?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
x86/speculation/mds: Fix documentation typo
[linux/fpc-iii.git] / net / wireless / nl80211.c
blob46e9812d13c02afa92d6ab70ca111ed282568cd9
1 /*
2 * This is the new netlink-based wireless configuration interface.
3 *
4 * Copyright 2006-2010 Johannes Berg <johannes@sipsolutions.net>
5 * Copyright 2013-2014 Intel Mobile Communications GmbH
6 * Copyright 2015-2017 Intel Deutschland GmbH
7 */
8
9 #include <linux/if.h>
10 #include <linux/module.h>
11 #include <linux/err.h>
12 #include <linux/slab.h>
13 #include <linux/list.h>
14 #include <linux/if_ether.h>
15 #include <linux/ieee80211.h>
16 #include <linux/nl80211.h>
17 #include <linux/rtnetlink.h>
18 #include <linux/netlink.h>
19 #include <linux/nospec.h>
20 #include <linux/etherdevice.h>
21 #include <net/net_namespace.h>
22 #include <net/genetlink.h>
23 #include <net/cfg80211.h>
24 #include <net/sock.h>
25 #include <net/inet_connection_sock.h>
26 #include "core.h"
27 #include "nl80211.h"
28 #include "reg.h"
29 #include "rdev-ops.h"
30
31 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
32 struct genl_info *info,
33 struct cfg80211_crypto_settings *settings,
34 int cipher_limit);
35
36 /* the netlink family */
37 static struct genl_family nl80211_fam;
38
39 /* multicast groups */
40 enum nl80211_multicast_groups {
41 NL80211_MCGRP_CONFIG,
42 NL80211_MCGRP_SCAN,
43 NL80211_MCGRP_REGULATORY,
44 NL80211_MCGRP_MLME,
45 NL80211_MCGRP_VENDOR,
46 NL80211_MCGRP_NAN,
47 NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
48 };
49
50 static const struct genl_multicast_group nl80211_mcgrps[] = {
51 [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
52 [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
53 [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
54 [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
55 [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
56 [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
57 #ifdef CONFIG_NL80211_TESTMODE
58 [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
59 #endif
60 };
61
62 /* returns ERR_PTR values */
63 static struct wireless_dev *
64 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
65 {
66 struct cfg80211_registered_device *rdev;
67 struct wireless_dev *result = NULL;
68 bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
69 bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
70 u64 wdev_id;
71 int wiphy_idx = -1;
72 int ifidx = -1;
73
74 ASSERT_RTNL();
75
76 if (!have_ifidx && !have_wdev_id)
77 return ERR_PTR(-EINVAL);
78
79 if (have_ifidx)
80 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
81 if (have_wdev_id) {
82 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
83 wiphy_idx = wdev_id >> 32;
84 }
85
86 list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
87 struct wireless_dev *wdev;
88
89 if (wiphy_net(&rdev->wiphy) != netns)
90 continue;
91
92 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
93 continue;
94
95 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
96 if (have_ifidx && wdev->netdev &&
97 wdev->netdev->ifindex == ifidx) {
98 result = wdev;
99 break;
100 }
101 if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
102 result = wdev;
103 break;
104 }
105 }
106
107 if (result)
108 break;
109 }
110
111 if (result)
112 return result;
113 return ERR_PTR(-ENODEV);
114 }
115
116 static struct cfg80211_registered_device *
117 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
118 {
119 struct cfg80211_registered_device *rdev = NULL, *tmp;
120 struct net_device *netdev;
121
122 ASSERT_RTNL();
123
124 if (!attrs[NL80211_ATTR_WIPHY] &&
125 !attrs[NL80211_ATTR_IFINDEX] &&
126 !attrs[NL80211_ATTR_WDEV])
127 return ERR_PTR(-EINVAL);
128
129 if (attrs[NL80211_ATTR_WIPHY])
130 rdev = cfg80211_rdev_by_wiphy_idx(
131 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
132
133 if (attrs[NL80211_ATTR_WDEV]) {
134 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
135 struct wireless_dev *wdev;
136 bool found = false;
137
138 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
139 if (tmp) {
140 /* make sure wdev exists */
141 list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
142 if (wdev->identifier != (u32)wdev_id)
143 continue;
144 found = true;
145 break;
146 }
147
148 if (!found)
149 tmp = NULL;
150
151 if (rdev && tmp != rdev)
152 return ERR_PTR(-EINVAL);
153 rdev = tmp;
154 }
155 }
156
157 if (attrs[NL80211_ATTR_IFINDEX]) {
158 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
159
160 netdev = __dev_get_by_index(netns, ifindex);
161 if (netdev) {
162 if (netdev->ieee80211_ptr)
163 tmp = wiphy_to_rdev(
164 netdev->ieee80211_ptr->wiphy);
165 else
166 tmp = NULL;
167
168 /* not wireless device -- return error */
169 if (!tmp)
170 return ERR_PTR(-EINVAL);
171
172 /* mismatch -- return error */
173 if (rdev && tmp != rdev)
174 return ERR_PTR(-EINVAL);
175
176 rdev = tmp;
177 }
178 }
179
180 if (!rdev)
181 return ERR_PTR(-ENODEV);
182
183 if (netns != wiphy_net(&rdev->wiphy))
184 return ERR_PTR(-ENODEV);
185
186 return rdev;
187 }
188
189 /*
190 * This function returns a pointer to the driver
191 * that the genl_info item that is passed refers to.
192 *
193 * The result of this can be a PTR_ERR and hence must
194 * be checked with IS_ERR() for errors.
195 */
196 static struct cfg80211_registered_device *
197 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
198 {
199 return __cfg80211_rdev_from_attrs(netns, info->attrs);
200 }
201
202 /* policy for the attributes */
203 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
204 [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
205 [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
206 .len = 20-1 },
207 [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
208
209 [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
210 [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
211 [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
212 [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
213 [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
214
215 [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
216 [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
217 [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
218 [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
219 [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
220 [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
221
222 [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
223 [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
224 [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
225
226 [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
227 [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
228
229 [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
230 [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
231 .len = WLAN_MAX_KEY_LEN },
232 [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
233 [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
234 [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
235 [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
236 [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
237
238 [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
239 [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
240 [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
241 .len = IEEE80211_MAX_DATA_LEN },
242 [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
243 .len = IEEE80211_MAX_DATA_LEN },
244 [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
245 [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
246 [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
247 [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
248 .len = NL80211_MAX_SUPP_RATES },
249 [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
250 [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
251 [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
252 [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
253 .len = IEEE80211_MAX_MESH_ID_LEN },
254 [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
255
256 [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
257 [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
258
259 [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
260 [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
261 [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
262 [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
263 .len = NL80211_MAX_SUPP_RATES },
264 [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
265
266 [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
267 [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
268
269 [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
270
271 [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
272 [NL80211_ATTR_IE] = { .type = NLA_BINARY,
273 .len = IEEE80211_MAX_DATA_LEN },
274 [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
275 [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
276
277 [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
278 .len = IEEE80211_MAX_SSID_LEN },
279 [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
280 [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
281 [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
282 [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
283 [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
284 [NL80211_ATTR_STA_FLAGS2] = {
285 .len = sizeof(struct nl80211_sta_flag_update),
286 },
287 [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
288 [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
289 [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
290 [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
291 [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
292 [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
293 [NL80211_ATTR_PID] = { .type = NLA_U32 },
294 [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
295 [NL80211_ATTR_PMKID] = { .len = WLAN_PMKID_LEN },
296 [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
297 [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
298 [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
299 [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
300 .len = IEEE80211_MAX_DATA_LEN },
301 [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
302 [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
303 [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
304 [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
305 [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
306 [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
307 [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
308 [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
309 [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
310 [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
311 [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
312 [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
313 [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
314 [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
315 [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
316 [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
317 [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
318 [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
319 [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
320 [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
321 .len = IEEE80211_MAX_DATA_LEN },
322 [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
323 .len = IEEE80211_MAX_DATA_LEN },
324 [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
325 [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
326 [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
327 [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
328 [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
329 [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
330 [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
331 [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
332 [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
333 [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
334 [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
335 .len = IEEE80211_MAX_DATA_LEN },
336 [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
337 [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
338 [NL80211_ATTR_HT_CAPABILITY_MASK] = {
339 .len = NL80211_HT_CAPABILITY_LEN
340 },
341 [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
342 [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
343 [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
344 [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
345 [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
346 [NL80211_ATTR_AUTH_DATA] = { .type = NLA_BINARY, },
347 [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
348 [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
349 [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
350 [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
351 [NL80211_ATTR_LOCAL_MESH_POWER_MODE] = {. type = NLA_U32 },
352 [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
353 [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
354 [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
355 [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
356 [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
357 [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
358 [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
359 .len = NL80211_VHT_CAPABILITY_LEN,
360 },
361 [NL80211_ATTR_MDID] = { .type = NLA_U16 },
362 [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
363 .len = IEEE80211_MAX_DATA_LEN },
364 [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
365 [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
366 [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
367 [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
368 [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
369 [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
370 [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
371 [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
372 [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
373 [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
374 [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
375 [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
376 [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
377 [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
378 .len = IEEE80211_QOS_MAP_LEN_MAX },
379 [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
380 [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
381 [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
382 [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
383 [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
384 [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
385 [NL80211_ATTR_TSID] = { .type = NLA_U8 },
386 [NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 },
387 [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
388 [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
389 [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN },
390 [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
391 [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
392 [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
393 [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
394 [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
395 [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
396 [NL80211_ATTR_STA_SUPPORT_P2P_PS] = { .type = NLA_U8 },
397 [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
398 .len = VHT_MUMIMO_GROUPS_DATA_LEN
399 },
400 [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = { .len = ETH_ALEN },
401 [NL80211_ATTR_NAN_MASTER_PREF] = { .type = NLA_U8 },
402 [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
403 [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
404 [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
405 .len = FILS_MAX_KEK_LEN },
406 [NL80211_ATTR_FILS_NONCES] = { .len = 2 * FILS_NONCE_LEN },
407 [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
408 [NL80211_ATTR_BSSID] = { .len = ETH_ALEN },
409 [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
410 [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
411 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
412 },
413 [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
414 [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
415 .len = FILS_ERP_MAX_USERNAME_LEN },
416 [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
417 .len = FILS_ERP_MAX_REALM_LEN },
418 [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
419 [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
420 .len = FILS_ERP_MAX_RRK_LEN },
421 [NL80211_ATTR_FILS_CACHE_ID] = { .len = 2 },
422 [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
423 [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
424 };
425
426 /* policy for the key attributes */
427 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
428 [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
429 [NL80211_KEY_IDX] = { .type = NLA_U8 },
430 [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
431 [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
432 [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
433 [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
434 [NL80211_KEY_TYPE] = { .type = NLA_U32 },
435 [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
436 };
437
438 /* policy for the key default flags */
439 static const struct nla_policy
440 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
441 [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
442 [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
443 };
444
445 #ifdef CONFIG_PM
446 /* policy for WoWLAN attributes */
447 static const struct nla_policy
448 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
449 [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
450 [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
451 [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
452 [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
453 [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
454 [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
455 [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
456 [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
457 [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
458 [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
459 };
460
461 static const struct nla_policy
462 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
463 [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
464 [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
465 [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
466 [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
467 [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
468 [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
469 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
470 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
471 },
472 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
473 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
474 },
475 [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
476 [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
477 [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
478 };
479 #endif /* CONFIG_PM */
480
481 /* policy for coalesce rule attributes */
482 static const struct nla_policy
483 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
484 [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
485 [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
486 [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
487 };
488
489 /* policy for GTK rekey offload attributes */
490 static const struct nla_policy
491 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
492 [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
493 [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
494 [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
495 };
496
497 static const struct nla_policy
498 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
499 [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
500 .len = IEEE80211_MAX_SSID_LEN },
501 [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = { .len = ETH_ALEN },
502 [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
503 };
504
505 static const struct nla_policy
506 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
507 [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
508 [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
509 };
510
511 static const struct nla_policy
512 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
513 [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
514 [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
515 [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
516 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
517 },
518 };
519
520 /* policy for NAN function attributes */
521 static const struct nla_policy
522 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
523 [NL80211_NAN_FUNC_TYPE] = { .type = NLA_U8 },
524 [NL80211_NAN_FUNC_SERVICE_ID] = {
525 .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
526 [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
527 [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
528 [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
529 [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
530 [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
531 [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = { .len = ETH_ALEN },
532 [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
533 [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
534 [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
535 .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
536 [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
537 [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
538 [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
539 [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
540 [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
541 };
542
543 /* policy for Service Response Filter attributes */
544 static const struct nla_policy
545 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
546 [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
547 [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
548 .len = NL80211_NAN_FUNC_SRF_MAX_LEN },
549 [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
550 [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
551 };
552
553 /* policy for packet pattern attributes */
554 static const struct nla_policy
555 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
556 [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
557 [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
558 [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
559 };
560
561 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
562 struct netlink_callback *cb,
563 struct cfg80211_registered_device **rdev,
564 struct wireless_dev **wdev)
565 {
566 int err;
567
568 if (!cb->args[0]) {
569 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
570 genl_family_attrbuf(&nl80211_fam),
571 nl80211_fam.maxattr, nl80211_policy, NULL);
572 if (err)
573 return err;
574
575 *wdev = __cfg80211_wdev_from_attrs(
576 sock_net(skb->sk),
577 genl_family_attrbuf(&nl80211_fam));
578 if (IS_ERR(*wdev))
579 return PTR_ERR(*wdev);
580 *rdev = wiphy_to_rdev((*wdev)->wiphy);
581 /* 0 is the first index - add 1 to parse only once */
582 cb->args[0] = (*rdev)->wiphy_idx + 1;
583 cb->args[1] = (*wdev)->identifier;
584 } else {
585 /* subtract the 1 again here */
586 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
587 struct wireless_dev *tmp;
588
589 if (!wiphy)
590 return -ENODEV;
591 *rdev = wiphy_to_rdev(wiphy);
592 *wdev = NULL;
593
594 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
595 if (tmp->identifier == cb->args[1]) {
596 *wdev = tmp;
597 break;
598 }
599 }
600
601 if (!*wdev)
602 return -ENODEV;
603 }
604
605 return 0;
606 }
607
608 /* IE validation */
609 static bool is_valid_ie_attr(const struct nlattr *attr)
610 {
611 const u8 *pos;
612 int len;
613
614 if (!attr)
615 return true;
616
617 pos = nla_data(attr);
618 len = nla_len(attr);
619
620 while (len) {
621 u8 elemlen;
622
623 if (len < 2)
624 return false;
625 len -= 2;
626
627 elemlen = pos[1];
628 if (elemlen > len)
629 return false;
630
631 len -= elemlen;
632 pos += 2 + elemlen;
633 }
634
635 return true;
636 }
637
638 /* message building helper */
639 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
640 int flags, u8 cmd)
641 {
642 /* since there is no private header just add the generic one */
643 return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
644 }
645
646 static int nl80211_msg_put_channel(struct sk_buff *msg,
647 struct ieee80211_channel *chan,
648 bool large)
649 {
650 /* Some channels must be completely excluded from the
651 * list to protect old user-space tools from breaking
652 */
653 if (!large && chan->flags &
654 (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
655 return 0;
656
657 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
658 chan->center_freq))
659 goto nla_put_failure;
660
661 if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
662 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
663 goto nla_put_failure;
664 if (chan->flags & IEEE80211_CHAN_NO_IR) {
665 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
666 goto nla_put_failure;
667 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
668 goto nla_put_failure;
669 }
670 if (chan->flags & IEEE80211_CHAN_RADAR) {
671 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
672 goto nla_put_failure;
673 if (large) {
674 u32 time;
675
676 time = elapsed_jiffies_msecs(chan->dfs_state_entered);
677
678 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
679 chan->dfs_state))
680 goto nla_put_failure;
681 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
682 time))
683 goto nla_put_failure;
684 if (nla_put_u32(msg,
685 NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
686 chan->dfs_cac_ms))
687 goto nla_put_failure;
688 }
689 }
690
691 if (large) {
692 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
693 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
694 goto nla_put_failure;
695 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
696 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
697 goto nla_put_failure;
698 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
699 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
700 goto nla_put_failure;
701 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
702 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
703 goto nla_put_failure;
704 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
705 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
706 goto nla_put_failure;
707 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
708 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
709 goto nla_put_failure;
710 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
711 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
712 goto nla_put_failure;
713 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
714 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
715 goto nla_put_failure;
716 }
717
718 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
719 DBM_TO_MBM(chan->max_power)))
720 goto nla_put_failure;
721
722 return 0;
723
724 nla_put_failure:
725 return -ENOBUFS;
726 }
727
728 /* netlink command implementations */
729
730 struct key_parse {
731 struct key_params p;
732 int idx;
733 int type;
734 bool def, defmgmt;
735 bool def_uni, def_multi;
736 };
737
738 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
739 {
740 struct nlattr *tb[NL80211_KEY_MAX + 1];
741 int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
742 nl80211_key_policy, NULL);
743 if (err)
744 return err;
745
746 k->def = !!tb[NL80211_KEY_DEFAULT];
747 k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
748
749 if (k->def) {
750 k->def_uni = true;
751 k->def_multi = true;
752 }
753 if (k->defmgmt)
754 k->def_multi = true;
755
756 if (tb[NL80211_KEY_IDX])
757 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
758
759 if (tb[NL80211_KEY_DATA]) {
760 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
761 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
762 }
763
764 if (tb[NL80211_KEY_SEQ]) {
765 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
766 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
767 }
768
769 if (tb[NL80211_KEY_CIPHER])
770 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
771
772 if (tb[NL80211_KEY_TYPE]) {
773 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
774 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
775 return -EINVAL;
776 }
777
778 if (tb[NL80211_KEY_DEFAULT_TYPES]) {
779 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
780
781 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
782 tb[NL80211_KEY_DEFAULT_TYPES],
783 nl80211_key_default_policy, NULL);
784 if (err)
785 return err;
786
787 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
788 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
789 }
790
791 return 0;
792 }
793
794 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
795 {
796 if (info->attrs[NL80211_ATTR_KEY_DATA]) {
797 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
798 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
799 }
800
801 if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
802 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
803 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
804 }
805
806 if (info->attrs[NL80211_ATTR_KEY_IDX])
807 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
808
809 if (info->attrs[NL80211_ATTR_KEY_CIPHER])
810 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
811
812 k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
813 k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
814
815 if (k->def) {
816 k->def_uni = true;
817 k->def_multi = true;
818 }
819 if (k->defmgmt)
820 k->def_multi = true;
821
822 if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
823 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
824 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
825 return -EINVAL;
826 }
827
828 if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
829 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
830 int err = nla_parse_nested(kdt,
831 NUM_NL80211_KEY_DEFAULT_TYPES - 1,
832 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
833 nl80211_key_default_policy,
834 info->extack);
835 if (err)
836 return err;
837
838 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
839 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
840 }
841
842 return 0;
843 }
844
845 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
846 {
847 int err;
848
849 memset(k, 0, sizeof(*k));
850 k->idx = -1;
851 k->type = -1;
852
853 if (info->attrs[NL80211_ATTR_KEY])
854 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
855 else
856 err = nl80211_parse_key_old(info, k);
857
858 if (err)
859 return err;
860
861 if (k->def && k->defmgmt)
862 return -EINVAL;
863
864 if (k->defmgmt) {
865 if (k->def_uni || !k->def_multi)
866 return -EINVAL;
867 }
868
869 if (k->idx != -1) {
870 if (k->defmgmt) {
871 if (k->idx < 4 || k->idx > 5)
872 return -EINVAL;
873 } else if (k->def) {
874 if (k->idx < 0 || k->idx > 3)
875 return -EINVAL;
876 } else {
877 if (k->idx < 0 || k->idx > 5)
878 return -EINVAL;
879 }
880 }
881
882 return 0;
883 }
884
885 static struct cfg80211_cached_keys *
886 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
887 struct nlattr *keys, bool *no_ht)
888 {
889 struct key_parse parse;
890 struct nlattr *key;
891 struct cfg80211_cached_keys *result;
892 int rem, err, def = 0;
893 bool have_key = false;
894
895 nla_for_each_nested(key, keys, rem) {
896 have_key = true;
897 break;
898 }
899
900 if (!have_key)
901 return NULL;
902
903 result = kzalloc(sizeof(*result), GFP_KERNEL);
904 if (!result)
905 return ERR_PTR(-ENOMEM);
906
907 result->def = -1;
908
909 nla_for_each_nested(key, keys, rem) {
910 memset(&parse, 0, sizeof(parse));
911 parse.idx = -1;
912
913 err = nl80211_parse_key_new(key, &parse);
914 if (err)
915 goto error;
916 err = -EINVAL;
917 if (!parse.p.key)
918 goto error;
919 if (parse.idx < 0 || parse.idx > 3)
920 goto error;
921 if (parse.def) {
922 if (def)
923 goto error;
924 def = 1;
925 result->def = parse.idx;
926 if (!parse.def_uni || !parse.def_multi)
927 goto error;
928 } else if (parse.defmgmt)
929 goto error;
930 err = cfg80211_validate_key_settings(rdev, &parse.p,
931 parse.idx, false, NULL);
932 if (err)
933 goto error;
934 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
935 parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
936 err = -EINVAL;
937 goto error;
938 }
939 result->params[parse.idx].cipher = parse.p.cipher;
940 result->params[parse.idx].key_len = parse.p.key_len;
941 result->params[parse.idx].key = result->data[parse.idx];
942 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
943
944 /* must be WEP key if we got here */
945 if (no_ht)
946 *no_ht = true;
947 }
948
949 if (result->def < 0) {
950 err = -EINVAL;
951 goto error;
952 }
953
954 return result;
955 error:
956 kfree(result);
957 return ERR_PTR(err);
958 }
959
960 static int nl80211_key_allowed(struct wireless_dev *wdev)
961 {
962 ASSERT_WDEV_LOCK(wdev);
963
964 switch (wdev->iftype) {
965 case NL80211_IFTYPE_AP:
966 case NL80211_IFTYPE_AP_VLAN:
967 case NL80211_IFTYPE_P2P_GO:
968 case NL80211_IFTYPE_MESH_POINT:
969 break;
970 case NL80211_IFTYPE_ADHOC:
971 case NL80211_IFTYPE_STATION:
972 case NL80211_IFTYPE_P2P_CLIENT:
973 if (!wdev->current_bss)
974 return -ENOLINK;
975 break;
976 case NL80211_IFTYPE_UNSPECIFIED:
977 case NL80211_IFTYPE_OCB:
978 case NL80211_IFTYPE_MONITOR:
979 case NL80211_IFTYPE_NAN:
980 case NL80211_IFTYPE_P2P_DEVICE:
981 case NL80211_IFTYPE_WDS:
982 case NUM_NL80211_IFTYPES:
983 return -EINVAL;
984 }
985
986 return 0;
987 }
988
989 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
990 struct nlattr *tb)
991 {
992 struct ieee80211_channel *chan;
993
994 if (tb == NULL)
995 return NULL;
996 chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
997 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
998 return NULL;
999 return chan;
1000 }
1001
1002 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1003 {
1004 struct nlattr *nl_modes = nla_nest_start(msg, attr);
1005 int i;
1006
1007 if (!nl_modes)
1008 goto nla_put_failure;
1009
1010 i = 0;
1011 while (ifmodes) {
1012 if ((ifmodes & 1) && nla_put_flag(msg, i))
1013 goto nla_put_failure;
1014 ifmodes >>= 1;
1015 i++;
1016 }
1017
1018 nla_nest_end(msg, nl_modes);
1019 return 0;
1020
1021 nla_put_failure:
1022 return -ENOBUFS;
1023 }
1024
1025 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1026 struct sk_buff *msg,
1027 bool large)
1028 {
1029 struct nlattr *nl_combis;
1030 int i, j;
1031
1032 nl_combis = nla_nest_start(msg,
1033 NL80211_ATTR_INTERFACE_COMBINATIONS);
1034 if (!nl_combis)
1035 goto nla_put_failure;
1036
1037 for (i = 0; i < wiphy->n_iface_combinations; i++) {
1038 const struct ieee80211_iface_combination *c;
1039 struct nlattr *nl_combi, *nl_limits;
1040
1041 c = &wiphy->iface_combinations[i];
1042
1043 nl_combi = nla_nest_start(msg, i + 1);
1044 if (!nl_combi)
1045 goto nla_put_failure;
1046
1047 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
1048 if (!nl_limits)
1049 goto nla_put_failure;
1050
1051 for (j = 0; j < c->n_limits; j++) {
1052 struct nlattr *nl_limit;
1053
1054 nl_limit = nla_nest_start(msg, j + 1);
1055 if (!nl_limit)
1056 goto nla_put_failure;
1057 if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1058 c->limits[j].max))
1059 goto nla_put_failure;
1060 if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1061 c->limits[j].types))
1062 goto nla_put_failure;
1063 nla_nest_end(msg, nl_limit);
1064 }
1065
1066 nla_nest_end(msg, nl_limits);
1067
1068 if (c->beacon_int_infra_match &&
1069 nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1070 goto nla_put_failure;
1071 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1072 c->num_different_channels) ||
1073 nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1074 c->max_interfaces))
1075 goto nla_put_failure;
1076 if (large &&
1077 (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1078 c->radar_detect_widths) ||
1079 nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1080 c->radar_detect_regions)))
1081 goto nla_put_failure;
1082 if (c->beacon_int_min_gcd &&
1083 nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1084 c->beacon_int_min_gcd))
1085 goto nla_put_failure;
1086
1087 nla_nest_end(msg, nl_combi);
1088 }
1089
1090 nla_nest_end(msg, nl_combis);
1091
1092 return 0;
1093 nla_put_failure:
1094 return -ENOBUFS;
1095 }
1096
1097 #ifdef CONFIG_PM
1098 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1099 struct sk_buff *msg)
1100 {
1101 const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1102 struct nlattr *nl_tcp;
1103
1104 if (!tcp)
1105 return 0;
1106
1107 nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1108 if (!nl_tcp)
1109 return -ENOBUFS;
1110
1111 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1112 tcp->data_payload_max))
1113 return -ENOBUFS;
1114
1115 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1116 tcp->data_payload_max))
1117 return -ENOBUFS;
1118
1119 if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1120 return -ENOBUFS;
1121
1122 if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1123 sizeof(*tcp->tok), tcp->tok))
1124 return -ENOBUFS;
1125
1126 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1127 tcp->data_interval_max))
1128 return -ENOBUFS;
1129
1130 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1131 tcp->wake_payload_max))
1132 return -ENOBUFS;
1133
1134 nla_nest_end(msg, nl_tcp);
1135 return 0;
1136 }
1137
1138 static int nl80211_send_wowlan(struct sk_buff *msg,
1139 struct cfg80211_registered_device *rdev,
1140 bool large)
1141 {
1142 struct nlattr *nl_wowlan;
1143
1144 if (!rdev->wiphy.wowlan)
1145 return 0;
1146
1147 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1148 if (!nl_wowlan)
1149 return -ENOBUFS;
1150
1151 if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1152 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1153 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1154 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1155 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1156 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1157 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1158 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1159 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1160 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1161 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1162 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1163 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1164 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1165 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1166 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1167 return -ENOBUFS;
1168
1169 if (rdev->wiphy.wowlan->n_patterns) {
1170 struct nl80211_pattern_support pat = {
1171 .max_patterns = rdev->wiphy.wowlan->n_patterns,
1172 .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1173 .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1174 .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1175 };
1176
1177 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1178 sizeof(pat), &pat))
1179 return -ENOBUFS;
1180 }
1181
1182 if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1183 nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1184 rdev->wiphy.wowlan->max_nd_match_sets))
1185 return -ENOBUFS;
1186
1187 if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1188 return -ENOBUFS;
1189
1190 nla_nest_end(msg, nl_wowlan);
1191
1192 return 0;
1193 }
1194 #endif
1195
1196 static int nl80211_send_coalesce(struct sk_buff *msg,
1197 struct cfg80211_registered_device *rdev)
1198 {
1199 struct nl80211_coalesce_rule_support rule;
1200
1201 if (!rdev->wiphy.coalesce)
1202 return 0;
1203
1204 rule.max_rules = rdev->wiphy.coalesce->n_rules;
1205 rule.max_delay = rdev->wiphy.coalesce->max_delay;
1206 rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1207 rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1208 rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1209 rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1210
1211 if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1212 return -ENOBUFS;
1213
1214 return 0;
1215 }
1216
1217 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1218 struct ieee80211_supported_band *sband)
1219 {
1220 struct nlattr *nl_rates, *nl_rate;
1221 struct ieee80211_rate *rate;
1222 int i;
1223
1224 /* add HT info */
1225 if (sband->ht_cap.ht_supported &&
1226 (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1227 sizeof(sband->ht_cap.mcs),
1228 &sband->ht_cap.mcs) ||
1229 nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1230 sband->ht_cap.cap) ||
1231 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1232 sband->ht_cap.ampdu_factor) ||
1233 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1234 sband->ht_cap.ampdu_density)))
1235 return -ENOBUFS;
1236
1237 /* add VHT info */
1238 if (sband->vht_cap.vht_supported &&
1239 (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1240 sizeof(sband->vht_cap.vht_mcs),
1241 &sband->vht_cap.vht_mcs) ||
1242 nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1243 sband->vht_cap.cap)))
1244 return -ENOBUFS;
1245
1246 /* add bitrates */
1247 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1248 if (!nl_rates)
1249 return -ENOBUFS;
1250
1251 for (i = 0; i < sband->n_bitrates; i++) {
1252 nl_rate = nla_nest_start(msg, i);
1253 if (!nl_rate)
1254 return -ENOBUFS;
1255
1256 rate = &sband->bitrates[i];
1257 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1258 rate->bitrate))
1259 return -ENOBUFS;
1260 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1261 nla_put_flag(msg,
1262 NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1263 return -ENOBUFS;
1264
1265 nla_nest_end(msg, nl_rate);
1266 }
1267
1268 nla_nest_end(msg, nl_rates);
1269
1270 return 0;
1271 }
1272
1273 static int
1274 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1275 const struct ieee80211_txrx_stypes *mgmt_stypes)
1276 {
1277 u16 stypes;
1278 struct nlattr *nl_ftypes, *nl_ifs;
1279 enum nl80211_iftype ift;
1280 int i;
1281
1282 if (!mgmt_stypes)
1283 return 0;
1284
1285 nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1286 if (!nl_ifs)
1287 return -ENOBUFS;
1288
1289 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1290 nl_ftypes = nla_nest_start(msg, ift);
1291 if (!nl_ftypes)
1292 return -ENOBUFS;
1293 i = 0;
1294 stypes = mgmt_stypes[ift].tx;
1295 while (stypes) {
1296 if ((stypes & 1) &&
1297 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1298 (i << 4) | IEEE80211_FTYPE_MGMT))
1299 return -ENOBUFS;
1300 stypes >>= 1;
1301 i++;
1302 }
1303 nla_nest_end(msg, nl_ftypes);
1304 }
1305
1306 nla_nest_end(msg, nl_ifs);
1307
1308 nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1309 if (!nl_ifs)
1310 return -ENOBUFS;
1311
1312 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1313 nl_ftypes = nla_nest_start(msg, ift);
1314 if (!nl_ftypes)
1315 return -ENOBUFS;
1316 i = 0;
1317 stypes = mgmt_stypes[ift].rx;
1318 while (stypes) {
1319 if ((stypes & 1) &&
1320 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1321 (i << 4) | IEEE80211_FTYPE_MGMT))
1322 return -ENOBUFS;
1323 stypes >>= 1;
1324 i++;
1325 }
1326 nla_nest_end(msg, nl_ftypes);
1327 }
1328 nla_nest_end(msg, nl_ifs);
1329
1330 return 0;
1331 }
1332
1333 #define CMD(op, n) \
1334 do { \
1335 if (rdev->ops->op) { \
1336 i++; \
1337 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1338 goto nla_put_failure; \
1339 } \
1340 } while (0)
1341
1342 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
1343 struct sk_buff *msg)
1344 {
1345 int i = 0;
1346
1347 /*
1348 * do *NOT* add anything into this function, new things need to be
1349 * advertised only to new versions of userspace that can deal with
1350 * the split (and they can't possibly care about new features...
1351 */
1352 CMD(add_virtual_intf, NEW_INTERFACE);
1353 CMD(change_virtual_intf, SET_INTERFACE);
1354 CMD(add_key, NEW_KEY);
1355 CMD(start_ap, START_AP);
1356 CMD(add_station, NEW_STATION);
1357 CMD(add_mpath, NEW_MPATH);
1358 CMD(update_mesh_config, SET_MESH_CONFIG);
1359 CMD(change_bss, SET_BSS);
1360 CMD(auth, AUTHENTICATE);
1361 CMD(assoc, ASSOCIATE);
1362 CMD(deauth, DEAUTHENTICATE);
1363 CMD(disassoc, DISASSOCIATE);
1364 CMD(join_ibss, JOIN_IBSS);
1365 CMD(join_mesh, JOIN_MESH);
1366 CMD(set_pmksa, SET_PMKSA);
1367 CMD(del_pmksa, DEL_PMKSA);
1368 CMD(flush_pmksa, FLUSH_PMKSA);
1369 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1370 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1371 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1372 CMD(mgmt_tx, FRAME);
1373 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1374 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1375 i++;
1376 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1377 goto nla_put_failure;
1378 }
1379 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1380 rdev->ops->join_mesh) {
1381 i++;
1382 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1383 goto nla_put_failure;
1384 }
1385 CMD(set_wds_peer, SET_WDS_PEER);
1386 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1387 CMD(tdls_mgmt, TDLS_MGMT);
1388 CMD(tdls_oper, TDLS_OPER);
1389 }
1390 if (rdev->wiphy.max_sched_scan_reqs)
1391 CMD(sched_scan_start, START_SCHED_SCAN);
1392 CMD(probe_client, PROBE_CLIENT);
1393 CMD(set_noack_map, SET_NOACK_MAP);
1394 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1395 i++;
1396 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1397 goto nla_put_failure;
1398 }
1399 CMD(start_p2p_device, START_P2P_DEVICE);
1400 CMD(set_mcast_rate, SET_MCAST_RATE);
1401 #ifdef CONFIG_NL80211_TESTMODE
1402 CMD(testmode_cmd, TESTMODE);
1403 #endif
1404
1405 if (rdev->ops->connect || rdev->ops->auth) {
1406 i++;
1407 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1408 goto nla_put_failure;
1409 }
1410
1411 if (rdev->ops->disconnect || rdev->ops->deauth) {
1412 i++;
1413 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1414 goto nla_put_failure;
1415 }
1416
1417 return i;
1418 nla_put_failure:
1419 return -ENOBUFS;
1420 }
1421
1422 struct nl80211_dump_wiphy_state {
1423 s64 filter_wiphy;
1424 long start;
1425 long split_start, band_start, chan_start, capa_start;
1426 bool split;
1427 };
1428
1429 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1430 enum nl80211_commands cmd,
1431 struct sk_buff *msg, u32 portid, u32 seq,
1432 int flags, struct nl80211_dump_wiphy_state *state)
1433 {
1434 void *hdr;
1435 struct nlattr *nl_bands, *nl_band;
1436 struct nlattr *nl_freqs, *nl_freq;
1437 struct nlattr *nl_cmds;
1438 enum nl80211_band band;
1439 struct ieee80211_channel *chan;
1440 int i;
1441 const struct ieee80211_txrx_stypes *mgmt_stypes =
1442 rdev->wiphy.mgmt_stypes;
1443 u32 features;
1444
1445 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1446 if (!hdr)
1447 return -ENOBUFS;
1448
1449 if (WARN_ON(!state))
1450 return -EINVAL;
1451
1452 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1453 nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1454 wiphy_name(&rdev->wiphy)) ||
1455 nla_put_u32(msg, NL80211_ATTR_GENERATION,
1456 cfg80211_rdev_list_generation))
1457 goto nla_put_failure;
1458
1459 if (cmd != NL80211_CMD_NEW_WIPHY)
1460 goto finish;
1461
1462 switch (state->split_start) {
1463 case 0:
1464 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1465 rdev->wiphy.retry_short) ||
1466 nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1467 rdev->wiphy.retry_long) ||
1468 nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1469 rdev->wiphy.frag_threshold) ||
1470 nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1471 rdev->wiphy.rts_threshold) ||
1472 nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1473 rdev->wiphy.coverage_class) ||
1474 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1475 rdev->wiphy.max_scan_ssids) ||
1476 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1477 rdev->wiphy.max_sched_scan_ssids) ||
1478 nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1479 rdev->wiphy.max_scan_ie_len) ||
1480 nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1481 rdev->wiphy.max_sched_scan_ie_len) ||
1482 nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1483 rdev->wiphy.max_match_sets) ||
1484 nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
1485 rdev->wiphy.max_sched_scan_plans) ||
1486 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
1487 rdev->wiphy.max_sched_scan_plan_interval) ||
1488 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
1489 rdev->wiphy.max_sched_scan_plan_iterations))
1490 goto nla_put_failure;
1491
1492 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1493 nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1494 goto nla_put_failure;
1495 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1496 nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1497 goto nla_put_failure;
1498 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1499 nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1500 goto nla_put_failure;
1501 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1502 nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1503 goto nla_put_failure;
1504 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1505 nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1506 goto nla_put_failure;
1507 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1508 nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1509 goto nla_put_failure;
1510 state->split_start++;
1511 if (state->split)
1512 break;
1513 case 1:
1514 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1515 sizeof(u32) * rdev->wiphy.n_cipher_suites,
1516 rdev->wiphy.cipher_suites))
1517 goto nla_put_failure;
1518
1519 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1520 rdev->wiphy.max_num_pmkids))
1521 goto nla_put_failure;
1522
1523 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1524 nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1525 goto nla_put_failure;
1526
1527 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1528 rdev->wiphy.available_antennas_tx) ||
1529 nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1530 rdev->wiphy.available_antennas_rx))
1531 goto nla_put_failure;
1532
1533 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1534 nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1535 rdev->wiphy.probe_resp_offload))
1536 goto nla_put_failure;
1537
1538 if ((rdev->wiphy.available_antennas_tx ||
1539 rdev->wiphy.available_antennas_rx) &&
1540 rdev->ops->get_antenna) {
1541 u32 tx_ant = 0, rx_ant = 0;
1542 int res;
1543
1544 res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1545 if (!res) {
1546 if (nla_put_u32(msg,
1547 NL80211_ATTR_WIPHY_ANTENNA_TX,
1548 tx_ant) ||
1549 nla_put_u32(msg,
1550 NL80211_ATTR_WIPHY_ANTENNA_RX,
1551 rx_ant))
1552 goto nla_put_failure;
1553 }
1554 }
1555
1556 state->split_start++;
1557 if (state->split)
1558 break;
1559 case 2:
1560 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1561 rdev->wiphy.interface_modes))
1562 goto nla_put_failure;
1563 state->split_start++;
1564 if (state->split)
1565 break;
1566 case 3:
1567 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1568 if (!nl_bands)
1569 goto nla_put_failure;
1570
1571 for (band = state->band_start;
1572 band < NUM_NL80211_BANDS; band++) {
1573 struct ieee80211_supported_band *sband;
1574
1575 sband = rdev->wiphy.bands[band];
1576
1577 if (!sband)
1578 continue;
1579
1580 nl_band = nla_nest_start(msg, band);
1581 if (!nl_band)
1582 goto nla_put_failure;
1583
1584 switch (state->chan_start) {
1585 case 0:
1586 if (nl80211_send_band_rateinfo(msg, sband))
1587 goto nla_put_failure;
1588 state->chan_start++;
1589 if (state->split)
1590 break;
1591 default:
1592 /* add frequencies */
1593 nl_freqs = nla_nest_start(
1594 msg, NL80211_BAND_ATTR_FREQS);
1595 if (!nl_freqs)
1596 goto nla_put_failure;
1597
1598 for (i = state->chan_start - 1;
1599 i < sband->n_channels;
1600 i++) {
1601 nl_freq = nla_nest_start(msg, i);
1602 if (!nl_freq)
1603 goto nla_put_failure;
1604
1605 chan = &sband->channels[i];
1606
1607 if (nl80211_msg_put_channel(
1608 msg, chan,
1609 state->split))
1610 goto nla_put_failure;
1611
1612 nla_nest_end(msg, nl_freq);
1613 if (state->split)
1614 break;
1615 }
1616 if (i < sband->n_channels)
1617 state->chan_start = i + 2;
1618 else
1619 state->chan_start = 0;
1620 nla_nest_end(msg, nl_freqs);
1621 }
1622
1623 nla_nest_end(msg, nl_band);
1624
1625 if (state->split) {
1626 /* start again here */
1627 if (state->chan_start)
1628 band--;
1629 break;
1630 }
1631 }
1632 nla_nest_end(msg, nl_bands);
1633
1634 if (band < NUM_NL80211_BANDS)
1635 state->band_start = band + 1;
1636 else
1637 state->band_start = 0;
1638
1639 /* if bands & channels are done, continue outside */
1640 if (state->band_start == 0 && state->chan_start == 0)
1641 state->split_start++;
1642 if (state->split)
1643 break;
1644 case 4:
1645 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1646 if (!nl_cmds)
1647 goto nla_put_failure;
1648
1649 i = nl80211_add_commands_unsplit(rdev, msg);
1650 if (i < 0)
1651 goto nla_put_failure;
1652 if (state->split) {
1653 CMD(crit_proto_start, CRIT_PROTOCOL_START);
1654 CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1655 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1656 CMD(channel_switch, CHANNEL_SWITCH);
1657 CMD(set_qos_map, SET_QOS_MAP);
1658 if (rdev->wiphy.features &
1659 NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
1660 CMD(add_tx_ts, ADD_TX_TS);
1661 CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
1662 CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
1663 }
1664 #undef CMD
1665
1666 nla_nest_end(msg, nl_cmds);
1667 state->split_start++;
1668 if (state->split)
1669 break;
1670 case 5:
1671 if (rdev->ops->remain_on_channel &&
1672 (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1673 nla_put_u32(msg,
1674 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1675 rdev->wiphy.max_remain_on_channel_duration))
1676 goto nla_put_failure;
1677
1678 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1679 nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1680 goto nla_put_failure;
1681
1682 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1683 goto nla_put_failure;
1684 state->split_start++;
1685 if (state->split)
1686 break;
1687 case 6:
1688 #ifdef CONFIG_PM
1689 if (nl80211_send_wowlan(msg, rdev, state->split))
1690 goto nla_put_failure;
1691 state->split_start++;
1692 if (state->split)
1693 break;
1694 #else
1695 state->split_start++;
1696 #endif
1697 case 7:
1698 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1699 rdev->wiphy.software_iftypes))
1700 goto nla_put_failure;
1701
1702 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
1703 state->split))
1704 goto nla_put_failure;
1705
1706 state->split_start++;
1707 if (state->split)
1708 break;
1709 case 8:
1710 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1711 nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1712 rdev->wiphy.ap_sme_capa))
1713 goto nla_put_failure;
1714
1715 features = rdev->wiphy.features;
1716 /*
1717 * We can only add the per-channel limit information if the
1718 * dump is split, otherwise it makes it too big. Therefore
1719 * only advertise it in that case.
1720 */
1721 if (state->split)
1722 features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1723 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1724 goto nla_put_failure;
1725
1726 if (rdev->wiphy.ht_capa_mod_mask &&
1727 nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1728 sizeof(*rdev->wiphy.ht_capa_mod_mask),
1729 rdev->wiphy.ht_capa_mod_mask))
1730 goto nla_put_failure;
1731
1732 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1733 rdev->wiphy.max_acl_mac_addrs &&
1734 nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1735 rdev->wiphy.max_acl_mac_addrs))
1736 goto nla_put_failure;
1737
1738 /*
1739 * Any information below this point is only available to
1740 * applications that can deal with it being split. This
1741 * helps ensure that newly added capabilities don't break
1742 * older tools by overrunning their buffers.
1743 *
1744 * We still increment split_start so that in the split
1745 * case we'll continue with more data in the next round,
1746 * but break unconditionally so unsplit data stops here.
1747 */
1748 state->split_start++;
1749 break;
1750 case 9:
1751 if (rdev->wiphy.extended_capabilities &&
1752 (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1753 rdev->wiphy.extended_capabilities_len,
1754 rdev->wiphy.extended_capabilities) ||
1755 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1756 rdev->wiphy.extended_capabilities_len,
1757 rdev->wiphy.extended_capabilities_mask)))
1758 goto nla_put_failure;
1759
1760 if (rdev->wiphy.vht_capa_mod_mask &&
1761 nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1762 sizeof(*rdev->wiphy.vht_capa_mod_mask),
1763 rdev->wiphy.vht_capa_mod_mask))
1764 goto nla_put_failure;
1765
1766 state->split_start++;
1767 break;
1768 case 10:
1769 if (nl80211_send_coalesce(msg, rdev))
1770 goto nla_put_failure;
1771
1772 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1773 (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1774 nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1775 goto nla_put_failure;
1776
1777 if (rdev->wiphy.max_ap_assoc_sta &&
1778 nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
1779 rdev->wiphy.max_ap_assoc_sta))
1780 goto nla_put_failure;
1781
1782 state->split_start++;
1783 break;
1784 case 11:
1785 if (rdev->wiphy.n_vendor_commands) {
1786 const struct nl80211_vendor_cmd_info *info;
1787 struct nlattr *nested;
1788
1789 nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1790 if (!nested)
1791 goto nla_put_failure;
1792
1793 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
1794 info = &rdev->wiphy.vendor_commands[i].info;
1795 if (nla_put(msg, i + 1, sizeof(*info), info))
1796 goto nla_put_failure;
1797 }
1798 nla_nest_end(msg, nested);
1799 }
1800
1801 if (rdev->wiphy.n_vendor_events) {
1802 const struct nl80211_vendor_cmd_info *info;
1803 struct nlattr *nested;
1804
1805 nested = nla_nest_start(msg,
1806 NL80211_ATTR_VENDOR_EVENTS);
1807 if (!nested)
1808 goto nla_put_failure;
1809
1810 for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
1811 info = &rdev->wiphy.vendor_events[i];
1812 if (nla_put(msg, i + 1, sizeof(*info), info))
1813 goto nla_put_failure;
1814 }
1815 nla_nest_end(msg, nested);
1816 }
1817 state->split_start++;
1818 break;
1819 case 12:
1820 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
1821 nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
1822 rdev->wiphy.max_num_csa_counters))
1823 goto nla_put_failure;
1824
1825 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
1826 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
1827 goto nla_put_failure;
1828
1829 if (rdev->wiphy.max_sched_scan_reqs &&
1830 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
1831 rdev->wiphy.max_sched_scan_reqs))
1832 goto nla_put_failure;
1833
1834 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
1835 sizeof(rdev->wiphy.ext_features),
1836 rdev->wiphy.ext_features))
1837 goto nla_put_failure;
1838
1839 if (rdev->wiphy.bss_select_support) {
1840 struct nlattr *nested;
1841 u32 bss_select_support = rdev->wiphy.bss_select_support;
1842
1843 nested = nla_nest_start(msg, NL80211_ATTR_BSS_SELECT);
1844 if (!nested)
1845 goto nla_put_failure;
1846
1847 i = 0;
1848 while (bss_select_support) {
1849 if ((bss_select_support & 1) &&
1850 nla_put_flag(msg, i))
1851 goto nla_put_failure;
1852 i++;
1853 bss_select_support >>= 1;
1854 }
1855 nla_nest_end(msg, nested);
1856 }
1857
1858 state->split_start++;
1859 break;
1860 case 13:
1861 if (rdev->wiphy.num_iftype_ext_capab &&
1862 rdev->wiphy.iftype_ext_capab) {
1863 struct nlattr *nested_ext_capab, *nested;
1864
1865 nested = nla_nest_start(msg,
1866 NL80211_ATTR_IFTYPE_EXT_CAPA);
1867 if (!nested)
1868 goto nla_put_failure;
1869
1870 for (i = state->capa_start;
1871 i < rdev->wiphy.num_iftype_ext_capab; i++) {
1872 const struct wiphy_iftype_ext_capab *capab;
1873
1874 capab = &rdev->wiphy.iftype_ext_capab[i];
1875
1876 nested_ext_capab = nla_nest_start(msg, i);
1877 if (!nested_ext_capab ||
1878 nla_put_u32(msg, NL80211_ATTR_IFTYPE,
1879 capab->iftype) ||
1880 nla_put(msg, NL80211_ATTR_EXT_CAPA,
1881 capab->extended_capabilities_len,
1882 capab->extended_capabilities) ||
1883 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1884 capab->extended_capabilities_len,
1885 capab->extended_capabilities_mask))
1886 goto nla_put_failure;
1887
1888 nla_nest_end(msg, nested_ext_capab);
1889 if (state->split)
1890 break;
1891 }
1892 nla_nest_end(msg, nested);
1893 if (i < rdev->wiphy.num_iftype_ext_capab) {
1894 state->capa_start = i + 1;
1895 break;
1896 }
1897 }
1898
1899 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
1900 rdev->wiphy.nan_supported_bands))
1901 goto nla_put_failure;
1902
1903 /* done */
1904 state->split_start = 0;
1905 break;
1906 }
1907 finish:
1908 genlmsg_end(msg, hdr);
1909 return 0;
1910
1911 nla_put_failure:
1912 genlmsg_cancel(msg, hdr);
1913 return -EMSGSIZE;
1914 }
1915
1916 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
1917 struct netlink_callback *cb,
1918 struct nl80211_dump_wiphy_state *state)
1919 {
1920 struct nlattr **tb = genl_family_attrbuf(&nl80211_fam);
1921 int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, tb,
1922 nl80211_fam.maxattr, nl80211_policy, NULL);
1923 /* ignore parse errors for backward compatibility */
1924 if (ret)
1925 return 0;
1926
1927 state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1928 if (tb[NL80211_ATTR_WIPHY])
1929 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1930 if (tb[NL80211_ATTR_WDEV])
1931 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1932 if (tb[NL80211_ATTR_IFINDEX]) {
1933 struct net_device *netdev;
1934 struct cfg80211_registered_device *rdev;
1935 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1936
1937 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1938 if (!netdev)
1939 return -ENODEV;
1940 if (netdev->ieee80211_ptr) {
1941 rdev = wiphy_to_rdev(
1942 netdev->ieee80211_ptr->wiphy);
1943 state->filter_wiphy = rdev->wiphy_idx;
1944 }
1945 }
1946
1947 return 0;
1948 }
1949
1950 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1951 {
1952 int idx = 0, ret;
1953 struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1954 struct cfg80211_registered_device *rdev;
1955
1956 rtnl_lock();
1957 if (!state) {
1958 state = kzalloc(sizeof(*state), GFP_KERNEL);
1959 if (!state) {
1960 rtnl_unlock();
1961 return -ENOMEM;
1962 }
1963 state->filter_wiphy = -1;
1964 ret = nl80211_dump_wiphy_parse(skb, cb, state);
1965 if (ret) {
1966 kfree(state);
1967 rtnl_unlock();
1968 return ret;
1969 }
1970 cb->args[0] = (long)state;
1971 }
1972
1973 list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1974 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1975 continue;
1976 if (++idx <= state->start)
1977 continue;
1978 if (state->filter_wiphy != -1 &&
1979 state->filter_wiphy != rdev->wiphy_idx)
1980 continue;
1981 /* attempt to fit multiple wiphy data chunks into the skb */
1982 do {
1983 ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
1984 skb,
1985 NETLINK_CB(cb->skb).portid,
1986 cb->nlh->nlmsg_seq,
1987 NLM_F_MULTI, state);
1988 if (ret < 0) {
1989 /*
1990 * If sending the wiphy data didn't fit (ENOBUFS
1991 * or EMSGSIZE returned), this SKB is still
1992 * empty (so it's not too big because another
1993 * wiphy dataset is already in the skb) and
1994 * we've not tried to adjust the dump allocation
1995 * yet ... then adjust the alloc size to be
1996 * bigger, and return 1 but with the empty skb.
