1 /* 2 * This is the new netlink-based wireless configuration interface. 3 * 4 * Copyright 2006-2010 Johannes Berg <johannes@sipsolutions.net> 5 * Copyright 2013-2014 Intel Mobile Communications GmbH 6 * Copyright 2015-2017 Intel Deutschland GmbH 7 */ 8 9 #include <linux/if.h> 10 #include <linux/module.h> 11 #include <linux/err.h> 12 #include <linux/slab.h> 13 #include <linux/list.h> 14 #include <linux/if_ether.h> 15 #include <linux/ieee80211.h> 16 #include <linux/nl80211.h> 17 #include <linux/rtnetlink.h> 18 #include <linux/netlink.h> 19 #include <linux/etherdevice.h> 20 #include <net/net_namespace.h> 21 #include <net/genetlink.h> 22 #include <net/cfg80211.h> 23 #include <net/sock.h> 24 #include <net/inet_connection_sock.h> 25 #include "core.h" 26 #include "nl80211.h" 27 #include "reg.h" 28 #include "rdev-ops.h" 29 30 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev, 31 struct genl_info *info, 32 struct cfg80211_crypto_settings *settings, 33 int cipher_limit); 34 35 /* the netlink family */ 36 static struct genl_family nl80211_fam; 37 38 /* multicast groups */ 39 enum nl80211_multicast_groups { 40 NL80211_MCGRP_CONFIG, 41 NL80211_MCGRP_SCAN, 42 NL80211_MCGRP_REGULATORY, 43 NL80211_MCGRP_MLME, 44 NL80211_MCGRP_VENDOR, 45 NL80211_MCGRP_NAN, 46 NL80211_MCGRP_TESTMODE /* keep last - ifdef! */ 47 }; 48 49 static const struct genl_multicast_group nl80211_mcgrps[] = { 50 [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG }, 51 [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN }, 52 [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG }, 53 [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME }, 54 [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR }, 55 [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN }, 56 #ifdef CONFIG_NL80211_TESTMODE 57 [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE } 58 #endif 59 }; 60 61 /* returns ERR_PTR values */ 62 static struct wireless_dev * 63 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs) 64 { 65 struct cfg80211_registered_device *rdev; 66 struct wireless_dev *result = NULL; 67 bool have_ifidx = attrs[NL80211_ATTR_IFINDEX]; 68 bool have_wdev_id = attrs[NL80211_ATTR_WDEV]; 69 u64 wdev_id; 70 int wiphy_idx = -1; 71 int ifidx = -1; 72 73 ASSERT_RTNL(); 74 75 if (!have_ifidx && !have_wdev_id) 76 return ERR_PTR(-EINVAL); 77 78 if (have_ifidx) 79 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]); 80 if (have_wdev_id) { 81 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]); 82 wiphy_idx = wdev_id >> 32; 83 } 84 85 list_for_each_entry(rdev, &cfg80211_rdev_list, list) { 86 struct wireless_dev *wdev; 87 88 if (wiphy_net(&rdev->wiphy) != netns) 89 continue; 90 91 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx) 92 continue; 93 94 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { 95 if (have_ifidx && wdev->netdev && 96 wdev->netdev->ifindex == ifidx) { 97 result = wdev; 98 break; 99 } 100 if (have_wdev_id && wdev->identifier == (u32)wdev_id) { 101 result = wdev; 102 break; 103 } 104 } 105 106 if (result) 107 break; 108 } 109 110 if (result) 111 return result; 112 return ERR_PTR(-ENODEV); 113 } 114 115 static struct cfg80211_registered_device * 116 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs) 117 { 118 struct cfg80211_registered_device *rdev = NULL, *tmp; 119 struct net_device *netdev; 120 121 ASSERT_RTNL(); 122 123 if (!attrs[NL80211_ATTR_WIPHY] && 124 !attrs[NL80211_ATTR_IFINDEX] && 125 !attrs[NL80211_ATTR_WDEV]) 126 return ERR_PTR(-EINVAL); 127 128 if (attrs[NL80211_ATTR_WIPHY]) 129 rdev = cfg80211_rdev_by_wiphy_idx( 130 nla_get_u32(attrs[NL80211_ATTR_WIPHY])); 131 132 if (attrs[NL80211_ATTR_WDEV]) { 133 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]); 134 struct wireless_dev *wdev; 135 bool found = false; 136 137 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32); 138 if (tmp) { 139 /* make sure wdev exists */ 140 list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) { 141 if (wdev->identifier != (u32)wdev_id) 142 continue; 143 found = true; 144 break; 145 } 146 147 if (!found) 148 tmp = NULL; 149 150 if (rdev && tmp != rdev) 151 return ERR_PTR(-EINVAL); 152 rdev = tmp; 153 } 154 } 155 156 if (attrs[NL80211_ATTR_IFINDEX]) { 157 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]); 158 159 netdev = __dev_get_by_index(netns, ifindex); 160 if (netdev) { 161 if (netdev->ieee80211_ptr) 162 tmp = wiphy_to_rdev( 163 netdev->ieee80211_ptr->wiphy); 164 else 165 tmp = NULL; 166 167 /* not wireless device -- return error */ 168 if (!tmp) 169 return ERR_PTR(-EINVAL); 170 171 /* mismatch -- return error */ 172 if (rdev && tmp != rdev) 173 return ERR_PTR(-EINVAL); 174 175 rdev = tmp; 176 } 177 } 178 179 if (!rdev) 180 return ERR_PTR(-ENODEV); 181 182 if (netns != wiphy_net(&rdev->wiphy)) 183 return ERR_PTR(-ENODEV); 184 185 return rdev; 186 } 187 188 /* 189 * This function returns a pointer to the driver 190 * that the genl_info item that is passed refers to. 191 * 192 * The result of this can be a PTR_ERR and hence must 193 * be checked with IS_ERR() for errors. 194 */ 195 static struct cfg80211_registered_device * 196 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info) 197 { 198 return __cfg80211_rdev_from_attrs(netns, info->attrs); 199 } 200 201 /* policy for the attributes */ 202 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { 203 [NL80211_ATTR_WIPHY] = { .type = NLA_U32 }, 204 [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING, 205 .len = 20-1 }, 206 [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED }, 207 208 [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 }, 209 [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 }, 210 [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 }, 211 [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 }, 212 [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 }, 213 214 [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 }, 215 [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 }, 216 [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 }, 217 [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 }, 218 [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 }, 219 [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG }, 220 221 [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 }, 222 [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 }, 223 [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 }, 224 225 [NL80211_ATTR_MAC] = { .len = ETH_ALEN }, 226 [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN }, 227 228 [NL80211_ATTR_KEY] = { .type = NLA_NESTED, }, 229 [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY, 230 .len = WLAN_MAX_KEY_LEN }, 231 [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 }, 232 [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 }, 233 [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG }, 234 [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 }, 235 [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 }, 236 237 [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 }, 238 [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 }, 239 [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY, 240 .len = IEEE80211_MAX_DATA_LEN }, 241 [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY, 242 .len = IEEE80211_MAX_DATA_LEN }, 243 [NL80211_ATTR_STA_AID] = { .type = NLA_U16 }, 244 [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED }, 245 [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 }, 246 [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY, 247 .len = NL80211_MAX_SUPP_RATES }, 248 [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 }, 249 [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 }, 250 [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ }, 251 [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY, 252 .len = IEEE80211_MAX_MESH_ID_LEN }, 253 [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 }, 254 255 [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 }, 256 [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED }, 257 258 [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 }, 259 [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 }, 260 [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 }, 261 [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY, 262 .len = NL80211_MAX_SUPP_RATES }, 263 [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 }, 264 265 [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED }, 266 [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG }, 267 268 [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN }, 269 270 [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 }, 271 [NL80211_ATTR_IE] = { .type = NLA_BINARY, 272 .len = IEEE80211_MAX_DATA_LEN }, 273 [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED }, 274 [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED }, 275 276 [NL80211_ATTR_SSID] = { .type = NLA_BINARY, 277 .len = IEEE80211_MAX_SSID_LEN }, 278 [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 }, 279 [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 }, 280 [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG }, 281 [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG }, 282 [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 }, 283 [NL80211_ATTR_STA_FLAGS2] = { 284 .len = sizeof(struct nl80211_sta_flag_update), 285 }, 286 [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG }, 287 [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 }, 288 [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG }, 289 [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG }, 290 [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 }, 291 [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 }, 292 [NL80211_ATTR_PID] = { .type = NLA_U32 }, 293 [NL80211_ATTR_4ADDR] = { .type = NLA_U8 }, 294 [NL80211_ATTR_PMKID] = { .type = NLA_BINARY, 295 .len = WLAN_PMKID_LEN }, 296 [NL80211_ATTR_DURATION] = { .type = NLA_U32 }, 297 [NL80211_ATTR_COOKIE] = { .type = NLA_U64 }, 298 [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED }, 299 [NL80211_ATTR_FRAME] = { .type = NLA_BINARY, 300 .len = IEEE80211_MAX_DATA_LEN }, 301 [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, }, 302 [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 }, 303 [NL80211_ATTR_CQM] = { .type = NLA_NESTED, }, 304 [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG }, 305 [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 }, 306 [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 }, 307 [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 }, 308 [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 }, 309 [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 }, 310 [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 }, 311 [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 }, 312 [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG }, 313 [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED }, 314 [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED }, 315 [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 }, 316 [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 }, 317 [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED }, 318 [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED }, 319 [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 }, 320 [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY, 321 .len = IEEE80211_MAX_DATA_LEN }, 322 [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY, 323 .len = IEEE80211_MAX_DATA_LEN }, 324 [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG }, 325 [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED }, 326 [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG }, 327 [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 }, 328 [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 }, 329 [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 }, 330 [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG }, 331 [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG }, 332 [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG }, 333 [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG }, 334 [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY, 335 .len = IEEE80211_MAX_DATA_LEN }, 336 [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 }, 337 [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG }, 338 [NL80211_ATTR_HT_CAPABILITY_MASK] = { 339 .len = NL80211_HT_CAPABILITY_LEN 340 }, 341 [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 }, 342 [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 }, 343 [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 }, 344 [NL80211_ATTR_WDEV] = { .type = NLA_U64 }, 345 [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 }, 346 [NL80211_ATTR_AUTH_DATA] = { .type = NLA_BINARY, }, 347 [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN }, 348 [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 }, 349 [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 }, 350 [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 }, 351 [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 }, 352 [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED }, 353 [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 }, 354 [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, }, 355 [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, }, 356 [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG }, 357 [NL80211_ATTR_VHT_CAPABILITY_MASK] = { 358 .len = NL80211_VHT_CAPABILITY_LEN, 359 }, 360 [NL80211_ATTR_MDID] = { .type = NLA_U16 }, 361 [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY, 362 .len = IEEE80211_MAX_DATA_LEN }, 363 [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 }, 364 [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 }, 365 [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG }, 366 [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED }, 367 [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY }, 368 [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY }, 369 [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY }, 370 [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY }, 371 [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG }, 372 [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 }, 373 [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 }, 374 [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 }, 375 [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY }, 376 [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY, 377 .len = IEEE80211_QOS_MAP_LEN_MAX }, 378 [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN }, 379 [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 }, 380 [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 }, 381 [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG }, 382 [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY }, 383 [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG }, 384 [NL80211_ATTR_TSID] = { .type = NLA_U8 }, 385 [NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 }, 386 [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 }, 387 [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 }, 388 [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN }, 389 [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG }, 390 [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 }, 391 [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 }, 392 [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG }, 393 [NL80211_ATTR_PBSS] = { .type = NLA_FLAG }, 394 [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED }, 395 [NL80211_ATTR_STA_SUPPORT_P2P_PS] = { .type = NLA_U8 }, 396 [NL80211_ATTR_MU_MIMO_GROUP_DATA] = { 397 .len = VHT_MUMIMO_GROUPS_DATA_LEN 398 }, 399 [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = { .len = ETH_ALEN }, 400 [NL80211_ATTR_NAN_MASTER_PREF] = { .type = NLA_U8 }, 401 [NL80211_ATTR_BANDS] = { .type = NLA_U32 }, 402 [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED }, 403 [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY, 404 .len = FILS_MAX_KEK_LEN }, 405 [NL80211_ATTR_FILS_NONCES] = { .len = 2 * FILS_NONCE_LEN }, 406 [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, }, 407 [NL80211_ATTR_BSSID] = { .len = ETH_ALEN }, 408 [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 }, 409 [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = { 410 .len = sizeof(struct nl80211_bss_select_rssi_adjust) 411 }, 412 [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 }, 413 [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY, 414 .len = FILS_ERP_MAX_USERNAME_LEN }, 415 [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY, 416 .len = FILS_ERP_MAX_REALM_LEN }, 417 [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 }, 418 [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY, 419 .len = FILS_ERP_MAX_RRK_LEN }, 420 [NL80211_ATTR_FILS_CACHE_ID] = { .len = 2 }, 421 [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN }, 422 [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG }, 423 }; 424 425 /* policy for the key attributes */ 426 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = { 427 [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN }, 428 [NL80211_KEY_IDX] = { .type = NLA_U8 }, 429 [NL80211_KEY_CIPHER] = { .type = NLA_U32 }, 430 [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 }, 431 [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG }, 432 [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG }, 433 [NL80211_KEY_TYPE] = { .type = NLA_U32 }, 434 [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED }, 435 }; 436 437 /* policy for the key default flags */ 438 static const struct nla_policy 439 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = { 440 [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG }, 441 [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG }, 442 }; 443 444 #ifdef CONFIG_PM 445 /* policy for WoWLAN attributes */ 446 static const struct nla_policy 447 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = { 448 [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG }, 449 [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG }, 450 [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG }, 451 [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED }, 452 [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG }, 453 [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG }, 454 [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG }, 455 [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG }, 456 [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED }, 457 [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED }, 458 }; 459 460 static const struct nla_policy 461 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = { 462 [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 }, 463 [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 }, 464 [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN }, 465 [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 }, 466 [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 }, 467 [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 }, 468 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = { 469 .len = sizeof(struct nl80211_wowlan_tcp_data_seq) 470 }, 471 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = { 472 .len = sizeof(struct nl80211_wowlan_tcp_data_token) 473 }, 474 [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 }, 475 [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 }, 476 [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 }, 477 }; 478 #endif /* CONFIG_PM */ 479 480 /* policy for coalesce rule attributes */ 481 static const struct nla_policy 482 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = { 483 [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 }, 484 [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 }, 485 [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED }, 486 }; 487 488 /* policy for GTK rekey offload attributes */ 489 static const struct nla_policy 490 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = { 491 [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN }, 492 [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN }, 493 [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN }, 494 }; 495 496 static const struct nla_policy 497 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = { 498 [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY, 499 .len = IEEE80211_MAX_SSID_LEN }, 500 [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = { .len = ETH_ALEN }, 501 [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 }, 502 }; 503 504 static const struct nla_policy 505 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = { 506 [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 }, 507 [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 }, 508 }; 509 510 static const struct nla_policy 511 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = { 512 [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG }, 513 [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 }, 514 [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = { 515 .len = sizeof(struct nl80211_bss_select_rssi_adjust) 516 }, 517 }; 518 519 /* policy for NAN function attributes */ 520 static const struct nla_policy 521 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = { 522 [NL80211_NAN_FUNC_TYPE] = { .type = NLA_U8 }, 523 [NL80211_NAN_FUNC_SERVICE_ID] = { .type = NLA_BINARY, 524 .len = NL80211_NAN_FUNC_SERVICE_ID_LEN }, 525 [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 }, 526 [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG }, 527 [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG }, 528 [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 }, 529 [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 }, 530 [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = { .len = ETH_ALEN }, 531 [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG }, 532 [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 }, 533 [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY, 534 .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN }, 535 [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED }, 536 [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED }, 537 [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED }, 538 [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 }, 539 [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 }, 540 }; 541 542 /* policy for Service Response Filter attributes */ 543 static const struct nla_policy 544 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = { 545 [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG }, 546 [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY, 547 .len = NL80211_NAN_FUNC_SRF_MAX_LEN }, 548 [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 }, 549 [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED }, 550 }; 551 552 static int nl80211_prepare_wdev_dump(struct sk_buff *skb, 553 struct netlink_callback *cb, 554 struct cfg80211_registered_device **rdev, 555 struct wireless_dev **wdev) 556 { 557 int err; 558 559 if (!cb->args[0]) { 560 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, 561 genl_family_attrbuf(&nl80211_fam), 562 nl80211_fam.maxattr, nl80211_policy, NULL); 563 if (err) 564 return err; 565 566 *wdev = __cfg80211_wdev_from_attrs( 567 sock_net(skb->sk), 568 genl_family_attrbuf(&nl80211_fam)); 569 if (IS_ERR(*wdev)) 570 return PTR_ERR(*wdev); 571 *rdev = wiphy_to_rdev((*wdev)->wiphy); 572 /* 0 is the first index - add 1 to parse only once */ 573 cb->args[0] = (*rdev)->wiphy_idx + 1; 574 cb->args[1] = (*wdev)->identifier; 575 } else { 576 /* subtract the 1 again here */ 577 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1); 578 struct wireless_dev *tmp; 579 580 if (!wiphy) 581 return -ENODEV; 582 *rdev = wiphy_to_rdev(wiphy); 583 *wdev = NULL; 584 585 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) { 586 if (tmp->identifier == cb->args[1]) { 587 *wdev = tmp; 588 break; 589 } 590 } 591 592 if (!*wdev) 593 return -ENODEV; 594 } 595 596 return 0; 597 } 598 599 /* IE validation */ 600 static bool is_valid_ie_attr(const struct nlattr *attr) 601 { 602 const u8 *pos; 603 int len; 604 605 if (!attr) 606 return true; 607 608 pos = nla_data(attr); 609 len = nla_len(attr); 610 611 while (len) { 612 u8 elemlen; 613 614 if (len < 2) 615 return false; 616 len -= 2; 617 618 elemlen = pos[1]; 619 if (elemlen > len) 620 return false; 621 622 len -= elemlen; 623 pos += 2 + elemlen; 624 } 625 626 return true; 627 } 628 629 /* message building helper */ 630 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq, 631 int flags, u8 cmd) 632 { 633 /* since there is no private header just add the generic one */ 634 return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd); 635 } 636 637 static int nl80211_msg_put_channel(struct sk_buff *msg, 638 struct ieee80211_channel *chan, 639 bool large) 640 { 641 /* Some channels must be completely excluded from the 642 * list to protect old user-space tools from breaking 643 */ 644 if (!large && chan->flags & 645 (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ)) 646 return 0; 647 648 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ, 649 chan->center_freq)) 650 goto nla_put_failure; 651 652 if ((chan->flags & IEEE80211_CHAN_DISABLED) && 653 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED)) 654 goto nla_put_failure; 655 if (chan->flags & IEEE80211_CHAN_NO_IR) { 656 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR)) 657 goto nla_put_failure; 658 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS)) 659 goto nla_put_failure; 660 } 661 if (chan->flags & IEEE80211_CHAN_RADAR) { 662 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR)) 663 goto nla_put_failure; 664 if (large) { 665 u32 time; 666 667 time = elapsed_jiffies_msecs(chan->dfs_state_entered); 668 669 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE, 670 chan->dfs_state)) 671 goto nla_put_failure; 672 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME, 673 time)) 674 goto nla_put_failure; 675 if (nla_put_u32(msg, 676 NL80211_FREQUENCY_ATTR_DFS_CAC_TIME, 677 chan->dfs_cac_ms)) 678 goto nla_put_failure; 679 } 680 } 681 682 if (large) { 683 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) && 684 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS)) 685 goto nla_put_failure; 686 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) && 687 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS)) 688 goto nla_put_failure; 689 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) && 690 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ)) 691 goto nla_put_failure; 692 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) && 693 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ)) 694 goto nla_put_failure; 695 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) && 696 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY)) 697 goto nla_put_failure; 698 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) && 699 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT)) 700 goto nla_put_failure; 701 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) && 702 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ)) 703 goto nla_put_failure; 704 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) && 705 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ)) 706 goto nla_put_failure; 707 } 708 709 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER, 710 DBM_TO_MBM(chan->max_power))) 711 goto nla_put_failure; 712 713 return 0; 714 715 nla_put_failure: 716 return -ENOBUFS; 717 } 718 719 /* netlink command implementations */ 720 721 struct key_parse { 722 struct key_params p; 723 int idx; 724 int type; 725 bool def, defmgmt; 726 bool def_uni, def_multi; 727 }; 728 729 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k) 730 { 731 struct nlattr *tb[NL80211_KEY_MAX + 1]; 732 int err = nla_parse_nested(tb, NL80211_KEY_MAX, key, 733 nl80211_key_policy, NULL); 734 if (err) 735 return err; 736 737 k->def = !!tb[NL80211_KEY_DEFAULT]; 738 k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT]; 739 740 if (k->def) { 741 k->def_uni = true; 742 k->def_multi = true; 743 } 744 if (k->defmgmt) 745 k->def_multi = true; 746 747 if (tb[NL80211_KEY_IDX]) 748 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]); 749 750 if (tb[NL80211_KEY_DATA]) { 751 k->p.key = nla_data(tb[NL80211_KEY_DATA]); 752 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]); 753 } 754 755 if (tb[NL80211_KEY_SEQ]) { 756 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]); 757 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]); 758 } 759 760 if (tb[NL80211_KEY_CIPHER]) 761 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]); 762 763 if (tb[NL80211_KEY_TYPE]) { 764 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]); 765 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES) 766 return -EINVAL; 767 } 768 769 if (tb[NL80211_KEY_DEFAULT_TYPES]) { 770 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES]; 771 772 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1, 773 tb[NL80211_KEY_DEFAULT_TYPES], 774 nl80211_key_default_policy, NULL); 775 if (err) 776 return err; 777 778 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST]; 779 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST]; 780 } 781 782 return 0; 783 } 784 785 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k) 786 { 787 if (info->attrs[NL80211_ATTR_KEY_DATA]) { 788 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]); 789 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]); 790 } 791 792 if (info->attrs[NL80211_ATTR_KEY_SEQ]) { 793 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]); 794 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]); 795 } 796 797 if (info->attrs[NL80211_ATTR_KEY_IDX]) 798 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]); 799 800 if (info->attrs[NL80211_ATTR_KEY_CIPHER]) 801 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]); 802 803 k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT]; 804 k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT]; 805 806 if (k->def) { 807 k->def_uni = true; 808 k->def_multi = true; 809 } 810 if (k->defmgmt) 811 k->def_multi = true; 812 813 if (info->attrs[NL80211_ATTR_KEY_TYPE]) { 814 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]); 815 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES) 816 return -EINVAL; 817 } 818 819 if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) { 820 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES]; 821 int err = nla_parse_nested(kdt, 822 NUM_NL80211_KEY_DEFAULT_TYPES - 1, 823 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES], 824 nl80211_key_default_policy, 825 info->extack); 826 if (err) 827 return err; 828 829 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST]; 830 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST]; 831 } 832 833 return 0; 834 } 835 836 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k) 837 { 838 int err; 839 840 memset(k, 0, sizeof(*k)); 841 k->idx = -1; 842 k->type = -1; 843 844 if (info->attrs[NL80211_ATTR_KEY]) 845 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k); 846 else 847 err = nl80211_parse_key_old(info, k); 848 849 if (err) 850 return err; 851 852 if (k->def && k->defmgmt) 853 return -EINVAL; 854 855 if (k->defmgmt) { 856 if (k->def_uni || !k->def_multi) 857 return -EINVAL; 858 } 859 860 if (k->idx != -1) { 861 if (k->defmgmt) { 862 if (k->idx < 4 || k->idx > 5) 863 return -EINVAL; 864 } else if (k->def) { 865 if (k->idx < 0 || k->idx > 3) 866 return -EINVAL; 867 } else { 868 if (k->idx < 0 || k->idx > 5) 869 return -EINVAL; 870 } 871 } 872 873 return 0; 874 } 875 876 static struct cfg80211_cached_keys * 877 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev, 878 struct nlattr *keys, bool *no_ht) 879 { 880 struct key_parse parse; 881 struct nlattr *key; 882 struct cfg80211_cached_keys *result; 883 int rem, err, def = 0; 884 bool have_key = false; 885 886 nla_for_each_nested(key, keys, rem) { 887 have_key = true; 888 break; 889 } 890 891 if (!have_key) 892 return NULL; 893 894 result = kzalloc(sizeof(*result), GFP_KERNEL); 895 if (!result) 896 return ERR_PTR(-ENOMEM); 897 898 result->def = -1; 899 900 nla_for_each_nested(key, keys, rem) { 901 memset(&parse, 0, sizeof(parse)); 902 parse.idx = -1; 903 904 err = nl80211_parse_key_new(key, &parse); 905 if (err) 906 goto error; 907 err = -EINVAL; 908 if (!parse.p.key) 909 goto error; 910 if (parse.idx < 0 || parse.idx > 3) 911 goto error; 912 if (parse.def) { 913 if (def) 914 goto error; 915 def = 1; 916 result->def = parse.idx; 917 if (!parse.def_uni || !parse.def_multi) 918 goto error; 919 } else if (parse.defmgmt) 920 goto error; 921 err = cfg80211_validate_key_settings(rdev, &parse.p, 922 parse.idx, false, NULL); 923 if (err) 924 goto error; 925 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 && 926 parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) { 927 err = -EINVAL; 928 goto error; 929 } 930 result->params[parse.idx].cipher = parse.p.cipher; 931 result->params[parse.idx].key_len = parse.p.key_len; 932 result->params[parse.idx].key = result->data[parse.idx]; 933 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len); 934 935 /* must be WEP key if we got here */ 936 if (no_ht) 937 *no_ht = true; 938 } 939 940 if (result->def < 0) { 941 err = -EINVAL; 942 goto error; 943 } 944 945 return result; 946 error: 947 kfree(result); 948 return ERR_PTR(err); 949 } 950 951 static int nl80211_key_allowed(struct wireless_dev *wdev) 952 { 953 ASSERT_WDEV_LOCK(wdev); 954 955 switch (wdev->iftype) { 956 case NL80211_IFTYPE_AP: 957 case NL80211_IFTYPE_AP_VLAN: 958 case NL80211_IFTYPE_P2P_GO: 959 case NL80211_IFTYPE_MESH_POINT: 960 break; 961 case NL80211_IFTYPE_ADHOC: 962 case NL80211_IFTYPE_STATION: 963 case NL80211_IFTYPE_P2P_CLIENT: 964 if (!wdev->current_bss) 965 return -ENOLINK; 966 break; 967 case NL80211_IFTYPE_UNSPECIFIED: 968 case NL80211_IFTYPE_OCB: 969 case NL80211_IFTYPE_MONITOR: 970 case NL80211_IFTYPE_NAN: 971 case NL80211_IFTYPE_P2P_DEVICE: 972 case NL80211_IFTYPE_WDS: 973 case NUM_NL80211_IFTYPES: 974 return -EINVAL; 975 } 976 977 return 0; 978 } 979 980 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy, 981 struct nlattr *tb) 982 { 983 struct ieee80211_channel *chan; 984 985 if (tb == NULL) 986 return NULL; 987 chan = ieee80211_get_channel(wiphy, nla_get_u32(tb)); 988 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) 989 return NULL; 990 return chan; 991 } 992 993 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes) 994 { 995 struct nlattr *nl_modes = nla_nest_start(msg, attr); 996 int i; 997 998 if (!nl_modes) 999 goto nla_put_failure; 1000 1001 i = 0; 1002 while (ifmodes) { 1003 if ((ifmodes & 1) && nla_put_flag(msg, i)) 1004 goto nla_put_failure; 1005 ifmodes >>= 1; 1006 i++; 1007 } 1008 1009 nla_nest_end(msg, nl_modes); 1010 return 0; 1011 1012 nla_put_failure: 1013 return -ENOBUFS; 1014 } 1015 1016 static int nl80211_put_iface_combinations(struct wiphy *wiphy, 1017 struct sk_buff *msg, 1018 bool large) 1019 { 1020 struct nlattr *nl_combis; 1021 int i, j; 1022 1023 nl_combis = nla_nest_start(msg, 1024 NL80211_ATTR_INTERFACE_COMBINATIONS); 1025 if (!nl_combis) 1026 goto nla_put_failure; 1027 1028 for (i = 0; i < wiphy->n_iface_combinations; i++) { 1029 const struct ieee80211_iface_combination *c; 1030 struct nlattr *nl_combi, *nl_limits; 1031 1032 c = &wiphy->iface_combinations[i]; 1033 1034 nl_combi = nla_nest_start(msg, i + 1); 1035 if (!nl_combi) 1036 goto nla_put_failure; 1037 1038 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS); 1039 if (!nl_limits) 1040 goto nla_put_failure; 1041 1042 for (j = 0; j < c->n_limits; j++) { 1043 struct nlattr *nl_limit; 1044 1045 nl_limit = nla_nest_start(msg, j + 1); 1046 if (!nl_limit) 1047 goto nla_put_failure; 1048 if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX, 1049 c->limits[j].max)) 1050 goto nla_put_failure; 1051 if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES, 1052 c->limits[j].types)) 1053 goto nla_put_failure; 1054 nla_nest_end(msg, nl_limit); 1055 } 1056 1057 nla_nest_end(msg, nl_limits); 1058 1059 if (c->beacon_int_infra_match && 1060 nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH)) 1061 goto nla_put_failure; 1062 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS, 1063 c->num_different_channels) || 1064 nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM, 1065 c->max_interfaces)) 1066 goto nla_put_failure; 1067 if (large && 1068 (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS, 1069 c->radar_detect_widths) || 1070 nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS, 1071 c->radar_detect_regions))) 1072 goto nla_put_failure; 1073 if (c->beacon_int_min_gcd && 1074 nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD, 1075 c->beacon_int_min_gcd)) 1076 goto nla_put_failure; 1077 1078 nla_nest_end(msg, nl_combi); 1079 } 1080 1081 nla_nest_end(msg, nl_combis); 1082 1083 return 0; 1084 nla_put_failure: 1085 return -ENOBUFS; 1086 } 1087 1088 #ifdef CONFIG_PM 1089 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev, 1090 struct sk_buff *msg) 1091 { 1092 const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp; 1093 struct nlattr *nl_tcp; 1094 1095 if (!tcp) 1096 return 0; 1097 1098 nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION); 1099 if (!nl_tcp) 1100 return -ENOBUFS; 1101 1102 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD, 1103 tcp->data_payload_max)) 1104 return -ENOBUFS; 1105 1106 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD, 1107 tcp->data_payload_max)) 1108 return -ENOBUFS; 1109 1110 if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ)) 1111 return -ENOBUFS; 1112 1113 if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN, 1114 sizeof(*tcp->tok), tcp->tok)) 1115 return -ENOBUFS; 1116 1117 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL, 1118 tcp->data_interval_max)) 1119 return -ENOBUFS; 1120 1121 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD, 1122 tcp->wake_payload_max)) 1123 return -ENOBUFS; 1124 1125 nla_nest_end(msg, nl_tcp); 1126 return 0; 1127 } 1128 1129 static int nl80211_send_wowlan(struct sk_buff *msg, 1130 struct cfg80211_registered_device *rdev, 1131 bool large) 1132 { 1133 struct nlattr *nl_wowlan; 1134 1135 if (!rdev->wiphy.wowlan) 1136 return 0; 1137 1138 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED); 1139 if (!nl_wowlan) 1140 return -ENOBUFS; 1141 1142 if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) && 1143 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) || 1144 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) && 1145 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) || 1146 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) && 1147 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) || 1148 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) && 1149 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) || 1150 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) && 1151 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) || 1152 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) && 1153 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) || 1154 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) && 1155 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) || 1156 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) && 1157 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))) 1158 return -ENOBUFS; 1159 1160 if (rdev->wiphy.wowlan->n_patterns) { 1161 struct nl80211_pattern_support pat = { 1162 .max_patterns = rdev->wiphy.wowlan->n_patterns, 1163 .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len, 1164 .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len, 1165 .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset, 1166 }; 1167 1168 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN, 1169 sizeof(pat), &pat)) 1170 return -ENOBUFS; 1171 } 1172 1173 if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) && 1174 nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT, 1175 rdev->wiphy.wowlan->max_nd_match_sets)) 1176 return -ENOBUFS; 1177 1178 if (large && nl80211_send_wowlan_tcp_caps(rdev, msg)) 1179 return -ENOBUFS; 1180 1181 nla_nest_end(msg, nl_wowlan); 1182 1183 return 0; 1184 } 1185 #endif 1186 1187 static int nl80211_send_coalesce(struct sk_buff *msg, 1188 struct cfg80211_registered_device *rdev) 1189 { 1190 struct nl80211_coalesce_rule_support rule; 1191 1192 if (!rdev->wiphy.coalesce) 1193 return 0; 1194 1195 rule.max_rules = rdev->wiphy.coalesce->n_rules; 1196 rule.max_delay = rdev->wiphy.coalesce->max_delay; 1197 rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns; 1198 rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len; 1199 rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len; 1200 rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset; 1201 1202 if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule)) 1203 return -ENOBUFS; 1204 1205 return 0; 1206 } 1207 1208 static int nl80211_send_band_rateinfo(struct sk_buff *msg, 1209 struct ieee80211_supported_band *sband) 1210 { 1211 struct nlattr *nl_rates, *nl_rate; 1212 struct ieee80211_rate *rate; 1213 int i; 1214 1215 /* add HT info */ 1216 if (sband->ht_cap.ht_supported && 1217 (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET, 1218 sizeof(sband->ht_cap.mcs), 1219 &sband->ht_cap.mcs) || 1220 nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA, 1221 sband->ht_cap.cap) || 1222 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR, 1223 sband->ht_cap.ampdu_factor) || 1224 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY, 1225 sband->ht_cap.ampdu_density))) 1226 return -ENOBUFS; 1227 1228 /* add VHT info */ 1229 if (sband->vht_cap.vht_supported && 1230 (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET, 1231 sizeof(sband->vht_cap.vht_mcs), 1232 &sband->vht_cap.vht_mcs) || 1233 nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA, 1234 sband->vht_cap.cap))) 1235 return -ENOBUFS; 1236 1237 /* add bitrates */ 1238 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES); 1239 if (!nl_rates) 1240 return -ENOBUFS; 1241 1242 for (i = 0; i < sband->n_bitrates; i++) { 1243 nl_rate = nla_nest_start(msg, i); 1244 if (!nl_rate) 1245 return -ENOBUFS; 1246 1247 rate = &sband->bitrates[i]; 1248 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE, 1249 rate->bitrate)) 1250 return -ENOBUFS; 1251 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) && 1252 nla_put_flag(msg, 1253 NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE)) 1254 return -ENOBUFS; 1255 1256 nla_nest_end(msg, nl_rate); 1257 } 1258 1259 nla_nest_end(msg, nl_rates); 1260 1261 return 0; 1262 } 1263 1264 static int 1265 nl80211_send_mgmt_stypes(struct sk_buff *msg, 1266 const struct ieee80211_txrx_stypes *mgmt_stypes) 1267 { 1268 u16 stypes; 1269 struct nlattr *nl_ftypes, *nl_ifs; 1270 enum nl80211_iftype ift; 1271 int i; 1272 1273 if (!mgmt_stypes) 1274 return 0; 1275 1276 nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES); 1277 if (!nl_ifs) 1278 return -ENOBUFS; 1279 1280 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) { 1281 nl_ftypes = nla_nest_start(msg, ift); 1282 if (!nl_ftypes) 1283 return -ENOBUFS; 1284 i = 0; 1285 stypes = mgmt_stypes[ift].tx; 1286 while (stypes) { 1287 if ((stypes & 1) && 1288 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE, 1289 (i << 4) | IEEE80211_FTYPE_MGMT)) 1290 return -ENOBUFS; 1291 stypes >>= 1; 1292 i++; 1293 } 1294 nla_nest_end(msg, nl_ftypes); 1295 } 1296 1297 nla_nest_end(msg, nl_ifs); 1298 1299 nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES); 1300 if (!nl_ifs) 1301 return -ENOBUFS; 1302 1303 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) { 1304 nl_ftypes = nla_nest_start(msg, ift); 1305 if (!nl_ftypes) 1306 return -ENOBUFS; 1307 i = 0; 1308 stypes = mgmt_stypes[ift].rx; 1309 while (stypes) { 1310 if ((stypes & 1) && 1311 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE, 1312 (i << 4) | IEEE80211_FTYPE_MGMT)) 1313 return -ENOBUFS; 1314 stypes >>= 1; 1315 i++; 1316 } 1317 nla_nest_end(msg, nl_ftypes); 1318 } 1319 nla_nest_end(msg, nl_ifs); 1320 1321 return 0; 1322 } 1323 1324 #define CMD(op, n) \ 1325 do { \ 1326 if (rdev->ops->op) { \ 1327 i++; \ 1328 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \ 1329 goto nla_put_failure; \ 1330 } \ 1331 } while (0) 1332 1333 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev, 1334 struct sk_buff *msg) 1335 { 1336 int i = 0; 1337 1338 /* 1339 * do *NOT* add anything into this function, new things need to be 1340 * advertised only to new versions of userspace that can deal with 1341 * the split (and they can't possibly care about new features... 1342 */ 1343 CMD(add_virtual_intf, NEW_INTERFACE); 1344 CMD(change_virtual_intf, SET_INTERFACE); 1345 CMD(add_key, NEW_KEY); 1346 CMD(start_ap, START_AP); 1347 CMD(add_station, NEW_STATION); 1348 CMD(add_mpath, NEW_MPATH); 1349 CMD(update_mesh_config, SET_MESH_CONFIG); 1350 CMD(change_bss, SET_BSS); 1351 CMD(auth, AUTHENTICATE); 1352 CMD(assoc, ASSOCIATE); 1353 CMD(deauth, DEAUTHENTICATE); 1354 CMD(disassoc, DISASSOCIATE); 1355 CMD(join_ibss, JOIN_IBSS); 1356 CMD(join_mesh, JOIN_MESH); 1357 CMD(set_pmksa, SET_PMKSA); 1358 CMD(del_pmksa, DEL_PMKSA); 1359 CMD(flush_pmksa, FLUSH_PMKSA); 1360 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) 1361 CMD(remain_on_channel, REMAIN_ON_CHANNEL); 1362 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK); 1363 CMD(mgmt_tx, FRAME); 1364 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL); 1365 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) { 1366 i++; 1367 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS)) 1368 goto nla_put_failure; 1369 } 1370 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap || 1371 rdev->ops->join_mesh) { 1372 i++; 1373 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL)) 1374 goto nla_put_failure; 1375 } 1376 CMD(set_wds_peer, SET_WDS_PEER); 1377 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) { 1378 CMD(tdls_mgmt, TDLS_MGMT); 1379 CMD(tdls_oper, TDLS_OPER); 1380 } 1381 if (rdev->wiphy.max_sched_scan_reqs) 1382 CMD(sched_scan_start, START_SCHED_SCAN); 1383 CMD(probe_client, PROBE_CLIENT); 1384 CMD(set_noack_map, SET_NOACK_MAP); 1385 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) { 1386 i++; 1387 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS)) 1388 goto nla_put_failure; 1389 } 1390 CMD(start_p2p_device, START_P2P_DEVICE); 1391 CMD(set_mcast_rate, SET_MCAST_RATE); 1392 #ifdef CONFIG_NL80211_TESTMODE 1393 CMD(testmode_cmd, TESTMODE); 1394 #endif 1395 1396 if (rdev->ops->connect || rdev->ops->auth) { 1397 i++; 1398 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT)) 1399 goto nla_put_failure; 1400 } 1401 1402 if (rdev->ops->disconnect || rdev->ops->deauth) { 1403 i++; 1404 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT)) 1405 goto nla_put_failure; 1406 } 1407 1408 return i; 1409 nla_put_failure: 1410 return -ENOBUFS; 1411 } 1412 1413 struct nl80211_dump_wiphy_state { 1414 s64 filter_wiphy; 1415 long start; 1416 long split_start, band_start, chan_start, capa_start; 1417 bool split; 1418 }; 1419 1420 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev, 1421 enum nl80211_commands cmd, 1422 struct sk_buff *msg, u32 portid, u32 seq, 1423 int flags, struct nl80211_dump_wiphy_state *state) 1424 { 1425 void *hdr; 1426 struct nlattr *nl_bands, *nl_band; 1427 struct nlattr *nl_freqs, *nl_freq; 1428 struct nlattr *nl_cmds; 1429 enum nl80211_band band; 1430 struct ieee80211_channel *chan; 1431 int i; 1432 const struct ieee80211_txrx_stypes *mgmt_stypes = 1433 rdev->wiphy.mgmt_stypes; 1434 u32 features; 1435 1436 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 1437 if (!hdr) 1438 return -ENOBUFS; 1439 1440 if (WARN_ON(!state)) 1441 return -EINVAL; 1442 1443 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 1444 nla_put_string(msg, NL80211_ATTR_WIPHY_NAME, 1445 wiphy_name(&rdev->wiphy)) || 1446 nla_put_u32(msg, NL80211_ATTR_GENERATION, 1447 cfg80211_rdev_list_generation)) 1448 goto nla_put_failure; 1449 1450 if (cmd != NL80211_CMD_NEW_WIPHY) 1451 goto finish; 1452 1453 switch (state->split_start) { 1454 case 0: 1455 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT, 1456 rdev->wiphy.retry_short) || 1457 nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG, 1458 rdev->wiphy.retry_long) || 1459 nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD, 1460 rdev->wiphy.frag_threshold) || 1461 nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD, 1462 rdev->wiphy.rts_threshold) || 1463 nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS, 1464 rdev->wiphy.coverage_class) || 1465 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS, 1466 rdev->wiphy.max_scan_ssids) || 1467 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS, 1468 rdev->wiphy.max_sched_scan_ssids) || 1469 nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN, 1470 rdev->wiphy.max_scan_ie_len) || 1471 nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN, 1472 rdev->wiphy.max_sched_scan_ie_len) || 1473 nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS, 1474 rdev->wiphy.max_match_sets) || 1475 nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS, 1476 rdev->wiphy.max_sched_scan_plans) || 1477 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL, 1478 rdev->wiphy.max_sched_scan_plan_interval) || 1479 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS, 1480 rdev->wiphy.max_sched_scan_plan_iterations)) 1481 goto nla_put_failure; 1482 1483 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) && 1484 nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN)) 1485 goto nla_put_failure; 1486 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) && 1487 nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH)) 1488 goto nla_put_failure; 1489 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) && 1490 nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD)) 1491 goto nla_put_failure; 1492 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) && 1493 nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT)) 1494 goto nla_put_failure; 1495 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) && 1496 nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT)) 1497 goto nla_put_failure; 1498 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) && 1499 nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP)) 1500 goto nla_put_failure; 1501 state->split_start++; 1502 if (state->split) 1503 break; 1504 case 1: 1505 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES, 1506 sizeof(u32) * rdev->wiphy.n_cipher_suites, 1507 rdev->wiphy.cipher_suites)) 1508 goto nla_put_failure; 1509 1510 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS, 1511 rdev->wiphy.max_num_pmkids)) 1512 goto nla_put_failure; 1513 1514 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) && 1515 nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE)) 1516 goto nla_put_failure; 1517 1518 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX, 1519 rdev->wiphy.available_antennas_tx) || 1520 nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX, 1521 rdev->wiphy.available_antennas_rx)) 1522 goto nla_put_failure; 1523 1524 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) && 1525 nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD, 1526 rdev->wiphy.probe_resp_offload)) 1527 goto nla_put_failure; 1528 1529 if ((rdev->wiphy.available_antennas_tx || 1530 rdev->wiphy.available_antennas_rx) && 1531 rdev->ops->get_antenna) { 1532 u32 tx_ant = 0, rx_ant = 0; 1533 int res; 1534 1535 res = rdev_get_antenna(rdev, &tx_ant, &rx_ant); 1536 if (!res) { 1537 if (nla_put_u32(msg, 1538 NL80211_ATTR_WIPHY_ANTENNA_TX, 1539 tx_ant) || 1540 nla_put_u32(msg, 1541 NL80211_ATTR_WIPHY_ANTENNA_RX, 1542 rx_ant)) 1543 goto nla_put_failure; 1544 } 1545 } 1546 1547 state->split_start++; 1548 if (state->split) 1549 break; 1550 case 2: 1551 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES, 1552 rdev->wiphy.interface_modes)) 1553 goto nla_put_failure; 1554 state->split_start++; 1555 if (state->split) 1556 break; 1557 case 3: 1558 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS); 1559 if (!nl_bands) 1560 goto nla_put_failure; 1561 1562 for (band = state->band_start; 1563 band < NUM_NL80211_BANDS; band++) { 1564 struct ieee80211_supported_band *sband; 1565 1566 sband = rdev->wiphy.bands[band]; 1567 1568 if (!sband) 1569 continue; 1570 1571 nl_band = nla_nest_start(msg, band); 1572 if (!nl_band) 1573 goto nla_put_failure; 1574 1575 switch (state->chan_start) { 1576 case 0: 1577 if (nl80211_send_band_rateinfo(msg, sband)) 1578 goto nla_put_failure; 1579 state->chan_start++; 1580 if (state->split) 1581 break; 1582 default: 1583 /* add frequencies */ 1584 nl_freqs = nla_nest_start( 1585 msg, NL80211_BAND_ATTR_FREQS); 1586 if (!nl_freqs) 1587 goto nla_put_failure; 1588 1589 for (i = state->chan_start - 1; 1590 i < sband->n_channels; 1591 i++) { 1592 nl_freq = nla_nest_start(msg, i); 1593 if (!nl_freq) 1594 goto nla_put_failure; 1595 1596 chan = &sband->channels[i]; 1597 1598 if (nl80211_msg_put_channel( 1599 msg, chan, 1600 state->split)) 1601 goto nla_put_failure; 1602 1603 nla_nest_end(msg, nl_freq); 1604 if (state->split) 1605 break; 1606 } 1607 if (i < sband->n_channels) 1608 state->chan_start = i + 2; 1609 else 1610 state->chan_start = 0; 1611 nla_nest_end(msg, nl_freqs); 1612 } 1613 1614 nla_nest_end(msg, nl_band); 1615 1616 if (state->split) { 1617 /* start again here */ 1618 if (state->chan_start) 1619 band--; 1620 break; 1621 } 1622 } 1623 nla_nest_end(msg, nl_bands); 1624 1625 if (band < NUM_NL80211_BANDS) 1626 state->band_start = band + 1; 1627 else 1628 state->band_start = 0; 1629 1630 /* if bands & channels are done, continue outside */ 1631 if (state->band_start == 0 && state->chan_start == 0) 1632 state->split_start++; 1633 if (state->split) 1634 break; 1635 case 4: 1636 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS); 1637 if (!nl_cmds) 1638 goto nla_put_failure; 1639 1640 i = nl80211_add_commands_unsplit(rdev, msg); 1641 if (i < 0) 1642 goto nla_put_failure; 1643 if (state->split) { 1644 CMD(crit_proto_start, CRIT_PROTOCOL_START); 1645 CMD(crit_proto_stop, CRIT_PROTOCOL_STOP); 1646 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH) 1647 CMD(channel_switch, CHANNEL_SWITCH); 1648 CMD(set_qos_map, SET_QOS_MAP); 1649 if (rdev->wiphy.features & 1650 NL80211_FEATURE_SUPPORTS_WMM_ADMISSION) 1651 CMD(add_tx_ts, ADD_TX_TS); 1652 CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST); 1653 CMD(update_connect_params, UPDATE_CONNECT_PARAMS); 1654 } 1655 #undef CMD 1656 1657 nla_nest_end(msg, nl_cmds); 1658 state->split_start++; 1659 if (state->split) 1660 break; 1661 case 5: 1662 if (rdev->ops->remain_on_channel && 1663 (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) && 1664 nla_put_u32(msg, 1665 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION, 1666 rdev->wiphy.max_remain_on_channel_duration)) 1667 goto nla_put_failure; 1668 1669 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) && 1670 nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK)) 1671 goto nla_put_failure; 1672 1673 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes)) 1674 goto nla_put_failure; 1675 state->split_start++; 1676 if (state->split) 1677 break; 1678 case 6: 1679 #ifdef CONFIG_PM 1680 if (nl80211_send_wowlan(msg, rdev, state->split)) 1681 goto nla_put_failure; 1682 state->split_start++; 1683 if (state->split) 1684 break; 1685 #else 1686 state->split_start++; 1687 #endif 1688 case 7: 1689 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES, 1690 rdev->wiphy.software_iftypes)) 1691 goto nla_put_failure; 1692 1693 if (nl80211_put_iface_combinations(&rdev->wiphy, msg, 1694 state->split)) 1695 goto nla_put_failure; 1696 1697 state->split_start++; 1698 if (state->split) 1699 break; 1700 case 8: 1701 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) && 1702 nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME, 1703 rdev->wiphy.ap_sme_capa)) 1704 goto nla_put_failure; 1705 1706 features = rdev->wiphy.features; 1707 /* 1708 * We can only add the per-channel limit information if the 1709 * dump is split, otherwise it makes it too big. Therefore 1710 * only advertise it in that case. 1711 */ 1712 if (state->split) 1713 features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS; 1714 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features)) 1715 goto nla_put_failure; 1716 1717 if (rdev->wiphy.ht_capa_mod_mask && 1718 nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK, 1719 sizeof(*rdev->wiphy.ht_capa_mod_mask), 1720 rdev->wiphy.ht_capa_mod_mask)) 1721 goto nla_put_failure; 1722 1723 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME && 1724 rdev->wiphy.max_acl_mac_addrs && 1725 nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX, 1726 rdev->wiphy.max_acl_mac_addrs)) 1727 goto nla_put_failure; 1728 1729 /* 1730 * Any information below this point is only available to 1731 * applications that can deal with it being split. This 1732 * helps ensure that newly added capabilities don't break 1733 * older tools by overrunning their buffers. 