]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blob - net/wireless/nl80211.c
projects / mirror_ubuntu-bionic-kernel.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel...
[mirror_ubuntu-bionic-kernel.git] / net / wireless / nl80211.c
1 /*
2 * This is the new netlink-based wireless configuration interface.
3 *
4 * Copyright 2006-2010 Johannes Berg <johannes@sipsolutions.net>
5 * Copyright 2013-2014 Intel Mobile Communications GmbH
6 * Copyright 2015-2017 Intel Deutschland GmbH
7 */
8
9 #include <linux/if.h>
10 #include <linux/module.h>
11 #include <linux/err.h>
12 #include <linux/slab.h>
13 #include <linux/list.h>
14 #include <linux/if_ether.h>
15 #include <linux/ieee80211.h>
16 #include <linux/nl80211.h>
17 #include <linux/rtnetlink.h>
18 #include <linux/netlink.h>
19 #include <linux/etherdevice.h>
20 #include <net/net_namespace.h>
21 #include <net/genetlink.h>
22 #include <net/cfg80211.h>
23 #include <net/sock.h>
24 #include <net/inet_connection_sock.h>
25 #include "core.h"
26 #include "nl80211.h"
27 #include "reg.h"
28 #include "rdev-ops.h"
29
30 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
31 struct genl_info *info,
32 struct cfg80211_crypto_settings *settings,
33 int cipher_limit);
34
35 /* the netlink family */
36 static struct genl_family nl80211_fam;
37
38 /* multicast groups */
39 enum nl80211_multicast_groups {
40 NL80211_MCGRP_CONFIG,
41 NL80211_MCGRP_SCAN,
42 NL80211_MCGRP_REGULATORY,
43 NL80211_MCGRP_MLME,
44 NL80211_MCGRP_VENDOR,
45 NL80211_MCGRP_NAN,
46 NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
47 };
48
49 static const struct genl_multicast_group nl80211_mcgrps[] = {
50 [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
51 [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
52 [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
53 [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
54 [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
55 [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
56 #ifdef CONFIG_NL80211_TESTMODE
57 [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
58 #endif
59 };
60
61 /* returns ERR_PTR values */
62 static struct wireless_dev *
63 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
64 {
65 struct cfg80211_registered_device *rdev;
66 struct wireless_dev *result = NULL;
67 bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
68 bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
69 u64 wdev_id;
70 int wiphy_idx = -1;
71 int ifidx = -1;
72
73 ASSERT_RTNL();
74
75 if (!have_ifidx && !have_wdev_id)
76 return ERR_PTR(-EINVAL);
77
78 if (have_ifidx)
79 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
80 if (have_wdev_id) {
81 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
82 wiphy_idx = wdev_id >> 32;
83 }
84
85 list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
86 struct wireless_dev *wdev;
87
88 if (wiphy_net(&rdev->wiphy) != netns)
89 continue;
90
91 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
92 continue;
93
94 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
95 if (have_ifidx && wdev->netdev &&
96 wdev->netdev->ifindex == ifidx) {
97 result = wdev;
98 break;
99 }
100 if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
101 result = wdev;
102 break;
103 }
104 }
105
106 if (result)
107 break;
108 }
109
110 if (result)
111 return result;
112 return ERR_PTR(-ENODEV);
113 }
114
115 static struct cfg80211_registered_device *
116 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
117 {
118 struct cfg80211_registered_device *rdev = NULL, *tmp;
119 struct net_device *netdev;
120
121 ASSERT_RTNL();
122
123 if (!attrs[NL80211_ATTR_WIPHY] &&
124 !attrs[NL80211_ATTR_IFINDEX] &&
125 !attrs[NL80211_ATTR_WDEV])
126 return ERR_PTR(-EINVAL);
127
128 if (attrs[NL80211_ATTR_WIPHY])
129 rdev = cfg80211_rdev_by_wiphy_idx(
130 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
131
132 if (attrs[NL80211_ATTR_WDEV]) {
133 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
134 struct wireless_dev *wdev;
135 bool found = false;
136
137 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
138 if (tmp) {
139 /* make sure wdev exists */
140 list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
141 if (wdev->identifier != (u32)wdev_id)
142 continue;
143 found = true;
144 break;
145 }
146
147 if (!found)
148 tmp = NULL;
149
150 if (rdev && tmp != rdev)
151 return ERR_PTR(-EINVAL);
152 rdev = tmp;
153 }
154 }
155
156 if (attrs[NL80211_ATTR_IFINDEX]) {
157 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
158
159 netdev = __dev_get_by_index(netns, ifindex);
160 if (netdev) {
161 if (netdev->ieee80211_ptr)
162 tmp = wiphy_to_rdev(
163 netdev->ieee80211_ptr->wiphy);
164 else
165 tmp = NULL;
166
167 /* not wireless device -- return error */
168 if (!tmp)
169 return ERR_PTR(-EINVAL);
170
171 /* mismatch -- return error */
172 if (rdev && tmp != rdev)
173 return ERR_PTR(-EINVAL);
174
175 rdev = tmp;
176 }
177 }
178
179 if (!rdev)
180 return ERR_PTR(-ENODEV);
181
182 if (netns != wiphy_net(&rdev->wiphy))
183 return ERR_PTR(-ENODEV);
184
185 return rdev;
186 }
187
188 /*
189 * This function returns a pointer to the driver
190 * that the genl_info item that is passed refers to.
191 *
192 * The result of this can be a PTR_ERR and hence must
193 * be checked with IS_ERR() for errors.
194 */
195 static struct cfg80211_registered_device *
196 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
197 {
198 return __cfg80211_rdev_from_attrs(netns, info->attrs);
199 }
200
201 /* policy for the attributes */
202 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
203 [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
204 [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
205 .len = 20-1 },
206 [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
207
208 [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
209 [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
210 [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
211 [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
212 [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
213
214 [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
215 [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
216 [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
217 [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
218 [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
219 [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
220
221 [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
222 [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
223 [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
224
225 [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
226 [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
227
228 [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
229 [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
230 .len = WLAN_MAX_KEY_LEN },
231 [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
232 [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
233 [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
234 [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
235 [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
236
237 [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
238 [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
239 [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
240 .len = IEEE80211_MAX_DATA_LEN },
241 [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
242 .len = IEEE80211_MAX_DATA_LEN },
243 [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
244 [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
245 [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
246 [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
247 .len = NL80211_MAX_SUPP_RATES },
248 [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
249 [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
250 [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
251 [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
252 .len = IEEE80211_MAX_MESH_ID_LEN },
253 [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
254
255 [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
256 [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
257
258 [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
259 [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
260 [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
261 [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
262 .len = NL80211_MAX_SUPP_RATES },
263 [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
264
265 [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
266 [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
267
268 [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
269
270 [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
271 [NL80211_ATTR_IE] = { .type = NLA_BINARY,
272 .len = IEEE80211_MAX_DATA_LEN },
273 [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
274 [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
275
276 [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
277 .len = IEEE80211_MAX_SSID_LEN },
278 [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
279 [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
280 [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
281 [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
282 [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
283 [NL80211_ATTR_STA_FLAGS2] = {
284 .len = sizeof(struct nl80211_sta_flag_update),
285 },
286 [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
287 [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
288 [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
289 [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
290 [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
291 [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
292 [NL80211_ATTR_PID] = { .type = NLA_U32 },
293 [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
294 [NL80211_ATTR_PMKID] = { .len = WLAN_PMKID_LEN },
295 [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
296 [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
297 [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
298 [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
299 .len = IEEE80211_MAX_DATA_LEN },
300 [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
301 [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
302 [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
303 [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
304 [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
305 [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
306 [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
307 [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
308 [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
309 [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
310 [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
311 [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
312 [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
313 [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
314 [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
315 [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
316 [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
317 [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
318 [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
319 [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
320 .len = IEEE80211_MAX_DATA_LEN },
321 [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
322 .len = IEEE80211_MAX_DATA_LEN },
323 [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
324 [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
325 [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
326 [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
327 [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
328 [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
329 [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
330 [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
331 [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
332 [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
333 [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
334 .len = IEEE80211_MAX_DATA_LEN },
335 [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
336 [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
337 [NL80211_ATTR_HT_CAPABILITY_MASK] = {
338 .len = NL80211_HT_CAPABILITY_LEN
339 },
340 [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
341 [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
342 [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
343 [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
344 [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
345 [NL80211_ATTR_AUTH_DATA] = { .type = NLA_BINARY, },
346 [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
347 [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
348 [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
349 [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
350 [NL80211_ATTR_LOCAL_MESH_POWER_MODE] = {. type = NLA_U32 },
351 [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
352 [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
353 [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
354 [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
355 [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
356 [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
357 [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
358 .len = NL80211_VHT_CAPABILITY_LEN,
359 },
360 [NL80211_ATTR_MDID] = { .type = NLA_U16 },
361 [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
362 .len = IEEE80211_MAX_DATA_LEN },
363 [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
364 [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
365 [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
366 [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
367 [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
368 [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
369 [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
370 [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
371 [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
372 [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
373 [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
374 [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
375 [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
376 [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
377 .len = IEEE80211_QOS_MAP_LEN_MAX },
378 [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
379 [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
380 [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
381 [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
382 [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
383 [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
384 [NL80211_ATTR_TSID] = { .type = NLA_U8 },
385 [NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 },
386 [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
387 [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
388 [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN },
389 [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
390 [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
391 [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
392 [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
393 [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
394 [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
395 [NL80211_ATTR_STA_SUPPORT_P2P_PS] = { .type = NLA_U8 },
396 [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
397 .len = VHT_MUMIMO_GROUPS_DATA_LEN
398 },
399 [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = { .len = ETH_ALEN },
400 [NL80211_ATTR_NAN_MASTER_PREF] = { .type = NLA_U8 },
401 [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
402 [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
403 [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
404 .len = FILS_MAX_KEK_LEN },
405 [NL80211_ATTR_FILS_NONCES] = { .len = 2 * FILS_NONCE_LEN },
406 [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
407 [NL80211_ATTR_BSSID] = { .len = ETH_ALEN },
408 [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
409 [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
410 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
411 },
412 [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
413 [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
414 .len = FILS_ERP_MAX_USERNAME_LEN },
415 [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
416 .len = FILS_ERP_MAX_REALM_LEN },
417 [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
418 [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
419 .len = FILS_ERP_MAX_RRK_LEN },
420 [NL80211_ATTR_FILS_CACHE_ID] = { .len = 2 },
421 [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
422 [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
423 };
424
425 /* policy for the key attributes */
426 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
427 [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
428 [NL80211_KEY_IDX] = { .type = NLA_U8 },
429 [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
430 [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
431 [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
432 [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
433 [NL80211_KEY_TYPE] = { .type = NLA_U32 },
434 [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
435 };
436
437 /* policy for the key default flags */
438 static const struct nla_policy
439 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
440 [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
441 [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
442 };
443
444 #ifdef CONFIG_PM
445 /* policy for WoWLAN attributes */
446 static const struct nla_policy
447 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
448 [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
449 [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
450 [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
451 [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
452 [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
453 [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
454 [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
455 [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
456 [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
457 [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
458 };
459
460 static const struct nla_policy
461 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
462 [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
463 [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
464 [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
465 [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
466 [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
467 [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
468 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
469 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
470 },
471 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
472 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
473 },
474 [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
475 [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
476 [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
477 };
478 #endif /* CONFIG_PM */
479
480 /* policy for coalesce rule attributes */
481 static const struct nla_policy
482 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
483 [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
484 [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
485 [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
486 };
487
488 /* policy for GTK rekey offload attributes */
489 static const struct nla_policy
490 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
491 [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
492 [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
493 [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
494 };
495
496 static const struct nla_policy
497 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
498 [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
499 .len = IEEE80211_MAX_SSID_LEN },
500 [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = { .len = ETH_ALEN },
501 [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
502 };
503
504 static const struct nla_policy
505 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
506 [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
507 [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
508 };
509
510 static const struct nla_policy
511 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
512 [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
513 [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
514 [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
515 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
516 },
517 };
518
519 /* policy for NAN function attributes */
520 static const struct nla_policy
521 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
522 [NL80211_NAN_FUNC_TYPE] = { .type = NLA_U8 },
523 [NL80211_NAN_FUNC_SERVICE_ID] = {
524 .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
525 [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
526 [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
527 [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
528 [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
529 [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
530 [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = { .len = ETH_ALEN },
531 [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
532 [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
533 [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
534 .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
535 [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
536 [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
537 [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
538 [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
539 [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
540 };
541
542 /* policy for Service Response Filter attributes */
543 static const struct nla_policy
544 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
545 [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
546 [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
547 .len = NL80211_NAN_FUNC_SRF_MAX_LEN },
548 [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
549 [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
550 };
551
552 /* policy for packet pattern attributes */
553 static const struct nla_policy
554 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
555 [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
556 [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
557 [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
558 };
559
560 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
561 struct netlink_callback *cb,
562 struct cfg80211_registered_device **rdev,
563 struct wireless_dev **wdev)
564 {
565 int err;
566
567 if (!cb->args[0]) {
568 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
569 genl_family_attrbuf(&nl80211_fam),
570 nl80211_fam.maxattr, nl80211_policy, NULL);
571 if (err)
572 return err;
573
574 *wdev = __cfg80211_wdev_from_attrs(
575 sock_net(skb->sk),
576 genl_family_attrbuf(&nl80211_fam));
577 if (IS_ERR(*wdev))
578 return PTR_ERR(*wdev);
579 *rdev = wiphy_to_rdev((*wdev)->wiphy);
580 /* 0 is the first index - add 1 to parse only once */
581 cb->args[0] = (*rdev)->wiphy_idx + 1;
582 cb->args[1] = (*wdev)->identifier;
583 } else {
584 /* subtract the 1 again here */
585 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
586 struct wireless_dev *tmp;
587
588 if (!wiphy)
589 return -ENODEV;
590 *rdev = wiphy_to_rdev(wiphy);
591 *wdev = NULL;
592
593 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
594 if (tmp->identifier == cb->args[1]) {
595 *wdev = tmp;
596 break;
597 }
598 }
599
600 if (!*wdev)
601 return -ENODEV;
602 }
603
604 return 0;
605 }
606
607 /* IE validation */
608 static bool is_valid_ie_attr(const struct nlattr *attr)
609 {
610 const u8 *pos;
611 int len;
612
613 if (!attr)
614 return true;
615
616 pos = nla_data(attr);
617 len = nla_len(attr);
618
619 while (len) {
620 u8 elemlen;
621
622 if (len < 2)
623 return false;
624 len -= 2;
625
626 elemlen = pos[1];
627 if (elemlen > len)
628 return false;
629
630 len -= elemlen;
631 pos += 2 + elemlen;
632 }
633
634 return true;
635 }
636
637 /* message building helper */
638 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
639 int flags, u8 cmd)
640 {
641 /* since there is no private header just add the generic one */
642 return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
643 }
644
645 static int nl80211_msg_put_channel(struct sk_buff *msg,
646 struct ieee80211_channel *chan,
647 bool large)
648 {
649 /* Some channels must be completely excluded from the
650 * list to protect old user-space tools from breaking
651 */
652 if (!large && chan->flags &
653 (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
654 return 0;
655
656 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
657 chan->center_freq))
658 goto nla_put_failure;
659
660 if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
661 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
662 goto nla_put_failure;
663 if (chan->flags & IEEE80211_CHAN_NO_IR) {
664 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
665 goto nla_put_failure;
666 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
667 goto nla_put_failure;
668 }
669 if (chan->flags & IEEE80211_CHAN_RADAR) {
670 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
671 goto nla_put_failure;
672 if (large) {
673 u32 time;
674
675 time = elapsed_jiffies_msecs(chan->dfs_state_entered);
676
677 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
678 chan->dfs_state))
679 goto nla_put_failure;
680 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
681 time))
682 goto nla_put_failure;
683 if (nla_put_u32(msg,
684 NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
685 chan->dfs_cac_ms))
686 goto nla_put_failure;
687 }
688 }
689
690 if (large) {
691 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
692 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
693 goto nla_put_failure;
694 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
695 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
696 goto nla_put_failure;
697 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
698 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
699 goto nla_put_failure;
700 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
701 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
702 goto nla_put_failure;
703 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
704 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
705 goto nla_put_failure;
706 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
707 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
708 goto nla_put_failure;
709 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
710 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
711 goto nla_put_failure;
712 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
713 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
714 goto nla_put_failure;
715 }
716
717 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
718 DBM_TO_MBM(chan->max_power)))
719 goto nla_put_failure;
720
721 return 0;
722
723 nla_put_failure:
724 return -ENOBUFS;
725 }
726
727 /* netlink command implementations */
728
729 struct key_parse {
730 struct key_params p;
731 int idx;
732 int type;
733 bool def, defmgmt;
734 bool def_uni, def_multi;
735 };
736
737 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
738 {
739 struct nlattr *tb[NL80211_KEY_MAX + 1];
740 int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
741 nl80211_key_policy, NULL);
742 if (err)
743 return err;
744
745 k->def = !!tb[NL80211_KEY_DEFAULT];
746 k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
747
748 if (k->def) {
749 k->def_uni = true;
750 k->def_multi = true;
751 }
752 if (k->defmgmt)
753 k->def_multi = true;
754
755 if (tb[NL80211_KEY_IDX])
756 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
757
758 if (tb[NL80211_KEY_DATA]) {
759 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
760 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
761 }
762
763 if (tb[NL80211_KEY_SEQ]) {
764 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
765 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
766 }
767
768 if (tb[NL80211_KEY_CIPHER])
769 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
770
771 if (tb[NL80211_KEY_TYPE]) {
772 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
773 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
774 return -EINVAL;
775 }
776
777 if (tb[NL80211_KEY_DEFAULT_TYPES]) {
778 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
779
780 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
781 tb[NL80211_KEY_DEFAULT_TYPES],
782 nl80211_key_default_policy, NULL);
783 if (err)
784 return err;
785
786 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
787 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
788 }
789
790 return 0;
791 }
792
793 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
794 {
795 if (info->attrs[NL80211_ATTR_KEY_DATA]) {
796 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
797 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
798 }
799
800 if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
801 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
802 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
803 }
804
805 if (info->attrs[NL80211_ATTR_KEY_IDX])
806 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
807
808 if (info->attrs[NL80211_ATTR_KEY_CIPHER])
809 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
810
811 k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
812 k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
813
814 if (k->def) {
815 k->def_uni = true;
816 k->def_multi = true;
817 }
818 if (k->defmgmt)
819 k->def_multi = true;
820
821 if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
822 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
823 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
824 return -EINVAL;
825 }
826
827 if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
828 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
829 int err = nla_parse_nested(kdt,
830 NUM_NL80211_KEY_DEFAULT_TYPES - 1,
831 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
832 nl80211_key_default_policy,
833 info->extack);
834 if (err)
835 return err;
836
837 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
838 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
839 }
840
841 return 0;
842 }
843
844 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
845 {
846 int err;
847
848 memset(k, 0, sizeof(*k));
849 k->idx = -1;
850 k->type = -1;
851
852 if (info->attrs[NL80211_ATTR_KEY])
853 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
854 else
855 err = nl80211_parse_key_old(info, k);
856
857 if (err)
858 return err;
859
860 if (k->def && k->defmgmt)
861 return -EINVAL;
862
863 if (k->defmgmt) {
864 if (k->def_uni || !k->def_multi)
865 return -EINVAL;
866 }
867
868 if (k->idx != -1) {
869 if (k->defmgmt) {
870 if (k->idx < 4 || k->idx > 5)
871 return -EINVAL;
872 } else if (k->def) {
873 if (k->idx < 0 || k->idx > 3)
874 return -EINVAL;
875 } else {
876 if (k->idx < 0 || k->idx > 5)
877 return -EINVAL;
878 }
879 }
880
881 return 0;
882 }
883
884 static struct cfg80211_cached_keys *
885 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
886 struct nlattr *keys, bool *no_ht)
887 {
888 struct key_parse parse;
889 struct nlattr *key;
890 struct cfg80211_cached_keys *result;
891 int rem, err, def = 0;
892 bool have_key = false;
893
894 nla_for_each_nested(key, keys, rem) {
895 have_key = true;
896 break;
897 }
898
899 if (!have_key)
900 return NULL;
901
902 result = kzalloc(sizeof(*result), GFP_KERNEL);
903 if (!result)
904 return ERR_PTR(-ENOMEM);
905
906 result->def = -1;
907
908 nla_for_each_nested(key, keys, rem) {
909 memset(&parse, 0, sizeof(parse));
910 parse.idx = -1;
911
912 err = nl80211_parse_key_new(key, &parse);
913 if (err)
914 goto error;
915 err = -EINVAL;
916 if (!parse.p.key)
917 goto error;
918 if (parse.idx < 0 || parse.idx > 3)
919 goto error;
920 if (parse.def) {
921 if (def)
922 goto error;
923 def = 1;
924 result->def = parse.idx;
925 if (!parse.def_uni || !parse.def_multi)
926 goto error;
927 } else if (parse.defmgmt)
928 goto error;
929 err = cfg80211_validate_key_settings(rdev, &parse.p,
930 parse.idx, false, NULL);
931 if (err)
932 goto error;
933 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
934 parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
935 err = -EINVAL;
936 goto error;
937 }
938 result->params[parse.idx].cipher = parse.p.cipher;
939 result->params[parse.idx].key_len = parse.p.key_len;
940 result->params[parse.idx].key = result->data[parse.idx];
941 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
942
943 /* must be WEP key if we got here */
944 if (no_ht)
945 *no_ht = true;
946 }
947
948 if (result->def < 0) {
949 err = -EINVAL;
950 goto error;
951 }
952
953 return result;
954 error:
955 kfree(result);
956 return ERR_PTR(err);
957 }
958
959 static int nl80211_key_allowed(struct wireless_dev *wdev)
960 {
961 ASSERT_WDEV_LOCK(wdev);
962
963 switch (wdev->iftype) {
964 case NL80211_IFTYPE_AP:
965 case NL80211_IFTYPE_AP_VLAN:
966 case NL80211_IFTYPE_P2P_GO:
967 case NL80211_IFTYPE_MESH_POINT:
968 break;
969 case NL80211_IFTYPE_ADHOC:
970 case NL80211_IFTYPE_STATION:
971 case NL80211_IFTYPE_P2P_CLIENT:
972 if (!wdev->current_bss)
973 return -ENOLINK;
974 break;
975 case NL80211_IFTYPE_UNSPECIFIED:
976 case NL80211_IFTYPE_OCB:
977 case NL80211_IFTYPE_MONITOR:
978 case NL80211_IFTYPE_NAN:
979 case NL80211_IFTYPE_P2P_DEVICE:
980 case NL80211_IFTYPE_WDS:
981 case NUM_NL80211_IFTYPES:
982 return -EINVAL;
983 }
984
985 return 0;
986 }
987
988 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
989 struct nlattr *tb)
990 {
991 struct ieee80211_channel *chan;
992
993 if (tb == NULL)
994 return NULL;
995 chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
996 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
997 return NULL;
998 return chan;
999 }
1000
1001 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1002 {
1003 struct nlattr *nl_modes = nla_nest_start(msg, attr);
1004 int i;
1005
1006 if (!nl_modes)
1007 goto nla_put_failure;
1008
1009 i = 0;
1010 while (ifmodes) {
1011 if ((ifmodes & 1) && nla_put_flag(msg, i))
1012 goto nla_put_failure;
1013 ifmodes >>= 1;
1014 i++;
1015 }
1016
1017 nla_nest_end(msg, nl_modes);
1018 return 0;
1019
1020 nla_put_failure:
1021 return -ENOBUFS;
1022 }
1023
1024 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1025 struct sk_buff *msg,
1026 bool large)
1027 {
1028 struct nlattr *nl_combis;
1029 int i, j;
1030
1031 nl_combis = nla_nest_start(msg,
1032 NL80211_ATTR_INTERFACE_COMBINATIONS);
1033 if (!nl_combis)
1034 goto nla_put_failure;
1035
1036 for (i = 0; i < wiphy->n_iface_combinations; i++) {
1037 const struct ieee80211_iface_combination *c;
1038 struct nlattr *nl_combi, *nl_limits;
1039
1040 c = &wiphy->iface_combinations[i];
1041
1042 nl_combi = nla_nest_start(msg, i + 1);
1043 if (!nl_combi)
1044 goto nla_put_failure;
1045
1046 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
1047 if (!nl_limits)
1048 goto nla_put_failure;
1049
1050 for (j = 0; j < c->n_limits; j++) {
1051 struct nlattr *nl_limit;
1052
1053 nl_limit = nla_nest_start(msg, j + 1);
1054 if (!nl_limit)
1055 goto nla_put_failure;
1056 if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1057 c->limits[j].max))
1058 goto nla_put_failure;
1059 if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1060 c->limits[j].types))
1061 goto nla_put_failure;
1062 nla_nest_end(msg, nl_limit);
1063 }
1064
1065 nla_nest_end(msg, nl_limits);
1066
1067 if (c->beacon_int_infra_match &&
1068 nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1069 goto nla_put_failure;
1070 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1071 c->num_different_channels) ||
1072 nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1073 c->max_interfaces))
1074 goto nla_put_failure;
1075 if (large &&
1076 (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1077 c->radar_detect_widths) ||
1078 nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1079 c->radar_detect_regions)))
1080 goto nla_put_failure;
1081 if (c->beacon_int_min_gcd &&
1082 nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1083 c->beacon_int_min_gcd))
1084 goto nla_put_failure;
1085
1086 nla_nest_end(msg, nl_combi);
1087 }
1088
1089 nla_nest_end(msg, nl_combis);
1090
1091 return 0;
1092 nla_put_failure:
1093 return -ENOBUFS;
1094 }
1095
1096 #ifdef CONFIG_PM
1097 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1098 struct sk_buff *msg)
1099 {
1100 const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1101 struct nlattr *nl_tcp;
1102
1103 if (!tcp)
1104 return 0;
1105
1106 nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1107 if (!nl_tcp)
1108 return -ENOBUFS;
1109
1110 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1111 tcp->data_payload_max))
1112 return -ENOBUFS;
1113
1114 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1115 tcp->data_payload_max))
1116 return -ENOBUFS;
1117
1118 if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1119 return -ENOBUFS;
1120
1121 if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1122 sizeof(*tcp->tok), tcp->tok))
1123 return -ENOBUFS;
1124
1125 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1126 tcp->data_interval_max))
1127 return -ENOBUFS;
1128
1129 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1130 tcp->wake_payload_max))
1131 return -ENOBUFS;
1132
1133 nla_nest_end(msg, nl_tcp);
1134 return 0;
1135 }
1136
1137 static int nl80211_send_wowlan(struct sk_buff *msg,
1138 struct cfg80211_registered_device *rdev,
1139 bool large)
1140 {
1141 struct nlattr *nl_wowlan;
1142
1143 if (!rdev->wiphy.wowlan)
1144 return 0;
1145
1146 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1147 if (!nl_wowlan)
1148 return -ENOBUFS;
1149
1150 if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1151 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1152 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1153 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1154 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1155 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1156 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1157 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1158 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1159 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1160 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1161 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1162 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1163 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1164 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1165 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1166 return -ENOBUFS;
1167
1168 if (rdev->wiphy.wowlan->n_patterns) {
1169 struct nl80211_pattern_support pat = {
1170 .max_patterns = rdev->wiphy.wowlan->n_patterns,
1171 .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1172 .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1173 .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1174 };
1175
1176 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1177 sizeof(pat), &pat))
1178 return -ENOBUFS;
1179 }
1180
1181 if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1182 nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1183 rdev->wiphy.wowlan->max_nd_match_sets))
1184 return -ENOBUFS;
1185
1186 if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1187 return -ENOBUFS;
1188
1189 nla_nest_end(msg, nl_wowlan);
1190
1191 return 0;
1192 }
1193 #endif
1194
1195 static int nl80211_send_coalesce(struct sk_buff *msg,
1196 struct cfg80211_registered_device *rdev)
1197 {
1198 struct nl80211_coalesce_rule_support rule;
1199
1200 if (!rdev->wiphy.coalesce)
1201 return 0;
1202
1203 rule.max_rules = rdev->wiphy.coalesce->n_rules;
1204 rule.max_delay = rdev->wiphy.coalesce->max_delay;
1205 rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1206 rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1207 rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1208 rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1209
1210 if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1211 return -ENOBUFS;
1212
1213 return 0;
1214 }
1215
1216 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1217 struct ieee80211_supported_band *sband)
1218 {
1219 struct nlattr *nl_rates, *nl_rate;
1220 struct ieee80211_rate *rate;
1221 int i;
1222
1223 /* add HT info */
1224 if (sband->ht_cap.ht_supported &&
1225 (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1226 sizeof(sband->ht_cap.mcs),
1227 &sband->ht_cap.mcs) ||
1228 nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1229 sband->ht_cap.cap) ||
1230 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1231 sband->ht_cap.ampdu_factor) ||
1232 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1233 sband->ht_cap.ampdu_density)))
1234 return -ENOBUFS;
1235
1236 /* add VHT info */
1237 if (sband->vht_cap.vht_supported &&
1238 (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1239 sizeof(sband->vht_cap.vht_mcs),
1240 &sband->vht_cap.vht_mcs) ||
1241 nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1242 sband->vht_cap.cap)))
1243 return -ENOBUFS;
1244
1245 /* add bitrates */
1246 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1247 if (!nl_rates)
1248 return -ENOBUFS;
1249
1250 for (i = 0; i < sband->n_bitrates; i++) {
1251 nl_rate = nla_nest_start(msg, i);
1252 if (!nl_rate)
1253 return -ENOBUFS;
1254
1255 rate = &sband->bitrates[i];
1256 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1257 rate->bitrate))
1258 return -ENOBUFS;
1259 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1260 nla_put_flag(msg,
1261 NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1262 return -ENOBUFS;
1263
1264 nla_nest_end(msg, nl_rate);
1265 }
1266
1267 nla_nest_end(msg, nl_rates);
1268
1269 return 0;
1270 }
1271
1272 static int
1273 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1274 const struct ieee80211_txrx_stypes *mgmt_stypes)
1275 {
1276 u16 stypes;
1277 struct nlattr *nl_ftypes, *nl_ifs;
1278 enum nl80211_iftype ift;
1279 int i;
1280
1281 if (!mgmt_stypes)
1282 return 0;
1283
1284 nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1285 if (!nl_ifs)
1286 return -ENOBUFS;
1287
1288 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1289 nl_ftypes = nla_nest_start(msg, ift);
1290 if (!nl_ftypes)
1291 return -ENOBUFS;
1292 i = 0;
1293 stypes = mgmt_stypes[ift].tx;
1294 while (stypes) {
1295 if ((stypes & 1) &&
1296 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1297 (i << 4) | IEEE80211_FTYPE_MGMT))
1298 return -ENOBUFS;
1299 stypes >>= 1;
1300 i++;
1301 }
1302 nla_nest_end(msg, nl_ftypes);
1303 }
1304
1305 nla_nest_end(msg, nl_ifs);
1306
1307 nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1308 if (!nl_ifs)
1309 return -ENOBUFS;
1310
1311 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1312 nl_ftypes = nla_nest_start(msg, ift);
1313 if (!nl_ftypes)
1314 return -ENOBUFS;
1315 i = 0;
1316 stypes = mgmt_stypes[ift].rx;
1317 while (stypes) {
1318 if ((stypes & 1) &&
1319 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1320 (i << 4) | IEEE80211_FTYPE_MGMT))
1321 return -ENOBUFS;
1322 stypes >>= 1;
1323 i++;
1324 }
1325 nla_nest_end(msg, nl_ftypes);
1326 }
1327 nla_nest_end(msg, nl_ifs);
1328
1329 return 0;
1330 }
1331
1332 #define CMD(op, n) \
1333 do { \
1334 if (rdev->ops->op) { \
1335 i++; \
1336 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1337 goto nla_put_failure; \
1338 } \
1339 } while (0)
1340
1341 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
1342 struct sk_buff *msg)
1343 {
1344 int i = 0;
1345
1346 /*
1347 * do *NOT* add anything into this function, new things need to be
1348 * advertised only to new versions of userspace that can deal with
1349 * the split (and they can't possibly care about new features...
1350 */
1351 CMD(add_virtual_intf, NEW_INTERFACE);
1352 CMD(change_virtual_intf, SET_INTERFACE);
1353 CMD(add_key, NEW_KEY);
1354 CMD(start_ap, START_AP);
1355 CMD(add_station, NEW_STATION);
1356 CMD(add_mpath, NEW_MPATH);
1357 CMD(update_mesh_config, SET_MESH_CONFIG);
1358 CMD(change_bss, SET_BSS);
1359 CMD(auth, AUTHENTICATE);
1360 CMD(assoc, ASSOCIATE);
1361 CMD(deauth, DEAUTHENTICATE);
1362 CMD(disassoc, DISASSOCIATE);
1363 CMD(join_ibss, JOIN_IBSS);
1364 CMD(join_mesh, JOIN_MESH);
1365 CMD(set_pmksa, SET_PMKSA);
1366 CMD(del_pmksa, DEL_PMKSA);
1367 CMD(flush_pmksa, FLUSH_PMKSA);
1368 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1369 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1370 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1371 CMD(mgmt_tx, FRAME);
1372 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1373 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1374 i++;
1375 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1376 goto nla_put_failure;
1377 }
1378 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1379 rdev->ops->join_mesh) {
1380 i++;
1381 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1382 goto nla_put_failure;
1383 }
1384 CMD(set_wds_peer, SET_WDS_PEER);
1385 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1386 CMD(tdls_mgmt, TDLS_MGMT);
1387 CMD(tdls_oper, TDLS_OPER);
1388 }
1389 if (rdev->wiphy.max_sched_scan_reqs)
1390 CMD(sched_scan_start, START_SCHED_SCAN);
1391 CMD(probe_client, PROBE_CLIENT);
1392 CMD(set_noack_map, SET_NOACK_MAP);
1393 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1394 i++;
1395 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1396 goto nla_put_failure;
1397 }
1398 CMD(start_p2p_device, START_P2P_DEVICE);
1399 CMD(set_mcast_rate, SET_MCAST_RATE);
1400 #ifdef CONFIG_NL80211_TESTMODE
1401 CMD(testmode_cmd, TESTMODE);
1402 #endif
1403
1404 if (rdev->ops->connect || rdev->ops->auth) {
1405 i++;
1406 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1407 goto nla_put_failure;
1408 }
1409
1410 if (rdev->ops->disconnect || rdev->ops->deauth) {
1411 i++;
1412 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1413 goto nla_put_failure;
1414 }
1415
1416 return i;
1417 nla_put_failure:
1418 return -ENOBUFS;
1419 }
1420
1421 struct nl80211_dump_wiphy_state {
1422 s64 filter_wiphy;
1423 long start;
1424 long split_start, band_start, chan_start, capa_start;
1425 bool split;
1426 };
1427
1428 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1429 enum nl80211_commands cmd,
1430 struct sk_buff *msg, u32 portid, u32 seq,
1431 int flags, struct nl80211_dump_wiphy_state *state)
1432 {
1433 void *hdr;
1434 struct nlattr *nl_bands, *nl_band;
1435 struct nlattr *nl_freqs, *nl_freq;
1436 struct nlattr *nl_cmds;
1437 enum nl80211_band band;
1438 struct ieee80211_channel *chan;
1439 int i;
1440 const struct ieee80211_txrx_stypes *mgmt_stypes =
1441 rdev->wiphy.mgmt_stypes;
1442 u32 features;
1443
1444 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1445 if (!hdr)
1446 return -ENOBUFS;
1447
1448 if (WARN_ON(!state))
1449 return -EINVAL;
1450
1451 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1452 nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1453 wiphy_name(&rdev->wiphy)) ||
1454 nla_put_u32(msg, NL80211_ATTR_GENERATION,
1455 cfg80211_rdev_list_generation))
1456 goto nla_put_failure;
1457
1458 if (cmd != NL80211_CMD_NEW_WIPHY)
1459 goto finish;
1460
1461 switch (state->split_start) {
1462 case 0:
1463 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1464 rdev->wiphy.retry_short) ||
1465 nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1466 rdev->wiphy.retry_long) ||
1467 nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1468 rdev->wiphy.frag_threshold) ||
1469 nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1470 rdev->wiphy.rts_threshold) ||
1471 nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1472 rdev->wiphy.coverage_class) ||
1473 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1474 rdev->wiphy.max_scan_ssids) ||
1475 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1476 rdev->wiphy.max_sched_scan_ssids) ||
1477 nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1478 rdev->wiphy.max_scan_ie_len) ||
1479 nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1480 rdev->wiphy.max_sched_scan_ie_len) ||
1481 nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1482 rdev->wiphy.max_match_sets) ||
1483 nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
1484 rdev->wiphy.max_sched_scan_plans) ||
1485 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
1486 rdev->wiphy.max_sched_scan_plan_interval) ||
1487 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
1488 rdev->wiphy.max_sched_scan_plan_iterations))
1489 goto nla_put_failure;
1490
1491 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1492 nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1493 goto nla_put_failure;
1494 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1495 nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1496 goto nla_put_failure;
1497 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1498 nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1499 goto nla_put_failure;
1500 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1501 nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1502 goto nla_put_failure;
1503 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1504 nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1505 goto nla_put_failure;
1506 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1507 nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1508 goto nla_put_failure;
1509 state->split_start++;
1510 if (state->split)
1511 break;
1512 case 1:
1513 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1514 sizeof(u32) * rdev->wiphy.n_cipher_suites,
1515 rdev->wiphy.cipher_suites))
1516 goto nla_put_failure;
1517
1518 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1519 rdev->wiphy.max_num_pmkids))
1520 goto nla_put_failure;
1521
1522 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1523 nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1524 goto nla_put_failure;
1525
1526 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1527 rdev->wiphy.available_antennas_tx) ||
1528 nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1529 rdev->wiphy.available_antennas_rx))
1530 goto nla_put_failure;
1531
1532 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1533 nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1534 rdev->wiphy.probe_resp_offload))
1535 goto nla_put_failure;
1536
1537 if ((rdev->wiphy.available_antennas_tx ||
1538 rdev->wiphy.available_antennas_rx) &&
1539 rdev->ops->get_antenna) {
1540 u32 tx_ant = 0, rx_ant = 0;
1541 int res;
1542
1543 res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1544 if (!res) {
1545 if (nla_put_u32(msg,
1546 NL80211_ATTR_WIPHY_ANTENNA_TX,
1547 tx_ant) ||
1548 nla_put_u32(msg,
1549 NL80211_ATTR_WIPHY_ANTENNA_RX,
1550 rx_ant))
1551 goto nla_put_failure;
1552 }
1553 }
1554
1555 state->split_start++;
1556 if (state->split)
1557 break;
1558 case 2:
1559 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1560 rdev->wiphy.interface_modes))
1561 goto nla_put_failure;
1562 state->split_start++;
1563 if (state->split)
1564 break;
1565 case 3:
1566 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1567 if (!nl_bands)
1568 goto nla_put_failure;
1569
1570 for (band = state->band_start;
1571 band < NUM_NL80211_BANDS; band++) {
1572 struct ieee80211_supported_band *sband;
1573
1574 sband = rdev->wiphy.bands[band];
1575
1576 if (!sband)
1577 continue;
1578
1579 nl_band = nla_nest_start(msg, band);
1580 if (!nl_band)
1581 goto nla_put_failure;
1582
1583 switch (state->chan_start) {
1584 case 0:
1585 if (nl80211_send_band_rateinfo(msg, sband))
1586 goto nla_put_failure;
1587 state->chan_start++;
1588 if (state->split)
1589 break;
1590 default:
1591 /* add frequencies */
1592 nl_freqs = nla_nest_start(
1593 msg, NL80211_BAND_ATTR_FREQS);
1594 if (!nl_freqs)
1595 goto nla_put_failure;
1596
1597 for (i = state->chan_start - 1;
1598 i < sband->n_channels;
1599 i++) {
1600 nl_freq = nla_nest_start(msg, i);
1601 if (!nl_freq)
1602 goto nla_put_failure;
1603
1604 chan = &sband->channels[i];
1605
1606 if (nl80211_msg_put_channel(
1607 msg, chan,
1608 state->split))
1609 goto nla_put_failure;
1610
1611 nla_nest_end(msg, nl_freq);
1612 if (state->split)
1613 break;
1614 }
1615 if (i < sband->n_channels)
1616 state->chan_start = i + 2;
1617 else
1618 state->chan_start = 0;
1619 nla_nest_end(msg, nl_freqs);
1620 }
1621
1622 nla_nest_end(msg, nl_band);
1623
1624 if (state->split) {
1625 /* start again here */
1626 if (state->chan_start)
1627 band--;
1628 break;
1629 }
1630 }
1631 nla_nest_end(msg, nl_bands);
1632
1633 if (band < NUM_NL80211_BANDS)
1634 state->band_start = band + 1;
1635 else
1636 state->band_start = 0;
1637
1638 /* if bands & channels are done, continue outside */
1639 if (state->band_start == 0 && state->chan_start == 0)
1640 state->split_start++;
1641 if (state->split)
1642 break;
1643 case 4:
1644 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1645 if (!nl_cmds)
1646 goto nla_put_failure;
1647
1648 i = nl80211_add_commands_unsplit(rdev, msg);
1649 if (i < 0)
1650 goto nla_put_failure;
1651 if (state->split) {
1652 CMD(crit_proto_start, CRIT_PROTOCOL_START);
1653 CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1654 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1655 CMD(channel_switch, CHANNEL_SWITCH);
1656 CMD(set_qos_map, SET_QOS_MAP);
1657 if (rdev->wiphy.features &
1658 NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
1659 CMD(add_tx_ts, ADD_TX_TS);
1660 CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
1661 CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
1662 }
1663 #undef CMD
1664
1665 nla_nest_end(msg, nl_cmds);
1666 state->split_start++;
1667 if (state->split)
1668 break;
1669 case 5:
1670 if (rdev->ops->remain_on_channel &&
1671 (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1672 nla_put_u32(msg,
1673 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1674 rdev->wiphy.max_remain_on_channel_duration))
1675 goto nla_put_failure;
1676
1677 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1678 nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1679 goto nla_put_failure;
1680
1681 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1682 goto nla_put_failure;
1683 state->split_start++;
1684 if (state->split)
1685 break;
1686 case 6:
1687 #ifdef CONFIG_PM
1688 if (nl80211_send_wowlan(msg, rdev, state->split))
1689 goto nla_put_failure;
1690 state->split_start++;
1691 if (state->split)
1692 break;
1693 #else
1694 state->split_start++;
1695 #endif
1696 case 7:
1697 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1698 rdev->wiphy.software_iftypes))
1699 goto nla_put_failure;
1700
1701 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
1702 state->split))
1703 goto nla_put_failure;
1704
1705 state->split_start++;
1706 if (state->split)
1707 break;
1708 case 8:
1709 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1710 nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1711 rdev->wiphy.ap_sme_capa))
1712 goto nla_put_failure;
1713
1714 features = rdev->wiphy.features;
1715 /*
1716 * We can only add the per-channel limit information if the
1717 * dump is split, otherwise it makes it too big. Therefore
1718 * only advertise it in that case.
1719 */
1720 if (state->split)
1721 features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1722 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1723 goto nla_put_failure;
1724
1725 if (rdev->wiphy.ht_capa_mod_mask &&
1726 nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1727 sizeof(*rdev->wiphy.ht_capa_mod_mask),
1728 rdev->wiphy.ht_capa_mod_mask))
1729 goto nla_put_failure;
1730
1731 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1732 rdev->wiphy.max_acl_mac_addrs &&
1733 nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1734 rdev->wiphy.max_acl_mac_addrs))
1735 goto nla_put_failure;
1736
1737 /*
1738 * Any information below this point is only available to
1739 * applications that can deal with it being split. This
1740 * helps ensure that newly added capabilities don't break
1741 * older tools by overrunning their buffers.
1742 *
1743 * We still increment split_start so that in the split
1744 * case we'll continue with more data in the next round,
1745 * but break unconditionally so unsplit data stops here.
1746 */
1747 state->split_start++;
1748 break;
1749 case 9:
1750 if (rdev->wiphy.extended_capabilities &&
1751 (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1752 rdev->wiphy.extended_capabilities_len,
1753 rdev->wiphy.extended_capabilities) ||
1754 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1755 rdev->wiphy.extended_capabilities_len,
1756 rdev->wiphy.extended_capabilities_mask)))
1757 goto nla_put_failure;
1758
1759 if (rdev->wiphy.vht_capa_mod_mask &&
1760 nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1761 sizeof(*rdev->wiphy.vht_capa_mod_mask),
1762 rdev->wiphy.vht_capa_mod_mask))
1763 goto nla_put_failure;
1764
1765 state->split_start++;
1766 break;
1767 case 10:
1768 if (nl80211_send_coalesce(msg, rdev))
1769 goto nla_put_failure;
1770
1771 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1772 (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1773 nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1774 goto nla_put_failure;
1775
1776 if (rdev->wiphy.max_ap_assoc_sta &&
1777 nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
1778 rdev->wiphy.max_ap_assoc_sta))
1779 goto nla_put_failure;
1780
1781 state->split_start++;
1782 break;
1783 case 11:
1784 if (rdev->wiphy.n_vendor_commands) {
1785 const struct nl80211_vendor_cmd_info *info;
1786 struct nlattr *nested;
1787
1788 nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1789 if (!nested)
1790 goto nla_put_failure;
1791
1792 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
1793 info = &rdev->wiphy.vendor_commands[i].info;
1794 if (nla_put(msg, i + 1, sizeof(*info), info))
1795 goto nla_put_failure;
1796 }
1797 nla_nest_end(msg, nested);
1798 }
1799
1800 if (rdev->wiphy.n_vendor_events) {
1801 const struct nl80211_vendor_cmd_info *info;
1802 struct nlattr *nested;
1803
1804 nested = nla_nest_start(msg,
1805 NL80211_ATTR_VENDOR_EVENTS);
1806 if (!nested)
1807 goto nla_put_failure;
1808
1809 for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
1810 info = &rdev->wiphy.vendor_events[i];
1811 if (nla_put(msg, i + 1, sizeof(*info), info))
1812 goto nla_put_failure;
1813 }
1814 nla_nest_end(msg, nested);
1815 }
1816 state->split_start++;
1817 break;
1818 case 12:
1819 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
1820 nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
1821 rdev->wiphy.max_num_csa_counters))
1822 goto nla_put_failure;
1823
1824 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
1825 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
1826 goto nla_put_failure;
1827
1828 if (rdev->wiphy.max_sched_scan_reqs &&
1829 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
1830 rdev->wiphy.max_sched_scan_reqs))
1831 goto nla_put_failure;
1832
1833 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
1834 sizeof(rdev->wiphy.ext_features),
1835 rdev->wiphy.ext_features))
1836 goto nla_put_failure;
1837
1838 if (rdev->wiphy.bss_select_support) {
1839 struct nlattr *nested;
1840 u32 bss_select_support = rdev->wiphy.bss_select_support;
1841
1842 nested = nla_nest_start(msg, NL80211_ATTR_BSS_SELECT);
1843 if (!nested)
1844 goto nla_put_failure;
1845
1846 i = 0;
1847 while (bss_select_support) {
1848 if ((bss_select_support & 1) &&
1849 nla_put_flag(msg, i))
1850 goto nla_put_failure;
1851 i++;
1852 bss_select_support >>= 1;
1853 }
1854 nla_nest_end(msg, nested);
1855 }
1856
1857 state->split_start++;
1858 break;
1859 case 13:
1860 if (rdev->wiphy.num_iftype_ext_capab &&
1861 rdev->wiphy.iftype_ext_capab) {
1862 struct nlattr *nested_ext_capab, *nested;
1863
1864 nested = nla_nest_start(msg,
1865 NL80211_ATTR_IFTYPE_EXT_CAPA);
1866 if (!nested)
1867 goto nla_put_failure;
1868
1869 for (i = state->capa_start;
1870 i < rdev->wiphy.num_iftype_ext_capab; i++) {
1871 const struct wiphy_iftype_ext_capab *capab;
1872
1873 capab = &rdev->wiphy.iftype_ext_capab[i];
1874
1875 nested_ext_capab = nla_nest_start(msg, i);
1876 if (!nested_ext_capab ||
1877 nla_put_u32(msg, NL80211_ATTR_IFTYPE,
1878 capab->iftype) ||
1879 nla_put(msg, NL80211_ATTR_EXT_CAPA,
1880 capab->extended_capabilities_len,
1881 capab->extended_capabilities) ||
1882 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1883 capab->extended_capabilities_len,
1884 capab->extended_capabilities_mask))
1885 goto nla_put_failure;
1886
1887 nla_nest_end(msg, nested_ext_capab);
1888 if (state->split)
1889 break;
1890 }
1891 nla_nest_end(msg, nested);
1892 if (i < rdev->wiphy.num_iftype_ext_capab) {
1893 state->capa_start = i + 1;
1894 break;
1895 }
1896 }
1897
1898 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
1899 rdev->wiphy.nan_supported_bands))
1900 goto nla_put_failure;
1901
1902 /* done */
1903 state->split_start = 0;
1904 break;
1905 }
1906 finish:
1907 genlmsg_end(msg, hdr);
1908 return 0;
1909
1910 nla_put_failure:
1911 genlmsg_cancel(msg, hdr);
1912 return -EMSGSIZE;
1913 }
1914
1915 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
1916 struct netlink_callback *cb,
1917 struct nl80211_dump_wiphy_state *state)
1918 {
1919 struct nlattr **tb = genl_family_attrbuf(&nl80211_fam);
1920 int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, tb,
1921 nl80211_fam.maxattr, nl80211_policy, NULL);
1922 /* ignore parse errors for backward compatibility */
1923 if (ret)
1924 return 0;
1925
1926 state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1927 if (tb[NL80211_ATTR_WIPHY])
1928 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1929 if (tb[NL80211_ATTR_WDEV])
1930 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1931 if (tb[NL80211_ATTR_IFINDEX]) {
1932 struct net_device *netdev;
1933 struct cfg80211_registered_device *rdev;
1934 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1935
1936 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1937 if (!netdev)
1938 return -ENODEV;
1939 if (netdev->ieee80211_ptr) {
1940 rdev = wiphy_to_rdev(
1941 netdev->ieee80211_ptr->wiphy);
1942 state->filter_wiphy = rdev->wiphy_idx;
1943 }
1944 }
1945
1946 return 0;
1947 }
1948
1949 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1950 {
1951 int idx = 0, ret;
1952 struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1953 struct cfg80211_registered_device *rdev;
1954
1955 rtnl_lock();
1956 if (!state) {
1957 state = kzalloc(sizeof(*state), GFP_KERNEL);
1958 if (!state) {
1959 rtnl_unlock();
1960 return -ENOMEM;
1961 }
1962 state->filter_wiphy = -1;
1963 ret = nl80211_dump_wiphy_parse(skb, cb, state);
1964 if (ret) {
1965 kfree(state);
1966 rtnl_unlock();
1967 return ret;
1968 }
1969 cb->args[0] = (long)state;
1970 }
1971
1972 list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1973 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1974 continue;
1975 if (++idx <= state->start)
1976 continue;
1977 if (state->filter_wiphy != -1 &&
1978 state->filter_wiphy != rdev->wiphy_idx)
1979 continue;
1980 /* attempt to fit multiple wiphy data chunks into the skb */
1981 do {
1982 ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
1983 skb,
1984 NETLINK_CB(cb->skb).portid,
1985 cb->nlh->nlmsg_seq,
1986 NLM_F_MULTI, state);
1987 if (ret < 0) {
1988 /*
1989 * If sending the wiphy data didn't fit (ENOBUFS
1990 * or EMSGSIZE returned), this SKB is still
1991 * empty (so it's not too big because another
1992 * wiphy dataset is already in the skb) and
1993 * we've not tried to adjust the dump allocation
1994 * yet ... then adjust the alloc size to be
1995 * bigger, and return 1 but with the empty skb.
1996 * This results in an empty message being RX'ed
1997 * in userspace, but that is ignored.
1998 *
1999 * We can then retry with the larger buffer.
2000 */
2001 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
2002 !skb->len && !state->split &&
2003 cb->min_dump_alloc < 4096) {
2004 cb->min_dump_alloc = 4096;
2005 state->split_start = 0;
2006 rtnl_unlock();
2007 return 1;
2008 }
2009 idx--;
2010 break;
2011 }
2012 } while (state->split_start > 0);
2013 break;
2014 }
2015 rtnl_unlock();
2016
2017 state->start = idx;
2018
2019 return skb->len;
2020 }
2021
2022 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
2023 {
2024 kfree((void *)cb->args[0]);
2025 return 0;
2026 }
2027
2028 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
2029 {
2030 struct sk_buff *msg;
2031 struct cfg80211_registered_device *rdev = info->user_ptr[0];
2032 struct nl80211_dump_wiphy_state state = {};
2033
2034 msg = nlmsg_new(4096, GFP_KERNEL);
2035 if (!msg)
2036 return -ENOMEM;
2037
2038 if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
2039 info->snd_portid, info->snd_seq, 0,
2040 &state) < 0) {
2041 nlmsg_free(msg);
2042 return -ENOBUFS;
2043 }
2044
2045 return genlmsg_reply(msg, info);
2046 }
2047
2048 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
2049 [NL80211_TXQ_ATTR_QUEUE] = { .type = NLA_U8 },
2050 [NL80211_TXQ_ATTR_TXOP] = { .type = NLA_U16 },
2051 [NL80211_TXQ_ATTR_CWMIN] = { .type = NLA_U16 },
2052 [NL80211_TXQ_ATTR_CWMAX] = { .type = NLA_U16 },
2053 [NL80211_TXQ_ATTR_AIFS] = { .type = NLA_U8 },
2054 };
2055
2056 static int parse_txq_params(struct nlattr *tb[],
2057 struct ieee80211_txq_params *txq_params)
2058 {
2059 if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
2060 !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
2061 !tb[NL80211_TXQ_ATTR_AIFS])
2062 return -EINVAL;
2063
2064 txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
2065 txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
2066 txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
2067 txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
2068 txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
2069
2070 if (txq_params->ac >= NL80211_NUM_ACS)
2071 return -EINVAL;
2072
2073 return 0;
2074 }
2075
2076 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
2077 {
2078 /*
2079 * You can only set the channel explicitly for WDS interfaces,
2080 * all others have their channel managed via their respective
2081 * "establish a connection" command (connect, join, ...)
