 4119 ret = true; 4120 break; 4121 } 4122 4123 return ret; 4124 } 4125 4126 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev, 4127 enum nl80211_auth_type auth_type, 4128 enum nl80211_commands cmd) 4129 { 4130 if (auth_type > NL80211_AUTHTYPE_MAX) 4131 return false; 4132 4133 switch (cmd) { 4134 case NL80211_CMD_AUTHENTICATE: 4135 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) && 4136 auth_type == NL80211_AUTHTYPE_SAE) 4137 return false; 4138 if (!wiphy_ext_feature_isset(&rdev->wiphy, 4139 NL80211_EXT_FEATURE_FILS_STA) && 4140 (auth_type == NL80211_AUTHTYPE_FILS_SK || 4141 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 4142 auth_type == NL80211_AUTHTYPE_FILS_PK)) 4143 return false; 4144 return true; 4145 case NL80211_CMD_CONNECT: 4146 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) && 4147 auth_type == NL80211_AUTHTYPE_SAE) 4148 return false; 4149 4150 /* FILS with SK PFS or PK not supported yet */ 4151 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 4152 auth_type == NL80211_AUTHTYPE_FILS_PK) 4153 return false; 4154 if (!wiphy_ext_feature_isset( 4155 &rdev->wiphy, 4156 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) && 4157 auth_type == NL80211_AUTHTYPE_FILS_SK) 4158 return false; 4159 return true; 4160 case NL80211_CMD_START_AP: 4161 /* SAE not supported yet */ 4162 if (auth_type == NL80211_AUTHTYPE_SAE) 4163 return false; 4164 /* FILS not supported yet */ 4165 if (auth_type == NL80211_AUTHTYPE_FILS_SK || 4166 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 4167 auth_type == NL80211_AUTHTYPE_FILS_PK) 4168 return false; 4169 return true; 4170 default: 4171 return false; 4172 } 4173 } 4174 4175 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info) 4176 { 4177 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4178 struct net_device *dev = info->user_ptr[1]; 4179 struct wireless_dev *wdev = dev->ieee80211_ptr; 4180 struct cfg80211_ap_settings params; 4181 int err; 4182 4183 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 4184 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 4185 return -EOPNOTSUPP; 4186 4187 if (!rdev->ops->start_ap) 4188 return -EOPNOTSUPP; 4189 4190 if (wdev->beacon_interval) 4191 return -EALREADY; 4192 4193 memset(¶ms, 0, sizeof(params)); 4194 4195 /* these are required for START_AP */ 4196 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] || 4197 !info->attrs[NL80211_ATTR_DTIM_PERIOD] || 4198 !info->attrs[NL80211_ATTR_BEACON_HEAD]) 4199 return -EINVAL; 4200 4201 err = nl80211_parse_beacon(info->attrs, ¶ms.beacon); 4202 if (err) 4203 return err; 4204 4205 params.beacon_interval = 4206 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]); 4207 params.dtim_period = 4208 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]); 4209 4210 err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype, 4211 params.beacon_interval); 4212 if (err) 4213 return err; 4214 4215 /* 4216 * In theory, some of these attributes should be required here 4217 * but since they were not used when the command was originally 4218 * added, keep them optional for old user space programs to let 4219 * them continue to work with drivers that do not need the 4220 * additional information -- drivers must check! 4221 */ 4222 if (info->attrs[NL80211_ATTR_SSID]) { 4223 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 4224 params.ssid_len = 4225 nla_len(info->attrs[NL80211_ATTR_SSID]); 4226 if (params.ssid_len == 0 || 4227 params.ssid_len > IEEE80211_MAX_SSID_LEN) 4228 return -EINVAL; 4229 } 4230 4231 if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) { 4232 params.hidden_ssid = nla_get_u32( 4233 info->attrs[NL80211_ATTR_HIDDEN_SSID]); 4234 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE && 4235 params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN && 4236 params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS) 4237 return -EINVAL; 4238 } 4239 4240 params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY]; 4241 4242 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) { 4243 params.auth_type = nla_get_u32( 4244 info->attrs[NL80211_ATTR_AUTH_TYPE]); 4245 if (!nl80211_valid_auth_type(rdev, params.auth_type, 4246 NL80211_CMD_START_AP)) 4247 return -EINVAL; 4248 } else 4249 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC; 4250 4251 err = nl80211_crypto_settings(rdev, info, ¶ms.crypto, 4252 NL80211_MAX_NR_CIPHER_SUITES); 4253 if (err) 4254 return err; 4255 4256 if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) { 4257 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER)) 4258 return -EOPNOTSUPP; 4259 params.inactivity_timeout = nla_get_u16( 4260 info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]); 4261 } 4262 4263 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) { 4264 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 4265 return -EINVAL; 4266 params.p2p_ctwindow = 4267 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]); 4268 if (params.p2p_ctwindow > 127) 4269 return -EINVAL; 4270 if (params.p2p_ctwindow != 0 && 4271 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) 4272 return -EINVAL; 4273 } 4274 4275 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) { 4276 u8 tmp; 4277 4278 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 4279 return -EINVAL; 4280 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]); 4281 if (tmp > 1) 4282 return -EINVAL; 4283 params.p2p_opp_ps = tmp; 4284 if (params.p2p_opp_ps != 0 && 4285 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) 4286 return -EINVAL; 4287 } 4288 4289 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 4290 err = nl80211_parse_chandef(rdev, info, ¶ms.chandef); 4291 if (err) 4292 return err; 4293 } else if (wdev->preset_chandef.chan) { 4294 params.chandef = wdev->preset_chandef; 4295 } else if (!nl80211_get_ap_channel(rdev, ¶ms)) 4296 return -EINVAL; 4297 4298 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms.chandef, 4299 wdev->iftype)) 4300 return -EINVAL; 4301 4302 if (info->attrs[NL80211_ATTR_TX_RATES]) { 4303 err = nl80211_parse_tx_bitrate_mask(info, ¶ms.beacon_rate); 4304 if (err) 4305 return err; 4306 4307 err = validate_beacon_tx_rate(rdev, params.chandef.chan->band, 4308 ¶ms.beacon_rate); 4309 if (err) 4310 return err; 4311 } 4312 4313 if (info->attrs[NL80211_ATTR_SMPS_MODE]) { 4314 params.smps_mode = 4315 nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]); 4316 switch (params.smps_mode) { 4317 case NL80211_SMPS_OFF: 4318 break; 4319 case NL80211_SMPS_STATIC: 4320 if (!(rdev->wiphy.features & 4321 NL80211_FEATURE_STATIC_SMPS)) 4322 return -EINVAL; 4323 break; 4324 case NL80211_SMPS_DYNAMIC: 4325 if (!(rdev->wiphy.features & 4326 NL80211_FEATURE_DYNAMIC_SMPS)) 4327 return -EINVAL; 4328 break; 4329 default: 4330 return -EINVAL; 4331 } 4332 } else { 4333 params.smps_mode = NL80211_SMPS_OFF; 4334 } 4335 4336 params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]); 4337 if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) 4338 return -EOPNOTSUPP; 4339 4340 if (info->attrs[NL80211_ATTR_ACL_POLICY]) { 4341 params.acl = parse_acl_data(&rdev->wiphy, info); 4342 if (IS_ERR(params.acl)) 4343 return PTR_ERR(params.acl); 4344 } 4345 4346 nl80211_calculate_ap_params(¶ms); 4347 4348 wdev_lock(wdev); 4349 err = rdev_start_ap(rdev, dev, ¶ms); 4350 if (!err) { 4351 wdev->preset_chandef = params.chandef; 4352 wdev->beacon_interval = params.beacon_interval; 4353 wdev->chandef = params.chandef; 4354 wdev->ssid_len = params.ssid_len; 4355 memcpy(wdev->ssid, params.ssid, wdev->ssid_len); 4356 4357 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 4358 wdev->conn_owner_nlportid = info->snd_portid; 4359 } 4360 wdev_unlock(wdev); 4361 4362 kfree(params.acl); 4363 4364 return err; 4365 } 4366 4367 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info) 4368 { 4369 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4370 struct net_device *dev = info->user_ptr[1]; 4371 struct wireless_dev *wdev = dev->ieee80211_ptr; 4372 struct cfg80211_beacon_data params; 4373 int err; 4374 4375 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 4376 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 4377 return -EOPNOTSUPP; 4378 4379 if (!rdev->ops->change_beacon) 4380 return -EOPNOTSUPP; 4381 4382 if (!wdev->beacon_interval) 4383 return -EINVAL; 4384 4385 err = nl80211_parse_beacon(info->attrs, ¶ms); 4386 if (err) 4387 return err; 4388 4389 wdev_lock(wdev); 4390 err = rdev_change_beacon(rdev, dev, ¶ms); 4391 wdev_unlock(wdev); 4392 4393 return err; 4394 } 4395 4396 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info) 4397 { 4398 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4399 struct net_device *dev = info->user_ptr[1]; 4400 4401 return cfg80211_stop_ap(rdev, dev, false); 4402 } 4403 4404 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = { 4405 [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG }, 4406 [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG }, 4407 [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG }, 4408 [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG }, 4409 [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG }, 4410 [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG }, 4411 }; 4412 4413 static int parse_station_flags(struct genl_info *info, 4414 enum nl80211_iftype iftype, 4415 struct station_parameters *params) 4416 { 4417 struct nlattr *flags[NL80211_STA_FLAG_MAX + 1]; 4418 struct nlattr *nla; 4419 int flag; 4420 4421 /* 4422 * Try parsing the new attribute first so userspace 4423 * can specify both for older kernels. 4424 */ 4425 nla = info->attrs[NL80211_ATTR_STA_FLAGS2]; 4426 if (nla) { 4427 struct nl80211_sta_flag_update *sta_flags; 4428 4429 sta_flags = nla_data(nla); 4430 params->sta_flags_mask = sta_flags->mask; 4431 params->sta_flags_set = sta_flags->set; 4432 params->sta_flags_set &= params->sta_flags_mask; 4433 if ((params->sta_flags_mask | 4434 params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID)) 4435 return -EINVAL; 4436 return 0; 4437 } 4438 4439 /* if present, parse the old attribute */ 4440 4441 nla = info->attrs[NL80211_ATTR_STA_FLAGS]; 4442 if (!nla) 4443 return 0; 4444 4445 if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX, nla, 4446 sta_flags_policy, info->extack)) 4447 return -EINVAL; 4448 4449 /* 4450 * Only allow certain flags for interface types so that 4451 * other attributes are silently ignored. Remember that 4452 * this is backward compatibility code with old userspace 4453 * and shouldn't be hit in other cases anyway. 4454 */ 4455 switch (iftype) { 4456 case NL80211_IFTYPE_AP: 4457 case NL80211_IFTYPE_AP_VLAN: 4458 case NL80211_IFTYPE_P2P_GO: 4459 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) | 4460 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) | 4461 BIT(NL80211_STA_FLAG_WME) | 4462 BIT(NL80211_STA_FLAG_MFP); 4463 break; 4464 case NL80211_IFTYPE_P2P_CLIENT: 4465 case NL80211_IFTYPE_STATION: 4466 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) | 4467 BIT(NL80211_STA_FLAG_TDLS_PEER); 4468 break; 4469 case NL80211_IFTYPE_MESH_POINT: 4470 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) | 4471 BIT(NL80211_STA_FLAG_MFP) | 4472 BIT(NL80211_STA_FLAG_AUTHORIZED); 4473 break; 4474 default: 4475 return -EINVAL; 4476 } 4477 4478 for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) { 4479 if (flags[flag]) { 4480 params->sta_flags_set |= (1<<flag); 4481 4482 /* no longer support new API additions in old API */ 4483 if (flag > NL80211_STA_FLAG_MAX_OLD_API) 4484 return -EINVAL; 4485 } 4486 } 4487 4488 return 0; 4489 } 4490 4491 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, 4492 int attr) 4493 { 4494 struct nlattr *rate; 4495 u32 bitrate; 4496 u16 bitrate_compat; 4497 enum nl80211_rate_info rate_flg; 4498 4499 rate = nla_nest_start(msg, attr); 4500 if (!rate) 4501 return false; 4502 4503 /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */ 4504 bitrate = cfg80211_calculate_bitrate(info); 4505 /* report 16-bit bitrate only if we can */ 4506 bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0; 4507 if (bitrate > 0 && 4508 nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate)) 4509 return false; 4510 if (bitrate_compat > 0 && 4511 nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat)) 4512 return false; 4513 4514 switch (info->bw) { 4515 case RATE_INFO_BW_5: 4516 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH; 4517 break; 4518 case RATE_INFO_BW_10: 4519 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH; 4520 break; 4521 default: 4522 WARN_ON(1); 4523 /* fall through */ 4524 case RATE_INFO_BW_20: 4525 rate_flg = 0; 4526 break; 4527 case RATE_INFO_BW_40: 4528 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH; 4529 break; 4530 case RATE_INFO_BW_80: 4531 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH; 4532 break; 4533 case RATE_INFO_BW_160: 4534 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH; 4535 break; 4536 case RATE_INFO_BW_HE_RU: 4537 rate_flg = 0; 4538 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS)); 4539 } 4540 4541 if (rate_flg && nla_put_flag(msg, rate_flg)) 4542 return false; 4543 4544 if (info->flags & RATE_INFO_FLAGS_MCS) { 4545 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs)) 4546 return false; 4547 if (info->flags & RATE_INFO_FLAGS_SHORT_GI && 4548 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI)) 4549 return false; 4550 } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) { 4551 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs)) 4552 return false; 4553 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss)) 4554 return false; 4555 if (info->flags & RATE_INFO_FLAGS_SHORT_GI && 4556 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI)) 4557 return false; 4558 } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) { 4559 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs)) 4560 return false; 4561 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss)) 4562 return false; 4563 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi)) 4564 return false; 4565 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm)) 4566 return false; 4567 if (info->bw == RATE_INFO_BW_HE_RU && 4568 nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC, 4569 info->he_ru_alloc)) 4570 return false; 4571 } 4572 4573 nla_nest_end(msg, rate); 4574 return true; 4575 } 4576 4577 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal, 4578 int id) 4579 { 4580 void *attr; 4581 int i = 0; 4582 4583 if (!mask) 4584 return true; 4585 4586 attr = nla_nest_start(msg, id); 4587 if (!attr) 4588 return false; 4589 4590 for (i = 0; i < IEEE80211_MAX_CHAINS; i++) { 4591 if (!(mask & BIT(i))) 4592 continue; 4593 4594 if (nla_put_u8(msg, i, signal[i])) 4595 return false; 4596 } 4597 4598 nla_nest_end(msg, attr); 4599 4600 return true; 4601 } 4602 4603 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid, 4604 u32 seq, int flags, 4605 struct cfg80211_registered_device *rdev, 4606 struct net_device *dev, 4607 const u8 *mac_addr, struct station_info *sinfo) 4608 { 4609 void *hdr; 4610 struct nlattr *sinfoattr, *bss_param; 4611 4612 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 4613 if (!hdr) 4614 return -1; 4615 4616 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 4617 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) || 4618 nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation)) 4619 goto nla_put_failure; 4620 4621 sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO); 4622 if (!sinfoattr) 4623 goto nla_put_failure; 4624 4625 #define PUT_SINFO(attr, memb, type) do { \ 4626 BUILD_BUG_ON(sizeof(type) == sizeof(u64)); \ 4627 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \ 4628 nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr, \ 4629 sinfo->memb)) \ 4630 goto nla_put_failure; \ 4631 } while (0) 4632 #define PUT_SINFO_U64(attr, memb) do { \ 4633 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \ 4634 nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr, \ 4635 sinfo->memb, NL80211_STA_INFO_PAD)) \ 4636 goto nla_put_failure; \ 4637 } while (0) 4638 4639 PUT_SINFO(CONNECTED_TIME, connected_time, u32); 4640 PUT_SINFO(INACTIVE_TIME, inactive_time, u32); 4641 4642 if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) | 4643 BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) && 4644 nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES, 4645 (u32)sinfo->rx_bytes)) 4646 goto nla_put_failure; 4647 4648 if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) | 4649 BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) && 4650 nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES, 4651 (u32)sinfo->tx_bytes)) 4652 goto nla_put_failure; 4653 4654 PUT_SINFO_U64(RX_BYTES64, rx_bytes); 4655 PUT_SINFO_U64(TX_BYTES64, tx_bytes); 4656 PUT_SINFO(LLID, llid, u16); 4657 PUT_SINFO(PLID, plid, u16); 4658 PUT_SINFO(PLINK_STATE, plink_state, u8); 4659 PUT_SINFO_U64(RX_DURATION, rx_duration); 4660 4661 switch (rdev->wiphy.signal_type) { 4662 case CFG80211_SIGNAL_TYPE_MBM: 4663 PUT_SINFO(SIGNAL, signal, u8); 4664 PUT_SINFO(SIGNAL_AVG, signal_avg, u8); 4665 break; 4666 default: 4667 break; 4668 } 4669 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) { 4670 if (!nl80211_put_signal(msg, sinfo->chains, 4671 sinfo->chain_signal, 4672 NL80211_STA_INFO_CHAIN_SIGNAL)) 4673 goto nla_put_failure; 4674 } 4675 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) { 4676 if (!nl80211_put_signal(msg, sinfo->chains, 4677 sinfo->chain_signal_avg, 4678 NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) 4679 goto nla_put_failure; 4680 } 4681 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) { 4682 if (!nl80211_put_sta_rate(msg, &sinfo->txrate, 4683 NL80211_STA_INFO_TX_BITRATE)) 4684 goto nla_put_failure; 4685 } 4686 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) { 4687 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate, 4688 NL80211_STA_INFO_RX_BITRATE)) 4689 goto nla_put_failure; 4690 } 4691 4692 PUT_SINFO(RX_PACKETS, rx_packets, u32); 4693 PUT_SINFO(TX_PACKETS, tx_packets, u32); 4694 PUT_SINFO(TX_RETRIES, tx_retries, u32); 4695 PUT_SINFO(TX_FAILED, tx_failed, u32); 4696 PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32); 4697 PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32); 4698 PUT_SINFO(LOCAL_PM, local_pm, u32); 4699 PUT_SINFO(PEER_PM, peer_pm, u32); 4700 PUT_SINFO(NONPEER_PM, nonpeer_pm, u32); 4701 4702 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) { 4703 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM); 4704 if (!bss_param) 4705 goto nla_put_failure; 4706 4707 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) && 4708 nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) || 4709 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) && 4710 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) || 4711 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) && 4712 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) || 4713 nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD, 4714 sinfo->bss_param.dtim_period) || 4715 nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL, 4716 sinfo->bss_param.beacon_interval)) 4717 goto nla_put_failure; 4718 4719 nla_nest_end(msg, bss_param); 4720 } 4721 if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) && 4722 nla_put(msg, NL80211_STA_INFO_STA_FLAGS, 4723 sizeof(struct nl80211_sta_flag_update), 4724 &sinfo->sta_flags)) 4725 goto nla_put_failure; 4726 4727 PUT_SINFO_U64(T_OFFSET, t_offset); 4728 PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc); 4729 PUT_SINFO_U64(BEACON_RX, rx_beacon); 4730 PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8); 4731 if (wiphy_ext_feature_isset(&rdev->wiphy, 4732 NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) { 4733 PUT_SINFO(ACK_SIGNAL, ack_signal, u8); 4734 PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8); 4735 } 4736 4737 #undef PUT_SINFO 4738 #undef PUT_SINFO_U64 4739 4740 if (sinfo->pertid) { 4741 struct nlattr *tidsattr; 4742 int tid; 4743 4744 tidsattr = nla_nest_start(msg, NL80211_STA_INFO_TID_STATS); 4745 if (!tidsattr) 4746 goto nla_put_failure; 4747 4748 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) { 4749 struct cfg80211_tid_stats *tidstats; 4750 struct nlattr *tidattr; 4751 4752 tidstats = &sinfo->pertid[tid]; 4753 4754 if (!tidstats->filled) 4755 continue; 4756 4757 tidattr = nla_nest_start(msg, tid + 1); 4758 if (!tidattr) 4759 goto nla_put_failure; 4760 4761 #define PUT_TIDVAL_U64(attr, memb) do { \ 4762 if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) && \ 4763 nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr, \ 4764 tidstats->memb, NL80211_TID_STATS_PAD)) \ 4765 goto nla_put_failure; \ 4766 } while (0) 4767 4768 PUT_TIDVAL_U64(RX_MSDU, rx_msdu); 4769 PUT_TIDVAL_U64(TX_MSDU, tx_msdu); 4770 PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries); 4771 PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed); 4772 4773 #undef PUT_TIDVAL_U64 4774 if ((tidstats->filled & 4775 BIT(NL80211_TID_STATS_TXQ_STATS)) && 4776 !nl80211_put_txq_stats(msg, &tidstats->txq_stats, 4777 NL80211_TID_STATS_TXQ_STATS)) 4778 goto nla_put_failure; 4779 4780 nla_nest_end(msg, tidattr); 4781 } 4782 4783 nla_nest_end(msg, tidsattr); 4784 } 4785 4786 nla_nest_end(msg, sinfoattr); 4787 4788 if (sinfo->assoc_req_ies_len && 4789 nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len, 4790 sinfo->assoc_req_ies)) 4791 goto nla_put_failure; 4792 4793 cfg80211_sinfo_release_content(sinfo); 4794 genlmsg_end(msg, hdr); 4795 return 0; 4796 4797 nla_put_failure: 4798 cfg80211_sinfo_release_content(sinfo); 4799 genlmsg_cancel(msg, hdr); 4800 return -EMSGSIZE; 4801 } 4802 4803 static int nl80211_dump_station(struct sk_buff *skb, 4804 struct netlink_callback *cb) 4805 { 4806 struct station_info sinfo; 4807 struct cfg80211_registered_device *rdev; 4808 struct wireless_dev *wdev; 4809 u8 mac_addr[ETH_ALEN]; 4810 int sta_idx = cb->args[2]; 4811 int err; 4812 4813 rtnl_lock(); 4814 err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev); 4815 if (err) 4816 goto out_err; 4817 4818 if (!wdev->netdev) { 4819 err = -EINVAL; 4820 goto out_err; 4821 } 4822 4823 if (!rdev->ops->dump_station) { 4824 err = -EOPNOTSUPP; 4825 goto out_err; 4826 } 4827 4828 while (1) { 4829 memset(&sinfo, 0, sizeof(sinfo)); 4830 err = rdev_dump_station(rdev, wdev->netdev, sta_idx, 4831 mac_addr, &sinfo); 4832 if (err == -ENOENT) 4833 break; 4834 if (err) 4835 goto out_err; 4836 4837 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION, 4838 NETLINK_CB(cb->skb).portid, 4839 cb->nlh->nlmsg_seq, NLM_F_MULTI, 4840 rdev, wdev->netdev, mac_addr, 4841 &sinfo) < 0) 4842 goto out; 4843 4844 sta_idx++; 4845 } 4846 4847 out: 4848 cb->args[2] = sta_idx; 4849 err = skb->len; 4850 out_err: 4851 rtnl_unlock(); 4852 4853 return err; 4854 } 4855 4856 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info) 4857 { 4858 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4859 struct net_device *dev = info->user_ptr[1]; 4860 struct station_info sinfo; 4861 struct sk_buff *msg; 4862 u8 *mac_addr = NULL; 4863 int err; 4864 4865 memset(&sinfo, 0, sizeof(sinfo)); 4866 4867 if (!info->attrs[NL80211_ATTR_MAC]) 4868 return -EINVAL; 4869 4870 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 4871 4872 if (!rdev->ops->get_station) 4873 return -EOPNOTSUPP; 4874 4875 err = rdev_get_station(rdev, dev, mac_addr, &sinfo); 4876 if (err) 4877 return err; 4878 4879 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 4880 if (!msg) { 4881 cfg80211_sinfo_release_content(&sinfo); 4882 return -ENOMEM; 4883 } 4884 4885 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 4886 info->snd_portid, info->snd_seq, 0, 4887 rdev, dev, mac_addr, &sinfo) < 0) { 4888 nlmsg_free(msg); 4889 return -ENOBUFS; 4890 } 4891 4892 return genlmsg_reply(msg, info); 4893 } 4894 4895 int cfg80211_check_station_change(struct wiphy *wiphy, 4896 struct station_parameters *params, 4897 enum cfg80211_station_type statype) 4898 { 4899 if (params->listen_interval != -1 && 4900 statype != CFG80211_STA_AP_CLIENT_UNASSOC) 4901 return -EINVAL; 4902 4903 if (params->support_p2p_ps != -1 && 4904 statype != CFG80211_STA_AP_CLIENT_UNASSOC) 4905 return -EINVAL; 4906 4907 if (params->aid && 4908 !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) && 4909 statype != CFG80211_STA_AP_CLIENT_UNASSOC) 4910 return -EINVAL; 4911 4912 /* When you run into this, adjust the code below for the new flag */ 4913 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7); 4914 4915 switch (statype) { 4916 case CFG80211_STA_MESH_PEER_KERNEL: 4917 case CFG80211_STA_MESH_PEER_USER: 4918 /* 4919 * No ignoring the TDLS flag here -- the userspace mesh 4920 * code doesn't have the bug of including TDLS in the 4921 * mask everywhere. 4922 */ 4923 if (params->sta_flags_mask & 4924 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) | 4925 BIT(NL80211_STA_FLAG_MFP) | 4926 BIT(NL80211_STA_FLAG_AUTHORIZED))) 4927 return -EINVAL; 4928 break; 4929 case CFG80211_STA_TDLS_PEER_SETUP: 4930 case CFG80211_STA_TDLS_PEER_ACTIVE: 4931 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))) 4932 return -EINVAL; 4933 /* ignore since it can't change */ 4934 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER); 4935 break; 4936 default: 4937 /* disallow mesh-specific things */ 4938 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION) 4939 return -EINVAL; 4940 if (params->local_pm) 4941 return -EINVAL; 4942 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE) 4943 return -EINVAL; 4944 } 4945 4946 if (statype != CFG80211_STA_TDLS_PEER_SETUP && 4947 statype != CFG80211_STA_TDLS_PEER_ACTIVE) { 4948 /* TDLS can't be set, ... */ 4949 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) 4950 return -EINVAL; 4951 /* 4952 * ... but don't bother the driver with it. This works around 4953 * a hostapd/wpa_supplicant issue -- it always includes the 4954 * TLDS_PEER flag in the mask even for AP mode. 4955 */ 4956 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER); 4957 } 4958 4959 if (statype != CFG80211_STA_TDLS_PEER_SETUP && 4960 statype != CFG80211_STA_AP_CLIENT_UNASSOC) { 4961 /* reject other things that can't change */ 4962 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD) 4963 return -EINVAL; 4964 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY) 4965 return -EINVAL; 4966 if (params->supported_rates) 4967 return -EINVAL; 4968 if (params->ext_capab || params->ht_capa || params->vht_capa || 4969 params->he_capa) 4970 return -EINVAL; 4971 } 4972 4973 if (statype != CFG80211_STA_AP_CLIENT && 4974 statype != CFG80211_STA_AP_CLIENT_UNASSOC) { 4975 if (params->vlan) 4976 return -EINVAL; 4977 } 4978 4979 switch (statype) { 4980 case CFG80211_STA_AP_MLME_CLIENT: 4981 /* Use this only for authorizing/unauthorizing a station */ 4982 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED))) 4983 return -EOPNOTSUPP; 4984 break; 4985 case CFG80211_STA_AP_CLIENT: 4986 case CFG80211_STA_AP_CLIENT_UNASSOC: 4987 /* accept only the listed bits */ 4988 if (params->sta_flags_mask & 4989 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) | 4990 BIT(NL80211_STA_FLAG_AUTHENTICATED) | 4991 BIT(NL80211_STA_FLAG_ASSOCIATED) | 4992 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) | 4993 BIT(NL80211_STA_FLAG_WME) | 4994 BIT(NL80211_STA_FLAG_MFP))) 4995 return -EINVAL; 4996 4997 /* but authenticated/associated only if driver handles it */ 4998 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) && 4999 params->sta_flags_mask & 5000 (BIT(NL80211_STA_FLAG_AUTHENTICATED) | 5001 BIT(NL80211_STA_FLAG_ASSOCIATED))) 5002 return -EINVAL; 5003 break; 5004 case CFG80211_STA_IBSS: 5005 case CFG80211_STA_AP_STA: 5006 /* reject any changes other than AUTHORIZED */ 5007 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED)) 5008 return -EINVAL; 5009 break; 5010 case CFG80211_STA_TDLS_PEER_SETUP: 5011 /* reject any changes other than AUTHORIZED or WME */ 5012 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) | 5013 BIT(NL80211_STA_FLAG_WME))) 5014 return -EINVAL; 5015 /* force (at least) rates when authorizing */ 5016 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) && 5017 !params->supported_rates) 5018 return -EINVAL; 5019 break; 5020 case CFG80211_STA_TDLS_PEER_ACTIVE: 5021 /* reject any changes */ 5022 return -EINVAL; 5023 case CFG80211_STA_MESH_PEER_KERNEL: 5024 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE) 5025 return -EINVAL; 5026 break; 5027 case CFG80211_STA_MESH_PEER_USER: 5028 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION && 5029 params->plink_action != NL80211_PLINK_ACTION_BLOCK) 5030 return -EINVAL; 5031 break; 5032 } 5033 5034 /* 5035 * Older kernel versions ignored this attribute entirely, so don't 5036 * reject attempts to update it but mark it as unused instead so the 5037 * driver won't look at the data. 5038 */ 5039 if (statype != CFG80211_STA_AP_CLIENT_UNASSOC && 5040 statype != CFG80211_STA_TDLS_PEER_SETUP) 5041 params->opmode_notif_used = false; 5042 5043 return 0; 5044 } 5045 EXPORT_SYMBOL(cfg80211_check_station_change); 5046 5047 /* 5048 * Get vlan interface making sure it is running and on the right wiphy. 5049 */ 5050 static struct net_device *get_vlan(struct genl_info *info, 5051 struct cfg80211_registered_device *rdev) 5052 { 5053 struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN]; 5054 struct net_device *v; 5055 int ret; 5056 5057 if (!vlanattr) 5058 return NULL; 5059 5060 v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr)); 5061 if (!v) 5062 return ERR_PTR(-ENODEV); 5063 5064 if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) { 5065 ret = -EINVAL; 5066 goto error; 5067 } 5068 5069 if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN && 5070 v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 5071 v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) { 5072 ret = -EINVAL; 5073 goto error; 5074 } 5075 5076 if (!netif_running(v)) { 5077 ret = -ENETDOWN; 5078 goto error; 5079 } 5080 5081 return v; 5082 error: 5083 dev_put(v); 5084 return ERR_PTR(ret); 5085 } 5086 5087 static const struct nla_policy 5088 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = { 5089 [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 }, 5090 [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 }, 5091 }; 5092 5093 static int nl80211_parse_sta_wme(struct genl_info *info, 5094 struct station_parameters *params) 5095 { 5096 struct nlattr *tb[NL80211_STA_WME_MAX + 1]; 5097 struct nlattr *nla; 5098 int err; 5099 5100 /* parse WME attributes if present */ 5101 if (!info->attrs[NL80211_ATTR_STA_WME]) 5102 return 0; 5103 5104 nla = info->attrs[NL80211_ATTR_STA_WME]; 5105 err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla, 5106 nl80211_sta_wme_policy, info->extack); 5107 if (err) 5108 return err; 5109 5110 if (tb[NL80211_STA_WME_UAPSD_QUEUES]) 5111 params->uapsd_queues = nla_get_u8( 5112 tb[NL80211_STA_WME_UAPSD_QUEUES]); 5113 if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK) 5114 return -EINVAL; 5115 5116 if (tb[NL80211_STA_WME_MAX_SP]) 5117 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]); 5118 5119 if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK) 5120 return -EINVAL; 5121 5122 params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD; 5123 5124 return 0; 5125 } 5126 5127 static int nl80211_parse_sta_channel_info(struct genl_info *info, 5128 struct station_parameters *params) 5129 { 5130 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) { 5131 params->supported_channels = 5132 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]); 5133 params->supported_channels_len = 5134 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]); 5135 /* 5136 * Need to include at least one (first channel, number of 5137 * channels) tuple for each subband, and must have proper 5138 * tuples for the rest of the data as well. 5139 */ 5140 if (params->supported_channels_len < 2) 5141 return -EINVAL; 5142 if (params->supported_channels_len % 2) 5143 return -EINVAL; 5144 } 5145 5146 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) { 5147 params->supported_oper_classes = 5148 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]); 5149 params->supported_oper_classes_len = 5150 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]); 5151 /* 5152 * The value of the Length field of the Supported Operating 5153 * Classes element is between 2 and 253. 5154 */ 5155 if (params->supported_oper_classes_len < 2 || 5156 params->supported_oper_classes_len > 253) 5157 return -EINVAL; 5158 } 5159 return 0; 5160 } 5161 5162 static int nl80211_set_station_tdls(struct genl_info *info, 5163 struct station_parameters *params) 5164 { 5165 int err; 5166 /* Dummy STA entry gets updated once the peer capabilities are known */ 5167 if (info->attrs[NL80211_ATTR_PEER_AID]) 5168 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]); 5169 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) 5170 params->ht_capa = 5171 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]); 5172 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) 5173 params->vht_capa = 5174 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]); 5175 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) { 5176 params->he_capa = 5177 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 5178 params->he_capa_len = 5179 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 5180 5181 if (params->he_capa_len < NL80211_HE_MIN_CAPABILITY_LEN) 5182 return -EINVAL; 5183 } 5184 5185 err = nl80211_parse_sta_channel_info(info, params); 5186 if (err) 5187 return err; 5188 5189 return nl80211_parse_sta_wme(info, params); 5190 } 5191 5192 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info) 5193 { 5194 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5195 struct net_device *dev = info->user_ptr[1]; 5196 struct station_parameters params; 5197 u8 *mac_addr; 5198 int err; 5199 5200 memset(¶ms, 0, sizeof(params)); 5201 5202 if (!rdev->ops->change_station) 5203 return -EOPNOTSUPP; 5204 5205 /* 5206 * AID and listen_interval properties can be set only for unassociated 5207 * station. Include these parameters here and will check them in 5208 * cfg80211_check_station_change(). 5209 */ 5210 if (info->attrs[NL80211_ATTR_STA_AID]) 5211 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]); 5212 5213 if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]) 5214 params.listen_interval = 5215 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]); 5216 else 5217 params.listen_interval = -1; 5218 5219 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) { 5220 u8 tmp; 5221 5222 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]); 5223 if (tmp >= NUM_NL80211_P2P_PS_STATUS) 5224 return -EINVAL; 5225 5226 params.support_p2p_ps = tmp; 5227 } else { 5228 params.support_p2p_ps = -1; 5229 } 5230 5231 if (!info->attrs[NL80211_ATTR_MAC]) 5232 return -EINVAL; 5233 5234 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 5235 5236 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) { 5237 params.supported_rates = 5238 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 5239 params.supported_rates_len = 5240 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 5241 } 5242 5243 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) { 5244 params.capability = 5245 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]); 5246 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY; 5247 } 5248 5249 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) { 5250 params.ext_capab = 5251 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 5252 params.ext_capab_len = 5253 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 5254 } 5255 5256 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms)) 5257 return -EINVAL; 5258 5259 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) { 5260 params.plink_action = 5261 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]); 5262 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS) 5263 return -EINVAL; 5264 } 5265 5266 if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) { 5267 params.plink_state = 5268 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]); 5269 if (params.plink_state >= NUM_NL80211_PLINK_STATES) 5270 return -EINVAL; 5271 if (info->attrs[NL80211_ATTR_MESH_PEER_AID]) { 5272 params.peer_aid = nla_get_u16( 5273 info->attrs[NL80211_ATTR_MESH_PEER_AID]); 5274 if (params.peer_aid > IEEE80211_MAX_AID) 5275 return -EINVAL; 5276 } 5277 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE; 5278 } 5279 5280 if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) { 5281 enum nl80211_mesh_power_mode pm = nla_get_u32( 5282 info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]); 5283 5284 if (pm <= NL80211_MESH_POWER_UNKNOWN || 5285 pm > NL80211_MESH_POWER_MAX) 5286 return -EINVAL; 5287 5288 params.local_pm = pm; 5289 } 5290 5291 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) { 5292 params.opmode_notif_used = true; 5293 params.opmode_notif = 5294 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]); 5295 } 5296 5297 /* Include parameters for TDLS peer (will check later) */ 5298 err = nl80211_set_station_tdls(info, ¶ms); 5299 if (err) 5300 return err; 5301 5302 params.vlan = get_vlan(info, rdev); 5303 if (IS_ERR(params.vlan)) 5304 return PTR_ERR(params.vlan); 5305 5306 switch (dev->ieee80211_ptr->iftype) { 5307 case NL80211_IFTYPE_AP: 5308 case NL80211_IFTYPE_AP_VLAN: 5309 case NL80211_IFTYPE_P2P_GO: 5310 case NL80211_IFTYPE_P2P_CLIENT: 5311 case NL80211_IFTYPE_STATION: 5312 case NL80211_IFTYPE_ADHOC: 5313 case NL80211_IFTYPE_MESH_POINT: 5314 break; 5315 default: 5316 err = -EOPNOTSUPP; 5317 goto out_put_vlan; 5318 } 5319 5320 /* driver will call cfg80211_check_station_change() */ 5321 err = rdev_change_station(rdev, dev, mac_addr, ¶ms); 5322 5323 out_put_vlan: 5324 if (params.vlan) 5325 dev_put(params.vlan); 5326 5327 return err; 5328 } 5329 5330 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info) 5331 { 5332 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5333 int err; 5334 struct net_device *dev = info->user_ptr[1]; 5335 struct station_parameters params; 5336 u8 *mac_addr = NULL; 5337 u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) | 5338 BIT(NL80211_STA_FLAG_ASSOCIATED); 5339 5340 memset(¶ms, 0, sizeof(params)); 5341 5342 if (!rdev->ops->add_station) 5343 return -EOPNOTSUPP; 5344 5345 if (!info->attrs[NL80211_ATTR_MAC]) 5346 return -EINVAL; 5347 5348 if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]) 5349 return -EINVAL; 5350 5351 if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) 5352 return -EINVAL; 5353 5354 if (!info->attrs[NL80211_ATTR_STA_AID] && 5355 !info->attrs[NL80211_ATTR_PEER_AID]) 5356 return -EINVAL; 5357 5358 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 5359 params.supported_rates = 5360 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 5361 params.supported_rates_len = 5362 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 5363 params.listen_interval = 5364 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]); 5365 5366 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) { 5367 u8 tmp; 5368 5369 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]); 5370 if (tmp >= NUM_NL80211_P2P_PS_STATUS) 5371 return -EINVAL; 5372 5373 params.support_p2p_ps = tmp; 5374 } else { 5375 /* 5376 * if not specified, assume it's supported for P2P GO interface, 5377 * and is NOT supported for AP interface 5378 */ 5379 params.support_p2p_ps = 5380 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO; 5381 } 5382 5383 if (info->attrs[NL80211_ATTR_PEER_AID]) 5384 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]); 5385 else 5386 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]); 5387 if (!params.aid || params.aid > IEEE80211_MAX_AID) 5388 return -EINVAL; 5389 5390 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) { 5391 params.capability = 5392 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]); 5393 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY; 5394 } 5395 5396 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) { 5397 params.ext_capab = 5398 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 5399 params.ext_capab_len = 5400 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 5401 } 5402 5403 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) 5404 params.ht_capa = 5405 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]); 5406 5407 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) 5408 params.vht_capa = 5409 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]); 5410 5411 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) { 5412 params.he_capa = 5413 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 5414 params.he_capa_len = 5415 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]); 5416 5417 /* max len is validated in nla policy */ 5418 if (params.he_capa_len < NL80211_HE_MIN_CAPABILITY_LEN) 5419 return -EINVAL; 5420 } 5421 5422 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) { 5423 params.opmode_notif_used = true; 5424 params.opmode_notif = 5425 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]); 5426 } 5427 5428 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) { 5429 params.plink_action = 5430 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]); 5431 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS) 5432 return -EINVAL; 5433 } 5434 5435 err = nl80211_parse_sta_channel_info(info, ¶ms); 5436 if (err) 5437 return err; 5438 5439 err = nl80211_parse_sta_wme(info, ¶ms); 5440 if (err) 5441 return err; 5442 5443 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms)) 5444 return -EINVAL; 5445 5446 /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT 5447 * as userspace might just pass through the capabilities from the IEs 5448 * directly, rather than enforcing this restriction and returning an 5449 * error in this case. 5450 */ 5451 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) { 5452 params.ht_capa = NULL; 5453 params.vht_capa = NULL; 5454 5455 /* HE requires WME */ 5456 if (params.he_capa_len) 5457 return -EINVAL; 5458 } 5459 5460 /* When you run into this, adjust the code below for the new flag */ 5461 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7); 5462 5463 switch (dev->ieee80211_ptr->iftype) { 5464 case NL80211_IFTYPE_AP: 5465 case NL80211_IFTYPE_AP_VLAN: 5466 case NL80211_IFTYPE_P2P_GO: 5467 /* ignore WME attributes if iface/sta is not capable */ 5468 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) || 5469 !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) 5470 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD; 5471 5472 /* TDLS peers cannot be added */ 5473 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) || 5474 info->attrs[NL80211_ATTR_PEER_AID]) 5475 return -EINVAL; 5476 /* but don't bother the driver with it */ 5477 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER); 5478 5479 /* allow authenticated/associated only if driver handles it */ 5480 if (!(rdev->wiphy.features & 5481 NL80211_FEATURE_FULL_AP_CLIENT_STATE) && 5482 params.sta_flags_mask & auth_assoc) 5483 return -EINVAL; 5484 5485 /* Older userspace, or userspace wanting to be compatible with 5486 * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth 5487 * and assoc flags in the mask, but assumes the station will be 5488 * added as associated anyway since this was the required driver 5489 * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was 5490 * introduced. 5491 * In order to not bother drivers with this quirk in the API 5492 * set the flags in both the mask and set for new stations in 5493 * this case. 5494 */ 5495 if (!