1734 * 1735 * We still increment split_start so that in the split 1736 * case we'll continue with more data in the next round, 1737 * but break unconditionally so unsplit data stops here. 1738 */ 1739 state->split_start++; 1740 break; 1741 case 9: 1742 if (rdev->wiphy.extended_capabilities && 1743 (nla_put(msg, NL80211_ATTR_EXT_CAPA, 1744 rdev->wiphy.extended_capabilities_len, 1745 rdev->wiphy.extended_capabilities) || 1746 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK, 1747 rdev->wiphy.extended_capabilities_len, 1748 rdev->wiphy.extended_capabilities_mask))) 1749 goto nla_put_failure; 1750 1751 if (rdev->wiphy.vht_capa_mod_mask && 1752 nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK, 1753 sizeof(*rdev->wiphy.vht_capa_mod_mask), 1754 rdev->wiphy.vht_capa_mod_mask)) 1755 goto nla_put_failure; 1756 1757 state->split_start++; 1758 break; 1759 case 10: 1760 if (nl80211_send_coalesce(msg, rdev)) 1761 goto nla_put_failure; 1762 1763 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) && 1764 (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) || 1765 nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ))) 1766 goto nla_put_failure; 1767 1768 if (rdev->wiphy.max_ap_assoc_sta && 1769 nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA, 1770 rdev->wiphy.max_ap_assoc_sta)) 1771 goto nla_put_failure; 1772 1773 state->split_start++; 1774 break; 1775 case 11: 1776 if (rdev->wiphy.n_vendor_commands) { 1777 const struct nl80211_vendor_cmd_info *info; 1778 struct nlattr *nested; 1779 1780 nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA); 1781 if (!nested) 1782 goto nla_put_failure; 1783 1784 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) { 1785 info = &rdev->wiphy.vendor_commands[i].info; 1786 if (nla_put(msg, i + 1, sizeof(*info), info)) 1787 goto nla_put_failure; 1788 } 1789 nla_nest_end(msg, nested); 1790 } 1791 1792 if (rdev->wiphy.n_vendor_events) { 1793 const struct nl80211_vendor_cmd_info *info; 1794 struct nlattr *nested; 1795 1796 nested = nla_nest_start(msg, 1797 NL80211_ATTR_VENDOR_EVENTS); 1798 if (!nested) 1799 goto nla_put_failure; 1800 1801 for (i = 0; i < rdev->wiphy.n_vendor_events; i++) { 1802 info = &rdev->wiphy.vendor_events[i]; 1803 if (nla_put(msg, i + 1, sizeof(*info), info)) 1804 goto nla_put_failure; 1805 } 1806 nla_nest_end(msg, nested); 1807 } 1808 state->split_start++; 1809 break; 1810 case 12: 1811 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH && 1812 nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS, 1813 rdev->wiphy.max_num_csa_counters)) 1814 goto nla_put_failure; 1815 1816 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED && 1817 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG)) 1818 goto nla_put_failure; 1819 1820 if (rdev->wiphy.max_sched_scan_reqs && 1821 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS, 1822 rdev->wiphy.max_sched_scan_reqs)) 1823 goto nla_put_failure; 1824 1825 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES, 1826 sizeof(rdev->wiphy.ext_features), 1827 rdev->wiphy.ext_features)) 1828 goto nla_put_failure; 1829 1830 if (rdev->wiphy.bss_select_support) { 1831 struct nlattr *nested; 1832 u32 bss_select_support = rdev->wiphy.bss_select_support; 1833 1834 nested = nla_nest_start(msg, NL80211_ATTR_BSS_SELECT); 1835 if (!nested) 1836 goto nla_put_failure; 1837 1838 i = 0; 1839 while (bss_select_support) { 1840 if ((bss_select_support & 1) && 1841 nla_put_flag(msg, i)) 1842 goto nla_put_failure; 1843 i++; 1844 bss_select_support >>= 1; 1845 } 1846 nla_nest_end(msg, nested); 1847 } 1848 1849 state->split_start++; 1850 break; 1851 case 13: 1852 if (rdev->wiphy.num_iftype_ext_capab && 1853 rdev->wiphy.iftype_ext_capab) { 1854 struct nlattr *nested_ext_capab, *nested; 1855 1856 nested = nla_nest_start(msg, 1857 NL80211_ATTR_IFTYPE_EXT_CAPA); 1858 if (!nested) 1859 goto nla_put_failure; 1860 1861 for (i = state->capa_start; 1862 i < rdev->wiphy.num_iftype_ext_capab; i++) { 1863 const struct wiphy_iftype_ext_capab *capab; 1864 1865 capab = &rdev->wiphy.iftype_ext_capab[i]; 1866 1867 nested_ext_capab = nla_nest_start(msg, i); 1868 if (!nested_ext_capab || 1869 nla_put_u32(msg, NL80211_ATTR_IFTYPE, 1870 capab->iftype) || 1871 nla_put(msg, NL80211_ATTR_EXT_CAPA, 1872 capab->extended_capabilities_len, 1873 capab->extended_capabilities) || 1874 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK, 1875 capab->extended_capabilities_len, 1876 capab->extended_capabilities_mask)) 1877 goto nla_put_failure; 1878 1879 nla_nest_end(msg, nested_ext_capab); 1880 if (state->split) 1881 break; 1882 } 1883 nla_nest_end(msg, nested); 1884 if (i < rdev->wiphy.num_iftype_ext_capab) { 1885 state->capa_start = i + 1; 1886 break; 1887 } 1888 } 1889 1890 if (nla_put_u32(msg, NL80211_ATTR_BANDS, 1891 rdev->wiphy.nan_supported_bands)) 1892 goto nla_put_failure; 1893 1894 /* done */ 1895 state->split_start = 0; 1896 break; 1897 } 1898 finish: 1899 genlmsg_end(msg, hdr); 1900 return 0; 1901 1902 nla_put_failure: 1903 genlmsg_cancel(msg, hdr); 1904 return -EMSGSIZE; 1905 } 1906 1907 static int nl80211_dump_wiphy_parse(struct sk_buff *skb, 1908 struct netlink_callback *cb, 1909 struct nl80211_dump_wiphy_state *state) 1910 { 1911 struct nlattr **tb = genl_family_attrbuf(&nl80211_fam); 1912 int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, tb, 1913 nl80211_fam.maxattr, nl80211_policy, NULL); 1914 /* ignore parse errors for backward compatibility */ 1915 if (ret) 1916 return 0; 1917 1918 state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP]; 1919 if (tb[NL80211_ATTR_WIPHY]) 1920 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]); 1921 if (tb[NL80211_ATTR_WDEV]) 1922 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32; 1923 if (tb[NL80211_ATTR_IFINDEX]) { 1924 struct net_device *netdev; 1925 struct cfg80211_registered_device *rdev; 1926 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]); 1927 1928 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx); 1929 if (!netdev) 1930 return -ENODEV; 1931 if (netdev->ieee80211_ptr) { 1932 rdev = wiphy_to_rdev( 1933 netdev->ieee80211_ptr->wiphy); 1934 state->filter_wiphy = rdev->wiphy_idx; 1935 } 1936 } 1937 1938 return 0; 1939 } 1940 1941 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb) 1942 { 1943 int idx = 0, ret; 1944 struct nl80211_dump_wiphy_state *state = (void *)cb->args[0]; 1945 struct cfg80211_registered_device *rdev; 1946 1947 rtnl_lock(); 1948 if (!state) { 1949 state = kzalloc(sizeof(*state), GFP_KERNEL); 1950 if (!state) { 1951 rtnl_unlock(); 1952 return -ENOMEM; 1953 } 1954 state->filter_wiphy = -1; 1955 ret = nl80211_dump_wiphy_parse(skb, cb, state); 1956 if (ret) { 1957 kfree(state); 1958 rtnl_unlock(); 1959 return ret; 1960 } 1961 cb->args[0] = (long)state; 1962 } 1963 1964 list_for_each_entry(rdev, &cfg80211_rdev_list, list) { 1965 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk))) 1966 continue; 1967 if (++idx <= state->start) 1968 continue; 1969 if (state->filter_wiphy != -1 && 1970 state->filter_wiphy != rdev->wiphy_idx) 1971 continue; 1972 /* attempt to fit multiple wiphy data chunks into the skb */ 1973 do { 1974 ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, 1975 skb, 1976 NETLINK_CB(cb->skb).portid, 1977 cb->nlh->nlmsg_seq, 1978 NLM_F_MULTI, state); 1979 if (ret < 0) { 1980 /* 1981 * If sending the wiphy data didn't fit (ENOBUFS 1982 * or EMSGSIZE returned), this SKB is still 1983 * empty (so it's not too big because another 1984 * wiphy dataset is already in the skb) and 1985 * we've not tried to adjust the dump allocation 1986 * yet ... then adjust the alloc size to be 1987 * bigger, and return 1 but with the empty skb. 1988 * This results in an empty message being RX'ed 1989 * in userspace, but that is ignored. 1990 * 1991 * We can then retry with the larger buffer. 1992 */ 1993 if ((ret == -ENOBUFS || ret == -EMSGSIZE) && 1994 !skb->len && !state->split && 1995 cb->min_dump_alloc < 4096) { 1996 cb->min_dump_alloc = 4096; 1997 state->split_start = 0; 1998 rtnl_unlock(); 1999 return 1; 2000 } 2001 idx--; 2002 break; 2003 } 2004 } while (state->split_start > 0); 2005 break; 2006 } 2007 rtnl_unlock(); 2008 2009 state->start = idx; 2010 2011 return skb->len; 2012 } 2013 2014 static int nl80211_dump_wiphy_done(struct netlink_callback *cb) 2015 { 2016 kfree((void *)cb->args[0]); 2017 return 0; 2018 } 2019 2020 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info) 2021 { 2022 struct sk_buff *msg; 2023 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 2024 struct nl80211_dump_wiphy_state state = {}; 2025 2026 msg = nlmsg_new(4096, GFP_KERNEL); 2027 if (!msg) 2028 return -ENOMEM; 2029 2030 if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg, 2031 info->snd_portid, info->snd_seq, 0, 2032 &state) < 0) { 2033 nlmsg_free(msg); 2034 return -ENOBUFS; 2035 } 2036 2037 return genlmsg_reply(msg, info); 2038 } 2039 2040 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = { 2041 [NL80211_TXQ_ATTR_QUEUE] = { .type = NLA_U8 }, 2042 [NL80211_TXQ_ATTR_TXOP] = { .type = NLA_U16 }, 2043 [NL80211_TXQ_ATTR_CWMIN] = { .type = NLA_U16 }, 2044 [NL80211_TXQ_ATTR_CWMAX] = { .type = NLA_U16 }, 2045 [NL80211_TXQ_ATTR_AIFS] = { .type = NLA_U8 }, 2046 }; 2047 2048 static int parse_txq_params(struct nlattr *tb[], 2049 struct ieee80211_txq_params *txq_params) 2050 { 2051 if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] || 2052 !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] || 2053 !tb[NL80211_TXQ_ATTR_AIFS]) 2054 return -EINVAL; 2055 2056 txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]); 2057 txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]); 2058 txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]); 2059 txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]); 2060 txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]); 2061 2062 if (txq_params->ac >= NL80211_NUM_ACS) 2063 return -EINVAL; 2064 2065 return 0; 2066 } 2067 2068 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev) 2069 { 2070 /* 2071 * You can only set the channel explicitly for WDS interfaces, 2072 * all others have their channel managed via their respective 2073 * "establish a connection" command (connect, join, ...) 2074 * 2075 * For AP/GO and mesh mode, the channel can be set with the 2076 * channel userspace API, but is only stored and passed to the 2077 * low-level driver when the AP starts or the mesh is joined. 2078 * This is for backward compatibility, userspace can also give 2079 * the channel in the start-ap or join-mesh commands instead. 2080 * 2081 * Monitors are special as they are normally slaved to 2082 * whatever else is going on, so they have their own special 2083 * operation to set the monitor channel if possible. 2084 */ 2085 return !wdev || 2086 wdev->iftype == NL80211_IFTYPE_AP || 2087 wdev->iftype == NL80211_IFTYPE_MESH_POINT || 2088 wdev->iftype == NL80211_IFTYPE_MONITOR || 2089 wdev->iftype == NL80211_IFTYPE_P2P_GO; 2090 } 2091 2092 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev, 2093 struct genl_info *info, 2094 struct cfg80211_chan_def *chandef) 2095 { 2096 u32 control_freq; 2097 2098 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ]) 2099 return -EINVAL; 2100 2101 control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]); 2102 2103 chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq); 2104 chandef->width = NL80211_CHAN_WIDTH_20_NOHT; 2105 chandef->center_freq1 = control_freq; 2106 chandef->center_freq2 = 0; 2107 2108 /* Primary channel not allowed */ 2109 if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED) 2110 return -EINVAL; 2111 2112 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) { 2113 enum nl80211_channel_type chantype; 2114 2115 chantype = nla_get_u32( 2116 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]); 2117 2118 switch (chantype) { 2119 case NL80211_CHAN_NO_HT: 2120 case NL80211_CHAN_HT20: 2121 case NL80211_CHAN_HT40PLUS: 2122 case NL80211_CHAN_HT40MINUS: 2123 cfg80211_chandef_create(chandef, chandef->chan, 2124 chantype); 2125 break; 2126 default: 2127 return -EINVAL; 2128 } 2129 } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) { 2130 chandef->width = 2131 nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]); 2132 if (info->attrs[NL80211_ATTR_CENTER_FREQ1]) 2133 chandef->center_freq1 = 2134 nla_get_u32( 2135 info->attrs[NL80211_ATTR_CENTER_FREQ1]); 2136 if (info->attrs[NL80211_ATTR_CENTER_FREQ2]) 2137 chandef->center_freq2 = 2138 nla_get_u32( 2139 info->attrs[NL80211_ATTR_CENTER_FREQ2]); 2140 } 2141 2142 if (!cfg80211_chandef_valid(chandef)) 2143 return -EINVAL; 2144 2145 if (!cfg80211_chandef_usable(&rdev->wiphy, chandef, 2146 IEEE80211_CHAN_DISABLED)) 2147 return -EINVAL; 2148 2149 if ((chandef->width == NL80211_CHAN_WIDTH_5 || 2150 chandef->width == NL80211_CHAN_WIDTH_10) && 2151 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) 2152 return -EINVAL; 2153 2154 return 0; 2155 } 2156 2157 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev, 2158 struct net_device *dev, 2159 struct genl_info *info) 2160 { 2161 struct cfg80211_chan_def chandef; 2162 int result; 2163 enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR; 2164 struct wireless_dev *wdev = NULL; 2165 2166 if (dev) 2167 wdev = dev->ieee80211_ptr; 2168 if (!nl80211_can_set_dev_channel(wdev)) 2169 return -EOPNOTSUPP; 2170 if (wdev) 2171 iftype = wdev->iftype; 2172 2173 result = nl80211_parse_chandef(rdev, info, &chandef); 2174 if (result) 2175 return result; 2176 2177 switch (iftype) { 2178 case NL80211_IFTYPE_AP: 2179 case NL80211_IFTYPE_P2P_GO: 2180 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef, 2181 iftype)) { 2182 result = -EINVAL; 2183 break; 2184 } 2185 if (wdev->beacon_interval) { 2186 if (!dev || !rdev->ops->set_ap_chanwidth || 2187 !(rdev->wiphy.features & 2188 NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) { 2189 result = -EBUSY; 2190 break; 2191 } 2192 2193 /* Only allow dynamic channel width changes */ 2194 if (chandef.chan != wdev->preset_chandef.chan) { 2195 result = -EBUSY; 2196 break; 2197 } 2198 result = rdev_set_ap_chanwidth(rdev, dev, &chandef); 2199 if (result) 2200 break; 2201 } 2202 wdev->preset_chandef = chandef; 2203 result = 0; 2204 break; 2205 case NL80211_IFTYPE_MESH_POINT: 2206 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef); 2207 break; 2208 case NL80211_IFTYPE_MONITOR: 2209 result = cfg80211_set_monitor_channel(rdev, &chandef); 2210 break; 2211 default: 2212 result = -EINVAL; 2213 } 2214 2215 return result; 2216 } 2217 2218 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info) 2219 { 2220 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 2221 struct net_device *netdev = info->user_ptr[1]; 2222 2223 return __nl80211_set_channel(rdev, netdev, info); 2224 } 2225 2226 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info) 2227 { 2228 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 2229 struct net_device *dev = info->user_ptr[1]; 2230 struct wireless_dev *wdev = dev->ieee80211_ptr; 2231 const u8 *bssid; 2232 2233 if (!info->attrs[NL80211_ATTR_MAC]) 2234 return -EINVAL; 2235 2236 if (netif_running(dev)) 2237 return -EBUSY; 2238 2239 if (!rdev->ops->set_wds_peer) 2240 return -EOPNOTSUPP; 2241 2242 if (wdev->iftype != NL80211_IFTYPE_WDS) 2243 return -EOPNOTSUPP; 2244 2245 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 2246 return rdev_set_wds_peer(rdev, dev, bssid); 2247 } 2248 2249 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info) 2250 { 2251 struct cfg80211_registered_device *rdev; 2252 struct net_device *netdev = NULL; 2253 struct wireless_dev *wdev; 2254 int result = 0, rem_txq_params = 0; 2255 struct nlattr *nl_txq_params; 2256 u32 changed; 2257 u8 retry_short = 0, retry_long = 0; 2258 u32 frag_threshold = 0, rts_threshold = 0; 2259 u8 coverage_class = 0; 2260 2261 ASSERT_RTNL(); 2262 2263 /* 2264 * Try to find the wiphy and netdev. Normally this 2265 * function shouldn't need the netdev, but this is 2266 * done for backward compatibility -- previously 2267 * setting the channel was done per wiphy, but now 2268 * it is per netdev. Previous userland like hostapd 2269 * also passed a netdev to set_wiphy, so that it is 2270 * possible to let that go to the right netdev! 2271 */ 2272 2273 if (info->attrs[NL80211_ATTR_IFINDEX]) { 2274 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]); 2275 2276 netdev = __dev_get_by_index(genl_info_net(info), ifindex); 2277 if (netdev && netdev->ieee80211_ptr) 2278 rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy); 2279 else 2280 netdev = NULL; 2281 } 2282 2283 if (!netdev) { 2284 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info), 2285 info->attrs); 2286 if (IS_ERR(rdev)) 2287 return PTR_ERR(rdev); 2288 wdev = NULL; 2289 netdev = NULL; 2290 result = 0; 2291 } else 2292 wdev = netdev->ieee80211_ptr; 2293 2294 /* 2295 * end workaround code, by now the rdev is available 2296 * and locked, and wdev may or may not be NULL. 2297 */ 2298 2299 if (info->attrs[NL80211_ATTR_WIPHY_NAME]) 2300 result = cfg80211_dev_rename( 2301 rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME])); 2302 2303 if (result) 2304 return result; 2305 2306 if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) { 2307 struct ieee80211_txq_params txq_params; 2308 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1]; 2309 2310 if (!rdev->ops->set_txq_params) 2311 return -EOPNOTSUPP; 2312 2313 if (!netdev) 2314 return -EINVAL; 2315 2316 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 2317 netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 2318 return -EINVAL; 2319 2320 if (!netif_running(netdev)) 2321 return -ENETDOWN; 2322 2323 nla_for_each_nested(nl_txq_params, 2324 info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS], 2325 rem_txq_params) { 2326 result = nla_parse_nested(tb, NL80211_TXQ_ATTR_MAX, 2327 nl_txq_params, 2328 txq_params_policy, 2329 info->extack); 2330 if (result) 2331 return result; 2332 result = parse_txq_params(tb, &txq_params); 2333 if (result) 2334 return result; 2335 2336 result = rdev_set_txq_params(rdev, netdev, 2337 &txq_params); 2338 if (result) 2339 return result; 2340 } 2341 } 2342 2343 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 2344 result = __nl80211_set_channel( 2345 rdev, 2346 nl80211_can_set_dev_channel(wdev) ? netdev : NULL, 2347 info); 2348 if (result) 2349 return result; 2350 } 2351 2352 if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) { 2353 struct wireless_dev *txp_wdev = wdev; 2354 enum nl80211_tx_power_setting type; 2355 int idx, mbm = 0; 2356 2357 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER)) 2358 txp_wdev = NULL; 2359 2360 if (!rdev->ops->set_tx_power) 2361 return -EOPNOTSUPP; 2362 2363 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING; 2364 type = nla_get_u32(info->attrs[idx]); 2365 2366 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] && 2367 (type != NL80211_TX_POWER_AUTOMATIC)) 2368 return -EINVAL; 2369 2370 if (type != NL80211_TX_POWER_AUTOMATIC) { 2371 idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL; 2372 mbm = nla_get_u32(info->attrs[idx]); 2373 } 2374 2375 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm); 2376 if (result) 2377 return result; 2378 } 2379 2380 if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] && 2381 info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) { 2382 u32 tx_ant, rx_ant; 2383 2384 if ((!rdev->wiphy.available_antennas_tx && 2385 !rdev->wiphy.available_antennas_rx) || 2386 !rdev->ops->set_antenna) 2387 return -EOPNOTSUPP; 2388 2389 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]); 2390 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]); 2391 2392 /* reject antenna configurations which don't match the 2393 * available antenna masks, except for the "all" mask */ 2394 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) || 2395 (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) 2396 return -EINVAL; 2397 2398 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx; 2399 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx; 2400 2401 result = rdev_set_antenna(rdev, tx_ant, rx_ant); 2402 if (result) 2403 return result; 2404 } 2405 2406 changed = 0; 2407 2408 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) { 2409 retry_short = nla_get_u8( 2410 info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]); 2411 if (retry_short == 0) 2412 return -EINVAL; 2413 2414 changed |= WIPHY_PARAM_RETRY_SHORT; 2415 } 2416 2417 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) { 2418 retry_long = nla_get_u8( 2419 info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]); 2420 if (retry_long == 0) 2421 return -EINVAL; 2422 2423 changed |= WIPHY_PARAM_RETRY_LONG; 2424 } 2425 2426 if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) { 2427 frag_threshold = nla_get_u32( 2428 info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]); 2429 if (frag_threshold < 256) 2430 return -EINVAL; 2431 2432 if (frag_threshold != (u32) -1) { 2433 /* 2434 * Fragments (apart from the last one) are required to 2435 * have even length. Make the fragmentation code 2436 * simpler by stripping LSB should someone try to use 2437 * odd threshold value. 2438 */ 2439 frag_threshold &= ~0x1; 2440 } 2441 changed |= WIPHY_PARAM_FRAG_THRESHOLD; 2442 } 2443 2444 if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) { 2445 rts_threshold = nla_get_u32( 2446 info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]); 2447 changed |= WIPHY_PARAM_RTS_THRESHOLD; 2448 } 2449 2450 if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) { 2451 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) 2452 return -EINVAL; 2453 2454 coverage_class = nla_get_u8( 2455 info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]); 2456 changed |= WIPHY_PARAM_COVERAGE_CLASS; 2457 } 2458 2459 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) { 2460 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION)) 2461 return -EOPNOTSUPP; 2462 2463 changed |= WIPHY_PARAM_DYN_ACK; 2464 } 2465 2466 if (changed) { 2467 u8 old_retry_short, old_retry_long; 2468 u32 old_frag_threshold, old_rts_threshold; 2469 u8 old_coverage_class; 2470 2471 if (!rdev->ops->set_wiphy_params) 2472 return -EOPNOTSUPP; 2473 2474 old_retry_short = rdev->wiphy.retry_short; 2475 old_retry_long = rdev->wiphy.retry_long; 2476 old_frag_threshold = rdev->wiphy.frag_threshold; 2477 old_rts_threshold = rdev->wiphy.rts_threshold; 2478 old_coverage_class = rdev->wiphy.coverage_class; 2479 2480 if (changed & WIPHY_PARAM_RETRY_SHORT) 2481 rdev->wiphy.retry_short = retry_short; 2482 if (changed & WIPHY_PARAM_RETRY_LONG) 2483 rdev->wiphy.retry_long = retry_long; 2484 if (changed & WIPHY_PARAM_FRAG_THRESHOLD) 2485 rdev->wiphy.frag_threshold = frag_threshold; 2486 if (changed & WIPHY_PARAM_RTS_THRESHOLD) 2487 rdev->wiphy.rts_threshold = rts_threshold; 2488 if (changed & WIPHY_PARAM_COVERAGE_CLASS) 2489 rdev->wiphy.coverage_class = coverage_class; 2490 2491 result = rdev_set_wiphy_params(rdev, changed); 2492 if (result) { 2493 rdev->wiphy.retry_short = old_retry_short; 2494 rdev->wiphy.retry_long = old_retry_long; 2495 rdev->wiphy.frag_threshold = old_frag_threshold; 2496 rdev->wiphy.rts_threshold = old_rts_threshold; 2497 rdev->wiphy.coverage_class = old_coverage_class; 2498 return result; 2499 } 2500 } 2501 return 0; 2502 } 2503 2504 static inline u64 wdev_id(struct wireless_dev *wdev) 2505 { 2506 return (u64)wdev->identifier | 2507 ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32); 2508 } 2509 2510 static int nl80211_send_chandef(struct sk_buff *msg, 2511 const struct cfg80211_chan_def *chandef) 2512 { 2513 if (WARN_ON(!cfg80211_chandef_valid(chandef))) 2514 return -EINVAL; 2515 2516 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, 2517 chandef->chan->center_freq)) 2518 return -ENOBUFS; 2519 switch (chandef->width) { 2520 case NL80211_CHAN_WIDTH_20_NOHT: 2521 case NL80211_CHAN_WIDTH_20: 2522 case NL80211_CHAN_WIDTH_40: 2523 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, 2524 cfg80211_get_chandef_type(chandef))) 2525 return -ENOBUFS; 2526 break; 2527 default: 2528 break; 2529 } 2530 if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width)) 2531 return -ENOBUFS; 2532 if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1)) 2533 return -ENOBUFS; 2534 if (chandef->center_freq2 && 2535 nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2)) 2536 return -ENOBUFS; 2537 return 0; 2538 } 2539 2540 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags, 2541 struct cfg80211_registered_device *rdev, 2542 struct wireless_dev *wdev, bool removal) 2543 { 2544 struct net_device *dev = wdev->netdev; 2545 u8 cmd = NL80211_CMD_NEW_INTERFACE; 2546 void *hdr; 2547 2548 if (removal) 2549 cmd = NL80211_CMD_DEL_INTERFACE; 2550 2551 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 2552 if (!hdr) 2553 return -1; 2554 2555 if (dev && 2556 (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 2557 nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name))) 2558 goto nla_put_failure; 2559 2560 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 2561 nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) || 2562 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 2563 NL80211_ATTR_PAD) || 2564 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) || 2565 nla_put_u32(msg, NL80211_ATTR_GENERATION, 2566 rdev->devlist_generation ^ 2567 (cfg80211_rdev_list_generation << 2))) 2568 goto nla_put_failure; 2569 2570 if (rdev->ops->get_channel) { 2571 int ret; 2572 struct cfg80211_chan_def chandef; 2573 2574 ret = rdev_get_channel(rdev, wdev, &chandef); 2575 if (ret == 0) { 2576 if (nl80211_send_chandef(msg, &chandef)) 2577 goto nla_put_failure; 2578 } 2579 } 2580 2581 if (rdev->ops->get_tx_power) { 2582 int dbm, ret; 2583 2584 ret = rdev_get_tx_power(rdev, wdev, &dbm); 2585 if (ret == 0 && 2586 nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL, 2587 DBM_TO_MBM(dbm))) 2588 goto nla_put_failure; 2589 } 2590 2591 if (wdev->ssid_len) { 2592 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid)) 2593 goto nla_put_failure; 2594 } 2595 2596 genlmsg_end(msg, hdr); 2597 return 0; 2598 2599 nla_put_failure: 2600 genlmsg_cancel(msg, hdr); 2601 return -EMSGSIZE; 2602 } 2603 2604 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb) 2605 { 2606 int wp_idx = 0; 2607 int if_idx = 0; 2608 int wp_start = cb->args[0]; 2609 int if_start = cb->args[1]; 2610 int filter_wiphy = -1; 2611 struct cfg80211_registered_device *rdev; 2612 struct wireless_dev *wdev; 2613 int ret; 2614 2615 rtnl_lock(); 2616 if (!cb->args[2]) { 2617 struct nl80211_dump_wiphy_state state = { 2618 .filter_wiphy = -1, 2619 }; 2620 2621 ret = nl80211_dump_wiphy_parse(skb, cb, &state); 2622 if (ret) 2623 goto out_unlock; 2624 2625 filter_wiphy = state.filter_wiphy; 2626 2627 /* 2628 * if filtering, set cb->args[2] to +1 since 0 is the default 2629 * value needed to determine that parsing is necessary. 2630 */ 2631 if (filter_wiphy >= 0) 2632 cb->args[2] = filter_wiphy + 1; 2633 else 2634 cb->args[2] = -1; 2635 } else if (cb->args[2] > 0) { 2636 filter_wiphy = cb->args[2] - 1; 2637 } 2638 2639 list_for_each_entry(rdev, &cfg80211_rdev_list, list) { 2640 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk))) 2641 continue; 2642 if (wp_idx < wp_start) { 2643 wp_idx++; 2644 continue; 2645 } 2646 2647 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx) 2648 continue; 2649 2650 if_idx = 0; 2651 2652 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { 2653 if (if_idx < if_start) { 2654 if_idx++; 2655 continue; 2656 } 2657 if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid, 2658 cb->nlh->nlmsg_seq, NLM_F_MULTI, 2659 rdev, wdev, false) < 0) { 2660 goto out; 2661 } 2662 if_idx++; 2663 } 2664 2665 wp_idx++; 2666 } 2667 out: 2668 cb->args[0] = wp_idx; 2669 cb->args[1] = if_idx; 2670 2671 ret = skb->len; 2672 out_unlock: 2673 rtnl_unlock(); 2674 2675 return ret; 2676 } 2677 2678 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info) 2679 { 2680 struct sk_buff *msg; 2681 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 2682 struct wireless_dev *wdev = info->user_ptr[1]; 2683 2684 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 2685 if (!msg) 2686 return -ENOMEM; 2687 2688 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0, 2689 rdev, wdev, false) < 0) { 2690 nlmsg_free(msg); 2691 return -ENOBUFS; 2692 } 2693 2694 return genlmsg_reply(msg, info); 2695 } 2696 2697 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = { 2698 [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG }, 2699 [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG }, 2700 [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG }, 2701 [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG }, 2702 [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG }, 2703 [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG }, 2704 }; 2705 2706 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags) 2707 { 2708 struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1]; 2709 int flag; 2710 2711 *mntrflags = 0; 2712 2713 if (!nla) 2714 return -EINVAL; 2715 2716 if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX, nla, 2717 mntr_flags_policy, NULL)) 2718 return -EINVAL; 2719 2720 for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++) 2721 if (flags[flag]) 2722 *mntrflags |= (1<<flag); 2723 2724 *mntrflags |= MONITOR_FLAG_CHANGED; 2725 2726 return 0; 2727 } 2728 2729 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev, 2730 enum nl80211_iftype type, 2731 struct genl_info *info, 2732 struct vif_params *params) 2733 { 2734 bool change = false; 2735 int err; 2736 2737 if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) { 2738 if (type != NL80211_IFTYPE_MONITOR) 2739 return -EINVAL; 2740 2741 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS], 2742 ¶ms->flags); 2743 if (err) 2744 return err; 2745 2746 change = true; 2747 } 2748 2749 if (params->flags & MONITOR_FLAG_ACTIVE && 2750 !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR)) 2751 return -EOPNOTSUPP; 2752 2753 if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) { 2754 const u8 *mumimo_groups; 2755 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER; 2756 2757 if (type != NL80211_IFTYPE_MONITOR) 2758 return -EINVAL; 2759 2760 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag)) 2761 return -EOPNOTSUPP; 2762 2763 mumimo_groups = 2764 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]); 2765 2766 /* bits 0 and 63 are reserved and must be zero */ 2767 if ((mumimo_groups[0] & BIT(0)) || 2768 (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7))) 2769 return -EINVAL; 2770 2771 params->vht_mumimo_groups = mumimo_groups; 2772 change = true; 2773 } 2774 2775 if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) { 2776 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER; 2777 2778 if (type != NL80211_IFTYPE_MONITOR) 2779 return -EINVAL; 2780 2781 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag)) 2782 return -EOPNOTSUPP; 2783 2784 params->vht_mumimo_follow_addr = 2785 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]); 2786 change = true; 2787 } 2788 2789 return change ? 1 : 0; 2790 } 2791 2792 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev, 2793 struct net_device *netdev, u8 use_4addr, 2794 enum nl80211_iftype iftype) 2795 { 2796 if (!use_4addr) { 2797 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT)) 2798 return -EBUSY; 2799 return 0; 2800 } 2801 2802 switch (iftype) { 2803 case NL80211_IFTYPE_AP_VLAN: 2804 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP) 2805 return 0; 2806 break; 2807 case NL80211_IFTYPE_STATION: 2808 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION) 2809 return 0; 2810 break; 2811 default: 2812 break; 2813 } 2814 2815 return -EOPNOTSUPP; 2816 } 2817 2818 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info) 2819 { 2820 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 2821 struct vif_params params; 2822 int err; 2823 enum nl80211_iftype otype, ntype; 2824 struct net_device *dev = info->user_ptr[1]; 2825 bool change = false; 2826 2827 memset(¶ms, 0, sizeof(params)); 2828 2829 otype = ntype = dev->ieee80211_ptr->iftype; 2830 2831 if (info->attrs[NL80211_ATTR_IFTYPE]) { 2832 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]); 2833 if (otype != ntype) 2834 change = true; 2835 if (ntype > NL80211_IFTYPE_MAX) 2836 return -EINVAL; 2837 } 2838 2839 if (info->attrs[NL80211_ATTR_MESH_ID]) { 2840 struct wireless_dev *wdev = dev->ieee80211_ptr; 2841 2842 if (ntype != NL80211_IFTYPE_MESH_POINT) 2843 return -EINVAL; 2844 if (netif_running(dev)) 2845 return -EBUSY; 2846 2847 wdev_lock(wdev); 2848 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN != 2849 IEEE80211_MAX_MESH_ID_LEN); 2850 wdev->mesh_id_up_len = 2851 nla_len(info->attrs[NL80211_ATTR_MESH_ID]); 2852 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]), 2853 wdev->mesh_id_up_len); 2854 wdev_unlock(wdev); 2855 } 2856 2857 if (info->attrs[NL80211_ATTR_4ADDR]) { 2858 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]); 2859 change = true; 2860 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype); 2861 if (err) 2862 return err; 2863 } else { 2864 params.use_4addr = -1; 2865 } 2866 2867 err = nl80211_parse_mon_options(rdev, ntype, info, ¶ms); 2868 if (err < 0) 2869 return err; 2870 if (err > 0) 2871 change = true; 2872 2873 if (change) 2874 err = cfg80211_change_iface(rdev, dev, ntype, ¶ms); 2875 else 2876 err = 0; 2877 2878 if (!err && params.use_4addr != -1) 2879 dev->ieee80211_ptr->use_4addr = params.use_4addr; 2880 2881 return err; 2882 } 2883 2884 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info) 2885 { 2886 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 2887 struct vif_params params; 2888 struct wireless_dev *wdev; 2889 struct sk_buff *msg; 2890 int err; 2891 enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED; 2892 2893 /* to avoid failing a new interface creation due to pending removal */ 2894 cfg80211_destroy_ifaces(rdev); 2895 2896 memset(¶ms, 0, sizeof(params)); 2897 2898 if (!info->attrs[NL80211_ATTR_IFNAME]) 2899 return -EINVAL; 2900 2901 if (info->attrs[NL80211_ATTR_IFTYPE]) { 2902 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]); 2903 if (type > NL80211_IFTYPE_MAX) 2904 return -EINVAL; 2905 } 2906 2907 if (!rdev->ops->add_virtual_intf || 2908 !(rdev->wiphy.interface_modes & (1 << type))) 2909 return -EOPNOTSUPP; 2910 2911 if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN || 2912 rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) && 2913 info->attrs[NL80211_ATTR_MAC]) { 2914 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC], 2915 ETH_ALEN); 2916 if (!is_valid_ether_addr(params.macaddr)) 2917 return -EADDRNOTAVAIL; 2918 } 2919 2920 if (info->attrs[NL80211_ATTR_4ADDR]) { 2921 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]); 2922 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type); 2923 if (err) 2924 return err; 2925 } 2926 2927 err = nl80211_parse_mon_options(rdev, type, info, ¶ms); 2928 if (err < 0) 2929 return err; 2930 2931 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 2932 if (!msg) 2933 return -ENOMEM; 2934 2935 wdev = rdev_add_virtual_intf(rdev, 2936 nla_data(info->attrs[NL80211_ATTR_IFNAME]), 2937 NET_NAME_USER, type, ¶ms); 2938 if (WARN_ON(!wdev)) { 2939 nlmsg_free(msg); 2940 return -EPROTO; 2941 } else if (IS_ERR(wdev)) { 2942 nlmsg_free(msg); 2943 return PTR_ERR(wdev); 2944 } 2945 2946 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 2947 wdev->owner_nlportid = info->snd_portid; 2948 2949 switch (type) { 2950 case NL80211_IFTYPE_MESH_POINT: 2951 if (!info->attrs[NL80211_ATTR_MESH_ID]) 2952 break; 2953 wdev_lock(wdev); 2954 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN != 2955 IEEE80211_MAX_MESH_ID_LEN); 2956 wdev->mesh_id_up_len = 2957 nla_len(info->attrs[NL80211_ATTR_MESH_ID]); 2958 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]), 2959 wdev->mesh_id_up_len); 2960 wdev_unlock(wdev); 2961 break; 2962 case NL80211_IFTYPE_NAN: 2963 case NL80211_IFTYPE_P2P_DEVICE: 2964 /* 2965 * P2P Device and NAN do not have a netdev, so don't go 2966 * through the netdev notifier and must be added here 2967 */ 2968 mutex_init(&wdev->mtx); 2969 INIT_LIST_HEAD(&wdev->event_list); 2970 spin_lock_init(&wdev->event_lock); 2971 INIT_LIST_HEAD(&wdev->mgmt_registrations); 2972 spin_lock_init(&wdev->mgmt_registrations_lock); 2973 2974 wdev->identifier = ++rdev->wdev_id; 2975 list_add_rcu(&wdev->list, &rdev->wiphy.wdev_list); 2976 rdev->devlist_generation++; 2977 break; 2978 default: 2979 break; 2980 } 2981 2982 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0, 2983 rdev, wdev, false) < 0) { 2984 nlmsg_free(msg); 2985 return -ENOBUFS; 2986 } 2987 2988 /* 2989 * For wdevs which have no associated netdev object (e.g. of type 2990 * NL80211_IFTYPE_P2P_DEVICE), emit the NEW_INTERFACE event here. 2991 * For all other types, the event will be generated from the 2992 * netdev notifier 2993 */ 2994 if (!wdev->netdev) 2995 nl80211_notify_iface(rdev, wdev, NL80211_CMD_NEW_INTERFACE); 2996 2997 return genlmsg_reply(msg, info); 2998 } 2999 3000 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info) 3001 { 3002 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3003 struct wireless_dev *wdev = info->user_ptr[1]; 3004 3005 if (!rdev->ops->del_virtual_intf) 3006 return -EOPNOTSUPP; 3007 3008 /* 3009 * If we remove a wireless device without a netdev then clear 3010 * user_ptr[1] so that nl80211_post_doit won't dereference it 3011 * to check if it needs to do dev_put(). Otherwise it crashes 3012 * since the wdev has been freed, unlike with a netdev where 3013 * we need the dev_put() for the netdev to really be freed. 3014 */ 3015 if (!wdev->netdev) 3016 info->user_ptr[1] = NULL; 3017 3018 return rdev_del_virtual_intf(rdev, wdev); 3019 } 3020 3021 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info) 3022 { 3023 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3024 struct net_device *dev = info->user_ptr[1]; 3025 u16 noack_map; 3026 3027 if (!info->attrs[NL80211_ATTR_NOACK_MAP]) 3028 return -EINVAL; 3029 3030 if (!rdev->ops->set_noack_map) 3031 return -EOPNOTSUPP; 3032 3033 noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]); 3034 3035 return rdev_set_noack_map(rdev, dev, noack_map); 3036 } 3037 3038 struct get_key_cookie { 3039 struct sk_buff *msg; 3040 int error; 3041 int idx; 3042 }; 3043 3044 static void get_key_callback(void *c, struct key_params *params) 3045 { 3046 struct nlattr *key; 3047 struct get_key_cookie *cookie = c; 3048 3049 if ((params->key && 3050 nla_put(cookie->msg, NL80211_ATTR_KEY_DATA, 3051 params->key_len, params->key)) || 3052 (params->seq && 3053 nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ, 3054 params->seq_len, params->seq)) || 3055 (params->cipher && 3056 nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER, 3057 params->cipher))) 3058 goto nla_put_failure; 3059 3060 key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY); 3061 if (!key) 3062 goto nla_put_failure; 3063 3064 if ((params->key && 3065 nla_put(cookie->msg, NL80211_KEY_DATA, 3066 params->key_len, params->key)) || 3067 (params->seq && 3068 nla_put(cookie->msg, NL80211_KEY_SEQ, 3069 params->seq_len, params->seq)) || 3070 (params->cipher && 3071 nla_put_u32(cookie->msg, NL80211_KEY_CIPHER, 3072 params->cipher))) 3073 goto nla_put_failure; 3074 3075 if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx)) 3076 goto nla_put_failure; 3077 3078 nla_nest_end(cookie->msg, key); 3079 3080 return; 3081 nla_put_failure: 3082 cookie->error = 1; 3083 } 3084 3085 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info) 3086 { 3087 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3088 int err; 3089 struct net_device *dev = info->user_ptr[1]; 3090 u8 key_idx = 0; 3091 const u8 *mac_addr = NULL; 3092 bool pairwise; 3093 struct get_key_cookie cookie = { 3094 .error = 0, 3095 }; 3096 void *hdr; 3097 struct sk_buff *msg; 3098 3099 if (info->attrs[NL80211_ATTR_KEY_IDX]) 3100 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]); 3101 3102 if (key_idx > 5) 3103 return -EINVAL; 3104 3105 if (info->attrs[NL80211_ATTR_MAC]) 3106 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 3107 3108 pairwise = !!mac_addr; 3109 if (info->attrs[NL80211_ATTR_KEY_TYPE]) { 3110 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]); 3111 3112 if (kt >= NUM_NL80211_KEYTYPES) 3113 return -EINVAL; 3114 if (kt != NL80211_KEYTYPE_GROUP && 3115 kt != NL80211_KEYTYPE_PAIRWISE) 3116 return -EINVAL; 3117 pairwise = kt == NL80211_KEYTYPE_PAIRWISE; 3118 } 3119 3120 if (!rdev->ops->get_key) 3121 return -EOPNOTSUPP; 3122 3123 if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)) 3124 return -ENOENT; 3125 3126 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 3127 if (!msg) 3128 return -ENOMEM; 3129 3130 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 3131 NL80211_CMD_NEW_KEY); 3132 if (!hdr) 3133 goto nla_put_failure; 3134 3135 cookie.msg = msg; 3136 cookie.idx = key_idx; 3137 3138 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 3139 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx)) 3140 goto nla_put_failure; 3141 if (mac_addr && 3142 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr)) 3143 goto nla_put_failure; 3144 3145 err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie, 3146 get_key_callback); 3147 3148 if (err) 3149 goto free_msg; 3150 3151 if (cookie.error) 3152 goto nla_put_failure; 3153 3154 genlmsg_end(msg, hdr); 3155 return genlmsg_reply(msg, info); 3156 3157 nla_put_failure: 3158 err = -ENOBUFS; 3159 free_msg: 3160 nlmsg_free(msg); 3161 return err; 3162 } 3163 3164 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info) 3165 { 3166 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3167 struct key_parse key; 3168 int err; 3169 struct net_device *dev = info->user_ptr[1]; 3170 3171 err = nl80211_parse_key(info, &key); 3172 if (err) 3173 return err; 3174 3175 if (key.idx < 0) 3176 return -EINVAL; 3177 3178 /* only support setting default key */ 3179 if (!key.def && !key.defmgmt) 3180 return -EINVAL; 3181 3182 wdev_lock(dev->ieee80211_ptr); 3183 3184 if (key.def) { 3185 if (!rdev->ops->set_default_key) { 3186 err = -EOPNOTSUPP; 3187 goto out; 3188 } 3189 3190 err = nl80211_key_allowed(dev->ieee80211_ptr); 3191 if (err) 3192 goto out; 3193 3194 err = rdev_set_default_key(rdev, dev, key.idx, 3195 key.def_uni, key.def_multi); 3196 3197 if (err) 3198 goto out; 3199 3200 #ifdef CONFIG_CFG80211_WEXT 3201 dev->ieee80211_ptr->wext.default_key = key.idx; 3202 #endif 3203 } else { 3204 if (key.def_uni || !key.def_multi) { 3205 err = -EINVAL; 3206 goto out; 3207 } 3208 3209 if (!rdev->ops->set_default_mgmt_key) { 3210 err = -EOPNOTSUPP; 3211 goto out; 3212 } 3213 3214 err = nl80211_key_allowed(dev->ieee80211_ptr); 3215 if (err) 3216 goto out; 3217 3218 err = rdev_set_default_mgmt_key(rdev, dev, key.idx); 3219 if (err) 3220 goto out; 3221 3222 #ifdef CONFIG_CFG80211_WEXT 3223 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx; 3224 #endif 3225 } 3226 3227 out: 3228 wdev_unlock(dev->ieee80211_ptr); 3229 3230 return err; 3231 } 3232 3233 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info) 3234 { 3235 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3236 int err; 3237 struct net_device *dev = info->user_ptr[1]; 3238 struct key_parse key; 3239 const u8 *mac_addr = NULL; 3240 3241 err = nl80211_parse_key(info, &key); 3242 if (err) 3243 return err; 3244 3245 if (!key.p.key) 3246 return -EINVAL; 3247 3248 if (info->attrs[NL80211_ATTR_MAC]) 3249 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 3250 3251 if (key.type == -1) { 3252 if (mac_addr) 3253 key.type = NL80211_KEYTYPE_PAIRWISE; 3254 else 3255 key.type = NL80211_KEYTYPE_GROUP; 3256 } 3257 3258 /* for now */ 3259 if (key.type != NL80211_KEYTYPE_PAIRWISE && 3260 key.type != NL80211_KEYTYPE_GROUP) 3261 return -EINVAL; 3262 3263 if (!rdev->ops->add_key) 3264 return -EOPNOTSUPP; 3265 3266 if (cfg80211_validate_key_settings(rdev, &key.p, key.idx, 3267 key.type == NL80211_KEYTYPE_PAIRWISE, 3268 mac_addr)) 3269 return -EINVAL; 3270 3271 wdev_lock(dev->ieee80211_ptr); 3272 err = nl80211_key_allowed(dev->ieee80211_ptr); 3273 if (!err) 3274 err = rdev_add_key(rdev, dev, key.idx, 3275 key.type == NL80211_KEYTYPE_PAIRWISE, 3276 mac_addr, &key.p); 3277 wdev_unlock(dev->ieee80211_ptr); 3278 3279 return err; 3280 } 3281 3282 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info) 3283 { 3284 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3285 int err; 3286 struct net_device *dev = info->user_ptr[1]; 3287 u8 *mac_addr = NULL; 3288 struct key_parse key; 3289 3290 err = nl80211_parse_key(info, &key); 3291 if (err) 3292 return err; 3293 3294 if (info->attrs[NL80211_ATTR_MAC]) 3295 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 3296 3297 if (key.type == -1) { 3298 if (mac_addr) 3299 key.type = NL80211_KEYTYPE_PAIRWISE; 3300 else 3301 key.type = NL80211_KEYTYPE_GROUP; 3302 } 3303 3304 /* for now */ 3305 if (key.type != NL80211_KEYTYPE_PAIRWISE && 3306 key.type != NL80211_KEYTYPE_GROUP) 3307 return -EINVAL; 3308 3309 if (!rdev->ops->del_key) 3310 return -EOPNOTSUPP; 3311 3312 wdev_lock(dev->ieee80211_ptr); 3313 err = nl80211_key_allowed(dev->ieee80211_ptr); 3314 3315 if (key.type == NL80211_KEYTYPE_GROUP && mac_addr && 3316 !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN)) 3317 err = -ENOENT; 3318 3319 if (!err) 3320 err = rdev_del_key(rdev, dev, key.idx, 3321 key.type == NL80211_KEYTYPE_PAIRWISE, 3322 mac_addr); 3323 3324 #ifdef CONFIG_CFG80211_WEXT 3325 if (!err) { 3326 if (key.idx == dev->ieee80211_ptr->wext.default_key) 3327 dev->ieee80211_ptr->wext.default_key = -1; 3328 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key) 3329 dev->ieee80211_ptr->wext.default_mgmt_key = -1; 3330 } 3331 #endif 3332 wdev_unlock(dev->ieee80211_ptr); 3333 3334 return err; 3335 } 3336 3337 /* This function returns an error or the number of nested attributes */ 3338 static int validate_acl_mac_addrs(struct nlattr *nl_attr) 3339 { 3340 struct nlattr *attr; 3341 int n_entries = 0, tmp; 3342 3343 nla_for_each_nested(attr, nl_attr, tmp) { 3344 if (nla_len(attr) != ETH_ALEN) 3345 return -EINVAL; 3346 3347 n_entries++; 3348 } 3349 3350 return n_entries; 3351 } 3352 3353 /* 3354 * This function parses ACL information and allocates memory for ACL data. 3355 * On successful return, the calling function is responsible to free the 3356 * ACL buffer returned by this function. 3357 */ 3358 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy, 3359 struct genl_info *info) 3360 { 3361 enum nl80211_acl_policy acl_policy; 3362 struct nlattr *attr; 3363 struct cfg80211_acl_data *acl; 3364 int i = 0, n_entries, tmp; 3365 3366 if (!wiphy->max_acl_mac_addrs) 3367 return ERR_PTR(-EOPNOTSUPP); 3368 3369 if (!info->attrs[NL80211_ATTR_ACL_POLICY]) 3370 return ERR_PTR(-EINVAL); 3371 3372 acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]); 3373 if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED && 3374 acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED) 3375 return ERR_PTR(-EINVAL); 3376 3377 if (!info->attrs[NL80211_ATTR_MAC_ADDRS]) 3378 return ERR_PTR(-EINVAL); 3379 3380 n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]); 3381 if (n_entries < 0) 3382 return ERR_PTR(n_entries); 3383 3384 if (n_entries > wiphy->max_acl_mac_addrs) 3385 return ERR_PTR(-ENOTSUPP); 3386 3387 acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries), 3388 GFP_KERNEL); 3389 if (!acl) 3390 return ERR_PTR(-ENOMEM); 3391 3392 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) { 3393 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN); 3394 i++; 3395 } 3396 3397 acl->n_acl_entries = n_entries; 3398 acl->acl_policy = acl_policy; 3399 3400 return acl; 3401 } 3402 3403 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info) 3404 { 3405 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3406 struct net_device *dev = info->user_ptr[1]; 3407 struct cfg80211_acl_data *acl; 3408 int err; 3409 3410 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 3411 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 3412 return -EOPNOTSUPP; 3413 3414 if (!dev->ieee80211_ptr->beacon_interval) 3415 return -EINVAL; 3416 3417 acl = parse_acl_data(&rdev->wiphy, info); 3418 if (IS_ERR(acl)) 3419 return PTR_ERR(acl); 3420 3421 err = rdev_set_mac_acl(rdev, dev, acl); 3422 3423 kfree(acl); 3424 3425 return err; 3426 } 3427 3428 static u32 rateset_to_mask(struct ieee80211_supported_band *sband, 3429 u8 *rates, u8 rates_len) 3430 { 3431 u8 i; 3432 u32 mask = 0; 3433 3434 for (i = 0; i < rates_len; i++) { 3435 int rate = (rates[i] & 0x7f) * 5; 3436 int ridx; 3437 3438 for (ridx = 0; ridx < sband->n_bitrates; ridx++) { 3439 struct ieee80211_rate *srate = 3440 &sband->bitrates[ridx]; 3441 if (rate == srate->bitrate) { 3442 mask |= 1 << ridx; 3443 break; 3444 } 3445 } 3446 if (ridx == sband->n_bitrates) 3447 return 0; /* rate not found */ 3448 } 3449 3450 return mask; 3451 } 3452 3453 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband, 3454 u8 *rates, u8 rates_len, 3455 u8 mcs[IEEE80211_HT_MCS_MASK_LEN]) 3456 { 3457 u8 i; 3458 3459 memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN); 3460 3461 for (i = 0; i < rates_len; i++) { 3462 int ridx, rbit; 3463 3464 ridx = rates[i] / 8; 3465 rbit = BIT(rates[i] % 8); 3466 3467 /* check validity */ 3468 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN)) 3469 return false; 3470 3471 /* check availability */ 3472 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit) 3473 mcs[ridx] |= rbit; 3474 else 3475 return false; 3476 } 3477 3478 return true; 3479 } 3480 3481 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map) 3482 { 3483 u16 mcs_mask = 0; 3484 3485 switch (vht_mcs_map) { 3486 case IEEE80211_VHT_MCS_NOT_SUPPORTED: 3487 break; 3488 case IEEE80211_VHT_MCS_SUPPORT_0_7: 3489 mcs_mask = 0x00FF; 3490 break; 3491 case IEEE80211_VHT_MCS_SUPPORT_0_8: 3492 mcs_mask = 0x01FF; 3493 break; 3494 case IEEE80211_VHT_MCS_SUPPORT_0_9: 3495 mcs_mask = 0x03FF; 3496 break; 3497 default: 3498 break; 3499 } 3500 3501 return mcs_mask; 3502 } 3503 3504 static void vht_build_mcs_mask(u16 vht_mcs_map, 3505 u16 vht_mcs_mask[NL80211_VHT_NSS_MAX]) 3506 { 3507 u8 nss; 3508 3509 for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) { 3510 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03); 3511 vht_mcs_map >>= 2; 3512 } 3513 } 3514 3515 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband, 3516 struct nl80211_txrate_vht *txrate, 3517 u16 mcs[NL80211_VHT_NSS_MAX]) 3518 { 3519 u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map); 3520 u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {}; 3521 u8 i; 3522 3523 if (!sband->vht_cap.vht_supported) 3524 return false; 3525 3526 memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX); 3527 3528 /* Build vht_mcs_mask from VHT capabilities */ 3529 vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask); 3530 3531 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) { 3532 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i]) 3533 mcs[i] = txrate->mcs[i]; 3534 else 3535 return false; 3536 } 3537 3538 return true; 3539 } 3540 3541 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = { 3542 [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY, 3543 .len = NL80211_MAX_SUPP_RATES }, 3544 [NL80211_TXRATE_HT] = { .type = NLA_BINARY, 3545 .len = NL80211_MAX_SUPP_HT_RATES }, 3546 [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)}, 3547 [NL80211_TXRATE_GI] = { .type = NLA_U8 }, 3548 }; 3549 3550 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info, 3551 struct cfg80211_bitrate_mask *mask) 3552 { 3553 struct nlattr *tb[NL80211_TXRATE_MAX + 1]; 3554 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3555 int rem, i; 3556 struct nlattr *tx_rates; 3557 struct ieee80211_supported_band *sband; 3558 u16 vht_tx_mcs_map; 3559 3560 memset(mask, 0, sizeof(*mask)); 3561 /* Default to all rates enabled */ 3562 for (i = 0; i < NUM_NL80211_BANDS; i++) { 3563 sband = rdev->wiphy.bands[i]; 3564 3565 if (!sband) 3566 continue; 3567 3568 mask->control[i].legacy = (1 << sband->n_bitrates) - 1; 3569 memcpy(mask->control[i].ht_mcs, 3570 sband->ht_cap.mcs.rx_mask, 3571 sizeof(mask->control[i].ht_mcs)); 3572 3573 if (!sband->vht_cap.vht_supported) 3574 continue; 3575 3576 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map); 3577 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs); 3578 } 3579 3580 /* if no rates are given set it back to the defaults */ 3581 if (!info->attrs[NL80211_ATTR_TX_RATES]) 3582 goto out; 3583 3584 /* The nested attribute uses enum nl80211_band as the index. This maps 3585 * directly to the enum nl80211_band values used in cfg80211. 3586 */ 3587 BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8); 3588 nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) { 3589 enum nl80211_band band = nla_type(tx_rates); 3590 int err; 3591 3592 if (band < 0 || band >= NUM_NL80211_BANDS) 3593 return -EINVAL; 3594 sband = rdev->wiphy.bands[band]; 3595 if (sband == NULL) 3596 return -EINVAL; 3597 err = nla_parse_nested(tb, NL80211_TXRATE_MAX, tx_rates, 3598 nl80211_txattr_policy, info->extack); 3599 if (err) 3600 return err; 3601 if (tb[NL80211_TXRATE_LEGACY]) { 3602 mask->control[band].legacy = rateset_to_mask( 3603 sband, 3604 nla_data(tb[NL80211_TXRATE_LEGACY]), 3605 nla_len(tb[NL80211_TXRATE_LEGACY])); 3606 if ((mask->control[band].legacy == 0) && 3607 nla_len(tb[NL80211_TXRATE_LEGACY])) 3608 return -EINVAL; 3609 } 3610 if (tb[NL80211_TXRATE_HT]) { 3611 if (!ht_rateset_to_mask( 3612 sband, 3613 nla_data(tb[NL80211_TXRATE_HT]), 3614 nla_len(tb[NL80211_TXRATE_HT]), 3615 mask->control[band].ht_mcs)) 3616 return -EINVAL; 3617 } 3618 if (tb[NL80211_TXRATE_VHT]) { 3619 if (!vht_set_mcs_mask( 3620 sband, 3621 nla_data(tb[NL80211_TXRATE_VHT]), 3622 mask->control[band].vht_mcs)) 3623 return -EINVAL; 3624 } 3625 if (tb[NL80211_TXRATE_GI]) { 3626 mask->control[band].gi = 3627 nla_get_u8(tb[NL80211_TXRATE_GI]); 3628 if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI) 3629 return -EINVAL; 3630 } 3631 3632 if (mask->control[band].legacy == 0) { 3633 /* don't allow empty legacy rates if HT or VHT 3634 * are not even supported. 3635 */ 3636 if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported || 3637 rdev->wiphy.bands[band]->vht_cap.vht_supported)) 3638 return -EINVAL; 3639 3640 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) 3641 if (mask->control[band].ht_mcs[i]) 3642 goto out; 3643 3644 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) 3645 if (mask->control[band].vht_mcs[i]) 3646 goto out; 3647 3648 /* legacy and mcs rates may not be both empty */ 3649 return -EINVAL; 3650 } 3651 } 3652 3653 out: 3654 return 0; 3655 } 3656 3657 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev, 3658 enum nl80211_band band, 3659 struct cfg80211_bitrate_mask *beacon_rate) 3660 { 3661 u32 count_ht, count_vht, i; 3662 u32 rate = beacon_rate->control[band].legacy; 3663 3664 /* Allow only one rate */ 3665 if (hweight32(rate) > 1) 3666 return -EINVAL; 3667 3668 count_ht = 0; 3669 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) { 3670 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) { 3671 return -EINVAL; 3672 } else if (beacon_rate->control[band].ht_mcs[i]) { 3673 count_ht++; 3674 if (count_ht > 1) 3675 return -EINVAL; 3676 } 3677 if (count_ht && rate) 3678 return -EINVAL; 3679 } 3680 3681 count_vht = 0; 3682 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) { 3683 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) { 3684 return -EINVAL; 3685 } else if (beacon_rate->control[band].vht_mcs[i]) { 3686 count_vht++; 3687 if (count_vht > 1) 3688 return -EINVAL; 3689 } 3690 if (count_vht && rate) 3691 return -EINVAL; 3692 } 3693 3694 if ((count_ht && count_vht) || (!rate && !count_ht && !count_vht)) 3695 return -EINVAL; 3696 3697 if (rate && 3698 !wiphy_ext_feature_isset(&rdev->wiphy, 3699 NL80211_EXT_FEATURE_BEACON_RATE_LEGACY)) 3700 return -EINVAL; 3701 if (count_ht && 3702 !wiphy_ext_feature_isset(&rdev->wiphy, 3703 NL80211_EXT_FEATURE_BEACON_RATE_HT)) 3704 return -EINVAL; 3705 if (count_vht && 3706 !wiphy_ext_feature_isset(&rdev->wiphy, 3707 NL80211_EXT_FEATURE_BEACON_RATE_VHT)) 3708 return -EINVAL; 3709 3710 return 0; 3711 } 3712 3713 static int nl80211_parse_beacon(struct nlattr *attrs[], 3714 struct cfg80211_beacon_data *bcn) 3715 { 3716 bool haveinfo = false; 3717 3718 if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) || 3719 !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) || 3720 !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) || 3721 !