2082 *
2083 * For AP/GO and mesh mode, the channel can be set with the
2084 * channel userspace API, but is only stored and passed to the
2085 * low-level driver when the AP starts or the mesh is joined.
2086 * This is for backward compatibility, userspace can also give
2087 * the channel in the start-ap or join-mesh commands instead.
2088 *
2089 * Monitors are special as they are normally slaved to
2090 * whatever else is going on, so they have their own special
2091 * operation to set the monitor channel if possible.
2092 */
2093 return !wdev ||
2094 wdev->iftype == NL80211_IFTYPE_AP ||
2095 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
2096 wdev->iftype == NL80211_IFTYPE_MONITOR ||
2097 wdev->iftype == NL80211_IFTYPE_P2P_GO;
2098 }
2099
2100 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
2101 struct genl_info *info,
2102 struct cfg80211_chan_def *chandef)
2103 {
2104 u32 control_freq;
2105
2106 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
2107 return -EINVAL;
2108
2109 control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
2110
2111 chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
2112 chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
2113 chandef->center_freq1 = control_freq;
2114 chandef->center_freq2 = 0;
2115
2116 /* Primary channel not allowed */
2117 if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
2118 return -EINVAL;
2119
2120 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
2121 enum nl80211_channel_type chantype;
2122
2123 chantype = nla_get_u32(
2124 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
2125
2126 switch (chantype) {
2127 case NL80211_CHAN_NO_HT:
2128 case NL80211_CHAN_HT20:
2129 case NL80211_CHAN_HT40PLUS:
2130 case NL80211_CHAN_HT40MINUS:
2131 cfg80211_chandef_create(chandef, chandef->chan,
2132 chantype);
2133 /* user input for center_freq is incorrect */
2134 if (info->attrs[NL80211_ATTR_CENTER_FREQ1] &&
2135 chandef->center_freq1 != nla_get_u32(
2136 info->attrs[NL80211_ATTR_CENTER_FREQ1]))
2137 return -EINVAL;
2138 /* center_freq2 must be zero */
2139 if (info->attrs[NL80211_ATTR_CENTER_FREQ2] &&
2140 nla_get_u32(info->attrs[NL80211_ATTR_CENTER_FREQ2]))
2141 return -EINVAL;
2142 break;
2143 default:
2144 return -EINVAL;
2145 }
2146 } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
2147 chandef->width =
2148 nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
2149 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
2150 chandef->center_freq1 =
2151 nla_get_u32(
2152 info->attrs[NL80211_ATTR_CENTER_FREQ1]);
2153 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
2154 chandef->center_freq2 =
2155 nla_get_u32(
2156 info->attrs[NL80211_ATTR_CENTER_FREQ2]);
2157 }
2158
2159 if (!cfg80211_chandef_valid(chandef))
2160 return -EINVAL;
2161
2162 if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
2163 IEEE80211_CHAN_DISABLED))
2164 return -EINVAL;
2165
2166 if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
2167 chandef->width == NL80211_CHAN_WIDTH_10) &&
2168 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
2169 return -EINVAL;
2170
2171 return 0;
2172 }
2173
2174 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
2175 struct net_device *dev,
2176 struct genl_info *info)
2177 {
2178 struct cfg80211_chan_def chandef;
2179 int result;
2180 enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
2181 struct wireless_dev *wdev = NULL;
2182
2183 if (dev)
2184 wdev = dev->ieee80211_ptr;
2185 if (!nl80211_can_set_dev_channel(wdev))
2186 return -EOPNOTSUPP;
2187 if (wdev)
2188 iftype = wdev->iftype;
2189
2190 result = nl80211_parse_chandef(rdev, info, &chandef);
2191 if (result)
2192 return result;
2193
2194 switch (iftype) {
2195 case NL80211_IFTYPE_AP:
2196 case NL80211_IFTYPE_P2P_GO:
2197 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
2198 iftype)) {
2199 result = -EINVAL;
2200 break;
2201 }
2202 if (wdev->beacon_interval) {
2203 if (!dev || !rdev->ops->set_ap_chanwidth ||
2204 !(rdev->wiphy.features &
2205 NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
2206 result = -EBUSY;
2207 break;
2208 }
2209
2210 /* Only allow dynamic channel width changes */
2211 if (chandef.chan != wdev->preset_chandef.chan) {
2212 result = -EBUSY;
2213 break;
2214 }
2215 result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2216 if (result)
2217 break;
2218 }
2219 wdev->preset_chandef = chandef;
2220 result = 0;
2221 break;
2222 case NL80211_IFTYPE_MESH_POINT:
2223 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2224 break;
2225 case NL80211_IFTYPE_MONITOR:
2226 result = cfg80211_set_monitor_channel(rdev, &chandef);
2227 break;
2228 default:
2229 result = -EINVAL;
2230 }
2231
2232 return result;
2233 }
2234
2235 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2236 {
2237 struct cfg80211_registered_device *rdev = info->user_ptr[0];
2238 struct net_device *netdev = info->user_ptr[1];
2239
2240 return __nl80211_set_channel(rdev, netdev, info);
2241 }
2242
2243 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2244 {
2245 struct cfg80211_registered_device *rdev = info->user_ptr[0];
2246 struct net_device *dev = info->user_ptr[1];
2247 struct wireless_dev *wdev = dev->ieee80211_ptr;
2248 const u8 *bssid;
2249
2250 if (!info->attrs[NL80211_ATTR_MAC])
2251 return -EINVAL;
2252
2253 if (netif_running(dev))
2254 return -EBUSY;
2255
2256 if (!rdev->ops->set_wds_peer)
2257 return -EOPNOTSUPP;
2258
2259 if (wdev->iftype != NL80211_IFTYPE_WDS)
2260 return -EOPNOTSUPP;
2261
2262 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2263 return rdev_set_wds_peer(rdev, dev, bssid);
2264 }
2265
2266 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2267 {
2268 struct cfg80211_registered_device *rdev;
2269 struct net_device *netdev = NULL;
2270 struct wireless_dev *wdev;
2271 int result = 0, rem_txq_params = 0;
2272 struct nlattr *nl_txq_params;
2273 u32 changed;
2274 u8 retry_short = 0, retry_long = 0;
2275 u32 frag_threshold = 0, rts_threshold = 0;
2276 u8 coverage_class = 0;
2277
2278 ASSERT_RTNL();
2279
2280 /*
2281 * Try to find the wiphy and netdev. Normally this
2282 * function shouldn't need the netdev, but this is
2283 * done for backward compatibility -- previously
2284 * setting the channel was done per wiphy, but now
2285 * it is per netdev. Previous userland like hostapd
2286 * also passed a netdev to set_wiphy, so that it is
2287 * possible to let that go to the right netdev!
2288 */
2289
2290 if (info->attrs[NL80211_ATTR_IFINDEX]) {
2291 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2292
2293 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2294 if (netdev && netdev->ieee80211_ptr)
2295 rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2296 else
2297 netdev = NULL;
2298 }
2299
2300 if (!netdev) {
2301 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2302 info->attrs);
2303 if (IS_ERR(rdev))
2304 return PTR_ERR(rdev);
2305 wdev = NULL;
2306 netdev = NULL;
2307 result = 0;
2308 } else
2309 wdev = netdev->ieee80211_ptr;
2310
2311 /*
2312 * end workaround code, by now the rdev is available
2313 * and locked, and wdev may or may not be NULL.
2314 */
2315
2316 if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2317 result = cfg80211_dev_rename(
2318 rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2319
2320 if (result)
2321 return result;
2322
2323 if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2324 struct ieee80211_txq_params txq_params;
2325 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2326
2327 if (!rdev->ops->set_txq_params)
2328 return -EOPNOTSUPP;
2329
2330 if (!netdev)
2331 return -EINVAL;
2332
2333 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2334 netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2335 return -EINVAL;
2336
2337 if (!netif_running(netdev))
2338 return -ENETDOWN;
2339
2340 nla_for_each_nested(nl_txq_params,
2341 info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2342 rem_txq_params) {
2343 result = nla_parse_nested(tb, NL80211_TXQ_ATTR_MAX,
2344 nl_txq_params,
2345 txq_params_policy,
2346 info->extack);
2347 if (result)
2348 return result;
2349 result = parse_txq_params(tb, &txq_params);
2350 if (result)
2351 return result;
2352
2353 result = rdev_set_txq_params(rdev, netdev,
2354 &txq_params);
2355 if (result)
2356 return result;
2357 }
2358 }
2359
2360 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2361 result = __nl80211_set_channel(
2362 rdev,
2363 nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2364 info);
2365 if (result)
2366 return result;
2367 }
2368
2369 if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2370 struct wireless_dev *txp_wdev = wdev;
2371 enum nl80211_tx_power_setting type;
2372 int idx, mbm = 0;
2373
2374 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2375 txp_wdev = NULL;
2376
2377 if (!rdev->ops->set_tx_power)
2378 return -EOPNOTSUPP;
2379
2380 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2381 type = nla_get_u32(info->attrs[idx]);
2382
2383 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2384 (type != NL80211_TX_POWER_AUTOMATIC))
2385 return -EINVAL;
2386
2387 if (type != NL80211_TX_POWER_AUTOMATIC) {
2388 idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2389 mbm = nla_get_u32(info->attrs[idx]);
2390 }
2391
2392 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2393 if (result)
2394 return result;
2395 }
2396
2397 if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2398 info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2399 u32 tx_ant, rx_ant;
2400
2401 if ((!rdev->wiphy.available_antennas_tx &&
2402 !rdev->wiphy.available_antennas_rx) ||
2403 !rdev->ops->set_antenna)
2404 return -EOPNOTSUPP;
2405
2406 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2407 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2408
2409 /* reject antenna configurations which don't match the
2410 * available antenna masks, except for the "all" mask */
2411 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2412 (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2413 return -EINVAL;
2414
2415 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2416 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2417
2418 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2419 if (result)
2420 return result;
2421 }
2422
2423 changed = 0;
2424
2425 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2426 retry_short = nla_get_u8(
2427 info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2428 if (retry_short == 0)
2429 return -EINVAL;
2430
2431 changed |= WIPHY_PARAM_RETRY_SHORT;
2432 }
2433
2434 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2435 retry_long = nla_get_u8(
2436 info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2437 if (retry_long == 0)
2438 return -EINVAL;
2439
2440 changed |= WIPHY_PARAM_RETRY_LONG;
2441 }
2442
2443 if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2444 frag_threshold = nla_get_u32(
2445 info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2446 if (frag_threshold < 256)
2447 return -EINVAL;
2448
2449 if (frag_threshold != (u32) -1) {
2450 /*
2451 * Fragments (apart from the last one) are required to
2452 * have even length. Make the fragmentation code
2453 * simpler by stripping LSB should someone try to use
2454 * odd threshold value.
2455 */
2456 frag_threshold &= ~0x1;
2457 }
2458 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2459 }
2460
2461 if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2462 rts_threshold = nla_get_u32(
2463 info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2464 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2465 }
2466
2467 if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2468 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
2469 return -EINVAL;
2470
2471 coverage_class = nla_get_u8(
2472 info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2473 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2474 }
2475
2476 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
2477 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
2478 return -EOPNOTSUPP;
2479
2480 changed |= WIPHY_PARAM_DYN_ACK;
2481 }
2482
2483 if (changed) {
2484 u8 old_retry_short, old_retry_long;
2485 u32 old_frag_threshold, old_rts_threshold;
2486 u8 old_coverage_class;
2487
2488 if (!rdev->ops->set_wiphy_params)
2489 return -EOPNOTSUPP;
2490
2491 old_retry_short = rdev->wiphy.retry_short;
2492 old_retry_long = rdev->wiphy.retry_long;
2493 old_frag_threshold = rdev->wiphy.frag_threshold;
2494 old_rts_threshold = rdev->wiphy.rts_threshold;
2495 old_coverage_class = rdev->wiphy.coverage_class;
2496
2497 if (changed & WIPHY_PARAM_RETRY_SHORT)
2498 rdev->wiphy.retry_short = retry_short;
2499 if (changed & WIPHY_PARAM_RETRY_LONG)
2500 rdev->wiphy.retry_long = retry_long;
2501 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2502 rdev->wiphy.frag_threshold = frag_threshold;
2503 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2504 rdev->wiphy.rts_threshold = rts_threshold;
2505 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2506 rdev->wiphy.coverage_class = coverage_class;
2507
2508 result = rdev_set_wiphy_params(rdev, changed);
2509 if (result) {
2510 rdev->wiphy.retry_short = old_retry_short;
2511 rdev->wiphy.retry_long = old_retry_long;
2512 rdev->wiphy.frag_threshold = old_frag_threshold;
2513 rdev->wiphy.rts_threshold = old_rts_threshold;
2514 rdev->wiphy.coverage_class = old_coverage_class;
2515 return result;
2516 }
2517 }
2518 return 0;
2519 }
2520
2521 static inline u64 wdev_id(struct wireless_dev *wdev)
2522 {
2523 return (u64)wdev->identifier |
2524 ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
2525 }
2526
2527 static int nl80211_send_chandef(struct sk_buff *msg,
2528 const struct cfg80211_chan_def *chandef)
2529 {
2530 if (WARN_ON(!cfg80211_chandef_valid(chandef)))
2531 return -EINVAL;
2532
2533 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2534 chandef->chan->center_freq))
2535 return -ENOBUFS;
2536 switch (chandef->width) {
2537 case NL80211_CHAN_WIDTH_20_NOHT:
2538 case NL80211_CHAN_WIDTH_20:
2539 case NL80211_CHAN_WIDTH_40:
2540 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2541 cfg80211_get_chandef_type(chandef)))
2542 return -ENOBUFS;
2543 break;
2544 default:
2545 break;
2546 }
2547 if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2548 return -ENOBUFS;
2549 if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2550 return -ENOBUFS;
2551 if (chandef->center_freq2 &&
2552 nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2553 return -ENOBUFS;
2554 return 0;
2555 }
2556
2557 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2558 struct cfg80211_registered_device *rdev,
2559 struct wireless_dev *wdev, bool removal)
2560 {
2561 struct net_device *dev = wdev->netdev;
2562 u8 cmd = NL80211_CMD_NEW_INTERFACE;
2563 void *hdr;
2564
2565 if (removal)
2566 cmd = NL80211_CMD_DEL_INTERFACE;
2567
2568 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2569 if (!hdr)
2570 return -1;
2571
2572 if (dev &&
2573 (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2574 nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2575 goto nla_put_failure;
2576
2577 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2578 nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2579 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
2580 NL80211_ATTR_PAD) ||
2581 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2582 nla_put_u32(msg, NL80211_ATTR_GENERATION,
2583 rdev->devlist_generation ^
2584 (cfg80211_rdev_list_generation << 2)))
2585 goto nla_put_failure;
2586
2587 if (rdev->ops->get_channel) {
2588 int ret;
2589 struct cfg80211_chan_def chandef;
2590
2591 ret = rdev_get_channel(rdev, wdev, &chandef);
2592 if (ret == 0) {
2593 if (nl80211_send_chandef(msg, &chandef))
2594 goto nla_put_failure;
2595 }
2596 }
2597
2598 if (rdev->ops->get_tx_power) {
2599 int dbm, ret;
2600
2601 ret = rdev_get_tx_power(rdev, wdev, &dbm);
2602 if (ret == 0 &&
2603 nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
2604 DBM_TO_MBM(dbm)))
2605 goto nla_put_failure;
2606 }
2607
2608 wdev_lock(wdev);
2609 switch (wdev->iftype) {
2610 case NL80211_IFTYPE_AP:
2611 if (wdev->ssid_len &&
2612 nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2613 goto nla_put_failure;
2614 break;
2615 case NL80211_IFTYPE_STATION:
2616 case NL80211_IFTYPE_P2P_CLIENT:
2617 case NL80211_IFTYPE_ADHOC: {
2618 const u8 *ssid_ie;
2619 if (!wdev->current_bss)
2620 break;
2621 ssid_ie = ieee80211_bss_get_ie(&wdev->current_bss->pub,
2622 WLAN_EID_SSID);
2623 if (!ssid_ie)
2624 break;
2625 if (nla_put(msg, NL80211_ATTR_SSID, ssid_ie[1], ssid_ie + 2))
2626 goto nla_put_failure;
2627 break;
2628 }
2629 default:
2630 /* nothing */
2631 break;
2632 }
2633 wdev_unlock(wdev);
2634
2635 genlmsg_end(msg, hdr);
2636 return 0;
2637
2638 nla_put_failure:
2639 genlmsg_cancel(msg, hdr);
2640 return -EMSGSIZE;
2641 }
2642
2643 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2644 {
2645 int wp_idx = 0;
2646 int if_idx = 0;
2647 int wp_start = cb->args[0];
2648 int if_start = cb->args[1];
2649 int filter_wiphy = -1;
2650 struct cfg80211_registered_device *rdev;
2651 struct wireless_dev *wdev;
2652 int ret;
2653
2654 rtnl_lock();
2655 if (!cb->args[2]) {
2656 struct nl80211_dump_wiphy_state state = {
2657 .filter_wiphy = -1,
2658 };
2659
2660 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
2661 if (ret)
2662 goto out_unlock;
2663
2664 filter_wiphy = state.filter_wiphy;
2665
2666 /*
2667 * if filtering, set cb->args[2] to +1 since 0 is the default
2668 * value needed to determine that parsing is necessary.
2669 */
2670 if (filter_wiphy >= 0)
2671 cb->args[2] = filter_wiphy + 1;
2672 else
2673 cb->args[2] = -1;
2674 } else if (cb->args[2] > 0) {
2675 filter_wiphy = cb->args[2] - 1;
2676 }
2677
2678 list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2679 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2680 continue;
2681 if (wp_idx < wp_start) {
2682 wp_idx++;
2683 continue;
2684 }
2685
2686 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
2687 continue;
2688
2689 if_idx = 0;
2690
2691 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
2692 if (if_idx < if_start) {
2693 if_idx++;
2694 continue;
2695 }
2696 if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2697 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2698 rdev, wdev, false) < 0) {
2699 goto out;
2700 }
2701 if_idx++;
2702 }
2703
2704 wp_idx++;
2705 }
2706 out:
2707 cb->args[0] = wp_idx;
2708 cb->args[1] = if_idx;
2709
2710 ret = skb->len;
2711 out_unlock:
2712 rtnl_unlock();
2713
2714 return ret;
2715 }
2716
2717 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2718 {
2719 struct sk_buff *msg;
2720 struct cfg80211_registered_device *rdev = info->user_ptr[0];
2721 struct wireless_dev *wdev = info->user_ptr[1];
2722
2723 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2724 if (!msg)
2725 return -ENOMEM;
2726
2727 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2728 rdev, wdev, false) < 0) {
2729 nlmsg_free(msg);
2730 return -ENOBUFS;
2731 }
2732
2733 return genlmsg_reply(msg, info);
2734 }
2735
2736 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2737 [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2738 [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2739 [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2740 [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2741 [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2742 [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2743 };
2744
2745 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2746 {
2747 struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2748 int flag;
2749
2750 *mntrflags = 0;
2751
2752 if (!nla)
2753 return -EINVAL;
2754
2755 if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX, nla,
2756 mntr_flags_policy, NULL))
2757 return -EINVAL;
2758
2759 for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2760 if (flags[flag])
2761 *mntrflags |= (1<<flag);
2762
2763 *mntrflags |= MONITOR_FLAG_CHANGED;
2764
2765 return 0;
2766 }
2767
2768 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
2769 enum nl80211_iftype type,
2770 struct genl_info *info,
2771 struct vif_params *params)
2772 {
2773 bool change = false;
2774 int err;
2775
2776 if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2777 if (type != NL80211_IFTYPE_MONITOR)
2778 return -EINVAL;
2779
2780 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2781 &params->flags);
2782 if (err)
2783 return err;
2784
2785 change = true;
2786 }
2787
2788 if (params->flags & MONITOR_FLAG_ACTIVE &&
2789 !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2790 return -EOPNOTSUPP;
2791
2792 if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
2793 const u8 *mumimo_groups;
2794 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
2795
2796 if (type != NL80211_IFTYPE_MONITOR)
2797 return -EINVAL;
2798
2799 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
2800 return -EOPNOTSUPP;
2801
2802 mumimo_groups =
2803 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
2804
2805 /* bits 0 and 63 are reserved and must be zero */
2806 if ((mumimo_groups[0] & BIT(0)) ||
2807 (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
2808 return -EINVAL;
2809
2810 params->vht_mumimo_groups = mumimo_groups;
2811 change = true;
2812 }
2813
2814 if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
2815 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
2816
2817 if (type != NL80211_IFTYPE_MONITOR)
2818 return -EINVAL;
2819
2820 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
2821 return -EOPNOTSUPP;
2822
2823 params->vht_mumimo_follow_addr =
2824 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
2825 change = true;
2826 }
2827
2828 return change ? 1 : 0;
2829 }
2830
2831 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2832 struct net_device *netdev, u8 use_4addr,
2833 enum nl80211_iftype iftype)
2834 {
2835 if (!use_4addr) {
2836 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2837 return -EBUSY;
2838 return 0;
2839 }
2840
2841 switch (iftype) {
2842 case NL80211_IFTYPE_AP_VLAN:
2843 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2844 return 0;
2845 break;
2846 case NL80211_IFTYPE_STATION:
2847 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2848 return 0;
2849 break;
2850 default:
2851 break;
2852 }
2853
2854 return -EOPNOTSUPP;
2855 }
2856
2857 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2858 {
2859 struct cfg80211_registered_device *rdev = info->user_ptr[0];
2860 struct vif_params params;
2861 int err;
2862 enum nl80211_iftype otype, ntype;
2863 struct net_device *dev = info->user_ptr[1];
2864 bool change = false;
2865
2866 memset(&params, 0, sizeof(params));
2867
2868 otype = ntype = dev->ieee80211_ptr->iftype;
2869
2870 if (info->attrs[NL80211_ATTR_IFTYPE]) {
2871 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2872 if (otype != ntype)
2873 change = true;
2874 if (ntype > NL80211_IFTYPE_MAX)
2875 return -EINVAL;
2876 }
2877
2878 if (info->attrs[NL80211_ATTR_MESH_ID]) {
2879 struct wireless_dev *wdev = dev->ieee80211_ptr;
2880
2881 if (ntype != NL80211_IFTYPE_MESH_POINT)
2882 return -EINVAL;
2883 if (netif_running(dev))
2884 return -EBUSY;
2885
2886 wdev_lock(wdev);
2887 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2888 IEEE80211_MAX_MESH_ID_LEN);
2889 wdev->mesh_id_up_len =
2890 nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2891 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2892 wdev->mesh_id_up_len);
2893 wdev_unlock(wdev);
2894 }
2895
2896 if (info->attrs[NL80211_ATTR_4ADDR]) {
2897 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2898 change = true;
2899 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2900 if (err)
2901 return err;
2902 } else {
2903 params.use_4addr = -1;
2904 }
2905
2906 err = nl80211_parse_mon_options(rdev, ntype, info, &params);
2907 if (err < 0)
2908 return err;
2909 if (err > 0)
2910 change = true;
2911
2912 if (change)
2913 err = cfg80211_change_iface(rdev, dev, ntype, &params);
2914 else
2915 err = 0;
2916
2917 if (!err && params.use_4addr != -1)
2918 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2919
2920 return err;
2921 }
2922
2923 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2924 {
2925 struct cfg80211_registered_device *rdev = info->user_ptr[0];
2926 struct vif_params params;
2927 struct wireless_dev *wdev;
2928 struct sk_buff *msg;
2929 int err;
2930 enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2931
2932 /* to avoid failing a new interface creation due to pending removal */
2933 cfg80211_destroy_ifaces(rdev);
2934
2935 memset(&params, 0, sizeof(params));
2936
2937 if (!info->attrs[NL80211_ATTR_IFNAME])
2938 return -EINVAL;
2939
2940 if (info->attrs[NL80211_ATTR_IFTYPE]) {
2941 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2942 if (type > NL80211_IFTYPE_MAX)
2943 return -EINVAL;
2944 }
2945
2946 if (!rdev->ops->add_virtual_intf ||
2947 !(rdev->wiphy.interface_modes & (1 << type)))
2948 return -EOPNOTSUPP;
2949
2950 if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
2951 rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
2952 info->attrs[NL80211_ATTR_MAC]) {
2953 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2954 ETH_ALEN);
2955 if (!is_valid_ether_addr(params.macaddr))
2956 return -EADDRNOTAVAIL;
2957 }
2958
2959 if (info->attrs[NL80211_ATTR_4ADDR]) {
2960 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2961 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2962 if (err)
2963 return err;
2964 }
2965
2966 err = nl80211_parse_mon_options(rdev, type, info, &params);
2967 if (err < 0)
2968 return err;
2969
2970 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2971 if (!msg)
2972 return -ENOMEM;
2973
2974 wdev = rdev_add_virtual_intf(rdev,
2975 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2976 NET_NAME_USER, type, &params);
2977 if (WARN_ON(!wdev)) {
2978 nlmsg_free(msg);
2979 return -EPROTO;
2980 } else if (IS_ERR(wdev)) {
2981 nlmsg_free(msg);
2982 return PTR_ERR(wdev);
2983 }
2984
2985 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
2986 wdev->owner_nlportid = info->snd_portid;
2987
2988 switch (type) {
2989 case NL80211_IFTYPE_MESH_POINT:
2990 if (!info->attrs[NL80211_ATTR_MESH_ID])
2991 break;
2992 wdev_lock(wdev);
2993 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2994 IEEE80211_MAX_MESH_ID_LEN);
2995 wdev->mesh_id_up_len =
2996 nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2997 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2998 wdev->mesh_id_up_len);
2999 wdev_unlock(wdev);
3000 break;
3001 case NL80211_IFTYPE_NAN:
3002 case NL80211_IFTYPE_P2P_DEVICE:
3003 /*
3004 * P2P Device and NAN do not have a netdev, so don't go
3005 * through the netdev notifier and must be added here
3006 */
3007 mutex_init(&wdev->mtx);
3008 INIT_LIST_HEAD(&wdev->event_list);
3009 spin_lock_init(&wdev->event_lock);
3010 INIT_LIST_HEAD(&wdev->mgmt_registrations);
3011 spin_lock_init(&wdev->mgmt_registrations_lock);
3012
3013 wdev->identifier = ++rdev->wdev_id;
3014 list_add_rcu(&wdev->list, &rdev->wiphy.wdev_list);
3015 rdev->devlist_generation++;
3016 break;
3017 default:
3018 break;
3019 }
3020
3021 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3022 rdev, wdev, false) < 0) {
3023 nlmsg_free(msg);
3024 return -ENOBUFS;
3025 }
3026
3027 /*
3028 * For wdevs which have no associated netdev object (e.g. of type
3029 * NL80211_IFTYPE_P2P_DEVICE), emit the NEW_INTERFACE event here.
3030 * For all other types, the event will be generated from the
3031 * netdev notifier
3032 */
3033 if (!wdev->netdev)
3034 nl80211_notify_iface(rdev, wdev, NL80211_CMD_NEW_INTERFACE);
3035
3036 return genlmsg_reply(msg, info);
3037 }
3038
3039 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
3040 {
3041 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3042 struct wireless_dev *wdev = info->user_ptr[1];
3043
3044 if (!rdev->ops->del_virtual_intf)
3045 return -EOPNOTSUPP;
3046
3047 /*
3048 * If we remove a wireless device without a netdev then clear
3049 * user_ptr[1] so that nl80211_post_doit won't dereference it
3050 * to check if it needs to do dev_put(). Otherwise it crashes
3051 * since the wdev has been freed, unlike with a netdev where
3052 * we need the dev_put() for the netdev to really be freed.
3053 */
3054 if (!wdev->netdev)
3055 info->user_ptr[1] = NULL;
3056
3057 return rdev_del_virtual_intf(rdev, wdev);
3058 }
3059
3060 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
3061 {
3062 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3063 struct net_device *dev = info->user_ptr[1];
3064 u16 noack_map;
3065
3066 if (!info->attrs[NL80211_ATTR_NOACK_MAP])
3067 return -EINVAL;
3068
3069 if (!rdev->ops->set_noack_map)
3070 return -EOPNOTSUPP;
3071
3072 noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
3073
3074 return rdev_set_noack_map(rdev, dev, noack_map);
3075 }
3076
3077 struct get_key_cookie {
3078 struct sk_buff *msg;
3079 int error;
3080 int idx;
3081 };
3082
3083 static void get_key_callback(void *c, struct key_params *params)
3084 {
3085 struct nlattr *key;
3086 struct get_key_cookie *cookie = c;
3087
3088 if ((params->key &&
3089 nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
3090 params->key_len, params->key)) ||
3091 (params->seq &&
3092 nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
3093 params->seq_len, params->seq)) ||
3094 (params->cipher &&
3095 nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
3096 params->cipher)))
3097 goto nla_put_failure;
3098
3099 key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
3100 if (!key)
3101 goto nla_put_failure;
3102
3103 if ((params->key &&
3104 nla_put(cookie->msg, NL80211_KEY_DATA,
3105 params->key_len, params->key)) ||
3106 (params->seq &&
3107 nla_put(cookie->msg, NL80211_KEY_SEQ,
3108 params->seq_len, params->seq)) ||
3109 (params->cipher &&
3110 nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
3111 params->cipher)))
3112 goto nla_put_failure;
3113
3114 if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
3115 goto nla_put_failure;
3116
3117 nla_nest_end(cookie->msg, key);
3118
3119 return;
3120 nla_put_failure:
3121 cookie->error = 1;
3122 }
3123
3124 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
3125 {
3126 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3127 int err;
3128 struct net_device *dev = info->user_ptr[1];
3129 u8 key_idx = 0;
3130 const u8 *mac_addr = NULL;
3131 bool pairwise;
3132 struct get_key_cookie cookie = {
3133 .error = 0,
3134 };
3135 void *hdr;
3136 struct sk_buff *msg;
3137
3138 if (info->attrs[NL80211_ATTR_KEY_IDX])
3139 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
3140
3141 if (key_idx > 5)
3142 return -EINVAL;
3143
3144 if (info->attrs[NL80211_ATTR_MAC])
3145 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3146
3147 pairwise = !!mac_addr;
3148 if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
3149 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
3150
3151 if (kt >= NUM_NL80211_KEYTYPES)
3152 return -EINVAL;
3153 if (kt != NL80211_KEYTYPE_GROUP &&
3154 kt != NL80211_KEYTYPE_PAIRWISE)
3155 return -EINVAL;
3156 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
3157 }
3158
3159 if (!rdev->ops->get_key)
3160 return -EOPNOTSUPP;
3161
3162 if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3163 return -ENOENT;
3164
3165 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3166 if (!msg)
3167 return -ENOMEM;
3168
3169 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
3170 NL80211_CMD_NEW_KEY);
3171 if (!hdr)
3172 goto nla_put_failure;
3173
3174 cookie.msg = msg;
3175 cookie.idx = key_idx;
3176
3177 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3178 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
3179 goto nla_put_failure;
3180 if (mac_addr &&
3181 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
3182 goto nla_put_failure;
3183
3184 err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
3185 get_key_callback);
3186
3187 if (err)
3188 goto free_msg;
3189
3190 if (cookie.error)
3191 goto nla_put_failure;
3192
3193 genlmsg_end(msg, hdr);
3194 return genlmsg_reply(msg, info);
3195
3196 nla_put_failure:
3197 err = -ENOBUFS;
3198 free_msg:
3199 nlmsg_free(msg);
3200 return err;
3201 }
3202
3203 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
3204 {
3205 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3206 struct key_parse key;
3207 int err;
3208 struct net_device *dev = info->user_ptr[1];
3209
3210 err = nl80211_parse_key(info, &key);
3211 if (err)
3212 return err;
3213
3214 if (key.idx < 0)
3215 return -EINVAL;
3216
3217 /* only support setting default key */
3218 if (!key.def && !key.defmgmt)
3219 return -EINVAL;
3220
3221 wdev_lock(dev->ieee80211_ptr);
3222
3223 if (key.def) {
3224 if (!rdev->ops->set_default_key) {
3225 err = -EOPNOTSUPP;
3226 goto out;
3227 }
3228
3229 err = nl80211_key_allowed(dev->ieee80211_ptr);
3230 if (err)
3231 goto out;
3232
3233 err = rdev_set_default_key(rdev, dev, key.idx,
3234 key.def_uni, key.def_multi);
3235
3236 if (err)
3237 goto out;
3238
3239 #ifdef CONFIG_CFG80211_WEXT
3240 dev->ieee80211_ptr->wext.default_key = key.idx;
3241 #endif
3242 } else {
3243 if (key.def_uni || !key.def_multi) {
3244 err = -EINVAL;
3245 goto out;
3246 }
3247
3248 if (!rdev->ops->set_default_mgmt_key) {
3249 err = -EOPNOTSUPP;
3250 goto out;
3251 }
3252
3253 err = nl80211_key_allowed(dev->ieee80211_ptr);
3254 if (err)
3255 goto out;
3256
3257 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
3258 if (err)
3259 goto out;
3260
3261 #ifdef CONFIG_CFG80211_WEXT
3262 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
3263 #endif
3264 }
3265
3266 out:
3267 wdev_unlock(dev->ieee80211_ptr);
3268
3269 return err;
3270 }
3271
3272 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
3273 {
3274 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3275 int err;
3276 struct net_device *dev = info->user_ptr[1];
3277 struct key_parse key;
3278 const u8 *mac_addr = NULL;
3279
3280 err = nl80211_parse_key(info, &key);
3281 if (err)
3282 return err;
3283
3284 if (!key.p.key)
3285 return -EINVAL;
3286
3287 if (info->attrs[NL80211_ATTR_MAC])
3288 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3289
3290 if (key.type == -1) {
3291 if (mac_addr)
3292 key.type = NL80211_KEYTYPE_PAIRWISE;
3293 else
3294 key.type = NL80211_KEYTYPE_GROUP;
3295 }
3296
3297 /* for now */
3298 if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3299 key.type != NL80211_KEYTYPE_GROUP)
3300 return -EINVAL;
3301
3302 if (!rdev->ops->add_key)
3303 return -EOPNOTSUPP;
3304
3305 if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
3306 key.type == NL80211_KEYTYPE_PAIRWISE,
3307 mac_addr))
3308 return -EINVAL;
3309
3310 wdev_lock(dev->ieee80211_ptr);
3311 err = nl80211_key_allowed(dev->ieee80211_ptr);
3312 if (!err)
3313 err = rdev_add_key(rdev, dev, key.idx,
3314 key.type == NL80211_KEYTYPE_PAIRWISE,
3315 mac_addr, &key.p);
3316 wdev_unlock(dev->ieee80211_ptr);
3317
3318 return err;
3319 }
3320
3321 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
3322 {
3323 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3324 int err;
3325 struct net_device *dev = info->user_ptr[1];
3326 u8 *mac_addr = NULL;
3327 struct key_parse key;
3328
3329 err = nl80211_parse_key(info, &key);
3330 if (err)
3331 return err;
3332
3333 if (info->attrs[NL80211_ATTR_MAC])
3334 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3335
3336 if (key.type == -1) {
3337 if (mac_addr)
3338 key.type = NL80211_KEYTYPE_PAIRWISE;
3339 else
3340 key.type = NL80211_KEYTYPE_GROUP;
3341 }
3342
3343 /* for now */
3344 if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3345 key.type != NL80211_KEYTYPE_GROUP)
3346 return -EINVAL;
3347
3348 if (!rdev->ops->del_key)
3349 return -EOPNOTSUPP;
3350
3351 wdev_lock(dev->ieee80211_ptr);
3352 err = nl80211_key_allowed(dev->ieee80211_ptr);
3353
3354 if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
3355 !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3356 err = -ENOENT;
3357
3358 if (!err)
3359 err = rdev_del_key(rdev, dev, key.idx,
3360 key.type == NL80211_KEYTYPE_PAIRWISE,
3361 mac_addr);
3362
3363 #ifdef CONFIG_CFG80211_WEXT
3364 if (!err) {
3365 if (key.idx == dev->ieee80211_ptr->wext.default_key)
3366 dev->ieee80211_ptr->wext.default_key = -1;
3367 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
3368 dev->ieee80211_ptr->wext.default_mgmt_key = -1;
3369 }
3370 #endif
3371 wdev_unlock(dev->ieee80211_ptr);
3372
3373 return err;
3374 }
3375
3376 /* This function returns an error or the number of nested attributes */
3377 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
3378 {
3379 struct nlattr *attr;
3380 int n_entries = 0, tmp;
3381
3382 nla_for_each_nested(attr, nl_attr, tmp) {
3383 if (nla_len(attr) != ETH_ALEN)
3384 return -EINVAL;
3385
3386 n_entries++;
3387 }
3388
3389 return n_entries;
3390 }
3391
3392 /*
3393 * This function parses ACL information and allocates memory for ACL data.
3394 * On successful return, the calling function is responsible to free the
3395 * ACL buffer returned by this function.
3396 */
3397 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3398 struct genl_info *info)
3399 {
3400 enum nl80211_acl_policy acl_policy;
3401 struct nlattr *attr;
3402 struct cfg80211_acl_data *acl;
3403 int i = 0, n_entries, tmp;
3404
3405 if (!wiphy->max_acl_mac_addrs)
3406 return ERR_PTR(-EOPNOTSUPP);
3407
3408 if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3409 return ERR_PTR(-EINVAL);
3410
3411 acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3412 if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3413 acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3414 return ERR_PTR(-EINVAL);
3415
3416 if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3417 return ERR_PTR(-EINVAL);
3418
3419 n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3420 if (n_entries < 0)
3421 return ERR_PTR(n_entries);
3422
3423 if (n_entries > wiphy->max_acl_mac_addrs)
3424 return ERR_PTR(-ENOTSUPP);
3425
3426 acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
3427 GFP_KERNEL);
3428 if (!acl)
3429 return ERR_PTR(-ENOMEM);
3430
3431 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3432 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3433 i++;
3434 }
3435
3436 acl->n_acl_entries = n_entries;
3437 acl->acl_policy = acl_policy;
3438
3439 return acl;
3440 }
3441
3442 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3443 {
3444 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3445 struct net_device *dev = info->user_ptr[1];
3446 struct cfg80211_acl_data *acl;
3447 int err;
3448
3449 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3450 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3451 return -EOPNOTSUPP;
3452
3453 if (!dev->ieee80211_ptr->beacon_interval)
3454 return -EINVAL;
3455
3456 acl = parse_acl_data(&rdev->wiphy, info);
3457 if (IS_ERR(acl))
3458 return PTR_ERR(acl);
3459
3460 err = rdev_set_mac_acl(rdev, dev, acl);
3461
3462 kfree(acl);
3463
3464 return err;
3465 }
3466
3467 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
3468 u8 *rates, u8 rates_len)
3469 {
3470 u8 i;
3471 u32 mask = 0;
3472
3473 for (i = 0; i < rates_len; i++) {
3474 int rate = (rates[i] & 0x7f) * 5;
3475 int ridx;
3476
3477 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
3478 struct ieee80211_rate *srate =
3479 &sband->bitrates[ridx];
3480 if (rate == srate->bitrate) {
3481 mask |= 1 << ridx;
3482 break;
3483 }
3484 }
3485 if (ridx == sband->n_bitrates)
3486 return 0; /* rate not found */
3487 }
3488
3489 return mask;
3490 }
3491
3492 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
3493 u8 *rates, u8 rates_len,
3494 u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
3495 {
3496 u8 i;
3497
3498 memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
3499
3500 for (i = 0; i < rates_len; i++) {
3501 int ridx, rbit;
3502
3503 ridx = rates[i] / 8;
3504 rbit = BIT(rates[i] % 8);
3505
3506 /* check validity */
3507 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
3508 return false;
3509
3510 /* check availability */
3511 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
3512 mcs[ridx] |= rbit;
3513 else
3514 return false;
3515 }
3516
3517 return true;
3518 }
3519
3520 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
3521 {
3522 u16 mcs_mask = 0;
3523
3524 switch (vht_mcs_map) {
3525 case IEEE80211_VHT_MCS_NOT_SUPPORTED:
3526 break;
3527 case IEEE80211_VHT_MCS_SUPPORT_0_7:
3528 mcs_mask = 0x00FF;
3529 break;
3530 case IEEE80211_VHT_MCS_SUPPORT_0_8:
3531 mcs_mask = 0x01FF;
3532 break;
3533 case IEEE80211_VHT_MCS_SUPPORT_0_9:
3534 mcs_mask = 0x03FF;
3535 break;
3536 default:
3537 break;
3538 }
3539
3540 return mcs_mask;
3541 }
3542
3543 static void vht_build_mcs_mask(u16 vht_mcs_map,
3544 u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
3545 {
3546 u8 nss;
3547
3548 for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
3549 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
3550 vht_mcs_map >>= 2;
3551 }
3552 }
3553
3554 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
3555 struct nl80211_txrate_vht *txrate,
3556 u16 mcs[NL80211_VHT_NSS_MAX])
3557 {
3558 u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
3559 u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
3560 u8 i;
3561
3562 if (!sband->vht_cap.vht_supported)
3563 return false;
3564
3565 memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
3566
3567 /* Build vht_mcs_mask from VHT capabilities */
3568 vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
3569
3570 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
3571 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
3572 mcs[i] = txrate->mcs[i];
3573 else
3574 return false;
3575 }
3576
3577 return true;
3578 }
3579
3580 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
3581 [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
3582 .len = NL80211_MAX_SUPP_RATES },
3583 [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
3584 .len = NL80211_MAX_SUPP_HT_RATES },
3585 [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
3586 [NL80211_TXRATE_GI] = { .type = NLA_U8 },
3587 };
3588
3589 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
3590 struct cfg80211_bitrate_mask *mask)
3591 {
3592 struct nlattr *tb[NL80211_TXRATE_MAX + 1];
3593 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3594 int rem, i;
3595 struct nlattr *tx_rates;
3596 struct ieee80211_supported_band *sband;
3597 u16 vht_tx_mcs_map;
3598
3599 memset(mask, 0, sizeof(*mask));
3600 /* Default to all rates enabled */
3601 for (i = 0; i < NUM_NL80211_BANDS; i++) {
3602 sband = rdev->wiphy.bands[i];
3603
3604 if (!sband)
3605 continue;
3606
3607 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
3608 memcpy(mask->control[i].ht_mcs,
3609 sband->ht_cap.mcs.rx_mask,
3610 sizeof(mask->control[i].ht_mcs));
3611
3612 if (!sband->vht_cap.vht_supported)
3613 continue;
3614
3615 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
3616 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
3617 }
3618
3619 /* if no rates are given set it back to the defaults */
3620 if (!info->attrs[NL80211_ATTR_TX_RATES])
3621 goto out;
3622
3623 /* The nested attribute uses enum nl80211_band as the index. This maps
3624 * directly to the enum nl80211_band values used in cfg80211.
3625 */
3626 BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
3627 nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
3628 enum nl80211_band band = nla_type(tx_rates);
3629 int err;
3630
3631 if (band < 0 || band >= NUM_NL80211_BANDS)
3632 return -EINVAL;
3633 sband = rdev->wiphy.bands[band];
3634 if (sband == NULL)
3635 return -EINVAL;
3636 err = nla_parse_nested(tb, NL80211_TXRATE_MAX, tx_rates,
3637 nl80211_txattr_policy, info->extack);
3638 if (err)
3639 return err;
3640 if (tb[NL80211_TXRATE_LEGACY]) {
3641 mask->control[band].legacy = rateset_to_mask(
3642 sband,
3643 nla_data(tb[NL80211_TXRATE_LEGACY]),
3644 nla_len(tb[NL80211_TXRATE_LEGACY]));
3645 if ((mask->control[band].legacy == 0) &&
3646 nla_len(tb[NL80211_TXRATE_LEGACY]))
3647 return -EINVAL;
3648 }
3649 if (tb[NL80211_TXRATE_HT]) {
3650 if (!ht_rateset_to_mask(
3651 sband,
3652 nla_data(tb[NL80211_TXRATE_HT]),
3653 nla_len(tb[NL80211_TXRATE_HT]),
3654 mask->control[band].ht_mcs))
3655 return -EINVAL;
3656 }
3657 if (tb[NL80211_TXRATE_VHT]) {
3658 if (!vht_set_mcs_mask(
3659 sband,
3660 nla_data(tb[NL80211_TXRATE_VHT]),
3661 mask->control[band].vht_mcs))
3662 return -EINVAL;
3663 }
3664 if (tb[NL80211_TXRATE_GI]) {
3665 mask->control[band].gi =
3666 nla_get_u8(tb[NL80211_TXRATE_GI]);
3667 if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
3668 return -EINVAL;
3669 }
3670
3671 if (mask->control[band].legacy == 0) {
3672 /* don't allow empty legacy rates if HT or VHT
3673 * are not even supported.
3674 */
3675 if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
3676 rdev->wiphy.bands[band]->vht_cap.vht_supported))
3677 return -EINVAL;
3678
3679 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
3680 if (mask->control[band].ht_mcs[i])
3681 goto out;
3682
3683 for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
3684 if (mask->control[band].vht_mcs[i])
3685 goto out;
3686
3687 /* legacy and mcs rates may not be both empty */
3688 return -EINVAL;
3689 }
3690 }
3691
3692 out:
3693 return 0;
3694 }
3695
3696 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
3697 enum nl80211_band band,
3698 struct cfg80211_bitrate_mask *beacon_rate)
3699 {
3700 u32 count_ht, count_vht, i;
3701 u32 rate = beacon_rate->control[band].legacy;
3702
3703 /* Allow only one rate */
3704 if (hweight32(rate) > 1)
3705 return -EINVAL;
3706
3707 count_ht = 0;
3708 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3709 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
3710 return -EINVAL;
3711 } else if (beacon_rate->control[band].ht_mcs[i]) {
3712 count_ht++;
3713 if (count_ht > 1)
3714 return -EINVAL;
3715 }
3716 if (count_ht && rate)
3717 return -EINVAL;
3718 }
3719
3720 count_vht = 0;
3721 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
3722 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
3723 return -EINVAL;
3724 } else if (beacon_rate->control[band].vht_mcs[i]) {
3725 count_vht++;
3726 if (count_vht > 1)
3727 return -EINVAL;
3728 }
3729 if (count_vht && rate)
3730 return -EINVAL;
3731 }
3732
3733 if ((count_ht && count_vht) || (!rate && !count_ht && !count_vht))
3734 return -EINVAL;
3735
3736 if (rate &&
3737 !wiphy_ext_feature_isset(&rdev->wiphy,
3738 NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
3739 return -EINVAL;
3740 if (count_ht &&
3741 !wiphy_ext_feature_isset(&rdev->wiphy,
3742 NL80211_EXT_FEATURE_BEACON_RATE_HT))
3743 return -EINVAL;
3744 if (count_vht &&
3745 !wiphy_ext_feature_isset(&rdev->wiphy,
3746 NL80211_EXT_FEATURE_BEACON_RATE_VHT))
3747 return -EINVAL;
3748
3749 return 0;
3750 }
3751
3752 static int nl80211_parse_beacon(struct nlattr *attrs[],
3753 struct cfg80211_beacon_data *bcn)
3754 {
3755 bool haveinfo = false;
3756
3757 if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
3758 !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
3759 !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
3760 !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
3761 return -EINVAL;
3762
3763 memset(bcn, 0, sizeof(*bcn));
3764
3765 if (attrs[NL80211_ATTR_BEACON_HEAD]) {
3766 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
3767 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
3768 if (!bcn->head_len)
3769 return -EINVAL;
3770 haveinfo = true;
3771 }
3772
3773 if (attrs[NL80211_ATTR_BEACON_TAIL]) {
3774 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
3775 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
3776 haveinfo = true;
3777 }
3778
3779 if (!haveinfo)
3780 return -EINVAL;
3781
3782 if (attrs[NL80211_ATTR_IE]) {
3783 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
3784 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
3785 }
3786
3787 if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
3788 bcn->proberesp_ies =
3789 nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3790 bcn->proberesp_ies_len =
3791 nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3792 }
3793
3794 if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
3795 bcn->assocresp_ies =
3796 nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3797 bcn->assocresp_ies_len =
3798 nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3799 }
3800
3801 if (attrs[NL80211_ATTR_PROBE_RESP]) {
3802 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
3803 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
3804 }
3805
3806 return 0;
3807 }
3808
3809 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
3810 const u8 *rates)
3811 {
3812 int i;
3813
3814 if (!rates)
3815 return;
3816
3817 for (i = 0; i < rates[1]; i++) {
3818 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
3819 params->ht_required = true;
3820 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
3821 params->vht_required = true;
3822 }
3823 }
3824
3825 /*
3826 * Since the nl80211 API didn't include, from the beginning, attributes about
3827 * HT/VHT requirements/capabilities, we parse them out of the IEs for the
3828 * benefit of drivers that rebuild IEs in the firmware.
3829 */
3830 static void nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
3831 {
3832 const struct cfg80211_beacon_data *bcn = &params->beacon;
3833 size_t ies_len = bcn->tail_len;
3834 const u8 *ies = bcn->tail;
3835 const u8 *rates;
3836 const u8 *cap;
3837
3838 rates = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies, ies_len);
3839 nl80211_check_ap_rate_selectors(params, rates);
3840
3841 rates = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
3842 nl80211_check_ap_rate_selectors(params, rates);
3843
3844 cap = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies, ies_len);
3845 if (cap && cap[1] >= sizeof(*params->ht_cap))
3846 params->ht_cap = (void *)(cap + 2);
3847 cap = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
3848 if (cap && cap[1] >= sizeof(*params->vht_cap))
3849 params->vht_cap = (void *)(cap + 2);
3850 }
3851
3852 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
3853 struct cfg80211_ap_settings *params)
3854 {
3855 struct wireless_dev *wdev;
3856 bool ret = false;
3857
3858 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
3859 if (wdev->iftype != NL80211_IFTYPE_AP &&
3860 wdev->iftype != NL80211_IFTYPE_P2P_GO)
3861 continue;
3862
3863 if (!wdev->preset_chandef.chan)
3864 continue;
3865
3866 params->chandef = wdev->preset_chandef;
3867 ret = true;
3868 break;
3869 }
3870
3871 return ret;
3872 }
3873
3874 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3875 enum nl80211_auth_type auth_type,
3876 enum nl80211_commands cmd)
3877 {
3878 if (auth_type > NL80211_AUTHTYPE_MAX)
3879 return false;
3880
3881 switch (cmd) {
3882 case NL80211_CMD_AUTHENTICATE:
3883 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3884 auth_type == NL80211_AUTHTYPE_SAE)
3885 return false;
3886 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3887 NL80211_EXT_FEATURE_FILS_STA) &&
3888 (auth_type == NL80211_AUTHTYPE_FILS_SK ||
3889 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
3890 auth_type == NL80211_AUTHTYPE_FILS_PK))
3891 return false;
3892 return true;
3893 case NL80211_CMD_CONNECT:
3894 /* SAE not supported yet */
3895 if (auth_type == NL80211_AUTHTYPE_SAE)
3896 return false;
3897 /* FILS with SK PFS or PK not supported yet */
3898 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
3899 auth_type == NL80211_AUTHTYPE_FILS_PK)
3900 return false;
3901 if (!wiphy_ext_feature_isset(
3902 &rdev->wiphy,
3903 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
3904 auth_type == NL80211_AUTHTYPE_FILS_SK)
3905 return false;
3906 return true;
3907 case NL80211_CMD_START_AP:
3908 /* SAE not supported yet */
3909 if (auth_type == NL80211_AUTHTYPE_SAE)
3910 return false;
3911 /* FILS not supported yet */
3912 if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
3913 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
3914 auth_type == NL80211_AUTHTYPE_FILS_PK)
3915 return false;
3916 return true;
3917 default:
3918 return false;
3919 }
3920 }
3921
3922 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3923 {
3924 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3925 struct net_device *dev = info->user_ptr[1];
3926 struct wireless_dev *wdev = dev->ieee80211_ptr;
3927 struct cfg80211_ap_settings params;
3928 int err;
3929
3930 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3931 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3932 return -EOPNOTSUPP;
3933
3934 if (!rdev->ops->start_ap)
3935 return -EOPNOTSUPP;
3936
3937 if (wdev->beacon_interval)
3938 return -EALREADY;
3939
3940 memset(&params, 0, sizeof(params));
3941
3942 /* these are required for START_AP */
3943 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3944 !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3945 !info->attrs[NL80211_ATTR_BEACON_HEAD])
3946 return -EINVAL;
3947
3948 err = nl80211_parse_beacon(info->attrs, &params.beacon);
3949 if (err)
3950 return err;
3951
3952 params.beacon_interval =
3953 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3954 params.dtim_period =
3955 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3956
3957 err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
3958 params.beacon_interval);
3959 if (err)
3960 return err;
3961
3962 /*
3963 * In theory, some of these attributes should be required here
3964 * but since they were not used when the command was originally
3965 * added, keep them optional for old user space programs to let
3966 * them continue to work with drivers that do not need the
3967 * additional information -- drivers must check!