1997 * This results in an empty message being RX'ed
1998 * in userspace, but that is ignored.
1999 *
2000 * We can then retry with the larger buffer.
2001 */
2002 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
2003 !skb->len && !state->split &&
2004 cb->min_dump_alloc < 4096) {
2005 cb->min_dump_alloc = 4096;
2006 state->split_start = 0;
2007 rtnl_unlock();
2008 return 1;
2009 }
2010 idx--;
2011 break;
2012 }
2013 } while (state->split_start > 0);
2014 break;
2015 }
2016 rtnl_unlock();
2017
2018 state->start = idx;
2019
2020 return skb->len;
2021 }
2022
2023 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
2024 {
2025 kfree((void *)cb->args[0]);
2026 return 0;
2027 }
2028
2029 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
2030 {
2031 struct sk_buff *msg;
2032 struct cfg80211_registered_device *rdev = info->user_ptr[0];
2033 struct nl80211_dump_wiphy_state state = {};
2034
2035 msg = nlmsg_new(4096, GFP_KERNEL);
2036 if (!msg)
2037 return -ENOMEM;
2038
2039 if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
2040 info->snd_portid, info->snd_seq, 0,
2041 &state) < 0) {
2042 nlmsg_free(msg);
2043 return -ENOBUFS;
2044 }
2045
2046 return genlmsg_reply(msg, info);
2047 }
2048
2049 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
2050 [NL80211_TXQ_ATTR_QUEUE] = { .type = NLA_U8 },
2051 [NL80211_TXQ_ATTR_TXOP] = { .type = NLA_U16 },
2052 [NL80211_TXQ_ATTR_CWMIN] = { .type = NLA_U16 },
2053 [NL80211_TXQ_ATTR_CWMAX] = { .type = NLA_U16 },
2054 [NL80211_TXQ_ATTR_AIFS] = { .type = NLA_U8 },
2055 };
2056
2057 static int parse_txq_params(struct nlattr *tb[],
2058 struct ieee80211_txq_params *txq_params)
2059 {
2060 u8 ac;
2061
2062 if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
2063 !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
2064 !tb[NL80211_TXQ_ATTR_AIFS])
2065 return -EINVAL;
2066
2067 ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
2068 txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
2069 txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
2070 txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
2071 txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
2072
2073 if (ac >= NL80211_NUM_ACS)
2074 return -EINVAL;
2075 txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
2076 return 0;
2077 }
2078
2079 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
2080 {
2081 /*
2082 * You can only set the channel explicitly for WDS interfaces,
2083 * all others have their channel managed via their respective
2084 * "establish a connection" command (connect, join, ...)
2085 *
2086 * For AP/GO and mesh mode, the channel can be set with the
2087 * channel userspace API, but is only stored and passed to the
2088 * low-level driver when the AP starts or the mesh is joined.
2089 * This is for backward compatibility, userspace can also give
2090 * the channel in the start-ap or join-mesh commands instead.
2091 *
2092 * Monitors are special as they are normally slaved to
2093 * whatever else is going on, so they have their own special
2094 * operation to set the monitor channel if possible.
2095 */
2096 return !wdev ||
2097 wdev->iftype == NL80211_IFTYPE_AP ||
2098 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
2099 wdev->iftype == NL80211_IFTYPE_MONITOR ||
2100 wdev->iftype == NL80211_IFTYPE_P2P_GO;
2101 }
2102
2103 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
2104 struct genl_info *info,
2105 struct cfg80211_chan_def *chandef)
2106 {
2107 u32 control_freq;
2108
2109 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
2110 return -EINVAL;
2111
2112 control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
2113
2114 chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
2115 chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
2116 chandef->center_freq1 = control_freq;
2117 chandef->center_freq2 = 0;
2118
2119 /* Primary channel not allowed */
2120 if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
2121 return -EINVAL;
2122
2123 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
2124 enum nl80211_channel_type chantype;
2125
2126 chantype = nla_get_u32(
2127 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
2128
2129 switch (chantype) {
2130 case NL80211_CHAN_NO_HT:
2131 case NL80211_CHAN_HT20:
2132 case NL80211_CHAN_HT40PLUS:
2133 case NL80211_CHAN_HT40MINUS:
2134 cfg80211_chandef_create(chandef, chandef->chan,
2135 chantype);
2136 break;
2137 default:
2138 return -EINVAL;
2139 }
2140 } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
2141 chandef->width =
2142 nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
2143 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
2144 chandef->center_freq1 =
2145 nla_get_u32(
2146 info->attrs[NL80211_ATTR_CENTER_FREQ1]);
2147 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
2148 chandef->center_freq2 =
2149 nla_get_u32(
2150 info->attrs[NL80211_ATTR_CENTER_FREQ2]);
2151 }
2152
2153 if (!cfg80211_chandef_valid(chandef))
2154 return -EINVAL;
2155
2156 if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
2157 IEEE80211_CHAN_DISABLED))
2158 return -EINVAL;
2159
2160 if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
2161 chandef->width == NL80211_CHAN_WIDTH_10) &&
2162 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
2163 return -EINVAL;
2164
2165 return 0;
2166 }
2167
2168 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
2169 struct net_device *dev,
2170 struct genl_info *info)
2171 {
2172 struct cfg80211_chan_def chandef;
2173 int result;
2174 enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
2175 struct wireless_dev *wdev = NULL;
2176
2177 if (dev)
2178 wdev = dev->ieee80211_ptr;
2179 if (!nl80211_can_set_dev_channel(wdev))
2180 return -EOPNOTSUPP;
2181 if (wdev)
2182 iftype = wdev->iftype;
2183
2184 result = nl80211_parse_chandef(rdev, info, &chandef);
2185 if (result)
2186 return result;
2187
2188 switch (iftype) {
2189 case NL80211_IFTYPE_AP:
2190 case NL80211_IFTYPE_P2P_GO:
2191 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
2192 iftype)) {
2193 result = -EINVAL;
2194 break;
2195 }
2196 if (wdev->beacon_interval) {
2197 if (!dev || !rdev->ops->set_ap_chanwidth ||
2198 !(rdev->wiphy.features &
2199 NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
2200 result = -EBUSY;
2201 break;
2202 }
2203
2204 /* Only allow dynamic channel width changes */
2205 if (chandef.chan != wdev->preset_chandef.chan) {
2206 result = -EBUSY;
2207 break;
2208 }
2209 result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2210 if (result)
2211 break;
2212 }
2213 wdev->preset_chandef = chandef;
2214 result = 0;
2215 break;
2216 case NL80211_IFTYPE_MESH_POINT:
2217 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2218 break;
2219 case NL80211_IFTYPE_MONITOR:
2220 result = cfg80211_set_monitor_channel(rdev, &chandef);
2221 break;
2222 default:
2223 result = -EINVAL;
2224 }
2225
2226 return result;
2227 }
2228
2229 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2230 {
2231 struct cfg80211_registered_device *rdev = info->user_ptr[0];
2232 struct net_device *netdev = info->user_ptr[1];
2233
2234 return __nl80211_set_channel(rdev, netdev, info);
2235 }
2236
2237 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2238 {
2239 struct cfg80211_registered_device *rdev = info->user_ptr[0];
2240 struct net_device *dev = info->user_ptr[1];
2241 struct wireless_dev *wdev = dev->ieee80211_ptr;
2242 const u8 *bssid;
2243
2244 if (!info->attrs[NL80211_ATTR_MAC])
2245 return -EINVAL;
2246
2247 if (netif_running(dev))
2248 return -EBUSY;
2249
2250 if (!rdev->ops->set_wds_peer)
2251 return -EOPNOTSUPP;
2252
2253 if (wdev->iftype != NL80211_IFTYPE_WDS)
2254 return -EOPNOTSUPP;
2255
2256 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2257 return rdev_set_wds_peer(rdev, dev, bssid);
2258 }
2259
2260 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2261 {
2262 struct cfg80211_registered_device *rdev;
2263 struct net_device *netdev = NULL;
2264 struct wireless_dev *wdev;
2265 int result = 0, rem_txq_params = 0;
2266 struct nlattr *nl_txq_params;
2267 u32 changed;
2268 u8 retry_short = 0, retry_long = 0;
2269 u32 frag_threshold = 0, rts_threshold = 0;
2270 u8 coverage_class = 0;
2271
2272 ASSERT_RTNL();
2273
2274 /*
2275 * Try to find the wiphy and netdev. Normally this
2276 * function shouldn't need the netdev, but this is
2277 * done for backward compatibility -- previously
2278 * setting the channel was done per wiphy, but now
2279 * it is per netdev. Previous userland like hostapd
2280 * also passed a netdev to set_wiphy, so that it is
2281 * possible to let that go to the right netdev!
2282 */
2283
2284 if (info->attrs[NL80211_ATTR_IFINDEX]) {
2285 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2286
2287 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2288 if (netdev && netdev->ieee80211_ptr)
2289 rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2290 else
2291 netdev = NULL;
2292 }
2293
2294 if (!netdev) {
2295 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2296 info->attrs);
2297 if (IS_ERR(rdev))
2298 return PTR_ERR(rdev);
2299 wdev = NULL;
2300 netdev = NULL;
2301 result = 0;
2302 } else
2303 wdev = netdev->ieee80211_ptr;
2304
2305 /*
2306 * end workaround code, by now the rdev is available
2307 * and locked, and wdev may or may not be NULL.
2308 */
2309
2310 if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2311 result = cfg80211_dev_rename(
2312 rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2313
2314 if (result)
2315 return result;
2316
2317 if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2318 struct ieee80211_txq_params txq_params;
2319 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2320
2321 if (!rdev->ops->set_txq_params)
2322 return -EOPNOTSUPP;
2323
2324 if (!netdev)
2325 return -EINVAL;
2326
2327 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2328 netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2329 return -EINVAL;
2330
2331 if (!netif_running(netdev))
2332 return -ENETDOWN;
2333
2334 nla_for_each_nested(nl_txq_params,
2335 info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2336 rem_txq_params) {
2337 result = nla_parse_nested(tb, NL80211_TXQ_ATTR_MAX,
2338 nl_txq_params,
2339 txq_params_policy,
2340 info->extack);
2341 if (result)
2342 return result;
2343 result = parse_txq_params(tb, &txq_params);
2344 if (result)
2345 return result;
2346
2347 result = rdev_set_txq_params(rdev, netdev,
2348 &txq_params);
2349 if (result)
2350 return result;
2351 }
2352 }
2353
2354 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2355 result = __nl80211_set_channel(
2356 rdev,
2357 nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2358 info);
2359 if (result)
2360 return result;
2361 }
2362
2363 if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2364 struct wireless_dev *txp_wdev = wdev;
2365 enum nl80211_tx_power_setting type;
2366 int idx, mbm = 0;
2367
2368 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2369 txp_wdev = NULL;
2370
2371 if (!rdev->ops->set_tx_power)
2372 return -EOPNOTSUPP;
2373
2374 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2375 type = nla_get_u32(info->attrs[idx]);
2376
2377 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2378 (type != NL80211_TX_POWER_AUTOMATIC))
2379 return -EINVAL;
2380
2381 if (type != NL80211_TX_POWER_AUTOMATIC) {
2382 idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2383 mbm = nla_get_u32(info->attrs[idx]);
2384 }
2385
2386 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2387 if (result)
2388 return result;
2389 }
2390
2391 if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2392 info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2393 u32 tx_ant, rx_ant;
2394
2395 if ((!rdev->wiphy.available_antennas_tx &&
2396 !rdev->wiphy.available_antennas_rx) ||
2397 !rdev->ops->set_antenna)
2398 return -EOPNOTSUPP;
2399
2400 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2401 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2402
2403 /* reject antenna configurations which don't match the
2404 * available antenna masks, except for the "all" mask */
2405 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2406 (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2407 return -EINVAL;
2408
2409 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2410 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2411
2412 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2413 if (result)
2414 return result;
2415 }
2416
2417 changed = 0;
2418
2419 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2420 retry_short = nla_get_u8(
2421 info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2422 if (retry_short == 0)
2423 return -EINVAL;
2424
2425 changed |= WIPHY_PARAM_RETRY_SHORT;
2426 }
2427
2428 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2429 retry_long = nla_get_u8(
2430 info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2431 if (retry_long == 0)
2432 return -EINVAL;
2433
2434 changed |= WIPHY_PARAM_RETRY_LONG;
2435 }
2436
2437 if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2438 frag_threshold = nla_get_u32(
2439 info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2440 if (frag_threshold < 256)
2441 return -EINVAL;
2442
2443 if (frag_threshold != (u32) -1) {
2444 /*
2445 * Fragments (apart from the last one) are required to
2446 * have even length. Make the fragmentation code
2447 * simpler by stripping LSB should someone try to use
2448 * odd threshold value.
2449 */
2450 frag_threshold &= ~0x1;
2451 }
2452 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2453 }
2454
2455 if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2456 rts_threshold = nla_get_u32(
2457 info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2458 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2459 }
2460
2461 if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2462 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
2463 return -EINVAL;
2464
2465 coverage_class = nla_get_u8(
2466 info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2467 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2468 }
2469
2470 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
2471 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
2472 return -EOPNOTSUPP;
2473
2474 changed |= WIPHY_PARAM_DYN_ACK;
2475 }
2476
2477 if (changed) {
2478 u8 old_retry_short, old_retry_long;
2479 u32 old_frag_threshold, old_rts_threshold;
2480 u8 old_coverage_class;
2481
2482 if (!rdev->ops->set_wiphy_params)
2483 return -EOPNOTSUPP;
2484
2485 old_retry_short = rdev->wiphy.retry_short;
2486 old_retry_long = rdev->wiphy.retry_long;
2487 old_frag_threshold = rdev->wiphy.frag_threshold;
2488 old_rts_threshold = rdev->wiphy.rts_threshold;
2489 old_coverage_class = rdev->wiphy.coverage_class;
2490
2491 if (changed & WIPHY_PARAM_RETRY_SHORT)
2492 rdev->wiphy.retry_short = retry_short;
2493 if (changed & WIPHY_PARAM_RETRY_LONG)
2494 rdev->wiphy.retry_long = retry_long;
2495 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2496 rdev->wiphy.frag_threshold = frag_threshold;
2497 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2498 rdev->wiphy.rts_threshold = rts_threshold;
2499 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2500 rdev->wiphy.coverage_class = coverage_class;
2501
2502 result = rdev_set_wiphy_params(rdev, changed);
2503 if (result) {
2504 rdev->wiphy.retry_short = old_retry_short;
2505 rdev->wiphy.retry_long = old_retry_long;
2506 rdev->wiphy.frag_threshold = old_frag_threshold;
2507 rdev->wiphy.rts_threshold = old_rts_threshold;
2508 rdev->wiphy.coverage_class = old_coverage_class;
2509 return result;
2510 }
2511 }
2512 return 0;
2513 }
2514
2515 static inline u64 wdev_id(struct wireless_dev *wdev)
2516 {
2517 return (u64)wdev->identifier |
2518 ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
2519 }
2520
2521 static int nl80211_send_chandef(struct sk_buff *msg,
2522 const struct cfg80211_chan_def *chandef)
2523 {
2524 if (WARN_ON(!cfg80211_chandef_valid(chandef)))
2525 return -EINVAL;
2526
2527 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2528 chandef->chan->center_freq))
2529 return -ENOBUFS;
2530 switch (chandef->width) {
2531 case NL80211_CHAN_WIDTH_20_NOHT:
2532 case NL80211_CHAN_WIDTH_20:
2533 case NL80211_CHAN_WIDTH_40:
2534 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2535 cfg80211_get_chandef_type(chandef)))
2536 return -ENOBUFS;
2537 break;
2538 default:
2539 break;
2540 }
2541 if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2542 return -ENOBUFS;
2543 if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2544 return -ENOBUFS;
2545 if (chandef->center_freq2 &&
2546 nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2547 return -ENOBUFS;
2548 return 0;
2549 }
2550
2551 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2552 struct cfg80211_registered_device *rdev,
2553 struct wireless_dev *wdev, bool removal)
2554 {
2555 struct net_device *dev = wdev->netdev;
2556 u8 cmd = NL80211_CMD_NEW_INTERFACE;
2557 void *hdr;
2558
2559 if (removal)
2560 cmd = NL80211_CMD_DEL_INTERFACE;
2561
2562 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2563 if (!hdr)
2564 return -1;
2565
2566 if (dev &&
2567 (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2568 nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2569 goto nla_put_failure;
2570
2571 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2572 nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2573 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
2574 NL80211_ATTR_PAD) ||
2575 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2576 nla_put_u32(msg, NL80211_ATTR_GENERATION,
2577 rdev->devlist_generation ^
2578 (cfg80211_rdev_list_generation << 2)))
2579 goto nla_put_failure;
2580
2581 if (rdev->ops->get_channel) {
2582 int ret;
2583 struct cfg80211_chan_def chandef;
2584
2585 ret = rdev_get_channel(rdev, wdev, &chandef);
2586 if (ret == 0) {
2587 if (nl80211_send_chandef(msg, &chandef))
2588 goto nla_put_failure;
2589 }
2590 }
2591
2592 if (rdev->ops->get_tx_power) {
2593 int dbm, ret;
2594
2595 ret = rdev_get_tx_power(rdev, wdev, &dbm);
2596 if (ret == 0 &&
2597 nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
2598 DBM_TO_MBM(dbm)))
2599 goto nla_put_failure;
2600 }
2601
2602 if (wdev->ssid_len) {
2603 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2604 goto nla_put_failure;
2605 }
2606
2607 genlmsg_end(msg, hdr);
2608 return 0;
2609
2610 nla_put_failure:
2611 genlmsg_cancel(msg, hdr);
2612 return -EMSGSIZE;
2613 }
2614
2615 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2616 {
2617 int wp_idx = 0;
2618 int if_idx = 0;
2619 int wp_start = cb->args[0];
2620 int if_start = cb->args[1];
2621 int filter_wiphy = -1;
2622 struct cfg80211_registered_device *rdev;
2623 struct wireless_dev *wdev;
2624 int ret;
2625
2626 rtnl_lock();
2627 if (!cb->args[2]) {
2628 struct nl80211_dump_wiphy_state state = {
2629 .filter_wiphy = -1,
2630 };
2631
2632 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
2633 if (ret)
2634 goto out_unlock;
2635
2636 filter_wiphy = state.filter_wiphy;
2637
2638 /*
2639 * if filtering, set cb->args[2] to +1 since 0 is the default
2640 * value needed to determine that parsing is necessary.
2641 */
2642 if (filter_wiphy >= 0)
2643 cb->args[2] = filter_wiphy + 1;
2644 else
2645 cb->args[2] = -1;
2646 } else if (cb->args[2] > 0) {
2647 filter_wiphy = cb->args[2] - 1;
2648 }
2649
2650 list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2651 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2652 continue;
2653 if (wp_idx < wp_start) {
2654 wp_idx++;
2655 continue;
2656 }
2657
2658 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
2659 continue;
2660
2661 if_idx = 0;
2662
2663 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
2664 if (if_idx < if_start) {
2665 if_idx++;
2666 continue;
2667 }
2668 if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2669 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2670 rdev, wdev, false) < 0) {
2671 goto out;
2672 }
2673 if_idx++;
2674 }
2675
2676 wp_idx++;
2677 }
2678 out:
2679 cb->args[0] = wp_idx;
2680 cb->args[1] = if_idx;
2681
2682 ret = skb->len;
2683 out_unlock:
2684 rtnl_unlock();
2685
2686 return ret;
2687 }
2688
2689 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2690 {
2691 struct sk_buff *msg;
2692 struct cfg80211_registered_device *rdev = info->user_ptr[0];
2693 struct wireless_dev *wdev = info->user_ptr[1];
2694
2695 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2696 if (!msg)
2697 return -ENOMEM;
2698
2699 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2700 rdev, wdev, false) < 0) {
2701 nlmsg_free(msg);
2702 return -ENOBUFS;
2703 }
2704
2705 return genlmsg_reply(msg, info);
2706 }
2707
2708 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2709 [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2710 [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2711 [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2712 [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2713 [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2714 [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2715 };
2716
2717 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2718 {
2719 struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2720 int flag;
2721
2722 *mntrflags = 0;
2723
2724 if (!nla)
2725 return -EINVAL;
2726
2727 if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX, nla,
2728 mntr_flags_policy, NULL))
2729 return -EINVAL;
2730
2731 for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2732 if (flags[flag])
2733 *mntrflags |= (1<<flag);
2734
2735 *mntrflags |= MONITOR_FLAG_CHANGED;
2736
2737 return 0;
2738 }
2739
2740 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
2741 enum nl80211_iftype type,
2742 struct genl_info *info,
2743 struct vif_params *params)
2744 {
2745 bool change = false;
2746 int err;
2747
2748 if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2749 if (type != NL80211_IFTYPE_MONITOR)
2750 return -EINVAL;
2751
2752 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2753 &params->flags);
2754 if (err)
2755 return err;
2756
2757 change = true;
2758 }
2759
2760 if (params->flags & MONITOR_FLAG_ACTIVE &&
2761 !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2762 return -EOPNOTSUPP;
2763
2764 if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
2765 const u8 *mumimo_groups;
2766 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
2767
2768 if (type != NL80211_IFTYPE_MONITOR)
2769 return -EINVAL;
2770
2771 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
2772 return -EOPNOTSUPP;
2773
2774 mumimo_groups =
2775 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
2776
2777 /* bits 0 and 63 are reserved and must be zero */
2778 if ((mumimo_groups[0] & BIT(0)) ||
2779 (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
2780 return -EINVAL;
2781
2782 params->vht_mumimo_groups = mumimo_groups;
2783 change = true;
2784 }
2785
2786 if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
2787 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
2788
2789 if (type != NL80211_IFTYPE_MONITOR)
2790 return -EINVAL;
2791
2792 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
2793 return -EOPNOTSUPP;
2794
2795 params->vht_mumimo_follow_addr =
2796 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
2797 change = true;
2798 }
2799
2800 return change ? 1 : 0;
2801 }
2802
2803 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2804 struct net_device *netdev, u8 use_4addr,
2805 enum nl80211_iftype iftype)
2806 {
2807 if (!use_4addr) {
2808 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2809 return -EBUSY;
2810 return 0;
2811 }
2812
2813 switch (iftype) {
2814 case NL80211_IFTYPE_AP_VLAN:
2815 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2816 return 0;
2817 break;
2818 case NL80211_IFTYPE_STATION:
2819 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2820 return 0;
2821 break;
2822 default:
2823 break;
2824 }
2825
2826 return -EOPNOTSUPP;
2827 }
2828
2829 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2830 {
2831 struct cfg80211_registered_device *rdev = info->user_ptr[0];
2832 struct vif_params params;
2833 int err;
2834 enum nl80211_iftype otype, ntype;
2835 struct net_device *dev = info->user_ptr[1];
2836 bool change = false;
2837
2838 memset(&params, 0, sizeof(params));
2839
2840 otype = ntype = dev->ieee80211_ptr->iftype;
2841
2842 if (info->attrs[NL80211_ATTR_IFTYPE]) {
2843 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2844 if (otype != ntype)
2845 change = true;
2846 if (ntype > NL80211_IFTYPE_MAX)
2847 return -EINVAL;
2848 }
2849
2850 if (info->attrs[NL80211_ATTR_MESH_ID]) {
2851 struct wireless_dev *wdev = dev->ieee80211_ptr;
2852
2853 if (ntype != NL80211_IFTYPE_MESH_POINT)
2854 return -EINVAL;
2855 if (netif_running(dev))
2856 return -EBUSY;
2857
2858 wdev_lock(wdev);
2859 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2860 IEEE80211_MAX_MESH_ID_LEN);
2861 wdev->mesh_id_up_len =
2862 nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2863 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2864 wdev->mesh_id_up_len);
2865 wdev_unlock(wdev);
2866 }
2867
2868 if (info->attrs[NL80211_ATTR_4ADDR]) {
2869 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2870 change = true;
2871 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2872 if (err)
2873 return err;
2874 } else {
2875 params.use_4addr = -1;
2876 }
2877
2878 err = nl80211_parse_mon_options(rdev, ntype, info, &params);
2879 if (err < 0)
2880 return err;
2881 if (err > 0)
2882 change = true;
2883
2884 if (change)
2885 err = cfg80211_change_iface(rdev, dev, ntype, &params);
2886 else
2887 err = 0;
2888
2889 if (!err && params.use_4addr != -1)
2890 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2891
2892 return err;
2893 }
2894
2895 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2896 {
2897 struct cfg80211_registered_device *rdev = info->user_ptr[0];
2898 struct vif_params params;
2899 struct wireless_dev *wdev;
2900 struct sk_buff *msg;
2901 int err;
2902 enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2903
2904 /* to avoid failing a new interface creation due to pending removal */
2905 cfg80211_destroy_ifaces(rdev);
2906
2907 memset(&params, 0, sizeof(params));
2908
2909 if (!info->attrs[NL80211_ATTR_IFNAME])
2910 return -EINVAL;
2911
2912 if (info->attrs[NL80211_ATTR_IFTYPE]) {
2913 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2914 if (type > NL80211_IFTYPE_MAX)
2915 return -EINVAL;
2916 }
2917
2918 if (!rdev->ops->add_virtual_intf ||
2919 !(rdev->wiphy.interface_modes & (1 << type)))
2920 return -EOPNOTSUPP;
2921
2922 if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
2923 rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
2924 info->attrs[NL80211_ATTR_MAC]) {
2925 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2926 ETH_ALEN);
2927 if (!is_valid_ether_addr(params.macaddr))
2928 return -EADDRNOTAVAIL;
2929 }
2930
2931 if (info->attrs[NL80211_ATTR_4ADDR]) {
2932 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2933 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2934 if (err)
2935 return err;
2936 }
2937
2938 err = nl80211_parse_mon_options(rdev, type, info, &params);
2939 if (err < 0)
2940 return err;
2941
2942 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2943 if (!msg)
2944 return -ENOMEM;
2945
2946 wdev = rdev_add_virtual_intf(rdev,
2947 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2948 NET_NAME_USER, type, &params);
2949 if (WARN_ON(!wdev)) {
2950 nlmsg_free(msg);
2951 return -EPROTO;
2952 } else if (IS_ERR(wdev)) {
2953 nlmsg_free(msg);
2954 return PTR_ERR(wdev);
2955 }
2956
2957 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
2958 wdev->owner_nlportid = info->snd_portid;
2959
2960 switch (type) {
2961 case NL80211_IFTYPE_MESH_POINT:
2962 if (!info->attrs[NL80211_ATTR_MESH_ID])
2963 break;
2964 wdev_lock(wdev);
2965 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2966 IEEE80211_MAX_MESH_ID_LEN);
2967 wdev->mesh_id_up_len =
2968 nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2969 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2970 wdev->mesh_id_up_len);
2971 wdev_unlock(wdev);
2972 break;
2973 case NL80211_IFTYPE_NAN:
2974 case NL80211_IFTYPE_P2P_DEVICE:
2975 /*
2976 * P2P Device and NAN do not have a netdev, so don't go
2977 * through the netdev notifier and must be added here
2978 */
2979 mutex_init(&wdev->mtx);
2980 INIT_LIST_HEAD(&wdev->event_list);
2981 spin_lock_init(&wdev->event_lock);
2982 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2983 spin_lock_init(&wdev->mgmt_registrations_lock);
2984
2985 wdev->identifier = ++rdev->wdev_id;
2986 list_add_rcu(&wdev->list, &rdev->wiphy.wdev_list);
2987 rdev->devlist_generation++;
2988 break;
2989 default:
2990 break;
2991 }
2992
2993 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2994 rdev, wdev, false) < 0) {
2995 nlmsg_free(msg);
2996 return -ENOBUFS;
2997 }
2998
2999 /*
3000 * For wdevs which have no associated netdev object (e.g. of type
3001 * NL80211_IFTYPE_P2P_DEVICE), emit the NEW_INTERFACE event here.
3002 * For all other types, the event will be generated from the
3003 * netdev notifier
3004 */
3005 if (!wdev->netdev)
3006 nl80211_notify_iface(rdev, wdev, NL80211_CMD_NEW_INTERFACE);
3007
3008 return genlmsg_reply(msg, info);
3009 }
3010
3011 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
3012 {
3013 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3014 struct wireless_dev *wdev = info->user_ptr[1];
3015
3016 if (!rdev->ops->del_virtual_intf)
3017 return -EOPNOTSUPP;
3018
3019 /*
3020 * If we remove a wireless device without a netdev then clear
3021 * user_ptr[1] so that nl80211_post_doit won't dereference it
3022 * to check if it needs to do dev_put(). Otherwise it crashes
3023 * since the wdev has been freed, unlike with a netdev where
3024 * we need the dev_put() for the netdev to really be freed.
3025 */
3026 if (!wdev->netdev)
3027 info->user_ptr[1] = NULL;
3028
3029 return rdev_del_virtual_intf(rdev, wdev);
3030 }
3031
3032 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
3033 {
3034 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3035 struct net_device *dev = info->user_ptr[1];
3036 u16 noack_map;
3037
3038 if (!info->attrs[NL80211_ATTR_NOACK_MAP])
3039 return -EINVAL;
3040
3041 if (!rdev->ops->set_noack_map)
3042 return -EOPNOTSUPP;
3043
3044 noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
3045
3046 return rdev_set_noack_map(rdev, dev, noack_map);
3047 }
3048
3049 struct get_key_cookie {
3050 struct sk_buff *msg;
3051 int error;
3052 int idx;
3053 };
3054
3055 static void get_key_callback(void *c, struct key_params *params)
3056 {
3057 struct nlattr *key;
3058 struct get_key_cookie *cookie = c;
3059
3060 if ((params->key &&
3061 nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
3062 params->key_len, params->key)) ||
3063 (params->seq &&
3064 nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
3065 params->seq_len, params->seq)) ||
3066 (params->cipher &&
3067 nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
3068 params->cipher)))
3069 goto nla_put_failure;
3070
3071 key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
3072 if (!key)
3073 goto nla_put_failure;
3074
3075 if ((params->key &&
3076 nla_put(cookie->msg, NL80211_KEY_DATA,
3077 params->key_len, params->key)) ||
3078 (params->seq &&
3079 nla_put(cookie->msg, NL80211_KEY_SEQ,
3080 params->seq_len, params->seq)) ||
3081 (params->cipher &&
3082 nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
3083 params->cipher)))
3084 goto nla_put_failure;
3085
3086 if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
3087 goto nla_put_failure;
3088
3089 nla_nest_end(cookie->msg, key);
3090
3091 return;
3092 nla_put_failure:
3093 cookie->error = 1;
3094 }
3095
3096 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
3097 {
3098 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3099 int err;
3100 struct net_device *dev = info->user_ptr[1];
3101 u8 key_idx = 0;
3102 const u8 *mac_addr = NULL;
3103 bool pairwise;
3104 struct get_key_cookie cookie = {
3105 .error = 0,
3106 };
3107 void *hdr;
3108 struct sk_buff *msg;
3109
3110 if (info->attrs[NL80211_ATTR_KEY_IDX])
3111 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
3112
3113 if (key_idx > 5)
3114 return -EINVAL;
3115
3116 if (info->attrs[NL80211_ATTR_MAC])
3117 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3118
3119 pairwise = !!mac_addr;
3120 if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
3121 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
3122
3123 if (kt >= NUM_NL80211_KEYTYPES)
3124 return -EINVAL;
3125 if (kt != NL80211_KEYTYPE_GROUP &&
3126 kt != NL80211_KEYTYPE_PAIRWISE)
3127 return -EINVAL;
3128 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
3129 }
3130
3131 if (!rdev->ops->get_key)
3132 return -EOPNOTSUPP;
3133
3134 if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3135 return -ENOENT;
3136
3137 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3138 if (!msg)
3139 return -ENOMEM;
3140
3141 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
3142 NL80211_CMD_NEW_KEY);
3143 if (!hdr)
3144 goto nla_put_failure;
3145
3146 cookie.msg = msg;
3147 cookie.idx = key_idx;
3148
3149 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3150 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
3151 goto nla_put_failure;
3152 if (mac_addr &&
3153 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
3154 goto nla_put_failure;
3155
3156 err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
3157 get_key_callback);
3158
3159 if (err)
3160 goto free_msg;
3161
3162 if (cookie.error)
3163 goto nla_put_failure;
3164
3165 genlmsg_end(msg, hdr);
3166 return genlmsg_reply(msg, info);
3167
3168 nla_put_failure:
3169 err = -ENOBUFS;
3170 free_msg:
3171 nlmsg_free(msg);
3172 return err;
3173 }
3174
3175 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
3176 {
3177 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3178 struct key_parse key;
3179 int err;
3180 struct net_device *dev = info->user_ptr[1];
3181
3182 err = nl80211_parse_key(info, &key);
3183 if (err)
3184 return err;
3185
3186 if (key.idx < 0)
3187 return -EINVAL;
3188
3189 /* only support setting default key */
3190 if (!key.def && !key.defmgmt)
3191 return -EINVAL;
3192
3193 wdev_lock(dev->ieee80211_ptr);
3194
3195 if (key.def) {
3196 if (!rdev->ops->set_default_key) {
3197 err = -EOPNOTSUPP;
3198 goto out;
3199 }
3200
3201 err = nl80211_key_allowed(dev->ieee80211_ptr);
3202 if (err)
3203 goto out;
3204
3205 err = rdev_set_default_key(rdev, dev, key.idx,
3206 key.def_uni, key.def_multi);
3207
3208 if (err)
3209 goto out;
3210
3211 #ifdef CONFIG_CFG80211_WEXT
3212 dev->ieee80211_ptr->wext.default_key = key.idx;
3213 #endif
3214 } else {
3215 if (key.def_uni || !key.def_multi) {
3216 err = -EINVAL;
3217 goto out;
3218 }
3219
3220 if (!rdev->ops->set_default_mgmt_key) {
3221 err = -EOPNOTSUPP;
3222 goto out;
3223 }
3224
3225 err = nl80211_key_allowed(dev->ieee80211_ptr);
3226 if (err)
3227 goto out;
3228
3229 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
3230 if (err)
3231 goto out;
3232
3233 #ifdef CONFIG_CFG80211_WEXT
3234 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
3235 #endif
3236 }
3237
3238 out:
3239 wdev_unlock(dev->ieee80211_ptr);
3240
3241 return err;
3242 }
3243
3244 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
3245 {
3246 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3247 int err;
3248 struct net_device *dev = info->user_ptr[1];
3249 struct key_parse key;
3250 const u8 *mac_addr = NULL;
3251
3252 err = nl80211_parse_key(info, &key);
3253 if (err)
3254 return err;
3255
3256 if (!key.p.key)
3257 return -EINVAL;
3258
3259 if (info->attrs[NL80211_ATTR_MAC])
3260 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3261
3262 if (key.type == -1) {
3263 if (mac_addr)
3264 key.type = NL80211_KEYTYPE_PAIRWISE;
3265 else
3266 key.type = NL80211_KEYTYPE_GROUP;
3267 }
3268
3269 /* for now */
3270 if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3271 key.type != NL80211_KEYTYPE_GROUP)
3272 return -EINVAL;
3273
3274 if (!rdev->ops->add_key)
3275 return -EOPNOTSUPP;
3276
3277 if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
3278 key.type == NL80211_KEYTYPE_PAIRWISE,
3279 mac_addr))
3280 return -EINVAL;
3281
3282 wdev_lock(dev->ieee80211_ptr);
3283 err = nl80211_key_allowed(dev->ieee80211_ptr);
3284 if (!err)
3285 err = rdev_add_key(rdev, dev, key.idx,
3286 key.type == NL80211_KEYTYPE_PAIRWISE,
3287 mac_addr, &key.p);
3288 wdev_unlock(dev->ieee80211_ptr);
3289
3290 return err;
3291 }
3292
3293 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
3294 {
3295 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3296 int err;
3297 struct net_device *dev = info->user_ptr[1];
3298 u8 *mac_addr = NULL;
3299 struct key_parse key;
3300
3301 err = nl80211_parse_key(info, &key);
3302 if (err)
3303 return err;
3304
3305 if (info->attrs[NL80211_ATTR_MAC])
3306 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3307
3308 if (key.type == -1) {
3309 if (mac_addr)
3310 key.type = NL80211_KEYTYPE_PAIRWISE;
3311 else
3312 key.type = NL80211_KEYTYPE_GROUP;
3313 }
3314
3315 /* for now */
3316 if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3317 key.type != NL80211_KEYTYPE_GROUP)
3318 return -EINVAL;
3319
3320 if (!rdev->ops->del_key)
3321 return -EOPNOTSUPP;
3322
3323 wdev_lock(dev->ieee80211_ptr);
3324 err = nl80211_key_allowed(dev->ieee80211_ptr);
3325
3326 if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
3327 !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3328 err = -ENOENT;
3329
3330 if (!err)
3331 err = rdev_del_key(rdev, dev, key.idx,
3332 key.type == NL80211_KEYTYPE_PAIRWISE,
3333 mac_addr);
3334
3335 #ifdef CONFIG_CFG80211_WEXT
3336 if (!err) {
3337 if (key.idx == dev->ieee80211_ptr->wext.default_key)
3338 dev->ieee80211_ptr->wext.default_key = -1;
3339 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
3340 dev->ieee80211_ptr->wext.default_mgmt_key = -1;
3341 }
3342 #endif
3343 wdev_unlock(dev->ieee80211_ptr);
3344
3345 return err;
3346 }
3347
3348 /* This function returns an error or the number of nested attributes */
3349 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
3350 {
3351 struct nlattr *attr;
3352 int n_entries = 0, tmp;
3353
3354 nla_for_each_nested(attr, nl_attr, tmp) {
3355 if (nla_len(attr) != ETH_ALEN)
3356 return -EINVAL;
3357
3358 n_entries++;
3359 }
3360
3361 return n_entries;
3362 }
3363
3364 /*
3365 * This function parses ACL information and allocates memory for ACL data.
3366 * On successful return, the calling function is responsible to free the
3367 * ACL buffer returned by this function.
3368 */
3369 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3370 struct genl_info *info)
3371 {
3372 enum nl80211_acl_policy acl_policy;
3373 struct nlattr *attr;
3374 struct cfg80211_acl_data *acl;
3375 int i = 0, n_entries, tmp;
3376
3377 if (!wiphy->max_acl_mac_addrs)
3378 return ERR_PTR(-EOPNOTSUPP);
3379
3380 if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3381 return ERR_PTR(-EINVAL);
3382
3383 acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3384 if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3385 acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3386 return ERR_PTR(-EINVAL);
3387
3388 if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3389 return ERR_PTR(-EINVAL);
3390
3391 n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3392 if (n_entries < 0)
3393 return ERR_PTR(n_entries);
3394
3395 if (n_entries > wiphy->max_acl_mac_addrs)
3396 return ERR_PTR(-ENOTSUPP);
3397
3398 acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
3399 GFP_KERNEL);
3400 if (!acl)
3401 return ERR_PTR(-ENOMEM);
3402
3403 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3404 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3405 i++;
3406 }
3407
3408 acl->n_acl_entries = n_entries;
3409 acl->acl_policy = acl_policy;
3410
3411 return acl;
3412 }
3413
3414 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3415 {
3416 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3417 struct net_device *dev = info->user_ptr[1];
3418 struct cfg80211_acl_data *acl;
3419 int err;
3420
3421 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3422 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3423 return -EOPNOTSUPP;
3424
3425 if (!dev->ieee80211_ptr->beacon_interval)
3426 return -EINVAL;
3427
3428 acl = parse_acl_data(&rdev->wiphy, info);
3429 if (IS_ERR(acl))
3430 return PTR_ERR(acl);
3431
3432 err = rdev_set_mac_acl(rdev, dev, acl);
3433
3434 kfree(acl);
3435
3436 return err;
3437 }
3438
3439 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
3440 u8 *rates, u8 rates_len)
3441 {
3442 u8 i;
3443 u32 mask = 0;
3444
3445 for (i = 0; i < rates_len; i++) {
3446 int rate = (rates[i] & 0x7f) * 5;
3447 int ridx;
3448
3449 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
3450 struct ieee80211_rate *srate =
3451 &sband->bitrates[ridx];
3452 if (rate == srate->bitrate) {
3453 mask |= 1 << ridx;
3454 break;
3455 }
3456 }
3457 if (ridx == sband->n_bitrates)
3458 return 0; /* rate not found */
3459 }
3460
3461 return mask;
3462 }
3463
3464 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
3465 u8 *rates, u8 rates_len,
3466 u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
3467 {
3468 u8 i;
3469
3470 memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
3471
3472 for (i = 0; i < rates_len; i++) {
3473 int ridx, rbit;
3474
3475 ridx = rates[i] / 8;
3476 rbit = BIT(rates[i] % 8);
3477
3478 /* check validity */
3479 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
3480 return false;
3481
3482 /* check availability */
3483 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
3484 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
3485 mcs[ridx] |= rbit;
3486 else
3487 return false;
3488 }
3489
3490 return true;
3491 }
3492
3493 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
3494 {
3495 u16 mcs_mask = 0;
3496
3497 switch (vht_mcs_map) {
3498 case IEEE80211_VHT_MCS_NOT_SUPPORTED:
3499 break;
3500 case IEEE80211_VHT_MCS_SUPPORT_0_7:
3501 mcs_mask = 0x00FF;
3502 break;
3503 case IEEE80211_VHT_MCS_SUPPORT_0_8:
3504 mcs_mask = 0x01FF;
3505 break;
3506 case IEEE80211_VHT_MCS_SUPPORT_0_9:
3507 mcs_mask = 0x03FF;
3508 break;
3509 default:
3510 break;
3511 }
3512
3513 return mcs_mask;
3514 }
3515
3516 static void vht_build_mcs_mask(u16 vht_mcs_map,
3517 u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
3518 {
3519 u8 nss;
3520
3521 for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
3522 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
3523 vht_mcs_map >>= 2;
3524 }
3525 }
3526
3527 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
3528 struct nl80211_txrate_vht *txrate,
3529 u16 mcs[NL80211_VHT_NSS_MAX])
3530 {
3531 u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
3532 u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
3533 u8 i;
3534
3535 if (!sband->vht_cap.vht_supported)
3536 return false;
3537
3538 memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
3539
3540 /* Build vht_mcs_mask from VHT capabilities */
3541 vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
3542
3543 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
3544 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
3545 mcs[i] = txrate->mcs[i];
3546 else
3547 return false;
3548 }
3549
3550 return true;
3551 }
3552
3553 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
3554 [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
3555 .len = NL80211_MAX_SUPP_RATES },
3556 [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
3557 .len = NL80211_MAX_SUPP_HT_RATES },
3558 [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
3559 [NL80211_TXRATE_GI] = { .type = NLA_U8 },
3560 };
3561
3562 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
3563 struct cfg80211_bitrate_mask *mask)
3564 {
3565 struct nlattr *tb[NL80211_TXRATE_MAX + 1];
3566 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3567 int rem, i;
3568 struct nlattr *tx_rates;
3569 struct ieee80211_supported_band *sband;
3570 u16 vht_tx_mcs_map;
3571
3572 memset(mask, 0, sizeof(*mask));
3573 /* Default to all rates enabled */
3574 for (i = 0; i < NUM_NL80211_BANDS; i++) {
3575 sband = rdev->wiphy.bands[i];
3576
3577 if (!sband)
3578 continue;
3579
3580 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
3581 memcpy(mask->control[i].ht_mcs,
3582 sband->ht_cap.mcs.rx_mask,
3583 sizeof(mask->control[i].ht_mcs));
3584
3585 if (!sband->vht_cap.vht_supported)
3586 continue;
3587
3588 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
3589 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
3590 }
3591
3592 /* if no rates are given set it back to the defaults */
3593 if (!info->attrs[NL80211_ATTR_TX_RATES])
3594 goto out;
3595
3596 /* The nested attribute uses enum nl80211_band as the index. This maps
3597 * directly to the enum nl80211_band values used in cfg80211.
3598 */
3599 BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
3600 nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
3601 enum nl80211_band band = nla_type(tx_rates);
3602 int err;
3603
3604 if (band < 0 || band >= NUM_NL80211_BANDS)
3605 return -EINVAL;
3606 sband = rdev->wiphy.bands[band];
3607 if (sband == NULL)
3608 return -EINVAL;
3609 err = nla_parse_nested(tb, NL80211_TXRATE_MAX, tx_rates,
3610 nl80211_txattr_policy, info->extack);
3611 if (err)
3612 return err;
3613 if (tb[NL80211_TXRATE_LEGACY]) {
3614 mask->control[band].legacy = rateset_to_mask(
3615 sband,
3616 nla_data(tb[NL80211_TXRATE_LEGACY]),
3617 nla_len(tb[NL80211_TXRATE_LEGACY]));
3618 if ((mask->control[band].legacy == 0) &&
3619 nla_len(tb[NL80211_TXRATE_LEGACY]))
3620 return -EINVAL;
3621 }
3622 if (tb[NL80211_TXRATE_HT]) {
3623 if (!ht_rateset_to_mask(
3624 sband,
3625 nla_data(tb[NL80211_TXRATE_HT]),
3626 nla_len(tb[NL80211_TXRATE_HT]),
3627 mask->control[band].ht_mcs))
3628 return -EINVAL;
3629 }
3630 if (tb[NL80211_TXRATE_VHT]) {
3631 if (!vht_set_mcs_mask(
3632 sband,
3633 nla_data(tb[NL80211_TXRATE_VHT]),
3634 mask->control[band].vht_mcs))
3635 return -EINVAL;
3636 }
3637 if (tb[NL80211_TXRATE_GI]) {
3638 mask->control[band].gi =
3639 nla_get_u8(tb[NL80211_TXRATE_GI]);
3640 if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
3641 return -EINVAL;
3642 }
3643
3644 if (mask->control[band].legacy == 0) {
3645 /* don't allow empty legacy rates if HT or VHT
3646 * are not even supported.