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP])) 3722 return -EINVAL; 3723 3724 memset(bcn, 0, sizeof(*bcn)); 3725 3726 if (attrs[NL80211_ATTR_BEACON_HEAD]) { 3727 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]); 3728 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]); 3729 if (!bcn->head_len) 3730 return -EINVAL; 3731 haveinfo = true; 3732 } 3733 3734 if (attrs[NL80211_ATTR_BEACON_TAIL]) { 3735 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]); 3736 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]); 3737 haveinfo = true; 3738 } 3739 3740 if (!haveinfo) 3741 return -EINVAL; 3742 3743 if (attrs[NL80211_ATTR_IE]) { 3744 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]); 3745 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]); 3746 } 3747 3748 if (attrs[NL80211_ATTR_IE_PROBE_RESP]) { 3749 bcn->proberesp_ies = 3750 nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]); 3751 bcn->proberesp_ies_len = 3752 nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]); 3753 } 3754 3755 if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) { 3756 bcn->assocresp_ies = 3757 nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]); 3758 bcn->assocresp_ies_len = 3759 nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]); 3760 } 3761 3762 if (attrs[NL80211_ATTR_PROBE_RESP]) { 3763 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]); 3764 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]); 3765 } 3766 3767 return 0; 3768 } 3769 3770 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params, 3771 const u8 *rates) 3772 { 3773 int i; 3774 3775 if (!rates) 3776 return; 3777 3778 for (i = 0; i < rates[1]; i++) { 3779 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY) 3780 params->ht_required = true; 3781 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY) 3782 params->vht_required = true; 3783 } 3784 } 3785 3786 /* 3787 * Since the nl80211 API didn't include, from the beginning, attributes about 3788 * HT/VHT requirements/capabilities, we parse them out of the IEs for the 3789 * benefit of drivers that rebuild IEs in the firmware. 3790 */ 3791 static void nl80211_calculate_ap_params(struct cfg80211_ap_settings *params) 3792 { 3793 const struct cfg80211_beacon_data *bcn = ¶ms->beacon; 3794 size_t ies_len = bcn->beacon_ies_len; 3795 const u8 *ies = bcn->beacon_ies; 3796 const u8 *rates; 3797 const u8 *cap; 3798 3799 rates = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies, ies_len); 3800 nl80211_check_ap_rate_selectors(params, rates); 3801 3802 rates = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, ies, ies_len); 3803 nl80211_check_ap_rate_selectors(params, rates); 3804 3805 cap = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies, ies_len); 3806 if (cap && cap[1] >= sizeof(*params->ht_cap)) 3807 params->ht_cap = (void *)(cap + 2); 3808 cap = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, ies, ies_len); 3809 if (cap && cap[1] >= sizeof(*params->vht_cap)) 3810 params->vht_cap = (void *)(cap + 2); 3811 } 3812 3813 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev, 3814 struct cfg80211_ap_settings *params) 3815 { 3816 struct wireless_dev *wdev; 3817 bool ret = false; 3818 3819 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) { 3820 if (wdev->iftype != NL80211_IFTYPE_AP && 3821 wdev->iftype != NL80211_IFTYPE_P2P_GO) 3822 continue; 3823 3824 if (!wdev->preset_chandef.chan) 3825 continue; 3826 3827 params->chandef = wdev->preset_chandef; 3828 ret = true; 3829 break; 3830 } 3831 3832 return ret; 3833 } 3834 3835 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev, 3836 enum nl80211_auth_type auth_type, 3837 enum nl80211_commands cmd) 3838 { 3839 if (auth_type > NL80211_AUTHTYPE_MAX) 3840 return false; 3841 3842 switch (cmd) { 3843 case NL80211_CMD_AUTHENTICATE: 3844 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) && 3845 auth_type == NL80211_AUTHTYPE_SAE) 3846 return false; 3847 if (!wiphy_ext_feature_isset(&rdev->wiphy, 3848 NL80211_EXT_FEATURE_FILS_STA) && 3849 (auth_type == NL80211_AUTHTYPE_FILS_SK || 3850 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 3851 auth_type == NL80211_AUTHTYPE_FILS_PK)) 3852 return false; 3853 return true; 3854 case NL80211_CMD_CONNECT: 3855 /* SAE not supported yet */ 3856 if (auth_type == NL80211_AUTHTYPE_SAE) 3857 return false; 3858 /* FILS with SK PFS or PK not supported yet */ 3859 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 3860 auth_type == NL80211_AUTHTYPE_FILS_PK) 3861 return false; 3862 if (!wiphy_ext_feature_isset( 3863 &rdev->wiphy, 3864 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) && 3865 auth_type == NL80211_AUTHTYPE_FILS_SK) 3866 return false; 3867 return true; 3868 case NL80211_CMD_START_AP: 3869 /* SAE not supported yet */ 3870 if (auth_type == NL80211_AUTHTYPE_SAE) 3871 return false; 3872 /* FILS not supported yet */ 3873 if (auth_type == NL80211_AUTHTYPE_FILS_SK || 3874 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 3875 auth_type == NL80211_AUTHTYPE_FILS_PK) 3876 return false; 3877 return true; 3878 default: 3879 return false; 3880 } 3881 } 3882 3883 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info) 3884 { 3885 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 3886 struct net_device *dev = info->user_ptr[1]; 3887 struct wireless_dev *wdev = dev->ieee80211_ptr; 3888 struct cfg80211_ap_settings params; 3889 int err; 3890 3891 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 3892 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 3893 return -EOPNOTSUPP; 3894 3895 if (!rdev->ops->start_ap) 3896 return -EOPNOTSUPP; 3897 3898 if (wdev->beacon_interval) 3899 return -EALREADY; 3900 3901 memset(¶ms, 0, sizeof(params)); 3902 3903 /* these are required for START_AP */ 3904 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] || 3905 !info->attrs[NL80211_ATTR_DTIM_PERIOD] || 3906 !info->attrs[NL80211_ATTR_BEACON_HEAD]) 3907 return -EINVAL; 3908 3909 err = nl80211_parse_beacon(info->attrs, ¶ms.beacon); 3910 if (err) 3911 return err; 3912 3913 params.beacon_interval = 3914 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]); 3915 params.dtim_period = 3916 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]); 3917 3918 err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype, 3919 params.beacon_interval); 3920 if (err) 3921 return err; 3922 3923 /* 3924 * In theory, some of these attributes should be required here 3925 * but since they were not used when the command was originally 3926 * added, keep them optional for old user space programs to let 3927 * them continue to work with drivers that do not need the 3928 * additional information -- drivers must check! 3929 */ 3930 if (info->attrs[NL80211_ATTR_SSID]) { 3931 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 3932 params.ssid_len = 3933 nla_len(info->attrs[NL80211_ATTR_SSID]); 3934 if (params.ssid_len == 0 || 3935 params.ssid_len > IEEE80211_MAX_SSID_LEN) 3936 return -EINVAL; 3937 } 3938 3939 if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) { 3940 params.hidden_ssid = nla_get_u32( 3941 info->attrs[NL80211_ATTR_HIDDEN_SSID]); 3942 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE && 3943 params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN && 3944 params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS) 3945 return -EINVAL; 3946 } 3947 3948 params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY]; 3949 3950 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) { 3951 params.auth_type = nla_get_u32( 3952 info->attrs[NL80211_ATTR_AUTH_TYPE]); 3953 if (!nl80211_valid_auth_type(rdev, params.auth_type, 3954 NL80211_CMD_START_AP)) 3955 return -EINVAL; 3956 } else 3957 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC; 3958 3959 err = nl80211_crypto_settings(rdev, info, ¶ms.crypto, 3960 NL80211_MAX_NR_CIPHER_SUITES); 3961 if (err) 3962 return err; 3963 3964 if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) { 3965 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER)) 3966 return -EOPNOTSUPP; 3967 params.inactivity_timeout = nla_get_u16( 3968 info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]); 3969 } 3970 3971 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) { 3972 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 3973 return -EINVAL; 3974 params.p2p_ctwindow = 3975 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]); 3976 if (params.p2p_ctwindow > 127) 3977 return -EINVAL; 3978 if (params.p2p_ctwindow != 0 && 3979 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) 3980 return -EINVAL; 3981 } 3982 3983 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) { 3984 u8 tmp; 3985 3986 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 3987 return -EINVAL; 3988 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]); 3989 if (tmp > 1) 3990 return -EINVAL; 3991 params.p2p_opp_ps = tmp; 3992 if (params.p2p_opp_ps != 0 && 3993 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) 3994 return -EINVAL; 3995 } 3996 3997 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 3998 err = nl80211_parse_chandef(rdev, info, ¶ms.chandef); 3999 if (err) 4000 return err; 4001 } else if (wdev->preset_chandef.chan) { 4002 params.chandef = wdev->preset_chandef; 4003 } else if (!nl80211_get_ap_channel(rdev, ¶ms)) 4004 return -EINVAL; 4005 4006 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms.chandef, 4007 wdev->iftype)) 4008 return -EINVAL; 4009 4010 if (info->attrs[NL80211_ATTR_TX_RATES]) { 4011 err = nl80211_parse_tx_bitrate_mask(info, ¶ms.beacon_rate); 4012 if (err) 4013 return err; 4014 4015 err = validate_beacon_tx_rate(rdev, params.chandef.chan->band, 4016 ¶ms.beacon_rate); 4017 if (err) 4018 return err; 4019 } 4020 4021 if (info->attrs[NL80211_ATTR_SMPS_MODE]) { 4022 params.smps_mode = 4023 nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]); 4024 switch (params.smps_mode) { 4025 case NL80211_SMPS_OFF: 4026 break; 4027 case NL80211_SMPS_STATIC: 4028 if (!(rdev->wiphy.features & 4029 NL80211_FEATURE_STATIC_SMPS)) 4030 return -EINVAL; 4031 break; 4032 case NL80211_SMPS_DYNAMIC: 4033 if (!(rdev->wiphy.features & 4034 NL80211_FEATURE_DYNAMIC_SMPS)) 4035 return -EINVAL; 4036 break; 4037 default: 4038 return -EINVAL; 4039 } 4040 } else { 4041 params.smps_mode = NL80211_SMPS_OFF; 4042 } 4043 4044 params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]); 4045 if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) 4046 return -EOPNOTSUPP; 4047 4048 if (info->attrs[NL80211_ATTR_ACL_POLICY]) { 4049 params.acl = parse_acl_data(&rdev->wiphy, info); 4050 if (IS_ERR(params.acl)) 4051 return PTR_ERR(params.acl); 4052 } 4053 4054 nl80211_calculate_ap_params(¶ms); 4055 4056 wdev_lock(wdev); 4057 err = rdev_start_ap(rdev, dev, ¶ms); 4058 if (!err) { 4059 wdev->preset_chandef = params.chandef; 4060 wdev->beacon_interval = params.beacon_interval; 4061 wdev->chandef = params.chandef; 4062 wdev->ssid_len = params.ssid_len; 4063 memcpy(wdev->ssid, params.ssid, wdev->ssid_len); 4064 } 4065 wdev_unlock(wdev); 4066 4067 kfree(params.acl); 4068 4069 return err; 4070 } 4071 4072 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info) 4073 { 4074 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4075 struct net_device *dev = info->user_ptr[1]; 4076 struct wireless_dev *wdev = dev->ieee80211_ptr; 4077 struct cfg80211_beacon_data params; 4078 int err; 4079 4080 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 4081 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 4082 return -EOPNOTSUPP; 4083 4084 if (!rdev->ops->change_beacon) 4085 return -EOPNOTSUPP; 4086 4087 if (!wdev->beacon_interval) 4088 return -EINVAL; 4089 4090 err = nl80211_parse_beacon(info->attrs, ¶ms); 4091 if (err) 4092 return err; 4093 4094 wdev_lock(wdev); 4095 err = rdev_change_beacon(rdev, dev, ¶ms); 4096 wdev_unlock(wdev); 4097 4098 return err; 4099 } 4100 4101 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info) 4102 { 4103 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4104 struct net_device *dev = info->user_ptr[1]; 4105 4106 return cfg80211_stop_ap(rdev, dev, false); 4107 } 4108 4109 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = { 4110 [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG }, 4111 [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG }, 4112 [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG }, 4113 [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG }, 4114 [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG }, 4115 [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG }, 4116 }; 4117 4118 static int parse_station_flags(struct genl_info *info, 4119 enum nl80211_iftype iftype, 4120 struct station_parameters *params) 4121 { 4122 struct nlattr *flags[NL80211_STA_FLAG_MAX + 1]; 4123 struct nlattr *nla; 4124 int flag; 4125 4126 /* 4127 * Try parsing the new attribute first so userspace 4128 * can specify both for older kernels. 4129 */ 4130 nla = info->attrs[NL80211_ATTR_STA_FLAGS2]; 4131 if (nla) { 4132 struct nl80211_sta_flag_update *sta_flags; 4133 4134 sta_flags = nla_data(nla); 4135 params->sta_flags_mask = sta_flags->mask; 4136 params->sta_flags_set = sta_flags->set; 4137 params->sta_flags_set &= params->sta_flags_mask; 4138 if ((params->sta_flags_mask | 4139 params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID)) 4140 return -EINVAL; 4141 return 0; 4142 } 4143 4144 /* if present, parse the old attribute */ 4145 4146 nla = info->attrs[NL80211_ATTR_STA_FLAGS]; 4147 if (!nla) 4148 return 0; 4149 4150 if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX, nla, 4151 sta_flags_policy, info->extack)) 4152 return -EINVAL; 4153 4154 /* 4155 * Only allow certain flags for interface types so that 4156 * other attributes are silently ignored. Remember that 4157 * this is backward compatibility code with old userspace 4158 * and shouldn't be hit in other cases anyway. 4159 */ 4160 switch (iftype) { 4161 case NL80211_IFTYPE_AP: 4162 case NL80211_IFTYPE_AP_VLAN: 4163 case NL80211_IFTYPE_P2P_GO: 4164 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) | 4165 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) | 4166 BIT(NL80211_STA_FLAG_WME) | 4167 BIT(NL80211_STA_FLAG_MFP); 4168 break; 4169 case NL80211_IFTYPE_P2P_CLIENT: 4170 case NL80211_IFTYPE_STATION: 4171 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) | 4172 BIT(NL80211_STA_FLAG_TDLS_PEER); 4173 break; 4174 case NL80211_IFTYPE_MESH_POINT: 4175 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) | 4176 BIT(NL80211_STA_FLAG_MFP) | 4177 BIT(NL80211_STA_FLAG_AUTHORIZED); 4178 default: 4179 return -EINVAL; 4180 } 4181 4182 for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) { 4183 if (flags[flag]) { 4184 params->sta_flags_set |= (1<<flag); 4185 4186 /* no longer support new API additions in old API */ 4187 if (flag > NL80211_STA_FLAG_MAX_OLD_API) 4188 return -EINVAL; 4189 } 4190 } 4191 4192 return 0; 4193 } 4194 4195 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, 4196 int attr) 4197 { 4198 struct nlattr *rate; 4199 u32 bitrate; 4200 u16 bitrate_compat; 4201 enum nl80211_rate_info rate_flg; 4202 4203 rate = nla_nest_start(msg, attr); 4204 if (!rate) 4205 return false; 4206 4207 /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */ 4208 bitrate = cfg80211_calculate_bitrate(info); 4209 /* report 16-bit bitrate only if we can */ 4210 bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0; 4211 if (bitrate > 0 && 4212 nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate)) 4213 return false; 4214 if (bitrate_compat > 0 && 4215 nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat)) 4216 return false; 4217 4218 switch (info->bw) { 4219 case RATE_INFO_BW_5: 4220 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH; 4221 break; 4222 case RATE_INFO_BW_10: 4223 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH; 4224 break; 4225 default: 4226 WARN_ON(1); 4227 /* fall through */ 4228 case RATE_INFO_BW_20: 4229 rate_flg = 0; 4230 break; 4231 case RATE_INFO_BW_40: 4232 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH; 4233 break; 4234 case RATE_INFO_BW_80: 4235 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH; 4236 break; 4237 case RATE_INFO_BW_160: 4238 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH; 4239 break; 4240 } 4241 4242 if (rate_flg && nla_put_flag(msg, rate_flg)) 4243 return false; 4244 4245 if (info->flags & RATE_INFO_FLAGS_MCS) { 4246 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs)) 4247 return false; 4248 if (info->flags & RATE_INFO_FLAGS_SHORT_GI && 4249 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI)) 4250 return false; 4251 } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) { 4252 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs)) 4253 return false; 4254 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss)) 4255 return false; 4256 if (info->flags & RATE_INFO_FLAGS_SHORT_GI && 4257 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI)) 4258 return false; 4259 } 4260 4261 nla_nest_end(msg, rate); 4262 return true; 4263 } 4264 4265 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal, 4266 int id) 4267 { 4268 void *attr; 4269 int i = 0; 4270 4271 if (!mask) 4272 return true; 4273 4274 attr = nla_nest_start(msg, id); 4275 if (!attr) 4276 return false; 4277 4278 for (i = 0; i < IEEE80211_MAX_CHAINS; i++) { 4279 if (!(mask & BIT(i))) 4280 continue; 4281 4282 if (nla_put_u8(msg, i, signal[i])) 4283 return false; 4284 } 4285 4286 nla_nest_end(msg, attr); 4287 4288 return true; 4289 } 4290 4291 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid, 4292 u32 seq, int flags, 4293 struct cfg80211_registered_device *rdev, 4294 struct net_device *dev, 4295 const u8 *mac_addr, struct station_info *sinfo) 4296 { 4297 void *hdr; 4298 struct nlattr *sinfoattr, *bss_param; 4299 4300 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 4301 if (!hdr) 4302 return -1; 4303 4304 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 4305 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) || 4306 nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation)) 4307 goto nla_put_failure; 4308 4309 sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO); 4310 if (!sinfoattr) 4311 goto nla_put_failure; 4312 4313 #define PUT_SINFO(attr, memb, type) do { \ 4314 BUILD_BUG_ON(sizeof(type) == sizeof(u64)); \ 4315 if (sinfo->filled & (1ULL << NL80211_STA_INFO_ ## attr) && \ 4316 nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr, \ 4317 sinfo->memb)) \ 4318 goto nla_put_failure; \ 4319 } while (0) 4320 #define PUT_SINFO_U64(attr, memb) do { \ 4321 if (sinfo->filled & (1ULL << NL80211_STA_INFO_ ## attr) && \ 4322 nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr, \ 4323 sinfo->memb, NL80211_STA_INFO_PAD)) \ 4324 goto nla_put_failure; \ 4325 } while (0) 4326 4327 PUT_SINFO(CONNECTED_TIME, connected_time, u32); 4328 PUT_SINFO(INACTIVE_TIME, inactive_time, u32); 4329 4330 if (sinfo->filled & (BIT(NL80211_STA_INFO_RX_BYTES) | 4331 BIT(NL80211_STA_INFO_RX_BYTES64)) && 4332 nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES, 4333 (u32)sinfo->rx_bytes)) 4334 goto nla_put_failure; 4335 4336 if (sinfo->filled & (BIT(NL80211_STA_INFO_TX_BYTES) | 4337 BIT(NL80211_STA_INFO_TX_BYTES64)) && 4338 nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES, 4339 (u32)sinfo->tx_bytes)) 4340 goto nla_put_failure; 4341 4342 PUT_SINFO_U64(RX_BYTES64, rx_bytes); 4343 PUT_SINFO_U64(TX_BYTES64, tx_bytes); 4344 PUT_SINFO(LLID, llid, u16); 4345 PUT_SINFO(PLID, plid, u16); 4346 PUT_SINFO(PLINK_STATE, plink_state, u8); 4347 PUT_SINFO_U64(RX_DURATION, rx_duration); 4348 4349 switch (rdev->wiphy.signal_type) { 4350 case CFG80211_SIGNAL_TYPE_MBM: 4351 PUT_SINFO(SIGNAL, signal, u8); 4352 PUT_SINFO(SIGNAL_AVG, signal_avg, u8); 4353 break; 4354 default: 4355 break; 4356 } 4357 if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL)) { 4358 if (!nl80211_put_signal(msg, sinfo->chains, 4359 sinfo->chain_signal, 4360 NL80211_STA_INFO_CHAIN_SIGNAL)) 4361 goto nla_put_failure; 4362 } 4363 if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) { 4364 if (!nl80211_put_signal(msg, sinfo->chains, 4365 sinfo->chain_signal_avg, 4366 NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) 4367 goto nla_put_failure; 4368 } 4369 if (sinfo->filled & BIT(NL80211_STA_INFO_TX_BITRATE)) { 4370 if (!nl80211_put_sta_rate(msg, &sinfo->txrate, 4371 NL80211_STA_INFO_TX_BITRATE)) 4372 goto nla_put_failure; 4373 } 4374 if (sinfo->filled & BIT(NL80211_STA_INFO_RX_BITRATE)) { 4375 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate, 4376 NL80211_STA_INFO_RX_BITRATE)) 4377 goto nla_put_failure; 4378 } 4379 4380 PUT_SINFO(RX_PACKETS, rx_packets, u32); 4381 PUT_SINFO(TX_PACKETS, tx_packets, u32); 4382 PUT_SINFO(TX_RETRIES, tx_retries, u32); 4383 PUT_SINFO(TX_FAILED, tx_failed, u32); 4384 PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32); 4385 PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32); 4386 PUT_SINFO(LOCAL_PM, local_pm, u32); 4387 PUT_SINFO(PEER_PM, peer_pm, u32); 4388 PUT_SINFO(NONPEER_PM, nonpeer_pm, u32); 4389 4390 if (sinfo->filled & BIT(NL80211_STA_INFO_BSS_PARAM)) { 4391 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM); 4392 if (!bss_param) 4393 goto nla_put_failure; 4394 4395 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) && 4396 nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) || 4397 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) && 4398 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) || 4399 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) && 4400 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) || 4401 nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD, 4402 sinfo->bss_param.dtim_period) || 4403 nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL, 4404 sinfo->bss_param.beacon_interval)) 4405 goto nla_put_failure; 4406 4407 nla_nest_end(msg, bss_param); 4408 } 4409 if ((sinfo->filled & BIT(NL80211_STA_INFO_STA_FLAGS)) && 4410 nla_put(msg, NL80211_STA_INFO_STA_FLAGS, 4411 sizeof(struct nl80211_sta_flag_update), 4412 &sinfo->sta_flags)) 4413 goto nla_put_failure; 4414 4415 PUT_SINFO_U64(T_OFFSET, t_offset); 4416 PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc); 4417 PUT_SINFO_U64(BEACON_RX, rx_beacon); 4418 PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8); 4419 4420 #undef PUT_SINFO 4421 #undef PUT_SINFO_U64 4422 4423 if (sinfo->filled & BIT(NL80211_STA_INFO_TID_STATS)) { 4424 struct nlattr *tidsattr; 4425 int tid; 4426 4427 tidsattr = nla_nest_start(msg, NL80211_STA_INFO_TID_STATS); 4428 if (!tidsattr) 4429 goto nla_put_failure; 4430 4431 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) { 4432 struct cfg80211_tid_stats *tidstats; 4433 struct nlattr *tidattr; 4434 4435 tidstats = &sinfo->pertid[tid]; 4436 4437 if (!tidstats->filled) 4438 continue; 4439 4440 tidattr = nla_nest_start(msg, tid + 1); 4441 if (!tidattr) 4442 goto nla_put_failure; 4443 4444 #define PUT_TIDVAL_U64(attr, memb) do { \ 4445 if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) && \ 4446 nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr, \ 4447 tidstats->memb, NL80211_TID_STATS_PAD)) \ 4448 goto nla_put_failure; \ 4449 } while (0) 4450 4451 PUT_TIDVAL_U64(RX_MSDU, rx_msdu); 4452 PUT_TIDVAL_U64(TX_MSDU, tx_msdu); 4453 PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries); 4454 PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed); 4455 4456 #undef PUT_TIDVAL_U64 4457 nla_nest_end(msg, tidattr); 4458 } 4459 4460 nla_nest_end(msg, tidsattr); 4461 } 4462 4463 nla_nest_end(msg, sinfoattr); 4464 4465 if (sinfo->assoc_req_ies_len && 4466 nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len, 4467 sinfo->assoc_req_ies)) 4468 goto nla_put_failure; 4469 4470 genlmsg_end(msg, hdr); 4471 return 0; 4472 4473 nla_put_failure: 4474 genlmsg_cancel(msg, hdr); 4475 return -EMSGSIZE; 4476 } 4477 4478 static int nl80211_dump_station(struct sk_buff *skb, 4479 struct netlink_callback *cb) 4480 { 4481 struct station_info sinfo; 4482 struct cfg80211_registered_device *rdev; 4483 struct wireless_dev *wdev; 4484 u8 mac_addr[ETH_ALEN]; 4485 int sta_idx = cb->args[2]; 4486 int err; 4487 4488 rtnl_lock(); 4489 err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev); 4490 if (err) 4491 goto out_err; 4492 4493 if (!wdev->netdev) { 4494 err = -EINVAL; 4495 goto out_err; 4496 } 4497 4498 if (!rdev->ops->dump_station) { 4499 err = -EOPNOTSUPP; 4500 goto out_err; 4501 } 4502 4503 while (1) { 4504 memset(&sinfo, 0, sizeof(sinfo)); 4505 err = rdev_dump_station(rdev, wdev->netdev, sta_idx, 4506 mac_addr, &sinfo); 4507 if (err == -ENOENT) 4508 break; 4509 if (err) 4510 goto out_err; 4511 4512 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION, 4513 NETLINK_CB(cb->skb).portid, 4514 cb->nlh->nlmsg_seq, NLM_F_MULTI, 4515 rdev, wdev->netdev, mac_addr, 4516 &sinfo) < 0) 4517 goto out; 4518 4519 sta_idx++; 4520 } 4521 4522 out: 4523 cb->args[2] = sta_idx; 4524 err = skb->len; 4525 out_err: 4526 rtnl_unlock(); 4527 4528 return err; 4529 } 4530 4531 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info) 4532 { 4533 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4534 struct net_device *dev = info->user_ptr[1]; 4535 struct station_info sinfo; 4536 struct sk_buff *msg; 4537 u8 *mac_addr = NULL; 4538 int err; 4539 4540 memset(&sinfo, 0, sizeof(sinfo)); 4541 4542 if (!info->attrs[NL80211_ATTR_MAC]) 4543 return -EINVAL; 4544 4545 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 4546 4547 if (!rdev->ops->get_station) 4548 return -EOPNOTSUPP; 4549 4550 err = rdev_get_station(rdev, dev, mac_addr, &sinfo); 4551 if (err) 4552 return err; 4553 4554 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 4555 if (!msg) 4556 return -ENOMEM; 4557 4558 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 4559 info->snd_portid, info->snd_seq, 0, 4560 rdev, dev, mac_addr, &sinfo) < 0) { 4561 nlmsg_free(msg); 4562 return -ENOBUFS; 4563 } 4564 4565 return genlmsg_reply(msg, info); 4566 } 4567 4568 int cfg80211_check_station_change(struct wiphy *wiphy, 4569 struct station_parameters *params, 4570 enum cfg80211_station_type statype) 4571 { 4572 if (params->listen_interval != -1 && 4573 statype != CFG80211_STA_AP_CLIENT_UNASSOC) 4574 return -EINVAL; 4575 4576 if (params->support_p2p_ps != -1 && 4577 statype != CFG80211_STA_AP_CLIENT_UNASSOC) 4578 return -EINVAL; 4579 4580 if (params->aid && 4581 !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) && 4582 statype != CFG80211_STA_AP_CLIENT_UNASSOC) 4583 return -EINVAL; 4584 4585 /* When you run into this, adjust the code below for the new flag */ 4586 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7); 4587 4588 switch (statype) { 4589 case CFG80211_STA_MESH_PEER_KERNEL: 4590 case CFG80211_STA_MESH_PEER_USER: 4591 /* 4592 * No ignoring the TDLS flag here -- the userspace mesh 4593 * code doesn't have the bug of including TDLS in the 4594 * mask everywhere. 4595 */ 4596 if (params->sta_flags_mask & 4597 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) | 4598 BIT(NL80211_STA_FLAG_MFP) | 4599 BIT(NL80211_STA_FLAG_AUTHORIZED))) 4600 return -EINVAL; 4601 break; 4602 case CFG80211_STA_TDLS_PEER_SETUP: 4603 case CFG80211_STA_TDLS_PEER_ACTIVE: 4604 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))) 4605 return -EINVAL; 4606 /* ignore since it can't change */ 4607 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER); 4608 break; 4609 default: 4610 /* disallow mesh-specific things */ 4611 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION) 4612 return -EINVAL; 4613 if (params->local_pm) 4614 return -EINVAL; 4615 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE) 4616 return -EINVAL; 4617 } 4618 4619 if (statype != CFG80211_STA_TDLS_PEER_SETUP && 4620 statype != CFG80211_STA_TDLS_PEER_ACTIVE) { 4621 /* TDLS can't be set, ... */ 4622 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) 4623 return -EINVAL; 4624 /* 4625 * ... but don't bother the driver with it. This works around 4626 * a hostapd/wpa_supplicant issue -- it always includes the 4627 * TLDS_PEER flag in the mask even for AP mode. 4628 */ 4629 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER); 4630 } 4631 4632 if (statype != CFG80211_STA_TDLS_PEER_SETUP && 4633 statype != CFG80211_STA_AP_CLIENT_UNASSOC) { 4634 /* reject other things that can't change */ 4635 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD) 4636 return -EINVAL; 4637 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY) 4638 return -EINVAL; 4639 if (params->supported_rates) 4640 return -EINVAL; 4641 if (params->ext_capab || params->ht_capa || params->vht_capa) 4642 return -EINVAL; 4643 } 4644 4645 if (statype != CFG80211_STA_AP_CLIENT && 4646 statype != CFG80211_STA_AP_CLIENT_UNASSOC) { 4647 if (params->vlan) 4648 return -EINVAL; 4649 } 4650 4651 switch (statype) { 4652 case CFG80211_STA_AP_MLME_CLIENT: 4653 /* Use this only for authorizing/unauthorizing a station */ 4654 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED))) 4655 return -EOPNOTSUPP; 4656 break; 4657 case CFG80211_STA_AP_CLIENT: 4658 case CFG80211_STA_AP_CLIENT_UNASSOC: 4659 /* accept only the listed bits */ 4660 if (params->sta_flags_mask & 4661 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) | 4662 BIT(NL80211_STA_FLAG_AUTHENTICATED) | 4663 BIT(NL80211_STA_FLAG_ASSOCIATED) | 4664 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) | 4665 BIT(NL80211_STA_FLAG_WME) | 4666 BIT(NL80211_STA_FLAG_MFP))) 4667 return -EINVAL; 4668 4669 /* but authenticated/associated only if driver handles it */ 4670 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) && 4671 params->sta_flags_mask & 4672 (BIT(NL80211_STA_FLAG_AUTHENTICATED) | 4673 BIT(NL80211_STA_FLAG_ASSOCIATED))) 4674 return -EINVAL; 4675 break; 4676 case CFG80211_STA_IBSS: 4677 case CFG80211_STA_AP_STA: 4678 /* reject any changes other than AUTHORIZED */ 4679 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED)) 4680 return -EINVAL; 4681 break; 4682 case CFG80211_STA_TDLS_PEER_SETUP: 4683 /* reject any changes other than AUTHORIZED or WME */ 4684 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) | 4685 BIT(NL80211_STA_FLAG_WME))) 4686 return -EINVAL; 4687 /* force (at least) rates when authorizing */ 4688 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) && 4689 !params->supported_rates) 4690 return -EINVAL; 4691 break; 4692 case CFG80211_STA_TDLS_PEER_ACTIVE: 4693 /* reject any changes */ 4694 return -EINVAL; 4695 case CFG80211_STA_MESH_PEER_KERNEL: 4696 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE) 4697 return -EINVAL; 4698 break; 4699 case CFG80211_STA_MESH_PEER_USER: 4700 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION && 4701 params->plink_action != NL80211_PLINK_ACTION_BLOCK) 4702 return -EINVAL; 4703 break; 4704 } 4705 4706 /* 4707 * Older kernel versions ignored this attribute entirely, so don't 4708 * reject attempts to update it but mark it as unused instead so the 4709 * driver won't look at the data. 4710 */ 4711 if (statype != CFG80211_STA_AP_CLIENT_UNASSOC && 4712 statype != CFG80211_STA_TDLS_PEER_SETUP) 4713 params->opmode_notif_used = false; 4714 4715 return 0; 4716 } 4717 EXPORT_SYMBOL(cfg80211_check_station_change); 4718 4719 /* 4720 * Get vlan interface making sure it is running and on the right wiphy. 4721 */ 4722 static struct net_device *get_vlan(struct genl_info *info, 4723 struct cfg80211_registered_device *rdev) 4724 { 4725 struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN]; 4726 struct net_device *v; 4727 int ret; 4728 4729 if (!vlanattr) 4730 return NULL; 4731 4732 v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr)); 4733 if (!v) 4734 return ERR_PTR(-ENODEV); 4735 4736 if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) { 4737 ret = -EINVAL; 4738 goto error; 4739 } 4740 4741 if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN && 4742 v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 4743 v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) { 4744 ret = -EINVAL; 4745 goto error; 4746 } 4747 4748 if (!netif_running(v)) { 4749 ret = -ENETDOWN; 4750 goto error; 4751 } 4752 4753 return v; 4754 error: 4755 dev_put(v); 4756 return ERR_PTR(ret); 4757 } 4758 4759 static const struct nla_policy 4760 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = { 4761 [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 }, 4762 [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 }, 4763 }; 4764 4765 static int nl80211_parse_sta_wme(struct genl_info *info, 4766 struct station_parameters *params) 4767 { 4768 struct nlattr *tb[NL80211_STA_WME_MAX + 1]; 4769 struct nlattr *nla; 4770 int err; 4771 4772 /* parse WME attributes if present */ 4773 if (!info->attrs[NL80211_ATTR_STA_WME]) 4774 return 0; 4775 4776 nla = info->attrs[NL80211_ATTR_STA_WME]; 4777 err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla, 4778 nl80211_sta_wme_policy, info->extack); 4779 if (err) 4780 return err; 4781 4782 if (tb[NL80211_STA_WME_UAPSD_QUEUES]) 4783 params->uapsd_queues = nla_get_u8( 4784 tb[NL80211_STA_WME_UAPSD_QUEUES]); 4785 if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK) 4786 return -EINVAL; 4787 4788 if (tb[NL80211_STA_WME_MAX_SP]) 4789 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]); 4790 4791 if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK) 4792 return -EINVAL; 4793 4794 params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD; 4795 4796 return 0; 4797 } 4798 4799 static int nl80211_parse_sta_channel_info(struct genl_info *info, 4800 struct station_parameters *params) 4801 { 4802 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) { 4803 params->supported_channels = 4804 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]); 4805 params->supported_channels_len = 4806 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]); 4807 /* 4808 * Need to include at least one (first channel, number of 4809 * channels) tuple for each subband, and must have proper 4810 * tuples for the rest of the data as well. 4811 */ 4812 if (params->supported_channels_len < 2) 4813 return -EINVAL; 4814 if (params->supported_channels_len % 2) 4815 return -EINVAL; 4816 } 4817 4818 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) { 4819 params->supported_oper_classes = 4820 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]); 4821 params->supported_oper_classes_len = 4822 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]); 4823 /* 4824 * The value of the Length field of the Supported Operating 4825 * Classes element is between 2 and 253. 4826 */ 4827 if (params->supported_oper_classes_len < 2 || 4828 params->supported_oper_classes_len > 253) 4829 return -EINVAL; 4830 } 4831 return 0; 4832 } 4833 4834 static int nl80211_set_station_tdls(struct genl_info *info, 4835 struct station_parameters *params) 4836 { 4837 int err; 4838 /* Dummy STA entry gets updated once the peer capabilities are known */ 4839 if (info->attrs[NL80211_ATTR_PEER_AID]) 4840 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]); 4841 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) 4842 params->ht_capa = 4843 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]); 4844 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) 4845 params->vht_capa = 4846 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]); 4847 4848 err = nl80211_parse_sta_channel_info(info, params); 4849 if (err) 4850 return err; 4851 4852 return nl80211_parse_sta_wme(info, params); 4853 } 4854 4855 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info) 4856 { 4857 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4858 struct net_device *dev = info->user_ptr[1]; 4859 struct station_parameters params; 4860 u8 *mac_addr; 4861 int err; 4862 4863 memset(¶ms, 0, sizeof(params)); 4864 4865 if (!rdev->ops->change_station) 4866 return -EOPNOTSUPP; 4867 4868 /* 4869 * AID and listen_interval properties can be set only for unassociated 4870 * station. Include these parameters here and will check them in 4871 * cfg80211_check_station_change(). 4872 */ 4873 if (info->attrs[NL80211_ATTR_STA_AID]) 4874 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]); 4875 4876 if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]) 4877 params.listen_interval = 4878 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]); 4879 else 4880 params.listen_interval = -1; 4881 4882 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) { 4883 u8 tmp; 4884 4885 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]); 4886 if (tmp >= NUM_NL80211_P2P_PS_STATUS) 4887 return -EINVAL; 4888 4889 params.support_p2p_ps = tmp; 4890 } else { 4891 params.support_p2p_ps = -1; 4892 } 4893 4894 if (!info->attrs[NL80211_ATTR_MAC]) 4895 return -EINVAL; 4896 4897 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 4898 4899 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) { 4900 params.supported_rates = 4901 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 4902 params.supported_rates_len = 4903 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 4904 } 4905 4906 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) { 4907 params.capability = 4908 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]); 4909 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY; 4910 } 4911 4912 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) { 4913 params.ext_capab = 4914 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 4915 params.ext_capab_len = 4916 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 4917 } 4918 4919 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms)) 4920 return -EINVAL; 4921 4922 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) { 4923 params.plink_action = 4924 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]); 4925 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS) 4926 return -EINVAL; 4927 } 4928 4929 if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) { 4930 params.plink_state = 4931 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]); 4932 if (params.plink_state >= NUM_NL80211_PLINK_STATES) 4933 return -EINVAL; 4934 if (info->attrs[NL80211_ATTR_MESH_PEER_AID]) { 4935 params.peer_aid = nla_get_u16( 4936 info->attrs[NL80211_ATTR_MESH_PEER_AID]); 4937 if (params.peer_aid > IEEE80211_MAX_AID) 4938 return -EINVAL; 4939 } 4940 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE; 4941 } 4942 4943 if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) { 4944 enum nl80211_mesh_power_mode pm = nla_get_u32( 4945 info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]); 4946 4947 if (pm <= NL80211_MESH_POWER_UNKNOWN || 4948 pm > NL80211_MESH_POWER_MAX) 4949 return -EINVAL; 4950 4951 params.local_pm = pm; 4952 } 4953 4954 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) { 4955 params.opmode_notif_used = true; 4956 params.opmode_notif = 4957 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]); 4958 } 4959 4960 /* Include parameters for TDLS peer (will check later) */ 4961 err = nl80211_set_station_tdls(info, ¶ms); 4962 if (err) 4963 return err; 4964 4965 params.vlan = get_vlan(info, rdev); 4966 if (IS_ERR(params.vlan)) 4967 return PTR_ERR(params.vlan); 4968 4969 switch (dev->ieee80211_ptr->iftype) { 4970 case NL80211_IFTYPE_AP: 4971 case NL80211_IFTYPE_AP_VLAN: 4972 case NL80211_IFTYPE_P2P_GO: 4973 case NL80211_IFTYPE_P2P_CLIENT: 4974 case NL80211_IFTYPE_STATION: 4975 case NL80211_IFTYPE_ADHOC: 4976 case NL80211_IFTYPE_MESH_POINT: 4977 break; 4978 default: 4979 err = -EOPNOTSUPP; 4980 goto out_put_vlan; 4981 } 4982 4983 /* driver will call cfg80211_check_station_change() */ 4984 err = rdev_change_station(rdev, dev, mac_addr, ¶ms); 4985 4986 out_put_vlan: 4987 if (params.vlan) 4988 dev_put(params.vlan); 4989 4990 return err; 4991 } 4992 4993 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info) 4994 { 4995 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 4996 int err; 4997 struct net_device *dev = info->user_ptr[1]; 4998 struct station_parameters params; 4999 u8 *mac_addr = NULL; 5000 u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) | 5001 BIT(NL80211_STA_FLAG_ASSOCIATED); 5002 5003 memset(¶ms, 0, sizeof(params)); 5004 5005 if (!rdev->ops->add_station) 5006 return -EOPNOTSUPP; 5007 5008 if (!info->attrs[NL80211_ATTR_MAC]) 5009 return -EINVAL; 5010 5011 if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]) 5012 return -EINVAL; 5013 5014 if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) 5015 return -EINVAL; 5016 5017 if (!info->attrs[NL80211_ATTR_STA_AID] && 5018 !info->attrs[NL80211_ATTR_PEER_AID]) 5019 return -EINVAL; 5020 5021 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 5022 params.supported_rates = 5023 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 5024 params.supported_rates_len = 5025 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 5026 params.listen_interval = 5027 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]); 5028 5029 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) { 5030 u8 tmp; 5031 5032 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]); 5033 if (tmp >= NUM_NL80211_P2P_PS_STATUS) 5034 return -EINVAL; 5035 5036 params.support_p2p_ps = tmp; 5037 } else { 5038 /* 5039 * if not specified, assume it's supported for P2P GO interface, 5040 * and is NOT supported for AP interface 5041 */ 5042 params.support_p2p_ps = 5043 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO; 5044 } 5045 5046 if (info->attrs[NL80211_ATTR_PEER_AID]) 5047 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]); 5048 else 5049 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]); 5050 if (!params.aid || params.aid > IEEE80211_MAX_AID) 5051 return -EINVAL; 5052 5053 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) { 5054 params.capability = 5055 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]); 5056 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY; 5057 } 5058 5059 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) { 5060 params.ext_capab = 5061 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 5062 params.ext_capab_len = 5063 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]); 5064 } 5065 5066 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) 5067 params.ht_capa = 5068 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]); 5069 5070 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) 5071 params.vht_capa = 5072 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]); 5073 5074 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) { 5075 params.opmode_notif_used = true; 5076 params.opmode_notif = 5077 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]); 5078 } 5079 5080 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) { 5081 params.plink_action = 5082 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]); 5083 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS) 5084 return -EINVAL; 5085 } 5086 5087 err = nl80211_parse_sta_channel_info(info, ¶ms); 5088 if (err) 5089 return err; 5090 5091 err = nl80211_parse_sta_wme(info, ¶ms); 5092 if (err) 5093 return err; 5094 5095 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms)) 5096 return -EINVAL; 5097 5098 /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT 5099 * as userspace might just pass through the capabilities from the IEs 5100 * directly, rather than enforcing this restriction and returning an 5101 * error in this case. 5102 */ 5103 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) { 5104 params.ht_capa = NULL; 5105 params.vht_capa = NULL; 5106 } 5107 5108 /* When you run into this, adjust the code below for the new flag */ 5109 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7); 5110 5111 switch (dev->ieee80211_ptr->iftype) { 5112 case NL80211_IFTYPE_AP: 5113 case NL80211_IFTYPE_AP_VLAN: 5114 case NL80211_IFTYPE_P2P_GO: 5115 /* ignore WME attributes if iface/sta is not capable */ 5116 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) || 5117 !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) 5118 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD; 5119 5120 /* TDLS peers cannot be added */ 5121 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) || 5122 info->attrs[NL80211_ATTR_PEER_AID]) 5123 return -EINVAL; 5124 /* but don't bother the driver with it */ 5125 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER); 5126 5127 /* allow authenticated/associated only if driver handles it */ 5128 if (!(rdev->wiphy.features & 5129 NL80211_FEATURE_FULL_AP_CLIENT_STATE) && 5130 params.sta_flags_mask & auth_assoc) 5131 return -EINVAL; 5132 5133 /* Older userspace, or userspace wanting to be compatible with 5134 * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth 5135 * and assoc flags in the mask, but assumes the station will be 5136 * added as associated anyway since this was the required driver 5137 * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was 5138 * introduced. 5139 * In order to not bother drivers with this quirk in the API 5140 * set the flags in both the mask and set for new stations in 5141 * this case. 5142 */ 5143 if (!(params.sta_flags_mask & auth_assoc)) { 5144 params.sta_flags_mask |= auth_assoc; 5145 params.sta_flags_set |= auth_assoc; 5146 } 5147 5148 /* must be last in here for error handling */ 5149 params.vlan = get_vlan(info, rdev); 5150 if (IS_ERR(params.vlan)) 5151 return PTR_ERR(params.vlan); 5152 break; 5153 case NL80211_IFTYPE_MESH_POINT: 5154 /* ignore uAPSD data */ 5155 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD; 5156 5157 /* associated is disallowed */ 5158 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED)) 5159 return -EINVAL; 5160 /* TDLS peers cannot be added */ 5161 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) || 5162 info->attrs[NL80211_ATTR_PEER_AID]) 5163 return -EINVAL; 5164 break; 5165 case NL80211_IFTYPE_STATION: 5166 case NL80211_IFTYPE_P2P_CLIENT: 5167 /* ignore uAPSD data */ 5168 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD; 5169 5170 /* these are disallowed */ 5171 if (params.sta_flags_mask & 5172 (BIT(NL80211_STA_FLAG_ASSOCIATED) | 5173 BIT(NL80211_STA_FLAG_AUTHENTICATED))) 5174 return -EINVAL; 5175 /* Only TDLS peers can be added */ 5176 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))) 5177 return -EINVAL; 5178 /* Can only add if TDLS ... */ 5179 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS)) 5180 return -EOPNOTSUPP; 5181 /* ... with external setup is supported */ 5182 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP)) 5183 return -EOPNOTSUPP; 5184 /* 5185 * Older wpa_supplicant versions always mark the TDLS peer 5186 * as authorized, but it shouldn't yet be. 5187 */ 5188 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED); 5189 break; 5190 default: 5191 return -EOPNOTSUPP; 5192 } 5193 5194 /* be aware of params.vlan when changing code here */ 5195 5196 err = rdev_add_station(rdev, dev, mac_addr, ¶ms); 5197 5198 if (params.vlan) 5199 dev_put(params.vlan); 5200 return err; 5201 } 5202 5203 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info) 5204 { 5205 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5206 struct net_device *dev = info->user_ptr[1]; 5207 struct station_del_parameters params; 5208 5209 memset(¶ms, 0, sizeof(params)); 5210 5211 if (info->attrs[NL80211_ATTR_MAC]) 5212 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]); 5213 5214 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 5215 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN && 5216 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT && 5217 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 5218 return -EINVAL; 5219 5220 if (!rdev->ops->del_station) 5221 return -EOPNOTSUPP; 5222 5223 if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) { 5224 params.subtype = 5225 nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]); 5226 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 && 5227 params.subtype != IEEE80211_STYPE_DEAUTH >> 4) 5228 return -EINVAL; 5229 } else { 5230 /* Default to Deauthentication frame */ 5231 params.subtype = IEEE80211_STYPE_DEAUTH >> 4; 5232 } 5233 5234 if (info->attrs[NL80211_ATTR_REASON_CODE]) { 5235 params.reason_code = 5236 nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 5237 if (params.reason_code == 0) 5238 return -EINVAL; /* 0 is reserved */ 5239 } else { 5240 /* Default to reason code 2 */ 5241 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID; 5242 } 5243 5244 return rdev_del_station(rdev, dev, ¶ms); 5245 } 5246 5247 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq, 5248 int flags, struct net_device *dev, 5249 u8 *dst, u8 *next_hop, 5250 struct mpath_info *pinfo) 5251 { 5252 void *hdr; 5253 struct nlattr *pinfoattr; 5254 5255 hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH); 5256 if (!hdr) 5257 return -1; 5258 5259 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 5260 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) || 5261 nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) || 5262 nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation)) 5263 goto nla_put_failure; 5264 5265 pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO); 5266 if (!pinfoattr) 5267 goto nla_put_failure; 5268 if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) && 5269 nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN, 5270 pinfo->frame_qlen)) 5271 goto nla_put_failure; 5272 if (((pinfo->filled & MPATH_INFO_SN) && 5273 nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) || 5274 ((pinfo->filled & MPATH_INFO_METRIC) && 5275 nla_put_u32(msg, NL80211_MPATH_INFO_METRIC, 5276 pinfo->metric)) || 5277 ((pinfo->filled & MPATH_INFO_EXPTIME) && 5278 nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME, 5279 pinfo->exptime)) || 5280 ((pinfo->filled & MPATH_INFO_FLAGS) && 5281 nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS, 5282 pinfo->flags)) || 5283 ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) && 5284 nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT, 5285 pinfo->discovery_timeout)) || 5286 ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) && 5287 nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES, 5288 pinfo->discovery_retries))) 5289 goto nla_put_failure; 5290 5291 nla_nest_end(msg, pinfoattr); 5292 5293 genlmsg_end(msg, hdr); 5294 return 0; 5295 5296 nla_put_failure: 5297 genlmsg_cancel(msg, hdr); 5298 return -EMSGSIZE; 5299 } 5300 5301 static int nl80211_dump_mpath(struct sk_buff *skb, 5302 struct netlink_callback *cb) 5303 { 5304 struct mpath_info pinfo; 5305 struct cfg80211_registered_device *rdev; 5306 struct wireless_dev *wdev; 5307 u8 dst[ETH_ALEN]; 5308 u8 next_hop[ETH_ALEN]; 5309 int path_idx = cb->args[2]; 5310 int err; 5311 5312 rtnl_lock(); 5313 err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev); 5314 if (err) 5315 goto out_err; 5316 5317 if (!rdev->ops->dump_mpath) { 5318 err = -EOPNOTSUPP; 5319 goto out_err; 5320 } 5321 5322 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) { 5323 err = -EOPNOTSUPP; 5324 goto out_err; 5325 } 5326 5327 while (1) { 5328 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst, 5329 next_hop, &pinfo); 5330 if (err == -ENOENT) 5331 break; 5332 if (err) 5333 goto out_err; 5334 5335 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid, 5336 cb->nlh->nlmsg_seq, NLM_F_MULTI, 5337 wdev->netdev, dst, next_hop, 5338 &pinfo) < 0) 5339 goto out; 5340 5341 path_idx++; 5342 } 5343 5344 out: 5345 cb->args[2] = path_idx; 5346 err = skb->len; 5347 out_err: 5348 rtnl_unlock(); 5349 return err; 5350 } 5351 5352 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info) 5353 { 5354 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5355 int err; 5356 struct net_device *dev = info->user_ptr[1]; 5357 struct mpath_info pinfo; 5358 struct sk_buff *msg; 5359 u8 *dst = NULL; 5360 u8 next_hop[ETH_ALEN]; 5361 5362 memset(&pinfo, 0, sizeof(pinfo)); 5363 5364 if (!info->attrs[NL80211_ATTR_MAC]) 5365 return -EINVAL; 5366 5367 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 5368 5369 if (!rdev->ops->get_mpath) 5370 return -EOPNOTSUPP; 5371 5372 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 5373 return -EOPNOTSUPP; 5374 5375 err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo); 5376 if (err) 5377 return err; 5378 5379 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 5380 if (!msg) 5381 return -ENOMEM; 5382 5383 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0, 5384 dev, dst, next_hop, &pinfo) < 0) { 5385 nlmsg_free(msg); 5386 return -ENOBUFS; 5387 } 5388 5389 return genlmsg_reply(msg, info); 5390 } 5391 5392 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info) 5393 { 5394 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5395 struct net_device *dev = info->user_ptr[1]; 5396 u8 *dst = NULL; 5397 u8 *next_hop = NULL; 5398 5399 if (!info->attrs[NL80211_ATTR_MAC]) 5400 return -EINVAL; 5401 5402 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]) 5403 return -EINVAL; 5404 5405 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 5406 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]); 5407 5408 if (!rdev->ops->change_mpath) 5409 return -EOPNOTSUPP; 5410 5411 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 5412 return -EOPNOTSUPP; 5413 5414 return rdev_change_mpath(rdev, dev, dst, next_hop); 5415 } 5416 5417 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info) 5418 { 5419 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5420 struct net_device *dev = info->user_ptr[1]; 5421 u8 *dst = NULL; 5422 u8 *next_hop = NULL; 5423 5424 if (!info->attrs[NL80211_ATTR_MAC]) 5425 return -EINVAL; 5426 5427 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]) 5428 return -EINVAL; 5429 5430 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 5431 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]); 5432 5433 if (!rdev->ops->add_mpath) 5434 return -EOPNOTSUPP; 5435 5436 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 5437 return -EOPNOTSUPP; 5438 5439 return rdev_add_mpath(rdev, dev, dst, next_hop); 5440 } 5441 5442 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info) 5443 { 5444 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5445 struct net_device *dev = info->user_ptr[1]; 5446 u8 *dst = NULL; 5447 5448 if (info->attrs[NL80211_ATTR_MAC]) 5449 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 5450 5451 if (!rdev->ops->del_mpath) 5452 return -EOPNOTSUPP; 5453 5454 return rdev_del_mpath(rdev, dev, dst); 5455 } 5456 5457 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info) 5458 { 5459 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5460 int err; 5461 struct net_device *dev = info->user_ptr[1]; 5462 struct mpath_info pinfo; 5463 struct sk_buff *msg; 5464 u8 *dst = NULL; 5465 u8 mpp[ETH_ALEN]; 5466 5467 memset(&pinfo, 0, sizeof(pinfo)); 5468 5469 if (!info->attrs[NL80211_ATTR_MAC]) 5470 return -EINVAL; 5471 5472 dst = nla_data(info->attrs[NL80211_ATTR_MAC]); 5473 5474 if (!rdev->ops->get_mpp) 5475 return -EOPNOTSUPP; 5476 5477 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) 5478 return -EOPNOTSUPP; 5479 5480 err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo); 5481 if (err) 5482 return err; 5483 5484 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 5485 if (!msg) 5486 return -ENOMEM; 5487 5488 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0, 5489 dev, dst, mpp, &pinfo) < 0) { 5490 nlmsg_free(msg); 5491 return -ENOBUFS; 5492 } 5493 5494 return genlmsg_reply(msg, info); 5495 } 5496 5497 static int nl80211_dump_mpp(struct sk_buff *skb, 5498 struct netlink_callback *cb) 5499 { 5500 struct mpath_info pinfo; 5501 struct cfg80211_registered_device *rdev; 5502 struct wireless_dev *wdev; 5503 u8 dst[ETH_ALEN]; 5504 u8 mpp[ETH_ALEN]; 5505 int path_idx = cb->args[2]; 5506 int err; 5507 5508 rtnl_lock(); 5509 err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev); 5510 if (err) 5511 goto out_err; 5512 5513 if (!rdev->ops->dump_mpp) { 5514 err = -EOPNOTSUPP; 5515 goto out_err; 5516 } 5517 5518 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) { 5519 err = -EOPNOTSUPP; 5520 goto out_err; 5521 } 5522 5523 while (1) { 5524 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst, 5525 mpp, &pinfo); 5526 if (err == -ENOENT) 5527 break; 5528 if (err) 5529 goto out_err; 5530 5531 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid, 5532 cb->nlh->nlmsg_seq, NLM_F_MULTI, 5533 wdev->netdev, dst, mpp, 5534 &pinfo) < 0) 5535 goto out; 5536 5537 path_idx++; 5538 } 5539 5540 out: 5541 cb->args[2] = path_idx; 5542 err = skb->len; 5543 out_err: 5544 rtnl_unlock(); 5545 return err; 5546 } 5547 5548 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info) 5549 { 5550 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5551 struct net_device *dev = info->user_ptr[1]; 5552 struct wireless_dev *wdev = dev->ieee80211_ptr; 5553 struct bss_parameters params; 5554 int err; 5555 5556 memset(¶ms, 0, sizeof(params)); 5557 /* default to not changing parameters */ 5558 params.use_cts_prot = -1; 5559 params.use_short_preamble = -1; 5560 params.use_short_slot_time = -1; 5561 params.ap_isolate = -1; 5562 params.ht_opmode = -1; 5563 params.p2p_ctwindow = -1; 5564 params.p2p_opp_ps = -1; 5565 5566 if (info->attrs[NL80211_ATTR_BSS_CTS_PROT]) 5567 params.use_cts_prot = 5568 nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]); 5569 if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]) 5570 params.use_short_preamble = 5571 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]); 5572 if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]) 5573 params.use_short_slot_time = 5574 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]); 5575 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) { 5576 params.basic_rates = 5577 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 5578 params.basic_rates_len = 5579 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 5580 } 5581 if (info->attrs[NL80211_ATTR_AP_ISOLATE]) 5582 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]); 5583 if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE]) 5584 params.ht_opmode = 5585 nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]); 5586 5587 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) { 5588 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 5589 return -EINVAL; 5590 params.p2p_ctwindow = 5591 nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]); 5592 if (params.p2p_ctwindow < 0) 5593 return -EINVAL; 5594 if (params.p2p_ctwindow != 0 && 5595 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) 5596 return -EINVAL; 5597 } 5598 5599 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) { 5600 u8 tmp; 5601 5602 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 5603 return -EINVAL; 5604 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]); 5605 if (tmp > 1) 5606 return -EINVAL; 5607 params.p2p_opp_ps = tmp; 5608 if (params.p2p_opp_ps && 5609 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) 5610 return -EINVAL; 5611 } 5612 5613 if (!rdev->ops->change_bss) 5614 return -EOPNOTSUPP; 5615 5616 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP && 5617 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) 5618 return -EOPNOTSUPP; 5619 5620 wdev_lock(wdev); 5621 err = rdev_change_bss(rdev, dev, ¶ms); 5622 wdev_unlock(wdev); 5623 5624 return err; 5625 } 5626 5627 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info) 5628 { 5629 char *data = NULL; 5630 bool is_indoor; 5631 enum nl80211_user_reg_hint_type user_reg_hint_type; 5632 u32 owner_nlportid; 5633 5634 /* 5635 * You should only get this when cfg80211 hasn't yet initialized 5636 * completely when built-in to the kernel right between the time 5637 * window between nl80211_init() and regulatory_init(), if that is 5638 * even possible. 