3968 */
3969 if (info->attrs[NL80211_ATTR_SSID]) {
3970 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3971 params.ssid_len =
3972 nla_len(info->attrs[NL80211_ATTR_SSID]);
3973 if (params.ssid_len == 0 ||
3974 params.ssid_len > IEEE80211_MAX_SSID_LEN)
3975 return -EINVAL;
3976 }
3977
3978 if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3979 params.hidden_ssid = nla_get_u32(
3980 info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3981 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3982 params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3983 params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3984 return -EINVAL;
3985 }
3986
3987 params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3988
3989 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3990 params.auth_type = nla_get_u32(
3991 info->attrs[NL80211_ATTR_AUTH_TYPE]);
3992 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3993 NL80211_CMD_START_AP))
3994 return -EINVAL;
3995 } else
3996 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3997
3998 err = nl80211_crypto_settings(rdev, info, &params.crypto,
3999 NL80211_MAX_NR_CIPHER_SUITES);
4000 if (err)
4001 return err;
4002
4003 if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
4004 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
4005 return -EOPNOTSUPP;
4006 params.inactivity_timeout = nla_get_u16(
4007 info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
4008 }
4009
4010 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4011 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4012 return -EINVAL;
4013 params.p2p_ctwindow =
4014 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4015 if (params.p2p_ctwindow > 127)
4016 return -EINVAL;
4017 if (params.p2p_ctwindow != 0 &&
4018 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4019 return -EINVAL;
4020 }
4021
4022 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4023 u8 tmp;
4024
4025 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4026 return -EINVAL;
4027 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4028 if (tmp > 1)
4029 return -EINVAL;
4030 params.p2p_opp_ps = tmp;
4031 if (params.p2p_opp_ps != 0 &&
4032 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4033 return -EINVAL;
4034 }
4035
4036 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4037 err = nl80211_parse_chandef(rdev, info, &params.chandef);
4038 if (err)
4039 return err;
4040 } else if (wdev->preset_chandef.chan) {
4041 params.chandef = wdev->preset_chandef;
4042 } else if (!nl80211_get_ap_channel(rdev, &params))
4043 return -EINVAL;
4044
4045 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
4046 wdev->iftype))
4047 return -EINVAL;
4048
4049 if (info->attrs[NL80211_ATTR_TX_RATES]) {
4050 err = nl80211_parse_tx_bitrate_mask(info, &params.beacon_rate);
4051 if (err)
4052 return err;
4053
4054 err = validate_beacon_tx_rate(rdev, params.chandef.chan->band,
4055 &params.beacon_rate);
4056 if (err)
4057 return err;
4058 }
4059
4060 if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
4061 params.smps_mode =
4062 nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
4063 switch (params.smps_mode) {
4064 case NL80211_SMPS_OFF:
4065 break;
4066 case NL80211_SMPS_STATIC:
4067 if (!(rdev->wiphy.features &
4068 NL80211_FEATURE_STATIC_SMPS))
4069 return -EINVAL;
4070 break;
4071 case NL80211_SMPS_DYNAMIC:
4072 if (!(rdev->wiphy.features &
4073 NL80211_FEATURE_DYNAMIC_SMPS))
4074 return -EINVAL;
4075 break;
4076 default:
4077 return -EINVAL;
4078 }
4079 } else {
4080 params.smps_mode = NL80211_SMPS_OFF;
4081 }
4082
4083 params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
4084 if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ])
4085 return -EOPNOTSUPP;
4086
4087 if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
4088 params.acl = parse_acl_data(&rdev->wiphy, info);
4089 if (IS_ERR(params.acl))
4090 return PTR_ERR(params.acl);
4091 }
4092
4093 nl80211_calculate_ap_params(&params);
4094
4095 wdev_lock(wdev);
4096 err = rdev_start_ap(rdev, dev, &params);
4097 if (!err) {
4098 wdev->preset_chandef = params.chandef;
4099 wdev->beacon_interval = params.beacon_interval;
4100 wdev->chandef = params.chandef;
4101 wdev->ssid_len = params.ssid_len;
4102 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
4103 }
4104 wdev_unlock(wdev);
4105
4106 kfree(params.acl);
4107
4108 return err;
4109 }
4110
4111 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
4112 {
4113 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4114 struct net_device *dev = info->user_ptr[1];
4115 struct wireless_dev *wdev = dev->ieee80211_ptr;
4116 struct cfg80211_beacon_data params;
4117 int err;
4118
4119 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4120 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4121 return -EOPNOTSUPP;
4122
4123 if (!rdev->ops->change_beacon)
4124 return -EOPNOTSUPP;
4125
4126 if (!wdev->beacon_interval)
4127 return -EINVAL;
4128
4129 err = nl80211_parse_beacon(info->attrs, &params);
4130 if (err)
4131 return err;
4132
4133 wdev_lock(wdev);
4134 err = rdev_change_beacon(rdev, dev, &params);
4135 wdev_unlock(wdev);
4136
4137 return err;
4138 }
4139
4140 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
4141 {
4142 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4143 struct net_device *dev = info->user_ptr[1];
4144
4145 return cfg80211_stop_ap(rdev, dev, false);
4146 }
4147
4148 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
4149 [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
4150 [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
4151 [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
4152 [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
4153 [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
4154 [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
4155 };
4156
4157 static int parse_station_flags(struct genl_info *info,
4158 enum nl80211_iftype iftype,
4159 struct station_parameters *params)
4160 {
4161 struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
4162 struct nlattr *nla;
4163 int flag;
4164
4165 /*
4166 * Try parsing the new attribute first so userspace
4167 * can specify both for older kernels.
4168 */
4169 nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
4170 if (nla) {
4171 struct nl80211_sta_flag_update *sta_flags;
4172
4173 sta_flags = nla_data(nla);
4174 params->sta_flags_mask = sta_flags->mask;
4175 params->sta_flags_set = sta_flags->set;
4176 params->sta_flags_set &= params->sta_flags_mask;
4177 if ((params->sta_flags_mask |
4178 params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
4179 return -EINVAL;
4180 return 0;
4181 }
4182
4183 /* if present, parse the old attribute */
4184
4185 nla = info->attrs[NL80211_ATTR_STA_FLAGS];
4186 if (!nla)
4187 return 0;
4188
4189 if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX, nla,
4190 sta_flags_policy, info->extack))
4191 return -EINVAL;
4192
4193 /*
4194 * Only allow certain flags for interface types so that
4195 * other attributes are silently ignored. Remember that
4196 * this is backward compatibility code with old userspace
4197 * and shouldn't be hit in other cases anyway.
4198 */
4199 switch (iftype) {
4200 case NL80211_IFTYPE_AP:
4201 case NL80211_IFTYPE_AP_VLAN:
4202 case NL80211_IFTYPE_P2P_GO:
4203 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4204 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4205 BIT(NL80211_STA_FLAG_WME) |
4206 BIT(NL80211_STA_FLAG_MFP);
4207 break;
4208 case NL80211_IFTYPE_P2P_CLIENT:
4209 case NL80211_IFTYPE_STATION:
4210 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4211 BIT(NL80211_STA_FLAG_TDLS_PEER);
4212 break;
4213 case NL80211_IFTYPE_MESH_POINT:
4214 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4215 BIT(NL80211_STA_FLAG_MFP) |
4216 BIT(NL80211_STA_FLAG_AUTHORIZED);
4217 default:
4218 return -EINVAL;
4219 }
4220
4221 for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
4222 if (flags[flag]) {
4223 params->sta_flags_set |= (1<<flag);
4224
4225 /* no longer support new API additions in old API */
4226 if (flag > NL80211_STA_FLAG_MAX_OLD_API)
4227 return -EINVAL;
4228 }
4229 }
4230
4231 return 0;
4232 }
4233
4234 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
4235 int attr)
4236 {
4237 struct nlattr *rate;
4238 u32 bitrate;
4239 u16 bitrate_compat;
4240 enum nl80211_rate_info rate_flg;
4241
4242 rate = nla_nest_start(msg, attr);
4243 if (!rate)
4244 return false;
4245
4246 /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
4247 bitrate = cfg80211_calculate_bitrate(info);
4248 /* report 16-bit bitrate only if we can */
4249 bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
4250 if (bitrate > 0 &&
4251 nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
4252 return false;
4253 if (bitrate_compat > 0 &&
4254 nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
4255 return false;
4256
4257 switch (info->bw) {
4258 case RATE_INFO_BW_5:
4259 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
4260 break;
4261 case RATE_INFO_BW_10:
4262 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
4263 break;
4264 default:
4265 WARN_ON(1);
4266 /* fall through */
4267 case RATE_INFO_BW_20:
4268 rate_flg = 0;
4269 break;
4270 case RATE_INFO_BW_40:
4271 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
4272 break;
4273 case RATE_INFO_BW_80:
4274 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
4275 break;
4276 case RATE_INFO_BW_160:
4277 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
4278 break;
4279 }
4280
4281 if (rate_flg && nla_put_flag(msg, rate_flg))
4282 return false;
4283
4284 if (info->flags & RATE_INFO_FLAGS_MCS) {
4285 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
4286 return false;
4287 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4288 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4289 return false;
4290 } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
4291 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
4292 return false;
4293 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
4294 return false;
4295 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4296 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4297 return false;
4298 }
4299
4300 nla_nest_end(msg, rate);
4301 return true;
4302 }
4303
4304 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
4305 int id)
4306 {
4307 void *attr;
4308 int i = 0;
4309
4310 if (!mask)
4311 return true;
4312
4313 attr = nla_nest_start(msg, id);
4314 if (!attr)
4315 return false;
4316
4317 for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
4318 if (!(mask & BIT(i)))
4319 continue;
4320
4321 if (nla_put_u8(msg, i, signal[i]))
4322 return false;
4323 }
4324
4325 nla_nest_end(msg, attr);
4326
4327 return true;
4328 }
4329
4330 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
4331 u32 seq, int flags,
4332 struct cfg80211_registered_device *rdev,
4333 struct net_device *dev,
4334 const u8 *mac_addr, struct station_info *sinfo)
4335 {
4336 void *hdr;
4337 struct nlattr *sinfoattr, *bss_param;
4338
4339 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
4340 if (!hdr)
4341 return -1;
4342
4343 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4344 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
4345 nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
4346 goto nla_put_failure;
4347
4348 sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
4349 if (!sinfoattr)
4350 goto nla_put_failure;
4351
4352 #define PUT_SINFO(attr, memb, type) do { \
4353 BUILD_BUG_ON(sizeof(type) == sizeof(u64)); \
4354 if (sinfo->filled & (1ULL << NL80211_STA_INFO_ ## attr) && \
4355 nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr, \
4356 sinfo->memb)) \
4357 goto nla_put_failure; \
4358 } while (0)
4359 #define PUT_SINFO_U64(attr, memb) do { \
4360 if (sinfo->filled & (1ULL << NL80211_STA_INFO_ ## attr) && \
4361 nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr, \
4362 sinfo->memb, NL80211_STA_INFO_PAD)) \
4363 goto nla_put_failure; \
4364 } while (0)
4365
4366 PUT_SINFO(CONNECTED_TIME, connected_time, u32);
4367 PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
4368
4369 if (sinfo->filled & (BIT(NL80211_STA_INFO_RX_BYTES) |
4370 BIT(NL80211_STA_INFO_RX_BYTES64)) &&
4371 nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
4372 (u32)sinfo->rx_bytes))
4373 goto nla_put_failure;
4374
4375 if (sinfo->filled & (BIT(NL80211_STA_INFO_TX_BYTES) |
4376 BIT(NL80211_STA_INFO_TX_BYTES64)) &&
4377 nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
4378 (u32)sinfo->tx_bytes))
4379 goto nla_put_failure;
4380
4381 PUT_SINFO_U64(RX_BYTES64, rx_bytes);
4382 PUT_SINFO_U64(TX_BYTES64, tx_bytes);
4383 PUT_SINFO(LLID, llid, u16);
4384 PUT_SINFO(PLID, plid, u16);
4385 PUT_SINFO(PLINK_STATE, plink_state, u8);
4386 PUT_SINFO_U64(RX_DURATION, rx_duration);
4387
4388 switch (rdev->wiphy.signal_type) {
4389 case CFG80211_SIGNAL_TYPE_MBM:
4390 PUT_SINFO(SIGNAL, signal, u8);
4391 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
4392 break;
4393 default:
4394 break;
4395 }
4396 if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL)) {
4397 if (!nl80211_put_signal(msg, sinfo->chains,
4398 sinfo->chain_signal,
4399 NL80211_STA_INFO_CHAIN_SIGNAL))
4400 goto nla_put_failure;
4401 }
4402 if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
4403 if (!nl80211_put_signal(msg, sinfo->chains,
4404 sinfo->chain_signal_avg,
4405 NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
4406 goto nla_put_failure;
4407 }
4408 if (sinfo->filled & BIT(NL80211_STA_INFO_TX_BITRATE)) {
4409 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
4410 NL80211_STA_INFO_TX_BITRATE))
4411 goto nla_put_failure;
4412 }
4413 if (sinfo->filled & BIT(NL80211_STA_INFO_RX_BITRATE)) {
4414 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
4415 NL80211_STA_INFO_RX_BITRATE))
4416 goto nla_put_failure;
4417 }
4418
4419 PUT_SINFO(RX_PACKETS, rx_packets, u32);
4420 PUT_SINFO(TX_PACKETS, tx_packets, u32);
4421 PUT_SINFO(TX_RETRIES, tx_retries, u32);
4422 PUT_SINFO(TX_FAILED, tx_failed, u32);
4423 PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
4424 PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
4425 PUT_SINFO(LOCAL_PM, local_pm, u32);
4426 PUT_SINFO(PEER_PM, peer_pm, u32);
4427 PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
4428
4429 if (sinfo->filled & BIT(NL80211_STA_INFO_BSS_PARAM)) {
4430 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
4431 if (!bss_param)
4432 goto nla_put_failure;
4433
4434 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
4435 nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
4436 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
4437 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
4438 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
4439 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
4440 nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
4441 sinfo->bss_param.dtim_period) ||
4442 nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
4443 sinfo->bss_param.beacon_interval))
4444 goto nla_put_failure;
4445
4446 nla_nest_end(msg, bss_param);
4447 }
4448 if ((sinfo->filled & BIT(NL80211_STA_INFO_STA_FLAGS)) &&
4449 nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
4450 sizeof(struct nl80211_sta_flag_update),
4451 &sinfo->sta_flags))
4452 goto nla_put_failure;
4453
4454 PUT_SINFO_U64(T_OFFSET, t_offset);
4455 PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
4456 PUT_SINFO_U64(BEACON_RX, rx_beacon);
4457 PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
4458
4459 #undef PUT_SINFO
4460 #undef PUT_SINFO_U64
4461
4462 if (sinfo->filled & BIT(NL80211_STA_INFO_TID_STATS)) {
4463 struct nlattr *tidsattr;
4464 int tid;
4465
4466 tidsattr = nla_nest_start(msg, NL80211_STA_INFO_TID_STATS);
4467 if (!tidsattr)
4468 goto nla_put_failure;
4469
4470 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
4471 struct cfg80211_tid_stats *tidstats;
4472 struct nlattr *tidattr;
4473
4474 tidstats = &sinfo->pertid[tid];
4475
4476 if (!tidstats->filled)
4477 continue;
4478
4479 tidattr = nla_nest_start(msg, tid + 1);
4480 if (!tidattr)
4481 goto nla_put_failure;
4482
4483 #define PUT_TIDVAL_U64(attr, memb) do { \
4484 if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) && \
4485 nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr, \
4486 tidstats->memb, NL80211_TID_STATS_PAD)) \
4487 goto nla_put_failure; \
4488 } while (0)
4489
4490 PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
4491 PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
4492 PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
4493 PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
4494
4495 #undef PUT_TIDVAL_U64
4496 nla_nest_end(msg, tidattr);
4497 }
4498
4499 nla_nest_end(msg, tidsattr);
4500 }
4501
4502 nla_nest_end(msg, sinfoattr);
4503
4504 if (sinfo->assoc_req_ies_len &&
4505 nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
4506 sinfo->assoc_req_ies))
4507 goto nla_put_failure;
4508
4509 genlmsg_end(msg, hdr);
4510 return 0;
4511
4512 nla_put_failure:
4513 genlmsg_cancel(msg, hdr);
4514 return -EMSGSIZE;
4515 }
4516
4517 static int nl80211_dump_station(struct sk_buff *skb,
4518 struct netlink_callback *cb)
4519 {
4520 struct station_info sinfo;
4521 struct cfg80211_registered_device *rdev;
4522 struct wireless_dev *wdev;
4523 u8 mac_addr[ETH_ALEN];
4524 int sta_idx = cb->args[2];
4525 int err;
4526
4527 rtnl_lock();
4528 err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4529 if (err)
4530 goto out_err;
4531
4532 if (!wdev->netdev) {
4533 err = -EINVAL;
4534 goto out_err;
4535 }
4536
4537 if (!rdev->ops->dump_station) {
4538 err = -EOPNOTSUPP;
4539 goto out_err;
4540 }
4541
4542 while (1) {
4543 memset(&sinfo, 0, sizeof(sinfo));
4544 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
4545 mac_addr, &sinfo);
4546 if (err == -ENOENT)
4547 break;
4548 if (err)
4549 goto out_err;
4550
4551 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
4552 NETLINK_CB(cb->skb).portid,
4553 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4554 rdev, wdev->netdev, mac_addr,
4555 &sinfo) < 0)
4556 goto out;
4557
4558 sta_idx++;
4559 }
4560
4561 out:
4562 cb->args[2] = sta_idx;
4563 err = skb->len;
4564 out_err:
4565 rtnl_unlock();
4566
4567 return err;
4568 }
4569
4570 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
4571 {
4572 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4573 struct net_device *dev = info->user_ptr[1];
4574 struct station_info sinfo;
4575 struct sk_buff *msg;
4576 u8 *mac_addr = NULL;
4577 int err;
4578
4579 memset(&sinfo, 0, sizeof(sinfo));
4580
4581 if (!info->attrs[NL80211_ATTR_MAC])
4582 return -EINVAL;
4583
4584 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4585
4586 if (!rdev->ops->get_station)
4587 return -EOPNOTSUPP;
4588
4589 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
4590 if (err)
4591 return err;
4592
4593 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4594 if (!msg)
4595 return -ENOMEM;
4596
4597 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
4598 info->snd_portid, info->snd_seq, 0,
4599 rdev, dev, mac_addr, &sinfo) < 0) {
4600 nlmsg_free(msg);
4601 return -ENOBUFS;
4602 }
4603
4604 return genlmsg_reply(msg, info);
4605 }
4606
4607 int cfg80211_check_station_change(struct wiphy *wiphy,
4608 struct station_parameters *params,
4609 enum cfg80211_station_type statype)
4610 {
4611 if (params->listen_interval != -1 &&
4612 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4613 return -EINVAL;
4614
4615 if (params->support_p2p_ps != -1 &&
4616 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4617 return -EINVAL;
4618
4619 if (params->aid &&
4620 !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
4621 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4622 return -EINVAL;
4623
4624 /* When you run into this, adjust the code below for the new flag */
4625 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4626
4627 switch (statype) {
4628 case CFG80211_STA_MESH_PEER_KERNEL:
4629 case CFG80211_STA_MESH_PEER_USER:
4630 /*
4631 * No ignoring the TDLS flag here -- the userspace mesh
4632 * code doesn't have the bug of including TDLS in the
4633 * mask everywhere.
4634 */
4635 if (params->sta_flags_mask &
4636 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4637 BIT(NL80211_STA_FLAG_MFP) |
4638 BIT(NL80211_STA_FLAG_AUTHORIZED)))
4639 return -EINVAL;
4640 break;
4641 case CFG80211_STA_TDLS_PEER_SETUP:
4642 case CFG80211_STA_TDLS_PEER_ACTIVE:
4643 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4644 return -EINVAL;
4645 /* ignore since it can't change */
4646 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4647 break;
4648 default:
4649 /* disallow mesh-specific things */
4650 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
4651 return -EINVAL;
4652 if (params->local_pm)
4653 return -EINVAL;
4654 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4655 return -EINVAL;
4656 }
4657
4658 if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4659 statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
4660 /* TDLS can't be set, ... */
4661 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
4662 return -EINVAL;
4663 /*
4664 * ... but don't bother the driver with it. This works around
4665 * a hostapd/wpa_supplicant issue -- it always includes the
4666 * TLDS_PEER flag in the mask even for AP mode.
4667 */
4668 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4669 }
4670
4671 if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4672 statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4673 /* reject other things that can't change */
4674 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
4675 return -EINVAL;
4676 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
4677 return -EINVAL;
4678 if (params->supported_rates)
4679 return -EINVAL;
4680 if (params->ext_capab || params->ht_capa || params->vht_capa)
4681 return -EINVAL;
4682 }
4683
4684 if (statype != CFG80211_STA_AP_CLIENT &&
4685 statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4686 if (params->vlan)
4687 return -EINVAL;
4688 }
4689
4690 switch (statype) {
4691 case CFG80211_STA_AP_MLME_CLIENT:
4692 /* Use this only for authorizing/unauthorizing a station */
4693 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
4694 return -EOPNOTSUPP;
4695 break;
4696 case CFG80211_STA_AP_CLIENT:
4697 case CFG80211_STA_AP_CLIENT_UNASSOC:
4698 /* accept only the listed bits */
4699 if (params->sta_flags_mask &
4700 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4701 BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4702 BIT(NL80211_STA_FLAG_ASSOCIATED) |
4703 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4704 BIT(NL80211_STA_FLAG_WME) |
4705 BIT(NL80211_STA_FLAG_MFP)))
4706 return -EINVAL;
4707
4708 /* but authenticated/associated only if driver handles it */
4709 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4710 params->sta_flags_mask &
4711 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4712 BIT(NL80211_STA_FLAG_ASSOCIATED)))
4713 return -EINVAL;
4714 break;
4715 case CFG80211_STA_IBSS:
4716 case CFG80211_STA_AP_STA:
4717 /* reject any changes other than AUTHORIZED */
4718 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
4719 return -EINVAL;
4720 break;
4721 case CFG80211_STA_TDLS_PEER_SETUP:
4722 /* reject any changes other than AUTHORIZED or WME */
4723 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4724 BIT(NL80211_STA_FLAG_WME)))
4725 return -EINVAL;
4726 /* force (at least) rates when authorizing */
4727 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
4728 !params->supported_rates)
4729 return -EINVAL;
4730 break;
4731 case CFG80211_STA_TDLS_PEER_ACTIVE:
4732 /* reject any changes */
4733 return -EINVAL;
4734 case CFG80211_STA_MESH_PEER_KERNEL:
4735 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4736 return -EINVAL;
4737 break;
4738 case CFG80211_STA_MESH_PEER_USER:
4739 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
4740 params->plink_action != NL80211_PLINK_ACTION_BLOCK)
4741 return -EINVAL;
4742 break;
4743 }
4744
4745 /*
4746 * Older kernel versions ignored this attribute entirely, so don't
4747 * reject attempts to update it but mark it as unused instead so the
4748 * driver won't look at the data.
4749 */
4750 if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
4751 statype != CFG80211_STA_TDLS_PEER_SETUP)
4752 params->opmode_notif_used = false;
4753
4754 return 0;
4755 }
4756 EXPORT_SYMBOL(cfg80211_check_station_change);
4757
4758 /*
4759 * Get vlan interface making sure it is running and on the right wiphy.
4760 */
4761 static struct net_device *get_vlan(struct genl_info *info,
4762 struct cfg80211_registered_device *rdev)
4763 {
4764 struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
4765 struct net_device *v;
4766 int ret;
4767
4768 if (!vlanattr)
4769 return NULL;
4770
4771 v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
4772 if (!v)
4773 return ERR_PTR(-ENODEV);
4774
4775 if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
4776 ret = -EINVAL;
4777 goto error;
4778 }
4779
4780 if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4781 v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4782 v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
4783 ret = -EINVAL;
4784 goto error;
4785 }
4786
4787 if (!netif_running(v)) {
4788 ret = -ENETDOWN;
4789 goto error;
4790 }
4791
4792 return v;
4793 error:
4794 dev_put(v);
4795 return ERR_PTR(ret);
4796 }
4797
4798 static const struct nla_policy
4799 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
4800 [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
4801 [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
4802 };
4803
4804 static int nl80211_parse_sta_wme(struct genl_info *info,
4805 struct station_parameters *params)
4806 {
4807 struct nlattr *tb[NL80211_STA_WME_MAX + 1];
4808 struct nlattr *nla;
4809 int err;
4810
4811 /* parse WME attributes if present */
4812 if (!info->attrs[NL80211_ATTR_STA_WME])
4813 return 0;
4814
4815 nla = info->attrs[NL80211_ATTR_STA_WME];
4816 err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
4817 nl80211_sta_wme_policy, info->extack);
4818 if (err)
4819 return err;
4820
4821 if (tb[NL80211_STA_WME_UAPSD_QUEUES])
4822 params->uapsd_queues = nla_get_u8(
4823 tb[NL80211_STA_WME_UAPSD_QUEUES]);
4824 if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
4825 return -EINVAL;
4826
4827 if (tb[NL80211_STA_WME_MAX_SP])
4828 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
4829
4830 if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
4831 return -EINVAL;
4832
4833 params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
4834
4835 return 0;
4836 }
4837
4838 static int nl80211_parse_sta_channel_info(struct genl_info *info,
4839 struct station_parameters *params)
4840 {
4841 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
4842 params->supported_channels =
4843 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4844 params->supported_channels_len =
4845 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4846 /*
4847 * Need to include at least one (first channel, number of
4848 * channels) tuple for each subband, and must have proper
4849 * tuples for the rest of the data as well.
4850 */
4851 if (params->supported_channels_len < 2)
4852 return -EINVAL;
4853 if (params->supported_channels_len % 2)
4854 return -EINVAL;
4855 }
4856
4857 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
4858 params->supported_oper_classes =
4859 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4860 params->supported_oper_classes_len =
4861 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4862 /*
4863 * The value of the Length field of the Supported Operating
4864 * Classes element is between 2 and 253.
4865 */
4866 if (params->supported_oper_classes_len < 2 ||
4867 params->supported_oper_classes_len > 253)
4868 return -EINVAL;
4869 }
4870 return 0;
4871 }
4872
4873 static int nl80211_set_station_tdls(struct genl_info *info,
4874 struct station_parameters *params)
4875 {
4876 int err;
4877 /* Dummy STA entry gets updated once the peer capabilities are known */
4878 if (info->attrs[NL80211_ATTR_PEER_AID])
4879 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4880 if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4881 params->ht_capa =
4882 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4883 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4884 params->vht_capa =
4885 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4886
4887 err = nl80211_parse_sta_channel_info(info, params);
4888 if (err)
4889 return err;
4890
4891 return nl80211_parse_sta_wme(info, params);
4892 }
4893
4894 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
4895 {
4896 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4897 struct net_device *dev = info->user_ptr[1];
4898 struct station_parameters params;
4899 u8 *mac_addr;
4900 int err;
4901
4902 memset(&params, 0, sizeof(params));
4903
4904 if (!rdev->ops->change_station)
4905 return -EOPNOTSUPP;
4906
4907 /*
4908 * AID and listen_interval properties can be set only for unassociated
4909 * station. Include these parameters here and will check them in
4910 * cfg80211_check_station_change().
4911 */
4912 if (info->attrs[NL80211_ATTR_STA_AID])
4913 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4914
4915 if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4916 params.listen_interval =
4917 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4918 else
4919 params.listen_interval = -1;
4920
4921 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
4922 u8 tmp;
4923
4924 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
4925 if (tmp >= NUM_NL80211_P2P_PS_STATUS)
4926 return -EINVAL;
4927
4928 params.support_p2p_ps = tmp;
4929 } else {
4930 params.support_p2p_ps = -1;
4931 }
4932
4933 if (!info->attrs[NL80211_ATTR_MAC])
4934 return -EINVAL;
4935
4936 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4937
4938 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
4939 params.supported_rates =
4940 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4941 params.supported_rates_len =
4942 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4943 }
4944
4945 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4946 params.capability =
4947 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4948 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4949 }
4950
4951 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4952 params.ext_capab =
4953 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4954 params.ext_capab_len =
4955 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4956 }
4957
4958 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4959 return -EINVAL;
4960
4961 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4962 params.plink_action =
4963 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4964 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4965 return -EINVAL;
4966 }
4967
4968 if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
4969 params.plink_state =
4970 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
4971 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
4972 return -EINVAL;
4973 if (info->attrs[NL80211_ATTR_MESH_PEER_AID]) {
4974 params.peer_aid = nla_get_u16(
4975 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
4976 if (params.peer_aid > IEEE80211_MAX_AID)
4977 return -EINVAL;
4978 }
4979 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
4980 }
4981
4982 if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
4983 enum nl80211_mesh_power_mode pm = nla_get_u32(
4984 info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
4985
4986 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
4987 pm > NL80211_MESH_POWER_MAX)
4988 return -EINVAL;
4989
4990 params.local_pm = pm;
4991 }
4992
4993 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
4994 params.opmode_notif_used = true;
4995 params.opmode_notif =
4996 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
4997 }
4998
4999 /* Include parameters for TDLS peer (will check later) */
5000 err = nl80211_set_station_tdls(info, &params);
5001 if (err)
5002 return err;
5003
5004 params.vlan = get_vlan(info, rdev);
5005 if (IS_ERR(params.vlan))
5006 return PTR_ERR(params.vlan);
5007
5008 switch (dev->ieee80211_ptr->iftype) {
5009 case NL80211_IFTYPE_AP:
5010 case NL80211_IFTYPE_AP_VLAN:
5011 case NL80211_IFTYPE_P2P_GO:
5012 case NL80211_IFTYPE_P2P_CLIENT:
5013 case NL80211_IFTYPE_STATION:
5014 case NL80211_IFTYPE_ADHOC:
5015 case NL80211_IFTYPE_MESH_POINT:
5016 break;
5017 default:
5018 err = -EOPNOTSUPP;
5019 goto out_put_vlan;
5020 }
5021
5022 /* driver will call cfg80211_check_station_change() */
5023 err = rdev_change_station(rdev, dev, mac_addr, &params);
5024
5025 out_put_vlan:
5026 if (params.vlan)
5027 dev_put(params.vlan);
5028
5029 return err;
5030 }
5031
5032 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
5033 {
5034 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5035 int err;
5036 struct net_device *dev = info->user_ptr[1];
5037 struct station_parameters params;
5038 u8 *mac_addr = NULL;
5039 u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5040 BIT(NL80211_STA_FLAG_ASSOCIATED);
5041
5042 memset(&params, 0, sizeof(params));
5043
5044 if (!rdev->ops->add_station)
5045 return -EOPNOTSUPP;
5046
5047 if (!info->attrs[NL80211_ATTR_MAC])
5048 return -EINVAL;
5049
5050 if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
5051 return -EINVAL;
5052
5053 if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
5054 return -EINVAL;
5055
5056 if (!info->attrs[NL80211_ATTR_STA_AID] &&
5057 !info->attrs[NL80211_ATTR_PEER_AID])
5058 return -EINVAL;
5059
5060 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5061 params.supported_rates =
5062 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5063 params.supported_rates_len =
5064 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5065 params.listen_interval =
5066 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
5067
5068 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
5069 u8 tmp;
5070
5071 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
5072 if (tmp >= NUM_NL80211_P2P_PS_STATUS)
5073 return -EINVAL;
5074
5075 params.support_p2p_ps = tmp;
5076 } else {
5077 /*
5078 * if not specified, assume it's supported for P2P GO interface,
5079 * and is NOT supported for AP interface
5080 */
5081 params.support_p2p_ps =
5082 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
5083 }
5084
5085 if (info->attrs[NL80211_ATTR_PEER_AID])
5086 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
5087 else
5088 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
5089 if (!params.aid || params.aid > IEEE80211_MAX_AID)
5090 return -EINVAL;
5091
5092 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
5093 params.capability =
5094 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
5095 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
5096 }
5097
5098 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
5099 params.ext_capab =
5100 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5101 params.ext_capab_len =
5102 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5103 }
5104
5105 if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
5106 params.ht_capa =
5107 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5108
5109 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
5110 params.vht_capa =
5111 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
5112
5113 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
5114 params.opmode_notif_used = true;
5115 params.opmode_notif =
5116 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
5117 }
5118
5119 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
5120 params.plink_action =
5121 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
5122 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
5123 return -EINVAL;
5124 }
5125
5126 err = nl80211_parse_sta_channel_info(info, &params);
5127 if (err)
5128 return err;
5129
5130 err = nl80211_parse_sta_wme(info, &params);
5131 if (err)
5132 return err;
5133
5134 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
5135 return -EINVAL;
5136
5137 /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
5138 * as userspace might just pass through the capabilities from the IEs
5139 * directly, rather than enforcing this restriction and returning an
5140 * error in this case.
5141 */
5142 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
5143 params.ht_capa = NULL;
5144 params.vht_capa = NULL;
5145 }
5146
5147 /* When you run into this, adjust the code below for the new flag */
5148 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
5149
5150 switch (dev->ieee80211_ptr->iftype) {
5151 case NL80211_IFTYPE_AP:
5152 case NL80211_IFTYPE_AP_VLAN:
5153 case NL80211_IFTYPE_P2P_GO:
5154 /* ignore WME attributes if iface/sta is not capable */
5155 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
5156 !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
5157 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5158
5159 /* TDLS peers cannot be added */
5160 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5161 info->attrs[NL80211_ATTR_PEER_AID])
5162 return -EINVAL;
5163 /* but don't bother the driver with it */
5164 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
5165
5166 /* allow authenticated/associated only if driver handles it */
5167 if (!(rdev->wiphy.features &
5168 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
5169 params.sta_flags_mask & auth_assoc)
5170 return -EINVAL;
5171
5172 /* Older userspace, or userspace wanting to be compatible with
5173 * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
5174 * and assoc flags in the mask, but assumes the station will be
5175 * added as associated anyway since this was the required driver
5176 * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
5177 * introduced.
5178 * In order to not bother drivers with this quirk in the API
5179 * set the flags in both the mask and set for new stations in
5180 * this case.
5181 */
5182 if (!(params.sta_flags_mask & auth_assoc)) {
5183 params.sta_flags_mask |= auth_assoc;
5184 params.sta_flags_set |= auth_assoc;
5185 }
5186
5187 /* must be last in here for error handling */
5188 params.vlan = get_vlan(info, rdev);
5189 if (IS_ERR(params.vlan))
5190 return PTR_ERR(params.vlan);
5191 break;
5192 case NL80211_IFTYPE_MESH_POINT:
5193 /* ignore uAPSD data */
5194 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5195
5196 /* associated is disallowed */
5197 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
5198 return -EINVAL;
5199 /* TDLS peers cannot be added */
5200 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5201 info->attrs[NL80211_ATTR_PEER_AID])
5202 return -EINVAL;
5203 break;
5204 case NL80211_IFTYPE_STATION:
5205 case NL80211_IFTYPE_P2P_CLIENT:
5206 /* ignore uAPSD data */
5207 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5208
5209 /* these are disallowed */
5210 if (params.sta_flags_mask &
5211 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
5212 BIT(NL80211_STA_FLAG_AUTHENTICATED)))
5213 return -EINVAL;
5214 /* Only TDLS peers can be added */
5215 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
5216 return -EINVAL;
5217 /* Can only add if TDLS ... */
5218 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
5219 return -EOPNOTSUPP;
5220 /* ... with external setup is supported */
5221 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
5222 return -EOPNOTSUPP;
5223 /*
5224 * Older wpa_supplicant versions always mark the TDLS peer
5225 * as authorized, but it shouldn't yet be.
5226 */
5227 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
5228 break;
5229 default:
5230 return -EOPNOTSUPP;
5231 }
5232
5233 /* be aware of params.vlan when changing code here */
5234
5235 err = rdev_add_station(rdev, dev, mac_addr, &params);
5236
5237 if (params.vlan)
5238 dev_put(params.vlan);
5239 return err;
5240 }
5241
5242 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
5243 {
5244 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5245 struct net_device *dev = info->user_ptr[1];
5246 struct station_del_parameters params;
5247
5248 memset(&params, 0, sizeof(params));
5249
5250 if (info->attrs[NL80211_ATTR_MAC])
5251 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
5252
5253 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5254 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5255 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5256 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5257 return -EINVAL;
5258
5259 if (!rdev->ops->del_station)
5260 return -EOPNOTSUPP;
5261
5262 if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
5263 params.subtype =
5264 nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
5265 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
5266 params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
5267 return -EINVAL;
5268 } else {
5269 /* Default to Deauthentication frame */
5270 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
5271 }
5272
5273 if (info->attrs[NL80211_ATTR_REASON_CODE]) {
5274 params.reason_code =
5275 nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5276 if (params.reason_code == 0)
5277 return -EINVAL; /* 0 is reserved */
5278 } else {
5279 /* Default to reason code 2 */
5280 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
5281 }
5282
5283 return rdev_del_station(rdev, dev, &params);
5284 }
5285
5286 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
5287 int flags, struct net_device *dev,
5288 u8 *dst, u8 *next_hop,
5289 struct mpath_info *pinfo)
5290 {
5291 void *hdr;
5292 struct nlattr *pinfoattr;
5293
5294 hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
5295 if (!hdr)
5296 return -1;
5297
5298 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5299 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
5300 nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
5301 nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
5302 goto nla_put_failure;
5303
5304 pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
5305 if (!pinfoattr)
5306 goto nla_put_failure;
5307 if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
5308 nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
5309 pinfo->frame_qlen))
5310 goto nla_put_failure;
5311 if (((pinfo->filled & MPATH_INFO_SN) &&
5312 nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
5313 ((pinfo->filled & MPATH_INFO_METRIC) &&
5314 nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
5315 pinfo->metric)) ||
5316 ((pinfo->filled & MPATH_INFO_EXPTIME) &&
5317 nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
5318 pinfo->exptime)) ||
5319 ((pinfo->filled & MPATH_INFO_FLAGS) &&
5320 nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
5321 pinfo->flags)) ||
5322 ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
5323 nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
5324 pinfo->discovery_timeout)) ||
5325 ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
5326 nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
5327 pinfo->discovery_retries)))
5328 goto nla_put_failure;
5329
5330 nla_nest_end(msg, pinfoattr);
5331
5332 genlmsg_end(msg, hdr);
5333 return 0;
5334
5335 nla_put_failure:
5336 genlmsg_cancel(msg, hdr);
5337 return -EMSGSIZE;
5338 }
5339
5340 static int nl80211_dump_mpath(struct sk_buff *skb,
5341 struct netlink_callback *cb)
5342 {
5343 struct mpath_info pinfo;
5344 struct cfg80211_registered_device *rdev;
5345 struct wireless_dev *wdev;
5346 u8 dst[ETH_ALEN];
5347 u8 next_hop[ETH_ALEN];
5348 int path_idx = cb->args[2];
5349 int err;
5350
5351 rtnl_lock();
5352 err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5353 if (err)
5354 goto out_err;
5355
5356 if (!rdev->ops->dump_mpath) {
5357 err = -EOPNOTSUPP;
5358 goto out_err;
5359 }
5360
5361 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
5362 err = -EOPNOTSUPP;
5363 goto out_err;
5364 }
5365
5366 while (1) {
5367 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
5368 next_hop, &pinfo);
5369 if (err == -ENOENT)
5370 break;
5371 if (err)
5372 goto out_err;
5373
5374 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
5375 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5376 wdev->netdev, dst, next_hop,
5377 &pinfo) < 0)
5378 goto out;
5379
5380 path_idx++;
5381 }
5382
5383 out:
5384 cb->args[2] = path_idx;
5385 err = skb->len;
5386 out_err:
5387 rtnl_unlock();
5388 return err;
5389 }
5390
5391 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
5392 {
5393 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5394 int err;
5395 struct net_device *dev = info->user_ptr[1];
5396 struct mpath_info pinfo;
5397 struct sk_buff *msg;
5398 u8 *dst = NULL;
5399 u8 next_hop[ETH_ALEN];
5400
5401 memset(&pinfo, 0, sizeof(pinfo));
5402
5403 if (!info->attrs[NL80211_ATTR_MAC])
5404 return -EINVAL;
5405
5406 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5407
5408 if (!rdev->ops->get_mpath)
5409 return -EOPNOTSUPP;
5410
5411 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5412 return -EOPNOTSUPP;
5413
5414 err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
5415 if (err)
5416 return err;
5417
5418 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5419 if (!msg)
5420 return -ENOMEM;
5421
5422 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
5423 dev, dst, next_hop, &pinfo) < 0) {
5424 nlmsg_free(msg);
5425 return -ENOBUFS;
5426 }
5427
5428 return genlmsg_reply(msg, info);
5429 }
5430
5431 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
5432 {
5433 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5434 struct net_device *dev = info->user_ptr[1];
5435 u8 *dst = NULL;
5436 u8 *next_hop = NULL;
5437
5438 if (!info->attrs[NL80211_ATTR_MAC])
5439 return -EINVAL;
5440
5441 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
5442 return -EINVAL;
5443
5444 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5445 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
5446
5447 if (!rdev->ops->change_mpath)
5448 return -EOPNOTSUPP;
5449
5450 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5451 return -EOPNOTSUPP;
5452
5453 return rdev_change_mpath(rdev, dev, dst, next_hop);
5454 }
5455
5456 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
5457 {
5458 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5459 struct net_device *dev = info->user_ptr[1];
5460 u8 *dst = NULL;
5461 u8 *next_hop = NULL;
5462
5463 if (!info->attrs[NL80211_ATTR_MAC])
5464 return -EINVAL;
5465
5466 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
5467 return -EINVAL;
5468
5469 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5470 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
5471
5472 if (!rdev->ops->add_mpath)
5473 return -EOPNOTSUPP;
5474
5475 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5476 return -EOPNOTSUPP;
5477
5478 return rdev_add_mpath(rdev, dev, dst, next_hop);
5479 }
5480
5481 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
5482 {
5483 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5484 struct net_device *dev = info->user_ptr[1];
5485 u8 *dst = NULL;
5486
5487 if (info->attrs[NL80211_ATTR_MAC])
5488 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5489
5490 if (!rdev->ops->del_mpath)
5491 return -EOPNOTSUPP;
5492
5493 return rdev_del_mpath(rdev, dev, dst);
5494 }
5495
5496 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
5497 {
5498 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5499 int err;
5500 struct net_device *dev = info->user_ptr[1];
5501 struct mpath_info pinfo;
5502 struct sk_buff *msg;
5503 u8 *dst = NULL;
5504 u8 mpp[ETH_ALEN];
5505
5506 memset(&pinfo, 0, sizeof(pinfo));
5507
5508 if (!info->attrs[NL80211_ATTR_MAC])
5509 return -EINVAL;
5510
5511 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5512
5513 if (!rdev->ops->get_mpp)
5514 return -EOPNOTSUPP;
5515
5516 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5517 return -EOPNOTSUPP;
5518
5519 err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
5520 if (err)
5521 return err;
5522
5523 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5524 if (!msg)
5525 return -ENOMEM;
5526
5527 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
5528 dev, dst, mpp, &pinfo) < 0) {
5529 nlmsg_free(msg);
5530 return -ENOBUFS;
5531 }
5532
5533 return genlmsg_reply(msg, info);
5534 }
5535
5536 static int nl80211_dump_mpp(struct sk_buff *skb,
5537 struct netlink_callback *cb)
5538 {
5539 struct mpath_info pinfo;
5540 struct cfg80211_registered_device *rdev;
5541 struct wireless_dev *wdev;
5542 u8 dst[ETH_ALEN];
5543 u8 mpp[ETH_ALEN];
5544 int path_idx = cb->args[2];
5545 int err;
5546
5547 rtnl_lock();
5548 err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5549 if (err)
5550 goto out_err;
5551
5552 if (!rdev->ops->dump_mpp) {
5553 err = -EOPNOTSUPP;
5554 goto out_err;
5555 }
5556
5557 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
5558 err = -EOPNOTSUPP;
5559 goto out_err;
5560 }
5561
5562 while (1) {
5563 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
5564 mpp, &pinfo);
5565 if (err == -ENOENT)
5566 break;
5567 if (err)
5568 goto out_err;
5569
5570 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
5571 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5572 wdev->netdev, dst, mpp,
5573 &pinfo) < 0)
5574 goto out;
5575
5576 path_idx++;
5577 }
5578
5579 out:
5580 cb->args[2] = path_idx;
5581 err = skb->len;
5582 out_err:
5583 rtnl_unlock();
5584 return err;
5585 }
5586
5587 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
5588 {
5589 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5590 struct net_device *dev = info->user_ptr[1];
5591 struct wireless_dev *wdev = dev->ieee80211_ptr;
5592 struct bss_parameters params;
5593 int err;
5594
5595 memset(&params, 0, sizeof(params));
5596 /* default to not changing parameters */
5597 params.use_cts_prot = -1;
5598 params.use_short_preamble = -1;
5599 params.use_short_slot_time = -1;
5600 params.ap_isolate = -1;
5601 params.ht_opmode = -1;
5602 params.p2p_ctwindow = -1;
5603 params.p2p_opp_ps = -1;
5604
5605 if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
5606 params.use_cts_prot =
5607 nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
5608 if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
5609 params.use_short_preamble =
5610 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
5611 if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
5612 params.use_short_slot_time =
5613 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
5614 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
5615 params.basic_rates =
5616 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5617 params.basic_rates_len =
5618 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5619 }
5620 if (info->attrs[NL80211_ATTR_AP_ISOLATE])
5621 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
5622 if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
5623 params.ht_opmode =
5624 nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
5625
5626 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
5627 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5628 return -EINVAL;
5629 params.p2p_ctwindow =
5630 nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
5631 if (params.p2p_ctwindow < 0)
5632 return -EINVAL;
5633 if (params.p2p_ctwindow != 0 &&
5634 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
5635 return -EINVAL;
5636 }
5637
5638 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
5639 u8 tmp;
5640
5641 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5642 return -EINVAL;
5643 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
5644 if (tmp > 1)
5645 return -EINVAL;
5646 params.p2p_opp_ps = tmp;
5647 if (params.p2p_opp_ps &&
5648 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
5649 return -EINVAL;
5650 }
5651
5652 if (!rdev->ops->change_bss)
5653 return -EOPNOTSUPP;
5654
5655 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5656 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5657 return -EOPNOTSUPP;
5658
5659 wdev_lock(wdev);
5660 err = rdev_change_bss(rdev, dev, &params);
5661 wdev_unlock(wdev);
5662
5663 return err;
5664 }
5665
5666 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
5667 {
5668 char *data = NULL;
5669 bool is_indoor;
5670 enum nl80211_user_reg_hint_type user_reg_hint_type;
5671 u32 owner_nlportid;
5672
5673 /*
5674 * You should only get this when cfg80211 hasn't yet initialized
5675 * completely when built-in to the kernel right between the time
5676 * window between nl80211_init() and regulatory_init(), if that is
5677 * even possible.
5678 */
5679 if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
5680 return -EINPROGRESS;
5681
5682 if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
5683 user_reg_hint_type =
5684 nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
5685 else
5686 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
5687
5688 switch (user_reg_hint_type) {
5689 case NL80211_USER_REG_HINT_USER:
5690 case NL80211_USER_REG_HINT_CELL_BASE:
5691 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5692 return -EINVAL;
5693
5694 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5695 return regulatory_hint_user(data, user_reg_hint_type);
5696 case NL80211_USER_REG_HINT_INDOOR:
5697 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
5698 owner_nlportid = info->snd_portid;
5699 is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
5700 } else {
5701 owner_nlportid = 0;
5702 is_indoor = true;
5703 }
5704
5705 return regulatory_hint_indoor(is_indoor, owner_nlportid);
5706 default:
5707 return -EINVAL;
5708 }
5709 }
5710
5711 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
5712 {
5713 return reg_reload_regdb();
5714 }
5715
5716 static int nl80211_get_mesh_config(struct sk_buff *skb,
5717 struct genl_info *info)
5718 {
5719 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5720 struct net_device *dev = info->user_ptr[1];
5721 struct wireless_dev *wdev = dev->ieee80211_ptr;
5722 struct mesh_config cur_params;
5723 int err = 0;
5724 void *hdr;
5725 struct nlattr *pinfoattr;
5726 struct sk_buff *msg;
5727
5728 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5729 return -EOPNOTSUPP;
5730
5731 if (!rdev->ops->get_mesh_config)
5732 return -EOPNOTSUPP;
5733
5734 wdev_lock(wdev);
5735 /* If not connected, get default parameters */
5736 if (!wdev->mesh_id_len)
5737 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
5738 else
5739 err = rdev_get_mesh_config(rdev, dev, &cur_params);
5740 wdev_unlock(wdev);
5741
5742 if (err)
5743 return err;
5744
5745 /* Draw up a netlink message to send back */
5746 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5747 if (!msg)
5748 return -ENOMEM;
5749 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5750 NL80211_CMD_GET_MESH_CONFIG);
5751 if (!hdr)
5752 goto out;
5753 pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
5754 if (!pinfoattr)
5755 goto nla_put_failure;
5756 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5757 nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
5758 cur_params.dot11MeshRetryTimeout) ||
5759 nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5760 cur_params.dot11MeshConfirmTimeout) ||
5761 nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
5762 cur_params.dot11MeshHoldingTimeout) ||
5763 nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
5764 cur_params.dot11MeshMaxPeerLinks) ||
5765 nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
5766 cur_params.dot11MeshMaxRetries) ||
5767 nla_put_u8(msg, NL80211_MESHCONF_TTL,
5768 cur_params.dot11MeshTTL) ||
5769 nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
5770 cur_params.element_ttl) ||
5771 nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5772 cur_params.auto_open_plinks) ||
5773 nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5774 cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
5775 nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5776 cur_params.dot11MeshHWMPmaxPREQretries) ||
5777 nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
5778 cur_params.path_refresh_time) ||
5779 nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5780 cur_params.min_discovery_timeout) ||
5781 nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5782 cur_params.dot11MeshHWMPactivePathTimeout) ||
5783 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5784 cur_params.dot11MeshHWMPpreqMinInterval) ||
5785 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5786 cur_params.dot11MeshHWMPperrMinInterval) ||
5787 nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5788 cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
5789 nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
5790 cur_params.dot11MeshHWMPRootMode) ||
5791 nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5792 cur_params.dot11MeshHWMPRannInterval) ||
5793 nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5794 cur_params.dot11MeshGateAnnouncementProtocol) ||
5795 nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
5796 cur_params.dot11MeshForwarding) ||
5797 nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
5798 cur_params.rssi_threshold) ||
5799 nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
5800 cur_params.ht_opmode) ||
5801 nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5802 cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
5803 nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5804 cur_params.dot11MeshHWMProotInterval) ||
5805 nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5806 cur_params.dot11MeshHWMPconfirmationInterval) ||
5807 nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
5808 cur_params.power_mode) ||
5809 nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
5810 cur_params.dot11MeshAwakeWindowDuration) ||
5811 nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
5812 cur_params.plink_timeout))
5813 goto nla_put_failure;
5814 nla_nest_end(msg, pinfoattr);
5815 genlmsg_end(msg, hdr);
5816 return genlmsg_reply(msg, info);
5817
5818 nla_put_failure:
5819 genlmsg_cancel(msg, hdr);
5820 out:
5821 nlmsg_free(msg);
5822 return -ENOBUFS;
5823 }
5824
5825 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
5826 [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
5827 [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
5828 [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
5829 [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
5830 [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
5831 [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
5832 [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
5833 [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
5834 [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
5835 [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
5836 [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
5837 [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
5838 [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
5839 [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
5840 [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
5841 [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
5842 [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
5843 [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
5844 [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
5845 [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
5846 [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
5847 [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
5848 [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
5849 [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
5850 [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
5851 [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
5852 [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
5853 [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
5854 };
5855
5856 static const struct nla_policy
5857 nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
5858 [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
5859 [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
5860 [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
5861 [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
5862 [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
5863 [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
5864 [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
5865 .len = IEEE80211_MAX_DATA_LEN },
5866 [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
5867 };
5868
5869 static int nl80211_check_bool(const struct nlattr *nla, u8 min, u8 max, bool *out)
5870 {
5871 u8 val = nla_get_u8(nla);
5872 if (val < min || val > max)
5873 return -EINVAL;
5874 *out = val;
5875 return 0;
5876 }
5877
5878 static int nl80211_check_u8(const struct nlattr *nla, u8 min, u8 max, u8 *out)
5879 {
5880 u8 val = nla_get_u8(nla);
5881 if (val < min || val > max)
5882 return -EINVAL;
5883 *out = val;
5884 return 0;
5885 }
5886
5887 static int nl80211_check_u16(const struct nlattr *nla, u16 min, u16 max, u16 *out)
5888 {
5889 u16 val = nla_get_u16(nla);
5890 if (val < min || val > max)
5891 return -EINVAL;
5892 *out = val;
5893 return 0;
5894 }
5895
5896 static int nl80211_check_u32(const struct nlattr *nla, u32 min, u32 max, u32 *out)
5897 {
5898 u32 val = nla_get_u32(nla);
5899 if (val < min || val > max)
5900 return -EINVAL;
5901 *out = val;
5902 return 0;
5903 }
5904
5905 static int nl80211_check_s32(const struct nlattr *nla, s32 min, s32 max, s32 *out)
5906 {
5907 s32 val = nla_get_s32(nla);
5908 if (val < min || val > max)
5909 return -EINVAL;
5910 *out = val;
5911 return 0;
5912 }
5913
5914 static int nl80211_check_power_mode(const struct nlattr *nla,
5915 enum nl80211_mesh_power_mode min,
5916 enum nl80211_mesh_power_mode max,
5917 enum nl80211_mesh_power_mode *out)
5918 {
5919 u32 val = nla_get_u32(nla);
5920 if (val < min || val > max)
5921 return -EINVAL;
5922 *out = val;
5923 return 0;
5924 }
5925
5926 static int nl80211_parse_mesh_config(struct genl_info *info,
5927 struct mesh_config *cfg,
5928 u32 *mask_out)
5929 {
5930 struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
5931 u32 mask = 0;
5932 u16 ht_opmode;
5933
5934 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
5935 do { \
5936 if (tb[attr]) { \
5937 if (fn(tb[attr], min, max, &cfg->param)) \
5938 return -EINVAL; \
5939 mask |= (1 << (attr - 1)); \
5940 } \
5941 } while (0)
5942
5943 if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
5944 return -EINVAL;
5945 if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
5946 info->attrs[NL80211_ATTR_MESH_CONFIG],
5947 nl80211_meshconf_params_policy, info->extack))
5948 return -EINVAL;
5949
5950 /* This makes sure that there aren't more than 32 mesh config
5951 * parameters (otherwise our bitfield scheme would not work.) */
5952 BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
5953
5954 /* Fill in the params struct */
5955 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
5956 mask, NL80211_MESHCONF_RETRY_TIMEOUT,
5957 nl80211_check_u16);
5958 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
5959 mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5960 nl80211_check_u16);
5961 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
5962 mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
5963 nl80211_check_u16);
5964 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
5965 mask, NL80211_MESHCONF_MAX_PEER_LINKS,
5966 nl80211_check_u16);
5967 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
5968 mask, NL80211_MESHCONF_MAX_RETRIES,
5969 nl80211_check_u8);
5970 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
5971 mask, NL80211_MESHCONF_TTL, nl80211_check_u8);
5972 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
5973 mask, NL80211_MESHCONF_ELEMENT_TTL,
5974 nl80211_check_u8);
5975 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
5976 mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5977 nl80211_check_bool);
5978 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
5979 1, 255, mask,
5980 NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5981 nl80211_check_u32);
5982 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
5983 mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5984 nl80211_check_u8);
5985 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
5986 mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
5987 nl80211_check_u32);
5988 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
5989 mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5990 nl80211_check_u16);
5991 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
5992 1, 65535, mask,
5993 NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5994 nl80211_check_u32);
5995 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
5996 1, 65535, mask,
5997 NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5998 nl80211_check_u16);
5999 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
6000 1, 65535, mask,
6001 NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
6002 nl80211_check_u16);
6003 FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6004 dot11MeshHWMPnetDiameterTraversalTime,
6005 1, 65535, mask,
6006 NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
6007 nl80211_check_u16);
6008 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
6009 mask, NL80211_MESHCONF_HWMP_ROOTMODE,
6010 nl80211_check_u8);
6011 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
6012 mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
6013 nl80211_check_u16);
6014 FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6015 dot11MeshGateAnnouncementProtocol, 0, 1,
6016 mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
6017 nl80211_check_bool);
6018 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
6019 mask, NL80211_MESHCONF_FORWARDING,
6020 nl80211_check_bool);
6021 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
6022 mask, NL80211_MESHCONF_RSSI_THRESHOLD,
6023 nl80211_check_s32);
6024 /*
6025 * Check HT operation mode based on
6026 * IEEE 802.11 2012 8.4.2.59 HT Operation element.