(params.sta_flags_mask & auth_assoc)) { 5496 params.sta_flags_mask |= auth_assoc; 5497 params.sta_flags_set |= auth_assoc; 5498 } 5499 5500 /* must be last in here for error handling */ 5501 params.vlan = get_vlan(info, rdev); 5502 if (IS_ERR(params.vlan)) 5503 return PTR_ERR(params.vlan); 5504 break; 5505 case NL80211_IFTYPE_MESH_POINT: 5506 /* ignore uAPSD data */ 5507 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD; 5508 5509 /* associated is disallowed */ 5510 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED)) 5511 return -EINVAL; 5512 /* TDLS peers cannot be added */ 5513 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) || 5514 info->attrs[NL80211_ATTR_PEER_AID]) 5515 return -EINVAL; 5516 break; 5517 case NL80211_IFTYPE_STATION: 5518 case NL80211_IFTYPE_P2P_CLIENT: 5519 /* ignore uAPSD data */ 5520 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD; 5521 5522 /* these are disallowed */ 5523 if (params.sta_flags_mask & 5524 (BIT(NL80211_STA_FLAG_ASSOCIATED) | 5525 BIT(NL80211_STA_FLAG_AUTHENTICATED))) 5526 return -EINVAL; 5527 /* Only TDLS peers can be added */ 5528 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))) 5529 return -EINVAL; 5530 /* Can only add if TDLS ... */ 5531 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS)) 5532 return -EOPNOTSUPP; 5533 /* ... with external setup is supported */ 5534 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP)) 5535 return -EOPNOTSUPP; 5536 /* 5537 * Older wpa_supplicant versions always mark the TDLS peer 5538 * as authorized, but it shouldn't yet be. 5539 */ 5540 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED); 5541 break; 5542 default: 5543 return -EOPNOTSUPP; 5544 } 5545 5546 /* be aware of params.vlan when changing code here */ 5547 5548 err = rdev_add_station(rdev, dev, mac_addr, ¶ms); 5549 5550 if (params.vlan) 5551 dev_put(params.vlan); 5552 return err; 5553 } 5554 5555 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info) 5556 { 5557 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5558 struct net_device *dev = info->user_ptr[1]; 5559 struct station_del_parameters params; 5560 5561 memset(¶ms, 0, sizeof(params)); 5562 5563 if (info->attrs[NL80211_ATTR_MAC]) 5564 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]); 5565 5566 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 5567 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN && 5568 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT && 5569 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 5570 return -EINVAL; 5571 5572 if (!rdev->ops->del_station) 5573 return -EOPNOTSUPP; 5574 5575 if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) { 5576 params.subtype = 5577 nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]); 5578 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 && 5579 params.subtype != IEEE80211_STYPE_DEAUTH >> 4) 5580 return -EINVAL; 5581 } else { 5582 /* Default to Deauthentication frame */ 5583 params.subtype = IEEE80211_STYPE_DEAUTH >> 4; 5584 } 5585 5586 if (info->attrs[NL80211_ATTR_REASON_CODE]) { 5587 params.reason_code = 5588 nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 5589 if (params.reason_code == 0) 5590 return -EINVAL; /* 0 is reserved */ 5591 } else { 5592 /* Default to reason code 2 */ 5593 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID; 5594 } 5595 5596 return rdev_del_station(rdev, dev, ¶ms); 5597 } 5598 5599 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq, 5600 int flags, struct net_device *dev, 5601 u8 *dst, u8 *next_hop, 5602 struct mpath_info *pinfo) 5603 { 5604 void *hdr; 5605 struct nlattr *pinfoattr; 5606 5607 hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH); 5608 if (!hdr) 5609 return -1; 5610 5611 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 5612 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) || 5613 nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) || 5614 nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation)) 5615 goto nla_put_failure; 5616 5617 pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO); 5618 if (!pinfoattr) 5619 goto nla_put_failure; 5620 if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) && 5621 nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN, 5622 pinfo->frame_qlen)) 5623 goto nla_put_failure; 5624 if (((pinfo->filled & MPATH_INFO_SN) && 5625 nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) || 5626 ((pinfo->filled & MPATH_INFO_METRIC) && 5627 nla_put_u32(msg, NL80211_MPATH_INFO_METRIC, 5628 pinfo->metric)) || 5629 ((pinfo->filled & MPATH_INFO_EXPTIME) && 5630 nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME, 5631 pinfo->exptime)) || 5632 ((pinfo->filled & MPATH_INFO_FLAGS) && 5633 nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS, 5634 pinfo->flags)) || 5635 ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) && 5636 nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT, 5637 pinfo->discovery_timeout)) || 5638 ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) && 5639 nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES, 5640 pinfo->discovery_retries))) 5641 goto nla_put_failure; 5642 5643 nla_nest_end(msg, pinfoattr); 5644 5645 genlmsg_end(msg, hdr); 5646 return 0; 5647 5648 nla_put_failure: 5649 genlmsg_cancel(msg, hdr); 5650 return -EMSGSIZE; 5651 } 5652 5653 static int nl80211_dump_mpath(struct sk_buff *skb, 5654 struct netlink_callback *cb) 5655 { 5656 struct mpath_info pinfo; 5657 struct cfg80211_registered_device *rdev; 5658 struct wireless_dev *wdev; 5659 u8 dst[ETH_ALEN]; 5660 u8 next_hop[ETH_ALEN]; 5661 int path_idx = cb->args[2]; 5662 int err; 5663 5664 rtnl_lock(); 5665 err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev); 5666 if (err) 5667 goto out_err; 5668 5669 if (!rdev->ops->dump_mpath) { 5670 err = -EOPNOTSUPP; 5671 goto out_err; 5672 } 5673 5674 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) { 5675 err = -EOPNOTSUPP; 5676 goto out_err; 5677 } 5678 5679 while (1) { 5680 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst, 5681 next_hop, &pinfo); 5682 if (err == -ENOENT) 5683 break; 5684 if (err) 5685 goto out_err; 5686 5687 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid, 5688 cb->nlh->nlmsg_seq, NLM_F_MULTI, 5689 wdev->netdev, dst, next_hop, 5690 &pinfo) < 0) 5691 goto out; 5692 5693 path_idx++; 5694 } 5695 5696 out: 5697 cb->args[2] = path_idx; 5698 err = skb->len; 5699 out_err: 5700 rtnl_unlock(); 5701 return err; 5702 } 5703 5704 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info) 5705 { 5706 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5707 int err; 5708 struct net_device *dev = info->user_ptr[1]; 5709 struct mpath_info pinfo; 5710 struct sk_buff *msg; 5711 u8 *dst = NULL; 5712 u8 next_hop[ETH_ALEN]; 5713 5714 memset(&pinfo, 0, sizeof(pinfo)); 5715 5716 if (!info->attrs[NL80211_ATTR_MAC]) 5717 return -EINVAL; 5718 5719 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 5720 5721 if (!rdev->ops->get_mpath) 5722 return -EOPNOTSUPP; 5723 5724 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 5725 return -EOPNOTSUPP; 5726 5727 err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo); 5728 if (err) 5729 return err; 5730 5731 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 5732 if (!msg) 5733 return -ENOMEM; 5734 5735 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0, 5736 dev, dst, next_hop, &pinfo) < 0) { 5737 nlmsg_free(msg); 5738 return -ENOBUFS; 5739 } 5740 5741 return genlmsg_reply(msg, info); 5742 } 5743 5744 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info) 5745 { 5746 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5747 struct net_device *dev = info->user_ptr[1]; 5748 u8 *dst = NULL; 5749 u8 *next_hop = NULL; 5750 5751 if (!info->attrs[NL80211_ATTR_MAC]) 5752 return -EINVAL; 5753 5754 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]) 5755 return -EINVAL; 5756 5757 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 5758 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]); 5759 5760 if (!rdev->ops->change_mpath) 5761 return -EOPNOTSUPP; 5762 5763 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 5764 return -EOPNOTSUPP; 5765 5766 return rdev_change_mpath(rdev, dev, dst, next_hop); 5767 } 5768 5769 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info) 5770 { 5771 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5772 struct net_device *dev = info->user_ptr[1]; 5773 u8 *dst = NULL; 5774 u8 *next_hop = NULL; 5775 5776 if (!info->attrs[NL80211_ATTR_MAC]) 5777 return -EINVAL; 5778 5779 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]) 5780 return -EINVAL; 5781 5782 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 5783 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]); 5784 5785 if (!rdev->ops->add_mpath) 5786 return -EOPNOTSUPP; 5787 5788 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 5789 return -EOPNOTSUPP; 5790 5791 return rdev_add_mpath(rdev, dev, dst, next_hop); 5792 } 5793 5794 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info) 5795 { 5796 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5797 struct net_device *dev = info->user_ptr[1]; 5798 u8 *dst = NULL; 5799 5800 if (info->attrs[NL80211_ATTR_MAC]) 5801 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 5802 5803 if (!rdev->ops->del_mpath) 5804 return -EOPNOTSUPP; 5805 5806 return rdev_del_mpath(rdev, dev, dst); 5807 } 5808 5809 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info) 5810 { 5811 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5812 int err; 5813 struct net_device *dev = info->user_ptr[1]; 5814 struct mpath_info pinfo; 5815 struct sk_buff *msg; 5816 u8 *dst = NULL; 5817 u8 mpp[ETH_ALEN]; 5818 5819 memset(&pinfo, 0, sizeof(pinfo)); 5820 5821 if (!info->attrs[NL80211_ATTR_MAC]) 5822 return -EINVAL; 5823 5824 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 5825 5826 if (!rdev->ops->get_mpp) 5827 return -EOPNOTSUPP; 5828 5829 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 5830 return -EOPNOTSUPP; 5831 5832 err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo); 5833 if (err) 5834 return err; 5835 5836 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 5837 if (!msg) 5838 return -ENOMEM; 5839 5840 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0, 5841 dev, dst, mpp, &pinfo) < 0) { 5842 nlmsg_free(msg); 5843 return -ENOBUFS; 5844 } 5845 5846 return genlmsg_reply(msg, info); 5847 } 5848 5849 static int nl80211_dump_mpp(struct sk_buff *skb, 5850 struct netlink_callback *cb) 5851 { 5852 struct mpath_info pinfo; 5853 struct cfg80211_registered_device *rdev; 5854 struct wireless_dev *wdev; 5855 u8 dst[ETH_ALEN]; 5856 u8 mpp[ETH_ALEN]; 5857 int path_idx = cb->args[2]; 5858 int err; 5859 5860 rtnl_lock(); 5861 err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev); 5862 if (err) 5863 goto out_err; 5864 5865 if (!rdev->ops->dump_mpp) { 5866 err = -EOPNOTSUPP; 5867 goto out_err; 5868 } 5869 5870 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) { 5871 err = -EOPNOTSUPP; 5872 goto out_err; 5873 } 5874 5875 while (1) { 5876 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst, 5877 mpp, &pinfo); 5878 if (err == -ENOENT) 5879 break; 5880 if (err) 5881 goto out_err; 5882 5883 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid, 5884 cb->nlh->nlmsg_seq, NLM_F_MULTI, 5885 wdev->netdev, dst, mpp, 5886 &pinfo) < 0) 5887 goto out; 5888 5889 path_idx++; 5890 } 5891 5892 out: 5893 cb->args[2] = path_idx; 5894 err = skb->len; 5895 out_err: 5896 rtnl_unlock(); 5897 return err; 5898 } 5899 5900 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info) 5901 { 5902 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5903 struct net_device *dev = info->user_ptr[1]; 5904 struct wireless_dev *wdev = dev->ieee80211_ptr; 5905 struct bss_parameters params; 5906 int err; 5907 5908 memset(¶ms, 0, sizeof(params)); 5909 /* default to not changing parameters */ 5910 params.use_cts_prot = -1; 5911 params.use_short_preamble = -1; 5912 params.use_short_slot_time = -1; 5913 params.ap_isolate = -1; 5914 params.ht_opmode = -1; 5915 params.p2p_ctwindow = -1; 5916 params.p2p_opp_ps = -1; 5917 5918 if (info->attrs[NL80211_ATTR_BSS_CTS_PROT]) 5919 params.use_cts_prot = 5920 nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]); 5921 if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]) 5922 params.use_short_preamble = 5923 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]); 5924 if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]) 5925 params.use_short_slot_time = 5926 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]); 5927 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) { 5928 params.basic_rates = 5929 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 5930 params.basic_rates_len = 5931 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 5932 } 5933 if (info->attrs[NL80211_ATTR_AP_ISOLATE]) 5934 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]); 5935 if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE]) 5936 params.ht_opmode = 5937 nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]); 5938 5939 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) { 5940 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 5941 return -EINVAL; 5942 params.p2p_ctwindow = 5943 nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]); 5944 if (params.p2p_ctwindow < 0) 5945 return -EINVAL; 5946 if (params.p2p_ctwindow != 0 && 5947 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) 5948 return -EINVAL; 5949 } 5950 5951 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) { 5952 u8 tmp; 5953 5954 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 5955 return -EINVAL; 5956 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]); 5957 if (tmp > 1) 5958 return -EINVAL; 5959 params.p2p_opp_ps = tmp; 5960 if (params.p2p_opp_ps && 5961 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) 5962 return -EINVAL; 5963 } 5964 5965 if (!rdev->ops->change_bss) 5966 return -EOPNOTSUPP; 5967 5968 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 5969 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 5970 return -EOPNOTSUPP; 5971 5972 wdev_lock(wdev); 5973 err = rdev_change_bss(rdev, dev, ¶ms); 5974 wdev_unlock(wdev); 5975 5976 return err; 5977 } 5978 5979 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info) 5980 { 5981 char *data = NULL; 5982 bool is_indoor; 5983 enum nl80211_user_reg_hint_type user_reg_hint_type; 5984 u32 owner_nlportid; 5985 5986 /* 5987 * You should only get this when cfg80211 hasn't yet initialized 5988 * completely when built-in to the kernel right between the time 5989 * window between nl80211_init() and regulatory_init(), if that is 5990 * even possible. 5991 */ 5992 if (unlikely(!rcu_access_pointer(cfg80211_regdomain))) 5993 return -EINPROGRESS; 5994 5995 if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]) 5996 user_reg_hint_type = 5997 nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]); 5998 else 5999 user_reg_hint_type = NL80211_USER_REG_HINT_USER; 6000 6001 switch (user_reg_hint_type) { 6002 case NL80211_USER_REG_HINT_USER: 6003 case NL80211_USER_REG_HINT_CELL_BASE: 6004 if (!info->attrs[NL80211_ATTR_REG_ALPHA2]) 6005 return -EINVAL; 6006 6007 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]); 6008 return regulatory_hint_user(data, user_reg_hint_type); 6009 case NL80211_USER_REG_HINT_INDOOR: 6010 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 6011 owner_nlportid = info->snd_portid; 6012 is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR]; 6013 } else { 6014 owner_nlportid = 0; 6015 is_indoor = true; 6016 } 6017 6018 return regulatory_hint_indoor(is_indoor, owner_nlportid); 6019 default: 6020 return -EINVAL; 6021 } 6022 } 6023 6024 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info) 6025 { 6026 return reg_reload_regdb(); 6027 } 6028 6029 static int nl80211_get_mesh_config(struct sk_buff *skb, 6030 struct genl_info *info) 6031 { 6032 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6033 struct net_device *dev = info->user_ptr[1]; 6034 struct wireless_dev *wdev = dev->ieee80211_ptr; 6035 struct mesh_config cur_params; 6036 int err = 0; 6037 void *hdr; 6038 struct nlattr *pinfoattr; 6039 struct sk_buff *msg; 6040 6041 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) 6042 return -EOPNOTSUPP; 6043 6044 if (!rdev->ops->get_mesh_config) 6045 return -EOPNOTSUPP; 6046 6047 wdev_lock(wdev); 6048 /* If not connected, get default parameters */ 6049 if (!wdev->mesh_id_len) 6050 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params)); 6051 else 6052 err = rdev_get_mesh_config(rdev, dev, &cur_params); 6053 wdev_unlock(wdev); 6054 6055 if (err) 6056 return err; 6057 6058 /* Draw up a netlink message to send back */ 6059 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 6060 if (!msg) 6061 return -ENOMEM; 6062 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 6063 NL80211_CMD_GET_MESH_CONFIG); 6064 if (!hdr) 6065 goto out; 6066 pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG); 6067 if (!pinfoattr) 6068 goto nla_put_failure; 6069 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 6070 nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT, 6071 cur_params.dot11MeshRetryTimeout) || 6072 nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT, 6073 cur_params.dot11MeshConfirmTimeout) || 6074 nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT, 6075 cur_params.dot11MeshHoldingTimeout) || 6076 nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS, 6077 cur_params.dot11MeshMaxPeerLinks) || 6078 nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES, 6079 cur_params.dot11MeshMaxRetries) || 6080 nla_put_u8(msg, NL80211_MESHCONF_TTL, 6081 cur_params.dot11MeshTTL) || 6082 nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL, 6083 cur_params.element_ttl) || 6084 nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS, 6085 cur_params.auto_open_plinks) || 6086 nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR, 6087 cur_params.dot11MeshNbrOffsetMaxNeighbor) || 6088 nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES, 6089 cur_params.dot11MeshHWMPmaxPREQretries) || 6090 nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME, 6091 cur_params.path_refresh_time) || 6092 nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT, 6093 cur_params.min_discovery_timeout) || 6094 nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT, 6095 cur_params.dot11MeshHWMPactivePathTimeout) || 6096 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL, 6097 cur_params.dot11MeshHWMPpreqMinInterval) || 6098 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL, 6099 cur_params.dot11MeshHWMPperrMinInterval) || 6100 nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME, 6101 cur_params.dot11MeshHWMPnetDiameterTraversalTime) || 6102 nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE, 6103 cur_params.dot11MeshHWMPRootMode) || 6104 nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL, 6105 cur_params.dot11MeshHWMPRannInterval) || 6106 nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS, 6107 cur_params.dot11MeshGateAnnouncementProtocol) || 6108 nla_put_u8(msg, NL80211_MESHCONF_FORWARDING, 6109 cur_params.dot11MeshForwarding) || 6110 nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD, 6111 cur_params.rssi_threshold) || 6112 nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE, 6113 cur_params.ht_opmode) || 6114 nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT, 6115 cur_params.dot11MeshHWMPactivePathToRootTimeout) || 6116 nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL, 6117 cur_params.dot11MeshHWMProotInterval) || 6118 nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL, 6119 cur_params.dot11MeshHWMPconfirmationInterval) || 6120 nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE, 6121 cur_params.power_mode) || 6122 nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW, 6123 cur_params.dot11MeshAwakeWindowDuration) || 6124 nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT, 6125 cur_params.plink_timeout)) 6126 goto nla_put_failure; 6127 nla_nest_end(msg, pinfoattr); 6128 genlmsg_end(msg, hdr); 6129 return genlmsg_reply(msg, info); 6130 6131 nla_put_failure: 6132 out: 6133 nlmsg_free(msg); 6134 return -ENOBUFS; 6135 } 6136 6137 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = { 6138 [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 }, 6139 [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 }, 6140 [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 }, 6141 [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 }, 6142 [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 }, 6143 [NL80211_MESHCONF_TTL] = { .type = NLA_U8 }, 6144 [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 }, 6145 [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 }, 6146 [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 }, 6147 [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 }, 6148 [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 }, 6149 [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 }, 6150 [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 }, 6151 [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 }, 6152 [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 }, 6153 [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 }, 6154 [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 }, 6155 [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 }, 6156 [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 }, 6157 [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 }, 6158 [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 }, 6159 [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 }, 6160 [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 }, 6161 [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 }, 6162 [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 }, 6163 [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 }, 6164 [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 }, 6165 [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 }, 6166 }; 6167 6168 static const struct nla_policy 6169 nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = { 6170 [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 }, 6171 [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 }, 6172 [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 }, 6173 [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG }, 6174 [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 }, 6175 [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG }, 6176 [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY, 6177 .len = IEEE80211_MAX_DATA_LEN }, 6178 [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG }, 6179 }; 6180 6181 static int nl80211_check_bool(const struct nlattr *nla, u8 min, u8 max, bool *out) 6182 { 6183 u8 val = nla_get_u8(nla); 6184 if (val < min || val > max) 6185 return -EINVAL; 6186 *out = val; 6187 return 0; 6188 } 6189 6190 static int nl80211_check_u8(const struct nlattr *nla, u8 min, u8 max, u8 *out) 6191 { 6192 u8 val = nla_get_u8(nla); 6193 if (val < min || val > max) 6194 return -EINVAL; 6195 *out = val; 6196 return 0; 6197 } 6198 6199 static int nl80211_check_u16(const struct nlattr *nla, u16 min, u16 max, u16 *out) 6200 { 6201 u16 val = nla_get_u16(nla); 6202 if (val < min || val > max) 6203 return -EINVAL; 6204 *out = val; 6205 return 0; 6206 } 6207 6208 static int nl80211_check_u32(const struct nlattr *nla, u32 min, u32 max, u32 *out) 6209 { 6210 u32 val = nla_get_u32(nla); 6211 if (val < min || val > max) 6212 return -EINVAL; 6213 *out = val; 6214 return 0; 6215 } 6216 6217 static int nl80211_check_s32(const struct nlattr *nla, s32 min, s32 max, s32 *out) 6218 { 6219 s32 val = nla_get_s32(nla); 6220 if (val < min || val > max) 6221 return -EINVAL; 6222 *out = val; 6223 return 0; 6224 } 6225 6226 static int nl80211_check_power_mode(const struct nlattr *nla, 6227 enum nl80211_mesh_power_mode min, 6228 enum nl80211_mesh_power_mode max, 6229 enum nl80211_mesh_power_mode *out) 6230 { 6231 u32 val = nla_get_u32(nla); 6232 if (val < min || val > max) 6233 return -EINVAL; 6234 *out = val; 6235 return 0; 6236 } 6237 6238 static int nl80211_parse_mesh_config(struct genl_info *info, 6239 struct mesh_config *cfg, 6240 u32 *mask_out) 6241 { 6242 struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1]; 6243 u32 mask = 0; 6244 u16 ht_opmode; 6245 6246 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \ 6247 do { \ 6248 if (tb[attr]) { \ 6249 if (fn(tb[attr], min, max, &cfg->param)) \ 6250 return -EINVAL; \ 6251 mask |= (1 << (attr - 1)); \ 6252 } \ 6253 } while (0) 6254 6255 if (!info->attrs[NL80211_ATTR_MESH_CONFIG]) 6256 return -EINVAL; 6257 if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX, 6258 info->attrs[NL80211_ATTR_MESH_CONFIG], 6259 nl80211_meshconf_params_policy, info->extack)) 6260 return -EINVAL; 6261 6262 /* This makes sure that there aren't more than 32 mesh config 6263 * parameters (otherwise our bitfield scheme would not work.) */ 6264 BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32); 6265 6266 /* Fill in the params struct */ 6267 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255, 6268 mask, NL80211_MESHCONF_RETRY_TIMEOUT, 6269 nl80211_check_u16); 6270 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255, 6271 mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, 6272 nl80211_check_u16); 6273 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255, 6274 mask, NL80211_MESHCONF_HOLDING_TIMEOUT, 6275 nl80211_check_u16); 6276 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255, 6277 mask, NL80211_MESHCONF_MAX_PEER_LINKS, 6278 nl80211_check_u16); 6279 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16, 6280 mask, NL80211_MESHCONF_MAX_RETRIES, 6281 nl80211_check_u8); 6282 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255, 6283 mask, NL80211_MESHCONF_TTL, nl80211_check_u8); 6284 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255, 6285 mask, NL80211_MESHCONF_ELEMENT_TTL, 6286 nl80211_check_u8); 6287 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1, 6288 mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, 6289 nl80211_check_bool); 6290 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor, 6291 1, 255, mask, 6292 NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR, 6293 nl80211_check_u32); 6294 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255, 6295 mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES, 6296 nl80211_check_u8); 6297 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535, 6298 mask, NL80211_MESHCONF_PATH_REFRESH_TIME, 6299 nl80211_check_u32); 6300 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535, 6301 mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT, 6302 nl80211_check_u16); 6303 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout, 6304 1, 65535, mask, 6305 NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT, 6306 nl80211_check_u32); 6307 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, 6308 1, 65535, mask, 6309 NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL, 6310 nl80211_check_u16); 6311 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, 6312 1, 65535, mask, 6313 NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL, 6314 nl80211_check_u16); 6315 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, 6316 dot11MeshHWMPnetDiameterTraversalTime, 6317 1, 65535, mask, 6318 NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME, 6319 nl80211_check_u16); 6320 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4, 6321 mask, NL80211_MESHCONF_HWMP_ROOTMODE, 6322 nl80211_check_u8); 6323 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535, 6324 mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL, 6325 nl80211_check_u16); 6326 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, 6327 dot11MeshGateAnnouncementProtocol, 0, 1, 6328 mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS, 6329 nl80211_check_bool); 6330 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1, 6331 mask, NL80211_MESHCONF_FORWARDING, 6332 nl80211_check_bool); 6333 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0, 6334 mask, NL80211_MESHCONF_RSSI_THRESHOLD, 6335 nl80211_check_s32); 6336 /* 6337 * Check HT operation mode based on 6338 * IEEE 802.11-2016 9.4.2.57 HT Operation element. 6339 */ 6340 if (tb[NL80211_MESHCONF_HT_OPMODE]) { 6341 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]); 6342 6343 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION | 6344 IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT | 6345 IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)) 6346 return -EINVAL; 6347 6348 /* NON_HT_STA bit is reserved, but some programs set it */ 6349 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT; 6350 6351 cfg->ht_opmode = ht_opmode; 6352 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1)); 6353 } 6354 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout, 6355 1, 65535, mask, 6356 NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT, 6357 nl80211_check_u32); 6358 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535, 6359 mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL, 6360 nl80211_check_u16); 6361 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, 6362 dot11MeshHWMPconfirmationInterval, 6363 1, 65535, mask, 6364 NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL, 6365 nl80211_check_u16); 6366 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, 6367 NL80211_MESH_POWER_ACTIVE, 6368 NL80211_MESH_POWER_MAX, 6369 mask, NL80211_MESHCONF_POWER_MODE, 6370 nl80211_check_power_mode); 6371 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, 6372 0, 65535, mask, 6373 NL80211_MESHCONF_AWAKE_WINDOW, nl80211_check_u16); 6374 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 0, 0xffffffff, 6375 mask, NL80211_MESHCONF_PLINK_TIMEOUT, 6376 nl80211_check_u32); 6377 if (mask_out) 6378 *mask_out = mask; 6379 6380 return 0; 6381 6382 #undef FILL_IN_MESH_PARAM_IF_SET 6383 } 6384 6385 static int nl80211_parse_mesh_setup(struct genl_info *info, 6386 struct mesh_setup *setup) 6387 { 6388 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6389 struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1]; 6390 6391 if (!info->attrs[NL80211_ATTR_MESH_SETUP]) 6392 return -EINVAL; 6393 if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX, 6394 info->attrs[NL80211_ATTR_MESH_SETUP], 6395 nl80211_mesh_setup_params_policy, info->extack)) 6396 return -EINVAL; 6397 6398 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC]) 6399 setup->sync_method = 6400 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ? 6401 IEEE80211_SYNC_METHOD_VENDOR : 6402 IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET; 6403 6404 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL]) 6405 setup->path_sel_proto = 6406 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ? 6407 IEEE80211_PATH_PROTOCOL_VENDOR : 6408 IEEE80211_PATH_PROTOCOL_HWMP; 6409 6410 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC]) 6411 setup->path_metric = 6412 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ? 6413 IEEE80211_PATH_METRIC_VENDOR : 6414 IEEE80211_PATH_METRIC_AIRTIME; 6415 6416 if (tb[NL80211_MESH_SETUP_IE]) { 6417 struct nlattr *ieattr = 6418 tb[NL80211_MESH_SETUP_IE]; 6419 if (!is_valid_ie_attr(ieattr)) 6420 return -EINVAL; 6421 setup->ie = nla_data(ieattr); 6422 setup->ie_len = nla_len(ieattr); 6423 } 6424 if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] && 6425 !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM)) 6426 return -EINVAL; 6427 setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]); 6428 setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]); 6429 setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]); 6430 if (setup->is_secure) 6431 setup->user_mpm = true; 6432 6433 if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) { 6434 if (!setup->user_mpm) 6435 return -EINVAL; 6436 setup->auth_id = 6437 nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]); 6438 } 6439 6440 return 0; 6441 } 6442 6443 static int nl80211_update_mesh_config(struct sk_buff *skb, 6444 struct genl_info *info) 6445 { 6446 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6447 struct net_device *dev = info->user_ptr[1]; 6448 struct wireless_dev *wdev = dev->ieee80211_ptr; 6449 struct mesh_config cfg; 6450 u32 mask; 6451 int err; 6452 6453 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) 6454 return -EOPNOTSUPP; 6455 6456 if (!rdev->ops->update_mesh_config) 6457 return -EOPNOTSUPP; 6458 6459 err = nl80211_parse_mesh_config(info, &cfg, &mask); 6460 if (err) 6461 return err; 6462 6463 wdev_lock(wdev); 6464 if (!wdev->mesh_id_len) 6465 err = -ENOLINK; 6466 6467 if (!err) 6468 err = rdev_update_mesh_config(rdev, dev, mask, &cfg); 6469 6470 wdev_unlock(wdev); 6471 6472 return err; 6473 } 6474 6475 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom, 6476 struct sk_buff *msg) 6477 { 6478 struct nlattr *nl_reg_rules; 6479 unsigned int i; 6480 6481 if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) || 6482 (regdom->dfs_region && 6483 nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region))) 6484 goto nla_put_failure; 6485 6486 nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES); 6487 if (!nl_reg_rules) 6488 goto nla_put_failure; 6489 6490 for (i = 0; i < regdom->n_reg_rules; i++) { 6491 struct nlattr *nl_reg_rule; 6492 const struct ieee80211_reg_rule *reg_rule; 6493 const struct ieee80211_freq_range *freq_range; 6494 const struct ieee80211_power_rule *power_rule; 6495 unsigned int max_bandwidth_khz; 6496 6497 reg_rule = ®dom->reg_rules[i]; 6498 freq_range = ®_rule->freq_range; 6499 power_rule = ®_rule->power_rule; 6500 6501 nl_reg_rule = nla_nest_start(msg, i); 6502 if (!nl_reg_rule) 6503 goto nla_put_failure; 6504 6505 max_bandwidth_khz = freq_range->max_bandwidth_khz; 6506 if (!max_bandwidth_khz) 6507 max_bandwidth_khz = reg_get_max_bandwidth(regdom, 6508 reg_rule); 6509 6510 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS, 6511 reg_rule->flags) || 6512 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START, 6513 freq_range->start_freq_khz) || 6514 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END, 6515 freq_range->end_freq_khz) || 6516 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW, 6517 max_bandwidth_khz) || 6518 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN, 6519 power_rule->max_antenna_gain) || 6520 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP, 6521 power_rule->max_eirp) || 6522 nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME, 6523 reg_rule->dfs_cac_ms)) 6524 goto nla_put_failure; 6525 6526 nla_nest_end(msg, nl_reg_rule); 6527 } 6528 6529 nla_nest_end(msg, nl_reg_rules); 6530 return 0; 6531 6532 nla_put_failure: 6533 return -EMSGSIZE; 6534 } 6535 6536 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info) 6537 { 6538 const struct ieee80211_regdomain *regdom = NULL; 6539 struct cfg80211_registered_device *rdev; 6540 struct wiphy *wiphy = NULL; 6541 struct sk_buff *msg; 6542 void *hdr; 6543 6544 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 6545 if (!msg) 6546 return -ENOBUFS; 6547 6548 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 6549 NL80211_CMD_GET_REG); 6550 if (!hdr) 6551 goto put_failure; 6552 6553 if (info->attrs[NL80211_ATTR_WIPHY]) { 6554 bool self_managed; 6555 6556 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info); 6557 if (IS_ERR(rdev)) { 6558 nlmsg_free(msg); 6559 return PTR_ERR(rdev); 6560 } 6561 6562 wiphy = &rdev->wiphy; 6563 self_managed = wiphy->regulatory_flags & 6564 REGULATORY_WIPHY_SELF_MANAGED; 6565 regdom = get_wiphy_regdom(wiphy); 6566 6567 /* a self-managed-reg device must have a private regdom */ 6568 if (WARN_ON(!regdom && self_managed)) { 6569 nlmsg_free(msg); 6570 return -EINVAL; 6571 } 6572 6573 if (regdom && 6574 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy))) 6575 goto nla_put_failure; 6576 } 6577 6578 if (!wiphy && reg_last_request_cell_base() && 6579 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE, 6580 NL80211_USER_REG_HINT_CELL_BASE)) 6581 goto nla_put_failure; 6582 6583 rcu_read_lock(); 6584 6585 if (!regdom) 6586 regdom = rcu_dereference(cfg80211_regdomain); 6587 6588 if (nl80211_put_regdom(regdom, msg)) 6589 goto nla_put_failure_rcu; 6590 6591 rcu_read_unlock(); 6592 6593 genlmsg_end(msg, hdr); 6594 return genlmsg_reply(msg, info); 6595 6596 nla_put_failure_rcu: 6597 rcu_read_unlock(); 6598 nla_put_failure: 6599 put_failure: 6600 nlmsg_free(msg); 6601 return -EMSGSIZE; 6602 } 6603 6604 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb, 6605 u32 seq, int flags, struct wiphy *wiphy, 6606 const struct ieee80211_regdomain *regdom) 6607 { 6608 void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags, 6609 NL80211_CMD_GET_REG); 6610 6611 if (!hdr) 6612 return -1; 6613 6614 genl_dump_check_consistent(cb, hdr); 6615 6616 if (nl80211_put_regdom(regdom, msg)) 6617 goto nla_put_failure; 6618 6619 if (!wiphy && reg_last_request_cell_base() && 6620 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE, 6621 NL80211_USER_REG_HINT_CELL_BASE)) 6622 goto nla_put_failure; 6623 6624 if (wiphy && 6625 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy))) 6626 goto nla_put_failure; 6627 6628 if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED && 6629 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG)) 6630 goto nla_put_failure; 6631 6632 genlmsg_end(msg, hdr); 6633 return 0; 6634 6635 nla_put_failure: 6636 genlmsg_cancel(msg, hdr); 6637 return -EMSGSIZE; 6638 } 6639 6640 static int nl80211_get_reg_dump(struct sk_buff *skb, 6641 struct netlink_callback *cb) 6642 { 6643 const struct ieee80211_regdomain *regdom = NULL; 6644 struct cfg80211_registered_device *rdev; 6645 int err, reg_idx, start = cb->args[2]; 6646 6647 rtnl_lock(); 6648 6649 if (cfg80211_regdomain && start == 0) { 6650 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq, 6651 NLM_F_MULTI, NULL, 6652 rtnl_dereference(cfg80211_regdomain)); 6653 if (err < 0) 6654 goto out_err; 6655 } 6656 6657 /* the global regdom is idx 0 */ 6658 reg_idx = 1; 6659 list_for_each_entry(rdev, &cfg80211_rdev_list, list) { 6660 regdom = get_wiphy_regdom(&rdev->wiphy); 6661 if (!regdom) 6662 continue; 6663 6664 if (++reg_idx <= start) 6665 continue; 6666 6667 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq, 6668 NLM_F_MULTI, &rdev->wiphy, regdom); 6669 if (err < 0) { 6670 reg_idx--; 6671 break; 6672 } 6673 } 6674 6675 cb->args[2] = reg_idx; 6676 err = skb->len; 6677 out_err: 6678 rtnl_unlock(); 6679 return err; 6680 } 6681 6682 #ifdef CONFIG_CFG80211_CRDA_SUPPORT 6683 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = { 6684 [NL80211_ATTR_REG_RULE_FLAGS] = { .type = NLA_U32 }, 6685 [NL80211_ATTR_FREQ_RANGE_START] = { .type = NLA_U32 }, 6686 [NL80211_ATTR_FREQ_RANGE_END] = { .type = NLA_U32 }, 6687 [NL80211_ATTR_FREQ_RANGE_MAX_BW] = { .type = NLA_U32 }, 6688 [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN] = { .type = NLA_U32 }, 6689 [NL80211_ATTR_POWER_RULE_MAX_EIRP] = { .type = NLA_U32 }, 6690 [NL80211_ATTR_DFS_CAC_TIME] = { .type = NLA_U32 }, 6691 }; 6692 6693 static int parse_reg_rule(struct nlattr *tb[], 6694 struct ieee80211_reg_rule *reg_rule) 6695 { 6696 struct ieee80211_freq_range *freq_range = ®_rule->freq_range; 6697 struct ieee80211_power_rule *power_rule = ®_rule->power_rule; 6698 6699 if (!tb[NL80211_ATTR_REG_RULE_FLAGS]) 6700 return -EINVAL; 6701 if (!tb[NL80211_ATTR_FREQ_RANGE_START]) 6702 return -EINVAL; 6703 if (!tb[NL80211_ATTR_FREQ_RANGE_END]) 6704 return -EINVAL; 6705 if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]) 6706 return -EINVAL; 6707 if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]) 6708 return -EINVAL; 6709 6710 reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]); 6711 6712 freq_range->start_freq_khz = 6713 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]); 6714 freq_range->end_freq_khz = 6715 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]); 6716 freq_range->max_bandwidth_khz = 6717 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]); 6718 6719 power_rule->max_eirp = 6720 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]); 6721 6722 if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]) 6723 power_rule->max_antenna_gain = 6724 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]); 6725 6726 if (tb[NL80211_ATTR_DFS_CAC_TIME]) 6727 reg_rule->dfs_cac_ms = 6728 nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]); 6729 6730 return 0; 6731 } 6732 6733 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info) 6734 { 6735 struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1]; 6736 struct nlattr *nl_reg_rule; 6737 char *alpha2; 6738 int rem_reg_rules, r; 6739 u32 num_rules = 0, rule_idx = 0, size_of_regd; 6740 enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET; 6741 struct ieee80211_regdomain *rd; 6742 6743 if (!info->attrs[NL80211_ATTR_REG_ALPHA2]) 6744 return -EINVAL; 6745 6746 if (!info->attrs[NL80211_ATTR_REG_RULES]) 6747 return -EINVAL; 6748 6749 alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]); 6750 6751 if (info->attrs[NL80211_ATTR_DFS_REGION]) 6752 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]); 6753 6754 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES], 6755 rem_reg_rules) { 6756 num_rules++; 6757 if (num_rules > NL80211_MAX_SUPP_REG_RULES) 6758 return -EINVAL; 6759 } 6760 6761 if (!reg_is_valid_request(alpha2)) 6762 return -EINVAL; 6763 6764 size_of_regd = sizeof(struct ieee80211_regdomain) + 6765 num_rules * sizeof(struct ieee80211_reg_rule); 6766 6767 rd = kzalloc(size_of_regd, GFP_KERNEL); 6768 if (!rd) 6769 return -ENOMEM; 6770 6771 rd->n_reg_rules = num_rules; 6772 rd->alpha2[0] = alpha2[0]; 6773 rd->alpha2[1] = alpha2[1]; 6774 6775 /* 6776 * Disable DFS master mode if the DFS region was 6777 * not supported or known on this kernel. 6778 */ 6779 if (reg_supported_dfs_region(dfs_region)) 6780 rd->dfs_region = dfs_region; 6781 6782 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES], 6783 rem_reg_rules) { 6784 r = nla_parse_nested(tb, NL80211_REG_RULE_ATTR_MAX, 6785 nl_reg_rule, reg_rule_policy, 6786 info->extack); 6787 if (r) 6788 goto bad_reg; 6789 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]); 6790 if (r) 6791 goto bad_reg; 6792 6793 rule_idx++; 6794 6795 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) { 6796 r = -EINVAL; 6797 goto bad_reg; 6798 } 6799 } 6800 6801 /* set_regdom takes ownership of rd */ 6802 return set_regdom(rd, REGD_SOURCE_CRDA); 6803 bad_reg: 6804 kfree(rd); 6805 return r; 6806 } 6807 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */ 6808 6809 static int validate_scan_freqs(struct nlattr *freqs) 6810 { 6811 struct nlattr *attr1, *attr2; 6812 int n_channels = 0, tmp1, tmp2; 6813 6814 nla_for_each_nested(attr1, freqs, tmp1) 6815 if (nla_len(attr1) != sizeof(u32)) 6816 return 0; 6817 6818 nla_for_each_nested(attr1, freqs, tmp1) { 6819 n_channels++; 6820 /* 6821 * Some hardware has a limited channel list for 6822 * scanning, and it is pretty much nonsensical 6823 * to scan for a channel twice, so disallow that 6824 * and don't require drivers to check that the 6825 * channel list they get isn't longer than what 6826 * they can scan, as long as they can scan all 6827 * the channels they registered at once. 6828 */ 6829 nla_for_each_nested(attr2, freqs, tmp2) 6830 if (attr1 != attr2 && 6831 nla_get_u32(attr1) == nla_get_u32(attr2)) 6832 return 0; 6833 } 6834 6835 return n_channels; 6836 } 6837 6838 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b) 6839 { 6840 return b < NUM_NL80211_BANDS && wiphy->bands[b]; 6841 } 6842 6843 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy, 6844 struct cfg80211_bss_selection *bss_select) 6845 { 6846 struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1]; 6847 struct nlattr *nest; 6848 int err; 6849 bool found = false; 6850 int i; 6851 6852 /* only process one nested attribute */ 6853 nest = nla_data(nla); 6854 if (!nla_ok(nest, nla_len(nest))) 6855 return -EINVAL; 6856 6857 err = nla_parse_nested(attr, NL80211_BSS_SELECT_ATTR_MAX, nest, 6858 nl80211_bss_select_policy, NULL); 6859 if (err) 6860 return err; 6861 6862 /* only one attribute may be given */ 6863 for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) { 6864 if (attr[i]) { 6865 if (found) 6866 return -EINVAL; 6867 found = true; 6868 } 6869 } 6870 6871 bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID; 6872 6873 if (attr[NL80211_BSS_SELECT_ATTR_RSSI]) 6874 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI; 6875 6876 if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) { 6877 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF; 6878 bss_select->param.band_pref = 6879 nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]); 6880 if (!is_band_valid(wiphy, bss_select->param.band_pref)) 6881 return -EINVAL; 6882 } 6883 6884 if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) { 6885 struct nl80211_bss_select_rssi_adjust *adj_param; 6886 6887 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]); 6888 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST; 6889 bss_select->param.adjust.band = adj_param->band; 6890 bss_select->param.adjust.delta = adj_param->delta; 6891 if (!is_band_valid(wiphy, bss_select->param.adjust.band)) 6892 return -EINVAL; 6893 } 6894 6895 /* user-space did not provide behaviour attribute */ 6896 if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID) 6897 return -EINVAL; 6898 6899 if (!(wiphy->bss_select_support & BIT(bss_select->behaviour))) 6900 return -EINVAL; 6901 6902 return 0; 6903 } 6904 6905 static int nl80211_parse_random_mac(struct nlattr **attrs, 6906 u8 *mac_addr, u8 *mac_addr_mask) 6907 { 6908 int i; 6909 6910 if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) { 6911 eth_zero_addr(mac_addr); 6912 eth_zero_addr(mac_addr_mask); 6913 mac_addr[0] = 0x2; 6914 mac_addr_mask[0] = 0x3; 6915 6916 return 0; 6917 } 6918 6919 /* need both or none */ 6920 if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK]) 6921 return -EINVAL; 6922 6923 memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN); 6924 memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN); 6925 6926 /* don't allow or configure an mcast address */ 6927 if (!is_multicast_ether_addr(mac_addr_mask) || 6928 is_multicast_ether_addr(mac_addr)) 6929 return -EINVAL; 6930 6931 /* 6932 * allow users to pass a MAC address that has bits set outside 6933 * of the mask, but don't bother drivers with having to deal 6934 * with such bits 6935 */ 6936 for (i = 0; i < ETH_ALEN; i++) 6937 mac_addr[i] &= mac_addr_mask[i]; 6938 6939 return 0; 6940 } 6941 6942 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev) 6943 { 6944 ASSERT_WDEV_LOCK(wdev); 6945 6946 if (!cfg80211_beaconing_iface_active(wdev)) 6947 return true; 6948 6949 if (!(wdev->chandef.chan->flags & IEEE80211_CHAN_RADAR)) 6950 return true; 6951 6952 return regulatory_pre_cac_allowed(wdev->wiphy); 6953 } 6954 6955 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag, 6956 enum nl80211_ext_feature_index feat) 6957 { 6958 if (!