5639 */ 5640 if (unlikely(!rcu_access_pointer(cfg80211_regdomain))) 5641 return -EINPROGRESS; 5642 5643 if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]) 5644 user_reg_hint_type = 5645 nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]); 5646 else 5647 user_reg_hint_type = NL80211_USER_REG_HINT_USER; 5648 5649 switch (user_reg_hint_type) { 5650 case NL80211_USER_REG_HINT_USER: 5651 case NL80211_USER_REG_HINT_CELL_BASE: 5652 if (!info->attrs[NL80211_ATTR_REG_ALPHA2]) 5653 return -EINVAL; 5654 5655 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]); 5656 return regulatory_hint_user(data, user_reg_hint_type); 5657 case NL80211_USER_REG_HINT_INDOOR: 5658 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 5659 owner_nlportid = info->snd_portid; 5660 is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR]; 5661 } else { 5662 owner_nlportid = 0; 5663 is_indoor = true; 5664 } 5665 5666 return regulatory_hint_indoor(is_indoor, owner_nlportid); 5667 default: 5668 return -EINVAL; 5669 } 5670 } 5671 5672 static int nl80211_get_mesh_config(struct sk_buff *skb, 5673 struct genl_info *info) 5674 { 5675 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 5676 struct net_device *dev = info->user_ptr[1]; 5677 struct wireless_dev *wdev = dev->ieee80211_ptr; 5678 struct mesh_config cur_params; 5679 int err = 0; 5680 void *hdr; 5681 struct nlattr *pinfoattr; 5682 struct sk_buff *msg; 5683 5684 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) 5685 return -EOPNOTSUPP; 5686 5687 if (!rdev->ops->get_mesh_config) 5688 return -EOPNOTSUPP; 5689 5690 wdev_lock(wdev); 5691 /* If not connected, get default parameters */ 5692 if (!wdev->mesh_id_len) 5693 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params)); 5694 else 5695 err = rdev_get_mesh_config(rdev, dev, &cur_params); 5696 wdev_unlock(wdev); 5697 5698 if (err) 5699 return err; 5700 5701 /* Draw up a netlink message to send back */ 5702 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 5703 if (!msg) 5704 return -ENOMEM; 5705 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 5706 NL80211_CMD_GET_MESH_CONFIG); 5707 if (!hdr) 5708 goto out; 5709 pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG); 5710 if (!pinfoattr) 5711 goto nla_put_failure; 5712 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 5713 nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT, 5714 cur_params.dot11MeshRetryTimeout) || 5715 nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT, 5716 cur_params.dot11MeshConfirmTimeout) || 5717 nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT, 5718 cur_params.dot11MeshHoldingTimeout) || 5719 nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS, 5720 cur_params.dot11MeshMaxPeerLinks) || 5721 nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES, 5722 cur_params.dot11MeshMaxRetries) || 5723 nla_put_u8(msg, NL80211_MESHCONF_TTL, 5724 cur_params.dot11MeshTTL) || 5725 nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL, 5726 cur_params.element_ttl) || 5727 nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS, 5728 cur_params.auto_open_plinks) || 5729 nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR, 5730 cur_params.dot11MeshNbrOffsetMaxNeighbor) || 5731 nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES, 5732 cur_params.dot11MeshHWMPmaxPREQretries) || 5733 nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME, 5734 cur_params.path_refresh_time) || 5735 nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT, 5736 cur_params.min_discovery_timeout) || 5737 nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT, 5738 cur_params.dot11MeshHWMPactivePathTimeout) || 5739 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL, 5740 cur_params.dot11MeshHWMPpreqMinInterval) || 5741 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL, 5742 cur_params.dot11MeshHWMPperrMinInterval) || 5743 nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME, 5744 cur_params.dot11MeshHWMPnetDiameterTraversalTime) || 5745 nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE, 5746 cur_params.dot11MeshHWMPRootMode) || 5747 nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL, 5748 cur_params.dot11MeshHWMPRannInterval) || 5749 nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS, 5750 cur_params.dot11MeshGateAnnouncementProtocol) || 5751 nla_put_u8(msg, NL80211_MESHCONF_FORWARDING, 5752 cur_params.dot11MeshForwarding) || 5753 nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD, 5754 cur_params.rssi_threshold) || 5755 nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE, 5756 cur_params.ht_opmode) || 5757 nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT, 5758 cur_params.dot11MeshHWMPactivePathToRootTimeout) || 5759 nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL, 5760 cur_params.dot11MeshHWMProotInterval) || 5761 nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL, 5762 cur_params.dot11MeshHWMPconfirmationInterval) || 5763 nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE, 5764 cur_params.power_mode) || 5765 nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW, 5766 cur_params.dot11MeshAwakeWindowDuration) || 5767 nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT, 5768 cur_params.plink_timeout)) 5769 goto nla_put_failure; 5770 nla_nest_end(msg, pinfoattr); 5771 genlmsg_end(msg, hdr); 5772 return genlmsg_reply(msg, info); 5773 5774 nla_put_failure: 5775 genlmsg_cancel(msg, hdr); 5776 out: 5777 nlmsg_free(msg); 5778 return -ENOBUFS; 5779 } 5780 5781 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = { 5782 [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 }, 5783 [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 }, 5784 [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 }, 5785 [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 }, 5786 [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 }, 5787 [NL80211_MESHCONF_TTL] = { .type = NLA_U8 }, 5788 [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 }, 5789 [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 }, 5790 [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 }, 5791 [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 }, 5792 [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 }, 5793 [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 }, 5794 [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 }, 5795 [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 }, 5796 [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 }, 5797 [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 }, 5798 [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 }, 5799 [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 }, 5800 [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 }, 5801 [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 }, 5802 [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 }, 5803 [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 }, 5804 [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 }, 5805 [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 }, 5806 [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 }, 5807 [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 }, 5808 [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 }, 5809 [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 }, 5810 }; 5811 5812 static const struct nla_policy 5813 nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = { 5814 [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 }, 5815 [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 }, 5816 [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 }, 5817 [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG }, 5818 [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 }, 5819 [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG }, 5820 [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY, 5821 .len = IEEE80211_MAX_DATA_LEN }, 5822 [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG }, 5823 }; 5824 5825 static int nl80211_check_bool(const struct nlattr *nla, u8 min, u8 max, bool *out) 5826 { 5827 u8 val = nla_get_u8(nla); 5828 if (val < min || val > max) 5829 return -EINVAL; 5830 *out = val; 5831 return 0; 5832 } 5833 5834 static int nl80211_check_u8(const struct nlattr *nla, u8 min, u8 max, u8 *out) 5835 { 5836 u8 val = nla_get_u8(nla); 5837 if (val < min || val > max) 5838 return -EINVAL; 5839 *out = val; 5840 return 0; 5841 } 5842 5843 static int nl80211_check_u16(const struct nlattr *nla, u16 min, u16 max, u16 *out) 5844 { 5845 u16 val = nla_get_u16(nla); 5846 if (val < min || val > max) 5847 return -EINVAL; 5848 *out = val; 5849 return 0; 5850 } 5851 5852 static int nl80211_check_u32(const struct nlattr *nla, u32 min, u32 max, u32 *out) 5853 { 5854 u32 val = nla_get_u32(nla); 5855 if (val < min || val > max) 5856 return -EINVAL; 5857 *out = val; 5858 return 0; 5859 } 5860 5861 static int nl80211_check_s32(const struct nlattr *nla, s32 min, s32 max, s32 *out) 5862 { 5863 s32 val = nla_get_s32(nla); 5864 if (val < min || val > max) 5865 return -EINVAL; 5866 *out = val; 5867 return 0; 5868 } 5869 5870 static int nl80211_check_power_mode(const struct nlattr *nla, 5871 enum nl80211_mesh_power_mode min, 5872 enum nl80211_mesh_power_mode max, 5873 enum nl80211_mesh_power_mode *out) 5874 { 5875 u32 val = nla_get_u32(nla); 5876 if (val < min || val > max) 5877 return -EINVAL; 5878 *out = val; 5879 return 0; 5880 } 5881 5882 static int nl80211_parse_mesh_config(struct genl_info *info, 5883 struct mesh_config *cfg, 5884 u32 *mask_out) 5885 { 5886 struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1]; 5887 u32 mask = 0; 5888 u16 ht_opmode; 5889 5890 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \ 5891 do { \ 5892 if (tb[attr]) { \ 5893 if (fn(tb[attr], min, max, &cfg->param)) \ 5894 return -EINVAL; \ 5895 mask |= (1 << (attr - 1)); \ 5896 } \ 5897 } while (0) 5898 5899 if (!info->attrs[NL80211_ATTR_MESH_CONFIG]) 5900 return -EINVAL; 5901 if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX, 5902 info->attrs[NL80211_ATTR_MESH_CONFIG], 5903 nl80211_meshconf_params_policy, info->extack)) 5904 return -EINVAL; 5905 5906 /* This makes sure that there aren't more than 32 mesh config 5907 * parameters (otherwise our bitfield scheme would not work.) */ 5908 BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32); 5909 5910 /* Fill in the params struct */ 5911 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255, 5912 mask, NL80211_MESHCONF_RETRY_TIMEOUT, 5913 nl80211_check_u16); 5914 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255, 5915 mask, NL80211_MESHCONF_CONFIRM_TIMEOUT, 5916 nl80211_check_u16); 5917 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255, 5918 mask, NL80211_MESHCONF_HOLDING_TIMEOUT, 5919 nl80211_check_u16); 5920 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255, 5921 mask, NL80211_MESHCONF_MAX_PEER_LINKS, 5922 nl80211_check_u16); 5923 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16, 5924 mask, NL80211_MESHCONF_MAX_RETRIES, 5925 nl80211_check_u8); 5926 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255, 5927 mask, NL80211_MESHCONF_TTL, nl80211_check_u8); 5928 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255, 5929 mask, NL80211_MESHCONF_ELEMENT_TTL, 5930 nl80211_check_u8); 5931 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1, 5932 mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS, 5933 nl80211_check_bool); 5934 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor, 5935 1, 255, mask, 5936 NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR, 5937 nl80211_check_u32); 5938 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255, 5939 mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES, 5940 nl80211_check_u8); 5941 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535, 5942 mask, NL80211_MESHCONF_PATH_REFRESH_TIME, 5943 nl80211_check_u32); 5944 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535, 5945 mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT, 5946 nl80211_check_u16); 5947 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout, 5948 1, 65535, mask, 5949 NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT, 5950 nl80211_check_u32); 5951 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, 5952 1, 65535, mask, 5953 NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL, 5954 nl80211_check_u16); 5955 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, 5956 1, 65535, mask, 5957 NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL, 5958 nl80211_check_u16); 5959 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, 5960 dot11MeshHWMPnetDiameterTraversalTime, 5961 1, 65535, mask, 5962 NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME, 5963 nl80211_check_u16); 5964 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4, 5965 mask, NL80211_MESHCONF_HWMP_ROOTMODE, 5966 nl80211_check_u8); 5967 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535, 5968 mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL, 5969 nl80211_check_u16); 5970 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, 5971 dot11MeshGateAnnouncementProtocol, 0, 1, 5972 mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS, 5973 nl80211_check_bool); 5974 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1, 5975 mask, NL80211_MESHCONF_FORWARDING, 5976 nl80211_check_bool); 5977 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0, 5978 mask, NL80211_MESHCONF_RSSI_THRESHOLD, 5979 nl80211_check_s32); 5980 /* 5981 * Check HT operation mode based on 5982 * IEEE 802.11 2012 8.4.2.59 HT Operation element. 5983 */ 5984 if (tb[NL80211_MESHCONF_HT_OPMODE]) { 5985 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]); 5986 5987 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION | 5988 IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT | 5989 IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)) 5990 return -EINVAL; 5991 5992 if ((ht_opmode & IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT) && 5993 (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)) 5994 return -EINVAL; 5995 5996 switch (ht_opmode & IEEE80211_HT_OP_MODE_PROTECTION) { 5997 case IEEE80211_HT_OP_MODE_PROTECTION_NONE: 5998 case IEEE80211_HT_OP_MODE_PROTECTION_20MHZ: 5999 if (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT) 6000 return -EINVAL; 6001 break; 6002 case IEEE80211_HT_OP_MODE_PROTECTION_NONMEMBER: 6003 case IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED: 6004 if (!(ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)) 6005 return -EINVAL; 6006 break; 6007 } 6008 cfg->ht_opmode = ht_opmode; 6009 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1)); 6010 } 6011 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout, 6012 1, 65535, mask, 6013 NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT, 6014 nl80211_check_u32); 6015 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535, 6016 mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL, 6017 nl80211_check_u16); 6018 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, 6019 dot11MeshHWMPconfirmationInterval, 6020 1, 65535, mask, 6021 NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL, 6022 nl80211_check_u16); 6023 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, 6024 NL80211_MESH_POWER_ACTIVE, 6025 NL80211_MESH_POWER_MAX, 6026 mask, NL80211_MESHCONF_POWER_MODE, 6027 nl80211_check_power_mode); 6028 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, 6029 0, 65535, mask, 6030 NL80211_MESHCONF_AWAKE_WINDOW, nl80211_check_u16); 6031 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 0, 0xffffffff, 6032 mask, NL80211_MESHCONF_PLINK_TIMEOUT, 6033 nl80211_check_u32); 6034 if (mask_out) 6035 *mask_out = mask; 6036 6037 return 0; 6038 6039 #undef FILL_IN_MESH_PARAM_IF_SET 6040 } 6041 6042 static int nl80211_parse_mesh_setup(struct genl_info *info, 6043 struct mesh_setup *setup) 6044 { 6045 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6046 struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1]; 6047 6048 if (!info->attrs[NL80211_ATTR_MESH_SETUP]) 6049 return -EINVAL; 6050 if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX, 6051 info->attrs[NL80211_ATTR_MESH_SETUP], 6052 nl80211_mesh_setup_params_policy, info->extack)) 6053 return -EINVAL; 6054 6055 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC]) 6056 setup->sync_method = 6057 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ? 6058 IEEE80211_SYNC_METHOD_VENDOR : 6059 IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET; 6060 6061 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL]) 6062 setup->path_sel_proto = 6063 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ? 6064 IEEE80211_PATH_PROTOCOL_VENDOR : 6065 IEEE80211_PATH_PROTOCOL_HWMP; 6066 6067 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC]) 6068 setup->path_metric = 6069 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ? 6070 IEEE80211_PATH_METRIC_VENDOR : 6071 IEEE80211_PATH_METRIC_AIRTIME; 6072 6073 if (tb[NL80211_MESH_SETUP_IE]) { 6074 struct nlattr *ieattr = 6075 tb[NL80211_MESH_SETUP_IE]; 6076 if (!is_valid_ie_attr(ieattr)) 6077 return -EINVAL; 6078 setup->ie = nla_data(ieattr); 6079 setup->ie_len = nla_len(ieattr); 6080 } 6081 if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] && 6082 !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM)) 6083 return -EINVAL; 6084 setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]); 6085 setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]); 6086 setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]); 6087 if (setup->is_secure) 6088 setup->user_mpm = true; 6089 6090 if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) { 6091 if (!setup->user_mpm) 6092 return -EINVAL; 6093 setup->auth_id = 6094 nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]); 6095 } 6096 6097 return 0; 6098 } 6099 6100 static int nl80211_update_mesh_config(struct sk_buff *skb, 6101 struct genl_info *info) 6102 { 6103 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6104 struct net_device *dev = info->user_ptr[1]; 6105 struct wireless_dev *wdev = dev->ieee80211_ptr; 6106 struct mesh_config cfg; 6107 u32 mask; 6108 int err; 6109 6110 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) 6111 return -EOPNOTSUPP; 6112 6113 if (!rdev->ops->update_mesh_config) 6114 return -EOPNOTSUPP; 6115 6116 err = nl80211_parse_mesh_config(info, &cfg, &mask); 6117 if (err) 6118 return err; 6119 6120 wdev_lock(wdev); 6121 if (!wdev->mesh_id_len) 6122 err = -ENOLINK; 6123 6124 if (!err) 6125 err = rdev_update_mesh_config(rdev, dev, mask, &cfg); 6126 6127 wdev_unlock(wdev); 6128 6129 return err; 6130 } 6131 6132 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom, 6133 struct sk_buff *msg) 6134 { 6135 struct nlattr *nl_reg_rules; 6136 unsigned int i; 6137 6138 if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) || 6139 (regdom->dfs_region && 6140 nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region))) 6141 goto nla_put_failure; 6142 6143 nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES); 6144 if (!nl_reg_rules) 6145 goto nla_put_failure; 6146 6147 for (i = 0; i < regdom->n_reg_rules; i++) { 6148 struct nlattr *nl_reg_rule; 6149 const struct ieee80211_reg_rule *reg_rule; 6150 const struct ieee80211_freq_range *freq_range; 6151 const struct ieee80211_power_rule *power_rule; 6152 unsigned int max_bandwidth_khz; 6153 6154 reg_rule = ®dom->reg_rules[i]; 6155 freq_range = ®_rule->freq_range; 6156 power_rule = ®_rule->power_rule; 6157 6158 nl_reg_rule = nla_nest_start(msg, i); 6159 if (!nl_reg_rule) 6160 goto nla_put_failure; 6161 6162 max_bandwidth_khz = freq_range->max_bandwidth_khz; 6163 if (!max_bandwidth_khz) 6164 max_bandwidth_khz = reg_get_max_bandwidth(regdom, 6165 reg_rule); 6166 6167 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS, 6168 reg_rule->flags) || 6169 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START, 6170 freq_range->start_freq_khz) || 6171 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END, 6172 freq_range->end_freq_khz) || 6173 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW, 6174 max_bandwidth_khz) || 6175 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN, 6176 power_rule->max_antenna_gain) || 6177 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP, 6178 power_rule->max_eirp) || 6179 nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME, 6180 reg_rule->dfs_cac_ms)) 6181 goto nla_put_failure; 6182 6183 nla_nest_end(msg, nl_reg_rule); 6184 } 6185 6186 nla_nest_end(msg, nl_reg_rules); 6187 return 0; 6188 6189 nla_put_failure: 6190 return -EMSGSIZE; 6191 } 6192 6193 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info) 6194 { 6195 const struct ieee80211_regdomain *regdom = NULL; 6196 struct cfg80211_registered_device *rdev; 6197 struct wiphy *wiphy = NULL; 6198 struct sk_buff *msg; 6199 void *hdr; 6200 6201 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 6202 if (!msg) 6203 return -ENOBUFS; 6204 6205 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 6206 NL80211_CMD_GET_REG); 6207 if (!hdr) 6208 goto put_failure; 6209 6210 if (info->attrs[NL80211_ATTR_WIPHY]) { 6211 bool self_managed; 6212 6213 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info); 6214 if (IS_ERR(rdev)) { 6215 nlmsg_free(msg); 6216 return PTR_ERR(rdev); 6217 } 6218 6219 wiphy = &rdev->wiphy; 6220 self_managed = wiphy->regulatory_flags & 6221 REGULATORY_WIPHY_SELF_MANAGED; 6222 regdom = get_wiphy_regdom(wiphy); 6223 6224 /* a self-managed-reg device must have a private regdom */ 6225 if (WARN_ON(!regdom && self_managed)) { 6226 nlmsg_free(msg); 6227 return -EINVAL; 6228 } 6229 6230 if (regdom && 6231 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy))) 6232 goto nla_put_failure; 6233 } 6234 6235 if (!wiphy && reg_last_request_cell_base() && 6236 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE, 6237 NL80211_USER_REG_HINT_CELL_BASE)) 6238 goto nla_put_failure; 6239 6240 rcu_read_lock(); 6241 6242 if (!regdom) 6243 regdom = rcu_dereference(cfg80211_regdomain); 6244 6245 if (nl80211_put_regdom(regdom, msg)) 6246 goto nla_put_failure_rcu; 6247 6248 rcu_read_unlock(); 6249 6250 genlmsg_end(msg, hdr); 6251 return genlmsg_reply(msg, info); 6252 6253 nla_put_failure_rcu: 6254 rcu_read_unlock(); 6255 nla_put_failure: 6256 genlmsg_cancel(msg, hdr); 6257 put_failure: 6258 nlmsg_free(msg); 6259 return -EMSGSIZE; 6260 } 6261 6262 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb, 6263 u32 seq, int flags, struct wiphy *wiphy, 6264 const struct ieee80211_regdomain *regdom) 6265 { 6266 void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags, 6267 NL80211_CMD_GET_REG); 6268 6269 if (!hdr) 6270 return -1; 6271 6272 genl_dump_check_consistent(cb, hdr, &nl80211_fam); 6273 6274 if (nl80211_put_regdom(regdom, msg)) 6275 goto nla_put_failure; 6276 6277 if (!wiphy && reg_last_request_cell_base() && 6278 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE, 6279 NL80211_USER_REG_HINT_CELL_BASE)) 6280 goto nla_put_failure; 6281 6282 if (wiphy && 6283 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy))) 6284 goto nla_put_failure; 6285 6286 if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED && 6287 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG)) 6288 goto nla_put_failure; 6289 6290 genlmsg_end(msg, hdr); 6291 return 0; 6292 6293 nla_put_failure: 6294 genlmsg_cancel(msg, hdr); 6295 return -EMSGSIZE; 6296 } 6297 6298 static int nl80211_get_reg_dump(struct sk_buff *skb, 6299 struct netlink_callback *cb) 6300 { 6301 const struct ieee80211_regdomain *regdom = NULL; 6302 struct cfg80211_registered_device *rdev; 6303 int err, reg_idx, start = cb->args[2]; 6304 6305 rtnl_lock(); 6306 6307 if (cfg80211_regdomain && start == 0) { 6308 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq, 6309 NLM_F_MULTI, NULL, 6310 rtnl_dereference(cfg80211_regdomain)); 6311 if (err < 0) 6312 goto out_err; 6313 } 6314 6315 /* the global regdom is idx 0 */ 6316 reg_idx = 1; 6317 list_for_each_entry(rdev, &cfg80211_rdev_list, list) { 6318 regdom = get_wiphy_regdom(&rdev->wiphy); 6319 if (!regdom) 6320 continue; 6321 6322 if (++reg_idx <= start) 6323 continue; 6324 6325 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq, 6326 NLM_F_MULTI, &rdev->wiphy, regdom); 6327 if (err < 0) { 6328 reg_idx--; 6329 break; 6330 } 6331 } 6332 6333 cb->args[2] = reg_idx; 6334 err = skb->len; 6335 out_err: 6336 rtnl_unlock(); 6337 return err; 6338 } 6339 6340 #ifdef CONFIG_CFG80211_CRDA_SUPPORT 6341 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = { 6342 [NL80211_ATTR_REG_RULE_FLAGS] = { .type = NLA_U32 }, 6343 [NL80211_ATTR_FREQ_RANGE_START] = { .type = NLA_U32 }, 6344 [NL80211_ATTR_FREQ_RANGE_END] = { .type = NLA_U32 }, 6345 [NL80211_ATTR_FREQ_RANGE_MAX_BW] = { .type = NLA_U32 }, 6346 [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN] = { .type = NLA_U32 }, 6347 [NL80211_ATTR_POWER_RULE_MAX_EIRP] = { .type = NLA_U32 }, 6348 [NL80211_ATTR_DFS_CAC_TIME] = { .type = NLA_U32 }, 6349 }; 6350 6351 static int parse_reg_rule(struct nlattr *tb[], 6352 struct ieee80211_reg_rule *reg_rule) 6353 { 6354 struct ieee80211_freq_range *freq_range = ®_rule->freq_range; 6355 struct ieee80211_power_rule *power_rule = ®_rule->power_rule; 6356 6357 if (!tb[NL80211_ATTR_REG_RULE_FLAGS]) 6358 return -EINVAL; 6359 if (!tb[NL80211_ATTR_FREQ_RANGE_START]) 6360 return -EINVAL; 6361 if (!tb[NL80211_ATTR_FREQ_RANGE_END]) 6362 return -EINVAL; 6363 if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]) 6364 return -EINVAL; 6365 if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]) 6366 return -EINVAL; 6367 6368 reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]); 6369 6370 freq_range->start_freq_khz = 6371 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]); 6372 freq_range->end_freq_khz = 6373 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]); 6374 freq_range->max_bandwidth_khz = 6375 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]); 6376 6377 power_rule->max_eirp = 6378 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]); 6379 6380 if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]) 6381 power_rule->max_antenna_gain = 6382 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]); 6383 6384 if (tb[NL80211_ATTR_DFS_CAC_TIME]) 6385 reg_rule->dfs_cac_ms = 6386 nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]); 6387 6388 return 0; 6389 } 6390 6391 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info) 6392 { 6393 struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1]; 6394 struct nlattr *nl_reg_rule; 6395 char *alpha2; 6396 int rem_reg_rules, r; 6397 u32 num_rules = 0, rule_idx = 0, size_of_regd; 6398 enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET; 6399 struct ieee80211_regdomain *rd; 6400 6401 if (!info->attrs[NL80211_ATTR_REG_ALPHA2]) 6402 return -EINVAL; 6403 6404 if (!info->attrs[NL80211_ATTR_REG_RULES]) 6405 return -EINVAL; 6406 6407 alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]); 6408 6409 if (info->attrs[NL80211_ATTR_DFS_REGION]) 6410 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]); 6411 6412 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES], 6413 rem_reg_rules) { 6414 num_rules++; 6415 if (num_rules > NL80211_MAX_SUPP_REG_RULES) 6416 return -EINVAL; 6417 } 6418 6419 if (!reg_is_valid_request(alpha2)) 6420 return -EINVAL; 6421 6422 size_of_regd = sizeof(struct ieee80211_regdomain) + 6423 num_rules * sizeof(struct ieee80211_reg_rule); 6424 6425 rd = kzalloc(size_of_regd, GFP_KERNEL); 6426 if (!rd) 6427 return -ENOMEM; 6428 6429 rd->n_reg_rules = num_rules; 6430 rd->alpha2[0] = alpha2[0]; 6431 rd->alpha2[1] = alpha2[1]; 6432 6433 /* 6434 * Disable DFS master mode if the DFS region was 6435 * not supported or known on this kernel. 6436 */ 6437 if (reg_supported_dfs_region(dfs_region)) 6438 rd->dfs_region = dfs_region; 6439 6440 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES], 6441 rem_reg_rules) { 6442 r = nla_parse_nested(tb, NL80211_REG_RULE_ATTR_MAX, 6443 nl_reg_rule, reg_rule_policy, 6444 info->extack); 6445 if (r) 6446 goto bad_reg; 6447 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]); 6448 if (r) 6449 goto bad_reg; 6450 6451 rule_idx++; 6452 6453 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) { 6454 r = -EINVAL; 6455 goto bad_reg; 6456 } 6457 } 6458 6459 /* set_regdom takes ownership of rd */ 6460 return set_regdom(rd, REGD_SOURCE_CRDA); 6461 bad_reg: 6462 kfree(rd); 6463 return r; 6464 } 6465 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */ 6466 6467 static int validate_scan_freqs(struct nlattr *freqs) 6468 { 6469 struct nlattr *attr1, *attr2; 6470 int n_channels = 0, tmp1, tmp2; 6471 6472 nla_for_each_nested(attr1, freqs, tmp1) { 6473 n_channels++; 6474 /* 6475 * Some hardware has a limited channel list for 6476 * scanning, and it is pretty much nonsensical 6477 * to scan for a channel twice, so disallow that 6478 * and don't require drivers to check that the 6479 * channel list they get isn't longer than what 6480 * they can scan, as long as they can scan all 6481 * the channels they registered at once. 6482 */ 6483 nla_for_each_nested(attr2, freqs, tmp2) 6484 if (attr1 != attr2 && 6485 nla_get_u32(attr1) == nla_get_u32(attr2)) 6486 return 0; 6487 } 6488 6489 return n_channels; 6490 } 6491 6492 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b) 6493 { 6494 return b < NUM_NL80211_BANDS && wiphy->bands[b]; 6495 } 6496 6497 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy, 6498 struct cfg80211_bss_selection *bss_select) 6499 { 6500 struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1]; 6501 struct nlattr *nest; 6502 int err; 6503 bool found = false; 6504 int i; 6505 6506 /* only process one nested attribute */ 6507 nest = nla_data(nla); 6508 if (!nla_ok(nest, nla_len(nest))) 6509 return -EINVAL; 6510 6511 err = nla_parse_nested(attr, NL80211_BSS_SELECT_ATTR_MAX, nest, 6512 nl80211_bss_select_policy, NULL); 6513 if (err) 6514 return err; 6515 6516 /* only one attribute may be given */ 6517 for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) { 6518 if (attr[i]) { 6519 if (found) 6520 return -EINVAL; 6521 found = true; 6522 } 6523 } 6524 6525 bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID; 6526 6527 if (attr[NL80211_BSS_SELECT_ATTR_RSSI]) 6528 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI; 6529 6530 if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) { 6531 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF; 6532 bss_select->param.band_pref = 6533 nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]); 6534 if (!is_band_valid(wiphy, bss_select->param.band_pref)) 6535 return -EINVAL; 6536 } 6537 6538 if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) { 6539 struct nl80211_bss_select_rssi_adjust *adj_param; 6540 6541 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]); 6542 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST; 6543 bss_select->param.adjust.band = adj_param->band; 6544 bss_select->param.adjust.delta = adj_param->delta; 6545 if (!is_band_valid(wiphy, bss_select->param.adjust.band)) 6546 return -EINVAL; 6547 } 6548 6549 /* user-space did not provide behaviour attribute */ 6550 if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID) 6551 return -EINVAL; 6552 6553 if (!(wiphy->bss_select_support & BIT(bss_select->behaviour))) 6554 return -EINVAL; 6555 6556 return 0; 6557 } 6558 6559 static int nl80211_parse_random_mac(struct nlattr **attrs, 6560 u8 *mac_addr, u8 *mac_addr_mask) 6561 { 6562 int i; 6563 6564 if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) { 6565 eth_zero_addr(mac_addr); 6566 eth_zero_addr(mac_addr_mask); 6567 mac_addr[0] = 0x2; 6568 mac_addr_mask[0] = 0x3; 6569 6570 return 0; 6571 } 6572 6573 /* need both or none */ 6574 if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK]) 6575 return -EINVAL; 6576 6577 memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN); 6578 memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN); 6579 6580 /* don't allow or configure an mcast address */ 6581 if (!is_multicast_ether_addr(mac_addr_mask) || 6582 is_multicast_ether_addr(mac_addr)) 6583 return -EINVAL; 6584 6585 /* 6586 * allow users to pass a MAC address that has bits set outside 6587 * of the mask, but don't bother drivers with having to deal 6588 * with such bits 6589 */ 6590 for (i = 0; i < ETH_ALEN; i++) 6591 mac_addr[i] &= mac_addr_mask[i]; 6592 6593 return 0; 6594 } 6595 6596 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev) 6597 { 6598 ASSERT_WDEV_LOCK(wdev); 6599 6600 if (!cfg80211_beaconing_iface_active(wdev)) 6601 return true; 6602 6603 if (!(wdev->chandef.chan->flags & IEEE80211_CHAN_RADAR)) 6604 return true; 6605 6606 return regulatory_pre_cac_allowed(wdev->wiphy); 6607 } 6608 6609 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info) 6610 { 6611 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6612 struct wireless_dev *wdev = info->user_ptr[1]; 6613 struct cfg80211_scan_request *request; 6614 struct nlattr *attr; 6615 struct wiphy *wiphy; 6616 int err, tmp, n_ssids = 0, n_channels, i; 6617 size_t ie_len; 6618 6619 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) 6620 return -EINVAL; 6621 6622 wiphy = &rdev->wiphy; 6623 6624 if (wdev->iftype == NL80211_IFTYPE_NAN) 6625 return -EOPNOTSUPP; 6626 6627 if (!rdev->ops->scan) 6628 return -EOPNOTSUPP; 6629 6630 if (rdev->scan_req || rdev->scan_msg) { 6631 err = -EBUSY; 6632 goto unlock; 6633 } 6634 6635 if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) { 6636 n_channels = validate_scan_freqs( 6637 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]); 6638 if (!n_channels) { 6639 err = -EINVAL; 6640 goto unlock; 6641 } 6642 } else { 6643 n_channels = ieee80211_get_num_supported_channels(wiphy); 6644 } 6645 6646 if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) 6647 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) 6648 n_ssids++; 6649 6650 if (n_ssids > wiphy->max_scan_ssids) { 6651 err = -EINVAL; 6652 goto unlock; 6653 } 6654 6655 if (info->attrs[NL80211_ATTR_IE]) 6656 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 6657 else 6658 ie_len = 0; 6659 6660 if (ie_len > wiphy->max_scan_ie_len) { 6661 err = -EINVAL; 6662 goto unlock; 6663 } 6664 6665 request = kzalloc(sizeof(*request) 6666 + sizeof(*request->ssids) * n_ssids 6667 + sizeof(*request->channels) * n_channels 6668 + ie_len, GFP_KERNEL); 6669 if (!request) { 6670 err = -ENOMEM; 6671 goto unlock; 6672 } 6673 6674 if (n_ssids) 6675 request->ssids = (void *)&request->channels[n_channels]; 6676 request->n_ssids = n_ssids; 6677 if (ie_len) { 6678 if (n_ssids) 6679 request->ie = (void *)(request->ssids + n_ssids); 6680 else 6681 request->ie = (void *)(request->channels + n_channels); 6682 } 6683 6684 i = 0; 6685 if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) { 6686 /* user specified, bail out if channel not found */ 6687 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) { 6688 struct ieee80211_channel *chan; 6689 6690 chan = ieee80211_get_channel(wiphy, nla_get_u32(attr)); 6691 6692 if (!chan) { 6693 err = -EINVAL; 6694 goto out_free; 6695 } 6696 6697 /* ignore disabled channels */ 6698 if (chan->flags & IEEE80211_CHAN_DISABLED) 6699 continue; 6700 6701 request->channels[i] = chan; 6702 i++; 6703 } 6704 } else { 6705 enum nl80211_band band; 6706 6707 /* all channels */ 6708 for (band = 0; band < NUM_NL80211_BANDS; band++) { 6709 int j; 6710 6711 if (!wiphy->bands[band]) 6712 continue; 6713 for (j = 0; j < wiphy->bands[band]->n_channels; j++) { 6714 struct ieee80211_channel *chan; 6715 6716 chan = &wiphy->bands[band]->channels[j]; 6717 6718 if (chan->flags & IEEE80211_CHAN_DISABLED) 6719 continue; 6720 6721 request->channels[i] = chan; 6722 i++; 6723 } 6724 } 6725 } 6726 6727 if (!i) { 6728 err = -EINVAL; 6729 goto out_free; 6730 } 6731 6732 request->n_channels = i; 6733 6734 wdev_lock(wdev); 6735 if (!cfg80211_off_channel_oper_allowed(wdev)) { 6736 struct ieee80211_channel *chan; 6737 6738 if (request->n_channels != 1) { 6739 wdev_unlock(wdev); 6740 err = -EBUSY; 6741 goto out_free; 6742 } 6743 6744 chan = request->channels[0]; 6745 if (chan->center_freq != wdev->chandef.chan->center_freq) { 6746 wdev_unlock(wdev); 6747 err = -EBUSY; 6748 goto out_free; 6749 } 6750 } 6751 wdev_unlock(wdev); 6752 6753 i = 0; 6754 if (n_ssids) { 6755 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) { 6756 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) { 6757 err = -EINVAL; 6758 goto out_free; 6759 } 6760 request->ssids[i].ssid_len = nla_len(attr); 6761 memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr)); 6762 i++; 6763 } 6764 } 6765 6766 if (info->attrs[NL80211_ATTR_IE]) { 6767 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 6768 memcpy((void *)request->ie, 6769 nla_data(info->attrs[NL80211_ATTR_IE]), 6770 request->ie_len); 6771 } 6772 6773 for (i = 0; i < NUM_NL80211_BANDS; i++) 6774 if (wiphy->bands[i]) 6775 request->rates[i] = 6776 (1 << wiphy->bands[i]->n_bitrates) - 1; 6777 6778 if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) { 6779 nla_for_each_nested(attr, 6780 info->attrs[NL80211_ATTR_SCAN_SUPP_RATES], 6781 tmp) { 6782 enum nl80211_band band = nla_type(attr); 6783 6784 if (band < 0 || band >= NUM_NL80211_BANDS) { 6785 err = -EINVAL; 6786 goto out_free; 6787 } 6788 6789 if (!wiphy->bands[band]) 6790 continue; 6791 6792 err = ieee80211_get_ratemask(wiphy->bands[band], 6793 nla_data(attr), 6794 nla_len(attr), 6795 &request->rates[band]); 6796 if (err) 6797 goto out_free; 6798 } 6799 } 6800 6801 if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) { 6802 if (!wiphy_ext_feature_isset(wiphy, 6803 NL80211_EXT_FEATURE_SET_SCAN_DWELL)) { 6804 err = -EOPNOTSUPP; 6805 goto out_free; 6806 } 6807 6808 request->duration = 6809 nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]); 6810 request->duration_mandatory = 6811 nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]); 6812 } 6813 6814 if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) { 6815 request->flags = nla_get_u32( 6816 info->attrs[NL80211_ATTR_SCAN_FLAGS]); 6817 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) && 6818 !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) { 6819 err = -EOPNOTSUPP; 6820 goto out_free; 6821 } 6822 6823 if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) { 6824 if (!(wiphy->features & 6825 NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR)) { 6826 err = -EOPNOTSUPP; 6827 goto out_free; 6828 } 6829 6830 if (wdev->current_bss) { 6831 err = -EOPNOTSUPP; 6832 goto out_free; 6833 } 6834 6835 err = nl80211_parse_random_mac(info->attrs, 6836 request->mac_addr, 6837 request->mac_addr_mask); 6838 if (err) 6839 goto out_free; 6840 } 6841 } 6842 6843 request->no_cck = 6844 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]); 6845 6846 /* Initial implementation used NL80211_ATTR_MAC to set the specific 6847 * BSSID to scan for. This was problematic because that same attribute 6848 * was already used for another purpose (local random MAC address). The 6849 * NL80211_ATTR_BSSID attribute was added to fix this. For backwards 6850 * compatibility with older userspace components, also use the 6851 * NL80211_ATTR_MAC value here if it can be determined to be used for 6852 * the specific BSSID use case instead of the random MAC address 6853 * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use). 6854 */ 6855 if (info->attrs[NL80211_ATTR_BSSID]) 6856 memcpy(request->bssid, 6857 nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN); 6858 else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) && 6859 info->attrs[NL80211_ATTR_MAC]) 6860 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]), 6861 ETH_ALEN); 6862 else 6863 eth_broadcast_addr(request->bssid); 6864 6865 request->wdev = wdev; 6866 request->wiphy = &rdev->wiphy; 6867 request->scan_start = jiffies; 6868 6869 rdev->scan_req = request; 6870 err = rdev_scan(rdev, request); 6871 6872 if (!err) { 6873 nl80211_send_scan_start(rdev, wdev); 6874 if (wdev->netdev) 6875 dev_hold(wdev->netdev); 6876 } else { 6877 out_free: 6878 rdev->scan_req = NULL; 6879 kfree(request); 6880 } 6881 6882 unlock: 6883 return err; 6884 } 6885 6886 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info) 6887 { 6888 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 6889 struct wireless_dev *wdev = info->user_ptr[1]; 6890 6891 if (!rdev->ops->abort_scan) 6892 return -EOPNOTSUPP; 6893 6894 if (rdev->scan_msg) 6895 return 0; 6896 6897 if (!rdev->scan_req) 6898 return -ENOENT; 6899 6900 rdev_abort_scan(rdev, wdev); 6901 return 0; 6902 } 6903 6904 static int 6905 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans, 6906 struct cfg80211_sched_scan_request *request, 6907 struct nlattr **attrs) 6908 { 6909 int tmp, err, i = 0; 6910 struct nlattr *attr; 6911 6912 if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) { 6913 u32 interval; 6914 6915 /* 6916 * If scan plans are not specified, 6917 * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this 6918 * case one scan plan will be set with the specified scan 6919 * interval and infinite number of iterations. 6920 */ 6921 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]); 6922 if (!interval) 6923 return -EINVAL; 6924 6925 request->scan_plans[0].interval = 6926 DIV_ROUND_UP(interval, MSEC_PER_SEC); 6927 if (!request->scan_plans[0].interval) 6928 return -EINVAL; 6929 6930 if (request->scan_plans[0].interval > 6931 wiphy->max_sched_scan_plan_interval) 6932 request->scan_plans[0].interval = 6933 wiphy->max_sched_scan_plan_interval; 6934 6935 return 0; 6936 } 6937 6938 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) { 6939 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1]; 6940 6941 if (WARN_ON(i >= n_plans)) 6942 return -EINVAL; 6943 6944 err = nla_parse_nested(plan, NL80211_SCHED_SCAN_PLAN_MAX, 6945 attr, nl80211_plan_policy, NULL); 6946 if (err) 6947 return err; 6948 6949 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]) 6950 return -EINVAL; 6951 6952 request->scan_plans[i].interval = 6953 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]); 6954 if (!request->scan_plans[i].interval || 6955 request->scan_plans[i].interval > 6956 wiphy->max_sched_scan_plan_interval) 6957 return -EINVAL; 6958 6959 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) { 6960 request->scan_plans[i].iterations = 6961 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]); 6962 if (!request->scan_plans[i].iterations || 6963 (request->scan_plans[i].iterations > 6964 wiphy->max_sched_scan_plan_iterations)) 6965 return -EINVAL; 6966 } else if (i < n_plans - 1) { 6967 /* 6968 * All scan plans but the last one must specify 6969 * a finite number of iterations 6970 */ 6971 return -EINVAL; 6972 } 6973 6974 i++; 6975 } 6976 6977 /* 6978 * The last scan plan must not specify the number of 6979 * iterations, it is supposed to run infinitely 6980 */ 6981 if (request->scan_plans[n_plans - 1].iterations) 6982 return -EINVAL; 6983 6984 return 0; 6985 } 6986 6987 static struct cfg80211_sched_scan_request * 6988 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev, 6989 struct nlattr **attrs, int max_match_sets) 6990 { 6991 struct cfg80211_sched_scan_request *request; 6992 struct nlattr *attr; 6993 int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0; 6994 enum nl80211_band band; 6995 size_t ie_len; 6996 struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1]; 6997 s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF; 6998 6999 if (!is_valid_ie_attr(attrs[NL80211_ATTR_IE])) 7000 return ERR_PTR(-EINVAL); 7001 7002 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) { 7003 n_channels = validate_scan_freqs( 7004 attrs[NL80211_ATTR_SCAN_FREQUENCIES]); 7005 if (!n_channels) 7006 return ERR_PTR(-EINVAL); 7007 } else { 7008 n_channels = ieee80211_get_num_supported_channels(wiphy); 7009 } 7010 7011 if (attrs[NL80211_ATTR_SCAN_SSIDS]) 7012 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS], 7013 tmp) 7014 n_ssids++; 7015 7016 if (n_ssids > wiphy->max_sched_scan_ssids) 7017 return ERR_PTR(-EINVAL); 7018 7019 /* 7020 * First, count the number of 'real' matchsets. Due to an issue with 7021 * the old implementation, matchsets containing only the RSSI attribute 7022 * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default' 7023 * RSSI for all matchsets, rather than their own matchset for reporting 7024 * all APs with a strong RSSI. This is needed to be compatible with 7025 * older userspace that treated a matchset with only the RSSI as the 7026 * global RSSI for all other matchsets - if there are other matchsets. 7027 */ 7028 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) { 7029 nla_for_each_nested(attr, 7030 attrs[NL80211_ATTR_SCHED_SCAN_MATCH], 7031 tmp) { 7032 struct nlattr *rssi; 7033 7034 err = nla_parse_nested(tb, 7035 NL80211_SCHED_SCAN_MATCH_ATTR_MAX, 7036 attr, nl80211_match_policy, 7037 NULL); 7038 if (err) 7039 return ERR_PTR(err); 7040 7041 /* SSID and BSSID are mutually exclusive */ 7042 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] && 7043 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) 7044 return ERR_PTR(-EINVAL); 7045 7046 /* add other standalone attributes here */ 7047 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] || 7048 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) { 7049 n_match_sets++; 7050 continue; 7051 } 7052 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI]; 7053 if (rssi) 7054 default_match_rssi = nla_get_s32(rssi); 7055 } 7056 } 7057 7058 /* However, if there's no other matchset, add the RSSI one */ 7059 if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF) 7060 n_match_sets = 1; 7061 7062 if (n_match_sets > max_match_sets) 7063 return ERR_PTR(-EINVAL); 7064 7065 if (attrs[NL80211_ATTR_IE]) 7066 ie_len = nla_len(attrs[NL80211_ATTR_IE]); 7067 else 7068 ie_len = 0; 7069 7070 if (ie_len > wiphy->max_sched_scan_ie_len) 7071 return ERR_PTR(-EINVAL); 7072 7073 if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) { 7074 /* 7075 * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since 7076 * each scan plan already specifies its own interval 7077 */ 7078 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]) 7079 return ERR_PTR(-EINVAL); 7080 7081 nla_for_each_nested(attr, 7082 attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) 7083 n_plans++; 7084 } else { 7085 /* 7086 * The scan interval attribute is kept for backward 7087 * compatibility. If no scan plans are specified and sched scan 7088 * interval is specified, one scan plan will be set with this 7089 * scan interval and infinite number of iterations. 7090 */ 7091 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]) 7092 return ERR_PTR(-EINVAL); 7093 7094 n_plans = 1; 7095 } 7096 7097 if (!n_plans || n_plans > wiphy->max_sched_scan_plans) 7098 return ERR_PTR(-EINVAL); 7099 7100 if (!wiphy_ext_feature_isset( 7101 wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) && 7102 (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] || 7103 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST])) 7104 return ERR_PTR(-EINVAL); 7105 7106 request = kzalloc(sizeof(*request) 7107 + sizeof(*request->ssids) * n_ssids 7108 + sizeof(*request->match_sets) * n_match_sets 7109 + sizeof(*request->scan_plans) * n_plans 7110 + sizeof(*request->channels) * n_channels 7111 + ie_len, GFP_KERNEL); 7112 if (!request) 7113 return ERR_PTR(-ENOMEM); 7114 7115 if (n_ssids) 7116 request->ssids = (void *)&request->channels[n_channels]; 7117 request->n_ssids = n_ssids; 7118 if (ie_len) { 7119 if (n_ssids) 7120 request->ie = (void *)(request->ssids + n_ssids); 7121 else 7122 request->ie = (void *)(request->channels + n_channels); 7123 } 7124 7125 if (n_match_sets) { 7126 if (request->ie) 7127 request->match_sets = (void *)(request->ie + ie_len); 7128 else if (n_ssids) 7129 request->match_sets = 7130 (void *)(request->ssids + n_ssids); 7131 else 7132 request->match_sets = 7133 (void *)(request->channels + n_channels); 7134 } 7135 request->n_match_sets = n_match_sets; 7136 7137 if (n_match_sets) 7138 request->scan_plans = (void *)(request->match_sets + 7139 n_match_sets); 7140 else if (request->ie) 7141 request->scan_plans = (void *)(request->ie + ie_len); 7142 else if (n_ssids) 7143 request->scan_plans = (void *)(request->ssids + n_ssids); 7144 else 7145 request->scan_plans = (void *)(request->channels + n_channels); 7146 7147 request->n_scan_plans = n_plans; 7148 7149 i = 0; 7150 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) { 7151 /* user specified, bail out if channel not found */ 7152 nla_for_each_nested(attr, 7153 attrs[NL80211_ATTR_SCAN_FREQUENCIES], 7154 tmp) { 7155 struct ieee80211_channel *chan; 7156 7157 chan = ieee80211_get_channel(wiphy, nla_get_u32(attr)); 7158 7159 if (!chan) { 7160 err = -EINVAL; 7161 goto out_free; 7162 } 7163 7164 /* ignore disabled channels */ 7165 if (chan->flags & IEEE80211_CHAN_DISABLED) 7166 continue; 7167 7168 request->channels[i] = chan; 7169 i++; 7170 } 7171 } else { 7172 /* all channels */ 7173 for (band = 0; band < NUM_NL80211_BANDS; band++) { 7174 int j; 7175 7176 if (!wiphy->bands[band]) 7177 continue; 7178 for (j = 0; j < wiphy->bands[band]->n_channels; j++) { 7179 struct ieee80211_channel *chan; 7180 7181 chan = &wiphy->bands[band]->channels[j]; 7182 7183 if (chan->flags & IEEE80211_CHAN_DISABLED) 7184 continue; 7185 7186 request->channels[i] = chan; 7187 i++; 7188 } 7189 } 7190 } 7191 7192 if (!i) { 7193 err = -EINVAL; 7194 goto out_free; 7195 } 7196 7197 request->n_channels = i; 7198 7199 i = 0; 7200 if (n_ssids) { 7201 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS], 7202 tmp) { 7203 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) { 7204 err = -EINVAL; 7205 goto out_free; 7206 } 7207 request->ssids[i].ssid_len = nla_len(attr); 7208 memcpy(request->ssids[i].ssid, nla_data(attr), 7209 nla_len(attr)); 7210 i++; 7211 } 7212 } 7213 7214 i = 0; 7215 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) { 7216 nla_for_each_nested(attr, 7217 attrs[NL80211_ATTR_SCHED_SCAN_MATCH], 7218 tmp) { 7219 struct nlattr *ssid, *bssid, *rssi; 7220 7221 err = nla_parse_nested(tb, 7222 NL80211_SCHED_SCAN_MATCH_ATTR_MAX, 7223 attr, nl80211_match_policy, 7224 NULL); 7225 if (err) 7226 goto out_free; 7227 ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]; 7228 bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]; 7229 if (ssid || bssid) { 7230 if (WARN_ON(i >= n_match_sets)) { 7231 /* this indicates a programming error, 7232 * the loop above should have verified 7233 * things properly 7234 */ 7235 err = -EINVAL; 7236 goto out_free; 7237 } 7238 7239 if (ssid) { 7240 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) { 7241 err = -EINVAL; 7242 goto out_free; 7243 } 7244 memcpy(request->match_sets[i].ssid.ssid, 7245 nla_data(ssid), nla_len(ssid)); 7246 request->match_sets[i].ssid.ssid_len = 7247 nla_len(ssid); 7248 } 7249 if (bssid) { 7250 if (nla_len(bssid) != ETH_ALEN) { 7251 err = -EINVAL; 7252 goto out_free; 7253 } 7254 memcpy(request->match_sets[i].bssid, 7255 nla_data(bssid), ETH_ALEN); 7256 } 7257 7258 /* special attribute - old implementation w/a */ 7259 request->match_sets[i].rssi_thold = 7260 default_match_rssi; 7261 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI]; 7262 if (rssi) 7263 request->match_sets[i].rssi_thold = 7264 nla_get_s32(rssi); 7265 } 7266 i++; 7267 } 7268 7269 /* there was no other matchset, so the RSSI one is alone */ 7270 if (i == 0 && n_match_sets) 7271 request->match_sets[0].rssi_thold = default_match_rssi; 7272 7273 request->min_rssi_thold = INT_MAX; 7274 for (i = 0; i < n_match_sets; i++) 7275 request->min_rssi_thold = 7276 min(request->match_sets[i].rssi_thold, 7277 request->min_rssi_thold); 7278 } else { 7279 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF; 7280 } 7281 7282 if (ie_len) { 7283 request->ie_len = ie_len; 7284 memcpy((void *)request->ie, 7285 nla_data(attrs[NL80211_ATTR_IE]), 7286 request->ie_len); 7287 } 7288 7289 if (attrs[NL80211_ATTR_SCAN_FLAGS]) { 7290 request->flags = nla_get_u32( 7291 attrs[NL80211_ATTR_SCAN_FLAGS]); 7292 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) && 7293 !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) { 7294 err = -EOPNOTSUPP; 7295 goto out_free; 7296 } 7297 7298 if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) { 7299 u32 flg = NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR; 7300 7301 if (!wdev) /* must be net-detect */ 7302 flg = NL80211_FEATURE_ND_RANDOM_MAC_ADDR; 7303 7304 if (!(wiphy->features & flg)) { 7305 err = -EOPNOTSUPP; 7306 goto out_free; 7307 } 7308 7309 if (wdev && wdev->current_bss) { 7310 err = -EOPNOTSUPP; 7311 goto out_free; 7312 } 7313 7314 err = nl80211_parse_random_mac(attrs, request->mac_addr, 7315 request->mac_addr_mask); 7316 if (err) 7317 goto out_free; 7318 } 7319 } 7320 7321 if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY]) 7322 request->delay = 7323 nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]); 7324 7325 if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) { 7326 request->relative_rssi = nla_get_s8( 7327 attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]); 7328 request->relative_rssi_set = true; 7329 } 7330 7331 if (request->relative_rssi_set && 7332 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) { 7333 struct nl80211_bss_select_rssi_adjust *rssi_adjust; 7334 7335 rssi_adjust = nla_data( 7336 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]); 7337 request->rssi_adjust.band = rssi_adjust->band; 7338 request->rssi_adjust.delta = rssi_adjust->delta; 7339 if (!is_band_valid(wiphy, request->rssi_adjust.band)) { 7340 err = -EINVAL; 7341 goto out_free; 7342 } 7343 } 7344 7345 err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs); 7346 if (err) 7347 goto out_free; 7348 7349 request->scan_start = jiffies; 7350 7351 return request; 7352 7353 out_free: 7354 kfree(request); 7355 return ERR_PTR(err); 7356 } 7357 7358 static int nl80211_start_sched_scan(struct sk_buff *skb, 7359 struct genl_info *info) 7360 { 7361 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7362 struct net_device *dev = info->user_ptr[1]; 7363 struct wireless_dev *wdev = dev->ieee80211_ptr; 7364 struct cfg80211_sched_scan_request *sched_scan_req; 7365 bool want_multi; 7366 int err; 7367 7368 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start) 7369 return -EOPNOTSUPP; 7370 7371 want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI]; 7372 err = cfg80211_sched_scan_req_possible(rdev, want_multi); 7373 if (err) 7374 return err; 7375 7376 sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev, 7377 info->attrs, 7378 rdev->wiphy.max_match_sets); 7379 7380 err = PTR_ERR_OR_ZERO(sched_scan_req); 7381 if (err) 7382 goto out_err; 7383 7384 /* leave request id zero for legacy request 7385 * or if driver does not support multi-scheduled scan 7386 */ 7387 if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1) { 7388 while (!sched_scan_req->reqid) 7389 sched_scan_req->reqid = rdev->wiphy.cookie_counter++; 7390 } 7391 7392 err = rdev_sched_scan_start(rdev, dev, sched_scan_req); 7393 if (err) 7394 goto out_free; 7395 7396 sched_scan_req->dev = dev; 7397 sched_scan_req->wiphy = &rdev->wiphy; 7398 7399 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) 7400 sched_scan_req->owner_nlportid = info->snd_portid; 7401 7402 cfg80211_add_sched_scan_req(rdev, sched_scan_req); 7403 7404 nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN); 7405 return 0; 7406 7407 out_free: 7408 kfree(sched_scan_req); 7409 out_err: 7410 return err; 7411 } 7412 7413 static int nl80211_stop_sched_scan(struct sk_buff *skb, 7414 struct genl_info *info) 7415 { 7416 struct cfg80211_sched_scan_request *req; 7417 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7418 u64 cookie; 7419 7420 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop) 7421 return -EOPNOTSUPP; 7422 7423 if (info->attrs[NL80211_ATTR_COOKIE]) { 7424 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 7425 return __cfg80211_stop_sched_scan(rdev, cookie, false); 7426 } 7427 7428 req = list_first_or_null_rcu(&rdev->sched_scan_req_list, 7429 struct cfg80211_sched_scan_request, 7430 list); 7431 if (!req || req->reqid || 7432 (req->owner_nlportid && 7433 req->owner_nlportid != info->snd_portid)) 7434 return -ENOENT; 7435 7436 return cfg80211_stop_sched_scan_req(rdev, req, false); 7437 } 7438 7439 static int nl80211_start_radar_detection(struct sk_buff *skb, 7440 struct genl_info *info) 7441 { 7442 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7443 struct net_device *dev = info->user_ptr[1]; 7444 struct wireless_dev *wdev = dev->ieee80211_ptr; 7445 struct cfg80211_chan_def chandef; 7446 enum nl80211_dfs_regions dfs_region; 7447 unsigned int cac_time_ms; 7448 int err; 7449 7450 dfs_region = reg_get_dfs_region(wdev->wiphy); 7451 if (dfs_region == NL80211_DFS_UNSET) 7452 return -EINVAL; 7453 7454 err = nl80211_parse_chandef(rdev, info, &chandef); 7455 if (err) 7456 return err; 7457 7458 if (netif_carrier_ok(dev)) 7459 return -EBUSY; 7460 7461 if (wdev->cac_started) 7462 return -EBUSY; 7463 7464 err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, 7465 wdev->iftype); 7466 if (err < 0) 7467 return err; 7468 7469 if (err == 0) 7470 return -EINVAL; 7471 7472 if (!cfg80211_chandef_dfs_usable(wdev->wiphy, &chandef)) 7473 return -EINVAL; 7474 7475 if (!rdev->ops->start_radar_detection) 7476 return -EOPNOTSUPP; 7477 7478 cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef); 7479 if (WARN_ON(!cac_time_ms)) 7480 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS; 7481 7482 err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms); 7483 if (!err) { 7484 wdev->chandef = chandef; 7485 wdev->cac_started = true; 7486 wdev->cac_start_time = jiffies; 7487 wdev->cac_time_ms = cac_time_ms; 7488 } 7489 return err; 7490 } 7491 7492 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info) 7493 { 7494 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7495 struct net_device *dev = info->user_ptr[1]; 7496 struct wireless_dev *wdev = dev->ieee80211_ptr; 7497 struct cfg80211_csa_settings params; 7498 /* csa_attrs is defined static to avoid waste of stack size - this 7499 * function is called under RTNL lock, so this should not be a problem. 