6027 */
6028 if (tb[NL80211_MESHCONF_HT_OPMODE]) {
6029 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
6030
6031 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
6032 IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
6033 IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
6034 return -EINVAL;
6035
6036 if ((ht_opmode & IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT) &&
6037 (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
6038 return -EINVAL;
6039
6040 switch (ht_opmode & IEEE80211_HT_OP_MODE_PROTECTION) {
6041 case IEEE80211_HT_OP_MODE_PROTECTION_NONE:
6042 case IEEE80211_HT_OP_MODE_PROTECTION_20MHZ:
6043 if (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)
6044 return -EINVAL;
6045 break;
6046 case IEEE80211_HT_OP_MODE_PROTECTION_NONMEMBER:
6047 case IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED:
6048 if (!(ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
6049 return -EINVAL;
6050 break;
6051 }
6052 cfg->ht_opmode = ht_opmode;
6053 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
6054 }
6055 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
6056 1, 65535, mask,
6057 NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
6058 nl80211_check_u32);
6059 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
6060 mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
6061 nl80211_check_u16);
6062 FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6063 dot11MeshHWMPconfirmationInterval,
6064 1, 65535, mask,
6065 NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
6066 nl80211_check_u16);
6067 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
6068 NL80211_MESH_POWER_ACTIVE,
6069 NL80211_MESH_POWER_MAX,
6070 mask, NL80211_MESHCONF_POWER_MODE,
6071 nl80211_check_power_mode);
6072 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
6073 0, 65535, mask,
6074 NL80211_MESHCONF_AWAKE_WINDOW, nl80211_check_u16);
6075 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 0, 0xffffffff,
6076 mask, NL80211_MESHCONF_PLINK_TIMEOUT,
6077 nl80211_check_u32);
6078 if (mask_out)
6079 *mask_out = mask;
6080
6081 return 0;
6082
6083 #undef FILL_IN_MESH_PARAM_IF_SET
6084 }
6085
6086 static int nl80211_parse_mesh_setup(struct genl_info *info,
6087 struct mesh_setup *setup)
6088 {
6089 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6090 struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
6091
6092 if (!info->attrs[NL80211_ATTR_MESH_SETUP])
6093 return -EINVAL;
6094 if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
6095 info->attrs[NL80211_ATTR_MESH_SETUP],
6096 nl80211_mesh_setup_params_policy, info->extack))
6097 return -EINVAL;
6098
6099 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
6100 setup->sync_method =
6101 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
6102 IEEE80211_SYNC_METHOD_VENDOR :
6103 IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
6104
6105 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
6106 setup->path_sel_proto =
6107 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
6108 IEEE80211_PATH_PROTOCOL_VENDOR :
6109 IEEE80211_PATH_PROTOCOL_HWMP;
6110
6111 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
6112 setup->path_metric =
6113 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
6114 IEEE80211_PATH_METRIC_VENDOR :
6115 IEEE80211_PATH_METRIC_AIRTIME;
6116
6117 if (tb[NL80211_MESH_SETUP_IE]) {
6118 struct nlattr *ieattr =
6119 tb[NL80211_MESH_SETUP_IE];
6120 if (!is_valid_ie_attr(ieattr))
6121 return -EINVAL;
6122 setup->ie = nla_data(ieattr);
6123 setup->ie_len = nla_len(ieattr);
6124 }
6125 if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
6126 !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
6127 return -EINVAL;
6128 setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
6129 setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
6130 setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
6131 if (setup->is_secure)
6132 setup->user_mpm = true;
6133
6134 if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
6135 if (!setup->user_mpm)
6136 return -EINVAL;
6137 setup->auth_id =
6138 nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
6139 }
6140
6141 return 0;
6142 }
6143
6144 static int nl80211_update_mesh_config(struct sk_buff *skb,
6145 struct genl_info *info)
6146 {
6147 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6148 struct net_device *dev = info->user_ptr[1];
6149 struct wireless_dev *wdev = dev->ieee80211_ptr;
6150 struct mesh_config cfg;
6151 u32 mask;
6152 int err;
6153
6154 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
6155 return -EOPNOTSUPP;
6156
6157 if (!rdev->ops->update_mesh_config)
6158 return -EOPNOTSUPP;
6159
6160 err = nl80211_parse_mesh_config(info, &cfg, &mask);
6161 if (err)
6162 return err;
6163
6164 wdev_lock(wdev);
6165 if (!wdev->mesh_id_len)
6166 err = -ENOLINK;
6167
6168 if (!err)
6169 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
6170
6171 wdev_unlock(wdev);
6172
6173 return err;
6174 }
6175
6176 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
6177 struct sk_buff *msg)
6178 {
6179 struct nlattr *nl_reg_rules;
6180 unsigned int i;
6181
6182 if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
6183 (regdom->dfs_region &&
6184 nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
6185 goto nla_put_failure;
6186
6187 nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
6188 if (!nl_reg_rules)
6189 goto nla_put_failure;
6190
6191 for (i = 0; i < regdom->n_reg_rules; i++) {
6192 struct nlattr *nl_reg_rule;
6193 const struct ieee80211_reg_rule *reg_rule;
6194 const struct ieee80211_freq_range *freq_range;
6195 const struct ieee80211_power_rule *power_rule;
6196 unsigned int max_bandwidth_khz;
6197
6198 reg_rule = &regdom->reg_rules[i];
6199 freq_range = &reg_rule->freq_range;
6200 power_rule = &reg_rule->power_rule;
6201
6202 nl_reg_rule = nla_nest_start(msg, i);
6203 if (!nl_reg_rule)
6204 goto nla_put_failure;
6205
6206 max_bandwidth_khz = freq_range->max_bandwidth_khz;
6207 if (!max_bandwidth_khz)
6208 max_bandwidth_khz = reg_get_max_bandwidth(regdom,
6209 reg_rule);
6210
6211 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
6212 reg_rule->flags) ||
6213 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
6214 freq_range->start_freq_khz) ||
6215 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
6216 freq_range->end_freq_khz) ||
6217 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
6218 max_bandwidth_khz) ||
6219 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
6220 power_rule->max_antenna_gain) ||
6221 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
6222 power_rule->max_eirp) ||
6223 nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
6224 reg_rule->dfs_cac_ms))
6225 goto nla_put_failure;
6226
6227 nla_nest_end(msg, nl_reg_rule);
6228 }
6229
6230 nla_nest_end(msg, nl_reg_rules);
6231 return 0;
6232
6233 nla_put_failure:
6234 return -EMSGSIZE;
6235 }
6236
6237 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
6238 {
6239 const struct ieee80211_regdomain *regdom = NULL;
6240 struct cfg80211_registered_device *rdev;
6241 struct wiphy *wiphy = NULL;
6242 struct sk_buff *msg;
6243 void *hdr;
6244
6245 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6246 if (!msg)
6247 return -ENOBUFS;
6248
6249 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6250 NL80211_CMD_GET_REG);
6251 if (!hdr)
6252 goto put_failure;
6253
6254 if (info->attrs[NL80211_ATTR_WIPHY]) {
6255 bool self_managed;
6256
6257 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
6258 if (IS_ERR(rdev)) {
6259 nlmsg_free(msg);
6260 return PTR_ERR(rdev);
6261 }
6262
6263 wiphy = &rdev->wiphy;
6264 self_managed = wiphy->regulatory_flags &
6265 REGULATORY_WIPHY_SELF_MANAGED;
6266 regdom = get_wiphy_regdom(wiphy);
6267
6268 /* a self-managed-reg device must have a private regdom */
6269 if (WARN_ON(!regdom && self_managed)) {
6270 nlmsg_free(msg);
6271 return -EINVAL;
6272 }
6273
6274 if (regdom &&
6275 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6276 goto nla_put_failure;
6277 }
6278
6279 if (!wiphy && reg_last_request_cell_base() &&
6280 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6281 NL80211_USER_REG_HINT_CELL_BASE))
6282 goto nla_put_failure;
6283
6284 rcu_read_lock();
6285
6286 if (!regdom)
6287 regdom = rcu_dereference(cfg80211_regdomain);
6288
6289 if (nl80211_put_regdom(regdom, msg))
6290 goto nla_put_failure_rcu;
6291
6292 rcu_read_unlock();
6293
6294 genlmsg_end(msg, hdr);
6295 return genlmsg_reply(msg, info);
6296
6297 nla_put_failure_rcu:
6298 rcu_read_unlock();
6299 nla_put_failure:
6300 genlmsg_cancel(msg, hdr);
6301 put_failure:
6302 nlmsg_free(msg);
6303 return -EMSGSIZE;
6304 }
6305
6306 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
6307 u32 seq, int flags, struct wiphy *wiphy,
6308 const struct ieee80211_regdomain *regdom)
6309 {
6310 void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
6311 NL80211_CMD_GET_REG);
6312
6313 if (!hdr)
6314 return -1;
6315
6316 genl_dump_check_consistent(cb, hdr);
6317
6318 if (nl80211_put_regdom(regdom, msg))
6319 goto nla_put_failure;
6320
6321 if (!wiphy && reg_last_request_cell_base() &&
6322 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6323 NL80211_USER_REG_HINT_CELL_BASE))
6324 goto nla_put_failure;
6325
6326 if (wiphy &&
6327 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6328 goto nla_put_failure;
6329
6330 if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
6331 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
6332 goto nla_put_failure;
6333
6334 genlmsg_end(msg, hdr);
6335 return 0;
6336
6337 nla_put_failure:
6338 genlmsg_cancel(msg, hdr);
6339 return -EMSGSIZE;
6340 }
6341
6342 static int nl80211_get_reg_dump(struct sk_buff *skb,
6343 struct netlink_callback *cb)
6344 {
6345 const struct ieee80211_regdomain *regdom = NULL;
6346 struct cfg80211_registered_device *rdev;
6347 int err, reg_idx, start = cb->args[2];
6348
6349 rtnl_lock();
6350
6351 if (cfg80211_regdomain && start == 0) {
6352 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6353 NLM_F_MULTI, NULL,
6354 rtnl_dereference(cfg80211_regdomain));
6355 if (err < 0)
6356 goto out_err;
6357 }
6358
6359 /* the global regdom is idx 0 */
6360 reg_idx = 1;
6361 list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
6362 regdom = get_wiphy_regdom(&rdev->wiphy);
6363 if (!regdom)
6364 continue;
6365
6366 if (++reg_idx <= start)
6367 continue;
6368
6369 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6370 NLM_F_MULTI, &rdev->wiphy, regdom);
6371 if (err < 0) {
6372 reg_idx--;
6373 break;
6374 }
6375 }
6376
6377 cb->args[2] = reg_idx;
6378 err = skb->len;
6379 out_err:
6380 rtnl_unlock();
6381 return err;
6382 }
6383
6384 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
6385 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
6386 [NL80211_ATTR_REG_RULE_FLAGS] = { .type = NLA_U32 },
6387 [NL80211_ATTR_FREQ_RANGE_START] = { .type = NLA_U32 },
6388 [NL80211_ATTR_FREQ_RANGE_END] = { .type = NLA_U32 },
6389 [NL80211_ATTR_FREQ_RANGE_MAX_BW] = { .type = NLA_U32 },
6390 [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN] = { .type = NLA_U32 },
6391 [NL80211_ATTR_POWER_RULE_MAX_EIRP] = { .type = NLA_U32 },
6392 [NL80211_ATTR_DFS_CAC_TIME] = { .type = NLA_U32 },
6393 };
6394
6395 static int parse_reg_rule(struct nlattr *tb[],
6396 struct ieee80211_reg_rule *reg_rule)
6397 {
6398 struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
6399 struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
6400
6401 if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
6402 return -EINVAL;
6403 if (!tb[NL80211_ATTR_FREQ_RANGE_START])
6404 return -EINVAL;
6405 if (!tb[NL80211_ATTR_FREQ_RANGE_END])
6406 return -EINVAL;
6407 if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
6408 return -EINVAL;
6409 if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
6410 return -EINVAL;
6411
6412 reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
6413
6414 freq_range->start_freq_khz =
6415 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
6416 freq_range->end_freq_khz =
6417 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
6418 freq_range->max_bandwidth_khz =
6419 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
6420
6421 power_rule->max_eirp =
6422 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
6423
6424 if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
6425 power_rule->max_antenna_gain =
6426 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
6427
6428 if (tb[NL80211_ATTR_DFS_CAC_TIME])
6429 reg_rule->dfs_cac_ms =
6430 nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
6431
6432 return 0;
6433 }
6434
6435 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
6436 {
6437 struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
6438 struct nlattr *nl_reg_rule;
6439 char *alpha2;
6440 int rem_reg_rules, r;
6441 u32 num_rules = 0, rule_idx = 0, size_of_regd;
6442 enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
6443 struct ieee80211_regdomain *rd;
6444
6445 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
6446 return -EINVAL;
6447
6448 if (!info->attrs[NL80211_ATTR_REG_RULES])
6449 return -EINVAL;
6450
6451 alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
6452
6453 if (info->attrs[NL80211_ATTR_DFS_REGION])
6454 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
6455
6456 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6457 rem_reg_rules) {
6458 num_rules++;
6459 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
6460 return -EINVAL;
6461 }
6462
6463 if (!reg_is_valid_request(alpha2))
6464 return -EINVAL;
6465
6466 size_of_regd = sizeof(struct ieee80211_regdomain) +
6467 num_rules * sizeof(struct ieee80211_reg_rule);
6468
6469 rd = kzalloc(size_of_regd, GFP_KERNEL);
6470 if (!rd)
6471 return -ENOMEM;
6472
6473 rd->n_reg_rules = num_rules;
6474 rd->alpha2[0] = alpha2[0];
6475 rd->alpha2[1] = alpha2[1];
6476
6477 /*
6478 * Disable DFS master mode if the DFS region was
6479 * not supported or known on this kernel.
6480 */
6481 if (reg_supported_dfs_region(dfs_region))
6482 rd->dfs_region = dfs_region;
6483
6484 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6485 rem_reg_rules) {
6486 r = nla_parse_nested(tb, NL80211_REG_RULE_ATTR_MAX,
6487 nl_reg_rule, reg_rule_policy,
6488 info->extack);
6489 if (r)
6490 goto bad_reg;
6491 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
6492 if (r)
6493 goto bad_reg;
6494
6495 rule_idx++;
6496
6497 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
6498 r = -EINVAL;
6499 goto bad_reg;
6500 }
6501 }
6502
6503 /* set_regdom takes ownership of rd */
6504 return set_regdom(rd, REGD_SOURCE_CRDA);
6505 bad_reg:
6506 kfree(rd);
6507 return r;
6508 }
6509 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
6510
6511 static int validate_scan_freqs(struct nlattr *freqs)
6512 {
6513 struct nlattr *attr1, *attr2;
6514 int n_channels = 0, tmp1, tmp2;
6515
6516 nla_for_each_nested(attr1, freqs, tmp1)
6517 if (nla_len(attr1) != sizeof(u32))
6518 return 0;
6519
6520 nla_for_each_nested(attr1, freqs, tmp1) {
6521 n_channels++;
6522 /*
6523 * Some hardware has a limited channel list for
6524 * scanning, and it is pretty much nonsensical
6525 * to scan for a channel twice, so disallow that
6526 * and don't require drivers to check that the
6527 * channel list they get isn't longer than what
6528 * they can scan, as long as they can scan all
6529 * the channels they registered at once.
6530 */
6531 nla_for_each_nested(attr2, freqs, tmp2)
6532 if (attr1 != attr2 &&
6533 nla_get_u32(attr1) == nla_get_u32(attr2))
6534 return 0;
6535 }
6536
6537 return n_channels;
6538 }
6539
6540 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
6541 {
6542 return b < NUM_NL80211_BANDS && wiphy->bands[b];
6543 }
6544
6545 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
6546 struct cfg80211_bss_selection *bss_select)
6547 {
6548 struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
6549 struct nlattr *nest;
6550 int err;
6551 bool found = false;
6552 int i;
6553
6554 /* only process one nested attribute */
6555 nest = nla_data(nla);
6556 if (!nla_ok(nest, nla_len(nest)))
6557 return -EINVAL;
6558
6559 err = nla_parse_nested(attr, NL80211_BSS_SELECT_ATTR_MAX, nest,
6560 nl80211_bss_select_policy, NULL);
6561 if (err)
6562 return err;
6563
6564 /* only one attribute may be given */
6565 for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
6566 if (attr[i]) {
6567 if (found)
6568 return -EINVAL;
6569 found = true;
6570 }
6571 }
6572
6573 bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
6574
6575 if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
6576 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
6577
6578 if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
6579 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
6580 bss_select->param.band_pref =
6581 nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
6582 if (!is_band_valid(wiphy, bss_select->param.band_pref))
6583 return -EINVAL;
6584 }
6585
6586 if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
6587 struct nl80211_bss_select_rssi_adjust *adj_param;
6588
6589 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
6590 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
6591 bss_select->param.adjust.band = adj_param->band;
6592 bss_select->param.adjust.delta = adj_param->delta;
6593 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
6594 return -EINVAL;
6595 }
6596
6597 /* user-space did not provide behaviour attribute */
6598 if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
6599 return -EINVAL;
6600
6601 if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
6602 return -EINVAL;
6603
6604 return 0;
6605 }
6606
6607 static int nl80211_parse_random_mac(struct nlattr **attrs,
6608 u8 *mac_addr, u8 *mac_addr_mask)
6609 {
6610 int i;
6611
6612 if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
6613 eth_zero_addr(mac_addr);
6614 eth_zero_addr(mac_addr_mask);
6615 mac_addr[0] = 0x2;
6616 mac_addr_mask[0] = 0x3;
6617
6618 return 0;
6619 }
6620
6621 /* need both or none */
6622 if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
6623 return -EINVAL;
6624
6625 memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
6626 memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
6627
6628 /* don't allow or configure an mcast address */
6629 if (!is_multicast_ether_addr(mac_addr_mask) ||
6630 is_multicast_ether_addr(mac_addr))
6631 return -EINVAL;
6632
6633 /*
6634 * allow users to pass a MAC address that has bits set outside
6635 * of the mask, but don't bother drivers with having to deal
6636 * with such bits
6637 */
6638 for (i = 0; i < ETH_ALEN; i++)
6639 mac_addr[i] &= mac_addr_mask[i];
6640
6641 return 0;
6642 }
6643
6644 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev)
6645 {
6646 ASSERT_WDEV_LOCK(wdev);
6647
6648 if (!cfg80211_beaconing_iface_active(wdev))
6649 return true;
6650
6651 if (!(wdev->chandef.chan->flags & IEEE80211_CHAN_RADAR))
6652 return true;
6653
6654 return regulatory_pre_cac_allowed(wdev->wiphy);
6655 }
6656
6657 static int
6658 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
6659 void *request, struct nlattr **attrs,
6660 bool is_sched_scan)
6661 {
6662 u8 *mac_addr, *mac_addr_mask;
6663 u32 *flags;
6664 enum nl80211_feature_flags randomness_flag;
6665
6666 if (!attrs[NL80211_ATTR_SCAN_FLAGS])
6667 return 0;
6668
6669 if (is_sched_scan) {
6670 struct cfg80211_sched_scan_request *req = request;
6671
6672 randomness_flag = wdev ?
6673 NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
6674 NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
6675 flags = &req->flags;
6676 mac_addr = req->mac_addr;
6677 mac_addr_mask = req->mac_addr_mask;
6678 } else {
6679 struct cfg80211_scan_request *req = request;
6680
6681 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
6682 flags = &req->flags;
6683 mac_addr = req->mac_addr;
6684 mac_addr_mask = req->mac_addr_mask;
6685 }
6686
6687 *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
6688
6689 if ((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
6690 !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN))
6691 return -EOPNOTSUPP;
6692
6693 if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
6694 int err;
6695
6696 if (!(wiphy->features & randomness_flag) ||
6697 (wdev && wdev->current_bss))
6698 return -EOPNOTSUPP;
6699
6700 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
6701 if (err)
6702 return err;
6703 }
6704
6705 if ((*flags & NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME) &&
6706 !wiphy_ext_feature_isset(wiphy,
6707 NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME))
6708 return -EOPNOTSUPP;
6709
6710 if ((*flags & NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP) &&
6711 !wiphy_ext_feature_isset(wiphy,
6712 NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP))
6713 return -EOPNOTSUPP;
6714
6715 if ((*flags & NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) &&
6716 !wiphy_ext_feature_isset(wiphy,
6717 NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION))
6718 return -EOPNOTSUPP;
6719
6720 if ((*flags & NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE) &&
6721 !wiphy_ext_feature_isset(wiphy,
6722 NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE))
6723 return -EOPNOTSUPP;
6724
6725 return 0;
6726 }
6727
6728 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
6729 {
6730 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6731 struct wireless_dev *wdev = info->user_ptr[1];
6732 struct cfg80211_scan_request *request;
6733 struct nlattr *attr;
6734 struct wiphy *wiphy;
6735 int err, tmp, n_ssids = 0, n_channels, i;
6736 size_t ie_len;
6737
6738 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6739 return -EINVAL;
6740
6741 wiphy = &rdev->wiphy;
6742
6743 if (wdev->iftype == NL80211_IFTYPE_NAN)
6744 return -EOPNOTSUPP;
6745
6746 if (!rdev->ops->scan)
6747 return -EOPNOTSUPP;
6748
6749 if (rdev->scan_req || rdev->scan_msg) {
6750 err = -EBUSY;
6751 goto unlock;
6752 }
6753
6754 if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6755 n_channels = validate_scan_freqs(
6756 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
6757 if (!n_channels) {
6758 err = -EINVAL;
6759 goto unlock;
6760 }
6761 } else {
6762 n_channels = ieee80211_get_num_supported_channels(wiphy);
6763 }
6764
6765 if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
6766 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
6767 n_ssids++;
6768
6769 if (n_ssids > wiphy->max_scan_ssids) {
6770 err = -EINVAL;
6771 goto unlock;
6772 }
6773
6774 if (info->attrs[NL80211_ATTR_IE])
6775 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6776 else
6777 ie_len = 0;
6778
6779 if (ie_len > wiphy->max_scan_ie_len) {
6780 err = -EINVAL;
6781 goto unlock;
6782 }
6783
6784 request = kzalloc(sizeof(*request)
6785 + sizeof(*request->ssids) * n_ssids
6786 + sizeof(*request->channels) * n_channels
6787 + ie_len, GFP_KERNEL);
6788 if (!request) {
6789 err = -ENOMEM;
6790 goto unlock;
6791 }
6792
6793 if (n_ssids)
6794 request->ssids = (void *)&request->channels[n_channels];
6795 request->n_ssids = n_ssids;
6796 if (ie_len) {
6797 if (n_ssids)
6798 request->ie = (void *)(request->ssids + n_ssids);
6799 else
6800 request->ie = (void *)(request->channels + n_channels);
6801 }
6802
6803 i = 0;
6804 if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6805 /* user specified, bail out if channel not found */
6806 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
6807 struct ieee80211_channel *chan;
6808
6809 chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
6810
6811 if (!chan) {
6812 err = -EINVAL;
6813 goto out_free;
6814 }
6815
6816 /* ignore disabled channels */
6817 if (chan->flags & IEEE80211_CHAN_DISABLED)
6818 continue;
6819
6820 request->channels[i] = chan;
6821 i++;
6822 }
6823 } else {
6824 enum nl80211_band band;
6825
6826 /* all channels */
6827 for (band = 0; band < NUM_NL80211_BANDS; band++) {
6828 int j;
6829
6830 if (!wiphy->bands[band])
6831 continue;
6832 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
6833 struct ieee80211_channel *chan;
6834
6835 chan = &wiphy->bands[band]->channels[j];
6836
6837 if (chan->flags & IEEE80211_CHAN_DISABLED)
6838 continue;
6839
6840 request->channels[i] = chan;
6841 i++;
6842 }
6843 }
6844 }
6845
6846 if (!i) {
6847 err = -EINVAL;
6848 goto out_free;
6849 }
6850
6851 request->n_channels = i;
6852
6853 wdev_lock(wdev);
6854 if (!cfg80211_off_channel_oper_allowed(wdev)) {
6855 struct ieee80211_channel *chan;
6856
6857 if (request->n_channels != 1) {
6858 wdev_unlock(wdev);
6859 err = -EBUSY;
6860 goto out_free;
6861 }
6862
6863 chan = request->channels[0];
6864 if (chan->center_freq != wdev->chandef.chan->center_freq) {
6865 wdev_unlock(wdev);
6866 err = -EBUSY;
6867 goto out_free;
6868 }
6869 }
6870 wdev_unlock(wdev);
6871
6872 i = 0;
6873 if (n_ssids) {
6874 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
6875 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
6876 err = -EINVAL;
6877 goto out_free;
6878 }
6879 request->ssids[i].ssid_len = nla_len(attr);
6880 memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
6881 i++;
6882 }
6883 }
6884
6885 if (info->attrs[NL80211_ATTR_IE]) {
6886 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6887 memcpy((void *)request->ie,
6888 nla_data(info->attrs[NL80211_ATTR_IE]),
6889 request->ie_len);
6890 }
6891
6892 for (i = 0; i < NUM_NL80211_BANDS; i++)
6893 if (wiphy->bands[i])
6894 request->rates[i] =
6895 (1 << wiphy->bands[i]->n_bitrates) - 1;
6896
6897 if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
6898 nla_for_each_nested(attr,
6899 info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
6900 tmp) {
6901 enum nl80211_band band = nla_type(attr);
6902
6903 if (band < 0 || band >= NUM_NL80211_BANDS) {
6904 err = -EINVAL;
6905 goto out_free;
6906 }
6907
6908 if (!wiphy->bands[band])
6909 continue;
6910
6911 err = ieee80211_get_ratemask(wiphy->bands[band],
6912 nla_data(attr),
6913 nla_len(attr),
6914 &request->rates[band]);
6915 if (err)
6916 goto out_free;
6917 }
6918 }
6919
6920 if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
6921 if (!wiphy_ext_feature_isset(wiphy,
6922 NL80211_EXT_FEATURE_SET_SCAN_DWELL)) {
6923 err = -EOPNOTSUPP;
6924 goto out_free;
6925 }
6926
6927 request->duration =
6928 nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
6929 request->duration_mandatory =
6930 nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
6931 }
6932
6933 err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs,
6934 false);
6935 if (err)
6936 goto out_free;
6937
6938 request->no_cck =
6939 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
6940
6941 /* Initial implementation used NL80211_ATTR_MAC to set the specific
6942 * BSSID to scan for. This was problematic because that same attribute
6943 * was already used for another purpose (local random MAC address). The
6944 * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
6945 * compatibility with older userspace components, also use the
6946 * NL80211_ATTR_MAC value here if it can be determined to be used for
6947 * the specific BSSID use case instead of the random MAC address
6948 * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
6949 */
6950 if (info->attrs[NL80211_ATTR_BSSID])
6951 memcpy(request->bssid,
6952 nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
6953 else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
6954 info->attrs[NL80211_ATTR_MAC])
6955 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
6956 ETH_ALEN);
6957 else
6958 eth_broadcast_addr(request->bssid);
6959
6960 request->wdev = wdev;
6961 request->wiphy = &rdev->wiphy;
6962 request->scan_start = jiffies;
6963
6964 rdev->scan_req = request;
6965 err = rdev_scan(rdev, request);
6966
6967 if (!err) {
6968 nl80211_send_scan_start(rdev, wdev);
6969 if (wdev->netdev)
6970 dev_hold(wdev->netdev);
6971 } else {
6972 out_free:
6973 rdev->scan_req = NULL;
6974 kfree(request);
6975 }
6976
6977 unlock:
6978 return err;
6979 }
6980
6981 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
6982 {
6983 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6984 struct wireless_dev *wdev = info->user_ptr[1];
6985
6986 if (!rdev->ops->abort_scan)
6987 return -EOPNOTSUPP;
6988
6989 if (rdev->scan_msg)
6990 return 0;
6991
6992 if (!rdev->scan_req)
6993 return -ENOENT;
6994
6995 rdev_abort_scan(rdev, wdev);
6996 return 0;
6997 }
6998
6999 static int
7000 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
7001 struct cfg80211_sched_scan_request *request,
7002 struct nlattr **attrs)
7003 {
7004 int tmp, err, i = 0;
7005 struct nlattr *attr;
7006
7007 if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
7008 u32 interval;
7009
7010 /*
7011 * If scan plans are not specified,
7012 * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
7013 * case one scan plan will be set with the specified scan
7014 * interval and infinite number of iterations.
7015 */
7016 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
7017 if (!interval)
7018 return -EINVAL;
7019
7020 request->scan_plans[0].interval =
7021 DIV_ROUND_UP(interval, MSEC_PER_SEC);
7022 if (!request->scan_plans[0].interval)
7023 return -EINVAL;
7024
7025 if (request->scan_plans[0].interval >
7026 wiphy->max_sched_scan_plan_interval)
7027 request->scan_plans[0].interval =
7028 wiphy->max_sched_scan_plan_interval;
7029
7030 return 0;
7031 }
7032
7033 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
7034 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
7035
7036 if (WARN_ON(i >= n_plans))
7037 return -EINVAL;
7038
7039 err = nla_parse_nested(plan, NL80211_SCHED_SCAN_PLAN_MAX,
7040 attr, nl80211_plan_policy, NULL);
7041 if (err)
7042 return err;
7043
7044 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
7045 return -EINVAL;
7046
7047 request->scan_plans[i].interval =
7048 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
7049 if (!request->scan_plans[i].interval ||
7050 request->scan_plans[i].interval >
7051 wiphy->max_sched_scan_plan_interval)
7052 return -EINVAL;
7053
7054 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
7055 request->scan_plans[i].iterations =
7056 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
7057 if (!request->scan_plans[i].iterations ||
7058 (request->scan_plans[i].iterations >
7059 wiphy->max_sched_scan_plan_iterations))
7060 return -EINVAL;
7061 } else if (i < n_plans - 1) {
7062 /*
7063 * All scan plans but the last one must specify
7064 * a finite number of iterations
7065 */
7066 return -EINVAL;
7067 }
7068
7069 i++;
7070 }
7071
7072 /*
7073 * The last scan plan must not specify the number of
7074 * iterations, it is supposed to run infinitely
7075 */
7076 if (request->scan_plans[n_plans - 1].iterations)
7077 return -EINVAL;
7078
7079 return 0;
7080 }
7081
7082 static struct cfg80211_sched_scan_request *
7083 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
7084 struct nlattr **attrs, int max_match_sets)
7085 {
7086 struct cfg80211_sched_scan_request *request;
7087 struct nlattr *attr;
7088 int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
7089 enum nl80211_band band;
7090 size_t ie_len;
7091 struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
7092 s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
7093
7094 if (!is_valid_ie_attr(attrs[NL80211_ATTR_IE]))
7095 return ERR_PTR(-EINVAL);
7096
7097 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7098 n_channels = validate_scan_freqs(
7099 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
7100 if (!n_channels)
7101 return ERR_PTR(-EINVAL);
7102 } else {
7103 n_channels = ieee80211_get_num_supported_channels(wiphy);
7104 }
7105
7106 if (attrs[NL80211_ATTR_SCAN_SSIDS])
7107 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7108 tmp)
7109 n_ssids++;
7110
7111 if (n_ssids > wiphy->max_sched_scan_ssids)
7112 return ERR_PTR(-EINVAL);
7113
7114 /*
7115 * First, count the number of 'real' matchsets. Due to an issue with
7116 * the old implementation, matchsets containing only the RSSI attribute
7117 * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
7118 * RSSI for all matchsets, rather than their own matchset for reporting
7119 * all APs with a strong RSSI. This is needed to be compatible with
7120 * older userspace that treated a matchset with only the RSSI as the
7121 * global RSSI for all other matchsets - if there are other matchsets.
7122 */
7123 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7124 nla_for_each_nested(attr,
7125 attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7126 tmp) {
7127 struct nlattr *rssi;
7128
7129 err = nla_parse_nested(tb,
7130 NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7131 attr, nl80211_match_policy,
7132 NULL);
7133 if (err)
7134 return ERR_PTR(err);
7135
7136 /* SSID and BSSID are mutually exclusive */
7137 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
7138 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
7139 return ERR_PTR(-EINVAL);
7140
7141 /* add other standalone attributes here */
7142 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
7143 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
7144 n_match_sets++;
7145 continue;
7146 }
7147 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
7148 if (rssi)
7149 default_match_rssi = nla_get_s32(rssi);
7150 }
7151 }
7152
7153 /* However, if there's no other matchset, add the RSSI one */
7154 if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
7155 n_match_sets = 1;
7156
7157 if (n_match_sets > max_match_sets)
7158 return ERR_PTR(-EINVAL);
7159
7160 if (attrs[NL80211_ATTR_IE])
7161 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
7162 else
7163 ie_len = 0;
7164
7165 if (ie_len > wiphy->max_sched_scan_ie_len)
7166 return ERR_PTR(-EINVAL);
7167
7168 if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
7169 /*
7170 * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
7171 * each scan plan already specifies its own interval
7172 */
7173 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
7174 return ERR_PTR(-EINVAL);
7175
7176 nla_for_each_nested(attr,
7177 attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
7178 n_plans++;
7179 } else {
7180 /*
7181 * The scan interval attribute is kept for backward
7182 * compatibility. If no scan plans are specified and sched scan
7183 * interval is specified, one scan plan will be set with this
7184 * scan interval and infinite number of iterations.
7185 */
7186 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
7187 return ERR_PTR(-EINVAL);
7188
7189 n_plans = 1;
7190 }
7191
7192 if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
7193 return ERR_PTR(-EINVAL);
7194
7195 if (!wiphy_ext_feature_isset(
7196 wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
7197 (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
7198 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
7199 return ERR_PTR(-EINVAL);
7200
7201 request = kzalloc(sizeof(*request)
7202 + sizeof(*request->ssids) * n_ssids
7203 + sizeof(*request->match_sets) * n_match_sets
7204 + sizeof(*request->scan_plans) * n_plans
7205 + sizeof(*request->channels) * n_channels
7206 + ie_len, GFP_KERNEL);
7207 if (!request)
7208 return ERR_PTR(-ENOMEM);
7209
7210 if (n_ssids)
7211 request->ssids = (void *)&request->channels[n_channels];
7212 request->n_ssids = n_ssids;
7213 if (ie_len) {
7214 if (n_ssids)
7215 request->ie = (void *)(request->ssids + n_ssids);
7216 else
7217 request->ie = (void *)(request->channels + n_channels);
7218 }
7219
7220 if (n_match_sets) {
7221 if (request->ie)
7222 request->match_sets = (void *)(request->ie + ie_len);
7223 else if (n_ssids)
7224 request->match_sets =
7225 (void *)(request->ssids + n_ssids);
7226 else
7227 request->match_sets =
7228 (void *)(request->channels + n_channels);
7229 }
7230 request->n_match_sets = n_match_sets;
7231
7232 if (n_match_sets)
7233 request->scan_plans = (void *)(request->match_sets +
7234 n_match_sets);
7235 else if (request->ie)
7236 request->scan_plans = (void *)(request->ie + ie_len);
7237 else if (n_ssids)
7238 request->scan_plans = (void *)(request->ssids + n_ssids);
7239 else
7240 request->scan_plans = (void *)(request->channels + n_channels);
7241
7242 request->n_scan_plans = n_plans;
7243
7244 i = 0;
7245 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7246 /* user specified, bail out if channel not found */
7247 nla_for_each_nested(attr,
7248 attrs[NL80211_ATTR_SCAN_FREQUENCIES],
7249 tmp) {
7250 struct ieee80211_channel *chan;
7251
7252 chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
7253
7254 if (!chan) {
7255 err = -EINVAL;
7256 goto out_free;
7257 }
7258
7259 /* ignore disabled channels */
7260 if (chan->flags & IEEE80211_CHAN_DISABLED)
7261 continue;
7262
7263 request->channels[i] = chan;
7264 i++;
7265 }
7266 } else {
7267 /* all channels */
7268 for (band = 0; band < NUM_NL80211_BANDS; band++) {
7269 int j;
7270
7271 if (!wiphy->bands[band])
7272 continue;
7273 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
7274 struct ieee80211_channel *chan;
7275
7276 chan = &wiphy->bands[band]->channels[j];
7277
7278 if (chan->flags & IEEE80211_CHAN_DISABLED)
7279 continue;
7280
7281 request->channels[i] = chan;
7282 i++;
7283 }
7284 }
7285 }
7286
7287 if (!i) {
7288 err = -EINVAL;
7289 goto out_free;
7290 }
7291
7292 request->n_channels = i;
7293
7294 i = 0;
7295 if (n_ssids) {
7296 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7297 tmp) {
7298 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
7299 err = -EINVAL;
7300 goto out_free;
7301 }
7302 request->ssids[i].ssid_len = nla_len(attr);
7303 memcpy(request->ssids[i].ssid, nla_data(attr),
7304 nla_len(attr));
7305 i++;
7306 }
7307 }
7308
7309 i = 0;
7310 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7311 nla_for_each_nested(attr,
7312 attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7313 tmp) {
7314 struct nlattr *ssid, *bssid, *rssi;
7315
7316 err = nla_parse_nested(tb,
7317 NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7318 attr, nl80211_match_policy,
7319 NULL);
7320 if (err)
7321 goto out_free;
7322 ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
7323 bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
7324 if (ssid || bssid) {
7325 if (WARN_ON(i >= n_match_sets)) {
7326 /* this indicates a programming error,
7327 * the loop above should have verified
7328 * things properly
7329 */
7330 err = -EINVAL;
7331 goto out_free;
7332 }
7333
7334 if (ssid) {
7335 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
7336 err = -EINVAL;
7337 goto out_free;
7338 }
7339 memcpy(request->match_sets[i].ssid.ssid,
7340 nla_data(ssid), nla_len(ssid));
7341 request->match_sets[i].ssid.ssid_len =
7342 nla_len(ssid);
7343 }
7344 if (bssid) {
7345 if (nla_len(bssid) != ETH_ALEN) {
7346 err = -EINVAL;
7347 goto out_free;
7348 }
7349 memcpy(request->match_sets[i].bssid,
7350 nla_data(bssid), ETH_ALEN);
7351 }
7352
7353 /* special attribute - old implementation w/a */
7354 request->match_sets[i].rssi_thold =
7355 default_match_rssi;
7356 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
7357 if (rssi)
7358 request->match_sets[i].rssi_thold =
7359 nla_get_s32(rssi);
7360 }
7361 i++;
7362 }
7363
7364 /* there was no other matchset, so the RSSI one is alone */
7365 if (i == 0 && n_match_sets)
7366 request->match_sets[0].rssi_thold = default_match_rssi;
7367
7368 request->min_rssi_thold = INT_MAX;
7369 for (i = 0; i < n_match_sets; i++)
7370 request->min_rssi_thold =
7371 min(request->match_sets[i].rssi_thold,
7372 request->min_rssi_thold);
7373 } else {
7374 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
7375 }
7376
7377 if (ie_len) {
7378 request->ie_len = ie_len;
7379 memcpy((void *)request->ie,
7380 nla_data(attrs[NL80211_ATTR_IE]),
7381 request->ie_len);
7382 }
7383
7384 err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true);
7385 if (err)
7386 goto out_free;
7387
7388 if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
7389 request->delay =
7390 nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
7391
7392 if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
7393 request->relative_rssi = nla_get_s8(
7394 attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
7395 request->relative_rssi_set = true;
7396 }
7397
7398 if (request->relative_rssi_set &&
7399 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
7400 struct nl80211_bss_select_rssi_adjust *rssi_adjust;
7401
7402 rssi_adjust = nla_data(
7403 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
7404 request->rssi_adjust.band = rssi_adjust->band;
7405 request->rssi_adjust.delta = rssi_adjust->delta;
7406 if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
7407 err = -EINVAL;
7408 goto out_free;
7409 }
7410 }
7411
7412 err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
7413 if (err)
7414 goto out_free;
7415
7416 request->scan_start = jiffies;
7417
7418 return request;
7419
7420 out_free:
7421 kfree(request);
7422 return ERR_PTR(err);
7423 }
7424
7425 static int nl80211_start_sched_scan(struct sk_buff *skb,
7426 struct genl_info *info)
7427 {
7428 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7429 struct net_device *dev = info->user_ptr[1];
7430 struct wireless_dev *wdev = dev->ieee80211_ptr;
7431 struct cfg80211_sched_scan_request *sched_scan_req;
7432 bool want_multi;
7433 int err;
7434
7435 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
7436 return -EOPNOTSUPP;
7437
7438 want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
7439 err = cfg80211_sched_scan_req_possible(rdev, want_multi);
7440 if (err)
7441 return err;
7442
7443 sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
7444 info->attrs,
7445 rdev->wiphy.max_match_sets);
7446
7447 err = PTR_ERR_OR_ZERO(sched_scan_req);
7448 if (err)
7449 goto out_err;
7450
7451 /* leave request id zero for legacy request
7452 * or if driver does not support multi-scheduled scan
7453 */
7454 if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1) {
7455 while (!sched_scan_req->reqid)
7456 sched_scan_req->reqid = rdev->wiphy.cookie_counter++;
7457 }
7458
7459 err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
7460 if (err)
7461 goto out_free;
7462
7463 sched_scan_req->dev = dev;
7464 sched_scan_req->wiphy = &rdev->wiphy;
7465
7466 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
7467 sched_scan_req->owner_nlportid = info->snd_portid;
7468
7469 cfg80211_add_sched_scan_req(rdev, sched_scan_req);
7470
7471 nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
7472 return 0;
7473
7474 out_free:
7475 kfree(sched_scan_req);
7476 out_err:
7477 return err;
7478 }
7479
7480 static int nl80211_stop_sched_scan(struct sk_buff *skb,
7481 struct genl_info *info)
7482 {
7483 struct cfg80211_sched_scan_request *req;
7484 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7485 u64 cookie;
7486
7487 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
7488 return -EOPNOTSUPP;
7489
7490 if (info->attrs[NL80211_ATTR_COOKIE]) {
7491 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7492 return __cfg80211_stop_sched_scan(rdev, cookie, false);
7493 }
7494
7495 req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
7496 struct cfg80211_sched_scan_request,
7497 list);
7498 if (!req || req->reqid ||
7499 (req->owner_nlportid &&
7500 req->owner_nlportid != info->snd_portid))
7501 return -ENOENT;
7502
7503 return cfg80211_stop_sched_scan_req(rdev, req, false);
7504 }
7505
7506 static int nl80211_start_radar_detection(struct sk_buff *skb,
7507 struct genl_info *info)
7508 {
7509 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7510 struct net_device *dev = info->user_ptr[1];
7511 struct wireless_dev *wdev = dev->ieee80211_ptr;
7512 struct cfg80211_chan_def chandef;
7513 enum nl80211_dfs_regions dfs_region;
7514 unsigned int cac_time_ms;
7515 int err;
7516
7517 dfs_region = reg_get_dfs_region(wdev->wiphy);
7518 if (dfs_region == NL80211_DFS_UNSET)
7519 return -EINVAL;
7520
7521 err = nl80211_parse_chandef(rdev, info, &chandef);
7522 if (err)
7523 return err;
7524
7525 if (netif_carrier_ok(dev))
7526 return -EBUSY;
7527
7528 if (wdev->cac_started)
7529 return -EBUSY;
7530
7531 err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef,
7532 wdev->iftype);
7533 if (err < 0)
7534 return err;
7535
7536 if (err == 0)
7537 return -EINVAL;
7538
7539 if (!cfg80211_chandef_dfs_usable(wdev->wiphy, &chandef))
7540 return -EINVAL;
7541
7542 if (!rdev->ops->start_radar_detection)
7543 return -EOPNOTSUPP;
7544
7545 cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
7546 if (WARN_ON(!cac_time_ms))
7547 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
7548
7549 err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
7550 if (!err) {
7551 wdev->chandef = chandef;
7552 wdev->cac_started = true;
7553 wdev->cac_start_time = jiffies;
7554 wdev->cac_time_ms = cac_time_ms;
7555 }
7556 return err;
7557 }
7558
7559 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
7560 {
7561 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7562 struct net_device *dev = info->user_ptr[1];
7563 struct wireless_dev *wdev = dev->ieee80211_ptr;
7564 struct cfg80211_csa_settings params;
7565 /* csa_attrs is defined static to avoid waste of stack size - this
7566 * function is called under RTNL lock, so this should not be a problem.
7567 */
7568 static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
7569 int err;
7570 bool need_new_beacon = false;
7571 bool need_handle_dfs_flag = true;
7572 int len, i;
7573 u32 cs_count;
7574
7575 if (!rdev->ops->channel_switch ||
7576 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
7577 return -EOPNOTSUPP;
7578
7579 switch (dev->ieee80211_ptr->iftype) {
7580 case NL80211_IFTYPE_AP:
7581 case NL80211_IFTYPE_P2P_GO:
7582 need_new_beacon = true;
7583 /* For all modes except AP the handle_dfs flag needs to be
7584 * supplied to tell the kernel that userspace will handle radar
7585 * events when they happen. Otherwise a switch to a channel
7586 * requiring DFS will be rejected.
7587 */
7588 need_handle_dfs_flag = false;
7589
7590 /* useless if AP is not running */
7591 if (!wdev->beacon_interval)
7592 return -ENOTCONN;
7593 break;
7594 case NL80211_IFTYPE_ADHOC:
7595 if (!wdev->ssid_len)
7596 return -ENOTCONN;
7597 break;
7598 case NL80211_IFTYPE_MESH_POINT:
7599 if (!wdev->mesh_id_len)
7600 return -ENOTCONN;
7601 break;
7602 default:
7603 return -EOPNOTSUPP;
7604 }
7605
7606 memset(&params, 0, sizeof(params));
7607
7608 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
7609 !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
7610 return -EINVAL;
7611
7612 /* only important for AP, IBSS and mesh create IEs internally */
7613 if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
7614 return -EINVAL;
7615
7616 /* Even though the attribute is u32, the specification says
7617 * u8, so let's make sure we don't overflow.