3647 */
3648 if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
3649 rdev->wiphy.bands[band]->vht_cap.vht_supported))
3650 return -EINVAL;
3651
3652 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
3653 if (mask->control[band].ht_mcs[i])
3654 goto out;
3655
3656 for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
3657 if (mask->control[band].vht_mcs[i])
3658 goto out;
3659
3660 /* legacy and mcs rates may not be both empty */
3661 return -EINVAL;
3662 }
3663 }
3664
3665 out:
3666 return 0;
3667 }
3668
3669 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
3670 enum nl80211_band band,
3671 struct cfg80211_bitrate_mask *beacon_rate)
3672 {
3673 u32 count_ht, count_vht, i;
3674 u32 rate = beacon_rate->control[band].legacy;
3675
3676 /* Allow only one rate */
3677 if (hweight32(rate) > 1)
3678 return -EINVAL;
3679
3680 count_ht = 0;
3681 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3682 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
3683 return -EINVAL;
3684 } else if (beacon_rate->control[band].ht_mcs[i]) {
3685 count_ht++;
3686 if (count_ht > 1)
3687 return -EINVAL;
3688 }
3689 if (count_ht && rate)
3690 return -EINVAL;
3691 }
3692
3693 count_vht = 0;
3694 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
3695 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
3696 return -EINVAL;
3697 } else if (beacon_rate->control[band].vht_mcs[i]) {
3698 count_vht++;
3699 if (count_vht > 1)
3700 return -EINVAL;
3701 }
3702 if (count_vht && rate)
3703 return -EINVAL;
3704 }
3705
3706 if ((count_ht && count_vht) || (!rate && !count_ht && !count_vht))
3707 return -EINVAL;
3708
3709 if (rate &&
3710 !wiphy_ext_feature_isset(&rdev->wiphy,
3711 NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
3712 return -EINVAL;
3713 if (count_ht &&
3714 !wiphy_ext_feature_isset(&rdev->wiphy,
3715 NL80211_EXT_FEATURE_BEACON_RATE_HT))
3716 return -EINVAL;
3717 if (count_vht &&
3718 !wiphy_ext_feature_isset(&rdev->wiphy,
3719 NL80211_EXT_FEATURE_BEACON_RATE_VHT))
3720 return -EINVAL;
3721
3722 return 0;
3723 }
3724
3725 static int nl80211_parse_beacon(struct nlattr *attrs[],
3726 struct cfg80211_beacon_data *bcn)
3727 {
3728 bool haveinfo = false;
3729
3730 if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
3731 !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
3732 !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
3733 !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
3734 return -EINVAL;
3735
3736 memset(bcn, 0, sizeof(*bcn));
3737
3738 if (attrs[NL80211_ATTR_BEACON_HEAD]) {
3739 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
3740 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
3741 if (!bcn->head_len)
3742 return -EINVAL;
3743 haveinfo = true;
3744 }
3745
3746 if (attrs[NL80211_ATTR_BEACON_TAIL]) {
3747 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
3748 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
3749 haveinfo = true;
3750 }
3751
3752 if (!haveinfo)
3753 return -EINVAL;
3754
3755 if (attrs[NL80211_ATTR_IE]) {
3756 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
3757 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
3758 }
3759
3760 if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
3761 bcn->proberesp_ies =
3762 nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3763 bcn->proberesp_ies_len =
3764 nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3765 }
3766
3767 if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
3768 bcn->assocresp_ies =
3769 nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3770 bcn->assocresp_ies_len =
3771 nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3772 }
3773
3774 if (attrs[NL80211_ATTR_PROBE_RESP]) {
3775 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
3776 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
3777 }
3778
3779 return 0;
3780 }
3781
3782 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
3783 const u8 *rates)
3784 {
3785 int i;
3786
3787 if (!rates)
3788 return;
3789
3790 for (i = 0; i < rates[1]; i++) {
3791 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
3792 params->ht_required = true;
3793 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
3794 params->vht_required = true;
3795 }
3796 }
3797
3798 /*
3799 * Since the nl80211 API didn't include, from the beginning, attributes about
3800 * HT/VHT requirements/capabilities, we parse them out of the IEs for the
3801 * benefit of drivers that rebuild IEs in the firmware.
3802 */
3803 static void nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
3804 {
3805 const struct cfg80211_beacon_data *bcn = &params->beacon;
3806 size_t ies_len = bcn->tail_len;
3807 const u8 *ies = bcn->tail;
3808 const u8 *rates;
3809 const u8 *cap;
3810
3811 rates = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies, ies_len);
3812 nl80211_check_ap_rate_selectors(params, rates);
3813
3814 rates = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
3815 nl80211_check_ap_rate_selectors(params, rates);
3816
3817 cap = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies, ies_len);
3818 if (cap && cap[1] >= sizeof(*params->ht_cap))
3819 params->ht_cap = (void *)(cap + 2);
3820 cap = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
3821 if (cap && cap[1] >= sizeof(*params->vht_cap))
3822 params->vht_cap = (void *)(cap + 2);
3823 }
3824
3825 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
3826 struct cfg80211_ap_settings *params)
3827 {
3828 struct wireless_dev *wdev;
3829 bool ret = false;
3830
3831 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
3832 if (wdev->iftype != NL80211_IFTYPE_AP &&
3833 wdev->iftype != NL80211_IFTYPE_P2P_GO)
3834 continue;
3835
3836 if (!wdev->preset_chandef.chan)
3837 continue;
3838
3839 params->chandef = wdev->preset_chandef;
3840 ret = true;
3841 break;
3842 }
3843
3844 return ret;
3845 }
3846
3847 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3848 enum nl80211_auth_type auth_type,
3849 enum nl80211_commands cmd)
3850 {
3851 if (auth_type > NL80211_AUTHTYPE_MAX)
3852 return false;
3853
3854 switch (cmd) {
3855 case NL80211_CMD_AUTHENTICATE:
3856 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3857 auth_type == NL80211_AUTHTYPE_SAE)
3858 return false;
3859 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3860 NL80211_EXT_FEATURE_FILS_STA) &&
3861 (auth_type == NL80211_AUTHTYPE_FILS_SK ||
3862 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
3863 auth_type == NL80211_AUTHTYPE_FILS_PK))
3864 return false;
3865 return true;
3866 case NL80211_CMD_CONNECT:
3867 /* SAE not supported yet */
3868 if (auth_type == NL80211_AUTHTYPE_SAE)
3869 return false;
3870 /* FILS with SK PFS or PK not supported yet */
3871 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
3872 auth_type == NL80211_AUTHTYPE_FILS_PK)
3873 return false;
3874 if (!wiphy_ext_feature_isset(
3875 &rdev->wiphy,
3876 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
3877 auth_type == NL80211_AUTHTYPE_FILS_SK)
3878 return false;
3879 return true;
3880 case NL80211_CMD_START_AP:
3881 /* SAE not supported yet */
3882 if (auth_type == NL80211_AUTHTYPE_SAE)
3883 return false;
3884 /* FILS not supported yet */
3885 if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
3886 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
3887 auth_type == NL80211_AUTHTYPE_FILS_PK)
3888 return false;
3889 return true;
3890 default:
3891 return false;
3892 }
3893 }
3894
3895 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3896 {
3897 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3898 struct net_device *dev = info->user_ptr[1];
3899 struct wireless_dev *wdev = dev->ieee80211_ptr;
3900 struct cfg80211_ap_settings params;
3901 int err;
3902
3903 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3904 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3905 return -EOPNOTSUPP;
3906
3907 if (!rdev->ops->start_ap)
3908 return -EOPNOTSUPP;
3909
3910 if (wdev->beacon_interval)
3911 return -EALREADY;
3912
3913 memset(&params, 0, sizeof(params));
3914
3915 /* these are required for START_AP */
3916 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3917 !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3918 !info->attrs[NL80211_ATTR_BEACON_HEAD])
3919 return -EINVAL;
3920
3921 err = nl80211_parse_beacon(info->attrs, &params.beacon);
3922 if (err)
3923 return err;
3924
3925 params.beacon_interval =
3926 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3927 params.dtim_period =
3928 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3929
3930 err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
3931 params.beacon_interval);
3932 if (err)
3933 return err;
3934
3935 /*
3936 * In theory, some of these attributes should be required here
3937 * but since they were not used when the command was originally
3938 * added, keep them optional for old user space programs to let
3939 * them continue to work with drivers that do not need the
3940 * additional information -- drivers must check!
3941 */
3942 if (info->attrs[NL80211_ATTR_SSID]) {
3943 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3944 params.ssid_len =
3945 nla_len(info->attrs[NL80211_ATTR_SSID]);
3946 if (params.ssid_len == 0 ||
3947 params.ssid_len > IEEE80211_MAX_SSID_LEN)
3948 return -EINVAL;
3949 }
3950
3951 if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3952 params.hidden_ssid = nla_get_u32(
3953 info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3954 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3955 params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3956 params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3957 return -EINVAL;
3958 }
3959
3960 params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3961
3962 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3963 params.auth_type = nla_get_u32(
3964 info->attrs[NL80211_ATTR_AUTH_TYPE]);
3965 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3966 NL80211_CMD_START_AP))
3967 return -EINVAL;
3968 } else
3969 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3970
3971 err = nl80211_crypto_settings(rdev, info, &params.crypto,
3972 NL80211_MAX_NR_CIPHER_SUITES);
3973 if (err)
3974 return err;
3975
3976 if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3977 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3978 return -EOPNOTSUPP;
3979 params.inactivity_timeout = nla_get_u16(
3980 info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3981 }
3982
3983 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3984 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3985 return -EINVAL;
3986 params.p2p_ctwindow =
3987 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3988 if (params.p2p_ctwindow > 127)
3989 return -EINVAL;
3990 if (params.p2p_ctwindow != 0 &&
3991 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3992 return -EINVAL;
3993 }
3994
3995 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3996 u8 tmp;
3997
3998 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3999 return -EINVAL;
4000 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4001 if (tmp > 1)
4002 return -EINVAL;
4003 params.p2p_opp_ps = tmp;
4004 if (params.p2p_opp_ps != 0 &&
4005 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4006 return -EINVAL;
4007 }
4008
4009 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4010 err = nl80211_parse_chandef(rdev, info, &params.chandef);
4011 if (err)
4012 return err;
4013 } else if (wdev->preset_chandef.chan) {
4014 params.chandef = wdev->preset_chandef;
4015 } else if (!nl80211_get_ap_channel(rdev, &params))
4016 return -EINVAL;
4017
4018 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
4019 wdev->iftype))
4020 return -EINVAL;
4021
4022 if (info->attrs[NL80211_ATTR_TX_RATES]) {
4023 err = nl80211_parse_tx_bitrate_mask(info, &params.beacon_rate);
4024 if (err)
4025 return err;
4026
4027 err = validate_beacon_tx_rate(rdev, params.chandef.chan->band,
4028 &params.beacon_rate);
4029 if (err)
4030 return err;
4031 }
4032
4033 if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
4034 params.smps_mode =
4035 nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
4036 switch (params.smps_mode) {
4037 case NL80211_SMPS_OFF:
4038 break;
4039 case NL80211_SMPS_STATIC:
4040 if (!(rdev->wiphy.features &
4041 NL80211_FEATURE_STATIC_SMPS))
4042 return -EINVAL;
4043 break;
4044 case NL80211_SMPS_DYNAMIC:
4045 if (!(rdev->wiphy.features &
4046 NL80211_FEATURE_DYNAMIC_SMPS))
4047 return -EINVAL;
4048 break;
4049 default:
4050 return -EINVAL;
4051 }
4052 } else {
4053 params.smps_mode = NL80211_SMPS_OFF;
4054 }
4055
4056 params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
4057 if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ])
4058 return -EOPNOTSUPP;
4059
4060 if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
4061 params.acl = parse_acl_data(&rdev->wiphy, info);
4062 if (IS_ERR(params.acl))
4063 return PTR_ERR(params.acl);
4064 }
4065
4066 nl80211_calculate_ap_params(&params);
4067
4068 wdev_lock(wdev);
4069 err = rdev_start_ap(rdev, dev, &params);
4070 if (!err) {
4071 wdev->preset_chandef = params.chandef;
4072 wdev->beacon_interval = params.beacon_interval;
4073 wdev->chandef = params.chandef;
4074 wdev->ssid_len = params.ssid_len;
4075 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
4076 }
4077 wdev_unlock(wdev);
4078
4079 kfree(params.acl);
4080
4081 return err;
4082 }
4083
4084 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
4085 {
4086 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4087 struct net_device *dev = info->user_ptr[1];
4088 struct wireless_dev *wdev = dev->ieee80211_ptr;
4089 struct cfg80211_beacon_data params;
4090 int err;
4091
4092 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4093 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4094 return -EOPNOTSUPP;
4095
4096 if (!rdev->ops->change_beacon)
4097 return -EOPNOTSUPP;
4098
4099 if (!wdev->beacon_interval)
4100 return -EINVAL;
4101
4102 err = nl80211_parse_beacon(info->attrs, &params);
4103 if (err)
4104 return err;
4105
4106 wdev_lock(wdev);
4107 err = rdev_change_beacon(rdev, dev, &params);
4108 wdev_unlock(wdev);
4109
4110 return err;
4111 }
4112
4113 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
4114 {
4115 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4116 struct net_device *dev = info->user_ptr[1];
4117
4118 return cfg80211_stop_ap(rdev, dev, false);
4119 }
4120
4121 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
4122 [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
4123 [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
4124 [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
4125 [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
4126 [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
4127 [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
4128 };
4129
4130 static int parse_station_flags(struct genl_info *info,
4131 enum nl80211_iftype iftype,
4132 struct station_parameters *params)
4133 {
4134 struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
4135 struct nlattr *nla;
4136 int flag;
4137
4138 /*
4139 * Try parsing the new attribute first so userspace
4140 * can specify both for older kernels.
4141 */
4142 nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
4143 if (nla) {
4144 struct nl80211_sta_flag_update *sta_flags;
4145
4146 sta_flags = nla_data(nla);
4147 params->sta_flags_mask = sta_flags->mask;
4148 params->sta_flags_set = sta_flags->set;
4149 params->sta_flags_set &= params->sta_flags_mask;
4150 if ((params->sta_flags_mask |
4151 params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
4152 return -EINVAL;
4153 return 0;
4154 }
4155
4156 /* if present, parse the old attribute */
4157
4158 nla = info->attrs[NL80211_ATTR_STA_FLAGS];
4159 if (!nla)
4160 return 0;
4161
4162 if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX, nla,
4163 sta_flags_policy, info->extack))
4164 return -EINVAL;
4165
4166 /*
4167 * Only allow certain flags for interface types so that
4168 * other attributes are silently ignored. Remember that
4169 * this is backward compatibility code with old userspace
4170 * and shouldn't be hit in other cases anyway.
4171 */
4172 switch (iftype) {
4173 case NL80211_IFTYPE_AP:
4174 case NL80211_IFTYPE_AP_VLAN:
4175 case NL80211_IFTYPE_P2P_GO:
4176 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4177 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4178 BIT(NL80211_STA_FLAG_WME) |
4179 BIT(NL80211_STA_FLAG_MFP);
4180 break;
4181 case NL80211_IFTYPE_P2P_CLIENT:
4182 case NL80211_IFTYPE_STATION:
4183 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4184 BIT(NL80211_STA_FLAG_TDLS_PEER);
4185 break;
4186 case NL80211_IFTYPE_MESH_POINT:
4187 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4188 BIT(NL80211_STA_FLAG_MFP) |
4189 BIT(NL80211_STA_FLAG_AUTHORIZED);
4190 break;
4191 default:
4192 return -EINVAL;
4193 }
4194
4195 for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
4196 if (flags[flag]) {
4197 params->sta_flags_set |= (1<<flag);
4198
4199 /* no longer support new API additions in old API */
4200 if (flag > NL80211_STA_FLAG_MAX_OLD_API)
4201 return -EINVAL;
4202 }
4203 }
4204
4205 return 0;
4206 }
4207
4208 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
4209 int attr)
4210 {
4211 struct nlattr *rate;
4212 u32 bitrate;
4213 u16 bitrate_compat;
4214 enum nl80211_rate_info rate_flg;
4215
4216 rate = nla_nest_start(msg, attr);
4217 if (!rate)
4218 return false;
4219
4220 /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
4221 bitrate = cfg80211_calculate_bitrate(info);
4222 /* report 16-bit bitrate only if we can */
4223 bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
4224 if (bitrate > 0 &&
4225 nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
4226 return false;
4227 if (bitrate_compat > 0 &&
4228 nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
4229 return false;
4230
4231 switch (info->bw) {
4232 case RATE_INFO_BW_5:
4233 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
4234 break;
4235 case RATE_INFO_BW_10:
4236 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
4237 break;
4238 default:
4239 WARN_ON(1);
4240 /* fall through */
4241 case RATE_INFO_BW_20:
4242 rate_flg = 0;
4243 break;
4244 case RATE_INFO_BW_40:
4245 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
4246 break;
4247 case RATE_INFO_BW_80:
4248 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
4249 break;
4250 case RATE_INFO_BW_160:
4251 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
4252 break;
4253 }
4254
4255 if (rate_flg && nla_put_flag(msg, rate_flg))
4256 return false;
4257
4258 if (info->flags & RATE_INFO_FLAGS_MCS) {
4259 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
4260 return false;
4261 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4262 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4263 return false;
4264 } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
4265 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
4266 return false;
4267 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
4268 return false;
4269 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4270 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4271 return false;
4272 }
4273
4274 nla_nest_end(msg, rate);
4275 return true;
4276 }
4277
4278 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
4279 int id)
4280 {
4281 void *attr;
4282 int i = 0;
4283
4284 if (!mask)
4285 return true;
4286
4287 attr = nla_nest_start(msg, id);
4288 if (!attr)
4289 return false;
4290
4291 for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
4292 if (!(mask & BIT(i)))
4293 continue;
4294
4295 if (nla_put_u8(msg, i, signal[i]))
4296 return false;
4297 }
4298
4299 nla_nest_end(msg, attr);
4300
4301 return true;
4302 }
4303
4304 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
4305 u32 seq, int flags,
4306 struct cfg80211_registered_device *rdev,
4307 struct net_device *dev,
4308 const u8 *mac_addr, struct station_info *sinfo)
4309 {
4310 void *hdr;
4311 struct nlattr *sinfoattr, *bss_param;
4312
4313 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
4314 if (!hdr)
4315 return -1;
4316
4317 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4318 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
4319 nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
4320 goto nla_put_failure;
4321
4322 sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
4323 if (!sinfoattr)
4324 goto nla_put_failure;
4325
4326 #define PUT_SINFO(attr, memb, type) do { \
4327 BUILD_BUG_ON(sizeof(type) == sizeof(u64)); \
4328 if (sinfo->filled & (1ULL << NL80211_STA_INFO_ ## attr) && \
4329 nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr, \
4330 sinfo->memb)) \
4331 goto nla_put_failure; \
4332 } while (0)
4333 #define PUT_SINFO_U64(attr, memb) do { \
4334 if (sinfo->filled & (1ULL << NL80211_STA_INFO_ ## attr) && \
4335 nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr, \
4336 sinfo->memb, NL80211_STA_INFO_PAD)) \
4337 goto nla_put_failure; \
4338 } while (0)
4339
4340 PUT_SINFO(CONNECTED_TIME, connected_time, u32);
4341 PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
4342
4343 if (sinfo->filled & (BIT(NL80211_STA_INFO_RX_BYTES) |
4344 BIT(NL80211_STA_INFO_RX_BYTES64)) &&
4345 nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
4346 (u32)sinfo->rx_bytes))
4347 goto nla_put_failure;
4348
4349 if (sinfo->filled & (BIT(NL80211_STA_INFO_TX_BYTES) |
4350 BIT(NL80211_STA_INFO_TX_BYTES64)) &&
4351 nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
4352 (u32)sinfo->tx_bytes))
4353 goto nla_put_failure;
4354
4355 PUT_SINFO_U64(RX_BYTES64, rx_bytes);
4356 PUT_SINFO_U64(TX_BYTES64, tx_bytes);
4357 PUT_SINFO(LLID, llid, u16);
4358 PUT_SINFO(PLID, plid, u16);
4359 PUT_SINFO(PLINK_STATE, plink_state, u8);
4360 PUT_SINFO_U64(RX_DURATION, rx_duration);
4361
4362 switch (rdev->wiphy.signal_type) {
4363 case CFG80211_SIGNAL_TYPE_MBM:
4364 PUT_SINFO(SIGNAL, signal, u8);
4365 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
4366 break;
4367 default:
4368 break;
4369 }
4370 if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL)) {
4371 if (!nl80211_put_signal(msg, sinfo->chains,
4372 sinfo->chain_signal,
4373 NL80211_STA_INFO_CHAIN_SIGNAL))
4374 goto nla_put_failure;
4375 }
4376 if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
4377 if (!nl80211_put_signal(msg, sinfo->chains,
4378 sinfo->chain_signal_avg,
4379 NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
4380 goto nla_put_failure;
4381 }
4382 if (sinfo->filled & BIT(NL80211_STA_INFO_TX_BITRATE)) {
4383 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
4384 NL80211_STA_INFO_TX_BITRATE))
4385 goto nla_put_failure;
4386 }
4387 if (sinfo->filled & BIT(NL80211_STA_INFO_RX_BITRATE)) {
4388 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
4389 NL80211_STA_INFO_RX_BITRATE))
4390 goto nla_put_failure;
4391 }
4392
4393 PUT_SINFO(RX_PACKETS, rx_packets, u32);
4394 PUT_SINFO(TX_PACKETS, tx_packets, u32);
4395 PUT_SINFO(TX_RETRIES, tx_retries, u32);
4396 PUT_SINFO(TX_FAILED, tx_failed, u32);
4397 PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
4398 PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
4399 PUT_SINFO(LOCAL_PM, local_pm, u32);
4400 PUT_SINFO(PEER_PM, peer_pm, u32);
4401 PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
4402
4403 if (sinfo->filled & BIT(NL80211_STA_INFO_BSS_PARAM)) {
4404 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
4405 if (!bss_param)
4406 goto nla_put_failure;
4407
4408 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
4409 nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
4410 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
4411 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
4412 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
4413 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
4414 nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
4415 sinfo->bss_param.dtim_period) ||
4416 nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
4417 sinfo->bss_param.beacon_interval))
4418 goto nla_put_failure;
4419
4420 nla_nest_end(msg, bss_param);
4421 }
4422 if ((sinfo->filled & BIT(NL80211_STA_INFO_STA_FLAGS)) &&
4423 nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
4424 sizeof(struct nl80211_sta_flag_update),
4425 &sinfo->sta_flags))
4426 goto nla_put_failure;
4427
4428 PUT_SINFO_U64(T_OFFSET, t_offset);
4429 PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
4430 PUT_SINFO_U64(BEACON_RX, rx_beacon);
4431 PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
4432
4433 #undef PUT_SINFO
4434 #undef PUT_SINFO_U64
4435
4436 if (sinfo->filled & BIT(NL80211_STA_INFO_TID_STATS)) {
4437 struct nlattr *tidsattr;
4438 int tid;
4439
4440 tidsattr = nla_nest_start(msg, NL80211_STA_INFO_TID_STATS);
4441 if (!tidsattr)
4442 goto nla_put_failure;
4443
4444 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
4445 struct cfg80211_tid_stats *tidstats;
4446 struct nlattr *tidattr;
4447
4448 tidstats = &sinfo->pertid[tid];
4449
4450 if (!tidstats->filled)
4451 continue;
4452
4453 tidattr = nla_nest_start(msg, tid + 1);
4454 if (!tidattr)
4455 goto nla_put_failure;
4456
4457 #define PUT_TIDVAL_U64(attr, memb) do { \
4458 if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) && \
4459 nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr, \
4460 tidstats->memb, NL80211_TID_STATS_PAD)) \
4461 goto nla_put_failure; \
4462 } while (0)
4463
4464 PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
4465 PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
4466 PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
4467 PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
4468
4469 #undef PUT_TIDVAL_U64
4470 nla_nest_end(msg, tidattr);
4471 }
4472
4473 nla_nest_end(msg, tidsattr);
4474 }
4475
4476 nla_nest_end(msg, sinfoattr);
4477
4478 if (sinfo->assoc_req_ies_len &&
4479 nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
4480 sinfo->assoc_req_ies))
4481 goto nla_put_failure;
4482
4483 genlmsg_end(msg, hdr);
4484 return 0;
4485
4486 nla_put_failure:
4487 genlmsg_cancel(msg, hdr);
4488 return -EMSGSIZE;
4489 }
4490
4491 static int nl80211_dump_station(struct sk_buff *skb,
4492 struct netlink_callback *cb)
4493 {
4494 struct station_info sinfo;
4495 struct cfg80211_registered_device *rdev;
4496 struct wireless_dev *wdev;
4497 u8 mac_addr[ETH_ALEN];
4498 int sta_idx = cb->args[2];
4499 int err;
4500
4501 rtnl_lock();
4502 err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4503 if (err)
4504 goto out_err;
4505
4506 if (!wdev->netdev) {
4507 err = -EINVAL;
4508 goto out_err;
4509 }
4510
4511 if (!rdev->ops->dump_station) {
4512 err = -EOPNOTSUPP;
4513 goto out_err;
4514 }
4515
4516 while (1) {
4517 memset(&sinfo, 0, sizeof(sinfo));
4518 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
4519 mac_addr, &sinfo);
4520 if (err == -ENOENT)
4521 break;
4522 if (err)
4523 goto out_err;
4524
4525 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
4526 NETLINK_CB(cb->skb).portid,
4527 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4528 rdev, wdev->netdev, mac_addr,
4529 &sinfo) < 0)
4530 goto out;
4531
4532 sta_idx++;
4533 }
4534
4535 out:
4536 cb->args[2] = sta_idx;
4537 err = skb->len;
4538 out_err:
4539 rtnl_unlock();
4540
4541 return err;
4542 }
4543
4544 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
4545 {
4546 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4547 struct net_device *dev = info->user_ptr[1];
4548 struct station_info sinfo;
4549 struct sk_buff *msg;
4550 u8 *mac_addr = NULL;
4551 int err;
4552
4553 memset(&sinfo, 0, sizeof(sinfo));
4554
4555 if (!info->attrs[NL80211_ATTR_MAC])
4556 return -EINVAL;
4557
4558 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4559
4560 if (!rdev->ops->get_station)
4561 return -EOPNOTSUPP;
4562
4563 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
4564 if (err)
4565 return err;
4566
4567 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4568 if (!msg)
4569 return -ENOMEM;
4570
4571 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
4572 info->snd_portid, info->snd_seq, 0,
4573 rdev, dev, mac_addr, &sinfo) < 0) {
4574 nlmsg_free(msg);
4575 return -ENOBUFS;
4576 }
4577
4578 return genlmsg_reply(msg, info);
4579 }
4580
4581 int cfg80211_check_station_change(struct wiphy *wiphy,
4582 struct station_parameters *params,
4583 enum cfg80211_station_type statype)
4584 {
4585 if (params->listen_interval != -1 &&
4586 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4587 return -EINVAL;
4588
4589 if (params->support_p2p_ps != -1 &&
4590 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4591 return -EINVAL;
4592
4593 if (params->aid &&
4594 !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
4595 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4596 return -EINVAL;
4597
4598 /* When you run into this, adjust the code below for the new flag */
4599 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4600
4601 switch (statype) {
4602 case CFG80211_STA_MESH_PEER_KERNEL:
4603 case CFG80211_STA_MESH_PEER_USER:
4604 /*
4605 * No ignoring the TDLS flag here -- the userspace mesh
4606 * code doesn't have the bug of including TDLS in the
4607 * mask everywhere.
4608 */
4609 if (params->sta_flags_mask &
4610 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4611 BIT(NL80211_STA_FLAG_MFP) |
4612 BIT(NL80211_STA_FLAG_AUTHORIZED)))
4613 return -EINVAL;
4614 break;
4615 case CFG80211_STA_TDLS_PEER_SETUP:
4616 case CFG80211_STA_TDLS_PEER_ACTIVE:
4617 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4618 return -EINVAL;
4619 /* ignore since it can't change */
4620 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4621 break;
4622 default:
4623 /* disallow mesh-specific things */
4624 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
4625 return -EINVAL;
4626 if (params->local_pm)
4627 return -EINVAL;
4628 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4629 return -EINVAL;
4630 }
4631
4632 if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4633 statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
4634 /* TDLS can't be set, ... */
4635 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
4636 return -EINVAL;
4637 /*
4638 * ... but don't bother the driver with it. This works around
4639 * a hostapd/wpa_supplicant issue -- it always includes the
4640 * TLDS_PEER flag in the mask even for AP mode.
4641 */
4642 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4643 }
4644
4645 if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4646 statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4647 /* reject other things that can't change */
4648 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
4649 return -EINVAL;
4650 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
4651 return -EINVAL;
4652 if (params->supported_rates)
4653 return -EINVAL;
4654 if (params->ext_capab || params->ht_capa || params->vht_capa)
4655 return -EINVAL;
4656 }
4657
4658 if (statype != CFG80211_STA_AP_CLIENT &&
4659 statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4660 if (params->vlan)
4661 return -EINVAL;
4662 }
4663
4664 switch (statype) {
4665 case CFG80211_STA_AP_MLME_CLIENT:
4666 /* Use this only for authorizing/unauthorizing a station */
4667 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
4668 return -EOPNOTSUPP;
4669 break;
4670 case CFG80211_STA_AP_CLIENT:
4671 case CFG80211_STA_AP_CLIENT_UNASSOC:
4672 /* accept only the listed bits */
4673 if (params->sta_flags_mask &
4674 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4675 BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4676 BIT(NL80211_STA_FLAG_ASSOCIATED) |
4677 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4678 BIT(NL80211_STA_FLAG_WME) |
4679 BIT(NL80211_STA_FLAG_MFP)))
4680 return -EINVAL;
4681
4682 /* but authenticated/associated only if driver handles it */
4683 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4684 params->sta_flags_mask &
4685 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4686 BIT(NL80211_STA_FLAG_ASSOCIATED)))
4687 return -EINVAL;
4688 break;
4689 case CFG80211_STA_IBSS:
4690 case CFG80211_STA_AP_STA:
4691 /* reject any changes other than AUTHORIZED */
4692 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
4693 return -EINVAL;
4694 break;
4695 case CFG80211_STA_TDLS_PEER_SETUP:
4696 /* reject any changes other than AUTHORIZED or WME */
4697 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4698 BIT(NL80211_STA_FLAG_WME)))
4699 return -EINVAL;
4700 /* force (at least) rates when authorizing */
4701 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
4702 !params->supported_rates)
4703 return -EINVAL;
4704 break;
4705 case CFG80211_STA_TDLS_PEER_ACTIVE:
4706 /* reject any changes */
4707 return -EINVAL;
4708 case CFG80211_STA_MESH_PEER_KERNEL:
4709 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4710 return -EINVAL;
4711 break;
4712 case CFG80211_STA_MESH_PEER_USER:
4713 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
4714 params->plink_action != NL80211_PLINK_ACTION_BLOCK)
4715 return -EINVAL;
4716 break;
4717 }
4718
4719 /*
4720 * Older kernel versions ignored this attribute entirely, so don't
4721 * reject attempts to update it but mark it as unused instead so the
4722 * driver won't look at the data.
4723 */
4724 if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
4725 statype != CFG80211_STA_TDLS_PEER_SETUP)
4726 params->opmode_notif_used = false;
4727
4728 return 0;
4729 }
4730 EXPORT_SYMBOL(cfg80211_check_station_change);
4731
4732 /*
4733 * Get vlan interface making sure it is running and on the right wiphy.
4734 */
4735 static struct net_device *get_vlan(struct genl_info *info,
4736 struct cfg80211_registered_device *rdev)
4737 {
4738 struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
4739 struct net_device *v;
4740 int ret;
4741
4742 if (!vlanattr)
4743 return NULL;
4744
4745 v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
4746 if (!v)
4747 return ERR_PTR(-ENODEV);
4748
4749 if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
4750 ret = -EINVAL;
4751 goto error;
4752 }
4753
4754 if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4755 v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4756 v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
4757 ret = -EINVAL;
4758 goto error;
4759 }
4760
4761 if (!netif_running(v)) {
4762 ret = -ENETDOWN;
4763 goto error;
4764 }
4765
4766 return v;
4767 error:
4768 dev_put(v);
4769 return ERR_PTR(ret);
4770 }
4771
4772 static const struct nla_policy
4773 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
4774 [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
4775 [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
4776 };
4777
4778 static int nl80211_parse_sta_wme(struct genl_info *info,
4779 struct station_parameters *params)
4780 {
4781 struct nlattr *tb[NL80211_STA_WME_MAX + 1];
4782 struct nlattr *nla;
4783 int err;
4784
4785 /* parse WME attributes if present */
4786 if (!info->attrs[NL80211_ATTR_STA_WME])
4787 return 0;
4788
4789 nla = info->attrs[NL80211_ATTR_STA_WME];
4790 err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
4791 nl80211_sta_wme_policy, info->extack);
4792 if (err)
4793 return err;
4794
4795 if (tb[NL80211_STA_WME_UAPSD_QUEUES])
4796 params->uapsd_queues = nla_get_u8(
4797 tb[NL80211_STA_WME_UAPSD_QUEUES]);
4798 if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
4799 return -EINVAL;
4800
4801 if (tb[NL80211_STA_WME_MAX_SP])
4802 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
4803
4804 if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
4805 return -EINVAL;
4806
4807 params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
4808
4809 return 0;
4810 }
4811
4812 static int nl80211_parse_sta_channel_info(struct genl_info *info,
4813 struct station_parameters *params)
4814 {
4815 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
4816 params->supported_channels =
4817 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4818 params->supported_channels_len =
4819 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4820 /*
4821 * Need to include at least one (first channel, number of
4822 * channels) tuple for each subband, and must have proper
4823 * tuples for the rest of the data as well.
4824 */
4825 if (params->supported_channels_len < 2)
4826 return -EINVAL;
4827 if (params->supported_channels_len % 2)
4828 return -EINVAL;
4829 }
4830
4831 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
4832 params->supported_oper_classes =
4833 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4834 params->supported_oper_classes_len =
4835 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4836 /*
4837 * The value of the Length field of the Supported Operating
4838 * Classes element is between 2 and 253.
4839 */
4840 if (params->supported_oper_classes_len < 2 ||
4841 params->supported_oper_classes_len > 253)
4842 return -EINVAL;
4843 }
4844 return 0;
4845 }
4846
4847 static int nl80211_set_station_tdls(struct genl_info *info,
4848 struct station_parameters *params)
4849 {
4850 int err;
4851 /* Dummy STA entry gets updated once the peer capabilities are known */
4852 if (info->attrs[NL80211_ATTR_PEER_AID])
4853 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4854 if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4855 params->ht_capa =
4856 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4857 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4858 params->vht_capa =
4859 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4860
4861 err = nl80211_parse_sta_channel_info(info, params);
4862 if (err)
4863 return err;
4864
4865 return nl80211_parse_sta_wme(info, params);
4866 }
4867
4868 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
4869 {
4870 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4871 struct net_device *dev = info->user_ptr[1];
4872 struct station_parameters params;
4873 u8 *mac_addr;
4874 int err;
4875
4876 memset(&params, 0, sizeof(params));
4877
4878 if (!rdev->ops->change_station)
4879 return -EOPNOTSUPP;
4880
4881 /*
4882 * AID and listen_interval properties can be set only for unassociated
4883 * station. Include these parameters here and will check them in
4884 * cfg80211_check_station_change().
4885 */
4886 if (info->attrs[NL80211_ATTR_STA_AID])
4887 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4888
4889 if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4890 params.listen_interval =
4891 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4892 else
4893 params.listen_interval = -1;
4894
4895 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
4896 u8 tmp;
4897
4898 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
4899 if (tmp >= NUM_NL80211_P2P_PS_STATUS)
4900 return -EINVAL;
4901
4902 params.support_p2p_ps = tmp;
4903 } else {
4904 params.support_p2p_ps = -1;
4905 }
4906
4907 if (!info->attrs[NL80211_ATTR_MAC])
4908 return -EINVAL;
4909
4910 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4911
4912 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
4913 params.supported_rates =
4914 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4915 params.supported_rates_len =
4916 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4917 }
4918
4919 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4920 params.capability =
4921 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4922 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4923 }
4924
4925 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4926 params.ext_capab =
4927 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4928 params.ext_capab_len =
4929 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4930 }
4931
4932 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4933 return -EINVAL;
4934
4935 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4936 params.plink_action =
4937 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4938 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4939 return -EINVAL;
4940 }
4941
4942 if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
4943 params.plink_state =
4944 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
4945 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
4946 return -EINVAL;
4947 if (info->attrs[NL80211_ATTR_MESH_PEER_AID]) {
4948 params.peer_aid = nla_get_u16(
4949 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
4950 if (params.peer_aid > IEEE80211_MAX_AID)
4951 return -EINVAL;
4952 }
4953 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
4954 }
4955
4956 if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
4957 enum nl80211_mesh_power_mode pm = nla_get_u32(
4958 info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
4959
4960 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
4961 pm > NL80211_MESH_POWER_MAX)
4962 return -EINVAL;
4963
4964 params.local_pm = pm;
4965 }
4966
4967 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
4968 params.opmode_notif_used = true;
4969 params.opmode_notif =
4970 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
4971 }
4972
4973 /* Include parameters for TDLS peer (will check later) */
4974 err = nl80211_set_station_tdls(info, &params);
4975 if (err)
4976 return err;
4977
4978 params.vlan = get_vlan(info, rdev);
4979 if (IS_ERR(params.vlan))
4980 return PTR_ERR(params.vlan);
4981
4982 switch (dev->ieee80211_ptr->iftype) {
4983 case NL80211_IFTYPE_AP:
4984 case NL80211_IFTYPE_AP_VLAN:
4985 case NL80211_IFTYPE_P2P_GO:
4986 case NL80211_IFTYPE_P2P_CLIENT:
4987 case NL80211_IFTYPE_STATION:
4988 case NL80211_IFTYPE_ADHOC:
4989 case NL80211_IFTYPE_MESH_POINT:
4990 break;
4991 default:
4992 err = -EOPNOTSUPP;
4993 goto out_put_vlan;
4994 }
4995
4996 /* driver will call cfg80211_check_station_change() */
4997 err = rdev_change_station(rdev, dev, mac_addr, &params);
4998
4999 out_put_vlan:
5000 if (params.vlan)
5001 dev_put(params.vlan);
5002
5003 return err;
5004 }
5005
5006 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
5007 {
5008 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5009 int err;
5010 struct net_device *dev = info->user_ptr[1];
5011 struct station_parameters params;
5012 u8 *mac_addr = NULL;
5013 u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5014 BIT(NL80211_STA_FLAG_ASSOCIATED);
5015
5016 memset(&params, 0, sizeof(params));
5017
5018 if (!rdev->ops->add_station)
5019 return -EOPNOTSUPP;
5020
5021 if (!info->attrs[NL80211_ATTR_MAC])
5022 return -EINVAL;
5023
5024 if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
5025 return -EINVAL;
5026
5027 if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
5028 return -EINVAL;
5029
5030 if (!info->attrs[NL80211_ATTR_STA_AID] &&
5031 !info->attrs[NL80211_ATTR_PEER_AID])
5032 return -EINVAL;
5033
5034 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5035 params.supported_rates =
5036 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5037 params.supported_rates_len =
5038 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5039 params.listen_interval =
5040 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
5041
5042 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
5043 u8 tmp;
5044
5045 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
5046 if (tmp >= NUM_NL80211_P2P_PS_STATUS)
5047 return -EINVAL;
5048
5049 params.support_p2p_ps = tmp;
5050 } else {
5051 /*
5052 * if not specified, assume it's supported for P2P GO interface,
5053 * and is NOT supported for AP interface
5054 */
5055 params.support_p2p_ps =
5056 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
5057 }
5058
5059 if (info->attrs[NL80211_ATTR_PEER_AID])
5060 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
5061 else
5062 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
5063 if (!params.aid || params.aid > IEEE80211_MAX_AID)
5064 return -EINVAL;
5065
5066 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
5067 params.capability =
5068 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
5069 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
5070 }
5071
5072 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
5073 params.ext_capab =
5074 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5075 params.ext_capab_len =
5076 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5077 }
5078
5079 if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
5080 params.ht_capa =
5081 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5082
5083 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
5084 params.vht_capa =
5085 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
5086
5087 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
5088 params.opmode_notif_used = true;
5089 params.opmode_notif =
5090 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
5091 }
5092
5093 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
5094 params.plink_action =
5095 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
5096 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
5097 return -EINVAL;
5098 }
5099
5100 err = nl80211_parse_sta_channel_info(info, &params);
5101 if (err)
5102 return err;
5103
5104 err = nl80211_parse_sta_wme(info, &params);
5105 if (err)
5106 return err;
5107
5108 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
5109 return -EINVAL;
5110
5111 /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
5112 * as userspace might just pass through the capabilities from the IEs
5113 * directly, rather than enforcing this restriction and returning an
5114 * error in this case.
5115 */
5116 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
5117 params.ht_capa = NULL;
5118 params.vht_capa = NULL;
5119 }
5120
5121 /* When you run into this, adjust the code below for the new flag */
5122 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
5123
5124 switch (dev->ieee80211_ptr->iftype) {
5125 case NL80211_IFTYPE_AP:
5126 case NL80211_IFTYPE_AP_VLAN:
5127 case NL80211_IFTYPE_P2P_GO:
5128 /* ignore WME attributes if iface/sta is not capable */
5129 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
5130 !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
5131 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5132
5133 /* TDLS peers cannot be added */
5134 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5135 info->attrs[NL80211_ATTR_PEER_AID])
5136 return -EINVAL;
5137 /* but don't bother the driver with it */
5138 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
5139
5140 /* allow authenticated/associated only if driver handles it */
5141 if (!(rdev->wiphy.features &
5142 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
5143 params.sta_flags_mask & auth_assoc)
5144 return -EINVAL;
5145
5146 /* Older userspace, or userspace wanting to be compatible with
5147 * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
5148 * and assoc flags in the mask, but assumes the station will be
5149 * added as associated anyway since this was the required driver
5150 * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
5151 * introduced.
5152 * In order to not bother drivers with this quirk in the API
5153 * set the flags in both the mask and set for new stations in
5154 * this case.
5155 */
5156 if (!(params.sta_flags_mask & auth_assoc)) {
5157 params.sta_flags_mask |= auth_assoc;
5158 params.sta_flags_set |= auth_assoc;
5159 }
5160
5161 /* must be last in here for error handling */
5162 params.vlan = get_vlan(info, rdev);
5163 if (IS_ERR(params.vlan))
5164 return PTR_ERR(params.vlan);
5165 break;
5166 case NL80211_IFTYPE_MESH_POINT:
5167 /* ignore uAPSD data */
5168 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5169
5170 /* associated is disallowed */
5171 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
5172 return -EINVAL;
5173 /* TDLS peers cannot be added */
5174 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5175 info->attrs[NL80211_ATTR_PEER_AID])
5176 return -EINVAL;
5177 break;
5178 case NL80211_IFTYPE_STATION:
5179 case NL80211_IFTYPE_P2P_CLIENT:
5180 /* ignore uAPSD data */
5181 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5182
5183 /* these are disallowed */
5184 if (params.sta_flags_mask &
5185 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
5186 BIT(NL80211_STA_FLAG_AUTHENTICATED)))
5187 return -EINVAL;
5188 /* Only TDLS peers can be added */
5189 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
5190 return -EINVAL;
5191 /* Can only add if TDLS ... */
5192 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
5193 return -EOPNOTSUPP;
5194 /* ... with external setup is supported */
5195 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
5196 return -EOPNOTSUPP;
5197 /*
5198 * Older wpa_supplicant versions always mark the TDLS peer
5199 * as authorized, but it shouldn't yet be.