(flags & flag)) 6959 return true; 6960 if (wiphy_ext_feature_isset(wiphy, feat)) 6961 return true; 6962 return false; 6963 } 6964 6965 static int 6966 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev, 6967 void *request, struct nlattr **attrs, 6968 bool is_sched_scan) 6969 { 6970 u8 *mac_addr, *mac_addr_mask; 6971 u32 *flags; 6972 enum nl80211_feature_flags randomness_flag; 6973 6974 if (!attrs[NL80211_ATTR_SCAN_FLAGS]) 6975 return 0; 6976 6977 if (is_sched_scan) { 6978 struct cfg80211_sched_scan_request *req = request; 6979 6980 randomness_flag = wdev ? 6981 NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR : 6982 NL80211_FEATURE_ND_RANDOM_MAC_ADDR; 6983 flags = &req->flags; 6984 mac_addr = req->mac_addr; 6985 mac_addr_mask = req->mac_addr_mask; 6986 } else { 6987 struct cfg80211_scan_request *req = request; 6988 6989 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR; 6990 flags = &req->flags; 6991 mac_addr = req->mac_addr; 6992 mac_addr_mask = req->mac_addr_mask; 6993 } 6994 6995 *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]); 6996 6997 if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) && 6998 !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) || 6999 !nl80211_check_scan_feat(wiphy, *flags, 7000 NL80211_SCAN_FLAG_LOW_SPAN, 7001 NL80211_EXT_FEATURE_LOW_SPAN_SCAN) || 7002 !nl80211_check_scan_feat(wiphy, *flags, 7003 NL80211_SCAN_FLAG_LOW_POWER, 7004 NL80211_EXT_FEATURE_LOW_POWER_SCAN) || 7005 !nl80211_check_scan_feat(wiphy, *flags, 7006 NL80211_SCAN_FLAG_HIGH_ACCURACY, 7007 NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) || 7008 !nl80211_check_scan_feat(wiphy, *flags, 7009 NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME, 7010 NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) || 7011 !nl80211_check_scan_feat(wiphy, *flags, 7012 NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP, 7013 NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) || 7014 !nl80211_check_scan_feat(wiphy, *flags, 7015 NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION, 7016 NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) || 7017 !nl80211_check_scan_feat(wiphy, *flags, 7018 NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE, 7019 NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) || 7020 !nl80211_check_scan_feat(wiphy, *flags, 7021 NL80211_SCAN_FLAG_RANDOM_SN, 7022 NL80211_EXT_FEATURE_SCAN_RANDOM_SN) || 7023 !nl80211_check_scan_feat(wiphy, *flags, 7024 NL80211_SCAN_FLAG_MIN_PREQ_CONTENT, 7025 NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT)) 7026 return -EOPNOTSUPP; 7027 7028 if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) { 7029 int err; 7030 7031 if (!(wiphy->features & randomness_flag) || 7032 (wdev && wdev->current_bss)) 7033 return -EOPNOTSUPP; 7034 7035 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask); 7036 if (err) 7037 return err; 7038 } 7039 7040 return 0; 7041 } 7042 7043 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info) 7044 { 7045 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7046 struct wireless_dev *wdev = info->user_ptr[1]; 7047 struct cfg80211_scan_request *request; 7048 struct nlattr *attr; 7049 struct wiphy *wiphy; 7050 int err, tmp, n_ssids = 0, n_channels, i; 7051 size_t ie_len; 7052 7053 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) 7054 return -EINVAL; 7055 7056 wiphy = &rdev->wiphy; 7057 7058 if (wdev->iftype == NL80211_IFTYPE_NAN) 7059 return -EOPNOTSUPP; 7060 7061 if (!rdev->ops->scan) 7062 return -EOPNOTSUPP; 7063 7064 if (rdev->scan_req || rdev->scan_msg) { 7065 err = -EBUSY; 7066 goto unlock; 7067 } 7068 7069 if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) { 7070 n_channels = validate_scan_freqs( 7071 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]); 7072 if (!n_channels) { 7073 err = -EINVAL; 7074 goto unlock; 7075 } 7076 } else { 7077 n_channels = ieee80211_get_num_supported_channels(wiphy); 7078 } 7079 7080 if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) 7081 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) 7082 n_ssids++; 7083 7084 if (n_ssids > wiphy->max_scan_ssids) { 7085 err = -EINVAL; 7086 goto unlock; 7087 } 7088 7089 if (info->attrs[NL80211_ATTR_IE]) 7090 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 7091 else 7092 ie_len = 0; 7093 7094 if (ie_len > wiphy->max_scan_ie_len) { 7095 err = -EINVAL; 7096 goto unlock; 7097 } 7098 7099 request = kzalloc(sizeof(*request) 7100 + sizeof(*request->ssids) * n_ssids 7101 + sizeof(*request->channels) * n_channels 7102 + ie_len, GFP_KERNEL); 7103 if (!request) { 7104 err = -ENOMEM; 7105 goto unlock; 7106 } 7107 7108 if (n_ssids) 7109 request->ssids = (void *)&request->channels[n_channels]; 7110 request->n_ssids = n_ssids; 7111 if (ie_len) { 7112 if (n_ssids) 7113 request->ie = (void *)(request->ssids + n_ssids); 7114 else 7115 request->ie = (void *)(request->channels + n_channels); 7116 } 7117 7118 i = 0; 7119 if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) { 7120 /* user specified, bail out if channel not found */ 7121 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) { 7122 struct ieee80211_channel *chan; 7123 7124 chan = ieee80211_get_channel(wiphy, nla_get_u32(attr)); 7125 7126 if (!chan) { 7127 err = -EINVAL; 7128 goto out_free; 7129 } 7130 7131 /* ignore disabled channels */ 7132 if (chan->flags & IEEE80211_CHAN_DISABLED) 7133 continue; 7134 7135 request->channels[i] = chan; 7136 i++; 7137 } 7138 } else { 7139 enum nl80211_band band; 7140 7141 /* all channels */ 7142 for (band = 0; band < NUM_NL80211_BANDS; band++) { 7143 int j; 7144 7145 if (!wiphy->bands[band]) 7146 continue; 7147 for (j = 0; j < wiphy->bands[band]->n_channels; j++) { 7148 struct ieee80211_channel *chan; 7149 7150 chan = &wiphy->bands[band]->channels[j]; 7151 7152 if (chan->flags & IEEE80211_CHAN_DISABLED) 7153 continue; 7154 7155 request->channels[i] = chan; 7156 i++; 7157 } 7158 } 7159 } 7160 7161 if (!i) { 7162 err = -EINVAL; 7163 goto out_free; 7164 } 7165 7166 request->n_channels = i; 7167 7168 wdev_lock(wdev); 7169 if (!cfg80211_off_channel_oper_allowed(wdev)) { 7170 struct ieee80211_channel *chan; 7171 7172 if (request->n_channels != 1) { 7173 wdev_unlock(wdev); 7174 err = -EBUSY; 7175 goto out_free; 7176 } 7177 7178 chan = request->channels[0]; 7179 if (chan->center_freq != wdev->chandef.chan->center_freq) { 7180 wdev_unlock(wdev); 7181 err = -EBUSY; 7182 goto out_free; 7183 } 7184 } 7185 wdev_unlock(wdev); 7186 7187 i = 0; 7188 if (n_ssids) { 7189 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) { 7190 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) { 7191 err = -EINVAL; 7192 goto out_free; 7193 } 7194 request->ssids[i].ssid_len = nla_len(attr); 7195 memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr)); 7196 i++; 7197 } 7198 } 7199 7200 if (info->attrs[NL80211_ATTR_IE]) { 7201 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 7202 memcpy((void *)request->ie, 7203 nla_data(info->attrs[NL80211_ATTR_IE]), 7204 request->ie_len); 7205 } 7206 7207 for (i = 0; i < NUM_NL80211_BANDS; i++) 7208 if (wiphy->bands[i]) 7209 request->rates[i] = 7210 (1 << wiphy->bands[i]->n_bitrates) - 1; 7211 7212 if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) { 7213 nla_for_each_nested(attr, 7214 info->attrs[NL80211_ATTR_SCAN_SUPP_RATES], 7215 tmp) { 7216 enum nl80211_band band = nla_type(attr); 7217 7218 if (band < 0 || band >= NUM_NL80211_BANDS) { 7219 err = -EINVAL; 7220 goto out_free; 7221 } 7222 7223 if (!wiphy->bands[band]) 7224 continue; 7225 7226 err = ieee80211_get_ratemask(wiphy->bands[band], 7227 nla_data(attr), 7228 nla_len(attr), 7229 &request->rates[band]); 7230 if (err) 7231 goto out_free; 7232 } 7233 } 7234 7235 if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) { 7236 if (!wiphy_ext_feature_isset(wiphy, 7237 NL80211_EXT_FEATURE_SET_SCAN_DWELL)) { 7238 err = -EOPNOTSUPP; 7239 goto out_free; 7240 } 7241 7242 request->duration = 7243 nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]); 7244 request->duration_mandatory = 7245 nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]); 7246 } 7247 7248 err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs, 7249 false); 7250 if (err) 7251 goto out_free; 7252 7253 request->no_cck = 7254 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]); 7255 7256 /* Initial implementation used NL80211_ATTR_MAC to set the specific 7257 * BSSID to scan for. This was problematic because that same attribute 7258 * was already used for another purpose (local random MAC address). The 7259 * NL80211_ATTR_BSSID attribute was added to fix this. For backwards 7260 * compatibility with older userspace components, also use the 7261 * NL80211_ATTR_MAC value here if it can be determined to be used for 7262 * the specific BSSID use case instead of the random MAC address 7263 * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use). 7264 */ 7265 if (info->attrs[NL80211_ATTR_BSSID]) 7266 memcpy(request->bssid, 7267 nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN); 7268 else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) && 7269 info->attrs[NL80211_ATTR_MAC]) 7270 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]), 7271 ETH_ALEN); 7272 else 7273 eth_broadcast_addr(request->bssid); 7274 7275 request->wdev = wdev; 7276 request->wiphy = &rdev->wiphy; 7277 request->scan_start = jiffies; 7278 7279 rdev->scan_req = request; 7280 err = rdev_scan(rdev, request); 7281 7282 if (!err) { 7283 nl80211_send_scan_start(rdev, wdev); 7284 if (wdev->netdev) 7285 dev_hold(wdev->netdev); 7286 } else { 7287 out_free: 7288 rdev->scan_req = NULL; 7289 kfree(request); 7290 } 7291 7292 unlock: 7293 return err; 7294 } 7295 7296 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info) 7297 { 7298 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7299 struct wireless_dev *wdev = info->user_ptr[1]; 7300 7301 if (!rdev->ops->abort_scan) 7302 return -EOPNOTSUPP; 7303 7304 if (rdev->scan_msg) 7305 return 0; 7306 7307 if (!rdev->scan_req) 7308 return -ENOENT; 7309 7310 rdev_abort_scan(rdev, wdev); 7311 return 0; 7312 } 7313 7314 static int 7315 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans, 7316 struct cfg80211_sched_scan_request *request, 7317 struct nlattr **attrs) 7318 { 7319 int tmp, err, i = 0; 7320 struct nlattr *attr; 7321 7322 if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) { 7323 u32 interval; 7324 7325 /* 7326 * If scan plans are not specified, 7327 * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this 7328 * case one scan plan will be set with the specified scan 7329 * interval and infinite number of iterations. 7330 */ 7331 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]); 7332 if (!interval) 7333 return -EINVAL; 7334 7335 request->scan_plans[0].interval = 7336 DIV_ROUND_UP(interval, MSEC_PER_SEC); 7337 if (!request->scan_plans[0].interval) 7338 return -EINVAL; 7339 7340 if (request->scan_plans[0].interval > 7341 wiphy->max_sched_scan_plan_interval) 7342 request->scan_plans[0].interval = 7343 wiphy->max_sched_scan_plan_interval; 7344 7345 return 0; 7346 } 7347 7348 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) { 7349 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1]; 7350 7351 if (WARN_ON(i >= n_plans)) 7352 return -EINVAL; 7353 7354 err = nla_parse_nested(plan, NL80211_SCHED_SCAN_PLAN_MAX, 7355 attr, nl80211_plan_policy, NULL); 7356 if (err) 7357 return err; 7358 7359 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]) 7360 return -EINVAL; 7361 7362 request->scan_plans[i].interval = 7363 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]); 7364 if (!request->scan_plans[i].interval || 7365 request->scan_plans[i].interval > 7366 wiphy->max_sched_scan_plan_interval) 7367 return -EINVAL; 7368 7369 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) { 7370 request->scan_plans[i].iterations = 7371 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]); 7372 if (!request->scan_plans[i].iterations || 7373 (request->scan_plans[i].iterations > 7374 wiphy->max_sched_scan_plan_iterations)) 7375 return -EINVAL; 7376 } else if (i < n_plans - 1) { 7377 /* 7378 * All scan plans but the last one must specify 7379 * a finite number of iterations 7380 */ 7381 return -EINVAL; 7382 } 7383 7384 i++; 7385 } 7386 7387 /* 7388 * The last scan plan must not specify the number of 7389 * iterations, it is supposed to run infinitely 7390 */ 7391 if (request->scan_plans[n_plans - 1].iterations) 7392 return -EINVAL; 7393 7394 return 0; 7395 } 7396 7397 static struct cfg80211_sched_scan_request * 7398 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev, 7399 struct nlattr **attrs, int max_match_sets) 7400 { 7401 struct cfg80211_sched_scan_request *request; 7402 struct nlattr *attr; 7403 int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0; 7404 enum nl80211_band band; 7405 size_t ie_len; 7406 struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1]; 7407 s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF; 7408 7409 if (!is_valid_ie_attr(attrs[NL80211_ATTR_IE])) 7410 return ERR_PTR(-EINVAL); 7411 7412 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) { 7413 n_channels = validate_scan_freqs( 7414 attrs[NL80211_ATTR_SCAN_FREQUENCIES]); 7415 if (!n_channels) 7416 return ERR_PTR(-EINVAL); 7417 } else { 7418 n_channels = ieee80211_get_num_supported_channels(wiphy); 7419 } 7420 7421 if (attrs[NL80211_ATTR_SCAN_SSIDS]) 7422 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS], 7423 tmp) 7424 n_ssids++; 7425 7426 if (n_ssids > wiphy->max_sched_scan_ssids) 7427 return ERR_PTR(-EINVAL); 7428 7429 /* 7430 * First, count the number of 'real' matchsets. Due to an issue with 7431 * the old implementation, matchsets containing only the RSSI attribute 7432 * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default' 7433 * RSSI for all matchsets, rather than their own matchset for reporting 7434 * all APs with a strong RSSI. This is needed to be compatible with 7435 * older userspace that treated a matchset with only the RSSI as the 7436 * global RSSI for all other matchsets - if there are other matchsets. 7437 */ 7438 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) { 7439 nla_for_each_nested(attr, 7440 attrs[NL80211_ATTR_SCHED_SCAN_MATCH], 7441 tmp) { 7442 struct nlattr *rssi; 7443 7444 err = nla_parse_nested(tb, 7445 NL80211_SCHED_SCAN_MATCH_ATTR_MAX, 7446 attr, nl80211_match_policy, 7447 NULL); 7448 if (err) 7449 return ERR_PTR(err); 7450 7451 /* SSID and BSSID are mutually exclusive */ 7452 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] && 7453 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) 7454 return ERR_PTR(-EINVAL); 7455 7456 /* add other standalone attributes here */ 7457 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] || 7458 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) { 7459 n_match_sets++; 7460 continue; 7461 } 7462 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI]; 7463 if (rssi) 7464 default_match_rssi = nla_get_s32(rssi); 7465 } 7466 } 7467 7468 /* However, if there's no other matchset, add the RSSI one */ 7469 if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF) 7470 n_match_sets = 1; 7471 7472 if (n_match_sets > max_match_sets) 7473 return ERR_PTR(-EINVAL); 7474 7475 if (attrs[NL80211_ATTR_IE]) 7476 ie_len = nla_len(attrs[NL80211_ATTR_IE]); 7477 else 7478 ie_len = 0; 7479 7480 if (ie_len > wiphy->max_sched_scan_ie_len) 7481 return ERR_PTR(-EINVAL); 7482 7483 if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) { 7484 /* 7485 * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since 7486 * each scan plan already specifies its own interval 7487 */ 7488 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]) 7489 return ERR_PTR(-EINVAL); 7490 7491 nla_for_each_nested(attr, 7492 attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) 7493 n_plans++; 7494 } else { 7495 /* 7496 * The scan interval attribute is kept for backward 7497 * compatibility. If no scan plans are specified and sched scan 7498 * interval is specified, one scan plan will be set with this 7499 * scan interval and infinite number of iterations. 7500 */ 7501 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]) 7502 return ERR_PTR(-EINVAL); 7503 7504 n_plans = 1; 7505 } 7506 7507 if (!n_plans || n_plans > wiphy->max_sched_scan_plans) 7508 return ERR_PTR(-EINVAL); 7509 7510 if (!wiphy_ext_feature_isset( 7511 wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) && 7512 (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] || 7513 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST])) 7514 return ERR_PTR(-EINVAL); 7515 7516 request = kzalloc(sizeof(*request) 7517 + sizeof(*request->ssids) * n_ssids 7518 + sizeof(*request->match_sets) * n_match_sets 7519 + sizeof(*request->scan_plans) * n_plans 7520 + sizeof(*request->channels) * n_channels 7521 + ie_len, GFP_KERNEL); 7522 if (!request) 7523 return ERR_PTR(-ENOMEM); 7524 7525 if (n_ssids) 7526 request->ssids = (void *)&request->channels[n_channels]; 7527 request->n_ssids = n_ssids; 7528 if (ie_len) { 7529 if (n_ssids) 7530 request->ie = (void *)(request->ssids + n_ssids); 7531 else 7532 request->ie = (void *)(request->channels + n_channels); 7533 } 7534 7535 if (n_match_sets) { 7536 if (request->ie) 7537 request->match_sets = (void *)(request->ie + ie_len); 7538 else if (n_ssids) 7539 request->match_sets = 7540 (void *)(request->ssids + n_ssids); 7541 else 7542 request->match_sets = 7543 (void *)(request->channels + n_channels); 7544 } 7545 request->n_match_sets = n_match_sets; 7546 7547 if (n_match_sets) 7548 request->scan_plans = (void *)(request->match_sets + 7549 n_match_sets); 7550 else if (request->ie) 7551 request->scan_plans = (void *)(request->ie + ie_len); 7552 else if (n_ssids) 7553 request->scan_plans = (void *)(request->ssids + n_ssids); 7554 else 7555 request->scan_plans = (void *)(request->channels + n_channels); 7556 7557 request->n_scan_plans = n_plans; 7558 7559 i = 0; 7560 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) { 7561 /* user specified, bail out if channel not found */ 7562 nla_for_each_nested(attr, 7563 attrs[NL80211_ATTR_SCAN_FREQUENCIES], 7564 tmp) { 7565 struct ieee80211_channel *chan; 7566 7567 chan = ieee80211_get_channel(wiphy, nla_get_u32(attr)); 7568 7569 if (!chan) { 7570 err = -EINVAL; 7571 goto out_free; 7572 } 7573 7574 /* ignore disabled channels */ 7575 if (chan->flags & IEEE80211_CHAN_DISABLED) 7576 continue; 7577 7578 request->channels[i] = chan; 7579 i++; 7580 } 7581 } else { 7582 /* all channels */ 7583 for (band = 0; band < NUM_NL80211_BANDS; band++) { 7584 int j; 7585 7586 if (!wiphy->bands[band]) 7587 continue; 7588 for (j = 0; j < wiphy->bands[band]->n_channels; j++) { 7589 struct ieee80211_channel *chan; 7590 7591 chan = &wiphy->bands[band]->channels[j]; 7592 7593 if (chan->flags & IEEE80211_CHAN_DISABLED) 7594 continue; 7595 7596 request->channels[i] = chan; 7597 i++; 7598 } 7599 } 7600 } 7601 7602 if (!i) { 7603 err = -EINVAL; 7604 goto out_free; 7605 } 7606 7607 request->n_channels = i; 7608 7609 i = 0; 7610 if (n_ssids) { 7611 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS], 7612 tmp) { 7613 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) { 7614 err = -EINVAL; 7615 goto out_free; 7616 } 7617 request->ssids[i].ssid_len = nla_len(attr); 7618 memcpy(request->ssids[i].ssid, nla_data(attr), 7619 nla_len(attr)); 7620 i++; 7621 } 7622 } 7623 7624 i = 0; 7625 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) { 7626 nla_for_each_nested(attr, 7627 attrs[NL80211_ATTR_SCHED_SCAN_MATCH], 7628 tmp) { 7629 struct nlattr *ssid, *bssid, *rssi; 7630 7631 err = nla_parse_nested(tb, 7632 NL80211_SCHED_SCAN_MATCH_ATTR_MAX, 7633 attr, nl80211_match_policy, 7634 NULL); 7635 if (err) 7636 goto out_free; 7637 ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]; 7638 bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]; 7639 if (ssid || bssid) { 7640 if (WARN_ON(i >= n_match_sets)) { 7641 /* this indicates a programming error, 7642 * the loop above should have verified 7643 * things properly 7644 */ 7645 err = -EINVAL; 7646 goto out_free; 7647 } 7648 7649 if (ssid) { 7650 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) { 7651 err = -EINVAL; 7652 goto out_free; 7653 } 7654 memcpy(request->match_sets[i].ssid.ssid, 7655 nla_data(ssid), nla_len(ssid)); 7656 request->match_sets[i].ssid.ssid_len = 7657 nla_len(ssid); 7658 } 7659 if (bssid) { 7660 if (nla_len(bssid) != ETH_ALEN) { 7661 err = -EINVAL; 7662 goto out_free; 7663 } 7664 memcpy(request->match_sets[i].bssid, 7665 nla_data(bssid), ETH_ALEN); 7666 } 7667 7668 /* special attribute - old implementation w/a */ 7669 request->match_sets[i].rssi_thold = 7670 default_match_rssi; 7671 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI]; 7672 if (rssi) 7673 request->match_sets[i].rssi_thold = 7674 nla_get_s32(rssi); 7675 } 7676 i++; 7677 } 7678 7679 /* there was no other matchset, so the RSSI one is alone */ 7680 if (i == 0 && n_match_sets) 7681 request->match_sets[0].rssi_thold = default_match_rssi; 7682 7683 request->min_rssi_thold = INT_MAX; 7684 for (i = 0; i < n_match_sets; i++) 7685 request->min_rssi_thold = 7686 min(request->match_sets[i].rssi_thold, 7687 request->min_rssi_thold); 7688 } else { 7689 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF; 7690 } 7691 7692 if (ie_len) { 7693 request->ie_len = ie_len; 7694 memcpy((void *)request->ie, 7695 nla_data(attrs[NL80211_ATTR_IE]), 7696 request->ie_len); 7697 } 7698 7699 err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true); 7700 if (err) 7701 goto out_free; 7702 7703 if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY]) 7704 request->delay = 7705 nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]); 7706 7707 if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) { 7708 request->relative_rssi = nla_get_s8( 7709 attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]); 7710 request->relative_rssi_set = true; 7711 } 7712 7713 if (request->relative_rssi_set && 7714 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) { 7715 struct nl80211_bss_select_rssi_adjust *rssi_adjust; 7716 7717 rssi_adjust = nla_data( 7718 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]); 7719 request->rssi_adjust.band = rssi_adjust->band; 7720 request->rssi_adjust.delta = rssi_adjust->delta; 7721 if (!is_band_valid(wiphy, request->rssi_adjust.band)) { 7722 err = -EINVAL; 7723 goto out_free; 7724 } 7725 } 7726 7727 err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs); 7728 if (err) 7729 goto out_free; 7730 7731 request->scan_start = jiffies; 7732 7733 return request; 7734 7735 out_free: 7736 kfree(request); 7737 return ERR_PTR(err); 7738 } 7739 7740 static int nl80211_start_sched_scan(struct sk_buff *skb, 7741 struct genl_info *info) 7742 { 7743 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7744 struct net_device *dev = info->user_ptr[1]; 7745 struct wireless_dev *wdev = dev->ieee80211_ptr; 7746 struct cfg80211_sched_scan_request *sched_scan_req; 7747 bool want_multi; 7748 int err; 7749 7750 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start) 7751 return -EOPNOTSUPP; 7752 7753 want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI]; 7754 err = cfg80211_sched_scan_req_possible(rdev, want_multi); 7755 if (err) 7756 return err; 7757 7758 sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev, 7759 info->attrs, 7760 rdev->wiphy.max_match_sets); 7761 7762 err = PTR_ERR_OR_ZERO(sched_scan_req); 7763 if (err) 7764 goto out_err; 7765 7766 /* leave request id zero for legacy request 7767 * or if driver does not support multi-scheduled scan 7768 */ 7769 if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1) { 7770 while (!sched_scan_req->reqid) 7771 sched_scan_req->reqid = rdev->wiphy.cookie_counter++; 7772 } 7773 7774 err = rdev_sched_scan_start(rdev, dev, sched_scan_req); 7775 if (err) 7776 goto out_free; 7777 7778 sched_scan_req->dev = dev; 7779 sched_scan_req->wiphy = &rdev->wiphy; 7780 7781 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 7782 sched_scan_req->owner_nlportid = info->snd_portid; 7783 7784 cfg80211_add_sched_scan_req(rdev, sched_scan_req); 7785 7786 nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN); 7787 return 0; 7788 7789 out_free: 7790 kfree(sched_scan_req); 7791 out_err: 7792 return err; 7793 } 7794 7795 static int nl80211_stop_sched_scan(struct sk_buff *skb, 7796 struct genl_info *info) 7797 { 7798 struct cfg80211_sched_scan_request *req; 7799 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7800 u64 cookie; 7801 7802 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop) 7803 return -EOPNOTSUPP; 7804 7805 if (info->attrs[NL80211_ATTR_COOKIE]) { 7806 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 7807 return __cfg80211_stop_sched_scan(rdev, cookie, false); 7808 } 7809 7810 req = list_first_or_null_rcu(&rdev->sched_scan_req_list, 7811 struct cfg80211_sched_scan_request, 7812 list); 7813 if (!req || req->reqid || 7814 (req->owner_nlportid && 7815 req->owner_nlportid != info->snd_portid)) 7816 return -ENOENT; 7817 7818 return cfg80211_stop_sched_scan_req(rdev, req, false); 7819 } 7820 7821 static int nl80211_start_radar_detection(struct sk_buff *skb, 7822 struct genl_info *info) 7823 { 7824 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7825 struct net_device *dev = info->user_ptr[1]; 7826 struct wireless_dev *wdev = dev->ieee80211_ptr; 7827 struct wiphy *wiphy = wdev->wiphy; 7828 struct cfg80211_chan_def chandef; 7829 enum nl80211_dfs_regions dfs_region; 7830 unsigned int cac_time_ms; 7831 int err; 7832 7833 dfs_region = reg_get_dfs_region(wiphy); 7834 if (dfs_region == NL80211_DFS_UNSET) 7835 return -EINVAL; 7836 7837 err = nl80211_parse_chandef(rdev, info, &chandef); 7838 if (err) 7839 return err; 7840 7841 if (netif_carrier_ok(dev)) 7842 return -EBUSY; 7843 7844 if (wdev->cac_started) 7845 return -EBUSY; 7846 7847 err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype); 7848 if (err < 0) 7849 return err; 7850 7851 if (err == 0) 7852 return -EINVAL; 7853 7854 if (!cfg80211_chandef_dfs_usable(wiphy, &chandef)) 7855 return -EINVAL; 7856 7857 /* CAC start is offloaded to HW and can't be started manually */ 7858 if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD)) 7859 return -EOPNOTSUPP; 7860 7861 if (!rdev->ops->start_radar_detection) 7862 return -EOPNOTSUPP; 7863 7864 cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef); 7865 if (WARN_ON(!cac_time_ms)) 7866 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS; 7867 7868 err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms); 7869 if (!err) { 7870 wdev->chandef = chandef; 7871 wdev->cac_started = true; 7872 wdev->cac_start_time = jiffies; 7873 wdev->cac_time_ms = cac_time_ms; 7874 } 7875 return err; 7876 } 7877 7878 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info) 7879 { 7880 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7881 struct net_device *dev = info->user_ptr[1]; 7882 struct wireless_dev *wdev = dev->ieee80211_ptr; 7883 struct cfg80211_csa_settings params; 7884 /* csa_attrs is defined static to avoid waste of stack size - this 7885 * function is called under RTNL lock, so this should not be a problem. 7886 */ 7887 static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1]; 7888 int err; 7889 bool need_new_beacon = false; 7890 bool need_handle_dfs_flag = true; 7891 int len, i; 7892 u32 cs_count; 7893 7894 if (!rdev->ops->channel_switch || 7895 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)) 7896 return -EOPNOTSUPP; 7897 7898 switch (dev->ieee80211_ptr->iftype) { 7899 case NL80211_IFTYPE_AP: 7900 case NL80211_IFTYPE_P2P_GO: 7901 need_new_beacon = true; 7902 /* For all modes except AP the handle_dfs flag needs to be 7903 * supplied to tell the kernel that userspace will handle radar 7904 * events when they happen. Otherwise a switch to a channel 7905 * requiring DFS will be rejected. 7906 */ 7907 need_handle_dfs_flag = false; 7908 7909 /* useless if AP is not running */ 7910 if (!wdev->beacon_interval) 7911 return -ENOTCONN; 7912 break; 7913 case NL80211_IFTYPE_ADHOC: 7914 if (!wdev->ssid_len) 7915 return -ENOTCONN; 7916 break; 7917 case NL80211_IFTYPE_MESH_POINT: 7918 if (!wdev->mesh_id_len) 7919 return -ENOTCONN; 7920 break; 7921 default: 7922 return -EOPNOTSUPP; 7923 } 7924 7925 memset(¶ms, 0, sizeof(params)); 7926 7927 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] || 7928 !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]) 7929 return -EINVAL; 7930 7931 /* only important for AP, IBSS and mesh create IEs internally */ 7932 if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES]) 7933 return -EINVAL; 7934 7935 /* Even though the attribute is u32, the specification says 7936 * u8, so let's make sure we don't overflow. 7937 */ 7938 cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]); 7939 if (cs_count > 255) 7940 return -EINVAL; 7941 7942 params.count = cs_count; 7943 7944 if (!need_new_beacon) 7945 goto skip_beacons; 7946 7947 err = nl80211_parse_beacon(info->attrs, ¶ms.beacon_after); 7948 if (err) 7949 return err; 7950 7951 err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX, 7952 info->attrs[NL80211_ATTR_CSA_IES], 7953 nl80211_policy, info->extack); 7954 if (err) 7955 return err; 7956 7957 err = nl80211_parse_beacon(csa_attrs, ¶ms.beacon_csa); 7958 if (err) 7959 return err; 7960 7961 if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]) 7962 return -EINVAL; 7963 7964 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]); 7965 if (!len || (len % sizeof(u16))) 7966 return -EINVAL; 7967 7968 params.n_counter_offsets_beacon = len / sizeof(u16); 7969 if (rdev->wiphy.max_num_csa_counters && 7970 (params.n_counter_offsets_beacon > 7971 rdev->wiphy.max_num_csa_counters)) 7972 return -EINVAL; 7973 7974 params.counter_offsets_beacon = 7975 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]); 7976 7977 /* sanity checks - counters should fit and be the same */ 7978 for (i = 0; i < params.n_counter_offsets_beacon; i++) { 7979 u16 offset = params.counter_offsets_beacon[i]; 7980 7981 if (offset >= params.beacon_csa.tail_len) 7982 return -EINVAL; 7983 7984 if (params.beacon_csa.tail[offset] != params.count) 7985 return -EINVAL; 7986 } 7987 7988 if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) { 7989 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]); 7990 if (!len || (len % sizeof(u16))) 7991 return -EINVAL; 7992 7993 params.n_counter_offsets_presp = len / sizeof(u16); 7994 if (rdev->wiphy.max_num_csa_counters && 7995 (params.n_counter_offsets_presp > 7996 rdev->wiphy.max_num_csa_counters)) 7997 return -EINVAL; 7998 7999 params.counter_offsets_presp = 8000 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]); 8001 8002 /* sanity checks - counters should fit and be the same */ 8003 for (i = 0; i < params.n_counter_offsets_presp; i++) { 8004 u16 offset = params.counter_offsets_presp[i]; 8005 8006 if (offset >= params.beacon_csa.probe_resp_len) 8007 return -EINVAL; 8008 8009 if (params.beacon_csa.probe_resp[offset] != 8010 params.count) 8011 return -EINVAL; 8012 } 8013 } 8014 8015 skip_beacons: 8016 err = nl80211_parse_chandef(rdev, info, ¶ms.chandef); 8017 if (err) 8018 return err; 8019 8020 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms.chandef, 8021 wdev->iftype)) 8022 return -EINVAL; 8023 8024 err = cfg80211_chandef_dfs_required(wdev->wiphy, 8025 ¶ms.chandef, 8026 wdev->iftype); 8027 if (err < 0) 8028 return err; 8029 8030 if (err > 0) { 8031 params.radar_required = true; 8032 if (need_handle_dfs_flag && 8033 !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) { 8034 return -EINVAL; 8035 } 8036 } 8037 8038 if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX]) 8039 params.block_tx = true; 8040 8041 wdev_lock(wdev); 8042 err = rdev_channel_switch(rdev, dev, ¶ms); 8043 wdev_unlock(wdev); 8044 8045 return err; 8046 } 8047 8048 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb, 8049 u32 seq, int flags, 8050 struct cfg80211_registered_device *rdev, 8051 struct wireless_dev *wdev, 8052 struct cfg80211_internal_bss *intbss) 8053 { 8054 struct cfg80211_bss *res = &intbss->pub; 8055 const struct cfg80211_bss_ies *ies; 8056 void *hdr; 8057 struct nlattr *bss; 8058 8059 ASSERT_WDEV_LOCK(wdev); 8060 8061 hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags, 8062 NL80211_CMD_NEW_SCAN_RESULTS); 8063 if (!hdr) 8064 return -1; 8065 8066 genl_dump_check_consistent(cb, hdr); 8067 8068 if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation)) 8069 goto nla_put_failure; 8070 if (wdev->netdev && 8071 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex)) 8072 goto nla_put_failure; 8073 if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 8074 NL80211_ATTR_PAD)) 8075 goto nla_put_failure; 8076 8077 bss = nla_nest_start(msg, NL80211_ATTR_BSS); 8078 if (!bss) 8079 goto nla_put_failure; 8080 if ((!is_zero_ether_addr(res->bssid) && 8081 nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid))) 8082 goto nla_put_failure; 8083 8084 rcu_read_lock(); 8085 /* indicate whether we have probe response data or not */ 8086 if (rcu_access_pointer(res->proberesp_ies) && 8087 nla_put_flag(msg, NL80211_BSS_PRESP_DATA)) 8088 goto fail_unlock_rcu; 8089 8090 /* this pointer prefers to be pointed to probe response data 8091 * but is always valid 8092 */ 8093 ies = rcu_dereference(res->ies); 8094 if (ies) { 8095 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf, 8096 NL80211_BSS_PAD)) 8097 goto fail_unlock_rcu; 8098 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS, 8099 ies->len, ies->data)) 8100 goto fail_unlock_rcu; 8101 } 8102 8103 /* and this pointer is always (unless driver didn't know) beacon data */ 8104 ies = rcu_dereference(res->beacon_ies); 8105 if (ies && ies->from_beacon) { 8106 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf, 8107 NL80211_BSS_PAD)) 8108 goto fail_unlock_rcu; 8109 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES, 8110 ies->len, ies->data)) 8111 goto fail_unlock_rcu; 8112 } 8113 rcu_read_unlock(); 8114 8115 if (res->beacon_interval && 8116 nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval)) 8117 goto nla_put_failure; 8118 if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) || 8119 nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) || 8120 nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) || 8121 nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO, 8122 jiffies_to_msecs(jiffies - intbss->ts))) 8123 goto nla_put_failure; 8124 8125 if (intbss->parent_tsf && 8126 (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF, 8127 intbss->parent_tsf, NL80211_BSS_PAD) || 8128 nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN, 8129 intbss->parent_bssid))) 8130 goto nla_put_failure; 8131 8132 if (intbss->ts_boottime && 8133 nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME, 8134 intbss->ts_boottime, NL80211_BSS_PAD)) 8135 goto nla_put_failure; 8136 8137 if (!nl80211_put_signal(msg, intbss->pub.chains, 8138 intbss->pub.chain_signal, 8139 NL80211_BSS_CHAIN_SIGNAL)) 8140 goto nla_put_failure; 8141 8142 switch (rdev->wiphy.signal_type) { 8143 case CFG80211_SIGNAL_TYPE_MBM: 8144 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal)) 8145 goto nla_put_failure; 8146 break; 8147 case CFG80211_SIGNAL_TYPE_UNSPEC: 8148 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal)) 8149 goto nla_put_failure; 8150 break; 8151 default: 8152 break; 8153 } 8154 8155 switch (wdev->iftype) { 8156 case NL80211_IFTYPE_P2P_CLIENT: 8157 case NL80211_IFTYPE_STATION: 8158 if (intbss == wdev->current_bss && 8159 nla_put_u32(msg, NL80211_BSS_STATUS, 8160 NL80211_BSS_STATUS_ASSOCIATED)) 8161 goto nla_put_failure; 8162 break; 8163 case NL80211_IFTYPE_ADHOC: 8164 if (intbss == wdev->current_bss && 8165 nla_put_u32(msg, NL80211_BSS_STATUS, 8166 NL80211_BSS_STATUS_IBSS_JOINED)) 8167 goto nla_put_failure; 8168 break; 8169 default: 8170 break; 8171 } 8172 8173 nla_nest_end(msg, bss); 8174 8175 genlmsg_end(msg, hdr); 8176 return 0; 8177 8178 fail_unlock_rcu: 8179 rcu_read_unlock(); 8180 nla_put_failure: 8181 genlmsg_cancel(msg, hdr); 8182 return -EMSGSIZE; 8183 } 8184 8185 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb) 8186 { 8187 struct cfg80211_registered_device *rdev; 8188 struct cfg80211_internal_bss *scan; 8189 struct wireless_dev *wdev; 8190 int start = cb->args[2], idx = 0; 8191 int err; 8192 8193 rtnl_lock(); 8194 err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev); 8195 if (err) { 8196 rtnl_unlock(); 8197 return err; 8198 } 8199 8200 wdev_lock(wdev); 8201 spin_lock_bh(&rdev->bss_lock); 8202 8203 /* 8204 * dump_scan will be called multiple times to break up the scan results 8205 * into multiple messages. It is unlikely that any more bss-es will be 8206 * expired after the first call, so only call only call this on the 8207 * first dump_scan invocation. 8208 */ 8209 if (start == 0) 8210 cfg80211_bss_expire(rdev); 8211 8212 cb->seq = rdev->bss_generation; 8213 8214 list_for_each_entry(scan, &rdev->bss_list, list) { 8215 if (++idx <= start) 8216 continue; 8217 if (nl80211_send_bss(skb, cb, 8218 cb->nlh->nlmsg_seq, NLM_F_MULTI, 8219 rdev, wdev, scan) < 0) { 8220 idx--; 8221 break; 8222 } 8223 } 8224 8225 spin_unlock_bh(&rdev->bss_lock); 8226 wdev_unlock(wdev); 8227 8228 cb->args[2] = idx; 8229 rtnl_unlock(); 8230 8231 return skb->len; 8232 } 8233 8234 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq, 8235 int flags, struct net_device *dev, 8236 bool allow_radio_stats, 8237 struct survey_info *survey) 8238 { 8239 void *hdr; 8240 struct nlattr *infoattr; 8241 8242 /* skip radio stats if userspace didn't request them */ 8243 if (!survey->channel && !allow_radio_stats) 8244 return 0; 8245 8246 hdr = nl80211hdr_put(msg, portid, seq, flags, 8247 NL80211_CMD_NEW_SURVEY_RESULTS); 8248 if (!hdr) 8249 return -ENOMEM; 8250 8251 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 8252 goto nla_put_failure; 8253 8254 infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO); 8255 if (!infoattr) 8256 goto nla_put_failure; 8257 8258 if (survey->channel && 8259 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY, 8260 survey->channel->center_freq)) 8261 goto nla_put_failure; 8262 8263 if ((survey->filled & SURVEY_INFO_NOISE_DBM) && 8264 nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise)) 8265 goto nla_put_failure; 8266 if ((survey->filled & SURVEY_INFO_IN_USE) && 8267 nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE)) 8268 goto nla_put_failure; 8269 if ((survey->filled & SURVEY_INFO_TIME) && 8270 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME, 8271 survey->time, NL80211_SURVEY_INFO_PAD)) 8272 goto nla_put_failure; 8273 if ((survey->filled & SURVEY_INFO_TIME_BUSY) && 8274 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY, 8275 survey->time_busy, NL80211_SURVEY_INFO_PAD)) 8276 goto nla_put_failure; 8277 if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) && 8278 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY, 8279 survey->time_ext_busy, NL80211_SURVEY_INFO_PAD)) 8280 goto nla_put_failure; 8281 if ((survey->filled & SURVEY_INFO_TIME_RX) && 8282 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX, 8283 survey->time_rx, NL80211_SURVEY_INFO_PAD)) 8284 goto nla_put_failure; 8285 if ((survey->filled & SURVEY_INFO_TIME_TX) && 8286 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX, 8287 survey->time_tx, NL80211_SURVEY_INFO_PAD)) 8288 goto nla_put_failure; 8289 if ((survey->filled & SURVEY_INFO_TIME_SCAN) && 8290 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN, 8291 survey->time_scan, NL80211_SURVEY_INFO_PAD)) 8292 goto nla_put_failure; 8293 8294 nla_nest_end(msg, infoattr); 8295 8296 genlmsg_end(msg, hdr); 8297 return 0; 8298 8299 nla_put_failure: 8300 genlmsg_cancel(msg, hdr); 8301 return -EMSGSIZE; 8302 } 8303 8304 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb) 8305 { 8306 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam); 8307 struct survey_info survey; 8308 struct cfg80211_registered_device *rdev; 8309 struct wireless_dev *wdev; 8310 int survey_idx = cb->args[2]; 8311 int res; 8312 bool radio_stats; 8313 8314 rtnl_lock(); 8315 res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev); 8316 if (res) 8317 goto out_err; 8318 8319 /* prepare_wdev_dump parsed the attributes */ 8320 radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS]; 8321 8322 if (!wdev->netdev) { 8323 res = -EINVAL; 8324 goto out_err; 8325 } 8326 8327 if (!rdev->ops->dump_survey) { 8328 res = -EOPNOTSUPP; 8329 goto out_err; 8330 } 8331 8332 while (1) { 8333 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey); 8334 if (res == -ENOENT) 8335 break; 8336 if (res) 8337 goto out_err; 8338 8339 /* don't send disabled channels, but do send non-channel data */ 8340 if (survey.channel && 8341 survey.channel->flags & IEEE80211_CHAN_DISABLED) { 8342 survey_idx++; 8343 continue; 8344 } 8345 8346 if (nl80211_send_survey(skb, 8347 NETLINK_CB(cb->skb).portid, 8348 cb->nlh->nlmsg_seq, NLM_F_MULTI, 8349 wdev->netdev, radio_stats, &survey) < 0) 8350 goto out; 8351 survey_idx++; 8352 } 8353 8354 out: 8355 cb->args[2] = survey_idx; 8356 res = skb->len; 8357 out_err: 8358 rtnl_unlock(); 8359 return res; 8360 } 8361 8362 static bool nl80211_valid_wpa_versions(u32 wpa_versions) 8363 { 8364 return !(wpa_versions & ~(NL80211_WPA_VERSION_1 | 8365 NL80211_WPA_VERSION_2)); 8366 } 8367 8368 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info) 8369 { 8370 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8371 struct net_device *dev = info->user_ptr[1]; 8372 struct ieee80211_channel *chan; 8373 const u8 *bssid, *ssid, *ie = NULL, *auth_data = NULL; 8374 int err, ssid_len, ie_len = 0, auth_data_len = 0; 8375 enum nl80211_auth_type auth_type; 8376 struct key_parse key; 8377 bool local_state_change; 8378 8379 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) 8380 return -EINVAL; 8381 8382 if (!info->attrs[NL80211_ATTR_MAC]) 8383 return -EINVAL; 8384 8385 if (!info->attrs[NL80211_ATTR_AUTH_TYPE]) 8386 return -EINVAL; 8387 8388 if (!info->attrs[NL80211_ATTR_SSID]) 8389 return -EINVAL; 8390 8391 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ]) 8392 return -EINVAL; 8393 8394 err = nl80211_parse_key(info, &key); 8395 if (err) 8396 return err; 8397 8398 if (key.idx >= 0) { 8399 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP) 8400 return -EINVAL; 8401 if (!key.p.key || !key.p.key_len) 8402 return -EINVAL; 8403 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 || 8404 key.p.key_len != WLAN_KEY_LEN_WEP40) && 8405 (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 || 8406 key.p.key_len != WLAN_KEY_LEN_WEP104)) 8407 return -EINVAL; 8408 if (key.idx > 3) 8409 return -EINVAL; 8410 } else { 8411 key.p.key_len = 0; 8412 key.p.key = NULL; 8413 } 8414 8415 if (key.idx >= 0) { 8416 int i; 8417 bool ok = false; 8418 8419 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) { 8420 if (key.p.cipher == rdev->wiphy.cipher_suites[i]) { 8421 ok = true; 8422 break; 8423 } 8424 } 8425 if (!ok) 8426 return -EINVAL; 8427 } 8428 8429 if (!rdev->ops->auth) 8430 return -EOPNOTSUPP; 8431 8432 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 8433 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 8434 return -EOPNOTSUPP; 8435 8436 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 8437 chan = nl80211_get_valid_chan(&rdev->wiphy, 8438 info->attrs[NL80211_ATTR_WIPHY_FREQ]); 8439 if (!chan) 8440 return -EINVAL; 8441 8442 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 8443 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 8444 8445 if (info->attrs[NL80211_ATTR_IE]) { 8446 ie = nla_data(info->attrs[NL80211_ATTR_IE]); 8447 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 8448 } 8449 8450 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]); 8451 if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE)) 8452 return -EINVAL; 8453 8454 if ((auth_type == NL80211_AUTHTYPE_SAE || 8455 auth_type == NL80211_AUTHTYPE_FILS_SK || 8456 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 8457 auth_type == NL80211_AUTHTYPE_FILS_PK) && 8458 !info->attrs[NL80211_ATTR_AUTH_DATA]) 8459 return -EINVAL; 8460 8461 if (info->attrs[NL80211_ATTR_AUTH_DATA]) { 8462 if (auth_type != NL80211_AUTHTYPE_SAE && 8463 auth_type != NL80211_AUTHTYPE_FILS_SK && 8464 auth_type != NL80211_AUTHTYPE_FILS_SK_PFS && 8465 auth_type != NL80211_AUTHTYPE_FILS_PK) 8466 return -EINVAL; 8467 auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]); 8468 auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]); 8469 /* need to include at least Auth Transaction and Status Code */ 8470 if (auth_data_len < 4) 8471 return -EINVAL; 8472 } 8473 8474 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE]; 8475 8476 /* 8477 * Since we no longer track auth state, ignore 8478 * requests to only change local state. 