7618 */
7619 cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
7620 if (cs_count > 255)
7621 return -EINVAL;
7622
7623 params.count = cs_count;
7624
7625 if (!need_new_beacon)
7626 goto skip_beacons;
7627
7628 err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
7629 if (err)
7630 return err;
7631
7632 err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
7633 info->attrs[NL80211_ATTR_CSA_IES],
7634 nl80211_policy, info->extack);
7635 if (err)
7636 return err;
7637
7638 err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
7639 if (err)
7640 return err;
7641
7642 if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
7643 return -EINVAL;
7644
7645 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
7646 if (!len || (len % sizeof(u16)))
7647 return -EINVAL;
7648
7649 params.n_counter_offsets_beacon = len / sizeof(u16);
7650 if (rdev->wiphy.max_num_csa_counters &&
7651 (params.n_counter_offsets_beacon >
7652 rdev->wiphy.max_num_csa_counters))
7653 return -EINVAL;
7654
7655 params.counter_offsets_beacon =
7656 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
7657
7658 /* sanity checks - counters should fit and be the same */
7659 for (i = 0; i < params.n_counter_offsets_beacon; i++) {
7660 u16 offset = params.counter_offsets_beacon[i];
7661
7662 if (offset >= params.beacon_csa.tail_len)
7663 return -EINVAL;
7664
7665 if (params.beacon_csa.tail[offset] != params.count)
7666 return -EINVAL;
7667 }
7668
7669 if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
7670 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
7671 if (!len || (len % sizeof(u16)))
7672 return -EINVAL;
7673
7674 params.n_counter_offsets_presp = len / sizeof(u16);
7675 if (rdev->wiphy.max_num_csa_counters &&
7676 (params.n_counter_offsets_presp >
7677 rdev->wiphy.max_num_csa_counters))
7678 return -EINVAL;
7679
7680 params.counter_offsets_presp =
7681 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
7682
7683 /* sanity checks - counters should fit and be the same */
7684 for (i = 0; i < params.n_counter_offsets_presp; i++) {
7685 u16 offset = params.counter_offsets_presp[i];
7686
7687 if (offset >= params.beacon_csa.probe_resp_len)
7688 return -EINVAL;
7689
7690 if (params.beacon_csa.probe_resp[offset] !=
7691 params.count)
7692 return -EINVAL;
7693 }
7694 }
7695
7696 skip_beacons:
7697 err = nl80211_parse_chandef(rdev, info, &params.chandef);
7698 if (err)
7699 return err;
7700
7701 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
7702 wdev->iftype))
7703 return -EINVAL;
7704
7705 err = cfg80211_chandef_dfs_required(wdev->wiphy,
7706 &params.chandef,
7707 wdev->iftype);
7708 if (err < 0)
7709 return err;
7710
7711 if (err > 0) {
7712 params.radar_required = true;
7713 if (need_handle_dfs_flag &&
7714 !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
7715 return -EINVAL;
7716 }
7717 }
7718
7719 if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
7720 params.block_tx = true;
7721
7722 wdev_lock(wdev);
7723 err = rdev_channel_switch(rdev, dev, &params);
7724 wdev_unlock(wdev);
7725
7726 return err;
7727 }
7728
7729 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
7730 u32 seq, int flags,
7731 struct cfg80211_registered_device *rdev,
7732 struct wireless_dev *wdev,
7733 struct cfg80211_internal_bss *intbss)
7734 {
7735 struct cfg80211_bss *res = &intbss->pub;
7736 const struct cfg80211_bss_ies *ies;
7737 void *hdr;
7738 struct nlattr *bss;
7739
7740 ASSERT_WDEV_LOCK(wdev);
7741
7742 hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
7743 NL80211_CMD_NEW_SCAN_RESULTS);
7744 if (!hdr)
7745 return -1;
7746
7747 genl_dump_check_consistent(cb, hdr);
7748
7749 if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
7750 goto nla_put_failure;
7751 if (wdev->netdev &&
7752 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
7753 goto nla_put_failure;
7754 if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
7755 NL80211_ATTR_PAD))
7756 goto nla_put_failure;
7757
7758 bss = nla_nest_start(msg, NL80211_ATTR_BSS);
7759 if (!bss)
7760 goto nla_put_failure;
7761 if ((!is_zero_ether_addr(res->bssid) &&
7762 nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
7763 goto nla_put_failure;
7764
7765 rcu_read_lock();
7766 /* indicate whether we have probe response data or not */
7767 if (rcu_access_pointer(res->proberesp_ies) &&
7768 nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
7769 goto fail_unlock_rcu;
7770
7771 /* this pointer prefers to be pointed to probe response data
7772 * but is always valid
7773 */
7774 ies = rcu_dereference(res->ies);
7775 if (ies) {
7776 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
7777 NL80211_BSS_PAD))
7778 goto fail_unlock_rcu;
7779 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
7780 ies->len, ies->data))
7781 goto fail_unlock_rcu;
7782 }
7783
7784 /* and this pointer is always (unless driver didn't know) beacon data */
7785 ies = rcu_dereference(res->beacon_ies);
7786 if (ies && ies->from_beacon) {
7787 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
7788 NL80211_BSS_PAD))
7789 goto fail_unlock_rcu;
7790 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
7791 ies->len, ies->data))
7792 goto fail_unlock_rcu;
7793 }
7794 rcu_read_unlock();
7795
7796 if (res->beacon_interval &&
7797 nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
7798 goto nla_put_failure;
7799 if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
7800 nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
7801 nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
7802 nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
7803 jiffies_to_msecs(jiffies - intbss->ts)))
7804 goto nla_put_failure;
7805
7806 if (intbss->parent_tsf &&
7807 (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
7808 intbss->parent_tsf, NL80211_BSS_PAD) ||
7809 nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
7810 intbss->parent_bssid)))
7811 goto nla_put_failure;
7812
7813 if (intbss->ts_boottime &&
7814 nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
7815 intbss->ts_boottime, NL80211_BSS_PAD))
7816 goto nla_put_failure;
7817
7818 switch (rdev->wiphy.signal_type) {
7819 case CFG80211_SIGNAL_TYPE_MBM:
7820 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
7821 goto nla_put_failure;
7822 break;
7823 case CFG80211_SIGNAL_TYPE_UNSPEC:
7824 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
7825 goto nla_put_failure;
7826 break;
7827 default:
7828 break;
7829 }
7830
7831 switch (wdev->iftype) {
7832 case NL80211_IFTYPE_P2P_CLIENT:
7833 case NL80211_IFTYPE_STATION:
7834 if (intbss == wdev->current_bss &&
7835 nla_put_u32(msg, NL80211_BSS_STATUS,
7836 NL80211_BSS_STATUS_ASSOCIATED))
7837 goto nla_put_failure;
7838 break;
7839 case NL80211_IFTYPE_ADHOC:
7840 if (intbss == wdev->current_bss &&
7841 nla_put_u32(msg, NL80211_BSS_STATUS,
7842 NL80211_BSS_STATUS_IBSS_JOINED))
7843 goto nla_put_failure;
7844 break;
7845 default:
7846 break;
7847 }
7848
7849 nla_nest_end(msg, bss);
7850
7851 genlmsg_end(msg, hdr);
7852 return 0;
7853
7854 fail_unlock_rcu:
7855 rcu_read_unlock();
7856 nla_put_failure:
7857 genlmsg_cancel(msg, hdr);
7858 return -EMSGSIZE;
7859 }
7860
7861 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
7862 {
7863 struct cfg80211_registered_device *rdev;
7864 struct cfg80211_internal_bss *scan;
7865 struct wireless_dev *wdev;
7866 int start = cb->args[2], idx = 0;
7867 int err;
7868
7869 rtnl_lock();
7870 err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
7871 if (err) {
7872 rtnl_unlock();
7873 return err;
7874 }
7875
7876 wdev_lock(wdev);
7877 spin_lock_bh(&rdev->bss_lock);
7878 cfg80211_bss_expire(rdev);
7879
7880 cb->seq = rdev->bss_generation;
7881
7882 list_for_each_entry(scan, &rdev->bss_list, list) {
7883 if (++idx <= start)
7884 continue;
7885 if (nl80211_send_bss(skb, cb,
7886 cb->nlh->nlmsg_seq, NLM_F_MULTI,
7887 rdev, wdev, scan) < 0) {
7888 idx--;
7889 break;
7890 }
7891 }
7892
7893 spin_unlock_bh(&rdev->bss_lock);
7894 wdev_unlock(wdev);
7895
7896 cb->args[2] = idx;
7897 rtnl_unlock();
7898
7899 return skb->len;
7900 }
7901
7902 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
7903 int flags, struct net_device *dev,
7904 bool allow_radio_stats,
7905 struct survey_info *survey)
7906 {
7907 void *hdr;
7908 struct nlattr *infoattr;
7909
7910 /* skip radio stats if userspace didn't request them */
7911 if (!survey->channel && !allow_radio_stats)
7912 return 0;
7913
7914 hdr = nl80211hdr_put(msg, portid, seq, flags,
7915 NL80211_CMD_NEW_SURVEY_RESULTS);
7916 if (!hdr)
7917 return -ENOMEM;
7918
7919 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
7920 goto nla_put_failure;
7921
7922 infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
7923 if (!infoattr)
7924 goto nla_put_failure;
7925
7926 if (survey->channel &&
7927 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
7928 survey->channel->center_freq))
7929 goto nla_put_failure;
7930
7931 if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
7932 nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
7933 goto nla_put_failure;
7934 if ((survey->filled & SURVEY_INFO_IN_USE) &&
7935 nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
7936 goto nla_put_failure;
7937 if ((survey->filled & SURVEY_INFO_TIME) &&
7938 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
7939 survey->time, NL80211_SURVEY_INFO_PAD))
7940 goto nla_put_failure;
7941 if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
7942 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
7943 survey->time_busy, NL80211_SURVEY_INFO_PAD))
7944 goto nla_put_failure;
7945 if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
7946 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
7947 survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
7948 goto nla_put_failure;
7949 if ((survey->filled & SURVEY_INFO_TIME_RX) &&
7950 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
7951 survey->time_rx, NL80211_SURVEY_INFO_PAD))
7952 goto nla_put_failure;
7953 if ((survey->filled & SURVEY_INFO_TIME_TX) &&
7954 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
7955 survey->time_tx, NL80211_SURVEY_INFO_PAD))
7956 goto nla_put_failure;
7957 if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
7958 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
7959 survey->time_scan, NL80211_SURVEY_INFO_PAD))
7960 goto nla_put_failure;
7961
7962 nla_nest_end(msg, infoattr);
7963
7964 genlmsg_end(msg, hdr);
7965 return 0;
7966
7967 nla_put_failure:
7968 genlmsg_cancel(msg, hdr);
7969 return -EMSGSIZE;
7970 }
7971
7972 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
7973 {
7974 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
7975 struct survey_info survey;
7976 struct cfg80211_registered_device *rdev;
7977 struct wireless_dev *wdev;
7978 int survey_idx = cb->args[2];
7979 int res;
7980 bool radio_stats;
7981
7982 rtnl_lock();
7983 res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
7984 if (res)
7985 goto out_err;
7986
7987 /* prepare_wdev_dump parsed the attributes */
7988 radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
7989
7990 if (!wdev->netdev) {
7991 res = -EINVAL;
7992 goto out_err;
7993 }
7994
7995 if (!rdev->ops->dump_survey) {
7996 res = -EOPNOTSUPP;
7997 goto out_err;
7998 }
7999
8000 while (1) {
8001 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
8002 if (res == -ENOENT)
8003 break;
8004 if (res)
8005 goto out_err;
8006
8007 /* don't send disabled channels, but do send non-channel data */
8008 if (survey.channel &&
8009 survey.channel->flags & IEEE80211_CHAN_DISABLED) {
8010 survey_idx++;
8011 continue;
8012 }
8013
8014 if (nl80211_send_survey(skb,
8015 NETLINK_CB(cb->skb).portid,
8016 cb->nlh->nlmsg_seq, NLM_F_MULTI,
8017 wdev->netdev, radio_stats, &survey) < 0)
8018 goto out;
8019 survey_idx++;
8020 }
8021
8022 out:
8023 cb->args[2] = survey_idx;
8024 res = skb->len;
8025 out_err:
8026 rtnl_unlock();
8027 return res;
8028 }
8029
8030 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
8031 {
8032 return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
8033 NL80211_WPA_VERSION_2));
8034 }
8035
8036 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
8037 {
8038 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8039 struct net_device *dev = info->user_ptr[1];
8040 struct ieee80211_channel *chan;
8041 const u8 *bssid, *ssid, *ie = NULL, *auth_data = NULL;
8042 int err, ssid_len, ie_len = 0, auth_data_len = 0;
8043 enum nl80211_auth_type auth_type;
8044 struct key_parse key;
8045 bool local_state_change;
8046
8047 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8048 return -EINVAL;
8049
8050 if (!info->attrs[NL80211_ATTR_MAC])
8051 return -EINVAL;
8052
8053 if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
8054 return -EINVAL;
8055
8056 if (!info->attrs[NL80211_ATTR_SSID])
8057 return -EINVAL;
8058
8059 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
8060 return -EINVAL;
8061
8062 err = nl80211_parse_key(info, &key);
8063 if (err)
8064 return err;
8065
8066 if (key.idx >= 0) {
8067 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
8068 return -EINVAL;
8069 if (!key.p.key || !key.p.key_len)
8070 return -EINVAL;
8071 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
8072 key.p.key_len != WLAN_KEY_LEN_WEP40) &&
8073 (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
8074 key.p.key_len != WLAN_KEY_LEN_WEP104))
8075 return -EINVAL;
8076 if (key.idx > 3)
8077 return -EINVAL;
8078 } else {
8079 key.p.key_len = 0;
8080 key.p.key = NULL;
8081 }
8082
8083 if (key.idx >= 0) {
8084 int i;
8085 bool ok = false;
8086
8087 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
8088 if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
8089 ok = true;
8090 break;
8091 }
8092 }
8093 if (!ok)
8094 return -EINVAL;
8095 }
8096
8097 if (!rdev->ops->auth)
8098 return -EOPNOTSUPP;
8099
8100 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8101 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8102 return -EOPNOTSUPP;
8103
8104 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8105 chan = nl80211_get_valid_chan(&rdev->wiphy,
8106 info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8107 if (!chan)
8108 return -EINVAL;
8109
8110 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8111 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8112
8113 if (info->attrs[NL80211_ATTR_IE]) {
8114 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8115 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8116 }
8117
8118 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
8119 if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
8120 return -EINVAL;
8121
8122 if ((auth_type == NL80211_AUTHTYPE_SAE ||
8123 auth_type == NL80211_AUTHTYPE_FILS_SK ||
8124 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
8125 auth_type == NL80211_AUTHTYPE_FILS_PK) &&
8126 !info->attrs[NL80211_ATTR_AUTH_DATA])
8127 return -EINVAL;
8128
8129 if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
8130 if (auth_type != NL80211_AUTHTYPE_SAE &&
8131 auth_type != NL80211_AUTHTYPE_FILS_SK &&
8132 auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
8133 auth_type != NL80211_AUTHTYPE_FILS_PK)
8134 return -EINVAL;
8135 auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
8136 auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
8137 /* need to include at least Auth Transaction and Status Code */
8138 if (auth_data_len < 4)
8139 return -EINVAL;
8140 }
8141
8142 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8143
8144 /*
8145 * Since we no longer track auth state, ignore
8146 * requests to only change local state.
8147 */
8148 if (local_state_change)
8149 return 0;
8150
8151 wdev_lock(dev->ieee80211_ptr);
8152 err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
8153 ssid, ssid_len, ie, ie_len,
8154 key.p.key, key.p.key_len, key.idx,
8155 auth_data, auth_data_len);
8156 wdev_unlock(dev->ieee80211_ptr);
8157 return err;
8158 }
8159
8160 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
8161 struct genl_info *info,
8162 struct cfg80211_crypto_settings *settings,
8163 int cipher_limit)
8164 {
8165 memset(settings, 0, sizeof(*settings));
8166
8167 settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
8168
8169 if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
8170 u16 proto;
8171
8172 proto = nla_get_u16(
8173 info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
8174 settings->control_port_ethertype = cpu_to_be16(proto);
8175 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
8176 proto != ETH_P_PAE)
8177 return -EINVAL;
8178 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
8179 settings->control_port_no_encrypt = true;
8180 } else
8181 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
8182
8183 if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
8184 void *data;
8185 int len, i;
8186
8187 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
8188 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
8189 settings->n_ciphers_pairwise = len / sizeof(u32);
8190
8191 if (len % sizeof(u32))
8192 return -EINVAL;
8193
8194 if (settings->n_ciphers_pairwise > cipher_limit)
8195 return -EINVAL;
8196
8197 memcpy(settings->ciphers_pairwise, data, len);
8198
8199 for (i = 0; i < settings->n_ciphers_pairwise; i++)
8200 if (!cfg80211_supported_cipher_suite(
8201 &rdev->wiphy,
8202 settings->ciphers_pairwise[i]))
8203 return -EINVAL;
8204 }
8205
8206 if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
8207 settings->cipher_group =
8208 nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
8209 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
8210 settings->cipher_group))
8211 return -EINVAL;
8212 }
8213
8214 if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
8215 settings->wpa_versions =
8216 nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
8217 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
8218 return -EINVAL;
8219 }
8220
8221 if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
8222 void *data;
8223 int len;
8224
8225 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
8226 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
8227 settings->n_akm_suites = len / sizeof(u32);
8228
8229 if (len % sizeof(u32))
8230 return -EINVAL;
8231
8232 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
8233 return -EINVAL;
8234
8235 memcpy(settings->akm_suites, data, len);
8236 }
8237
8238 if (info->attrs[NL80211_ATTR_PMK]) {
8239 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
8240 return -EINVAL;
8241 if (!wiphy_ext_feature_isset(&rdev->wiphy,
8242 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK))
8243 return -EINVAL;
8244 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
8245 }
8246
8247 return 0;
8248 }
8249
8250 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
8251 {
8252 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8253 struct net_device *dev = info->user_ptr[1];
8254 struct ieee80211_channel *chan;
8255 struct cfg80211_assoc_request req = {};
8256 const u8 *bssid, *ssid;
8257 int err, ssid_len = 0;
8258
8259 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8260 return -EINVAL;
8261
8262 if (!info->attrs[NL80211_ATTR_MAC] ||
8263 !info->attrs[NL80211_ATTR_SSID] ||
8264 !info->attrs[NL80211_ATTR_WIPHY_FREQ])
8265 return -EINVAL;
8266
8267 if (!rdev->ops->assoc)
8268 return -EOPNOTSUPP;
8269
8270 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8271 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8272 return -EOPNOTSUPP;
8273
8274 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8275
8276 chan = nl80211_get_valid_chan(&rdev->wiphy,
8277 info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8278 if (!chan)
8279 return -EINVAL;
8280
8281 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8282 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8283
8284 if (info->attrs[NL80211_ATTR_IE]) {
8285 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8286 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8287 }
8288
8289 if (info->attrs[NL80211_ATTR_USE_MFP]) {
8290 enum nl80211_mfp mfp =
8291 nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
8292 if (mfp == NL80211_MFP_REQUIRED)
8293 req.use_mfp = true;
8294 else if (mfp != NL80211_MFP_NO)
8295 return -EINVAL;
8296 }
8297
8298 if (info->attrs[NL80211_ATTR_PREV_BSSID])
8299 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
8300
8301 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
8302 req.flags |= ASSOC_REQ_DISABLE_HT;
8303
8304 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8305 memcpy(&req.ht_capa_mask,
8306 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8307 sizeof(req.ht_capa_mask));
8308
8309 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8310 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8311 return -EINVAL;
8312 memcpy(&req.ht_capa,
8313 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8314 sizeof(req.ht_capa));
8315 }
8316
8317 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
8318 req.flags |= ASSOC_REQ_DISABLE_VHT;
8319
8320 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8321 memcpy(&req.vht_capa_mask,
8322 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
8323 sizeof(req.vht_capa_mask));
8324
8325 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
8326 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8327 return -EINVAL;
8328 memcpy(&req.vht_capa,
8329 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
8330 sizeof(req.vht_capa));
8331 }
8332
8333 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
8334 if (!((rdev->wiphy.features &
8335 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
8336 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
8337 !wiphy_ext_feature_isset(&rdev->wiphy,
8338 NL80211_EXT_FEATURE_RRM))
8339 return -EINVAL;
8340 req.flags |= ASSOC_REQ_USE_RRM;
8341 }
8342
8343 if (info->attrs[NL80211_ATTR_FILS_KEK]) {
8344 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
8345 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
8346 if (!info->attrs[NL80211_ATTR_FILS_NONCES])
8347 return -EINVAL;
8348 req.fils_nonces =
8349 nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
8350 }
8351
8352 err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
8353 if (!err) {
8354 wdev_lock(dev->ieee80211_ptr);
8355
8356 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
8357 ssid, ssid_len, &req);
8358
8359 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8360 dev->ieee80211_ptr->conn_owner_nlportid =
8361 info->snd_portid;
8362 memcpy(dev->ieee80211_ptr->disconnect_bssid,
8363 bssid, ETH_ALEN);
8364 }
8365
8366 wdev_unlock(dev->ieee80211_ptr);
8367 }
8368
8369 return err;
8370 }
8371
8372 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
8373 {
8374 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8375 struct net_device *dev = info->user_ptr[1];
8376 const u8 *ie = NULL, *bssid;
8377 int ie_len = 0, err;
8378 u16 reason_code;
8379 bool local_state_change;
8380
8381 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8382 return -EINVAL;
8383
8384 if (!info->attrs[NL80211_ATTR_MAC])
8385 return -EINVAL;
8386
8387 if (!info->attrs[NL80211_ATTR_REASON_CODE])
8388 return -EINVAL;
8389
8390 if (!rdev->ops->deauth)
8391 return -EOPNOTSUPP;
8392
8393 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8394 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8395 return -EOPNOTSUPP;
8396
8397 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8398
8399 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8400 if (reason_code == 0) {
8401 /* Reason Code 0 is reserved */
8402 return -EINVAL;
8403 }
8404
8405 if (info->attrs[NL80211_ATTR_IE]) {
8406 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8407 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8408 }
8409
8410 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8411
8412 wdev_lock(dev->ieee80211_ptr);
8413 err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
8414 local_state_change);
8415 wdev_unlock(dev->ieee80211_ptr);
8416 return err;
8417 }
8418
8419 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
8420 {
8421 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8422 struct net_device *dev = info->user_ptr[1];
8423 const u8 *ie = NULL, *bssid;
8424 int ie_len = 0, err;
8425 u16 reason_code;
8426 bool local_state_change;
8427
8428 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8429 return -EINVAL;
8430
8431 if (!info->attrs[NL80211_ATTR_MAC])
8432 return -EINVAL;
8433
8434 if (!info->attrs[NL80211_ATTR_REASON_CODE])
8435 return -EINVAL;
8436
8437 if (!rdev->ops->disassoc)
8438 return -EOPNOTSUPP;
8439
8440 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8441 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8442 return -EOPNOTSUPP;
8443
8444 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8445
8446 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8447 if (reason_code == 0) {
8448 /* Reason Code 0 is reserved */
8449 return -EINVAL;
8450 }
8451
8452 if (info->attrs[NL80211_ATTR_IE]) {
8453 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8454 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8455 }
8456
8457 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8458
8459 wdev_lock(dev->ieee80211_ptr);
8460 err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
8461 local_state_change);
8462 wdev_unlock(dev->ieee80211_ptr);
8463 return err;
8464 }
8465
8466 static bool
8467 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
8468 int mcast_rate[NUM_NL80211_BANDS],
8469 int rateval)
8470 {
8471 struct wiphy *wiphy = &rdev->wiphy;
8472 bool found = false;
8473 int band, i;
8474
8475 for (band = 0; band < NUM_NL80211_BANDS; band++) {
8476 struct ieee80211_supported_band *sband;
8477
8478 sband = wiphy->bands[band];
8479 if (!sband)
8480 continue;
8481
8482 for (i = 0; i < sband->n_bitrates; i++) {
8483 if (sband->bitrates[i].bitrate == rateval) {
8484 mcast_rate[band] = i + 1;
8485 found = true;
8486 break;
8487 }
8488 }
8489 }
8490
8491 return found;
8492 }
8493
8494 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
8495 {
8496 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8497 struct net_device *dev = info->user_ptr[1];
8498 struct cfg80211_ibss_params ibss;
8499 struct wiphy *wiphy;
8500 struct cfg80211_cached_keys *connkeys = NULL;
8501 int err;
8502
8503 memset(&ibss, 0, sizeof(ibss));
8504
8505 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8506 return -EINVAL;
8507
8508 if (!info->attrs[NL80211_ATTR_SSID] ||
8509 !nla_len(info->attrs[NL80211_ATTR_SSID]))
8510 return -EINVAL;
8511
8512 ibss.beacon_interval = 100;
8513
8514 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
8515 ibss.beacon_interval =
8516 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
8517
8518 err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
8519 ibss.beacon_interval);
8520 if (err)
8521 return err;
8522
8523 if (!rdev->ops->join_ibss)
8524 return -EOPNOTSUPP;
8525
8526 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
8527 return -EOPNOTSUPP;
8528
8529 wiphy = &rdev->wiphy;
8530
8531 if (info->attrs[NL80211_ATTR_MAC]) {
8532 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8533
8534 if (!is_valid_ether_addr(ibss.bssid))
8535 return -EINVAL;
8536 }
8537 ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8538 ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8539
8540 if (info->attrs[NL80211_ATTR_IE]) {
8541 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8542 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8543 }
8544
8545 err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
8546 if (err)
8547 return err;
8548
8549 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
8550 NL80211_IFTYPE_ADHOC))
8551 return -EINVAL;
8552
8553 switch (ibss.chandef.width) {
8554 case NL80211_CHAN_WIDTH_5:
8555 case NL80211_CHAN_WIDTH_10:
8556 case NL80211_CHAN_WIDTH_20_NOHT:
8557 break;
8558 case NL80211_CHAN_WIDTH_20:
8559 case NL80211_CHAN_WIDTH_40:
8560 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
8561 return -EINVAL;
8562 break;
8563 case NL80211_CHAN_WIDTH_80:
8564 case NL80211_CHAN_WIDTH_80P80:
8565 case NL80211_CHAN_WIDTH_160:
8566 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
8567 return -EINVAL;
8568 if (!wiphy_ext_feature_isset(&rdev->wiphy,
8569 NL80211_EXT_FEATURE_VHT_IBSS))
8570 return -EINVAL;
8571 break;
8572 default:
8573 return -EINVAL;
8574 }
8575
8576 ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
8577 ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
8578
8579 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
8580 u8 *rates =
8581 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8582 int n_rates =
8583 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8584 struct ieee80211_supported_band *sband =
8585 wiphy->bands[ibss.chandef.chan->band];
8586
8587 err = ieee80211_get_ratemask(sband, rates, n_rates,
8588 &ibss.basic_rates);
8589 if (err)
8590 return err;
8591 }
8592
8593 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8594 memcpy(&ibss.ht_capa_mask,
8595 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8596 sizeof(ibss.ht_capa_mask));
8597
8598 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8599 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8600 return -EINVAL;
8601 memcpy(&ibss.ht_capa,
8602 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8603 sizeof(ibss.ht_capa));
8604 }
8605
8606 if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
8607 !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
8608 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
8609 return -EINVAL;
8610
8611 if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
8612 bool no_ht = false;
8613
8614 connkeys = nl80211_parse_connkeys(rdev,
8615 info->attrs[NL80211_ATTR_KEYS],
8616 &no_ht);
8617 if (IS_ERR(connkeys))
8618 return PTR_ERR(connkeys);
8619
8620 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
8621 no_ht) {
8622 kzfree(connkeys);
8623 return -EINVAL;
8624 }
8625 }
8626
8627 ibss.control_port =
8628 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
8629
8630 ibss.userspace_handles_dfs =
8631 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
8632
8633 err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
8634 if (err)
8635 kzfree(connkeys);
8636 return err;
8637 }
8638
8639 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
8640 {
8641 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8642 struct net_device *dev = info->user_ptr[1];
8643
8644 if (!rdev->ops->leave_ibss)
8645 return -EOPNOTSUPP;
8646
8647 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
8648 return -EOPNOTSUPP;
8649
8650 return cfg80211_leave_ibss(rdev, dev, false);
8651 }
8652
8653 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
8654 {
8655 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8656 struct net_device *dev = info->user_ptr[1];
8657 int mcast_rate[NUM_NL80211_BANDS];
8658 u32 nla_rate;
8659 int err;
8660
8661 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
8662 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
8663 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
8664 return -EOPNOTSUPP;
8665
8666 if (!rdev->ops->set_mcast_rate)
8667 return -EOPNOTSUPP;
8668
8669 memset(mcast_rate, 0, sizeof(mcast_rate));
8670
8671 if (!info->attrs[NL80211_ATTR_MCAST_RATE])
8672 return -EINVAL;
8673
8674 nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
8675 if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
8676 return -EINVAL;
8677
8678 err = rdev_set_mcast_rate(rdev, dev, mcast_rate);
8679
8680 return err;
8681 }
8682
8683 static struct sk_buff *
8684 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
8685 struct wireless_dev *wdev, int approxlen,
8686 u32 portid, u32 seq, enum nl80211_commands cmd,
8687 enum nl80211_attrs attr,
8688 const struct nl80211_vendor_cmd_info *info,
8689 gfp_t gfp)
8690 {
8691 struct sk_buff *skb;
8692 void *hdr;
8693 struct nlattr *data;
8694
8695 skb = nlmsg_new(approxlen + 100, gfp);
8696 if (!skb)
8697 return NULL;
8698
8699 hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
8700 if (!hdr) {
8701 kfree_skb(skb);
8702 return NULL;
8703 }
8704
8705 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
8706 goto nla_put_failure;
8707
8708 if (info) {
8709 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
8710 info->vendor_id))
8711 goto nla_put_failure;
8712 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
8713 info->subcmd))
8714 goto nla_put_failure;
8715 }
8716
8717 if (wdev) {
8718 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
8719 wdev_id(wdev), NL80211_ATTR_PAD))
8720 goto nla_put_failure;
8721 if (wdev->netdev &&
8722 nla_put_u32(skb, NL80211_ATTR_IFINDEX,
8723 wdev->netdev->ifindex))
8724 goto nla_put_failure;
8725 }
8726
8727 data = nla_nest_start(skb, attr);
8728 if (!data)
8729 goto nla_put_failure;
8730
8731 ((void **)skb->cb)[0] = rdev;
8732 ((void **)skb->cb)[1] = hdr;
8733 ((void **)skb->cb)[2] = data;
8734
8735 return skb;
8736
8737 nla_put_failure:
8738 kfree_skb(skb);
8739 return NULL;
8740 }
8741
8742 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
8743 struct wireless_dev *wdev,
8744 enum nl80211_commands cmd,
8745 enum nl80211_attrs attr,
8746 int vendor_event_idx,
8747 int approxlen, gfp_t gfp)
8748 {
8749 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
8750 const struct nl80211_vendor_cmd_info *info;
8751
8752 switch (cmd) {
8753 case NL80211_CMD_TESTMODE:
8754 if (WARN_ON(vendor_event_idx != -1))
8755 return NULL;
8756 info = NULL;
8757 break;
8758 case NL80211_CMD_VENDOR:
8759 if (WARN_ON(vendor_event_idx < 0 ||
8760 vendor_event_idx >= wiphy->n_vendor_events))
8761 return NULL;
8762 info = &wiphy->vendor_events[vendor_event_idx];
8763 break;
8764 default:
8765 WARN_ON(1);
8766 return NULL;
8767 }
8768
8769 return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, 0, 0,
8770 cmd, attr, info, gfp);
8771 }
8772 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
8773
8774 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
8775 {
8776 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
8777 void *hdr = ((void **)skb->cb)[1];
8778 struct nlattr *data = ((void **)skb->cb)[2];
8779 enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
8780
8781 /* clear CB data for netlink core to own from now on */
8782 memset(skb->cb, 0, sizeof(skb->cb));
8783
8784 nla_nest_end(skb, data);
8785 genlmsg_end(skb, hdr);
8786
8787 if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
8788 mcgrp = NL80211_MCGRP_VENDOR;
8789
8790 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
8791 mcgrp, gfp);
8792 }
8793 EXPORT_SYMBOL(__cfg80211_send_event_skb);
8794
8795 #ifdef CONFIG_NL80211_TESTMODE
8796 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
8797 {
8798 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8799 struct wireless_dev *wdev =
8800 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
8801 int err;
8802
8803 if (!rdev->ops->testmode_cmd)
8804 return -EOPNOTSUPP;
8805
8806 if (IS_ERR(wdev)) {
8807 err = PTR_ERR(wdev);
8808 if (err != -EINVAL)
8809 return err;
8810 wdev = NULL;
8811 } else if (wdev->wiphy != &rdev->wiphy) {
8812 return -EINVAL;
8813 }
8814
8815 if (!info->attrs[NL80211_ATTR_TESTDATA])
8816 return -EINVAL;
8817
8818 rdev->cur_cmd_info = info;
8819 err = rdev_testmode_cmd(rdev, wdev,
8820 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
8821 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
8822 rdev->cur_cmd_info = NULL;
8823
8824 return err;
8825 }
8826
8827 static int nl80211_testmode_dump(struct sk_buff *skb,
8828 struct netlink_callback *cb)
8829 {
8830 struct cfg80211_registered_device *rdev;
8831 int err;
8832 long phy_idx;
8833 void *data = NULL;
8834 int data_len = 0;
8835
8836 rtnl_lock();
8837
8838 if (cb->args[0]) {
8839 /*
8840 * 0 is a valid index, but not valid for args[0],
8841 * so we need to offset by 1.
8842 */
8843 phy_idx = cb->args[0] - 1;
8844
8845 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
8846 if (!rdev) {
8847 err = -ENOENT;
8848 goto out_err;
8849 }
8850 } else {
8851 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
8852
8853 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
8854 attrbuf, nl80211_fam.maxattr,
8855 nl80211_policy, NULL);
8856 if (err)
8857 goto out_err;
8858
8859 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
8860 if (IS_ERR(rdev)) {
8861 err = PTR_ERR(rdev);
8862 goto out_err;
8863 }
8864 phy_idx = rdev->wiphy_idx;
8865
8866 if (attrbuf[NL80211_ATTR_TESTDATA])
8867 cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
8868 }
8869
8870 if (cb->args[1]) {
8871 data = nla_data((void *)cb->args[1]);
8872 data_len = nla_len((void *)cb->args[1]);
8873 }
8874
8875 if (!rdev->ops->testmode_dump) {
8876 err = -EOPNOTSUPP;
8877 goto out_err;
8878 }
8879
8880 while (1) {
8881 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
8882 cb->nlh->nlmsg_seq, NLM_F_MULTI,
8883 NL80211_CMD_TESTMODE);
8884 struct nlattr *tmdata;
8885
8886 if (!hdr)
8887 break;
8888
8889 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
8890 genlmsg_cancel(skb, hdr);
8891 break;
8892 }
8893
8894 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
8895 if (!tmdata) {
8896 genlmsg_cancel(skb, hdr);
8897 break;
8898 }
8899 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
8900 nla_nest_end(skb, tmdata);
8901
8902 if (err == -ENOBUFS || err == -ENOENT) {
8903 genlmsg_cancel(skb, hdr);
8904 break;
8905 } else if (err) {
8906 genlmsg_cancel(skb, hdr);
8907 goto out_err;
8908 }
8909
8910 genlmsg_end(skb, hdr);
8911 }
8912
8913 err = skb->len;
8914 /* see above */
8915 cb->args[0] = phy_idx + 1;
8916 out_err:
8917 rtnl_unlock();
8918 return err;
8919 }
8920 #endif
8921
8922 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
8923 {
8924 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8925 struct net_device *dev = info->user_ptr[1];
8926 struct cfg80211_connect_params connect;
8927 struct wiphy *wiphy;
8928 struct cfg80211_cached_keys *connkeys = NULL;
8929 int err;
8930
8931 memset(&connect, 0, sizeof(connect));
8932
8933 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8934 return -EINVAL;
8935
8936 if (!info->attrs[NL80211_ATTR_SSID] ||
8937 !nla_len(info->attrs[NL80211_ATTR_SSID]))
8938 return -EINVAL;
8939
8940 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
8941 connect.auth_type =
8942 nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
8943 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
8944 NL80211_CMD_CONNECT))
8945 return -EINVAL;
8946 } else
8947 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
8948
8949 connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
8950
8951 if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
8952 !wiphy_ext_feature_isset(&rdev->wiphy,
8953 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
8954 return -EINVAL;
8955 connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
8956
8957 err = nl80211_crypto_settings(rdev, info, &connect.crypto,
8958 NL80211_MAX_NR_CIPHER_SUITES);
8959 if (err)
8960 return err;
8961
8962 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8963 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8964 return -EOPNOTSUPP;
8965
8966 wiphy = &rdev->wiphy;
8967
8968 connect.bg_scan_period = -1;
8969 if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
8970 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
8971 connect.bg_scan_period =
8972 nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
8973 }
8974
8975 if (info->attrs[NL80211_ATTR_MAC])
8976 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8977 else if (info->attrs[NL80211_ATTR_MAC_HINT])
8978 connect.bssid_hint =
8979 nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
8980 connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8981 connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8982
8983 if (info->attrs[NL80211_ATTR_IE]) {
8984 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8985 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8986 }
8987
8988 if (info->attrs[NL80211_ATTR_USE_MFP]) {
8989 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
8990 if (connect.mfp == NL80211_MFP_OPTIONAL &&
8991 !wiphy_ext_feature_isset(&rdev->wiphy,
8992 NL80211_EXT_FEATURE_MFP_OPTIONAL))
8993 return -EOPNOTSUPP;
8994
8995 if (connect.mfp != NL80211_MFP_REQUIRED &&
8996 connect.mfp != NL80211_MFP_NO &&
8997 connect.mfp != NL80211_MFP_OPTIONAL)
8998 return -EINVAL;
8999 } else {
9000 connect.mfp = NL80211_MFP_NO;
9001 }
9002
9003 if (info->attrs[NL80211_ATTR_PREV_BSSID])
9004 connect.prev_bssid =
9005 nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
9006
9007 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
9008 connect.channel = nl80211_get_valid_chan(
9009 wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
9010 if (!connect.channel)
9011 return -EINVAL;
9012 } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
9013 connect.channel_hint = nl80211_get_valid_chan(
9014 wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
9015 if (!connect.channel_hint)
9016 return -EINVAL;
9017 }
9018
9019 if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
9020 connkeys = nl80211_parse_connkeys(rdev,
9021 info->attrs[NL80211_ATTR_KEYS], NULL);
9022 if (IS_ERR(connkeys))
9023 return PTR_ERR(connkeys);
9024 }
9025
9026 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
9027 connect.flags |= ASSOC_REQ_DISABLE_HT;
9028
9029 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9030 memcpy(&connect.ht_capa_mask,
9031 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
9032 sizeof(connect.ht_capa_mask));
9033
9034 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
9035 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
9036 kzfree(connkeys);
9037 return -EINVAL;
9038 }
9039 memcpy(&connect.ht_capa,
9040 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
9041 sizeof(connect.ht_capa));
9042 }
9043
9044 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
9045 connect.flags |= ASSOC_REQ_DISABLE_VHT;
9046
9047 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
9048 memcpy(&connect.vht_capa_mask,
9049 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
9050 sizeof(connect.vht_capa_mask));
9051
9052 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
9053 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
9054 kzfree(connkeys);
9055 return -EINVAL;
9056 }
9057 memcpy(&connect.vht_capa,
9058 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
9059 sizeof(connect.vht_capa));
9060 }
9061
9062 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
9063 if (!((rdev->wiphy.features &
9064 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
9065 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
9066 !wiphy_ext_feature_isset(&rdev->wiphy,
9067 NL80211_EXT_FEATURE_RRM)) {
9068 kzfree(connkeys);
9069 return -EINVAL;
9070 }
9071 connect.flags |= ASSOC_REQ_USE_RRM;
9072 }
9073
9074 connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
9075 if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
9076 kzfree(connkeys);
9077 return -EOPNOTSUPP;
9078 }
9079
9080 if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
9081 /* bss selection makes no sense if bssid is set */
9082 if (connect.bssid) {
9083 kzfree(connkeys);
9084 return -EINVAL;
9085 }
9086
9087 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
9088 wiphy, &connect.bss_select);
9089 if (err) {
9090 kzfree(connkeys);
9091 return err;
9092 }
9093 }
9094
9095 if (wiphy_ext_feature_isset(&rdev->wiphy,
9096 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
9097 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
9098 info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
9099 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
9100 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9101 connect.fils_erp_username =
9102 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9103 connect.fils_erp_username_len =
9104 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9105 connect.fils_erp_realm =
9106 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9107 connect.fils_erp_realm_len =
9108 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9109 connect.fils_erp_next_seq_num =
9110 nla_get_u16(
9111 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
9112 connect.fils_erp_rrk =
9113 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9114 connect.fils_erp_rrk_len =
9115 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9116 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
9117 info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
9118 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
9119 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9120 kzfree(connkeys);
9121 return -EINVAL;
9122 }
9123
9124 wdev_lock(dev->ieee80211_ptr);
9125
9126 err = cfg80211_connect(rdev, dev, &connect, connkeys,
9127 connect.prev_bssid);
9128 if (err)
9129 kzfree(connkeys);
9130
9131 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9132 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
9133 if (connect.bssid)
9134 memcpy(dev->ieee80211_ptr->disconnect_bssid,
9135 connect.bssid, ETH_ALEN);
9136 else
9137 memset(dev->ieee80211_ptr->disconnect_bssid,
9138 0, ETH_ALEN);
9139 }
9140
9141 wdev_unlock(dev->ieee80211_ptr);
9142
9143 return err;
9144 }
9145
9146 static int nl80211_update_connect_params(struct sk_buff *skb,
9147 struct genl_info *info)
9148 {
9149 struct cfg80211_connect_params connect = {};
9150 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9151 struct net_device *dev = info->user_ptr[1];
9152 struct wireless_dev *wdev = dev->ieee80211_ptr;
9153 u32 changed = 0;
9154 int ret;
9155
9156 if (!rdev->ops->update_connect_params)
9157 return -EOPNOTSUPP;
9158
9159 if (info->attrs[NL80211_ATTR_IE]) {
9160 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
9161 return -EINVAL;
9162 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9163 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9164 changed |= UPDATE_ASSOC_IES;
9165 }
9166
9167 wdev_lock(dev->ieee80211_ptr);
9168 if (!wdev->current_bss)
9169 ret = -ENOLINK;
9170 else
9171 ret = rdev_update_connect_params(rdev, dev, &connect, changed);
9172 wdev_unlock(dev->ieee80211_ptr);
9173
9174 return ret;
9175 }
9176
9177 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
9178 {
9179 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9180 struct net_device *dev = info->user_ptr[1];
9181 u16 reason;
9182 int ret;
9183
9184 if (!info->attrs[NL80211_ATTR_REASON_CODE])
9185 reason = WLAN_REASON_DEAUTH_LEAVING;
9186 else
9187 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
9188
9189 if (reason == 0)
9190 return -EINVAL;
9191
9192 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9193 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9194 return -EOPNOTSUPP;
9195
9196 wdev_lock(dev->ieee80211_ptr);
9197 ret = cfg80211_disconnect(rdev, dev, reason, true);
9198 wdev_unlock(dev->ieee80211_ptr);
9199 return ret;
9200 }
9201
9202 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
9203 {
9204 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9205 struct net *net;
9206 int err;
9207
9208 if (info->attrs[NL80211_ATTR_PID]) {
9209 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
9210
9211 net = get_net_ns_by_pid(pid);
9212 } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
9213 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
9214
9215 net = get_net_ns_by_fd(fd);
9216 } else {
9217 return -EINVAL;
9218 }
9219
9220 if (IS_ERR(net))
9221 return PTR_ERR(net);
9222
9223 err = 0;
9224
9225 /* check if anything to do */
9226 if (!net_eq(wiphy_net(&rdev->wiphy), net))
9227 err = cfg80211_switch_netns(rdev, net);
9228
9229 put_net(net);
9230 return err;
9231 }
9232
9233 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
9234 {
9235 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9236 int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
9237 struct cfg80211_pmksa *pmksa) = NULL;
9238 struct net_device *dev = info->user_ptr[1];
9239 struct cfg80211_pmksa pmksa;
9240
9241 memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
9242
9243 if (!info->attrs[NL80211_ATTR_PMKID])
9244 return -EINVAL;
9245
9246 pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
9247
9248 if (info->attrs[NL80211_ATTR_MAC]) {
9249 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9250 } else if (info->attrs[NL80211_ATTR_SSID] &&
9251 info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
9252 (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA ||
9253 info->attrs[NL80211_ATTR_PMK])) {
9254 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9255 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9256 pmksa.cache_id =
9257 nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
9258 } else {
9259 return -EINVAL;
9260 }
9261 if (info->attrs[NL80211_ATTR_PMK]) {
9262 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
9263 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
9264 }
9265
9266 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9267 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9268 return -EOPNOTSUPP;
9269
9270 switch (info->genlhdr->cmd) {
9271 case NL80211_CMD_SET_PMKSA:
9272 rdev_ops = rdev->ops->set_pmksa;
9273 break;
9274 case NL80211_CMD_DEL_PMKSA:
9275 rdev_ops = rdev->ops->del_pmksa;
9276 break;
9277 default:
9278 WARN_ON(1);
9279 break;
9280 }
9281
9282 if (!rdev_ops)
9283 return -EOPNOTSUPP;
9284
9285 return rdev_ops(&rdev->wiphy, dev, &pmksa);
9286 }
9287
9288 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
9289 {
9290 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9291 struct net_device *dev = info->user_ptr[1];
9292
9293 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9294 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9295 return -EOPNOTSUPP;
9296
9297 if (!rdev->ops->flush_pmksa)
9298 return -EOPNOTSUPP;
9299
9300 return rdev_flush_pmksa(rdev, dev);
9301 }
9302
9303 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
9304 {
9305 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9306 struct net_device *dev = info->user_ptr[1];
9307 u8 action_code, dialog_token;
9308 u32 peer_capability = 0;
9309 u16 status_code;
9310 u8 *peer;
9311 bool initiator;
9312
9313 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
9314 !rdev->ops->tdls_mgmt)
9315 return -EOPNOTSUPP;
9316
9317 if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
9318 !info->attrs[NL80211_ATTR_STATUS_CODE] ||
9319 !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
9320 !info->attrs[NL80211_ATTR_IE] ||
9321 !info->attrs[NL80211_ATTR_MAC])
9322 return -EINVAL;
9323
9324 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
9325 action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
9326 status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
9327 dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
9328 initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
9329 if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
9330 peer_capability =
9331 nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
9332
9333 return rdev_tdls_mgmt(rdev, dev, peer, action_code,
9334 dialog_token, status_code, peer_capability,
9335 initiator,
9336 nla_data(info->attrs[NL80211_ATTR_IE]),
9337 nla_len(info->attrs[NL80211_ATTR_IE]));
9338 }
9339
9340 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
9341 {
9342 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9343 struct net_device *dev = info->user_ptr[1];
9344 enum nl80211_tdls_operation operation;
9345 u8 *peer;
9346
9347 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
9348 !rdev->ops->tdls_oper)
9349 return -EOPNOTSUPP;
9350
9351 if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
9352 !info->attrs[NL80211_ATTR_MAC])
9353 return -EINVAL;
9354
9355 operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
9356 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
9357
9358 return rdev_tdls_oper(rdev, dev, peer, operation);
9359 }
9360
9361 static int nl80211_remain_on_channel(struct sk_buff *skb,
9362 struct genl_info *info)
9363 {
9364 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9365 struct wireless_dev *wdev = info->user_ptr[1];
9366 struct cfg80211_chan_def chandef;
9367 const struct cfg80211_chan_def *compat_chandef;
9368 struct sk_buff *msg;
9369 void *hdr;
9370 u64 cookie;
9371 u32 duration;
9372 int err;
9373
9374 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
9375 !info->attrs[NL80211_ATTR_DURATION])
9376 return -EINVAL;
9377
9378 duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
9379
9380 if (!rdev->ops->remain_on_channel ||
9381 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
9382 return -EOPNOTSUPP;
9383
9384 /*
9385 * We should be on that channel for at least a minimum amount of
9386 * time (10ms) but no longer than the driver supports.
9387 */
9388 if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
9389 duration > rdev->wiphy.max_remain_on_channel_duration)
9390 return -EINVAL;
9391
9392 err = nl80211_parse_chandef(rdev, info, &chandef);
9393 if (err)
9394 return err;
9395
9396 wdev_lock(wdev);
9397 if (!cfg80211_off_channel_oper_allowed(wdev) &&
9398 !cfg80211_chandef_identical(&wdev->chandef, &chandef)) {
9399 compat_chandef = cfg80211_chandef_compatible(&wdev->chandef,
9400 &chandef);
9401 if (compat_chandef != &chandef) {
9402 wdev_unlock(wdev);
9403 return -EBUSY;
9404 }
9405 }
9406 wdev_unlock(wdev);
9407
9408 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9409 if (!msg)
9410 return -ENOMEM;
9411
9412 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9413 NL80211_CMD_REMAIN_ON_CHANNEL);
9414 if (!hdr) {
9415 err = -ENOBUFS;
9416 goto free_msg;
9417 }
9418
9419 err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
9420 duration, &cookie);
9421
9422 if (err)
9423 goto free_msg;
9424
9425 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
9426 NL80211_ATTR_PAD))
9427 goto nla_put_failure;
9428
9429 genlmsg_end(msg, hdr);
9430
9431 return genlmsg_reply(msg, info);
9432
9433 nla_put_failure:
9434 err = -ENOBUFS;
9435 free_msg:
9436 nlmsg_free(msg);
9437 return err;
9438 }
9439
9440 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
9441 struct genl_info *info)
9442 {
9443 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9444 struct wireless_dev *wdev = info->user_ptr[1];
9445 u64 cookie;
9446
9447 if (!info->attrs[NL80211_ATTR_COOKIE])
9448 return -EINVAL;
9449
9450 if (!rdev->ops->cancel_remain_on_channel)
9451 return -EOPNOTSUPP;
9452
9453 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
9454
9455 return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
9456 }
9457
9458 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
9459 struct genl_info *info)
9460 {
9461 struct cfg80211_bitrate_mask mask;
9462 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9463 struct net_device *dev = info->user_ptr[1];
9464 int err;
9465
9466 if (!rdev->ops->set_bitrate_mask)
9467 return -EOPNOTSUPP;
9468
9469 err = nl80211_parse_tx_bitrate_mask(info, &mask);
9470 if (err)
9471 return err;
9472
9473 return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
9474 }
9475
9476 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
9477 {
9478 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9479 struct wireless_dev *wdev = info->user_ptr[1];
9480 u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
9481
9482 if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
9483 return -EINVAL;
9484
9485 if (info->attrs[NL80211_ATTR_FRAME_TYPE])
9486 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
9487
9488 switch (wdev->iftype) {
9489 case NL80211_IFTYPE_STATION:
9490 case NL80211_IFTYPE_ADHOC:
9491 case NL80211_IFTYPE_P2P_CLIENT:
9492 case NL80211_IFTYPE_AP:
9493 case NL80211_IFTYPE_AP_VLAN:
9494 case NL80211_IFTYPE_MESH_POINT:
9495 case NL80211_IFTYPE_P2P_GO:
9496 case NL80211_IFTYPE_P2P_DEVICE:
9497 break;
9498 case NL80211_IFTYPE_NAN:
9499 default:
9500 return -EOPNOTSUPP;
9501 }
9502
9503 /* not much point in registering if we can't reply */
9504 if (!rdev->ops->mgmt_tx)
9505 return -EOPNOTSUPP;
9506
9507 return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
9508 nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
9509 nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
9510 }
9511
9512 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
9513 {
9514 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9515 struct wireless_dev *wdev = info->user_ptr[1];
9516 struct cfg80211_chan_def chandef;
9517 int err;
9518 void *hdr = NULL;
9519 u64 cookie;
9520 struct sk_buff *msg = NULL;
9521 struct cfg80211_mgmt_tx_params params = {
9522 .dont_wait_for_ack =
9523 info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
9524 };
9525
9526 if (!info->attrs[NL80211_ATTR_FRAME])
9527 return -EINVAL;
9528
9529 if (!rdev->ops->mgmt_tx)
9530 return -EOPNOTSUPP;
9531
9532 switch (wdev->iftype) {
9533 case NL80211_IFTYPE_P2P_DEVICE:
9534 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
9535 return -EINVAL;
9536 case NL80211_IFTYPE_STATION:
9537 case NL80211_IFTYPE_ADHOC:
9538 case NL80211_IFTYPE_P2P_CLIENT:
9539 case NL80211_IFTYPE_AP:
9540 case NL80211_IFTYPE_AP_VLAN:
9541 case NL80211_IFTYPE_MESH_POINT:
9542 case NL80211_IFTYPE_P2P_GO:
9543 break;
9544 case NL80211_IFTYPE_NAN:
9545 default:
9546 return -EOPNOTSUPP;
9547 }
9548
9549 if (info->attrs[NL80211_ATTR_DURATION]) {
9550 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
9551 return -EINVAL;
9552 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
9553
9554 /*
9555 * We should wait on the channel for at least a minimum amount
9556 * of time (10ms) but no longer than the driver supports.