5200 */
5201 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
5202 break;
5203 default:
5204 return -EOPNOTSUPP;
5205 }
5206
5207 /* be aware of params.vlan when changing code here */
5208
5209 err = rdev_add_station(rdev, dev, mac_addr, &params);
5210
5211 if (params.vlan)
5212 dev_put(params.vlan);
5213 return err;
5214 }
5215
5216 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
5217 {
5218 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5219 struct net_device *dev = info->user_ptr[1];
5220 struct station_del_parameters params;
5221
5222 memset(&params, 0, sizeof(params));
5223
5224 if (info->attrs[NL80211_ATTR_MAC])
5225 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
5226
5227 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5228 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5229 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5230 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5231 return -EINVAL;
5232
5233 if (!rdev->ops->del_station)
5234 return -EOPNOTSUPP;
5235
5236 if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
5237 params.subtype =
5238 nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
5239 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
5240 params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
5241 return -EINVAL;
5242 } else {
5243 /* Default to Deauthentication frame */
5244 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
5245 }
5246
5247 if (info->attrs[NL80211_ATTR_REASON_CODE]) {
5248 params.reason_code =
5249 nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5250 if (params.reason_code == 0)
5251 return -EINVAL; /* 0 is reserved */
5252 } else {
5253 /* Default to reason code 2 */
5254 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
5255 }
5256
5257 return rdev_del_station(rdev, dev, &params);
5258 }
5259
5260 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
5261 int flags, struct net_device *dev,
5262 u8 *dst, u8 *next_hop,
5263 struct mpath_info *pinfo)
5264 {
5265 void *hdr;
5266 struct nlattr *pinfoattr;
5267
5268 hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
5269 if (!hdr)
5270 return -1;
5271
5272 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5273 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
5274 nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
5275 nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
5276 goto nla_put_failure;
5277
5278 pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
5279 if (!pinfoattr)
5280 goto nla_put_failure;
5281 if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
5282 nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
5283 pinfo->frame_qlen))
5284 goto nla_put_failure;
5285 if (((pinfo->filled & MPATH_INFO_SN) &&
5286 nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
5287 ((pinfo->filled & MPATH_INFO_METRIC) &&
5288 nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
5289 pinfo->metric)) ||
5290 ((pinfo->filled & MPATH_INFO_EXPTIME) &&
5291 nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
5292 pinfo->exptime)) ||
5293 ((pinfo->filled & MPATH_INFO_FLAGS) &&
5294 nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
5295 pinfo->flags)) ||
5296 ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
5297 nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
5298 pinfo->discovery_timeout)) ||
5299 ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
5300 nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
5301 pinfo->discovery_retries)))
5302 goto nla_put_failure;
5303
5304 nla_nest_end(msg, pinfoattr);
5305
5306 genlmsg_end(msg, hdr);
5307 return 0;
5308
5309 nla_put_failure:
5310 genlmsg_cancel(msg, hdr);
5311 return -EMSGSIZE;
5312 }
5313
5314 static int nl80211_dump_mpath(struct sk_buff *skb,
5315 struct netlink_callback *cb)
5316 {
5317 struct mpath_info pinfo;
5318 struct cfg80211_registered_device *rdev;
5319 struct wireless_dev *wdev;
5320 u8 dst[ETH_ALEN];
5321 u8 next_hop[ETH_ALEN];
5322 int path_idx = cb->args[2];
5323 int err;
5324
5325 rtnl_lock();
5326 err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5327 if (err)
5328 goto out_err;
5329
5330 if (!rdev->ops->dump_mpath) {
5331 err = -EOPNOTSUPP;
5332 goto out_err;
5333 }
5334
5335 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
5336 err = -EOPNOTSUPP;
5337 goto out_err;
5338 }
5339
5340 while (1) {
5341 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
5342 next_hop, &pinfo);
5343 if (err == -ENOENT)
5344 break;
5345 if (err)
5346 goto out_err;
5347
5348 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
5349 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5350 wdev->netdev, dst, next_hop,
5351 &pinfo) < 0)
5352 goto out;
5353
5354 path_idx++;
5355 }
5356
5357 out:
5358 cb->args[2] = path_idx;
5359 err = skb->len;
5360 out_err:
5361 rtnl_unlock();
5362 return err;
5363 }
5364
5365 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
5366 {
5367 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5368 int err;
5369 struct net_device *dev = info->user_ptr[1];
5370 struct mpath_info pinfo;
5371 struct sk_buff *msg;
5372 u8 *dst = NULL;
5373 u8 next_hop[ETH_ALEN];
5374
5375 memset(&pinfo, 0, sizeof(pinfo));
5376
5377 if (!info->attrs[NL80211_ATTR_MAC])
5378 return -EINVAL;
5379
5380 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5381
5382 if (!rdev->ops->get_mpath)
5383 return -EOPNOTSUPP;
5384
5385 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5386 return -EOPNOTSUPP;
5387
5388 err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
5389 if (err)
5390 return err;
5391
5392 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5393 if (!msg)
5394 return -ENOMEM;
5395
5396 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
5397 dev, dst, next_hop, &pinfo) < 0) {
5398 nlmsg_free(msg);
5399 return -ENOBUFS;
5400 }
5401
5402 return genlmsg_reply(msg, info);
5403 }
5404
5405 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
5406 {
5407 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5408 struct net_device *dev = info->user_ptr[1];
5409 u8 *dst = NULL;
5410 u8 *next_hop = NULL;
5411
5412 if (!info->attrs[NL80211_ATTR_MAC])
5413 return -EINVAL;
5414
5415 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
5416 return -EINVAL;
5417
5418 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5419 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
5420
5421 if (!rdev->ops->change_mpath)
5422 return -EOPNOTSUPP;
5423
5424 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5425 return -EOPNOTSUPP;
5426
5427 return rdev_change_mpath(rdev, dev, dst, next_hop);
5428 }
5429
5430 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
5431 {
5432 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5433 struct net_device *dev = info->user_ptr[1];
5434 u8 *dst = NULL;
5435 u8 *next_hop = NULL;
5436
5437 if (!info->attrs[NL80211_ATTR_MAC])
5438 return -EINVAL;
5439
5440 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
5441 return -EINVAL;
5442
5443 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5444 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
5445
5446 if (!rdev->ops->add_mpath)
5447 return -EOPNOTSUPP;
5448
5449 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5450 return -EOPNOTSUPP;
5451
5452 return rdev_add_mpath(rdev, dev, dst, next_hop);
5453 }
5454
5455 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
5456 {
5457 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5458 struct net_device *dev = info->user_ptr[1];
5459 u8 *dst = NULL;
5460
5461 if (info->attrs[NL80211_ATTR_MAC])
5462 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5463
5464 if (!rdev->ops->del_mpath)
5465 return -EOPNOTSUPP;
5466
5467 return rdev_del_mpath(rdev, dev, dst);
5468 }
5469
5470 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
5471 {
5472 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5473 int err;
5474 struct net_device *dev = info->user_ptr[1];
5475 struct mpath_info pinfo;
5476 struct sk_buff *msg;
5477 u8 *dst = NULL;
5478 u8 mpp[ETH_ALEN];
5479
5480 memset(&pinfo, 0, sizeof(pinfo));
5481
5482 if (!info->attrs[NL80211_ATTR_MAC])
5483 return -EINVAL;
5484
5485 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5486
5487 if (!rdev->ops->get_mpp)
5488 return -EOPNOTSUPP;
5489
5490 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5491 return -EOPNOTSUPP;
5492
5493 err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
5494 if (err)
5495 return err;
5496
5497 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5498 if (!msg)
5499 return -ENOMEM;
5500
5501 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
5502 dev, dst, mpp, &pinfo) < 0) {
5503 nlmsg_free(msg);
5504 return -ENOBUFS;
5505 }
5506
5507 return genlmsg_reply(msg, info);
5508 }
5509
5510 static int nl80211_dump_mpp(struct sk_buff *skb,
5511 struct netlink_callback *cb)
5512 {
5513 struct mpath_info pinfo;
5514 struct cfg80211_registered_device *rdev;
5515 struct wireless_dev *wdev;
5516 u8 dst[ETH_ALEN];
5517 u8 mpp[ETH_ALEN];
5518 int path_idx = cb->args[2];
5519 int err;
5520
5521 rtnl_lock();
5522 err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5523 if (err)
5524 goto out_err;
5525
5526 if (!rdev->ops->dump_mpp) {
5527 err = -EOPNOTSUPP;
5528 goto out_err;
5529 }
5530
5531 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
5532 err = -EOPNOTSUPP;
5533 goto out_err;
5534 }
5535
5536 while (1) {
5537 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
5538 mpp, &pinfo);
5539 if (err == -ENOENT)
5540 break;
5541 if (err)
5542 goto out_err;
5543
5544 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
5545 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5546 wdev->netdev, dst, mpp,
5547 &pinfo) < 0)
5548 goto out;
5549
5550 path_idx++;
5551 }
5552
5553 out:
5554 cb->args[2] = path_idx;
5555 err = skb->len;
5556 out_err:
5557 rtnl_unlock();
5558 return err;
5559 }
5560
5561 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
5562 {
5563 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5564 struct net_device *dev = info->user_ptr[1];
5565 struct wireless_dev *wdev = dev->ieee80211_ptr;
5566 struct bss_parameters params;
5567 int err;
5568
5569 memset(&params, 0, sizeof(params));
5570 /* default to not changing parameters */
5571 params.use_cts_prot = -1;
5572 params.use_short_preamble = -1;
5573 params.use_short_slot_time = -1;
5574 params.ap_isolate = -1;
5575 params.ht_opmode = -1;
5576 params.p2p_ctwindow = -1;
5577 params.p2p_opp_ps = -1;
5578
5579 if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
5580 params.use_cts_prot =
5581 nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
5582 if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
5583 params.use_short_preamble =
5584 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
5585 if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
5586 params.use_short_slot_time =
5587 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
5588 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
5589 params.basic_rates =
5590 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5591 params.basic_rates_len =
5592 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5593 }
5594 if (info->attrs[NL80211_ATTR_AP_ISOLATE])
5595 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
5596 if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
5597 params.ht_opmode =
5598 nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
5599
5600 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
5601 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5602 return -EINVAL;
5603 params.p2p_ctwindow =
5604 nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
5605 if (params.p2p_ctwindow < 0)
5606 return -EINVAL;
5607 if (params.p2p_ctwindow != 0 &&
5608 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
5609 return -EINVAL;
5610 }
5611
5612 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
5613 u8 tmp;
5614
5615 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5616 return -EINVAL;
5617 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
5618 if (tmp > 1)
5619 return -EINVAL;
5620 params.p2p_opp_ps = tmp;
5621 if (params.p2p_opp_ps &&
5622 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
5623 return -EINVAL;
5624 }
5625
5626 if (!rdev->ops->change_bss)
5627 return -EOPNOTSUPP;
5628
5629 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5630 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5631 return -EOPNOTSUPP;
5632
5633 wdev_lock(wdev);
5634 err = rdev_change_bss(rdev, dev, &params);
5635 wdev_unlock(wdev);
5636
5637 return err;
5638 }
5639
5640 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
5641 {
5642 char *data = NULL;
5643 bool is_indoor;
5644 enum nl80211_user_reg_hint_type user_reg_hint_type;
5645 u32 owner_nlportid;
5646
5647 /*
5648 * You should only get this when cfg80211 hasn't yet initialized
5649 * completely when built-in to the kernel right between the time
5650 * window between nl80211_init() and regulatory_init(), if that is
5651 * even possible.
5652 */
5653 if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
5654 return -EINPROGRESS;
5655
5656 if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
5657 user_reg_hint_type =
5658 nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
5659 else
5660 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
5661
5662 switch (user_reg_hint_type) {
5663 case NL80211_USER_REG_HINT_USER:
5664 case NL80211_USER_REG_HINT_CELL_BASE:
5665 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5666 return -EINVAL;
5667
5668 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5669 return regulatory_hint_user(data, user_reg_hint_type);
5670 case NL80211_USER_REG_HINT_INDOOR:
5671 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
5672 owner_nlportid = info->snd_portid;
5673 is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
5674 } else {
5675 owner_nlportid = 0;
5676 is_indoor = true;
5677 }
5678
5679 return regulatory_hint_indoor(is_indoor, owner_nlportid);
5680 default:
5681 return -EINVAL;
5682 }
5683 }
5684
5685 static int nl80211_get_mesh_config(struct sk_buff *skb,
5686 struct genl_info *info)
5687 {
5688 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5689 struct net_device *dev = info->user_ptr[1];
5690 struct wireless_dev *wdev = dev->ieee80211_ptr;
5691 struct mesh_config cur_params;
5692 int err = 0;
5693 void *hdr;
5694 struct nlattr *pinfoattr;
5695 struct sk_buff *msg;
5696
5697 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5698 return -EOPNOTSUPP;
5699
5700 if (!rdev->ops->get_mesh_config)
5701 return -EOPNOTSUPP;
5702
5703 wdev_lock(wdev);
5704 /* If not connected, get default parameters */
5705 if (!wdev->mesh_id_len)
5706 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
5707 else
5708 err = rdev_get_mesh_config(rdev, dev, &cur_params);
5709 wdev_unlock(wdev);
5710
5711 if (err)
5712 return err;
5713
5714 /* Draw up a netlink message to send back */
5715 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5716 if (!msg)
5717 return -ENOMEM;
5718 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5719 NL80211_CMD_GET_MESH_CONFIG);
5720 if (!hdr)
5721 goto out;
5722 pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
5723 if (!pinfoattr)
5724 goto nla_put_failure;
5725 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5726 nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
5727 cur_params.dot11MeshRetryTimeout) ||
5728 nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5729 cur_params.dot11MeshConfirmTimeout) ||
5730 nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
5731 cur_params.dot11MeshHoldingTimeout) ||
5732 nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
5733 cur_params.dot11MeshMaxPeerLinks) ||
5734 nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
5735 cur_params.dot11MeshMaxRetries) ||
5736 nla_put_u8(msg, NL80211_MESHCONF_TTL,
5737 cur_params.dot11MeshTTL) ||
5738 nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
5739 cur_params.element_ttl) ||
5740 nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5741 cur_params.auto_open_plinks) ||
5742 nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5743 cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
5744 nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5745 cur_params.dot11MeshHWMPmaxPREQretries) ||
5746 nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
5747 cur_params.path_refresh_time) ||
5748 nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5749 cur_params.min_discovery_timeout) ||
5750 nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5751 cur_params.dot11MeshHWMPactivePathTimeout) ||
5752 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5753 cur_params.dot11MeshHWMPpreqMinInterval) ||
5754 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5755 cur_params.dot11MeshHWMPperrMinInterval) ||
5756 nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5757 cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
5758 nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
5759 cur_params.dot11MeshHWMPRootMode) ||
5760 nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5761 cur_params.dot11MeshHWMPRannInterval) ||
5762 nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5763 cur_params.dot11MeshGateAnnouncementProtocol) ||
5764 nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
5765 cur_params.dot11MeshForwarding) ||
5766 nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
5767 cur_params.rssi_threshold) ||
5768 nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
5769 cur_params.ht_opmode) ||
5770 nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5771 cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
5772 nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5773 cur_params.dot11MeshHWMProotInterval) ||
5774 nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5775 cur_params.dot11MeshHWMPconfirmationInterval) ||
5776 nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
5777 cur_params.power_mode) ||
5778 nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
5779 cur_params.dot11MeshAwakeWindowDuration) ||
5780 nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
5781 cur_params.plink_timeout))
5782 goto nla_put_failure;
5783 nla_nest_end(msg, pinfoattr);
5784 genlmsg_end(msg, hdr);
5785 return genlmsg_reply(msg, info);
5786
5787 nla_put_failure:
5788 genlmsg_cancel(msg, hdr);
5789 out:
5790 nlmsg_free(msg);
5791 return -ENOBUFS;
5792 }
5793
5794 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
5795 [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
5796 [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
5797 [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
5798 [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
5799 [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
5800 [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
5801 [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
5802 [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
5803 [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
5804 [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
5805 [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
5806 [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
5807 [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
5808 [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
5809 [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
5810 [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
5811 [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
5812 [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
5813 [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
5814 [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
5815 [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
5816 [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
5817 [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
5818 [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
5819 [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
5820 [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
5821 [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
5822 [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
5823 };
5824
5825 static const struct nla_policy
5826 nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
5827 [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
5828 [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
5829 [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
5830 [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
5831 [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
5832 [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
5833 [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
5834 .len = IEEE80211_MAX_DATA_LEN },
5835 [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
5836 };
5837
5838 static int nl80211_check_bool(const struct nlattr *nla, u8 min, u8 max, bool *out)
5839 {
5840 u8 val = nla_get_u8(nla);
5841 if (val < min || val > max)
5842 return -EINVAL;
5843 *out = val;
5844 return 0;
5845 }
5846
5847 static int nl80211_check_u8(const struct nlattr *nla, u8 min, u8 max, u8 *out)
5848 {
5849 u8 val = nla_get_u8(nla);
5850 if (val < min || val > max)
5851 return -EINVAL;
5852 *out = val;
5853 return 0;
5854 }
5855
5856 static int nl80211_check_u16(const struct nlattr *nla, u16 min, u16 max, u16 *out)
5857 {
5858 u16 val = nla_get_u16(nla);
5859 if (val < min || val > max)
5860 return -EINVAL;
5861 *out = val;
5862 return 0;
5863 }
5864
5865 static int nl80211_check_u32(const struct nlattr *nla, u32 min, u32 max, u32 *out)
5866 {
5867 u32 val = nla_get_u32(nla);
5868 if (val < min || val > max)
5869 return -EINVAL;
5870 *out = val;
5871 return 0;
5872 }
5873
5874 static int nl80211_check_s32(const struct nlattr *nla, s32 min, s32 max, s32 *out)
5875 {
5876 s32 val = nla_get_s32(nla);
5877 if (val < min || val > max)
5878 return -EINVAL;
5879 *out = val;
5880 return 0;
5881 }
5882
5883 static int nl80211_check_power_mode(const struct nlattr *nla,
5884 enum nl80211_mesh_power_mode min,
5885 enum nl80211_mesh_power_mode max,
5886 enum nl80211_mesh_power_mode *out)
5887 {
5888 u32 val = nla_get_u32(nla);
5889 if (val < min || val > max)
5890 return -EINVAL;
5891 *out = val;
5892 return 0;
5893 }
5894
5895 static int nl80211_parse_mesh_config(struct genl_info *info,
5896 struct mesh_config *cfg,
5897 u32 *mask_out)
5898 {
5899 struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
5900 u32 mask = 0;
5901 u16 ht_opmode;
5902
5903 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
5904 do { \
5905 if (tb[attr]) { \
5906 if (fn(tb[attr], min, max, &cfg->param)) \
5907 return -EINVAL; \
5908 mask |= (1 << (attr - 1)); \
5909 } \
5910 } while (0)
5911
5912 if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
5913 return -EINVAL;
5914 if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
5915 info->attrs[NL80211_ATTR_MESH_CONFIG],
5916 nl80211_meshconf_params_policy, info->extack))
5917 return -EINVAL;
5918
5919 /* This makes sure that there aren't more than 32 mesh config
5920 * parameters (otherwise our bitfield scheme would not work.) */
5921 BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
5922
5923 /* Fill in the params struct */
5924 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
5925 mask, NL80211_MESHCONF_RETRY_TIMEOUT,
5926 nl80211_check_u16);
5927 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
5928 mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5929 nl80211_check_u16);
5930 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
5931 mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
5932 nl80211_check_u16);
5933 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
5934 mask, NL80211_MESHCONF_MAX_PEER_LINKS,
5935 nl80211_check_u16);
5936 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
5937 mask, NL80211_MESHCONF_MAX_RETRIES,
5938 nl80211_check_u8);
5939 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
5940 mask, NL80211_MESHCONF_TTL, nl80211_check_u8);
5941 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
5942 mask, NL80211_MESHCONF_ELEMENT_TTL,
5943 nl80211_check_u8);
5944 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
5945 mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5946 nl80211_check_bool);
5947 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
5948 1, 255, mask,
5949 NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5950 nl80211_check_u32);
5951 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
5952 mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5953 nl80211_check_u8);
5954 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
5955 mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
5956 nl80211_check_u32);
5957 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
5958 mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5959 nl80211_check_u16);
5960 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
5961 1, 65535, mask,
5962 NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5963 nl80211_check_u32);
5964 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
5965 1, 65535, mask,
5966 NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5967 nl80211_check_u16);
5968 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
5969 1, 65535, mask,
5970 NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5971 nl80211_check_u16);
5972 FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5973 dot11MeshHWMPnetDiameterTraversalTime,
5974 1, 65535, mask,
5975 NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5976 nl80211_check_u16);
5977 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
5978 mask, NL80211_MESHCONF_HWMP_ROOTMODE,
5979 nl80211_check_u8);
5980 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
5981 mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5982 nl80211_check_u16);
5983 FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5984 dot11MeshGateAnnouncementProtocol, 0, 1,
5985 mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5986 nl80211_check_bool);
5987 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
5988 mask, NL80211_MESHCONF_FORWARDING,
5989 nl80211_check_bool);
5990 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
5991 mask, NL80211_MESHCONF_RSSI_THRESHOLD,
5992 nl80211_check_s32);
5993 /*
5994 * Check HT operation mode based on
5995 * IEEE 802.11-2016 9.4.2.57 HT Operation element.
5996 */
5997 if (tb[NL80211_MESHCONF_HT_OPMODE]) {
5998 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
5999
6000 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
6001 IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
6002 IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
6003 return -EINVAL;
6004
6005 /* NON_HT_STA bit is reserved, but some programs set it */
6006 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
6007
6008 cfg->ht_opmode = ht_opmode;
6009 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
6010 }
6011 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
6012 1, 65535, mask,
6013 NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
6014 nl80211_check_u32);
6015 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
6016 mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
6017 nl80211_check_u16);
6018 FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6019 dot11MeshHWMPconfirmationInterval,
6020 1, 65535, mask,
6021 NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
6022 nl80211_check_u16);
6023 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
6024 NL80211_MESH_POWER_ACTIVE,
6025 NL80211_MESH_POWER_MAX,
6026 mask, NL80211_MESHCONF_POWER_MODE,
6027 nl80211_check_power_mode);
6028 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
6029 0, 65535, mask,
6030 NL80211_MESHCONF_AWAKE_WINDOW, nl80211_check_u16);
6031 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 0, 0xffffffff,
6032 mask, NL80211_MESHCONF_PLINK_TIMEOUT,
6033 nl80211_check_u32);
6034 if (mask_out)
6035 *mask_out = mask;
6036
6037 return 0;
6038
6039 #undef FILL_IN_MESH_PARAM_IF_SET
6040 }
6041
6042 static int nl80211_parse_mesh_setup(struct genl_info *info,
6043 struct mesh_setup *setup)
6044 {
6045 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6046 struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
6047
6048 if (!info->attrs[NL80211_ATTR_MESH_SETUP])
6049 return -EINVAL;
6050 if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
6051 info->attrs[NL80211_ATTR_MESH_SETUP],
6052 nl80211_mesh_setup_params_policy, info->extack))
6053 return -EINVAL;
6054
6055 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
6056 setup->sync_method =
6057 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
6058 IEEE80211_SYNC_METHOD_VENDOR :
6059 IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
6060
6061 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
6062 setup->path_sel_proto =
6063 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
6064 IEEE80211_PATH_PROTOCOL_VENDOR :
6065 IEEE80211_PATH_PROTOCOL_HWMP;
6066
6067 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
6068 setup->path_metric =
6069 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
6070 IEEE80211_PATH_METRIC_VENDOR :
6071 IEEE80211_PATH_METRIC_AIRTIME;
6072
6073 if (tb[NL80211_MESH_SETUP_IE]) {
6074 struct nlattr *ieattr =
6075 tb[NL80211_MESH_SETUP_IE];
6076 if (!is_valid_ie_attr(ieattr))
6077 return -EINVAL;
6078 setup->ie = nla_data(ieattr);
6079 setup->ie_len = nla_len(ieattr);
6080 }
6081 if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
6082 !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
6083 return -EINVAL;
6084 setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
6085 setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
6086 setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
6087 if (setup->is_secure)
6088 setup->user_mpm = true;
6089
6090 if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
6091 if (!setup->user_mpm)
6092 return -EINVAL;
6093 setup->auth_id =
6094 nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
6095 }
6096
6097 return 0;
6098 }
6099
6100 static int nl80211_update_mesh_config(struct sk_buff *skb,
6101 struct genl_info *info)
6102 {
6103 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6104 struct net_device *dev = info->user_ptr[1];
6105 struct wireless_dev *wdev = dev->ieee80211_ptr;
6106 struct mesh_config cfg;
6107 u32 mask;
6108 int err;
6109
6110 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
6111 return -EOPNOTSUPP;
6112
6113 if (!rdev->ops->update_mesh_config)
6114 return -EOPNOTSUPP;
6115
6116 err = nl80211_parse_mesh_config(info, &cfg, &mask);
6117 if (err)
6118 return err;
6119
6120 wdev_lock(wdev);
6121 if (!wdev->mesh_id_len)
6122 err = -ENOLINK;
6123
6124 if (!err)
6125 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
6126
6127 wdev_unlock(wdev);
6128
6129 return err;
6130 }
6131
6132 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
6133 struct sk_buff *msg)
6134 {
6135 struct nlattr *nl_reg_rules;
6136 unsigned int i;
6137
6138 if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
6139 (regdom->dfs_region &&
6140 nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
6141 goto nla_put_failure;
6142
6143 nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
6144 if (!nl_reg_rules)
6145 goto nla_put_failure;
6146
6147 for (i = 0; i < regdom->n_reg_rules; i++) {
6148 struct nlattr *nl_reg_rule;
6149 const struct ieee80211_reg_rule *reg_rule;
6150 const struct ieee80211_freq_range *freq_range;
6151 const struct ieee80211_power_rule *power_rule;
6152 unsigned int max_bandwidth_khz;
6153
6154 reg_rule = &regdom->reg_rules[i];
6155 freq_range = &reg_rule->freq_range;
6156 power_rule = &reg_rule->power_rule;
6157
6158 nl_reg_rule = nla_nest_start(msg, i);
6159 if (!nl_reg_rule)
6160 goto nla_put_failure;
6161
6162 max_bandwidth_khz = freq_range->max_bandwidth_khz;
6163 if (!max_bandwidth_khz)
6164 max_bandwidth_khz = reg_get_max_bandwidth(regdom,
6165 reg_rule);
6166
6167 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
6168 reg_rule->flags) ||
6169 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
6170 freq_range->start_freq_khz) ||
6171 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
6172 freq_range->end_freq_khz) ||
6173 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
6174 max_bandwidth_khz) ||
6175 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
6176 power_rule->max_antenna_gain) ||
6177 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
6178 power_rule->max_eirp) ||
6179 nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
6180 reg_rule->dfs_cac_ms))
6181 goto nla_put_failure;
6182
6183 nla_nest_end(msg, nl_reg_rule);
6184 }
6185
6186 nla_nest_end(msg, nl_reg_rules);
6187 return 0;
6188
6189 nla_put_failure:
6190 return -EMSGSIZE;
6191 }
6192
6193 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
6194 {
6195 const struct ieee80211_regdomain *regdom = NULL;
6196 struct cfg80211_registered_device *rdev;
6197 struct wiphy *wiphy = NULL;
6198 struct sk_buff *msg;
6199 void *hdr;
6200
6201 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6202 if (!msg)
6203 return -ENOBUFS;
6204
6205 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6206 NL80211_CMD_GET_REG);
6207 if (!hdr)
6208 goto put_failure;
6209
6210 if (info->attrs[NL80211_ATTR_WIPHY]) {
6211 bool self_managed;
6212
6213 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
6214 if (IS_ERR(rdev)) {
6215 nlmsg_free(msg);
6216 return PTR_ERR(rdev);
6217 }
6218
6219 wiphy = &rdev->wiphy;
6220 self_managed = wiphy->regulatory_flags &
6221 REGULATORY_WIPHY_SELF_MANAGED;
6222 regdom = get_wiphy_regdom(wiphy);
6223
6224 /* a self-managed-reg device must have a private regdom */
6225 if (WARN_ON(!regdom && self_managed)) {
6226 nlmsg_free(msg);
6227 return -EINVAL;
6228 }
6229
6230 if (regdom &&
6231 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6232 goto nla_put_failure;
6233 }
6234
6235 if (!wiphy && reg_last_request_cell_base() &&
6236 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6237 NL80211_USER_REG_HINT_CELL_BASE))
6238 goto nla_put_failure;
6239
6240 rcu_read_lock();
6241
6242 if (!regdom)
6243 regdom = rcu_dereference(cfg80211_regdomain);
6244
6245 if (nl80211_put_regdom(regdom, msg))
6246 goto nla_put_failure_rcu;
6247
6248 rcu_read_unlock();
6249
6250 genlmsg_end(msg, hdr);
6251 return genlmsg_reply(msg, info);
6252
6253 nla_put_failure_rcu:
6254 rcu_read_unlock();
6255 nla_put_failure:
6256 genlmsg_cancel(msg, hdr);
6257 put_failure:
6258 nlmsg_free(msg);
6259 return -EMSGSIZE;
6260 }
6261
6262 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
6263 u32 seq, int flags, struct wiphy *wiphy,
6264 const struct ieee80211_regdomain *regdom)
6265 {
6266 void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
6267 NL80211_CMD_GET_REG);
6268
6269 if (!hdr)
6270 return -1;
6271
6272 genl_dump_check_consistent(cb, hdr, &nl80211_fam);
6273
6274 if (nl80211_put_regdom(regdom, msg))
6275 goto nla_put_failure;
6276
6277 if (!wiphy && reg_last_request_cell_base() &&
6278 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6279 NL80211_USER_REG_HINT_CELL_BASE))
6280 goto nla_put_failure;
6281
6282 if (wiphy &&
6283 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6284 goto nla_put_failure;
6285
6286 if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
6287 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
6288 goto nla_put_failure;
6289
6290 genlmsg_end(msg, hdr);
6291 return 0;
6292
6293 nla_put_failure:
6294 genlmsg_cancel(msg, hdr);
6295 return -EMSGSIZE;
6296 }
6297
6298 static int nl80211_get_reg_dump(struct sk_buff *skb,
6299 struct netlink_callback *cb)
6300 {
6301 const struct ieee80211_regdomain *regdom = NULL;
6302 struct cfg80211_registered_device *rdev;
6303 int err, reg_idx, start = cb->args[2];
6304
6305 rtnl_lock();
6306
6307 if (cfg80211_regdomain && start == 0) {
6308 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6309 NLM_F_MULTI, NULL,
6310 rtnl_dereference(cfg80211_regdomain));
6311 if (err < 0)
6312 goto out_err;
6313 }
6314
6315 /* the global regdom is idx 0 */
6316 reg_idx = 1;
6317 list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
6318 regdom = get_wiphy_regdom(&rdev->wiphy);
6319 if (!regdom)
6320 continue;
6321
6322 if (++reg_idx <= start)
6323 continue;
6324
6325 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6326 NLM_F_MULTI, &rdev->wiphy, regdom);
6327 if (err < 0) {
6328 reg_idx--;
6329 break;
6330 }
6331 }
6332
6333 cb->args[2] = reg_idx;
6334 err = skb->len;
6335 out_err:
6336 rtnl_unlock();
6337 return err;
6338 }
6339
6340 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
6341 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
6342 [NL80211_ATTR_REG_RULE_FLAGS] = { .type = NLA_U32 },
6343 [NL80211_ATTR_FREQ_RANGE_START] = { .type = NLA_U32 },
6344 [NL80211_ATTR_FREQ_RANGE_END] = { .type = NLA_U32 },
6345 [NL80211_ATTR_FREQ_RANGE_MAX_BW] = { .type = NLA_U32 },
6346 [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN] = { .type = NLA_U32 },
6347 [NL80211_ATTR_POWER_RULE_MAX_EIRP] = { .type = NLA_U32 },
6348 [NL80211_ATTR_DFS_CAC_TIME] = { .type = NLA_U32 },
6349 };
6350
6351 static int parse_reg_rule(struct nlattr *tb[],
6352 struct ieee80211_reg_rule *reg_rule)
6353 {
6354 struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
6355 struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
6356
6357 if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
6358 return -EINVAL;
6359 if (!tb[NL80211_ATTR_FREQ_RANGE_START])
6360 return -EINVAL;
6361 if (!tb[NL80211_ATTR_FREQ_RANGE_END])
6362 return -EINVAL;
6363 if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
6364 return -EINVAL;
6365 if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
6366 return -EINVAL;
6367
6368 reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
6369
6370 freq_range->start_freq_khz =
6371 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
6372 freq_range->end_freq_khz =
6373 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
6374 freq_range->max_bandwidth_khz =
6375 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
6376
6377 power_rule->max_eirp =
6378 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
6379
6380 if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
6381 power_rule->max_antenna_gain =
6382 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
6383
6384 if (tb[NL80211_ATTR_DFS_CAC_TIME])
6385 reg_rule->dfs_cac_ms =
6386 nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
6387
6388 return 0;
6389 }
6390
6391 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
6392 {
6393 struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
6394 struct nlattr *nl_reg_rule;
6395 char *alpha2;
6396 int rem_reg_rules, r;
6397 u32 num_rules = 0, rule_idx = 0, size_of_regd;
6398 enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
6399 struct ieee80211_regdomain *rd;
6400
6401 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
6402 return -EINVAL;
6403
6404 if (!info->attrs[NL80211_ATTR_REG_RULES])
6405 return -EINVAL;
6406
6407 alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
6408
6409 if (info->attrs[NL80211_ATTR_DFS_REGION])
6410 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
6411
6412 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6413 rem_reg_rules) {
6414 num_rules++;
6415 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
6416 return -EINVAL;
6417 }
6418
6419 if (!reg_is_valid_request(alpha2))
6420 return -EINVAL;
6421
6422 size_of_regd = sizeof(struct ieee80211_regdomain) +
6423 num_rules * sizeof(struct ieee80211_reg_rule);
6424
6425 rd = kzalloc(size_of_regd, GFP_KERNEL);
6426 if (!rd)
6427 return -ENOMEM;
6428
6429 rd->n_reg_rules = num_rules;
6430 rd->alpha2[0] = alpha2[0];
6431 rd->alpha2[1] = alpha2[1];
6432
6433 /*
6434 * Disable DFS master mode if the DFS region was
6435 * not supported or known on this kernel.
6436 */
6437 if (reg_supported_dfs_region(dfs_region))
6438 rd->dfs_region = dfs_region;
6439
6440 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6441 rem_reg_rules) {
6442 r = nla_parse_nested(tb, NL80211_REG_RULE_ATTR_MAX,
6443 nl_reg_rule, reg_rule_policy,
6444 info->extack);
6445 if (r)
6446 goto bad_reg;
6447 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
6448 if (r)
6449 goto bad_reg;
6450
6451 rule_idx++;
6452
6453 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
6454 r = -EINVAL;
6455 goto bad_reg;
6456 }
6457 }
6458
6459 /* set_regdom takes ownership of rd */
6460 return set_regdom(rd, REGD_SOURCE_CRDA);
6461 bad_reg:
6462 kfree(rd);
6463 return r;
6464 }
6465 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
6466
6467 static int validate_scan_freqs(struct nlattr *freqs)
6468 {
6469 struct nlattr *attr1, *attr2;
6470 int n_channels = 0, tmp1, tmp2;
6471
6472 nla_for_each_nested(attr1, freqs, tmp1)
6473 if (nla_len(attr1) != sizeof(u32))
6474 return 0;
6475
6476 nla_for_each_nested(attr1, freqs, tmp1) {
6477 n_channels++;
6478 /*
6479 * Some hardware has a limited channel list for
6480 * scanning, and it is pretty much nonsensical
6481 * to scan for a channel twice, so disallow that
6482 * and don't require drivers to check that the
6483 * channel list they get isn't longer than what
6484 * they can scan, as long as they can scan all
6485 * the channels they registered at once.
6486 */
6487 nla_for_each_nested(attr2, freqs, tmp2)
6488 if (attr1 != attr2 &&
6489 nla_get_u32(attr1) == nla_get_u32(attr2))
6490 return 0;
6491 }
6492
6493 return n_channels;
6494 }
6495
6496 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
6497 {
6498 return b < NUM_NL80211_BANDS && wiphy->bands[b];
6499 }
6500
6501 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
6502 struct cfg80211_bss_selection *bss_select)
6503 {
6504 struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
6505 struct nlattr *nest;
6506 int err;
6507 bool found = false;
6508 int i;
6509
6510 /* only process one nested attribute */
6511 nest = nla_data(nla);
6512 if (!nla_ok(nest, nla_len(nest)))
6513 return -EINVAL;
6514
6515 err = nla_parse_nested(attr, NL80211_BSS_SELECT_ATTR_MAX, nest,
6516 nl80211_bss_select_policy, NULL);
6517 if (err)
6518 return err;
6519
6520 /* only one attribute may be given */
6521 for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
6522 if (attr[i]) {
6523 if (found)
6524 return -EINVAL;
6525 found = true;
6526 }
6527 }
6528
6529 bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
6530
6531 if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
6532 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
6533
6534 if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
6535 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
6536 bss_select->param.band_pref =
6537 nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
6538 if (!is_band_valid(wiphy, bss_select->param.band_pref))
6539 return -EINVAL;
6540 }
6541
6542 if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
6543 struct nl80211_bss_select_rssi_adjust *adj_param;
6544
6545 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
6546 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
6547 bss_select->param.adjust.band = adj_param->band;
6548 bss_select->param.adjust.delta = adj_param->delta;
6549 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
6550 return -EINVAL;
6551 }
6552
6553 /* user-space did not provide behaviour attribute */
6554 if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
6555 return -EINVAL;
6556
6557 if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
6558 return -EINVAL;
6559
6560 return 0;
6561 }
6562
6563 static int nl80211_parse_random_mac(struct nlattr **attrs,
6564 u8 *mac_addr, u8 *mac_addr_mask)
6565 {
6566 int i;
6567
6568 if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
6569 eth_zero_addr(mac_addr);
6570 eth_zero_addr(mac_addr_mask);
6571 mac_addr[0] = 0x2;
6572 mac_addr_mask[0] = 0x3;
6573
6574 return 0;
6575 }
6576
6577 /* need both or none */
6578 if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
6579 return -EINVAL;
6580
6581 memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
6582 memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
6583
6584 /* don't allow or configure an mcast address */
6585 if (!is_multicast_ether_addr(mac_addr_mask) ||
6586 is_multicast_ether_addr(mac_addr))
6587 return -EINVAL;
6588
6589 /*
6590 * allow users to pass a MAC address that has bits set outside
6591 * of the mask, but don't bother drivers with having to deal
6592 * with such bits
6593 */
6594 for (i = 0; i < ETH_ALEN; i++)
6595 mac_addr[i] &= mac_addr_mask[i];
6596
6597 return 0;
6598 }
6599
6600 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev)
6601 {
6602 ASSERT_WDEV_LOCK(wdev);
6603
6604 if (!cfg80211_beaconing_iface_active(wdev))
6605 return true;
6606
6607 if (!(wdev->chandef.chan->flags & IEEE80211_CHAN_RADAR))
6608 return true;
6609
6610 return regulatory_pre_cac_allowed(wdev->wiphy);
6611 }
6612
6613 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
6614 {
6615 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6616 struct wireless_dev *wdev = info->user_ptr[1];
6617 struct cfg80211_scan_request *request;
6618 struct nlattr *attr;
6619 struct wiphy *wiphy;
6620 int err, tmp, n_ssids = 0, n_channels, i;
6621 size_t ie_len;
6622
6623 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6624 return -EINVAL;
6625
6626 wiphy = &rdev->wiphy;
6627
6628 if (wdev->iftype == NL80211_IFTYPE_NAN)
6629 return -EOPNOTSUPP;
6630
6631 if (!rdev->ops->scan)
6632 return -EOPNOTSUPP;
6633
6634 if (rdev->scan_req || rdev->scan_msg) {
6635 err = -EBUSY;
6636 goto unlock;
6637 }
6638
6639 if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6640 n_channels = validate_scan_freqs(
6641 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
6642 if (!n_channels) {
6643 err = -EINVAL;
6644 goto unlock;
6645 }
6646 } else {
6647 n_channels = ieee80211_get_num_supported_channels(wiphy);
6648 }
6649
6650 if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
6651 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
6652 n_ssids++;
6653
6654 if (n_ssids > wiphy->max_scan_ssids) {
6655 err = -EINVAL;
6656 goto unlock;
6657 }
6658
6659 if (info->attrs[NL80211_ATTR_IE])
6660 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6661 else
6662 ie_len = 0;
6663
6664 if (ie_len > wiphy->max_scan_ie_len) {
6665 err = -EINVAL;
6666 goto unlock;
6667 }
6668
6669 request = kzalloc(sizeof(*request)
6670 + sizeof(*request->ssids) * n_ssids
6671 + sizeof(*request->channels) * n_channels
6672 + ie_len, GFP_KERNEL);
6673 if (!request) {
6674 err = -ENOMEM;
6675 goto unlock;
6676 }
6677
6678 if (n_ssids)
6679 request->ssids = (void *)&request->channels[n_channels];
6680 request->n_ssids = n_ssids;
6681 if (ie_len) {
6682 if (n_ssids)
6683 request->ie = (void *)(request->ssids + n_ssids);
6684 else
6685 request->ie = (void *)(request->channels + n_channels);
6686 }
6687
6688 i = 0;
6689 if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6690 /* user specified, bail out if channel not found */
6691 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
6692 struct ieee80211_channel *chan;
6693
6694 chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
6695
6696 if (!chan) {
6697 err = -EINVAL;
6698 goto out_free;
6699 }
6700
6701 /* ignore disabled channels */
6702 if (chan->flags & IEEE80211_CHAN_DISABLED)
6703 continue;
6704
6705 request->channels[i] = chan;
6706 i++;
6707 }
6708 } else {
6709 enum nl80211_band band;
6710
6711 /* all channels */
6712 for (band = 0; band < NUM_NL80211_BANDS; band++) {
6713 int j;
6714
6715 if (!wiphy->bands[band])
6716 continue;
6717 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
6718 struct ieee80211_channel *chan;
6719
6720 chan = &wiphy->bands[band]->channels[j];
6721
6722 if (chan->flags & IEEE80211_CHAN_DISABLED)
6723 continue;
6724
6725 request->channels[i] = chan;
6726 i++;
6727 }
6728 }
6729 }
6730
6731 if (!i) {
6732 err = -EINVAL;
6733 goto out_free;
6734 }
6735
6736 request->n_channels = i;
6737
6738 wdev_lock(wdev);
6739 if (!cfg80211_off_channel_oper_allowed(wdev)) {
6740 struct ieee80211_channel *chan;
6741
6742 if (request->n_channels != 1) {
6743 wdev_unlock(wdev);
6744 err = -EBUSY;
6745 goto out_free;
6746 }
6747
6748 chan = request->channels[0];
6749 if (chan->center_freq != wdev->chandef.chan->center_freq) {
6750 wdev_unlock(wdev);
6751 err = -EBUSY;
6752 goto out_free;
6753 }
6754 }
6755 wdev_unlock(wdev);
6756
6757 i = 0;
6758 if (n_ssids) {
6759 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
6760 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
6761 err = -EINVAL;
6762 goto out_free;
6763 }
6764 request->ssids[i].ssid_len = nla_len(attr);
6765 memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
6766 i++;
6767 }
6768 }
6769
6770 if (info->attrs[NL80211_ATTR_IE]) {
6771 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6772 memcpy((void *)request->ie,
6773 nla_data(info->attrs[NL80211_ATTR_IE]),
6774 request->ie_len);
6775 }
6776
6777 for (i = 0; i < NUM_NL80211_BANDS; i++)
6778 if (wiphy->bands[i])
6779 request->rates[i] =
6780 (1 << wiphy->bands[i]->n_bitrates) - 1;
6781
6782 if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
6783 nla_for_each_nested(attr,
6784 info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
6785 tmp) {
6786 enum nl80211_band band = nla_type(attr);
6787
6788 if (band < 0 || band >= NUM_NL80211_BANDS) {
6789 err = -EINVAL;
6790 goto out_free;
6791 }
6792
6793 if (!wiphy->bands[band])
6794 continue;
6795
6796 err = ieee80211_get_ratemask(wiphy->bands[band],
6797 nla_data(attr),
6798 nla_len(attr),
6799 &request->rates[band]);
6800 if (err)
6801 goto out_free;
6802 }
6803 }
6804
6805 if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
6806 if (!wiphy_ext_feature_isset(wiphy,
6807 NL80211_EXT_FEATURE_SET_SCAN_DWELL)) {
6808 err = -EOPNOTSUPP;
6809 goto out_free;
6810 }
6811
6812 request->duration =
6813 nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
6814 request->duration_mandatory =
6815 nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
6816 }
6817
6818 if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
6819 request->flags = nla_get_u32(
6820 info->attrs[NL80211_ATTR_SCAN_FLAGS]);
6821 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
6822 !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
6823 err = -EOPNOTSUPP;
6824 goto out_free;
6825 }
6826
6827 if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
6828 if (!(wiphy->features &
6829 NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR)) {
6830 err = -EOPNOTSUPP;
6831 goto out_free;
6832 }
6833
6834 if (wdev->current_bss) {
6835 err = -EOPNOTSUPP;
6836 goto out_free;
6837 }
6838
6839 err = nl80211_parse_random_mac(info->attrs,
6840 request->mac_addr,
6841 request->mac_addr_mask);
6842 if (err)
6843 goto out_free;
6844 }
6845 }
6846
6847 request->no_cck =
6848 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
6849
6850 /* Initial implementation used NL80211_ATTR_MAC to set the specific
6851 * BSSID to scan for. This was problematic because that same attribute
6852 * was already used for another purpose (local random MAC address). The
6853 * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
6854 * compatibility with older userspace components, also use the
6855 * NL80211_ATTR_MAC value here if it can be determined to be used for
6856 * the specific BSSID use case instead of the random MAC address
6857 * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
6858 */
6859 if (info->attrs[NL80211_ATTR_BSSID])
6860 memcpy(request->bssid,
6861 nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
6862 else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
6863 info->attrs[NL80211_ATTR_MAC])
6864 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
6865 ETH_ALEN);
6866 else
6867 eth_broadcast_addr(request->bssid);
6868
6869 request->wdev = wdev;
6870 request->wiphy = &rdev->wiphy;
6871 request->scan_start = jiffies;
6872
6873 rdev->scan_req = request;
6874 err = rdev_scan(rdev, request);
6875
6876 if (!err) {
6877 nl80211_send_scan_start(rdev, wdev);
6878 if (wdev->netdev)
6879 dev_hold(wdev->netdev);
6880 } else {
6881 out_free:
6882 rdev->scan_req = NULL;
6883 kfree(request);
6884 }
6885
6886 unlock:
6887 return err;
6888 }
6889
6890 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
6891 {
6892 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6893 struct wireless_dev *wdev = info->user_ptr[1];
6894
6895 if (!rdev->ops->abort_scan)
6896 return -EOPNOTSUPP;
6897
6898 if (rdev->scan_msg)
6899 return 0;
6900
6901 if (!rdev->scan_req)
6902 return -ENOENT;
6903
6904 rdev_abort_scan(rdev, wdev);
6905 return 0;
6906 }
6907
6908 static int
6909 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
6910 struct cfg80211_sched_scan_request *request,
6911 struct nlattr **attrs)
6912 {
6913 int tmp, err, i = 0;
6914 struct nlattr *attr;
6915
6916 if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
6917 u32 interval;
6918
6919 /*
6920 * If scan plans are not specified,
6921 * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
6922 * case one scan plan will be set with the specified scan
6923 * interval and infinite number of iterations.
6924 */
6925 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
6926 if (!interval)
6927 return -EINVAL;
6928
6929 request->scan_plans[0].interval =
6930 DIV_ROUND_UP(interval, MSEC_PER_SEC);
6931 if (!request->scan_plans[0].interval)
6932 return -EINVAL;
6933
6934 if (request->scan_plans[0].interval >
6935 wiphy->max_sched_scan_plan_interval)
6936 request->scan_plans[0].interval =
6937 wiphy->max_sched_scan_plan_interval;
6938
6939 return 0;
6940 }
6941
6942 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
6943 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
6944
6945 if (WARN_ON(i >= n_plans))
6946 return -EINVAL;
6947
6948 err = nla_parse_nested(plan, NL80211_SCHED_SCAN_PLAN_MAX,
6949 attr, nl80211_plan_policy, NULL);
6950 if (err)
6951 return err;
6952
6953 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
6954 return -EINVAL;
6955
6956 request->scan_plans[i].interval =
6957 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
6958 if (!request->scan_plans[i].interval ||
6959 request->scan_plans[i].interval >
6960 wiphy->max_sched_scan_plan_interval)
6961 return -EINVAL;
6962
6963 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
6964 request->scan_plans[i].iterations =
6965 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
6966 if (!request->scan_plans[i].iterations ||
6967 (request->scan_plans[i].iterations >
6968 wiphy->max_sched_scan_plan_iterations))
6969 return -EINVAL;
6970 } else if (i < n_plans - 1) {
6971 /*
6972 * All scan plans but the last one must specify
6973 * a finite number of iterations
6974 */
6975 return -EINVAL;
6976 }
6977
6978 i++;
6979 }
6980
6981 /*
6982 * The last scan plan must not specify the number of
6983 * iterations, it is supposed to run infinitely
6984 */
6985 if (request->scan_plans[n_plans - 1].iterations)
6986 return -EINVAL;
6987
6988 return 0;
6989 }
6990
6991 static struct cfg80211_sched_scan_request *
6992 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
6993 struct nlattr **attrs, int max_match_sets)
6994 {
6995 struct cfg80211_sched_scan_request *request;
6996 struct nlattr *attr;
6997 int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
6998 enum nl80211_band band;
6999 size_t ie_len;
7000 struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
7001 s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
7002
7003 if (!is_valid_ie_attr(attrs[NL80211_ATTR_IE]))
7004 return ERR_PTR(-EINVAL);
7005
7006 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7007 n_channels = validate_scan_freqs(
7008 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
7009 if (!n_channels)
7010 return ERR_PTR(-EINVAL);
7011 } else {
7012 n_channels = ieee80211_get_num_supported_channels(wiphy);
7013 }
7014
7015 if (attrs[NL80211_ATTR_SCAN_SSIDS])
7016 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7017 tmp)
7018 n_ssids++;
7019
7020 if (n_ssids > wiphy->max_sched_scan_ssids)
7021 return ERR_PTR(-EINVAL);
7022
7023 /*
7024 * First, count the number of 'real' matchsets. Due to an issue with
7025 * the old implementation, matchsets containing only the RSSI attribute
7026 * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
7027 * RSSI for all matchsets, rather than their own matchset for reporting
7028 * all APs with a strong RSSI. This is needed to be compatible with
7029 * older userspace that treated a matchset with only the RSSI as the
7030 * global RSSI for all other matchsets - if there are other matchsets.
7031 */
7032 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7033 nla_for_each_nested(attr,
7034 attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7035 tmp) {
7036 struct nlattr *rssi;
7037
7038 err = nla_parse_nested(tb,
7039 NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7040 attr, nl80211_match_policy,
7041 NULL);
7042 if (err)
7043 return ERR_PTR(err);
7044
7045 /* SSID and BSSID are mutually exclusive */
7046 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
7047 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
7048 return ERR_PTR(-EINVAL);
7049
7050 /* add other standalone attributes here */
7051 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
7052 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
7053 n_match_sets++;
7054 continue;
7055 }
7056 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
7057 if (rssi)
7058 default_match_rssi = nla_get_s32(rssi);
7059 }
7060 }
7061
7062 /* However, if there's no other matchset, add the RSSI one */
7063 if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
7064 n_match_sets = 1;
7065
7066 if (n_match_sets > max_match_sets)
7067 return ERR_PTR(-EINVAL);
7068
7069 if (attrs[NL80211_ATTR_IE])
7070 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
7071 else
7072 ie_len = 0;
7073
7074 if (ie_len > wiphy->max_sched_scan_ie_len)
7075 return ERR_PTR(-EINVAL);
7076
7077 if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
7078 /*
7079 * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
7080 * each scan plan already specifies its own interval
7081 */
7082 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
7083 return ERR_PTR(-EINVAL);
7084
7085 nla_for_each_nested(attr,
7086 attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
7087 n_plans++;
7088 } else {
7089 /*
7090 * The scan interval attribute is kept for backward
7091 * compatibility. If no scan plans are specified and sched scan
7092 * interval is specified, one scan plan will be set with this
7093 * scan interval and infinite number of iterations.