8479 */ 8480 if (local_state_change) 8481 return 0; 8482 8483 wdev_lock(dev->ieee80211_ptr); 8484 err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid, 8485 ssid, ssid_len, ie, ie_len, 8486 key.p.key, key.p.key_len, key.idx, 8487 auth_data, auth_data_len); 8488 wdev_unlock(dev->ieee80211_ptr); 8489 return err; 8490 } 8491 8492 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev, 8493 struct genl_info *info) 8494 { 8495 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 8496 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set"); 8497 return -EINVAL; 8498 } 8499 8500 if (!rdev->ops->tx_control_port || 8501 !wiphy_ext_feature_isset(&rdev->wiphy, 8502 NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211)) 8503 return -EOPNOTSUPP; 8504 8505 return 0; 8506 } 8507 8508 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev, 8509 struct genl_info *info, 8510 struct cfg80211_crypto_settings *settings, 8511 int cipher_limit) 8512 { 8513 memset(settings, 0, sizeof(*settings)); 8514 8515 settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT]; 8516 8517 if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) { 8518 u16 proto; 8519 8520 proto = nla_get_u16( 8521 info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]); 8522 settings->control_port_ethertype = cpu_to_be16(proto); 8523 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) && 8524 proto != ETH_P_PAE) 8525 return -EINVAL; 8526 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]) 8527 settings->control_port_no_encrypt = true; 8528 } else 8529 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE); 8530 8531 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) { 8532 int r = validate_pae_over_nl80211(rdev, info); 8533 8534 if (r < 0) 8535 return r; 8536 8537 settings->control_port_over_nl80211 = true; 8538 } 8539 8540 if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) { 8541 void *data; 8542 int len, i; 8543 8544 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]); 8545 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]); 8546 settings->n_ciphers_pairwise = len / sizeof(u32); 8547 8548 if (len % sizeof(u32)) 8549 return -EINVAL; 8550 8551 if (settings->n_ciphers_pairwise > cipher_limit) 8552 return -EINVAL; 8553 8554 memcpy(settings->ciphers_pairwise, data, len); 8555 8556 for (i = 0; i < settings->n_ciphers_pairwise; i++) 8557 if (!cfg80211_supported_cipher_suite( 8558 &rdev->wiphy, 8559 settings->ciphers_pairwise[i])) 8560 return -EINVAL; 8561 } 8562 8563 if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) { 8564 settings->cipher_group = 8565 nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]); 8566 if (!cfg80211_supported_cipher_suite(&rdev->wiphy, 8567 settings->cipher_group)) 8568 return -EINVAL; 8569 } 8570 8571 if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) { 8572 settings->wpa_versions = 8573 nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]); 8574 if (!nl80211_valid_wpa_versions(settings->wpa_versions)) 8575 return -EINVAL; 8576 } 8577 8578 if (info->attrs[NL80211_ATTR_AKM_SUITES]) { 8579 void *data; 8580 int len; 8581 8582 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]); 8583 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]); 8584 settings->n_akm_suites = len / sizeof(u32); 8585 8586 if (len % sizeof(u32)) 8587 return -EINVAL; 8588 8589 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES) 8590 return -EINVAL; 8591 8592 memcpy(settings->akm_suites, data, len); 8593 } 8594 8595 if (info->attrs[NL80211_ATTR_PMK]) { 8596 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN) 8597 return -EINVAL; 8598 if (!wiphy_ext_feature_isset(&rdev->wiphy, 8599 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK)) 8600 return -EINVAL; 8601 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]); 8602 } 8603 8604 return 0; 8605 } 8606 8607 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info) 8608 { 8609 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8610 struct net_device *dev = info->user_ptr[1]; 8611 struct ieee80211_channel *chan; 8612 struct cfg80211_assoc_request req = {}; 8613 const u8 *bssid, *ssid; 8614 int err, ssid_len = 0; 8615 8616 if (dev->ieee80211_ptr->conn_owner_nlportid && 8617 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid) 8618 return -EPERM; 8619 8620 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) 8621 return -EINVAL; 8622 8623 if (!info->attrs[NL80211_ATTR_MAC] || 8624 !info->attrs[NL80211_ATTR_SSID] || 8625 !info->attrs[NL80211_ATTR_WIPHY_FREQ]) 8626 return -EINVAL; 8627 8628 if (!rdev->ops->assoc) 8629 return -EOPNOTSUPP; 8630 8631 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 8632 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 8633 return -EOPNOTSUPP; 8634 8635 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 8636 8637 chan = nl80211_get_valid_chan(&rdev->wiphy, 8638 info->attrs[NL80211_ATTR_WIPHY_FREQ]); 8639 if (!chan) 8640 return -EINVAL; 8641 8642 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 8643 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 8644 8645 if (info->attrs[NL80211_ATTR_IE]) { 8646 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 8647 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 8648 } 8649 8650 if (info->attrs[NL80211_ATTR_USE_MFP]) { 8651 enum nl80211_mfp mfp = 8652 nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]); 8653 if (mfp == NL80211_MFP_REQUIRED) 8654 req.use_mfp = true; 8655 else if (mfp != NL80211_MFP_NO) 8656 return -EINVAL; 8657 } 8658 8659 if (info->attrs[NL80211_ATTR_PREV_BSSID]) 8660 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]); 8661 8662 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT])) 8663 req.flags |= ASSOC_REQ_DISABLE_HT; 8664 8665 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 8666 memcpy(&req.ht_capa_mask, 8667 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]), 8668 sizeof(req.ht_capa_mask)); 8669 8670 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) { 8671 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 8672 return -EINVAL; 8673 memcpy(&req.ht_capa, 8674 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]), 8675 sizeof(req.ht_capa)); 8676 } 8677 8678 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT])) 8679 req.flags |= ASSOC_REQ_DISABLE_VHT; 8680 8681 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) 8682 memcpy(&req.vht_capa_mask, 8683 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]), 8684 sizeof(req.vht_capa_mask)); 8685 8686 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) { 8687 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) 8688 return -EINVAL; 8689 memcpy(&req.vht_capa, 8690 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]), 8691 sizeof(req.vht_capa)); 8692 } 8693 8694 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) { 8695 if (!((rdev->wiphy.features & 8696 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) && 8697 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) && 8698 !wiphy_ext_feature_isset(&rdev->wiphy, 8699 NL80211_EXT_FEATURE_RRM)) 8700 return -EINVAL; 8701 req.flags |= ASSOC_REQ_USE_RRM; 8702 } 8703 8704 if (info->attrs[NL80211_ATTR_FILS_KEK]) { 8705 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]); 8706 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]); 8707 if (!info->attrs[NL80211_ATTR_FILS_NONCES]) 8708 return -EINVAL; 8709 req.fils_nonces = 8710 nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]); 8711 } 8712 8713 err = nl80211_crypto_settings(rdev, info, &req.crypto, 1); 8714 if (!err) { 8715 wdev_lock(dev->ieee80211_ptr); 8716 8717 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, 8718 ssid, ssid_len, &req); 8719 8720 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 8721 dev->ieee80211_ptr->conn_owner_nlportid = 8722 info->snd_portid; 8723 memcpy(dev->ieee80211_ptr->disconnect_bssid, 8724 bssid, ETH_ALEN); 8725 } 8726 8727 wdev_unlock(dev->ieee80211_ptr); 8728 } 8729 8730 return err; 8731 } 8732 8733 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info) 8734 { 8735 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8736 struct net_device *dev = info->user_ptr[1]; 8737 const u8 *ie = NULL, *bssid; 8738 int ie_len = 0, err; 8739 u16 reason_code; 8740 bool local_state_change; 8741 8742 if (dev->ieee80211_ptr->conn_owner_nlportid && 8743 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid) 8744 return -EPERM; 8745 8746 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) 8747 return -EINVAL; 8748 8749 if (!info->attrs[NL80211_ATTR_MAC]) 8750 return -EINVAL; 8751 8752 if (!info->attrs[NL80211_ATTR_REASON_CODE]) 8753 return -EINVAL; 8754 8755 if (!rdev->ops->deauth) 8756 return -EOPNOTSUPP; 8757 8758 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 8759 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 8760 return -EOPNOTSUPP; 8761 8762 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 8763 8764 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 8765 if (reason_code == 0) { 8766 /* Reason Code 0 is reserved */ 8767 return -EINVAL; 8768 } 8769 8770 if (info->attrs[NL80211_ATTR_IE]) { 8771 ie = nla_data(info->attrs[NL80211_ATTR_IE]); 8772 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 8773 } 8774 8775 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE]; 8776 8777 wdev_lock(dev->ieee80211_ptr); 8778 err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code, 8779 local_state_change); 8780 wdev_unlock(dev->ieee80211_ptr); 8781 return err; 8782 } 8783 8784 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info) 8785 { 8786 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8787 struct net_device *dev = info->user_ptr[1]; 8788 const u8 *ie = NULL, *bssid; 8789 int ie_len = 0, err; 8790 u16 reason_code; 8791 bool local_state_change; 8792 8793 if (dev->ieee80211_ptr->conn_owner_nlportid && 8794 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid) 8795 return -EPERM; 8796 8797 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) 8798 return -EINVAL; 8799 8800 if (!info->attrs[NL80211_ATTR_MAC]) 8801 return -EINVAL; 8802 8803 if (!info->attrs[NL80211_ATTR_REASON_CODE]) 8804 return -EINVAL; 8805 8806 if (!rdev->ops->disassoc) 8807 return -EOPNOTSUPP; 8808 8809 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 8810 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 8811 return -EOPNOTSUPP; 8812 8813 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 8814 8815 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 8816 if (reason_code == 0) { 8817 /* Reason Code 0 is reserved */ 8818 return -EINVAL; 8819 } 8820 8821 if (info->attrs[NL80211_ATTR_IE]) { 8822 ie = nla_data(info->attrs[NL80211_ATTR_IE]); 8823 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 8824 } 8825 8826 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE]; 8827 8828 wdev_lock(dev->ieee80211_ptr); 8829 err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code, 8830 local_state_change); 8831 wdev_unlock(dev->ieee80211_ptr); 8832 return err; 8833 } 8834 8835 static bool 8836 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev, 8837 int mcast_rate[NUM_NL80211_BANDS], 8838 int rateval) 8839 { 8840 struct wiphy *wiphy = &rdev->wiphy; 8841 bool found = false; 8842 int band, i; 8843 8844 for (band = 0; band < NUM_NL80211_BANDS; band++) { 8845 struct ieee80211_supported_band *sband; 8846 8847 sband = wiphy->bands[band]; 8848 if (!sband) 8849 continue; 8850 8851 for (i = 0; i < sband->n_bitrates; i++) { 8852 if (sband->bitrates[i].bitrate == rateval) { 8853 mcast_rate[band] = i + 1; 8854 found = true; 8855 break; 8856 } 8857 } 8858 } 8859 8860 return found; 8861 } 8862 8863 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info) 8864 { 8865 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8866 struct net_device *dev = info->user_ptr[1]; 8867 struct cfg80211_ibss_params ibss; 8868 struct wiphy *wiphy; 8869 struct cfg80211_cached_keys *connkeys = NULL; 8870 int err; 8871 8872 memset(&ibss, 0, sizeof(ibss)); 8873 8874 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) 8875 return -EINVAL; 8876 8877 if (!info->attrs[NL80211_ATTR_SSID] || 8878 !nla_len(info->attrs[NL80211_ATTR_SSID])) 8879 return -EINVAL; 8880 8881 ibss.beacon_interval = 100; 8882 8883 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) 8884 ibss.beacon_interval = 8885 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]); 8886 8887 err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC, 8888 ibss.beacon_interval); 8889 if (err) 8890 return err; 8891 8892 if (!rdev->ops->join_ibss) 8893 return -EOPNOTSUPP; 8894 8895 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) 8896 return -EOPNOTSUPP; 8897 8898 wiphy = &rdev->wiphy; 8899 8900 if (info->attrs[NL80211_ATTR_MAC]) { 8901 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 8902 8903 if (!is_valid_ether_addr(ibss.bssid)) 8904 return -EINVAL; 8905 } 8906 ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 8907 ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 8908 8909 if (info->attrs[NL80211_ATTR_IE]) { 8910 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 8911 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 8912 } 8913 8914 err = nl80211_parse_chandef(rdev, info, &ibss.chandef); 8915 if (err) 8916 return err; 8917 8918 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef, 8919 NL80211_IFTYPE_ADHOC)) 8920 return -EINVAL; 8921 8922 switch (ibss.chandef.width) { 8923 case NL80211_CHAN_WIDTH_5: 8924 case NL80211_CHAN_WIDTH_10: 8925 case NL80211_CHAN_WIDTH_20_NOHT: 8926 break; 8927 case NL80211_CHAN_WIDTH_20: 8928 case NL80211_CHAN_WIDTH_40: 8929 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)) 8930 return -EINVAL; 8931 break; 8932 case NL80211_CHAN_WIDTH_80: 8933 case NL80211_CHAN_WIDTH_80P80: 8934 case NL80211_CHAN_WIDTH_160: 8935 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)) 8936 return -EINVAL; 8937 if (!wiphy_ext_feature_isset(&rdev->wiphy, 8938 NL80211_EXT_FEATURE_VHT_IBSS)) 8939 return -EINVAL; 8940 break; 8941 default: 8942 return -EINVAL; 8943 } 8944 8945 ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED]; 8946 ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY]; 8947 8948 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) { 8949 u8 *rates = 8950 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 8951 int n_rates = 8952 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 8953 struct ieee80211_supported_band *sband = 8954 wiphy->bands[ibss.chandef.chan->band]; 8955 8956 err = ieee80211_get_ratemask(sband, rates, n_rates, 8957 &ibss.basic_rates); 8958 if (err) 8959 return err; 8960 } 8961 8962 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 8963 memcpy(&ibss.ht_capa_mask, 8964 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]), 8965 sizeof(ibss.ht_capa_mask)); 8966 8967 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) { 8968 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 8969 return -EINVAL; 8970 memcpy(&ibss.ht_capa, 8971 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]), 8972 sizeof(ibss.ht_capa)); 8973 } 8974 8975 if (info->attrs[NL80211_ATTR_MCAST_RATE] && 8976 !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate, 8977 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]))) 8978 return -EINVAL; 8979 8980 if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) { 8981 bool no_ht = false; 8982 8983 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht); 8984 if (IS_ERR(connkeys)) 8985 return PTR_ERR(connkeys); 8986 8987 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) && 8988 no_ht) { 8989 kzfree(connkeys); 8990 return -EINVAL; 8991 } 8992 } 8993 8994 ibss.control_port = 8995 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]); 8996 8997 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) { 8998 int r = validate_pae_over_nl80211(rdev, info); 8999 9000 if (r < 0) 9001 return r; 9002 9003 ibss.control_port_over_nl80211 = true; 9004 } 9005 9006 ibss.userspace_handles_dfs = 9007 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]); 9008 9009 wdev_lock(dev->ieee80211_ptr); 9010 err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys); 9011 if (err) 9012 kzfree(connkeys); 9013 else if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 9014 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid; 9015 wdev_unlock(dev->ieee80211_ptr); 9016 9017 return err; 9018 } 9019 9020 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info) 9021 { 9022 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9023 struct net_device *dev = info->user_ptr[1]; 9024 9025 if (!rdev->ops->leave_ibss) 9026 return -EOPNOTSUPP; 9027 9028 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) 9029 return -EOPNOTSUPP; 9030 9031 return cfg80211_leave_ibss(rdev, dev, false); 9032 } 9033 9034 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info) 9035 { 9036 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9037 struct net_device *dev = info->user_ptr[1]; 9038 int mcast_rate[NUM_NL80211_BANDS]; 9039 u32 nla_rate; 9040 int err; 9041 9042 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC && 9043 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT && 9044 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB) 9045 return -EOPNOTSUPP; 9046 9047 if (!rdev->ops->set_mcast_rate) 9048 return -EOPNOTSUPP; 9049 9050 memset(mcast_rate, 0, sizeof(mcast_rate)); 9051 9052 if (!info->attrs[NL80211_ATTR_MCAST_RATE]) 9053 return -EINVAL; 9054 9055 nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]); 9056 if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate)) 9057 return -EINVAL; 9058 9059 err = rdev_set_mcast_rate(rdev, dev, mcast_rate); 9060 9061 return err; 9062 } 9063 9064 static struct sk_buff * 9065 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev, 9066 struct wireless_dev *wdev, int approxlen, 9067 u32 portid, u32 seq, enum nl80211_commands cmd, 9068 enum nl80211_attrs attr, 9069 const struct nl80211_vendor_cmd_info *info, 9070 gfp_t gfp) 9071 { 9072 struct sk_buff *skb; 9073 void *hdr; 9074 struct nlattr *data; 9075 9076 skb = nlmsg_new(approxlen + 100, gfp); 9077 if (!skb) 9078 return NULL; 9079 9080 hdr = nl80211hdr_put(skb, portid, seq, 0, cmd); 9081 if (!hdr) { 9082 kfree_skb(skb); 9083 return NULL; 9084 } 9085 9086 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx)) 9087 goto nla_put_failure; 9088 9089 if (info) { 9090 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID, 9091 info->vendor_id)) 9092 goto nla_put_failure; 9093 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD, 9094 info->subcmd)) 9095 goto nla_put_failure; 9096 } 9097 9098 if (wdev) { 9099 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV, 9100 wdev_id(wdev), NL80211_ATTR_PAD)) 9101 goto nla_put_failure; 9102 if (wdev->netdev && 9103 nla_put_u32(skb, NL80211_ATTR_IFINDEX, 9104 wdev->netdev->ifindex)) 9105 goto nla_put_failure; 9106 } 9107 9108 data = nla_nest_start(skb, attr); 9109 if (!data) 9110 goto nla_put_failure; 9111 9112 ((void **)skb->cb)[0] = rdev; 9113 ((void **)skb->cb)[1] = hdr; 9114 ((void **)skb->cb)[2] = data; 9115 9116 return skb; 9117 9118 nla_put_failure: 9119 kfree_skb(skb); 9120 return NULL; 9121 } 9122 9123 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy, 9124 struct wireless_dev *wdev, 9125 enum nl80211_commands cmd, 9126 enum nl80211_attrs attr, 9127 int vendor_event_idx, 9128 int approxlen, gfp_t gfp) 9129 { 9130 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 9131 const struct nl80211_vendor_cmd_info *info; 9132 9133 switch (cmd) { 9134 case NL80211_CMD_TESTMODE: 9135 if (WARN_ON(vendor_event_idx != -1)) 9136 return NULL; 9137 info = NULL; 9138 break; 9139 case NL80211_CMD_VENDOR: 9140 if (WARN_ON(vendor_event_idx < 0 || 9141 vendor_event_idx >= wiphy->n_vendor_events)) 9142 return NULL; 9143 info = &wiphy->vendor_events[vendor_event_idx]; 9144 break; 9145 default: 9146 WARN_ON(1); 9147 return NULL; 9148 } 9149 9150 return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, 0, 0, 9151 cmd, attr, info, gfp); 9152 } 9153 EXPORT_SYMBOL(__cfg80211_alloc_event_skb); 9154 9155 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp) 9156 { 9157 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0]; 9158 void *hdr = ((void **)skb->cb)[1]; 9159 struct nlattr *data = ((void **)skb->cb)[2]; 9160 enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE; 9161 9162 /* clear CB data for netlink core to own from now on */ 9163 memset(skb->cb, 0, sizeof(skb->cb)); 9164 9165 nla_nest_end(skb, data); 9166 genlmsg_end(skb, hdr); 9167 9168 if (data->nla_type == NL80211_ATTR_VENDOR_DATA) 9169 mcgrp = NL80211_MCGRP_VENDOR; 9170 9171 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0, 9172 mcgrp, gfp); 9173 } 9174 EXPORT_SYMBOL(__cfg80211_send_event_skb); 9175 9176 #ifdef CONFIG_NL80211_TESTMODE 9177 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info) 9178 { 9179 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9180 struct wireless_dev *wdev = 9181 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs); 9182 int err; 9183 9184 if (!rdev->ops->testmode_cmd) 9185 return -EOPNOTSUPP; 9186 9187 if (IS_ERR(wdev)) { 9188 err = PTR_ERR(wdev); 9189 if (err != -EINVAL) 9190 return err; 9191 wdev = NULL; 9192 } else if (wdev->wiphy != &rdev->wiphy) { 9193 return -EINVAL; 9194 } 9195 9196 if (!info->attrs[NL80211_ATTR_TESTDATA]) 9197 return -EINVAL; 9198 9199 rdev->cur_cmd_info = info; 9200 err = rdev_testmode_cmd(rdev, wdev, 9201 nla_data(info->attrs[NL80211_ATTR_TESTDATA]), 9202 nla_len(info->attrs[NL80211_ATTR_TESTDATA])); 9203 rdev->cur_cmd_info = NULL; 9204 9205 return err; 9206 } 9207 9208 static int nl80211_testmode_dump(struct sk_buff *skb, 9209 struct netlink_callback *cb) 9210 { 9211 struct cfg80211_registered_device *rdev; 9212 int err; 9213 long phy_idx; 9214 void *data = NULL; 9215 int data_len = 0; 9216 9217 rtnl_lock(); 9218 9219 if (cb->args[0]) { 9220 /* 9221 * 0 is a valid index, but not valid for args[0], 9222 * so we need to offset by 1. 9223 */ 9224 phy_idx = cb->args[0] - 1; 9225 9226 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx); 9227 if (!rdev) { 9228 err = -ENOENT; 9229 goto out_err; 9230 } 9231 } else { 9232 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam); 9233 9234 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, 9235 attrbuf, nl80211_fam.maxattr, 9236 nl80211_policy, NULL); 9237 if (err) 9238 goto out_err; 9239 9240 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf); 9241 if (IS_ERR(rdev)) { 9242 err = PTR_ERR(rdev); 9243 goto out_err; 9244 } 9245 phy_idx = rdev->wiphy_idx; 9246 9247 if (attrbuf[NL80211_ATTR_TESTDATA]) 9248 cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA]; 9249 } 9250 9251 if (cb->args[1]) { 9252 data = nla_data((void *)cb->args[1]); 9253 data_len = nla_len((void *)cb->args[1]); 9254 } 9255 9256 if (!rdev->ops->testmode_dump) { 9257 err = -EOPNOTSUPP; 9258 goto out_err; 9259 } 9260 9261 while (1) { 9262 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid, 9263 cb->nlh->nlmsg_seq, NLM_F_MULTI, 9264 NL80211_CMD_TESTMODE); 9265 struct nlattr *tmdata; 9266 9267 if (!hdr) 9268 break; 9269 9270 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) { 9271 genlmsg_cancel(skb, hdr); 9272 break; 9273 } 9274 9275 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA); 9276 if (!tmdata) { 9277 genlmsg_cancel(skb, hdr); 9278 break; 9279 } 9280 err = rdev_testmode_dump(rdev, skb, cb, data, data_len); 9281 nla_nest_end(skb, tmdata); 9282 9283 if (err == -ENOBUFS || err == -ENOENT) { 9284 genlmsg_cancel(skb, hdr); 9285 break; 9286 } else if (err) { 9287 genlmsg_cancel(skb, hdr); 9288 goto out_err; 9289 } 9290 9291 genlmsg_end(skb, hdr); 9292 } 9293 9294 err = skb->len; 9295 /* see above */ 9296 cb->args[0] = phy_idx + 1; 9297 out_err: 9298 rtnl_unlock(); 9299 return err; 9300 } 9301 #endif 9302 9303 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info) 9304 { 9305 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9306 struct net_device *dev = info->user_ptr[1]; 9307 struct cfg80211_connect_params connect; 9308 struct wiphy *wiphy; 9309 struct cfg80211_cached_keys *connkeys = NULL; 9310 int err; 9311 9312 memset(&connect, 0, sizeof(connect)); 9313 9314 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) 9315 return -EINVAL; 9316 9317 if (!info->attrs[NL80211_ATTR_SSID] || 9318 !nla_len(info->attrs[NL80211_ATTR_SSID])) 9319 return -EINVAL; 9320 9321 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) { 9322 connect.auth_type = 9323 nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]); 9324 if (!nl80211_valid_auth_type(rdev, connect.auth_type, 9325 NL80211_CMD_CONNECT)) 9326 return -EINVAL; 9327 } else 9328 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC; 9329 9330 connect.privacy = info->attrs[NL80211_ATTR_PRIVACY]; 9331 9332 if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] && 9333 !wiphy_ext_feature_isset(&rdev->wiphy, 9334 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X)) 9335 return -EINVAL; 9336 connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS]; 9337 9338 err = nl80211_crypto_settings(rdev, info, &connect.crypto, 9339 NL80211_MAX_NR_CIPHER_SUITES); 9340 if (err) 9341 return err; 9342 9343 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 9344 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 9345 return -EOPNOTSUPP; 9346 9347 wiphy = &rdev->wiphy; 9348 9349 connect.bg_scan_period = -1; 9350 if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] && 9351 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) { 9352 connect.bg_scan_period = 9353 nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]); 9354 } 9355 9356 if (info->attrs[NL80211_ATTR_MAC]) 9357 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 9358 else if (info->attrs[NL80211_ATTR_MAC_HINT]) 9359 connect.bssid_hint = 9360 nla_data(info->attrs[NL80211_ATTR_MAC_HINT]); 9361 connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 9362 connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 9363 9364 if (info->attrs[NL80211_ATTR_IE]) { 9365 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 9366 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 9367 } 9368 9369 if (info->attrs[NL80211_ATTR_USE_MFP]) { 9370 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]); 9371 if (connect.mfp == NL80211_MFP_OPTIONAL && 9372 !wiphy_ext_feature_isset(&rdev->wiphy, 9373 NL80211_EXT_FEATURE_MFP_OPTIONAL)) 9374 return -EOPNOTSUPP; 9375 9376 if (connect.mfp != NL80211_MFP_REQUIRED && 9377 connect.mfp != NL80211_MFP_NO && 9378 connect.mfp != NL80211_MFP_OPTIONAL) 9379 return -EINVAL; 9380 } else { 9381 connect.mfp = NL80211_MFP_NO; 9382 } 9383 9384 if (info->attrs[NL80211_ATTR_PREV_BSSID]) 9385 connect.prev_bssid = 9386 nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]); 9387 9388 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 9389 connect.channel = nl80211_get_valid_chan( 9390 wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]); 9391 if (!connect.channel) 9392 return -EINVAL; 9393 } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) { 9394 connect.channel_hint = nl80211_get_valid_chan( 9395 wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]); 9396 if (!connect.channel_hint) 9397 return -EINVAL; 9398 } 9399 9400 if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) { 9401 connkeys = nl80211_parse_connkeys(rdev, info, NULL); 9402 if (IS_ERR(connkeys)) 9403 return PTR_ERR(connkeys); 9404 } 9405 9406 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT])) 9407 connect.flags |= ASSOC_REQ_DISABLE_HT; 9408 9409 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 9410 memcpy(&connect.ht_capa_mask, 9411 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]), 9412 sizeof(connect.ht_capa_mask)); 9413 9414 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) { 9415 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) { 9416 kzfree(connkeys); 9417 return -EINVAL; 9418 } 9419 memcpy(&connect.ht_capa, 9420 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]), 9421 sizeof(connect.ht_capa)); 9422 } 9423 9424 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT])) 9425 connect.flags |= ASSOC_REQ_DISABLE_VHT; 9426 9427 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) 9428 memcpy(&connect.vht_capa_mask, 9429 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]), 9430 sizeof(connect.vht_capa_mask)); 9431 9432 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) { 9433 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) { 9434 kzfree(connkeys); 9435 return -EINVAL; 9436 } 9437 memcpy(&connect.vht_capa, 9438 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]), 9439 sizeof(connect.vht_capa)); 9440 } 9441 9442 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) { 9443 if (!((rdev->wiphy.features & 9444 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) && 9445 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) && 9446 !wiphy_ext_feature_isset(&rdev->wiphy, 9447 NL80211_EXT_FEATURE_RRM)) { 9448 kzfree(connkeys); 9449 return -EINVAL; 9450 } 9451 connect.flags |= ASSOC_REQ_USE_RRM; 9452 } 9453 9454 connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]); 9455 if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) { 9456 kzfree(connkeys); 9457 return -EOPNOTSUPP; 9458 } 9459 9460 if (info->attrs[NL80211_ATTR_BSS_SELECT]) { 9461 /* bss selection makes no sense if bssid is set */ 9462 if (connect.bssid) { 9463 kzfree(connkeys); 9464 return -EINVAL; 9465 } 9466 9467 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT], 9468 wiphy, &connect.bss_select); 9469 if (err) { 9470 kzfree(connkeys); 9471 return err; 9472 } 9473 } 9474 9475 if (wiphy_ext_feature_isset(&rdev->wiphy, 9476 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) && 9477 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] && 9478 info->attrs[NL80211_ATTR_FILS_ERP_REALM] && 9479 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] && 9480 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 9481 connect.fils_erp_username = 9482 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 9483 connect.fils_erp_username_len = 9484 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 9485 connect.fils_erp_realm = 9486 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 9487 connect.fils_erp_realm_len = 9488 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 9489 connect.fils_erp_next_seq_num = 9490 nla_get_u16( 9491 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]); 9492 connect.fils_erp_rrk = 9493 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 9494 connect.fils_erp_rrk_len = 9495 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 9496 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] || 9497 info->attrs[NL80211_ATTR_FILS_ERP_REALM] || 9498 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] || 9499 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 9500 kzfree(connkeys); 9501 return -EINVAL; 9502 } 9503 9504 if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) { 9505 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 9506 kzfree(connkeys); 9507 GENL_SET_ERR_MSG(info, 9508 "external auth requires connection ownership"); 9509 return -EINVAL; 9510 } 9511 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT; 9512 } 9513 9514 wdev_lock(dev->ieee80211_ptr); 9515 9516 err = cfg80211_connect(rdev, dev, &connect, connkeys, 9517 connect.prev_bssid); 9518 if (err) 9519 kzfree(connkeys); 9520 9521 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 9522 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid; 9523 if (connect.bssid) 9524 memcpy(dev->ieee80211_ptr->disconnect_bssid, 9525 connect.bssid, ETH_ALEN); 9526 else 9527 memset(dev->ieee80211_ptr->disconnect_bssid, 9528 0, ETH_ALEN); 9529 } 9530 9531 wdev_unlock(dev->ieee80211_ptr); 9532 9533 return err; 9534 } 9535 9536 static int nl80211_update_connect_params(struct sk_buff *skb, 9537 struct genl_info *info) 9538 { 9539 struct cfg80211_connect_params connect = {}; 9540 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9541 struct net_device *dev = info->user_ptr[1]; 9542 struct wireless_dev *wdev = dev->ieee80211_ptr; 9543 bool fils_sk_offload; 9544 u32 auth_type; 9545 u32 changed = 0; 9546 int ret; 9547 9548 if (!rdev->ops->update_connect_params) 9549 return -EOPNOTSUPP; 9550 9551 if (info->attrs[NL80211_ATTR_IE]) { 9552 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) 9553 return -EINVAL; 9554 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 9555 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 9556 changed |= UPDATE_ASSOC_IES; 9557 } 9558 9559 fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy, 9560 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD); 9561 9562 /* 9563 * when driver supports fils-sk offload all attributes must be 9564 * provided. So the else covers "fils-sk-not-all" and 9565 * "no-fils-sk-any". 9566 */ 9567 if (fils_sk_offload && 9568 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] && 9569 info->attrs[NL80211_ATTR_FILS_ERP_REALM] && 9570 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] && 9571 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 9572 connect.fils_erp_username = 9573 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 9574 connect.fils_erp_username_len = 9575 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 9576 connect.fils_erp_realm = 9577 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 9578 connect.fils_erp_realm_len = 9579 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 9580 connect.fils_erp_next_seq_num = 9581 nla_get_u16( 9582 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]); 9583 connect.fils_erp_rrk = 9584 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 9585 connect.fils_erp_rrk_len = 9586 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 9587 changed |= UPDATE_FILS_ERP_INFO; 9588 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] || 9589 info->attrs[NL80211_ATTR_FILS_ERP_REALM] || 9590 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] || 9591 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 9592 return -EINVAL; 9593 } 9594 9595 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) { 9596 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]); 9597 if (!nl80211_valid_auth_type(rdev, auth_type, 9598 NL80211_CMD_CONNECT)) 9599 return -EINVAL; 9600 9601 if (auth_type == NL80211_AUTHTYPE_FILS_SK && 9602 fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO)) 9603 return -EINVAL; 9604 9605 connect.auth_type = auth_type; 9606 changed |= UPDATE_AUTH_TYPE; 9607 } 9608 9609 wdev_lock(dev->ieee80211_ptr); 9610 if (!wdev->current_bss) 9611 ret = -ENOLINK; 9612 else 9613 ret = rdev_update_connect_params(rdev, dev, &connect, changed); 9614 wdev_unlock(dev->ieee80211_ptr); 9615 9616 return ret; 9617 } 9618 9619 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info) 9620 { 9621 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9622 struct net_device *dev = info->user_ptr[1]; 9623 u16 reason; 9624 int ret; 9625 9626 if (dev->ieee80211_ptr->conn_owner_nlportid && 9627 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid) 9628 return -EPERM; 9629 9630 if (!info->attrs[NL80211_ATTR_REASON_CODE]) 9631 reason = WLAN_REASON_DEAUTH_LEAVING; 9632 else 9633 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 9634 9635 if (reason == 0) 9636 return -EINVAL; 9637 9638 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 9639 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 9640 return -EOPNOTSUPP; 9641 9642 wdev_lock(dev->ieee80211_ptr); 9643 ret = cfg80211_disconnect(rdev, dev, reason, true); 9644 wdev_unlock(dev->ieee80211_ptr); 9645 return ret; 9646 } 9647 9648 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info) 9649 { 9650 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9651 struct net *net; 9652 int err; 9653 9654 if (info->attrs[NL80211_ATTR_PID]) { 9655 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]); 9656 9657 net = get_net_ns_by_pid(pid); 9658 } else if (info->attrs[NL80211_ATTR_NETNS_FD]) { 9659 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]); 9660 9661 net = get_net_ns_by_fd(fd); 9662 } else { 9663 return -EINVAL; 9664 } 9665 9666 if (IS_ERR(net)) 9667 return PTR_ERR(net); 9668 9669 err = 0; 9670 9671 /* check if anything to do */ 9672 if (!net_eq(wiphy_net(&rdev->wiphy), net)) 9673 err = cfg80211_switch_netns(rdev, net); 9674 9675 put_net(net); 9676 return err; 9677 } 9678 9679 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info) 9680 { 9681 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9682 int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev, 9683 struct cfg80211_pmksa *pmksa) = NULL; 9684 struct net_device *dev = info->user_ptr[1]; 9685 struct cfg80211_pmksa pmksa; 9686 9687 memset(&pmksa, 0, sizeof(struct cfg80211_pmksa)); 9688 9689 if (!info->attrs[NL80211_ATTR_PMKID]) 9690 return -EINVAL; 9691 9692 pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]); 9693 9694 if (info->attrs[NL80211_ATTR_MAC]) { 9695 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 9696 } else if (info->attrs[NL80211_ATTR_SSID] && 9697 info->attrs[NL80211_ATTR_FILS_CACHE_ID] && 9698 (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA || 9699 info->attrs[NL80211_ATTR_PMK])) { 9700 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 9701 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 9702 pmksa.cache_id = 9703 nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]); 9704 } else { 9705 return -EINVAL; 9706 } 9707 if (info->attrs[NL80211_ATTR_PMK]) { 9708 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]); 9709 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]); 9710 } 9711 9712 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 9713 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 9714 return -EOPNOTSUPP; 9715 9716 switch (info->genlhdr->cmd) { 9717 case NL80211_CMD_SET_PMKSA: 9718 rdev_ops = rdev->ops->set_pmksa; 9719 break; 9720 case NL80211_CMD_DEL_PMKSA: 9721 rdev_ops = rdev->ops->del_pmksa; 9722 break; 9723 default: 9724 WARN_ON(1); 9725 break; 9726 } 9727 9728 if (!rdev_ops) 9729 return -EOPNOTSUPP; 9730 9731 return rdev_ops(&rdev->wiphy, dev, &pmksa); 9732 } 9733 9734 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info) 9735 { 9736 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9737 struct net_device *dev = info->user_ptr[1]; 9738 9739 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 9740 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 9741 return -EOPNOTSUPP; 9742 9743 if (!rdev->ops->flush_pmksa) 9744 return -EOPNOTSUPP; 9745 9746 return rdev_flush_pmksa(rdev, dev); 9747 } 9748 9749 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info) 9750 { 9751 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9752 struct net_device *dev = info->user_ptr[1]; 9753 u8 action_code, dialog_token; 9754 u32 peer_capability = 0; 9755 u16 status_code; 9756 u8 *peer; 9757 bool initiator; 9758 9759 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) || 9760 !rdev->ops->tdls_mgmt) 9761 return -EOPNOTSUPP; 9762 9763 if (!info->attrs[NL80211_ATTR_TDLS_ACTION] || 9764 !info->attrs[NL80211_ATTR_STATUS_CODE] || 9765 !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] || 9766 !info->attrs[NL80211_ATTR_IE] || 9767 !info->attrs[NL80211_ATTR_MAC]) 9768 return -EINVAL; 9769 9770 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 9771 action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]); 9772 status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]); 9773 dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]); 9774 initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]); 9775 if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]) 9776 peer_capability = 9777 nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]); 9778 9779 return rdev_tdls_mgmt(rdev, dev, peer, action_code, 9780 dialog_token, status_code, peer_capability, 9781 initiator, 9782 nla_data(info->attrs[NL80211_ATTR_IE]), 9783 nla_len(info->attrs[NL80211_ATTR_IE])); 9784 } 9785 9786 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info) 9787 { 9788 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9789 struct net_device *dev = info->user_ptr[1]; 9790 enum nl80211_tdls_operation operation; 9791 u8 *peer; 9792 9793 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) || 9794 !rdev->ops->tdls_oper) 9795 return -EOPNOTSUPP; 9796 9797 if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] || 9798 !info->attrs[NL80211_ATTR_MAC]) 9799 return -EINVAL; 9800 9801 operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]); 9802 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 9803 9804 return rdev_tdls_oper(rdev, dev, peer, operation); 9805 } 9806 9807 static int nl80211_remain_on_channel(struct sk_buff *skb, 9808 struct genl_info *info) 9809 { 9810 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9811 struct wireless_dev *wdev = info->user_ptr[1]; 9812 struct cfg80211_chan_def chandef; 9813 const struct cfg80211_chan_def *compat_chandef; 9814 struct sk_buff *msg; 9815 void *hdr; 9816 u64 cookie; 9817 u32 duration; 9818 int err; 9819 9820 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] || 9821 !info->attrs[NL80211_ATTR_DURATION]) 9822 return -EINVAL; 9823 9824 duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]); 9825 9826 if (!rdev->ops->remain_on_channel || 9827 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)) 9828 return -EOPNOTSUPP; 9829 9830 /* 9831 * We should be on that channel for at least a minimum amount of 9832 * time (10ms) but no longer than the driver supports. 9833 */ 9834 if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME || 9835 duration > rdev->wiphy.max_remain_on_channel_duration) 9836 return -EINVAL; 9837 9838 err = nl80211_parse_chandef(rdev, info, &chandef); 9839 if (err) 9840 return err; 9841 9842 wdev_lock(wdev); 9843 if (!cfg80211_off_channel_oper_allowed(wdev) && 9844 !cfg80211_chandef_identical(&wdev->chandef, &chandef)) { 9845 compat_chandef = cfg80211_chandef_compatible(&wdev->chandef, 9846 &chandef); 9847 if (compat_chandef != &chandef) { 9848 wdev_unlock(wdev); 9849 return -EBUSY; 9850 } 9851 } 9852 wdev_unlock(wdev); 9853 9854 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 9855 if (!msg) 9856 return -ENOMEM; 9857 9858 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 9859 NL80211_CMD_REMAIN_ON_CHANNEL); 9860 if (!hdr) { 9861 err = -ENOBUFS; 9862 goto free_msg; 9863 } 9864 9865 err = rdev_remain_on_channel(rdev, wdev, chandef.chan, 9866 duration, &cookie); 9867 9868 if (err) 9869 goto free_msg; 9870 9871 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 9872 NL80211_ATTR_PAD)) 9873 goto nla_put_failure; 9874 9875 genlmsg_end(msg, hdr); 9876 9877 return genlmsg_reply(msg, info); 9878 9879 nla_put_failure: 9880 err = -ENOBUFS; 9881 free_msg: 9882 nlmsg_free(msg); 9883 return err; 9884 } 9885 9886 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb, 9887 struct genl_info *info) 9888 { 9889 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9890 struct wireless_dev *wdev = info->user_ptr[1]; 9891 u64 cookie; 9892 9893 if (!info->attrs[NL80211_ATTR_COOKIE]) 9894 return -EINVAL; 9895 9896 if (!rdev->ops->cancel_remain_on_channel) 9897 return -EOPNOTSUPP; 9898 9899 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 9900 9901 return rdev_cancel_remain_on_channel(rdev, wdev, cookie); 9902 } 9903 9904 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb, 9905 struct genl_info *info) 9906 { 9907 struct cfg80211_bitrate_mask mask; 9908 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9909 struct net_device *dev = info->user_ptr[1]; 9910 int err; 9911 9912 if (!rdev->ops->set_bitrate_mask) 9913 return -EOPNOTSUPP; 9914 9915 err = nl80211_parse_tx_bitrate_mask(info, &mask); 9916 if (err) 9917 return err; 9918 9919 return rdev_set_bitrate_mask(rdev, dev, NULL, &mask); 9920 } 9921 9922 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info) 9923 { 9924 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9925 struct wireless_dev *wdev = info->user_ptr[1]; 9926 u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION; 9927 9928 if (!info->attrs[NL80211_ATTR_FRAME_MATCH]) 9929 return -EINVAL; 9930 9931 if (info->attrs[NL80211_ATTR_FRAME_TYPE]) 9932 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]); 9933 9934 switch (wdev->iftype) { 9935 case NL80211_IFTYPE_STATION: 9936 case NL80211_IFTYPE_ADHOC: 9937 case NL80211_IFTYPE_P2P_CLIENT: 9938 case NL80211_IFTYPE_AP: 9939 case NL80211_IFTYPE_AP_VLAN: 9940 case NL80211_IFTYPE_MESH_POINT: 9941 case NL80211_IFTYPE_P2P_GO: 9942 case NL80211_IFTYPE_P2P_DEVICE: 9943 break; 9944 case NL80211_IFTYPE_NAN: 9945 default: 9946 return -EOPNOTSUPP; 9947 } 9948 9949 /* not much point in registering if we can't reply */ 9950 if (!rdev->ops->mgmt_tx) 9951 return -EOPNOTSUPP; 9952 9953 return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type, 9954 nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]), 9955 nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH])); 9956 } 9957 9958 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info) 9959 { 9960 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9961 struct wireless_dev *wdev = info->user_ptr[1]; 9962 struct cfg80211_chan_def chandef; 9963 int err; 9964 void *hdr = NULL; 9965 u64 cookie; 9966 struct sk_buff *msg = NULL; 9967 struct cfg80211_mgmt_tx_params params = { 9968 .dont_wait_for_ack = 9969 info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK], 9970 }; 9971 9972 if (!info->attrs[NL80211_ATTR_FRAME]) 9973 return -EINVAL; 9974 9975 if (!rdev->ops->mgmt_tx) 9976 return -EOPNOTSUPP; 9977 9978 switch (wdev->iftype) { 9979 case NL80211_IFTYPE_P2P_DEVICE: 9980 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ]) 9981 return -EINVAL; 9982 case NL80211_IFTYPE_STATION: 9983 case NL80211_IFTYPE_ADHOC: 9984 case NL80211_IFTYPE_P2P_CLIENT: 9985 case NL80211_IFTYPE_AP: 9986 case NL80211_IFTYPE_AP_VLAN: 9987 case NL80211_IFTYPE_MESH_POINT: 9988 case NL80211_IFTYPE_P2P_GO: 9989 break; 9990 case NL80211_IFTYPE_NAN: 9991 default: 9992 return -EOPNOTSUPP; 9993 } 9994 9995 if (info->attrs[NL80211_ATTR_DURATION]) { 9996 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX)) 9997 return -EINVAL; 9998 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]); 9999 10000 /* 10001 * We should wait on the channel for at least a minimum amount 10002 * of time (10ms) but no longer than the driver supports. 