9557 */
9558 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
9559 params.wait > rdev->wiphy.max_remain_on_channel_duration)
9560 return -EINVAL;
9561 }
9562
9563 params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
9564
9565 if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
9566 return -EINVAL;
9567
9568 params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
9569
9570 /* get the channel if any has been specified, otherwise pass NULL to
9571 * the driver. The latter will use the current one
9572 */
9573 chandef.chan = NULL;
9574 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
9575 err = nl80211_parse_chandef(rdev, info, &chandef);
9576 if (err)
9577 return err;
9578 }
9579
9580 if (!chandef.chan && params.offchan)
9581 return -EINVAL;
9582
9583 wdev_lock(wdev);
9584 if (params.offchan && !cfg80211_off_channel_oper_allowed(wdev)) {
9585 wdev_unlock(wdev);
9586 return -EBUSY;
9587 }
9588 wdev_unlock(wdev);
9589
9590 params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
9591 params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
9592
9593 if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
9594 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
9595 int i;
9596
9597 if (len % sizeof(u16))
9598 return -EINVAL;
9599
9600 params.n_csa_offsets = len / sizeof(u16);
9601 params.csa_offsets =
9602 nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
9603
9604 /* check that all the offsets fit the frame */
9605 for (i = 0; i < params.n_csa_offsets; i++) {
9606 if (params.csa_offsets[i] >= params.len)
9607 return -EINVAL;
9608 }
9609 }
9610
9611 if (!params.dont_wait_for_ack) {
9612 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9613 if (!msg)
9614 return -ENOMEM;
9615
9616 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9617 NL80211_CMD_FRAME);
9618 if (!hdr) {
9619 err = -ENOBUFS;
9620 goto free_msg;
9621 }
9622 }
9623
9624 params.chan = chandef.chan;
9625 err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
9626 if (err)
9627 goto free_msg;
9628
9629 if (msg) {
9630 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
9631 NL80211_ATTR_PAD))
9632 goto nla_put_failure;
9633
9634 genlmsg_end(msg, hdr);
9635 return genlmsg_reply(msg, info);
9636 }
9637
9638 return 0;
9639
9640 nla_put_failure:
9641 err = -ENOBUFS;
9642 free_msg:
9643 nlmsg_free(msg);
9644 return err;
9645 }
9646
9647 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
9648 {
9649 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9650 struct wireless_dev *wdev = info->user_ptr[1];
9651 u64 cookie;
9652
9653 if (!info->attrs[NL80211_ATTR_COOKIE])
9654 return -EINVAL;
9655
9656 if (!rdev->ops->mgmt_tx_cancel_wait)
9657 return -EOPNOTSUPP;
9658
9659 switch (wdev->iftype) {
9660 case NL80211_IFTYPE_STATION:
9661 case NL80211_IFTYPE_ADHOC:
9662 case NL80211_IFTYPE_P2P_CLIENT:
9663 case NL80211_IFTYPE_AP:
9664 case NL80211_IFTYPE_AP_VLAN:
9665 case NL80211_IFTYPE_P2P_GO:
9666 case NL80211_IFTYPE_P2P_DEVICE:
9667 break;
9668 case NL80211_IFTYPE_NAN:
9669 default:
9670 return -EOPNOTSUPP;
9671 }
9672
9673 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
9674
9675 return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
9676 }
9677
9678 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
9679 {
9680 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9681 struct wireless_dev *wdev;
9682 struct net_device *dev = info->user_ptr[1];
9683 u8 ps_state;
9684 bool state;
9685 int err;
9686
9687 if (!info->attrs[NL80211_ATTR_PS_STATE])
9688 return -EINVAL;
9689
9690 ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
9691
9692 if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
9693 return -EINVAL;
9694
9695 wdev = dev->ieee80211_ptr;
9696
9697 if (!rdev->ops->set_power_mgmt)
9698 return -EOPNOTSUPP;
9699
9700 state = (ps_state == NL80211_PS_ENABLED) ? true : false;
9701
9702 if (state == wdev->ps)
9703 return 0;
9704
9705 err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
9706 if (!err)
9707 wdev->ps = state;
9708 return err;
9709 }
9710
9711 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
9712 {
9713 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9714 enum nl80211_ps_state ps_state;
9715 struct wireless_dev *wdev;
9716 struct net_device *dev = info->user_ptr[1];
9717 struct sk_buff *msg;
9718 void *hdr;
9719 int err;
9720
9721 wdev = dev->ieee80211_ptr;
9722
9723 if (!rdev->ops->set_power_mgmt)
9724 return -EOPNOTSUPP;
9725
9726 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9727 if (!msg)
9728 return -ENOMEM;
9729
9730 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9731 NL80211_CMD_GET_POWER_SAVE);
9732 if (!hdr) {
9733 err = -ENOBUFS;
9734 goto free_msg;
9735 }
9736
9737 if (wdev->ps)
9738 ps_state = NL80211_PS_ENABLED;
9739 else
9740 ps_state = NL80211_PS_DISABLED;
9741
9742 if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
9743 goto nla_put_failure;
9744
9745 genlmsg_end(msg, hdr);
9746 return genlmsg_reply(msg, info);
9747
9748 nla_put_failure:
9749 err = -ENOBUFS;
9750 free_msg:
9751 nlmsg_free(msg);
9752 return err;
9753 }
9754
9755 static const struct nla_policy
9756 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
9757 [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
9758 [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
9759 [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
9760 [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
9761 [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
9762 [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
9763 [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
9764 };
9765
9766 static int nl80211_set_cqm_txe(struct genl_info *info,
9767 u32 rate, u32 pkts, u32 intvl)
9768 {
9769 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9770 struct net_device *dev = info->user_ptr[1];
9771 struct wireless_dev *wdev = dev->ieee80211_ptr;
9772
9773 if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
9774 return -EINVAL;
9775
9776 if (!rdev->ops->set_cqm_txe_config)
9777 return -EOPNOTSUPP;
9778
9779 if (wdev->iftype != NL80211_IFTYPE_STATION &&
9780 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
9781 return -EOPNOTSUPP;
9782
9783 return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
9784 }
9785
9786 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
9787 struct net_device *dev)
9788 {
9789 struct wireless_dev *wdev = dev->ieee80211_ptr;
9790 s32 last, low, high;
9791 u32 hyst;
9792 int i, n;
9793 int err;
9794
9795 /* RSSI reporting disabled? */
9796 if (!wdev->cqm_config)
9797 return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
9798
9799 /*
9800 * Obtain current RSSI value if possible, if not and no RSSI threshold
9801 * event has been received yet, we should receive an event after a
9802 * connection is established and enough beacons received to calculate
9803 * the average.
9804 */
9805 if (!wdev->cqm_config->last_rssi_event_value && wdev->current_bss &&
9806 rdev->ops->get_station) {
9807 struct station_info sinfo;
9808 u8 *mac_addr;
9809
9810 mac_addr = wdev->current_bss->pub.bssid;
9811
9812 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
9813 if (err)
9814 return err;
9815
9816 if (sinfo.filled & BIT(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
9817 wdev->cqm_config->last_rssi_event_value =
9818 (s8) sinfo.rx_beacon_signal_avg;
9819 }
9820
9821 last = wdev->cqm_config->last_rssi_event_value;
9822 hyst = wdev->cqm_config->rssi_hyst;
9823 n = wdev->cqm_config->n_rssi_thresholds;
9824
9825 for (i = 0; i < n; i++)
9826 if (last < wdev->cqm_config->rssi_thresholds[i])
9827 break;
9828
9829 low = i > 0 ?
9830 (wdev->cqm_config->rssi_thresholds[i - 1] - hyst) : S32_MIN;
9831 high = i < n ?
9832 (wdev->cqm_config->rssi_thresholds[i] + hyst - 1) : S32_MAX;
9833
9834 return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
9835 }
9836
9837 static int nl80211_set_cqm_rssi(struct genl_info *info,
9838 const s32 *thresholds, int n_thresholds,
9839 u32 hysteresis)
9840 {
9841 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9842 struct net_device *dev = info->user_ptr[1];
9843 struct wireless_dev *wdev = dev->ieee80211_ptr;
9844 int i, err;
9845 s32 prev = S32_MIN;
9846
9847 /* Check all values negative and sorted */
9848 for (i = 0; i < n_thresholds; i++) {
9849 if (thresholds[i] > 0 || thresholds[i] <= prev)
9850 return -EINVAL;
9851
9852 prev = thresholds[i];
9853 }
9854
9855 if (wdev->iftype != NL80211_IFTYPE_STATION &&
9856 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
9857 return -EOPNOTSUPP;
9858
9859 wdev_lock(wdev);
9860 cfg80211_cqm_config_free(wdev);
9861 wdev_unlock(wdev);
9862
9863 if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) {
9864 if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */
9865 return rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
9866
9867 return rdev_set_cqm_rssi_config(rdev, dev,
9868 thresholds[0], hysteresis);
9869 }
9870
9871 if (!wiphy_ext_feature_isset(&rdev->wiphy,
9872 NL80211_EXT_FEATURE_CQM_RSSI_LIST))
9873 return -EOPNOTSUPP;
9874
9875 if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
9876 n_thresholds = 0;
9877
9878 wdev_lock(wdev);
9879 if (n_thresholds) {
9880 struct cfg80211_cqm_config *cqm_config;
9881
9882 cqm_config = kzalloc(sizeof(struct cfg80211_cqm_config) +
9883 n_thresholds * sizeof(s32), GFP_KERNEL);
9884 if (!cqm_config) {
9885 err = -ENOMEM;
9886 goto unlock;
9887 }
9888
9889 cqm_config->rssi_hyst = hysteresis;
9890 cqm_config->n_rssi_thresholds = n_thresholds;
9891 memcpy(cqm_config->rssi_thresholds, thresholds,
9892 n_thresholds * sizeof(s32));
9893
9894 wdev->cqm_config = cqm_config;
9895 }
9896
9897 err = cfg80211_cqm_rssi_update(rdev, dev);
9898
9899 unlock:
9900 wdev_unlock(wdev);
9901
9902 return err;
9903 }
9904
9905 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
9906 {
9907 struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
9908 struct nlattr *cqm;
9909 int err;
9910
9911 cqm = info->attrs[NL80211_ATTR_CQM];
9912 if (!cqm)
9913 return -EINVAL;
9914
9915 err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
9916 nl80211_attr_cqm_policy, info->extack);
9917 if (err)
9918 return err;
9919
9920 if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
9921 attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
9922 const s32 *thresholds =
9923 nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
9924 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
9925 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
9926
9927 if (len % 4)
9928 return -EINVAL;
9929
9930 return nl80211_set_cqm_rssi(info, thresholds, len / 4,
9931 hysteresis);
9932 }
9933
9934 if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
9935 attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
9936 attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
9937 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
9938 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
9939 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
9940
9941 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
9942 }
9943
9944 return -EINVAL;
9945 }
9946
9947 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
9948 {
9949 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9950 struct net_device *dev = info->user_ptr[1];
9951 struct ocb_setup setup = {};
9952 int err;
9953
9954 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
9955 if (err)
9956 return err;
9957
9958 return cfg80211_join_ocb(rdev, dev, &setup);
9959 }
9960
9961 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
9962 {
9963 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9964 struct net_device *dev = info->user_ptr[1];
9965
9966 return cfg80211_leave_ocb(rdev, dev);
9967 }
9968
9969 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
9970 {
9971 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9972 struct net_device *dev = info->user_ptr[1];
9973 struct mesh_config cfg;
9974 struct mesh_setup setup;
9975 int err;
9976
9977 /* start with default */
9978 memcpy(&cfg, &default_mesh_config, sizeof(cfg));
9979 memcpy(&setup, &default_mesh_setup, sizeof(setup));
9980
9981 if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
9982 /* and parse parameters if given */
9983 err = nl80211_parse_mesh_config(info, &cfg, NULL);
9984 if (err)
9985 return err;
9986 }
9987
9988 if (!info->attrs[NL80211_ATTR_MESH_ID] ||
9989 !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
9990 return -EINVAL;
9991
9992 setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
9993 setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
9994
9995 if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
9996 !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
9997 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
9998 return -EINVAL;
9999
10000 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
10001 setup.beacon_interval =
10002 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
10003
10004 err = cfg80211_validate_beacon_int(rdev,
10005 NL80211_IFTYPE_MESH_POINT,
10006 setup.beacon_interval);
10007 if (err)
10008 return err;
10009 }
10010
10011 if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
10012 setup.dtim_period =
10013 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
10014 if (setup.dtim_period < 1 || setup.dtim_period > 100)
10015 return -EINVAL;
10016 }
10017
10018 if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
10019 /* parse additional setup parameters if given */
10020 err = nl80211_parse_mesh_setup(info, &setup);
10021 if (err)
10022 return err;
10023 }
10024
10025 if (setup.user_mpm)
10026 cfg.auto_open_plinks = false;
10027
10028 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
10029 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
10030 if (err)
10031 return err;
10032 } else {
10033 /* cfg80211_join_mesh() will sort it out */
10034 setup.chandef.chan = NULL;
10035 }
10036
10037 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
10038 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10039 int n_rates =
10040 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10041 struct ieee80211_supported_band *sband;
10042
10043 if (!setup.chandef.chan)
10044 return -EINVAL;
10045
10046 sband = rdev->wiphy.bands[setup.chandef.chan->band];
10047
10048 err = ieee80211_get_ratemask(sband, rates, n_rates,
10049 &setup.basic_rates);
10050 if (err)
10051 return err;
10052 }
10053
10054 if (info->attrs[NL80211_ATTR_TX_RATES]) {
10055 err = nl80211_parse_tx_bitrate_mask(info, &setup.beacon_rate);
10056 if (err)
10057 return err;
10058
10059 if (!setup.chandef.chan)
10060 return -EINVAL;
10061
10062 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
10063 &setup.beacon_rate);
10064 if (err)
10065 return err;
10066 }
10067
10068 setup.userspace_handles_dfs =
10069 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
10070
10071 return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
10072 }
10073
10074 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
10075 {
10076 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10077 struct net_device *dev = info->user_ptr[1];
10078
10079 return cfg80211_leave_mesh(rdev, dev);
10080 }
10081
10082 #ifdef CONFIG_PM
10083 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
10084 struct cfg80211_registered_device *rdev)
10085 {
10086 struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
10087 struct nlattr *nl_pats, *nl_pat;
10088 int i, pat_len;
10089
10090 if (!wowlan->n_patterns)
10091 return 0;
10092
10093 nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
10094 if (!nl_pats)
10095 return -ENOBUFS;
10096
10097 for (i = 0; i < wowlan->n_patterns; i++) {
10098 nl_pat = nla_nest_start(msg, i + 1);
10099 if (!nl_pat)
10100 return -ENOBUFS;
10101 pat_len = wowlan->patterns[i].pattern_len;
10102 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
10103 wowlan->patterns[i].mask) ||
10104 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
10105 wowlan->patterns[i].pattern) ||
10106 nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
10107 wowlan->patterns[i].pkt_offset))
10108 return -ENOBUFS;
10109 nla_nest_end(msg, nl_pat);
10110 }
10111 nla_nest_end(msg, nl_pats);
10112
10113 return 0;
10114 }
10115
10116 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
10117 struct cfg80211_wowlan_tcp *tcp)
10118 {
10119 struct nlattr *nl_tcp;
10120
10121 if (!tcp)
10122 return 0;
10123
10124 nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
10125 if (!nl_tcp)
10126 return -ENOBUFS;
10127
10128 if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
10129 nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
10130 nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
10131 nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
10132 nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
10133 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
10134 tcp->payload_len, tcp->payload) ||
10135 nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
10136 tcp->data_interval) ||
10137 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
10138 tcp->wake_len, tcp->wake_data) ||
10139 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
10140 DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
10141 return -ENOBUFS;
10142
10143 if (tcp->payload_seq.len &&
10144 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
10145 sizeof(tcp->payload_seq), &tcp->payload_seq))
10146 return -ENOBUFS;
10147
10148 if (tcp->payload_tok.len &&
10149 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
10150 sizeof(tcp->payload_tok) + tcp->tokens_size,
10151 &tcp->payload_tok))
10152 return -ENOBUFS;
10153
10154 nla_nest_end(msg, nl_tcp);
10155
10156 return 0;
10157 }
10158
10159 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
10160 struct cfg80211_sched_scan_request *req)
10161 {
10162 struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
10163 int i;
10164
10165 if (!req)
10166 return 0;
10167
10168 nd = nla_nest_start(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
10169 if (!nd)
10170 return -ENOBUFS;
10171
10172 if (req->n_scan_plans == 1 &&
10173 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
10174 req->scan_plans[0].interval * 1000))
10175 return -ENOBUFS;
10176
10177 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
10178 return -ENOBUFS;
10179
10180 if (req->relative_rssi_set) {
10181 struct nl80211_bss_select_rssi_adjust rssi_adjust;
10182
10183 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
10184 req->relative_rssi))
10185 return -ENOBUFS;
10186
10187 rssi_adjust.band = req->rssi_adjust.band;
10188 rssi_adjust.delta = req->rssi_adjust.delta;
10189 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
10190 sizeof(rssi_adjust), &rssi_adjust))
10191 return -ENOBUFS;
10192 }
10193
10194 freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
10195 if (!freqs)
10196 return -ENOBUFS;
10197
10198 for (i = 0; i < req->n_channels; i++) {
10199 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
10200 return -ENOBUFS;
10201 }
10202
10203 nla_nest_end(msg, freqs);
10204
10205 if (req->n_match_sets) {
10206 matches = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
10207 if (!matches)
10208 return -ENOBUFS;
10209
10210 for (i = 0; i < req->n_match_sets; i++) {
10211 match = nla_nest_start(msg, i);
10212 if (!match)
10213 return -ENOBUFS;
10214
10215 if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
10216 req->match_sets[i].ssid.ssid_len,
10217 req->match_sets[i].ssid.ssid))
10218 return -ENOBUFS;
10219 nla_nest_end(msg, match);
10220 }
10221 nla_nest_end(msg, matches);
10222 }
10223
10224 scan_plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
10225 if (!scan_plans)
10226 return -ENOBUFS;
10227
10228 for (i = 0; i < req->n_scan_plans; i++) {
10229 scan_plan = nla_nest_start(msg, i + 1);
10230 if (!scan_plan)
10231 return -ENOBUFS;
10232
10233 if (!scan_plan ||
10234 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
10235 req->scan_plans[i].interval) ||
10236 (req->scan_plans[i].iterations &&
10237 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
10238 req->scan_plans[i].iterations)))
10239 return -ENOBUFS;
10240 nla_nest_end(msg, scan_plan);
10241 }
10242 nla_nest_end(msg, scan_plans);
10243
10244 nla_nest_end(msg, nd);
10245
10246 return 0;
10247 }
10248
10249 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
10250 {
10251 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10252 struct sk_buff *msg;
10253 void *hdr;
10254 u32 size = NLMSG_DEFAULT_SIZE;
10255
10256 if (!rdev->wiphy.wowlan)
10257 return -EOPNOTSUPP;
10258
10259 if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
10260 /* adjust size to have room for all the data */
10261 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
10262 rdev->wiphy.wowlan_config->tcp->payload_len +
10263 rdev->wiphy.wowlan_config->tcp->wake_len +
10264 rdev->wiphy.wowlan_config->tcp->wake_len / 8;
10265 }
10266
10267 msg = nlmsg_new(size, GFP_KERNEL);
10268 if (!msg)
10269 return -ENOMEM;
10270
10271 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10272 NL80211_CMD_GET_WOWLAN);
10273 if (!hdr)
10274 goto nla_put_failure;
10275
10276 if (rdev->wiphy.wowlan_config) {
10277 struct nlattr *nl_wowlan;
10278
10279 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
10280 if (!nl_wowlan)
10281 goto nla_put_failure;
10282
10283 if ((rdev->wiphy.wowlan_config->any &&
10284 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
10285 (rdev->wiphy.wowlan_config->disconnect &&
10286 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
10287 (rdev->wiphy.wowlan_config->magic_pkt &&
10288 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
10289 (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
10290 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
10291 (rdev->wiphy.wowlan_config->eap_identity_req &&
10292 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
10293 (rdev->wiphy.wowlan_config->four_way_handshake &&
10294 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
10295 (rdev->wiphy.wowlan_config->rfkill_release &&
10296 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
10297 goto nla_put_failure;
10298
10299 if (nl80211_send_wowlan_patterns(msg, rdev))
10300 goto nla_put_failure;
10301
10302 if (nl80211_send_wowlan_tcp(msg,
10303 rdev->wiphy.wowlan_config->tcp))
10304 goto nla_put_failure;
10305
10306 if (nl80211_send_wowlan_nd(
10307 msg,
10308 rdev->wiphy.wowlan_config->nd_config))
10309 goto nla_put_failure;
10310
10311 nla_nest_end(msg, nl_wowlan);
10312 }
10313
10314 genlmsg_end(msg, hdr);
10315 return genlmsg_reply(msg, info);
10316
10317 nla_put_failure:
10318 nlmsg_free(msg);
10319 return -ENOBUFS;
10320 }
10321
10322 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
10323 struct nlattr *attr,
10324 struct cfg80211_wowlan *trig)
10325 {
10326 struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
10327 struct cfg80211_wowlan_tcp *cfg;
10328 struct nl80211_wowlan_tcp_data_token *tok = NULL;
10329 struct nl80211_wowlan_tcp_data_seq *seq = NULL;
10330 u32 size;
10331 u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
10332 int err, port;
10333
10334 if (!rdev->wiphy.wowlan->tcp)
10335 return -EINVAL;
10336
10337 err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TCP, attr,
10338 nl80211_wowlan_tcp_policy, NULL);
10339 if (err)
10340 return err;
10341
10342 if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
10343 !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
10344 !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
10345 !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
10346 !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
10347 !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
10348 !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
10349 !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
10350 return -EINVAL;
10351
10352 data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
10353 if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
10354 return -EINVAL;
10355
10356 if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
10357 rdev->wiphy.wowlan->tcp->data_interval_max ||
10358 nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
10359 return -EINVAL;
10360
10361 wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
10362 if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
10363 return -EINVAL;
10364
10365 wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
10366 if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
10367 return -EINVAL;
10368
10369 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
10370 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
10371
10372 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
10373 tokens_size = tokln - sizeof(*tok);
10374
10375 if (!tok->len || tokens_size % tok->len)
10376 return -EINVAL;
10377 if (!rdev->wiphy.wowlan->tcp->tok)
10378 return -EINVAL;
10379 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
10380 return -EINVAL;
10381 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
10382 return -EINVAL;
10383 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
10384 return -EINVAL;
10385 if (tok->offset + tok->len > data_size)
10386 return -EINVAL;
10387 }
10388
10389 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
10390 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
10391 if (!rdev->wiphy.wowlan->tcp->seq)
10392 return -EINVAL;
10393 if (seq->len == 0 || seq->len > 4)
10394 return -EINVAL;
10395 if (seq->len + seq->offset > data_size)
10396 return -EINVAL;
10397 }
10398
10399 size = sizeof(*cfg);
10400 size += data_size;
10401 size += wake_size + wake_mask_size;
10402 size += tokens_size;
10403
10404 cfg = kzalloc(size, GFP_KERNEL);
10405 if (!cfg)
10406 return -ENOMEM;
10407 cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
10408 cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
10409 memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
10410 ETH_ALEN);
10411 if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
10412 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
10413 else
10414 port = 0;
10415 #ifdef CONFIG_INET
10416 /* allocate a socket and port for it and use it */
10417 err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
10418 IPPROTO_TCP, &cfg->sock, 1);
10419 if (err) {
10420 kfree(cfg);
10421 return err;
10422 }
10423 if (inet_csk_get_port(cfg->sock->sk, port)) {
10424 sock_release(cfg->sock);
10425 kfree(cfg);
10426 return -EADDRINUSE;
10427 }
10428 cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
10429 #else
10430 if (!port) {
10431 kfree(cfg);
10432 return -EINVAL;
10433 }
10434 cfg->src_port = port;
10435 #endif
10436
10437 cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
10438 cfg->payload_len = data_size;
10439 cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
10440 memcpy((void *)cfg->payload,
10441 nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
10442 data_size);
10443 if (seq)
10444 cfg->payload_seq = *seq;
10445 cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
10446 cfg->wake_len = wake_size;
10447 cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
10448 memcpy((void *)cfg->wake_data,
10449 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
10450 wake_size);
10451 cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
10452 data_size + wake_size;
10453 memcpy((void *)cfg->wake_mask,
10454 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
10455 wake_mask_size);
10456 if (tok) {
10457 cfg->tokens_size = tokens_size;
10458 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
10459 }
10460
10461 trig->tcp = cfg;
10462
10463 return 0;
10464 }
10465
10466 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
10467 const struct wiphy_wowlan_support *wowlan,
10468 struct nlattr *attr,
10469 struct cfg80211_wowlan *trig)
10470 {
10471 struct nlattr **tb;
10472 int err;
10473
10474 tb = kzalloc(NUM_NL80211_ATTR * sizeof(*tb), GFP_KERNEL);
10475 if (!tb)
10476 return -ENOMEM;
10477
10478 if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
10479 err = -EOPNOTSUPP;
10480 goto out;
10481 }
10482
10483 err = nla_parse_nested(tb, NL80211_ATTR_MAX, attr, nl80211_policy,
10484 NULL);
10485 if (err)
10486 goto out;
10487
10488 trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
10489 wowlan->max_nd_match_sets);
10490 err = PTR_ERR_OR_ZERO(trig->nd_config);
10491 if (err)
10492 trig->nd_config = NULL;
10493
10494 out:
10495 kfree(tb);
10496 return err;
10497 }
10498
10499 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
10500 {
10501 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10502 struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
10503 struct cfg80211_wowlan new_triggers = {};
10504 struct cfg80211_wowlan *ntrig;
10505 const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
10506 int err, i;
10507 bool prev_enabled = rdev->wiphy.wowlan_config;
10508 bool regular = false;
10509
10510 if (!wowlan)
10511 return -EOPNOTSUPP;
10512
10513 if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
10514 cfg80211_rdev_free_wowlan(rdev);
10515 rdev->wiphy.wowlan_config = NULL;
10516 goto set_wakeup;
10517 }
10518
10519 err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TRIG,
10520 info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
10521 nl80211_wowlan_policy, info->extack);
10522 if (err)
10523 return err;
10524
10525 if (tb[NL80211_WOWLAN_TRIG_ANY]) {
10526 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
10527 return -EINVAL;
10528 new_triggers.any = true;
10529 }
10530
10531 if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
10532 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
10533 return -EINVAL;
10534 new_triggers.disconnect = true;
10535 regular = true;
10536 }
10537
10538 if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
10539 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
10540 return -EINVAL;
10541 new_triggers.magic_pkt = true;
10542 regular = true;
10543 }
10544
10545 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
10546 return -EINVAL;
10547
10548 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
10549 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
10550 return -EINVAL;
10551 new_triggers.gtk_rekey_failure = true;
10552 regular = true;
10553 }
10554
10555 if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
10556 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
10557 return -EINVAL;
10558 new_triggers.eap_identity_req = true;
10559 regular = true;
10560 }
10561
10562 if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
10563 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
10564 return -EINVAL;
10565 new_triggers.four_way_handshake = true;
10566 regular = true;
10567 }
10568
10569 if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
10570 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
10571 return -EINVAL;
10572 new_triggers.rfkill_release = true;
10573 regular = true;
10574 }
10575
10576 if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
10577 struct nlattr *pat;
10578 int n_patterns = 0;
10579 int rem, pat_len, mask_len, pkt_offset;
10580 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
10581
10582 regular = true;
10583
10584 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
10585 rem)
10586 n_patterns++;
10587 if (n_patterns > wowlan->n_patterns)
10588 return -EINVAL;
10589
10590 new_triggers.patterns = kcalloc(n_patterns,
10591 sizeof(new_triggers.patterns[0]),
10592 GFP_KERNEL);
10593 if (!new_triggers.patterns)
10594 return -ENOMEM;
10595
10596 new_triggers.n_patterns = n_patterns;
10597 i = 0;
10598
10599 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
10600 rem) {
10601 u8 *mask_pat;
10602
10603 nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
10604 nl80211_packet_pattern_policy,
10605 info->extack);
10606 err = -EINVAL;
10607 if (!pat_tb[NL80211_PKTPAT_MASK] ||
10608 !pat_tb[NL80211_PKTPAT_PATTERN])
10609 goto error;
10610 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
10611 mask_len = DIV_ROUND_UP(pat_len, 8);
10612 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
10613 goto error;
10614 if (pat_len > wowlan->pattern_max_len ||
10615 pat_len < wowlan->pattern_min_len)
10616 goto error;
10617
10618 if (!pat_tb[NL80211_PKTPAT_OFFSET])
10619 pkt_offset = 0;
10620 else
10621 pkt_offset = nla_get_u32(
10622 pat_tb[NL80211_PKTPAT_OFFSET]);
10623 if (pkt_offset > wowlan->max_pkt_offset)
10624 goto error;
10625 new_triggers.patterns[i].pkt_offset = pkt_offset;
10626
10627 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
10628 if (!mask_pat) {
10629 err = -ENOMEM;
10630 goto error;
10631 }
10632 new_triggers.patterns[i].mask = mask_pat;
10633 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
10634 mask_len);
10635 mask_pat += mask_len;
10636 new_triggers.patterns[i].pattern = mask_pat;
10637 new_triggers.patterns[i].pattern_len = pat_len;
10638 memcpy(mask_pat,
10639 nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
10640 pat_len);
10641 i++;
10642 }
10643 }
10644
10645 if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
10646 regular = true;
10647 err = nl80211_parse_wowlan_tcp(
10648 rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
10649 &new_triggers);
10650 if (err)
10651 goto error;
10652 }
10653
10654 if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
10655 regular = true;
10656 err = nl80211_parse_wowlan_nd(
10657 rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
10658 &new_triggers);
10659 if (err)
10660 goto error;
10661 }
10662
10663 /* The 'any' trigger means the device continues operating more or less
10664 * as in its normal operation mode and wakes up the host on most of the
10665 * normal interrupts (like packet RX, ...)
10666 * It therefore makes little sense to combine with the more constrained
10667 * wakeup trigger modes.
10668 */
10669 if (new_triggers.any && regular) {
10670 err = -EINVAL;
10671 goto error;
10672 }
10673
10674 ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
10675 if (!ntrig) {
10676 err = -ENOMEM;
10677 goto error;
10678 }
10679 cfg80211_rdev_free_wowlan(rdev);
10680 rdev->wiphy.wowlan_config = ntrig;
10681
10682 set_wakeup:
10683 if (rdev->ops->set_wakeup &&
10684 prev_enabled != !!rdev->wiphy.wowlan_config)
10685 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
10686
10687 return 0;
10688 error:
10689 for (i = 0; i < new_triggers.n_patterns; i++)
10690 kfree(new_triggers.patterns[i].mask);
10691 kfree(new_triggers.patterns);
10692 if (new_triggers.tcp && new_triggers.tcp->sock)
10693 sock_release(new_triggers.tcp->sock);
10694 kfree(new_triggers.tcp);
10695 kfree(new_triggers.nd_config);
10696 return err;
10697 }
10698 #endif
10699
10700 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
10701 struct cfg80211_registered_device *rdev)
10702 {
10703 struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
10704 int i, j, pat_len;
10705 struct cfg80211_coalesce_rules *rule;
10706
10707 if (!rdev->coalesce->n_rules)
10708 return 0;
10709
10710 nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
10711 if (!nl_rules)
10712 return -ENOBUFS;
10713
10714 for (i = 0; i < rdev->coalesce->n_rules; i++) {
10715 nl_rule = nla_nest_start(msg, i + 1);
10716 if (!nl_rule)
10717 return -ENOBUFS;
10718
10719 rule = &rdev->coalesce->rules[i];
10720 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
10721 rule->delay))
10722 return -ENOBUFS;
10723
10724 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
10725 rule->condition))
10726 return -ENOBUFS;
10727
10728 nl_pats = nla_nest_start(msg,
10729 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
10730 if (!nl_pats)
10731 return -ENOBUFS;
10732
10733 for (j = 0; j < rule->n_patterns; j++) {
10734 nl_pat = nla_nest_start(msg, j + 1);
10735 if (!nl_pat)
10736 return -ENOBUFS;
10737 pat_len = rule->patterns[j].pattern_len;
10738 if (nla_put(msg, NL80211_PKTPAT_MASK,
10739 DIV_ROUND_UP(pat_len, 8),
10740 rule->patterns[j].mask) ||
10741 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
10742 rule->patterns[j].pattern) ||
10743 nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
10744 rule->patterns[j].pkt_offset))
10745 return -ENOBUFS;
10746 nla_nest_end(msg, nl_pat);
10747 }
10748 nla_nest_end(msg, nl_pats);
10749 nla_nest_end(msg, nl_rule);
10750 }
10751 nla_nest_end(msg, nl_rules);
10752
10753 return 0;
10754 }
10755
10756 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
10757 {
10758 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10759 struct sk_buff *msg;
10760 void *hdr;
10761
10762 if (!rdev->wiphy.coalesce)
10763 return -EOPNOTSUPP;
10764
10765 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10766 if (!msg)
10767 return -ENOMEM;
10768
10769 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10770 NL80211_CMD_GET_COALESCE);
10771 if (!hdr)
10772 goto nla_put_failure;
10773
10774 if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
10775 goto nla_put_failure;
10776
10777 genlmsg_end(msg, hdr);
10778 return genlmsg_reply(msg, info);
10779
10780 nla_put_failure:
10781 nlmsg_free(msg);
10782 return -ENOBUFS;
10783 }
10784
10785 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
10786 {
10787 struct cfg80211_coalesce *coalesce = rdev->coalesce;
10788 int i, j;
10789 struct cfg80211_coalesce_rules *rule;
10790
10791 if (!coalesce)
10792 return;
10793
10794 for (i = 0; i < coalesce->n_rules; i++) {
10795 rule = &coalesce->rules[i];
10796 for (j = 0; j < rule->n_patterns; j++)
10797 kfree(rule->patterns[j].mask);
10798 kfree(rule->patterns);
10799 }
10800 kfree(coalesce->rules);
10801 kfree(coalesce);
10802 rdev->coalesce = NULL;
10803 }
10804
10805 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
10806 struct nlattr *rule,
10807 struct cfg80211_coalesce_rules *new_rule)
10808 {
10809 int err, i;
10810 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
10811 struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
10812 int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
10813 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
10814
10815 err = nla_parse_nested(tb, NL80211_ATTR_COALESCE_RULE_MAX, rule,
10816 nl80211_coalesce_policy, NULL);
10817 if (err)
10818 return err;
10819
10820 if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
10821 new_rule->delay =
10822 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
10823 if (new_rule->delay > coalesce->max_delay)
10824 return -EINVAL;
10825
10826 if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
10827 new_rule->condition =
10828 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
10829 if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
10830 new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
10831 return -EINVAL;
10832
10833 if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
10834 return -EINVAL;
10835
10836 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
10837 rem)
10838 n_patterns++;
10839 if (n_patterns > coalesce->n_patterns)
10840 return -EINVAL;
10841
10842 new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
10843 GFP_KERNEL);
10844 if (!new_rule->patterns)
10845 return -ENOMEM;
10846
10847 new_rule->n_patterns = n_patterns;
10848 i = 0;
10849
10850 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
10851 rem) {
10852 u8 *mask_pat;
10853
10854 nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
10855 nl80211_packet_pattern_policy, NULL);
10856 if (!pat_tb[NL80211_PKTPAT_MASK] ||
10857 !pat_tb[NL80211_PKTPAT_PATTERN])
10858 return -EINVAL;
10859 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
10860 mask_len = DIV_ROUND_UP(pat_len, 8);
10861 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
10862 return -EINVAL;
10863 if (pat_len > coalesce->pattern_max_len ||
10864 pat_len < coalesce->pattern_min_len)
10865 return -EINVAL;
10866
10867 if (!pat_tb[NL80211_PKTPAT_OFFSET])
10868 pkt_offset = 0;
10869 else
10870 pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
10871 if (pkt_offset > coalesce->max_pkt_offset)
10872 return -EINVAL;
10873 new_rule->patterns[i].pkt_offset = pkt_offset;
10874
10875 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
10876 if (!mask_pat)
10877 return -ENOMEM;
10878
10879 new_rule->patterns[i].mask = mask_pat;
10880 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
10881 mask_len);
10882
10883 mask_pat += mask_len;
10884 new_rule->patterns[i].pattern = mask_pat;
10885 new_rule->patterns[i].pattern_len = pat_len;
10886 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
10887 pat_len);
10888 i++;
10889 }
10890
10891 return 0;
10892 }
10893
10894 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
10895 {
10896 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10897 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
10898 struct cfg80211_coalesce new_coalesce = {};
10899 struct cfg80211_coalesce *n_coalesce;
10900 int err, rem_rule, n_rules = 0, i, j;
10901 struct nlattr *rule;
10902 struct cfg80211_coalesce_rules *tmp_rule;
10903
10904 if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
10905 return -EOPNOTSUPP;
10906
10907 if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
10908 cfg80211_rdev_free_coalesce(rdev);
10909 rdev_set_coalesce(rdev, NULL);
10910 return 0;
10911 }
10912
10913 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
10914 rem_rule)
10915 n_rules++;
10916 if (n_rules > coalesce->n_rules)
10917 return -EINVAL;
10918
10919 new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
10920 GFP_KERNEL);
10921 if (!new_coalesce.rules)
10922 return -ENOMEM;
10923
10924 new_coalesce.n_rules = n_rules;
10925 i = 0;
10926
10927 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
10928 rem_rule) {
10929 err = nl80211_parse_coalesce_rule(rdev, rule,
10930 &new_coalesce.rules[i]);
10931 if (err)
10932 goto error;
10933
10934 i++;
10935 }
10936
10937 err = rdev_set_coalesce(rdev, &new_coalesce);
10938 if (err)
10939 goto error;
10940
10941 n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
10942 if (!n_coalesce) {
10943 err = -ENOMEM;
10944 goto error;
10945 }
10946 cfg80211_rdev_free_coalesce(rdev);
10947 rdev->coalesce = n_coalesce;
10948
10949 return 0;
10950 error:
10951 for (i = 0; i < new_coalesce.n_rules; i++) {
10952 tmp_rule = &new_coalesce.rules[i];
10953 for (j = 0; j < tmp_rule->n_patterns; j++)
10954 kfree(tmp_rule->patterns[j].mask);
10955 kfree(tmp_rule->patterns);
10956 }
10957 kfree(new_coalesce.rules);
10958
10959 return err;
10960 }
10961
10962 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
10963 {
10964 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10965 struct net_device *dev = info->user_ptr[1];
10966 struct wireless_dev *wdev = dev->ieee80211_ptr;
10967 struct nlattr *tb[NUM_NL80211_REKEY_DATA];
10968 struct cfg80211_gtk_rekey_data rekey_data;
10969 int err;
10970
10971 if (!info->attrs[NL80211_ATTR_REKEY_DATA])
10972 return -EINVAL;
10973
10974 err = nla_parse_nested(tb, MAX_NL80211_REKEY_DATA,
10975 info->attrs[NL80211_ATTR_REKEY_DATA],
10976 nl80211_rekey_policy, info->extack);
10977 if (err)
10978 return err;
10979
10980 if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
10981 !tb[NL80211_REKEY_DATA_KCK])
10982 return -EINVAL;
10983 if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
10984 return -ERANGE;
10985 if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
10986 return -ERANGE;
10987 if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
10988 return -ERANGE;
10989
10990 rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
10991 rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
10992 rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
10993
10994 wdev_lock(wdev);
10995 if (!wdev->current_bss) {
10996 err = -ENOTCONN;
10997 goto out;
10998 }
10999
11000 if (!rdev->ops->set_rekey_data) {
11001 err = -EOPNOTSUPP;
11002 goto out;
11003 }
11004
11005 err = rdev_set_rekey_data(rdev, dev, &rekey_data);
11006 out:
11007 wdev_unlock(wdev);
11008 return err;
11009 }
11010
11011 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
11012 struct genl_info *info)
11013 {
11014 struct net_device *dev = info->user_ptr[1];
11015 struct wireless_dev *wdev = dev->ieee80211_ptr;
11016
11017 if (wdev->iftype != NL80211_IFTYPE_AP &&
11018 wdev->iftype != NL80211_IFTYPE_P2P_GO)
11019 return -EINVAL;
11020
11021 if (wdev->ap_unexpected_nlportid)
11022 return -EBUSY;
11023
11024 wdev->ap_unexpected_nlportid = info->snd_portid;
11025 return 0;
11026 }
11027
11028 static int nl80211_probe_client(struct sk_buff *skb,
11029 struct genl_info *info)
11030 {
11031 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11032 struct net_device *dev = info->user_ptr[1];
11033 struct wireless_dev *wdev = dev->ieee80211_ptr;
11034 struct sk_buff *msg;
11035 void *hdr;
11036 const u8 *addr;
11037 u64 cookie;
11038 int err;
11039
11040 if (wdev->iftype != NL80211_IFTYPE_AP &&
11041 wdev->iftype != NL80211_IFTYPE_P2P_GO)
11042 return -EOPNOTSUPP;
11043
11044 if (!info->attrs[NL80211_ATTR_MAC])
11045 return -EINVAL;
11046
11047 if (!rdev->ops->probe_client)
11048 return -EOPNOTSUPP;
11049
11050 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11051 if (!msg)
11052 return -ENOMEM;
11053
11054 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11055 NL80211_CMD_PROBE_CLIENT);
11056 if (!hdr) {
11057 err = -ENOBUFS;
11058 goto free_msg;
11059 }
11060
11061 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
11062
11063 err = rdev_probe_client(rdev, dev, addr, &cookie);
11064 if (err)
11065 goto free_msg;
11066
11067 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11068 NL80211_ATTR_PAD))
11069 goto nla_put_failure;
11070
11071 genlmsg_end(msg, hdr);
11072
11073 return genlmsg_reply(msg, info);
11074
11075 nla_put_failure:
11076 err = -ENOBUFS;
11077 free_msg:
11078 nlmsg_free(msg);
11079 return err;
11080 }
11081
11082 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
11083 {
11084 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11085 struct cfg80211_beacon_registration *reg, *nreg;
11086 int rv;
11087
11088 if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
11089 return -EOPNOTSUPP;
11090
11091 nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
11092 if (!nreg)
11093 return -ENOMEM;
11094
11095 /* First, check if already registered. */
11096 spin_lock_bh(&rdev->beacon_registrations_lock);
11097 list_for_each_entry(reg, &rdev->beacon_registrations, list) {
11098 if (reg->nlportid == info->snd_portid) {
11099 rv = -EALREADY;
11100 goto out_err;
11101 }
11102 }
11103 /* Add it to the list */
11104 nreg->nlportid = info->snd_portid;
11105 list_add(&nreg->list, &rdev->beacon_registrations);
11106
11107 spin_unlock_bh(&rdev->beacon_registrations_lock);
11108
11109 return 0;
11110 out_err:
11111 spin_unlock_bh(&rdev->beacon_registrations_lock);
11112 kfree(nreg);
11113 return rv;
11114 }
11115
11116 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
11117 {
11118 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11119 struct wireless_dev *wdev = info->user_ptr[1];
11120 int err;
11121
11122 if (!rdev->ops->start_p2p_device)
11123 return -EOPNOTSUPP;
11124
11125 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
11126 return -EOPNOTSUPP;
11127
11128 if (wdev_running(wdev))
11129 return 0;
11130
11131 if (rfkill_blocked(rdev->rfkill))
11132 return -ERFKILL;
11133
11134 err = rdev_start_p2p_device(rdev, wdev);
11135 if (err)
11136 return err;
11137
11138 wdev->is_running = true;
11139 rdev->opencount++;
11140
11141 return 0;
11142 }
11143
11144 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
11145 {
11146 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11147 struct wireless_dev *wdev = info->user_ptr[1];
11148
11149 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
11150 return -EOPNOTSUPP;
11151
11152 if (!rdev->ops->stop_p2p_device)
11153 return -EOPNOTSUPP;
11154
11155 cfg80211_stop_p2p_device(rdev, wdev);
11156
11157 return 0;
11158 }
11159
11160 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
11161 {
11162 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11163 struct wireless_dev *wdev = info->user_ptr[1];
11164 struct cfg80211_nan_conf conf = {};
11165 int err;
11166
11167 if (wdev->iftype != NL80211_IFTYPE_NAN)
11168 return -EOPNOTSUPP;
11169
11170 if (wdev_running(wdev))
11171 return -EEXIST;
11172
11173 if (rfkill_blocked(rdev->rfkill))
11174 return -ERFKILL;
11175
11176 if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
11177 return -EINVAL;
11178
11179 conf.master_pref =
11180 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
11181 if (!conf.master_pref)
11182 return -EINVAL;
11183
11184 if (info->attrs[NL80211_ATTR_BANDS]) {
11185 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
11186
11187 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
11188 return -EOPNOTSUPP;
11189
11190 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
11191 return -EINVAL;
11192
11193 conf.bands = bands;
11194 }
11195
11196 err = rdev_start_nan(rdev, wdev, &conf);
11197 if (err)
11198 return err;
11199
11200 wdev->is_running = true;
11201 rdev->opencount++;
11202
11203 return 0;
11204 }
11205
11206 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
11207 {
11208 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11209 struct wireless_dev *wdev = info->user_ptr[1];
11210
11211 if (wdev->iftype != NL80211_IFTYPE_NAN)
11212 return -EOPNOTSUPP;
11213
11214 cfg80211_stop_nan(rdev, wdev);
11215
11216 return 0;
11217 }
11218
11219 static int validate_nan_filter(struct nlattr *filter_attr)
11220 {
11221 struct nlattr *attr;
11222 int len = 0, n_entries = 0, rem;
11223
11224 nla_for_each_nested(attr, filter_attr, rem) {
11225 len += nla_len(attr);
11226 n_entries++;
11227 }
11228
11229 if (len >= U8_MAX)
11230 return -EINVAL;
11231
11232 return n_entries;
11233 }
11234
11235 static int handle_nan_filter(struct nlattr *attr_filter,
11236 struct cfg80211_nan_func *func,
11237 bool tx)
11238 {
11239 struct nlattr *attr;
11240 int n_entries, rem, i;
11241 struct cfg80211_nan_func_filter *filter;
11242
11243 n_entries = validate_nan_filter(attr_filter);
11244 if (n_entries < 0)
11245 return n_entries;
11246
11247 BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
11248
11249 filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
11250 if (!filter)
11251 return -ENOMEM;
11252
11253 i = 0;
11254 nla_for_each_nested(attr, attr_filter, rem) {
11255 filter[i].filter = nla_memdup(attr, GFP_KERNEL);
11256 filter[i].len = nla_len(attr);
11257 i++;
11258 }
11259 if (tx) {
11260 func->num_tx_filters = n_entries;
11261 func->tx_filters = filter;
11262 } else {
11263 func->num_rx_filters = n_entries;
11264 func->rx_filters = filter;
11265 }
11266
11267 return 0;
11268 }
11269
11270 static int nl80211_nan_add_func(struct sk_buff *skb,
11271 struct genl_info *info)
11272 {
11273 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11274 struct wireless_dev *wdev = info->user_ptr[1];
11275 struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
11276 struct cfg80211_nan_func *func;
11277 struct sk_buff *msg = NULL;
11278 void *hdr = NULL;
11279 int err = 0;
11280
11281 if (wdev->iftype != NL80211_IFTYPE_NAN)
11282 return -EOPNOTSUPP;
11283
11284 if (!wdev_running(wdev))
11285 return -ENOTCONN;
11286
11287 if (!info->attrs[NL80211_ATTR_NAN_FUNC])
11288 return -EINVAL;
11289
11290 err = nla_parse_nested(tb, NL80211_NAN_FUNC_ATTR_MAX,
11291 info->attrs[NL80211_ATTR_NAN_FUNC],
11292 nl80211_nan_func_policy, info->extack);
11293 if (err)
11294 return err;
11295
11296 func = kzalloc(sizeof(*func), GFP_KERNEL);
11297 if (!func)
11298 return -ENOMEM;
11299
11300 func->cookie = wdev->wiphy->cookie_counter++;
11301
11302 if (!tb[NL80211_NAN_FUNC_TYPE] ||
11303 nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]) > NL80211_NAN_FUNC_MAX_TYPE) {
11304 err = -EINVAL;
11305 goto out;
11306 }
11307
11308
11309 func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
11310
11311 if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
11312 err = -EINVAL;
11313 goto out;
11314 }
11315
11316 memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
11317 sizeof(func->service_id));
11318
11319 func->close_range =
11320 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
11321
11322 if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
11323 func->serv_spec_info_len =
11324 nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
11325 func->serv_spec_info =
11326 kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
11327 func->serv_spec_info_len,
11328 GFP_KERNEL);
11329 if (!func->serv_spec_info) {
11330 err = -ENOMEM;
11331 goto out;
11332 }
11333 }
11334
11335 if (tb[NL80211_NAN_FUNC_TTL])
11336 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
11337
11338 switch (func->type) {
11339 case NL80211_NAN_FUNC_PUBLISH:
11340 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
11341 err = -EINVAL;
11342 goto out;
11343 }
11344
11345 func->publish_type =
11346 nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
11347 func->publish_bcast =
11348 nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
11349
11350 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
11351 func->publish_bcast) {
11352 err = -EINVAL;
11353 goto out;
11354 }
11355 break;
11356 case NL80211_NAN_FUNC_SUBSCRIBE:
11357 func->subscribe_active =
11358 nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
11359 break;
11360 case NL80211_NAN_FUNC_FOLLOW_UP:
11361 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
11362 !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]) {
11363 err = -EINVAL;
11364 goto out;
11365 }
11366
11367 func->followup_id =
11368 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
11369 func->followup_reqid =
11370 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
11371 memcpy(func->followup_dest.addr,
11372 nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
11373 sizeof(func->followup_dest.addr));
11374 if (func->ttl) {
11375 err = -EINVAL;
11376 goto out;
11377 }
11378 break;
11379 default:
11380 err = -EINVAL;
11381 goto out;
11382 }
11383
11384 if (tb[NL80211_NAN_FUNC_SRF]) {
11385 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
11386
11387 err = nla_parse_nested(srf_tb, NL80211_NAN_SRF_ATTR_MAX,
11388 tb[NL80211_NAN_FUNC_SRF],
11389 nl80211_nan_srf_policy, info->extack);
11390 if (err)
11391 goto out;
11392
11393 func->srf_include =
11394 nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
11395
11396 if (srf_tb[NL80211_NAN_SRF_BF]) {
11397 if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
11398 !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
11399 err = -EINVAL;
11400 goto out;
11401 }
11402
11403 func->srf_bf_len =
11404 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
11405 func->srf_bf =
11406 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
11407 func->srf_bf_len, GFP_KERNEL);
11408 if (!func->srf_bf) {
11409 err = -ENOMEM;
11410 goto out;
11411 }
11412
11413 func->srf_bf_idx =
11414 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
11415 } else {
11416 struct nlattr *attr, *mac_attr =
11417 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
11418 int n_entries, rem, i = 0;
11419
11420 if (!mac_attr) {
11421 err = -EINVAL;
11422 goto out;
11423 }
11424
11425 n_entries = validate_acl_mac_addrs(mac_attr);
11426 if (n_entries <= 0) {
11427 err = -EINVAL;
11428 goto out;
11429 }
11430
11431 func->srf_num_macs = n_entries;
11432 func->srf_macs =
11433 kzalloc(sizeof(*func->srf_macs) * n_entries,
11434 GFP_KERNEL);
11435 if (!func->srf_macs) {
11436 err = -ENOMEM;
11437 goto out;
11438 }
11439
11440 nla_for_each_nested(attr, mac_attr, rem)
11441 memcpy(func->srf_macs[i++].addr, nla_data(attr),
11442 sizeof(*func->srf_macs));
11443 }
11444 }
11445
11446 if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
11447 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
11448 func, true);
11449 if (err)
11450 goto out;
11451 }
11452
11453 if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
11454 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
11455 func, false);
11456 if (err)
11457 goto out;
11458 }
11459
11460 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11461 if (!msg) {
11462 err = -ENOMEM;
11463 goto out;
11464 }
11465
11466 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11467 NL80211_CMD_ADD_NAN_FUNCTION);
11468 /* This can't really happen - we just allocated 4KB */
11469 if (WARN_ON(!hdr)) {
11470 err = -ENOMEM;
11471 goto out;
11472 }
11473
11474 err = rdev_add_nan_func(rdev, wdev, func);
11475 out:
11476 if (err < 0) {
11477 cfg80211_free_nan_func(func);
11478 nlmsg_free(msg);
11479 return err;
11480 }
11481
11482 /* propagate the instance id and cookie to userspace */
11483 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
11484 NL80211_ATTR_PAD))
11485 goto nla_put_failure;
11486
11487 func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC);
11488 if (!func_attr)
11489 goto nla_put_failure;
11490
11491 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
11492 func->instance_id))
11493 goto nla_put_failure;
11494
11495 nla_nest_end(msg, func_attr);
11496
11497 genlmsg_end(msg, hdr);
11498 return genlmsg_reply(msg, info);
11499
11500 nla_put_failure:
11501 nlmsg_free(msg);
11502 return -ENOBUFS;
11503 }
11504
11505 static int nl80211_nan_del_func(struct sk_buff *skb,
11506 struct genl_info *info)
11507 {
11508 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11509 struct wireless_dev *wdev = info->user_ptr[1];
11510 u64 cookie;
11511
11512 if (wdev->iftype != NL80211_IFTYPE_NAN)
11513 return -EOPNOTSUPP;
11514
11515 if (!wdev_running(wdev))
11516 return -ENOTCONN;
11517
11518 if (!info->attrs[NL80211_ATTR_COOKIE])
11519 return -EINVAL;
11520
11521 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
11522
11523 rdev_del_nan_func(rdev, wdev, cookie);
11524
11525 return 0;
11526 }
11527
11528 static int nl80211_nan_change_config(struct sk_buff *skb,
11529 struct genl_info *info)
11530 {
11531 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11532 struct wireless_dev *wdev = info->user_ptr[1];
11533 struct cfg80211_nan_conf conf = {};
11534 u32 changed = 0;
11535
11536 if (wdev->iftype != NL80211_IFTYPE_NAN)
11537 return -EOPNOTSUPP;
11538
11539 if (!wdev_running(wdev))
11540 return -ENOTCONN;
11541
11542 if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
11543 conf.master_pref =
11544 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
11545 if (conf.master_pref <= 1 || conf.master_pref == 255)
11546 return -EINVAL;
11547
11548 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
11549 }
11550
11551 if (info->attrs[NL80211_ATTR_BANDS]) {
11552 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
11553
11554 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
11555 return -EOPNOTSUPP;
11556
11557 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
11558 return -EINVAL;
11559
11560 conf.bands = bands;
11561 changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
11562 }
11563
11564 if (!changed)
11565 return -EINVAL;
11566
11567 return rdev_nan_change_conf(rdev, wdev, &conf, changed);
11568 }
11569
11570 void cfg80211_nan_match(struct wireless_dev *wdev,
11571 struct cfg80211_nan_match_params *match, gfp_t gfp)
11572 {
11573 struct wiphy *wiphy = wdev->wiphy;
11574 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11575 struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
11576 struct sk_buff *msg;
11577 void *hdr;
11578
11579 if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
11580 return;
11581
11582 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11583 if (!msg)
11584 return;
11585
11586 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
11587 if (!hdr) {
11588 nlmsg_free(msg);
11589 return;
11590 }
11591
11592 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11593 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11594 wdev->netdev->ifindex)) ||
11595 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
11596 NL80211_ATTR_PAD))
11597 goto nla_put_failure;
11598
11599 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
11600 NL80211_ATTR_PAD) ||
11601 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
11602 goto nla_put_failure;