7094 */
7095 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
7096 return ERR_PTR(-EINVAL);
7097
7098 n_plans = 1;
7099 }
7100
7101 if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
7102 return ERR_PTR(-EINVAL);
7103
7104 if (!wiphy_ext_feature_isset(
7105 wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
7106 (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
7107 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
7108 return ERR_PTR(-EINVAL);
7109
7110 request = kzalloc(sizeof(*request)
7111 + sizeof(*request->ssids) * n_ssids
7112 + sizeof(*request->match_sets) * n_match_sets
7113 + sizeof(*request->scan_plans) * n_plans
7114 + sizeof(*request->channels) * n_channels
7115 + ie_len, GFP_KERNEL);
7116 if (!request)
7117 return ERR_PTR(-ENOMEM);
7118
7119 if (n_ssids)
7120 request->ssids = (void *)&request->channels[n_channels];
7121 request->n_ssids = n_ssids;
7122 if (ie_len) {
7123 if (n_ssids)
7124 request->ie = (void *)(request->ssids + n_ssids);
7125 else
7126 request->ie = (void *)(request->channels + n_channels);
7127 }
7128
7129 if (n_match_sets) {
7130 if (request->ie)
7131 request->match_sets = (void *)(request->ie + ie_len);
7132 else if (n_ssids)
7133 request->match_sets =
7134 (void *)(request->ssids + n_ssids);
7135 else
7136 request->match_sets =
7137 (void *)(request->channels + n_channels);
7138 }
7139 request->n_match_sets = n_match_sets;
7140
7141 if (n_match_sets)
7142 request->scan_plans = (void *)(request->match_sets +
7143 n_match_sets);
7144 else if (request->ie)
7145 request->scan_plans = (void *)(request->ie + ie_len);
7146 else if (n_ssids)
7147 request->scan_plans = (void *)(request->ssids + n_ssids);
7148 else
7149 request->scan_plans = (void *)(request->channels + n_channels);
7150
7151 request->n_scan_plans = n_plans;
7152
7153 i = 0;
7154 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7155 /* user specified, bail out if channel not found */
7156 nla_for_each_nested(attr,
7157 attrs[NL80211_ATTR_SCAN_FREQUENCIES],
7158 tmp) {
7159 struct ieee80211_channel *chan;
7160
7161 chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
7162
7163 if (!chan) {
7164 err = -EINVAL;
7165 goto out_free;
7166 }
7167
7168 /* ignore disabled channels */
7169 if (chan->flags & IEEE80211_CHAN_DISABLED)
7170 continue;
7171
7172 request->channels[i] = chan;
7173 i++;
7174 }
7175 } else {
7176 /* all channels */
7177 for (band = 0; band < NUM_NL80211_BANDS; band++) {
7178 int j;
7179
7180 if (!wiphy->bands[band])
7181 continue;
7182 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
7183 struct ieee80211_channel *chan;
7184
7185 chan = &wiphy->bands[band]->channels[j];
7186
7187 if (chan->flags & IEEE80211_CHAN_DISABLED)
7188 continue;
7189
7190 request->channels[i] = chan;
7191 i++;
7192 }
7193 }
7194 }
7195
7196 if (!i) {
7197 err = -EINVAL;
7198 goto out_free;
7199 }
7200
7201 request->n_channels = i;
7202
7203 i = 0;
7204 if (n_ssids) {
7205 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7206 tmp) {
7207 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
7208 err = -EINVAL;
7209 goto out_free;
7210 }
7211 request->ssids[i].ssid_len = nla_len(attr);
7212 memcpy(request->ssids[i].ssid, nla_data(attr),
7213 nla_len(attr));
7214 i++;
7215 }
7216 }
7217
7218 i = 0;
7219 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7220 nla_for_each_nested(attr,
7221 attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7222 tmp) {
7223 struct nlattr *ssid, *bssid, *rssi;
7224
7225 err = nla_parse_nested(tb,
7226 NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7227 attr, nl80211_match_policy,
7228 NULL);
7229 if (err)
7230 goto out_free;
7231 ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
7232 bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
7233 if (ssid || bssid) {
7234 if (WARN_ON(i >= n_match_sets)) {
7235 /* this indicates a programming error,
7236 * the loop above should have verified
7237 * things properly
7238 */
7239 err = -EINVAL;
7240 goto out_free;
7241 }
7242
7243 if (ssid) {
7244 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
7245 err = -EINVAL;
7246 goto out_free;
7247 }
7248 memcpy(request->match_sets[i].ssid.ssid,
7249 nla_data(ssid), nla_len(ssid));
7250 request->match_sets[i].ssid.ssid_len =
7251 nla_len(ssid);
7252 }
7253 if (bssid) {
7254 if (nla_len(bssid) != ETH_ALEN) {
7255 err = -EINVAL;
7256 goto out_free;
7257 }
7258 memcpy(request->match_sets[i].bssid,
7259 nla_data(bssid), ETH_ALEN);
7260 }
7261
7262 /* special attribute - old implementation w/a */
7263 request->match_sets[i].rssi_thold =
7264 default_match_rssi;
7265 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
7266 if (rssi)
7267 request->match_sets[i].rssi_thold =
7268 nla_get_s32(rssi);
7269 }
7270 i++;
7271 }
7272
7273 /* there was no other matchset, so the RSSI one is alone */
7274 if (i == 0 && n_match_sets)
7275 request->match_sets[0].rssi_thold = default_match_rssi;
7276
7277 request->min_rssi_thold = INT_MAX;
7278 for (i = 0; i < n_match_sets; i++)
7279 request->min_rssi_thold =
7280 min(request->match_sets[i].rssi_thold,
7281 request->min_rssi_thold);
7282 } else {
7283 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
7284 }
7285
7286 if (ie_len) {
7287 request->ie_len = ie_len;
7288 memcpy((void *)request->ie,
7289 nla_data(attrs[NL80211_ATTR_IE]),
7290 request->ie_len);
7291 }
7292
7293 if (attrs[NL80211_ATTR_SCAN_FLAGS]) {
7294 request->flags = nla_get_u32(
7295 attrs[NL80211_ATTR_SCAN_FLAGS]);
7296 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
7297 !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
7298 err = -EOPNOTSUPP;
7299 goto out_free;
7300 }
7301
7302 if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
7303 u32 flg = NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
7304
7305 if (!wdev) /* must be net-detect */
7306 flg = NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
7307
7308 if (!(wiphy->features & flg)) {
7309 err = -EOPNOTSUPP;
7310 goto out_free;
7311 }
7312
7313 if (wdev && wdev->current_bss) {
7314 err = -EOPNOTSUPP;
7315 goto out_free;
7316 }
7317
7318 err = nl80211_parse_random_mac(attrs, request->mac_addr,
7319 request->mac_addr_mask);
7320 if (err)
7321 goto out_free;
7322 }
7323 }
7324
7325 if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
7326 request->delay =
7327 nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
7328
7329 if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
7330 request->relative_rssi = nla_get_s8(
7331 attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
7332 request->relative_rssi_set = true;
7333 }
7334
7335 if (request->relative_rssi_set &&
7336 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
7337 struct nl80211_bss_select_rssi_adjust *rssi_adjust;
7338
7339 rssi_adjust = nla_data(
7340 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
7341 request->rssi_adjust.band = rssi_adjust->band;
7342 request->rssi_adjust.delta = rssi_adjust->delta;
7343 if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
7344 err = -EINVAL;
7345 goto out_free;
7346 }
7347 }
7348
7349 err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
7350 if (err)
7351 goto out_free;
7352
7353 request->scan_start = jiffies;
7354
7355 return request;
7356
7357 out_free:
7358 kfree(request);
7359 return ERR_PTR(err);
7360 }
7361
7362 static int nl80211_start_sched_scan(struct sk_buff *skb,
7363 struct genl_info *info)
7364 {
7365 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7366 struct net_device *dev = info->user_ptr[1];
7367 struct wireless_dev *wdev = dev->ieee80211_ptr;
7368 struct cfg80211_sched_scan_request *sched_scan_req;
7369 bool want_multi;
7370 int err;
7371
7372 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
7373 return -EOPNOTSUPP;
7374
7375 want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
7376 err = cfg80211_sched_scan_req_possible(rdev, want_multi);
7377 if (err)
7378 return err;
7379
7380 sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
7381 info->attrs,
7382 rdev->wiphy.max_match_sets);
7383
7384 err = PTR_ERR_OR_ZERO(sched_scan_req);
7385 if (err)
7386 goto out_err;
7387
7388 /* leave request id zero for legacy request
7389 * or if driver does not support multi-scheduled scan
7390 */
7391 if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1) {
7392 while (!sched_scan_req->reqid)
7393 sched_scan_req->reqid = rdev->wiphy.cookie_counter++;
7394 }
7395
7396 err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
7397 if (err)
7398 goto out_free;
7399
7400 sched_scan_req->dev = dev;
7401 sched_scan_req->wiphy = &rdev->wiphy;
7402
7403 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
7404 sched_scan_req->owner_nlportid = info->snd_portid;
7405
7406 cfg80211_add_sched_scan_req(rdev, sched_scan_req);
7407
7408 nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
7409 return 0;
7410
7411 out_free:
7412 kfree(sched_scan_req);
7413 out_err:
7414 return err;
7415 }
7416
7417 static int nl80211_stop_sched_scan(struct sk_buff *skb,
7418 struct genl_info *info)
7419 {
7420 struct cfg80211_sched_scan_request *req;
7421 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7422 u64 cookie;
7423
7424 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
7425 return -EOPNOTSUPP;
7426
7427 if (info->attrs[NL80211_ATTR_COOKIE]) {
7428 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7429 return __cfg80211_stop_sched_scan(rdev, cookie, false);
7430 }
7431
7432 req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
7433 struct cfg80211_sched_scan_request,
7434 list);
7435 if (!req || req->reqid ||
7436 (req->owner_nlportid &&
7437 req->owner_nlportid != info->snd_portid))
7438 return -ENOENT;
7439
7440 return cfg80211_stop_sched_scan_req(rdev, req, false);
7441 }
7442
7443 static int nl80211_start_radar_detection(struct sk_buff *skb,
7444 struct genl_info *info)
7445 {
7446 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7447 struct net_device *dev = info->user_ptr[1];
7448 struct wireless_dev *wdev = dev->ieee80211_ptr;
7449 struct cfg80211_chan_def chandef;
7450 enum nl80211_dfs_regions dfs_region;
7451 unsigned int cac_time_ms;
7452 int err;
7453
7454 dfs_region = reg_get_dfs_region(wdev->wiphy);
7455 if (dfs_region == NL80211_DFS_UNSET)
7456 return -EINVAL;
7457
7458 err = nl80211_parse_chandef(rdev, info, &chandef);
7459 if (err)
7460 return err;
7461
7462 if (netif_carrier_ok(dev))
7463 return -EBUSY;
7464
7465 if (wdev->cac_started)
7466 return -EBUSY;
7467
7468 err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef,
7469 wdev->iftype);
7470 if (err < 0)
7471 return err;
7472
7473 if (err == 0)
7474 return -EINVAL;
7475
7476 if (!cfg80211_chandef_dfs_usable(wdev->wiphy, &chandef))
7477 return -EINVAL;
7478
7479 if (!rdev->ops->start_radar_detection)
7480 return -EOPNOTSUPP;
7481
7482 cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
7483 if (WARN_ON(!cac_time_ms))
7484 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
7485
7486 err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
7487 if (!err) {
7488 wdev->chandef = chandef;
7489 wdev->cac_started = true;
7490 wdev->cac_start_time = jiffies;
7491 wdev->cac_time_ms = cac_time_ms;
7492 }
7493 return err;
7494 }
7495
7496 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
7497 {
7498 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7499 struct net_device *dev = info->user_ptr[1];
7500 struct wireless_dev *wdev = dev->ieee80211_ptr;
7501 struct cfg80211_csa_settings params;
7502 /* csa_attrs is defined static to avoid waste of stack size - this
7503 * function is called under RTNL lock, so this should not be a problem.
7504 */
7505 static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
7506 int err;
7507 bool need_new_beacon = false;
7508 bool need_handle_dfs_flag = true;
7509 int len, i;
7510 u32 cs_count;
7511
7512 if (!rdev->ops->channel_switch ||
7513 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
7514 return -EOPNOTSUPP;
7515
7516 switch (dev->ieee80211_ptr->iftype) {
7517 case NL80211_IFTYPE_AP:
7518 case NL80211_IFTYPE_P2P_GO:
7519 need_new_beacon = true;
7520 /* For all modes except AP the handle_dfs flag needs to be
7521 * supplied to tell the kernel that userspace will handle radar
7522 * events when they happen. Otherwise a switch to a channel
7523 * requiring DFS will be rejected.
7524 */
7525 need_handle_dfs_flag = false;
7526
7527 /* useless if AP is not running */
7528 if (!wdev->beacon_interval)
7529 return -ENOTCONN;
7530 break;
7531 case NL80211_IFTYPE_ADHOC:
7532 if (!wdev->ssid_len)
7533 return -ENOTCONN;
7534 break;
7535 case NL80211_IFTYPE_MESH_POINT:
7536 if (!wdev->mesh_id_len)
7537 return -ENOTCONN;
7538 break;
7539 default:
7540 return -EOPNOTSUPP;
7541 }
7542
7543 memset(&params, 0, sizeof(params));
7544
7545 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
7546 !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
7547 return -EINVAL;
7548
7549 /* only important for AP, IBSS and mesh create IEs internally */
7550 if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
7551 return -EINVAL;
7552
7553 /* Even though the attribute is u32, the specification says
7554 * u8, so let's make sure we don't overflow.
7555 */
7556 cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
7557 if (cs_count > 255)
7558 return -EINVAL;
7559
7560 params.count = cs_count;
7561
7562 if (!need_new_beacon)
7563 goto skip_beacons;
7564
7565 err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
7566 if (err)
7567 return err;
7568
7569 err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
7570 info->attrs[NL80211_ATTR_CSA_IES],
7571 nl80211_policy, info->extack);
7572 if (err)
7573 return err;
7574
7575 err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
7576 if (err)
7577 return err;
7578
7579 if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
7580 return -EINVAL;
7581
7582 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
7583 if (!len || (len % sizeof(u16)))
7584 return -EINVAL;
7585
7586 params.n_counter_offsets_beacon = len / sizeof(u16);
7587 if (rdev->wiphy.max_num_csa_counters &&
7588 (params.n_counter_offsets_beacon >
7589 rdev->wiphy.max_num_csa_counters))
7590 return -EINVAL;
7591
7592 params.counter_offsets_beacon =
7593 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
7594
7595 /* sanity checks - counters should fit and be the same */
7596 for (i = 0; i < params.n_counter_offsets_beacon; i++) {
7597 u16 offset = params.counter_offsets_beacon[i];
7598
7599 if (offset >= params.beacon_csa.tail_len)
7600 return -EINVAL;
7601
7602 if (params.beacon_csa.tail[offset] != params.count)
7603 return -EINVAL;
7604 }
7605
7606 if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
7607 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
7608 if (!len || (len % sizeof(u16)))
7609 return -EINVAL;
7610
7611 params.n_counter_offsets_presp = len / sizeof(u16);
7612 if (rdev->wiphy.max_num_csa_counters &&
7613 (params.n_counter_offsets_presp >
7614 rdev->wiphy.max_num_csa_counters))
7615 return -EINVAL;
7616
7617 params.counter_offsets_presp =
7618 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
7619
7620 /* sanity checks - counters should fit and be the same */
7621 for (i = 0; i < params.n_counter_offsets_presp; i++) {
7622 u16 offset = params.counter_offsets_presp[i];
7623
7624 if (offset >= params.beacon_csa.probe_resp_len)
7625 return -EINVAL;
7626
7627 if (params.beacon_csa.probe_resp[offset] !=
7628 params.count)
7629 return -EINVAL;
7630 }
7631 }
7632
7633 skip_beacons:
7634 err = nl80211_parse_chandef(rdev, info, &params.chandef);
7635 if (err)
7636 return err;
7637
7638 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
7639 wdev->iftype))
7640 return -EINVAL;
7641
7642 err = cfg80211_chandef_dfs_required(wdev->wiphy,
7643 &params.chandef,
7644 wdev->iftype);
7645 if (err < 0)
7646 return err;
7647
7648 if (err > 0) {
7649 params.radar_required = true;
7650 if (need_handle_dfs_flag &&
7651 !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
7652 return -EINVAL;
7653 }
7654 }
7655
7656 if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
7657 params.block_tx = true;
7658
7659 wdev_lock(wdev);
7660 err = rdev_channel_switch(rdev, dev, &params);
7661 wdev_unlock(wdev);
7662
7663 return err;
7664 }
7665
7666 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
7667 u32 seq, int flags,
7668 struct cfg80211_registered_device *rdev,
7669 struct wireless_dev *wdev,
7670 struct cfg80211_internal_bss *intbss)
7671 {
7672 struct cfg80211_bss *res = &intbss->pub;
7673 const struct cfg80211_bss_ies *ies;
7674 void *hdr;
7675 struct nlattr *bss;
7676
7677 ASSERT_WDEV_LOCK(wdev);
7678
7679 hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
7680 NL80211_CMD_NEW_SCAN_RESULTS);
7681 if (!hdr)
7682 return -1;
7683
7684 genl_dump_check_consistent(cb, hdr, &nl80211_fam);
7685
7686 if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
7687 goto nla_put_failure;
7688 if (wdev->netdev &&
7689 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
7690 goto nla_put_failure;
7691 if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
7692 NL80211_ATTR_PAD))
7693 goto nla_put_failure;
7694
7695 bss = nla_nest_start(msg, NL80211_ATTR_BSS);
7696 if (!bss)
7697 goto nla_put_failure;
7698 if ((!is_zero_ether_addr(res->bssid) &&
7699 nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
7700 goto nla_put_failure;
7701
7702 rcu_read_lock();
7703 /* indicate whether we have probe response data or not */
7704 if (rcu_access_pointer(res->proberesp_ies) &&
7705 nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
7706 goto fail_unlock_rcu;
7707
7708 /* this pointer prefers to be pointed to probe response data
7709 * but is always valid
7710 */
7711 ies = rcu_dereference(res->ies);
7712 if (ies) {
7713 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
7714 NL80211_BSS_PAD))
7715 goto fail_unlock_rcu;
7716 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
7717 ies->len, ies->data))
7718 goto fail_unlock_rcu;
7719 }
7720
7721 /* and this pointer is always (unless driver didn't know) beacon data */
7722 ies = rcu_dereference(res->beacon_ies);
7723 if (ies && ies->from_beacon) {
7724 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
7725 NL80211_BSS_PAD))
7726 goto fail_unlock_rcu;
7727 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
7728 ies->len, ies->data))
7729 goto fail_unlock_rcu;
7730 }
7731 rcu_read_unlock();
7732
7733 if (res->beacon_interval &&
7734 nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
7735 goto nla_put_failure;
7736 if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
7737 nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
7738 nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
7739 nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
7740 jiffies_to_msecs(jiffies - intbss->ts)))
7741 goto nla_put_failure;
7742
7743 if (intbss->parent_tsf &&
7744 (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
7745 intbss->parent_tsf, NL80211_BSS_PAD) ||
7746 nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
7747 intbss->parent_bssid)))
7748 goto nla_put_failure;
7749
7750 if (intbss->ts_boottime &&
7751 nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
7752 intbss->ts_boottime, NL80211_BSS_PAD))
7753 goto nla_put_failure;
7754
7755 switch (rdev->wiphy.signal_type) {
7756 case CFG80211_SIGNAL_TYPE_MBM:
7757 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
7758 goto nla_put_failure;
7759 break;
7760 case CFG80211_SIGNAL_TYPE_UNSPEC:
7761 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
7762 goto nla_put_failure;
7763 break;
7764 default:
7765 break;
7766 }
7767
7768 switch (wdev->iftype) {
7769 case NL80211_IFTYPE_P2P_CLIENT:
7770 case NL80211_IFTYPE_STATION:
7771 if (intbss == wdev->current_bss &&
7772 nla_put_u32(msg, NL80211_BSS_STATUS,
7773 NL80211_BSS_STATUS_ASSOCIATED))
7774 goto nla_put_failure;
7775 break;
7776 case NL80211_IFTYPE_ADHOC:
7777 if (intbss == wdev->current_bss &&
7778 nla_put_u32(msg, NL80211_BSS_STATUS,
7779 NL80211_BSS_STATUS_IBSS_JOINED))
7780 goto nla_put_failure;
7781 break;
7782 default:
7783 break;
7784 }
7785
7786 nla_nest_end(msg, bss);
7787
7788 genlmsg_end(msg, hdr);
7789 return 0;
7790
7791 fail_unlock_rcu:
7792 rcu_read_unlock();
7793 nla_put_failure:
7794 genlmsg_cancel(msg, hdr);
7795 return -EMSGSIZE;
7796 }
7797
7798 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
7799 {
7800 struct cfg80211_registered_device *rdev;
7801 struct cfg80211_internal_bss *scan;
7802 struct wireless_dev *wdev;
7803 int start = cb->args[2], idx = 0;
7804 int err;
7805
7806 rtnl_lock();
7807 err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
7808 if (err) {
7809 rtnl_unlock();
7810 return err;
7811 }
7812
7813 wdev_lock(wdev);
7814 spin_lock_bh(&rdev->bss_lock);
7815 cfg80211_bss_expire(rdev);
7816
7817 cb->seq = rdev->bss_generation;
7818
7819 list_for_each_entry(scan, &rdev->bss_list, list) {
7820 if (++idx <= start)
7821 continue;
7822 if (nl80211_send_bss(skb, cb,
7823 cb->nlh->nlmsg_seq, NLM_F_MULTI,
7824 rdev, wdev, scan) < 0) {
7825 idx--;
7826 break;
7827 }
7828 }
7829
7830 spin_unlock_bh(&rdev->bss_lock);
7831 wdev_unlock(wdev);
7832
7833 cb->args[2] = idx;
7834 rtnl_unlock();
7835
7836 return skb->len;
7837 }
7838
7839 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
7840 int flags, struct net_device *dev,
7841 bool allow_radio_stats,
7842 struct survey_info *survey)
7843 {
7844 void *hdr;
7845 struct nlattr *infoattr;
7846
7847 /* skip radio stats if userspace didn't request them */
7848 if (!survey->channel && !allow_radio_stats)
7849 return 0;
7850
7851 hdr = nl80211hdr_put(msg, portid, seq, flags,
7852 NL80211_CMD_NEW_SURVEY_RESULTS);
7853 if (!hdr)
7854 return -ENOMEM;
7855
7856 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
7857 goto nla_put_failure;
7858
7859 infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
7860 if (!infoattr)
7861 goto nla_put_failure;
7862
7863 if (survey->channel &&
7864 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
7865 survey->channel->center_freq))
7866 goto nla_put_failure;
7867
7868 if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
7869 nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
7870 goto nla_put_failure;
7871 if ((survey->filled & SURVEY_INFO_IN_USE) &&
7872 nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
7873 goto nla_put_failure;
7874 if ((survey->filled & SURVEY_INFO_TIME) &&
7875 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
7876 survey->time, NL80211_SURVEY_INFO_PAD))
7877 goto nla_put_failure;
7878 if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
7879 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
7880 survey->time_busy, NL80211_SURVEY_INFO_PAD))
7881 goto nla_put_failure;
7882 if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
7883 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
7884 survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
7885 goto nla_put_failure;
7886 if ((survey->filled & SURVEY_INFO_TIME_RX) &&
7887 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
7888 survey->time_rx, NL80211_SURVEY_INFO_PAD))
7889 goto nla_put_failure;
7890 if ((survey->filled & SURVEY_INFO_TIME_TX) &&
7891 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
7892 survey->time_tx, NL80211_SURVEY_INFO_PAD))
7893 goto nla_put_failure;
7894 if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
7895 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
7896 survey->time_scan, NL80211_SURVEY_INFO_PAD))
7897 goto nla_put_failure;
7898
7899 nla_nest_end(msg, infoattr);
7900
7901 genlmsg_end(msg, hdr);
7902 return 0;
7903
7904 nla_put_failure:
7905 genlmsg_cancel(msg, hdr);
7906 return -EMSGSIZE;
7907 }
7908
7909 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
7910 {
7911 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
7912 struct survey_info survey;
7913 struct cfg80211_registered_device *rdev;
7914 struct wireless_dev *wdev;
7915 int survey_idx = cb->args[2];
7916 int res;
7917 bool radio_stats;
7918
7919 rtnl_lock();
7920 res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
7921 if (res)
7922 goto out_err;
7923
7924 /* prepare_wdev_dump parsed the attributes */
7925 radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
7926
7927 if (!wdev->netdev) {
7928 res = -EINVAL;
7929 goto out_err;
7930 }
7931
7932 if (!rdev->ops->dump_survey) {
7933 res = -EOPNOTSUPP;
7934 goto out_err;
7935 }
7936
7937 while (1) {
7938 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
7939 if (res == -ENOENT)
7940 break;
7941 if (res)
7942 goto out_err;
7943
7944 /* don't send disabled channels, but do send non-channel data */
7945 if (survey.channel &&
7946 survey.channel->flags & IEEE80211_CHAN_DISABLED) {
7947 survey_idx++;
7948 continue;
7949 }
7950
7951 if (nl80211_send_survey(skb,
7952 NETLINK_CB(cb->skb).portid,
7953 cb->nlh->nlmsg_seq, NLM_F_MULTI,
7954 wdev->netdev, radio_stats, &survey) < 0)
7955 goto out;
7956 survey_idx++;
7957 }
7958
7959 out:
7960 cb->args[2] = survey_idx;
7961 res = skb->len;
7962 out_err:
7963 rtnl_unlock();
7964 return res;
7965 }
7966
7967 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
7968 {
7969 return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
7970 NL80211_WPA_VERSION_2));
7971 }
7972
7973 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
7974 {
7975 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7976 struct net_device *dev = info->user_ptr[1];
7977 struct ieee80211_channel *chan;
7978 const u8 *bssid, *ssid, *ie = NULL, *auth_data = NULL;
7979 int err, ssid_len, ie_len = 0, auth_data_len = 0;
7980 enum nl80211_auth_type auth_type;
7981 struct key_parse key;
7982 bool local_state_change;
7983
7984 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7985 return -EINVAL;
7986
7987 if (!info->attrs[NL80211_ATTR_MAC])
7988 return -EINVAL;
7989
7990 if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
7991 return -EINVAL;
7992
7993 if (!info->attrs[NL80211_ATTR_SSID])
7994 return -EINVAL;
7995
7996 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
7997 return -EINVAL;
7998
7999 err = nl80211_parse_key(info, &key);
8000 if (err)
8001 return err;
8002
8003 if (key.idx >= 0) {
8004 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
8005 return -EINVAL;
8006 if (!key.p.key || !key.p.key_len)
8007 return -EINVAL;
8008 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
8009 key.p.key_len != WLAN_KEY_LEN_WEP40) &&
8010 (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
8011 key.p.key_len != WLAN_KEY_LEN_WEP104))
8012 return -EINVAL;
8013 if (key.idx > 3)
8014 return -EINVAL;
8015 } else {
8016 key.p.key_len = 0;
8017 key.p.key = NULL;
8018 }
8019
8020 if (key.idx >= 0) {
8021 int i;
8022 bool ok = false;
8023
8024 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
8025 if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
8026 ok = true;
8027 break;
8028 }
8029 }
8030 if (!ok)
8031 return -EINVAL;
8032 }
8033
8034 if (!rdev->ops->auth)
8035 return -EOPNOTSUPP;
8036
8037 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8038 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8039 return -EOPNOTSUPP;
8040
8041 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8042 chan = nl80211_get_valid_chan(&rdev->wiphy,
8043 info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8044 if (!chan)
8045 return -EINVAL;
8046
8047 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8048 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8049
8050 if (info->attrs[NL80211_ATTR_IE]) {
8051 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8052 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8053 }
8054
8055 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
8056 if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
8057 return -EINVAL;
8058
8059 if ((auth_type == NL80211_AUTHTYPE_SAE ||
8060 auth_type == NL80211_AUTHTYPE_FILS_SK ||
8061 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
8062 auth_type == NL80211_AUTHTYPE_FILS_PK) &&
8063 !info->attrs[NL80211_ATTR_AUTH_DATA])
8064 return -EINVAL;
8065
8066 if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
8067 if (auth_type != NL80211_AUTHTYPE_SAE &&
8068 auth_type != NL80211_AUTHTYPE_FILS_SK &&
8069 auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
8070 auth_type != NL80211_AUTHTYPE_FILS_PK)
8071 return -EINVAL;
8072 auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
8073 auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
8074 /* need to include at least Auth Transaction and Status Code */
8075 if (auth_data_len < 4)
8076 return -EINVAL;
8077 }
8078
8079 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8080
8081 /*
8082 * Since we no longer track auth state, ignore
8083 * requests to only change local state.
8084 */
8085 if (local_state_change)
8086 return 0;
8087
8088 wdev_lock(dev->ieee80211_ptr);
8089 err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
8090 ssid, ssid_len, ie, ie_len,
8091 key.p.key, key.p.key_len, key.idx,
8092 auth_data, auth_data_len);
8093 wdev_unlock(dev->ieee80211_ptr);
8094 return err;
8095 }
8096
8097 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
8098 struct genl_info *info,
8099 struct cfg80211_crypto_settings *settings,
8100 int cipher_limit)
8101 {
8102 memset(settings, 0, sizeof(*settings));
8103
8104 settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
8105
8106 if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
8107 u16 proto;
8108
8109 proto = nla_get_u16(
8110 info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
8111 settings->control_port_ethertype = cpu_to_be16(proto);
8112 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
8113 proto != ETH_P_PAE)
8114 return -EINVAL;
8115 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
8116 settings->control_port_no_encrypt = true;
8117 } else
8118 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
8119
8120 if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
8121 void *data;
8122 int len, i;
8123
8124 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
8125 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
8126 settings->n_ciphers_pairwise = len / sizeof(u32);
8127
8128 if (len % sizeof(u32))
8129 return -EINVAL;
8130
8131 if (settings->n_ciphers_pairwise > cipher_limit)
8132 return -EINVAL;
8133
8134 memcpy(settings->ciphers_pairwise, data, len);
8135
8136 for (i = 0; i < settings->n_ciphers_pairwise; i++)
8137 if (!cfg80211_supported_cipher_suite(
8138 &rdev->wiphy,
8139 settings->ciphers_pairwise[i]))
8140 return -EINVAL;
8141 }
8142
8143 if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
8144 settings->cipher_group =
8145 nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
8146 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
8147 settings->cipher_group))
8148 return -EINVAL;
8149 }
8150
8151 if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
8152 settings->wpa_versions =
8153 nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
8154 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
8155 return -EINVAL;
8156 }
8157
8158 if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
8159 void *data;
8160 int len;
8161
8162 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
8163 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
8164 settings->n_akm_suites = len / sizeof(u32);
8165
8166 if (len % sizeof(u32))
8167 return -EINVAL;
8168
8169 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
8170 return -EINVAL;
8171
8172 memcpy(settings->akm_suites, data, len);
8173 }
8174
8175 if (info->attrs[NL80211_ATTR_PMK]) {
8176 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
8177 return -EINVAL;
8178 if (!wiphy_ext_feature_isset(&rdev->wiphy,
8179 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK))
8180 return -EINVAL;
8181 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
8182 }
8183
8184 return 0;
8185 }
8186
8187 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
8188 {
8189 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8190 struct net_device *dev = info->user_ptr[1];
8191 struct ieee80211_channel *chan;
8192 struct cfg80211_assoc_request req = {};
8193 const u8 *bssid, *ssid;
8194 int err, ssid_len = 0;
8195
8196 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8197 return -EINVAL;
8198
8199 if (!info->attrs[NL80211_ATTR_MAC] ||
8200 !info->attrs[NL80211_ATTR_SSID] ||
8201 !info->attrs[NL80211_ATTR_WIPHY_FREQ])
8202 return -EINVAL;
8203
8204 if (!rdev->ops->assoc)
8205 return -EOPNOTSUPP;
8206
8207 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8208 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8209 return -EOPNOTSUPP;
8210
8211 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8212
8213 chan = nl80211_get_valid_chan(&rdev->wiphy,
8214 info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8215 if (!chan)
8216 return -EINVAL;
8217
8218 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8219 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8220
8221 if (info->attrs[NL80211_ATTR_IE]) {
8222 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8223 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8224 }
8225
8226 if (info->attrs[NL80211_ATTR_USE_MFP]) {
8227 enum nl80211_mfp mfp =
8228 nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
8229 if (mfp == NL80211_MFP_REQUIRED)
8230 req.use_mfp = true;
8231 else if (mfp != NL80211_MFP_NO)
8232 return -EINVAL;
8233 }
8234
8235 if (info->attrs[NL80211_ATTR_PREV_BSSID])
8236 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
8237
8238 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
8239 req.flags |= ASSOC_REQ_DISABLE_HT;
8240
8241 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8242 memcpy(&req.ht_capa_mask,
8243 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8244 sizeof(req.ht_capa_mask));
8245
8246 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8247 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8248 return -EINVAL;
8249 memcpy(&req.ht_capa,
8250 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8251 sizeof(req.ht_capa));
8252 }
8253
8254 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
8255 req.flags |= ASSOC_REQ_DISABLE_VHT;
8256
8257 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8258 memcpy(&req.vht_capa_mask,
8259 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
8260 sizeof(req.vht_capa_mask));
8261
8262 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
8263 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8264 return -EINVAL;
8265 memcpy(&req.vht_capa,
8266 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
8267 sizeof(req.vht_capa));
8268 }
8269
8270 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
8271 if (!((rdev->wiphy.features &
8272 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
8273 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
8274 !wiphy_ext_feature_isset(&rdev->wiphy,
8275 NL80211_EXT_FEATURE_RRM))
8276 return -EINVAL;
8277 req.flags |= ASSOC_REQ_USE_RRM;
8278 }
8279
8280 if (info->attrs[NL80211_ATTR_FILS_KEK]) {
8281 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
8282 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
8283 if (!info->attrs[NL80211_ATTR_FILS_NONCES])
8284 return -EINVAL;
8285 req.fils_nonces =
8286 nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
8287 }
8288
8289 err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
8290 if (!err) {
8291 wdev_lock(dev->ieee80211_ptr);
8292
8293 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
8294 ssid, ssid_len, &req);
8295
8296 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8297 dev->ieee80211_ptr->conn_owner_nlportid =
8298 info->snd_portid;
8299 memcpy(dev->ieee80211_ptr->disconnect_bssid,
8300 bssid, ETH_ALEN);
8301 }
8302
8303 wdev_unlock(dev->ieee80211_ptr);
8304 }
8305
8306 return err;
8307 }
8308
8309 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
8310 {
8311 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8312 struct net_device *dev = info->user_ptr[1];
8313 const u8 *ie = NULL, *bssid;
8314 int ie_len = 0, err;
8315 u16 reason_code;
8316 bool local_state_change;
8317
8318 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8319 return -EINVAL;
8320
8321 if (!info->attrs[NL80211_ATTR_MAC])
8322 return -EINVAL;
8323
8324 if (!info->attrs[NL80211_ATTR_REASON_CODE])
8325 return -EINVAL;
8326
8327 if (!rdev->ops->deauth)
8328 return -EOPNOTSUPP;
8329
8330 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8331 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8332 return -EOPNOTSUPP;
8333
8334 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8335
8336 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8337 if (reason_code == 0) {
8338 /* Reason Code 0 is reserved */
8339 return -EINVAL;
8340 }
8341
8342 if (info->attrs[NL80211_ATTR_IE]) {
8343 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8344 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8345 }
8346
8347 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8348
8349 wdev_lock(dev->ieee80211_ptr);
8350 err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
8351 local_state_change);
8352 wdev_unlock(dev->ieee80211_ptr);
8353 return err;
8354 }
8355
8356 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
8357 {
8358 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8359 struct net_device *dev = info->user_ptr[1];
8360 const u8 *ie = NULL, *bssid;
8361 int ie_len = 0, err;
8362 u16 reason_code;
8363 bool local_state_change;
8364
8365 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8366 return -EINVAL;
8367
8368 if (!info->attrs[NL80211_ATTR_MAC])
8369 return -EINVAL;
8370
8371 if (!info->attrs[NL80211_ATTR_REASON_CODE])
8372 return -EINVAL;
8373
8374 if (!rdev->ops->disassoc)
8375 return -EOPNOTSUPP;
8376
8377 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8378 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8379 return -EOPNOTSUPP;
8380
8381 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8382
8383 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8384 if (reason_code == 0) {
8385 /* Reason Code 0 is reserved */
8386 return -EINVAL;
8387 }
8388
8389 if (info->attrs[NL80211_ATTR_IE]) {
8390 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8391 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8392 }
8393
8394 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8395
8396 wdev_lock(dev->ieee80211_ptr);
8397 err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
8398 local_state_change);
8399 wdev_unlock(dev->ieee80211_ptr);
8400 return err;
8401 }
8402
8403 static bool
8404 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
8405 int mcast_rate[NUM_NL80211_BANDS],
8406 int rateval)
8407 {
8408 struct wiphy *wiphy = &rdev->wiphy;
8409 bool found = false;
8410 int band, i;
8411
8412 for (band = 0; band < NUM_NL80211_BANDS; band++) {
8413 struct ieee80211_supported_band *sband;
8414
8415 sband = wiphy->bands[band];
8416 if (!sband)
8417 continue;
8418
8419 for (i = 0; i < sband->n_bitrates; i++) {
8420 if (sband->bitrates[i].bitrate == rateval) {
8421 mcast_rate[band] = i + 1;
8422 found = true;
8423 break;
8424 }
8425 }
8426 }
8427
8428 return found;
8429 }
8430
8431 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
8432 {
8433 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8434 struct net_device *dev = info->user_ptr[1];
8435 struct cfg80211_ibss_params ibss;
8436 struct wiphy *wiphy;
8437 struct cfg80211_cached_keys *connkeys = NULL;
8438 int err;
8439
8440 memset(&ibss, 0, sizeof(ibss));
8441
8442 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8443 return -EINVAL;
8444
8445 if (!info->attrs[NL80211_ATTR_SSID] ||
8446 !nla_len(info->attrs[NL80211_ATTR_SSID]))
8447 return -EINVAL;
8448
8449 ibss.beacon_interval = 100;
8450
8451 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
8452 ibss.beacon_interval =
8453 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
8454
8455 err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
8456 ibss.beacon_interval);
8457 if (err)
8458 return err;
8459
8460 if (!rdev->ops->join_ibss)
8461 return -EOPNOTSUPP;
8462
8463 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
8464 return -EOPNOTSUPP;
8465
8466 wiphy = &rdev->wiphy;
8467
8468 if (info->attrs[NL80211_ATTR_MAC]) {
8469 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8470
8471 if (!is_valid_ether_addr(ibss.bssid))
8472 return -EINVAL;
8473 }
8474 ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8475 ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8476
8477 if (info->attrs[NL80211_ATTR_IE]) {
8478 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8479 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8480 }
8481
8482 err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
8483 if (err)
8484 return err;
8485
8486 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
8487 NL80211_IFTYPE_ADHOC))
8488 return -EINVAL;
8489
8490 switch (ibss.chandef.width) {
8491 case NL80211_CHAN_WIDTH_5:
8492 case NL80211_CHAN_WIDTH_10:
8493 case NL80211_CHAN_WIDTH_20_NOHT:
8494 break;
8495 case NL80211_CHAN_WIDTH_20:
8496 case NL80211_CHAN_WIDTH_40:
8497 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
8498 return -EINVAL;
8499 break;
8500 case NL80211_CHAN_WIDTH_80:
8501 case NL80211_CHAN_WIDTH_80P80:
8502 case NL80211_CHAN_WIDTH_160:
8503 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
8504 return -EINVAL;
8505 if (!wiphy_ext_feature_isset(&rdev->wiphy,
8506 NL80211_EXT_FEATURE_VHT_IBSS))
8507 return -EINVAL;
8508 break;
8509 default:
8510 return -EINVAL;
8511 }
8512
8513 ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
8514 ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
8515
8516 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
8517 u8 *rates =
8518 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8519 int n_rates =
8520 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8521 struct ieee80211_supported_band *sband =
8522 wiphy->bands[ibss.chandef.chan->band];
8523
8524 err = ieee80211_get_ratemask(sband, rates, n_rates,
8525 &ibss.basic_rates);
8526 if (err)
8527 return err;
8528 }
8529
8530 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8531 memcpy(&ibss.ht_capa_mask,
8532 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8533 sizeof(ibss.ht_capa_mask));
8534
8535 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8536 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8537 return -EINVAL;
8538 memcpy(&ibss.ht_capa,
8539 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8540 sizeof(ibss.ht_capa));
8541 }
8542
8543 if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
8544 !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
8545 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
8546 return -EINVAL;
8547
8548 if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
8549 bool no_ht = false;
8550
8551 connkeys = nl80211_parse_connkeys(rdev,
8552 info->attrs[NL80211_ATTR_KEYS],
8553 &no_ht);
8554 if (IS_ERR(connkeys))
8555 return PTR_ERR(connkeys);
8556
8557 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
8558 no_ht) {
8559 kzfree(connkeys);
8560 return -EINVAL;
8561 }
8562 }
8563
8564 ibss.control_port =
8565 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
8566
8567 ibss.userspace_handles_dfs =
8568 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
8569
8570 err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
8571 if (err)
8572 kzfree(connkeys);
8573 return err;
8574 }
8575
8576 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
8577 {
8578 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8579 struct net_device *dev = info->user_ptr[1];
8580
8581 if (!rdev->ops->leave_ibss)
8582 return -EOPNOTSUPP;
8583
8584 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
8585 return -EOPNOTSUPP;
8586
8587 return cfg80211_leave_ibss(rdev, dev, false);
8588 }
8589
8590 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
8591 {
8592 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8593 struct net_device *dev = info->user_ptr[1];
8594 int mcast_rate[NUM_NL80211_BANDS];
8595 u32 nla_rate;
8596 int err;
8597
8598 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
8599 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
8600 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
8601 return -EOPNOTSUPP;
8602
8603 if (!rdev->ops->set_mcast_rate)
8604 return -EOPNOTSUPP;
8605
8606 memset(mcast_rate, 0, sizeof(mcast_rate));
8607
8608 if (!info->attrs[NL80211_ATTR_MCAST_RATE])
8609 return -EINVAL;
8610
8611 nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
8612 if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
8613 return -EINVAL;
8614
8615 err = rdev_set_mcast_rate(rdev, dev, mcast_rate);
8616
8617 return err;
8618 }
8619
8620 static struct sk_buff *
8621 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
8622 struct wireless_dev *wdev, int approxlen,
8623 u32 portid, u32 seq, enum nl80211_commands cmd,
8624 enum nl80211_attrs attr,
8625 const struct nl80211_vendor_cmd_info *info,
8626 gfp_t gfp)
8627 {
8628 struct sk_buff *skb;
8629 void *hdr;
8630 struct nlattr *data;
8631
8632 skb = nlmsg_new(approxlen + 100, gfp);
8633 if (!skb)
8634 return NULL;
8635
8636 hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
8637 if (!hdr) {
8638 kfree_skb(skb);
8639 return NULL;
8640 }
8641
8642 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
8643 goto nla_put_failure;
8644
8645 if (info) {
8646 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
8647 info->vendor_id))
8648 goto nla_put_failure;
8649 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
8650 info->subcmd))
8651 goto nla_put_failure;
8652 }
8653
8654 if (wdev) {
8655 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
8656 wdev_id(wdev), NL80211_ATTR_PAD))
8657 goto nla_put_failure;
8658 if (wdev->netdev &&
8659 nla_put_u32(skb, NL80211_ATTR_IFINDEX,
8660 wdev->netdev->ifindex))
8661 goto nla_put_failure;
8662 }
8663
8664 data = nla_nest_start(skb, attr);
8665 if (!data)
8666 goto nla_put_failure;
8667
8668 ((void **)skb->cb)[0] = rdev;
8669 ((void **)skb->cb)[1] = hdr;
8670 ((void **)skb->cb)[2] = data;
8671
8672 return skb;
8673
8674 nla_put_failure:
8675 kfree_skb(skb);
8676 return NULL;
8677 }
8678
8679 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
8680 struct wireless_dev *wdev,
8681 enum nl80211_commands cmd,
8682 enum nl80211_attrs attr,
8683 int vendor_event_idx,
8684 int approxlen, gfp_t gfp)
8685 {
8686 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
8687 const struct nl80211_vendor_cmd_info *info;
8688
8689 switch (cmd) {
8690 case NL80211_CMD_TESTMODE:
8691 if (WARN_ON(vendor_event_idx != -1))
8692 return NULL;
8693 info = NULL;
8694 break;
8695 case NL80211_CMD_VENDOR:
8696 if (WARN_ON(vendor_event_idx < 0 ||
8697 vendor_event_idx >= wiphy->n_vendor_events))
8698 return NULL;
8699 info = &wiphy->vendor_events[vendor_event_idx];
8700 break;
8701 default:
8702 WARN_ON(1);
8703 return NULL;
8704 }
8705
8706 return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, 0, 0,
8707 cmd, attr, info, gfp);
8708 }
8709 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
8710
8711 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
8712 {
8713 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
8714 void *hdr = ((void **)skb->cb)[1];
8715 struct nlattr *data = ((void **)skb->cb)[2];
8716 enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
8717
8718 /* clear CB data for netlink core to own from now on */
8719 memset(skb->cb, 0, sizeof(skb->cb));
8720
8721 nla_nest_end(skb, data);
8722 genlmsg_end(skb, hdr);
8723
8724 if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
8725 mcgrp = NL80211_MCGRP_VENDOR;
8726
8727 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
8728 mcgrp, gfp);
8729 }
8730 EXPORT_SYMBOL(__cfg80211_send_event_skb);
8731
8732 #ifdef CONFIG_NL80211_TESTMODE
8733 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
8734 {
8735 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8736 struct wireless_dev *wdev =
8737 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
8738 int err;
8739
8740 if (!rdev->ops->testmode_cmd)
8741 return -EOPNOTSUPP;
8742
8743 if (IS_ERR(wdev)) {
8744 err = PTR_ERR(wdev);
8745 if (err != -EINVAL)
8746 return err;
8747 wdev = NULL;
8748 } else if (wdev->wiphy != &rdev->wiphy) {
8749 return -EINVAL;
8750 }
8751
8752 if (!info->attrs[NL80211_ATTR_TESTDATA])
8753 return -EINVAL;
8754
8755 rdev->cur_cmd_info = info;
8756 err = rdev_testmode_cmd(rdev, wdev,
8757 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
8758 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
8759 rdev->cur_cmd_info = NULL;
8760
8761 return err;
8762 }
8763
8764 static int nl80211_testmode_dump(struct sk_buff *skb,
8765 struct netlink_callback *cb)
8766 {
8767 struct cfg80211_registered_device *rdev;
8768 int err;
8769 long phy_idx;
8770 void *data = NULL;
8771 int data_len = 0;
8772
8773 rtnl_lock();
8774
8775 if (cb->args[0]) {
8776 /*
8777 * 0 is a valid index, but not valid for args[0],
8778 * so we need to offset by 1.