7500 */ 7501 static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1]; 7502 int err; 7503 bool need_new_beacon = false; 7504 int len, i; 7505 u32 cs_count; 7506 7507 if (!rdev->ops->channel_switch || 7508 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)) 7509 return -EOPNOTSUPP; 7510 7511 switch (dev->ieee80211_ptr->iftype) { 7512 case NL80211_IFTYPE_AP: 7513 case NL80211_IFTYPE_P2P_GO: 7514 need_new_beacon = true; 7515 7516 /* useless if AP is not running */ 7517 if (!wdev->beacon_interval) 7518 return -ENOTCONN; 7519 break; 7520 case NL80211_IFTYPE_ADHOC: 7521 if (!wdev->ssid_len) 7522 return -ENOTCONN; 7523 break; 7524 case NL80211_IFTYPE_MESH_POINT: 7525 if (!wdev->mesh_id_len) 7526 return -ENOTCONN; 7527 break; 7528 default: 7529 return -EOPNOTSUPP; 7530 } 7531 7532 memset(¶ms, 0, sizeof(params)); 7533 7534 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] || 7535 !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]) 7536 return -EINVAL; 7537 7538 /* only important for AP, IBSS and mesh create IEs internally */ 7539 if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES]) 7540 return -EINVAL; 7541 7542 /* Even though the attribute is u32, the specification says 7543 * u8, so let's make sure we don't overflow. 7544 */ 7545 cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]); 7546 if (cs_count > 255) 7547 return -EINVAL; 7548 7549 params.count = cs_count; 7550 7551 if (!need_new_beacon) 7552 goto skip_beacons; 7553 7554 err = nl80211_parse_beacon(info->attrs, ¶ms.beacon_after); 7555 if (err) 7556 return err; 7557 7558 err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX, 7559 info->attrs[NL80211_ATTR_CSA_IES], 7560 nl80211_policy, info->extack); 7561 if (err) 7562 return err; 7563 7564 err = nl80211_parse_beacon(csa_attrs, ¶ms.beacon_csa); 7565 if (err) 7566 return err; 7567 7568 if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]) 7569 return -EINVAL; 7570 7571 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]); 7572 if (!len || (len % sizeof(u16))) 7573 return -EINVAL; 7574 7575 params.n_counter_offsets_beacon = len / sizeof(u16); 7576 if (rdev->wiphy.max_num_csa_counters && 7577 (params.n_counter_offsets_beacon > 7578 rdev->wiphy.max_num_csa_counters)) 7579 return -EINVAL; 7580 7581 params.counter_offsets_beacon = 7582 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]); 7583 7584 /* sanity checks - counters should fit and be the same */ 7585 for (i = 0; i < params.n_counter_offsets_beacon; i++) { 7586 u16 offset = params.counter_offsets_beacon[i]; 7587 7588 if (offset >= params.beacon_csa.tail_len) 7589 return -EINVAL; 7590 7591 if (params.beacon_csa.tail[offset] != params.count) 7592 return -EINVAL; 7593 } 7594 7595 if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) { 7596 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]); 7597 if (!len || (len % sizeof(u16))) 7598 return -EINVAL; 7599 7600 params.n_counter_offsets_presp = len / sizeof(u16); 7601 if (rdev->wiphy.max_num_csa_counters && 7602 (params.n_counter_offsets_presp > 7603 rdev->wiphy.max_num_csa_counters)) 7604 return -EINVAL; 7605 7606 params.counter_offsets_presp = 7607 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]); 7608 7609 /* sanity checks - counters should fit and be the same */ 7610 for (i = 0; i < params.n_counter_offsets_presp; i++) { 7611 u16 offset = params.counter_offsets_presp[i]; 7612 7613 if (offset >= params.beacon_csa.probe_resp_len) 7614 return -EINVAL; 7615 7616 if (params.beacon_csa.probe_resp[offset] != 7617 params.count) 7618 return -EINVAL; 7619 } 7620 } 7621 7622 skip_beacons: 7623 err = nl80211_parse_chandef(rdev, info, ¶ms.chandef); 7624 if (err) 7625 return err; 7626 7627 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms.chandef, 7628 wdev->iftype)) 7629 return -EINVAL; 7630 7631 err = cfg80211_chandef_dfs_required(wdev->wiphy, 7632 ¶ms.chandef, 7633 wdev->iftype); 7634 if (err < 0) 7635 return err; 7636 7637 if (err > 0) 7638 params.radar_required = true; 7639 7640 if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX]) 7641 params.block_tx = true; 7642 7643 wdev_lock(wdev); 7644 err = rdev_channel_switch(rdev, dev, ¶ms); 7645 wdev_unlock(wdev); 7646 7647 return err; 7648 } 7649 7650 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb, 7651 u32 seq, int flags, 7652 struct cfg80211_registered_device *rdev, 7653 struct wireless_dev *wdev, 7654 struct cfg80211_internal_bss *intbss) 7655 { 7656 struct cfg80211_bss *res = &intbss->pub; 7657 const struct cfg80211_bss_ies *ies; 7658 void *hdr; 7659 struct nlattr *bss; 7660 7661 ASSERT_WDEV_LOCK(wdev); 7662 7663 hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags, 7664 NL80211_CMD_NEW_SCAN_RESULTS); 7665 if (!hdr) 7666 return -1; 7667 7668 genl_dump_check_consistent(cb, hdr, &nl80211_fam); 7669 7670 if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation)) 7671 goto nla_put_failure; 7672 if (wdev->netdev && 7673 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex)) 7674 goto nla_put_failure; 7675 if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 7676 NL80211_ATTR_PAD)) 7677 goto nla_put_failure; 7678 7679 bss = nla_nest_start(msg, NL80211_ATTR_BSS); 7680 if (!bss) 7681 goto nla_put_failure; 7682 if ((!is_zero_ether_addr(res->bssid) && 7683 nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid))) 7684 goto nla_put_failure; 7685 7686 rcu_read_lock(); 7687 /* indicate whether we have probe response data or not */ 7688 if (rcu_access_pointer(res->proberesp_ies) && 7689 nla_put_flag(msg, NL80211_BSS_PRESP_DATA)) 7690 goto fail_unlock_rcu; 7691 7692 /* this pointer prefers to be pointed to probe response data 7693 * but is always valid 7694 */ 7695 ies = rcu_dereference(res->ies); 7696 if (ies) { 7697 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf, 7698 NL80211_BSS_PAD)) 7699 goto fail_unlock_rcu; 7700 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS, 7701 ies->len, ies->data)) 7702 goto fail_unlock_rcu; 7703 } 7704 7705 /* and this pointer is always (unless driver didn't know) beacon data */ 7706 ies = rcu_dereference(res->beacon_ies); 7707 if (ies && ies->from_beacon) { 7708 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf, 7709 NL80211_BSS_PAD)) 7710 goto fail_unlock_rcu; 7711 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES, 7712 ies->len, ies->data)) 7713 goto fail_unlock_rcu; 7714 } 7715 rcu_read_unlock(); 7716 7717 if (res->beacon_interval && 7718 nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval)) 7719 goto nla_put_failure; 7720 if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) || 7721 nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) || 7722 nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) || 7723 nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO, 7724 jiffies_to_msecs(jiffies - intbss->ts))) 7725 goto nla_put_failure; 7726 7727 if (intbss->parent_tsf && 7728 (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF, 7729 intbss->parent_tsf, NL80211_BSS_PAD) || 7730 nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN, 7731 intbss->parent_bssid))) 7732 goto nla_put_failure; 7733 7734 if (intbss->ts_boottime && 7735 nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME, 7736 intbss->ts_boottime, NL80211_BSS_PAD)) 7737 goto nla_put_failure; 7738 7739 switch (rdev->wiphy.signal_type) { 7740 case CFG80211_SIGNAL_TYPE_MBM: 7741 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal)) 7742 goto nla_put_failure; 7743 break; 7744 case CFG80211_SIGNAL_TYPE_UNSPEC: 7745 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal)) 7746 goto nla_put_failure; 7747 break; 7748 default: 7749 break; 7750 } 7751 7752 switch (wdev->iftype) { 7753 case NL80211_IFTYPE_P2P_CLIENT: 7754 case NL80211_IFTYPE_STATION: 7755 if (intbss == wdev->current_bss && 7756 nla_put_u32(msg, NL80211_BSS_STATUS, 7757 NL80211_BSS_STATUS_ASSOCIATED)) 7758 goto nla_put_failure; 7759 break; 7760 case NL80211_IFTYPE_ADHOC: 7761 if (intbss == wdev->current_bss && 7762 nla_put_u32(msg, NL80211_BSS_STATUS, 7763 NL80211_BSS_STATUS_IBSS_JOINED)) 7764 goto nla_put_failure; 7765 break; 7766 default: 7767 break; 7768 } 7769 7770 nla_nest_end(msg, bss); 7771 7772 genlmsg_end(msg, hdr); 7773 return 0; 7774 7775 fail_unlock_rcu: 7776 rcu_read_unlock(); 7777 nla_put_failure: 7778 genlmsg_cancel(msg, hdr); 7779 return -EMSGSIZE; 7780 } 7781 7782 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb) 7783 { 7784 struct cfg80211_registered_device *rdev; 7785 struct cfg80211_internal_bss *scan; 7786 struct wireless_dev *wdev; 7787 int start = cb->args[2], idx = 0; 7788 int err; 7789 7790 rtnl_lock(); 7791 err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev); 7792 if (err) { 7793 rtnl_unlock(); 7794 return err; 7795 } 7796 7797 wdev_lock(wdev); 7798 spin_lock_bh(&rdev->bss_lock); 7799 cfg80211_bss_expire(rdev); 7800 7801 cb->seq = rdev->bss_generation; 7802 7803 list_for_each_entry(scan, &rdev->bss_list, list) { 7804 if (++idx <= start) 7805 continue; 7806 if (nl80211_send_bss(skb, cb, 7807 cb->nlh->nlmsg_seq, NLM_F_MULTI, 7808 rdev, wdev, scan) < 0) { 7809 idx--; 7810 break; 7811 } 7812 } 7813 7814 spin_unlock_bh(&rdev->bss_lock); 7815 wdev_unlock(wdev); 7816 7817 cb->args[2] = idx; 7818 rtnl_unlock(); 7819 7820 return skb->len; 7821 } 7822 7823 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq, 7824 int flags, struct net_device *dev, 7825 bool allow_radio_stats, 7826 struct survey_info *survey) 7827 { 7828 void *hdr; 7829 struct nlattr *infoattr; 7830 7831 /* skip radio stats if userspace didn't request them */ 7832 if (!survey->channel && !allow_radio_stats) 7833 return 0; 7834 7835 hdr = nl80211hdr_put(msg, portid, seq, flags, 7836 NL80211_CMD_NEW_SURVEY_RESULTS); 7837 if (!hdr) 7838 return -ENOMEM; 7839 7840 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 7841 goto nla_put_failure; 7842 7843 infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO); 7844 if (!infoattr) 7845 goto nla_put_failure; 7846 7847 if (survey->channel && 7848 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY, 7849 survey->channel->center_freq)) 7850 goto nla_put_failure; 7851 7852 if ((survey->filled & SURVEY_INFO_NOISE_DBM) && 7853 nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise)) 7854 goto nla_put_failure; 7855 if ((survey->filled & SURVEY_INFO_IN_USE) && 7856 nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE)) 7857 goto nla_put_failure; 7858 if ((survey->filled & SURVEY_INFO_TIME) && 7859 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME, 7860 survey->time, NL80211_SURVEY_INFO_PAD)) 7861 goto nla_put_failure; 7862 if ((survey->filled & SURVEY_INFO_TIME_BUSY) && 7863 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY, 7864 survey->time_busy, NL80211_SURVEY_INFO_PAD)) 7865 goto nla_put_failure; 7866 if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) && 7867 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY, 7868 survey->time_ext_busy, NL80211_SURVEY_INFO_PAD)) 7869 goto nla_put_failure; 7870 if ((survey->filled & SURVEY_INFO_TIME_RX) && 7871 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX, 7872 survey->time_rx, NL80211_SURVEY_INFO_PAD)) 7873 goto nla_put_failure; 7874 if ((survey->filled & SURVEY_INFO_TIME_TX) && 7875 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX, 7876 survey->time_tx, NL80211_SURVEY_INFO_PAD)) 7877 goto nla_put_failure; 7878 if ((survey->filled & SURVEY_INFO_TIME_SCAN) && 7879 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN, 7880 survey->time_scan, NL80211_SURVEY_INFO_PAD)) 7881 goto nla_put_failure; 7882 7883 nla_nest_end(msg, infoattr); 7884 7885 genlmsg_end(msg, hdr); 7886 return 0; 7887 7888 nla_put_failure: 7889 genlmsg_cancel(msg, hdr); 7890 return -EMSGSIZE; 7891 } 7892 7893 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb) 7894 { 7895 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam); 7896 struct survey_info survey; 7897 struct cfg80211_registered_device *rdev; 7898 struct wireless_dev *wdev; 7899 int survey_idx = cb->args[2]; 7900 int res; 7901 bool radio_stats; 7902 7903 rtnl_lock(); 7904 res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev); 7905 if (res) 7906 goto out_err; 7907 7908 /* prepare_wdev_dump parsed the attributes */ 7909 radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS]; 7910 7911 if (!wdev->netdev) { 7912 res = -EINVAL; 7913 goto out_err; 7914 } 7915 7916 if (!rdev->ops->dump_survey) { 7917 res = -EOPNOTSUPP; 7918 goto out_err; 7919 } 7920 7921 while (1) { 7922 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey); 7923 if (res == -ENOENT) 7924 break; 7925 if (res) 7926 goto out_err; 7927 7928 /* don't send disabled channels, but do send non-channel data */ 7929 if (survey.channel && 7930 survey.channel->flags & IEEE80211_CHAN_DISABLED) { 7931 survey_idx++; 7932 continue; 7933 } 7934 7935 if (nl80211_send_survey(skb, 7936 NETLINK_CB(cb->skb).portid, 7937 cb->nlh->nlmsg_seq, NLM_F_MULTI, 7938 wdev->netdev, radio_stats, &survey) < 0) 7939 goto out; 7940 survey_idx++; 7941 } 7942 7943 out: 7944 cb->args[2] = survey_idx; 7945 res = skb->len; 7946 out_err: 7947 rtnl_unlock(); 7948 return res; 7949 } 7950 7951 static bool nl80211_valid_wpa_versions(u32 wpa_versions) 7952 { 7953 return !(wpa_versions & ~(NL80211_WPA_VERSION_1 | 7954 NL80211_WPA_VERSION_2)); 7955 } 7956 7957 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info) 7958 { 7959 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 7960 struct net_device *dev = info->user_ptr[1]; 7961 struct ieee80211_channel *chan; 7962 const u8 *bssid, *ssid, *ie = NULL, *auth_data = NULL; 7963 int err, ssid_len, ie_len = 0, auth_data_len = 0; 7964 enum nl80211_auth_type auth_type; 7965 struct key_parse key; 7966 bool local_state_change; 7967 7968 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) 7969 return -EINVAL; 7970 7971 if (!info->attrs[NL80211_ATTR_MAC]) 7972 return -EINVAL; 7973 7974 if (!info->attrs[NL80211_ATTR_AUTH_TYPE]) 7975 return -EINVAL; 7976 7977 if (!info->attrs[NL80211_ATTR_SSID]) 7978 return -EINVAL; 7979 7980 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ]) 7981 return -EINVAL; 7982 7983 err = nl80211_parse_key(info, &key); 7984 if (err) 7985 return err; 7986 7987 if (key.idx >= 0) { 7988 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP) 7989 return -EINVAL; 7990 if (!key.p.key || !key.p.key_len) 7991 return -EINVAL; 7992 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 || 7993 key.p.key_len != WLAN_KEY_LEN_WEP40) && 7994 (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 || 7995 key.p.key_len != WLAN_KEY_LEN_WEP104)) 7996 return -EINVAL; 7997 if (key.idx > 3) 7998 return -EINVAL; 7999 } else { 8000 key.p.key_len = 0; 8001 key.p.key = NULL; 8002 } 8003 8004 if (key.idx >= 0) { 8005 int i; 8006 bool ok = false; 8007 8008 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) { 8009 if (key.p.cipher == rdev->wiphy.cipher_suites[i]) { 8010 ok = true; 8011 break; 8012 } 8013 } 8014 if (!ok) 8015 return -EINVAL; 8016 } 8017 8018 if (!rdev->ops->auth) 8019 return -EOPNOTSUPP; 8020 8021 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 8022 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 8023 return -EOPNOTSUPP; 8024 8025 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 8026 chan = nl80211_get_valid_chan(&rdev->wiphy, 8027 info->attrs[NL80211_ATTR_WIPHY_FREQ]); 8028 if (!chan) 8029 return -EINVAL; 8030 8031 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 8032 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 8033 8034 if (info->attrs[NL80211_ATTR_IE]) { 8035 ie = nla_data(info->attrs[NL80211_ATTR_IE]); 8036 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 8037 } 8038 8039 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]); 8040 if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE)) 8041 return -EINVAL; 8042 8043 if ((auth_type == NL80211_AUTHTYPE_SAE || 8044 auth_type == NL80211_AUTHTYPE_FILS_SK || 8045 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS || 8046 auth_type == NL80211_AUTHTYPE_FILS_PK) && 8047 !info->attrs[NL80211_ATTR_AUTH_DATA]) 8048 return -EINVAL; 8049 8050 if (info->attrs[NL80211_ATTR_AUTH_DATA]) { 8051 if (auth_type != NL80211_AUTHTYPE_SAE && 8052 auth_type != NL80211_AUTHTYPE_FILS_SK && 8053 auth_type != NL80211_AUTHTYPE_FILS_SK_PFS && 8054 auth_type != NL80211_AUTHTYPE_FILS_PK) 8055 return -EINVAL; 8056 auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]); 8057 auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]); 8058 /* need to include at least Auth Transaction and Status Code */ 8059 if (auth_data_len < 4) 8060 return -EINVAL; 8061 } 8062 8063 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE]; 8064 8065 /* 8066 * Since we no longer track auth state, ignore 8067 * requests to only change local state. 8068 */ 8069 if (local_state_change) 8070 return 0; 8071 8072 wdev_lock(dev->ieee80211_ptr); 8073 err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid, 8074 ssid, ssid_len, ie, ie_len, 8075 key.p.key, key.p.key_len, key.idx, 8076 auth_data, auth_data_len); 8077 wdev_unlock(dev->ieee80211_ptr); 8078 return err; 8079 } 8080 8081 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev, 8082 struct genl_info *info, 8083 struct cfg80211_crypto_settings *settings, 8084 int cipher_limit) 8085 { 8086 memset(settings, 0, sizeof(*settings)); 8087 8088 settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT]; 8089 8090 if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) { 8091 u16 proto; 8092 8093 proto = nla_get_u16( 8094 info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]); 8095 settings->control_port_ethertype = cpu_to_be16(proto); 8096 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) && 8097 proto != ETH_P_PAE) 8098 return -EINVAL; 8099 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]) 8100 settings->control_port_no_encrypt = true; 8101 } else 8102 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE); 8103 8104 if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) { 8105 void *data; 8106 int len, i; 8107 8108 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]); 8109 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]); 8110 settings->n_ciphers_pairwise = len / sizeof(u32); 8111 8112 if (len % sizeof(u32)) 8113 return -EINVAL; 8114 8115 if (settings->n_ciphers_pairwise > cipher_limit) 8116 return -EINVAL; 8117 8118 memcpy(settings->ciphers_pairwise, data, len); 8119 8120 for (i = 0; i < settings->n_ciphers_pairwise; i++) 8121 if (!cfg80211_supported_cipher_suite( 8122 &rdev->wiphy, 8123 settings->ciphers_pairwise[i])) 8124 return -EINVAL; 8125 } 8126 8127 if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) { 8128 settings->cipher_group = 8129 nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]); 8130 if (!cfg80211_supported_cipher_suite(&rdev->wiphy, 8131 settings->cipher_group)) 8132 return -EINVAL; 8133 } 8134 8135 if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) { 8136 settings->wpa_versions = 8137 nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]); 8138 if (!nl80211_valid_wpa_versions(settings->wpa_versions)) 8139 return -EINVAL; 8140 } 8141 8142 if (info->attrs[NL80211_ATTR_AKM_SUITES]) { 8143 void *data; 8144 int len; 8145 8146 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]); 8147 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]); 8148 settings->n_akm_suites = len / sizeof(u32); 8149 8150 if (len % sizeof(u32)) 8151 return -EINVAL; 8152 8153 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES) 8154 return -EINVAL; 8155 8156 memcpy(settings->akm_suites, data, len); 8157 } 8158 8159 return 0; 8160 } 8161 8162 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info) 8163 { 8164 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8165 struct net_device *dev = info->user_ptr[1]; 8166 struct ieee80211_channel *chan; 8167 struct cfg80211_assoc_request req = {}; 8168 const u8 *bssid, *ssid; 8169 int err, ssid_len = 0; 8170 8171 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) 8172 return -EINVAL; 8173 8174 if (!info->attrs[NL80211_ATTR_MAC] || 8175 !info->attrs[NL80211_ATTR_SSID] || 8176 !info->attrs[NL80211_ATTR_WIPHY_FREQ]) 8177 return -EINVAL; 8178 8179 if (!rdev->ops->assoc) 8180 return -EOPNOTSUPP; 8181 8182 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 8183 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 8184 return -EOPNOTSUPP; 8185 8186 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 8187 8188 chan = nl80211_get_valid_chan(&rdev->wiphy, 8189 info->attrs[NL80211_ATTR_WIPHY_FREQ]); 8190 if (!chan) 8191 return -EINVAL; 8192 8193 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 8194 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 8195 8196 if (info->attrs[NL80211_ATTR_IE]) { 8197 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 8198 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 8199 } 8200 8201 if (info->attrs[NL80211_ATTR_USE_MFP]) { 8202 enum nl80211_mfp mfp = 8203 nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]); 8204 if (mfp == NL80211_MFP_REQUIRED) 8205 req.use_mfp = true; 8206 else if (mfp != NL80211_MFP_NO) 8207 return -EINVAL; 8208 } 8209 8210 if (info->attrs[NL80211_ATTR_PREV_BSSID]) 8211 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]); 8212 8213 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT])) 8214 req.flags |= ASSOC_REQ_DISABLE_HT; 8215 8216 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 8217 memcpy(&req.ht_capa_mask, 8218 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]), 8219 sizeof(req.ht_capa_mask)); 8220 8221 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) { 8222 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 8223 return -EINVAL; 8224 memcpy(&req.ht_capa, 8225 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]), 8226 sizeof(req.ht_capa)); 8227 } 8228 8229 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT])) 8230 req.flags |= ASSOC_REQ_DISABLE_VHT; 8231 8232 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) 8233 memcpy(&req.vht_capa_mask, 8234 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]), 8235 sizeof(req.vht_capa_mask)); 8236 8237 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) { 8238 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) 8239 return -EINVAL; 8240 memcpy(&req.vht_capa, 8241 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]), 8242 sizeof(req.vht_capa)); 8243 } 8244 8245 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) { 8246 if (!((rdev->wiphy.features & 8247 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) && 8248 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) && 8249 !wiphy_ext_feature_isset(&rdev->wiphy, 8250 NL80211_EXT_FEATURE_RRM)) 8251 return -EINVAL; 8252 req.flags |= ASSOC_REQ_USE_RRM; 8253 } 8254 8255 if (info->attrs[NL80211_ATTR_FILS_KEK]) { 8256 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]); 8257 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]); 8258 if (!info->attrs[NL80211_ATTR_FILS_NONCES]) 8259 return -EINVAL; 8260 req.fils_nonces = 8261 nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]); 8262 } 8263 8264 err = nl80211_crypto_settings(rdev, info, &req.crypto, 1); 8265 if (!err) { 8266 wdev_lock(dev->ieee80211_ptr); 8267 8268 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, 8269 ssid, ssid_len, &req); 8270 8271 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 8272 dev->ieee80211_ptr->conn_owner_nlportid = 8273 info->snd_portid; 8274 memcpy(dev->ieee80211_ptr->disconnect_bssid, 8275 bssid, ETH_ALEN); 8276 } 8277 8278 wdev_unlock(dev->ieee80211_ptr); 8279 } 8280 8281 return err; 8282 } 8283 8284 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info) 8285 { 8286 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8287 struct net_device *dev = info->user_ptr[1]; 8288 const u8 *ie = NULL, *bssid; 8289 int ie_len = 0, err; 8290 u16 reason_code; 8291 bool local_state_change; 8292 8293 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) 8294 return -EINVAL; 8295 8296 if (!info->attrs[NL80211_ATTR_MAC]) 8297 return -EINVAL; 8298 8299 if (!info->attrs[NL80211_ATTR_REASON_CODE]) 8300 return -EINVAL; 8301 8302 if (!rdev->ops->deauth) 8303 return -EOPNOTSUPP; 8304 8305 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 8306 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 8307 return -EOPNOTSUPP; 8308 8309 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 8310 8311 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 8312 if (reason_code == 0) { 8313 /* Reason Code 0 is reserved */ 8314 return -EINVAL; 8315 } 8316 8317 if (info->attrs[NL80211_ATTR_IE]) { 8318 ie = nla_data(info->attrs[NL80211_ATTR_IE]); 8319 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 8320 } 8321 8322 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE]; 8323 8324 wdev_lock(dev->ieee80211_ptr); 8325 err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code, 8326 local_state_change); 8327 wdev_unlock(dev->ieee80211_ptr); 8328 return err; 8329 } 8330 8331 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info) 8332 { 8333 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8334 struct net_device *dev = info->user_ptr[1]; 8335 const u8 *ie = NULL, *bssid; 8336 int ie_len = 0, err; 8337 u16 reason_code; 8338 bool local_state_change; 8339 8340 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) 8341 return -EINVAL; 8342 8343 if (!info->attrs[NL80211_ATTR_MAC]) 8344 return -EINVAL; 8345 8346 if (!info->attrs[NL80211_ATTR_REASON_CODE]) 8347 return -EINVAL; 8348 8349 if (!rdev->ops->disassoc) 8350 return -EOPNOTSUPP; 8351 8352 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 8353 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 8354 return -EOPNOTSUPP; 8355 8356 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 8357 8358 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 8359 if (reason_code == 0) { 8360 /* Reason Code 0 is reserved */ 8361 return -EINVAL; 8362 } 8363 8364 if (info->attrs[NL80211_ATTR_IE]) { 8365 ie = nla_data(info->attrs[NL80211_ATTR_IE]); 8366 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 8367 } 8368 8369 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE]; 8370 8371 wdev_lock(dev->ieee80211_ptr); 8372 err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code, 8373 local_state_change); 8374 wdev_unlock(dev->ieee80211_ptr); 8375 return err; 8376 } 8377 8378 static bool 8379 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev, 8380 int mcast_rate[NUM_NL80211_BANDS], 8381 int rateval) 8382 { 8383 struct wiphy *wiphy = &rdev->wiphy; 8384 bool found = false; 8385 int band, i; 8386 8387 for (band = 0; band < NUM_NL80211_BANDS; band++) { 8388 struct ieee80211_supported_band *sband; 8389 8390 sband = wiphy->bands[band]; 8391 if (!sband) 8392 continue; 8393 8394 for (i = 0; i < sband->n_bitrates; i++) { 8395 if (sband->bitrates[i].bitrate == rateval) { 8396 mcast_rate[band] = i + 1; 8397 found = true; 8398 break; 8399 } 8400 } 8401 } 8402 8403 return found; 8404 } 8405 8406 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info) 8407 { 8408 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8409 struct net_device *dev = info->user_ptr[1]; 8410 struct cfg80211_ibss_params ibss; 8411 struct wiphy *wiphy; 8412 struct cfg80211_cached_keys *connkeys = NULL; 8413 int err; 8414 8415 memset(&ibss, 0, sizeof(ibss)); 8416 8417 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) 8418 return -EINVAL; 8419 8420 if (!info->attrs[NL80211_ATTR_SSID] || 8421 !nla_len(info->attrs[NL80211_ATTR_SSID])) 8422 return -EINVAL; 8423 8424 ibss.beacon_interval = 100; 8425 8426 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) 8427 ibss.beacon_interval = 8428 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]); 8429 8430 err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC, 8431 ibss.beacon_interval); 8432 if (err) 8433 return err; 8434 8435 if (!rdev->ops->join_ibss) 8436 return -EOPNOTSUPP; 8437 8438 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) 8439 return -EOPNOTSUPP; 8440 8441 wiphy = &rdev->wiphy; 8442 8443 if (info->attrs[NL80211_ATTR_MAC]) { 8444 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 8445 8446 if (!is_valid_ether_addr(ibss.bssid)) 8447 return -EINVAL; 8448 } 8449 ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 8450 ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 8451 8452 if (info->attrs[NL80211_ATTR_IE]) { 8453 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 8454 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 8455 } 8456 8457 err = nl80211_parse_chandef(rdev, info, &ibss.chandef); 8458 if (err) 8459 return err; 8460 8461 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef, 8462 NL80211_IFTYPE_ADHOC)) 8463 return -EINVAL; 8464 8465 switch (ibss.chandef.width) { 8466 case NL80211_CHAN_WIDTH_5: 8467 case NL80211_CHAN_WIDTH_10: 8468 case NL80211_CHAN_WIDTH_20_NOHT: 8469 break; 8470 case NL80211_CHAN_WIDTH_20: 8471 case NL80211_CHAN_WIDTH_40: 8472 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)) 8473 return -EINVAL; 8474 break; 8475 case NL80211_CHAN_WIDTH_80: 8476 case NL80211_CHAN_WIDTH_80P80: 8477 case NL80211_CHAN_WIDTH_160: 8478 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)) 8479 return -EINVAL; 8480 if (!wiphy_ext_feature_isset(&rdev->wiphy, 8481 NL80211_EXT_FEATURE_VHT_IBSS)) 8482 return -EINVAL; 8483 break; 8484 default: 8485 return -EINVAL; 8486 } 8487 8488 ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED]; 8489 ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY]; 8490 8491 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) { 8492 u8 *rates = 8493 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 8494 int n_rates = 8495 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 8496 struct ieee80211_supported_band *sband = 8497 wiphy->bands[ibss.chandef.chan->band]; 8498 8499 err = ieee80211_get_ratemask(sband, rates, n_rates, 8500 &ibss.basic_rates); 8501 if (err) 8502 return err; 8503 } 8504 8505 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 8506 memcpy(&ibss.ht_capa_mask, 8507 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]), 8508 sizeof(ibss.ht_capa_mask)); 8509 8510 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) { 8511 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 8512 return -EINVAL; 8513 memcpy(&ibss.ht_capa, 8514 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]), 8515 sizeof(ibss.ht_capa)); 8516 } 8517 8518 if (info->attrs[NL80211_ATTR_MCAST_RATE] && 8519 !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate, 8520 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]))) 8521 return -EINVAL; 8522 8523 if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) { 8524 bool no_ht = false; 8525 8526 connkeys = nl80211_parse_connkeys(rdev, 8527 info->attrs[NL80211_ATTR_KEYS], 8528 &no_ht); 8529 if (IS_ERR(connkeys)) 8530 return PTR_ERR(connkeys); 8531 8532 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) && 8533 no_ht) { 8534 kzfree(connkeys); 8535 return -EINVAL; 8536 } 8537 } 8538 8539 ibss.control_port = 8540 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]); 8541 8542 ibss.userspace_handles_dfs = 8543 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]); 8544 8545 err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys); 8546 if (err) 8547 kzfree(connkeys); 8548 return err; 8549 } 8550 8551 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info) 8552 { 8553 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8554 struct net_device *dev = info->user_ptr[1]; 8555 8556 if (!rdev->ops->leave_ibss) 8557 return -EOPNOTSUPP; 8558 8559 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC) 8560 return -EOPNOTSUPP; 8561 8562 return cfg80211_leave_ibss(rdev, dev, false); 8563 } 8564 8565 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info) 8566 { 8567 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8568 struct net_device *dev = info->user_ptr[1]; 8569 int mcast_rate[NUM_NL80211_BANDS]; 8570 u32 nla_rate; 8571 int err; 8572 8573 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC && 8574 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT && 8575 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB) 8576 return -EOPNOTSUPP; 8577 8578 if (!rdev->ops->set_mcast_rate) 8579 return -EOPNOTSUPP; 8580 8581 memset(mcast_rate, 0, sizeof(mcast_rate)); 8582 8583 if (!info->attrs[NL80211_ATTR_MCAST_RATE]) 8584 return -EINVAL; 8585 8586 nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]); 8587 if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate)) 8588 return -EINVAL; 8589 8590 err = rdev_set_mcast_rate(rdev, dev, mcast_rate); 8591 8592 return err; 8593 } 8594 8595 static struct sk_buff * 8596 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev, 8597 struct wireless_dev *wdev, int approxlen, 8598 u32 portid, u32 seq, enum nl80211_commands cmd, 8599 enum nl80211_attrs attr, 8600 const struct nl80211_vendor_cmd_info *info, 8601 gfp_t gfp) 8602 { 8603 struct sk_buff *skb; 8604 void *hdr; 8605 struct nlattr *data; 8606 8607 skb = nlmsg_new(approxlen + 100, gfp); 8608 if (!skb) 8609 return NULL; 8610 8611 hdr = nl80211hdr_put(skb, portid, seq, 0, cmd); 8612 if (!hdr) { 8613 kfree_skb(skb); 8614 return NULL; 8615 } 8616 8617 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx)) 8618 goto nla_put_failure; 8619 8620 if (info) { 8621 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID, 8622 info->vendor_id)) 8623 goto nla_put_failure; 8624 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD, 8625 info->subcmd)) 8626 goto nla_put_failure; 8627 } 8628 8629 if (wdev) { 8630 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV, 8631 wdev_id(wdev), NL80211_ATTR_PAD)) 8632 goto nla_put_failure; 8633 if (wdev->netdev && 8634 nla_put_u32(skb, NL80211_ATTR_IFINDEX, 8635 wdev->netdev->ifindex)) 8636 goto nla_put_failure; 8637 } 8638 8639 data = nla_nest_start(skb, attr); 8640 if (!data) 8641 goto nla_put_failure; 8642 8643 ((void **)skb->cb)[0] = rdev; 8644 ((void **)skb->cb)[1] = hdr; 8645 ((void **)skb->cb)[2] = data; 8646 8647 return skb; 8648 8649 nla_put_failure: 8650 kfree_skb(skb); 8651 return NULL; 8652 } 8653 8654 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy, 8655 struct wireless_dev *wdev, 8656 enum nl80211_commands cmd, 8657 enum nl80211_attrs attr, 8658 int vendor_event_idx, 8659 int approxlen, gfp_t gfp) 8660 { 8661 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 8662 const struct nl80211_vendor_cmd_info *info; 8663 8664 switch (cmd) { 8665 case NL80211_CMD_TESTMODE: 8666 if (WARN_ON(vendor_event_idx != -1)) 8667 return NULL; 8668 info = NULL; 8669 break; 8670 case NL80211_CMD_VENDOR: 8671 if (WARN_ON(vendor_event_idx < 0 || 8672 vendor_event_idx >= wiphy->n_vendor_events)) 8673 return NULL; 8674 info = &wiphy->vendor_events[vendor_event_idx]; 8675 break; 8676 default: 8677 WARN_ON(1); 8678 return NULL; 8679 } 8680 8681 return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, 0, 0, 8682 cmd, attr, info, gfp); 8683 } 8684 EXPORT_SYMBOL(__cfg80211_alloc_event_skb); 8685 8686 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp) 8687 { 8688 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0]; 8689 void *hdr = ((void **)skb->cb)[1]; 8690 struct nlattr *data = ((void **)skb->cb)[2]; 8691 enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE; 8692 8693 /* clear CB data for netlink core to own from now on */ 8694 memset(skb->cb, 0, sizeof(skb->cb)); 8695 8696 nla_nest_end(skb, data); 8697 genlmsg_end(skb, hdr); 8698 8699 if (data->nla_type == NL80211_ATTR_VENDOR_DATA) 8700 mcgrp = NL80211_MCGRP_VENDOR; 8701 8702 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0, 8703 mcgrp, gfp); 8704 } 8705 EXPORT_SYMBOL(__cfg80211_send_event_skb); 8706 8707 #ifdef CONFIG_NL80211_TESTMODE 8708 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info) 8709 { 8710 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8711 struct wireless_dev *wdev = 8712 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs); 8713 int err; 8714 8715 if (!rdev->ops->testmode_cmd) 8716 return -EOPNOTSUPP; 8717 8718 if (IS_ERR(wdev)) { 8719 err = PTR_ERR(wdev); 8720 if (err != -EINVAL) 8721 return err; 8722 wdev = NULL; 8723 } else if (wdev->wiphy != &rdev->wiphy) { 8724 return -EINVAL; 8725 } 8726 8727 if (!info->attrs[NL80211_ATTR_TESTDATA]) 8728 return -EINVAL; 8729 8730 rdev->cur_cmd_info = info; 8731 err = rdev_testmode_cmd(rdev, wdev, 8732 nla_data(info->attrs[NL80211_ATTR_TESTDATA]), 8733 nla_len(info->attrs[NL80211_ATTR_TESTDATA])); 8734 rdev->cur_cmd_info = NULL; 8735 8736 return err; 8737 } 8738 8739 static int nl80211_testmode_dump(struct sk_buff *skb, 8740 struct netlink_callback *cb) 8741 { 8742 struct cfg80211_registered_device *rdev; 8743 int err; 8744 long phy_idx; 8745 void *data = NULL; 8746 int data_len = 0; 8747 8748 rtnl_lock(); 8749 8750 if (cb->args[0]) { 8751 /* 8752 * 0 is a valid index, but not valid for args[0], 8753 * so we need to offset by 1. 8754 */ 8755 phy_idx = cb->args[0] - 1; 8756 8757 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx); 8758 if (!rdev) { 8759 err = -ENOENT; 8760 goto out_err; 8761 } 8762 } else { 8763 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam); 8764 8765 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, 8766 attrbuf, nl80211_fam.maxattr, 8767 nl80211_policy, NULL); 8768 if (err) 8769 goto out_err; 8770 8771 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf); 8772 if (IS_ERR(rdev)) { 8773 err = PTR_ERR(rdev); 8774 goto out_err; 8775 } 8776 phy_idx = rdev->wiphy_idx; 8777 8778 if (attrbuf[NL80211_ATTR_TESTDATA]) 8779 cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA]; 8780 } 8781 8782 if (cb->args[1]) { 8783 data = nla_data((void *)cb->args[1]); 8784 data_len = nla_len((void *)cb->args[1]); 8785 } 8786 8787 if (!rdev->ops->testmode_dump) { 8788 err = -EOPNOTSUPP; 8789 goto out_err; 8790 } 8791 8792 while (1) { 8793 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid, 8794 cb->nlh->nlmsg_seq, NLM_F_MULTI, 8795 NL80211_CMD_TESTMODE); 8796 struct nlattr *tmdata; 8797 8798 if (!hdr) 8799 break; 8800 8801 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) { 8802 genlmsg_cancel(skb, hdr); 8803 break; 8804 } 8805 8806 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA); 8807 if (!tmdata) { 8808 genlmsg_cancel(skb, hdr); 8809 break; 8810 } 8811 err = rdev_testmode_dump(rdev, skb, cb, data, data_len); 8812 nla_nest_end(skb, tmdata); 8813 8814 if (err == -ENOBUFS || err == -ENOENT) { 8815 genlmsg_cancel(skb, hdr); 8816 break; 8817 } else if (err) { 8818 genlmsg_cancel(skb, hdr); 8819 goto out_err; 8820 } 8821 8822 genlmsg_end(skb, hdr); 8823 } 8824 8825 err = skb->len; 8826 /* see above */ 8827 cb->args[0] = phy_idx + 1; 8828 out_err: 8829 rtnl_unlock(); 8830 return err; 8831 } 8832 #endif 8833 8834 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info) 8835 { 8836 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 8837 struct net_device *dev = info->user_ptr[1]; 8838 struct cfg80211_connect_params connect; 8839 struct wiphy *wiphy; 8840 struct cfg80211_cached_keys *connkeys = NULL; 8841 int err; 8842 8843 memset(&connect, 0, sizeof(connect)); 8844 8845 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) 8846 return -EINVAL; 8847 8848 if (!info->attrs[NL80211_ATTR_SSID] || 8849 !nla_len(info->attrs[NL80211_ATTR_SSID])) 8850 return -EINVAL; 8851 8852 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) { 8853 connect.auth_type = 8854 nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]); 8855 if (!nl80211_valid_auth_type(rdev, connect.auth_type, 8856 NL80211_CMD_CONNECT)) 8857 return -EINVAL; 8858 } else 8859 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC; 8860 8861 connect.privacy = info->attrs[NL80211_ATTR_PRIVACY]; 8862 8863 err = nl80211_crypto_settings(rdev, info, &connect.crypto, 8864 NL80211_MAX_NR_CIPHER_SUITES); 8865 if (err) 8866 return err; 8867 8868 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 8869 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 8870 return -EOPNOTSUPP; 8871 8872 wiphy = &rdev->wiphy; 8873 8874 connect.bg_scan_period = -1; 8875 if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] && 8876 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) { 8877 connect.bg_scan_period = 8878 nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]); 8879 } 8880 8881 if (info->attrs[NL80211_ATTR_MAC]) 8882 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 8883 else if (info->attrs[NL80211_ATTR_MAC_HINT]) 8884 connect.bssid_hint = 8885 nla_data(info->attrs[NL80211_ATTR_MAC_HINT]); 8886 connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 8887 connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 8888 8889 if (info->attrs[NL80211_ATTR_IE]) { 8890 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 8891 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 8892 } 8893 8894 if (info->attrs[NL80211_ATTR_USE_MFP]) { 8895 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]); 8896 if (connect.mfp != NL80211_MFP_REQUIRED && 8897 connect.mfp != NL80211_MFP_NO) 8898 return -EINVAL; 8899 } else { 8900 connect.mfp = NL80211_MFP_NO; 8901 } 8902 8903 if (info->attrs[NL80211_ATTR_PREV_BSSID]) 8904 connect.prev_bssid = 8905 nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]); 8906 8907 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 8908 connect.channel = nl80211_get_valid_chan( 8909 wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]); 8910 if (!connect.channel) 8911 return -EINVAL; 8912 } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) { 8913 connect.channel_hint = nl80211_get_valid_chan( 8914 wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]); 8915 if (!connect.channel_hint) 8916 return -EINVAL; 8917 } 8918 8919 if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) { 8920 connkeys = nl80211_parse_connkeys(rdev, 8921 info->attrs[NL80211_ATTR_KEYS], NULL); 8922 if (IS_ERR(connkeys)) 8923 return PTR_ERR(connkeys); 8924 } 8925 8926 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT])) 8927 connect.flags |= ASSOC_REQ_DISABLE_HT; 8928 8929 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) 8930 memcpy(&connect.ht_capa_mask, 8931 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]), 8932 sizeof(connect.ht_capa_mask)); 8933 8934 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) { 8935 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) { 8936 kzfree(connkeys); 8937 return -EINVAL; 8938 } 8939 memcpy(&connect.ht_capa, 8940 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]), 8941 sizeof(connect.ht_capa)); 8942 } 8943 8944 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT])) 8945 connect.flags |= ASSOC_REQ_DISABLE_VHT; 8946 8947 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) 8948 memcpy(&connect.vht_capa_mask, 8949 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]), 8950 sizeof(connect.vht_capa_mask)); 8951 8952 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) { 8953 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) { 8954 kzfree(connkeys); 8955 return -EINVAL; 8956 } 8957 memcpy(&connect.vht_capa, 8958 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]), 8959 sizeof(connect.vht_capa)); 8960 } 8961 8962 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) { 8963 if (!((rdev->wiphy.features & 8964 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) && 8965 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) && 8966 !wiphy_ext_feature_isset(&rdev->wiphy, 8967 NL80211_EXT_FEATURE_RRM)) { 8968 kzfree(connkeys); 8969 return -EINVAL; 8970 } 8971 connect.flags |= ASSOC_REQ_USE_RRM; 8972 } 8973 8974 connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]); 8975 if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) { 8976 kzfree(connkeys); 8977 return -EOPNOTSUPP; 8978 } 8979 8980 if (info->attrs[NL80211_ATTR_BSS_SELECT]) { 8981 /* bss selection makes no sense if bssid is set */ 8982 if (connect.bssid) { 8983 kzfree(connkeys); 8984 return -EINVAL; 8985 } 8986 8987 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT], 8988 wiphy, &connect.bss_select); 8989 if (err) { 8990 kzfree(connkeys); 8991 return err; 8992 } 8993 } 8994 8995 if (wiphy_ext_feature_isset(&rdev->wiphy, 8996 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) && 8997 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] && 8998 info->attrs[NL80211_ATTR_FILS_ERP_REALM] && 8999 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] && 9000 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 9001 connect.fils_erp_username = 9002 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 9003 connect.fils_erp_username_len = 9004 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]); 9005 connect.fils_erp_realm = 9006 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 9007 connect.fils_erp_realm_len = 9008 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]); 9009 connect.fils_erp_next_seq_num = 9010 nla_get_u16( 9011 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]); 9012 connect.fils_erp_rrk = 9013 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 9014 connect.fils_erp_rrk_len = 9015 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]); 9016 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] || 9017 info->attrs[NL80211_ATTR_FILS_ERP_REALM] || 9018 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] || 9019 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) { 9020 kzfree(connkeys); 9021 return -EINVAL; 9022 } 9023 9024 wdev_lock(dev->ieee80211_ptr); 9025 9026 err = cfg80211_connect(rdev, dev, &connect, connkeys, 9027 connect.prev_bssid); 9028 if (err) 9029 kzfree(connkeys); 9030 9031 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) { 9032 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid; 9033 if (connect.bssid) 9034 memcpy(dev->ieee80211_ptr->disconnect_bssid, 9035 connect.bssid, ETH_ALEN); 9036 else 9037 memset(dev->ieee80211_ptr->disconnect_bssid, 9038 0, ETH_ALEN); 9039 } 9040 9041 wdev_unlock(dev->ieee80211_ptr); 9042 9043 return err; 9044 } 9045 9046 static int nl80211_update_connect_params(struct sk_buff *skb, 9047 struct genl_info *info) 9048 { 9049 struct cfg80211_connect_params connect = {}; 9050 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9051 struct net_device *dev = info->user_ptr[1]; 9052 struct wireless_dev *wdev = dev->ieee80211_ptr; 9053 u32 changed = 0; 9054 int ret; 9055 9056 if (!rdev->ops->update_connect_params) 9057 return -EOPNOTSUPP; 9058 9059 if (info->attrs[NL80211_ATTR_IE]) { 9060 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) 9061 return -EINVAL; 9062 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 9063 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 9064 changed |= UPDATE_ASSOC_IES; 9065 } 9066 9067 wdev_lock(dev->ieee80211_ptr); 9068 if (!wdev->current_bss) 9069 ret = -ENOLINK; 9070 else 9071 ret = rdev_update_connect_params(rdev, dev, &connect, changed); 9072 wdev_unlock(dev->ieee80211_ptr); 9073 9074 return ret; 9075 } 9076 9077 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info) 9078 { 9079 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9080 struct net_device *dev = info->user_ptr[1]; 9081 u16 reason; 9082 int ret; 9083 9084 if (!info->attrs[NL80211_ATTR_REASON_CODE]) 9085 reason = WLAN_REASON_DEAUTH_LEAVING; 9086 else 9087 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]); 9088 9089 if (reason == 0) 9090 return -EINVAL; 9091 9092 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 9093 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 9094 return -EOPNOTSUPP; 9095 9096 wdev_lock(dev->ieee80211_ptr); 9097 ret = cfg80211_disconnect(rdev, dev, reason, true); 9098 wdev_unlock(dev->ieee80211_ptr); 9099 return ret; 9100 } 9101 9102 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info) 9103 { 9104 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9105 struct net *net; 9106 int err; 9107 9108 if (info->attrs[NL80211_ATTR_PID]) { 9109 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]); 9110 9111 net = get_net_ns_by_pid(pid); 9112 } else if (info->attrs[NL80211_ATTR_NETNS_FD]) { 9113 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]); 9114 9115 net = get_net_ns_by_fd(fd); 9116 } else { 9117 return -EINVAL; 9118 } 9119 9120 if (IS_ERR(net)) 9121 return PTR_ERR(net); 9122 9123 err = 0; 9124 9125 /* check if anything to do */ 9126 if (!net_eq(wiphy_net(&rdev->wiphy), net)) 9127 err = cfg80211_switch_netns(rdev, net); 9128 9129 put_net(net); 9130 return err; 9131 } 9132 9133 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info) 9134 { 9135 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9136 int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev, 9137 struct cfg80211_pmksa *pmksa) = NULL; 9138 struct net_device *dev = info->user_ptr[1]; 9139 struct cfg80211_pmksa pmksa; 9140 9141 memset(&pmksa, 0, sizeof(struct cfg80211_pmksa)); 9142 9143 if (!info->attrs[NL80211_ATTR_PMKID]) 9144 return -EINVAL; 9145 9146 pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]); 9147 9148 if (info->attrs[NL80211_ATTR_MAC]) { 9149 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]); 9150 } else if (info->attrs[NL80211_ATTR_SSID] && 9151 info->attrs[NL80211_ATTR_FILS_CACHE_ID] && 9152 (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA || 9153 info->attrs[NL80211_ATTR_PMK])) { 9154 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]); 9155 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]); 9156 pmksa.cache_id = 9157 nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]); 9158 } else { 9159 return -EINVAL; 9160 } 9161 if (info->attrs[NL80211_ATTR_PMK]) { 9162 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]); 9163 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]); 9164 } 9165 9166 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 9167 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 9168 return -EOPNOTSUPP; 9169 9170 switch (info->genlhdr->cmd) { 9171 case NL80211_CMD_SET_PMKSA: 9172 rdev_ops = rdev->ops->set_pmksa; 9173 break; 9174 case NL80211_CMD_DEL_PMKSA: 9175 rdev_ops = rdev->ops->del_pmksa; 9176 break; 9177 default: 9178 WARN_ON(1); 9179 break; 9180 } 9181 9182 if (!rdev_ops) 9183 return -EOPNOTSUPP; 9184 9185 return rdev_ops(&rdev->wiphy, dev, &pmksa); 9186 } 9187 9188 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info) 9189 { 9190 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9191 struct net_device *dev = info->user_ptr[1]; 9192 9193 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION && 9194 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT) 9195 return -EOPNOTSUPP; 9196 9197 if (!rdev->ops->flush_pmksa) 9198 return -EOPNOTSUPP; 9199 9200 return rdev_flush_pmksa(rdev, dev); 9201 } 9202 9203 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info) 9204 { 9205 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9206 struct net_device *dev = info->user_ptr[1]; 9207 u8 action_code, dialog_token; 9208 u32 peer_capability = 0; 9209 u16 status_code; 9210 u8 *peer; 9211 bool initiator; 9212 9213 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) || 9214 !rdev->ops->tdls_mgmt) 9215 return -EOPNOTSUPP; 9216 9217 if (!info->attrs[NL80211_ATTR_TDLS_ACTION] || 9218 !info->attrs[NL80211_ATTR_STATUS_CODE] || 9219 !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] || 9220 !info->attrs[NL80211_ATTR_IE] || 9221 !info->attrs[NL80211_ATTR_MAC]) 9222 return -EINVAL; 9223 9224 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 9225 action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]); 9226 status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]); 9227 dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]); 9228 initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]); 9229 if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]) 9230 peer_capability = 9231 nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]); 9232 9233 return rdev_tdls_mgmt(rdev, dev, peer, action_code, 9234 dialog_token, status_code, peer_capability, 9235 initiator, 9236 nla_data(info->attrs[NL80211_ATTR_IE]), 9237 nla_len(info->attrs[NL80211_ATTR_IE])); 9238 } 9239 9240 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info) 9241 { 9242 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9243 struct net_device *dev = info->user_ptr[1]; 9244 enum nl80211_tdls_operation operation; 9245 u8 *peer; 9246 9247 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) || 9248 !rdev->ops->tdls_oper) 9249 return -EOPNOTSUPP; 9250 9251 if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] || 9252 !info->attrs[NL80211_ATTR_MAC]) 9253 return -EINVAL; 9254 9255 operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]); 9256 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 9257 9258 return rdev_tdls_oper(rdev, dev, peer, operation); 9259 } 9260 9261 static int nl80211_remain_on_channel(struct sk_buff *skb, 9262 struct genl_info *info) 9263 { 9264 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9265 struct wireless_dev *wdev = info->user_ptr[1]; 9266 struct cfg80211_chan_def chandef; 9267 const struct cfg80211_chan_def *compat_chandef; 9268 struct sk_buff *msg; 9269 void *hdr; 9270 u64 cookie; 9271 u32 duration; 9272 int err; 9273 9274 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] || 9275 !info->attrs[NL80211_ATTR_DURATION]) 9276 return -EINVAL; 9277 9278 duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]); 9279 9280 if (!rdev->ops->remain_on_channel || 9281 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)) 9282 return -EOPNOTSUPP; 9283 9284 /* 9285 * We should be on that channel for at least a minimum amount of 9286 * time (10ms) but no longer than the driver supports. 