10003 */ 10004 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME || 10005 params.wait > rdev->wiphy.max_remain_on_channel_duration) 10006 return -EINVAL; 10007 } 10008 10009 params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK]; 10010 10011 if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX)) 10012 return -EINVAL; 10013 10014 params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]); 10015 10016 /* get the channel if any has been specified, otherwise pass NULL to 10017 * the driver. The latter will use the current one 10018 */ 10019 chandef.chan = NULL; 10020 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 10021 err = nl80211_parse_chandef(rdev, info, &chandef); 10022 if (err) 10023 return err; 10024 } 10025 10026 if (!chandef.chan && params.offchan) 10027 return -EINVAL; 10028 10029 wdev_lock(wdev); 10030 if (params.offchan && !cfg80211_off_channel_oper_allowed(wdev)) { 10031 wdev_unlock(wdev); 10032 return -EBUSY; 10033 } 10034 wdev_unlock(wdev); 10035 10036 params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]); 10037 params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]); 10038 10039 if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) { 10040 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]); 10041 int i; 10042 10043 if (len % sizeof(u16)) 10044 return -EINVAL; 10045 10046 params.n_csa_offsets = len / sizeof(u16); 10047 params.csa_offsets = 10048 nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]); 10049 10050 /* check that all the offsets fit the frame */ 10051 for (i = 0; i < params.n_csa_offsets; i++) { 10052 if (params.csa_offsets[i] >= params.len) 10053 return -EINVAL; 10054 } 10055 } 10056 10057 if (!params.dont_wait_for_ack) { 10058 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 10059 if (!msg) 10060 return -ENOMEM; 10061 10062 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 10063 NL80211_CMD_FRAME); 10064 if (!hdr) { 10065 err = -ENOBUFS; 10066 goto free_msg; 10067 } 10068 } 10069 10070 params.chan = chandef.chan; 10071 err = cfg80211_mlme_mgmt_tx(rdev, wdev, ¶ms, &cookie); 10072 if (err) 10073 goto free_msg; 10074 10075 if (msg) { 10076 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 10077 NL80211_ATTR_PAD)) 10078 goto nla_put_failure; 10079 10080 genlmsg_end(msg, hdr); 10081 return genlmsg_reply(msg, info); 10082 } 10083 10084 return 0; 10085 10086 nla_put_failure: 10087 err = -ENOBUFS; 10088 free_msg: 10089 nlmsg_free(msg); 10090 return err; 10091 } 10092 10093 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info) 10094 { 10095 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10096 struct wireless_dev *wdev = info->user_ptr[1]; 10097 u64 cookie; 10098 10099 if (!info->attrs[NL80211_ATTR_COOKIE]) 10100 return -EINVAL; 10101 10102 if (!rdev->ops->mgmt_tx_cancel_wait) 10103 return -EOPNOTSUPP; 10104 10105 switch (wdev->iftype) { 10106 case NL80211_IFTYPE_STATION: 10107 case NL80211_IFTYPE_ADHOC: 10108 case NL80211_IFTYPE_P2P_CLIENT: 10109 case NL80211_IFTYPE_AP: 10110 case NL80211_IFTYPE_AP_VLAN: 10111 case NL80211_IFTYPE_P2P_GO: 10112 case NL80211_IFTYPE_P2P_DEVICE: 10113 break; 10114 case NL80211_IFTYPE_NAN: 10115 default: 10116 return -EOPNOTSUPP; 10117 } 10118 10119 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 10120 10121 return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie); 10122 } 10123 10124 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info) 10125 { 10126 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10127 struct wireless_dev *wdev; 10128 struct net_device *dev = info->user_ptr[1]; 10129 u8 ps_state; 10130 bool state; 10131 int err; 10132 10133 if (!info->attrs[NL80211_ATTR_PS_STATE]) 10134 return -EINVAL; 10135 10136 ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]); 10137 10138 if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED) 10139 return -EINVAL; 10140 10141 wdev = dev->ieee80211_ptr; 10142 10143 if (!rdev->ops->set_power_mgmt) 10144 return -EOPNOTSUPP; 10145 10146 state = (ps_state == NL80211_PS_ENABLED) ? true : false; 10147 10148 if (state == wdev->ps) 10149 return 0; 10150 10151 err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout); 10152 if (!err) 10153 wdev->ps = state; 10154 return err; 10155 } 10156 10157 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info) 10158 { 10159 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10160 enum nl80211_ps_state ps_state; 10161 struct wireless_dev *wdev; 10162 struct net_device *dev = info->user_ptr[1]; 10163 struct sk_buff *msg; 10164 void *hdr; 10165 int err; 10166 10167 wdev = dev->ieee80211_ptr; 10168 10169 if (!rdev->ops->set_power_mgmt) 10170 return -EOPNOTSUPP; 10171 10172 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 10173 if (!msg) 10174 return -ENOMEM; 10175 10176 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 10177 NL80211_CMD_GET_POWER_SAVE); 10178 if (!hdr) { 10179 err = -ENOBUFS; 10180 goto free_msg; 10181 } 10182 10183 if (wdev->ps) 10184 ps_state = NL80211_PS_ENABLED; 10185 else 10186 ps_state = NL80211_PS_DISABLED; 10187 10188 if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state)) 10189 goto nla_put_failure; 10190 10191 genlmsg_end(msg, hdr); 10192 return genlmsg_reply(msg, info); 10193 10194 nla_put_failure: 10195 err = -ENOBUFS; 10196 free_msg: 10197 nlmsg_free(msg); 10198 return err; 10199 } 10200 10201 static const struct nla_policy 10202 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = { 10203 [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY }, 10204 [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 }, 10205 [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 }, 10206 [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 }, 10207 [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 }, 10208 [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 }, 10209 [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 }, 10210 }; 10211 10212 static int nl80211_set_cqm_txe(struct genl_info *info, 10213 u32 rate, u32 pkts, u32 intvl) 10214 { 10215 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10216 struct net_device *dev = info->user_ptr[1]; 10217 struct wireless_dev *wdev = dev->ieee80211_ptr; 10218 10219 if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL) 10220 return -EINVAL; 10221 10222 if (!rdev->ops->set_cqm_txe_config) 10223 return -EOPNOTSUPP; 10224 10225 if (wdev->iftype != NL80211_IFTYPE_STATION && 10226 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 10227 return -EOPNOTSUPP; 10228 10229 return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl); 10230 } 10231 10232 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev, 10233 struct net_device *dev) 10234 { 10235 struct wireless_dev *wdev = dev->ieee80211_ptr; 10236 s32 last, low, high; 10237 u32 hyst; 10238 int i, n, low_index; 10239 int err; 10240 10241 /* RSSI reporting disabled? */ 10242 if (!wdev->cqm_config) 10243 return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0); 10244 10245 /* 10246 * Obtain current RSSI value if possible, if not and no RSSI threshold 10247 * event has been received yet, we should receive an event after a 10248 * connection is established and enough beacons received to calculate 10249 * the average. 10250 */ 10251 if (!wdev->cqm_config->last_rssi_event_value && wdev->current_bss && 10252 rdev->ops->get_station) { 10253 struct station_info sinfo = {}; 10254 u8 *mac_addr; 10255 10256 mac_addr = wdev->current_bss->pub.bssid; 10257 10258 err = rdev_get_station(rdev, dev, mac_addr, &sinfo); 10259 if (err) 10260 return err; 10261 10262 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG)) 10263 wdev->cqm_config->last_rssi_event_value = 10264 (s8) sinfo.rx_beacon_signal_avg; 10265 } 10266 10267 last = wdev->cqm_config->last_rssi_event_value; 10268 hyst = wdev->cqm_config->rssi_hyst; 10269 n = wdev->cqm_config->n_rssi_thresholds; 10270 10271 for (i = 0; i < n; i++) 10272 if (last < wdev->cqm_config->rssi_thresholds[i]) 10273 break; 10274 10275 low_index = i - 1; 10276 if (low_index >= 0) { 10277 low_index = array_index_nospec(low_index, n); 10278 low = wdev->cqm_config->rssi_thresholds[low_index] - hyst; 10279 } else { 10280 low = S32_MIN; 10281 } 10282 if (i < n) { 10283 i = array_index_nospec(i, n); 10284 high = wdev->cqm_config->rssi_thresholds[i] + hyst - 1; 10285 } else { 10286 high = S32_MAX; 10287 } 10288 10289 return rdev_set_cqm_rssi_range_config(rdev, dev, low, high); 10290 } 10291 10292 static int nl80211_set_cqm_rssi(struct genl_info *info, 10293 const s32 *thresholds, int n_thresholds, 10294 u32 hysteresis) 10295 { 10296 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10297 struct net_device *dev = info->user_ptr[1]; 10298 struct wireless_dev *wdev = dev->ieee80211_ptr; 10299 int i, err; 10300 s32 prev = S32_MIN; 10301 10302 /* Check all values negative and sorted */ 10303 for (i = 0; i < n_thresholds; i++) { 10304 if (thresholds[i] > 0 || thresholds[i] <= prev) 10305 return -EINVAL; 10306 10307 prev = thresholds[i]; 10308 } 10309 10310 if (wdev->iftype != NL80211_IFTYPE_STATION && 10311 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 10312 return -EOPNOTSUPP; 10313 10314 wdev_lock(wdev); 10315 cfg80211_cqm_config_free(wdev); 10316 wdev_unlock(wdev); 10317 10318 if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) { 10319 if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */ 10320 return rdev_set_cqm_rssi_config(rdev, dev, 0, 0); 10321 10322 return rdev_set_cqm_rssi_config(rdev, dev, 10323 thresholds[0], hysteresis); 10324 } 10325 10326 if (!wiphy_ext_feature_isset(&rdev->wiphy, 10327 NL80211_EXT_FEATURE_CQM_RSSI_LIST)) 10328 return -EOPNOTSUPP; 10329 10330 if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */ 10331 n_thresholds = 0; 10332 10333 wdev_lock(wdev); 10334 if (n_thresholds) { 10335 struct cfg80211_cqm_config *cqm_config; 10336 10337 cqm_config = kzalloc(sizeof(struct cfg80211_cqm_config) + 10338 n_thresholds * sizeof(s32), GFP_KERNEL); 10339 if (!cqm_config) { 10340 err = -ENOMEM; 10341 goto unlock; 10342 } 10343 10344 cqm_config->rssi_hyst = hysteresis; 10345 cqm_config->n_rssi_thresholds = n_thresholds; 10346 memcpy(cqm_config->rssi_thresholds, thresholds, 10347 n_thresholds * sizeof(s32)); 10348 10349 wdev->cqm_config = cqm_config; 10350 } 10351 10352 err = cfg80211_cqm_rssi_update(rdev, dev); 10353 10354 unlock: 10355 wdev_unlock(wdev); 10356 10357 return err; 10358 } 10359 10360 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info) 10361 { 10362 struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1]; 10363 struct nlattr *cqm; 10364 int err; 10365 10366 cqm = info->attrs[NL80211_ATTR_CQM]; 10367 if (!cqm) 10368 return -EINVAL; 10369 10370 err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm, 10371 nl80211_attr_cqm_policy, info->extack); 10372 if (err) 10373 return err; 10374 10375 if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] && 10376 attrs[NL80211_ATTR_CQM_RSSI_HYST]) { 10377 const s32 *thresholds = 10378 nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]); 10379 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]); 10380 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]); 10381 10382 if (len % 4) 10383 return -EINVAL; 10384 10385 return nl80211_set_cqm_rssi(info, thresholds, len / 4, 10386 hysteresis); 10387 } 10388 10389 if (attrs[NL80211_ATTR_CQM_TXE_RATE] && 10390 attrs[NL80211_ATTR_CQM_TXE_PKTS] && 10391 attrs[NL80211_ATTR_CQM_TXE_INTVL]) { 10392 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]); 10393 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]); 10394 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]); 10395 10396 return nl80211_set_cqm_txe(info, rate, pkts, intvl); 10397 } 10398 10399 return -EINVAL; 10400 } 10401 10402 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info) 10403 { 10404 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10405 struct net_device *dev = info->user_ptr[1]; 10406 struct ocb_setup setup = {}; 10407 int err; 10408 10409 err = nl80211_parse_chandef(rdev, info, &setup.chandef); 10410 if (err) 10411 return err; 10412 10413 return cfg80211_join_ocb(rdev, dev, &setup); 10414 } 10415 10416 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info) 10417 { 10418 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10419 struct net_device *dev = info->user_ptr[1]; 10420 10421 return cfg80211_leave_ocb(rdev, dev); 10422 } 10423 10424 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info) 10425 { 10426 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10427 struct net_device *dev = info->user_ptr[1]; 10428 struct mesh_config cfg; 10429 struct mesh_setup setup; 10430 int err; 10431 10432 /* start with default */ 10433 memcpy(&cfg, &default_mesh_config, sizeof(cfg)); 10434 memcpy(&setup, &default_mesh_setup, sizeof(setup)); 10435 10436 if (info->attrs[NL80211_ATTR_MESH_CONFIG]) { 10437 /* and parse parameters if given */ 10438 err = nl80211_parse_mesh_config(info, &cfg, NULL); 10439 if (err) 10440 return err; 10441 } 10442 10443 if (!info->attrs[NL80211_ATTR_MESH_ID] || 10444 !nla_len(info->attrs[NL80211_ATTR_MESH_ID])) 10445 return -EINVAL; 10446 10447 setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]); 10448 setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]); 10449 10450 if (info->attrs[NL80211_ATTR_MCAST_RATE] && 10451 !nl80211_parse_mcast_rate(rdev, setup.mcast_rate, 10452 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]))) 10453 return -EINVAL; 10454 10455 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) { 10456 setup.beacon_interval = 10457 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]); 10458 10459 err = cfg80211_validate_beacon_int(rdev, 10460 NL80211_IFTYPE_MESH_POINT, 10461 setup.beacon_interval); 10462 if (err) 10463 return err; 10464 } 10465 10466 if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) { 10467 setup.dtim_period = 10468 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]); 10469 if (setup.dtim_period < 1 || setup.dtim_period > 100) 10470 return -EINVAL; 10471 } 10472 10473 if (info->attrs[NL80211_ATTR_MESH_SETUP]) { 10474 /* parse additional setup parameters if given */ 10475 err = nl80211_parse_mesh_setup(info, &setup); 10476 if (err) 10477 return err; 10478 } 10479 10480 if (setup.user_mpm) 10481 cfg.auto_open_plinks = false; 10482 10483 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 10484 err = nl80211_parse_chandef(rdev, info, &setup.chandef); 10485 if (err) 10486 return err; 10487 } else { 10488 /* __cfg80211_join_mesh() will sort it out */ 10489 setup.chandef.chan = NULL; 10490 } 10491 10492 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) { 10493 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 10494 int n_rates = 10495 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 10496 struct ieee80211_supported_band *sband; 10497 10498 if (!setup.chandef.chan) 10499 return -EINVAL; 10500 10501 sband = rdev->wiphy.bands[setup.chandef.chan->band]; 10502 10503 err = ieee80211_get_ratemask(sband, rates, n_rates, 10504 &setup.basic_rates); 10505 if (err) 10506 return err; 10507 } 10508 10509 if (info->attrs[NL80211_ATTR_TX_RATES]) { 10510 err = nl80211_parse_tx_bitrate_mask(info, &setup.beacon_rate); 10511 if (err) 10512 return err; 10513 10514 if (!setup.chandef.chan) 10515 return -EINVAL; 10516 10517 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band, 10518 &setup.beacon_rate); 10519 if (err) 10520 return err; 10521 } 10522 10523 setup.userspace_handles_dfs = 10524 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]); 10525 10526 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) { 10527 int r = validate_pae_over_nl80211(rdev, info); 10528 10529 if (r < 0) 10530 return r; 10531 10532 setup.control_port_over_nl80211 = true; 10533 } 10534 10535 wdev_lock(dev->ieee80211_ptr); 10536 err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg); 10537 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) 10538 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid; 10539 wdev_unlock(dev->ieee80211_ptr); 10540 10541 return err; 10542 } 10543 10544 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info) 10545 { 10546 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10547 struct net_device *dev = info->user_ptr[1]; 10548 10549 return cfg80211_leave_mesh(rdev, dev); 10550 } 10551 10552 #ifdef CONFIG_PM 10553 static int nl80211_send_wowlan_patterns(struct sk_buff *msg, 10554 struct cfg80211_registered_device *rdev) 10555 { 10556 struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config; 10557 struct nlattr *nl_pats, *nl_pat; 10558 int i, pat_len; 10559 10560 if (!wowlan->n_patterns) 10561 return 0; 10562 10563 nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN); 10564 if (!nl_pats) 10565 return -ENOBUFS; 10566 10567 for (i = 0; i < wowlan->n_patterns; i++) { 10568 nl_pat = nla_nest_start(msg, i + 1); 10569 if (!nl_pat) 10570 return -ENOBUFS; 10571 pat_len = wowlan->patterns[i].pattern_len; 10572 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8), 10573 wowlan->patterns[i].mask) || 10574 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len, 10575 wowlan->patterns[i].pattern) || 10576 nla_put_u32(msg, NL80211_PKTPAT_OFFSET, 10577 wowlan->patterns[i].pkt_offset)) 10578 return -ENOBUFS; 10579 nla_nest_end(msg, nl_pat); 10580 } 10581 nla_nest_end(msg, nl_pats); 10582 10583 return 0; 10584 } 10585 10586 static int nl80211_send_wowlan_tcp(struct sk_buff *msg, 10587 struct cfg80211_wowlan_tcp *tcp) 10588 { 10589 struct nlattr *nl_tcp; 10590 10591 if (!tcp) 10592 return 0; 10593 10594 nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION); 10595 if (!nl_tcp) 10596 return -ENOBUFS; 10597 10598 if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) || 10599 nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) || 10600 nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) || 10601 nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) || 10602 nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) || 10603 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD, 10604 tcp->payload_len, tcp->payload) || 10605 nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL, 10606 tcp->data_interval) || 10607 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD, 10608 tcp->wake_len, tcp->wake_data) || 10609 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK, 10610 DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask)) 10611 return -ENOBUFS; 10612 10613 if (tcp->payload_seq.len && 10614 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ, 10615 sizeof(tcp->payload_seq), &tcp->payload_seq)) 10616 return -ENOBUFS; 10617 10618 if (tcp->payload_tok.len && 10619 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN, 10620 sizeof(tcp->payload_tok) + tcp->tokens_size, 10621 &tcp->payload_tok)) 10622 return -ENOBUFS; 10623 10624 nla_nest_end(msg, nl_tcp); 10625 10626 return 0; 10627 } 10628 10629 static int nl80211_send_wowlan_nd(struct sk_buff *msg, 10630 struct cfg80211_sched_scan_request *req) 10631 { 10632 struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan; 10633 int i; 10634 10635 if (!req) 10636 return 0; 10637 10638 nd = nla_nest_start(msg, NL80211_WOWLAN_TRIG_NET_DETECT); 10639 if (!nd) 10640 return -ENOBUFS; 10641 10642 if (req->n_scan_plans == 1 && 10643 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL, 10644 req->scan_plans[0].interval * 1000)) 10645 return -ENOBUFS; 10646 10647 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay)) 10648 return -ENOBUFS; 10649 10650 if (req->relative_rssi_set) { 10651 struct nl80211_bss_select_rssi_adjust rssi_adjust; 10652 10653 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI, 10654 req->relative_rssi)) 10655 return -ENOBUFS; 10656 10657 rssi_adjust.band = req->rssi_adjust.band; 10658 rssi_adjust.delta = req->rssi_adjust.delta; 10659 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST, 10660 sizeof(rssi_adjust), &rssi_adjust)) 10661 return -ENOBUFS; 10662 } 10663 10664 freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES); 10665 if (!freqs) 10666 return -ENOBUFS; 10667 10668 for (i = 0; i < req->n_channels; i++) { 10669 if (nla_put_u32(msg, i, req->channels[i]->center_freq)) 10670 return -ENOBUFS; 10671 } 10672 10673 nla_nest_end(msg, freqs); 10674 10675 if (req->n_match_sets) { 10676 matches = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH); 10677 if (!matches) 10678 return -ENOBUFS; 10679 10680 for (i = 0; i < req->n_match_sets; i++) { 10681 match = nla_nest_start(msg, i); 10682 if (!match) 10683 return -ENOBUFS; 10684 10685 if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID, 10686 req->match_sets[i].ssid.ssid_len, 10687 req->match_sets[i].ssid.ssid)) 10688 return -ENOBUFS; 10689 nla_nest_end(msg, match); 10690 } 10691 nla_nest_end(msg, matches); 10692 } 10693 10694 scan_plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS); 10695 if (!scan_plans) 10696 return -ENOBUFS; 10697 10698 for (i = 0; i < req->n_scan_plans; i++) { 10699 scan_plan = nla_nest_start(msg, i + 1); 10700 if (!scan_plan) 10701 return -ENOBUFS; 10702 10703 if (!scan_plan || 10704 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL, 10705 req->scan_plans[i].interval) || 10706 (req->scan_plans[i].iterations && 10707 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS, 10708 req->scan_plans[i].iterations))) 10709 return -ENOBUFS; 10710 nla_nest_end(msg, scan_plan); 10711 } 10712 nla_nest_end(msg, scan_plans); 10713 10714 nla_nest_end(msg, nd); 10715 10716 return 0; 10717 } 10718 10719 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info) 10720 { 10721 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10722 struct sk_buff *msg; 10723 void *hdr; 10724 u32 size = NLMSG_DEFAULT_SIZE; 10725 10726 if (!rdev->wiphy.wowlan) 10727 return -EOPNOTSUPP; 10728 10729 if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) { 10730 /* adjust size to have room for all the data */ 10731 size += rdev->wiphy.wowlan_config->tcp->tokens_size + 10732 rdev->wiphy.wowlan_config->tcp->payload_len + 10733 rdev->wiphy.wowlan_config->tcp->wake_len + 10734 rdev->wiphy.wowlan_config->tcp->wake_len / 8; 10735 } 10736 10737 msg = nlmsg_new(size, GFP_KERNEL); 10738 if (!msg) 10739 return -ENOMEM; 10740 10741 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 10742 NL80211_CMD_GET_WOWLAN); 10743 if (!hdr) 10744 goto nla_put_failure; 10745 10746 if (rdev->wiphy.wowlan_config) { 10747 struct nlattr *nl_wowlan; 10748 10749 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS); 10750 if (!nl_wowlan) 10751 goto nla_put_failure; 10752 10753 if ((rdev->wiphy.wowlan_config->any && 10754 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) || 10755 (rdev->wiphy.wowlan_config->disconnect && 10756 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) || 10757 (rdev->wiphy.wowlan_config->magic_pkt && 10758 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) || 10759 (rdev->wiphy.wowlan_config->gtk_rekey_failure && 10760 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) || 10761 (rdev->wiphy.wowlan_config->eap_identity_req && 10762 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) || 10763 (rdev->wiphy.wowlan_config->four_way_handshake && 10764 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) || 10765 (rdev->wiphy.wowlan_config->rfkill_release && 10766 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))) 10767 goto nla_put_failure; 10768 10769 if (nl80211_send_wowlan_patterns(msg, rdev)) 10770 goto nla_put_failure; 10771 10772 if (nl80211_send_wowlan_tcp(msg, 10773 rdev->wiphy.wowlan_config->tcp)) 10774 goto nla_put_failure; 10775 10776 if (nl80211_send_wowlan_nd( 10777 msg, 10778 rdev->wiphy.wowlan_config->nd_config)) 10779 goto nla_put_failure; 10780 10781 nla_nest_end(msg, nl_wowlan); 10782 } 10783 10784 genlmsg_end(msg, hdr); 10785 return genlmsg_reply(msg, info); 10786 10787 nla_put_failure: 10788 nlmsg_free(msg); 10789 return -ENOBUFS; 10790 } 10791 10792 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev, 10793 struct nlattr *attr, 10794 struct cfg80211_wowlan *trig) 10795 { 10796 struct nlattr *tb[NUM_NL80211_WOWLAN_TCP]; 10797 struct cfg80211_wowlan_tcp *cfg; 10798 struct nl80211_wowlan_tcp_data_token *tok = NULL; 10799 struct nl80211_wowlan_tcp_data_seq *seq = NULL; 10800 u32 size; 10801 u32 data_size, wake_size, tokens_size = 0, wake_mask_size; 10802 int err, port; 10803 10804 if (!rdev->wiphy.wowlan->tcp) 10805 return -EINVAL; 10806 10807 err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TCP, attr, 10808 nl80211_wowlan_tcp_policy, NULL); 10809 if (err) 10810 return err; 10811 10812 if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] || 10813 !tb[NL80211_WOWLAN_TCP_DST_IPV4] || 10814 !tb[NL80211_WOWLAN_TCP_DST_MAC] || 10815 !tb[NL80211_WOWLAN_TCP_DST_PORT] || 10816 !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] || 10817 !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] || 10818 !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] || 10819 !tb[NL80211_WOWLAN_TCP_WAKE_MASK]) 10820 return -EINVAL; 10821 10822 data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]); 10823 if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max) 10824 return -EINVAL; 10825 10826 if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) > 10827 rdev->wiphy.wowlan->tcp->data_interval_max || 10828 nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0) 10829 return -EINVAL; 10830 10831 wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]); 10832 if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max) 10833 return -EINVAL; 10834 10835 wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]); 10836 if (wake_mask_size != DIV_ROUND_UP(wake_size, 8)) 10837 return -EINVAL; 10838 10839 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) { 10840 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]); 10841 10842 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]); 10843 tokens_size = tokln - sizeof(*tok); 10844 10845 if (!tok->len || tokens_size % tok->len) 10846 return -EINVAL; 10847 if (!rdev->wiphy.wowlan->tcp->tok) 10848 return -EINVAL; 10849 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len) 10850 return -EINVAL; 10851 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len) 10852 return -EINVAL; 10853 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize) 10854 return -EINVAL; 10855 if (tok->offset + tok->len > data_size) 10856 return -EINVAL; 10857 } 10858 10859 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) { 10860 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]); 10861 if (!rdev->wiphy.wowlan->tcp->seq) 10862 return -EINVAL; 10863 if (seq->len == 0 || seq->len > 4) 10864 return -EINVAL; 10865 if (seq->len + seq->offset > data_size) 10866 return -EINVAL; 10867 } 10868 10869 size = sizeof(*cfg); 10870 size += data_size; 10871 size += wake_size + wake_mask_size; 10872 size += tokens_size; 10873 10874 cfg = kzalloc(size, GFP_KERNEL); 10875 if (!cfg) 10876 return -ENOMEM; 10877 cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]); 10878 cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]); 10879 memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]), 10880 ETH_ALEN); 10881 if (tb[NL80211_WOWLAN_TCP_SRC_PORT]) 10882 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]); 10883 else 10884 port = 0; 10885 #ifdef CONFIG_INET 10886 /* allocate a socket and port for it and use it */ 10887 err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM, 10888 IPPROTO_TCP, &cfg->sock, 1); 10889 if (err) { 10890 kfree(cfg); 10891 return err; 10892 } 10893 if (inet_csk_get_port(cfg->sock->sk, port)) { 10894 sock_release(cfg->sock); 10895 kfree(cfg); 10896 return -EADDRINUSE; 10897 } 10898 cfg->src_port = inet_sk(cfg->sock->sk)->inet_num; 10899 #else 10900 if (!port) { 10901 kfree(cfg); 10902 return -EINVAL; 10903 } 10904 cfg->src_port = port; 10905 #endif 10906 10907 cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]); 10908 cfg->payload_len = data_size; 10909 cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size; 10910 memcpy((void *)cfg->payload, 10911 nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]), 10912 data_size); 10913 if (seq) 10914 cfg->payload_seq = *seq; 10915 cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]); 10916 cfg->wake_len = wake_size; 10917 cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size; 10918 memcpy((void *)cfg->wake_data, 10919 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]), 10920 wake_size); 10921 cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size + 10922 data_size + wake_size; 10923 memcpy((void *)cfg->wake_mask, 10924 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]), 10925 wake_mask_size); 10926 if (tok) { 10927 cfg->tokens_size = tokens_size; 10928 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size); 10929 } 10930 10931 trig->tcp = cfg; 10932 10933 return 0; 10934 } 10935 10936 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev, 10937 const struct wiphy_wowlan_support *wowlan, 10938 struct nlattr *attr, 10939 struct cfg80211_wowlan *trig) 10940 { 10941 struct nlattr **tb; 10942 int err; 10943 10944 tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL); 10945 if (!tb) 10946 return -ENOMEM; 10947 10948 if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) { 10949 err = -EOPNOTSUPP; 10950 goto out; 10951 } 10952 10953 err = nla_parse_nested(tb, NL80211_ATTR_MAX, attr, nl80211_policy, 10954 NULL); 10955 if (err) 10956 goto out; 10957 10958 trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb, 10959 wowlan->max_nd_match_sets); 10960 err = PTR_ERR_OR_ZERO(trig->nd_config); 10961 if (err) 10962 trig->nd_config = NULL; 10963 10964 out: 10965 kfree(tb); 10966 return err; 10967 } 10968 10969 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info) 10970 { 10971 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10972 struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG]; 10973 struct cfg80211_wowlan new_triggers = {}; 10974 struct cfg80211_wowlan *ntrig; 10975 const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan; 10976 int err, i; 10977 bool prev_enabled = rdev->wiphy.wowlan_config; 10978 bool regular = false; 10979 10980 if (!wowlan) 10981 return -EOPNOTSUPP; 10982 10983 if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) { 10984 cfg80211_rdev_free_wowlan(rdev); 10985 rdev->wiphy.wowlan_config = NULL; 10986 goto set_wakeup; 10987 } 10988 10989 err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TRIG, 10990 info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS], 10991 nl80211_wowlan_policy, info->extack); 10992 if (err) 10993 return err; 10994 10995 if (tb[NL80211_WOWLAN_TRIG_ANY]) { 10996 if (!(wowlan->flags & WIPHY_WOWLAN_ANY)) 10997 return -EINVAL; 10998 new_triggers.any = true; 10999 } 11000 11001 if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) { 11002 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT)) 11003 return -EINVAL; 11004 new_triggers.disconnect = true; 11005 regular = true; 11006 } 11007 11008 if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) { 11009 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT)) 11010 return -EINVAL; 11011 new_triggers.magic_pkt = true; 11012 regular = true; 11013 } 11014 11015 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED]) 11016 return -EINVAL; 11017 11018 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) { 11019 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE)) 11020 return -EINVAL; 11021 new_triggers.gtk_rekey_failure = true; 11022 regular = true; 11023 } 11024 11025 if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) { 11026 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ)) 11027 return -EINVAL; 11028 new_triggers.eap_identity_req = true; 11029 regular = true; 11030 } 11031 11032 if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) { 11033 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE)) 11034 return -EINVAL; 11035 new_triggers.four_way_handshake = true; 11036 regular = true; 11037 } 11038 11039 if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) { 11040 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE)) 11041 return -EINVAL; 11042 new_triggers.rfkill_release = true; 11043 regular = true; 11044 } 11045 11046 if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) { 11047 struct nlattr *pat; 11048 int n_patterns = 0; 11049 int rem, pat_len, mask_len, pkt_offset; 11050 struct nlattr *pat_tb[NUM_NL80211_PKTPAT]; 11051 11052 regular = true; 11053 11054 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN], 11055 rem) 11056 n_patterns++; 11057 if (n_patterns > wowlan->n_patterns) 11058 return -EINVAL; 11059 11060 new_triggers.patterns = kcalloc(n_patterns, 11061 sizeof(new_triggers.patterns[0]), 11062 GFP_KERNEL); 11063 if (!new_triggers.patterns) 11064 return -ENOMEM; 11065 11066 new_triggers.n_patterns = n_patterns; 11067 i = 0; 11068 11069 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN], 11070 rem) { 11071 u8 *mask_pat; 11072 11073 err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat, 11074 nl80211_packet_pattern_policy, 11075 info->extack); 11076 if (err) 11077 goto error; 11078 11079 err = -EINVAL; 11080 if (!pat_tb[NL80211_PKTPAT_MASK] || 11081 !pat_tb[NL80211_PKTPAT_PATTERN]) 11082 goto error; 11083 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]); 11084 mask_len = DIV_ROUND_UP(pat_len, 8); 11085 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len) 11086 goto error; 11087 if (pat_len > wowlan->pattern_max_len || 11088 pat_len < wowlan->pattern_min_len) 11089 goto error; 11090 11091 if (!pat_tb[NL80211_PKTPAT_OFFSET]) 11092 pkt_offset = 0; 11093 else 11094 pkt_offset = nla_get_u32( 11095 pat_tb[NL80211_PKTPAT_OFFSET]); 11096 if (pkt_offset > wowlan->max_pkt_offset) 11097 goto error; 11098 new_triggers.patterns[i].pkt_offset = pkt_offset; 11099 11100 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL); 11101 if (!mask_pat) { 11102 err = -ENOMEM; 11103 goto error; 11104 } 11105 new_triggers.patterns[i].mask = mask_pat; 11106 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]), 11107 mask_len); 11108 mask_pat += mask_len; 11109 new_triggers.patterns[i].pattern = mask_pat; 11110 new_triggers.patterns[i].pattern_len = pat_len; 11111 memcpy(mask_pat, 11112 nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), 11113 pat_len); 11114 i++; 11115 } 11116 } 11117 11118 if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) { 11119 regular = true; 11120 err = nl80211_parse_wowlan_tcp( 11121 rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION], 11122 &new_triggers); 11123 if (err) 11124 goto error; 11125 } 11126 11127 if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) { 11128 regular = true; 11129 err = nl80211_parse_wowlan_nd( 11130 rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT], 11131 &new_triggers); 11132 if (err) 11133 goto error; 11134 } 11135 11136 /* The 'any' trigger means the device continues operating more or less 11137 * as in its normal operation mode and wakes up the host on most of the 11138 * normal interrupts (like packet RX, ...) 11139 * It therefore makes little sense to combine with the more constrained 11140 * wakeup trigger modes. 11141 */ 11142 if (new_triggers.any && regular) { 11143 err = -EINVAL; 11144 goto error; 11145 } 11146 11147 ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL); 11148 if (!ntrig) { 11149 err = -ENOMEM; 11150 goto error; 11151 } 11152 cfg80211_rdev_free_wowlan(rdev); 11153 rdev->wiphy.wowlan_config = ntrig; 11154 11155 set_wakeup: 11156 if (rdev->ops->set_wakeup && 11157 prev_enabled != !!rdev->wiphy.wowlan_config) 11158 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config); 11159 11160 return 0; 11161 error: 11162 for (i = 0; i < new_triggers.n_patterns; i++) 11163 kfree(new_triggers.patterns[i].mask); 11164 kfree(new_triggers.patterns); 11165 if (new_triggers.tcp && new_triggers.tcp->sock) 11166 sock_release(new_triggers.tcp->sock); 11167 kfree(new_triggers.tcp); 11168 kfree(new_triggers.nd_config); 11169 return err; 11170 } 11171 #endif 11172 11173 static int nl80211_send_coalesce_rules(struct sk_buff *msg, 11174 struct cfg80211_registered_device *rdev) 11175 { 11176 struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules; 11177 int i, j, pat_len; 11178 struct cfg80211_coalesce_rules *rule; 11179 11180 if (!rdev->coalesce->n_rules) 11181 return 0; 11182 11183 nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE); 11184 if (!nl_rules) 11185 return -ENOBUFS; 11186 11187 for (i = 0; i < rdev->coalesce->n_rules; i++) { 11188 nl_rule = nla_nest_start(msg, i + 1); 11189 if (!nl_rule) 11190 return -ENOBUFS; 11191 11192 rule = &rdev->coalesce->rules[i]; 11193 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY, 11194 rule->delay)) 11195 return -ENOBUFS; 11196 11197 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION, 11198 rule->condition)) 11199 return -ENOBUFS; 11200 11201 nl_pats = nla_nest_start(msg, 11202 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN); 11203 if (!nl_pats) 11204 return -ENOBUFS; 11205 11206 for (j = 0; j < rule->n_patterns; j++) { 11207 nl_pat = nla_nest_start(msg, j + 1); 11208 if (!nl_pat) 11209 return -ENOBUFS; 11210 pat_len = rule->patterns[j].pattern_len; 11211 if (nla_put(msg, NL80211_PKTPAT_MASK, 11212 DIV_ROUND_UP(pat_len, 8), 11213 rule->patterns[j].mask) || 11214 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len, 11215 rule->patterns[j].pattern) || 11216 nla_put_u32(msg, NL80211_PKTPAT_OFFSET, 11217 rule->patterns[j].pkt_offset)) 11218 return -ENOBUFS; 11219 nla_nest_end(msg, nl_pat); 11220 } 11221 nla_nest_end(msg, nl_pats); 11222 nla_nest_end(msg, nl_rule); 11223 } 11224 nla_nest_end(msg, nl_rules); 11225 11226 return 0; 11227 } 11228 11229 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info) 11230 { 11231 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11232 struct sk_buff *msg; 11233 void *hdr; 11234 11235 if (!rdev->wiphy.coalesce) 11236 return -EOPNOTSUPP; 11237 11238 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 11239 if (!msg) 11240 return -ENOMEM; 11241 11242 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 11243 NL80211_CMD_GET_COALESCE); 11244 if (!hdr) 11245 goto nla_put_failure; 11246 11247 if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev)) 11248 goto nla_put_failure; 11249 11250 genlmsg_end(msg, hdr); 11251 return genlmsg_reply(msg, info); 11252 11253 nla_put_failure: 11254 nlmsg_free(msg); 11255 return -ENOBUFS; 11256 } 11257 11258 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev) 11259 { 11260 struct cfg80211_coalesce *coalesce = rdev->coalesce; 11261 int i, j; 11262 struct cfg80211_coalesce_rules *rule; 11263 11264 if (!coalesce) 11265 return; 11266 11267 for (i = 0; i < coalesce->n_rules; i++) { 11268 rule = &coalesce->rules[i]; 11269 for (j = 0; j < rule->n_patterns; j++) 11270 kfree(rule->patterns[j].mask); 11271 kfree(rule->patterns); 11272 } 11273 kfree(coalesce->rules); 11274 kfree(coalesce); 11275 rdev->coalesce = NULL; 11276 } 11277 11278 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev, 11279 struct nlattr *rule, 11280 struct cfg80211_coalesce_rules *new_rule) 11281 { 11282 int err, i; 11283 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce; 11284 struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat; 11285 int rem, pat_len, mask_len, pkt_offset, n_patterns = 0; 11286 struct nlattr *pat_tb[NUM_NL80211_PKTPAT]; 11287 11288 err = nla_parse_nested(tb, NL80211_ATTR_COALESCE_RULE_MAX, rule, 11289 nl80211_coalesce_policy, NULL); 11290 if (err) 11291 return err; 11292 11293 if (tb[NL80211_ATTR_COALESCE_RULE_DELAY]) 11294 new_rule->delay = 11295 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]); 11296 if (new_rule->delay > coalesce->max_delay) 11297 return -EINVAL; 11298 11299 if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION]) 11300 new_rule->condition = 11301 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]); 11302 if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH && 11303 new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH) 11304 return -EINVAL; 11305 11306 if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN]) 11307 return -EINVAL; 11308 11309 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN], 11310 rem) 11311 n_patterns++; 11312 if (n_patterns > coalesce->n_patterns) 11313 return -EINVAL; 11314 11315 new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]), 11316 GFP_KERNEL); 11317 if (!new_rule->patterns) 11318 return -ENOMEM; 11319 11320 new_rule->n_patterns = n_patterns; 11321 i = 0; 11322 11323 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN], 11324 rem) { 11325 u8 *mask_pat; 11326 11327 err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat, 11328 nl80211_packet_pattern_policy, NULL); 11329 if (err) 11330 return err; 11331 11332 if (!pat_tb[NL80211_PKTPAT_MASK] || 11333 !pat_tb[NL80211_PKTPAT_PATTERN]) 11334 return -EINVAL; 11335 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]); 11336 mask_len = DIV_ROUND_UP(pat_len, 8); 11337 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len) 11338 return -EINVAL; 11339 if (pat_len > coalesce->pattern_max_len || 11340 pat_len < coalesce->pattern_min_len) 11341 return -EINVAL; 11342 11343 if (!pat_tb[NL80211_PKTPAT_OFFSET]) 11344 pkt_offset = 0; 11345 else 11346 pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]); 11347 if (pkt_offset > coalesce->max_pkt_offset) 11348 return -EINVAL; 11349 new_rule->patterns[i].pkt_offset = pkt_offset; 11350 11351 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL); 11352 if (!mask_pat) 11353 return -ENOMEM; 11354 11355 new_rule->patterns[i].mask = mask_pat; 11356 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]), 11357 mask_len); 11358 11359 mask_pat += mask_len; 11360 new_rule->patterns[i].pattern = mask_pat; 11361 new_rule->patterns[i].pattern_len = pat_len; 11362 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), 11363 pat_len); 11364 i++; 11365 } 11366 11367 return 0; 11368 } 11369 11370 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info) 11371 { 11372 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11373 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce; 11374 struct cfg80211_coalesce new_coalesce = {}; 11375 struct cfg80211_coalesce *n_coalesce; 11376 int err, rem_rule, n_rules = 0, i, j; 11377 struct nlattr *rule; 11378 struct cfg80211_coalesce_rules *tmp_rule; 11379 11380 if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce) 11381 return -EOPNOTSUPP; 11382 11383 if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) { 11384 cfg80211_rdev_free_coalesce(rdev); 11385 rdev_set_coalesce(rdev, NULL); 11386 return 0; 11387 } 11388 11389 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE], 11390 rem_rule) 11391 n_rules++; 11392 if (n_rules > coalesce->n_rules) 11393 return -EINVAL; 11394 11395 new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]), 11396 GFP_KERNEL); 11397 if (!new_coalesce.rules) 11398 return -ENOMEM; 11399 11400 new_coalesce.n_rules = n_rules; 11401 i = 0; 11402 11403 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE], 11404 rem_rule) { 11405 err = nl80211_parse_coalesce_rule(rdev, rule, 11406 &new_coalesce.rules[i]); 11407 if (err) 11408 goto error; 11409 11410 i++; 11411 } 11412 11413 err = rdev_set_coalesce(rdev, &new_coalesce); 11414 if (err) 11415 goto error; 11416 11417 n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL); 11418 if (!n_coalesce) { 11419 err = -ENOMEM; 11420 goto error; 11421 } 11422 cfg80211_rdev_free_coalesce(rdev); 11423 rdev->coalesce = n_coalesce; 11424 11425 return 0; 11426 error: 11427 for (i = 0; i < new_coalesce.n_rules; i++) { 11428 tmp_rule = &new_coalesce.rules[i]; 11429 for (j = 0; j < tmp_rule->n_patterns; j++) 11430 kfree(tmp_rule->patterns[j].mask); 11431 kfree(tmp_rule->patterns); 11432 } 11433 kfree(new_coalesce.rules); 11434 11435 return err; 11436 } 11437 11438 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info) 11439 { 11440 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11441 struct net_device *dev = info->user_ptr[1]; 11442 struct wireless_dev *wdev = dev->ieee80211_ptr; 11443 struct nlattr *tb[NUM_NL80211_REKEY_DATA]; 11444 struct cfg80211_gtk_rekey_data rekey_data; 11445 int err; 11446 11447 if (!info->attrs[NL80211_ATTR_REKEY_DATA]) 11448 return -EINVAL; 11449 11450 err = nla_parse_nested(tb, MAX_NL80211_REKEY_DATA, 11451 info->attrs[NL80211_ATTR_REKEY_DATA], 11452 nl80211_rekey_policy, info->extack); 11453 if (err) 11454 return err; 11455 11456 if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] || 11457 !tb[NL80211_REKEY_DATA_KCK]) 11458 return -EINVAL; 11459 if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN) 11460 return -ERANGE; 11461 if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN) 11462 return -ERANGE; 11463 if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN) 11464 return -ERANGE; 11465 11466 rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]); 11467 rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]); 11468 rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]); 11469 11470 wdev_lock(wdev); 11471 if (!wdev->current_bss) { 11472 err = -ENOTCONN; 11473 goto out; 11474 } 11475 11476 if (!rdev->ops->set_rekey_data) { 11477 err = -EOPNOTSUPP; 11478 goto out; 11479 } 11480 11481 err = rdev_set_rekey_data(rdev, dev, &rekey_data); 11482 out: 11483 wdev_unlock(wdev); 11484 return err; 11485 } 11486 11487 static int nl80211_register_unexpected_frame(struct sk_buff *skb, 11488 struct genl_info *info) 11489 { 11490 struct net_device *dev = info->user_ptr[1]; 11491 struct wireless_dev *wdev = dev->ieee80211_ptr; 11492 11493 if (wdev->iftype != NL80211_IFTYPE_AP && 11494 wdev->iftype != NL80211_IFTYPE_P2P_GO) 11495 return -EINVAL; 11496 11497 if (wdev->ap_unexpected_nlportid) 11498 return -EBUSY; 11499 11500 wdev->ap_unexpected_nlportid = info->snd_portid; 11501 return 0; 11502 } 11503 11504 static int nl80211_probe_client(struct sk_buff *skb, 11505 struct genl_info *info) 11506 { 11507 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11508 struct net_device *dev = info->user_ptr[1]; 11509 struct wireless_dev *wdev = dev->ieee80211_ptr; 11510 struct sk_buff *msg; 11511 void *hdr; 11512 const u8 *addr; 11513 u64 cookie; 11514 int err; 11515 11516 if (wdev->iftype != NL80211_IFTYPE_AP && 11517 wdev->iftype != NL80211_IFTYPE_P2P_GO) 11518 return -EOPNOTSUPP; 11519 11520 if (!info->attrs[NL80211_ATTR_MAC]) 11521 return -EINVAL; 11522 11523 if (!rdev->ops->probe_client) 11524 return -EOPNOTSUPP; 11525 11526 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 11527 if (!msg) 11528 return -ENOMEM; 11529 11530 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 11531 NL80211_CMD_PROBE_CLIENT); 11532 if (!hdr) { 11533 err = -ENOBUFS; 11534 goto free_msg; 11535 } 11536 11537 addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 11538 11539 err = rdev_probe_client(rdev, dev, addr, &cookie); 11540 if (err) 11541 goto free_msg; 11542 11543 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 11544 NL80211_ATTR_PAD)) 11545 goto nla_put_failure; 11546 11547 genlmsg_end(msg, hdr); 11548 11549 return genlmsg_reply(msg, info); 11550 11551 nla_put_failure: 11552 err = -ENOBUFS; 11553 free_msg: 11554 nlmsg_free(msg); 11555 return err; 11556 } 11557 11558 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info) 11559 { 11560 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11561 struct cfg80211_beacon_registration *reg, *nreg; 11562 int rv; 11563 11564 if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS)) 11565 return -EOPNOTSUPP; 11566 11567 nreg = kzalloc(sizeof(*nreg), GFP_KERNEL); 11568 if (!nreg) 11569 return -ENOMEM; 11570 11571 /* First, check if already registered. */ 11572 spin_lock_bh(&rdev->beacon_registrations_lock); 11573 list_for_each_entry(reg, &rdev->beacon_registrations, list) { 11574 if (reg->nlportid == info->snd_portid) { 11575 rv = -EALREADY; 11576 goto out_err; 11577 } 11578 } 11579 /* Add it to the list */ 11580 nreg->nlportid = info->snd_portid; 11581 list_add(&nreg->list, &rdev->beacon_registrations); 11582 11583 spin_unlock_bh(&rdev->beacon_registrations_lock); 11584 11585 return 0; 11586 out_err: 11587 spin_unlock_bh(&rdev->beacon_registrations_lock); 11588 kfree(nreg); 11589 return rv; 11590 } 11591 11592 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info) 11593 { 11594 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11595 struct wireless_dev *wdev = info->user_ptr[1]; 11596 int err; 11597 11598 if (!rdev->ops->start_p2p_device) 11599 return -EOPNOTSUPP; 11600 11601 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE) 11602 return -EOPNOTSUPP; 11603 11604 if (wdev_running(wdev)) 11605 return 0; 11606 11607 if (rfkill_blocked(rdev->rfkill)) 11608 return -ERFKILL; 11609 11610 err = rdev_start_p2p_device(rdev, wdev); 11611 if (err) 11612 return err; 11613 11614 wdev->is_running = true; 11615 rdev->opencount++; 11616 11617 return 0; 11618 } 11619 11620 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info) 11621 { 11622 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11623 struct wireless_dev *wdev = info->user_ptr[1]; 11624 11625 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE) 11626 return -EOPNOTSUPP; 11627 11628 if (!rdev->ops->stop_p2p_device) 11629 return -EOPNOTSUPP; 11630 11631 cfg80211_stop_p2p_device(rdev, wdev); 11632 11633 return 0; 11634 } 11635 11636 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info) 11637 { 11638 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11639 struct wireless_dev *wdev = info->user_ptr[1]; 11640 struct cfg80211_nan_conf conf = {}; 11641 int err; 11642 11643 if (wdev->iftype != NL80211_IFTYPE_NAN) 11644 return -EOPNOTSUPP; 11645 11646 if (wdev_running(wdev)) 11647 return -EEXIST; 11648 11649 if (rfkill_blocked(rdev->rfkill)) 11650 return -ERFKILL; 11651 11652 if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) 11653 return -EINVAL; 11654 11655 conf.master_pref = 11656 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]); 11657 if (!conf.master_pref) 11658 return -EINVAL; 11659 11660 if (info->attrs[NL80211_ATTR_BANDS]) { 11661 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]); 11662 11663 if (bands & ~(u32)wdev->wiphy->nan_supported_bands) 11664 return -EOPNOTSUPP; 11665 11666 if (bands && !