8779 */
8780 phy_idx = cb->args[0] - 1;
8781
8782 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
8783 if (!rdev) {
8784 err = -ENOENT;
8785 goto out_err;
8786 }
8787 } else {
8788 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
8789
8790 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
8791 attrbuf, nl80211_fam.maxattr,
8792 nl80211_policy, NULL);
8793 if (err)
8794 goto out_err;
8795
8796 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
8797 if (IS_ERR(rdev)) {
8798 err = PTR_ERR(rdev);
8799 goto out_err;
8800 }
8801 phy_idx = rdev->wiphy_idx;
8802
8803 if (attrbuf[NL80211_ATTR_TESTDATA])
8804 cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
8805 }
8806
8807 if (cb->args[1]) {
8808 data = nla_data((void *)cb->args[1]);
8809 data_len = nla_len((void *)cb->args[1]);
8810 }
8811
8812 if (!rdev->ops->testmode_dump) {
8813 err = -EOPNOTSUPP;
8814 goto out_err;
8815 }
8816
8817 while (1) {
8818 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
8819 cb->nlh->nlmsg_seq, NLM_F_MULTI,
8820 NL80211_CMD_TESTMODE);
8821 struct nlattr *tmdata;
8822
8823 if (!hdr)
8824 break;
8825
8826 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
8827 genlmsg_cancel(skb, hdr);
8828 break;
8829 }
8830
8831 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
8832 if (!tmdata) {
8833 genlmsg_cancel(skb, hdr);
8834 break;
8835 }
8836 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
8837 nla_nest_end(skb, tmdata);
8838
8839 if (err == -ENOBUFS || err == -ENOENT) {
8840 genlmsg_cancel(skb, hdr);
8841 break;
8842 } else if (err) {
8843 genlmsg_cancel(skb, hdr);
8844 goto out_err;
8845 }
8846
8847 genlmsg_end(skb, hdr);
8848 }
8849
8850 err = skb->len;
8851 /* see above */
8852 cb->args[0] = phy_idx + 1;
8853 out_err:
8854 rtnl_unlock();
8855 return err;
8856 }
8857 #endif
8858
8859 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
8860 {
8861 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8862 struct net_device *dev = info->user_ptr[1];
8863 struct cfg80211_connect_params connect;
8864 struct wiphy *wiphy;
8865 struct cfg80211_cached_keys *connkeys = NULL;
8866 int err;
8867
8868 memset(&connect, 0, sizeof(connect));
8869
8870 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8871 return -EINVAL;
8872
8873 if (!info->attrs[NL80211_ATTR_SSID] ||
8874 !nla_len(info->attrs[NL80211_ATTR_SSID]))
8875 return -EINVAL;
8876
8877 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
8878 connect.auth_type =
8879 nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
8880 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
8881 NL80211_CMD_CONNECT))
8882 return -EINVAL;
8883 } else
8884 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
8885
8886 connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
8887
8888 if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
8889 !wiphy_ext_feature_isset(&rdev->wiphy,
8890 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
8891 return -EINVAL;
8892 connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
8893
8894 err = nl80211_crypto_settings(rdev, info, &connect.crypto,
8895 NL80211_MAX_NR_CIPHER_SUITES);
8896 if (err)
8897 return err;
8898
8899 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8900 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8901 return -EOPNOTSUPP;
8902
8903 wiphy = &rdev->wiphy;
8904
8905 connect.bg_scan_period = -1;
8906 if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
8907 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
8908 connect.bg_scan_period =
8909 nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
8910 }
8911
8912 if (info->attrs[NL80211_ATTR_MAC])
8913 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8914 else if (info->attrs[NL80211_ATTR_MAC_HINT])
8915 connect.bssid_hint =
8916 nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
8917 connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8918 connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8919
8920 if (info->attrs[NL80211_ATTR_IE]) {
8921 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8922 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8923 }
8924
8925 if (info->attrs[NL80211_ATTR_USE_MFP]) {
8926 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
8927 if (connect.mfp != NL80211_MFP_REQUIRED &&
8928 connect.mfp != NL80211_MFP_NO)
8929 return -EINVAL;
8930 } else {
8931 connect.mfp = NL80211_MFP_NO;
8932 }
8933
8934 if (info->attrs[NL80211_ATTR_PREV_BSSID])
8935 connect.prev_bssid =
8936 nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
8937
8938 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
8939 connect.channel = nl80211_get_valid_chan(
8940 wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8941 if (!connect.channel)
8942 return -EINVAL;
8943 } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
8944 connect.channel_hint = nl80211_get_valid_chan(
8945 wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
8946 if (!connect.channel_hint)
8947 return -EINVAL;
8948 }
8949
8950 if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
8951 connkeys = nl80211_parse_connkeys(rdev,
8952 info->attrs[NL80211_ATTR_KEYS], NULL);
8953 if (IS_ERR(connkeys))
8954 return PTR_ERR(connkeys);
8955 }
8956
8957 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
8958 connect.flags |= ASSOC_REQ_DISABLE_HT;
8959
8960 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8961 memcpy(&connect.ht_capa_mask,
8962 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8963 sizeof(connect.ht_capa_mask));
8964
8965 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8966 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
8967 kzfree(connkeys);
8968 return -EINVAL;
8969 }
8970 memcpy(&connect.ht_capa,
8971 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8972 sizeof(connect.ht_capa));
8973 }
8974
8975 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
8976 connect.flags |= ASSOC_REQ_DISABLE_VHT;
8977
8978 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8979 memcpy(&connect.vht_capa_mask,
8980 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
8981 sizeof(connect.vht_capa_mask));
8982
8983 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
8984 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
8985 kzfree(connkeys);
8986 return -EINVAL;
8987 }
8988 memcpy(&connect.vht_capa,
8989 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
8990 sizeof(connect.vht_capa));
8991 }
8992
8993 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
8994 if (!((rdev->wiphy.features &
8995 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
8996 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
8997 !wiphy_ext_feature_isset(&rdev->wiphy,
8998 NL80211_EXT_FEATURE_RRM)) {
8999 kzfree(connkeys);
9000 return -EINVAL;
9001 }
9002 connect.flags |= ASSOC_REQ_USE_RRM;
9003 }
9004
9005 connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
9006 if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
9007 kzfree(connkeys);
9008 return -EOPNOTSUPP;
9009 }
9010
9011 if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
9012 /* bss selection makes no sense if bssid is set */
9013 if (connect.bssid) {
9014 kzfree(connkeys);
9015 return -EINVAL;
9016 }
9017
9018 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
9019 wiphy, &connect.bss_select);
9020 if (err) {
9021 kzfree(connkeys);
9022 return err;
9023 }
9024 }
9025
9026 if (wiphy_ext_feature_isset(&rdev->wiphy,
9027 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
9028 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
9029 info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
9030 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
9031 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9032 connect.fils_erp_username =
9033 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9034 connect.fils_erp_username_len =
9035 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9036 connect.fils_erp_realm =
9037 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9038 connect.fils_erp_realm_len =
9039 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9040 connect.fils_erp_next_seq_num =
9041 nla_get_u16(
9042 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
9043 connect.fils_erp_rrk =
9044 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9045 connect.fils_erp_rrk_len =
9046 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9047 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
9048 info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
9049 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
9050 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9051 kzfree(connkeys);
9052 return -EINVAL;
9053 }
9054
9055 wdev_lock(dev->ieee80211_ptr);
9056
9057 err = cfg80211_connect(rdev, dev, &connect, connkeys,
9058 connect.prev_bssid);
9059 if (err)
9060 kzfree(connkeys);
9061
9062 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9063 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
9064 if (connect.bssid)
9065 memcpy(dev->ieee80211_ptr->disconnect_bssid,
9066 connect.bssid, ETH_ALEN);
9067 else
9068 memset(dev->ieee80211_ptr->disconnect_bssid,
9069 0, ETH_ALEN);
9070 }
9071
9072 wdev_unlock(dev->ieee80211_ptr);
9073
9074 return err;
9075 }
9076
9077 static int nl80211_update_connect_params(struct sk_buff *skb,
9078 struct genl_info *info)
9079 {
9080 struct cfg80211_connect_params connect = {};
9081 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9082 struct net_device *dev = info->user_ptr[1];
9083 struct wireless_dev *wdev = dev->ieee80211_ptr;
9084 u32 changed = 0;
9085 int ret;
9086
9087 if (!rdev->ops->update_connect_params)
9088 return -EOPNOTSUPP;
9089
9090 if (info->attrs[NL80211_ATTR_IE]) {
9091 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
9092 return -EINVAL;
9093 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9094 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9095 changed |= UPDATE_ASSOC_IES;
9096 }
9097
9098 wdev_lock(dev->ieee80211_ptr);
9099 if (!wdev->current_bss)
9100 ret = -ENOLINK;
9101 else
9102 ret = rdev_update_connect_params(rdev, dev, &connect, changed);
9103 wdev_unlock(dev->ieee80211_ptr);
9104
9105 return ret;
9106 }
9107
9108 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
9109 {
9110 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9111 struct net_device *dev = info->user_ptr[1];
9112 u16 reason;
9113 int ret;
9114
9115 if (!info->attrs[NL80211_ATTR_REASON_CODE])
9116 reason = WLAN_REASON_DEAUTH_LEAVING;
9117 else
9118 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
9119
9120 if (reason == 0)
9121 return -EINVAL;
9122
9123 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9124 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9125 return -EOPNOTSUPP;
9126
9127 wdev_lock(dev->ieee80211_ptr);
9128 ret = cfg80211_disconnect(rdev, dev, reason, true);
9129 wdev_unlock(dev->ieee80211_ptr);
9130 return ret;
9131 }
9132
9133 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
9134 {
9135 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9136 struct net *net;
9137 int err;
9138
9139 if (info->attrs[NL80211_ATTR_PID]) {
9140 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
9141
9142 net = get_net_ns_by_pid(pid);
9143 } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
9144 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
9145
9146 net = get_net_ns_by_fd(fd);
9147 } else {
9148 return -EINVAL;
9149 }
9150
9151 if (IS_ERR(net))
9152 return PTR_ERR(net);
9153
9154 err = 0;
9155
9156 /* check if anything to do */
9157 if (!net_eq(wiphy_net(&rdev->wiphy), net))
9158 err = cfg80211_switch_netns(rdev, net);
9159
9160 put_net(net);
9161 return err;
9162 }
9163
9164 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
9165 {
9166 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9167 int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
9168 struct cfg80211_pmksa *pmksa) = NULL;
9169 struct net_device *dev = info->user_ptr[1];
9170 struct cfg80211_pmksa pmksa;
9171
9172 memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
9173
9174 if (!info->attrs[NL80211_ATTR_PMKID])
9175 return -EINVAL;
9176
9177 pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
9178
9179 if (info->attrs[NL80211_ATTR_MAC]) {
9180 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9181 } else if (info->attrs[NL80211_ATTR_SSID] &&
9182 info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
9183 (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA ||
9184 info->attrs[NL80211_ATTR_PMK])) {
9185 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9186 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9187 pmksa.cache_id =
9188 nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
9189 } else {
9190 return -EINVAL;
9191 }
9192 if (info->attrs[NL80211_ATTR_PMK]) {
9193 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
9194 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
9195 }
9196
9197 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9198 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9199 return -EOPNOTSUPP;
9200
9201 switch (info->genlhdr->cmd) {
9202 case NL80211_CMD_SET_PMKSA:
9203 rdev_ops = rdev->ops->set_pmksa;
9204 break;
9205 case NL80211_CMD_DEL_PMKSA:
9206 rdev_ops = rdev->ops->del_pmksa;
9207 break;
9208 default:
9209 WARN_ON(1);
9210 break;
9211 }
9212
9213 if (!rdev_ops)
9214 return -EOPNOTSUPP;
9215
9216 return rdev_ops(&rdev->wiphy, dev, &pmksa);
9217 }
9218
9219 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
9220 {
9221 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9222 struct net_device *dev = info->user_ptr[1];
9223
9224 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9225 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9226 return -EOPNOTSUPP;
9227
9228 if (!rdev->ops->flush_pmksa)
9229 return -EOPNOTSUPP;
9230
9231 return rdev_flush_pmksa(rdev, dev);
9232 }
9233
9234 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
9235 {
9236 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9237 struct net_device *dev = info->user_ptr[1];
9238 u8 action_code, dialog_token;
9239 u32 peer_capability = 0;
9240 u16 status_code;
9241 u8 *peer;
9242 bool initiator;
9243
9244 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
9245 !rdev->ops->tdls_mgmt)
9246 return -EOPNOTSUPP;
9247
9248 if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
9249 !info->attrs[NL80211_ATTR_STATUS_CODE] ||
9250 !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
9251 !info->attrs[NL80211_ATTR_IE] ||
9252 !info->attrs[NL80211_ATTR_MAC])
9253 return -EINVAL;
9254
9255 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
9256 action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
9257 status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
9258 dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
9259 initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
9260 if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
9261 peer_capability =
9262 nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
9263
9264 return rdev_tdls_mgmt(rdev, dev, peer, action_code,
9265 dialog_token, status_code, peer_capability,
9266 initiator,
9267 nla_data(info->attrs[NL80211_ATTR_IE]),
9268 nla_len(info->attrs[NL80211_ATTR_IE]));
9269 }
9270
9271 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
9272 {
9273 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9274 struct net_device *dev = info->user_ptr[1];
9275 enum nl80211_tdls_operation operation;
9276 u8 *peer;
9277
9278 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
9279 !rdev->ops->tdls_oper)
9280 return -EOPNOTSUPP;
9281
9282 if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
9283 !info->attrs[NL80211_ATTR_MAC])
9284 return -EINVAL;
9285
9286 operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
9287 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
9288
9289 return rdev_tdls_oper(rdev, dev, peer, operation);
9290 }
9291
9292 static int nl80211_remain_on_channel(struct sk_buff *skb,
9293 struct genl_info *info)
9294 {
9295 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9296 struct wireless_dev *wdev = info->user_ptr[1];
9297 struct cfg80211_chan_def chandef;
9298 const struct cfg80211_chan_def *compat_chandef;
9299 struct sk_buff *msg;
9300 void *hdr;
9301 u64 cookie;
9302 u32 duration;
9303 int err;
9304
9305 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
9306 !info->attrs[NL80211_ATTR_DURATION])
9307 return -EINVAL;
9308
9309 duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
9310
9311 if (!rdev->ops->remain_on_channel ||
9312 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
9313 return -EOPNOTSUPP;
9314
9315 /*
9316 * We should be on that channel for at least a minimum amount of
9317 * time (10ms) but no longer than the driver supports.
9318 */
9319 if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
9320 duration > rdev->wiphy.max_remain_on_channel_duration)
9321 return -EINVAL;
9322
9323 err = nl80211_parse_chandef(rdev, info, &chandef);
9324 if (err)
9325 return err;
9326
9327 wdev_lock(wdev);
9328 if (!cfg80211_off_channel_oper_allowed(wdev) &&
9329 !cfg80211_chandef_identical(&wdev->chandef, &chandef)) {
9330 compat_chandef = cfg80211_chandef_compatible(&wdev->chandef,
9331 &chandef);
9332 if (compat_chandef != &chandef) {
9333 wdev_unlock(wdev);
9334 return -EBUSY;
9335 }
9336 }
9337 wdev_unlock(wdev);
9338
9339 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9340 if (!msg)
9341 return -ENOMEM;
9342
9343 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9344 NL80211_CMD_REMAIN_ON_CHANNEL);
9345 if (!hdr) {
9346 err = -ENOBUFS;
9347 goto free_msg;
9348 }
9349
9350 err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
9351 duration, &cookie);
9352
9353 if (err)
9354 goto free_msg;
9355
9356 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
9357 NL80211_ATTR_PAD))
9358 goto nla_put_failure;
9359
9360 genlmsg_end(msg, hdr);
9361
9362 return genlmsg_reply(msg, info);
9363
9364 nla_put_failure:
9365 err = -ENOBUFS;
9366 free_msg:
9367 nlmsg_free(msg);
9368 return err;
9369 }
9370
9371 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
9372 struct genl_info *info)
9373 {
9374 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9375 struct wireless_dev *wdev = info->user_ptr[1];
9376 u64 cookie;
9377
9378 if (!info->attrs[NL80211_ATTR_COOKIE])
9379 return -EINVAL;
9380
9381 if (!rdev->ops->cancel_remain_on_channel)
9382 return -EOPNOTSUPP;
9383
9384 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
9385
9386 return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
9387 }
9388
9389 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
9390 struct genl_info *info)
9391 {
9392 struct cfg80211_bitrate_mask mask;
9393 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9394 struct net_device *dev = info->user_ptr[1];
9395 int err;
9396
9397 if (!rdev->ops->set_bitrate_mask)
9398 return -EOPNOTSUPP;
9399
9400 err = nl80211_parse_tx_bitrate_mask(info, &mask);
9401 if (err)
9402 return err;
9403
9404 return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
9405 }
9406
9407 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
9408 {
9409 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9410 struct wireless_dev *wdev = info->user_ptr[1];
9411 u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
9412
9413 if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
9414 return -EINVAL;
9415
9416 if (info->attrs[NL80211_ATTR_FRAME_TYPE])
9417 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
9418
9419 switch (wdev->iftype) {
9420 case NL80211_IFTYPE_STATION:
9421 case NL80211_IFTYPE_ADHOC:
9422 case NL80211_IFTYPE_P2P_CLIENT:
9423 case NL80211_IFTYPE_AP:
9424 case NL80211_IFTYPE_AP_VLAN:
9425 case NL80211_IFTYPE_MESH_POINT:
9426 case NL80211_IFTYPE_P2P_GO:
9427 case NL80211_IFTYPE_P2P_DEVICE:
9428 break;
9429 case NL80211_IFTYPE_NAN:
9430 default:
9431 return -EOPNOTSUPP;
9432 }
9433
9434 /* not much point in registering if we can't reply */
9435 if (!rdev->ops->mgmt_tx)
9436 return -EOPNOTSUPP;
9437
9438 return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
9439 nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
9440 nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
9441 }
9442
9443 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
9444 {
9445 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9446 struct wireless_dev *wdev = info->user_ptr[1];
9447 struct cfg80211_chan_def chandef;
9448 int err;
9449 void *hdr = NULL;
9450 u64 cookie;
9451 struct sk_buff *msg = NULL;
9452 struct cfg80211_mgmt_tx_params params = {
9453 .dont_wait_for_ack =
9454 info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
9455 };
9456
9457 if (!info->attrs[NL80211_ATTR_FRAME])
9458 return -EINVAL;
9459
9460 if (!rdev->ops->mgmt_tx)
9461 return -EOPNOTSUPP;
9462
9463 switch (wdev->iftype) {
9464 case NL80211_IFTYPE_P2P_DEVICE:
9465 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
9466 return -EINVAL;
9467 case NL80211_IFTYPE_STATION:
9468 case NL80211_IFTYPE_ADHOC:
9469 case NL80211_IFTYPE_P2P_CLIENT:
9470 case NL80211_IFTYPE_AP:
9471 case NL80211_IFTYPE_AP_VLAN:
9472 case NL80211_IFTYPE_MESH_POINT:
9473 case NL80211_IFTYPE_P2P_GO:
9474 break;
9475 case NL80211_IFTYPE_NAN:
9476 default:
9477 return -EOPNOTSUPP;
9478 }
9479
9480 if (info->attrs[NL80211_ATTR_DURATION]) {
9481 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
9482 return -EINVAL;
9483 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
9484
9485 /*
9486 * We should wait on the channel for at least a minimum amount
9487 * of time (10ms) but no longer than the driver supports.
9488 */
9489 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
9490 params.wait > rdev->wiphy.max_remain_on_channel_duration)
9491 return -EINVAL;
9492 }
9493
9494 params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
9495
9496 if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
9497 return -EINVAL;
9498
9499 params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
9500
9501 /* get the channel if any has been specified, otherwise pass NULL to
9502 * the driver. The latter will use the current one
9503 */
9504 chandef.chan = NULL;
9505 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
9506 err = nl80211_parse_chandef(rdev, info, &chandef);
9507 if (err)
9508 return err;
9509 }
9510
9511 if (!chandef.chan && params.offchan)
9512 return -EINVAL;
9513
9514 wdev_lock(wdev);
9515 if (params.offchan && !cfg80211_off_channel_oper_allowed(wdev)) {
9516 wdev_unlock(wdev);
9517 return -EBUSY;
9518 }
9519 wdev_unlock(wdev);
9520
9521 params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
9522 params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
9523
9524 if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
9525 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
9526 int i;
9527
9528 if (len % sizeof(u16))
9529 return -EINVAL;
9530
9531 params.n_csa_offsets = len / sizeof(u16);
9532 params.csa_offsets =
9533 nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
9534
9535 /* check that all the offsets fit the frame */
9536 for (i = 0; i < params.n_csa_offsets; i++) {
9537 if (params.csa_offsets[i] >= params.len)
9538 return -EINVAL;
9539 }
9540 }
9541
9542 if (!params.dont_wait_for_ack) {
9543 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9544 if (!msg)
9545 return -ENOMEM;
9546
9547 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9548 NL80211_CMD_FRAME);
9549 if (!hdr) {
9550 err = -ENOBUFS;
9551 goto free_msg;
9552 }
9553 }
9554
9555 params.chan = chandef.chan;
9556 err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
9557 if (err)
9558 goto free_msg;
9559
9560 if (msg) {
9561 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
9562 NL80211_ATTR_PAD))
9563 goto nla_put_failure;
9564
9565 genlmsg_end(msg, hdr);
9566 return genlmsg_reply(msg, info);
9567 }
9568
9569 return 0;
9570
9571 nla_put_failure:
9572 err = -ENOBUFS;
9573 free_msg:
9574 nlmsg_free(msg);
9575 return err;
9576 }
9577
9578 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
9579 {
9580 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9581 struct wireless_dev *wdev = info->user_ptr[1];
9582 u64 cookie;
9583
9584 if (!info->attrs[NL80211_ATTR_COOKIE])
9585 return -EINVAL;
9586
9587 if (!rdev->ops->mgmt_tx_cancel_wait)
9588 return -EOPNOTSUPP;
9589
9590 switch (wdev->iftype) {
9591 case NL80211_IFTYPE_STATION:
9592 case NL80211_IFTYPE_ADHOC:
9593 case NL80211_IFTYPE_P2P_CLIENT:
9594 case NL80211_IFTYPE_AP:
9595 case NL80211_IFTYPE_AP_VLAN:
9596 case NL80211_IFTYPE_P2P_GO:
9597 case NL80211_IFTYPE_P2P_DEVICE:
9598 break;
9599 case NL80211_IFTYPE_NAN:
9600 default:
9601 return -EOPNOTSUPP;
9602 }
9603
9604 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
9605
9606 return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
9607 }
9608
9609 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
9610 {
9611 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9612 struct wireless_dev *wdev;
9613 struct net_device *dev = info->user_ptr[1];
9614 u8 ps_state;
9615 bool state;
9616 int err;
9617
9618 if (!info->attrs[NL80211_ATTR_PS_STATE])
9619 return -EINVAL;
9620
9621 ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
9622
9623 if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
9624 return -EINVAL;
9625
9626 wdev = dev->ieee80211_ptr;
9627
9628 if (!rdev->ops->set_power_mgmt)
9629 return -EOPNOTSUPP;
9630
9631 state = (ps_state == NL80211_PS_ENABLED) ? true : false;
9632
9633 if (state == wdev->ps)
9634 return 0;
9635
9636 err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
9637 if (!err)
9638 wdev->ps = state;
9639 return err;
9640 }
9641
9642 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
9643 {
9644 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9645 enum nl80211_ps_state ps_state;
9646 struct wireless_dev *wdev;
9647 struct net_device *dev = info->user_ptr[1];
9648 struct sk_buff *msg;
9649 void *hdr;
9650 int err;
9651
9652 wdev = dev->ieee80211_ptr;
9653
9654 if (!rdev->ops->set_power_mgmt)
9655 return -EOPNOTSUPP;
9656
9657 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9658 if (!msg)
9659 return -ENOMEM;
9660
9661 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9662 NL80211_CMD_GET_POWER_SAVE);
9663 if (!hdr) {
9664 err = -ENOBUFS;
9665 goto free_msg;
9666 }
9667
9668 if (wdev->ps)
9669 ps_state = NL80211_PS_ENABLED;
9670 else
9671 ps_state = NL80211_PS_DISABLED;
9672
9673 if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
9674 goto nla_put_failure;
9675
9676 genlmsg_end(msg, hdr);
9677 return genlmsg_reply(msg, info);
9678
9679 nla_put_failure:
9680 err = -ENOBUFS;
9681 free_msg:
9682 nlmsg_free(msg);
9683 return err;
9684 }
9685
9686 static const struct nla_policy
9687 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
9688 [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
9689 [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
9690 [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
9691 [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
9692 [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
9693 [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
9694 [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
9695 };
9696
9697 static int nl80211_set_cqm_txe(struct genl_info *info,
9698 u32 rate, u32 pkts, u32 intvl)
9699 {
9700 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9701 struct net_device *dev = info->user_ptr[1];
9702 struct wireless_dev *wdev = dev->ieee80211_ptr;
9703
9704 if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
9705 return -EINVAL;
9706
9707 if (!rdev->ops->set_cqm_txe_config)
9708 return -EOPNOTSUPP;
9709
9710 if (wdev->iftype != NL80211_IFTYPE_STATION &&
9711 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
9712 return -EOPNOTSUPP;
9713
9714 return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
9715 }
9716
9717 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
9718 struct net_device *dev)
9719 {
9720 struct wireless_dev *wdev = dev->ieee80211_ptr;
9721 s32 last, low, high;
9722 u32 hyst;
9723 int i, n, low_index;
9724 int err;
9725
9726 /* RSSI reporting disabled? */
9727 if (!wdev->cqm_config)
9728 return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
9729
9730 /*
9731 * Obtain current RSSI value if possible, if not and no RSSI threshold
9732 * event has been received yet, we should receive an event after a
9733 * connection is established and enough beacons received to calculate
9734 * the average.
9735 */
9736 if (!wdev->cqm_config->last_rssi_event_value && wdev->current_bss &&
9737 rdev->ops->get_station) {
9738 struct station_info sinfo;
9739 u8 *mac_addr;
9740
9741 mac_addr = wdev->current_bss->pub.bssid;
9742
9743 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
9744 if (err)
9745 return err;
9746
9747 if (sinfo.filled & BIT(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
9748 wdev->cqm_config->last_rssi_event_value =
9749 (s8) sinfo.rx_beacon_signal_avg;
9750 }
9751
9752 last = wdev->cqm_config->last_rssi_event_value;
9753 hyst = wdev->cqm_config->rssi_hyst;
9754 n = wdev->cqm_config->n_rssi_thresholds;
9755
9756 for (i = 0; i < n; i++)
9757 if (last < wdev->cqm_config->rssi_thresholds[i])
9758 break;
9759
9760 low_index = i - 1;
9761 if (low_index >= 0) {
9762 low_index = array_index_nospec(low_index, n);
9763 low = wdev->cqm_config->rssi_thresholds[low_index] - hyst;
9764 } else {
9765 low = S32_MIN;
9766 }
9767 if (i < n) {
9768 i = array_index_nospec(i, n);
9769 high = wdev->cqm_config->rssi_thresholds[i] + hyst - 1;
9770 } else {
9771 high = S32_MAX;
9772 }
9773
9774 return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
9775 }
9776
9777 static int nl80211_set_cqm_rssi(struct genl_info *info,
9778 const s32 *thresholds, int n_thresholds,
9779 u32 hysteresis)
9780 {
9781 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9782 struct net_device *dev = info->user_ptr[1];
9783 struct wireless_dev *wdev = dev->ieee80211_ptr;
9784 int i, err;
9785 s32 prev = S32_MIN;
9786
9787 /* Check all values negative and sorted */
9788 for (i = 0; i < n_thresholds; i++) {
9789 if (thresholds[i] > 0 || thresholds[i] <= prev)
9790 return -EINVAL;
9791
9792 prev = thresholds[i];
9793 }
9794
9795 if (wdev->iftype != NL80211_IFTYPE_STATION &&
9796 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
9797 return -EOPNOTSUPP;
9798
9799 wdev_lock(wdev);
9800 cfg80211_cqm_config_free(wdev);
9801 wdev_unlock(wdev);
9802
9803 if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) {
9804 if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */
9805 return rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
9806
9807 return rdev_set_cqm_rssi_config(rdev, dev,
9808 thresholds[0], hysteresis);
9809 }
9810
9811 if (!wiphy_ext_feature_isset(&rdev->wiphy,
9812 NL80211_EXT_FEATURE_CQM_RSSI_LIST))
9813 return -EOPNOTSUPP;
9814
9815 if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
9816 n_thresholds = 0;
9817
9818 wdev_lock(wdev);
9819 if (n_thresholds) {
9820 struct cfg80211_cqm_config *cqm_config;
9821
9822 cqm_config = kzalloc(sizeof(struct cfg80211_cqm_config) +
9823 n_thresholds * sizeof(s32), GFP_KERNEL);
9824 if (!cqm_config) {
9825 err = -ENOMEM;
9826 goto unlock;
9827 }
9828
9829 cqm_config->rssi_hyst = hysteresis;
9830 cqm_config->n_rssi_thresholds = n_thresholds;
9831 memcpy(cqm_config->rssi_thresholds, thresholds,
9832 n_thresholds * sizeof(s32));
9833
9834 wdev->cqm_config = cqm_config;
9835 }
9836
9837 err = cfg80211_cqm_rssi_update(rdev, dev);
9838
9839 unlock:
9840 wdev_unlock(wdev);
9841
9842 return err;
9843 }
9844
9845 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
9846 {
9847 struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
9848 struct nlattr *cqm;
9849 int err;
9850
9851 cqm = info->attrs[NL80211_ATTR_CQM];
9852 if (!cqm)
9853 return -EINVAL;
9854
9855 err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
9856 nl80211_attr_cqm_policy, info->extack);
9857 if (err)
9858 return err;
9859
9860 if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
9861 attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
9862 const s32 *thresholds =
9863 nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
9864 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
9865 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
9866
9867 if (len % 4)
9868 return -EINVAL;
9869
9870 return nl80211_set_cqm_rssi(info, thresholds, len / 4,
9871 hysteresis);
9872 }
9873
9874 if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
9875 attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
9876 attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
9877 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
9878 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
9879 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
9880
9881 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
9882 }
9883
9884 return -EINVAL;
9885 }
9886
9887 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
9888 {
9889 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9890 struct net_device *dev = info->user_ptr[1];
9891 struct ocb_setup setup = {};
9892 int err;
9893
9894 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
9895 if (err)
9896 return err;
9897
9898 return cfg80211_join_ocb(rdev, dev, &setup);
9899 }
9900
9901 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
9902 {
9903 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9904 struct net_device *dev = info->user_ptr[1];
9905
9906 return cfg80211_leave_ocb(rdev, dev);
9907 }
9908
9909 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
9910 {
9911 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9912 struct net_device *dev = info->user_ptr[1];
9913 struct mesh_config cfg;
9914 struct mesh_setup setup;
9915 int err;
9916
9917 /* start with default */
9918 memcpy(&cfg, &default_mesh_config, sizeof(cfg));
9919 memcpy(&setup, &default_mesh_setup, sizeof(setup));
9920
9921 if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
9922 /* and parse parameters if given */
9923 err = nl80211_parse_mesh_config(info, &cfg, NULL);
9924 if (err)
9925 return err;
9926 }
9927
9928 if (!info->attrs[NL80211_ATTR_MESH_ID] ||
9929 !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
9930 return -EINVAL;
9931
9932 setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
9933 setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
9934
9935 if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
9936 !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
9937 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
9938 return -EINVAL;
9939
9940 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
9941 setup.beacon_interval =
9942 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
9943
9944 err = cfg80211_validate_beacon_int(rdev,
9945 NL80211_IFTYPE_MESH_POINT,
9946 setup.beacon_interval);
9947 if (err)
9948 return err;
9949 }
9950
9951 if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
9952 setup.dtim_period =
9953 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
9954 if (setup.dtim_period < 1 || setup.dtim_period > 100)
9955 return -EINVAL;
9956 }
9957
9958 if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
9959 /* parse additional setup parameters if given */
9960 err = nl80211_parse_mesh_setup(info, &setup);
9961 if (err)
9962 return err;
9963 }
9964
9965 if (setup.user_mpm)
9966 cfg.auto_open_plinks = false;
9967
9968 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
9969 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
9970 if (err)
9971 return err;
9972 } else {
9973 /* cfg80211_join_mesh() will sort it out */
9974 setup.chandef.chan = NULL;
9975 }
9976
9977 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
9978 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9979 int n_rates =
9980 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9981 struct ieee80211_supported_band *sband;
9982
9983 if (!setup.chandef.chan)
9984 return -EINVAL;
9985
9986 sband = rdev->wiphy.bands[setup.chandef.chan->band];
9987
9988 err = ieee80211_get_ratemask(sband, rates, n_rates,
9989 &setup.basic_rates);
9990 if (err)
9991 return err;
9992 }
9993
9994 if (info->attrs[NL80211_ATTR_TX_RATES]) {
9995 err = nl80211_parse_tx_bitrate_mask(info, &setup.beacon_rate);
9996 if (err)
9997 return err;
9998
9999 if (!setup.chandef.chan)
10000 return -EINVAL;
10001
10002 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
10003 &setup.beacon_rate);
10004 if (err)
10005 return err;
10006 }
10007
10008 setup.userspace_handles_dfs =
10009 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
10010
10011 return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
10012 }
10013
10014 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
10015 {
10016 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10017 struct net_device *dev = info->user_ptr[1];
10018
10019 return cfg80211_leave_mesh(rdev, dev);
10020 }
10021
10022 #ifdef CONFIG_PM
10023 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
10024 struct cfg80211_registered_device *rdev)
10025 {
10026 struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
10027 struct nlattr *nl_pats, *nl_pat;
10028 int i, pat_len;
10029
10030 if (!wowlan->n_patterns)
10031 return 0;
10032
10033 nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
10034 if (!nl_pats)
10035 return -ENOBUFS;
10036
10037 for (i = 0; i < wowlan->n_patterns; i++) {
10038 nl_pat = nla_nest_start(msg, i + 1);
10039 if (!nl_pat)
10040 return -ENOBUFS;
10041 pat_len = wowlan->patterns[i].pattern_len;
10042 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
10043 wowlan->patterns[i].mask) ||
10044 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
10045 wowlan->patterns[i].pattern) ||
10046 nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
10047 wowlan->patterns[i].pkt_offset))
10048 return -ENOBUFS;
10049 nla_nest_end(msg, nl_pat);
10050 }
10051 nla_nest_end(msg, nl_pats);
10052
10053 return 0;
10054 }
10055
10056 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
10057 struct cfg80211_wowlan_tcp *tcp)
10058 {
10059 struct nlattr *nl_tcp;
10060
10061 if (!tcp)
10062 return 0;
10063
10064 nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
10065 if (!nl_tcp)
10066 return -ENOBUFS;
10067
10068 if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
10069 nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
10070 nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
10071 nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
10072 nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
10073 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
10074 tcp->payload_len, tcp->payload) ||
10075 nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
10076 tcp->data_interval) ||
10077 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
10078 tcp->wake_len, tcp->wake_data) ||
10079 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
10080 DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
10081 return -ENOBUFS;
10082
10083 if (tcp->payload_seq.len &&
10084 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
10085 sizeof(tcp->payload_seq), &tcp->payload_seq))
10086 return -ENOBUFS;
10087
10088 if (tcp->payload_tok.len &&
10089 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
10090 sizeof(tcp->payload_tok) + tcp->tokens_size,
10091 &tcp->payload_tok))
10092 return -ENOBUFS;
10093
10094 nla_nest_end(msg, nl_tcp);
10095
10096 return 0;
10097 }
10098
10099 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
10100 struct cfg80211_sched_scan_request *req)
10101 {
10102 struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
10103 int i;
10104
10105 if (!req)
10106 return 0;
10107
10108 nd = nla_nest_start(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
10109 if (!nd)
10110 return -ENOBUFS;
10111
10112 if (req->n_scan_plans == 1 &&
10113 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
10114 req->scan_plans[0].interval * 1000))
10115 return -ENOBUFS;
10116
10117 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
10118 return -ENOBUFS;
10119
10120 if (req->relative_rssi_set) {
10121 struct nl80211_bss_select_rssi_adjust rssi_adjust;
10122
10123 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
10124 req->relative_rssi))
10125 return -ENOBUFS;
10126
10127 rssi_adjust.band = req->rssi_adjust.band;
10128 rssi_adjust.delta = req->rssi_adjust.delta;
10129 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
10130 sizeof(rssi_adjust), &rssi_adjust))
10131 return -ENOBUFS;
10132 }
10133
10134 freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
10135 if (!freqs)
10136 return -ENOBUFS;
10137
10138 for (i = 0; i < req->n_channels; i++) {
10139 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
10140 return -ENOBUFS;
10141 }
10142
10143 nla_nest_end(msg, freqs);
10144
10145 if (req->n_match_sets) {
10146 matches = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
10147 if (!matches)
10148 return -ENOBUFS;
10149
10150 for (i = 0; i < req->n_match_sets; i++) {
10151 match = nla_nest_start(msg, i);
10152 if (!match)
10153 return -ENOBUFS;
10154
10155 if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
10156 req->match_sets[i].ssid.ssid_len,
10157 req->match_sets[i].ssid.ssid))
10158 return -ENOBUFS;
10159 nla_nest_end(msg, match);
10160 }
10161 nla_nest_end(msg, matches);
10162 }
10163
10164 scan_plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
10165 if (!scan_plans)
10166 return -ENOBUFS;
10167
10168 for (i = 0; i < req->n_scan_plans; i++) {
10169 scan_plan = nla_nest_start(msg, i + 1);
10170 if (!scan_plan)
10171 return -ENOBUFS;
10172
10173 if (!scan_plan ||
10174 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
10175 req->scan_plans[i].interval) ||
10176 (req->scan_plans[i].iterations &&
10177 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
10178 req->scan_plans[i].iterations)))
10179 return -ENOBUFS;
10180 nla_nest_end(msg, scan_plan);
10181 }
10182 nla_nest_end(msg, scan_plans);
10183
10184 nla_nest_end(msg, nd);
10185
10186 return 0;
10187 }
10188
10189 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
10190 {
10191 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10192 struct sk_buff *msg;
10193 void *hdr;
10194 u32 size = NLMSG_DEFAULT_SIZE;
10195
10196 if (!rdev->wiphy.wowlan)
10197 return -EOPNOTSUPP;
10198
10199 if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
10200 /* adjust size to have room for all the data */
10201 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
10202 rdev->wiphy.wowlan_config->tcp->payload_len +
10203 rdev->wiphy.wowlan_config->tcp->wake_len +
10204 rdev->wiphy.wowlan_config->tcp->wake_len / 8;
10205 }
10206
10207 msg = nlmsg_new(size, GFP_KERNEL);
10208 if (!msg)
10209 return -ENOMEM;
10210
10211 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10212 NL80211_CMD_GET_WOWLAN);
10213 if (!hdr)
10214 goto nla_put_failure;
10215
10216 if (rdev->wiphy.wowlan_config) {
10217 struct nlattr *nl_wowlan;
10218
10219 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
10220 if (!nl_wowlan)
10221 goto nla_put_failure;
10222
10223 if ((rdev->wiphy.wowlan_config->any &&
10224 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
10225 (rdev->wiphy.wowlan_config->disconnect &&
10226 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
10227 (rdev->wiphy.wowlan_config->magic_pkt &&
10228 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
10229 (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
10230 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
10231 (rdev->wiphy.wowlan_config->eap_identity_req &&
10232 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
10233 (rdev->wiphy.wowlan_config->four_way_handshake &&
10234 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
10235 (rdev->wiphy.wowlan_config->rfkill_release &&
10236 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
10237 goto nla_put_failure;
10238
10239 if (nl80211_send_wowlan_patterns(msg, rdev))
10240 goto nla_put_failure;
10241
10242 if (nl80211_send_wowlan_tcp(msg,
10243 rdev->wiphy.wowlan_config->tcp))
10244 goto nla_put_failure;
10245
10246 if (nl80211_send_wowlan_nd(
10247 msg,
10248 rdev->wiphy.wowlan_config->nd_config))
10249 goto nla_put_failure;
10250
10251 nla_nest_end(msg, nl_wowlan);
10252 }
10253
10254 genlmsg_end(msg, hdr);
10255 return genlmsg_reply(msg, info);
10256
10257 nla_put_failure:
10258 nlmsg_free(msg);
10259 return -ENOBUFS;
10260 }
10261
10262 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
10263 struct nlattr *attr,
10264 struct cfg80211_wowlan *trig)
10265 {
10266 struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
10267 struct cfg80211_wowlan_tcp *cfg;
10268 struct nl80211_wowlan_tcp_data_token *tok = NULL;
10269 struct nl80211_wowlan_tcp_data_seq *seq = NULL;
10270 u32 size;
10271 u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
10272 int err, port;
10273
10274 if (!rdev->wiphy.wowlan->tcp)
10275 return -EINVAL;
10276
10277 err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TCP, attr,
10278 nl80211_wowlan_tcp_policy, NULL);
10279 if (err)
10280 return err;
10281
10282 if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
10283 !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
10284 !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
10285 !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
10286 !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
10287 !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
10288 !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
10289 !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
10290 return -EINVAL;
10291
10292 data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
10293 if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
10294 return -EINVAL;
10295
10296 if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
10297 rdev->wiphy.wowlan->tcp->data_interval_max ||
10298 nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
10299 return -EINVAL;
10300
10301 wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
10302 if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
10303 return -EINVAL;
10304
10305 wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
10306 if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
10307 return -EINVAL;
10308
10309 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
10310 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
10311
10312 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
10313 tokens_size = tokln - sizeof(*tok);
10314
10315 if (!tok->len || tokens_size % tok->len)
10316 return -EINVAL;
10317 if (!rdev->wiphy.wowlan->tcp->tok)
10318 return -EINVAL;
10319 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
10320 return -EINVAL;
10321 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
10322 return -EINVAL;
10323 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
10324 return -EINVAL;
10325 if (tok->offset + tok->len > data_size)
10326 return -EINVAL;
10327 }
10328
10329 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
10330 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
10331 if (!rdev->wiphy.wowlan->tcp->seq)
10332 return -EINVAL;
10333 if (seq->len == 0 || seq->len > 4)
10334 return -EINVAL;
10335 if (seq->len + seq->offset > data_size)
10336 return -EINVAL;
10337 }
10338
10339 size = sizeof(*cfg);
10340 size += data_size;
10341 size += wake_size + wake_mask_size;
10342 size += tokens_size;
10343
10344 cfg = kzalloc(size, GFP_KERNEL);
10345 if (!cfg)
10346 return -ENOMEM;
10347 cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
10348 cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
10349 memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
10350 ETH_ALEN);
10351 if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
10352 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
10353 else
10354 port = 0;
10355 #ifdef CONFIG_INET
10356 /* allocate a socket and port for it and use it */
10357 err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
10358 IPPROTO_TCP, &cfg->sock, 1);
10359 if (err) {
10360 kfree(cfg);
10361 return err;
10362 }
10363 if (inet_csk_get_port(cfg->sock->sk, port)) {
10364 sock_release(cfg->sock);
10365 kfree(cfg);
10366 return -EADDRINUSE;
10367 }
10368 cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
10369 #else
10370 if (!port) {
10371 kfree(cfg);
10372 return -EINVAL;
10373 }
10374 cfg->src_port = port;
10375 #endif
10376
10377 cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
10378 cfg->payload_len = data_size;
10379 cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
10380 memcpy((void *)cfg->payload,
10381 nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
10382 data_size);
10383 if (seq)
10384 cfg->payload_seq = *seq;
10385 cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
10386 cfg->wake_len = wake_size;
10387 cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
10388 memcpy((void *)cfg->wake_data,
10389 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
10390 wake_size);
10391 cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
10392 data_size + wake_size;
10393 memcpy((void *)cfg->wake_mask,
10394 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
10395 wake_mask_size);
10396 if (tok) {
10397 cfg->tokens_size = tokens_size;
10398 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
10399 }
10400
10401 trig->tcp = cfg;
10402
10403 return 0;
10404 }
10405
10406 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
10407 const struct wiphy_wowlan_support *wowlan,
10408 struct nlattr *attr,
10409 struct cfg80211_wowlan *trig)
10410 {
10411 struct nlattr **tb;
10412 int err;
10413
10414 tb = kzalloc(NUM_NL80211_ATTR * sizeof(*tb), GFP_KERNEL);
10415 if (!tb)
10416 return -ENOMEM;
10417
10418 if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
10419 err = -EOPNOTSUPP;
10420 goto out;
10421 }
10422
10423 err = nla_parse_nested(tb, NL80211_ATTR_MAX, attr, nl80211_policy,
10424 NULL);
10425 if (err)
10426 goto out;
10427
10428 trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
10429 wowlan->max_nd_match_sets);
10430 err = PTR_ERR_OR_ZERO(trig->nd_config);
10431 if (err)
10432 trig->nd_config = NULL;
10433
10434 out:
10435 kfree(tb);
10436 return err;
10437 }
10438
10439 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
10440 {
10441 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10442 struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
10443 struct cfg80211_wowlan new_triggers = {};
10444 struct cfg80211_wowlan *ntrig;
10445 const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
10446 int err, i;
10447 bool prev_enabled = rdev->wiphy.wowlan_config;
10448 bool regular = false;
10449
10450 if (!wowlan)
10451 return -EOPNOTSUPP;
10452
10453 if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
10454 cfg80211_rdev_free_wowlan(rdev);
10455 rdev->wiphy.wowlan_config = NULL;
10456 goto set_wakeup;
10457 }
10458
10459 err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TRIG,
10460 info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
10461 nl80211_wowlan_policy, info->extack);
10462 if (err)
10463 return err;
10464
10465 if (tb[NL80211_WOWLAN_TRIG_ANY]) {
10466 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
10467 return -EINVAL;
10468 new_triggers.any = true;
10469 }
10470
10471 if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
10472 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
10473 return -EINVAL;
10474 new_triggers.disconnect = true;
10475 regular = true;
10476 }
10477
10478 if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
10479 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
10480 return -EINVAL;
10481 new_triggers.magic_pkt = true;
10482 regular = true;
10483 }
10484
10485 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
10486 return -EINVAL;
10487
10488 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
10489 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
10490 return -EINVAL;
10491 new_triggers.gtk_rekey_failure = true;
10492 regular = true;
10493 }
10494
10495 if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
10496 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
10497 return -EINVAL;
10498 new_triggers.eap_identity_req = true;
10499 regular = true;
10500 }
10501
10502 if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
10503 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
10504 return -EINVAL;
10505 new_triggers.four_way_handshake = true;
10506 regular = true;
10507 }
10508
10509 if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
10510 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
10511 return -EINVAL;
10512 new_triggers.rfkill_release = true;
10513 regular = true;
10514 }
10515
10516 if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
10517 struct nlattr *pat;
10518 int n_patterns = 0;
10519 int rem, pat_len, mask_len, pkt_offset;
10520 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
10521
10522 regular = true;
10523
10524 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
10525 rem)
10526 n_patterns++;
10527 if (n_patterns > wowlan->n_patterns)
10528 return -EINVAL;
10529
10530 new_triggers.patterns = kcalloc(n_patterns,
10531 sizeof(new_triggers.patterns[0]),
10532 GFP_KERNEL);
10533 if (!new_triggers.patterns)
10534 return -ENOMEM;
10535
10536 new_triggers.n_patterns = n_patterns;
10537 i = 0;
10538
10539 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
10540 rem) {
10541 u8 *mask_pat;
10542
10543 err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
10544 nl80211_packet_pattern_policy,
10545 info->extack);
10546 if (err)
10547 goto error;
10548
10549 err = -EINVAL;
10550 if (!pat_tb[NL80211_PKTPAT_MASK] ||
10551 !pat_tb[NL80211_PKTPAT_PATTERN])
10552 goto error;
10553 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
10554 mask_len = DIV_ROUND_UP(pat_len, 8);
10555 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
10556 goto error;
10557 if (pat_len > wowlan->pattern_max_len ||
10558 pat_len < wowlan->pattern_min_len)
10559 goto error;
10560
10561 if (!pat_tb[NL80211_PKTPAT_OFFSET])
10562 pkt_offset = 0;
10563 else
10564 pkt_offset = nla_get_u32(
10565 pat_tb[NL80211_PKTPAT_OFFSET]);
10566 if (pkt_offset > wowlan->max_pkt_offset)
10567 goto error;
10568 new_triggers.patterns[i].pkt_offset = pkt_offset;
10569
10570 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
10571 if (!mask_pat) {
10572 err = -ENOMEM;
10573 goto error;
10574 }
10575 new_triggers.patterns[i].mask = mask_pat;
10576 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
10577 mask_len);
10578 mask_pat += mask_len;
10579 new_triggers.patterns[i].pattern = mask_pat;
10580 new_triggers.patterns[i].pattern_len = pat_len;
10581 memcpy(mask_pat,
10582 nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
10583 pat_len);
10584 i++;
10585 }
10586 }
10587
10588 if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
10589 regular = true;
10590 err = nl80211_parse_wowlan_tcp(
10591 rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
10592 &new_triggers);
10593 if (err)
10594 goto error;
10595 }
10596
10597 if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
10598 regular = true;
10599 err = nl80211_parse_wowlan_nd(
10600 rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
10601 &new_triggers);
10602 if (err)
10603 goto error;
10604 }
10605
10606 /* The 'any' trigger means the device continues operating more or less
10607 * as in its normal operation mode and wakes up the host on most of the
10608 * normal interrupts (like packet RX, ...)
10609 * It therefore makes little sense to combine with the more constrained
10610 * wakeup trigger modes.