11603
11604 match_attr = nla_nest_start(msg, NL80211_ATTR_NAN_MATCH);
11605 if (!match_attr)
11606 goto nla_put_failure;
11607
11608 local_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_LOCAL);
11609 if (!local_func_attr)
11610 goto nla_put_failure;
11611
11612 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
11613 goto nla_put_failure;
11614
11615 nla_nest_end(msg, local_func_attr);
11616
11617 peer_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_PEER);
11618 if (!peer_func_attr)
11619 goto nla_put_failure;
11620
11621 if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
11622 nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
11623 goto nla_put_failure;
11624
11625 if (match->info && match->info_len &&
11626 nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
11627 match->info))
11628 goto nla_put_failure;
11629
11630 nla_nest_end(msg, peer_func_attr);
11631 nla_nest_end(msg, match_attr);
11632 genlmsg_end(msg, hdr);
11633
11634 if (!wdev->owner_nlportid)
11635 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
11636 msg, 0, NL80211_MCGRP_NAN, gfp);
11637 else
11638 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
11639 wdev->owner_nlportid);
11640
11641 return;
11642
11643 nla_put_failure:
11644 nlmsg_free(msg);
11645 }
11646 EXPORT_SYMBOL(cfg80211_nan_match);
11647
11648 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
11649 u8 inst_id,
11650 enum nl80211_nan_func_term_reason reason,
11651 u64 cookie, gfp_t gfp)
11652 {
11653 struct wiphy *wiphy = wdev->wiphy;
11654 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11655 struct sk_buff *msg;
11656 struct nlattr *func_attr;
11657 void *hdr;
11658
11659 if (WARN_ON(!inst_id))
11660 return;
11661
11662 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11663 if (!msg)
11664 return;
11665
11666 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
11667 if (!hdr) {
11668 nlmsg_free(msg);
11669 return;
11670 }
11671
11672 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11673 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11674 wdev->netdev->ifindex)) ||
11675 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
11676 NL80211_ATTR_PAD))
11677 goto nla_put_failure;
11678
11679 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11680 NL80211_ATTR_PAD))
11681 goto nla_put_failure;
11682
11683 func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC);
11684 if (!func_attr)
11685 goto nla_put_failure;
11686
11687 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
11688 nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
11689 goto nla_put_failure;
11690
11691 nla_nest_end(msg, func_attr);
11692 genlmsg_end(msg, hdr);
11693
11694 if (!wdev->owner_nlportid)
11695 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
11696 msg, 0, NL80211_MCGRP_NAN, gfp);
11697 else
11698 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
11699 wdev->owner_nlportid);
11700
11701 return;
11702
11703 nla_put_failure:
11704 nlmsg_free(msg);
11705 }
11706 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
11707
11708 static int nl80211_get_protocol_features(struct sk_buff *skb,
11709 struct genl_info *info)
11710 {
11711 void *hdr;
11712 struct sk_buff *msg;
11713
11714 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11715 if (!msg)
11716 return -ENOMEM;
11717
11718 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11719 NL80211_CMD_GET_PROTOCOL_FEATURES);
11720 if (!hdr)
11721 goto nla_put_failure;
11722
11723 if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
11724 NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
11725 goto nla_put_failure;
11726
11727 genlmsg_end(msg, hdr);
11728 return genlmsg_reply(msg, info);
11729
11730 nla_put_failure:
11731 kfree_skb(msg);
11732 return -ENOBUFS;
11733 }
11734
11735 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
11736 {
11737 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11738 struct cfg80211_update_ft_ies_params ft_params;
11739 struct net_device *dev = info->user_ptr[1];
11740
11741 if (!rdev->ops->update_ft_ies)
11742 return -EOPNOTSUPP;
11743
11744 if (!info->attrs[NL80211_ATTR_MDID] ||
11745 !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
11746 return -EINVAL;
11747
11748 memset(&ft_params, 0, sizeof(ft_params));
11749 ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
11750 ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11751 ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11752
11753 return rdev_update_ft_ies(rdev, dev, &ft_params);
11754 }
11755
11756 static int nl80211_crit_protocol_start(struct sk_buff *skb,
11757 struct genl_info *info)
11758 {
11759 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11760 struct wireless_dev *wdev = info->user_ptr[1];
11761 enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
11762 u16 duration;
11763 int ret;
11764
11765 if (!rdev->ops->crit_proto_start)
11766 return -EOPNOTSUPP;
11767
11768 if (WARN_ON(!rdev->ops->crit_proto_stop))
11769 return -EINVAL;
11770
11771 if (rdev->crit_proto_nlportid)
11772 return -EBUSY;
11773
11774 /* determine protocol if provided */
11775 if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
11776 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
11777
11778 if (proto >= NUM_NL80211_CRIT_PROTO)
11779 return -EINVAL;
11780
11781 /* timeout must be provided */
11782 if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
11783 return -EINVAL;
11784
11785 duration =
11786 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
11787
11788 if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
11789 return -ERANGE;
11790
11791 ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
11792 if (!ret)
11793 rdev->crit_proto_nlportid = info->snd_portid;
11794
11795 return ret;
11796 }
11797
11798 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
11799 struct genl_info *info)
11800 {
11801 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11802 struct wireless_dev *wdev = info->user_ptr[1];
11803
11804 if (!rdev->ops->crit_proto_stop)
11805 return -EOPNOTSUPP;
11806
11807 if (rdev->crit_proto_nlportid) {
11808 rdev->crit_proto_nlportid = 0;
11809 rdev_crit_proto_stop(rdev, wdev);
11810 }
11811 return 0;
11812 }
11813
11814 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
11815 {
11816 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11817 struct wireless_dev *wdev =
11818 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
11819 int i, err;
11820 u32 vid, subcmd;
11821
11822 if (!rdev->wiphy.vendor_commands)
11823 return -EOPNOTSUPP;
11824
11825 if (IS_ERR(wdev)) {
11826 err = PTR_ERR(wdev);
11827 if (err != -EINVAL)
11828 return err;
11829 wdev = NULL;
11830 } else if (wdev->wiphy != &rdev->wiphy) {
11831 return -EINVAL;
11832 }
11833
11834 if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
11835 !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
11836 return -EINVAL;
11837
11838 vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
11839 subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
11840 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
11841 const struct wiphy_vendor_command *vcmd;
11842 void *data = NULL;
11843 int len = 0;
11844
11845 vcmd = &rdev->wiphy.vendor_commands[i];
11846
11847 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
11848 continue;
11849
11850 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
11851 WIPHY_VENDOR_CMD_NEED_NETDEV)) {
11852 if (!wdev)
11853 return -EINVAL;
11854 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
11855 !wdev->netdev)
11856 return -EINVAL;
11857
11858 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
11859 if (!wdev_running(wdev))
11860 return -ENETDOWN;
11861 }
11862
11863 if (!vcmd->doit)
11864 return -EOPNOTSUPP;
11865 } else {
11866 wdev = NULL;
11867 }
11868
11869 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
11870 data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
11871 len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
11872 }
11873
11874 rdev->cur_cmd_info = info;
11875 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
11876 data, len);
11877 rdev->cur_cmd_info = NULL;
11878 return err;
11879 }
11880
11881 return -EOPNOTSUPP;
11882 }
11883
11884 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
11885 struct netlink_callback *cb,
11886 struct cfg80211_registered_device **rdev,
11887 struct wireless_dev **wdev)
11888 {
11889 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
11890 u32 vid, subcmd;
11891 unsigned int i;
11892 int vcmd_idx = -1;
11893 int err;
11894 void *data = NULL;
11895 unsigned int data_len = 0;
11896
11897 if (cb->args[0]) {
11898 /* subtract the 1 again here */
11899 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
11900 struct wireless_dev *tmp;
11901
11902 if (!wiphy)
11903 return -ENODEV;
11904 *rdev = wiphy_to_rdev(wiphy);
11905 *wdev = NULL;
11906
11907 if (cb->args[1]) {
11908 list_for_each_entry(tmp, &wiphy->wdev_list, list) {
11909 if (tmp->identifier == cb->args[1] - 1) {
11910 *wdev = tmp;
11911 break;
11912 }
11913 }
11914 }
11915
11916 /* keep rtnl locked in successful case */
11917 return 0;
11918 }
11919
11920 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, attrbuf,
11921 nl80211_fam.maxattr, nl80211_policy, NULL);
11922 if (err)
11923 return err;
11924
11925 if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
11926 !attrbuf[NL80211_ATTR_VENDOR_SUBCMD])
11927 return -EINVAL;
11928
11929 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk), attrbuf);
11930 if (IS_ERR(*wdev))
11931 *wdev = NULL;
11932
11933 *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
11934 if (IS_ERR(*rdev))
11935 return PTR_ERR(*rdev);
11936
11937 vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
11938 subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
11939
11940 for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
11941 const struct wiphy_vendor_command *vcmd;
11942
11943 vcmd = &(*rdev)->wiphy.vendor_commands[i];
11944
11945 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
11946 continue;
11947
11948 if (!vcmd->dumpit)
11949 return -EOPNOTSUPP;
11950
11951 vcmd_idx = i;
11952 break;
11953 }
11954
11955 if (vcmd_idx < 0)
11956 return -EOPNOTSUPP;
11957
11958 if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
11959 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
11960 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
11961 }
11962
11963 /* 0 is the first index - add 1 to parse only once */
11964 cb->args[0] = (*rdev)->wiphy_idx + 1;
11965 /* add 1 to know if it was NULL */
11966 cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
11967 cb->args[2] = vcmd_idx;
11968 cb->args[3] = (unsigned long)data;
11969 cb->args[4] = data_len;
11970
11971 /* keep rtnl locked in successful case */
11972 return 0;
11973 }
11974
11975 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
11976 struct netlink_callback *cb)
11977 {
11978 struct cfg80211_registered_device *rdev;
11979 struct wireless_dev *wdev;
11980 unsigned int vcmd_idx;
11981 const struct wiphy_vendor_command *vcmd;
11982 void *data;
11983 int data_len;
11984 int err;
11985 struct nlattr *vendor_data;
11986
11987 rtnl_lock();
11988 err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
11989 if (err)
11990 goto out;
11991
11992 vcmd_idx = cb->args[2];
11993 data = (void *)cb->args[3];
11994 data_len = cb->args[4];
11995 vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
11996
11997 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
11998 WIPHY_VENDOR_CMD_NEED_NETDEV)) {
11999 if (!wdev) {
12000 err = -EINVAL;
12001 goto out;
12002 }
12003 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
12004 !wdev->netdev) {
12005 err = -EINVAL;
12006 goto out;
12007 }
12008
12009 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
12010 if (!wdev_running(wdev)) {
12011 err = -ENETDOWN;
12012 goto out;
12013 }
12014 }
12015 }
12016
12017 while (1) {
12018 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
12019 cb->nlh->nlmsg_seq, NLM_F_MULTI,
12020 NL80211_CMD_VENDOR);
12021 if (!hdr)
12022 break;
12023
12024 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12025 (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
12026 wdev_id(wdev),
12027 NL80211_ATTR_PAD))) {
12028 genlmsg_cancel(skb, hdr);
12029 break;
12030 }
12031
12032 vendor_data = nla_nest_start(skb, NL80211_ATTR_VENDOR_DATA);
12033 if (!vendor_data) {
12034 genlmsg_cancel(skb, hdr);
12035 break;
12036 }
12037
12038 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
12039 (unsigned long *)&cb->args[5]);
12040 nla_nest_end(skb, vendor_data);
12041
12042 if (err == -ENOBUFS || err == -ENOENT) {
12043 genlmsg_cancel(skb, hdr);
12044 break;
12045 } else if (err) {
12046 genlmsg_cancel(skb, hdr);
12047 goto out;
12048 }
12049
12050 genlmsg_end(skb, hdr);
12051 }
12052
12053 err = skb->len;
12054 out:
12055 rtnl_unlock();
12056 return err;
12057 }
12058
12059 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
12060 enum nl80211_commands cmd,
12061 enum nl80211_attrs attr,
12062 int approxlen)
12063 {
12064 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12065
12066 if (WARN_ON(!rdev->cur_cmd_info))
12067 return NULL;
12068
12069 return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
12070 rdev->cur_cmd_info->snd_portid,
12071 rdev->cur_cmd_info->snd_seq,
12072 cmd, attr, NULL, GFP_KERNEL);
12073 }
12074 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
12075
12076 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
12077 {
12078 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
12079 void *hdr = ((void **)skb->cb)[1];
12080 struct nlattr *data = ((void **)skb->cb)[2];
12081
12082 /* clear CB data for netlink core to own from now on */
12083 memset(skb->cb, 0, sizeof(skb->cb));
12084
12085 if (WARN_ON(!rdev->cur_cmd_info)) {
12086 kfree_skb(skb);
12087 return -EINVAL;
12088 }
12089
12090 nla_nest_end(skb, data);
12091 genlmsg_end(skb, hdr);
12092 return genlmsg_reply(skb, rdev->cur_cmd_info);
12093 }
12094 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
12095
12096 static int nl80211_set_qos_map(struct sk_buff *skb,
12097 struct genl_info *info)
12098 {
12099 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12100 struct cfg80211_qos_map *qos_map = NULL;
12101 struct net_device *dev = info->user_ptr[1];
12102 u8 *pos, len, num_des, des_len, des;
12103 int ret;
12104
12105 if (!rdev->ops->set_qos_map)
12106 return -EOPNOTSUPP;
12107
12108 if (info->attrs[NL80211_ATTR_QOS_MAP]) {
12109 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
12110 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
12111
12112 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
12113 len > IEEE80211_QOS_MAP_LEN_MAX)
12114 return -EINVAL;
12115
12116 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
12117 if (!qos_map)
12118 return -ENOMEM;
12119
12120 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
12121 if (num_des) {
12122 des_len = num_des *
12123 sizeof(struct cfg80211_dscp_exception);
12124 memcpy(qos_map->dscp_exception, pos, des_len);
12125 qos_map->num_des = num_des;
12126 for (des = 0; des < num_des; des++) {
12127 if (qos_map->dscp_exception[des].up > 7) {
12128 kfree(qos_map);
12129 return -EINVAL;
12130 }
12131 }
12132 pos += des_len;
12133 }
12134 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
12135 }
12136
12137 wdev_lock(dev->ieee80211_ptr);
12138 ret = nl80211_key_allowed(dev->ieee80211_ptr);
12139 if (!ret)
12140 ret = rdev_set_qos_map(rdev, dev, qos_map);
12141 wdev_unlock(dev->ieee80211_ptr);
12142
12143 kfree(qos_map);
12144 return ret;
12145 }
12146
12147 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
12148 {
12149 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12150 struct net_device *dev = info->user_ptr[1];
12151 struct wireless_dev *wdev = dev->ieee80211_ptr;
12152 const u8 *peer;
12153 u8 tsid, up;
12154 u16 admitted_time = 0;
12155 int err;
12156
12157 if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
12158 return -EOPNOTSUPP;
12159
12160 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
12161 !info->attrs[NL80211_ATTR_USER_PRIO])
12162 return -EINVAL;
12163
12164 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
12165 if (tsid >= IEEE80211_NUM_TIDS)
12166 return -EINVAL;
12167
12168 up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
12169 if (up >= IEEE80211_NUM_UPS)
12170 return -EINVAL;
12171
12172 /* WMM uses TIDs 0-7 even for TSPEC */
12173 if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
12174 /* TODO: handle 802.11 TSPEC/admission control
12175 * need more attributes for that (e.g. BA session requirement);
12176 * change the WMM adminssion test above to allow both then
12177 */
12178 return -EINVAL;
12179 }
12180
12181 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12182
12183 if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
12184 admitted_time =
12185 nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
12186 if (!admitted_time)
12187 return -EINVAL;
12188 }
12189
12190 wdev_lock(wdev);
12191 switch (wdev->iftype) {
12192 case NL80211_IFTYPE_STATION:
12193 case NL80211_IFTYPE_P2P_CLIENT:
12194 if (wdev->current_bss)
12195 break;
12196 err = -ENOTCONN;
12197 goto out;
12198 default:
12199 err = -EOPNOTSUPP;
12200 goto out;
12201 }
12202
12203 err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
12204
12205 out:
12206 wdev_unlock(wdev);
12207 return err;
12208 }
12209
12210 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
12211 {
12212 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12213 struct net_device *dev = info->user_ptr[1];
12214 struct wireless_dev *wdev = dev->ieee80211_ptr;
12215 const u8 *peer;
12216 u8 tsid;
12217 int err;
12218
12219 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
12220 return -EINVAL;
12221
12222 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
12223 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12224
12225 wdev_lock(wdev);
12226 err = rdev_del_tx_ts(rdev, dev, tsid, peer);
12227 wdev_unlock(wdev);
12228
12229 return err;
12230 }
12231
12232 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
12233 struct genl_info *info)
12234 {
12235 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12236 struct net_device *dev = info->user_ptr[1];
12237 struct wireless_dev *wdev = dev->ieee80211_ptr;
12238 struct cfg80211_chan_def chandef = {};
12239 const u8 *addr;
12240 u8 oper_class;
12241 int err;
12242
12243 if (!rdev->ops->tdls_channel_switch ||
12244 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
12245 return -EOPNOTSUPP;
12246
12247 switch (dev->ieee80211_ptr->iftype) {
12248 case NL80211_IFTYPE_STATION:
12249 case NL80211_IFTYPE_P2P_CLIENT:
12250 break;
12251 default:
12252 return -EOPNOTSUPP;
12253 }
12254
12255 if (!info->attrs[NL80211_ATTR_MAC] ||
12256 !info->attrs[NL80211_ATTR_OPER_CLASS])
12257 return -EINVAL;
12258
12259 err = nl80211_parse_chandef(rdev, info, &chandef);
12260 if (err)
12261 return err;
12262
12263 /*
12264 * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
12265 * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
12266 * specification is not defined for them.
12267 */
12268 if (chandef.chan->band == NL80211_BAND_2GHZ &&
12269 chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
12270 chandef.width != NL80211_CHAN_WIDTH_20)
12271 return -EINVAL;
12272
12273 /* we will be active on the TDLS link */
12274 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
12275 wdev->iftype))
12276 return -EINVAL;
12277
12278 /* don't allow switching to DFS channels */
12279 if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
12280 return -EINVAL;
12281
12282 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
12283 oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
12284
12285 wdev_lock(wdev);
12286 err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
12287 wdev_unlock(wdev);
12288
12289 return err;
12290 }
12291
12292 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
12293 struct genl_info *info)
12294 {
12295 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12296 struct net_device *dev = info->user_ptr[1];
12297 struct wireless_dev *wdev = dev->ieee80211_ptr;
12298 const u8 *addr;
12299
12300 if (!rdev->ops->tdls_channel_switch ||
12301 !rdev->ops->tdls_cancel_channel_switch ||
12302 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
12303 return -EOPNOTSUPP;
12304
12305 switch (dev->ieee80211_ptr->iftype) {
12306 case NL80211_IFTYPE_STATION:
12307 case NL80211_IFTYPE_P2P_CLIENT:
12308 break;
12309 default:
12310 return -EOPNOTSUPP;
12311 }
12312
12313 if (!info->attrs[NL80211_ATTR_MAC])
12314 return -EINVAL;
12315
12316 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
12317
12318 wdev_lock(wdev);
12319 rdev_tdls_cancel_channel_switch(rdev, dev, addr);
12320 wdev_unlock(wdev);
12321
12322 return 0;
12323 }
12324
12325 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
12326 struct genl_info *info)
12327 {
12328 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12329 struct net_device *dev = info->user_ptr[1];
12330 struct wireless_dev *wdev = dev->ieee80211_ptr;
12331 const struct nlattr *nla;
12332 bool enabled;
12333
12334 if (!rdev->ops->set_multicast_to_unicast)
12335 return -EOPNOTSUPP;
12336
12337 if (wdev->iftype != NL80211_IFTYPE_AP &&
12338 wdev->iftype != NL80211_IFTYPE_P2P_GO)
12339 return -EOPNOTSUPP;
12340
12341 nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
12342 enabled = nla_get_flag(nla);
12343
12344 return rdev_set_multicast_to_unicast(rdev, dev, enabled);
12345 }
12346
12347 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
12348 {
12349 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12350 struct net_device *dev = info->user_ptr[1];
12351 struct wireless_dev *wdev = dev->ieee80211_ptr;
12352 struct cfg80211_pmk_conf pmk_conf = {};
12353 int ret;
12354
12355 if (wdev->iftype != NL80211_IFTYPE_STATION &&
12356 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12357 return -EOPNOTSUPP;
12358
12359 if (!wiphy_ext_feature_isset(&rdev->wiphy,
12360 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
12361 return -EOPNOTSUPP;
12362
12363 if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
12364 return -EINVAL;
12365
12366 wdev_lock(wdev);
12367 if (!wdev->current_bss) {
12368 ret = -ENOTCONN;
12369 goto out;
12370 }
12371
12372 pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
12373 if (memcmp(pmk_conf.aa, wdev->current_bss->pub.bssid, ETH_ALEN)) {
12374 ret = -EINVAL;
12375 goto out;
12376 }
12377
12378 pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
12379 pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
12380 if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
12381 pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) {
12382 ret = -EINVAL;
12383 goto out;
12384 }
12385
12386 if (info->attrs[NL80211_ATTR_PMKR0_NAME]) {
12387 int r0_name_len = nla_len(info->attrs[NL80211_ATTR_PMKR0_NAME]);
12388
12389 if (r0_name_len != WLAN_PMK_NAME_LEN) {
12390 ret = -EINVAL;
12391 goto out;
12392 }
12393
12394 pmk_conf.pmk_r0_name =
12395 nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
12396 }
12397
12398 ret = rdev_set_pmk(rdev, dev, &pmk_conf);
12399 out:
12400 wdev_unlock(wdev);
12401 return ret;
12402 }
12403
12404 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
12405 {
12406 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12407 struct net_device *dev = info->user_ptr[1];
12408 struct wireless_dev *wdev = dev->ieee80211_ptr;
12409 const u8 *aa;
12410 int ret;
12411
12412 if (wdev->iftype != NL80211_IFTYPE_STATION &&
12413 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12414 return -EOPNOTSUPP;
12415
12416 if (!wiphy_ext_feature_isset(&rdev->wiphy,
12417 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
12418 return -EOPNOTSUPP;
12419
12420 if (!info->attrs[NL80211_ATTR_MAC])
12421 return -EINVAL;
12422
12423 wdev_lock(wdev);
12424 aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
12425 ret = rdev_del_pmk(rdev, dev, aa);
12426 wdev_unlock(wdev);
12427
12428 return ret;
12429 }
12430
12431 #define NL80211_FLAG_NEED_WIPHY 0x01
12432 #define NL80211_FLAG_NEED_NETDEV 0x02
12433 #define NL80211_FLAG_NEED_RTNL 0x04
12434 #define NL80211_FLAG_CHECK_NETDEV_UP 0x08
12435 #define NL80211_FLAG_NEED_NETDEV_UP (NL80211_FLAG_NEED_NETDEV |\
12436 NL80211_FLAG_CHECK_NETDEV_UP)
12437 #define NL80211_FLAG_NEED_WDEV 0x10
12438 /* If a netdev is associated, it must be UP, P2P must be started */
12439 #define NL80211_FLAG_NEED_WDEV_UP (NL80211_FLAG_NEED_WDEV |\
12440 NL80211_FLAG_CHECK_NETDEV_UP)
12441 #define NL80211_FLAG_CLEAR_SKB 0x20
12442
12443 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
12444 struct genl_info *info)
12445 {
12446 struct cfg80211_registered_device *rdev;
12447 struct wireless_dev *wdev;
12448 struct net_device *dev;
12449 bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
12450
12451 if (rtnl)
12452 rtnl_lock();
12453
12454 if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
12455 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
12456 if (IS_ERR(rdev)) {
12457 if (rtnl)
12458 rtnl_unlock();
12459 return PTR_ERR(rdev);
12460 }
12461 info->user_ptr[0] = rdev;
12462 } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
12463 ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
12464 ASSERT_RTNL();
12465
12466 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
12467 info->attrs);
12468 if (IS_ERR(wdev)) {
12469 if (rtnl)
12470 rtnl_unlock();
12471 return PTR_ERR(wdev);
12472 }
12473
12474 dev = wdev->netdev;
12475 rdev = wiphy_to_rdev(wdev->wiphy);
12476
12477 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
12478 if (!dev) {
12479 if (rtnl)
12480 rtnl_unlock();
12481 return -EINVAL;
12482 }
12483
12484 info->user_ptr[1] = dev;
12485 } else {
12486 info->user_ptr[1] = wdev;
12487 }
12488
12489 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
12490 !wdev_running(wdev)) {
12491 if (rtnl)
12492 rtnl_unlock();
12493 return -ENETDOWN;
12494 }
12495
12496 if (dev)
12497 dev_hold(dev);
12498
12499 info->user_ptr[0] = rdev;
12500 }
12501
12502 return 0;
12503 }
12504
12505 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
12506 struct genl_info *info)
12507 {
12508 if (info->user_ptr[1]) {
12509 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
12510 struct wireless_dev *wdev = info->user_ptr[1];
12511
12512 if (wdev->netdev)
12513 dev_put(wdev->netdev);
12514 } else {
12515 dev_put(info->user_ptr[1]);
12516 }
12517 }
12518
12519 if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
12520 rtnl_unlock();
12521
12522 /* If needed, clear the netlink message payload from the SKB
12523 * as it might contain key data that shouldn't stick around on
12524 * the heap after the SKB is freed. The netlink message header
12525 * is still needed for further processing, so leave it intact.
12526 */
12527 if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
12528 struct nlmsghdr *nlh = nlmsg_hdr(skb);
12529
12530 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
12531 }
12532 }
12533
12534 static const struct genl_ops nl80211_ops[] = {
12535 {
12536 .cmd = NL80211_CMD_GET_WIPHY,
12537 .doit = nl80211_get_wiphy,
12538 .dumpit = nl80211_dump_wiphy,
12539 .done = nl80211_dump_wiphy_done,
12540 .policy = nl80211_policy,
12541 /* can be retrieved by unprivileged users */
12542 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12543 NL80211_FLAG_NEED_RTNL,
12544 },
12545 {
12546 .cmd = NL80211_CMD_SET_WIPHY,
12547 .doit = nl80211_set_wiphy,
12548 .policy = nl80211_policy,
12549 .flags = GENL_UNS_ADMIN_PERM,
12550 .internal_flags = NL80211_FLAG_NEED_RTNL,
12551 },
12552 {
12553 .cmd = NL80211_CMD_GET_INTERFACE,
12554 .doit = nl80211_get_interface,
12555 .dumpit = nl80211_dump_interface,
12556 .policy = nl80211_policy,
12557 /* can be retrieved by unprivileged users */
12558 .internal_flags = NL80211_FLAG_NEED_WDEV |
12559 NL80211_FLAG_NEED_RTNL,
12560 },
12561 {
12562 .cmd = NL80211_CMD_SET_INTERFACE,
12563 .doit = nl80211_set_interface,
12564 .policy = nl80211_policy,
12565 .flags = GENL_UNS_ADMIN_PERM,
12566 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12567 NL80211_FLAG_NEED_RTNL,
12568 },
12569 {
12570 .cmd = NL80211_CMD_NEW_INTERFACE,
12571 .doit = nl80211_new_interface,
12572 .policy = nl80211_policy,
12573 .flags = GENL_UNS_ADMIN_PERM,
12574 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12575 NL80211_FLAG_NEED_RTNL,
12576 },
12577 {
12578 .cmd = NL80211_CMD_DEL_INTERFACE,
12579 .doit = nl80211_del_interface,
12580 .policy = nl80211_policy,
12581 .flags = GENL_UNS_ADMIN_PERM,
12582 .internal_flags = NL80211_FLAG_NEED_WDEV |
12583 NL80211_FLAG_NEED_RTNL,
12584 },
12585 {
12586 .cmd = NL80211_CMD_GET_KEY,
12587 .doit = nl80211_get_key,
12588 .policy = nl80211_policy,
12589 .flags = GENL_UNS_ADMIN_PERM,
12590 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12591 NL80211_FLAG_NEED_RTNL,
12592 },
12593 {
12594 .cmd = NL80211_CMD_SET_KEY,
12595 .doit = nl80211_set_key,
12596 .policy = nl80211_policy,
12597 .flags = GENL_UNS_ADMIN_PERM,
12598 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12599 NL80211_FLAG_NEED_RTNL |
12600 NL80211_FLAG_CLEAR_SKB,
12601 },
12602 {
12603 .cmd = NL80211_CMD_NEW_KEY,
12604 .doit = nl80211_new_key,
12605 .policy = nl80211_policy,
12606 .flags = GENL_UNS_ADMIN_PERM,
12607 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12608 NL80211_FLAG_NEED_RTNL |
12609 NL80211_FLAG_CLEAR_SKB,
12610 },
12611 {
12612 .cmd = NL80211_CMD_DEL_KEY,
12613 .doit = nl80211_del_key,
12614 .policy = nl80211_policy,
12615 .flags = GENL_UNS_ADMIN_PERM,
12616 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12617 NL80211_FLAG_NEED_RTNL,
12618 },
12619 {
12620 .cmd = NL80211_CMD_SET_BEACON,
12621 .policy = nl80211_policy,
12622 .flags = GENL_UNS_ADMIN_PERM,
12623 .doit = nl80211_set_beacon,
12624 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12625 NL80211_FLAG_NEED_RTNL,
12626 },
12627 {
12628 .cmd = NL80211_CMD_START_AP,
12629 .policy = nl80211_policy,
12630 .flags = GENL_UNS_ADMIN_PERM,
12631 .doit = nl80211_start_ap,
12632 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12633 NL80211_FLAG_NEED_RTNL,
12634 },
12635 {
12636 .cmd = NL80211_CMD_STOP_AP,
12637 .policy = nl80211_policy,
12638 .flags = GENL_UNS_ADMIN_PERM,
12639 .doit = nl80211_stop_ap,
12640 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12641 NL80211_FLAG_NEED_RTNL,
12642 },
12643 {
12644 .cmd = NL80211_CMD_GET_STATION,
12645 .doit = nl80211_get_station,
12646 .dumpit = nl80211_dump_station,
12647 .policy = nl80211_policy,
12648 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12649 NL80211_FLAG_NEED_RTNL,
12650 },
12651 {
12652 .cmd = NL80211_CMD_SET_STATION,
12653 .doit = nl80211_set_station,
12654 .policy = nl80211_policy,
12655 .flags = GENL_UNS_ADMIN_PERM,
12656 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12657 NL80211_FLAG_NEED_RTNL,
12658 },
12659 {
12660 .cmd = NL80211_CMD_NEW_STATION,
12661 .doit = nl80211_new_station,
12662 .policy = nl80211_policy,
12663 .flags = GENL_UNS_ADMIN_PERM,
12664 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12665 NL80211_FLAG_NEED_RTNL,
12666 },
12667 {
12668 .cmd = NL80211_CMD_DEL_STATION,
12669 .doit = nl80211_del_station,
12670 .policy = nl80211_policy,
12671 .flags = GENL_UNS_ADMIN_PERM,
12672 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12673 NL80211_FLAG_NEED_RTNL,
12674 },
12675 {
12676 .cmd = NL80211_CMD_GET_MPATH,
12677 .doit = nl80211_get_mpath,
12678 .dumpit = nl80211_dump_mpath,
12679 .policy = nl80211_policy,
12680 .flags = GENL_UNS_ADMIN_PERM,
12681 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12682 NL80211_FLAG_NEED_RTNL,
12683 },
12684 {
12685 .cmd = NL80211_CMD_GET_MPP,
12686 .doit = nl80211_get_mpp,
12687 .dumpit = nl80211_dump_mpp,
12688 .policy = nl80211_policy,
12689 .flags = GENL_UNS_ADMIN_PERM,
12690 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12691 NL80211_FLAG_NEED_RTNL,
12692 },
12693 {
12694 .cmd = NL80211_CMD_SET_MPATH,
12695 .doit = nl80211_set_mpath,
12696 .policy = nl80211_policy,
12697 .flags = GENL_UNS_ADMIN_PERM,
12698 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12699 NL80211_FLAG_NEED_RTNL,
12700 },
12701 {
12702 .cmd = NL80211_CMD_NEW_MPATH,
12703 .doit = nl80211_new_mpath,
12704 .policy = nl80211_policy,
12705 .flags = GENL_UNS_ADMIN_PERM,
12706 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12707 NL80211_FLAG_NEED_RTNL,
12708 },
12709 {
12710 .cmd = NL80211_CMD_DEL_MPATH,
12711 .doit = nl80211_del_mpath,
12712 .policy = nl80211_policy,
12713 .flags = GENL_UNS_ADMIN_PERM,
12714 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12715 NL80211_FLAG_NEED_RTNL,
12716 },
12717 {
12718 .cmd = NL80211_CMD_SET_BSS,
12719 .doit = nl80211_set_bss,
12720 .policy = nl80211_policy,
12721 .flags = GENL_UNS_ADMIN_PERM,
12722 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12723 NL80211_FLAG_NEED_RTNL,
12724 },
12725 {
12726 .cmd = NL80211_CMD_GET_REG,
12727 .doit = nl80211_get_reg_do,
12728 .dumpit = nl80211_get_reg_dump,
12729 .policy = nl80211_policy,
12730 .internal_flags = NL80211_FLAG_NEED_RTNL,
12731 /* can be retrieved by unprivileged users */
12732 },
12733 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
12734 {
12735 .cmd = NL80211_CMD_SET_REG,
12736 .doit = nl80211_set_reg,
12737 .policy = nl80211_policy,
12738 .flags = GENL_ADMIN_PERM,
12739 .internal_flags = NL80211_FLAG_NEED_RTNL,
12740 },
12741 #endif
12742 {
12743 .cmd = NL80211_CMD_REQ_SET_REG,
12744 .doit = nl80211_req_set_reg,
12745 .policy = nl80211_policy,
12746 .flags = GENL_ADMIN_PERM,
12747 },
12748 {
12749 .cmd = NL80211_CMD_RELOAD_REGDB,
12750 .doit = nl80211_reload_regdb,
12751 .policy = nl80211_policy,
12752 .flags = GENL_ADMIN_PERM,
12753 },
12754 {
12755 .cmd = NL80211_CMD_GET_MESH_CONFIG,
12756 .doit = nl80211_get_mesh_config,
12757 .policy = nl80211_policy,
12758 /* can be retrieved by unprivileged users */
12759 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12760 NL80211_FLAG_NEED_RTNL,
12761 },
12762 {
12763 .cmd = NL80211_CMD_SET_MESH_CONFIG,
12764 .doit = nl80211_update_mesh_config,
12765 .policy = nl80211_policy,
12766 .flags = GENL_UNS_ADMIN_PERM,
12767 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12768 NL80211_FLAG_NEED_RTNL,
12769 },
12770 {
12771 .cmd = NL80211_CMD_TRIGGER_SCAN,
12772 .doit = nl80211_trigger_scan,
12773 .policy = nl80211_policy,
12774 .flags = GENL_UNS_ADMIN_PERM,
12775 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12776 NL80211_FLAG_NEED_RTNL,
12777 },
12778 {
12779 .cmd = NL80211_CMD_ABORT_SCAN,
12780 .doit = nl80211_abort_scan,
12781 .policy = nl80211_policy,
12782 .flags = GENL_UNS_ADMIN_PERM,
12783 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12784 NL80211_FLAG_NEED_RTNL,
12785 },
12786 {
12787 .cmd = NL80211_CMD_GET_SCAN,
12788 .policy = nl80211_policy,
12789 .dumpit = nl80211_dump_scan,
12790 },
12791 {
12792 .cmd = NL80211_CMD_START_SCHED_SCAN,
12793 .doit = nl80211_start_sched_scan,
12794 .policy = nl80211_policy,
12795 .flags = GENL_UNS_ADMIN_PERM,
12796 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12797 NL80211_FLAG_NEED_RTNL,
12798 },
12799 {
12800 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
12801 .doit = nl80211_stop_sched_scan,
12802 .policy = nl80211_policy,
12803 .flags = GENL_UNS_ADMIN_PERM,
12804 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12805 NL80211_FLAG_NEED_RTNL,
12806 },
12807 {
12808 .cmd = NL80211_CMD_AUTHENTICATE,
12809 .doit = nl80211_authenticate,
12810 .policy = nl80211_policy,
12811 .flags = GENL_UNS_ADMIN_PERM,
12812 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12813 NL80211_FLAG_NEED_RTNL |
12814 NL80211_FLAG_CLEAR_SKB,
12815 },
12816 {
12817 .cmd = NL80211_CMD_ASSOCIATE,
12818 .doit = nl80211_associate,
12819 .policy = nl80211_policy,
12820 .flags = GENL_UNS_ADMIN_PERM,
12821 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12822 NL80211_FLAG_NEED_RTNL,
12823 },
12824 {
12825 .cmd = NL80211_CMD_DEAUTHENTICATE,
12826 .doit = nl80211_deauthenticate,
12827 .policy = nl80211_policy,
12828 .flags = GENL_UNS_ADMIN_PERM,
12829 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12830 NL80211_FLAG_NEED_RTNL,
12831 },
12832 {
12833 .cmd = NL80211_CMD_DISASSOCIATE,
12834 .doit = nl80211_disassociate,
12835 .policy = nl80211_policy,
12836 .flags = GENL_UNS_ADMIN_PERM,
12837 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12838 NL80211_FLAG_NEED_RTNL,
12839 },
12840 {
12841 .cmd = NL80211_CMD_JOIN_IBSS,
12842 .doit = nl80211_join_ibss,
12843 .policy = nl80211_policy,
12844 .flags = GENL_UNS_ADMIN_PERM,
12845 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12846 NL80211_FLAG_NEED_RTNL,
12847 },
12848 {
12849 .cmd = NL80211_CMD_LEAVE_IBSS,
12850 .doit = nl80211_leave_ibss,
12851 .policy = nl80211_policy,
12852 .flags = GENL_UNS_ADMIN_PERM,
12853 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12854 NL80211_FLAG_NEED_RTNL,
12855 },
12856 #ifdef CONFIG_NL80211_TESTMODE
12857 {
12858 .cmd = NL80211_CMD_TESTMODE,
12859 .doit = nl80211_testmode_do,
12860 .dumpit = nl80211_testmode_dump,
12861 .policy = nl80211_policy,
12862 .flags = GENL_UNS_ADMIN_PERM,
12863 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12864 NL80211_FLAG_NEED_RTNL,
12865 },
12866 #endif
12867 {
12868 .cmd = NL80211_CMD_CONNECT,
12869 .doit = nl80211_connect,
12870 .policy = nl80211_policy,
12871 .flags = GENL_UNS_ADMIN_PERM,
12872 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12873 NL80211_FLAG_NEED_RTNL,
12874 },
12875 {
12876 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
12877 .doit = nl80211_update_connect_params,
12878 .policy = nl80211_policy,
12879 .flags = GENL_ADMIN_PERM,
12880 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12881 NL80211_FLAG_NEED_RTNL,
12882 },
12883 {
12884 .cmd = NL80211_CMD_DISCONNECT,
12885 .doit = nl80211_disconnect,
12886 .policy = nl80211_policy,
12887 .flags = GENL_UNS_ADMIN_PERM,
12888 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12889 NL80211_FLAG_NEED_RTNL,
12890 },
12891 {
12892 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
12893 .doit = nl80211_wiphy_netns,
12894 .policy = nl80211_policy,
12895 .flags = GENL_UNS_ADMIN_PERM,
12896 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12897 NL80211_FLAG_NEED_RTNL,
12898 },
12899 {
12900 .cmd = NL80211_CMD_GET_SURVEY,
12901 .policy = nl80211_policy,
12902 .dumpit = nl80211_dump_survey,
12903 },
12904 {
12905 .cmd = NL80211_CMD_SET_PMKSA,
12906 .doit = nl80211_setdel_pmksa,
12907 .policy = nl80211_policy,
12908 .flags = GENL_UNS_ADMIN_PERM,
12909 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12910 NL80211_FLAG_NEED_RTNL,
12911 },
12912 {
12913 .cmd = NL80211_CMD_DEL_PMKSA,
12914 .doit = nl80211_setdel_pmksa,
12915 .policy = nl80211_policy,
12916 .flags = GENL_UNS_ADMIN_PERM,
12917 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12918 NL80211_FLAG_NEED_RTNL,
12919 },
12920 {
12921 .cmd = NL80211_CMD_FLUSH_PMKSA,
12922 .doit = nl80211_flush_pmksa,
12923 .policy = nl80211_policy,
12924 .flags = GENL_UNS_ADMIN_PERM,
12925 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12926 NL80211_FLAG_NEED_RTNL,
12927 },
12928 {
12929 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
12930 .doit = nl80211_remain_on_channel,
12931 .policy = nl80211_policy,
12932 .flags = GENL_UNS_ADMIN_PERM,
12933 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12934 NL80211_FLAG_NEED_RTNL,
12935 },
12936 {
12937 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
12938 .doit = nl80211_cancel_remain_on_channel,
12939 .policy = nl80211_policy,
12940 .flags = GENL_UNS_ADMIN_PERM,
12941 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12942 NL80211_FLAG_NEED_RTNL,
12943 },
12944 {
12945 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
12946 .doit = nl80211_set_tx_bitrate_mask,
12947 .policy = nl80211_policy,
12948 .flags = GENL_UNS_ADMIN_PERM,
12949 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12950 NL80211_FLAG_NEED_RTNL,
12951 },
12952 {
12953 .cmd = NL80211_CMD_REGISTER_FRAME,
12954 .doit = nl80211_register_mgmt,
12955 .policy = nl80211_policy,
12956 .flags = GENL_UNS_ADMIN_PERM,
12957 .internal_flags = NL80211_FLAG_NEED_WDEV |
12958 NL80211_FLAG_NEED_RTNL,
12959 },
12960 {
12961 .cmd = NL80211_CMD_FRAME,
12962 .doit = nl80211_tx_mgmt,
12963 .policy = nl80211_policy,
12964 .flags = GENL_UNS_ADMIN_PERM,
12965 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12966 NL80211_FLAG_NEED_RTNL,
12967 },
12968 {
12969 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
12970 .doit = nl80211_tx_mgmt_cancel_wait,
12971 .policy = nl80211_policy,
12972 .flags = GENL_UNS_ADMIN_PERM,
12973 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12974 NL80211_FLAG_NEED_RTNL,
12975 },
12976 {
12977 .cmd = NL80211_CMD_SET_POWER_SAVE,
12978 .doit = nl80211_set_power_save,
12979 .policy = nl80211_policy,
12980 .flags = GENL_UNS_ADMIN_PERM,
12981 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12982 NL80211_FLAG_NEED_RTNL,
12983 },
12984 {
12985 .cmd = NL80211_CMD_GET_POWER_SAVE,
12986 .doit = nl80211_get_power_save,
12987 .policy = nl80211_policy,
12988 /* can be retrieved by unprivileged users */
12989 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12990 NL80211_FLAG_NEED_RTNL,
12991 },
12992 {
12993 .cmd = NL80211_CMD_SET_CQM,
12994 .doit = nl80211_set_cqm,
12995 .policy = nl80211_policy,
12996 .flags = GENL_UNS_ADMIN_PERM,
12997 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12998 NL80211_FLAG_NEED_RTNL,
12999 },
13000 {
13001 .cmd = NL80211_CMD_SET_CHANNEL,
13002 .doit = nl80211_set_channel,
13003 .policy = nl80211_policy,
13004 .flags = GENL_UNS_ADMIN_PERM,
13005 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13006 NL80211_FLAG_NEED_RTNL,
13007 },
13008 {
13009 .cmd = NL80211_CMD_SET_WDS_PEER,
13010 .doit = nl80211_set_wds_peer,
13011 .policy = nl80211_policy,
13012 .flags = GENL_UNS_ADMIN_PERM,
13013 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13014 NL80211_FLAG_NEED_RTNL,
13015 },
13016 {
13017 .cmd = NL80211_CMD_JOIN_MESH,
13018 .doit = nl80211_join_mesh,
13019 .policy = nl80211_policy,
13020 .flags = GENL_UNS_ADMIN_PERM,
13021 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13022 NL80211_FLAG_NEED_RTNL,
13023 },
13024 {
13025 .cmd = NL80211_CMD_LEAVE_MESH,
13026 .doit = nl80211_leave_mesh,
13027 .policy = nl80211_policy,
13028 .flags = GENL_UNS_ADMIN_PERM,
13029 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13030 NL80211_FLAG_NEED_RTNL,
13031 },
13032 {
13033 .cmd = NL80211_CMD_JOIN_OCB,
13034 .doit = nl80211_join_ocb,
13035 .policy = nl80211_policy,
13036 .flags = GENL_UNS_ADMIN_PERM,
13037 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13038 NL80211_FLAG_NEED_RTNL,
13039 },
13040 {
13041 .cmd = NL80211_CMD_LEAVE_OCB,
13042 .doit = nl80211_leave_ocb,
13043 .policy = nl80211_policy,
13044 .flags = GENL_UNS_ADMIN_PERM,
13045 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13046 NL80211_FLAG_NEED_RTNL,
13047 },
13048 #ifdef CONFIG_PM
13049 {
13050 .cmd = NL80211_CMD_GET_WOWLAN,
13051 .doit = nl80211_get_wowlan,
13052 .policy = nl80211_policy,
13053 /* can be retrieved by unprivileged users */
13054 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13055 NL80211_FLAG_NEED_RTNL,
13056 },
13057 {
13058 .cmd = NL80211_CMD_SET_WOWLAN,
13059 .doit = nl80211_set_wowlan,
13060 .policy = nl80211_policy,
13061 .flags = GENL_UNS_ADMIN_PERM,
13062 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13063 NL80211_FLAG_NEED_RTNL,
13064 },
13065 #endif
13066 {
13067 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
13068 .doit = nl80211_set_rekey_data,
13069 .policy = nl80211_policy,
13070 .flags = GENL_UNS_ADMIN_PERM,
13071 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13072 NL80211_FLAG_NEED_RTNL |
13073 NL80211_FLAG_CLEAR_SKB,
13074 },
13075 {
13076 .cmd = NL80211_CMD_TDLS_MGMT,
13077 .doit = nl80211_tdls_mgmt,
13078 .policy = nl80211_policy,
13079 .flags = GENL_UNS_ADMIN_PERM,
13080 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13081 NL80211_FLAG_NEED_RTNL,
13082 },
13083 {
13084 .cmd = NL80211_CMD_TDLS_OPER,
13085 .doit = nl80211_tdls_oper,
13086 .policy = nl80211_policy,
13087 .flags = GENL_UNS_ADMIN_PERM,
13088 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13089 NL80211_FLAG_NEED_RTNL,
13090 },
13091 {
13092 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
13093 .doit = nl80211_register_unexpected_frame,
13094 .policy = nl80211_policy,
13095 .flags = GENL_UNS_ADMIN_PERM,
13096 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13097 NL80211_FLAG_NEED_RTNL,
13098 },
13099 {
13100 .cmd = NL80211_CMD_PROBE_CLIENT,
13101 .doit = nl80211_probe_client,
13102 .policy = nl80211_policy,
13103 .flags = GENL_UNS_ADMIN_PERM,
13104 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13105 NL80211_FLAG_NEED_RTNL,
13106 },
13107 {
13108 .cmd = NL80211_CMD_REGISTER_BEACONS,
13109 .doit = nl80211_register_beacons,
13110 .policy = nl80211_policy,
13111 .flags = GENL_UNS_ADMIN_PERM,
13112 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13113 NL80211_FLAG_NEED_RTNL,
13114 },
13115 {
13116 .cmd = NL80211_CMD_SET_NOACK_MAP,
13117 .doit = nl80211_set_noack_map,
13118 .policy = nl80211_policy,
13119 .flags = GENL_UNS_ADMIN_PERM,
13120 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13121 NL80211_FLAG_NEED_RTNL,
13122 },
13123 {
13124 .cmd = NL80211_CMD_START_P2P_DEVICE,
13125 .doit = nl80211_start_p2p_device,
13126 .policy = nl80211_policy,
13127 .flags = GENL_UNS_ADMIN_PERM,
13128 .internal_flags = NL80211_FLAG_NEED_WDEV |
13129 NL80211_FLAG_NEED_RTNL,
13130 },
13131 {
13132 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
13133 .doit = nl80211_stop_p2p_device,
13134 .policy = nl80211_policy,
13135 .flags = GENL_UNS_ADMIN_PERM,
13136 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13137 NL80211_FLAG_NEED_RTNL,
13138 },
13139 {
13140 .cmd = NL80211_CMD_START_NAN,
13141 .doit = nl80211_start_nan,
13142 .policy = nl80211_policy,
13143 .flags = GENL_ADMIN_PERM,
13144 .internal_flags = NL80211_FLAG_NEED_WDEV |
13145 NL80211_FLAG_NEED_RTNL,
13146 },
13147 {
13148 .cmd = NL80211_CMD_STOP_NAN,
13149 .doit = nl80211_stop_nan,
13150 .policy = nl80211_policy,
13151 .flags = GENL_ADMIN_PERM,
13152 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13153 NL80211_FLAG_NEED_RTNL,
13154 },
13155 {
13156 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
13157 .doit = nl80211_nan_add_func,
13158 .policy = nl80211_policy,
13159 .flags = GENL_ADMIN_PERM,
13160 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13161 NL80211_FLAG_NEED_RTNL,
13162 },
13163 {
13164 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
13165 .doit = nl80211_nan_del_func,
13166 .policy = nl80211_policy,
13167 .flags = GENL_ADMIN_PERM,
13168 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13169 NL80211_FLAG_NEED_RTNL,
13170 },
13171 {
13172 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
13173 .doit = nl80211_nan_change_config,
13174 .policy = nl80211_policy,
13175 .flags = GENL_ADMIN_PERM,
13176 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13177 NL80211_FLAG_NEED_RTNL,
13178 },
13179 {
13180 .cmd = NL80211_CMD_SET_MCAST_RATE,
13181 .doit = nl80211_set_mcast_rate,
13182 .policy = nl80211_policy,
13183 .flags = GENL_UNS_ADMIN_PERM,
13184 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13185 NL80211_FLAG_NEED_RTNL,
13186 },
13187 {
13188 .cmd = NL80211_CMD_SET_MAC_ACL,
13189 .doit = nl80211_set_mac_acl,
13190 .policy = nl80211_policy,
13191 .flags = GENL_UNS_ADMIN_PERM,
13192 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13193 NL80211_FLAG_NEED_RTNL,
13194 },
13195 {
13196 .cmd = NL80211_CMD_RADAR_DETECT,
13197 .doit = nl80211_start_radar_detection,
13198 .policy = nl80211_policy,
13199 .flags = GENL_UNS_ADMIN_PERM,
13200 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13201 NL80211_FLAG_NEED_RTNL,
13202 },
13203 {
13204 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
13205 .doit = nl80211_get_protocol_features,
13206 .policy = nl80211_policy,
13207 },
13208 {
13209 .cmd = NL80211_CMD_UPDATE_FT_IES,
13210 .doit = nl80211_update_ft_ies,
13211 .policy = nl80211_policy,
13212 .flags = GENL_UNS_ADMIN_PERM,
13213 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13214 NL80211_FLAG_NEED_RTNL,
13215 },
13216 {
13217 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
13218 .doit = nl80211_crit_protocol_start,
13219 .policy = nl80211_policy,
13220 .flags = GENL_UNS_ADMIN_PERM,
13221 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13222 NL80211_FLAG_NEED_RTNL,
13223 },
13224 {
13225 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
13226 .doit = nl80211_crit_protocol_stop,
13227 .policy = nl80211_policy,
13228 .flags = GENL_UNS_ADMIN_PERM,
13229 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13230 NL80211_FLAG_NEED_RTNL,
13231 },
13232 {
13233 .cmd = NL80211_CMD_GET_COALESCE,
13234 .doit = nl80211_get_coalesce,
13235 .policy = nl80211_policy,
13236 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13237 NL80211_FLAG_NEED_RTNL,
13238 },
13239 {
13240 .cmd = NL80211_CMD_SET_COALESCE,
13241 .doit = nl80211_set_coalesce,
13242 .policy = nl80211_policy,
13243 .flags = GENL_UNS_ADMIN_PERM,
13244 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13245 NL80211_FLAG_NEED_RTNL,
13246 },
13247 {
13248 .cmd = NL80211_CMD_CHANNEL_SWITCH,
13249 .doit = nl80211_channel_switch,
13250 .policy = nl80211_policy,
13251 .flags = GENL_UNS_ADMIN_PERM,
13252 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13253 NL80211_FLAG_NEED_RTNL,
13254 },
13255 {
13256 .cmd = NL80211_CMD_VENDOR,
13257 .doit = nl80211_vendor_cmd,
13258 .dumpit = nl80211_vendor_cmd_dump,
13259 .policy = nl80211_policy,
13260 .flags = GENL_UNS_ADMIN_PERM,
13261 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13262 NL80211_FLAG_NEED_RTNL,
13263 },
13264 {
13265 .cmd = NL80211_CMD_SET_QOS_MAP,
13266 .doit = nl80211_set_qos_map,
13267 .policy = nl80211_policy,
13268 .flags = GENL_UNS_ADMIN_PERM,
13269 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13270 NL80211_FLAG_NEED_RTNL,
13271 },
13272 {
13273 .cmd = NL80211_CMD_ADD_TX_TS,
13274 .doit = nl80211_add_tx_ts,
13275 .policy = nl80211_policy,
13276 .flags = GENL_UNS_ADMIN_PERM,
13277 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13278 NL80211_FLAG_NEED_RTNL,
13279 },
13280 {
13281 .cmd = NL80211_CMD_DEL_TX_TS,
13282 .doit = nl80211_del_tx_ts,
13283 .policy = nl80211_policy,
13284 .flags = GENL_UNS_ADMIN_PERM,
13285 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13286 NL80211_FLAG_NEED_RTNL,
13287 },
13288 {
13289 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
13290 .doit = nl80211_tdls_channel_switch,
13291 .policy = nl80211_policy,
13292 .flags = GENL_UNS_ADMIN_PERM,
13293 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13294 NL80211_FLAG_NEED_RTNL,
13295 },
13296 {
13297 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
13298 .doit = nl80211_tdls_cancel_channel_switch,
13299 .policy = nl80211_policy,
13300 .flags = GENL_UNS_ADMIN_PERM,
13301 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13302 NL80211_FLAG_NEED_RTNL,
13303 },
13304 {
13305 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
13306 .doit = nl80211_set_multicast_to_unicast,
13307 .policy = nl80211_policy,
13308 .flags = GENL_UNS_ADMIN_PERM,
13309 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13310 NL80211_FLAG_NEED_RTNL,
13311 },
13312 {
13313 .cmd = NL80211_CMD_SET_PMK,
13314 .doit = nl80211_set_pmk,
13315 .policy = nl80211_policy,
13316 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13317 NL80211_FLAG_NEED_RTNL,
13318 },
13319 {
13320 .cmd = NL80211_CMD_DEL_PMK,
13321 .doit = nl80211_del_pmk,
13322 .policy = nl80211_policy,
13323 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13324 NL80211_FLAG_NEED_RTNL,
13325 },
13326
13327 };
13328
13329 static struct genl_family nl80211_fam __ro_after_init = {
13330 .name = NL80211_GENL_NAME, /* have users key off the name instead */
13331 .hdrsize = 0, /* no private header */
13332 .version = 1, /* no particular meaning now */
13333 .maxattr = NL80211_ATTR_MAX,
13334 .netnsok = true,
13335 .pre_doit = nl80211_pre_doit,
13336 .post_doit = nl80211_post_doit,
13337 .module = THIS_MODULE,
13338 .ops = nl80211_ops,
13339 .n_ops = ARRAY_SIZE(nl80211_ops),
13340 .mcgrps = nl80211_mcgrps,
13341 .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
13342 };
13343
13344 /* notification functions */
13345
13346 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
13347 enum nl80211_commands cmd)
13348 {
13349 struct sk_buff *msg;
13350 struct nl80211_dump_wiphy_state state = {};
13351
13352 WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
13353 cmd != NL80211_CMD_DEL_WIPHY);
13354
13355 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13356 if (!msg)
13357 return;
13358
13359 if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
13360 nlmsg_free(msg);
13361 return;
13362 }
13363
13364 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13365 NL80211_MCGRP_CONFIG, GFP_KERNEL);
13366 }
13367
13368 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
13369 struct wireless_dev *wdev,
13370 enum nl80211_commands cmd)
13371 {
13372 struct sk_buff *msg;
13373
13374 WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
13375 cmd != NL80211_CMD_DEL_INTERFACE);
13376
13377 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13378 if (!msg)
13379 return;
13380
13381 if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev,
13382 cmd == NL80211_CMD_DEL_INTERFACE) < 0) {
13383 nlmsg_free(msg);
13384 return;
13385 }
13386
13387 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13388 NL80211_MCGRP_CONFIG, GFP_KERNEL);
13389 }
13390
13391 static int nl80211_add_scan_req(struct sk_buff *msg,
13392 struct cfg80211_registered_device *rdev)
13393 {
13394 struct cfg80211_scan_request *req = rdev->scan_req;
13395 struct nlattr *nest;
13396 int i;
13397
13398 if (WARN_ON(!req))
13399 return 0;
13400
13401 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
13402 if (!nest)
13403 goto nla_put_failure;
13404 for (i = 0; i < req->n_ssids; i++) {
13405 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
13406 goto nla_put_failure;
13407 }
13408 nla_nest_end(msg, nest);
13409
13410 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
13411 if (!nest)
13412 goto nla_put_failure;
13413 for (i = 0; i < req->n_channels; i++) {
13414 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
13415 goto nla_put_failure;
13416 }
13417 nla_nest_end(msg, nest);
13418
13419 if (req->ie &&
13420 nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
13421 goto nla_put_failure;
13422
13423 if (req->flags &&
13424 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
13425 goto nla_put_failure;
13426
13427 if (req->info.scan_start_tsf &&
13428 (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
13429 req->info.scan_start_tsf, NL80211_BSS_PAD) ||
13430 nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
13431 req->info.tsf_bssid)))
13432 goto nla_put_failure;
13433
13434 return 0;
13435 nla_put_failure:
13436 return -ENOBUFS;
13437 }
13438
13439 static int nl80211_prep_scan_msg(struct sk_buff *msg,
13440 struct cfg80211_registered_device *rdev,
13441 struct wireless_dev *wdev,
13442 u32 portid, u32 seq, int flags,
13443 u32 cmd)
13444 {
13445 void *hdr;
13446
13447 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
13448 if (!hdr)
13449 return -1;
13450
13451 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13452 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
13453 wdev->netdev->ifindex)) ||
13454 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
13455 NL80211_ATTR_PAD))
13456 goto nla_put_failure;
13457
13458 /* ignore errors and send incomplete event anyway */
13459 nl80211_add_scan_req(msg, rdev);
13460
13461 genlmsg_end(msg, hdr);
13462 return 0;
13463
13464 nla_put_failure:
13465 genlmsg_cancel(msg, hdr);
13466 return -EMSGSIZE;
13467 }
13468
13469 static int
13470 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
13471 struct cfg80211_sched_scan_request *req, u32 cmd)
13472 {
13473 void *hdr;
13474
13475 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
13476 if (!hdr)
13477 return -1;
13478
13479 if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
13480 wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
13481 nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
13482 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
13483 NL80211_ATTR_PAD))
13484 goto nla_put_failure;
13485
13486 genlmsg_end(msg, hdr);
13487 return 0;
13488
13489 nla_put_failure:
13490 genlmsg_cancel(msg, hdr);
13491 return -EMSGSIZE;
13492 }
13493
13494 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
13495 struct wireless_dev *wdev)
13496 {
13497 struct sk_buff *msg;
13498
13499 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13500 if (!msg)
13501 return;
13502
13503 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
13504 NL80211_CMD_TRIGGER_SCAN) < 0) {
13505 nlmsg_free(msg);
13506 return;
13507 }
13508
13509 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13510 NL80211_MCGRP_SCAN, GFP_KERNEL);
13511 }
13512
13513 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
13514 struct wireless_dev *wdev, bool aborted)
13515 {
13516 struct sk_buff *msg;
13517
13518 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13519 if (!msg)
13520 return NULL;
13521
13522 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
13523 aborted ? NL80211_CMD_SCAN_ABORTED :
13524 NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
13525 nlmsg_free(msg);
13526 return NULL;
13527 }
13528
13529 return msg;
13530 }
13531
13532 /* send message created by nl80211_build_scan_msg() */
13533 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
13534 struct sk_buff *msg)
13535 {
13536 if (!msg)
13537 return;
13538
13539 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13540 NL80211_MCGRP_SCAN, GFP_KERNEL);
13541 }
13542
13543 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
13544 {
13545 struct sk_buff *msg;
13546
13547 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13548 if (!msg)
13549 return;
13550
13551 if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
13552 nlmsg_free(msg);
13553 return;
13554 }
13555
13556 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
13557 NL80211_MCGRP_SCAN, GFP_KERNEL);
13558 }
13559
13560 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
13561 struct regulatory_request *request)
13562 {
13563 /* Userspace can always count this one always being set */
13564 if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
13565 goto nla_put_failure;
13566
13567 if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
13568 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
13569 NL80211_REGDOM_TYPE_WORLD))
13570 goto nla_put_failure;
13571 } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
13572 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
13573 NL80211_REGDOM_TYPE_CUSTOM_WORLD))
13574 goto nla_put_failure;
13575 } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
13576 request->intersect) {
13577 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
13578 NL80211_REGDOM_TYPE_INTERSECTION))
13579 goto nla_put_failure;
13580 } else {
13581 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
13582 NL80211_REGDOM_TYPE_COUNTRY) ||
13583 nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
13584 request->alpha2))
13585 goto nla_put_failure;
13586 }
13587
13588 if (request->wiphy_idx != WIPHY_IDX_INVALID) {
13589 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
13590
13591 if (wiphy &&
13592 nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
13593 goto nla_put_failure;
13594
13595 if (wiphy &&
13596 wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
13597 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
13598 goto nla_put_failure;
13599 }
13600
13601 return true;
13602
13603 nla_put_failure:
13604 return false;
13605 }
13606
13607 /*
13608 * This can happen on global regulatory changes or device specific settings
13609 * based on custom regulatory domains.