9287 */ 9288 if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME || 9289 duration > rdev->wiphy.max_remain_on_channel_duration) 9290 return -EINVAL; 9291 9292 err = nl80211_parse_chandef(rdev, info, &chandef); 9293 if (err) 9294 return err; 9295 9296 wdev_lock(wdev); 9297 if (!cfg80211_off_channel_oper_allowed(wdev) && 9298 !cfg80211_chandef_identical(&wdev->chandef, &chandef)) { 9299 compat_chandef = cfg80211_chandef_compatible(&wdev->chandef, 9300 &chandef); 9301 if (compat_chandef != &chandef) { 9302 wdev_unlock(wdev); 9303 return -EBUSY; 9304 } 9305 } 9306 wdev_unlock(wdev); 9307 9308 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 9309 if (!msg) 9310 return -ENOMEM; 9311 9312 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 9313 NL80211_CMD_REMAIN_ON_CHANNEL); 9314 if (!hdr) { 9315 err = -ENOBUFS; 9316 goto free_msg; 9317 } 9318 9319 err = rdev_remain_on_channel(rdev, wdev, chandef.chan, 9320 duration, &cookie); 9321 9322 if (err) 9323 goto free_msg; 9324 9325 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 9326 NL80211_ATTR_PAD)) 9327 goto nla_put_failure; 9328 9329 genlmsg_end(msg, hdr); 9330 9331 return genlmsg_reply(msg, info); 9332 9333 nla_put_failure: 9334 err = -ENOBUFS; 9335 free_msg: 9336 nlmsg_free(msg); 9337 return err; 9338 } 9339 9340 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb, 9341 struct genl_info *info) 9342 { 9343 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9344 struct wireless_dev *wdev = info->user_ptr[1]; 9345 u64 cookie; 9346 9347 if (!info->attrs[NL80211_ATTR_COOKIE]) 9348 return -EINVAL; 9349 9350 if (!rdev->ops->cancel_remain_on_channel) 9351 return -EOPNOTSUPP; 9352 9353 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 9354 9355 return rdev_cancel_remain_on_channel(rdev, wdev, cookie); 9356 } 9357 9358 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb, 9359 struct genl_info *info) 9360 { 9361 struct cfg80211_bitrate_mask mask; 9362 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9363 struct net_device *dev = info->user_ptr[1]; 9364 int err; 9365 9366 if (!rdev->ops->set_bitrate_mask) 9367 return -EOPNOTSUPP; 9368 9369 err = nl80211_parse_tx_bitrate_mask(info, &mask); 9370 if (err) 9371 return err; 9372 9373 return rdev_set_bitrate_mask(rdev, dev, NULL, &mask); 9374 } 9375 9376 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info) 9377 { 9378 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9379 struct wireless_dev *wdev = info->user_ptr[1]; 9380 u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION; 9381 9382 if (!info->attrs[NL80211_ATTR_FRAME_MATCH]) 9383 return -EINVAL; 9384 9385 if (info->attrs[NL80211_ATTR_FRAME_TYPE]) 9386 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]); 9387 9388 switch (wdev->iftype) { 9389 case NL80211_IFTYPE_STATION: 9390 case NL80211_IFTYPE_ADHOC: 9391 case NL80211_IFTYPE_P2P_CLIENT: 9392 case NL80211_IFTYPE_AP: 9393 case NL80211_IFTYPE_AP_VLAN: 9394 case NL80211_IFTYPE_MESH_POINT: 9395 case NL80211_IFTYPE_P2P_GO: 9396 case NL80211_IFTYPE_P2P_DEVICE: 9397 break; 9398 case NL80211_IFTYPE_NAN: 9399 default: 9400 return -EOPNOTSUPP; 9401 } 9402 9403 /* not much point in registering if we can't reply */ 9404 if (!rdev->ops->mgmt_tx) 9405 return -EOPNOTSUPP; 9406 9407 return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type, 9408 nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]), 9409 nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH])); 9410 } 9411 9412 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info) 9413 { 9414 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9415 struct wireless_dev *wdev = info->user_ptr[1]; 9416 struct cfg80211_chan_def chandef; 9417 int err; 9418 void *hdr = NULL; 9419 u64 cookie; 9420 struct sk_buff *msg = NULL; 9421 struct cfg80211_mgmt_tx_params params = { 9422 .dont_wait_for_ack = 9423 info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK], 9424 }; 9425 9426 if (!info->attrs[NL80211_ATTR_FRAME]) 9427 return -EINVAL; 9428 9429 if (!rdev->ops->mgmt_tx) 9430 return -EOPNOTSUPP; 9431 9432 switch (wdev->iftype) { 9433 case NL80211_IFTYPE_P2P_DEVICE: 9434 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ]) 9435 return -EINVAL; 9436 case NL80211_IFTYPE_STATION: 9437 case NL80211_IFTYPE_ADHOC: 9438 case NL80211_IFTYPE_P2P_CLIENT: 9439 case NL80211_IFTYPE_AP: 9440 case NL80211_IFTYPE_AP_VLAN: 9441 case NL80211_IFTYPE_MESH_POINT: 9442 case NL80211_IFTYPE_P2P_GO: 9443 break; 9444 case NL80211_IFTYPE_NAN: 9445 default: 9446 return -EOPNOTSUPP; 9447 } 9448 9449 if (info->attrs[NL80211_ATTR_DURATION]) { 9450 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX)) 9451 return -EINVAL; 9452 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]); 9453 9454 /* 9455 * We should wait on the channel for at least a minimum amount 9456 * of time (10ms) but no longer than the driver supports. 9457 */ 9458 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME || 9459 params.wait > rdev->wiphy.max_remain_on_channel_duration) 9460 return -EINVAL; 9461 } 9462 9463 params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK]; 9464 9465 if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX)) 9466 return -EINVAL; 9467 9468 params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]); 9469 9470 /* get the channel if any has been specified, otherwise pass NULL to 9471 * the driver. The latter will use the current one 9472 */ 9473 chandef.chan = NULL; 9474 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 9475 err = nl80211_parse_chandef(rdev, info, &chandef); 9476 if (err) 9477 return err; 9478 } 9479 9480 if (!chandef.chan && params.offchan) 9481 return -EINVAL; 9482 9483 wdev_lock(wdev); 9484 if (params.offchan && !cfg80211_off_channel_oper_allowed(wdev)) { 9485 wdev_unlock(wdev); 9486 return -EBUSY; 9487 } 9488 wdev_unlock(wdev); 9489 9490 params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]); 9491 params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]); 9492 9493 if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) { 9494 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]); 9495 int i; 9496 9497 if (len % sizeof(u16)) 9498 return -EINVAL; 9499 9500 params.n_csa_offsets = len / sizeof(u16); 9501 params.csa_offsets = 9502 nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]); 9503 9504 /* check that all the offsets fit the frame */ 9505 for (i = 0; i < params.n_csa_offsets; i++) { 9506 if (params.csa_offsets[i] >= params.len) 9507 return -EINVAL; 9508 } 9509 } 9510 9511 if (!params.dont_wait_for_ack) { 9512 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 9513 if (!msg) 9514 return -ENOMEM; 9515 9516 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 9517 NL80211_CMD_FRAME); 9518 if (!hdr) { 9519 err = -ENOBUFS; 9520 goto free_msg; 9521 } 9522 } 9523 9524 params.chan = chandef.chan; 9525 err = cfg80211_mlme_mgmt_tx(rdev, wdev, ¶ms, &cookie); 9526 if (err) 9527 goto free_msg; 9528 9529 if (msg) { 9530 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 9531 NL80211_ATTR_PAD)) 9532 goto nla_put_failure; 9533 9534 genlmsg_end(msg, hdr); 9535 return genlmsg_reply(msg, info); 9536 } 9537 9538 return 0; 9539 9540 nla_put_failure: 9541 err = -ENOBUFS; 9542 free_msg: 9543 nlmsg_free(msg); 9544 return err; 9545 } 9546 9547 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info) 9548 { 9549 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9550 struct wireless_dev *wdev = info->user_ptr[1]; 9551 u64 cookie; 9552 9553 if (!info->attrs[NL80211_ATTR_COOKIE]) 9554 return -EINVAL; 9555 9556 if (!rdev->ops->mgmt_tx_cancel_wait) 9557 return -EOPNOTSUPP; 9558 9559 switch (wdev->iftype) { 9560 case NL80211_IFTYPE_STATION: 9561 case NL80211_IFTYPE_ADHOC: 9562 case NL80211_IFTYPE_P2P_CLIENT: 9563 case NL80211_IFTYPE_AP: 9564 case NL80211_IFTYPE_AP_VLAN: 9565 case NL80211_IFTYPE_P2P_GO: 9566 case NL80211_IFTYPE_P2P_DEVICE: 9567 break; 9568 case NL80211_IFTYPE_NAN: 9569 default: 9570 return -EOPNOTSUPP; 9571 } 9572 9573 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 9574 9575 return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie); 9576 } 9577 9578 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info) 9579 { 9580 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9581 struct wireless_dev *wdev; 9582 struct net_device *dev = info->user_ptr[1]; 9583 u8 ps_state; 9584 bool state; 9585 int err; 9586 9587 if (!info->attrs[NL80211_ATTR_PS_STATE]) 9588 return -EINVAL; 9589 9590 ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]); 9591 9592 if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED) 9593 return -EINVAL; 9594 9595 wdev = dev->ieee80211_ptr; 9596 9597 if (!rdev->ops->set_power_mgmt) 9598 return -EOPNOTSUPP; 9599 9600 state = (ps_state == NL80211_PS_ENABLED) ? true : false; 9601 9602 if (state == wdev->ps) 9603 return 0; 9604 9605 err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout); 9606 if (!err) 9607 wdev->ps = state; 9608 return err; 9609 } 9610 9611 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info) 9612 { 9613 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9614 enum nl80211_ps_state ps_state; 9615 struct wireless_dev *wdev; 9616 struct net_device *dev = info->user_ptr[1]; 9617 struct sk_buff *msg; 9618 void *hdr; 9619 int err; 9620 9621 wdev = dev->ieee80211_ptr; 9622 9623 if (!rdev->ops->set_power_mgmt) 9624 return -EOPNOTSUPP; 9625 9626 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 9627 if (!msg) 9628 return -ENOMEM; 9629 9630 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 9631 NL80211_CMD_GET_POWER_SAVE); 9632 if (!hdr) { 9633 err = -ENOBUFS; 9634 goto free_msg; 9635 } 9636 9637 if (wdev->ps) 9638 ps_state = NL80211_PS_ENABLED; 9639 else 9640 ps_state = NL80211_PS_DISABLED; 9641 9642 if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state)) 9643 goto nla_put_failure; 9644 9645 genlmsg_end(msg, hdr); 9646 return genlmsg_reply(msg, info); 9647 9648 nla_put_failure: 9649 err = -ENOBUFS; 9650 free_msg: 9651 nlmsg_free(msg); 9652 return err; 9653 } 9654 9655 static const struct nla_policy 9656 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = { 9657 [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY }, 9658 [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 }, 9659 [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 }, 9660 [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 }, 9661 [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 }, 9662 [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 }, 9663 [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 }, 9664 }; 9665 9666 static int nl80211_set_cqm_txe(struct genl_info *info, 9667 u32 rate, u32 pkts, u32 intvl) 9668 { 9669 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9670 struct net_device *dev = info->user_ptr[1]; 9671 struct wireless_dev *wdev = dev->ieee80211_ptr; 9672 9673 if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL) 9674 return -EINVAL; 9675 9676 if (!rdev->ops->set_cqm_txe_config) 9677 return -EOPNOTSUPP; 9678 9679 if (wdev->iftype != NL80211_IFTYPE_STATION && 9680 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 9681 return -EOPNOTSUPP; 9682 9683 return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl); 9684 } 9685 9686 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev, 9687 struct net_device *dev) 9688 { 9689 struct wireless_dev *wdev = dev->ieee80211_ptr; 9690 s32 last, low, high; 9691 u32 hyst; 9692 int i, n; 9693 int err; 9694 9695 /* RSSI reporting disabled? */ 9696 if (!wdev->cqm_config) 9697 return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0); 9698 9699 /* 9700 * Obtain current RSSI value if possible, if not and no RSSI threshold 9701 * event has been received yet, we should receive an event after a 9702 * connection is established and enough beacons received to calculate 9703 * the average. 9704 */ 9705 if (!wdev->cqm_config->last_rssi_event_value && wdev->current_bss && 9706 rdev->ops->get_station) { 9707 struct station_info sinfo; 9708 u8 *mac_addr; 9709 9710 mac_addr = wdev->current_bss->pub.bssid; 9711 9712 err = rdev_get_station(rdev, dev, mac_addr, &sinfo); 9713 if (err) 9714 return err; 9715 9716 if (sinfo.filled & BIT(NL80211_STA_INFO_BEACON_SIGNAL_AVG)) 9717 wdev->cqm_config->last_rssi_event_value = 9718 (s8) sinfo.rx_beacon_signal_avg; 9719 } 9720 9721 last = wdev->cqm_config->last_rssi_event_value; 9722 hyst = wdev->cqm_config->rssi_hyst; 9723 n = wdev->cqm_config->n_rssi_thresholds; 9724 9725 for (i = 0; i < n; i++) 9726 if (last < wdev->cqm_config->rssi_thresholds[i]) 9727 break; 9728 9729 low = i > 0 ? 9730 (wdev->cqm_config->rssi_thresholds[i - 1] - hyst) : S32_MIN; 9731 high = i < n ? 9732 (wdev->cqm_config->rssi_thresholds[i] + hyst - 1) : S32_MAX; 9733 9734 return rdev_set_cqm_rssi_range_config(rdev, dev, low, high); 9735 } 9736 9737 static int nl80211_set_cqm_rssi(struct genl_info *info, 9738 const s32 *thresholds, int n_thresholds, 9739 u32 hysteresis) 9740 { 9741 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9742 struct net_device *dev = info->user_ptr[1]; 9743 struct wireless_dev *wdev = dev->ieee80211_ptr; 9744 int i, err; 9745 s32 prev = S32_MIN; 9746 9747 /* Check all values negative and sorted */ 9748 for (i = 0; i < n_thresholds; i++) { 9749 if (thresholds[i] > 0 || thresholds[i] <= prev) 9750 return -EINVAL; 9751 9752 prev = thresholds[i]; 9753 } 9754 9755 if (wdev->iftype != NL80211_IFTYPE_STATION && 9756 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT) 9757 return -EOPNOTSUPP; 9758 9759 wdev_lock(wdev); 9760 cfg80211_cqm_config_free(wdev); 9761 wdev_unlock(wdev); 9762 9763 if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) { 9764 if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */ 9765 return rdev_set_cqm_rssi_config(rdev, dev, 0, 0); 9766 9767 return rdev_set_cqm_rssi_config(rdev, dev, 9768 thresholds[0], hysteresis); 9769 } 9770 9771 if (!wiphy_ext_feature_isset(&rdev->wiphy, 9772 NL80211_EXT_FEATURE_CQM_RSSI_LIST)) 9773 return -EOPNOTSUPP; 9774 9775 if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */ 9776 n_thresholds = 0; 9777 9778 wdev_lock(wdev); 9779 if (n_thresholds) { 9780 struct cfg80211_cqm_config *cqm_config; 9781 9782 cqm_config = kzalloc(sizeof(struct cfg80211_cqm_config) + 9783 n_thresholds * sizeof(s32), GFP_KERNEL); 9784 if (!cqm_config) { 9785 err = -ENOMEM; 9786 goto unlock; 9787 } 9788 9789 cqm_config->rssi_hyst = hysteresis; 9790 cqm_config->n_rssi_thresholds = n_thresholds; 9791 memcpy(cqm_config->rssi_thresholds, thresholds, 9792 n_thresholds * sizeof(s32)); 9793 9794 wdev->cqm_config = cqm_config; 9795 } 9796 9797 err = cfg80211_cqm_rssi_update(rdev, dev); 9798 9799 unlock: 9800 wdev_unlock(wdev); 9801 9802 return err; 9803 } 9804 9805 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info) 9806 { 9807 struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1]; 9808 struct nlattr *cqm; 9809 int err; 9810 9811 cqm = info->attrs[NL80211_ATTR_CQM]; 9812 if (!cqm) 9813 return -EINVAL; 9814 9815 err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm, 9816 nl80211_attr_cqm_policy, info->extack); 9817 if (err) 9818 return err; 9819 9820 if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] && 9821 attrs[NL80211_ATTR_CQM_RSSI_HYST]) { 9822 const s32 *thresholds = 9823 nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]); 9824 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]); 9825 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]); 9826 9827 if (len % 4) 9828 return -EINVAL; 9829 9830 return nl80211_set_cqm_rssi(info, thresholds, len / 4, 9831 hysteresis); 9832 } 9833 9834 if (attrs[NL80211_ATTR_CQM_TXE_RATE] && 9835 attrs[NL80211_ATTR_CQM_TXE_PKTS] && 9836 attrs[NL80211_ATTR_CQM_TXE_INTVL]) { 9837 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]); 9838 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]); 9839 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]); 9840 9841 return nl80211_set_cqm_txe(info, rate, pkts, intvl); 9842 } 9843 9844 return -EINVAL; 9845 } 9846 9847 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info) 9848 { 9849 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9850 struct net_device *dev = info->user_ptr[1]; 9851 struct ocb_setup setup = {}; 9852 int err; 9853 9854 err = nl80211_parse_chandef(rdev, info, &setup.chandef); 9855 if (err) 9856 return err; 9857 9858 return cfg80211_join_ocb(rdev, dev, &setup); 9859 } 9860 9861 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info) 9862 { 9863 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9864 struct net_device *dev = info->user_ptr[1]; 9865 9866 return cfg80211_leave_ocb(rdev, dev); 9867 } 9868 9869 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info) 9870 { 9871 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9872 struct net_device *dev = info->user_ptr[1]; 9873 struct mesh_config cfg; 9874 struct mesh_setup setup; 9875 int err; 9876 9877 /* start with default */ 9878 memcpy(&cfg, &default_mesh_config, sizeof(cfg)); 9879 memcpy(&setup, &default_mesh_setup, sizeof(setup)); 9880 9881 if (info->attrs[NL80211_ATTR_MESH_CONFIG]) { 9882 /* and parse parameters if given */ 9883 err = nl80211_parse_mesh_config(info, &cfg, NULL); 9884 if (err) 9885 return err; 9886 } 9887 9888 if (!info->attrs[NL80211_ATTR_MESH_ID] || 9889 !nla_len(info->attrs[NL80211_ATTR_MESH_ID])) 9890 return -EINVAL; 9891 9892 setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]); 9893 setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]); 9894 9895 if (info->attrs[NL80211_ATTR_MCAST_RATE] && 9896 !nl80211_parse_mcast_rate(rdev, setup.mcast_rate, 9897 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]))) 9898 return -EINVAL; 9899 9900 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) { 9901 setup.beacon_interval = 9902 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]); 9903 9904 err = cfg80211_validate_beacon_int(rdev, 9905 NL80211_IFTYPE_MESH_POINT, 9906 setup.beacon_interval); 9907 if (err) 9908 return err; 9909 } 9910 9911 if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) { 9912 setup.dtim_period = 9913 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]); 9914 if (setup.dtim_period < 1 || setup.dtim_period > 100) 9915 return -EINVAL; 9916 } 9917 9918 if (info->attrs[NL80211_ATTR_MESH_SETUP]) { 9919 /* parse additional setup parameters if given */ 9920 err = nl80211_parse_mesh_setup(info, &setup); 9921 if (err) 9922 return err; 9923 } 9924 9925 if (setup.user_mpm) 9926 cfg.auto_open_plinks = false; 9927 9928 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) { 9929 err = nl80211_parse_chandef(rdev, info, &setup.chandef); 9930 if (err) 9931 return err; 9932 } else { 9933 /* cfg80211_join_mesh() will sort it out */ 9934 setup.chandef.chan = NULL; 9935 } 9936 9937 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) { 9938 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 9939 int n_rates = 9940 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]); 9941 struct ieee80211_supported_band *sband; 9942 9943 if (!setup.chandef.chan) 9944 return -EINVAL; 9945 9946 sband = rdev->wiphy.bands[setup.chandef.chan->band]; 9947 9948 err = ieee80211_get_ratemask(sband, rates, n_rates, 9949 &setup.basic_rates); 9950 if (err) 9951 return err; 9952 } 9953 9954 if (info->attrs[NL80211_ATTR_TX_RATES]) { 9955 err = nl80211_parse_tx_bitrate_mask(info, &setup.beacon_rate); 9956 if (err) 9957 return err; 9958 9959 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band, 9960 &setup.beacon_rate); 9961 if (err) 9962 return err; 9963 } 9964 9965 return cfg80211_join_mesh(rdev, dev, &setup, &cfg); 9966 } 9967 9968 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info) 9969 { 9970 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 9971 struct net_device *dev = info->user_ptr[1]; 9972 9973 return cfg80211_leave_mesh(rdev, dev); 9974 } 9975 9976 #ifdef CONFIG_PM 9977 static int nl80211_send_wowlan_patterns(struct sk_buff *msg, 9978 struct cfg80211_registered_device *rdev) 9979 { 9980 struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config; 9981 struct nlattr *nl_pats, *nl_pat; 9982 int i, pat_len; 9983 9984 if (!wowlan->n_patterns) 9985 return 0; 9986 9987 nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN); 9988 if (!nl_pats) 9989 return -ENOBUFS; 9990 9991 for (i = 0; i < wowlan->n_patterns; i++) { 9992 nl_pat = nla_nest_start(msg, i + 1); 9993 if (!nl_pat) 9994 return -ENOBUFS; 9995 pat_len = wowlan->patterns[i].pattern_len; 9996 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8), 9997 wowlan->patterns[i].mask) || 9998 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len, 9999 wowlan->patterns[i].pattern) || 10000 nla_put_u32(msg, NL80211_PKTPAT_OFFSET, 10001 wowlan->patterns[i].pkt_offset)) 10002 return -ENOBUFS; 10003 nla_nest_end(msg, nl_pat); 10004 } 10005 nla_nest_end(msg, nl_pats); 10006 10007 return 0; 10008 } 10009 10010 static int nl80211_send_wowlan_tcp(struct sk_buff *msg, 10011 struct cfg80211_wowlan_tcp *tcp) 10012 { 10013 struct nlattr *nl_tcp; 10014 10015 if (!tcp) 10016 return 0; 10017 10018 nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION); 10019 if (!nl_tcp) 10020 return -ENOBUFS; 10021 10022 if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) || 10023 nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) || 10024 nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) || 10025 nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) || 10026 nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) || 10027 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD, 10028 tcp->payload_len, tcp->payload) || 10029 nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL, 10030 tcp->data_interval) || 10031 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD, 10032 tcp->wake_len, tcp->wake_data) || 10033 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK, 10034 DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask)) 10035 return -ENOBUFS; 10036 10037 if (tcp->payload_seq.len && 10038 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ, 10039 sizeof(tcp->payload_seq), &tcp->payload_seq)) 10040 return -ENOBUFS; 10041 10042 if (tcp->payload_tok.len && 10043 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN, 10044 sizeof(tcp->payload_tok) + tcp->tokens_size, 10045 &tcp->payload_tok)) 10046 return -ENOBUFS; 10047 10048 nla_nest_end(msg, nl_tcp); 10049 10050 return 0; 10051 } 10052 10053 static int nl80211_send_wowlan_nd(struct sk_buff *msg, 10054 struct cfg80211_sched_scan_request *req) 10055 { 10056 struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan; 10057 int i; 10058 10059 if (!req) 10060 return 0; 10061 10062 nd = nla_nest_start(msg, NL80211_WOWLAN_TRIG_NET_DETECT); 10063 if (!nd) 10064 return -ENOBUFS; 10065 10066 if (req->n_scan_plans == 1 && 10067 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL, 10068 req->scan_plans[0].interval * 1000)) 10069 return -ENOBUFS; 10070 10071 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay)) 10072 return -ENOBUFS; 10073 10074 if (req->relative_rssi_set) { 10075 struct nl80211_bss_select_rssi_adjust rssi_adjust; 10076 10077 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI, 10078 req->relative_rssi)) 10079 return -ENOBUFS; 10080 10081 rssi_adjust.band = req->rssi_adjust.band; 10082 rssi_adjust.delta = req->rssi_adjust.delta; 10083 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST, 10084 sizeof(rssi_adjust), &rssi_adjust)) 10085 return -ENOBUFS; 10086 } 10087 10088 freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES); 10089 if (!freqs) 10090 return -ENOBUFS; 10091 10092 for (i = 0; i < req->n_channels; i++) { 10093 if (nla_put_u32(msg, i, req->channels[i]->center_freq)) 10094 return -ENOBUFS; 10095 } 10096 10097 nla_nest_end(msg, freqs); 10098 10099 if (req->n_match_sets) { 10100 matches = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH); 10101 if (!matches) 10102 return -ENOBUFS; 10103 10104 for (i = 0; i < req->n_match_sets; i++) { 10105 match = nla_nest_start(msg, i); 10106 if (!match) 10107 return -ENOBUFS; 10108 10109 if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID, 10110 req->match_sets[i].ssid.ssid_len, 10111 req->match_sets[i].ssid.ssid)) 10112 return -ENOBUFS; 10113 nla_nest_end(msg, match); 10114 } 10115 nla_nest_end(msg, matches); 10116 } 10117 10118 scan_plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS); 10119 if (!scan_plans) 10120 return -ENOBUFS; 10121 10122 for (i = 0; i < req->n_scan_plans; i++) { 10123 scan_plan = nla_nest_start(msg, i + 1); 10124 if (!scan_plan) 10125 return -ENOBUFS; 10126 10127 if (!scan_plan || 10128 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL, 10129 req->scan_plans[i].interval) || 10130 (req->scan_plans[i].iterations && 10131 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS, 10132 req->scan_plans[i].iterations))) 10133 return -ENOBUFS; 10134 nla_nest_end(msg, scan_plan); 10135 } 10136 nla_nest_end(msg, scan_plans); 10137 10138 nla_nest_end(msg, nd); 10139 10140 return 0; 10141 } 10142 10143 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info) 10144 { 10145 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10146 struct sk_buff *msg; 10147 void *hdr; 10148 u32 size = NLMSG_DEFAULT_SIZE; 10149 10150 if (!rdev->wiphy.wowlan) 10151 return -EOPNOTSUPP; 10152 10153 if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) { 10154 /* adjust size to have room for all the data */ 10155 size += rdev->wiphy.wowlan_config->tcp->tokens_size + 10156 rdev->wiphy.wowlan_config->tcp->payload_len + 10157 rdev->wiphy.wowlan_config->tcp->wake_len + 10158 rdev->wiphy.wowlan_config->tcp->wake_len / 8; 10159 } 10160 10161 msg = nlmsg_new(size, GFP_KERNEL); 10162 if (!msg) 10163 return -ENOMEM; 10164 10165 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 10166 NL80211_CMD_GET_WOWLAN); 10167 if (!hdr) 10168 goto nla_put_failure; 10169 10170 if (rdev->wiphy.wowlan_config) { 10171 struct nlattr *nl_wowlan; 10172 10173 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS); 10174 if (!nl_wowlan) 10175 goto nla_put_failure; 10176 10177 if ((rdev->wiphy.wowlan_config->any && 10178 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) || 10179 (rdev->wiphy.wowlan_config->disconnect && 10180 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) || 10181 (rdev->wiphy.wowlan_config->magic_pkt && 10182 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) || 10183 (rdev->wiphy.wowlan_config->gtk_rekey_failure && 10184 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) || 10185 (rdev->wiphy.wowlan_config->eap_identity_req && 10186 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) || 10187 (rdev->wiphy.wowlan_config->four_way_handshake && 10188 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) || 10189 (rdev->wiphy.wowlan_config->rfkill_release && 10190 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))) 10191 goto nla_put_failure; 10192 10193 if (nl80211_send_wowlan_patterns(msg, rdev)) 10194 goto nla_put_failure; 10195 10196 if (nl80211_send_wowlan_tcp(msg, 10197 rdev->wiphy.wowlan_config->tcp)) 10198 goto nla_put_failure; 10199 10200 if (nl80211_send_wowlan_nd( 10201 msg, 10202 rdev->wiphy.wowlan_config->nd_config)) 10203 goto nla_put_failure; 10204 10205 nla_nest_end(msg, nl_wowlan); 10206 } 10207 10208 genlmsg_end(msg, hdr); 10209 return genlmsg_reply(msg, info); 10210 10211 nla_put_failure: 10212 nlmsg_free(msg); 10213 return -ENOBUFS; 10214 } 10215 10216 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev, 10217 struct nlattr *attr, 10218 struct cfg80211_wowlan *trig) 10219 { 10220 struct nlattr *tb[NUM_NL80211_WOWLAN_TCP]; 10221 struct cfg80211_wowlan_tcp *cfg; 10222 struct nl80211_wowlan_tcp_data_token *tok = NULL; 10223 struct nl80211_wowlan_tcp_data_seq *seq = NULL; 10224 u32 size; 10225 u32 data_size, wake_size, tokens_size = 0, wake_mask_size; 10226 int err, port; 10227 10228 if (!rdev->wiphy.wowlan->tcp) 10229 return -EINVAL; 10230 10231 err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TCP, attr, 10232 nl80211_wowlan_tcp_policy, NULL); 10233 if (err) 10234 return err; 10235 10236 if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] || 10237 !tb[NL80211_WOWLAN_TCP_DST_IPV4] || 10238 !tb[NL80211_WOWLAN_TCP_DST_MAC] || 10239 !tb[NL80211_WOWLAN_TCP_DST_PORT] || 10240 !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] || 10241 !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] || 10242 !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] || 10243 !tb[NL80211_WOWLAN_TCP_WAKE_MASK]) 10244 return -EINVAL; 10245 10246 data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]); 10247 if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max) 10248 return -EINVAL; 10249 10250 if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) > 10251 rdev->wiphy.wowlan->tcp->data_interval_max || 10252 nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0) 10253 return -EINVAL; 10254 10255 wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]); 10256 if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max) 10257 return -EINVAL; 10258 10259 wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]); 10260 if (wake_mask_size != DIV_ROUND_UP(wake_size, 8)) 10261 return -EINVAL; 10262 10263 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) { 10264 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]); 10265 10266 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]); 10267 tokens_size = tokln - sizeof(*tok); 10268 10269 if (!tok->len || tokens_size % tok->len) 10270 return -EINVAL; 10271 if (!rdev->wiphy.wowlan->tcp->tok) 10272 return -EINVAL; 10273 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len) 10274 return -EINVAL; 10275 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len) 10276 return -EINVAL; 10277 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize) 10278 return -EINVAL; 10279 if (tok->offset + tok->len > data_size) 10280 return -EINVAL; 10281 } 10282 10283 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) { 10284 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]); 10285 if (!rdev->wiphy.wowlan->tcp->seq) 10286 return -EINVAL; 10287 if (seq->len == 0 || seq->len > 4) 10288 return -EINVAL; 10289 if (seq->len + seq->offset > data_size) 10290 return -EINVAL; 10291 } 10292 10293 size = sizeof(*cfg); 10294 size += data_size; 10295 size += wake_size + wake_mask_size; 10296 size += tokens_size; 10297 10298 cfg = kzalloc(size, GFP_KERNEL); 10299 if (!cfg) 10300 return -ENOMEM; 10301 cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]); 10302 cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]); 10303 memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]), 10304 ETH_ALEN); 10305 if (tb[NL80211_WOWLAN_TCP_SRC_PORT]) 10306 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]); 10307 else 10308 port = 0; 10309 #ifdef CONFIG_INET 10310 /* allocate a socket and port for it and use it */ 10311 err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM, 10312 IPPROTO_TCP, &cfg->sock, 1); 10313 if (err) { 10314 kfree(cfg); 10315 return err; 10316 } 10317 if (inet_csk_get_port(cfg->sock->sk, port)) { 10318 sock_release(cfg->sock); 10319 kfree(cfg); 10320 return -EADDRINUSE; 10321 } 10322 cfg->src_port = inet_sk(cfg->sock->sk)->inet_num; 10323 #else 10324 if (!port) { 10325 kfree(cfg); 10326 return -EINVAL; 10327 } 10328 cfg->src_port = port; 10329 #endif 10330 10331 cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]); 10332 cfg->payload_len = data_size; 10333 cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size; 10334 memcpy((void *)cfg->payload, 10335 nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]), 10336 data_size); 10337 if (seq) 10338 cfg->payload_seq = *seq; 10339 cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]); 10340 cfg->wake_len = wake_size; 10341 cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size; 10342 memcpy((void *)cfg->wake_data, 10343 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]), 10344 wake_size); 10345 cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size + 10346 data_size + wake_size; 10347 memcpy((void *)cfg->wake_mask, 10348 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]), 10349 wake_mask_size); 10350 if (tok) { 10351 cfg->tokens_size = tokens_size; 10352 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size); 10353 } 10354 10355 trig->tcp = cfg; 10356 10357 return 0; 10358 } 10359 10360 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev, 10361 const struct wiphy_wowlan_support *wowlan, 10362 struct nlattr *attr, 10363 struct cfg80211_wowlan *trig) 10364 { 10365 struct nlattr **tb; 10366 int err; 10367 10368 tb = kzalloc(NUM_NL80211_ATTR * sizeof(*tb), GFP_KERNEL); 10369 if (!tb) 10370 return -ENOMEM; 10371 10372 if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) { 10373 err = -EOPNOTSUPP; 10374 goto out; 10375 } 10376 10377 err = nla_parse_nested(tb, NL80211_ATTR_MAX, attr, nl80211_policy, 10378 NULL); 10379 if (err) 10380 goto out; 10381 10382 trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb, 10383 wowlan->max_nd_match_sets); 10384 err = PTR_ERR_OR_ZERO(trig->nd_config); 10385 if (err) 10386 trig->nd_config = NULL; 10387 10388 out: 10389 kfree(tb); 10390 return err; 10391 } 10392 10393 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info) 10394 { 10395 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10396 struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG]; 10397 struct cfg80211_wowlan new_triggers = {}; 10398 struct cfg80211_wowlan *ntrig; 10399 const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan; 10400 int err, i; 10401 bool prev_enabled = rdev->wiphy.wowlan_config; 10402 bool regular = false; 10403 10404 if (!wowlan) 10405 return -EOPNOTSUPP; 10406 10407 if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) { 10408 cfg80211_rdev_free_wowlan(rdev); 10409 rdev->wiphy.wowlan_config = NULL; 10410 goto set_wakeup; 10411 } 10412 10413 err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TRIG, 10414 info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS], 10415 nl80211_wowlan_policy, info->extack); 10416 if (err) 10417 return err; 10418 10419 if (tb[NL80211_WOWLAN_TRIG_ANY]) { 10420 if (!(wowlan->flags & WIPHY_WOWLAN_ANY)) 10421 return -EINVAL; 10422 new_triggers.any = true; 10423 } 10424 10425 if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) { 10426 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT)) 10427 return -EINVAL; 10428 new_triggers.disconnect = true; 10429 regular = true; 10430 } 10431 10432 if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) { 10433 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT)) 10434 return -EINVAL; 10435 new_triggers.magic_pkt = true; 10436 regular = true; 10437 } 10438 10439 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED]) 10440 return -EINVAL; 10441 10442 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) { 10443 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE)) 10444 return -EINVAL; 10445 new_triggers.gtk_rekey_failure = true; 10446 regular = true; 10447 } 10448 10449 if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) { 10450 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ)) 10451 return -EINVAL; 10452 new_triggers.eap_identity_req = true; 10453 regular = true; 10454 } 10455 10456 if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) { 10457 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE)) 10458 return -EINVAL; 10459 new_triggers.four_way_handshake = true; 10460 regular = true; 10461 } 10462 10463 if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) { 10464 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE)) 10465 return -EINVAL; 10466 new_triggers.rfkill_release = true; 10467 regular = true; 10468 } 10469 10470 if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) { 10471 struct nlattr *pat; 10472 int n_patterns = 0; 10473 int rem, pat_len, mask_len, pkt_offset; 10474 struct nlattr *pat_tb[NUM_NL80211_PKTPAT]; 10475 10476 regular = true; 10477 10478 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN], 10479 rem) 10480 n_patterns++; 10481 if (n_patterns > wowlan->n_patterns) 10482 return -EINVAL; 10483 10484 new_triggers.patterns = kcalloc(n_patterns, 10485 sizeof(new_triggers.patterns[0]), 10486 GFP_KERNEL); 10487 if (!new_triggers.patterns) 10488 return -ENOMEM; 10489 10490 new_triggers.n_patterns = n_patterns; 10491 i = 0; 10492 10493 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN], 10494 rem) { 10495 u8 *mask_pat; 10496 10497 nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat, 10498 NULL, info->extack); 10499 err = -EINVAL; 10500 if (!pat_tb[NL80211_PKTPAT_MASK] || 10501 !pat_tb[NL80211_PKTPAT_PATTERN]) 10502 goto error; 10503 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]); 10504 mask_len = DIV_ROUND_UP(pat_len, 8); 10505 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len) 10506 goto error; 10507 if (pat_len > wowlan->pattern_max_len || 10508 pat_len < wowlan->pattern_min_len) 10509 goto error; 10510 10511 if (!pat_tb[NL80211_PKTPAT_OFFSET]) 10512 pkt_offset = 0; 10513 else 10514 pkt_offset = nla_get_u32( 10515 pat_tb[NL80211_PKTPAT_OFFSET]); 10516 if (pkt_offset > wowlan->max_pkt_offset) 10517 goto error; 10518 new_triggers.patterns[i].pkt_offset = pkt_offset; 10519 10520 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL); 10521 if (!mask_pat) { 10522 err = -ENOMEM; 10523 goto error; 10524 } 10525 new_triggers.patterns[i].mask = mask_pat; 10526 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]), 10527 mask_len); 10528 mask_pat += mask_len; 10529 new_triggers.patterns[i].pattern = mask_pat; 10530 new_triggers.patterns[i].pattern_len = pat_len; 10531 memcpy(mask_pat, 10532 nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), 10533 pat_len); 10534 i++; 10535 } 10536 } 10537 10538 if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) { 10539 regular = true; 10540 err = nl80211_parse_wowlan_tcp( 10541 rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION], 10542 &new_triggers); 10543 if (err) 10544 goto error; 10545 } 10546 10547 if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) { 10548 regular = true; 10549 err = nl80211_parse_wowlan_nd( 10550 rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT], 10551 &new_triggers); 10552 if (err) 10553 goto error; 10554 } 10555 10556 /* The 'any' trigger means the device continues operating more or less 10557 * as in its normal operation mode and wakes up the host on most of the 10558 * normal interrupts (like packet RX, ...) 10559 * It therefore makes little sense to combine with the more constrained 10560 * wakeup trigger modes. 10561 */ 10562 if (new_triggers.any && regular) { 10563 err = -EINVAL; 10564 goto error; 10565 } 10566 10567 ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL); 10568 if (!ntrig) { 10569 err = -ENOMEM; 10570 goto error; 10571 } 10572 cfg80211_rdev_free_wowlan(rdev); 10573 rdev->wiphy.wowlan_config = ntrig; 10574 10575 set_wakeup: 10576 if (rdev->ops->set_wakeup && 10577 prev_enabled != !!rdev->wiphy.wowlan_config) 10578 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config); 10579 10580 return 0; 10581 error: 10582 for (i = 0; i < new_triggers.n_patterns; i++) 10583 kfree(new_triggers.patterns[i].mask); 10584 kfree(new_triggers.patterns); 10585 if (new_triggers.tcp && new_triggers.tcp->sock) 10586 sock_release(new_triggers.tcp->sock); 10587 kfree(new_triggers.tcp); 10588 kfree(new_triggers.nd_config); 10589 return err; 10590 } 10591 #endif 10592 10593 static int nl80211_send_coalesce_rules(struct sk_buff *msg, 10594 struct cfg80211_registered_device *rdev) 10595 { 10596 struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules; 10597 int i, j, pat_len; 10598 struct cfg80211_coalesce_rules *rule; 10599 10600 if (!rdev->coalesce->n_rules) 10601 return 0; 10602 10603 nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE); 10604 if (!nl_rules) 10605 return -ENOBUFS; 10606 10607 for (i = 0; i < rdev->coalesce->n_rules; i++) { 10608 nl_rule = nla_nest_start(msg, i + 1); 10609 if (!nl_rule) 10610 return -ENOBUFS; 10611 10612 rule = &rdev->coalesce->rules[i]; 10613 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY, 10614 rule->delay)) 10615 return -ENOBUFS; 10616 10617 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION, 10618 rule->condition)) 10619 return -ENOBUFS; 10620 10621 nl_pats = nla_nest_start(msg, 10622 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN); 10623 if (!nl_pats) 10624 return -ENOBUFS; 10625 10626 for (j = 0; j < rule->n_patterns; j++) { 10627 nl_pat = nla_nest_start(msg, j + 1); 10628 if (!nl_pat) 10629 return -ENOBUFS; 10630 pat_len = rule->patterns[j].pattern_len; 10631 if (nla_put(msg, NL80211_PKTPAT_MASK, 10632 DIV_ROUND_UP(pat_len, 8), 10633 rule->patterns[j].mask) || 10634 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len, 10635 rule->patterns[j].pattern) || 10636 nla_put_u32(msg, NL80211_PKTPAT_OFFSET, 10637 rule->patterns[j].pkt_offset)) 10638 return -ENOBUFS; 10639 nla_nest_end(msg, nl_pat); 10640 } 10641 nla_nest_end(msg, nl_pats); 10642 nla_nest_end(msg, nl_rule); 10643 } 10644 nla_nest_end(msg, nl_rules); 10645 10646 return 0; 10647 } 10648 10649 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info) 10650 { 10651 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10652 struct sk_buff *msg; 10653 void *hdr; 10654 10655 if (!rdev->wiphy.coalesce) 10656 return -EOPNOTSUPP; 10657 10658 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 10659 if (!msg) 10660 return -ENOMEM; 10661 10662 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 10663 NL80211_CMD_GET_COALESCE); 10664 if (!hdr) 10665 goto nla_put_failure; 10666 10667 if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev)) 10668 goto nla_put_failure; 10669 10670 genlmsg_end(msg, hdr); 10671 return genlmsg_reply(msg, info); 10672 10673 nla_put_failure: 10674 nlmsg_free(msg); 10675 return -ENOBUFS; 10676 } 10677 10678 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev) 10679 { 10680 struct cfg80211_coalesce *coalesce = rdev->coalesce; 10681 int i, j; 10682 struct cfg80211_coalesce_rules *rule; 10683 10684 if (!coalesce) 10685 return; 10686 10687 for (i = 0; i < coalesce->n_rules; i++) { 10688 rule = &coalesce->rules[i]; 10689 for (j = 0; j < rule->n_patterns; j++) 10690 kfree(rule->patterns[j].mask); 10691 kfree(rule->patterns); 10692 } 10693 kfree(coalesce->rules); 10694 kfree(coalesce); 10695 rdev->coalesce = NULL; 10696 } 10697 10698 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev, 10699 struct nlattr *rule, 10700 struct cfg80211_coalesce_rules *new_rule) 10701 { 10702 int err, i; 10703 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce; 10704 struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat; 10705 int rem, pat_len, mask_len, pkt_offset, n_patterns = 0; 10706 struct nlattr *pat_tb[NUM_NL80211_PKTPAT]; 10707 10708 err = nla_parse_nested(tb, NL80211_ATTR_COALESCE_RULE_MAX, rule, 10709 nl80211_coalesce_policy, NULL); 10710 if (err) 10711 return err; 10712 10713 if (tb[NL80211_ATTR_COALESCE_RULE_DELAY]) 10714 new_rule->delay = 10715 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]); 10716 if (new_rule->delay > coalesce->max_delay) 10717 return -EINVAL; 10718 10719 if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION]) 10720 new_rule->condition = 10721 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]); 10722 if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH && 10723 new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH) 10724 return -EINVAL; 10725 10726 if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN]) 10727 return -EINVAL; 10728 10729 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN], 10730 rem) 10731 n_patterns++; 10732 if (n_patterns > coalesce->n_patterns) 10733 return -EINVAL; 10734 10735 new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]), 10736 GFP_KERNEL); 10737 if (!new_rule->patterns) 10738 return -ENOMEM; 10739 10740 new_rule->n_patterns = n_patterns; 10741 i = 0; 10742 10743 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN], 10744 rem) { 10745 u8 *mask_pat; 10746 10747 nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat, NULL, NULL); 10748 if (!pat_tb[NL80211_PKTPAT_MASK] || 10749 !pat_tb[NL80211_PKTPAT_PATTERN]) 10750 return -EINVAL; 10751 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]); 10752 mask_len = DIV_ROUND_UP(pat_len, 8); 10753 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len) 10754 return -EINVAL; 10755 if (pat_len > coalesce->pattern_max_len || 10756 pat_len < coalesce->pattern_min_len) 10757 return -EINVAL; 10758 10759 if (!pat_tb[NL80211_PKTPAT_OFFSET]) 10760 pkt_offset = 0; 10761 else 10762 pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]); 10763 if (pkt_offset > coalesce->max_pkt_offset) 10764 return -EINVAL; 10765 new_rule->patterns[i].pkt_offset = pkt_offset; 10766 10767 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL); 10768 if (!mask_pat) 10769 return -ENOMEM; 10770 10771 new_rule->patterns[i].mask = mask_pat; 10772 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]), 10773 mask_len); 10774 10775 mask_pat += mask_len; 10776 new_rule->patterns[i].pattern = mask_pat; 10777 new_rule->patterns[i].pattern_len = pat_len; 10778 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), 10779 pat_len); 10780 i++; 10781 } 10782 10783 return 0; 10784 } 10785 10786 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info) 10787 { 10788 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10789 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce; 10790 struct cfg80211_coalesce new_coalesce = {}; 10791 struct cfg80211_coalesce *n_coalesce; 10792 int err, rem_rule, n_rules = 0, i, j; 10793 struct nlattr *rule; 10794 struct cfg80211_coalesce_rules *tmp_rule; 10795 10796 if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce) 10797 return -EOPNOTSUPP; 10798 10799 if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) { 10800 cfg80211_rdev_free_coalesce(rdev); 10801 rdev_set_coalesce(rdev, NULL); 10802 return 0; 10803 } 10804 10805 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE], 10806 rem_rule) 10807 n_rules++; 10808 if (n_rules > coalesce->n_rules) 10809 return -EINVAL; 10810 10811 new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]), 10812 GFP_KERNEL); 10813 if (!new_coalesce.rules) 10814 return -ENOMEM; 10815 10816 new_coalesce.n_rules = n_rules; 10817 i = 0; 10818 10819 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE], 10820 rem_rule) { 10821 err = nl80211_parse_coalesce_rule(rdev, rule, 10822 &new_coalesce.rules[i]); 10823 if (err) 10824 goto error; 10825 10826 i++; 10827 } 10828 10829 err = rdev_set_coalesce(rdev, &new_coalesce); 10830 if (err) 10831 goto error; 10832 10833 n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL); 10834 if (!n_coalesce) { 10835 err = -ENOMEM; 10836 goto error; 10837 } 10838 cfg80211_rdev_free_coalesce(rdev); 10839 rdev->coalesce = n_coalesce; 10840 10841 return 0; 10842 error: 10843 for (i = 0; i < new_coalesce.n_rules; i++) { 10844 tmp_rule = &new_coalesce.rules[i]; 10845 for (j = 0; j < tmp_rule->n_patterns; j++) 10846 kfree(tmp_rule->patterns[j].mask); 10847 kfree(tmp_rule->patterns); 10848 } 10849 kfree(new_coalesce.rules); 10850 10851 return err; 10852 } 10853 10854 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info) 10855 { 10856 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10857 struct net_device *dev = info->user_ptr[1]; 10858 struct wireless_dev *wdev = dev->ieee80211_ptr; 10859 struct nlattr *tb[NUM_NL80211_REKEY_DATA]; 10860 struct cfg80211_gtk_rekey_data rekey_data; 10861 int err; 10862 10863 if (!info->attrs[NL80211_ATTR_REKEY_DATA]) 10864 return -EINVAL; 10865 10866 err = nla_parse_nested(tb, MAX_NL80211_REKEY_DATA, 10867 info->attrs[NL80211_ATTR_REKEY_DATA], 10868 nl80211_rekey_policy, info->extack); 10869 if (err) 10870 return err; 10871 10872 if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN) 10873 return -ERANGE; 10874 if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN) 10875 return -ERANGE; 10876 if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN) 10877 return -ERANGE; 10878 10879 rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]); 10880 rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]); 10881 rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]); 10882 10883 wdev_lock(wdev); 10884 if (!wdev->current_bss) { 10885 err = -ENOTCONN; 10886 goto out; 10887 } 10888 10889 if (!rdev->ops->set_rekey_data) { 10890 err = -EOPNOTSUPP; 10891 goto out; 10892 } 10893 10894 err = rdev_set_rekey_data(rdev, dev, &rekey_data); 10895 out: 10896 wdev_unlock(wdev); 10897 return err; 10898 } 10899 10900 static int nl80211_register_unexpected_frame(struct sk_buff *skb, 10901 struct genl_info *info) 10902 { 10903 struct net_device *dev = info->user_ptr[1]; 10904 struct wireless_dev *wdev = dev->ieee80211_ptr; 10905 10906 if (wdev->iftype != NL80211_IFTYPE_AP && 10907 wdev->iftype != NL80211_IFTYPE_P2P_GO) 10908 return -EINVAL; 10909 10910 if (wdev->ap_unexpected_nlportid) 10911 return -EBUSY; 10912 10913 wdev->ap_unexpected_nlportid = info->snd_portid; 10914 return 0; 10915 } 10916 10917 static int nl80211_probe_client(struct sk_buff *skb, 10918 struct genl_info *info) 10919 { 10920 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10921 struct net_device *dev = info->user_ptr[1]; 10922 struct wireless_dev *wdev = dev->ieee80211_ptr; 10923 struct sk_buff *msg; 10924 void *hdr; 10925 const u8 *addr; 10926 u64 cookie; 10927 int err; 10928 10929 if (wdev->iftype != NL80211_IFTYPE_AP && 10930 wdev->iftype != NL80211_IFTYPE_P2P_GO) 10931 return -EOPNOTSUPP; 10932 10933 if (!info->attrs[NL80211_ATTR_MAC]) 10934 return -EINVAL; 10935 10936 if (!rdev->ops->probe_client) 10937 return -EOPNOTSUPP; 10938 10939 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 10940 if (!msg) 10941 return -ENOMEM; 10942 10943 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 10944 NL80211_CMD_PROBE_CLIENT); 10945 if (!hdr) { 10946 err = -ENOBUFS; 10947 goto free_msg; 10948 } 10949 10950 addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 10951 10952 err = rdev_probe_client(rdev, dev, addr, &cookie); 10953 if (err) 10954 goto free_msg; 10955 10956 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 10957 NL80211_ATTR_PAD)) 10958 goto nla_put_failure; 10959 10960 genlmsg_end(msg, hdr); 10961 10962 return genlmsg_reply(msg, info); 10963 10964 nla_put_failure: 10965 err = -ENOBUFS; 10966 free_msg: 10967 nlmsg_free(msg); 10968 return err; 10969 } 10970 10971 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info) 10972 { 10973 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 10974 struct cfg80211_beacon_registration *reg, *nreg; 10975 int rv; 10976 10977 if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS)) 10978 return -EOPNOTSUPP; 10979 10980 nreg = kzalloc(sizeof(*nreg), GFP_KERNEL); 10981 if (!nreg) 10982 return -ENOMEM; 10983 10984 /* First, check if already registered. */ 10985 spin_lock_bh(&rdev->beacon_registrations_lock); 10986 list_for_each_entry(reg, &rdev->beacon_registrations, list) { 10987 if (reg->nlportid == info->snd_portid) { 10988 rv = -EALREADY; 10989 goto out_err; 10990 } 10991 } 10992 /* Add it to the list */ 10993 nreg->nlportid = info->snd_portid; 10994 list_add(&nreg->list, &rdev->beacon_registrations); 10995 10996 spin_unlock_bh(&rdev->beacon_registrations_lock); 10997 10998 return 0; 10999 out_err: 11000 spin_unlock_bh(&rdev->beacon_registrations_lock); 11001 kfree(nreg); 11002 return rv; 11003 } 11004 11005 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info) 11006 { 11007 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11008 struct wireless_dev *wdev = info->user_ptr[1]; 11009 int err; 11010 11011 if (!rdev->ops->start_p2p_device) 11012 return -EOPNOTSUPP; 11013 11014 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE) 11015 return -EOPNOTSUPP; 11016 11017 if (wdev_running(wdev)) 11018 return 0; 11019 11020 if (rfkill_blocked(rdev->rfkill)) 11021 return -ERFKILL; 11022 11023 err = rdev_start_p2p_device(rdev, wdev); 11024 if (err) 11025 return err; 11026 11027 wdev->is_running = true; 11028 rdev->opencount++; 11029 11030 return 0; 11031 } 11032 11033 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info) 11034 { 11035 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11036 struct wireless_dev *wdev = info->user_ptr[1]; 11037 11038 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE) 11039 return -EOPNOTSUPP; 11040 11041 if (!rdev->ops->stop_p2p_device) 11042 return -EOPNOTSUPP; 11043 11044 cfg80211_stop_p2p_device(rdev, wdev); 11045 11046 return 0; 11047 } 11048 11049 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info) 11050 { 11051 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11052 struct wireless_dev *wdev = info->user_ptr[1]; 11053 struct cfg80211_nan_conf conf = {}; 11054 int err; 11055 11056 if (wdev->iftype != NL80211_IFTYPE_NAN) 11057 return -EOPNOTSUPP; 11058 11059 if (wdev_running(wdev)) 11060 return -EEXIST; 11061 11062 if (rfkill_blocked(rdev->rfkill)) 11063 return -ERFKILL; 11064 11065 if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) 11066 return -EINVAL; 11067 11068 conf.master_pref = 11069 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]); 11070 if (!conf.master_pref) 11071 return -EINVAL; 11072 11073 if (info->attrs[NL80211_ATTR_BANDS]) { 11074 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]); 11075 11076 if (bands & ~(u32)wdev->wiphy->nan_supported_bands) 11077 return -EOPNOTSUPP; 11078 11079 if (bands && !(bands & BIT(NL80211_BAND_2GHZ))) 11080 return -EINVAL; 11081 11082 conf.bands = bands; 11083 } 11084 11085 err = rdev_start_nan(rdev, wdev, &conf); 11086 if (err) 11087 return err; 11088 11089 wdev->is_running = true; 11090 rdev->opencount++; 11091 11092 return 0; 11093 } 11094 11095 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info) 11096 { 11097 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11098 struct wireless_dev *wdev = info->user_ptr[1]; 11099 11100 if (wdev->iftype != NL80211_IFTYPE_NAN) 11101 return -EOPNOTSUPP; 11102 11103 cfg80211_stop_nan(rdev, wdev); 11104 11105 return 0; 11106 } 11107 11108 static int validate_nan_filter(struct nlattr *filter_attr) 11109 { 11110 struct nlattr *attr; 11111 int len = 0, n_entries = 0, rem; 11112 11113 nla_for_each_nested(attr, filter_attr, rem) { 11114 len += nla_len(attr); 11115 n_entries++; 11116 } 11117 11118 if (len >= U8_MAX) 11119 return -EINVAL; 11120 11121 return n_entries; 11122 } 11123 11124 static int handle_nan_filter(struct nlattr *attr_filter, 11125 struct cfg80211_nan_func *func, 11126 bool tx) 11127 { 11128 struct nlattr *attr; 11129 int n_entries, rem, i; 11130 struct cfg80211_nan_func_filter *filter; 11131 11132 n_entries = validate_nan_filter(attr_filter); 11133 if (n_entries < 0) 11134 return n_entries; 11135 11136 BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters)); 11137 11138 filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL); 11139 if (!filter) 11140 return -ENOMEM; 11141 11142 i = 0; 11143 nla_for_each_nested(attr, attr_filter, rem) { 11144 filter[i].filter = nla_memdup(attr, GFP_KERNEL); 11145 filter[i].len = nla_len(attr); 11146 i++; 11147 } 11148 if (tx) { 11149 func->num_tx_filters = n_entries; 11150 func->tx_filters = filter; 11151 } else { 11152 func->num_rx_filters = n_entries; 11153 func->rx_filters = filter; 11154 } 11155 11156 return 0; 11157 } 11158 11159 static int nl80211_nan_add_func(struct sk_buff *skb, 11160 struct genl_info *info) 11161 { 11162 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11163 struct wireless_dev *wdev = info->user_ptr[1]; 11164 struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr; 11165 struct cfg80211_nan_func *func; 11166 struct sk_buff *msg = NULL; 11167 void *hdr = NULL; 11168 int err = 0; 11169 11170 if (wdev->iftype != NL80211_IFTYPE_NAN) 11171 return -EOPNOTSUPP; 11172 11173 if (!wdev_running(wdev)) 11174 return -ENOTCONN; 11175 11176 if (!info->attrs[NL80211_ATTR_NAN_FUNC]) 11177 return -EINVAL; 11178 11179 if (wdev->owner_nlportid && 11180 wdev->owner_nlportid != info->snd_portid) 11181 return -ENOTCONN; 11182 11183 err = nla_parse_nested(tb, NL80211_NAN_FUNC_ATTR_MAX, 11184 info->attrs[NL80211_ATTR_NAN_FUNC], 11185 nl80211_nan_func_policy, info->extack); 11186 if (err) 11187 return err; 11188 11189 func = kzalloc(sizeof(*func), GFP_KERNEL); 11190 if (!func) 11191 return -ENOMEM; 11192 11193 func->cookie = wdev->wiphy->cookie_counter++; 11194 11195 if (!tb[NL80211_NAN_FUNC_TYPE] || 11196 nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]) > NL80211_NAN_FUNC_MAX_TYPE) { 11197 err = -EINVAL; 11198 goto out; 11199 } 11200 11201 11202 func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]); 11203 11204 if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) { 11205 err = -EINVAL; 11206 goto out; 11207 } 11208 11209 memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]), 11210 sizeof(func->service_id)); 11211 11212 func->close_range = 11213 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]); 11214 11215 if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) { 11216 func->serv_spec_info_len = 11217 nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]); 11218 func->serv_spec_info = 11219 kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]), 11220 func->serv_spec_info_len, 11221 GFP_KERNEL); 11222 if (!func->serv_spec_info) { 11223 err = -ENOMEM; 11224 goto out; 11225 } 11226 } 11227 11228 if (tb[NL80211_NAN_FUNC_TTL]) 11229 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]); 11230 11231 switch (func->type) { 11232 case NL80211_NAN_FUNC_PUBLISH: 11233 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) { 11234 err = -EINVAL; 11235 goto out; 11236 } 11237 11238 func->publish_type = 11239 nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]); 11240 func->publish_bcast = 11241 nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]); 11242 11243 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) && 11244 func->publish_bcast) { 11245 err = -EINVAL; 11246 goto out; 11247 } 11248 break; 11249 case NL80211_NAN_FUNC_SUBSCRIBE: 11250 func->subscribe_active = 11251 nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]); 11252 break; 11253 case NL80211_NAN_FUNC_FOLLOW_UP: 11254 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] || 11255 !