10611 */
10612 if (new_triggers.any && regular) {
10613 err = -EINVAL;
10614 goto error;
10615 }
10616
10617 ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
10618 if (!ntrig) {
10619 err = -ENOMEM;
10620 goto error;
10621 }
10622 cfg80211_rdev_free_wowlan(rdev);
10623 rdev->wiphy.wowlan_config = ntrig;
10624
10625 set_wakeup:
10626 if (rdev->ops->set_wakeup &&
10627 prev_enabled != !!rdev->wiphy.wowlan_config)
10628 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
10629
10630 return 0;
10631 error:
10632 for (i = 0; i < new_triggers.n_patterns; i++)
10633 kfree(new_triggers.patterns[i].mask);
10634 kfree(new_triggers.patterns);
10635 if (new_triggers.tcp && new_triggers.tcp->sock)
10636 sock_release(new_triggers.tcp->sock);
10637 kfree(new_triggers.tcp);
10638 kfree(new_triggers.nd_config);
10639 return err;
10640 }
10641 #endif
10642
10643 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
10644 struct cfg80211_registered_device *rdev)
10645 {
10646 struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
10647 int i, j, pat_len;
10648 struct cfg80211_coalesce_rules *rule;
10649
10650 if (!rdev->coalesce->n_rules)
10651 return 0;
10652
10653 nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
10654 if (!nl_rules)
10655 return -ENOBUFS;
10656
10657 for (i = 0; i < rdev->coalesce->n_rules; i++) {
10658 nl_rule = nla_nest_start(msg, i + 1);
10659 if (!nl_rule)
10660 return -ENOBUFS;
10661
10662 rule = &rdev->coalesce->rules[i];
10663 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
10664 rule->delay))
10665 return -ENOBUFS;
10666
10667 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
10668 rule->condition))
10669 return -ENOBUFS;
10670
10671 nl_pats = nla_nest_start(msg,
10672 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
10673 if (!nl_pats)
10674 return -ENOBUFS;
10675
10676 for (j = 0; j < rule->n_patterns; j++) {
10677 nl_pat = nla_nest_start(msg, j + 1);
10678 if (!nl_pat)
10679 return -ENOBUFS;
10680 pat_len = rule->patterns[j].pattern_len;
10681 if (nla_put(msg, NL80211_PKTPAT_MASK,
10682 DIV_ROUND_UP(pat_len, 8),
10683 rule->patterns[j].mask) ||
10684 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
10685 rule->patterns[j].pattern) ||
10686 nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
10687 rule->patterns[j].pkt_offset))
10688 return -ENOBUFS;
10689 nla_nest_end(msg, nl_pat);
10690 }
10691 nla_nest_end(msg, nl_pats);
10692 nla_nest_end(msg, nl_rule);
10693 }
10694 nla_nest_end(msg, nl_rules);
10695
10696 return 0;
10697 }
10698
10699 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
10700 {
10701 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10702 struct sk_buff *msg;
10703 void *hdr;
10704
10705 if (!rdev->wiphy.coalesce)
10706 return -EOPNOTSUPP;
10707
10708 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10709 if (!msg)
10710 return -ENOMEM;
10711
10712 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10713 NL80211_CMD_GET_COALESCE);
10714 if (!hdr)
10715 goto nla_put_failure;
10716
10717 if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
10718 goto nla_put_failure;
10719
10720 genlmsg_end(msg, hdr);
10721 return genlmsg_reply(msg, info);
10722
10723 nla_put_failure:
10724 nlmsg_free(msg);
10725 return -ENOBUFS;
10726 }
10727
10728 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
10729 {
10730 struct cfg80211_coalesce *coalesce = rdev->coalesce;
10731 int i, j;
10732 struct cfg80211_coalesce_rules *rule;
10733
10734 if (!coalesce)
10735 return;
10736
10737 for (i = 0; i < coalesce->n_rules; i++) {
10738 rule = &coalesce->rules[i];
10739 for (j = 0; j < rule->n_patterns; j++)
10740 kfree(rule->patterns[j].mask);
10741 kfree(rule->patterns);
10742 }
10743 kfree(coalesce->rules);
10744 kfree(coalesce);
10745 rdev->coalesce = NULL;
10746 }
10747
10748 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
10749 struct nlattr *rule,
10750 struct cfg80211_coalesce_rules *new_rule)
10751 {
10752 int err, i;
10753 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
10754 struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
10755 int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
10756 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
10757
10758 err = nla_parse_nested(tb, NL80211_ATTR_COALESCE_RULE_MAX, rule,
10759 nl80211_coalesce_policy, NULL);
10760 if (err)
10761 return err;
10762
10763 if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
10764 new_rule->delay =
10765 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
10766 if (new_rule->delay > coalesce->max_delay)
10767 return -EINVAL;
10768
10769 if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
10770 new_rule->condition =
10771 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
10772 if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
10773 new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
10774 return -EINVAL;
10775
10776 if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
10777 return -EINVAL;
10778
10779 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
10780 rem)
10781 n_patterns++;
10782 if (n_patterns > coalesce->n_patterns)
10783 return -EINVAL;
10784
10785 new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
10786 GFP_KERNEL);
10787 if (!new_rule->patterns)
10788 return -ENOMEM;
10789
10790 new_rule->n_patterns = n_patterns;
10791 i = 0;
10792
10793 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
10794 rem) {
10795 u8 *mask_pat;
10796
10797 err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
10798 nl80211_packet_pattern_policy, NULL);
10799 if (err)
10800 return err;
10801
10802 if (!pat_tb[NL80211_PKTPAT_MASK] ||
10803 !pat_tb[NL80211_PKTPAT_PATTERN])
10804 return -EINVAL;
10805 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
10806 mask_len = DIV_ROUND_UP(pat_len, 8);
10807 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
10808 return -EINVAL;
10809 if (pat_len > coalesce->pattern_max_len ||
10810 pat_len < coalesce->pattern_min_len)
10811 return -EINVAL;
10812
10813 if (!pat_tb[NL80211_PKTPAT_OFFSET])
10814 pkt_offset = 0;
10815 else
10816 pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
10817 if (pkt_offset > coalesce->max_pkt_offset)
10818 return -EINVAL;
10819 new_rule->patterns[i].pkt_offset = pkt_offset;
10820
10821 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
10822 if (!mask_pat)
10823 return -ENOMEM;
10824
10825 new_rule->patterns[i].mask = mask_pat;
10826 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
10827 mask_len);
10828
10829 mask_pat += mask_len;
10830 new_rule->patterns[i].pattern = mask_pat;
10831 new_rule->patterns[i].pattern_len = pat_len;
10832 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
10833 pat_len);
10834 i++;
10835 }
10836
10837 return 0;
10838 }
10839
10840 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
10841 {
10842 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10843 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
10844 struct cfg80211_coalesce new_coalesce = {};
10845 struct cfg80211_coalesce *n_coalesce;
10846 int err, rem_rule, n_rules = 0, i, j;
10847 struct nlattr *rule;
10848 struct cfg80211_coalesce_rules *tmp_rule;
10849
10850 if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
10851 return -EOPNOTSUPP;
10852
10853 if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
10854 cfg80211_rdev_free_coalesce(rdev);
10855 rdev_set_coalesce(rdev, NULL);
10856 return 0;
10857 }
10858
10859 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
10860 rem_rule)
10861 n_rules++;
10862 if (n_rules > coalesce->n_rules)
10863 return -EINVAL;
10864
10865 new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
10866 GFP_KERNEL);
10867 if (!new_coalesce.rules)
10868 return -ENOMEM;
10869
10870 new_coalesce.n_rules = n_rules;
10871 i = 0;
10872
10873 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
10874 rem_rule) {
10875 err = nl80211_parse_coalesce_rule(rdev, rule,
10876 &new_coalesce.rules[i]);
10877 if (err)
10878 goto error;
10879
10880 i++;
10881 }
10882
10883 err = rdev_set_coalesce(rdev, &new_coalesce);
10884 if (err)
10885 goto error;
10886
10887 n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
10888 if (!n_coalesce) {
10889 err = -ENOMEM;
10890 goto error;
10891 }
10892 cfg80211_rdev_free_coalesce(rdev);
10893 rdev->coalesce = n_coalesce;
10894
10895 return 0;
10896 error:
10897 for (i = 0; i < new_coalesce.n_rules; i++) {
10898 tmp_rule = &new_coalesce.rules[i];
10899 for (j = 0; j < tmp_rule->n_patterns; j++)
10900 kfree(tmp_rule->patterns[j].mask);
10901 kfree(tmp_rule->patterns);
10902 }
10903 kfree(new_coalesce.rules);
10904
10905 return err;
10906 }
10907
10908 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
10909 {
10910 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10911 struct net_device *dev = info->user_ptr[1];
10912 struct wireless_dev *wdev = dev->ieee80211_ptr;
10913 struct nlattr *tb[NUM_NL80211_REKEY_DATA];
10914 struct cfg80211_gtk_rekey_data rekey_data;
10915 int err;
10916
10917 if (!info->attrs[NL80211_ATTR_REKEY_DATA])
10918 return -EINVAL;
10919
10920 err = nla_parse_nested(tb, MAX_NL80211_REKEY_DATA,
10921 info->attrs[NL80211_ATTR_REKEY_DATA],
10922 nl80211_rekey_policy, info->extack);
10923 if (err)
10924 return err;
10925
10926 if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
10927 !tb[NL80211_REKEY_DATA_KCK])
10928 return -EINVAL;
10929 if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
10930 return -ERANGE;
10931 if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
10932 return -ERANGE;
10933 if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
10934 return -ERANGE;
10935
10936 rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
10937 rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
10938 rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
10939
10940 wdev_lock(wdev);
10941 if (!wdev->current_bss) {
10942 err = -ENOTCONN;
10943 goto out;
10944 }
10945
10946 if (!rdev->ops->set_rekey_data) {
10947 err = -EOPNOTSUPP;
10948 goto out;
10949 }
10950
10951 err = rdev_set_rekey_data(rdev, dev, &rekey_data);
10952 out:
10953 wdev_unlock(wdev);
10954 return err;
10955 }
10956
10957 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
10958 struct genl_info *info)
10959 {
10960 struct net_device *dev = info->user_ptr[1];
10961 struct wireless_dev *wdev = dev->ieee80211_ptr;
10962
10963 if (wdev->iftype != NL80211_IFTYPE_AP &&
10964 wdev->iftype != NL80211_IFTYPE_P2P_GO)
10965 return -EINVAL;
10966
10967 if (wdev->ap_unexpected_nlportid)
10968 return -EBUSY;
10969
10970 wdev->ap_unexpected_nlportid = info->snd_portid;
10971 return 0;
10972 }
10973
10974 static int nl80211_probe_client(struct sk_buff *skb,
10975 struct genl_info *info)
10976 {
10977 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10978 struct net_device *dev = info->user_ptr[1];
10979 struct wireless_dev *wdev = dev->ieee80211_ptr;
10980 struct sk_buff *msg;
10981 void *hdr;
10982 const u8 *addr;
10983 u64 cookie;
10984 int err;
10985
10986 if (wdev->iftype != NL80211_IFTYPE_AP &&
10987 wdev->iftype != NL80211_IFTYPE_P2P_GO)
10988 return -EOPNOTSUPP;
10989
10990 if (!info->attrs[NL80211_ATTR_MAC])
10991 return -EINVAL;
10992
10993 if (!rdev->ops->probe_client)
10994 return -EOPNOTSUPP;
10995
10996 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10997 if (!msg)
10998 return -ENOMEM;
10999
11000 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11001 NL80211_CMD_PROBE_CLIENT);
11002 if (!hdr) {
11003 err = -ENOBUFS;
11004 goto free_msg;
11005 }
11006
11007 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
11008
11009 err = rdev_probe_client(rdev, dev, addr, &cookie);
11010 if (err)
11011 goto free_msg;
11012
11013 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11014 NL80211_ATTR_PAD))
11015 goto nla_put_failure;
11016
11017 genlmsg_end(msg, hdr);
11018
11019 return genlmsg_reply(msg, info);
11020
11021 nla_put_failure:
11022 err = -ENOBUFS;
11023 free_msg:
11024 nlmsg_free(msg);
11025 return err;
11026 }
11027
11028 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
11029 {
11030 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11031 struct cfg80211_beacon_registration *reg, *nreg;
11032 int rv;
11033
11034 if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
11035 return -EOPNOTSUPP;
11036
11037 nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
11038 if (!nreg)
11039 return -ENOMEM;
11040
11041 /* First, check if already registered. */
11042 spin_lock_bh(&rdev->beacon_registrations_lock);
11043 list_for_each_entry(reg, &rdev->beacon_registrations, list) {
11044 if (reg->nlportid == info->snd_portid) {
11045 rv = -EALREADY;
11046 goto out_err;
11047 }
11048 }
11049 /* Add it to the list */
11050 nreg->nlportid = info->snd_portid;
11051 list_add(&nreg->list, &rdev->beacon_registrations);
11052
11053 spin_unlock_bh(&rdev->beacon_registrations_lock);
11054
11055 return 0;
11056 out_err:
11057 spin_unlock_bh(&rdev->beacon_registrations_lock);
11058 kfree(nreg);
11059 return rv;
11060 }
11061
11062 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
11063 {
11064 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11065 struct wireless_dev *wdev = info->user_ptr[1];
11066 int err;
11067
11068 if (!rdev->ops->start_p2p_device)
11069 return -EOPNOTSUPP;
11070
11071 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
11072 return -EOPNOTSUPP;
11073
11074 if (wdev_running(wdev))
11075 return 0;
11076
11077 if (rfkill_blocked(rdev->rfkill))
11078 return -ERFKILL;
11079
11080 err = rdev_start_p2p_device(rdev, wdev);
11081 if (err)
11082 return err;
11083
11084 wdev->is_running = true;
11085 rdev->opencount++;
11086
11087 return 0;
11088 }
11089
11090 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
11091 {
11092 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11093 struct wireless_dev *wdev = info->user_ptr[1];
11094
11095 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
11096 return -EOPNOTSUPP;
11097
11098 if (!rdev->ops->stop_p2p_device)
11099 return -EOPNOTSUPP;
11100
11101 cfg80211_stop_p2p_device(rdev, wdev);
11102
11103 return 0;
11104 }
11105
11106 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
11107 {
11108 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11109 struct wireless_dev *wdev = info->user_ptr[1];
11110 struct cfg80211_nan_conf conf = {};
11111 int err;
11112
11113 if (wdev->iftype != NL80211_IFTYPE_NAN)
11114 return -EOPNOTSUPP;
11115
11116 if (wdev_running(wdev))
11117 return -EEXIST;
11118
11119 if (rfkill_blocked(rdev->rfkill))
11120 return -ERFKILL;
11121
11122 if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
11123 return -EINVAL;
11124
11125 conf.master_pref =
11126 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
11127 if (!conf.master_pref)
11128 return -EINVAL;
11129
11130 if (info->attrs[NL80211_ATTR_BANDS]) {
11131 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
11132
11133 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
11134 return -EOPNOTSUPP;
11135
11136 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
11137 return -EINVAL;
11138
11139 conf.bands = bands;
11140 }
11141
11142 err = rdev_start_nan(rdev, wdev, &conf);
11143 if (err)
11144 return err;
11145
11146 wdev->is_running = true;
11147 rdev->opencount++;
11148
11149 return 0;
11150 }
11151
11152 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
11153 {
11154 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11155 struct wireless_dev *wdev = info->user_ptr[1];
11156
11157 if (wdev->iftype != NL80211_IFTYPE_NAN)
11158 return -EOPNOTSUPP;
11159
11160 cfg80211_stop_nan(rdev, wdev);
11161
11162 return 0;
11163 }
11164
11165 static int validate_nan_filter(struct nlattr *filter_attr)
11166 {
11167 struct nlattr *attr;
11168 int len = 0, n_entries = 0, rem;
11169
11170 nla_for_each_nested(attr, filter_attr, rem) {
11171 len += nla_len(attr);
11172 n_entries++;
11173 }
11174
11175 if (len >= U8_MAX)
11176 return -EINVAL;
11177
11178 return n_entries;
11179 }
11180
11181 static int handle_nan_filter(struct nlattr *attr_filter,
11182 struct cfg80211_nan_func *func,
11183 bool tx)
11184 {
11185 struct nlattr *attr;
11186 int n_entries, rem, i;
11187 struct cfg80211_nan_func_filter *filter;
11188
11189 n_entries = validate_nan_filter(attr_filter);
11190 if (n_entries < 0)
11191 return n_entries;
11192
11193 BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
11194
11195 filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
11196 if (!filter)
11197 return -ENOMEM;
11198
11199 i = 0;
11200 nla_for_each_nested(attr, attr_filter, rem) {
11201 filter[i].filter = nla_memdup(attr, GFP_KERNEL);
11202 filter[i].len = nla_len(attr);
11203 i++;
11204 }
11205 if (tx) {
11206 func->num_tx_filters = n_entries;
11207 func->tx_filters = filter;
11208 } else {
11209 func->num_rx_filters = n_entries;
11210 func->rx_filters = filter;
11211 }
11212
11213 return 0;
11214 }
11215
11216 static int nl80211_nan_add_func(struct sk_buff *skb,
11217 struct genl_info *info)
11218 {
11219 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11220 struct wireless_dev *wdev = info->user_ptr[1];
11221 struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
11222 struct cfg80211_nan_func *func;
11223 struct sk_buff *msg = NULL;
11224 void *hdr = NULL;
11225 int err = 0;
11226
11227 if (wdev->iftype != NL80211_IFTYPE_NAN)
11228 return -EOPNOTSUPP;
11229
11230 if (!wdev_running(wdev))
11231 return -ENOTCONN;
11232
11233 if (!info->attrs[NL80211_ATTR_NAN_FUNC])
11234 return -EINVAL;
11235
11236 err = nla_parse_nested(tb, NL80211_NAN_FUNC_ATTR_MAX,
11237 info->attrs[NL80211_ATTR_NAN_FUNC],
11238 nl80211_nan_func_policy, info->extack);
11239 if (err)
11240 return err;
11241
11242 func = kzalloc(sizeof(*func), GFP_KERNEL);
11243 if (!func)
11244 return -ENOMEM;
11245
11246 func->cookie = wdev->wiphy->cookie_counter++;
11247
11248 if (!tb[NL80211_NAN_FUNC_TYPE] ||
11249 nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]) > NL80211_NAN_FUNC_MAX_TYPE) {
11250 err = -EINVAL;
11251 goto out;
11252 }
11253
11254
11255 func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
11256
11257 if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
11258 err = -EINVAL;
11259 goto out;
11260 }
11261
11262 memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
11263 sizeof(func->service_id));
11264
11265 func->close_range =
11266 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
11267
11268 if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
11269 func->serv_spec_info_len =
11270 nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
11271 func->serv_spec_info =
11272 kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
11273 func->serv_spec_info_len,
11274 GFP_KERNEL);
11275 if (!func->serv_spec_info) {
11276 err = -ENOMEM;
11277 goto out;
11278 }
11279 }
11280
11281 if (tb[NL80211_NAN_FUNC_TTL])
11282 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
11283
11284 switch (func->type) {
11285 case NL80211_NAN_FUNC_PUBLISH:
11286 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
11287 err = -EINVAL;
11288 goto out;
11289 }
11290
11291 func->publish_type =
11292 nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
11293 func->publish_bcast =
11294 nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
11295
11296 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
11297 func->publish_bcast) {
11298 err = -EINVAL;
11299 goto out;
11300 }
11301 break;
11302 case NL80211_NAN_FUNC_SUBSCRIBE:
11303 func->subscribe_active =
11304 nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
11305 break;
11306 case NL80211_NAN_FUNC_FOLLOW_UP:
11307 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
11308 !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
11309 !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
11310 err = -EINVAL;
11311 goto out;
11312 }
11313
11314 func->followup_id =
11315 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
11316 func->followup_reqid =
11317 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
11318 memcpy(func->followup_dest.addr,
11319 nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
11320 sizeof(func->followup_dest.addr));
11321 if (func->ttl) {
11322 err = -EINVAL;
11323 goto out;
11324 }
11325 break;
11326 default:
11327 err = -EINVAL;
11328 goto out;
11329 }
11330
11331 if (tb[NL80211_NAN_FUNC_SRF]) {
11332 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
11333
11334 err = nla_parse_nested(srf_tb, NL80211_NAN_SRF_ATTR_MAX,
11335 tb[NL80211_NAN_FUNC_SRF],
11336 nl80211_nan_srf_policy, info->extack);
11337 if (err)
11338 goto out;
11339
11340 func->srf_include =
11341 nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
11342
11343 if (srf_tb[NL80211_NAN_SRF_BF]) {
11344 if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
11345 !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
11346 err = -EINVAL;
11347 goto out;
11348 }
11349
11350 func->srf_bf_len =
11351 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
11352 func->srf_bf =
11353 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
11354 func->srf_bf_len, GFP_KERNEL);
11355 if (!func->srf_bf) {
11356 err = -ENOMEM;
11357 goto out;
11358 }
11359
11360 func->srf_bf_idx =
11361 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
11362 } else {
11363 struct nlattr *attr, *mac_attr =
11364 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
11365 int n_entries, rem, i = 0;
11366
11367 if (!mac_attr) {
11368 err = -EINVAL;
11369 goto out;
11370 }
11371
11372 n_entries = validate_acl_mac_addrs(mac_attr);
11373 if (n_entries <= 0) {
11374 err = -EINVAL;
11375 goto out;
11376 }
11377
11378 func->srf_num_macs = n_entries;
11379 func->srf_macs =
11380 kzalloc(sizeof(*func->srf_macs) * n_entries,
11381 GFP_KERNEL);
11382 if (!func->srf_macs) {
11383 err = -ENOMEM;
11384 goto out;
11385 }
11386
11387 nla_for_each_nested(attr, mac_attr, rem)
11388 memcpy(func->srf_macs[i++].addr, nla_data(attr),
11389 sizeof(*func->srf_macs));
11390 }
11391 }
11392
11393 if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
11394 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
11395 func, true);
11396 if (err)
11397 goto out;
11398 }
11399
11400 if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
11401 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
11402 func, false);
11403 if (err)
11404 goto out;
11405 }
11406
11407 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11408 if (!msg) {
11409 err = -ENOMEM;
11410 goto out;
11411 }
11412
11413 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11414 NL80211_CMD_ADD_NAN_FUNCTION);
11415 /* This can't really happen - we just allocated 4KB */
11416 if (WARN_ON(!hdr)) {
11417 err = -ENOMEM;
11418 goto out;
11419 }
11420
11421 err = rdev_add_nan_func(rdev, wdev, func);
11422 out:
11423 if (err < 0) {
11424 cfg80211_free_nan_func(func);
11425 nlmsg_free(msg);
11426 return err;
11427 }
11428
11429 /* propagate the instance id and cookie to userspace */
11430 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
11431 NL80211_ATTR_PAD))
11432 goto nla_put_failure;
11433
11434 func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC);
11435 if (!func_attr)
11436 goto nla_put_failure;
11437
11438 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
11439 func->instance_id))
11440 goto nla_put_failure;
11441
11442 nla_nest_end(msg, func_attr);
11443
11444 genlmsg_end(msg, hdr);
11445 return genlmsg_reply(msg, info);
11446
11447 nla_put_failure:
11448 nlmsg_free(msg);
11449 return -ENOBUFS;
11450 }
11451
11452 static int nl80211_nan_del_func(struct sk_buff *skb,
11453 struct genl_info *info)
11454 {
11455 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11456 struct wireless_dev *wdev = info->user_ptr[1];
11457 u64 cookie;
11458
11459 if (wdev->iftype != NL80211_IFTYPE_NAN)
11460 return -EOPNOTSUPP;
11461
11462 if (!wdev_running(wdev))
11463 return -ENOTCONN;
11464
11465 if (!info->attrs[NL80211_ATTR_COOKIE])
11466 return -EINVAL;
11467
11468 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
11469
11470 rdev_del_nan_func(rdev, wdev, cookie);
11471
11472 return 0;
11473 }
11474
11475 static int nl80211_nan_change_config(struct sk_buff *skb,
11476 struct genl_info *info)
11477 {
11478 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11479 struct wireless_dev *wdev = info->user_ptr[1];
11480 struct cfg80211_nan_conf conf = {};
11481 u32 changed = 0;
11482
11483 if (wdev->iftype != NL80211_IFTYPE_NAN)
11484 return -EOPNOTSUPP;
11485
11486 if (!wdev_running(wdev))
11487 return -ENOTCONN;
11488
11489 if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
11490 conf.master_pref =
11491 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
11492 if (conf.master_pref <= 1 || conf.master_pref == 255)
11493 return -EINVAL;
11494
11495 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
11496 }
11497
11498 if (info->attrs[NL80211_ATTR_BANDS]) {
11499 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
11500
11501 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
11502 return -EOPNOTSUPP;
11503
11504 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
11505 return -EINVAL;
11506
11507 conf.bands = bands;
11508 changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
11509 }
11510
11511 if (!changed)
11512 return -EINVAL;
11513
11514 return rdev_nan_change_conf(rdev, wdev, &conf, changed);
11515 }
11516
11517 void cfg80211_nan_match(struct wireless_dev *wdev,
11518 struct cfg80211_nan_match_params *match, gfp_t gfp)
11519 {
11520 struct wiphy *wiphy = wdev->wiphy;
11521 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11522 struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
11523 struct sk_buff *msg;
11524 void *hdr;
11525
11526 if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
11527 return;
11528
11529 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11530 if (!msg)
11531 return;
11532
11533 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
11534 if (!hdr) {
11535 nlmsg_free(msg);
11536 return;
11537 }
11538
11539 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11540 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11541 wdev->netdev->ifindex)) ||
11542 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
11543 NL80211_ATTR_PAD))
11544 goto nla_put_failure;
11545
11546 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
11547 NL80211_ATTR_PAD) ||
11548 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
11549 goto nla_put_failure;
11550
11551 match_attr = nla_nest_start(msg, NL80211_ATTR_NAN_MATCH);
11552 if (!match_attr)
11553 goto nla_put_failure;
11554
11555 local_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_LOCAL);
11556 if (!local_func_attr)
11557 goto nla_put_failure;
11558
11559 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
11560 goto nla_put_failure;
11561
11562 nla_nest_end(msg, local_func_attr);
11563
11564 peer_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_PEER);
11565 if (!peer_func_attr)
11566 goto nla_put_failure;
11567
11568 if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
11569 nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
11570 goto nla_put_failure;
11571
11572 if (match->info && match->info_len &&
11573 nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
11574 match->info))
11575 goto nla_put_failure;
11576
11577 nla_nest_end(msg, peer_func_attr);
11578 nla_nest_end(msg, match_attr);
11579 genlmsg_end(msg, hdr);
11580
11581 if (!wdev->owner_nlportid)
11582 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
11583 msg, 0, NL80211_MCGRP_NAN, gfp);
11584 else
11585 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
11586 wdev->owner_nlportid);
11587
11588 return;
11589
11590 nla_put_failure:
11591 nlmsg_free(msg);
11592 }
11593 EXPORT_SYMBOL(cfg80211_nan_match);
11594
11595 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
11596 u8 inst_id,
11597 enum nl80211_nan_func_term_reason reason,
11598 u64 cookie, gfp_t gfp)
11599 {
11600 struct wiphy *wiphy = wdev->wiphy;
11601 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11602 struct sk_buff *msg;
11603 struct nlattr *func_attr;
11604 void *hdr;
11605
11606 if (WARN_ON(!inst_id))
11607 return;
11608
11609 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11610 if (!msg)
11611 return;
11612
11613 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
11614 if (!hdr) {
11615 nlmsg_free(msg);
11616 return;
11617 }
11618
11619 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11620 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11621 wdev->netdev->ifindex)) ||
11622 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
11623 NL80211_ATTR_PAD))
11624 goto nla_put_failure;
11625
11626 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11627 NL80211_ATTR_PAD))
11628 goto nla_put_failure;
11629
11630 func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC);
11631 if (!func_attr)
11632 goto nla_put_failure;
11633
11634 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
11635 nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
11636 goto nla_put_failure;
11637
11638 nla_nest_end(msg, func_attr);
11639 genlmsg_end(msg, hdr);
11640
11641 if (!wdev->owner_nlportid)
11642 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
11643 msg, 0, NL80211_MCGRP_NAN, gfp);
11644 else
11645 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
11646 wdev->owner_nlportid);
11647
11648 return;
11649
11650 nla_put_failure:
11651 nlmsg_free(msg);
11652 }
11653 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
11654
11655 static int nl80211_get_protocol_features(struct sk_buff *skb,
11656 struct genl_info *info)
11657 {
11658 void *hdr;
11659 struct sk_buff *msg;
11660
11661 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11662 if (!msg)
11663 return -ENOMEM;
11664
11665 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11666 NL80211_CMD_GET_PROTOCOL_FEATURES);
11667 if (!hdr)
11668 goto nla_put_failure;
11669
11670 if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
11671 NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
11672 goto nla_put_failure;
11673
11674 genlmsg_end(msg, hdr);
11675 return genlmsg_reply(msg, info);
11676
11677 nla_put_failure:
11678 kfree_skb(msg);
11679 return -ENOBUFS;
11680 }
11681
11682 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
11683 {
11684 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11685 struct cfg80211_update_ft_ies_params ft_params;
11686 struct net_device *dev = info->user_ptr[1];
11687
11688 if (!rdev->ops->update_ft_ies)
11689 return -EOPNOTSUPP;
11690
11691 if (!info->attrs[NL80211_ATTR_MDID] ||
11692 !info->attrs[NL80211_ATTR_IE] ||
11693 !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
11694 return -EINVAL;
11695
11696 memset(&ft_params, 0, sizeof(ft_params));
11697 ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
11698 ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11699 ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11700
11701 return rdev_update_ft_ies(rdev, dev, &ft_params);
11702 }
11703
11704 static int nl80211_crit_protocol_start(struct sk_buff *skb,
11705 struct genl_info *info)
11706 {
11707 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11708 struct wireless_dev *wdev = info->user_ptr[1];
11709 enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
11710 u16 duration;
11711 int ret;
11712
11713 if (!rdev->ops->crit_proto_start)
11714 return -EOPNOTSUPP;
11715
11716 if (WARN_ON(!rdev->ops->crit_proto_stop))
11717 return -EINVAL;
11718
11719 if (rdev->crit_proto_nlportid)
11720 return -EBUSY;
11721
11722 /* determine protocol if provided */
11723 if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
11724 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
11725
11726 if (proto >= NUM_NL80211_CRIT_PROTO)
11727 return -EINVAL;
11728
11729 /* timeout must be provided */
11730 if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
11731 return -EINVAL;
11732
11733 duration =
11734 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
11735
11736 if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
11737 return -ERANGE;
11738
11739 ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
11740 if (!ret)
11741 rdev->crit_proto_nlportid = info->snd_portid;
11742
11743 return ret;
11744 }
11745
11746 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
11747 struct genl_info *info)
11748 {
11749 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11750 struct wireless_dev *wdev = info->user_ptr[1];
11751
11752 if (!rdev->ops->crit_proto_stop)
11753 return -EOPNOTSUPP;
11754
11755 if (rdev->crit_proto_nlportid) {
11756 rdev->crit_proto_nlportid = 0;
11757 rdev_crit_proto_stop(rdev, wdev);
11758 }
11759 return 0;
11760 }
11761
11762 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
11763 {
11764 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11765 struct wireless_dev *wdev =
11766 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
11767 int i, err;
11768 u32 vid, subcmd;
11769
11770 if (!rdev->wiphy.vendor_commands)
11771 return -EOPNOTSUPP;
11772
11773 if (IS_ERR(wdev)) {
11774 err = PTR_ERR(wdev);
11775 if (err != -EINVAL)
11776 return err;
11777 wdev = NULL;
11778 } else if (wdev->wiphy != &rdev->wiphy) {
11779 return -EINVAL;
11780 }
11781
11782 if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
11783 !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
11784 return -EINVAL;
11785
11786 vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
11787 subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
11788 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
11789 const struct wiphy_vendor_command *vcmd;
11790 void *data = NULL;
11791 int len = 0;
11792
11793 vcmd = &rdev->wiphy.vendor_commands[i];
11794
11795 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
11796 continue;
11797
11798 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
11799 WIPHY_VENDOR_CMD_NEED_NETDEV)) {
11800 if (!wdev)
11801 return -EINVAL;
11802 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
11803 !wdev->netdev)
11804 return -EINVAL;
11805
11806 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
11807 if (!wdev_running(wdev))
11808 return -ENETDOWN;
11809 }
11810
11811 if (!vcmd->doit)
11812 return -EOPNOTSUPP;
11813 } else {
11814 wdev = NULL;
11815 }
11816
11817 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
11818 data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
11819 len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
11820 }
11821
11822 rdev->cur_cmd_info = info;
11823 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
11824 data, len);
11825 rdev->cur_cmd_info = NULL;
11826 return err;
11827 }
11828
11829 return -EOPNOTSUPP;
11830 }
11831
11832 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
11833 struct netlink_callback *cb,
11834 struct cfg80211_registered_device **rdev,
11835 struct wireless_dev **wdev)
11836 {
11837 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
11838 u32 vid, subcmd;
11839 unsigned int i;
11840 int vcmd_idx = -1;
11841 int err;
11842 void *data = NULL;
11843 unsigned int data_len = 0;
11844
11845 if (cb->args[0]) {
11846 /* subtract the 1 again here */
11847 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
11848 struct wireless_dev *tmp;
11849
11850 if (!wiphy)
11851 return -ENODEV;
11852 *rdev = wiphy_to_rdev(wiphy);
11853 *wdev = NULL;
11854
11855 if (cb->args[1]) {
11856 list_for_each_entry(tmp, &wiphy->wdev_list, list) {
11857 if (tmp->identifier == cb->args[1] - 1) {
11858 *wdev = tmp;
11859 break;
11860 }
11861 }
11862 }
11863
11864 /* keep rtnl locked in successful case */
11865 return 0;
11866 }
11867
11868 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, attrbuf,
11869 nl80211_fam.maxattr, nl80211_policy, NULL);
11870 if (err)
11871 return err;
11872
11873 if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
11874 !attrbuf[NL80211_ATTR_VENDOR_SUBCMD])
11875 return -EINVAL;
11876
11877 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk), attrbuf);
11878 if (IS_ERR(*wdev))
11879 *wdev = NULL;
11880
11881 *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
11882 if (IS_ERR(*rdev))
11883 return PTR_ERR(*rdev);
11884
11885 vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
11886 subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
11887
11888 for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
11889 const struct wiphy_vendor_command *vcmd;
11890
11891 vcmd = &(*rdev)->wiphy.vendor_commands[i];
11892
11893 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
11894 continue;
11895
11896 if (!vcmd->dumpit)
11897 return -EOPNOTSUPP;
11898
11899 vcmd_idx = i;
11900 break;
11901 }
11902
11903 if (vcmd_idx < 0)
11904 return -EOPNOTSUPP;
11905
11906 if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
11907 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
11908 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
11909 }
11910
11911 /* 0 is the first index - add 1 to parse only once */
11912 cb->args[0] = (*rdev)->wiphy_idx + 1;
11913 /* add 1 to know if it was NULL */
11914 cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
11915 cb->args[2] = vcmd_idx;
11916 cb->args[3] = (unsigned long)data;
11917 cb->args[4] = data_len;
11918
11919 /* keep rtnl locked in successful case */
11920 return 0;
11921 }
11922
11923 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
11924 struct netlink_callback *cb)
11925 {
11926 struct cfg80211_registered_device *rdev;
11927 struct wireless_dev *wdev;
11928 unsigned int vcmd_idx;
11929 const struct wiphy_vendor_command *vcmd;
11930 void *data;
11931 int data_len;
11932 int err;
11933 struct nlattr *vendor_data;
11934
11935 rtnl_lock();
11936 err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
11937 if (err)
11938 goto out;
11939
11940 vcmd_idx = cb->args[2];
11941 data = (void *)cb->args[3];
11942 data_len = cb->args[4];
11943 vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
11944
11945 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
11946 WIPHY_VENDOR_CMD_NEED_NETDEV)) {
11947 if (!wdev) {
11948 err = -EINVAL;
11949 goto out;
11950 }
11951 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
11952 !wdev->netdev) {
11953 err = -EINVAL;
11954 goto out;
11955 }
11956
11957 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
11958 if (!wdev_running(wdev)) {
11959 err = -ENETDOWN;
11960 goto out;
11961 }
11962 }
11963 }
11964
11965 while (1) {
11966 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
11967 cb->nlh->nlmsg_seq, NLM_F_MULTI,
11968 NL80211_CMD_VENDOR);
11969 if (!hdr)
11970 break;
11971
11972 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11973 (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
11974 wdev_id(wdev),
11975 NL80211_ATTR_PAD))) {
11976 genlmsg_cancel(skb, hdr);
11977 break;
11978 }
11979
11980 vendor_data = nla_nest_start(skb, NL80211_ATTR_VENDOR_DATA);
11981 if (!vendor_data) {
11982 genlmsg_cancel(skb, hdr);
11983 break;
11984 }
11985
11986 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
11987 (unsigned long *)&cb->args[5]);
11988 nla_nest_end(skb, vendor_data);
11989
11990 if (err == -ENOBUFS || err == -ENOENT) {
11991 genlmsg_cancel(skb, hdr);
11992 break;
11993 } else if (err) {
11994 genlmsg_cancel(skb, hdr);
11995 goto out;
11996 }
11997
11998 genlmsg_end(skb, hdr);
11999 }
12000
12001 err = skb->len;
12002 out:
12003 rtnl_unlock();
12004 return err;
12005 }
12006
12007 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
12008 enum nl80211_commands cmd,
12009 enum nl80211_attrs attr,
12010 int approxlen)
12011 {
12012 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12013
12014 if (WARN_ON(!rdev->cur_cmd_info))
12015 return NULL;
12016
12017 return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
12018 rdev->cur_cmd_info->snd_portid,
12019 rdev->cur_cmd_info->snd_seq,
12020 cmd, attr, NULL, GFP_KERNEL);
12021 }
12022 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
12023
12024 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
12025 {
12026 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
12027 void *hdr = ((void **)skb->cb)[1];
12028 struct nlattr *data = ((void **)skb->cb)[2];
12029
12030 /* clear CB data for netlink core to own from now on */
12031 memset(skb->cb, 0, sizeof(skb->cb));
12032
12033 if (WARN_ON(!rdev->cur_cmd_info)) {
12034 kfree_skb(skb);
12035 return -EINVAL;
12036 }
12037
12038 nla_nest_end(skb, data);
12039 genlmsg_end(skb, hdr);
12040 return genlmsg_reply(skb, rdev->cur_cmd_info);
12041 }
12042 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
12043
12044 static int nl80211_set_qos_map(struct sk_buff *skb,
12045 struct genl_info *info)
12046 {
12047 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12048 struct cfg80211_qos_map *qos_map = NULL;
12049 struct net_device *dev = info->user_ptr[1];
12050 u8 *pos, len, num_des, des_len, des;
12051 int ret;
12052
12053 if (!rdev->ops->set_qos_map)
12054 return -EOPNOTSUPP;
12055
12056 if (info->attrs[NL80211_ATTR_QOS_MAP]) {
12057 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
12058 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
12059
12060 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
12061 len > IEEE80211_QOS_MAP_LEN_MAX)
12062 return -EINVAL;
12063
12064 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
12065 if (!qos_map)
12066 return -ENOMEM;
12067
12068 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
12069 if (num_des) {
12070 des_len = num_des *
12071 sizeof(struct cfg80211_dscp_exception);
12072 memcpy(qos_map->dscp_exception, pos, des_len);
12073 qos_map->num_des = num_des;
12074 for (des = 0; des < num_des; des++) {
12075 if (qos_map->dscp_exception[des].up > 7) {
12076 kfree(qos_map);
12077 return -EINVAL;
12078 }
12079 }
12080 pos += des_len;
12081 }
12082 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
12083 }
12084
12085 wdev_lock(dev->ieee80211_ptr);
12086 ret = nl80211_key_allowed(dev->ieee80211_ptr);
12087 if (!ret)
12088 ret = rdev_set_qos_map(rdev, dev, qos_map);
12089 wdev_unlock(dev->ieee80211_ptr);
12090
12091 kfree(qos_map);
12092 return ret;
12093 }
12094
12095 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
12096 {
12097 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12098 struct net_device *dev = info->user_ptr[1];
12099 struct wireless_dev *wdev = dev->ieee80211_ptr;
12100 const u8 *peer;
12101 u8 tsid, up;
12102 u16 admitted_time = 0;
12103 int err;
12104
12105 if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
12106 return -EOPNOTSUPP;
12107
12108 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
12109 !info->attrs[NL80211_ATTR_USER_PRIO])
12110 return -EINVAL;
12111
12112 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
12113 if (tsid >= IEEE80211_NUM_TIDS)
12114 return -EINVAL;
12115
12116 up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
12117 if (up >= IEEE80211_NUM_UPS)
12118 return -EINVAL;
12119
12120 /* WMM uses TIDs 0-7 even for TSPEC */
12121 if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
12122 /* TODO: handle 802.11 TSPEC/admission control
12123 * need more attributes for that (e.g. BA session requirement);
12124 * change the WMM adminssion test above to allow both then
12125 */
12126 return -EINVAL;
12127 }
12128
12129 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12130
12131 if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
12132 admitted_time =
12133 nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
12134 if (!admitted_time)
12135 return -EINVAL;
12136 }
12137
12138 wdev_lock(wdev);
12139 switch (wdev->iftype) {
12140 case NL80211_IFTYPE_STATION:
12141 case NL80211_IFTYPE_P2P_CLIENT:
12142 if (wdev->current_bss)
12143 break;
12144 err = -ENOTCONN;
12145 goto out;
12146 default:
12147 err = -EOPNOTSUPP;
12148 goto out;
12149 }
12150
12151 err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
12152
12153 out:
12154 wdev_unlock(wdev);
12155 return err;
12156 }
12157
12158 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
12159 {
12160 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12161 struct net_device *dev = info->user_ptr[1];
12162 struct wireless_dev *wdev = dev->ieee80211_ptr;
12163 const u8 *peer;
12164 u8 tsid;
12165 int err;
12166
12167 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
12168 return -EINVAL;
12169
12170 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
12171 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12172
12173 wdev_lock(wdev);
12174 err = rdev_del_tx_ts(rdev, dev, tsid, peer);
12175 wdev_unlock(wdev);
12176
12177 return err;
12178 }
12179
12180 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
12181 struct genl_info *info)
12182 {
12183 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12184 struct net_device *dev = info->user_ptr[1];
12185 struct wireless_dev *wdev = dev->ieee80211_ptr;
12186 struct cfg80211_chan_def chandef = {};
12187 const u8 *addr;
12188 u8 oper_class;
12189 int err;
12190
12191 if (!rdev->ops->tdls_channel_switch ||
12192 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
12193 return -EOPNOTSUPP;
12194
12195 switch (dev->ieee80211_ptr->iftype) {
12196 case NL80211_IFTYPE_STATION:
12197 case NL80211_IFTYPE_P2P_CLIENT:
12198 break;
12199 default:
12200 return -EOPNOTSUPP;
12201 }
12202
12203 if (!info->attrs[NL80211_ATTR_MAC] ||
12204 !info->attrs[NL80211_ATTR_OPER_CLASS])
12205 return -EINVAL;
12206
12207 err = nl80211_parse_chandef(rdev, info, &chandef);
12208 if (err)
12209 return err;
12210
12211 /*
12212 * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
12213 * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
12214 * specification is not defined for them.
12215 */
12216 if (chandef.chan->band == NL80211_BAND_2GHZ &&
12217 chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
12218 chandef.width != NL80211_CHAN_WIDTH_20)
12219 return -EINVAL;
12220
12221 /* we will be active on the TDLS link */
12222 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
12223 wdev->iftype))
12224 return -EINVAL;
12225
12226 /* don't allow switching to DFS channels */
12227 if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
12228 return -EINVAL;
12229
12230 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
12231 oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
12232
12233 wdev_lock(wdev);
12234 err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
12235 wdev_unlock(wdev);
12236
12237 return err;
12238 }
12239
12240 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
12241 struct genl_info *info)
12242 {
12243 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12244 struct net_device *dev = info->user_ptr[1];
12245 struct wireless_dev *wdev = dev->ieee80211_ptr;
12246 const u8 *addr;
12247
12248 if (!rdev->ops->tdls_channel_switch ||
12249 !rdev->ops->tdls_cancel_channel_switch ||
12250 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
12251 return -EOPNOTSUPP;
12252
12253 switch (dev->ieee80211_ptr->iftype) {
12254 case NL80211_IFTYPE_STATION:
12255 case NL80211_IFTYPE_P2P_CLIENT:
12256 break;
12257 default:
12258 return -EOPNOTSUPP;
12259 }
12260
12261 if (!info->attrs[NL80211_ATTR_MAC])
12262 return -EINVAL;
12263
12264 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
12265
12266 wdev_lock(wdev);
12267 rdev_tdls_cancel_channel_switch(rdev, dev, addr);
12268 wdev_unlock(wdev);
12269
12270 return 0;
12271 }
12272
12273 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
12274 struct genl_info *info)
12275 {
12276 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12277 struct net_device *dev = info->user_ptr[1];
12278 struct wireless_dev *wdev = dev->ieee80211_ptr;
12279 const struct nlattr *nla;
12280 bool enabled;
12281
12282 if (!rdev->ops->set_multicast_to_unicast)
12283 return -EOPNOTSUPP;
12284
12285 if (wdev->iftype != NL80211_IFTYPE_AP &&
12286 wdev->iftype != NL80211_IFTYPE_P2P_GO)
12287 return -EOPNOTSUPP;
12288
12289 nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
12290 enabled = nla_get_flag(nla);
12291
12292 return rdev_set_multicast_to_unicast(rdev, dev, enabled);
12293 }
12294
12295 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
12296 {
12297 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12298 struct net_device *dev = info->user_ptr[1];
12299 struct wireless_dev *wdev = dev->ieee80211_ptr;
12300 struct cfg80211_pmk_conf pmk_conf = {};
12301 int ret;
12302
12303 if (wdev->iftype != NL80211_IFTYPE_STATION &&
12304 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12305 return -EOPNOTSUPP;
12306
12307 if (!wiphy_ext_feature_isset(&rdev->wiphy,
12308 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
12309 return -EOPNOTSUPP;
12310
12311 if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
12312 return -EINVAL;
12313
12314 wdev_lock(wdev);
12315 if (!wdev->current_bss) {
12316 ret = -ENOTCONN;
12317 goto out;
12318 }
12319
12320 pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
12321 if (memcmp(pmk_conf.aa, wdev->current_bss->pub.bssid, ETH_ALEN)) {
12322 ret = -EINVAL;
12323 goto out;
12324 }
12325
12326 pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
12327 pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
12328 if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
12329 pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) {
12330 ret = -EINVAL;
12331 goto out;
12332 }
12333
12334 if (info->attrs[NL80211_ATTR_PMKR0_NAME]) {
12335 int r0_name_len = nla_len(info->attrs[NL80211_ATTR_PMKR0_NAME]);
12336
12337 if (r0_name_len != WLAN_PMK_NAME_LEN) {
12338 ret = -EINVAL;
12339 goto out;
12340 }
12341
12342 pmk_conf.pmk_r0_name =
12343 nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
12344 }
12345
12346 ret = rdev_set_pmk(rdev, dev, &pmk_conf);
12347 out:
12348 wdev_unlock(wdev);
12349 return ret;
12350 }
12351
12352 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
12353 {
12354 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12355 struct net_device *dev = info->user_ptr[1];
12356 struct wireless_dev *wdev = dev->ieee80211_ptr;
12357 const u8 *aa;
12358 int ret;
12359
12360 if (wdev->iftype != NL80211_IFTYPE_STATION &&
12361 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12362 return -EOPNOTSUPP;
12363
12364 if (!wiphy_ext_feature_isset(&rdev->wiphy,
12365 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
12366 return -EOPNOTSUPP;
12367
12368 if (!info->attrs[NL80211_ATTR_MAC])
12369 return -EINVAL;
12370
12371 wdev_lock(wdev);
12372 aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
12373 ret = rdev_del_pmk(rdev, dev, aa);
12374 wdev_unlock(wdev);
12375
12376 return ret;
12377 }
12378
12379 #define NL80211_FLAG_NEED_WIPHY 0x01
12380 #define NL80211_FLAG_NEED_NETDEV 0x02
12381 #define NL80211_FLAG_NEED_RTNL 0x04
12382 #define NL80211_FLAG_CHECK_NETDEV_UP 0x08
12383 #define NL80211_FLAG_NEED_NETDEV_UP (NL80211_FLAG_NEED_NETDEV |\
12384 NL80211_FLAG_CHECK_NETDEV_UP)
12385 #define NL80211_FLAG_NEED_WDEV 0x10
12386 /* If a netdev is associated, it must be UP, P2P must be started */
12387 #define NL80211_FLAG_NEED_WDEV_UP (NL80211_FLAG_NEED_WDEV |\
12388 NL80211_FLAG_CHECK_NETDEV_UP)
12389 #define NL80211_FLAG_CLEAR_SKB 0x20
12390
12391 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
12392 struct genl_info *info)
12393 {
12394 struct cfg80211_registered_device *rdev;
12395 struct wireless_dev *wdev;
12396 struct net_device *dev;
12397 bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
12398
12399 if (rtnl)
12400 rtnl_lock();
12401
12402 if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
12403 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
12404 if (IS_ERR(rdev)) {
12405 if (rtnl)
12406 rtnl_unlock();
12407 return PTR_ERR(rdev);
12408 }
12409 info->user_ptr[0] = rdev;
12410 } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
12411 ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
12412 ASSERT_RTNL();
12413
12414 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
12415 info->attrs);
12416 if (IS_ERR(wdev)) {
12417 if (rtnl)
12418 rtnl_unlock();
12419 return PTR_ERR(wdev);
12420 }
12421
12422 dev = wdev->netdev;
12423 rdev = wiphy_to_rdev(wdev->wiphy);
12424
12425 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
12426 if (!dev) {
12427 if (rtnl)
12428 rtnl_unlock();
12429 return -EINVAL;
12430 }
12431
12432 info->user_ptr[1] = dev;
12433 } else {
12434 info->user_ptr[1] = wdev;
12435 }
12436
12437 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
12438 !wdev_running(wdev)) {
12439 if (rtnl)
12440 rtnl_unlock();
12441 return -ENETDOWN;
12442 }
12443
12444 if (dev)
12445 dev_hold(dev);
12446
12447 info->user_ptr[0] = rdev;
12448 }
12449
12450 return 0;
12451 }
12452
12453 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
12454 struct genl_info *info)
12455 {
12456 if (info->user_ptr[1]) {
12457 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
12458 struct wireless_dev *wdev = info->user_ptr[1];
12459
12460 if (wdev->netdev)
12461 dev_put(wdev->netdev);
12462 } else {
12463 dev_put(info->user_ptr[1]);
12464 }
12465 }
12466
12467 if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
12468 rtnl_unlock();
12469
12470 /* If needed, clear the netlink message payload from the SKB
12471 * as it might contain key data that shouldn't stick around on
12472 * the heap after the SKB is freed. The netlink message header
12473 * is still needed for further processing, so leave it intact.