(bands & BIT(NL80211_BAND_2GHZ))) 11667 return -EINVAL; 11668 11669 conf.bands = bands; 11670 } 11671 11672 err = rdev_start_nan(rdev, wdev, &conf); 11673 if (err) 11674 return err; 11675 11676 wdev->is_running = true; 11677 rdev->opencount++; 11678 11679 return 0; 11680 } 11681 11682 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info) 11683 { 11684 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11685 struct wireless_dev *wdev = info->user_ptr[1]; 11686 11687 if (wdev->iftype != NL80211_IFTYPE_NAN) 11688 return -EOPNOTSUPP; 11689 11690 cfg80211_stop_nan(rdev, wdev); 11691 11692 return 0; 11693 } 11694 11695 static int validate_nan_filter(struct nlattr *filter_attr) 11696 { 11697 struct nlattr *attr; 11698 int len = 0, n_entries = 0, rem; 11699 11700 nla_for_each_nested(attr, filter_attr, rem) { 11701 len += nla_len(attr); 11702 n_entries++; 11703 } 11704 11705 if (len >= U8_MAX) 11706 return -EINVAL; 11707 11708 return n_entries; 11709 } 11710 11711 static int handle_nan_filter(struct nlattr *attr_filter, 11712 struct cfg80211_nan_func *func, 11713 bool tx) 11714 { 11715 struct nlattr *attr; 11716 int n_entries, rem, i; 11717 struct cfg80211_nan_func_filter *filter; 11718 11719 n_entries = validate_nan_filter(attr_filter); 11720 if (n_entries < 0) 11721 return n_entries; 11722 11723 BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters)); 11724 11725 filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL); 11726 if (!filter) 11727 return -ENOMEM; 11728 11729 i = 0; 11730 nla_for_each_nested(attr, attr_filter, rem) { 11731 filter[i].filter = nla_memdup(attr, GFP_KERNEL); 11732 filter[i].len = nla_len(attr); 11733 i++; 11734 } 11735 if (tx) { 11736 func->num_tx_filters = n_entries; 11737 func->tx_filters = filter; 11738 } else { 11739 func->num_rx_filters = n_entries; 11740 func->rx_filters = filter; 11741 } 11742 11743 return 0; 11744 } 11745 11746 static int nl80211_nan_add_func(struct sk_buff *skb, 11747 struct genl_info *info) 11748 { 11749 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11750 struct wireless_dev *wdev = info->user_ptr[1]; 11751 struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr; 11752 struct cfg80211_nan_func *func; 11753 struct sk_buff *msg = NULL; 11754 void *hdr = NULL; 11755 int err = 0; 11756 11757 if (wdev->iftype != NL80211_IFTYPE_NAN) 11758 return -EOPNOTSUPP; 11759 11760 if (!wdev_running(wdev)) 11761 return -ENOTCONN; 11762 11763 if (!info->attrs[NL80211_ATTR_NAN_FUNC]) 11764 return -EINVAL; 11765 11766 err = nla_parse_nested(tb, NL80211_NAN_FUNC_ATTR_MAX, 11767 info->attrs[NL80211_ATTR_NAN_FUNC], 11768 nl80211_nan_func_policy, info->extack); 11769 if (err) 11770 return err; 11771 11772 func = kzalloc(sizeof(*func), GFP_KERNEL); 11773 if (!func) 11774 return -ENOMEM; 11775 11776 func->cookie = wdev->wiphy->cookie_counter++; 11777 11778 if (!tb[NL80211_NAN_FUNC_TYPE] || 11779 nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]) > NL80211_NAN_FUNC_MAX_TYPE) { 11780 err = -EINVAL; 11781 goto out; 11782 } 11783 11784 11785 func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]); 11786 11787 if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) { 11788 err = -EINVAL; 11789 goto out; 11790 } 11791 11792 memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]), 11793 sizeof(func->service_id)); 11794 11795 func->close_range = 11796 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]); 11797 11798 if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) { 11799 func->serv_spec_info_len = 11800 nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]); 11801 func->serv_spec_info = 11802 kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]), 11803 func->serv_spec_info_len, 11804 GFP_KERNEL); 11805 if (!func->serv_spec_info) { 11806 err = -ENOMEM; 11807 goto out; 11808 } 11809 } 11810 11811 if (tb[NL80211_NAN_FUNC_TTL]) 11812 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]); 11813 11814 switch (func->type) { 11815 case NL80211_NAN_FUNC_PUBLISH: 11816 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) { 11817 err = -EINVAL; 11818 goto out; 11819 } 11820 11821 func->publish_type = 11822 nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]); 11823 func->publish_bcast = 11824 nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]); 11825 11826 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) && 11827 func->publish_bcast) { 11828 err = -EINVAL; 11829 goto out; 11830 } 11831 break; 11832 case NL80211_NAN_FUNC_SUBSCRIBE: 11833 func->subscribe_active = 11834 nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]); 11835 break; 11836 case NL80211_NAN_FUNC_FOLLOW_UP: 11837 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] || 11838 !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] || 11839 !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) { 11840 err = -EINVAL; 11841 goto out; 11842 } 11843 11844 func->followup_id = 11845 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]); 11846 func->followup_reqid = 11847 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]); 11848 memcpy(func->followup_dest.addr, 11849 nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]), 11850 sizeof(func->followup_dest.addr)); 11851 if (func->ttl) { 11852 err = -EINVAL; 11853 goto out; 11854 } 11855 break; 11856 default: 11857 err = -EINVAL; 11858 goto out; 11859 } 11860 11861 if (tb[NL80211_NAN_FUNC_SRF]) { 11862 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR]; 11863 11864 err = nla_parse_nested(srf_tb, NL80211_NAN_SRF_ATTR_MAX, 11865 tb[NL80211_NAN_FUNC_SRF], 11866 nl80211_nan_srf_policy, info->extack); 11867 if (err) 11868 goto out; 11869 11870 func->srf_include = 11871 nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]); 11872 11873 if (srf_tb[NL80211_NAN_SRF_BF]) { 11874 if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] || 11875 !srf_tb[NL80211_NAN_SRF_BF_IDX]) { 11876 err = -EINVAL; 11877 goto out; 11878 } 11879 11880 func->srf_bf_len = 11881 nla_len(srf_tb[NL80211_NAN_SRF_BF]); 11882 func->srf_bf = 11883 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]), 11884 func->srf_bf_len, GFP_KERNEL); 11885 if (!func->srf_bf) { 11886 err = -ENOMEM; 11887 goto out; 11888 } 11889 11890 func->srf_bf_idx = 11891 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]); 11892 } else { 11893 struct nlattr *attr, *mac_attr = 11894 srf_tb[NL80211_NAN_SRF_MAC_ADDRS]; 11895 int n_entries, rem, i = 0; 11896 11897 if (!mac_attr) { 11898 err = -EINVAL; 11899 goto out; 11900 } 11901 11902 n_entries = validate_acl_mac_addrs(mac_attr); 11903 if (n_entries <= 0) { 11904 err = -EINVAL; 11905 goto out; 11906 } 11907 11908 func->srf_num_macs = n_entries; 11909 func->srf_macs = 11910 kcalloc(n_entries, sizeof(*func->srf_macs), 11911 GFP_KERNEL); 11912 if (!func->srf_macs) { 11913 err = -ENOMEM; 11914 goto out; 11915 } 11916 11917 nla_for_each_nested(attr, mac_attr, rem) 11918 memcpy(func->srf_macs[i++].addr, nla_data(attr), 11919 sizeof(*func->srf_macs)); 11920 } 11921 } 11922 11923 if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) { 11924 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER], 11925 func, true); 11926 if (err) 11927 goto out; 11928 } 11929 11930 if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) { 11931 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER], 11932 func, false); 11933 if (err) 11934 goto out; 11935 } 11936 11937 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 11938 if (!msg) { 11939 err = -ENOMEM; 11940 goto out; 11941 } 11942 11943 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 11944 NL80211_CMD_ADD_NAN_FUNCTION); 11945 /* This can't really happen - we just allocated 4KB */ 11946 if (WARN_ON(!hdr)) { 11947 err = -ENOMEM; 11948 goto out; 11949 } 11950 11951 err = rdev_add_nan_func(rdev, wdev, func); 11952 out: 11953 if (err < 0) { 11954 cfg80211_free_nan_func(func); 11955 nlmsg_free(msg); 11956 return err; 11957 } 11958 11959 /* propagate the instance id and cookie to userspace */ 11960 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie, 11961 NL80211_ATTR_PAD)) 11962 goto nla_put_failure; 11963 11964 func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC); 11965 if (!func_attr) 11966 goto nla_put_failure; 11967 11968 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, 11969 func->instance_id)) 11970 goto nla_put_failure; 11971 11972 nla_nest_end(msg, func_attr); 11973 11974 genlmsg_end(msg, hdr); 11975 return genlmsg_reply(msg, info); 11976 11977 nla_put_failure: 11978 nlmsg_free(msg); 11979 return -ENOBUFS; 11980 } 11981 11982 static int nl80211_nan_del_func(struct sk_buff *skb, 11983 struct genl_info *info) 11984 { 11985 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11986 struct wireless_dev *wdev = info->user_ptr[1]; 11987 u64 cookie; 11988 11989 if (wdev->iftype != NL80211_IFTYPE_NAN) 11990 return -EOPNOTSUPP; 11991 11992 if (!wdev_running(wdev)) 11993 return -ENOTCONN; 11994 11995 if (!info->attrs[NL80211_ATTR_COOKIE]) 11996 return -EINVAL; 11997 11998 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 11999 12000 rdev_del_nan_func(rdev, wdev, cookie); 12001 12002 return 0; 12003 } 12004 12005 static int nl80211_nan_change_config(struct sk_buff *skb, 12006 struct genl_info *info) 12007 { 12008 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12009 struct wireless_dev *wdev = info->user_ptr[1]; 12010 struct cfg80211_nan_conf conf = {}; 12011 u32 changed = 0; 12012 12013 if (wdev->iftype != NL80211_IFTYPE_NAN) 12014 return -EOPNOTSUPP; 12015 12016 if (!wdev_running(wdev)) 12017 return -ENOTCONN; 12018 12019 if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) { 12020 conf.master_pref = 12021 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]); 12022 if (conf.master_pref <= 1 || conf.master_pref == 255) 12023 return -EINVAL; 12024 12025 changed |= CFG80211_NAN_CONF_CHANGED_PREF; 12026 } 12027 12028 if (info->attrs[NL80211_ATTR_BANDS]) { 12029 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]); 12030 12031 if (bands & ~(u32)wdev->wiphy->nan_supported_bands) 12032 return -EOPNOTSUPP; 12033 12034 if (bands && !(bands & BIT(NL80211_BAND_2GHZ))) 12035 return -EINVAL; 12036 12037 conf.bands = bands; 12038 changed |= CFG80211_NAN_CONF_CHANGED_BANDS; 12039 } 12040 12041 if (!changed) 12042 return -EINVAL; 12043 12044 return rdev_nan_change_conf(rdev, wdev, &conf, changed); 12045 } 12046 12047 void cfg80211_nan_match(struct wireless_dev *wdev, 12048 struct cfg80211_nan_match_params *match, gfp_t gfp) 12049 { 12050 struct wiphy *wiphy = wdev->wiphy; 12051 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 12052 struct nlattr *match_attr, *local_func_attr, *peer_func_attr; 12053 struct sk_buff *msg; 12054 void *hdr; 12055 12056 if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr)) 12057 return; 12058 12059 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 12060 if (!msg) 12061 return; 12062 12063 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH); 12064 if (!hdr) { 12065 nlmsg_free(msg); 12066 return; 12067 } 12068 12069 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 12070 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 12071 wdev->netdev->ifindex)) || 12072 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 12073 NL80211_ATTR_PAD)) 12074 goto nla_put_failure; 12075 12076 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie, 12077 NL80211_ATTR_PAD) || 12078 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr)) 12079 goto nla_put_failure; 12080 12081 match_attr = nla_nest_start(msg, NL80211_ATTR_NAN_MATCH); 12082 if (!match_attr) 12083 goto nla_put_failure; 12084 12085 local_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_LOCAL); 12086 if (!local_func_attr) 12087 goto nla_put_failure; 12088 12089 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id)) 12090 goto nla_put_failure; 12091 12092 nla_nest_end(msg, local_func_attr); 12093 12094 peer_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_PEER); 12095 if (!peer_func_attr) 12096 goto nla_put_failure; 12097 12098 if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) || 12099 nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id)) 12100 goto nla_put_failure; 12101 12102 if (match->info && match->info_len && 12103 nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len, 12104 match->info)) 12105 goto nla_put_failure; 12106 12107 nla_nest_end(msg, peer_func_attr); 12108 nla_nest_end(msg, match_attr); 12109 genlmsg_end(msg, hdr); 12110 12111 if (!wdev->owner_nlportid) 12112 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), 12113 msg, 0, NL80211_MCGRP_NAN, gfp); 12114 else 12115 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, 12116 wdev->owner_nlportid); 12117 12118 return; 12119 12120 nla_put_failure: 12121 nlmsg_free(msg); 12122 } 12123 EXPORT_SYMBOL(cfg80211_nan_match); 12124 12125 void cfg80211_nan_func_terminated(struct wireless_dev *wdev, 12126 u8 inst_id, 12127 enum nl80211_nan_func_term_reason reason, 12128 u64 cookie, gfp_t gfp) 12129 { 12130 struct wiphy *wiphy = wdev->wiphy; 12131 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 12132 struct sk_buff *msg; 12133 struct nlattr *func_attr; 12134 void *hdr; 12135 12136 if (WARN_ON(!inst_id)) 12137 return; 12138 12139 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 12140 if (!msg) 12141 return; 12142 12143 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION); 12144 if (!hdr) { 12145 nlmsg_free(msg); 12146 return; 12147 } 12148 12149 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 12150 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 12151 wdev->netdev->ifindex)) || 12152 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 12153 NL80211_ATTR_PAD)) 12154 goto nla_put_failure; 12155 12156 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 12157 NL80211_ATTR_PAD)) 12158 goto nla_put_failure; 12159 12160 func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC); 12161 if (!func_attr) 12162 goto nla_put_failure; 12163 12164 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) || 12165 nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason)) 12166 goto nla_put_failure; 12167 12168 nla_nest_end(msg, func_attr); 12169 genlmsg_end(msg, hdr); 12170 12171 if (!wdev->owner_nlportid) 12172 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), 12173 msg, 0, NL80211_MCGRP_NAN, gfp); 12174 else 12175 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, 12176 wdev->owner_nlportid); 12177 12178 return; 12179 12180 nla_put_failure: 12181 nlmsg_free(msg); 12182 } 12183 EXPORT_SYMBOL(cfg80211_nan_func_terminated); 12184 12185 static int nl80211_get_protocol_features(struct sk_buff *skb, 12186 struct genl_info *info) 12187 { 12188 void *hdr; 12189 struct sk_buff *msg; 12190 12191 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 12192 if (!msg) 12193 return -ENOMEM; 12194 12195 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 12196 NL80211_CMD_GET_PROTOCOL_FEATURES); 12197 if (!hdr) 12198 goto nla_put_failure; 12199 12200 if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES, 12201 NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP)) 12202 goto nla_put_failure; 12203 12204 genlmsg_end(msg, hdr); 12205 return genlmsg_reply(msg, info); 12206 12207 nla_put_failure: 12208 kfree_skb(msg); 12209 return -ENOBUFS; 12210 } 12211 12212 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info) 12213 { 12214 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12215 struct cfg80211_update_ft_ies_params ft_params; 12216 struct net_device *dev = info->user_ptr[1]; 12217 12218 if (!rdev->ops->update_ft_ies) 12219 return -EOPNOTSUPP; 12220 12221 if (!info->attrs[NL80211_ATTR_MDID] || 12222 !info->attrs[NL80211_ATTR_IE] || 12223 !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) 12224 return -EINVAL; 12225 12226 memset(&ft_params, 0, sizeof(ft_params)); 12227 ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]); 12228 ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 12229 ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 12230 12231 return rdev_update_ft_ies(rdev, dev, &ft_params); 12232 } 12233 12234 static int nl80211_crit_protocol_start(struct sk_buff *skb, 12235 struct genl_info *info) 12236 { 12237 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12238 struct wireless_dev *wdev = info->user_ptr[1]; 12239 enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC; 12240 u16 duration; 12241 int ret; 12242 12243 if (!rdev->ops->crit_proto_start) 12244 return -EOPNOTSUPP; 12245 12246 if (WARN_ON(!rdev->ops->crit_proto_stop)) 12247 return -EINVAL; 12248 12249 if (rdev->crit_proto_nlportid) 12250 return -EBUSY; 12251 12252 /* determine protocol if provided */ 12253 if (info->attrs[NL80211_ATTR_CRIT_PROT_ID]) 12254 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]); 12255 12256 if (proto >= NUM_NL80211_CRIT_PROTO) 12257 return -EINVAL; 12258 12259 /* timeout must be provided */ 12260 if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]) 12261 return -EINVAL; 12262 12263 duration = 12264 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]); 12265 12266 if (duration > NL80211_CRIT_PROTO_MAX_DURATION) 12267 return -ERANGE; 12268 12269 ret = rdev_crit_proto_start(rdev, wdev, proto, duration); 12270 if (!ret) 12271 rdev->crit_proto_nlportid = info->snd_portid; 12272 12273 return ret; 12274 } 12275 12276 static int nl80211_crit_protocol_stop(struct sk_buff *skb, 12277 struct genl_info *info) 12278 { 12279 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12280 struct wireless_dev *wdev = info->user_ptr[1]; 12281 12282 if (!rdev->ops->crit_proto_stop) 12283 return -EOPNOTSUPP; 12284 12285 if (rdev->crit_proto_nlportid) { 12286 rdev->crit_proto_nlportid = 0; 12287 rdev_crit_proto_stop(rdev, wdev); 12288 } 12289 return 0; 12290 } 12291 12292 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info) 12293 { 12294 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12295 struct wireless_dev *wdev = 12296 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs); 12297 int i, err; 12298 u32 vid, subcmd; 12299 12300 if (!rdev->wiphy.vendor_commands) 12301 return -EOPNOTSUPP; 12302 12303 if (IS_ERR(wdev)) { 12304 err = PTR_ERR(wdev); 12305 if (err != -EINVAL) 12306 return err; 12307 wdev = NULL; 12308 } else if (wdev->wiphy != &rdev->wiphy) { 12309 return -EINVAL; 12310 } 12311 12312 if (!info->attrs[NL80211_ATTR_VENDOR_ID] || 12313 !info->attrs[NL80211_ATTR_VENDOR_SUBCMD]) 12314 return -EINVAL; 12315 12316 vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]); 12317 subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]); 12318 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) { 12319 const struct wiphy_vendor_command *vcmd; 12320 void *data = NULL; 12321 int len = 0; 12322 12323 vcmd = &rdev->wiphy.vendor_commands[i]; 12324 12325 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd) 12326 continue; 12327 12328 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV | 12329 WIPHY_VENDOR_CMD_NEED_NETDEV)) { 12330 if (!wdev) 12331 return -EINVAL; 12332 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV && 12333 !wdev->netdev) 12334 return -EINVAL; 12335 12336 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) { 12337 if (!wdev_running(wdev)) 12338 return -ENETDOWN; 12339 } 12340 12341 if (!vcmd->doit) 12342 return -EOPNOTSUPP; 12343 } else { 12344 wdev = NULL; 12345 } 12346 12347 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) { 12348 data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]); 12349 len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]); 12350 } 12351 12352 rdev->cur_cmd_info = info; 12353 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev, 12354 data, len); 12355 rdev->cur_cmd_info = NULL; 12356 return err; 12357 } 12358 12359 return -EOPNOTSUPP; 12360 } 12361 12362 static int nl80211_prepare_vendor_dump(struct sk_buff *skb, 12363 struct netlink_callback *cb, 12364 struct cfg80211_registered_device **rdev, 12365 struct wireless_dev **wdev) 12366 { 12367 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam); 12368 u32 vid, subcmd; 12369 unsigned int i; 12370 int vcmd_idx = -1; 12371 int err; 12372 void *data = NULL; 12373 unsigned int data_len = 0; 12374 12375 if (cb->args[0]) { 12376 /* subtract the 1 again here */ 12377 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1); 12378 struct wireless_dev *tmp; 12379 12380 if (!wiphy) 12381 return -ENODEV; 12382 *rdev = wiphy_to_rdev(wiphy); 12383 *wdev = NULL; 12384 12385 if (cb->args[1]) { 12386 list_for_each_entry(tmp, &wiphy->wdev_list, list) { 12387 if (tmp->identifier == cb->args[1] - 1) { 12388 *wdev = tmp; 12389 break; 12390 } 12391 } 12392 } 12393 12394 /* keep rtnl locked in successful case */ 12395 return 0; 12396 } 12397 12398 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, attrbuf, 12399 nl80211_fam.maxattr, nl80211_policy, NULL); 12400 if (err) 12401 return err; 12402 12403 if (!attrbuf[NL80211_ATTR_VENDOR_ID] || 12404 !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) 12405 return -EINVAL; 12406 12407 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk), attrbuf); 12408 if (IS_ERR(*wdev)) 12409 *wdev = NULL; 12410 12411 *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf); 12412 if (IS_ERR(*rdev)) 12413 return PTR_ERR(*rdev); 12414 12415 vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]); 12416 subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]); 12417 12418 for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) { 12419 const struct wiphy_vendor_command *vcmd; 12420 12421 vcmd = &(*rdev)->wiphy.vendor_commands[i]; 12422 12423 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd) 12424 continue; 12425 12426 if (!vcmd->dumpit) 12427 return -EOPNOTSUPP; 12428 12429 vcmd_idx = i; 12430 break; 12431 } 12432 12433 if (vcmd_idx < 0) 12434 return -EOPNOTSUPP; 12435 12436 if (attrbuf[NL80211_ATTR_VENDOR_DATA]) { 12437 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]); 12438 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]); 12439 } 12440 12441 /* 0 is the first index - add 1 to parse only once */ 12442 cb->args[0] = (*rdev)->wiphy_idx + 1; 12443 /* add 1 to know if it was NULL */ 12444 cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0; 12445 cb->args[2] = vcmd_idx; 12446 cb->args[3] = (unsigned long)data; 12447 cb->args[4] = data_len; 12448 12449 /* keep rtnl locked in successful case */ 12450 return 0; 12451 } 12452 12453 static int nl80211_vendor_cmd_dump(struct sk_buff *skb, 12454 struct netlink_callback *cb) 12455 { 12456 struct cfg80211_registered_device *rdev; 12457 struct wireless_dev *wdev; 12458 unsigned int vcmd_idx; 12459 const struct wiphy_vendor_command *vcmd; 12460 void *data; 12461 int data_len; 12462 int err; 12463 struct nlattr *vendor_data; 12464 12465 rtnl_lock(); 12466 err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev); 12467 if (err) 12468 goto out; 12469 12470 vcmd_idx = cb->args[2]; 12471 data = (void *)cb->args[3]; 12472 data_len = cb->args[4]; 12473 vcmd = &rdev->wiphy.vendor_commands[vcmd_idx]; 12474 12475 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV | 12476 WIPHY_VENDOR_CMD_NEED_NETDEV)) { 12477 if (!wdev) { 12478 err = -EINVAL; 12479 goto out; 12480 } 12481 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV && 12482 !wdev->netdev) { 12483 err = -EINVAL; 12484 goto out; 12485 } 12486 12487 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) { 12488 if (!wdev_running(wdev)) { 12489 err = -ENETDOWN; 12490 goto out; 12491 } 12492 } 12493 } 12494 12495 while (1) { 12496 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid, 12497 cb->nlh->nlmsg_seq, NLM_F_MULTI, 12498 NL80211_CMD_VENDOR); 12499 if (!hdr) 12500 break; 12501 12502 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 12503 (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV, 12504 wdev_id(wdev), 12505 NL80211_ATTR_PAD))) { 12506 genlmsg_cancel(skb, hdr); 12507 break; 12508 } 12509 12510 vendor_data = nla_nest_start(skb, NL80211_ATTR_VENDOR_DATA); 12511 if (!vendor_data) { 12512 genlmsg_cancel(skb, hdr); 12513 break; 12514 } 12515 12516 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len, 12517 (unsigned long *)&cb->args[5]); 12518 nla_nest_end(skb, vendor_data); 12519 12520 if (err == -ENOBUFS || err == -ENOENT) { 12521 genlmsg_cancel(skb, hdr); 12522 break; 12523 } else if (err) { 12524 genlmsg_cancel(skb, hdr); 12525 goto out; 12526 } 12527 12528 genlmsg_end(skb, hdr); 12529 } 12530 12531 err = skb->len; 12532 out: 12533 rtnl_unlock(); 12534 return err; 12535 } 12536 12537 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy, 12538 enum nl80211_commands cmd, 12539 enum nl80211_attrs attr, 12540 int approxlen) 12541 { 12542 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 12543 12544 if (WARN_ON(!rdev->cur_cmd_info)) 12545 return NULL; 12546 12547 return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen, 12548 rdev->cur_cmd_info->snd_portid, 12549 rdev->cur_cmd_info->snd_seq, 12550 cmd, attr, NULL, GFP_KERNEL); 12551 } 12552 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb); 12553 12554 int cfg80211_vendor_cmd_reply(struct sk_buff *skb) 12555 { 12556 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0]; 12557 void *hdr = ((void **)skb->cb)[1]; 12558 struct nlattr *data = ((void **)skb->cb)[2]; 12559 12560 /* clear CB data for netlink core to own from now on */ 12561 memset(skb->cb, 0, sizeof(skb->cb)); 12562 12563 if (WARN_ON(!rdev->cur_cmd_info)) { 12564 kfree_skb(skb); 12565 return -EINVAL; 12566 } 12567 12568 nla_nest_end(skb, data); 12569 genlmsg_end(skb, hdr); 12570 return genlmsg_reply(skb, rdev->cur_cmd_info); 12571 } 12572 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply); 12573 12574 static int nl80211_set_qos_map(struct sk_buff *skb, 12575 struct genl_info *info) 12576 { 12577 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12578 struct cfg80211_qos_map *qos_map = NULL; 12579 struct net_device *dev = info->user_ptr[1]; 12580 u8 *pos, len, num_des, des_len, des; 12581 int ret; 12582 12583 if (!rdev->ops->set_qos_map) 12584 return -EOPNOTSUPP; 12585 12586 if (info->attrs[NL80211_ATTR_QOS_MAP]) { 12587 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]); 12588 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]); 12589 12590 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN || 12591 len > IEEE80211_QOS_MAP_LEN_MAX) 12592 return -EINVAL; 12593 12594 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL); 12595 if (!qos_map) 12596 return -ENOMEM; 12597 12598 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1; 12599 if (num_des) { 12600 des_len = num_des * 12601 sizeof(struct cfg80211_dscp_exception); 12602 memcpy(qos_map->dscp_exception, pos, des_len); 12603 qos_map->num_des = num_des; 12604 for (des = 0; des < num_des; des++) { 12605 if (qos_map->dscp_exception[des].up > 7) { 12606 kfree(qos_map); 12607 return -EINVAL; 12608 } 12609 } 12610 pos += des_len; 12611 } 12612 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN); 12613 } 12614 12615 wdev_lock(dev->ieee80211_ptr); 12616 ret = nl80211_key_allowed(dev->ieee80211_ptr); 12617 if (!ret) 12618 ret = rdev_set_qos_map(rdev, dev, qos_map); 12619 wdev_unlock(dev->ieee80211_ptr); 12620 12621 kfree(qos_map); 12622 return ret; 12623 } 12624 12625 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info) 12626 { 12627 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12628 struct net_device *dev = info->user_ptr[1]; 12629 struct wireless_dev *wdev = dev->ieee80211_ptr; 12630 const u8 *peer; 12631 u8 tsid, up; 12632 u16 admitted_time = 0; 12633 int err; 12634 12635 if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)) 12636 return -EOPNOTSUPP; 12637 12638 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] || 12639 !info->attrs[NL80211_ATTR_USER_PRIO]) 12640 return -EINVAL; 12641 12642 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]); 12643 if (tsid >= IEEE80211_NUM_TIDS) 12644 return -EINVAL; 12645 12646 up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]); 12647 if (up >= IEEE80211_NUM_UPS) 12648 return -EINVAL; 12649 12650 /* WMM uses TIDs 0-7 even for TSPEC */ 12651 if (tsid >= IEEE80211_FIRST_TSPEC_TSID) { 12652 /* TODO: handle 802.11 TSPEC/admission control 12653 * need more attributes for that (e.g. BA session requirement); 12654 * change the WMM adminssion test above to allow both then 12655 */ 12656 return -EINVAL; 12657 } 12658 12659 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 12660 12661 if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) { 12662 admitted_time = 12663 nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]); 12664 if (!admitted_time) 12665 return -EINVAL; 12666 } 12667 12668 wdev_lock(wdev); 12669 switch (wdev->iftype) { 12670 case NL80211_IFTYPE_STATION: 12671 case NL80211_IFTYPE_P2P_CLIENT: 12672 if (wdev->current_bss) 12673 break; 12674 err = -ENOTCONN; 12675 goto out; 12676 default: 12677 err = -EOPNOTSUPP; 12678 goto out; 12679 } 12680 12681 err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time); 12682 12683 out: 12684 wdev_unlock(wdev); 12685 return err; 12686 } 12687 12688 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info) 12689 { 12690 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12691 struct net_device *dev = info->user_ptr[1]; 12692 struct wireless_dev *wdev = dev->ieee80211_ptr; 12693 const u8 *peer; 12694 u8 tsid; 12695 int err; 12696 12697 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC]) 12698 return -EINVAL; 12699 12700 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]); 12701 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 12702 12703 wdev_lock(wdev); 12704 err = rdev_del_tx_ts(rdev, dev, tsid, peer); 12705 wdev_unlock(wdev); 12706 12707 return err; 12708 } 12709 12710 static int nl80211_tdls_channel_switch(struct sk_buff *skb, 12711 struct genl_info *info) 12712 { 12713 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12714 struct net_device *dev = info->user_ptr[1]; 12715 struct wireless_dev *wdev = dev->ieee80211_ptr; 12716 struct cfg80211_chan_def chandef = {}; 12717 const u8 *addr; 12718 u8 oper_class; 12719 int err; 12720 12721 if (!rdev->ops->tdls_channel_switch || 12722 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH)) 12723 return -EOPNOTSUPP; 12724 12725 switch (dev->ieee80211_ptr->iftype) { 12726 case NL80211_IFTYPE_STATION: 12727 case NL80211_IFTYPE_P2P_CLIENT: 12728 break; 12729 default: 12730 return -EOPNOTSUPP; 12731 } 12732 12733 if (!info->attrs[NL80211_ATTR_MAC] || 12734 !info->attrs[NL80211_ATTR_OPER_CLASS]) 12735 return -EINVAL; 12736 12737 err = nl80211_parse_chandef(rdev, info, &chandef); 12738 if (err) 12739 return err; 12740 12741 /* 12742 * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012 12743 * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the 12744 * specification is not defined for them. 12745 */ 12746 if (chandef.chan->band == NL80211_BAND_2GHZ && 12747 chandef.width != NL80211_CHAN_WIDTH_20_NOHT && 12748 chandef.width != NL80211_CHAN_WIDTH_20) 12749 return -EINVAL; 12750 12751 /* we will be active on the TDLS link */ 12752 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef, 12753 wdev->iftype)) 12754 return -EINVAL; 12755 12756 /* don't allow switching to DFS channels */ 12757 if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype)) 12758 return -EINVAL; 12759 12760 addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 12761 oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]); 12762 12763 wdev_lock(wdev); 12764 err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef); 12765 wdev_unlock(wdev); 12766 12767 return err; 12768 } 12769 12770 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb, 12771 struct genl_info *info) 12772 { 12773 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12774 struct net_device *dev = info->user_ptr[1]; 12775 struct wireless_dev *wdev = dev->ieee80211_ptr; 12776 const u8 *addr; 12777 12778 if (!rdev->ops->tdls_channel_switch || 12779 !rdev->ops->tdls_cancel_channel_switch || 12780 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH)) 12781 return -EOPNOTSUPP; 12782 12783 switch (dev->ieee80211_ptr->iftype) { 12784 case NL80211_IFTYPE_STATION: 12785 case NL80211_IFTYPE_P2P_CLIENT: 12786 break; 12787 default: 12788 return -EOPNOTSUPP; 12789 } 12790 12791 if (!info->attrs[NL80211_ATTR_MAC]) 12792 return -EINVAL; 12793 12794 addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 12795 12796 wdev_lock(wdev); 12797 rdev_tdls_cancel_channel_switch(rdev, dev, addr); 12798 wdev_unlock(wdev); 12799 12800 return 0; 12801 } 12802 12803 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb, 12804 struct genl_info *info) 12805 { 12806 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12807 struct net_device *dev = info->user_ptr[1]; 12808 struct wireless_dev *wdev = dev->ieee80211_ptr; 12809 const struct nlattr *nla; 12810 bool enabled; 12811 12812 if (!rdev->ops->set_multicast_to_unicast) 12813 return -EOPNOTSUPP; 12814 12815 if (wdev->iftype != NL80211_IFTYPE_AP && 12816 wdev->iftype != NL80211_IFTYPE_P2P_GO) 12817 return -EOPNOTSUPP; 12818 12819 nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED]; 12820 enabled = nla_get_flag(nla); 12821 12822 return rdev_set_multicast_to_unicast(rdev, dev, enabled); 12823 } 12824 12825 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info) 12826 { 12827 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12828 struct net_device *dev = info->user_ptr[1]; 12829 struct wireless_dev *wdev = dev->ieee80211_ptr; 12830 struct cfg80211_pmk_conf pmk_conf = {}; 12831 int ret; 12832 12833 if (wdev->iftype != NL80211_IFTYPE_STATION && 12834 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 12835 return -EOPNOTSUPP; 12836 12837 if (!wiphy_ext_feature_isset(&rdev->wiphy, 12838 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X)) 12839 return -EOPNOTSUPP; 12840 12841 if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK]) 12842 return -EINVAL; 12843 12844 wdev_lock(wdev); 12845 if (!wdev->current_bss) { 12846 ret = -ENOTCONN; 12847 goto out; 12848 } 12849 12850 pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]); 12851 if (memcmp(pmk_conf.aa, wdev->current_bss->pub.bssid, ETH_ALEN)) { 12852 ret = -EINVAL; 12853 goto out; 12854 } 12855 12856 pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]); 12857 pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]); 12858 if (pmk_conf.pmk_len != WLAN_PMK_LEN && 12859 pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) { 12860 ret = -EINVAL; 12861 goto out; 12862 } 12863 12864 if (info->attrs[NL80211_ATTR_PMKR0_NAME]) { 12865 int r0_name_len = nla_len(info->attrs[NL80211_ATTR_PMKR0_NAME]); 12866 12867 if (r0_name_len != WLAN_PMK_NAME_LEN) { 12868 ret = -EINVAL; 12869 goto out; 12870 } 12871 12872 pmk_conf.pmk_r0_name = 12873 nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]); 12874 } 12875 12876 ret = rdev_set_pmk(rdev, dev, &pmk_conf); 12877 out: 12878 wdev_unlock(wdev); 12879 return ret; 12880 } 12881 12882 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info) 12883 { 12884 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12885 struct net_device *dev = info->user_ptr[1]; 12886 struct wireless_dev *wdev = dev->ieee80211_ptr; 12887 const u8 *aa; 12888 int ret; 12889 12890 if (wdev->iftype != NL80211_IFTYPE_STATION && 12891 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 12892 return -EOPNOTSUPP; 12893 12894 if (!wiphy_ext_feature_isset(&rdev->wiphy, 12895 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X)) 12896 return -EOPNOTSUPP; 12897 12898 if (!info->attrs[NL80211_ATTR_MAC]) 12899 return -EINVAL; 12900 12901 wdev_lock(wdev); 12902 aa = nla_data(info->attrs[NL80211_ATTR_MAC]); 12903 ret = rdev_del_pmk(rdev, dev, aa); 12904 wdev_unlock(wdev); 12905 12906 return ret; 12907 } 12908 12909 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info) 12910 { 12911 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12912 struct net_device *dev = info->user_ptr[1]; 12913 struct cfg80211_external_auth_params params; 12914 12915 if (!rdev->ops->external_auth) 12916 return -EOPNOTSUPP; 12917 12918 if (!info->attrs[NL80211_ATTR_SSID]) 12919 return -EINVAL; 12920 12921 if (!info->attrs[NL80211_ATTR_BSSID]) 12922 return -EINVAL; 12923 12924 if (!info->attrs[NL80211_ATTR_STATUS_CODE]) 12925 return -EINVAL; 12926 12927 memset(¶ms, 0, sizeof(params)); 12928 12929 params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 12930 if (params.ssid.ssid_len == 0 || 12931 params.ssid.ssid_len > IEEE80211_MAX_SSID_LEN) 12932 return -EINVAL; 12933 memcpy(params.ssid.ssid, nla_data(info->attrs[NL80211_ATTR_SSID]), 12934 params.ssid.ssid_len); 12935 12936 memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]), 12937 ETH_ALEN); 12938 12939 params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]); 12940 12941 return rdev_external_auth(rdev, dev, ¶ms); 12942 } 12943 12944 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info) 12945 { 12946 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12947 struct net_device *dev = info->user_ptr[1]; 12948 struct wireless_dev *wdev = dev->ieee80211_ptr; 12949 const u8 *buf; 12950 size_t len; 12951 u8 *dest; 12952 u16 proto; 12953 bool noencrypt; 12954 int err; 12955 12956 if (!wiphy_ext_feature_isset(&rdev->wiphy, 12957 NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211)) 12958 return -EOPNOTSUPP; 12959 12960 if (!rdev->ops->tx_control_port) 12961 return -EOPNOTSUPP; 12962 12963 if (!info->attrs[NL80211_ATTR_FRAME] || 12964 !info->attrs[NL80211_ATTR_MAC] || 12965 !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) { 12966 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing"); 12967 return -EINVAL; 12968 } 12969 12970 wdev_lock(wdev); 12971 12972 switch (wdev->iftype) { 12973 case NL80211_IFTYPE_AP: 12974 case NL80211_IFTYPE_P2P_GO: 12975 case NL80211_IFTYPE_MESH_POINT: 12976 break; 12977 case NL80211_IFTYPE_ADHOC: 12978 case NL80211_IFTYPE_STATION: 12979 case NL80211_IFTYPE_P2P_CLIENT: 12980 if (wdev->current_bss) 12981 break; 12982 err = -ENOTCONN; 12983 goto out; 12984 default: 12985 err = -EOPNOTSUPP; 12986 goto out; 12987 } 12988 12989 wdev_unlock(wdev); 12990 12991 buf = nla_data(info->attrs[NL80211_ATTR_FRAME]); 12992 len = nla_len(info->attrs[NL80211_ATTR_FRAME]); 12993 dest = nla_data(info->attrs[NL80211_ATTR_MAC]); 12994 proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]); 12995 noencrypt = 12996 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]); 12997 12998 return rdev_tx_control_port(rdev, dev, buf, len, 12999 dest, cpu_to_be16(proto), noencrypt); 13000 13001 out: 13002 wdev_unlock(wdev); 13003 return err; 13004 } 13005 13006 #define NL80211_FLAG_NEED_WIPHY 0x01 13007 #define NL80211_FLAG_NEED_NETDEV 0x02 13008 #define NL80211_FLAG_NEED_RTNL 0x04 13009 #define NL80211_FLAG_CHECK_NETDEV_UP 0x08 13010 #define NL80211_FLAG_NEED_NETDEV_UP (NL80211_FLAG_NEED_NETDEV |\ 13011 NL80211_FLAG_CHECK_NETDEV_UP) 13012 #define NL80211_FLAG_NEED_WDEV 0x10 13013 /* If a netdev is associated, it must be UP, P2P must be started */ 13014 #define NL80211_FLAG_NEED_WDEV_UP (NL80211_FLAG_NEED_WDEV |\ 13015 NL80211_FLAG_CHECK_NETDEV_UP) 13016 #define NL80211_FLAG_CLEAR_SKB 0x20 13017 13018 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb, 13019 struct genl_info *info) 13020 { 13021 struct cfg80211_registered_device *rdev; 13022 struct wireless_dev *wdev; 13023 struct net_device *dev; 13024 bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL; 13025 13026 if (rtnl) 13027 rtnl_lock(); 13028 13029 if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) { 13030 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info); 13031 if (IS_ERR(rdev)) { 13032 if (rtnl) 13033 rtnl_unlock(); 13034 return PTR_ERR(rdev); 13035 } 13036 info->user_ptr[0] = rdev; 13037 } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV || 13038 ops->internal_flags & NL80211_FLAG_NEED_WDEV) { 13039 ASSERT_RTNL(); 13040 13041 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info), 13042 info->attrs); 13043 if (IS_ERR(wdev)) { 13044 if (rtnl) 13045 rtnl_unlock(); 13046 return PTR_ERR(wdev); 13047 } 13048 13049 dev = wdev->netdev; 13050 rdev = wiphy_to_rdev(wdev->wiphy); 13051 13052 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) { 13053 if (!dev) { 13054 if (rtnl) 13055 rtnl_unlock(); 13056 return -EINVAL; 13057 } 13058 13059 info->user_ptr[1] = dev; 13060 } else { 13061 info->user_ptr[1] = wdev; 13062 } 13063 13064 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP && 13065 !wdev_running(wdev)) { 13066 if (rtnl) 13067 rtnl_unlock(); 13068 return -ENETDOWN; 13069 } 13070 13071 if (dev) 13072 dev_hold(dev); 13073 13074 info->user_ptr[0] = rdev; 13075 } 13076 13077 return 0; 13078 } 13079 13080 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb, 13081 struct genl_info *info) 13082 { 13083 if (info->user_ptr[1]) { 13084 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) { 13085 struct wireless_dev *wdev = info->user_ptr[1]; 13086 13087 if (wdev->netdev) 13088 dev_put(wdev->netdev); 13089 } else { 13090 dev_put(info->user_ptr[1]); 13091 } 13092 } 13093 13094 if (ops->internal_flags & NL80211_FLAG_NEED_RTNL) 13095 rtnl_unlock(); 13096 13097 /* If needed, clear the netlink message payload from the SKB 13098 * as it might contain key data that shouldn't stick around on 13099 * the heap after the SKB is freed. The netlink message header 13100 * is still needed for further processing, so leave it intact. 