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]) { 11256 err = -EINVAL; 11257 goto out; 11258 } 11259 11260 func->followup_id = 11261 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]); 11262 func->followup_reqid = 11263 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]); 11264 memcpy(func->followup_dest.addr, 11265 nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]), 11266 sizeof(func->followup_dest.addr)); 11267 if (func->ttl) { 11268 err = -EINVAL; 11269 goto out; 11270 } 11271 break; 11272 default: 11273 err = -EINVAL; 11274 goto out; 11275 } 11276 11277 if (tb[NL80211_NAN_FUNC_SRF]) { 11278 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR]; 11279 11280 err = nla_parse_nested(srf_tb, NL80211_NAN_SRF_ATTR_MAX, 11281 tb[NL80211_NAN_FUNC_SRF], 11282 nl80211_nan_srf_policy, info->extack); 11283 if (err) 11284 goto out; 11285 11286 func->srf_include = 11287 nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]); 11288 11289 if (srf_tb[NL80211_NAN_SRF_BF]) { 11290 if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] || 11291 !srf_tb[NL80211_NAN_SRF_BF_IDX]) { 11292 err = -EINVAL; 11293 goto out; 11294 } 11295 11296 func->srf_bf_len = 11297 nla_len(srf_tb[NL80211_NAN_SRF_BF]); 11298 func->srf_bf = 11299 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]), 11300 func->srf_bf_len, GFP_KERNEL); 11301 if (!func->srf_bf) { 11302 err = -ENOMEM; 11303 goto out; 11304 } 11305 11306 func->srf_bf_idx = 11307 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]); 11308 } else { 11309 struct nlattr *attr, *mac_attr = 11310 srf_tb[NL80211_NAN_SRF_MAC_ADDRS]; 11311 int n_entries, rem, i = 0; 11312 11313 if (!mac_attr) { 11314 err = -EINVAL; 11315 goto out; 11316 } 11317 11318 n_entries = validate_acl_mac_addrs(mac_attr); 11319 if (n_entries <= 0) { 11320 err = -EINVAL; 11321 goto out; 11322 } 11323 11324 func->srf_num_macs = n_entries; 11325 func->srf_macs = 11326 kzalloc(sizeof(*func->srf_macs) * n_entries, 11327 GFP_KERNEL); 11328 if (!func->srf_macs) { 11329 err = -ENOMEM; 11330 goto out; 11331 } 11332 11333 nla_for_each_nested(attr, mac_attr, rem) 11334 memcpy(func->srf_macs[i++].addr, nla_data(attr), 11335 sizeof(*func->srf_macs)); 11336 } 11337 } 11338 11339 if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) { 11340 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER], 11341 func, true); 11342 if (err) 11343 goto out; 11344 } 11345 11346 if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) { 11347 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER], 11348 func, false); 11349 if (err) 11350 goto out; 11351 } 11352 11353 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 11354 if (!msg) { 11355 err = -ENOMEM; 11356 goto out; 11357 } 11358 11359 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 11360 NL80211_CMD_ADD_NAN_FUNCTION); 11361 /* This can't really happen - we just allocated 4KB */ 11362 if (WARN_ON(!hdr)) { 11363 err = -ENOMEM; 11364 goto out; 11365 } 11366 11367 err = rdev_add_nan_func(rdev, wdev, func); 11368 out: 11369 if (err < 0) { 11370 cfg80211_free_nan_func(func); 11371 nlmsg_free(msg); 11372 return err; 11373 } 11374 11375 /* propagate the instance id and cookie to userspace */ 11376 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie, 11377 NL80211_ATTR_PAD)) 11378 goto nla_put_failure; 11379 11380 func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC); 11381 if (!func_attr) 11382 goto nla_put_failure; 11383 11384 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, 11385 func->instance_id)) 11386 goto nla_put_failure; 11387 11388 nla_nest_end(msg, func_attr); 11389 11390 genlmsg_end(msg, hdr); 11391 return genlmsg_reply(msg, info); 11392 11393 nla_put_failure: 11394 nlmsg_free(msg); 11395 return -ENOBUFS; 11396 } 11397 11398 static int nl80211_nan_del_func(struct sk_buff *skb, 11399 struct genl_info *info) 11400 { 11401 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11402 struct wireless_dev *wdev = info->user_ptr[1]; 11403 u64 cookie; 11404 11405 if (wdev->iftype != NL80211_IFTYPE_NAN) 11406 return -EOPNOTSUPP; 11407 11408 if (!wdev_running(wdev)) 11409 return -ENOTCONN; 11410 11411 if (!info->attrs[NL80211_ATTR_COOKIE]) 11412 return -EINVAL; 11413 11414 if (wdev->owner_nlportid && 11415 wdev->owner_nlportid != info->snd_portid) 11416 return -ENOTCONN; 11417 11418 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]); 11419 11420 rdev_del_nan_func(rdev, wdev, cookie); 11421 11422 return 0; 11423 } 11424 11425 static int nl80211_nan_change_config(struct sk_buff *skb, 11426 struct genl_info *info) 11427 { 11428 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11429 struct wireless_dev *wdev = info->user_ptr[1]; 11430 struct cfg80211_nan_conf conf = {}; 11431 u32 changed = 0; 11432 11433 if (wdev->iftype != NL80211_IFTYPE_NAN) 11434 return -EOPNOTSUPP; 11435 11436 if (!wdev_running(wdev)) 11437 return -ENOTCONN; 11438 11439 if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) { 11440 conf.master_pref = 11441 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]); 11442 if (conf.master_pref <= 1 || conf.master_pref == 255) 11443 return -EINVAL; 11444 11445 changed |= CFG80211_NAN_CONF_CHANGED_PREF; 11446 } 11447 11448 if (info->attrs[NL80211_ATTR_BANDS]) { 11449 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]); 11450 11451 if (bands & ~(u32)wdev->wiphy->nan_supported_bands) 11452 return -EOPNOTSUPP; 11453 11454 if (bands && !(bands & BIT(NL80211_BAND_2GHZ))) 11455 return -EINVAL; 11456 11457 conf.bands = bands; 11458 changed |= CFG80211_NAN_CONF_CHANGED_BANDS; 11459 } 11460 11461 if (!changed) 11462 return -EINVAL; 11463 11464 return rdev_nan_change_conf(rdev, wdev, &conf, changed); 11465 } 11466 11467 void cfg80211_nan_match(struct wireless_dev *wdev, 11468 struct cfg80211_nan_match_params *match, gfp_t gfp) 11469 { 11470 struct wiphy *wiphy = wdev->wiphy; 11471 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 11472 struct nlattr *match_attr, *local_func_attr, *peer_func_attr; 11473 struct sk_buff *msg; 11474 void *hdr; 11475 11476 if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr)) 11477 return; 11478 11479 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 11480 if (!msg) 11481 return; 11482 11483 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH); 11484 if (!hdr) { 11485 nlmsg_free(msg); 11486 return; 11487 } 11488 11489 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 11490 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 11491 wdev->netdev->ifindex)) || 11492 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 11493 NL80211_ATTR_PAD)) 11494 goto nla_put_failure; 11495 11496 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie, 11497 NL80211_ATTR_PAD) || 11498 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr)) 11499 goto nla_put_failure; 11500 11501 match_attr = nla_nest_start(msg, NL80211_ATTR_NAN_MATCH); 11502 if (!match_attr) 11503 goto nla_put_failure; 11504 11505 local_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_LOCAL); 11506 if (!local_func_attr) 11507 goto nla_put_failure; 11508 11509 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id)) 11510 goto nla_put_failure; 11511 11512 nla_nest_end(msg, local_func_attr); 11513 11514 peer_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_PEER); 11515 if (!peer_func_attr) 11516 goto nla_put_failure; 11517 11518 if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) || 11519 nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id)) 11520 goto nla_put_failure; 11521 11522 if (match->info && match->info_len && 11523 nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len, 11524 match->info)) 11525 goto nla_put_failure; 11526 11527 nla_nest_end(msg, peer_func_attr); 11528 nla_nest_end(msg, match_attr); 11529 genlmsg_end(msg, hdr); 11530 11531 if (!wdev->owner_nlportid) 11532 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), 11533 msg, 0, NL80211_MCGRP_NAN, gfp); 11534 else 11535 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, 11536 wdev->owner_nlportid); 11537 11538 return; 11539 11540 nla_put_failure: 11541 nlmsg_free(msg); 11542 } 11543 EXPORT_SYMBOL(cfg80211_nan_match); 11544 11545 void cfg80211_nan_func_terminated(struct wireless_dev *wdev, 11546 u8 inst_id, 11547 enum nl80211_nan_func_term_reason reason, 11548 u64 cookie, gfp_t gfp) 11549 { 11550 struct wiphy *wiphy = wdev->wiphy; 11551 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 11552 struct sk_buff *msg; 11553 struct nlattr *func_attr; 11554 void *hdr; 11555 11556 if (WARN_ON(!inst_id)) 11557 return; 11558 11559 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 11560 if (!msg) 11561 return; 11562 11563 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION); 11564 if (!hdr) { 11565 nlmsg_free(msg); 11566 return; 11567 } 11568 11569 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 11570 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 11571 wdev->netdev->ifindex)) || 11572 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 11573 NL80211_ATTR_PAD)) 11574 goto nla_put_failure; 11575 11576 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 11577 NL80211_ATTR_PAD)) 11578 goto nla_put_failure; 11579 11580 func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC); 11581 if (!func_attr) 11582 goto nla_put_failure; 11583 11584 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) || 11585 nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason)) 11586 goto nla_put_failure; 11587 11588 nla_nest_end(msg, func_attr); 11589 genlmsg_end(msg, hdr); 11590 11591 if (!wdev->owner_nlportid) 11592 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), 11593 msg, 0, NL80211_MCGRP_NAN, gfp); 11594 else 11595 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, 11596 wdev->owner_nlportid); 11597 11598 return; 11599 11600 nla_put_failure: 11601 nlmsg_free(msg); 11602 } 11603 EXPORT_SYMBOL(cfg80211_nan_func_terminated); 11604 11605 static int nl80211_get_protocol_features(struct sk_buff *skb, 11606 struct genl_info *info) 11607 { 11608 void *hdr; 11609 struct sk_buff *msg; 11610 11611 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 11612 if (!msg) 11613 return -ENOMEM; 11614 11615 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0, 11616 NL80211_CMD_GET_PROTOCOL_FEATURES); 11617 if (!hdr) 11618 goto nla_put_failure; 11619 11620 if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES, 11621 NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP)) 11622 goto nla_put_failure; 11623 11624 genlmsg_end(msg, hdr); 11625 return genlmsg_reply(msg, info); 11626 11627 nla_put_failure: 11628 kfree_skb(msg); 11629 return -ENOBUFS; 11630 } 11631 11632 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info) 11633 { 11634 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11635 struct cfg80211_update_ft_ies_params ft_params; 11636 struct net_device *dev = info->user_ptr[1]; 11637 11638 if (!rdev->ops->update_ft_ies) 11639 return -EOPNOTSUPP; 11640 11641 if (!info->attrs[NL80211_ATTR_MDID] || 11642 !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE])) 11643 return -EINVAL; 11644 11645 memset(&ft_params, 0, sizeof(ft_params)); 11646 ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]); 11647 ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]); 11648 ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]); 11649 11650 return rdev_update_ft_ies(rdev, dev, &ft_params); 11651 } 11652 11653 static int nl80211_crit_protocol_start(struct sk_buff *skb, 11654 struct genl_info *info) 11655 { 11656 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11657 struct wireless_dev *wdev = info->user_ptr[1]; 11658 enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC; 11659 u16 duration; 11660 int ret; 11661 11662 if (!rdev->ops->crit_proto_start) 11663 return -EOPNOTSUPP; 11664 11665 if (WARN_ON(!rdev->ops->crit_proto_stop)) 11666 return -EINVAL; 11667 11668 if (rdev->crit_proto_nlportid) 11669 return -EBUSY; 11670 11671 /* determine protocol if provided */ 11672 if (info->attrs[NL80211_ATTR_CRIT_PROT_ID]) 11673 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]); 11674 11675 if (proto >= NUM_NL80211_CRIT_PROTO) 11676 return -EINVAL; 11677 11678 /* timeout must be provided */ 11679 if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]) 11680 return -EINVAL; 11681 11682 duration = 11683 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]); 11684 11685 if (duration > NL80211_CRIT_PROTO_MAX_DURATION) 11686 return -ERANGE; 11687 11688 ret = rdev_crit_proto_start(rdev, wdev, proto, duration); 11689 if (!ret) 11690 rdev->crit_proto_nlportid = info->snd_portid; 11691 11692 return ret; 11693 } 11694 11695 static int nl80211_crit_protocol_stop(struct sk_buff *skb, 11696 struct genl_info *info) 11697 { 11698 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11699 struct wireless_dev *wdev = info->user_ptr[1]; 11700 11701 if (!rdev->ops->crit_proto_stop) 11702 return -EOPNOTSUPP; 11703 11704 if (rdev->crit_proto_nlportid) { 11705 rdev->crit_proto_nlportid = 0; 11706 rdev_crit_proto_stop(rdev, wdev); 11707 } 11708 return 0; 11709 } 11710 11711 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info) 11712 { 11713 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11714 struct wireless_dev *wdev = 11715 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs); 11716 int i, err; 11717 u32 vid, subcmd; 11718 11719 if (!rdev->wiphy.vendor_commands) 11720 return -EOPNOTSUPP; 11721 11722 if (IS_ERR(wdev)) { 11723 err = PTR_ERR(wdev); 11724 if (err != -EINVAL) 11725 return err; 11726 wdev = NULL; 11727 } else if (wdev->wiphy != &rdev->wiphy) { 11728 return -EINVAL; 11729 } 11730 11731 if (!info->attrs[NL80211_ATTR_VENDOR_ID] || 11732 !info->attrs[NL80211_ATTR_VENDOR_SUBCMD]) 11733 return -EINVAL; 11734 11735 vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]); 11736 subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]); 11737 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) { 11738 const struct wiphy_vendor_command *vcmd; 11739 void *data = NULL; 11740 int len = 0; 11741 11742 vcmd = &rdev->wiphy.vendor_commands[i]; 11743 11744 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd) 11745 continue; 11746 11747 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV | 11748 WIPHY_VENDOR_CMD_NEED_NETDEV)) { 11749 if (!wdev) 11750 return -EINVAL; 11751 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV && 11752 !wdev->netdev) 11753 return -EINVAL; 11754 11755 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) { 11756 if (!wdev_running(wdev)) 11757 return -ENETDOWN; 11758 } 11759 11760 if (!vcmd->doit) 11761 return -EOPNOTSUPP; 11762 } else { 11763 wdev = NULL; 11764 } 11765 11766 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) { 11767 data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]); 11768 len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]); 11769 } 11770 11771 rdev->cur_cmd_info = info; 11772 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev, 11773 data, len); 11774 rdev->cur_cmd_info = NULL; 11775 return err; 11776 } 11777 11778 return -EOPNOTSUPP; 11779 } 11780 11781 static int nl80211_prepare_vendor_dump(struct sk_buff *skb, 11782 struct netlink_callback *cb, 11783 struct cfg80211_registered_device **rdev, 11784 struct wireless_dev **wdev) 11785 { 11786 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam); 11787 u32 vid, subcmd; 11788 unsigned int i; 11789 int vcmd_idx = -1; 11790 int err; 11791 void *data = NULL; 11792 unsigned int data_len = 0; 11793 11794 if (cb->args[0]) { 11795 /* subtract the 1 again here */ 11796 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1); 11797 struct wireless_dev *tmp; 11798 11799 if (!wiphy) 11800 return -ENODEV; 11801 *rdev = wiphy_to_rdev(wiphy); 11802 *wdev = NULL; 11803 11804 if (cb->args[1]) { 11805 list_for_each_entry(tmp, &wiphy->wdev_list, list) { 11806 if (tmp->identifier == cb->args[1] - 1) { 11807 *wdev = tmp; 11808 break; 11809 } 11810 } 11811 } 11812 11813 /* keep rtnl locked in successful case */ 11814 return 0; 11815 } 11816 11817 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, attrbuf, 11818 nl80211_fam.maxattr, nl80211_policy, NULL); 11819 if (err) 11820 return err; 11821 11822 if (!attrbuf[NL80211_ATTR_VENDOR_ID] || 11823 !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) 11824 return -EINVAL; 11825 11826 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk), attrbuf); 11827 if (IS_ERR(*wdev)) 11828 *wdev = NULL; 11829 11830 *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf); 11831 if (IS_ERR(*rdev)) 11832 return PTR_ERR(*rdev); 11833 11834 vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]); 11835 subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]); 11836 11837 for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) { 11838 const struct wiphy_vendor_command *vcmd; 11839 11840 vcmd = &(*rdev)->wiphy.vendor_commands[i]; 11841 11842 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd) 11843 continue; 11844 11845 if (!vcmd->dumpit) 11846 return -EOPNOTSUPP; 11847 11848 vcmd_idx = i; 11849 break; 11850 } 11851 11852 if (vcmd_idx < 0) 11853 return -EOPNOTSUPP; 11854 11855 if (attrbuf[NL80211_ATTR_VENDOR_DATA]) { 11856 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]); 11857 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]); 11858 } 11859 11860 /* 0 is the first index - add 1 to parse only once */ 11861 cb->args[0] = (*rdev)->wiphy_idx + 1; 11862 /* add 1 to know if it was NULL */ 11863 cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0; 11864 cb->args[2] = vcmd_idx; 11865 cb->args[3] = (unsigned long)data; 11866 cb->args[4] = data_len; 11867 11868 /* keep rtnl locked in successful case */ 11869 return 0; 11870 } 11871 11872 static int nl80211_vendor_cmd_dump(struct sk_buff *skb, 11873 struct netlink_callback *cb) 11874 { 11875 struct cfg80211_registered_device *rdev; 11876 struct wireless_dev *wdev; 11877 unsigned int vcmd_idx; 11878 const struct wiphy_vendor_command *vcmd; 11879 void *data; 11880 int data_len; 11881 int err; 11882 struct nlattr *vendor_data; 11883 11884 rtnl_lock(); 11885 err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev); 11886 if (err) 11887 goto out; 11888 11889 vcmd_idx = cb->args[2]; 11890 data = (void *)cb->args[3]; 11891 data_len = cb->args[4]; 11892 vcmd = &rdev->wiphy.vendor_commands[vcmd_idx]; 11893 11894 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV | 11895 WIPHY_VENDOR_CMD_NEED_NETDEV)) { 11896 if (!wdev) { 11897 err = -EINVAL; 11898 goto out; 11899 } 11900 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV && 11901 !wdev->netdev) { 11902 err = -EINVAL; 11903 goto out; 11904 } 11905 11906 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) { 11907 if (!wdev_running(wdev)) { 11908 err = -ENETDOWN; 11909 goto out; 11910 } 11911 } 11912 } 11913 11914 while (1) { 11915 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid, 11916 cb->nlh->nlmsg_seq, NLM_F_MULTI, 11917 NL80211_CMD_VENDOR); 11918 if (!hdr) 11919 break; 11920 11921 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 11922 (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV, 11923 wdev_id(wdev), 11924 NL80211_ATTR_PAD))) { 11925 genlmsg_cancel(skb, hdr); 11926 break; 11927 } 11928 11929 vendor_data = nla_nest_start(skb, NL80211_ATTR_VENDOR_DATA); 11930 if (!vendor_data) { 11931 genlmsg_cancel(skb, hdr); 11932 break; 11933 } 11934 11935 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len, 11936 (unsigned long *)&cb->args[5]); 11937 nla_nest_end(skb, vendor_data); 11938 11939 if (err == -ENOBUFS || err == -ENOENT) { 11940 genlmsg_cancel(skb, hdr); 11941 break; 11942 } else if (err) { 11943 genlmsg_cancel(skb, hdr); 11944 goto out; 11945 } 11946 11947 genlmsg_end(skb, hdr); 11948 } 11949 11950 err = skb->len; 11951 out: 11952 rtnl_unlock(); 11953 return err; 11954 } 11955 11956 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy, 11957 enum nl80211_commands cmd, 11958 enum nl80211_attrs attr, 11959 int approxlen) 11960 { 11961 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 11962 11963 if (WARN_ON(!rdev->cur_cmd_info)) 11964 return NULL; 11965 11966 return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen, 11967 rdev->cur_cmd_info->snd_portid, 11968 rdev->cur_cmd_info->snd_seq, 11969 cmd, attr, NULL, GFP_KERNEL); 11970 } 11971 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb); 11972 11973 int cfg80211_vendor_cmd_reply(struct sk_buff *skb) 11974 { 11975 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0]; 11976 void *hdr = ((void **)skb->cb)[1]; 11977 struct nlattr *data = ((void **)skb->cb)[2]; 11978 11979 /* clear CB data for netlink core to own from now on */ 11980 memset(skb->cb, 0, sizeof(skb->cb)); 11981 11982 if (WARN_ON(!rdev->cur_cmd_info)) { 11983 kfree_skb(skb); 11984 return -EINVAL; 11985 } 11986 11987 nla_nest_end(skb, data); 11988 genlmsg_end(skb, hdr); 11989 return genlmsg_reply(skb, rdev->cur_cmd_info); 11990 } 11991 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply); 11992 11993 static int nl80211_set_qos_map(struct sk_buff *skb, 11994 struct genl_info *info) 11995 { 11996 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 11997 struct cfg80211_qos_map *qos_map = NULL; 11998 struct net_device *dev = info->user_ptr[1]; 11999 u8 *pos, len, num_des, des_len, des; 12000 int ret; 12001 12002 if (!rdev->ops->set_qos_map) 12003 return -EOPNOTSUPP; 12004 12005 if (info->attrs[NL80211_ATTR_QOS_MAP]) { 12006 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]); 12007 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]); 12008 12009 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN || 12010 len > IEEE80211_QOS_MAP_LEN_MAX) 12011 return -EINVAL; 12012 12013 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL); 12014 if (!qos_map) 12015 return -ENOMEM; 12016 12017 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1; 12018 if (num_des) { 12019 des_len = num_des * 12020 sizeof(struct cfg80211_dscp_exception); 12021 memcpy(qos_map->dscp_exception, pos, des_len); 12022 qos_map->num_des = num_des; 12023 for (des = 0; des < num_des; des++) { 12024 if (qos_map->dscp_exception[des].up > 7) { 12025 kfree(qos_map); 12026 return -EINVAL; 12027 } 12028 } 12029 pos += des_len; 12030 } 12031 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN); 12032 } 12033 12034 wdev_lock(dev->ieee80211_ptr); 12035 ret = nl80211_key_allowed(dev->ieee80211_ptr); 12036 if (!ret) 12037 ret = rdev_set_qos_map(rdev, dev, qos_map); 12038 wdev_unlock(dev->ieee80211_ptr); 12039 12040 kfree(qos_map); 12041 return ret; 12042 } 12043 12044 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info) 12045 { 12046 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12047 struct net_device *dev = info->user_ptr[1]; 12048 struct wireless_dev *wdev = dev->ieee80211_ptr; 12049 const u8 *peer; 12050 u8 tsid, up; 12051 u16 admitted_time = 0; 12052 int err; 12053 12054 if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)) 12055 return -EOPNOTSUPP; 12056 12057 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] || 12058 !info->attrs[NL80211_ATTR_USER_PRIO]) 12059 return -EINVAL; 12060 12061 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]); 12062 if (tsid >= IEEE80211_NUM_TIDS) 12063 return -EINVAL; 12064 12065 up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]); 12066 if (up >= IEEE80211_NUM_UPS) 12067 return -EINVAL; 12068 12069 /* WMM uses TIDs 0-7 even for TSPEC */ 12070 if (tsid >= IEEE80211_FIRST_TSPEC_TSID) { 12071 /* TODO: handle 802.11 TSPEC/admission control 12072 * need more attributes for that (e.g. BA session requirement); 12073 * change the WMM adminssion test above to allow both then 12074 */ 12075 return -EINVAL; 12076 } 12077 12078 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 12079 12080 if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) { 12081 admitted_time = 12082 nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]); 12083 if (!admitted_time) 12084 return -EINVAL; 12085 } 12086 12087 wdev_lock(wdev); 12088 switch (wdev->iftype) { 12089 case NL80211_IFTYPE_STATION: 12090 case NL80211_IFTYPE_P2P_CLIENT: 12091 if (wdev->current_bss) 12092 break; 12093 err = -ENOTCONN; 12094 goto out; 12095 default: 12096 err = -EOPNOTSUPP; 12097 goto out; 12098 } 12099 12100 err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time); 12101 12102 out: 12103 wdev_unlock(wdev); 12104 return err; 12105 } 12106 12107 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info) 12108 { 12109 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12110 struct net_device *dev = info->user_ptr[1]; 12111 struct wireless_dev *wdev = dev->ieee80211_ptr; 12112 const u8 *peer; 12113 u8 tsid; 12114 int err; 12115 12116 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC]) 12117 return -EINVAL; 12118 12119 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]); 12120 peer = nla_data(info->attrs[NL80211_ATTR_MAC]); 12121 12122 wdev_lock(wdev); 12123 err = rdev_del_tx_ts(rdev, dev, tsid, peer); 12124 wdev_unlock(wdev); 12125 12126 return err; 12127 } 12128 12129 static int nl80211_tdls_channel_switch(struct sk_buff *skb, 12130 struct genl_info *info) 12131 { 12132 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12133 struct net_device *dev = info->user_ptr[1]; 12134 struct wireless_dev *wdev = dev->ieee80211_ptr; 12135 struct cfg80211_chan_def chandef = {}; 12136 const u8 *addr; 12137 u8 oper_class; 12138 int err; 12139 12140 if (!rdev->ops->tdls_channel_switch || 12141 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH)) 12142 return -EOPNOTSUPP; 12143 12144 switch (dev->ieee80211_ptr->iftype) { 12145 case NL80211_IFTYPE_STATION: 12146 case NL80211_IFTYPE_P2P_CLIENT: 12147 break; 12148 default: 12149 return -EOPNOTSUPP; 12150 } 12151 12152 if (!info->attrs[NL80211_ATTR_MAC] || 12153 !info->attrs[NL80211_ATTR_OPER_CLASS]) 12154 return -EINVAL; 12155 12156 err = nl80211_parse_chandef(rdev, info, &chandef); 12157 if (err) 12158 return err; 12159 12160 /* 12161 * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012 12162 * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the 12163 * specification is not defined for them. 12164 */ 12165 if (chandef.chan->band == NL80211_BAND_2GHZ && 12166 chandef.width != NL80211_CHAN_WIDTH_20_NOHT && 12167 chandef.width != NL80211_CHAN_WIDTH_20) 12168 return -EINVAL; 12169 12170 /* we will be active on the TDLS link */ 12171 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef, 12172 wdev->iftype)) 12173 return -EINVAL; 12174 12175 /* don't allow switching to DFS channels */ 12176 if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype)) 12177 return -EINVAL; 12178 12179 addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 12180 oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]); 12181 12182 wdev_lock(wdev); 12183 err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef); 12184 wdev_unlock(wdev); 12185 12186 return err; 12187 } 12188 12189 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb, 12190 struct genl_info *info) 12191 { 12192 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12193 struct net_device *dev = info->user_ptr[1]; 12194 struct wireless_dev *wdev = dev->ieee80211_ptr; 12195 const u8 *addr; 12196 12197 if (!rdev->ops->tdls_channel_switch || 12198 !rdev->ops->tdls_cancel_channel_switch || 12199 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH)) 12200 return -EOPNOTSUPP; 12201 12202 switch (dev->ieee80211_ptr->iftype) { 12203 case NL80211_IFTYPE_STATION: 12204 case NL80211_IFTYPE_P2P_CLIENT: 12205 break; 12206 default: 12207 return -EOPNOTSUPP; 12208 } 12209 12210 if (!info->attrs[NL80211_ATTR_MAC]) 12211 return -EINVAL; 12212 12213 addr = nla_data(info->attrs[NL80211_ATTR_MAC]); 12214 12215 wdev_lock(wdev); 12216 rdev_tdls_cancel_channel_switch(rdev, dev, addr); 12217 wdev_unlock(wdev); 12218 12219 return 0; 12220 } 12221 12222 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb, 12223 struct genl_info *info) 12224 { 12225 struct cfg80211_registered_device *rdev = info->user_ptr[0]; 12226 struct net_device *dev = info->user_ptr[1]; 12227 struct wireless_dev *wdev = dev->ieee80211_ptr; 12228 const struct nlattr *nla; 12229 bool enabled; 12230 12231 if (!rdev->ops->set_multicast_to_unicast) 12232 return -EOPNOTSUPP; 12233 12234 if (wdev->iftype != NL80211_IFTYPE_AP && 12235 wdev->iftype != NL80211_IFTYPE_P2P_GO) 12236 return -EOPNOTSUPP; 12237 12238 nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED]; 12239 enabled = nla_get_flag(nla); 12240 12241 return rdev_set_multicast_to_unicast(rdev, dev, enabled); 12242 } 12243 12244 #define NL80211_FLAG_NEED_WIPHY 0x01 12245 #define NL80211_FLAG_NEED_NETDEV 0x02 12246 #define NL80211_FLAG_NEED_RTNL 0x04 12247 #define NL80211_FLAG_CHECK_NETDEV_UP 0x08 12248 #define NL80211_FLAG_NEED_NETDEV_UP (NL80211_FLAG_NEED_NETDEV |\ 12249 NL80211_FLAG_CHECK_NETDEV_UP) 12250 #define NL80211_FLAG_NEED_WDEV 0x10 12251 /* If a netdev is associated, it must be UP, P2P must be started */ 12252 #define NL80211_FLAG_NEED_WDEV_UP (NL80211_FLAG_NEED_WDEV |\ 12253 NL80211_FLAG_CHECK_NETDEV_UP) 12254 #define NL80211_FLAG_CLEAR_SKB 0x20 12255 12256 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb, 12257 struct genl_info *info) 12258 { 12259 struct cfg80211_registered_device *rdev; 12260 struct wireless_dev *wdev; 12261 struct net_device *dev; 12262 bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL; 12263 12264 if (rtnl) 12265 rtnl_lock(); 12266 12267 if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) { 12268 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info); 12269 if (IS_ERR(rdev)) { 12270 if (rtnl) 12271 rtnl_unlock(); 12272 return PTR_ERR(rdev); 12273 } 12274 info->user_ptr[0] = rdev; 12275 } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV || 12276 ops->internal_flags & NL80211_FLAG_NEED_WDEV) { 12277 ASSERT_RTNL(); 12278 12279 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info), 12280 info->attrs); 12281 if (IS_ERR(wdev)) { 12282 if (rtnl) 12283 rtnl_unlock(); 12284 return PTR_ERR(wdev); 12285 } 12286 12287 dev = wdev->netdev; 12288 rdev = wiphy_to_rdev(wdev->wiphy); 12289 12290 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) { 12291 if (!dev) { 12292 if (rtnl) 12293 rtnl_unlock(); 12294 return -EINVAL; 12295 } 12296 12297 info->user_ptr[1] = dev; 12298 } else { 12299 info->user_ptr[1] = wdev; 12300 } 12301 12302 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP && 12303 !wdev_running(wdev)) { 12304 if (rtnl) 12305 rtnl_unlock(); 12306 return -ENETDOWN; 12307 } 12308 12309 if (dev) 12310 dev_hold(dev); 12311 12312 info->user_ptr[0] = rdev; 12313 } 12314 12315 return 0; 12316 } 12317 12318 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb, 12319 struct genl_info *info) 12320 { 12321 if (info->user_ptr[1]) { 12322 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) { 12323 struct wireless_dev *wdev = info->user_ptr[1]; 12324 12325 if (wdev->netdev) 12326 dev_put(wdev->netdev); 12327 } else { 12328 dev_put(info->user_ptr[1]); 12329 } 12330 } 12331 12332 if (ops->internal_flags & NL80211_FLAG_NEED_RTNL) 12333 rtnl_unlock(); 12334 12335 /* If needed, clear the netlink message payload from the SKB 12336 * as it might contain key data that shouldn't stick around on 12337 * the heap after the SKB is freed. The netlink message header 12338 * is still needed for further processing, so leave it intact. 12339 */ 12340 if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) { 12341 struct nlmsghdr *nlh = nlmsg_hdr(skb); 12342 12343 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh)); 12344 } 12345 } 12346 12347 static const struct genl_ops nl80211_ops[] = { 12348 { 12349 .cmd = NL80211_CMD_GET_WIPHY, 12350 .doit = nl80211_get_wiphy, 12351 .dumpit = nl80211_dump_wiphy, 12352 .done = nl80211_dump_wiphy_done, 12353 .policy = nl80211_policy, 12354 /* can be retrieved by unprivileged users */ 12355 .internal_flags = NL80211_FLAG_NEED_WIPHY | 12356 NL80211_FLAG_NEED_RTNL, 12357 }, 12358 { 12359 .cmd = NL80211_CMD_SET_WIPHY, 12360 .doit = nl80211_set_wiphy, 12361 .policy = nl80211_policy, 12362 .flags = GENL_UNS_ADMIN_PERM, 12363 .internal_flags = NL80211_FLAG_NEED_RTNL, 12364 }, 12365 { 12366 .cmd = NL80211_CMD_GET_INTERFACE, 12367 .doit = nl80211_get_interface, 12368 .dumpit = nl80211_dump_interface, 12369 .policy = nl80211_policy, 12370 /* can be retrieved by unprivileged users */ 12371 .internal_flags = NL80211_FLAG_NEED_WDEV | 12372 NL80211_FLAG_NEED_RTNL, 12373 }, 12374 { 12375 .cmd = NL80211_CMD_SET_INTERFACE, 12376 .doit = nl80211_set_interface, 12377 .policy = nl80211_policy, 12378 .flags = GENL_UNS_ADMIN_PERM, 12379 .internal_flags = NL80211_FLAG_NEED_NETDEV | 12380 NL80211_FLAG_NEED_RTNL, 12381 }, 12382 { 12383 .cmd = NL80211_CMD_NEW_INTERFACE, 12384 .doit = nl80211_new_interface, 12385 .policy = nl80211_policy, 12386 .flags = GENL_UNS_ADMIN_PERM, 12387 .internal_flags = NL80211_FLAG_NEED_WIPHY | 12388 NL80211_FLAG_NEED_RTNL, 12389 }, 12390 { 12391 .cmd = NL80211_CMD_DEL_INTERFACE, 12392 .doit = nl80211_del_interface, 12393 .policy = nl80211_policy, 12394 .flags = GENL_UNS_ADMIN_PERM, 12395 .internal_flags = NL80211_FLAG_NEED_WDEV | 12396 NL80211_FLAG_NEED_RTNL, 12397 }, 12398 { 12399 .cmd = NL80211_CMD_GET_KEY, 12400 .doit = nl80211_get_key, 12401 .policy = nl80211_policy, 12402 .flags = GENL_UNS_ADMIN_PERM, 12403 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12404 NL80211_FLAG_NEED_RTNL, 12405 }, 12406 { 12407 .cmd = NL80211_CMD_SET_KEY, 12408 .doit = nl80211_set_key, 12409 .policy = nl80211_policy, 12410 .flags = GENL_UNS_ADMIN_PERM, 12411 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12412 NL80211_FLAG_NEED_RTNL | 12413 NL80211_FLAG_CLEAR_SKB, 12414 }, 12415 { 12416 .cmd = NL80211_CMD_NEW_KEY, 12417 .doit = nl80211_new_key, 12418 .policy = nl80211_policy, 12419 .flags = GENL_UNS_ADMIN_PERM, 12420 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12421 NL80211_FLAG_NEED_RTNL | 12422 NL80211_FLAG_CLEAR_SKB, 12423 }, 12424 { 12425 .cmd = NL80211_CMD_DEL_KEY, 12426 .doit = nl80211_del_key, 12427 .policy = nl80211_policy, 12428 .flags = GENL_UNS_ADMIN_PERM, 12429 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12430 NL80211_FLAG_NEED_RTNL, 12431 }, 12432 { 12433 .cmd = NL80211_CMD_SET_BEACON, 12434 .policy = nl80211_policy, 12435 .flags = GENL_UNS_ADMIN_PERM, 12436 .doit = nl80211_set_beacon, 12437 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12438 NL80211_FLAG_NEED_RTNL, 12439 }, 12440 { 12441 .cmd = NL80211_CMD_START_AP, 12442 .policy = nl80211_policy, 12443 .flags = GENL_UNS_ADMIN_PERM, 12444 .doit = nl80211_start_ap, 12445 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12446 NL80211_FLAG_NEED_RTNL, 12447 }, 12448 { 12449 .cmd = NL80211_CMD_STOP_AP, 12450 .policy = nl80211_policy, 12451 .flags = GENL_UNS_ADMIN_PERM, 12452 .doit = nl80211_stop_ap, 12453 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12454 NL80211_FLAG_NEED_RTNL, 12455 }, 12456 { 12457 .cmd = NL80211_CMD_GET_STATION, 12458 .doit = nl80211_get_station, 12459 .dumpit = nl80211_dump_station, 12460 .policy = nl80211_policy, 12461 .internal_flags = NL80211_FLAG_NEED_NETDEV | 12462 NL80211_FLAG_NEED_RTNL, 12463 }, 12464 { 12465 .cmd = NL80211_CMD_SET_STATION, 12466 .doit = nl80211_set_station, 12467 .policy = nl80211_policy, 12468 .flags = GENL_UNS_ADMIN_PERM, 12469 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12470 NL80211_FLAG_NEED_RTNL, 12471 }, 12472 { 12473 .cmd = NL80211_CMD_NEW_STATION, 12474 .doit = nl80211_new_station, 12475 .policy = nl80211_policy, 12476 .flags = GENL_UNS_ADMIN_PERM, 12477 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12478 NL80211_FLAG_NEED_RTNL, 12479 }, 12480 { 12481 .cmd = NL80211_CMD_DEL_STATION, 12482 .doit = nl80211_del_station, 12483 .policy = nl80211_policy, 12484 .flags = GENL_UNS_ADMIN_PERM, 12485 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12486 NL80211_FLAG_NEED_RTNL, 12487 }, 12488 { 12489 .cmd = NL80211_CMD_GET_MPATH, 12490 .doit = nl80211_get_mpath, 12491 .dumpit = nl80211_dump_mpath, 12492 .policy = nl80211_policy, 12493 .flags = GENL_UNS_ADMIN_PERM, 12494 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12495 NL80211_FLAG_NEED_RTNL, 12496 }, 12497 { 12498 .cmd = NL80211_CMD_GET_MPP, 12499 .doit = nl80211_get_mpp, 12500 .dumpit = nl80211_dump_mpp, 12501 .policy = nl80211_policy, 12502 .flags = GENL_UNS_ADMIN_PERM, 12503 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12504 NL80211_FLAG_NEED_RTNL, 12505 }, 12506 { 12507 .cmd = NL80211_CMD_SET_MPATH, 12508 .doit = nl80211_set_mpath, 12509 .policy = nl80211_policy, 12510 .flags = GENL_UNS_ADMIN_PERM, 12511 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12512 NL80211_FLAG_NEED_RTNL, 12513 }, 12514 { 12515 .cmd = NL80211_CMD_NEW_MPATH, 12516 .doit = nl80211_new_mpath, 12517 .policy = nl80211_policy, 12518 .flags = GENL_UNS_ADMIN_PERM, 12519 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12520 NL80211_FLAG_NEED_RTNL, 12521 }, 12522 { 12523 .cmd = NL80211_CMD_DEL_MPATH, 12524 .doit = nl80211_del_mpath, 12525 .policy = nl80211_policy, 12526 .flags = GENL_UNS_ADMIN_PERM, 12527 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12528 NL80211_FLAG_NEED_RTNL, 12529 }, 12530 { 12531 .cmd = NL80211_CMD_SET_BSS, 12532 .doit = nl80211_set_bss, 12533 .policy = nl80211_policy, 12534 .flags = GENL_UNS_ADMIN_PERM, 12535 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12536 NL80211_FLAG_NEED_RTNL, 12537 }, 12538 { 12539 .cmd = NL80211_CMD_GET_REG, 12540 .doit = nl80211_get_reg_do, 12541 .dumpit = nl80211_get_reg_dump, 12542 .policy = nl80211_policy, 12543 .internal_flags = NL80211_FLAG_NEED_RTNL, 12544 /* can be retrieved by unprivileged users */ 12545 }, 12546 #ifdef CONFIG_CFG80211_CRDA_SUPPORT 12547 { 12548 .cmd = NL80211_CMD_SET_REG, 12549 .doit = nl80211_set_reg, 12550 .policy = nl80211_policy, 12551 .flags = GENL_ADMIN_PERM, 12552 .internal_flags = NL80211_FLAG_NEED_RTNL, 12553 }, 12554 #endif 12555 { 12556 .cmd = NL80211_CMD_REQ_SET_REG, 12557 .doit = nl80211_req_set_reg, 12558 .policy = nl80211_policy, 12559 .flags = GENL_ADMIN_PERM, 12560 }, 12561 { 12562 .cmd = NL80211_CMD_GET_MESH_CONFIG, 12563 .doit = nl80211_get_mesh_config, 12564 .policy = nl80211_policy, 12565 /* can be retrieved by unprivileged users */ 12566 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12567 NL80211_FLAG_NEED_RTNL, 12568 }, 12569 { 12570 .cmd = NL80211_CMD_SET_MESH_CONFIG, 12571 .doit = nl80211_update_mesh_config, 12572 .policy = nl80211_policy, 12573 .flags = GENL_UNS_ADMIN_PERM, 12574 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12575 NL80211_FLAG_NEED_RTNL, 12576 }, 12577 { 12578 .cmd = NL80211_CMD_TRIGGER_SCAN, 12579 .doit = nl80211_trigger_scan, 12580 .policy = nl80211_policy, 12581 .flags = GENL_UNS_ADMIN_PERM, 12582 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 12583 NL80211_FLAG_NEED_RTNL, 12584 }, 12585 { 12586 .cmd = NL80211_CMD_ABORT_SCAN, 12587 .doit = nl80211_abort_scan, 12588 .policy = nl80211_policy, 12589 .flags = GENL_UNS_ADMIN_PERM, 12590 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 12591 NL80211_FLAG_NEED_RTNL, 12592 }, 12593 { 12594 .cmd = NL80211_CMD_GET_SCAN, 12595 .policy = nl80211_policy, 12596 .dumpit = nl80211_dump_scan, 12597 }, 12598 { 12599 .cmd = NL80211_CMD_START_SCHED_SCAN, 12600 .doit = nl80211_start_sched_scan, 12601 .policy = nl80211_policy, 12602 .flags = GENL_UNS_ADMIN_PERM, 12603 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12604 NL80211_FLAG_NEED_RTNL, 12605 }, 12606 { 12607 .cmd = NL80211_CMD_STOP_SCHED_SCAN, 12608 .doit = nl80211_stop_sched_scan, 12609 .policy = nl80211_policy, 12610 .flags = GENL_UNS_ADMIN_PERM, 12611 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12612 NL80211_FLAG_NEED_RTNL, 12613 }, 12614 { 12615 .cmd = NL80211_CMD_AUTHENTICATE, 12616 .doit = nl80211_authenticate, 12617 .policy = nl80211_policy, 12618 .flags = GENL_UNS_ADMIN_PERM, 12619 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12620 NL80211_FLAG_NEED_RTNL | 12621 NL80211_FLAG_CLEAR_SKB, 12622 }, 12623 { 12624 .cmd = NL80211_CMD_ASSOCIATE, 12625 .doit = nl80211_associate, 12626 .policy = nl80211_policy, 12627 .flags = GENL_UNS_ADMIN_PERM, 12628 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12629 NL80211_FLAG_NEED_RTNL, 12630 }, 12631 { 12632 .cmd = NL80211_CMD_DEAUTHENTICATE, 12633 .doit = nl80211_deauthenticate, 12634 .policy = nl80211_policy, 12635 .flags = GENL_UNS_ADMIN_PERM, 12636 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12637 NL80211_FLAG_NEED_RTNL, 12638 }, 12639 { 12640 .cmd = NL80211_CMD_DISASSOCIATE, 12641 .doit = nl80211_disassociate, 12642 .policy = nl80211_policy, 12643 .flags = GENL_UNS_ADMIN_PERM, 12644 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12645 NL80211_FLAG_NEED_RTNL, 12646 }, 12647 { 12648 .cmd = NL80211_CMD_JOIN_IBSS, 12649 .doit = nl80211_join_ibss, 12650 .policy = nl80211_policy, 12651 .flags = GENL_UNS_ADMIN_PERM, 12652 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12653 NL80211_FLAG_NEED_RTNL, 12654 }, 12655 { 12656 .cmd = NL80211_CMD_LEAVE_IBSS, 12657 .doit = nl80211_leave_ibss, 12658 .policy = nl80211_policy, 12659 .flags = GENL_UNS_ADMIN_PERM, 12660 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12661 NL80211_FLAG_NEED_RTNL, 12662 }, 12663 #ifdef CONFIG_NL80211_TESTMODE 12664 { 12665 .cmd = NL80211_CMD_TESTMODE, 12666 .doit = nl80211_testmode_do, 12667 .dumpit = nl80211_testmode_dump, 12668 .policy = nl80211_policy, 12669 .flags = GENL_UNS_ADMIN_PERM, 12670 .internal_flags = NL80211_FLAG_NEED_WIPHY | 12671 NL80211_FLAG_NEED_RTNL, 12672 }, 12673 #endif 12674 { 12675 .cmd = NL80211_CMD_CONNECT, 12676 .doit = nl80211_connect, 12677 .policy = nl80211_policy, 12678 .flags = GENL_UNS_ADMIN_PERM, 12679 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12680 NL80211_FLAG_NEED_RTNL, 12681 }, 12682 { 12683 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS, 12684 .doit = nl80211_update_connect_params, 12685 .policy = nl80211_policy, 12686 .flags = GENL_ADMIN_PERM, 12687 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12688 NL80211_FLAG_NEED_RTNL, 12689 }, 12690 { 12691 .cmd = NL80211_CMD_DISCONNECT, 12692 .doit = nl80211_disconnect, 12693 .policy = nl80211_policy, 12694 .flags = GENL_UNS_ADMIN_PERM, 12695 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12696 NL80211_FLAG_NEED_RTNL, 12697 }, 12698 { 12699 .cmd = NL80211_CMD_SET_WIPHY_NETNS, 12700 .doit = nl80211_wiphy_netns, 12701 .policy = nl80211_policy, 12702 .flags = GENL_UNS_ADMIN_PERM, 12703 .internal_flags = NL80211_FLAG_NEED_WIPHY | 12704 NL80211_FLAG_NEED_RTNL, 12705 }, 12706 { 12707 .cmd = NL80211_CMD_GET_SURVEY, 12708 .policy = nl80211_policy, 12709 .dumpit = nl80211_dump_survey, 12710 }, 12711 { 12712 .cmd = NL80211_CMD_SET_PMKSA, 12713 .doit = nl80211_setdel_pmksa, 12714 .policy = nl80211_policy, 12715 .flags = GENL_UNS_ADMIN_PERM, 12716 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12717 NL80211_FLAG_NEED_RTNL, 12718 }, 12719 { 12720 .cmd = NL80211_CMD_DEL_PMKSA, 12721 .doit = nl80211_setdel_pmksa, 12722 .policy = nl80211_policy, 12723 .flags = GENL_UNS_ADMIN_PERM, 12724 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12725 NL80211_FLAG_NEED_RTNL, 12726 }, 12727 { 12728 .cmd = NL80211_CMD_FLUSH_PMKSA, 12729 .doit = nl80211_flush_pmksa, 12730 .policy = nl80211_policy, 12731 .flags = GENL_UNS_ADMIN_PERM, 12732 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12733 NL80211_FLAG_NEED_RTNL, 12734 }, 12735 { 12736 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL, 12737 .doit = nl80211_remain_on_channel, 12738 .policy = nl80211_policy, 12739 .flags = GENL_UNS_ADMIN_PERM, 12740 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 12741 NL80211_FLAG_NEED_RTNL, 12742 }, 12743 { 12744 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL, 12745 .doit = nl80211_cancel_remain_on_channel, 12746 .policy = nl80211_policy, 12747 .flags = GENL_UNS_ADMIN_PERM, 12748 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 12749 NL80211_FLAG_NEED_RTNL, 12750 }, 12751 { 12752 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK, 12753 .doit = nl80211_set_tx_bitrate_mask, 12754 .policy = nl80211_policy, 12755 .flags = GENL_UNS_ADMIN_PERM, 12756 .internal_flags = NL80211_FLAG_NEED_NETDEV | 12757 NL80211_FLAG_NEED_RTNL, 12758 }, 12759 { 12760 .cmd = NL80211_CMD_REGISTER_FRAME, 12761 .doit = nl80211_register_mgmt, 12762 .policy = nl80211_policy, 12763 .flags = GENL_UNS_ADMIN_PERM, 12764 .internal_flags = NL80211_FLAG_NEED_WDEV | 12765 NL80211_FLAG_NEED_RTNL, 12766 }, 12767 { 12768 .cmd = NL80211_CMD_FRAME, 12769 .doit = nl80211_tx_mgmt, 12770 .policy = nl80211_policy, 12771 .flags = GENL_UNS_ADMIN_PERM, 12772 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 12773 NL80211_FLAG_NEED_RTNL, 12774 }, 12775 { 12776 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL, 12777 .doit = nl80211_tx_mgmt_cancel_wait, 12778 .policy = nl80211_policy, 12779 .flags = GENL_UNS_ADMIN_PERM, 12780 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 12781 NL80211_FLAG_NEED_RTNL, 12782 }, 12783 { 12784 .cmd = NL80211_CMD_SET_POWER_SAVE, 12785 .doit = nl80211_set_power_save, 12786 .policy = nl80211_policy, 12787 .flags = GENL_UNS_ADMIN_PERM, 12788 .internal_flags = NL80211_FLAG_NEED_NETDEV | 12789 NL80211_FLAG_NEED_RTNL, 12790 }, 12791 { 12792 .cmd = NL80211_CMD_GET_POWER_SAVE, 12793 .doit = nl80211_get_power_save, 12794 .policy = nl80211_policy, 12795 /* can be retrieved by unprivileged users */ 12796 .internal_flags = NL80211_FLAG_NEED_NETDEV | 12797 NL80211_FLAG_NEED_RTNL, 12798 }, 12799 { 12800 .cmd = NL80211_CMD_SET_CQM, 12801 .doit = nl80211_set_cqm, 12802 .policy = nl80211_policy, 12803 .flags = GENL_UNS_ADMIN_PERM, 12804 .internal_flags = NL80211_FLAG_NEED_NETDEV | 12805 NL80211_FLAG_NEED_RTNL, 12806 }, 12807 { 12808 .cmd = NL80211_CMD_SET_CHANNEL, 12809 .doit = nl80211_set_channel, 12810 .policy = nl80211_policy, 12811 .flags = GENL_UNS_ADMIN_PERM, 12812 .internal_flags = NL80211_FLAG_NEED_NETDEV | 12813 NL80211_FLAG_NEED_RTNL, 12814 }, 12815 { 12816 .cmd = NL80211_CMD_SET_WDS_PEER, 12817 .doit = nl80211_set_wds_peer, 12818 .policy = nl80211_policy, 12819 .flags = GENL_UNS_ADMIN_PERM, 12820 .internal_flags = NL80211_FLAG_NEED_NETDEV | 12821 NL80211_FLAG_NEED_RTNL, 12822 }, 12823 { 12824 .cmd = NL80211_CMD_JOIN_MESH, 12825 .doit = nl80211_join_mesh, 12826 .policy = nl80211_policy, 12827 .flags = GENL_UNS_ADMIN_PERM, 12828 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12829 NL80211_FLAG_NEED_RTNL, 12830 }, 12831 { 12832 .cmd = NL80211_CMD_LEAVE_MESH, 12833 .doit = nl80211_leave_mesh, 12834 .policy = nl80211_policy, 12835 .flags = GENL_UNS_ADMIN_PERM, 12836 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12837 NL80211_FLAG_NEED_RTNL, 12838 }, 12839 { 12840 .cmd = NL80211_CMD_JOIN_OCB, 12841 .doit = nl80211_join_ocb, 12842 .policy = nl80211_policy, 12843 .flags = GENL_UNS_ADMIN_PERM, 12844 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12845 NL80211_FLAG_NEED_RTNL, 12846 }, 12847 { 12848 .cmd = NL80211_CMD_LEAVE_OCB, 12849 .doit = nl80211_leave_ocb, 12850 .policy = nl80211_policy, 12851 .flags = GENL_UNS_ADMIN_PERM, 12852 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12853 NL80211_FLAG_NEED_RTNL, 12854 }, 12855 #ifdef CONFIG_PM 12856 { 12857 .cmd = NL80211_CMD_GET_WOWLAN, 12858 .doit = nl80211_get_wowlan, 12859 .policy = nl80211_policy, 12860 /* can be retrieved by unprivileged users */ 12861 .internal_flags = NL80211_FLAG_NEED_WIPHY | 12862 NL80211_FLAG_NEED_RTNL, 12863 }, 12864 { 12865 .cmd = NL80211_CMD_SET_WOWLAN, 12866 .doit = nl80211_set_wowlan, 12867 .policy = nl80211_policy, 12868 .flags = GENL_UNS_ADMIN_PERM, 12869 .internal_flags = NL80211_FLAG_NEED_WIPHY | 12870 NL80211_FLAG_NEED_RTNL, 12871 }, 12872 #endif 12873 { 12874 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD, 12875 .doit = nl80211_set_rekey_data, 12876 .policy = nl80211_policy, 12877 .flags = GENL_UNS_ADMIN_PERM, 12878 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12879 NL80211_FLAG_NEED_RTNL | 12880 NL80211_FLAG_CLEAR_SKB, 12881 }, 12882 { 12883 .cmd = NL80211_CMD_TDLS_MGMT, 12884 .doit = nl80211_tdls_mgmt, 12885 .policy = nl80211_policy, 12886 .flags = GENL_UNS_ADMIN_PERM, 12887 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12888 NL80211_FLAG_NEED_RTNL, 12889 }, 12890 { 12891 .cmd = NL80211_CMD_TDLS_OPER, 12892 .doit = nl80211_tdls_oper, 12893 .policy = nl80211_policy, 12894 .flags = GENL_UNS_ADMIN_PERM, 12895 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12896 NL80211_FLAG_NEED_RTNL, 12897 }, 12898 { 12899 .cmd = NL80211_CMD_UNEXPECTED_FRAME, 12900 .doit = nl80211_register_unexpected_frame, 12901 .policy = nl80211_policy, 12902 .flags = GENL_UNS_ADMIN_PERM, 12903 .internal_flags = NL80211_FLAG_NEED_NETDEV | 12904 NL80211_FLAG_NEED_RTNL, 12905 }, 12906 { 12907 .cmd = NL80211_CMD_PROBE_CLIENT, 12908 .doit = nl80211_probe_client, 12909 .policy = nl80211_policy, 12910 .flags = GENL_UNS_ADMIN_PERM, 12911 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 12912 NL80211_FLAG_NEED_RTNL, 12913 }, 12914 { 12915 .cmd = NL80211_CMD_REGISTER_BEACONS, 12916 .doit = nl80211_register_beacons, 12917 .policy = nl80211_policy, 12918 .flags = GENL_UNS_ADMIN_PERM, 12919 .internal_flags = NL80211_FLAG_NEED_WIPHY | 12920 NL80211_FLAG_NEED_RTNL, 12921 }, 12922 { 12923 .cmd = NL80211_CMD_SET_NOACK_MAP, 12924 .doit = nl80211_set_noack_map, 12925 .policy = nl80211_policy, 12926 .flags = GENL_UNS_ADMIN_PERM, 12927 .internal_flags = NL80211_FLAG_NEED_NETDEV | 12928 NL80211_FLAG_NEED_RTNL, 12929 }, 12930 { 12931 .cmd = NL80211_CMD_START_P2P_DEVICE, 12932 .doit = nl80211_start_p2p_device, 12933 .policy = nl80211_policy, 12934 .flags = GENL_UNS_ADMIN_PERM, 12935 .internal_flags = NL80211_FLAG_NEED_WDEV | 12936 NL80211_FLAG_NEED_RTNL, 12937 }, 12938 { 12939 .cmd = NL80211_CMD_STOP_P2P_DEVICE, 12940 .doit = nl80211_stop_p2p_device, 12941 .policy = nl80211_policy, 12942 .flags = GENL_UNS_ADMIN_PERM, 12943 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 12944 NL80211_FLAG_NEED_RTNL, 12945 }, 12946 { 12947 .cmd = NL80211_CMD_START_NAN, 12948 .doit = nl80211_start_nan, 12949 .policy = nl80211_policy, 12950 .flags = GENL_ADMIN_PERM, 12951 .internal_flags = NL80211_FLAG_NEED_WDEV | 12952 NL80211_FLAG_NEED_RTNL, 12953 }, 12954 { 12955 .cmd = NL80211_CMD_STOP_NAN, 12956 .doit = nl80211_stop_nan, 12957 .policy = nl80211_policy, 12958 .flags = GENL_ADMIN_PERM, 12959 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 12960 NL80211_FLAG_NEED_RTNL, 12961 }, 12962 { 12963 .cmd = NL80211_CMD_ADD_NAN_FUNCTION, 12964 .doit = nl80211_nan_add_func, 12965 .policy = nl80211_policy, 12966 .flags = GENL_ADMIN_PERM, 12967 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 12968 NL80211_FLAG_NEED_RTNL, 12969 }, 12970 { 12971 .cmd = NL80211_CMD_DEL_NAN_FUNCTION, 12972 .doit = nl80211_nan_del_func, 12973 .policy = nl80211_policy, 12974 .flags = GENL_ADMIN_PERM, 12975 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 12976 NL80211_FLAG_NEED_RTNL, 12977 }, 12978 { 12979 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG, 12980 .doit = nl80211_nan_change_config, 12981 .policy = nl80211_policy, 12982 .flags = GENL_ADMIN_PERM, 12983 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 12984 NL80211_FLAG_NEED_RTNL, 12985 }, 12986 { 12987 .cmd = NL80211_CMD_SET_MCAST_RATE, 12988 .doit = nl80211_set_mcast_rate, 12989 .policy = nl80211_policy, 12990 .flags = GENL_UNS_ADMIN_PERM, 12991 .internal_flags = NL80211_FLAG_NEED_NETDEV | 12992 NL80211_FLAG_NEED_RTNL, 12993 }, 12994 { 12995 .cmd = NL80211_CMD_SET_MAC_ACL, 12996 .doit = nl80211_set_mac_acl, 12997 .policy = nl80211_policy, 12998 .flags = GENL_UNS_ADMIN_PERM, 12999 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13000 NL80211_FLAG_NEED_RTNL, 13001 }, 13002 { 13003 .cmd = NL80211_CMD_RADAR_DETECT, 13004 .doit = nl80211_start_radar_detection, 13005 .policy = nl80211_policy, 13006 .flags = GENL_UNS_ADMIN_PERM, 13007 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13008 NL80211_FLAG_NEED_RTNL, 13009 }, 13010 { 13011 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES, 13012 .doit = nl80211_get_protocol_features, 13013 .policy = nl80211_policy, 13014 }, 13015 { 13016 .cmd = NL80211_CMD_UPDATE_FT_IES, 13017 .doit = nl80211_update_ft_ies, 13018 .policy = nl80211_policy, 13019 .flags = GENL_UNS_ADMIN_PERM, 13020 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13021 NL80211_FLAG_NEED_RTNL, 13022 }, 13023 { 13024 .cmd = NL80211_CMD_CRIT_PROTOCOL_START, 13025 .doit = nl80211_crit_protocol_start, 13026 .policy = nl80211_policy, 13027 .flags = GENL_UNS_ADMIN_PERM, 13028 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13029 NL80211_FLAG_NEED_RTNL, 13030 }, 13031 { 13032 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP, 13033 .doit = nl80211_crit_protocol_stop, 13034 .policy = nl80211_policy, 13035 .flags = GENL_UNS_ADMIN_PERM, 13036 .internal_flags = NL80211_FLAG_NEED_WDEV_UP | 13037 NL80211_FLAG_NEED_RTNL, 13038 }, 13039 { 13040 .cmd = NL80211_CMD_GET_COALESCE, 13041 .doit = nl80211_get_coalesce, 13042 .policy = nl80211_policy, 13043 .internal_flags = NL80211_FLAG_NEED_WIPHY | 13044 NL80211_FLAG_NEED_RTNL, 13045 }, 13046 { 13047 .cmd = NL80211_CMD_SET_COALESCE, 13048 .doit = nl80211_set_coalesce, 13049 .policy = nl80211_policy, 13050 .flags = GENL_UNS_ADMIN_PERM, 13051 .internal_flags = NL80211_FLAG_NEED_WIPHY | 13052 NL80211_FLAG_NEED_RTNL, 13053 }, 13054 { 13055 .cmd = NL80211_CMD_CHANNEL_SWITCH, 13056 .doit = nl80211_channel_switch, 13057 .policy = nl80211_policy, 13058 .flags = GENL_UNS_ADMIN_PERM, 13059 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13060 NL80211_FLAG_NEED_RTNL, 13061 }, 13062 { 13063 .cmd = NL80211_CMD_VENDOR, 13064 .doit = nl80211_vendor_cmd, 13065 .dumpit = nl80211_vendor_cmd_dump, 13066 .policy = nl80211_policy, 13067 .flags = GENL_UNS_ADMIN_PERM, 13068 .internal_flags = NL80211_FLAG_NEED_WIPHY | 13069 NL80211_FLAG_NEED_RTNL, 13070 }, 13071 { 13072 .cmd = NL80211_CMD_SET_QOS_MAP, 13073 .doit = nl80211_set_qos_map, 13074 .policy = nl80211_policy, 13075 .flags = GENL_UNS_ADMIN_PERM, 13076 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13077 NL80211_FLAG_NEED_RTNL, 13078 }, 13079 { 13080 .cmd = NL80211_CMD_ADD_TX_TS, 13081 .doit = nl80211_add_tx_ts, 13082 .policy = nl80211_policy, 13083 .flags = GENL_UNS_ADMIN_PERM, 13084 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13085 NL80211_FLAG_NEED_RTNL, 13086 }, 13087 { 13088 .cmd = NL80211_CMD_DEL_TX_TS, 13089 .doit = nl80211_del_tx_ts, 13090 .policy = nl80211_policy, 13091 .flags = GENL_UNS_ADMIN_PERM, 13092 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13093 NL80211_FLAG_NEED_RTNL, 13094 }, 13095 { 13096 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH, 13097 .doit = nl80211_tdls_channel_switch, 13098 .policy = nl80211_policy, 13099 .flags = GENL_UNS_ADMIN_PERM, 13100 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13101 NL80211_FLAG_NEED_RTNL, 13102 }, 13103 { 13104 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH, 13105 .doit = nl80211_tdls_cancel_channel_switch, 13106 .policy = nl80211_policy, 13107 .flags = GENL_UNS_ADMIN_PERM, 13108 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP | 13109 NL80211_FLAG_NEED_RTNL, 13110 }, 13111 { 13112 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST, 13113 .doit = nl80211_set_multicast_to_unicast, 13114 .policy = nl80211_policy, 13115 .flags = GENL_UNS_ADMIN_PERM, 13116 .internal_flags = NL80211_FLAG_NEED_NETDEV | 13117 NL80211_FLAG_NEED_RTNL, 13118 }, 13119 }; 13120 13121 static struct genl_family nl80211_fam __ro_after_init = { 13122 .name = NL80211_GENL_NAME, /* have users key off the name instead */ 13123 .hdrsize = 0, /* no private header */ 13124 .version = 1, /* no particular meaning now */ 13125 .maxattr = NL80211_ATTR_MAX, 13126 .netnsok = true, 13127 .pre_doit = nl80211_pre_doit, 13128 .post_doit = nl80211_post_doit, 13129 .module = THIS_MODULE, 13130 .ops = nl80211_ops, 13131 .n_ops = ARRAY_SIZE(nl80211_ops), 13132 .mcgrps = nl80211_mcgrps, 13133 .