13610 */
13611 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
13612 struct regulatory_request *request)
13613 {
13614 struct sk_buff *msg;
13615 void *hdr;
13616
13617 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13618 if (!msg)
13619 return;
13620
13621 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
13622 if (!hdr) {
13623 nlmsg_free(msg);
13624 return;
13625 }
13626
13627 if (nl80211_reg_change_event_fill(msg, request) == false)
13628 goto nla_put_failure;
13629
13630 genlmsg_end(msg, hdr);
13631
13632 rcu_read_lock();
13633 genlmsg_multicast_allns(&nl80211_fam, msg, 0,
13634 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
13635 rcu_read_unlock();
13636
13637 return;
13638
13639 nla_put_failure:
13640 genlmsg_cancel(msg, hdr);
13641 nlmsg_free(msg);
13642 }
13643
13644 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
13645 struct net_device *netdev,
13646 const u8 *buf, size_t len,
13647 enum nl80211_commands cmd, gfp_t gfp,
13648 int uapsd_queues)
13649 {
13650 struct sk_buff *msg;
13651 void *hdr;
13652
13653 msg = nlmsg_new(100 + len, gfp);
13654 if (!msg)
13655 return;
13656
13657 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
13658 if (!hdr) {
13659 nlmsg_free(msg);
13660 return;
13661 }
13662
13663 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13664 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13665 nla_put(msg, NL80211_ATTR_FRAME, len, buf))
13666 goto nla_put_failure;
13667
13668 if (uapsd_queues >= 0) {
13669 struct nlattr *nla_wmm =
13670 nla_nest_start(msg, NL80211_ATTR_STA_WME);
13671 if (!nla_wmm)
13672 goto nla_put_failure;
13673
13674 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
13675 uapsd_queues))
13676 goto nla_put_failure;
13677
13678 nla_nest_end(msg, nla_wmm);
13679 }
13680
13681 genlmsg_end(msg, hdr);
13682
13683 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13684 NL80211_MCGRP_MLME, gfp);
13685 return;
13686
13687 nla_put_failure:
13688 genlmsg_cancel(msg, hdr);
13689 nlmsg_free(msg);
13690 }
13691
13692 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
13693 struct net_device *netdev, const u8 *buf,
13694 size_t len, gfp_t gfp)
13695 {
13696 nl80211_send_mlme_event(rdev, netdev, buf, len,
13697 NL80211_CMD_AUTHENTICATE, gfp, -1);
13698 }
13699
13700 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
13701 struct net_device *netdev, const u8 *buf,
13702 size_t len, gfp_t gfp, int uapsd_queues)
13703 {
13704 nl80211_send_mlme_event(rdev, netdev, buf, len,
13705 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues);
13706 }
13707
13708 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
13709 struct net_device *netdev, const u8 *buf,
13710 size_t len, gfp_t gfp)
13711 {
13712 nl80211_send_mlme_event(rdev, netdev, buf, len,
13713 NL80211_CMD_DEAUTHENTICATE, gfp, -1);
13714 }
13715
13716 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
13717 struct net_device *netdev, const u8 *buf,
13718 size_t len, gfp_t gfp)
13719 {
13720 nl80211_send_mlme_event(rdev, netdev, buf, len,
13721 NL80211_CMD_DISASSOCIATE, gfp, -1);
13722 }
13723
13724 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
13725 size_t len)
13726 {
13727 struct wireless_dev *wdev = dev->ieee80211_ptr;
13728 struct wiphy *wiphy = wdev->wiphy;
13729 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13730 const struct ieee80211_mgmt *mgmt = (void *)buf;
13731 u32 cmd;
13732
13733 if (WARN_ON(len < 2))
13734 return;
13735
13736 if (ieee80211_is_deauth(mgmt->frame_control))
13737 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
13738 else
13739 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
13740
13741 trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
13742 nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1);
13743 }
13744 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
13745
13746 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
13747 struct net_device *netdev, int cmd,
13748 const u8 *addr, gfp_t gfp)
13749 {
13750 struct sk_buff *msg;
13751 void *hdr;
13752
13753 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13754 if (!msg)
13755 return;
13756
13757 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
13758 if (!hdr) {
13759 nlmsg_free(msg);
13760 return;
13761 }
13762
13763 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13764 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13765 nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
13766 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
13767 goto nla_put_failure;
13768
13769 genlmsg_end(msg, hdr);
13770
13771 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13772 NL80211_MCGRP_MLME, gfp);
13773 return;
13774
13775 nla_put_failure:
13776 genlmsg_cancel(msg, hdr);
13777 nlmsg_free(msg);
13778 }
13779
13780 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
13781 struct net_device *netdev, const u8 *addr,
13782 gfp_t gfp)
13783 {
13784 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
13785 addr, gfp);
13786 }
13787
13788 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
13789 struct net_device *netdev, const u8 *addr,
13790 gfp_t gfp)
13791 {
13792 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
13793 addr, gfp);
13794 }
13795
13796 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
13797 struct net_device *netdev,
13798 struct cfg80211_connect_resp_params *cr,
13799 gfp_t gfp)
13800 {
13801 struct sk_buff *msg;
13802 void *hdr;
13803
13804 msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
13805 cr->fils_kek_len + cr->pmk_len +
13806 (cr->pmkid ? WLAN_PMKID_LEN : 0), gfp);
13807 if (!msg)
13808 return;
13809
13810 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
13811 if (!hdr) {
13812 nlmsg_free(msg);
13813 return;
13814 }
13815
13816 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13817 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13818 (cr->bssid &&
13819 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cr->bssid)) ||
13820 nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
13821 cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
13822 cr->status) ||
13823 (cr->status < 0 &&
13824 (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
13825 nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
13826 cr->timeout_reason))) ||
13827 (cr->req_ie &&
13828 nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
13829 (cr->resp_ie &&
13830 nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
13831 cr->resp_ie)) ||
13832 (cr->update_erp_next_seq_num &&
13833 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
13834 cr->fils_erp_next_seq_num)) ||
13835 (cr->status == WLAN_STATUS_SUCCESS &&
13836 ((cr->fils_kek &&
13837 nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils_kek_len,
13838 cr->fils_kek)) ||
13839 (cr->pmk &&
13840 nla_put(msg, NL80211_ATTR_PMK, cr->pmk_len, cr->pmk)) ||
13841 (cr->pmkid &&
13842 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->pmkid)))))
13843 goto nla_put_failure;
13844
13845 genlmsg_end(msg, hdr);
13846
13847 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13848 NL80211_MCGRP_MLME, gfp);
13849 return;
13850
13851 nla_put_failure:
13852 genlmsg_cancel(msg, hdr);
13853 nlmsg_free(msg);
13854 }
13855
13856 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
13857 struct net_device *netdev,
13858 struct cfg80211_roam_info *info, gfp_t gfp)
13859 {
13860 struct sk_buff *msg;
13861 void *hdr;
13862 const u8 *bssid = info->bss ? info->bss->bssid : info->bssid;
13863
13864 msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len, gfp);
13865 if (!msg)
13866 return;
13867
13868 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
13869 if (!hdr) {
13870 nlmsg_free(msg);
13871 return;
13872 }
13873
13874 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13875 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13876 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
13877 (info->req_ie &&
13878 nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
13879 info->req_ie)) ||
13880 (info->resp_ie &&
13881 nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
13882 info->resp_ie)))
13883 goto nla_put_failure;
13884
13885 genlmsg_end(msg, hdr);
13886
13887 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13888 NL80211_MCGRP_MLME, gfp);
13889 return;
13890
13891 nla_put_failure:
13892 genlmsg_cancel(msg, hdr);
13893 nlmsg_free(msg);
13894 }
13895
13896 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
13897 struct net_device *netdev, const u8 *bssid)
13898 {
13899 struct sk_buff *msg;
13900 void *hdr;
13901
13902 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13903 if (!msg)
13904 return;
13905
13906 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
13907 if (!hdr) {
13908 nlmsg_free(msg);
13909 return;
13910 }
13911
13912 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
13913 goto nla_put_failure;
13914
13915 genlmsg_end(msg, hdr);
13916
13917 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13918 NL80211_MCGRP_MLME, GFP_KERNEL);
13919 return;
13920
13921 nla_put_failure:
13922 genlmsg_cancel(msg, hdr);
13923 nlmsg_free(msg);
13924 }
13925
13926 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
13927 struct net_device *netdev, u16 reason,
13928 const u8 *ie, size_t ie_len, bool from_ap)
13929 {
13930 struct sk_buff *msg;
13931 void *hdr;
13932
13933 msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
13934 if (!msg)
13935 return;
13936
13937 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
13938 if (!hdr) {
13939 nlmsg_free(msg);
13940 return;
13941 }
13942
13943 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13944 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13945 (from_ap && reason &&
13946 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
13947 (from_ap &&
13948 nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
13949 (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
13950 goto nla_put_failure;
13951
13952 genlmsg_end(msg, hdr);
13953
13954 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13955 NL80211_MCGRP_MLME, GFP_KERNEL);
13956 return;
13957
13958 nla_put_failure:
13959 genlmsg_cancel(msg, hdr);
13960 nlmsg_free(msg);
13961 }
13962
13963 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
13964 struct net_device *netdev, const u8 *bssid,
13965 gfp_t gfp)
13966 {
13967 struct sk_buff *msg;
13968 void *hdr;
13969
13970 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13971 if (!msg)
13972 return;
13973
13974 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
13975 if (!hdr) {
13976 nlmsg_free(msg);
13977 return;
13978 }
13979
13980 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13981 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13982 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
13983 goto nla_put_failure;
13984
13985 genlmsg_end(msg, hdr);
13986
13987 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13988 NL80211_MCGRP_MLME, gfp);
13989 return;
13990
13991 nla_put_failure:
13992 genlmsg_cancel(msg, hdr);
13993 nlmsg_free(msg);
13994 }
13995
13996 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
13997 const u8* ie, u8 ie_len, gfp_t gfp)
13998 {
13999 struct wireless_dev *wdev = dev->ieee80211_ptr;
14000 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14001 struct sk_buff *msg;
14002 void *hdr;
14003
14004 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
14005 return;
14006
14007 trace_cfg80211_notify_new_peer_candidate(dev, addr);
14008
14009 msg = nlmsg_new(100 + ie_len, gfp);
14010 if (!msg)
14011 return;
14012
14013 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
14014 if (!hdr) {
14015 nlmsg_free(msg);
14016 return;
14017 }
14018
14019 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14020 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14021 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
14022 (ie_len && ie &&
14023 nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
14024 goto nla_put_failure;
14025
14026 genlmsg_end(msg, hdr);
14027
14028 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14029 NL80211_MCGRP_MLME, gfp);
14030 return;
14031
14032 nla_put_failure:
14033 genlmsg_cancel(msg, hdr);
14034 nlmsg_free(msg);
14035 }
14036 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
14037
14038 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
14039 struct net_device *netdev, const u8 *addr,
14040 enum nl80211_key_type key_type, int key_id,
14041 const u8 *tsc, gfp_t gfp)
14042 {
14043 struct sk_buff *msg;
14044 void *hdr;
14045
14046 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14047 if (!msg)
14048 return;
14049
14050 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
14051 if (!hdr) {
14052 nlmsg_free(msg);
14053 return;
14054 }
14055
14056 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14057 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14058 (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
14059 nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
14060 (key_id != -1 &&
14061 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
14062 (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
14063 goto nla_put_failure;
14064
14065 genlmsg_end(msg, hdr);
14066
14067 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14068 NL80211_MCGRP_MLME, gfp);
14069 return;
14070
14071 nla_put_failure:
14072 genlmsg_cancel(msg, hdr);
14073 nlmsg_free(msg);
14074 }
14075
14076 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
14077 struct ieee80211_channel *channel_before,
14078 struct ieee80211_channel *channel_after)
14079 {
14080 struct sk_buff *msg;
14081 void *hdr;
14082 struct nlattr *nl_freq;
14083
14084 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
14085 if (!msg)
14086 return;
14087
14088 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
14089 if (!hdr) {
14090 nlmsg_free(msg);
14091 return;
14092 }
14093
14094 /*
14095 * Since we are applying the beacon hint to a wiphy we know its
14096 * wiphy_idx is valid
14097 */
14098 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
14099 goto nla_put_failure;
14100
14101 /* Before */
14102 nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
14103 if (!nl_freq)
14104 goto nla_put_failure;
14105 if (nl80211_msg_put_channel(msg, channel_before, false))
14106 goto nla_put_failure;
14107 nla_nest_end(msg, nl_freq);
14108
14109 /* After */
14110 nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
14111 if (!nl_freq)
14112 goto nla_put_failure;
14113 if (nl80211_msg_put_channel(msg, channel_after, false))
14114 goto nla_put_failure;
14115 nla_nest_end(msg, nl_freq);
14116
14117 genlmsg_end(msg, hdr);
14118
14119 rcu_read_lock();
14120 genlmsg_multicast_allns(&nl80211_fam, msg, 0,
14121 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
14122 rcu_read_unlock();
14123
14124 return;
14125
14126 nla_put_failure:
14127 genlmsg_cancel(msg, hdr);
14128 nlmsg_free(msg);
14129 }
14130
14131 static void nl80211_send_remain_on_chan_event(
14132 int cmd, struct cfg80211_registered_device *rdev,
14133 struct wireless_dev *wdev, u64 cookie,
14134 struct ieee80211_channel *chan,
14135 unsigned int duration, gfp_t gfp)
14136 {
14137 struct sk_buff *msg;
14138 void *hdr;
14139
14140 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14141 if (!msg)
14142 return;
14143
14144 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14145 if (!hdr) {
14146 nlmsg_free(msg);
14147 return;
14148 }
14149
14150 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14151 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14152 wdev->netdev->ifindex)) ||
14153 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14154 NL80211_ATTR_PAD) ||
14155 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
14156 nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
14157 NL80211_CHAN_NO_HT) ||
14158 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14159 NL80211_ATTR_PAD))
14160 goto nla_put_failure;
14161
14162 if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
14163 nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
14164 goto nla_put_failure;
14165
14166 genlmsg_end(msg, hdr);
14167
14168 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14169 NL80211_MCGRP_MLME, gfp);
14170 return;
14171
14172 nla_put_failure:
14173 genlmsg_cancel(msg, hdr);
14174 nlmsg_free(msg);
14175 }
14176
14177 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
14178 struct ieee80211_channel *chan,
14179 unsigned int duration, gfp_t gfp)
14180 {
14181 struct wiphy *wiphy = wdev->wiphy;
14182 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14183
14184 trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
14185 nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
14186 rdev, wdev, cookie, chan,
14187 duration, gfp);
14188 }
14189 EXPORT_SYMBOL(cfg80211_ready_on_channel);
14190
14191 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
14192 struct ieee80211_channel *chan,
14193 gfp_t gfp)
14194 {
14195 struct wiphy *wiphy = wdev->wiphy;
14196 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14197
14198 trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
14199 nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
14200 rdev, wdev, cookie, chan, 0, gfp);
14201 }
14202 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
14203
14204 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
14205 struct station_info *sinfo, gfp_t gfp)
14206 {
14207 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
14208 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14209 struct sk_buff *msg;
14210
14211 trace_cfg80211_new_sta(dev, mac_addr, sinfo);
14212
14213 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14214 if (!msg)
14215 return;
14216
14217 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
14218 rdev, dev, mac_addr, sinfo) < 0) {
14219 nlmsg_free(msg);
14220 return;
14221 }
14222
14223 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14224 NL80211_MCGRP_MLME, gfp);
14225 }
14226 EXPORT_SYMBOL(cfg80211_new_sta);
14227
14228 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
14229 struct station_info *sinfo, gfp_t gfp)
14230 {
14231 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
14232 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14233 struct sk_buff *msg;
14234 struct station_info empty_sinfo = {};
14235
14236 if (!sinfo)
14237 sinfo = &empty_sinfo;
14238
14239 trace_cfg80211_del_sta(dev, mac_addr);
14240
14241 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14242 if (!msg)
14243 return;
14244
14245 if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
14246 rdev, dev, mac_addr, sinfo) < 0) {
14247 nlmsg_free(msg);
14248 return;
14249 }
14250
14251 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14252 NL80211_MCGRP_MLME, gfp);
14253 }
14254 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
14255
14256 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
14257 enum nl80211_connect_failed_reason reason,
14258 gfp_t gfp)
14259 {
14260 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
14261 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14262 struct sk_buff *msg;
14263 void *hdr;
14264
14265 msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
14266 if (!msg)
14267 return;
14268
14269 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
14270 if (!hdr) {
14271 nlmsg_free(msg);
14272 return;
14273 }
14274
14275 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14276 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
14277 nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
14278 goto nla_put_failure;
14279
14280 genlmsg_end(msg, hdr);
14281
14282 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14283 NL80211_MCGRP_MLME, gfp);
14284 return;
14285
14286 nla_put_failure:
14287 genlmsg_cancel(msg, hdr);
14288 nlmsg_free(msg);
14289 }
14290 EXPORT_SYMBOL(cfg80211_conn_failed);
14291
14292 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
14293 const u8 *addr, gfp_t gfp)
14294 {
14295 struct wireless_dev *wdev = dev->ieee80211_ptr;
14296 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14297 struct sk_buff *msg;
14298 void *hdr;
14299 u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid);
14300
14301 if (!nlportid)
14302 return false;
14303
14304 msg = nlmsg_new(100, gfp);
14305 if (!msg)
14306 return true;
14307
14308 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14309 if (!hdr) {
14310 nlmsg_free(msg);
14311 return true;
14312 }
14313
14314 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14315 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14316 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
14317 goto nla_put_failure;
14318
14319 genlmsg_end(msg, hdr);
14320 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
14321 return true;
14322
14323 nla_put_failure:
14324 genlmsg_cancel(msg, hdr);
14325 nlmsg_free(msg);
14326 return true;
14327 }
14328
14329 bool cfg80211_rx_spurious_frame(struct net_device *dev,
14330 const u8 *addr, gfp_t gfp)
14331 {
14332 struct wireless_dev *wdev = dev->ieee80211_ptr;
14333 bool ret;
14334
14335 trace_cfg80211_rx_spurious_frame(dev, addr);
14336
14337 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
14338 wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
14339 trace_cfg80211_return_bool(false);
14340 return false;
14341 }
14342 ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
14343 addr, gfp);
14344 trace_cfg80211_return_bool(ret);
14345 return ret;
14346 }
14347 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
14348
14349 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
14350 const u8 *addr, gfp_t gfp)
14351 {
14352 struct wireless_dev *wdev = dev->ieee80211_ptr;
14353 bool ret;
14354
14355 trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
14356
14357 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
14358 wdev->iftype != NL80211_IFTYPE_P2P_GO &&
14359 wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
14360 trace_cfg80211_return_bool(false);
14361 return false;
14362 }
14363 ret = __nl80211_unexpected_frame(dev,
14364 NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
14365 addr, gfp);
14366 trace_cfg80211_return_bool(ret);
14367 return ret;
14368 }
14369 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
14370
14371 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
14372 struct wireless_dev *wdev, u32 nlportid,
14373 int freq, int sig_dbm,
14374 const u8 *buf, size_t len, u32 flags, gfp_t gfp)
14375 {
14376 struct net_device *netdev = wdev->netdev;
14377 struct sk_buff *msg;
14378 void *hdr;
14379
14380 msg = nlmsg_new(100 + len, gfp);
14381 if (!msg)
14382 return -ENOMEM;
14383
14384 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
14385 if (!hdr) {
14386 nlmsg_free(msg);
14387 return -ENOMEM;
14388 }
14389
14390 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14391 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14392 netdev->ifindex)) ||
14393 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14394 NL80211_ATTR_PAD) ||
14395 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
14396 (sig_dbm &&
14397 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
14398 nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
14399 (flags &&
14400 nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
14401 goto nla_put_failure;
14402
14403 genlmsg_end(msg, hdr);
14404
14405 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
14406
14407 nla_put_failure:
14408 genlmsg_cancel(msg, hdr);
14409 nlmsg_free(msg);
14410 return -ENOBUFS;
14411 }
14412
14413 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
14414 const u8 *buf, size_t len, bool ack, gfp_t gfp)
14415 {
14416 struct wiphy *wiphy = wdev->wiphy;
14417 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14418 struct net_device *netdev = wdev->netdev;
14419 struct sk_buff *msg;
14420 void *hdr;
14421
14422 trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
14423
14424 msg = nlmsg_new(100 + len, gfp);
14425 if (!msg)
14426 return;
14427
14428 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
14429 if (!hdr) {
14430 nlmsg_free(msg);
14431 return;
14432 }
14433
14434 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14435 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14436 netdev->ifindex)) ||
14437 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14438 NL80211_ATTR_PAD) ||
14439 nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
14440 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14441 NL80211_ATTR_PAD) ||
14442 (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
14443 goto nla_put_failure;
14444
14445 genlmsg_end(msg, hdr);
14446
14447 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14448 NL80211_MCGRP_MLME, gfp);
14449 return;
14450
14451 nla_put_failure:
14452 genlmsg_cancel(msg, hdr);
14453 nlmsg_free(msg);
14454 }
14455 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
14456
14457 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
14458 const char *mac, gfp_t gfp)
14459 {
14460 struct wireless_dev *wdev = dev->ieee80211_ptr;
14461 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14462 struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14463 void **cb;
14464
14465 if (!msg)
14466 return NULL;
14467
14468 cb = (void **)msg->cb;
14469
14470 cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
14471 if (!cb[0]) {
14472 nlmsg_free(msg);
14473 return NULL;
14474 }
14475
14476 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14477 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
14478 goto nla_put_failure;
14479
14480 if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
14481 goto nla_put_failure;
14482
14483 cb[1] = nla_nest_start(msg, NL80211_ATTR_CQM);
14484 if (!cb[1])
14485 goto nla_put_failure;
14486
14487 cb[2] = rdev;
14488
14489 return msg;
14490 nla_put_failure:
14491 nlmsg_free(msg);
14492 return NULL;
14493 }
14494
14495 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
14496 {
14497 void **cb = (void **)msg->cb;
14498 struct cfg80211_registered_device *rdev = cb[2];
14499
14500 nla_nest_end(msg, cb[1]);
14501 genlmsg_end(msg, cb[0]);
14502
14503 memset(msg->cb, 0, sizeof(msg->cb));
14504
14505 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14506 NL80211_MCGRP_MLME, gfp);
14507 }
14508
14509 void cfg80211_cqm_rssi_notify(struct net_device *dev,
14510 enum nl80211_cqm_rssi_threshold_event rssi_event,
14511 s32 rssi_level, gfp_t gfp)
14512 {
14513 struct sk_buff *msg;
14514 struct wireless_dev *wdev = dev->ieee80211_ptr;
14515 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14516
14517 trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
14518
14519 if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
14520 rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
14521 return;
14522
14523 if (wdev->cqm_config) {
14524 wdev->cqm_config->last_rssi_event_value = rssi_level;
14525
14526 cfg80211_cqm_rssi_update(rdev, dev);
14527
14528 if (rssi_level == 0)
14529 rssi_level = wdev->cqm_config->last_rssi_event_value;
14530 }
14531
14532 msg = cfg80211_prepare_cqm(dev, NULL, gfp);
14533 if (!msg)
14534 return;
14535
14536 if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
14537 rssi_event))
14538 goto nla_put_failure;
14539
14540 if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
14541 rssi_level))
14542 goto nla_put_failure;
14543
14544 cfg80211_send_cqm(msg, gfp);
14545
14546 return;
14547
14548 nla_put_failure:
14549 nlmsg_free(msg);
14550 }
14551 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
14552
14553 void cfg80211_cqm_txe_notify(struct net_device *dev,
14554 const u8 *peer, u32 num_packets,
14555 u32 rate, u32 intvl, gfp_t gfp)
14556 {
14557 struct sk_buff *msg;
14558
14559 msg = cfg80211_prepare_cqm(dev, peer, gfp);
14560 if (!msg)
14561 return;
14562
14563 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
14564 goto nla_put_failure;
14565
14566 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
14567 goto nla_put_failure;
14568
14569 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
14570 goto nla_put_failure;
14571
14572 cfg80211_send_cqm(msg, gfp);
14573 return;
14574
14575 nla_put_failure:
14576 nlmsg_free(msg);
14577 }
14578 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
14579
14580 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
14581 const u8 *peer, u32 num_packets, gfp_t gfp)
14582 {
14583 struct sk_buff *msg;
14584
14585 trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
14586
14587 msg = cfg80211_prepare_cqm(dev, peer, gfp);
14588 if (!msg)
14589 return;
14590
14591 if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
14592 goto nla_put_failure;
14593
14594 cfg80211_send_cqm(msg, gfp);
14595 return;
14596
14597 nla_put_failure:
14598 nlmsg_free(msg);
14599 }
14600 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
14601
14602 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
14603 {
14604 struct sk_buff *msg;
14605
14606 msg = cfg80211_prepare_cqm(dev, NULL, gfp);
14607 if (!msg)
14608 return;
14609
14610 if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
14611 goto nla_put_failure;
14612
14613 cfg80211_send_cqm(msg, gfp);
14614 return;
14615
14616 nla_put_failure:
14617 nlmsg_free(msg);
14618 }
14619 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
14620
14621 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
14622 struct net_device *netdev, const u8 *bssid,
14623 const u8 *replay_ctr, gfp_t gfp)
14624 {
14625 struct sk_buff *msg;
14626 struct nlattr *rekey_attr;
14627 void *hdr;
14628
14629 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14630 if (!msg)
14631 return;
14632
14633 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
14634 if (!hdr) {
14635 nlmsg_free(msg);
14636 return;
14637 }
14638
14639 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14640 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14641 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
14642 goto nla_put_failure;
14643
14644 rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
14645 if (!rekey_attr)
14646 goto nla_put_failure;
14647
14648 if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
14649 NL80211_REPLAY_CTR_LEN, replay_ctr))
14650 goto nla_put_failure;
14651
14652 nla_nest_end(msg, rekey_attr);
14653
14654 genlmsg_end(msg, hdr);
14655
14656 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14657 NL80211_MCGRP_MLME, gfp);
14658 return;
14659
14660 nla_put_failure:
14661 genlmsg_cancel(msg, hdr);
14662 nlmsg_free(msg);
14663 }
14664
14665 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
14666 const u8 *replay_ctr, gfp_t gfp)
14667 {
14668 struct wireless_dev *wdev = dev->ieee80211_ptr;
14669 struct wiphy *wiphy = wdev->wiphy;
14670 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14671
14672 trace_cfg80211_gtk_rekey_notify(dev, bssid);
14673 nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
14674 }
14675 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
14676
14677 static void
14678 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
14679 struct net_device *netdev, int index,
14680 const u8 *bssid, bool preauth, gfp_t gfp)
14681 {
14682 struct sk_buff *msg;
14683 struct nlattr *attr;
14684 void *hdr;
14685
14686 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14687 if (!msg)
14688 return;
14689
14690 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
14691 if (!hdr) {
14692 nlmsg_free(msg);
14693 return;
14694 }
14695
14696 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14697 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
14698 goto nla_put_failure;
14699
14700 attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
14701 if (!attr)
14702 goto nla_put_failure;
14703
14704 if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
14705 nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
14706 (preauth &&
14707 nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
14708 goto nla_put_failure;
14709
14710 nla_nest_end(msg, attr);
14711
14712 genlmsg_end(msg, hdr);
14713
14714 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14715 NL80211_MCGRP_MLME, gfp);
14716 return;
14717
14718 nla_put_failure:
14719 genlmsg_cancel(msg, hdr);
14720 nlmsg_free(msg);
14721 }
14722
14723 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
14724 const u8 *bssid, bool preauth, gfp_t gfp)
14725 {
14726 struct wireless_dev *wdev = dev->ieee80211_ptr;
14727 struct wiphy *wiphy = wdev->wiphy;
14728 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14729
14730 trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
14731 nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
14732 }
14733 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
14734
14735 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
14736 struct net_device *netdev,
14737 struct cfg80211_chan_def *chandef,
14738 gfp_t gfp,
14739 enum nl80211_commands notif,
14740 u8 count)
14741 {
14742 struct sk_buff *msg;
14743 void *hdr;
14744
14745 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14746 if (!msg)
14747 return;
14748
14749 hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
14750 if (!hdr) {
14751 nlmsg_free(msg);
14752 return;
14753 }
14754
14755 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
14756 goto nla_put_failure;
14757
14758 if (nl80211_send_chandef(msg, chandef))
14759 goto nla_put_failure;
14760
14761 if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) &&
14762 (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)))
14763 goto nla_put_failure;
14764
14765 genlmsg_end(msg, hdr);
14766
14767 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14768 NL80211_MCGRP_MLME, gfp);
14769 return;
14770
14771 nla_put_failure:
14772 genlmsg_cancel(msg, hdr);
14773 nlmsg_free(msg);
14774 }
14775
14776 void cfg80211_ch_switch_notify(struct net_device *dev,
14777 struct cfg80211_chan_def *chandef)
14778 {
14779 struct wireless_dev *wdev = dev->ieee80211_ptr;
14780 struct wiphy *wiphy = wdev->wiphy;
14781 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14782
14783 ASSERT_WDEV_LOCK(wdev);
14784
14785 trace_cfg80211_ch_switch_notify(dev, chandef);
14786
14787 wdev->chandef = *chandef;
14788 wdev->preset_chandef = *chandef;
14789 nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
14790 NL80211_CMD_CH_SWITCH_NOTIFY, 0);
14791 }
14792 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
14793
14794 void cfg80211_ch_switch_started_notify(struct net_device *dev,
14795 struct cfg80211_chan_def *chandef,
14796 u8 count)
14797 {
14798 struct wireless_dev *wdev = dev->ieee80211_ptr;
14799 struct wiphy *wiphy = wdev->wiphy;
14800 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14801
14802 trace_cfg80211_ch_switch_started_notify(dev, chandef);
14803
14804 nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
14805 NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count);
14806 }
14807 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
14808
14809 void
14810 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
14811 const struct cfg80211_chan_def *chandef,
14812 enum nl80211_radar_event event,
14813 struct net_device *netdev, gfp_t gfp)
14814 {
14815 struct sk_buff *msg;
14816 void *hdr;
14817
14818 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14819 if (!msg)
14820 return;
14821
14822 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
14823 if (!hdr) {
14824 nlmsg_free(msg);
14825 return;
14826 }
14827
14828 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
14829 goto nla_put_failure;
14830
14831 /* NOP and radar events don't need a netdev parameter */
14832 if (netdev) {
14833 struct wireless_dev *wdev = netdev->ieee80211_ptr;
14834
14835 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14836 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14837 NL80211_ATTR_PAD))
14838 goto nla_put_failure;
14839 }
14840
14841 if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
14842 goto nla_put_failure;
14843
14844 if (nl80211_send_chandef(msg, chandef))
14845 goto nla_put_failure;
14846
14847 genlmsg_end(msg, hdr);
14848
14849 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14850 NL80211_MCGRP_MLME, gfp);
14851 return;
14852
14853 nla_put_failure:
14854 genlmsg_cancel(msg, hdr);
14855 nlmsg_free(msg);
14856 }
14857
14858 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
14859 u64 cookie, bool acked, gfp_t gfp)
14860 {
14861 struct wireless_dev *wdev = dev->ieee80211_ptr;
14862 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14863 struct sk_buff *msg;
14864 void *hdr;
14865
14866 trace_cfg80211_probe_status(dev, addr, cookie, acked);
14867
14868 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14869
14870 if (!msg)
14871 return;
14872
14873 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
14874 if (!hdr) {
14875 nlmsg_free(msg);
14876 return;
14877 }
14878
14879 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14880 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14881 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
14882 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14883 NL80211_ATTR_PAD) ||
14884 (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
14885 goto nla_put_failure;
14886
14887 genlmsg_end(msg, hdr);
14888
14889 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14890 NL80211_MCGRP_MLME, gfp);
14891 return;
14892
14893 nla_put_failure:
14894 genlmsg_cancel(msg, hdr);
14895 nlmsg_free(msg);
14896 }
14897 EXPORT_SYMBOL(cfg80211_probe_status);
14898
14899 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
14900 const u8 *frame, size_t len,
14901 int freq, int sig_dbm)
14902 {
14903 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14904 struct sk_buff *msg;
14905 void *hdr;
14906 struct cfg80211_beacon_registration *reg;
14907
14908 trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
14909
14910 spin_lock_bh(&rdev->beacon_registrations_lock);
14911 list_for_each_entry(reg, &rdev->beacon_registrations, list) {
14912 msg = nlmsg_new(len + 100, GFP_ATOMIC);
14913 if (!msg) {
14914 spin_unlock_bh(&rdev->beacon_registrations_lock);
14915 return;
14916 }
14917
14918 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
14919 if (!hdr)
14920 goto nla_put_failure;
14921
14922 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14923 (freq &&
14924 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
14925 (sig_dbm &&
14926 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
14927 nla_put(msg, NL80211_ATTR_FRAME, len, frame))
14928 goto nla_put_failure;
14929
14930 genlmsg_end(msg, hdr);
14931
14932 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
14933 }
14934 spin_unlock_bh(&rdev->beacon_registrations_lock);
14935 return;
14936
14937 nla_put_failure:
14938 spin_unlock_bh(&rdev->beacon_registrations_lock);
14939 if (hdr)
14940 genlmsg_cancel(msg, hdr);
14941 nlmsg_free(msg);
14942 }
14943 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
14944
14945 #ifdef CONFIG_PM
14946 static int cfg80211_net_detect_results(struct sk_buff *msg,
14947 struct cfg80211_wowlan_wakeup *wakeup)
14948 {
14949 struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
14950 struct nlattr *nl_results, *nl_match, *nl_freqs;
14951 int i, j;
14952
14953 nl_results = nla_nest_start(
14954 msg, NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
14955 if (!nl_results)
14956 return -EMSGSIZE;
14957
14958 for (i = 0; i < nd->n_matches; i++) {
14959 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
14960
14961 nl_match = nla_nest_start(msg, i);
14962 if (!nl_match)
14963 break;
14964
14965 /* The SSID attribute is optional in nl80211, but for
14966 * simplicity reasons it's always present in the
14967 * cfg80211 structure. If a driver can't pass the
14968 * SSID, that needs to be changed. A zero length SSID
14969 * is still a valid SSID (wildcard), so it cannot be
14970 * used for this purpose.
14971 */
14972 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
14973 match->ssid.ssid)) {
14974 nla_nest_cancel(msg, nl_match);
14975 goto out;
14976 }
14977
14978 if (match->n_channels) {
14979 nl_freqs = nla_nest_start(
14980 msg, NL80211_ATTR_SCAN_FREQUENCIES);
14981 if (!nl_freqs) {
14982 nla_nest_cancel(msg, nl_match);
14983 goto out;
14984 }
14985
14986 for (j = 0; j < match->n_channels; j++) {
14987 if (nla_put_u32(msg, j, match->channels[j])) {
14988 nla_nest_cancel(msg, nl_freqs);
14989 nla_nest_cancel(msg, nl_match);
14990 goto out;
14991 }
14992 }
14993
14994 nla_nest_end(msg, nl_freqs);
14995 }
14996
14997 nla_nest_end(msg, nl_match);
14998 }
14999
15000 out:
15001 nla_nest_end(msg, nl_results);
15002 return 0;
15003 }
15004
15005 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
15006 struct cfg80211_wowlan_wakeup *wakeup,
15007 gfp_t gfp)
15008 {
15009 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15010 struct sk_buff *msg;
15011 void *hdr;
15012 int size = 200;
15013
15014 trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
15015
15016 if (wakeup)
15017 size += wakeup->packet_present_len;
15018
15019 msg = nlmsg_new(size, gfp);
15020 if (!msg)
15021 return;
15022
15023 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
15024 if (!hdr)
15025 goto free_msg;
15026
15027 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15028 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15029 NL80211_ATTR_PAD))
15030 goto free_msg;
15031
15032 if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15033 wdev->netdev->ifindex))
15034 goto free_msg;
15035
15036 if (wakeup) {
15037 struct nlattr *reasons;
15038
15039 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
15040 if (!reasons)
15041 goto free_msg;
15042
15043 if (wakeup->disconnect &&
15044 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
15045 goto free_msg;
15046 if (wakeup->magic_pkt &&
15047 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
15048 goto free_msg;
15049 if (wakeup->gtk_rekey_failure &&
15050 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
15051 goto free_msg;
15052 if (wakeup->eap_identity_req &&
15053 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
15054 goto free_msg;
15055 if (wakeup->four_way_handshake &&
15056 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
15057 goto free_msg;
15058 if (wakeup->rfkill_release &&
15059 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
15060 goto free_msg;
15061
15062 if (wakeup->pattern_idx >= 0 &&
15063 nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
15064 wakeup->pattern_idx))
15065 goto free_msg;
15066
15067 if (wakeup->tcp_match &&
15068 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
15069 goto free_msg;
15070
15071 if (wakeup->tcp_connlost &&
15072 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
15073 goto free_msg;
15074
15075 if (wakeup->tcp_nomoretokens &&
15076 nla_put_flag(msg,
15077 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
15078 goto free_msg;
15079
15080 if (wakeup->packet) {
15081 u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
15082 u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
15083
15084 if (!wakeup->packet_80211) {
15085 pkt_attr =
15086 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
15087 len_attr =
15088 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
15089 }
15090
15091 if (wakeup->packet_len &&
15092 nla_put_u32(msg, len_attr, wakeup->packet_len))
15093 goto free_msg;
15094
15095 if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
15096 wakeup->packet))
15097 goto free_msg;
15098 }
15099
15100 if (wakeup->net_detect &&
15101 cfg80211_net_detect_results(msg, wakeup))
15102 goto free_msg;
15103
15104 nla_nest_end(msg, reasons);
15105 }
15106
15107 genlmsg_end(msg, hdr);
15108
15109 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15110 NL80211_MCGRP_MLME, gfp);
15111 return;
15112
15113 free_msg:
15114 nlmsg_free(msg);
15115 }
15116 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
15117 #endif
15118
15119 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
15120 enum nl80211_tdls_operation oper,
15121 u16 reason_code, gfp_t gfp)
15122 {
15123 struct wireless_dev *wdev = dev->ieee80211_ptr;
15124 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15125 struct sk_buff *msg;
15126 void *hdr;
15127
15128 trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
15129 reason_code);
15130
15131 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15132 if (!msg)
15133 return;
15134
15135 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
15136 if (!hdr) {
15137 nlmsg_free(msg);
15138 return;
15139 }
15140
15141 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15142 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15143 nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
15144 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
15145 (reason_code > 0 &&
15146 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
15147 goto nla_put_failure;
15148
15149 genlmsg_end(msg, hdr);
15150
15151 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15152 NL80211_MCGRP_MLME, gfp);
15153 return;
15154
15155 nla_put_failure:
15156 genlmsg_cancel(msg, hdr);
15157 nlmsg_free(msg);
15158 }
15159 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
15160
15161 static int nl80211_netlink_notify(struct notifier_block * nb,
15162 unsigned long state,
15163 void *_notify)
15164 {
15165 struct netlink_notify *notify = _notify;
15166 struct cfg80211_registered_device *rdev;
15167 struct wireless_dev *wdev;
15168 struct cfg80211_beacon_registration *reg, *tmp;
15169
15170 if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
15171 return NOTIFY_DONE;
15172
15173 rcu_read_lock();
15174
15175 list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
15176 struct cfg80211_sched_scan_request *sched_scan_req;
15177
15178 list_for_each_entry_rcu(sched_scan_req,
15179 &rdev->sched_scan_req_list,
15180 list) {
15181 if (sched_scan_req->owner_nlportid == notify->portid) {
15182 sched_scan_req->nl_owner_dead = true;
15183 schedule_work(&rdev->sched_scan_stop_wk);
15184 }
15185 }
15186
15187 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
15188 cfg80211_mlme_unregister_socket(wdev, notify->portid);
15189
15190 if (wdev->owner_nlportid == notify->portid) {
15191 wdev->nl_owner_dead = true;
15192 schedule_work(&rdev->destroy_work);
15193 } else if (wdev->conn_owner_nlportid == notify->portid) {
15194 schedule_work(&wdev->disconnect_wk);
15195 }
15196 }
15197
15198 spin_lock_bh(&rdev->beacon_registrations_lock);
15199 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
15200 list) {
15201 if (reg->nlportid == notify->portid) {
15202 list_del(&reg->list);
15203 kfree(reg);
15204 break;
15205 }
15206 }
15207 spin_unlock_bh(&rdev->beacon_registrations_lock);
15208 }
15209
15210 rcu_read_unlock();
15211
15212 /*
15213 * It is possible that the user space process that is controlling the
15214 * indoor setting disappeared, so notify the regulatory core.
15215 */
15216 regulatory_netlink_notify(notify->portid);
15217 return NOTIFY_OK;
15218 }
15219
15220 static struct notifier_block nl80211_netlink_notifier = {
15221 .notifier_call = nl80211_netlink_notify,
15222 };
15223
15224 void cfg80211_ft_event(struct net_device *netdev,
15225 struct cfg80211_ft_event_params *ft_event)
15226 {
15227 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
15228 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15229 struct sk_buff *msg;
15230 void *hdr;
15231
15232 trace_cfg80211_ft_event(wiphy, netdev, ft_event);
15233
15234 if (!ft_event->target_ap)
15235 return;
15236
15237 msg = nlmsg_new(100 + ft_event->ric_ies_len, GFP_KERNEL);
15238 if (!msg)
15239 return;
15240
15241 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
15242 if (!hdr)
15243 goto out;
15244
15245 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15246 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15247 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
15248 goto out;
15249
15250 if (ft_event->ies &&
15251 nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
15252 goto out;
15253 if (ft_event->ric_ies &&
15254 nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
15255 ft_event->ric_ies))
15256 goto out;
15257
15258 genlmsg_end(msg, hdr);
15259
15260 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15261 NL80211_MCGRP_MLME, GFP_KERNEL);
15262 return;
15263 out:
15264 nlmsg_free(msg);
15265 }
15266 EXPORT_SYMBOL(cfg80211_ft_event);
15267
15268 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
15269 {
15270 struct cfg80211_registered_device *rdev;
15271 struct sk_buff *msg;
15272 void *hdr;
15273 u32 nlportid;
15274
15275 rdev = wiphy_to_rdev(wdev->wiphy);
15276 if (!rdev->crit_proto_nlportid)
15277 return;
15278
15279 nlportid = rdev->crit_proto_nlportid;
15280 rdev->crit_proto_nlportid = 0;
15281
15282 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15283 if (!msg)
15284 return;
15285
15286 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
15287 if (!hdr)
15288 goto nla_put_failure;
15289
15290 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15291 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15292 NL80211_ATTR_PAD))
15293 goto nla_put_failure;
15294
15295 genlmsg_end(msg, hdr);
15296
15297 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
15298 return;
15299
15300 nla_put_failure:
15301 if (hdr)
15302 genlmsg_cancel(msg, hdr);
15303 nlmsg_free(msg);
15304 }
15305 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
15306
15307 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
15308 {
15309 struct wiphy *wiphy = wdev->wiphy;
15310 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15311 struct sk_buff *msg;
15312 void *hdr;
15313
15314 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15315 if (!msg)
15316 return;
15317
15318 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
15319 if (!hdr)
15320 goto out;
15321
15322 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15323 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
15324 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15325 NL80211_ATTR_PAD))
15326 goto out;
15327
15328 genlmsg_end(msg, hdr);
15329
15330 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
15331 NL80211_MCGRP_MLME, GFP_KERNEL);
15332 return;
15333 out:
15334 nlmsg_free(msg);
15335 }
15336
15337 /* initialisation/exit functions */
15338
15339 int __init nl80211_init(void)
15340 {
15341 int err;
15342
15343 err = genl_register_family(&nl80211_fam);
15344 if (err)
15345 return err;
15346
15347 err = netlink_register_notifier(&nl80211_netlink_notifier);
15348 if (err)
15349 goto err_out;
15350
15351 return 0;
15352 err_out:
15353 genl_unregister_family(&nl80211_fam);
15354 return err;
15355 }
15356
15357 void nl80211_exit(void)
15358 {
15359 netlink_unregister_notifier(&nl80211_netlink_notifier);
15360 genl_unregister_family(&nl80211_fam);
15361 }
ubuntu-bionic-kernel mirror