13101 */ 13102 if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) { 13103 struct nlmsghdr *nlh = nlmsg_hdr(skb); 13104 13105 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh)); 13106 } 13107 } 13108 13109 static const struct genl_ops nl80211_ops[] = { 13110 { 13111 .cmd = NL80211_CMD_GET_WIPHY, 13112 .doit = nl80211_get_wiphy, 13113 .dumpit = nl80211_dump_wiphy, 13114 .done = nl80211_dump_wiphy_done, 13115 .policy = nl80211_policy, 13116 /* can be retrieved by unprivileged users */ 13117 .internal_flags = NL80211_FLAG_NEED_WIPHY | 13118 NL80211_FLAG_NEED_RTNL, 13119 }, 13120 { 13121 .cmd = NL80211_CMD_SET_WIPHY, 13122 .doit = nl80211_set_wiphy, 13123 .policy = nl80211_policy, 13124 .flags = GENL_UNS_ADMIN_PERM, 13125 .internal_flags = NL80211_FLAG_NEED_RTNL, 13126 }, 13127 { 13128 .cmd = NL80211_CMD_GET_INTERFACE, 13129 .doit = nl80211_get_interface, 13130 .dumpit = nl80211_dump_interface, 13131 .policy = nl80211_policy, 13132 /* can be retrieved by unprivileged users */ 13133 .internal_flags = NL80211_FLAG_NEED_WDEV | 13134 NL80211_FLAG_NEED_RTNL, 13135 }, 13136 { 13137 .cmd = NL80211_CMD_SET_INTERFACE, 13138 .doit = nl80211_set_interface, 13139 .policy = nl80211_policy, 13140 .flags = GENL_UNS_ADMIN_PERM, 13141 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13142 NL80211_FLAG_NEED_RTNL, 13143 }, 13144 { 13145 .cmd = NL80211_CMD_NEW_INTERFACE, 13146 .doit = nl80211_new_interface, 13147 .policy = nl80211_policy, 13148 .flags = GENL_UNS_ADMIN_PERM, 13149 .internal_flags = NL80211_FLAG_NEED_WIPHY | 13150 NL80211_FLAG_NEED_RTNL, 13151 }, 13152 { 13153 .cmd = NL80211_CMD_DEL_INTERFACE, 13154 .doit = nl80211_del_interface, 13155 .policy = nl80211_policy, 13156 .flags = GENL_UNS_ADMIN_PERM, 13157 .internal_flags = NL80211_FLAG_NEED_WDEV | 13158 NL80211_FLAG_NEED_RTNL, 13159 }, 13160 { 13161 .cmd = NL80211_CMD_GET_KEY, 13162 .doit = nl80211_get_key, 13163 .policy = nl80211_policy, 13164 .flags = GENL_UNS_ADMIN_PERM, 13165 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13166 NL80211_FLAG_NEED_RTNL, 13167 }, 13168 { 13169 .cmd = NL80211_CMD_SET_KEY, 13170 .doit = nl80211_set_key, 13171 .policy = nl80211_policy, 13172 .flags = GENL_UNS_ADMIN_PERM, 13173 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13174 NL80211_FLAG_NEED_RTNL | 13175 NL80211_FLAG_CLEAR_SKB, 13176 }, 13177 { 13178 .cmd = NL80211_CMD_NEW_KEY, 13179 .doit = nl80211_new_key, 13180 .policy = nl80211_policy, 13181 .flags = GENL_UNS_ADMIN_PERM, 13182 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13183 NL80211_FLAG_NEED_RTNL | 13184 NL80211_FLAG_CLEAR_SKB, 13185 }, 13186 { 13187 .cmd = NL80211_CMD_DEL_KEY, 13188 .doit = nl80211_del_key, 13189 .policy = nl80211_policy, 13190 .flags = GENL_UNS_ADMIN_PERM, 13191 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13192 NL80211_FLAG_NEED_RTNL, 13193 }, 13194 { 13195 .cmd = NL80211_CMD_SET_BEACON, 13196 .policy = nl80211_policy, 13197 .flags = GENL_UNS_ADMIN_PERM, 13198 .doit = nl80211_set_beacon, 13199 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13200 NL80211_FLAG_NEED_RTNL, 13201 }, 13202 { 13203 .cmd = NL80211_CMD_START_AP, 13204 .policy = nl80211_policy, 13205 .flags = GENL_UNS_ADMIN_PERM, 13206 .doit = nl80211_start_ap, 13207 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13208 NL80211_FLAG_NEED_RTNL, 13209 }, 13210 { 13211 .cmd = NL80211_CMD_STOP_AP, 13212 .policy = nl80211_policy, 13213 .flags = GENL_UNS_ADMIN_PERM, 13214 .doit = nl80211_stop_ap, 13215 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13216 NL80211_FLAG_NEED_RTNL, 13217 }, 13218 { 13219 .cmd = NL80211_CMD_GET_STATION, 13220 .doit = nl80211_get_station, 13221 .dumpit = nl80211_dump_station, 13222 .policy = nl80211_policy, 13223 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13224 NL80211_FLAG_NEED_RTNL, 13225 }, 13226 { 13227 .cmd = NL80211_CMD_SET_STATION, 13228 .doit = nl80211_set_station, 13229 .policy = nl80211_policy, 13230 .flags = GENL_UNS_ADMIN_PERM, 13231 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13232 NL80211_FLAG_NEED_RTNL, 13233 }, 13234 { 13235 .cmd = NL80211_CMD_NEW_STATION, 13236 .doit = nl80211_new_station, 13237 .policy = nl80211_policy, 13238 .flags = GENL_UNS_ADMIN_PERM, 13239 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13240 NL80211_FLAG_NEED_RTNL, 13241 }, 13242 { 13243 .cmd = NL80211_CMD_DEL_STATION, 13244 .doit = nl80211_del_station, 13245 .policy = nl80211_policy, 13246 .flags = GENL_UNS_ADMIN_PERM, 13247 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13248 NL80211_FLAG_NEED_RTNL, 13249 }, 13250 { 13251 .cmd = NL80211_CMD_GET_MPATH, 13252 .doit = nl80211_get_mpath, 13253 .dumpit = nl80211_dump_mpath, 13254 .policy = nl80211_policy, 13255 .flags = GENL_UNS_ADMIN_PERM, 13256 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13257 NL80211_FLAG_NEED_RTNL, 13258 }, 13259 { 13260 .cmd = NL80211_CMD_GET_MPP, 13261 .doit = nl80211_get_mpp, 13262 .dumpit = nl80211_dump_mpp, 13263 .policy = nl80211_policy, 13264 .flags = GENL_UNS_ADMIN_PERM, 13265 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13266 NL80211_FLAG_NEED_RTNL, 13267 }, 13268 { 13269 .cmd = NL80211_CMD_SET_MPATH, 13270 .doit = nl80211_set_mpath, 13271 .policy = nl80211_policy, 13272 .flags = GENL_UNS_ADMIN_PERM, 13273 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13274 NL80211_FLAG_NEED_RTNL, 13275 }, 13276 { 13277 .cmd = NL80211_CMD_NEW_MPATH, 13278 .doit = nl80211_new_mpath, 13279 .policy = nl80211_policy, 13280 .flags = GENL_UNS_ADMIN_PERM, 13281 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13282 NL80211_FLAG_NEED_RTNL, 13283 }, 13284 { 13285 .cmd = NL80211_CMD_DEL_MPATH, 13286 .doit = nl80211_del_mpath, 13287 .policy = nl80211_policy, 13288 .flags = GENL_UNS_ADMIN_PERM, 13289 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13290 NL80211_FLAG_NEED_RTNL, 13291 }, 13292 { 13293 .cmd = NL80211_CMD_SET_BSS, 13294 .doit = nl80211_set_bss, 13295 .policy = nl80211_policy, 13296 .flags = GENL_UNS_ADMIN_PERM, 13297 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13298 NL80211_FLAG_NEED_RTNL, 13299 }, 13300 { 13301 .cmd = NL80211_CMD_GET_REG, 13302 .doit = nl80211_get_reg_do, 13303 .dumpit = nl80211_get_reg_dump, 13304 .policy = nl80211_policy, 13305 .internal_flags = NL80211_FLAG_NEED_RTNL, 13306 /* can be retrieved by unprivileged users */ 13307 }, 13308 #ifdef CONFIG_CFG80211_CRDA_SUPPORT 13309 { 13310 .cmd = NL80211_CMD_SET_REG, 13311 .doit = nl80211_set_reg, 13312 .policy = nl80211_policy, 13313 .flags = GENL_ADMIN_PERM, 13314 .internal_flags = NL80211_FLAG_NEED_RTNL, 13315 }, 13316 #endif 13317 { 13318 .cmd = NL80211_CMD_REQ_SET_REG, 13319 .doit = nl80211_req_set_reg, 13320 .policy = nl80211_policy, 13321 .flags = GENL_ADMIN_PERM, 13322 }, 13323 { 13324 .cmd = NL80211_CMD_RELOAD_REGDB, 13325 .doit = nl80211_reload_regdb, 13326 .policy = nl80211_policy, 13327 .flags = GENL_ADMIN_PERM, 13328 }, 13329 { 13330 .cmd = NL80211_CMD_GET_MESH_CONFIG, 13331 .doit = nl80211_get_mesh_config, 13332 .policy = nl80211_policy, 13333 /* can be retrieved by unprivileged users */ 13334 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13335 NL80211_FLAG_NEED_RTNL, 13336 }, 13337 { 13338 .cmd = NL80211_CMD_SET_MESH_CONFIG, 13339 .doit = nl80211_update_mesh_config, 13340 .policy = nl80211_policy, 13341 .flags = GENL_UNS_ADMIN_PERM, 13342 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13343 NL80211_FLAG_NEED_RTNL, 13344 }, 13345 { 13346 .cmd = NL80211_CMD_TRIGGER_SCAN, 13347 .doit = nl80211_trigger_scan, 13348 .policy = nl80211_policy, 13349 .flags = GENL_UNS_ADMIN_PERM, 13350 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13351 NL80211_FLAG_NEED_RTNL, 13352 }, 13353 { 13354 .cmd = NL80211_CMD_ABORT_SCAN, 13355 .doit = nl80211_abort_scan, 13356 .policy = nl80211_policy, 13357 .flags = GENL_UNS_ADMIN_PERM, 13358 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13359 NL80211_FLAG_NEED_RTNL, 13360 }, 13361 { 13362 .cmd = NL80211_CMD_GET_SCAN, 13363 .policy = nl80211_policy, 13364 .dumpit = nl80211_dump_scan, 13365 }, 13366 { 13367 .cmd = NL80211_CMD_START_SCHED_SCAN, 13368 .doit = nl80211_start_sched_scan, 13369 .policy = nl80211_policy, 13370 .flags = GENL_UNS_ADMIN_PERM, 13371 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13372 NL80211_FLAG_NEED_RTNL, 13373 }, 13374 { 13375 .cmd = NL80211_CMD_STOP_SCHED_SCAN, 13376 .doit = nl80211_stop_sched_scan, 13377 .policy = nl80211_policy, 13378 .flags = GENL_UNS_ADMIN_PERM, 13379 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13380 NL80211_FLAG_NEED_RTNL, 13381 }, 13382 { 13383 .cmd = NL80211_CMD_AUTHENTICATE, 13384 .doit = nl80211_authenticate, 13385 .policy = nl80211_policy, 13386 .flags = GENL_UNS_ADMIN_PERM, 13387 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13388 NL80211_FLAG_NEED_RTNL | 13389 NL80211_FLAG_CLEAR_SKB, 13390 }, 13391 { 13392 .cmd = NL80211_CMD_ASSOCIATE, 13393 .doit = nl80211_associate, 13394 .policy = nl80211_policy, 13395 .flags = GENL_UNS_ADMIN_PERM, 13396 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13397 NL80211_FLAG_NEED_RTNL, 13398 }, 13399 { 13400 .cmd = NL80211_CMD_DEAUTHENTICATE, 13401 .doit = nl80211_deauthenticate, 13402 .policy = nl80211_policy, 13403 .flags = GENL_UNS_ADMIN_PERM, 13404 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13405 NL80211_FLAG_NEED_RTNL, 13406 }, 13407 { 13408 .cmd = NL80211_CMD_DISASSOCIATE, 13409 .doit = nl80211_disassociate, 13410 .policy = nl80211_policy, 13411 .flags = GENL_UNS_ADMIN_PERM, 13412 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13413 NL80211_FLAG_NEED_RTNL, 13414 }, 13415 { 13416 .cmd = NL80211_CMD_JOIN_IBSS, 13417 .doit = nl80211_join_ibss, 13418 .policy = nl80211_policy, 13419 .flags = GENL_UNS_ADMIN_PERM, 13420 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13421 NL80211_FLAG_NEED_RTNL, 13422 }, 13423 { 13424 .cmd = NL80211_CMD_LEAVE_IBSS, 13425 .doit = nl80211_leave_ibss, 13426 .policy = nl80211_policy, 13427 .flags = GENL_UNS_ADMIN_PERM, 13428 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13429 NL80211_FLAG_NEED_RTNL, 13430 }, 13431 #ifdef CONFIG_NL80211_TESTMODE 13432 { 13433 .cmd = NL80211_CMD_TESTMODE, 13434 .doit = nl80211_testmode_do, 13435 .dumpit = nl80211_testmode_dump, 13436 .policy = nl80211_policy, 13437 .flags = GENL_UNS_ADMIN_PERM, 13438 .internal_flags = NL80211_FLAG_NEED_WIPHY | 13439 NL80211_FLAG_NEED_RTNL, 13440 }, 13441 #endif 13442 { 13443 .cmd = NL80211_CMD_CONNECT, 13444 .doit = nl80211_connect, 13445 .policy = nl80211_policy, 13446 .flags = GENL_UNS_ADMIN_PERM, 13447 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13448 NL80211_FLAG_NEED_RTNL, 13449 }, 13450 { 13451 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS, 13452 .doit = nl80211_update_connect_params, 13453 .policy = nl80211_policy, 13454 .flags = GENL_ADMIN_PERM, 13455 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13456 NL80211_FLAG_NEED_RTNL, 13457 }, 13458 { 13459 .cmd = NL80211_CMD_DISCONNECT, 13460 .doit = nl80211_disconnect, 13461 .policy = nl80211_policy, 13462 .flags = GENL_UNS_ADMIN_PERM, 13463 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13464 NL80211_FLAG_NEED_RTNL, 13465 }, 13466 { 13467 .cmd = NL80211_CMD_SET_WIPHY_NETNS, 13468 .doit = nl80211_wiphy_netns, 13469 .policy = nl80211_policy, 13470 .flags = GENL_UNS_ADMIN_PERM, 13471 .internal_flags = NL80211_FLAG_NEED_WIPHY | 13472 NL80211_FLAG_NEED_RTNL, 13473 }, 13474 { 13475 .cmd = NL80211_CMD_GET_SURVEY, 13476 .policy = nl80211_policy, 13477 .dumpit = nl80211_dump_survey, 13478 }, 13479 { 13480 .cmd = NL80211_CMD_SET_PMKSA, 13481 .doit = nl80211_setdel_pmksa, 13482 .policy = nl80211_policy, 13483 .flags = GENL_UNS_ADMIN_PERM, 13484 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13485 NL80211_FLAG_NEED_RTNL, 13486 }, 13487 { 13488 .cmd = NL80211_CMD_DEL_PMKSA, 13489 .doit = nl80211_setdel_pmksa, 13490 .policy = nl80211_policy, 13491 .flags = GENL_UNS_ADMIN_PERM, 13492 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13493 NL80211_FLAG_NEED_RTNL, 13494 }, 13495 { 13496 .cmd = NL80211_CMD_FLUSH_PMKSA, 13497 .doit = nl80211_flush_pmksa, 13498 .policy = nl80211_policy, 13499 .flags = GENL_UNS_ADMIN_PERM, 13500 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13501 NL80211_FLAG_NEED_RTNL, 13502 }, 13503 { 13504 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL, 13505 .doit = nl80211_remain_on_channel, 13506 .policy = nl80211_policy, 13507 .flags = GENL_UNS_ADMIN_PERM, 13508 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13509 NL80211_FLAG_NEED_RTNL, 13510 }, 13511 { 13512 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL, 13513 .doit = nl80211_cancel_remain_on_channel, 13514 .policy = nl80211_policy, 13515 .flags = GENL_UNS_ADMIN_PERM, 13516 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13517 NL80211_FLAG_NEED_RTNL, 13518 }, 13519 { 13520 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK, 13521 .doit = nl80211_set_tx_bitrate_mask, 13522 .policy = nl80211_policy, 13523 .flags = GENL_UNS_ADMIN_PERM, 13524 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13525 NL80211_FLAG_NEED_RTNL, 13526 }, 13527 { 13528 .cmd = NL80211_CMD_REGISTER_FRAME, 13529 .doit = nl80211_register_mgmt, 13530 .policy = nl80211_policy, 13531 .flags = GENL_UNS_ADMIN_PERM, 13532 .internal_flags = NL80211_FLAG_NEED_WDEV | 13533 NL80211_FLAG_NEED_RTNL, 13534 }, 13535 { 13536 .cmd = NL80211_CMD_FRAME, 13537 .doit = nl80211_tx_mgmt, 13538 .policy = nl80211_policy, 13539 .flags = GENL_UNS_ADMIN_PERM, 13540 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13541 NL80211_FLAG_NEED_RTNL, 13542 }, 13543 { 13544 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL, 13545 .doit = nl80211_tx_mgmt_cancel_wait, 13546 .policy = nl80211_policy, 13547 .flags = GENL_UNS_ADMIN_PERM, 13548 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13549 NL80211_FLAG_NEED_RTNL, 13550 }, 13551 { 13552 .cmd = NL80211_CMD_SET_POWER_SAVE, 13553 .doit = nl80211_set_power_save, 13554 .policy = nl80211_policy, 13555 .flags = GENL_UNS_ADMIN_PERM, 13556 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13557 NL80211_FLAG_NEED_RTNL, 13558 }, 13559 { 13560 .cmd = NL80211_CMD_GET_POWER_SAVE, 13561 .doit = nl80211_get_power_save, 13562 .policy = nl80211_policy, 13563 /* can be retrieved by unprivileged users */ 13564 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13565 NL80211_FLAG_NEED_RTNL, 13566 }, 13567 { 13568 .cmd = NL80211_CMD_SET_CQM, 13569 .doit = nl80211_set_cqm, 13570 .policy = nl80211_policy, 13571 .flags = GENL_UNS_ADMIN_PERM, 13572 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13573 NL80211_FLAG_NEED_RTNL, 13574 }, 13575 { 13576 .cmd = NL80211_CMD_SET_CHANNEL, 13577 .doit = nl80211_set_channel, 13578 .policy = nl80211_policy, 13579 .flags = GENL_UNS_ADMIN_PERM, 13580 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13581 NL80211_FLAG_NEED_RTNL, 13582 }, 13583 { 13584 .cmd = NL80211_CMD_SET_WDS_PEER, 13585 .doit = nl80211_set_wds_peer, 13586 .policy = nl80211_policy, 13587 .flags = GENL_UNS_ADMIN_PERM, 13588 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13589 NL80211_FLAG_NEED_RTNL, 13590 }, 13591 { 13592 .cmd = NL80211_CMD_JOIN_MESH, 13593 .doit = nl80211_join_mesh, 13594 .policy = nl80211_policy, 13595 .flags = GENL_UNS_ADMIN_PERM, 13596 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13597 NL80211_FLAG_NEED_RTNL, 13598 }, 13599 { 13600 .cmd = NL80211_CMD_LEAVE_MESH, 13601 .doit = nl80211_leave_mesh, 13602 .policy = nl80211_policy, 13603 .flags = GENL_UNS_ADMIN_PERM, 13604 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13605 NL80211_FLAG_NEED_RTNL, 13606 }, 13607 { 13608 .cmd = NL80211_CMD_JOIN_OCB, 13609 .doit = nl80211_join_ocb, 13610 .policy = nl80211_policy, 13611 .flags = GENL_UNS_ADMIN_PERM, 13612 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13613 NL80211_FLAG_NEED_RTNL, 13614 }, 13615 { 13616 .cmd = NL80211_CMD_LEAVE_OCB, 13617 .doit = nl80211_leave_ocb, 13618 .policy = nl80211_policy, 13619 .flags = GENL_UNS_ADMIN_PERM, 13620 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13621 NL80211_FLAG_NEED_RTNL, 13622 }, 13623 #ifdef CONFIG_PM 13624 { 13625 .cmd = NL80211_CMD_GET_WOWLAN, 13626 .doit = nl80211_get_wowlan, 13627 .policy = nl80211_policy, 13628 /* can be retrieved by unprivileged users */ 13629 .internal_flags = NL80211_FLAG_NEED_WIPHY | 13630 NL80211_FLAG_NEED_RTNL, 13631 }, 13632 { 13633 .cmd = NL80211_CMD_SET_WOWLAN, 13634 .doit = nl80211_set_wowlan, 13635 .policy = nl80211_policy, 13636 .flags = GENL_UNS_ADMIN_PERM, 13637 .internal_flags = NL80211_FLAG_NEED_WIPHY | 13638 NL80211_FLAG_NEED_RTNL, 13639 }, 13640 #endif 13641 { 13642 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD, 13643 .doit = nl80211_set_rekey_data, 13644 .policy = nl80211_policy, 13645 .flags = GENL_UNS_ADMIN_PERM, 13646 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13647 NL80211_FLAG_NEED_RTNL | 13648 NL80211_FLAG_CLEAR_SKB, 13649 }, 13650 { 13651 .cmd = NL80211_CMD_TDLS_MGMT, 13652 .doit = nl80211_tdls_mgmt, 13653 .policy = nl80211_policy, 13654 .flags = GENL_UNS_ADMIN_PERM, 13655 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13656 NL80211_FLAG_NEED_RTNL, 13657 }, 13658 { 13659 .cmd = NL80211_CMD_TDLS_OPER, 13660 .doit = nl80211_tdls_oper, 13661 .policy = nl80211_policy, 13662 .flags = GENL_UNS_ADMIN_PERM, 13663 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13664 NL80211_FLAG_NEED_RTNL, 13665 }, 13666 { 13667 .cmd = NL80211_CMD_UNEXPECTED_FRAME, 13668 .doit = nl80211_register_unexpected_frame, 13669 .policy = nl80211_policy, 13670 .flags = GENL_UNS_ADMIN_PERM, 13671 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13672 NL80211_FLAG_NEED_RTNL, 13673 }, 13674 { 13675 .cmd = NL80211_CMD_PROBE_CLIENT, 13676 .doit = nl80211_probe_client, 13677 .policy = nl80211_policy, 13678 .flags = GENL_UNS_ADMIN_PERM, 13679 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13680 NL80211_FLAG_NEED_RTNL, 13681 }, 13682 { 13683 .cmd = NL80211_CMD_REGISTER_BEACONS, 13684 .doit = nl80211_register_beacons, 13685 .policy = nl80211_policy, 13686 .flags = GENL_UNS_ADMIN_PERM, 13687 .internal_flags = NL80211_FLAG_NEED_WIPHY | 13688 NL80211_FLAG_NEED_RTNL, 13689 }, 13690 { 13691 .cmd = NL80211_CMD_SET_NOACK_MAP, 13692 .doit = nl80211_set_noack_map, 13693 .policy = nl80211_policy, 13694 .flags = GENL_UNS_ADMIN_PERM, 13695 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13696 NL80211_FLAG_NEED_RTNL, 13697 }, 13698 { 13699 .cmd = NL80211_CMD_START_P2P_DEVICE, 13700 .doit = nl80211_start_p2p_device, 13701 .policy = nl80211_policy, 13702 .flags = GENL_UNS_ADMIN_PERM, 13703 .internal_flags = NL80211_FLAG_NEED_WDEV | 13704 NL80211_FLAG_NEED_RTNL, 13705 }, 13706 { 13707 .cmd = NL80211_CMD_STOP_P2P_DEVICE, 13708 .doit = nl80211_stop_p2p_device, 13709 .policy = nl80211_policy, 13710 .flags = GENL_UNS_ADMIN_PERM, 13711 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13712 NL80211_FLAG_NEED_RTNL, 13713 }, 13714 { 13715 .cmd = NL80211_CMD_START_NAN, 13716 .doit = nl80211_start_nan, 13717 .policy = nl80211_policy, 13718 .flags = GENL_ADMIN_PERM, 13719 .internal_flags = NL80211_FLAG_NEED_WDEV | 13720 NL80211_FLAG_NEED_RTNL, 13721 }, 13722 { 13723 .cmd = NL80211_CMD_STOP_NAN, 13724 .doit = nl80211_stop_nan, 13725 .policy = nl80211_policy, 13726 .flags = GENL_ADMIN_PERM, 13727 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13728 NL80211_FLAG_NEED_RTNL, 13729 }, 13730 { 13731 .cmd = NL80211_CMD_ADD_NAN_FUNCTION, 13732 .doit = nl80211_nan_add_func, 13733 .policy = nl80211_policy, 13734 .flags = GENL_ADMIN_PERM, 13735 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13736 NL80211_FLAG_NEED_RTNL, 13737 }, 13738 { 13739 .cmd = NL80211_CMD_DEL_NAN_FUNCTION, 13740 .doit = nl80211_nan_del_func, 13741 .policy = nl80211_policy, 13742 .flags = GENL_ADMIN_PERM, 13743 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13744 NL80211_FLAG_NEED_RTNL, 13745 }, 13746 { 13747 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG, 13748 .doit = nl80211_nan_change_config, 13749 .policy = nl80211_policy, 13750 .flags = GENL_ADMIN_PERM, 13751 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13752 NL80211_FLAG_NEED_RTNL, 13753 }, 13754 { 13755 .cmd = NL80211_CMD_SET_MCAST_RATE, 13756 .doit = nl80211_set_mcast_rate, 13757 .policy = nl80211_policy, 13758 .flags = GENL_UNS_ADMIN_PERM, 13759 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13760 NL80211_FLAG_NEED_RTNL, 13761 }, 13762 { 13763 .cmd = NL80211_CMD_SET_MAC_ACL, 13764 .doit = nl80211_set_mac_acl, 13765 .policy = nl80211_policy, 13766 .flags = GENL_UNS_ADMIN_PERM, 13767 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13768 NL80211_FLAG_NEED_RTNL, 13769 }, 13770 { 13771 .cmd = NL80211_CMD_RADAR_DETECT, 13772 .doit = nl80211_start_radar_detection, 13773 .policy = nl80211_policy, 13774 .flags = GENL_UNS_ADMIN_PERM, 13775 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13776 NL80211_FLAG_NEED_RTNL, 13777 }, 13778 { 13779 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES, 13780 .doit = nl80211_get_protocol_features, 13781 .policy = nl80211_policy, 13782 }, 13783 { 13784 .cmd = NL80211_CMD_UPDATE_FT_IES, 13785 .doit = nl80211_update_ft_ies, 13786 .policy = nl80211_policy, 13787 .flags = GENL_UNS_ADMIN_PERM, 13788 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13789 NL80211_FLAG_NEED_RTNL, 13790 }, 13791 { 13792 .cmd = NL80211_CMD_CRIT_PROTOCOL_START, 13793 .doit = nl80211_crit_protocol_start, 13794 .policy = nl80211_policy, 13795 .flags = GENL_UNS_ADMIN_PERM, 13796 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13797 NL80211_FLAG_NEED_RTNL, 13798 }, 13799 { 13800 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP, 13801 .doit = nl80211_crit_protocol_stop, 13802 .policy = nl80211_policy, 13803 .flags = GENL_UNS_ADMIN_PERM, 13804 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13805 NL80211_FLAG_NEED_RTNL, 13806 }, 13807 { 13808 .cmd = NL80211_CMD_GET_COALESCE, 13809 .doit = nl80211_get_coalesce, 13810 .policy = nl80211_policy, 13811 .internal_flags = NL80211_FLAG_NEED_WIPHY | 13812 NL80211_FLAG_NEED_RTNL, 13813 }, 13814 { 13815 .cmd = NL80211_CMD_SET_COALESCE, 13816 .doit = nl80211_set_coalesce, 13817 .policy = nl80211_policy, 13818 .flags = GENL_UNS_ADMIN_PERM, 13819 .internal_flags = NL80211_FLAG_NEED_WIPHY | 13820 NL80211_FLAG_NEED_RTNL, 13821 }, 13822 { 13823 .cmd = NL80211_CMD_CHANNEL_SWITCH, 13824 .doit = nl80211_channel_switch, 13825 .policy = nl80211_policy, 13826 .flags = GENL_UNS_ADMIN_PERM, 13827 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13828 NL80211_FLAG_NEED_RTNL, 13829 }, 13830 { 13831 .cmd = NL80211_CMD_VENDOR, 13832 .doit = nl80211_vendor_cmd, 13833 .dumpit = nl80211_vendor_cmd_dump, 13834 .policy = nl80211_policy, 13835 .flags = GENL_UNS_ADMIN_PERM, 13836 .internal_flags = NL80211_FLAG_NEED_WIPHY | 13837 NL80211_FLAG_NEED_RTNL, 13838 }, 13839 { 13840 .cmd = NL80211_CMD_SET_QOS_MAP, 13841 .doit = nl80211_set_qos_map, 13842 .policy = nl80211_policy, 13843 .flags = GENL_UNS_ADMIN_PERM, 13844 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13845 NL80211_FLAG_NEED_RTNL, 13846 }, 13847 { 13848 .cmd = NL80211_CMD_ADD_TX_TS, 13849 .doit = nl80211_add_tx_ts, 13850 .policy = nl80211_policy, 13851 .flags = GENL_UNS_ADMIN_PERM, 13852 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13853 NL80211_FLAG_NEED_RTNL, 13854 }, 13855 { 13856 .cmd = NL80211_CMD_DEL_TX_TS, 13857 .doit = nl80211_del_tx_ts, 13858 .policy = nl80211_policy, 13859 .flags = GENL_UNS_ADMIN_PERM, 13860 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13861 NL80211_FLAG_NEED_RTNL, 13862 }, 13863 { 13864 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH, 13865 .doit = nl80211_tdls_channel_switch, 13866 .policy = nl80211_policy, 13867 .flags = GENL_UNS_ADMIN_PERM, 13868 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13869 NL80211_FLAG_NEED_RTNL, 13870 }, 13871 { 13872 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH, 13873 .doit = nl80211_tdls_cancel_channel_switch, 13874 .policy = nl80211_policy, 13875 .flags = GENL_UNS_ADMIN_PERM, 13876 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13877 NL80211_FLAG_NEED_RTNL, 13878 }, 13879 { 13880 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST, 13881 .doit = nl80211_set_multicast_to_unicast, 13882 .policy = nl80211_policy, 13883 .flags = GENL_UNS_ADMIN_PERM, 13884 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13885 NL80211_FLAG_NEED_RTNL, 13886 }, 13887 { 13888 .cmd = NL80211_CMD_SET_PMK, 13889 .doit = nl80211_set_pmk, 13890 .policy = nl80211_policy, 13891 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13892 NL80211_FLAG_NEED_RTNL, 13893 }, 13894 { 13895 .cmd = NL80211_CMD_DEL_PMK, 13896 .doit = nl80211_del_pmk, 13897 .policy = nl80211_policy, 13898 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13899 NL80211_FLAG_NEED_RTNL, 13900 }, 13901 { 13902 .cmd = NL80211_CMD_EXTERNAL_AUTH, 13903 .doit = nl80211_external_auth, 13904 .policy = nl80211_policy, 13905 .flags = GENL_ADMIN_PERM, 13906 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13907 NL80211_FLAG_NEED_RTNL, 13908 }, 13909 { 13910 .cmd = NL80211_CMD_CONTROL_PORT_FRAME, 13911 .doit = nl80211_tx_control_port, 13912 .policy = nl80211_policy, 13913 .flags = GENL_UNS_ADMIN_PERM, 13914 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13915 NL80211_FLAG_NEED_RTNL, 13916 }, 13917 }; 13918 13919 static struct genl_family nl80211_fam __ro_after_init = { 13920 .name = NL80211_GENL_NAME, /* have users key off the name instead */ 13921 .hdrsize = 0, /* no private header */ 13922 .version = 1, /* no particular meaning now */ 13923 .maxattr = NL80211_ATTR_MAX, 13924 .netnsok = true, 13925 .pre_doit = nl80211_pre_doit, 13926 .post_doit = nl80211_post_doit, 13927 .module = THIS_MODULE, 13928 .ops = nl80211_ops, 13929 .n_ops = ARRAY_SIZE(nl80211_ops), 13930 .mcgrps = nl80211_mcgrps, 13931 .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps), 13932 }; 13933 13934 /* notification functions */ 13935 13936 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev, 13937 enum nl80211_commands cmd) 13938 { 13939 struct sk_buff *msg; 13940 struct nl80211_dump_wiphy_state state = {}; 13941 13942 WARN_ON(cmd != NL80211_CMD_NEW_WIPHY && 13943 cmd != NL80211_CMD_DEL_WIPHY); 13944 13945 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 13946 if (!msg) 13947 return; 13948 13949 if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) { 13950 nlmsg_free(msg); 13951 return; 13952 } 13953 13954 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13955 NL80211_MCGRP_CONFIG, GFP_KERNEL); 13956 } 13957 13958 void nl80211_notify_iface(struct cfg80211_registered_device *rdev, 13959 struct wireless_dev *wdev, 13960 enum nl80211_commands cmd) 13961 { 13962 struct sk_buff *msg; 13963 13964 WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE && 13965 cmd != NL80211_CMD_DEL_INTERFACE); 13966 13967 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 13968 if (!msg) 13969 return; 13970 13971 if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, 13972 cmd == NL80211_CMD_DEL_INTERFACE) < 0) { 13973 nlmsg_free(msg); 13974 return; 13975 } 13976 13977 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13978 NL80211_MCGRP_CONFIG, GFP_KERNEL); 13979 } 13980 13981 static int nl80211_add_scan_req(struct sk_buff *msg, 13982 struct cfg80211_registered_device *rdev) 13983 { 13984 struct cfg80211_scan_request *req = rdev->scan_req; 13985 struct nlattr *nest; 13986 int i; 13987 13988 if (WARN_ON(!req)) 13989 return 0; 13990 13991 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS); 13992 if (!nest) 13993 goto nla_put_failure; 13994 for (i = 0; i < req->n_ssids; i++) { 13995 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid)) 13996 goto nla_put_failure; 13997 } 13998 nla_nest_end(msg, nest); 13999 14000 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES); 14001 if (!nest) 14002 goto nla_put_failure; 14003 for (i = 0; i < req->n_channels; i++) { 14004 if (nla_put_u32(msg, i, req->channels[i]->center_freq)) 14005 goto nla_put_failure; 14006 } 14007 nla_nest_end(msg, nest); 14008 14009 if (req->ie && 14010 nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie)) 14011 goto nla_put_failure; 14012 14013 if (req->flags && 14014 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags)) 14015 goto nla_put_failure; 14016 14017 if (req->info.scan_start_tsf && 14018 (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF, 14019 req->info.scan_start_tsf, NL80211_BSS_PAD) || 14020 nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN, 14021 req->info.tsf_bssid))) 14022 goto nla_put_failure; 14023 14024 return 0; 14025 nla_put_failure: 14026 return -ENOBUFS; 14027 } 14028 14029 static int nl80211_prep_scan_msg(struct sk_buff *msg, 14030 struct cfg80211_registered_device *rdev, 14031 struct wireless_dev *wdev, 14032 u32 portid, u32 seq, int flags, 14033 u32 cmd) 14034 { 14035 void *hdr; 14036 14037 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 14038 if (!hdr) 14039 return -1; 14040 14041 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14042 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 14043 wdev->netdev->ifindex)) || 14044 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 14045 NL80211_ATTR_PAD)) 14046 goto nla_put_failure; 14047 14048 /* ignore errors and send incomplete event anyway */ 14049 nl80211_add_scan_req(msg, rdev); 14050 14051 genlmsg_end(msg, hdr); 14052 return 0; 14053 14054 nla_put_failure: 14055 genlmsg_cancel(msg, hdr); 14056 return -EMSGSIZE; 14057 } 14058 14059 static int 14060 nl80211_prep_sched_scan_msg(struct sk_buff *msg, 14061 struct cfg80211_sched_scan_request *req, u32 cmd) 14062 { 14063 void *hdr; 14064 14065 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 14066 if (!hdr) 14067 return -1; 14068 14069 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, 14070 wiphy_to_rdev(req->wiphy)->wiphy_idx) || 14071 nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) || 14072 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid, 14073 NL80211_ATTR_PAD)) 14074 goto nla_put_failure; 14075 14076 genlmsg_end(msg, hdr); 14077 return 0; 14078 14079 nla_put_failure: 14080 genlmsg_cancel(msg, hdr); 14081 return -EMSGSIZE; 14082 } 14083 14084 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev, 14085 struct wireless_dev *wdev) 14086 { 14087 struct sk_buff *msg; 14088 14089 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 14090 if (!msg) 14091 return; 14092 14093 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0, 14094 NL80211_CMD_TRIGGER_SCAN) < 0) { 14095 nlmsg_free(msg); 14096 return; 14097 } 14098 14099 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14100 NL80211_MCGRP_SCAN, GFP_KERNEL); 14101 } 14102 14103 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev, 14104 struct wireless_dev *wdev, bool aborted) 14105 { 14106 struct sk_buff *msg; 14107 14108 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 14109 if (!msg) 14110 return NULL; 14111 14112 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0, 14113 aborted ? NL80211_CMD_SCAN_ABORTED : 14114 NL80211_CMD_NEW_SCAN_RESULTS) < 0) { 14115 nlmsg_free(msg); 14116 return NULL; 14117 } 14118 14119 return msg; 14120 } 14121 14122 /* send message created by nl80211_build_scan_msg() */ 14123 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev, 14124 struct sk_buff *msg) 14125 { 14126 if (!msg) 14127 return; 14128 14129 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14130 NL80211_MCGRP_SCAN, GFP_KERNEL); 14131 } 14132 14133 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd) 14134 { 14135 struct sk_buff *msg; 14136 14137 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 14138 if (!msg) 14139 return; 14140 14141 if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) { 14142 nlmsg_free(msg); 14143 return; 14144 } 14145 14146 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0, 14147 NL80211_MCGRP_SCAN, GFP_KERNEL); 14148 } 14149 14150 static bool nl80211_reg_change_event_fill(struct sk_buff *msg, 14151 struct regulatory_request *request) 14152 { 14153 /* Userspace can always count this one always being set */ 14154 if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator)) 14155 goto nla_put_failure; 14156 14157 if (request->alpha2[0] == '0' && request->alpha2[1] == '0') { 14158 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 14159 NL80211_REGDOM_TYPE_WORLD)) 14160 goto nla_put_failure; 14161 } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') { 14162 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 14163 NL80211_REGDOM_TYPE_CUSTOM_WORLD)) 14164 goto nla_put_failure; 14165 } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') || 14166 request->intersect) { 14167 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 14168 NL80211_REGDOM_TYPE_INTERSECTION)) 14169 goto nla_put_failure; 14170 } else { 14171 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 14172 NL80211_REGDOM_TYPE_COUNTRY) || 14173 nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, 14174 request->alpha2)) 14175 goto nla_put_failure; 14176 } 14177 14178 if (request->wiphy_idx != WIPHY_IDX_INVALID) { 14179 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx); 14180 14181 if (wiphy && 14182 nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx)) 14183 goto nla_put_failure; 14184 14185 if (wiphy && 14186 wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED && 14187 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG)) 14188 goto nla_put_failure; 14189 } 14190 14191 return true; 14192 14193 nla_put_failure: 14194 return false; 14195 } 14196 14197 /* 14198 * This can happen on global regulatory changes or device specific settings 14199 * based on custom regulatory domains. 14200 */ 14201 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id, 14202 struct regulatory_request *request) 14203 { 14204 struct sk_buff *msg; 14205 void *hdr; 14206 14207 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 14208 if (!msg) 14209 return; 14210 14211 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id); 14212 if (!hdr) { 14213 nlmsg_free(msg); 14214 return; 14215 } 14216 14217 if (nl80211_reg_change_event_fill(msg, request) == false) 14218 goto nla_put_failure; 14219 14220 genlmsg_end(msg, hdr); 14221 14222 rcu_read_lock(); 14223 genlmsg_multicast_allns(&nl80211_fam, msg, 0, 14224 NL80211_MCGRP_REGULATORY, GFP_ATOMIC); 14225 rcu_read_unlock(); 14226 14227 return; 14228 14229 nla_put_failure: 14230 nlmsg_free(msg); 14231 } 14232 14233 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev, 14234 struct net_device *netdev, 14235 const u8 *buf, size_t len, 14236 enum nl80211_commands cmd, gfp_t gfp, 14237 int uapsd_queues) 14238 { 14239 struct sk_buff *msg; 14240 void *hdr; 14241 14242 msg = nlmsg_new(100 + len, gfp); 14243 if (!msg) 14244 return; 14245 14246 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 14247 if (!hdr) { 14248 nlmsg_free(msg); 14249 return; 14250 } 14251 14252 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14253 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 14254 nla_put(msg, NL80211_ATTR_FRAME, len, buf)) 14255 goto nla_put_failure; 14256 14257 if (uapsd_queues >= 0) { 14258 struct nlattr *nla_wmm = 14259 nla_nest_start(msg, NL80211_ATTR_STA_WME); 14260 if (!nla_wmm) 14261 goto nla_put_failure; 14262 14263 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES, 14264 uapsd_queues)) 14265 goto nla_put_failure; 14266 14267 nla_nest_end(msg, nla_wmm); 14268 } 14269 14270 genlmsg_end(msg, hdr); 14271 14272 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14273 NL80211_MCGRP_MLME, gfp); 14274 return; 14275 14276 nla_put_failure: 14277 nlmsg_free(msg); 14278 } 14279 14280 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev, 14281 struct net_device *netdev, const u8 *buf, 14282 size_t len, gfp_t gfp) 14283 { 14284 nl80211_send_mlme_event(rdev, netdev, buf, len, 14285 NL80211_CMD_AUTHENTICATE, gfp, -1); 14286 } 14287 14288 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev, 14289 struct net_device *netdev, const u8 *buf, 14290 size_t len, gfp_t gfp, int uapsd_queues) 14291 { 14292 nl80211_send_mlme_event(rdev, netdev, buf, len, 14293 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues); 14294 } 14295 14296 void nl80211_send_deauth(struct cfg80211_registered_device *rdev, 14297 struct net_device *netdev, const u8 *buf, 14298 size_t len, gfp_t gfp) 14299 { 14300 nl80211_send_mlme_event(rdev, netdev, buf, len, 14301 NL80211_CMD_DEAUTHENTICATE, gfp, -1); 14302 } 14303 14304 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev, 14305 struct net_device *netdev, const u8 *buf, 14306 size_t len, gfp_t gfp) 14307 { 14308 nl80211_send_mlme_event(rdev, netdev, buf, len, 14309 NL80211_CMD_DISASSOCIATE, gfp, -1); 14310 } 14311 14312 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf, 14313 size_t len) 14314 { 14315 struct wireless_dev *wdev = dev->ieee80211_ptr; 14316 struct wiphy *wiphy = wdev->wiphy; 14317 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14318 const struct ieee80211_mgmt *mgmt = (void *)buf; 14319 u32 cmd; 14320 14321 if (WARN_ON(len < 2)) 14322 return; 14323 14324 if (ieee80211_is_deauth(mgmt->frame_control)) 14325 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE; 14326 else 14327 cmd = NL80211_CMD_UNPROT_DISASSOCIATE; 14328 14329 trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len); 14330 nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1); 14331 } 14332 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt); 14333 14334 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev, 14335 struct net_device *netdev, int cmd, 14336 const u8 *addr, gfp_t gfp) 14337 { 14338 struct sk_buff *msg; 14339 void *hdr; 14340 14341 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14342 if (!msg) 14343 return; 14344 14345 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 14346 if (!hdr) { 14347 nlmsg_free(msg); 14348 return; 14349 } 14350 14351 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14352 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 14353 nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) || 14354 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) 14355 goto nla_put_failure; 14356 14357 genlmsg_end(msg, hdr); 14358 14359 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14360 NL80211_MCGRP_MLME, gfp); 14361 return; 14362 14363 nla_put_failure: 14364 nlmsg_free(msg); 14365 } 14366 14367 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev, 14368 struct net_device *netdev, const u8 *addr, 14369 gfp_t gfp) 14370 { 14371 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE, 14372 addr, gfp); 14373 } 14374 14375 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev, 14376 struct net_device *netdev, const u8 *addr, 14377 gfp_t gfp) 14378 { 14379 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE, 14380 addr, gfp); 14381 } 14382 14383 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev, 14384 struct net_device *netdev, 14385 struct cfg80211_connect_resp_params *cr, 14386 gfp_t gfp) 14387 { 14388 struct sk_buff *msg; 14389 void *hdr; 14390 14391 msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len + 14392 cr->fils.kek_len + cr->fils.pmk_len + 14393 (cr->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp); 14394 if (!msg) 14395 return; 14396 14397 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT); 14398 if (!hdr) { 14399 nlmsg_free(msg); 14400 return; 14401 } 14402 14403 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14404 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 14405 (cr->bssid && 14406 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cr->bssid)) || 14407 nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, 14408 cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE : 14409 cr->status) || 14410 (cr->status < 0 && 14411 (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) || 14412 nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON, 14413 cr->timeout_reason))) || 14414 (cr->req_ie && 14415 nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) || 14416 (cr->resp_ie && 14417 nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len, 14418 cr->resp_ie)) || 14419 (cr->fils.update_erp_next_seq_num && 14420 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM, 14421 cr->fils.erp_next_seq_num)) || 14422 (cr->status == WLAN_STATUS_SUCCESS && 14423 ((cr->fils.kek && 14424 nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len, 14425 cr->fils.kek)) || 14426 (cr->fils.pmk && 14427 nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) || 14428 (cr->fils.pmkid && 14429 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid))))) 14430 goto nla_put_failure; 14431 14432 genlmsg_end(msg, hdr); 14433 14434 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14435 NL80211_MCGRP_MLME, gfp); 14436 return; 14437 14438 nla_put_failure: 14439 nlmsg_free(msg); 14440 } 14441 14442 void nl80211_send_roamed(struct cfg80211_registered_device *rdev, 14443 struct net_device *netdev, 14444 struct cfg80211_roam_info *info, gfp_t gfp) 14445 { 14446 struct sk_buff *msg; 14447 void *hdr; 14448 const u8 *bssid = info->bss ? info->bss->bssid : info->bssid; 14449 14450 msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len + 14451 info->fils.kek_len + info->fils.pmk_len + 14452 (info->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp); 14453 if (!msg) 14454 return; 14455 14456 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM); 14457 if (!hdr) { 14458 nlmsg_free(msg); 14459 return; 14460 } 14461 14462 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14463 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 14464 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) || 14465 (info->req_ie && 14466 nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len, 14467 info->req_ie)) || 14468 (info->resp_ie && 14469 nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len, 14470 info->resp_ie)) || 14471 (info->fils.update_erp_next_seq_num && 14472 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM, 14473 info->fils.erp_next_seq_num)) || 14474 (info->fils.kek && 14475 nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len, 14476 info->fils.kek)) || 14477 (info->fils.pmk && 14478 nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) || 14479 (info->fils.pmkid && 14480 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid))) 14481 goto nla_put_failure; 14482 14483 genlmsg_end(msg, hdr); 14484 14485 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14486 NL80211_MCGRP_MLME, gfp); 14487 return; 14488 14489 nla_put_failure: 14490 nlmsg_free(msg); 14491 } 14492 14493 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev, 14494 struct net_device *netdev, const u8 *bssid) 14495 { 14496 struct sk_buff *msg; 14497 void *hdr; 14498 14499 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 14500 if (!msg) 14501 return; 14502 14503 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED); 14504 if (!hdr) { 14505 nlmsg_free(msg); 14506 return; 14507 } 14508 14509 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) 14510 goto nla_put_failure; 14511 14512 genlmsg_end(msg, hdr); 14513 14514 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14515 NL80211_MCGRP_MLME, GFP_KERNEL); 14516 return; 14517 14518 nla_put_failure: 14519 nlmsg_free(msg); 14520 } 14521 14522 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev, 14523 struct net_device *netdev, u16 reason, 14524 const u8 *ie, size_t ie_len, bool from_ap) 14525 { 14526 struct sk_buff *msg; 14527 void *hdr; 14528 14529 msg = nlmsg_new(100 + ie_len, GFP_KERNEL); 14530 if (!msg) 14531 return; 14532 14533 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT); 14534 if (!hdr) { 14535 nlmsg_free(msg); 14536 return; 14537 } 14538 14539 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14540 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 14541 (reason && 14542 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) || 14543 (from_ap && 14544 nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) || 14545 (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie))) 14546 goto nla_put_failure; 14547 14548 genlmsg_end(msg, hdr); 14549 14550 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14551 NL80211_MCGRP_MLME, GFP_KERNEL); 14552 return; 14553 14554 nla_put_failure: 14555 nlmsg_free(msg); 14556 } 14557 14558 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev, 14559 struct net_device *netdev, const u8 *bssid, 14560 gfp_t