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps), 13134 }; 13135 13136 /* notification functions */ 13137 13138 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev, 13139 enum nl80211_commands cmd) 13140 { 13141 struct sk_buff *msg; 13142 struct nl80211_dump_wiphy_state state = {}; 13143 13144 WARN_ON(cmd != NL80211_CMD_NEW_WIPHY && 13145 cmd != NL80211_CMD_DEL_WIPHY); 13146 13147 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 13148 if (!msg) 13149 return; 13150 13151 if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) { 13152 nlmsg_free(msg); 13153 return; 13154 } 13155 13156 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13157 NL80211_MCGRP_CONFIG, GFP_KERNEL); 13158 } 13159 13160 void nl80211_notify_iface(struct cfg80211_registered_device *rdev, 13161 struct wireless_dev *wdev, 13162 enum nl80211_commands cmd) 13163 { 13164 struct sk_buff *msg; 13165 13166 WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE && 13167 cmd != NL80211_CMD_DEL_INTERFACE); 13168 13169 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 13170 if (!msg) 13171 return; 13172 13173 if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, 13174 cmd == NL80211_CMD_DEL_INTERFACE) < 0) { 13175 nlmsg_free(msg); 13176 return; 13177 } 13178 13179 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13180 NL80211_MCGRP_CONFIG, GFP_KERNEL); 13181 } 13182 13183 static int nl80211_add_scan_req(struct sk_buff *msg, 13184 struct cfg80211_registered_device *rdev) 13185 { 13186 struct cfg80211_scan_request *req = rdev->scan_req; 13187 struct nlattr *nest; 13188 int i; 13189 13190 if (WARN_ON(!req)) 13191 return 0; 13192 13193 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS); 13194 if (!nest) 13195 goto nla_put_failure; 13196 for (i = 0; i < req->n_ssids; i++) { 13197 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid)) 13198 goto nla_put_failure; 13199 } 13200 nla_nest_end(msg, nest); 13201 13202 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES); 13203 if (!nest) 13204 goto nla_put_failure; 13205 for (i = 0; i < req->n_channels; i++) { 13206 if (nla_put_u32(msg, i, req->channels[i]->center_freq)) 13207 goto nla_put_failure; 13208 } 13209 nla_nest_end(msg, nest); 13210 13211 if (req->ie && 13212 nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie)) 13213 goto nla_put_failure; 13214 13215 if (req->flags && 13216 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags)) 13217 goto nla_put_failure; 13218 13219 if (req->info.scan_start_tsf && 13220 (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF, 13221 req->info.scan_start_tsf, NL80211_BSS_PAD) || 13222 nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN, 13223 req->info.tsf_bssid))) 13224 goto nla_put_failure; 13225 13226 return 0; 13227 nla_put_failure: 13228 return -ENOBUFS; 13229 } 13230 13231 static int nl80211_prep_scan_msg(struct sk_buff *msg, 13232 struct cfg80211_registered_device *rdev, 13233 struct wireless_dev *wdev, 13234 u32 portid, u32 seq, int flags, 13235 u32 cmd) 13236 { 13237 void *hdr; 13238 13239 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd); 13240 if (!hdr) 13241 return -1; 13242 13243 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 13244 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 13245 wdev->netdev->ifindex)) || 13246 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 13247 NL80211_ATTR_PAD)) 13248 goto nla_put_failure; 13249 13250 /* ignore errors and send incomplete event anyway */ 13251 nl80211_add_scan_req(msg, rdev); 13252 13253 genlmsg_end(msg, hdr); 13254 return 0; 13255 13256 nla_put_failure: 13257 genlmsg_cancel(msg, hdr); 13258 return -EMSGSIZE; 13259 } 13260 13261 static int 13262 nl80211_prep_sched_scan_msg(struct sk_buff *msg, 13263 struct cfg80211_sched_scan_request *req, u32 cmd) 13264 { 13265 void *hdr; 13266 13267 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 13268 if (!hdr) 13269 return -1; 13270 13271 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, 13272 wiphy_to_rdev(req->wiphy)->wiphy_idx) || 13273 nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) || 13274 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid, 13275 NL80211_ATTR_PAD)) 13276 goto nla_put_failure; 13277 13278 genlmsg_end(msg, hdr); 13279 return 0; 13280 13281 nla_put_failure: 13282 genlmsg_cancel(msg, hdr); 13283 return -EMSGSIZE; 13284 } 13285 13286 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev, 13287 struct wireless_dev *wdev) 13288 { 13289 struct sk_buff *msg; 13290 13291 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 13292 if (!msg) 13293 return; 13294 13295 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0, 13296 NL80211_CMD_TRIGGER_SCAN) < 0) { 13297 nlmsg_free(msg); 13298 return; 13299 } 13300 13301 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13302 NL80211_MCGRP_SCAN, GFP_KERNEL); 13303 } 13304 13305 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev, 13306 struct wireless_dev *wdev, bool aborted) 13307 { 13308 struct sk_buff *msg; 13309 13310 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 13311 if (!msg) 13312 return NULL; 13313 13314 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0, 13315 aborted ? NL80211_CMD_SCAN_ABORTED : 13316 NL80211_CMD_NEW_SCAN_RESULTS) < 0) { 13317 nlmsg_free(msg); 13318 return NULL; 13319 } 13320 13321 return msg; 13322 } 13323 13324 /* send message created by nl80211_build_scan_msg() */ 13325 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev, 13326 struct sk_buff *msg) 13327 { 13328 if (!msg) 13329 return; 13330 13331 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13332 NL80211_MCGRP_SCAN, GFP_KERNEL); 13333 } 13334 13335 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd) 13336 { 13337 struct sk_buff *msg; 13338 13339 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 13340 if (!msg) 13341 return; 13342 13343 if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) { 13344 nlmsg_free(msg); 13345 return; 13346 } 13347 13348 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0, 13349 NL80211_MCGRP_SCAN, GFP_KERNEL); 13350 } 13351 13352 static bool nl80211_reg_change_event_fill(struct sk_buff *msg, 13353 struct regulatory_request *request) 13354 { 13355 /* Userspace can always count this one always being set */ 13356 if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator)) 13357 goto nla_put_failure; 13358 13359 if (request->alpha2[0] == '0' && request->alpha2[1] == '0') { 13360 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 13361 NL80211_REGDOM_TYPE_WORLD)) 13362 goto nla_put_failure; 13363 } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') { 13364 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 13365 NL80211_REGDOM_TYPE_CUSTOM_WORLD)) 13366 goto nla_put_failure; 13367 } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') || 13368 request->intersect) { 13369 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 13370 NL80211_REGDOM_TYPE_INTERSECTION)) 13371 goto nla_put_failure; 13372 } else { 13373 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE, 13374 NL80211_REGDOM_TYPE_COUNTRY) || 13375 nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, 13376 request->alpha2)) 13377 goto nla_put_failure; 13378 } 13379 13380 if (request->wiphy_idx != WIPHY_IDX_INVALID) { 13381 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx); 13382 13383 if (wiphy && 13384 nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx)) 13385 goto nla_put_failure; 13386 13387 if (wiphy && 13388 wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED && 13389 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG)) 13390 goto nla_put_failure; 13391 } 13392 13393 return true; 13394 13395 nla_put_failure: 13396 return false; 13397 } 13398 13399 /* 13400 * This can happen on global regulatory changes or device specific settings 13401 * based on custom regulatory domains. 13402 */ 13403 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id, 13404 struct regulatory_request *request) 13405 { 13406 struct sk_buff *msg; 13407 void *hdr; 13408 13409 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 13410 if (!msg) 13411 return; 13412 13413 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id); 13414 if (!hdr) { 13415 nlmsg_free(msg); 13416 return; 13417 } 13418 13419 if (nl80211_reg_change_event_fill(msg, request) == false) 13420 goto nla_put_failure; 13421 13422 genlmsg_end(msg, hdr); 13423 13424 rcu_read_lock(); 13425 genlmsg_multicast_allns(&nl80211_fam, msg, 0, 13426 NL80211_MCGRP_REGULATORY, GFP_ATOMIC); 13427 rcu_read_unlock(); 13428 13429 return; 13430 13431 nla_put_failure: 13432 genlmsg_cancel(msg, hdr); 13433 nlmsg_free(msg); 13434 } 13435 13436 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev, 13437 struct net_device *netdev, 13438 const u8 *buf, size_t len, 13439 enum nl80211_commands cmd, gfp_t gfp, 13440 int uapsd_queues) 13441 { 13442 struct sk_buff *msg; 13443 void *hdr; 13444 13445 msg = nlmsg_new(100 + len, gfp); 13446 if (!msg) 13447 return; 13448 13449 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 13450 if (!hdr) { 13451 nlmsg_free(msg); 13452 return; 13453 } 13454 13455 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 13456 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 13457 nla_put(msg, NL80211_ATTR_FRAME, len, buf)) 13458 goto nla_put_failure; 13459 13460 if (uapsd_queues >= 0) { 13461 struct nlattr *nla_wmm = 13462 nla_nest_start(msg, NL80211_ATTR_STA_WME); 13463 if (!nla_wmm) 13464 goto nla_put_failure; 13465 13466 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES, 13467 uapsd_queues)) 13468 goto nla_put_failure; 13469 13470 nla_nest_end(msg, nla_wmm); 13471 } 13472 13473 genlmsg_end(msg, hdr); 13474 13475 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13476 NL80211_MCGRP_MLME, gfp); 13477 return; 13478 13479 nla_put_failure: 13480 genlmsg_cancel(msg, hdr); 13481 nlmsg_free(msg); 13482 } 13483 13484 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev, 13485 struct net_device *netdev, const u8 *buf, 13486 size_t len, gfp_t gfp) 13487 { 13488 nl80211_send_mlme_event(rdev, netdev, buf, len, 13489 NL80211_CMD_AUTHENTICATE, gfp, -1); 13490 } 13491 13492 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev, 13493 struct net_device *netdev, const u8 *buf, 13494 size_t len, gfp_t gfp, int uapsd_queues) 13495 { 13496 nl80211_send_mlme_event(rdev, netdev, buf, len, 13497 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues); 13498 } 13499 13500 void nl80211_send_deauth(struct cfg80211_registered_device *rdev, 13501 struct net_device *netdev, const u8 *buf, 13502 size_t len, gfp_t gfp) 13503 { 13504 nl80211_send_mlme_event(rdev, netdev, buf, len, 13505 NL80211_CMD_DEAUTHENTICATE, gfp, -1); 13506 } 13507 13508 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev, 13509 struct net_device *netdev, const u8 *buf, 13510 size_t len, gfp_t gfp) 13511 { 13512 nl80211_send_mlme_event(rdev, netdev, buf, len, 13513 NL80211_CMD_DISASSOCIATE, gfp, -1); 13514 } 13515 13516 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf, 13517 size_t len) 13518 { 13519 struct wireless_dev *wdev = dev->ieee80211_ptr; 13520 struct wiphy *wiphy = wdev->wiphy; 13521 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 13522 const struct ieee80211_mgmt *mgmt = (void *)buf; 13523 u32 cmd; 13524 13525 if (WARN_ON(len < 2)) 13526 return; 13527 13528 if (ieee80211_is_deauth(mgmt->frame_control)) 13529 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE; 13530 else 13531 cmd = NL80211_CMD_UNPROT_DISASSOCIATE; 13532 13533 trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len); 13534 nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1); 13535 } 13536 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt); 13537 13538 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev, 13539 struct net_device *netdev, int cmd, 13540 const u8 *addr, gfp_t gfp) 13541 { 13542 struct sk_buff *msg; 13543 void *hdr; 13544 13545 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 13546 if (!msg) 13547 return; 13548 13549 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 13550 if (!hdr) { 13551 nlmsg_free(msg); 13552 return; 13553 } 13554 13555 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 13556 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 13557 nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) || 13558 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) 13559 goto nla_put_failure; 13560 13561 genlmsg_end(msg, hdr); 13562 13563 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13564 NL80211_MCGRP_MLME, gfp); 13565 return; 13566 13567 nla_put_failure: 13568 genlmsg_cancel(msg, hdr); 13569 nlmsg_free(msg); 13570 } 13571 13572 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev, 13573 struct net_device *netdev, const u8 *addr, 13574 gfp_t gfp) 13575 { 13576 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE, 13577 addr, gfp); 13578 } 13579 13580 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev, 13581 struct net_device *netdev, const u8 *addr, 13582 gfp_t gfp) 13583 { 13584 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE, 13585 addr, gfp); 13586 } 13587 13588 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev, 13589 struct net_device *netdev, 13590 struct cfg80211_connect_resp_params *cr, 13591 gfp_t gfp) 13592 { 13593 struct sk_buff *msg; 13594 void *hdr; 13595 13596 msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len + 13597 cr->fils_kek_len + cr->pmk_len + 13598 (cr->pmkid ? WLAN_PMKID_LEN : 0), gfp); 13599 if (!msg) 13600 return; 13601 13602 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT); 13603 if (!hdr) { 13604 nlmsg_free(msg); 13605 return; 13606 } 13607 13608 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 13609 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 13610 (cr->bssid && 13611 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cr->bssid)) || 13612 nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, 13613 cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE : 13614 cr->status) || 13615 (cr->status < 0 && 13616 (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) || 13617 nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON, 13618 cr->timeout_reason))) || 13619 (cr->req_ie && 13620 nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) || 13621 (cr->resp_ie && 13622 nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len, 13623 cr->resp_ie)) || 13624 (cr->update_erp_next_seq_num && 13625 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM, 13626 cr->fils_erp_next_seq_num)) || 13627 (cr->status == WLAN_STATUS_SUCCESS && 13628 ((cr->fils_kek && 13629 nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils_kek_len, 13630 cr->fils_kek)) || 13631 (cr->pmk && 13632 nla_put(msg, NL80211_ATTR_PMK, cr->pmk_len, cr->pmk)) || 13633 (cr->pmkid && 13634 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->pmkid))))) 13635 goto nla_put_failure; 13636 13637 genlmsg_end(msg, hdr); 13638 13639 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13640 NL80211_MCGRP_MLME, gfp); 13641 return; 13642 13643 nla_put_failure: 13644 genlmsg_cancel(msg, hdr); 13645 nlmsg_free(msg); 13646 } 13647 13648 void nl80211_send_roamed(struct cfg80211_registered_device *rdev, 13649 struct net_device *netdev, 13650 struct cfg80211_roam_info *info, gfp_t gfp) 13651 { 13652 struct sk_buff *msg; 13653 void *hdr; 13654 const u8 *bssid = info->bss ? info->bss->bssid : info->bssid; 13655 13656 msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len, gfp); 13657 if (!msg) 13658 return; 13659 13660 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM); 13661 if (!hdr) { 13662 nlmsg_free(msg); 13663 return; 13664 } 13665 13666 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 13667 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 13668 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) || 13669 (info->req_ie && 13670 nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len, 13671 info->req_ie)) || 13672 (info->resp_ie && 13673 nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len, 13674 info->resp_ie))) 13675 goto nla_put_failure; 13676 13677 genlmsg_end(msg, hdr); 13678 13679 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13680 NL80211_MCGRP_MLME, gfp); 13681 return; 13682 13683 nla_put_failure: 13684 genlmsg_cancel(msg, hdr); 13685 nlmsg_free(msg); 13686 } 13687 13688 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev, 13689 struct net_device *netdev, u16 reason, 13690 const u8 *ie, size_t ie_len, bool from_ap) 13691 { 13692 struct sk_buff *msg; 13693 void *hdr; 13694 13695 msg = nlmsg_new(100 + ie_len, GFP_KERNEL); 13696 if (!msg) 13697 return; 13698 13699 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT); 13700 if (!hdr) { 13701 nlmsg_free(msg); 13702 return; 13703 } 13704 13705 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 13706 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 13707 (from_ap && reason && 13708 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) || 13709 (from_ap && 13710 nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) || 13711 (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie))) 13712 goto nla_put_failure; 13713 13714 genlmsg_end(msg, hdr); 13715 13716 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13717 NL80211_MCGRP_MLME, GFP_KERNEL); 13718 return; 13719 13720 nla_put_failure: 13721 genlmsg_cancel(msg, hdr); 13722 nlmsg_free(msg); 13723 } 13724 13725 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev, 13726 struct net_device *netdev, const u8 *bssid, 13727 gfp_t gfp) 13728 { 13729 struct sk_buff *msg; 13730 void *hdr; 13731 13732 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 13733 if (!msg) 13734 return; 13735 13736 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS); 13737 if (!hdr) { 13738 nlmsg_free(msg); 13739 return; 13740 } 13741 13742 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 13743 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 13744 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) 13745 goto nla_put_failure; 13746 13747 genlmsg_end(msg, hdr); 13748 13749 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13750 NL80211_MCGRP_MLME, gfp); 13751 return; 13752 13753 nla_put_failure: 13754 genlmsg_cancel(msg, hdr); 13755 nlmsg_free(msg); 13756 } 13757 13758 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr, 13759 const u8* ie, u8 ie_len, gfp_t gfp) 13760 { 13761 struct wireless_dev *wdev = dev->ieee80211_ptr; 13762 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 13763 struct sk_buff *msg; 13764 void *hdr; 13765 13766 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT)) 13767 return; 13768 13769 trace_cfg80211_notify_new_peer_candidate(dev, addr); 13770 13771 msg = nlmsg_new(100 + ie_len, gfp); 13772 if (!msg) 13773 return; 13774 13775 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE); 13776 if (!hdr) { 13777 nlmsg_free(msg); 13778 return; 13779 } 13780 13781 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 13782 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 13783 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) || 13784 (ie_len && ie && 13785 nla_put(msg, NL80211_ATTR_IE, ie_len , ie))) 13786 goto nla_put_failure; 13787 13788 genlmsg_end(msg, hdr); 13789 13790 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13791 NL80211_MCGRP_MLME, gfp); 13792 return; 13793 13794 nla_put_failure: 13795 genlmsg_cancel(msg, hdr); 13796 nlmsg_free(msg); 13797 } 13798 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate); 13799 13800 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev, 13801 struct net_device *netdev, const u8 *addr, 13802 enum nl80211_key_type key_type, int key_id, 13803 const u8 *tsc, gfp_t gfp) 13804 { 13805 struct sk_buff *msg; 13806 void *hdr; 13807 13808 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 13809 if (!msg) 13810 return; 13811 13812 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE); 13813 if (!hdr) { 13814 nlmsg_free(msg); 13815 return; 13816 } 13817 13818 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 13819 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 13820 (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) || 13821 nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) || 13822 (key_id != -1 && 13823 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) || 13824 (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc))) 13825 goto nla_put_failure; 13826 13827 genlmsg_end(msg, hdr); 13828 13829 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13830 NL80211_MCGRP_MLME, gfp); 13831 return; 13832 13833 nla_put_failure: 13834 genlmsg_cancel(msg, hdr); 13835 nlmsg_free(msg); 13836 } 13837 13838 void nl80211_send_beacon_hint_event(struct wiphy *wiphy, 13839 struct ieee80211_channel *channel_before, 13840 struct ieee80211_channel *channel_after) 13841 { 13842 struct sk_buff *msg; 13843 void *hdr; 13844 struct nlattr *nl_freq; 13845 13846 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); 13847 if (!msg) 13848 return; 13849 13850 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT); 13851 if (!hdr) { 13852 nlmsg_free(msg); 13853 return; 13854 } 13855 13856 /* 13857 * Since we are applying the beacon hint to a wiphy we know its 13858 * wiphy_idx is valid 13859 */ 13860 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy))) 13861 goto nla_put_failure; 13862 13863 /* Before */ 13864 nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE); 13865 if (!nl_freq) 13866 goto nla_put_failure; 13867 if (nl80211_msg_put_channel(msg, channel_before, false)) 13868 goto nla_put_failure; 13869 nla_nest_end(msg, nl_freq); 13870 13871 /* After */ 13872 nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER); 13873 if (!nl_freq) 13874 goto nla_put_failure; 13875 if (nl80211_msg_put_channel(msg, channel_after, false)) 13876 goto nla_put_failure; 13877 nla_nest_end(msg, nl_freq); 13878 13879 genlmsg_end(msg, hdr); 13880 13881 rcu_read_lock(); 13882 genlmsg_multicast_allns(&nl80211_fam, msg, 0, 13883 NL80211_MCGRP_REGULATORY, GFP_ATOMIC); 13884 rcu_read_unlock(); 13885 13886 return; 13887 13888 nla_put_failure: 13889 genlmsg_cancel(msg, hdr); 13890 nlmsg_free(msg); 13891 } 13892 13893 static void nl80211_send_remain_on_chan_event( 13894 int cmd, struct cfg80211_registered_device *rdev, 13895 struct wireless_dev *wdev, u64 cookie, 13896 struct ieee80211_channel *chan, 13897 unsigned int duration, gfp_t gfp) 13898 { 13899 struct sk_buff *msg; 13900 void *hdr; 13901 13902 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 13903 if (!msg) 13904 return; 13905 13906 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 13907 if (!hdr) { 13908 nlmsg_free(msg); 13909 return; 13910 } 13911 13912 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 13913 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 13914 wdev->netdev->ifindex)) || 13915 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 13916 NL80211_ATTR_PAD) || 13917 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) || 13918 nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, 13919 NL80211_CHAN_NO_HT) || 13920 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 13921 NL80211_ATTR_PAD)) 13922 goto nla_put_failure; 13923 13924 if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL && 13925 nla_put_u32(msg, NL80211_ATTR_DURATION, duration)) 13926 goto nla_put_failure; 13927 13928 genlmsg_end(msg, hdr); 13929 13930 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13931 NL80211_MCGRP_MLME, gfp); 13932 return; 13933 13934 nla_put_failure: 13935 genlmsg_cancel(msg, hdr); 13936 nlmsg_free(msg); 13937 } 13938 13939 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie, 13940 struct ieee80211_channel *chan, 13941 unsigned int duration, gfp_t gfp) 13942 { 13943 struct wiphy *wiphy = wdev->wiphy; 13944 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 13945 13946 trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration); 13947 nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL, 13948 rdev, wdev, cookie, chan, 13949 duration, gfp); 13950 } 13951 EXPORT_SYMBOL(cfg80211_ready_on_channel); 13952 13953 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie, 13954 struct ieee80211_channel *chan, 13955 gfp_t gfp) 13956 { 13957 struct wiphy *wiphy = wdev->wiphy; 13958 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 13959 13960 trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan); 13961 nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL, 13962 rdev, wdev, cookie, chan, 0, gfp); 13963 } 13964 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired); 13965 13966 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr, 13967 struct station_info *sinfo, gfp_t gfp) 13968 { 13969 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy; 13970 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 13971 struct sk_buff *msg; 13972 13973 trace_cfg80211_new_sta(dev, mac_addr, sinfo); 13974 13975 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 13976 if (!msg) 13977 return; 13978 13979 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0, 13980 rdev, dev, mac_addr, sinfo) < 0) { 13981 nlmsg_free(msg); 13982 return; 13983 } 13984 13985 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 13986 NL80211_MCGRP_MLME, gfp); 13987 } 13988 EXPORT_SYMBOL(cfg80211_new_sta); 13989 13990 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr, 13991 struct station_info *sinfo, gfp_t gfp) 13992 { 13993 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy; 13994 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 13995 struct sk_buff *msg; 13996 struct station_info empty_sinfo = {}; 13997 13998 if (!sinfo) 13999 sinfo = &empty_sinfo; 14000 14001 trace_cfg80211_del_sta(dev, mac_addr); 14002 14003 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14004 if (!msg) 14005 return; 14006 14007 if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0, 14008 rdev, dev, mac_addr, sinfo) < 0) { 14009 nlmsg_free(msg); 14010 return; 14011 } 14012 14013 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14014 NL80211_MCGRP_MLME, gfp); 14015 } 14016 EXPORT_SYMBOL(cfg80211_del_sta_sinfo); 14017 14018 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr, 14019 enum nl80211_connect_failed_reason reason, 14020 gfp_t gfp) 14021 { 14022 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy; 14023 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14024 struct sk_buff *msg; 14025 void *hdr; 14026 14027 msg = nlmsg_new(NLMSG_GOODSIZE, gfp); 14028 if (!msg) 14029 return; 14030 14031 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED); 14032 if (!hdr) { 14033 nlmsg_free(msg); 14034 return; 14035 } 14036 14037 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 14038 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) || 14039 nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason)) 14040 goto nla_put_failure; 14041 14042 genlmsg_end(msg, hdr); 14043 14044 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14045 NL80211_MCGRP_MLME, gfp); 14046 return; 14047 14048 nla_put_failure: 14049 genlmsg_cancel(msg, hdr); 14050 nlmsg_free(msg); 14051 } 14052 EXPORT_SYMBOL(cfg80211_conn_failed); 14053 14054 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd, 14055 const u8 *addr, gfp_t gfp) 14056 { 14057 struct wireless_dev *wdev = dev->ieee80211_ptr; 14058 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 14059 struct sk_buff *msg; 14060 void *hdr; 14061 u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid); 14062 14063 if (!nlportid) 14064 return false; 14065 14066 msg = nlmsg_new(100, gfp); 14067 if (!msg) 14068 return true; 14069 14070 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd); 14071 if (!hdr) { 14072 nlmsg_free(msg); 14073 return true; 14074 } 14075 14076 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14077 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 14078 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) 14079 goto nla_put_failure; 14080 14081 genlmsg_end(msg, hdr); 14082 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 14083 return true; 14084 14085 nla_put_failure: 14086 genlmsg_cancel(msg, hdr); 14087 nlmsg_free(msg); 14088 return true; 14089 } 14090 14091 bool cfg80211_rx_spurious_frame(struct net_device *dev, 14092 const u8 *addr, gfp_t gfp) 14093 { 14094 struct wireless_dev *wdev = dev->ieee80211_ptr; 14095 bool ret; 14096 14097 trace_cfg80211_rx_spurious_frame(dev, addr); 14098 14099 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP && 14100 wdev->iftype != NL80211_IFTYPE_P2P_GO)) { 14101 trace_cfg80211_return_bool(false); 14102 return false; 14103 } 14104 ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME, 14105 addr, gfp); 14106 trace_cfg80211_return_bool(ret); 14107 return ret; 14108 } 14109 EXPORT_SYMBOL(cfg80211_rx_spurious_frame); 14110 14111 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev, 14112 const u8 *addr, gfp_t gfp) 14113 { 14114 struct wireless_dev *wdev = dev->ieee80211_ptr; 14115 bool ret; 14116 14117 trace_cfg80211_rx_unexpected_4addr_frame(dev, addr); 14118 14119 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP && 14120 wdev->iftype != NL80211_IFTYPE_P2P_GO && 14121 wdev->iftype != NL80211_IFTYPE_AP_VLAN)) { 14122 trace_cfg80211_return_bool(false); 14123 return false; 14124 } 14125 ret = __nl80211_unexpected_frame(dev, 14126 NL80211_CMD_UNEXPECTED_4ADDR_FRAME, 14127 addr, gfp); 14128 trace_cfg80211_return_bool(ret); 14129 return ret; 14130 } 14131 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame); 14132 14133 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev, 14134 struct wireless_dev *wdev, u32 nlportid, 14135 int freq, int sig_dbm, 14136 const u8 *buf, size_t len, u32 flags, gfp_t gfp) 14137 { 14138 struct net_device *netdev = wdev->netdev; 14139 struct sk_buff *msg; 14140 void *hdr; 14141 14142 msg = nlmsg_new(100 + len, gfp); 14143 if (!msg) 14144 return -ENOMEM; 14145 14146 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME); 14147 if (!hdr) { 14148 nlmsg_free(msg); 14149 return -ENOMEM; 14150 } 14151 14152 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14153 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 14154 netdev->ifindex)) || 14155 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 14156 NL80211_ATTR_PAD) || 14157 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) || 14158 (sig_dbm && 14159 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) || 14160 nla_put(msg, NL80211_ATTR_FRAME, len, buf) || 14161 (flags && 14162 nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags))) 14163 goto nla_put_failure; 14164 14165 genlmsg_end(msg, hdr); 14166 14167 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 14168 14169 nla_put_failure: 14170 genlmsg_cancel(msg, hdr); 14171 nlmsg_free(msg); 14172 return -ENOBUFS; 14173 } 14174 14175 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie, 14176 const u8 *buf, size_t len, bool ack, gfp_t gfp) 14177 { 14178 struct wiphy *wiphy = wdev->wiphy; 14179 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14180 struct net_device *netdev = wdev->netdev; 14181 struct sk_buff *msg; 14182 void *hdr; 14183 14184 trace_cfg80211_mgmt_tx_status(wdev, cookie, ack); 14185 14186 msg = nlmsg_new(100 + len, gfp); 14187 if (!msg) 14188 return; 14189 14190 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS); 14191 if (!hdr) { 14192 nlmsg_free(msg); 14193 return; 14194 } 14195 14196 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14197 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 14198 netdev->ifindex)) || 14199 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 14200 NL80211_ATTR_PAD) || 14201 nla_put(msg, NL80211_ATTR_FRAME, len, buf) || 14202 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 14203 NL80211_ATTR_PAD) || 14204 (ack && nla_put_flag(msg, NL80211_ATTR_ACK))) 14205 goto nla_put_failure; 14206 14207 genlmsg_end(msg, hdr); 14208 14209 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14210 NL80211_MCGRP_MLME, gfp); 14211 return; 14212 14213 nla_put_failure: 14214 genlmsg_cancel(msg, hdr); 14215 nlmsg_free(msg); 14216 } 14217 EXPORT_SYMBOL(cfg80211_mgmt_tx_status); 14218 14219 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev, 14220 const char *mac, gfp_t gfp) 14221 { 14222 struct wireless_dev *wdev = dev->ieee80211_ptr; 14223 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 14224 struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14225 void **cb; 14226 14227 if (!msg) 14228 return NULL; 14229 14230 cb = (void **)msg->cb; 14231 14232 cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM); 14233 if (!cb[0]) { 14234 nlmsg_free(msg); 14235 return NULL; 14236 } 14237 14238 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14239 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex)) 14240 goto nla_put_failure; 14241 14242 if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac)) 14243 goto nla_put_failure; 14244 14245 cb[1] = nla_nest_start(msg, NL80211_ATTR_CQM); 14246 if (!cb[1]) 14247 goto nla_put_failure; 14248 14249 cb[2] = rdev; 14250 14251 return msg; 14252 nla_put_failure: 14253 nlmsg_free(msg); 14254 return NULL; 14255 } 14256 14257 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp) 14258 { 14259 void **cb = (void **)msg->cb; 14260 struct cfg80211_registered_device *rdev = cb[2]; 14261 14262 nla_nest_end(msg, cb[1]); 14263 genlmsg_end(msg, cb[0]); 14264 14265 memset(msg->cb, 0, sizeof(msg->cb)); 14266 14267 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14268 NL80211_MCGRP_MLME, gfp); 14269 } 14270 14271 void cfg80211_cqm_rssi_notify(struct net_device *dev, 14272 enum nl80211_cqm_rssi_threshold_event rssi_event, 14273 s32 rssi_level, gfp_t gfp) 14274 { 14275 struct sk_buff *msg; 14276 struct wireless_dev *wdev = dev->ieee80211_ptr; 14277 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 14278 14279 trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level); 14280 14281 if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW && 14282 rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH)) 14283 return; 14284 14285 if (wdev->cqm_config) { 14286 wdev->cqm_config->last_rssi_event_value = rssi_level; 14287 14288 cfg80211_cqm_rssi_update(rdev, dev); 14289 14290 if (rssi_level == 0) 14291 rssi_level = wdev->cqm_config->last_rssi_event_value; 14292 } 14293 14294 msg = cfg80211_prepare_cqm(dev, NULL, gfp); 14295 if (!msg) 14296 return; 14297 14298 if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT, 14299 rssi_event)) 14300 goto nla_put_failure; 14301 14302 if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL, 14303 rssi_level)) 14304 goto nla_put_failure; 14305 14306 cfg80211_send_cqm(msg, gfp); 14307 14308 return; 14309 14310 nla_put_failure: 14311 nlmsg_free(msg); 14312 } 14313 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify); 14314 14315 void cfg80211_cqm_txe_notify(struct net_device *dev, 14316 const u8 *peer, u32 num_packets, 14317 u32 rate, u32 intvl, gfp_t gfp) 14318 { 14319 struct sk_buff *msg; 14320 14321 msg = cfg80211_prepare_cqm(dev, peer, gfp); 14322 if (!msg) 14323 return; 14324 14325 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets)) 14326 goto nla_put_failure; 14327 14328 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate)) 14329 goto nla_put_failure; 14330 14331 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl)) 14332 goto nla_put_failure; 14333 14334 cfg80211_send_cqm(msg, gfp); 14335 return; 14336 14337 nla_put_failure: 14338 nlmsg_free(msg); 14339 } 14340 EXPORT_SYMBOL(cfg80211_cqm_txe_notify); 14341 14342 void cfg80211_cqm_pktloss_notify(struct net_device *dev, 14343 const u8 *peer, u32 num_packets, gfp_t gfp) 14344 { 14345 struct sk_buff *msg; 14346 14347 trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets); 14348 14349 msg = cfg80211_prepare_cqm(dev, peer, gfp); 14350 if (!msg) 14351 return; 14352 14353 if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets)) 14354 goto nla_put_failure; 14355 14356 cfg80211_send_cqm(msg, gfp); 14357 return; 14358 14359 nla_put_failure: 14360 nlmsg_free(msg); 14361 } 14362 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify); 14363 14364 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp) 14365 { 14366 struct sk_buff *msg; 14367 14368 msg = cfg80211_prepare_cqm(dev, NULL, gfp); 14369 if (!msg) 14370 return; 14371 14372 if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT)) 14373 goto nla_put_failure; 14374 14375 cfg80211_send_cqm(msg, gfp); 14376 return; 14377 14378 nla_put_failure: 14379 nlmsg_free(msg); 14380 } 14381 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify); 14382 14383 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev, 14384 struct net_device *netdev, const u8 *bssid, 14385 const u8 *replay_ctr, gfp_t gfp) 14386 { 14387 struct sk_buff *msg; 14388 struct nlattr *rekey_attr; 14389 void *hdr; 14390 14391 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14392 if (!msg) 14393 return; 14394 14395 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD); 14396 if (!hdr) { 14397 nlmsg_free(msg); 14398 return; 14399 } 14400 14401 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14402 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 14403 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) 14404 goto nla_put_failure; 14405 14406 rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA); 14407 if (!rekey_attr) 14408 goto nla_put_failure; 14409 14410 if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR, 14411 NL80211_REPLAY_CTR_LEN, replay_ctr)) 14412 goto nla_put_failure; 14413 14414 nla_nest_end(msg, rekey_attr); 14415 14416 genlmsg_end(msg, hdr); 14417 14418 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14419 NL80211_MCGRP_MLME, gfp); 14420 return; 14421 14422 nla_put_failure: 14423 genlmsg_cancel(msg, hdr); 14424 nlmsg_free(msg); 14425 } 14426 14427 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid, 14428 const u8 *replay_ctr, gfp_t gfp) 14429 { 14430 struct wireless_dev *wdev = dev->ieee80211_ptr; 14431 struct wiphy *wiphy = wdev->wiphy; 14432 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14433 14434 trace_cfg80211_gtk_rekey_notify(dev, bssid); 14435 nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp); 14436 } 14437 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify); 14438 14439 static void 14440 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev, 14441 struct net_device *netdev, int index, 14442 const u8 *bssid, bool preauth, gfp_t gfp) 14443 { 14444 struct sk_buff *msg; 14445 struct nlattr *attr; 14446 void *hdr; 14447 14448 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14449 if (!msg) 14450 return; 14451 14452 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE); 14453 if (!hdr) { 14454 nlmsg_free(msg); 14455 return; 14456 } 14457 14458 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14459 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex)) 14460 goto nla_put_failure; 14461 14462 attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE); 14463 if (!attr) 14464 goto nla_put_failure; 14465 14466 if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) || 14467 nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) || 14468 (preauth && 14469 nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH))) 14470 goto nla_put_failure; 14471 14472 nla_nest_end(msg, attr); 14473 14474 genlmsg_end(msg, hdr); 14475 14476 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14477 NL80211_MCGRP_MLME, gfp); 14478 return; 14479 14480 nla_put_failure: 14481 genlmsg_cancel(msg, hdr); 14482 nlmsg_free(msg); 14483 } 14484 14485 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index, 14486 const u8 *bssid, bool preauth, gfp_t gfp) 14487 { 14488 struct wireless_dev *wdev = dev->ieee80211_ptr; 14489 struct wiphy *wiphy = wdev->wiphy; 14490 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14491 14492 trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth); 14493 nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp); 14494 } 14495 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify); 14496 14497 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev, 14498 struct net_device *netdev, 14499 struct cfg80211_chan_def *chandef, 14500 gfp_t gfp, 14501 enum nl80211_commands notif, 14502 u8 count) 14503 { 14504 struct sk_buff *msg; 14505 void *hdr; 14506 14507 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14508 if (!msg) 14509 return; 14510 14511 hdr = nl80211hdr_put(msg, 0, 0, 0, notif); 14512 if (!hdr) { 14513 nlmsg_free(msg); 14514 return; 14515 } 14516 14517 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex)) 14518 goto nla_put_failure; 14519 14520 if (nl80211_send_chandef(msg, chandef)) 14521 goto nla_put_failure; 14522 14523 if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) && 14524 (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count))) 14525 goto nla_put_failure; 14526 14527 genlmsg_end(msg, hdr); 14528 14529 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14530 NL80211_MCGRP_MLME, gfp); 14531 return; 14532 14533 nla_put_failure: 14534 genlmsg_cancel(msg, hdr); 14535 nlmsg_free(msg); 14536 } 14537 14538 void cfg80211_ch_switch_notify(struct net_device *dev, 14539 struct cfg80211_chan_def *chandef) 14540 { 14541 struct wireless_dev *wdev = dev->ieee80211_ptr; 14542 struct wiphy *wiphy = wdev->wiphy; 14543 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14544 14545 ASSERT_WDEV_LOCK(wdev); 14546 14547 trace_cfg80211_ch_switch_notify(dev, chandef); 14548 14549 wdev->chandef = *chandef; 14550 wdev->preset_chandef = *chandef; 14551 nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL, 14552 NL80211_CMD_CH_SWITCH_NOTIFY, 0); 14553 } 14554 EXPORT_SYMBOL(cfg80211_ch_switch_notify); 14555 14556 void cfg80211_ch_switch_started_notify(struct net_device *dev, 14557 struct cfg80211_chan_def *chandef, 14558 u8 count) 14559 { 14560 struct wireless_dev *wdev = dev->ieee80211_ptr; 14561 struct wiphy *wiphy = wdev->wiphy; 14562 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14563 14564 trace_cfg80211_ch_switch_started_notify(dev, chandef); 14565 14566 nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL, 14567 NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count); 14568 } 14569 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify); 14570 14571 void 14572 nl80211_radar_notify(struct cfg80211_registered_device *rdev, 14573 const struct cfg80211_chan_def *chandef, 14574 enum nl80211_radar_event event, 14575 struct net_device *netdev, gfp_t gfp) 14576 { 14577 struct sk_buff *msg; 14578 void *hdr; 14579 14580 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14581 if (!msg) 14582 return; 14583 14584 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT); 14585 if (!hdr) { 14586 nlmsg_free(msg); 14587 return; 14588 } 14589 14590 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx)) 14591 goto nla_put_failure; 14592 14593 /* NOP and radar events don't need a netdev parameter */ 14594 if (netdev) { 14595 struct wireless_dev *wdev = netdev->ieee80211_ptr; 14596 14597 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 14598 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 14599 NL80211_ATTR_PAD)) 14600 goto nla_put_failure; 14601 } 14602 14603 if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event)) 14604 goto nla_put_failure; 14605 14606 if (nl80211_send_chandef(msg, chandef)) 14607 goto nla_put_failure; 14608 14609 genlmsg_end(msg, hdr); 14610 14611 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14612 NL80211_MCGRP_MLME, gfp); 14613 return; 14614 14615 nla_put_failure: 14616 genlmsg_cancel(msg, hdr); 14617 nlmsg_free(msg); 14618 } 14619 14620 void cfg80211_probe_status(struct net_device *dev, const u8 *addr, 14621 u64 cookie, bool acked, gfp_t gfp) 14622 { 14623 struct wireless_dev *wdev = dev->ieee80211_ptr; 14624 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 14625 struct sk_buff *msg; 14626 void *hdr; 14627 14628 trace_cfg80211_probe_status(dev, addr, cookie, acked); 14629 14630 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14631 14632 if (!msg) 14633 return; 14634 14635 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT); 14636 if (!hdr) { 14637 nlmsg_free(msg); 14638 return; 14639 } 14640 14641 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14642 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 14643 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) || 14644 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie, 14645 NL80211_ATTR_PAD) || 14646 (acked && nla_put_flag(msg, NL80211_ATTR_ACK))) 14647 goto nla_put_failure; 14648 14649 genlmsg_end(msg, hdr); 14650 14651 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14652 NL80211_MCGRP_MLME, gfp); 14653 return; 14654 14655 nla_put_failure: 14656 genlmsg_cancel(msg, hdr); 14657 nlmsg_free(msg); 14658 } 14659 EXPORT_SYMBOL(cfg80211_probe_status); 14660 14661 void cfg80211_report_obss_beacon(struct wiphy *wiphy, 14662 const u8 *frame, size_t len, 14663 int freq, int sig_dbm) 14664 { 14665 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14666 struct sk_buff *msg; 14667 void *hdr; 14668 struct cfg80211_beacon_registration *reg; 14669 14670 trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm); 14671 14672 spin_lock_bh(&rdev->beacon_registrations_lock); 14673 list_for_each_entry(reg, &rdev->beacon_registrations, list) { 14674 msg = nlmsg_new(len + 100, GFP_ATOMIC); 14675 if (!msg) { 14676 spin_unlock_bh(&rdev->beacon_registrations_lock); 14677 return; 14678 } 14679 14680 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME); 14681 if (!hdr) 14682 goto nla_put_failure; 14683 14684 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14685 (freq && 14686 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) || 14687 (sig_dbm && 14688 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) || 14689 nla_put(msg, NL80211_ATTR_FRAME, len, frame)) 14690 goto nla_put_failure; 14691 14692 genlmsg_end(msg, hdr); 14693 14694 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid); 14695 } 14696 spin_unlock_bh(&rdev->beacon_registrations_lock); 14697 return; 14698 14699 nla_put_failure: 14700 spin_unlock_bh(&rdev->beacon_registrations_lock); 14701 if (hdr) 14702 genlmsg_cancel(msg, hdr); 14703 nlmsg_free(msg); 14704 } 14705 EXPORT_SYMBOL(cfg80211_report_obss_beacon); 14706 14707 #ifdef CONFIG_PM 14708 static int cfg80211_net_detect_results(struct sk_buff *msg, 14709 struct cfg80211_wowlan_wakeup *wakeup) 14710 { 14711 struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect; 14712 struct nlattr *nl_results, *nl_match, *nl_freqs; 14713 int i, j; 14714 14715 nl_results = nla_nest_start( 14716 msg, NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS); 14717 if (!nl_results) 14718 return -EMSGSIZE; 14719 14720 for (i = 0; i < nd->n_matches; i++) { 14721 struct cfg80211_wowlan_nd_match *match = nd->matches[i]; 14722 14723 nl_match = nla_nest_start(msg, i); 14724 if (!nl_match) 14725 break; 14726 14727 /* The SSID attribute is optional in nl80211, but for 14728 * simplicity reasons it's always present in the 14729 * cfg80211 structure. If a driver can't pass the 14730 * SSID, that needs to be changed. A zero length SSID 14731 * is still a valid SSID (wildcard), so it cannot be 14732 * used for this purpose. 14733 */ 14734 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len, 14735 match->ssid.ssid)) { 14736 nla_nest_cancel(msg, nl_match); 14737 goto out; 14738 } 14739 14740 if (match->n_channels) { 14741 nl_freqs = nla_nest_start( 14742 msg, NL80211_ATTR_SCAN_FREQUENCIES); 14743 if (!nl_freqs) { 14744 nla_nest_cancel(msg, nl_match); 14745 goto out; 14746 } 14747 14748 for (j = 0; j < match->n_channels; j++) { 14749 if (nla_put_u32(msg, j, match->channels[j])) { 14750 nla_nest_cancel(msg, nl_freqs); 14751 nla_nest_cancel(msg, nl_match); 14752 goto out; 14753 } 14754 } 14755 14756 nla_nest_end(msg, nl_freqs); 14757 } 14758 14759 nla_nest_end(msg, nl_match); 14760 } 14761 14762 out: 14763 nla_nest_end(msg, nl_results); 14764 return 0; 14765 } 14766 14767 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev, 14768 struct cfg80211_wowlan_wakeup *wakeup, 14769 gfp_t gfp) 14770 { 14771 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 14772 struct sk_buff *msg; 14773 void *hdr; 14774 int size = 200; 14775 14776 trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup); 14777 14778 if (wakeup) 14779 size += wakeup->packet_present_len; 14780 14781 msg = nlmsg_new(size, gfp); 14782 if (!msg) 14783 return; 14784 14785 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN); 14786 if (!hdr) 14787 goto free_msg; 14788 14789 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14790 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 14791 NL80211_ATTR_PAD)) 14792 goto free_msg; 14793 14794 if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX, 14795 wdev->netdev->ifindex)) 14796 goto free_msg; 14797 14798 if (wakeup) { 14799 struct nlattr *reasons; 14800 14801 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS); 14802 if (!reasons) 14803 goto free_msg; 14804 14805 if (wakeup->disconnect && 14806 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) 14807 goto free_msg; 14808 if (wakeup->magic_pkt && 14809 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) 14810 goto free_msg; 14811 if (wakeup->gtk_rekey_failure && 14812 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) 14813 goto free_msg; 14814 if (wakeup->eap_identity_req && 14815 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) 14816 goto free_msg; 14817 if (wakeup->four_way_handshake && 14818 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) 14819 goto free_msg; 14820 if (wakeup->rfkill_release && 14821 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)) 14822 goto free_msg; 14823 14824 if (wakeup->pattern_idx >= 0 && 14825 nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN, 14826 wakeup->pattern_idx)) 14827 goto free_msg; 14828 14829 if (wakeup->tcp_match && 14830 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH)) 14831 goto free_msg; 14832 14833 if (wakeup->tcp_connlost && 14834 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST)) 14835 goto free_msg; 14836 14837 if (wakeup->tcp_nomoretokens && 14838 nla_put_flag(msg, 14839 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS)) 14840 goto free_msg; 14841 14842 if (wakeup->packet) { 14843 u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211; 14844 u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN; 14845 14846 if (!wakeup->packet_80211) { 14847 pkt_attr = 14848 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023; 14849 len_attr = 14850 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN; 14851 } 14852 14853 if (wakeup->packet_len && 14854 nla_put_u32(msg, len_attr, wakeup->packet_len)) 14855 goto free_msg; 14856 14857 if (nla_put(msg, pkt_attr, wakeup->packet_present_len, 14858 wakeup->packet)) 14859 goto free_msg; 14860 } 14861 14862 if (wakeup->net_detect && 14863 cfg80211_net_detect_results(msg, wakeup)) 14864 goto free_msg; 14865 14866 nla_nest_end(msg, reasons); 14867 } 14868 14869 genlmsg_end(msg, hdr); 14870 14871 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14872 NL80211_MCGRP_MLME, gfp); 14873 return; 14874 14875 free_msg: 14876 nlmsg_free(msg); 14877 } 14878 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup); 14879 #endif 14880 14881 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer, 14882 enum nl80211_tdls_operation oper, 14883 u16 reason_code, gfp_t gfp) 14884 { 14885 struct wireless_dev *wdev = dev->ieee80211_ptr; 14886 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 14887 struct sk_buff *msg; 14888 void *hdr; 14889 14890 trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper, 14891 reason_code); 14892 14893 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 14894 if (!msg) 14895 return; 14896 14897 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER); 14898 if (!hdr) { 14899 nlmsg_free(msg); 14900 return; 14901 } 14902 14903 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 14904 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) || 14905 nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) || 14906 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) || 14907 (reason_code > 0 && 14908 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code))) 14909 goto nla_put_failure; 14910 14911 genlmsg_end(msg, hdr); 14912 14913 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 14914 NL80211_MCGRP_MLME, gfp); 14915 return; 14916 14917 nla_put_failure: 14918 genlmsg_cancel(msg, hdr); 14919 nlmsg_free(msg); 14920 } 14921 EXPORT_SYMBOL(cfg80211_tdls_oper_request); 14922 14923 static int nl80211_netlink_notify(struct notifier_block * nb, 14924 unsigned long state, 14925 void *_notify) 14926 { 14927 struct netlink_notify *notify = _notify; 14928 struct cfg80211_registered_device *rdev; 14929 struct wireless_dev *wdev; 14930 struct cfg80211_beacon_registration *reg, *tmp; 14931 14932 if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC) 14933 return NOTIFY_DONE; 14934 14935 rcu_read_lock(); 14936 14937 list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) { 14938 struct cfg80211_sched_scan_request *sched_scan_req; 14939 14940 list_for_each_entry_rcu(sched_scan_req, 14941 &rdev->sched_scan_req_list, 14942 list) { 14943 if (sched_scan_req->owner_nlportid == notify->portid) { 14944 sched_scan_req->nl_owner_dead = true; 14945 schedule_work(&rdev->sched_scan_stop_wk); 14946 } 14947 } 14948 14949 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) { 14950 cfg80211_mlme_unregister_socket(wdev, notify->portid); 14951 14952 if (wdev->owner_nlportid == notify->portid) { 14953 wdev->nl_owner_dead = true; 14954 schedule_work(&rdev->destroy_work); 14955 } else if (wdev->conn_owner_nlportid == notify->portid) { 14956 schedule_work(&wdev->disconnect_wk); 14957 } 14958 } 14959 14960 spin_lock_bh(&rdev->beacon_registrations_lock); 14961 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations, 14962 list) { 14963 if (reg->nlportid == notify->portid) { 14964 list_del(®->list); 14965 kfree(reg); 14966 break; 14967 } 14968 } 14969 spin_unlock_bh(&rdev->beacon_registrations_lock); 14970 } 14971 14972 rcu_read_unlock(); 14973 14974 /* 14975 * It is possible that the user space process that is controlling the 14976 * indoor setting disappeared, so notify the regulatory core. 14977 */ 14978 regulatory_netlink_notify(notify->portid); 14979 return NOTIFY_OK; 14980 } 14981 14982 static struct notifier_block nl80211_netlink_notifier = { 14983 .notifier_call = nl80211_netlink_notify, 14984 }; 14985 14986 void cfg80211_ft_event(struct net_device *netdev, 14987 struct cfg80211_ft_event_params *ft_event) 14988 { 14989 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy; 14990 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 14991 struct sk_buff *msg; 14992 void *hdr; 14993 14994 trace_cfg80211_ft_event(wiphy, netdev, ft_event); 14995 14996 if (!ft_event->target_ap) 14997 return; 14998 14999 msg = nlmsg_new(100 + ft_event->ric_ies_len, GFP_KERNEL); 15000 if (!msg) 15001 return; 15002 15003 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT); 15004 if (!hdr) 15005 goto out; 15006 15007 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15008 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) || 15009 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap)) 15010 goto out; 15011 15012 if (ft_event->ies && 15013 nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies)) 15014 goto out; 15015 if (ft_event->ric_ies && 15016 nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len, 15017 ft_event->ric_ies)) 15018 goto out; 15019 15020 genlmsg_end(msg, hdr); 15021 15022 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0, 15023 NL80211_MCGRP_MLME, GFP_KERNEL); 15024 return; 15025 out: 15026 nlmsg_free(msg); 15027 } 15028 EXPORT_SYMBOL(cfg80211_ft_event); 15029 15030 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp) 15031 { 15032 struct cfg80211_registered_device *rdev; 15033 struct sk_buff *msg; 15034 void *hdr; 15035 u32 nlportid; 15036 15037 rdev = wiphy_to_rdev(wdev->wiphy); 15038 if (!rdev->crit_proto_nlportid) 15039 return; 15040 15041 nlportid = rdev->crit_proto_nlportid; 15042 rdev->crit_proto_nlportid = 0; 15043 15044 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp); 15045 if (!msg) 15046 return; 15047 15048 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP); 15049 if (!hdr) 15050 goto nla_put_failure; 15051 15052 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15053 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 15054 NL80211_ATTR_PAD)) 15055 goto nla_put_failure; 15056 15057 genlmsg_end(msg, hdr); 15058 15059 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid); 15060 return; 15061 15062 nla_put_failure: 15063 if (hdr) 15064 genlmsg_cancel(msg, hdr); 15065 nlmsg_free(msg); 15066 } 15067 EXPORT_SYMBOL(cfg80211_crit_proto_stopped); 15068 15069 void nl80211_send_ap_stopped(struct wireless_dev *wdev) 15070 { 15071 struct wiphy *wiphy = wdev->wiphy; 15072 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 15073 struct sk_buff *msg; 15074 void *hdr; 15075 15076 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); 15077 if (!msg) 15078 return; 15079 15080 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP); 15081 if (!hdr) 15082 goto out; 15083 15084 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) || 15085 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) || 15086 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev), 15087 NL80211_ATTR_PAD)) 15088 goto out; 15089 15090 genlmsg_end(msg, hdr); 15091 15092 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0, 15093 NL80211_MCGRP_MLME, GFP_KERNEL); 15094 return; 15095 out: 15096 nlmsg_free(msg); 15097 } 15098 15099 /* initialisation/exit functions */ 15100 15101 int __init nl80211_init(void) 15102 { 15103 int err; 15104 15105 err = genl_register_family(&nl80211_fam); 15106 if (err) 15107 return err; 15108 15109 err = netlink_register_notifier(&nl80211_netlink_notifier); 15110 if (err) 15111 goto err_out; 15112 15113 return 0; 15114 err_out: 15115 genl_unregister_family(&nl80211_fam); 15116 return err; 15117 } 15118 15119 void nl80211_exit(void) 15120 { 15121 netlink_unregister_notifier(&nl80211_netlink_notifier); 15122 genl_unregister_family(&nl80211_fam); 15123 } 15124