gfp) 14561 { 14562 struct sk_buff *msg; 14563 void *hdr; 14564 14565 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14566 if (!msg) 14567 return; 14568 14569 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS); 14570 if (!hdr) { 14571 nlmsg_free(msg); 14572 return; 14573 } 14574 14575 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14576 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 14577 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) 14578 goto nla_put_failure; 14579 14580 genlmsg_end(msg, hdr); 14581 14582 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14583 NL80211_MCGRP_MLME, gfp); 14584 return; 14585 14586 nla_put_failure: 14587 nlmsg_free(msg); 14588 } 14589 14590 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr, 14591 const u8* ie, u8 ie_len, gfp_t gfp) 14592 { 14593 struct wireless_dev *wdev = dev->ieee80211_ptr; 14594 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 14595 struct sk_buff *msg; 14596 void *hdr; 14597 14598 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT)) 14599 return; 14600 14601 trace_cfg80211_notify_new_peer_candidate(dev, addr); 14602 14603 msg = nlmsg_new(100 + ie_len, gfp); 14604 if (!msg) 14605 return; 14606 14607 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE); 14608 if (!hdr) { 14609 nlmsg_free(msg); 14610 return; 14611 } 14612 14613 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14614 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 14615 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) || 14616 (ie_len && ie && 14617 nla_put(msg, NL80211_ATTR_IE, ie_len , ie))) 14618 goto nla_put_failure; 14619 14620 genlmsg_end(msg, hdr); 14621 14622 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14623 NL80211_MCGRP_MLME, gfp); 14624 return; 14625 14626 nla_put_failure: 14627 nlmsg_free(msg); 14628 } 14629 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate); 14630 14631 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev, 14632 struct net_device *netdev, const u8 *addr, 14633 enum nl80211_key_type key_type, int key_id, 14634 const u8 *tsc, gfp_t gfp) 14635 { 14636 struct sk_buff *msg; 14637 void *hdr; 14638 14639 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14640 if (!msg) 14641 return; 14642 14643 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE); 14644 if (!hdr) { 14645 nlmsg_free(msg); 14646 return; 14647 } 14648 14649 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14650 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 14651 (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) || 14652 nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) || 14653 (key_id != -1 && 14654 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) || 14655 (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc))) 14656 goto nla_put_failure; 14657 14658 genlmsg_end(msg, hdr); 14659 14660 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14661 NL80211_MCGRP_MLME, gfp); 14662 return; 14663 14664 nla_put_failure: 14665 nlmsg_free(msg); 14666 } 14667 14668 void nl80211_send_beacon_hint_event(struct wiphy *wiphy, 14669 struct ieee80211_channel *channel_before, 14670 struct ieee80211_channel *channel_after) 14671 { 14672 struct sk_buff *msg; 14673 void *hdr; 14674 struct nlattr *nl_freq; 14675 14676 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); 14677 if (!msg) 14678 return; 14679 14680 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT); 14681 if (!hdr) { 14682 nlmsg_free(msg); 14683 return; 14684 } 14685 14686 /* 14687 * Since we are applying the beacon hint to a wiphy we know its 14688 * wiphy_idx is valid 14689 */ 14690 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy))) 14691 goto nla_put_failure; 14692 14693 /* Before */ 14694 nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE); 14695 if (!nl_freq) 14696 goto nla_put_failure; 14697 14698 if (nl80211_msg_put_channel(msg, wiphy, channel_before, false)) 14699 goto nla_put_failure; 14700 nla_nest_end(msg, nl_freq); 14701 14702 /* After */ 14703 nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER); 14704 if (!nl_freq) 14705 goto nla_put_failure; 14706 14707 if (nl80211_msg_put_channel(msg, wiphy, channel_after, false)) 14708 goto nla_put_failure; 14709 nla_nest_end(msg, nl_freq); 14710 14711 genlmsg_end(msg, hdr); 14712 14713 rcu_read_lock(); 14714 genlmsg_multicast_allns(&nl80211_fam, msg, 0, 14715 NL80211_MCGRP_REGULATORY, GFP_ATOMIC); 14716 rcu_read_unlock(); 14717 14718 return; 14719 14720 nla_put_failure: 14721 nlmsg_free(msg); 14722 } 14723 14724 static void nl80211_send_remain_on_chan_event( 14725 int cmd, struct cfg80211_registered_device *rdev, 14726 struct wireless_dev *wdev, u64 cookie, 14727 struct ieee80211_channel *chan, 14728 unsigned int duration, gfp_t gfp) 14729 { 14730 struct sk_buff *msg; 14731 void *hdr; 14732 14733 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14734 if (!msg) 14735 return; 14736 14737 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 14738 if (!hdr) { 14739 nlmsg_free(msg); 14740 return; 14741 } 14742 14743 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14744 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 14745 wdev->netdev->ifindex)) || 14746 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 14747 NL80211_ATTR_PAD) || 14748 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) || 14749 nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, 14750 NL80211_CHAN_NO_HT) || 14751 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 14752 NL80211_ATTR_PAD)) 14753 goto nla_put_failure; 14754 14755 if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL && 14756 nla_put_u32(msg, NL80211_ATTR_DURATION, duration)) 14757 goto nla_put_failure; 14758 14759 genlmsg_end(msg, hdr); 14760 14761 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14762 NL80211_MCGRP_MLME, gfp); 14763 return; 14764 14765 nla_put_failure: 14766 nlmsg_free(msg); 14767 } 14768 14769 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie, 14770 struct ieee80211_channel *chan, 14771 unsigned int duration, gfp_t gfp) 14772 { 14773 struct wiphy *wiphy = wdev->wiphy; 14774 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14775 14776 trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration); 14777 nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL, 14778 rdev, wdev, cookie, chan, 14779 duration, gfp); 14780 } 14781 EXPORT_SYMBOL(cfg80211_ready_on_channel); 14782 14783 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie, 14784 struct ieee80211_channel *chan, 14785 gfp_t gfp) 14786 { 14787 struct wiphy *wiphy = wdev->wiphy; 14788 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14789 14790 trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan); 14791 nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL, 14792 rdev, wdev, cookie, chan, 0, gfp); 14793 } 14794 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired); 14795 14796 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr, 14797 struct station_info *sinfo, gfp_t gfp) 14798 { 14799 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy; 14800 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14801 struct sk_buff *msg; 14802 14803 trace_cfg80211_new_sta(dev, mac_addr, sinfo); 14804 14805 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14806 if (!msg) 14807 return; 14808 14809 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0, 14810 rdev, dev, mac_addr, sinfo) < 0) { 14811 nlmsg_free(msg); 14812 return; 14813 } 14814 14815 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14816 NL80211_MCGRP_MLME, gfp); 14817 } 14818 EXPORT_SYMBOL(cfg80211_new_sta); 14819 14820 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr, 14821 struct station_info *sinfo, gfp_t gfp) 14822 { 14823 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy; 14824 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14825 struct sk_buff *msg; 14826 struct station_info empty_sinfo = {}; 14827 14828 if (!sinfo) 14829 sinfo = &empty_sinfo; 14830 14831 trace_cfg80211_del_sta(dev, mac_addr); 14832 14833 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14834 if (!msg) { 14835 cfg80211_sinfo_release_content(sinfo); 14836 return; 14837 } 14838 14839 if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0, 14840 rdev, dev, mac_addr, sinfo) < 0) { 14841 nlmsg_free(msg); 14842 return; 14843 } 14844 14845 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14846 NL80211_MCGRP_MLME, gfp); 14847 } 14848 EXPORT_SYMBOL(cfg80211_del_sta_sinfo); 14849 14850 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr, 14851 enum nl80211_connect_failed_reason reason, 14852 gfp_t gfp) 14853 { 14854 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy; 14855 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14856 struct sk_buff *msg; 14857 void *hdr; 14858 14859 msg = nlmsg_new(NLMSG_GOODSIZE, gfp); 14860 if (!msg) 14861 return; 14862 14863 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED); 14864 if (!hdr) { 14865 nlmsg_free(msg); 14866 return; 14867 } 14868 14869 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 14870 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) || 14871 nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason)) 14872 goto nla_put_failure; 14873 14874 genlmsg_end(msg, hdr); 14875 14876 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14877 NL80211_MCGRP_MLME, gfp); 14878 return; 14879 14880 nla_put_failure: 14881 nlmsg_free(msg); 14882 } 14883 EXPORT_SYMBOL(cfg80211_conn_failed); 14884 14885 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd, 14886 const u8 *addr, gfp_t gfp) 14887 { 14888 struct wireless_dev *wdev = dev->ieee80211_ptr; 14889 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 14890 struct sk_buff *msg; 14891 void *hdr; 14892 u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid); 14893 14894 if (!nlportid) 14895 return false; 14896 14897 msg = nlmsg_new(100, gfp); 14898 if (!msg) 14899 return true; 14900 14901 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 14902 if (!hdr) { 14903 nlmsg_free(msg); 14904 return true; 14905 } 14906 14907 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14908 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 14909 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) 14910 goto nla_put_failure; 14911 14912 genlmsg_end(msg, hdr); 14913 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 14914 return true; 14915 14916 nla_put_failure: 14917 nlmsg_free(msg); 14918 return true; 14919 } 14920 14921 bool cfg80211_rx_spurious_frame(struct net_device *dev, 14922 const u8 *addr, gfp_t gfp) 14923 { 14924 struct wireless_dev *wdev = dev->ieee80211_ptr; 14925 bool ret; 14926 14927 trace_cfg80211_rx_spurious_frame(dev, addr); 14928 14929 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP && 14930 wdev->iftype != NL80211_IFTYPE_P2P_GO)) { 14931 trace_cfg80211_return_bool(false); 14932 return false; 14933 } 14934 ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME, 14935 addr, gfp); 14936 trace_cfg80211_return_bool(ret); 14937 return ret; 14938 } 14939 EXPORT_SYMBOL(cfg80211_rx_spurious_frame); 14940 14941 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev, 14942 const u8 *addr, gfp_t gfp) 14943 { 14944 struct wireless_dev *wdev = dev->ieee80211_ptr; 14945 bool ret; 14946 14947 trace_cfg80211_rx_unexpected_4addr_frame(dev, addr); 14948 14949 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP && 14950 wdev->iftype != NL80211_IFTYPE_P2P_GO && 14951 wdev->iftype != NL80211_IFTYPE_AP_VLAN)) { 14952 trace_cfg80211_return_bool(false); 14953 return false; 14954 } 14955 ret = __nl80211_unexpected_frame(dev, 14956 NL80211_CMD_UNEXPECTED_4ADDR_FRAME, 14957 addr, gfp); 14958 trace_cfg80211_return_bool(ret); 14959 return ret; 14960 } 14961 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame); 14962 14963 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev, 14964 struct wireless_dev *wdev, u32 nlportid, 14965 int freq, int sig_dbm, 14966 const u8 *buf, size_t len, u32 flags, gfp_t gfp) 14967 { 14968 struct net_device *netdev = wdev->netdev; 14969 struct sk_buff *msg; 14970 void *hdr; 14971 14972 msg = nlmsg_new(100 + len, gfp); 14973 if (!msg) 14974 return -ENOMEM; 14975 14976 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME); 14977 if (!hdr) { 14978 nlmsg_free(msg); 14979 return -ENOMEM; 14980 } 14981 14982 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14983 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 14984 netdev->ifindex)) || 14985 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 14986 NL80211_ATTR_PAD) || 14987 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) || 14988 (sig_dbm && 14989 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) || 14990 nla_put(msg, NL80211_ATTR_FRAME, len, buf) || 14991 (flags && 14992 nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags))) 14993 goto nla_put_failure; 14994 14995 genlmsg_end(msg, hdr); 14996 14997 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 14998 14999 nla_put_failure: 15000 nlmsg_free(msg); 15001 return -ENOBUFS; 15002 } 15003 15004 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie, 15005 const u8 *buf, size_t len, bool ack, gfp_t gfp) 15006 { 15007 struct wiphy *wiphy = wdev->wiphy; 15008 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 15009 struct net_device *netdev = wdev->netdev; 15010 struct sk_buff *msg; 15011 void *hdr; 15012 15013 trace_cfg80211_mgmt_tx_status(wdev, cookie, ack); 15014 15015 msg = nlmsg_new(100 + len, gfp); 15016 if (!msg) 15017 return; 15018 15019 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS); 15020 if (!hdr) { 15021 nlmsg_free(msg); 15022 return; 15023 } 15024 15025 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15026 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 15027 netdev->ifindex)) || 15028 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 15029 NL80211_ATTR_PAD) || 15030 nla_put(msg, NL80211_ATTR_FRAME, len, buf) || 15031 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 15032 NL80211_ATTR_PAD) || 15033 (ack && nla_put_flag(msg, NL80211_ATTR_ACK))) 15034 goto nla_put_failure; 15035 15036 genlmsg_end(msg, hdr); 15037 15038 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15039 NL80211_MCGRP_MLME, gfp); 15040 return; 15041 15042 nla_put_failure: 15043 nlmsg_free(msg); 15044 } 15045 EXPORT_SYMBOL(cfg80211_mgmt_tx_status); 15046 15047 static int __nl80211_rx_control_port(struct net_device *dev, 15048 struct sk_buff *skb, 15049 bool unencrypted, gfp_t gfp) 15050 { 15051 struct wireless_dev *wdev = dev->ieee80211_ptr; 15052 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 15053 struct ethhdr *ehdr = eth_hdr(skb); 15054 const u8 *addr = ehdr->h_source; 15055 u16 proto = be16_to_cpu(skb->protocol); 15056 struct sk_buff *msg; 15057 void *hdr; 15058 struct nlattr *frame; 15059 15060 u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid); 15061 15062 if (!nlportid) 15063 return -ENOENT; 15064 15065 msg = nlmsg_new(100 + skb->len, gfp); 15066 if (!msg) 15067 return -ENOMEM; 15068 15069 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME); 15070 if (!hdr) { 15071 nlmsg_free(msg); 15072 return -ENOBUFS; 15073 } 15074 15075 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15076 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 15077 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 15078 NL80211_ATTR_PAD) || 15079 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) || 15080 nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) || 15081 (unencrypted && nla_put_flag(msg, 15082 NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT))) 15083 goto nla_put_failure; 15084 15085 frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len); 15086 if (!frame) 15087 goto nla_put_failure; 15088 15089 skb_copy_bits(skb, 0, nla_data(frame), skb->len); 15090 genlmsg_end(msg, hdr); 15091 15092 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 15093 15094 nla_put_failure: 15095 nlmsg_free(msg); 15096 return -ENOBUFS; 15097 } 15098 15099 bool cfg80211_rx_control_port(struct net_device *dev, 15100 struct sk_buff *skb, bool unencrypted) 15101 { 15102 int ret; 15103 15104 trace_cfg80211_rx_control_port(dev, skb, unencrypted); 15105 ret = __nl80211_rx_control_port(dev, skb, unencrypted, GFP_ATOMIC); 15106 trace_cfg80211_return_bool(ret == 0); 15107 return ret == 0; 15108 } 15109 EXPORT_SYMBOL(cfg80211_rx_control_port); 15110 15111 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev, 15112 const char *mac, gfp_t gfp) 15113 { 15114 struct wireless_dev *wdev = dev->ieee80211_ptr; 15115 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 15116 struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 15117 void **cb; 15118 15119 if (!msg) 15120 return NULL; 15121 15122 cb = (void **)msg->cb; 15123 15124 cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM); 15125 if (!cb[0]) { 15126 nlmsg_free(msg); 15127 return NULL; 15128 } 15129 15130 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15131 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 15132 goto nla_put_failure; 15133 15134 if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac)) 15135 goto nla_put_failure; 15136 15137 cb[1] = nla_nest_start(msg, NL80211_ATTR_CQM); 15138 if (!cb[1]) 15139 goto nla_put_failure; 15140 15141 cb[2] = rdev; 15142 15143 return msg; 15144 nla_put_failure: 15145 nlmsg_free(msg); 15146 return NULL; 15147 } 15148 15149 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp) 15150 { 15151 void **cb = (void **)msg->cb; 15152 struct cfg80211_registered_device *rdev = cb[2]; 15153 15154 nla_nest_end(msg, cb[1]); 15155 genlmsg_end(msg, cb[0]); 15156 15157 memset(msg->cb, 0, sizeof(msg->cb)); 15158 15159 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15160 NL80211_MCGRP_MLME, gfp); 15161 } 15162 15163 void cfg80211_cqm_rssi_notify(struct net_device *dev, 15164 enum nl80211_cqm_rssi_threshold_event rssi_event, 15165 s32 rssi_level, gfp_t gfp) 15166 { 15167 struct sk_buff *msg; 15168 struct wireless_dev *wdev = dev->ieee80211_ptr; 15169 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 15170 15171 trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level); 15172 15173 if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW && 15174 rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH)) 15175 return; 15176 15177 if (wdev->cqm_config) { 15178 wdev->cqm_config->last_rssi_event_value = rssi_level; 15179 15180 cfg80211_cqm_rssi_update(rdev, dev); 15181 15182 if (rssi_level == 0) 15183 rssi_level = wdev->cqm_config->last_rssi_event_value; 15184 } 15185 15186 msg = cfg80211_prepare_cqm(dev, NULL, gfp); 15187 if (!msg) 15188 return; 15189 15190 if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT, 15191 rssi_event)) 15192 goto nla_put_failure; 15193 15194 if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL, 15195 rssi_level)) 15196 goto nla_put_failure; 15197 15198 cfg80211_send_cqm(msg, gfp); 15199 15200 return; 15201 15202 nla_put_failure: 15203 nlmsg_free(msg); 15204 } 15205 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify); 15206 15207 void cfg80211_cqm_txe_notify(struct net_device *dev, 15208 const u8 *peer, u32 num_packets, 15209 u32 rate, u32 intvl, gfp_t gfp) 15210 { 15211 struct sk_buff *msg; 15212 15213 msg = cfg80211_prepare_cqm(dev, peer, gfp); 15214 if (!msg) 15215 return; 15216 15217 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets)) 15218 goto nla_put_failure; 15219 15220 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate)) 15221 goto nla_put_failure; 15222 15223 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl)) 15224 goto nla_put_failure; 15225 15226 cfg80211_send_cqm(msg, gfp); 15227 return; 15228 15229 nla_put_failure: 15230 nlmsg_free(msg); 15231 } 15232 EXPORT_SYMBOL(cfg80211_cqm_txe_notify); 15233 15234 void cfg80211_cqm_pktloss_notify(struct net_device *dev, 15235 const u8 *peer, u32 num_packets, gfp_t gfp) 15236 { 15237 struct sk_buff *msg; 15238 15239 trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets); 15240 15241 msg = cfg80211_prepare_cqm(dev, peer, gfp); 15242 if (!msg) 15243 return; 15244 15245 if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets)) 15246 goto nla_put_failure; 15247 15248 cfg80211_send_cqm(msg, gfp); 15249 return; 15250 15251 nla_put_failure: 15252 nlmsg_free(msg); 15253 } 15254 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify); 15255 15256 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp) 15257 { 15258 struct sk_buff *msg; 15259 15260 msg = cfg80211_prepare_cqm(dev, NULL, gfp); 15261 if (!msg) 15262 return; 15263 15264 if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT)) 15265 goto nla_put_failure; 15266 15267 cfg80211_send_cqm(msg, gfp); 15268 return; 15269 15270 nla_put_failure: 15271 nlmsg_free(msg); 15272 } 15273 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify); 15274 15275 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev, 15276 struct net_device *netdev, const u8 *bssid, 15277 const u8 *replay_ctr, gfp_t gfp) 15278 { 15279 struct sk_buff *msg; 15280 struct nlattr *rekey_attr; 15281 void *hdr; 15282 15283 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 15284 if (!msg) 15285 return; 15286 15287 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD); 15288 if (!hdr) { 15289 nlmsg_free(msg); 15290 return; 15291 } 15292 15293 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15294 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 15295 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) 15296 goto nla_put_failure; 15297 15298 rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA); 15299 if (!rekey_attr) 15300 goto nla_put_failure; 15301 15302 if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR, 15303 NL80211_REPLAY_CTR_LEN, replay_ctr)) 15304 goto nla_put_failure; 15305 15306 nla_nest_end(msg, rekey_attr); 15307 15308 genlmsg_end(msg, hdr); 15309 15310 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15311 NL80211_MCGRP_MLME, gfp); 15312 return; 15313 15314 nla_put_failure: 15315 nlmsg_free(msg); 15316 } 15317 15318 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid, 15319 const u8 *replay_ctr, gfp_t gfp) 15320 { 15321 struct wireless_dev *wdev = dev->ieee80211_ptr; 15322 struct wiphy *wiphy = wdev->wiphy; 15323 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 15324 15325 trace_cfg80211_gtk_rekey_notify(dev, bssid); 15326 nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp); 15327 } 15328 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify); 15329 15330 static void 15331 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev, 15332 struct net_device *netdev, int index, 15333 const u8 *bssid, bool preauth, gfp_t gfp) 15334 { 15335 struct sk_buff *msg; 15336 struct nlattr *attr; 15337 void *hdr; 15338 15339 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 15340 if (!msg) 15341 return; 15342 15343 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE); 15344 if (!hdr) { 15345 nlmsg_free(msg); 15346 return; 15347 } 15348 15349 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15350 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex)) 15351 goto nla_put_failure; 15352 15353 attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE); 15354 if (!attr) 15355 goto nla_put_failure; 15356 15357 if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) || 15358 nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) || 15359 (preauth && 15360 nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH))) 15361 goto nla_put_failure; 15362 15363 nla_nest_end(msg, attr); 15364 15365 genlmsg_end(msg, hdr); 15366 15367 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15368 NL80211_MCGRP_MLME, gfp); 15369 return; 15370 15371 nla_put_failure: 15372 nlmsg_free(msg); 15373 } 15374 15375 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index, 15376 const u8 *bssid, bool preauth, gfp_t gfp) 15377 { 15378 struct wireless_dev *wdev = dev->ieee80211_ptr; 15379 struct wiphy *wiphy = wdev->wiphy; 15380 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 15381 15382 trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth); 15383 nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp); 15384 } 15385 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify); 15386 15387 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev, 15388 struct net_device *netdev, 15389 struct cfg80211_chan_def *chandef, 15390 gfp_t gfp, 15391 enum nl80211_commands notif, 15392 u8 count) 15393 { 15394 struct sk_buff *msg; 15395 void *hdr; 15396 15397 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 15398 if (!msg) 15399 return; 15400 15401 hdr = nl80211hdr_put(msg, 0, 0, 0, notif); 15402 if (!hdr) { 15403 nlmsg_free(msg); 15404 return; 15405 } 15406 15407 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex)) 15408 goto nla_put_failure; 15409 15410 if (nl80211_send_chandef(msg, chandef)) 15411 goto nla_put_failure; 15412 15413 if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) && 15414 (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count))) 15415 goto nla_put_failure; 15416 15417 genlmsg_end(msg, hdr); 15418 15419 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15420 NL80211_MCGRP_MLME, gfp); 15421 return; 15422 15423 nla_put_failure: 15424 nlmsg_free(msg); 15425 } 15426 15427 void cfg80211_ch_switch_notify(struct net_device *dev, 15428 struct cfg80211_chan_def *chandef) 15429 { 15430 struct wireless_dev *wdev = dev->ieee80211_ptr; 15431 struct wiphy *wiphy = wdev->wiphy; 15432 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 15433 15434 ASSERT_WDEV_LOCK(wdev); 15435 15436 trace_cfg80211_ch_switch_notify(dev, chandef); 15437 15438 wdev->chandef = *chandef; 15439 wdev->preset_chandef = *chandef; 15440 nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL, 15441 NL80211_CMD_CH_SWITCH_NOTIFY, 0); 15442 } 15443 EXPORT_SYMBOL(cfg80211_ch_switch_notify); 15444 15445 void cfg80211_ch_switch_started_notify(struct net_device *dev, 15446 struct cfg80211_chan_def *chandef, 15447 u8 count) 15448 { 15449 struct wireless_dev *wdev = dev->ieee80211_ptr; 15450 struct wiphy *wiphy = wdev->wiphy; 15451 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 15452 15453 trace_cfg80211_ch_switch_started_notify(dev, chandef); 15454 15455 nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL, 15456 NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count); 15457 } 15458 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify); 15459 15460 void 15461 nl80211_radar_notify(struct cfg80211_registered_device *rdev, 15462 const struct cfg80211_chan_def *chandef, 15463 enum nl80211_radar_event event, 15464 struct net_device *netdev, gfp_t gfp) 15465 { 15466 struct sk_buff *msg; 15467 void *hdr; 15468 15469 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 15470 if (!msg) 15471 return; 15472 15473 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT); 15474 if (!hdr) { 15475 nlmsg_free(msg); 15476 return; 15477 } 15478 15479 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx)) 15480 goto nla_put_failure; 15481 15482 /* NOP and radar events don't need a netdev parameter */ 15483 if (netdev) { 15484 struct wireless_dev *wdev = netdev->ieee80211_ptr; 15485 15486 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 15487 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 15488 NL80211_ATTR_PAD)) 15489 goto nla_put_failure; 15490 } 15491 15492 if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event)) 15493 goto nla_put_failure; 15494 15495 if (nl80211_send_chandef(msg, chandef)) 15496 goto nla_put_failure; 15497 15498 genlmsg_end(msg, hdr); 15499 15500 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15501 NL80211_MCGRP_MLME, gfp); 15502 return; 15503 15504 nla_put_failure: 15505 nlmsg_free(msg); 15506 } 15507 15508 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac, 15509 struct sta_opmode_info *sta_opmode, 15510 gfp_t gfp) 15511 { 15512 struct sk_buff *msg; 15513 struct wireless_dev *wdev = dev->ieee80211_ptr; 15514 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 15515 void *hdr; 15516 15517 if (WARN_ON(!mac)) 15518 return; 15519 15520 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 15521 if (!msg) 15522 return; 15523 15524 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED); 15525 if (!hdr) { 15526 nlmsg_free(msg); 15527 return; 15528 } 15529 15530 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx)) 15531 goto nla_put_failure; 15532 15533 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 15534 goto nla_put_failure; 15535 15536 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac)) 15537 goto nla_put_failure; 15538 15539 if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) && 15540 nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode)) 15541 goto nla_put_failure; 15542 15543 if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) && 15544 nla_put_u8(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw)) 15545 goto nla_put_failure; 15546 15547 if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) && 15548 nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss)) 15549 goto nla_put_failure; 15550 15551 genlmsg_end(msg, hdr); 15552 15553 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15554 NL80211_MCGRP_MLME, gfp); 15555 15556 return; 15557 15558 nla_put_failure: 15559 nlmsg_free(msg); 15560 } 15561 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify); 15562 15563 void cfg80211_probe_status(struct net_device *dev, const u8 *addr, 15564 u64 cookie, bool acked, s32 ack_signal, 15565 bool is_valid_ack_signal, gfp_t gfp) 15566 { 15567 struct wireless_dev *wdev = dev->ieee80211_ptr; 15568 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 15569 struct sk_buff *msg; 15570 void *hdr; 15571 15572 trace_cfg80211_probe_status(dev, addr, cookie, acked); 15573 15574 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 15575 15576 if (!msg) 15577 return; 15578 15579 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT); 15580 if (!hdr) { 15581 nlmsg_free(msg); 15582 return; 15583 } 15584 15585 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15586 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 15587 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) || 15588 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 15589 NL80211_ATTR_PAD) || 15590 (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) || 15591 (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL, 15592 ack_signal))) 15593 goto nla_put_failure; 15594 15595 genlmsg_end(msg, hdr); 15596 15597 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15598 NL80211_MCGRP_MLME, gfp); 15599 return; 15600 15601 nla_put_failure: 15602 nlmsg_free(msg); 15603 } 15604 EXPORT_SYMBOL(cfg80211_probe_status); 15605 15606 void cfg80211_report_obss_beacon(struct wiphy *wiphy, 15607 const u8 *frame, size_t len, 15608 int freq, int sig_dbm) 15609 { 15610 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 15611 struct sk_buff *msg; 15612 void *hdr; 15613 struct cfg80211_beacon_registration *reg; 15614 15615 trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm); 15616 15617 spin_lock_bh(&rdev->beacon_registrations_lock); 15618 list_for_each_entry(reg, &rdev->beacon_registrations, list) { 15619 msg = nlmsg_new(len + 100, GFP_ATOMIC); 15620 if (!msg) { 15621 spin_unlock_bh(&rdev->beacon_registrations_lock); 15622 return; 15623 } 15624 15625 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME); 15626 if (!hdr) 15627 goto nla_put_failure; 15628 15629 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15630 (freq && 15631 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) || 15632 (sig_dbm && 15633 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) || 15634 nla_put(msg, NL80211_ATTR_FRAME, len, frame)) 15635 goto nla_put_failure; 15636 15637 genlmsg_end(msg, hdr); 15638 15639 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid); 15640 } 15641 spin_unlock_bh(&rdev->beacon_registrations_lock); 15642 return; 15643 15644 nla_put_failure: 15645 spin_unlock_bh(&rdev->beacon_registrations_lock); 15646 nlmsg_free(msg); 15647 } 15648 EXPORT_SYMBOL(cfg80211_report_obss_beacon); 15649 15650 #ifdef CONFIG_PM 15651 static int cfg80211_net_detect_results(struct sk_buff *msg, 15652 struct cfg80211_wowlan_wakeup *wakeup) 15653 { 15654 struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect; 15655 struct nlattr *nl_results, *nl_match, *nl_freqs; 15656 int i, j; 15657 15658 nl_results = nla_nest_start( 15659 msg, NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS); 15660 if (!nl_results) 15661 return -EMSGSIZE; 15662 15663 for (i = 0; i < nd->n_matches; i++) { 15664 struct cfg80211_wowlan_nd_match *match = nd->matches[i]; 15665 15666 nl_match = nla_nest_start(msg, i); 15667 if (!nl_match) 15668 break; 15669 15670 /* The SSID attribute is optional in nl80211, but for 15671 * simplicity reasons it's always present in the 15672 * cfg80211 structure. If a driver can't pass the 15673 * SSID, that needs to be changed. A zero length SSID 15674 * is still a valid SSID (wildcard), so it cannot be 15675 * used for this purpose. 15676 */ 15677 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len, 15678 match->ssid.ssid)) { 15679 nla_nest_cancel(msg, nl_match); 15680 goto out; 15681 } 15682 15683 if (match->n_channels) { 15684 nl_freqs = nla_nest_start( 15685 msg, NL80211_ATTR_SCAN_FREQUENCIES); 15686 if (!nl_freqs) { 15687 nla_nest_cancel(msg, nl_match); 15688 goto out; 15689 } 15690 15691 for (j = 0; j < match->n_channels; j++) { 15692 if (nla_put_u32(msg, j, match->channels[j])) { 15693 nla_nest_cancel(msg, nl_freqs); 15694 nla_nest_cancel(msg, nl_match); 15695 goto out; 15696 } 15697 } 15698 15699 nla_nest_end(msg, nl_freqs); 15700 } 15701 15702 nla_nest_end(msg, nl_match); 15703 } 15704 15705 out: 15706 nla_nest_end(msg, nl_results); 15707 return 0; 15708 } 15709 15710 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev, 15711 struct cfg80211_wowlan_wakeup *wakeup, 15712 gfp_t gfp) 15713 { 15714 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 15715 struct sk_buff *msg; 15716 void *hdr; 15717 int size = 200; 15718 15719 trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup); 15720 15721 if (wakeup) 15722 size += wakeup->packet_present_len; 15723 15724 msg = nlmsg_new(size, gfp); 15725 if (!msg) 15726 return; 15727 15728 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN); 15729 if (!hdr) 15730 goto free_msg; 15731 15732 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15733 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 15734 NL80211_ATTR_PAD)) 15735 goto free_msg; 15736 15737 if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 15738 wdev->netdev->ifindex)) 15739 goto free_msg; 15740 15741 if (wakeup) { 15742 struct nlattr *reasons; 15743 15744 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS); 15745 if (!reasons) 15746 goto free_msg; 15747 15748 if (wakeup->disconnect && 15749 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) 15750 goto free_msg; 15751 if (wakeup->magic_pkt && 15752 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) 15753 goto free_msg; 15754 if (wakeup->gtk_rekey_failure && 15755 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) 15756 goto free_msg; 15757 if (wakeup->eap_identity_req && 15758 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) 15759 goto free_msg; 15760 if (wakeup->four_way_handshake && 15761 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) 15762 goto free_msg; 15763 if (wakeup->rfkill_release && 15764 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)) 15765 goto free_msg; 15766 15767 if (wakeup->pattern_idx >= 0 && 15768 nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN, 15769 wakeup->pattern_idx)) 15770 goto free_msg; 15771 15772 if (wakeup->tcp_match && 15773 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH)) 15774 goto free_msg; 15775 15776 if (wakeup->tcp_connlost && 15777 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST)) 15778 goto free_msg; 15779 15780 if (wakeup->tcp_nomoretokens && 15781 nla_put_flag(msg, 15782 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS)) 15783 goto free_msg; 15784 15785 if (wakeup->packet) { 15786 u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211; 15787 u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN; 15788 15789 if (!wakeup->packet_80211) { 15790 pkt_attr = 15791 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023; 15792 len_attr = 15793 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN; 15794 } 15795 15796 if (wakeup->packet_len && 15797 nla_put_u32(msg, len_attr, wakeup->packet_len)) 15798 goto free_msg; 15799 15800 if (nla_put(msg, pkt_attr, wakeup->packet_present_len, 15801 wakeup->packet)) 15802 goto free_msg; 15803 } 15804 15805 if (wakeup->net_detect && 15806 cfg80211_net_detect_results(msg, wakeup)) 15807 goto free_msg; 15808 15809 nla_nest_end(msg, reasons); 15810 } 15811 15812 genlmsg_end(msg, hdr); 15813 15814 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15815 NL80211_MCGRP_MLME, gfp); 15816 return; 15817 15818 free_msg: 15819 nlmsg_free(msg); 15820 } 15821 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup); 15822 #endif 15823 15824 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer, 15825 enum nl80211_tdls_operation oper, 15826 u16 reason_code, gfp_t gfp) 15827 { 15828 struct wireless_dev *wdev = dev->ieee80211_ptr; 15829 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 15830 struct sk_buff *msg; 15831 void *hdr; 15832 15833 trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper, 15834 reason_code); 15835 15836 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 15837 if (!msg) 15838 return; 15839 15840 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER); 15841 if (!hdr) { 15842 nlmsg_free(msg); 15843 return; 15844 } 15845 15846 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15847 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 15848 nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) || 15849 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) || 15850 (reason_code > 0 && 15851 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code))) 15852 goto nla_put_failure; 15853 15854 genlmsg_end(msg, hdr); 15855 15856 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15857 NL80211_MCGRP_MLME, gfp); 15858 return; 15859 15860 nla_put_failure: 15861 nlmsg_free(msg); 15862 } 15863 EXPORT_SYMBOL(cfg80211_tdls_oper_request); 15864 15865 static int nl80211_netlink_notify(struct notifier_block * nb, 15866 unsigned long state, 15867 void *_notify) 15868 { 15869 struct netlink_notify *notify = _notify; 15870 struct cfg80211_registered_device *rdev; 15871 struct wireless_dev *wdev; 15872 struct cfg80211_beacon_registration *reg, *tmp; 15873 15874 if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC) 15875 return NOTIFY_DONE; 15876 15877 rcu_read_lock(); 15878 15879 list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) { 15880 struct cfg80211_sched_scan_request *sched_scan_req; 15881 15882 list_for_each_entry_rcu(sched_scan_req, 15883 &rdev->sched_scan_req_list, 15884 list) { 15885 if (sched_scan_req->owner_nlportid == notify->portid) { 15886 sched_scan_req->nl_owner_dead = true; 15887 schedule_work(&rdev->sched_scan_stop_wk); 15888 } 15889 } 15890 15891 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) { 15892 cfg80211_mlme_unregister_socket(wdev, notify->portid); 15893 15894 if (wdev->owner_nlportid == notify->portid) { 15895 wdev->nl_owner_dead = true; 15896 schedule_work(&rdev->destroy_work); 15897 } else if (wdev->conn_owner_nlportid == notify->portid) { 15898 schedule_work(&wdev->disconnect_wk); 15899 } 15900 } 15901 15902 spin_lock_bh(&rdev->beacon_registrations_lock); 15903 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations, 15904 list) { 15905 if (reg->nlportid == notify->portid) { 15906 list_del(®->list); 15907 kfree(reg); 15908 break; 15909 } 15910 } 15911 spin_unlock_bh(&rdev->beacon_registrations_lock); 15912 } 15913 15914 rcu_read_unlock(); 15915 15916 /* 15917 * It is possible that the user space process that is controlling the 15918 * indoor setting disappeared, so notify the regulatory core. 15919 */ 15920 regulatory_netlink_notify(notify->portid); 15921 return NOTIFY_OK; 15922 } 15923 15924 static struct notifier_block nl80211_netlink_notifier = { 15925 .notifier_call = nl80211_netlink_notify, 15926 }; 15927 15928 void cfg80211_ft_event(struct net_device *netdev, 15929 struct cfg80211_ft_event_params *ft_event) 15930 { 15931 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy; 15932 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 15933 struct sk_buff *msg; 15934 void *hdr; 15935 15936 trace_cfg80211_ft_event(wiphy, netdev, ft_event); 15937 15938 if (!ft_event->target_ap) 15939 return; 15940 15941 msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len, 15942 GFP_KERNEL); 15943 if (!msg) 15944 return; 15945 15946 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT); 15947 if (!hdr) 15948 goto out; 15949 15950 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15951 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 15952 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap)) 15953 goto out; 15954 15955 if (ft_event->ies && 15956 nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies)) 15957 goto out; 15958 if (ft_event->ric_ies && 15959 nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len, 15960 ft_event->ric_ies)) 15961 goto out; 15962 15963 genlmsg_end(msg, hdr); 15964 15965 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15966 NL80211_MCGRP_MLME, GFP_KERNEL); 15967 return; 15968 out: 15969 nlmsg_free(msg); 15970 } 15971 EXPORT_SYMBOL(cfg80211_ft_event); 15972 15973 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp) 15974 { 15975 struct cfg80211_registered_device *rdev; 15976 struct sk_buff *msg; 15977 void *hdr; 15978 u32 nlportid; 15979 15980 rdev = wiphy_to_rdev(wdev->wiphy); 15981 if (!rdev->crit_proto_nlportid) 15982 return; 15983 15984 nlportid = rdev->crit_proto_nlportid; 15985 rdev->crit_proto_nlportid = 0; 15986 15987 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 15988 if (!msg) 15989 return; 15990 15991 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP); 15992 if (!hdr) 15993 goto nla_put_failure; 15994 15995 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15996 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 15997 NL80211_ATTR_PAD)) 15998 goto nla_put_failure; 15999 16000 genlmsg_end(msg, hdr); 16001 16002 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 16003 return; 16004 16005 nla_put_failure: 16006 nlmsg_free(msg); 16007 } 16008 EXPORT_SYMBOL(cfg80211_crit_proto_stopped); 16009 16010 void nl80211_send_ap_stopped(struct wireless_dev *wdev) 16011 { 16012 struct wiphy *wiphy = wdev->wiphy; 16013 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 16014 struct sk_buff *msg; 16015 void *hdr; 16016 16017 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 16018 if (!msg) 16019 return; 16020 16021 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP); 16022 if (!hdr) 16023 goto out; 16024 16025 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16026 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) || 16027 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 16028 NL80211_ATTR_PAD)) 16029 goto out; 16030 16031 genlmsg_end(msg, hdr); 16032 16033 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0, 16034 NL80211_MCGRP_MLME, GFP_KERNEL); 16035 return; 16036 out: 16037 nlmsg_free(msg); 16038 } 16039 16040 int cfg80211_external_auth_request(struct net_device *dev, 16041 struct cfg80211_external_auth_params *params, 16042 gfp_t gfp) 16043 { 16044 struct wireless_dev *wdev = dev->ieee80211_ptr; 16045 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 16046 struct sk_buff *msg; 16047 void *hdr; 16048 16049 if (!wdev->conn_owner_nlportid) 16050 return -EINVAL; 16051 16052 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 16053 if (!msg) 16054 return -ENOMEM; 16055 16056 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH); 16057 if (!hdr) 16058 goto nla_put_failure; 16059 16060 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 16061 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 16062 nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, params->key_mgmt_suite) || 16063 nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION, 16064 params->action) || 16065 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) || 16066 nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len, 16067 params->ssid.ssid)) 16068 goto nla_put_failure; 16069 16070 genlmsg_end(msg, hdr); 16071 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, 16072 wdev->conn_owner_nlportid); 16073 return 0; 16074 16075 nla_put_failure: 16076 nlmsg_free(msg); 16077 return -ENOBUFS; 16078 } 16079 EXPORT_SYMBOL(cfg80211_external_auth_request); 16080 16081 /* initialisation/exit functions */ 16082 16083 int __init nl80211_init(void) 16084 { 16085 int err; 16086 16087 err = genl_register_family(&nl80211_fam); 16088 if (err) 16089 return err; 16090 16091 err = netlink_register_notifier(&nl80211_netlink_notifier); 16092 if (err) 16093 goto err_out; 16094 16095 return 0; 16096 err_out: 16097 genl_unregister_family(&nl80211_fam); 16098 return err; 16099 } 16100 16101 void nl80211_exit(void) 16102 { 16103 netlink_unregister_notifier(&nl80211_netlink_notifier); 16104 genl_unregister_family(&nl80211_fam); 16105 } 16106