12474 */
12475 if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
12476 struct nlmsghdr *nlh = nlmsg_hdr(skb);
12477
12478 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
12479 }
12480 }
12481
12482 static const struct genl_ops nl80211_ops[] = {
12483 {
12484 .cmd = NL80211_CMD_GET_WIPHY,
12485 .doit = nl80211_get_wiphy,
12486 .dumpit = nl80211_dump_wiphy,
12487 .done = nl80211_dump_wiphy_done,
12488 .policy = nl80211_policy,
12489 /* can be retrieved by unprivileged users */
12490 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12491 NL80211_FLAG_NEED_RTNL,
12492 },
12493 {
12494 .cmd = NL80211_CMD_SET_WIPHY,
12495 .doit = nl80211_set_wiphy,
12496 .policy = nl80211_policy,
12497 .flags = GENL_UNS_ADMIN_PERM,
12498 .internal_flags = NL80211_FLAG_NEED_RTNL,
12499 },
12500 {
12501 .cmd = NL80211_CMD_GET_INTERFACE,
12502 .doit = nl80211_get_interface,
12503 .dumpit = nl80211_dump_interface,
12504 .policy = nl80211_policy,
12505 /* can be retrieved by unprivileged users */
12506 .internal_flags = NL80211_FLAG_NEED_WDEV |
12507 NL80211_FLAG_NEED_RTNL,
12508 },
12509 {
12510 .cmd = NL80211_CMD_SET_INTERFACE,
12511 .doit = nl80211_set_interface,
12512 .policy = nl80211_policy,
12513 .flags = GENL_UNS_ADMIN_PERM,
12514 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12515 NL80211_FLAG_NEED_RTNL,
12516 },
12517 {
12518 .cmd = NL80211_CMD_NEW_INTERFACE,
12519 .doit = nl80211_new_interface,
12520 .policy = nl80211_policy,
12521 .flags = GENL_UNS_ADMIN_PERM,
12522 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12523 NL80211_FLAG_NEED_RTNL,
12524 },
12525 {
12526 .cmd = NL80211_CMD_DEL_INTERFACE,
12527 .doit = nl80211_del_interface,
12528 .policy = nl80211_policy,
12529 .flags = GENL_UNS_ADMIN_PERM,
12530 .internal_flags = NL80211_FLAG_NEED_WDEV |
12531 NL80211_FLAG_NEED_RTNL,
12532 },
12533 {
12534 .cmd = NL80211_CMD_GET_KEY,
12535 .doit = nl80211_get_key,
12536 .policy = nl80211_policy,
12537 .flags = GENL_UNS_ADMIN_PERM,
12538 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12539 NL80211_FLAG_NEED_RTNL,
12540 },
12541 {
12542 .cmd = NL80211_CMD_SET_KEY,
12543 .doit = nl80211_set_key,
12544 .policy = nl80211_policy,
12545 .flags = GENL_UNS_ADMIN_PERM,
12546 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12547 NL80211_FLAG_NEED_RTNL |
12548 NL80211_FLAG_CLEAR_SKB,
12549 },
12550 {
12551 .cmd = NL80211_CMD_NEW_KEY,
12552 .doit = nl80211_new_key,
12553 .policy = nl80211_policy,
12554 .flags = GENL_UNS_ADMIN_PERM,
12555 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12556 NL80211_FLAG_NEED_RTNL |
12557 NL80211_FLAG_CLEAR_SKB,
12558 },
12559 {
12560 .cmd = NL80211_CMD_DEL_KEY,
12561 .doit = nl80211_del_key,
12562 .policy = nl80211_policy,
12563 .flags = GENL_UNS_ADMIN_PERM,
12564 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12565 NL80211_FLAG_NEED_RTNL,
12566 },
12567 {
12568 .cmd = NL80211_CMD_SET_BEACON,
12569 .policy = nl80211_policy,
12570 .flags = GENL_UNS_ADMIN_PERM,
12571 .doit = nl80211_set_beacon,
12572 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12573 NL80211_FLAG_NEED_RTNL,
12574 },
12575 {
12576 .cmd = NL80211_CMD_START_AP,
12577 .policy = nl80211_policy,
12578 .flags = GENL_UNS_ADMIN_PERM,
12579 .doit = nl80211_start_ap,
12580 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12581 NL80211_FLAG_NEED_RTNL,
12582 },
12583 {
12584 .cmd = NL80211_CMD_STOP_AP,
12585 .policy = nl80211_policy,
12586 .flags = GENL_UNS_ADMIN_PERM,
12587 .doit = nl80211_stop_ap,
12588 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12589 NL80211_FLAG_NEED_RTNL,
12590 },
12591 {
12592 .cmd = NL80211_CMD_GET_STATION,
12593 .doit = nl80211_get_station,
12594 .dumpit = nl80211_dump_station,
12595 .policy = nl80211_policy,
12596 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12597 NL80211_FLAG_NEED_RTNL,
12598 },
12599 {
12600 .cmd = NL80211_CMD_SET_STATION,
12601 .doit = nl80211_set_station,
12602 .policy = nl80211_policy,
12603 .flags = GENL_UNS_ADMIN_PERM,
12604 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12605 NL80211_FLAG_NEED_RTNL,
12606 },
12607 {
12608 .cmd = NL80211_CMD_NEW_STATION,
12609 .doit = nl80211_new_station,
12610 .policy = nl80211_policy,
12611 .flags = GENL_UNS_ADMIN_PERM,
12612 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12613 NL80211_FLAG_NEED_RTNL,
12614 },
12615 {
12616 .cmd = NL80211_CMD_DEL_STATION,
12617 .doit = nl80211_del_station,
12618 .policy = nl80211_policy,
12619 .flags = GENL_UNS_ADMIN_PERM,
12620 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12621 NL80211_FLAG_NEED_RTNL,
12622 },
12623 {
12624 .cmd = NL80211_CMD_GET_MPATH,
12625 .doit = nl80211_get_mpath,
12626 .dumpit = nl80211_dump_mpath,
12627 .policy = nl80211_policy,
12628 .flags = GENL_UNS_ADMIN_PERM,
12629 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12630 NL80211_FLAG_NEED_RTNL,
12631 },
12632 {
12633 .cmd = NL80211_CMD_GET_MPP,
12634 .doit = nl80211_get_mpp,
12635 .dumpit = nl80211_dump_mpp,
12636 .policy = nl80211_policy,
12637 .flags = GENL_UNS_ADMIN_PERM,
12638 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12639 NL80211_FLAG_NEED_RTNL,
12640 },
12641 {
12642 .cmd = NL80211_CMD_SET_MPATH,
12643 .doit = nl80211_set_mpath,
12644 .policy = nl80211_policy,
12645 .flags = GENL_UNS_ADMIN_PERM,
12646 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12647 NL80211_FLAG_NEED_RTNL,
12648 },
12649 {
12650 .cmd = NL80211_CMD_NEW_MPATH,
12651 .doit = nl80211_new_mpath,
12652 .policy = nl80211_policy,
12653 .flags = GENL_UNS_ADMIN_PERM,
12654 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12655 NL80211_FLAG_NEED_RTNL,
12656 },
12657 {
12658 .cmd = NL80211_CMD_DEL_MPATH,
12659 .doit = nl80211_del_mpath,
12660 .policy = nl80211_policy,
12661 .flags = GENL_UNS_ADMIN_PERM,
12662 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12663 NL80211_FLAG_NEED_RTNL,
12664 },
12665 {
12666 .cmd = NL80211_CMD_SET_BSS,
12667 .doit = nl80211_set_bss,
12668 .policy = nl80211_policy,
12669 .flags = GENL_UNS_ADMIN_PERM,
12670 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12671 NL80211_FLAG_NEED_RTNL,
12672 },
12673 {
12674 .cmd = NL80211_CMD_GET_REG,
12675 .doit = nl80211_get_reg_do,
12676 .dumpit = nl80211_get_reg_dump,
12677 .policy = nl80211_policy,
12678 .internal_flags = NL80211_FLAG_NEED_RTNL,
12679 /* can be retrieved by unprivileged users */
12680 },
12681 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
12682 {
12683 .cmd = NL80211_CMD_SET_REG,
12684 .doit = nl80211_set_reg,
12685 .policy = nl80211_policy,
12686 .flags = GENL_ADMIN_PERM,
12687 .internal_flags = NL80211_FLAG_NEED_RTNL,
12688 },
12689 #endif
12690 {
12691 .cmd = NL80211_CMD_REQ_SET_REG,
12692 .doit = nl80211_req_set_reg,
12693 .policy = nl80211_policy,
12694 .flags = GENL_ADMIN_PERM,
12695 },
12696 {
12697 .cmd = NL80211_CMD_GET_MESH_CONFIG,
12698 .doit = nl80211_get_mesh_config,
12699 .policy = nl80211_policy,
12700 /* can be retrieved by unprivileged users */
12701 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12702 NL80211_FLAG_NEED_RTNL,
12703 },
12704 {
12705 .cmd = NL80211_CMD_SET_MESH_CONFIG,
12706 .doit = nl80211_update_mesh_config,
12707 .policy = nl80211_policy,
12708 .flags = GENL_UNS_ADMIN_PERM,
12709 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12710 NL80211_FLAG_NEED_RTNL,
12711 },
12712 {
12713 .cmd = NL80211_CMD_TRIGGER_SCAN,
12714 .doit = nl80211_trigger_scan,
12715 .policy = nl80211_policy,
12716 .flags = GENL_UNS_ADMIN_PERM,
12717 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12718 NL80211_FLAG_NEED_RTNL,
12719 },
12720 {
12721 .cmd = NL80211_CMD_ABORT_SCAN,
12722 .doit = nl80211_abort_scan,
12723 .policy = nl80211_policy,
12724 .flags = GENL_UNS_ADMIN_PERM,
12725 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12726 NL80211_FLAG_NEED_RTNL,
12727 },
12728 {
12729 .cmd = NL80211_CMD_GET_SCAN,
12730 .policy = nl80211_policy,
12731 .dumpit = nl80211_dump_scan,
12732 },
12733 {
12734 .cmd = NL80211_CMD_START_SCHED_SCAN,
12735 .doit = nl80211_start_sched_scan,
12736 .policy = nl80211_policy,
12737 .flags = GENL_UNS_ADMIN_PERM,
12738 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12739 NL80211_FLAG_NEED_RTNL,
12740 },
12741 {
12742 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
12743 .doit = nl80211_stop_sched_scan,
12744 .policy = nl80211_policy,
12745 .flags = GENL_UNS_ADMIN_PERM,
12746 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12747 NL80211_FLAG_NEED_RTNL,
12748 },
12749 {
12750 .cmd = NL80211_CMD_AUTHENTICATE,
12751 .doit = nl80211_authenticate,
12752 .policy = nl80211_policy,
12753 .flags = GENL_UNS_ADMIN_PERM,
12754 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12755 NL80211_FLAG_NEED_RTNL |
12756 NL80211_FLAG_CLEAR_SKB,
12757 },
12758 {
12759 .cmd = NL80211_CMD_ASSOCIATE,
12760 .doit = nl80211_associate,
12761 .policy = nl80211_policy,
12762 .flags = GENL_UNS_ADMIN_PERM,
12763 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12764 NL80211_FLAG_NEED_RTNL,
12765 },
12766 {
12767 .cmd = NL80211_CMD_DEAUTHENTICATE,
12768 .doit = nl80211_deauthenticate,
12769 .policy = nl80211_policy,
12770 .flags = GENL_UNS_ADMIN_PERM,
12771 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12772 NL80211_FLAG_NEED_RTNL,
12773 },
12774 {
12775 .cmd = NL80211_CMD_DISASSOCIATE,
12776 .doit = nl80211_disassociate,
12777 .policy = nl80211_policy,
12778 .flags = GENL_UNS_ADMIN_PERM,
12779 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12780 NL80211_FLAG_NEED_RTNL,
12781 },
12782 {
12783 .cmd = NL80211_CMD_JOIN_IBSS,
12784 .doit = nl80211_join_ibss,
12785 .policy = nl80211_policy,
12786 .flags = GENL_UNS_ADMIN_PERM,
12787 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12788 NL80211_FLAG_NEED_RTNL,
12789 },
12790 {
12791 .cmd = NL80211_CMD_LEAVE_IBSS,
12792 .doit = nl80211_leave_ibss,
12793 .policy = nl80211_policy,
12794 .flags = GENL_UNS_ADMIN_PERM,
12795 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12796 NL80211_FLAG_NEED_RTNL,
12797 },
12798 #ifdef CONFIG_NL80211_TESTMODE
12799 {
12800 .cmd = NL80211_CMD_TESTMODE,
12801 .doit = nl80211_testmode_do,
12802 .dumpit = nl80211_testmode_dump,
12803 .policy = nl80211_policy,
12804 .flags = GENL_UNS_ADMIN_PERM,
12805 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12806 NL80211_FLAG_NEED_RTNL,
12807 },
12808 #endif
12809 {
12810 .cmd = NL80211_CMD_CONNECT,
12811 .doit = nl80211_connect,
12812 .policy = nl80211_policy,
12813 .flags = GENL_UNS_ADMIN_PERM,
12814 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12815 NL80211_FLAG_NEED_RTNL,
12816 },
12817 {
12818 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
12819 .doit = nl80211_update_connect_params,
12820 .policy = nl80211_policy,
12821 .flags = GENL_ADMIN_PERM,
12822 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12823 NL80211_FLAG_NEED_RTNL,
12824 },
12825 {
12826 .cmd = NL80211_CMD_DISCONNECT,
12827 .doit = nl80211_disconnect,
12828 .policy = nl80211_policy,
12829 .flags = GENL_UNS_ADMIN_PERM,
12830 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12831 NL80211_FLAG_NEED_RTNL,
12832 },
12833 {
12834 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
12835 .doit = nl80211_wiphy_netns,
12836 .policy = nl80211_policy,
12837 .flags = GENL_UNS_ADMIN_PERM,
12838 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12839 NL80211_FLAG_NEED_RTNL,
12840 },
12841 {
12842 .cmd = NL80211_CMD_GET_SURVEY,
12843 .policy = nl80211_policy,
12844 .dumpit = nl80211_dump_survey,
12845 },
12846 {
12847 .cmd = NL80211_CMD_SET_PMKSA,
12848 .doit = nl80211_setdel_pmksa,
12849 .policy = nl80211_policy,
12850 .flags = GENL_UNS_ADMIN_PERM,
12851 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12852 NL80211_FLAG_NEED_RTNL,
12853 },
12854 {
12855 .cmd = NL80211_CMD_DEL_PMKSA,
12856 .doit = nl80211_setdel_pmksa,
12857 .policy = nl80211_policy,
12858 .flags = GENL_UNS_ADMIN_PERM,
12859 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12860 NL80211_FLAG_NEED_RTNL,
12861 },
12862 {
12863 .cmd = NL80211_CMD_FLUSH_PMKSA,
12864 .doit = nl80211_flush_pmksa,
12865 .policy = nl80211_policy,
12866 .flags = GENL_UNS_ADMIN_PERM,
12867 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12868 NL80211_FLAG_NEED_RTNL,
12869 },
12870 {
12871 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
12872 .doit = nl80211_remain_on_channel,
12873 .policy = nl80211_policy,
12874 .flags = GENL_UNS_ADMIN_PERM,
12875 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12876 NL80211_FLAG_NEED_RTNL,
12877 },
12878 {
12879 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
12880 .doit = nl80211_cancel_remain_on_channel,
12881 .policy = nl80211_policy,
12882 .flags = GENL_UNS_ADMIN_PERM,
12883 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12884 NL80211_FLAG_NEED_RTNL,
12885 },
12886 {
12887 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
12888 .doit = nl80211_set_tx_bitrate_mask,
12889 .policy = nl80211_policy,
12890 .flags = GENL_UNS_ADMIN_PERM,
12891 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12892 NL80211_FLAG_NEED_RTNL,
12893 },
12894 {
12895 .cmd = NL80211_CMD_REGISTER_FRAME,
12896 .doit = nl80211_register_mgmt,
12897 .policy = nl80211_policy,
12898 .flags = GENL_UNS_ADMIN_PERM,
12899 .internal_flags = NL80211_FLAG_NEED_WDEV |
12900 NL80211_FLAG_NEED_RTNL,
12901 },
12902 {
12903 .cmd = NL80211_CMD_FRAME,
12904 .doit = nl80211_tx_mgmt,
12905 .policy = nl80211_policy,
12906 .flags = GENL_UNS_ADMIN_PERM,
12907 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12908 NL80211_FLAG_NEED_RTNL,
12909 },
12910 {
12911 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
12912 .doit = nl80211_tx_mgmt_cancel_wait,
12913 .policy = nl80211_policy,
12914 .flags = GENL_UNS_ADMIN_PERM,
12915 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12916 NL80211_FLAG_NEED_RTNL,
12917 },
12918 {
12919 .cmd = NL80211_CMD_SET_POWER_SAVE,
12920 .doit = nl80211_set_power_save,
12921 .policy = nl80211_policy,
12922 .flags = GENL_UNS_ADMIN_PERM,
12923 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12924 NL80211_FLAG_NEED_RTNL,
12925 },
12926 {
12927 .cmd = NL80211_CMD_GET_POWER_SAVE,
12928 .doit = nl80211_get_power_save,
12929 .policy = nl80211_policy,
12930 /* can be retrieved by unprivileged users */
12931 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12932 NL80211_FLAG_NEED_RTNL,
12933 },
12934 {
12935 .cmd = NL80211_CMD_SET_CQM,
12936 .doit = nl80211_set_cqm,
12937 .policy = nl80211_policy,
12938 .flags = GENL_UNS_ADMIN_PERM,
12939 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12940 NL80211_FLAG_NEED_RTNL,
12941 },
12942 {
12943 .cmd = NL80211_CMD_SET_CHANNEL,
12944 .doit = nl80211_set_channel,
12945 .policy = nl80211_policy,
12946 .flags = GENL_UNS_ADMIN_PERM,
12947 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12948 NL80211_FLAG_NEED_RTNL,
12949 },
12950 {
12951 .cmd = NL80211_CMD_SET_WDS_PEER,
12952 .doit = nl80211_set_wds_peer,
12953 .policy = nl80211_policy,
12954 .flags = GENL_UNS_ADMIN_PERM,
12955 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12956 NL80211_FLAG_NEED_RTNL,
12957 },
12958 {
12959 .cmd = NL80211_CMD_JOIN_MESH,
12960 .doit = nl80211_join_mesh,
12961 .policy = nl80211_policy,
12962 .flags = GENL_UNS_ADMIN_PERM,
12963 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12964 NL80211_FLAG_NEED_RTNL,
12965 },
12966 {
12967 .cmd = NL80211_CMD_LEAVE_MESH,
12968 .doit = nl80211_leave_mesh,
12969 .policy = nl80211_policy,
12970 .flags = GENL_UNS_ADMIN_PERM,
12971 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12972 NL80211_FLAG_NEED_RTNL,
12973 },
12974 {
12975 .cmd = NL80211_CMD_JOIN_OCB,
12976 .doit = nl80211_join_ocb,
12977 .policy = nl80211_policy,
12978 .flags = GENL_UNS_ADMIN_PERM,
12979 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12980 NL80211_FLAG_NEED_RTNL,
12981 },
12982 {
12983 .cmd = NL80211_CMD_LEAVE_OCB,
12984 .doit = nl80211_leave_ocb,
12985 .policy = nl80211_policy,
12986 .flags = GENL_UNS_ADMIN_PERM,
12987 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12988 NL80211_FLAG_NEED_RTNL,
12989 },
12990 #ifdef CONFIG_PM
12991 {
12992 .cmd = NL80211_CMD_GET_WOWLAN,
12993 .doit = nl80211_get_wowlan,
12994 .policy = nl80211_policy,
12995 /* can be retrieved by unprivileged users */
12996 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12997 NL80211_FLAG_NEED_RTNL,
12998 },
12999 {
13000 .cmd = NL80211_CMD_SET_WOWLAN,
13001 .doit = nl80211_set_wowlan,
13002 .policy = nl80211_policy,
13003 .flags = GENL_UNS_ADMIN_PERM,
13004 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13005 NL80211_FLAG_NEED_RTNL,
13006 },
13007 #endif
13008 {
13009 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
13010 .doit = nl80211_set_rekey_data,
13011 .policy = nl80211_policy,
13012 .flags = GENL_UNS_ADMIN_PERM,
13013 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13014 NL80211_FLAG_NEED_RTNL |
13015 NL80211_FLAG_CLEAR_SKB,
13016 },
13017 {
13018 .cmd = NL80211_CMD_TDLS_MGMT,
13019 .doit = nl80211_tdls_mgmt,
13020 .policy = nl80211_policy,
13021 .flags = GENL_UNS_ADMIN_PERM,
13022 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13023 NL80211_FLAG_NEED_RTNL,
13024 },
13025 {
13026 .cmd = NL80211_CMD_TDLS_OPER,
13027 .doit = nl80211_tdls_oper,
13028 .policy = nl80211_policy,
13029 .flags = GENL_UNS_ADMIN_PERM,
13030 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13031 NL80211_FLAG_NEED_RTNL,
13032 },
13033 {
13034 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
13035 .doit = nl80211_register_unexpected_frame,
13036 .policy = nl80211_policy,
13037 .flags = GENL_UNS_ADMIN_PERM,
13038 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13039 NL80211_FLAG_NEED_RTNL,
13040 },
13041 {
13042 .cmd = NL80211_CMD_PROBE_CLIENT,
13043 .doit = nl80211_probe_client,
13044 .policy = nl80211_policy,
13045 .flags = GENL_UNS_ADMIN_PERM,
13046 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13047 NL80211_FLAG_NEED_RTNL,
13048 },
13049 {
13050 .cmd = NL80211_CMD_REGISTER_BEACONS,
13051 .doit = nl80211_register_beacons,
13052 .policy = nl80211_policy,
13053 .flags = GENL_UNS_ADMIN_PERM,
13054 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13055 NL80211_FLAG_NEED_RTNL,
13056 },
13057 {
13058 .cmd = NL80211_CMD_SET_NOACK_MAP,
13059 .doit = nl80211_set_noack_map,
13060 .policy = nl80211_policy,
13061 .flags = GENL_UNS_ADMIN_PERM,
13062 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13063 NL80211_FLAG_NEED_RTNL,
13064 },
13065 {
13066 .cmd = NL80211_CMD_START_P2P_DEVICE,
13067 .doit = nl80211_start_p2p_device,
13068 .policy = nl80211_policy,
13069 .flags = GENL_UNS_ADMIN_PERM,
13070 .internal_flags = NL80211_FLAG_NEED_WDEV |
13071 NL80211_FLAG_NEED_RTNL,
13072 },
13073 {
13074 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
13075 .doit = nl80211_stop_p2p_device,
13076 .policy = nl80211_policy,
13077 .flags = GENL_UNS_ADMIN_PERM,
13078 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13079 NL80211_FLAG_NEED_RTNL,
13080 },
13081 {
13082 .cmd = NL80211_CMD_START_NAN,
13083 .doit = nl80211_start_nan,
13084 .policy = nl80211_policy,
13085 .flags = GENL_ADMIN_PERM,
13086 .internal_flags = NL80211_FLAG_NEED_WDEV |
13087 NL80211_FLAG_NEED_RTNL,
13088 },
13089 {
13090 .cmd = NL80211_CMD_STOP_NAN,
13091 .doit = nl80211_stop_nan,
13092 .policy = nl80211_policy,
13093 .flags = GENL_ADMIN_PERM,
13094 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13095 NL80211_FLAG_NEED_RTNL,
13096 },
13097 {
13098 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
13099 .doit = nl80211_nan_add_func,
13100 .policy = nl80211_policy,
13101 .flags = GENL_ADMIN_PERM,
13102 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13103 NL80211_FLAG_NEED_RTNL,
13104 },
13105 {
13106 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
13107 .doit = nl80211_nan_del_func,
13108 .policy = nl80211_policy,
13109 .flags = GENL_ADMIN_PERM,
13110 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13111 NL80211_FLAG_NEED_RTNL,
13112 },
13113 {
13114 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
13115 .doit = nl80211_nan_change_config,
13116 .policy = nl80211_policy,
13117 .flags = GENL_ADMIN_PERM,
13118 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13119 NL80211_FLAG_NEED_RTNL,
13120 },
13121 {
13122 .cmd = NL80211_CMD_SET_MCAST_RATE,
13123 .doit = nl80211_set_mcast_rate,
13124 .policy = nl80211_policy,
13125 .flags = GENL_UNS_ADMIN_PERM,
13126 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13127 NL80211_FLAG_NEED_RTNL,
13128 },
13129 {
13130 .cmd = NL80211_CMD_SET_MAC_ACL,
13131 .doit = nl80211_set_mac_acl,
13132 .policy = nl80211_policy,
13133 .flags = GENL_UNS_ADMIN_PERM,
13134 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13135 NL80211_FLAG_NEED_RTNL,
13136 },
13137 {
13138 .cmd = NL80211_CMD_RADAR_DETECT,
13139 .doit = nl80211_start_radar_detection,
13140 .policy = nl80211_policy,
13141 .flags = GENL_UNS_ADMIN_PERM,
13142 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13143 NL80211_FLAG_NEED_RTNL,
13144 },
13145 {
13146 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
13147 .doit = nl80211_get_protocol_features,
13148 .policy = nl80211_policy,
13149 },
13150 {
13151 .cmd = NL80211_CMD_UPDATE_FT_IES,
13152 .doit = nl80211_update_ft_ies,
13153 .policy = nl80211_policy,
13154 .flags = GENL_UNS_ADMIN_PERM,
13155 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13156 NL80211_FLAG_NEED_RTNL,
13157 },
13158 {
13159 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
13160 .doit = nl80211_crit_protocol_start,
13161 .policy = nl80211_policy,
13162 .flags = GENL_UNS_ADMIN_PERM,
13163 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13164 NL80211_FLAG_NEED_RTNL,
13165 },
13166 {
13167 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
13168 .doit = nl80211_crit_protocol_stop,
13169 .policy = nl80211_policy,
13170 .flags = GENL_UNS_ADMIN_PERM,
13171 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13172 NL80211_FLAG_NEED_RTNL,
13173 },
13174 {
13175 .cmd = NL80211_CMD_GET_COALESCE,
13176 .doit = nl80211_get_coalesce,
13177 .policy = nl80211_policy,
13178 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13179 NL80211_FLAG_NEED_RTNL,
13180 },
13181 {
13182 .cmd = NL80211_CMD_SET_COALESCE,
13183 .doit = nl80211_set_coalesce,
13184 .policy = nl80211_policy,
13185 .flags = GENL_UNS_ADMIN_PERM,
13186 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13187 NL80211_FLAG_NEED_RTNL,
13188 },
13189 {
13190 .cmd = NL80211_CMD_CHANNEL_SWITCH,
13191 .doit = nl80211_channel_switch,
13192 .policy = nl80211_policy,
13193 .flags = GENL_UNS_ADMIN_PERM,
13194 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13195 NL80211_FLAG_NEED_RTNL,
13196 },
13197 {
13198 .cmd = NL80211_CMD_VENDOR,
13199 .doit = nl80211_vendor_cmd,
13200 .dumpit = nl80211_vendor_cmd_dump,
13201 .policy = nl80211_policy,
13202 .flags = GENL_UNS_ADMIN_PERM,
13203 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13204 NL80211_FLAG_NEED_RTNL,
13205 },
13206 {
13207 .cmd = NL80211_CMD_SET_QOS_MAP,
13208 .doit = nl80211_set_qos_map,
13209 .policy = nl80211_policy,
13210 .flags = GENL_UNS_ADMIN_PERM,
13211 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13212 NL80211_FLAG_NEED_RTNL,
13213 },
13214 {
13215 .cmd = NL80211_CMD_ADD_TX_TS,
13216 .doit = nl80211_add_tx_ts,
13217 .policy = nl80211_policy,
13218 .flags = GENL_UNS_ADMIN_PERM,
13219 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13220 NL80211_FLAG_NEED_RTNL,
13221 },
13222 {
13223 .cmd = NL80211_CMD_DEL_TX_TS,
13224 .doit = nl80211_del_tx_ts,
13225 .policy = nl80211_policy,
13226 .flags = GENL_UNS_ADMIN_PERM,
13227 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13228 NL80211_FLAG_NEED_RTNL,
13229 },
13230 {
13231 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
13232 .doit = nl80211_tdls_channel_switch,
13233 .policy = nl80211_policy,
13234 .flags = GENL_UNS_ADMIN_PERM,
13235 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13236 NL80211_FLAG_NEED_RTNL,
13237 },
13238 {
13239 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
13240 .doit = nl80211_tdls_cancel_channel_switch,
13241 .policy = nl80211_policy,
13242 .flags = GENL_UNS_ADMIN_PERM,
13243 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13244 NL80211_FLAG_NEED_RTNL,
13245 },
13246 {
13247 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
13248 .doit = nl80211_set_multicast_to_unicast,
13249 .policy = nl80211_policy,
13250 .flags = GENL_UNS_ADMIN_PERM,
13251 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13252 NL80211_FLAG_NEED_RTNL,
13253 },
13254 {
13255 .cmd = NL80211_CMD_SET_PMK,
13256 .doit = nl80211_set_pmk,
13257 .policy = nl80211_policy,
13258 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13259 NL80211_FLAG_NEED_RTNL,
13260 },
13261 {
13262 .cmd = NL80211_CMD_DEL_PMK,
13263 .doit = nl80211_del_pmk,
13264 .policy = nl80211_policy,
13265 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13266 NL80211_FLAG_NEED_RTNL,
13267 },
13268
13269 };
13270
13271 static struct genl_family nl80211_fam __ro_after_init = {
13272 .name = NL80211_GENL_NAME, /* have users key off the name instead */
13273 .hdrsize = 0, /* no private header */
13274 .version = 1, /* no particular meaning now */
13275 .maxattr = NL80211_ATTR_MAX,
13276 .netnsok = true,
13277 .pre_doit = nl80211_pre_doit,
13278 .post_doit = nl80211_post_doit,
13279 .module = THIS_MODULE,
13280 .ops = nl80211_ops,
13281 .n_ops = ARRAY_SIZE(nl80211_ops),
13282 .mcgrps = nl80211_mcgrps,
13283 .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
13284 };
13285
13286 /* notification functions */
13287
13288 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
13289 enum nl80211_commands cmd)
13290 {
13291 struct sk_buff *msg;
13292 struct nl80211_dump_wiphy_state state = {};
13293
13294 WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
13295 cmd != NL80211_CMD_DEL_WIPHY);
13296
13297 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13298 if (!msg)
13299 return;
13300
13301 if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
13302 nlmsg_free(msg);
13303 return;
13304 }
13305
13306 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13307 NL80211_MCGRP_CONFIG, GFP_KERNEL);
13308 }
13309
13310 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
13311 struct wireless_dev *wdev,
13312 enum nl80211_commands cmd)
13313 {
13314 struct sk_buff *msg;
13315
13316 WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
13317 cmd != NL80211_CMD_DEL_INTERFACE);
13318
13319 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13320 if (!msg)
13321 return;
13322
13323 if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev,
13324 cmd == NL80211_CMD_DEL_INTERFACE) < 0) {
13325 nlmsg_free(msg);
13326 return;
13327 }
13328
13329 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13330 NL80211_MCGRP_CONFIG, GFP_KERNEL);
13331 }
13332
13333 static int nl80211_add_scan_req(struct sk_buff *msg,
13334 struct cfg80211_registered_device *rdev)
13335 {
13336 struct cfg80211_scan_request *req = rdev->scan_req;
13337 struct nlattr *nest;
13338 int i;
13339
13340 if (WARN_ON(!req))
13341 return 0;
13342
13343 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
13344 if (!nest)
13345 goto nla_put_failure;
13346 for (i = 0; i < req->n_ssids; i++) {
13347 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
13348 goto nla_put_failure;
13349 }
13350 nla_nest_end(msg, nest);
13351
13352 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
13353 if (!nest)
13354 goto nla_put_failure;
13355 for (i = 0; i < req->n_channels; i++) {
13356 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
13357 goto nla_put_failure;
13358 }
13359 nla_nest_end(msg, nest);
13360
13361 if (req->ie &&
13362 nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
13363 goto nla_put_failure;
13364
13365 if (req->flags &&
13366 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
13367 goto nla_put_failure;
13368
13369 if (req->info.scan_start_tsf &&
13370 (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
13371 req->info.scan_start_tsf, NL80211_BSS_PAD) ||
13372 nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
13373 req->info.tsf_bssid)))
13374 goto nla_put_failure;
13375
13376 return 0;
13377 nla_put_failure:
13378 return -ENOBUFS;
13379 }
13380
13381 static int nl80211_prep_scan_msg(struct sk_buff *msg,
13382 struct cfg80211_registered_device *rdev,
13383 struct wireless_dev *wdev,
13384 u32 portid, u32 seq, int flags,
13385 u32 cmd)
13386 {
13387 void *hdr;
13388
13389 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
13390 if (!hdr)
13391 return -1;
13392
13393 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13394 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
13395 wdev->netdev->ifindex)) ||
13396 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
13397 NL80211_ATTR_PAD))
13398 goto nla_put_failure;
13399
13400 /* ignore errors and send incomplete event anyway */
13401 nl80211_add_scan_req(msg, rdev);
13402
13403 genlmsg_end(msg, hdr);
13404 return 0;
13405
13406 nla_put_failure:
13407 genlmsg_cancel(msg, hdr);
13408 return -EMSGSIZE;
13409 }
13410
13411 static int
13412 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
13413 struct cfg80211_sched_scan_request *req, u32 cmd)
13414 {
13415 void *hdr;
13416
13417 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
13418 if (!hdr)
13419 return -1;
13420
13421 if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
13422 wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
13423 nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
13424 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
13425 NL80211_ATTR_PAD))
13426 goto nla_put_failure;
13427
13428 genlmsg_end(msg, hdr);
13429 return 0;
13430
13431 nla_put_failure:
13432 genlmsg_cancel(msg, hdr);
13433 return -EMSGSIZE;
13434 }
13435
13436 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
13437 struct wireless_dev *wdev)
13438 {
13439 struct sk_buff *msg;
13440
13441 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13442 if (!msg)
13443 return;
13444
13445 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
13446 NL80211_CMD_TRIGGER_SCAN) < 0) {
13447 nlmsg_free(msg);
13448 return;
13449 }
13450
13451 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13452 NL80211_MCGRP_SCAN, GFP_KERNEL);
13453 }
13454
13455 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
13456 struct wireless_dev *wdev, bool aborted)
13457 {
13458 struct sk_buff *msg;
13459
13460 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13461 if (!msg)
13462 return NULL;
13463
13464 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
13465 aborted ? NL80211_CMD_SCAN_ABORTED :
13466 NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
13467 nlmsg_free(msg);
13468 return NULL;
13469 }
13470
13471 return msg;
13472 }
13473
13474 /* send message created by nl80211_build_scan_msg() */
13475 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
13476 struct sk_buff *msg)
13477 {
13478 if (!msg)
13479 return;
13480
13481 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13482 NL80211_MCGRP_SCAN, GFP_KERNEL);
13483 }
13484
13485 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
13486 {
13487 struct sk_buff *msg;
13488
13489 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13490 if (!msg)
13491 return;
13492
13493 if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
13494 nlmsg_free(msg);
13495 return;
13496 }
13497
13498 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
13499 NL80211_MCGRP_SCAN, GFP_KERNEL);
13500 }
13501
13502 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
13503 struct regulatory_request *request)
13504 {
13505 /* Userspace can always count this one always being set */
13506 if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
13507 goto nla_put_failure;
13508
13509 if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
13510 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
13511 NL80211_REGDOM_TYPE_WORLD))
13512 goto nla_put_failure;
13513 } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
13514 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
13515 NL80211_REGDOM_TYPE_CUSTOM_WORLD))
13516 goto nla_put_failure;
13517 } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
13518 request->intersect) {
13519 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
13520 NL80211_REGDOM_TYPE_INTERSECTION))
13521 goto nla_put_failure;
13522 } else {
13523 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
13524 NL80211_REGDOM_TYPE_COUNTRY) ||
13525 nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
13526 request->alpha2))
13527 goto nla_put_failure;
13528 }
13529
13530 if (request->wiphy_idx != WIPHY_IDX_INVALID) {
13531 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
13532
13533 if (wiphy &&
13534 nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
13535 goto nla_put_failure;
13536
13537 if (wiphy &&
13538 wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
13539 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
13540 goto nla_put_failure;
13541 }
13542
13543 return true;
13544
13545 nla_put_failure:
13546 return false;
13547 }
13548
13549 /*
13550 * This can happen on global regulatory changes or device specific settings
13551 * based on custom regulatory domains.
13552 */
13553 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
13554 struct regulatory_request *request)
13555 {
13556 struct sk_buff *msg;
13557 void *hdr;
13558
13559 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13560 if (!msg)
13561 return;
13562
13563 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
13564 if (!hdr) {
13565 nlmsg_free(msg);
13566 return;
13567 }
13568
13569 if (nl80211_reg_change_event_fill(msg, request) == false)
13570 goto nla_put_failure;
13571
13572 genlmsg_end(msg, hdr);
13573
13574 rcu_read_lock();
13575 genlmsg_multicast_allns(&nl80211_fam, msg, 0,
13576 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
13577 rcu_read_unlock();
13578
13579 return;
13580
13581 nla_put_failure:
13582 genlmsg_cancel(msg, hdr);
13583 nlmsg_free(msg);
13584 }
13585
13586 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
13587 struct net_device *netdev,
13588 const u8 *buf, size_t len,
13589 enum nl80211_commands cmd, gfp_t gfp,
13590 int uapsd_queues)
13591 {
13592 struct sk_buff *msg;
13593 void *hdr;
13594
13595 msg = nlmsg_new(100 + len, gfp);
13596 if (!msg)
13597 return;
13598
13599 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
13600 if (!hdr) {
13601 nlmsg_free(msg);
13602 return;
13603 }
13604
13605 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13606 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13607 nla_put(msg, NL80211_ATTR_FRAME, len, buf))
13608 goto nla_put_failure;
13609
13610 if (uapsd_queues >= 0) {
13611 struct nlattr *nla_wmm =
13612 nla_nest_start(msg, NL80211_ATTR_STA_WME);
13613 if (!nla_wmm)
13614 goto nla_put_failure;
13615
13616 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
13617 uapsd_queues))
13618 goto nla_put_failure;
13619
13620 nla_nest_end(msg, nla_wmm);
13621 }
13622
13623 genlmsg_end(msg, hdr);
13624
13625 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13626 NL80211_MCGRP_MLME, gfp);
13627 return;
13628
13629 nla_put_failure:
13630 genlmsg_cancel(msg, hdr);
13631 nlmsg_free(msg);
13632 }
13633
13634 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
13635 struct net_device *netdev, const u8 *buf,
13636 size_t len, gfp_t gfp)
13637 {
13638 nl80211_send_mlme_event(rdev, netdev, buf, len,
13639 NL80211_CMD_AUTHENTICATE, gfp, -1);
13640 }
13641
13642 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
13643 struct net_device *netdev, const u8 *buf,
13644 size_t len, gfp_t gfp, int uapsd_queues)
13645 {
13646 nl80211_send_mlme_event(rdev, netdev, buf, len,
13647 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues);
13648 }
13649
13650 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
13651 struct net_device *netdev, const u8 *buf,
13652 size_t len, gfp_t gfp)
13653 {
13654 nl80211_send_mlme_event(rdev, netdev, buf, len,
13655 NL80211_CMD_DEAUTHENTICATE, gfp, -1);
13656 }
13657
13658 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
13659 struct net_device *netdev, const u8 *buf,
13660 size_t len, gfp_t gfp)
13661 {
13662 nl80211_send_mlme_event(rdev, netdev, buf, len,
13663 NL80211_CMD_DISASSOCIATE, gfp, -1);
13664 }
13665
13666 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
13667 size_t len)
13668 {
13669 struct wireless_dev *wdev = dev->ieee80211_ptr;
13670 struct wiphy *wiphy = wdev->wiphy;
13671 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13672 const struct ieee80211_mgmt *mgmt = (void *)buf;
13673 u32 cmd;
13674
13675 if (WARN_ON(len < 2))
13676 return;
13677
13678 if (ieee80211_is_deauth(mgmt->frame_control))
13679 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
13680 else
13681 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
13682
13683 trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
13684 nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1);
13685 }
13686 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
13687
13688 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
13689 struct net_device *netdev, int cmd,
13690 const u8 *addr, gfp_t gfp)
13691 {
13692 struct sk_buff *msg;
13693 void *hdr;
13694
13695 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13696 if (!msg)
13697 return;
13698
13699 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
13700 if (!hdr) {
13701 nlmsg_free(msg);
13702 return;
13703 }
13704
13705 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13706 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13707 nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
13708 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
13709 goto nla_put_failure;
13710
13711 genlmsg_end(msg, hdr);
13712
13713 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13714 NL80211_MCGRP_MLME, gfp);
13715 return;
13716
13717 nla_put_failure:
13718 genlmsg_cancel(msg, hdr);
13719 nlmsg_free(msg);
13720 }
13721
13722 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
13723 struct net_device *netdev, const u8 *addr,
13724 gfp_t gfp)
13725 {
13726 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
13727 addr, gfp);
13728 }
13729
13730 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
13731 struct net_device *netdev, const u8 *addr,
13732 gfp_t gfp)
13733 {
13734 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
13735 addr, gfp);
13736 }
13737
13738 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
13739 struct net_device *netdev,
13740 struct cfg80211_connect_resp_params *cr,
13741 gfp_t gfp)
13742 {
13743 struct sk_buff *msg;
13744 void *hdr;
13745
13746 msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
13747 cr->fils_kek_len + cr->pmk_len +
13748 (cr->pmkid ? WLAN_PMKID_LEN : 0), gfp);
13749 if (!msg)
13750 return;
13751
13752 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
13753 if (!hdr) {
13754 nlmsg_free(msg);
13755 return;
13756 }
13757
13758 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13759 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13760 (cr->bssid &&
13761 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cr->bssid)) ||
13762 nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
13763 cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
13764 cr->status) ||
13765 (cr->status < 0 &&
13766 (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
13767 nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
13768 cr->timeout_reason))) ||
13769 (cr->req_ie &&
13770 nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
13771 (cr->resp_ie &&
13772 nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
13773 cr->resp_ie)) ||
13774 (cr->update_erp_next_seq_num &&
13775 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
13776 cr->fils_erp_next_seq_num)) ||
13777 (cr->status == WLAN_STATUS_SUCCESS &&
13778 ((cr->fils_kek &&
13779 nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils_kek_len,
13780 cr->fils_kek)) ||
13781 (cr->pmk &&
13782 nla_put(msg, NL80211_ATTR_PMK, cr->pmk_len, cr->pmk)) ||
13783 (cr->pmkid &&
13784 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->pmkid)))))
13785 goto nla_put_failure;
13786
13787 genlmsg_end(msg, hdr);
13788
13789 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13790 NL80211_MCGRP_MLME, gfp);
13791 return;
13792
13793 nla_put_failure:
13794 genlmsg_cancel(msg, hdr);
13795 nlmsg_free(msg);
13796 }
13797
13798 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
13799 struct net_device *netdev,
13800 struct cfg80211_roam_info *info, gfp_t gfp)
13801 {
13802 struct sk_buff *msg;
13803 void *hdr;
13804 const u8 *bssid = info->bss ? info->bss->bssid : info->bssid;
13805
13806 msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len, gfp);
13807 if (!msg)
13808 return;
13809
13810 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
13811 if (!hdr) {
13812 nlmsg_free(msg);
13813 return;
13814 }
13815
13816 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13817 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13818 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
13819 (info->req_ie &&
13820 nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
13821 info->req_ie)) ||
13822 (info->resp_ie &&
13823 nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
13824 info->resp_ie)) ||
13825 (info->authorized &&
13826 nla_put_flag(msg, NL80211_ATTR_PORT_AUTHORIZED)))
13827 goto nla_put_failure;
13828
13829 genlmsg_end(msg, hdr);
13830
13831 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13832 NL80211_MCGRP_MLME, gfp);
13833 return;
13834
13835 nla_put_failure:
13836 genlmsg_cancel(msg, hdr);
13837 nlmsg_free(msg);
13838 }
13839
13840 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
13841 struct net_device *netdev, u16 reason,
13842 const u8 *ie, size_t ie_len, bool from_ap)
13843 {
13844 struct sk_buff *msg;
13845 void *hdr;
13846
13847 msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
13848 if (!msg)
13849 return;
13850
13851 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
13852 if (!hdr) {
13853 nlmsg_free(msg);
13854 return;
13855 }
13856
13857 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13858 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13859 (from_ap && reason &&
13860 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
13861 (from_ap &&
13862 nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
13863 (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
13864 goto nla_put_failure;
13865
13866 genlmsg_end(msg, hdr);
13867
13868 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13869 NL80211_MCGRP_MLME, GFP_KERNEL);
13870 return;
13871
13872 nla_put_failure:
13873 genlmsg_cancel(msg, hdr);
13874 nlmsg_free(msg);
13875 }
13876
13877 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
13878 struct net_device *netdev, const u8 *bssid,
13879 gfp_t gfp)
13880 {
13881 struct sk_buff *msg;
13882 void *hdr;
13883
13884 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13885 if (!msg)
13886 return;
13887
13888 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
13889 if (!hdr) {
13890 nlmsg_free(msg);
13891 return;
13892 }
13893
13894 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13895 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13896 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
13897 goto nla_put_failure;
13898
13899 genlmsg_end(msg, hdr);
13900
13901 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13902 NL80211_MCGRP_MLME, gfp);
13903 return;
13904
13905 nla_put_failure:
13906 genlmsg_cancel(msg, hdr);
13907 nlmsg_free(msg);
13908 }
13909
13910 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
13911 const u8* ie, u8 ie_len, gfp_t gfp)
13912 {
13913 struct wireless_dev *wdev = dev->ieee80211_ptr;
13914 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
13915 struct sk_buff *msg;
13916 void *hdr;
13917
13918 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
13919 return;
13920
13921 trace_cfg80211_notify_new_peer_candidate(dev, addr);
13922
13923 msg = nlmsg_new(100 + ie_len, gfp);
13924 if (!msg)
13925 return;
13926
13927 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
13928 if (!hdr) {
13929 nlmsg_free(msg);
13930 return;
13931 }
13932
13933 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13934 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
13935 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
13936 (ie_len && ie &&
13937 nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
13938 goto nla_put_failure;
13939
13940 genlmsg_end(msg, hdr);
13941
13942 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13943 NL80211_MCGRP_MLME, gfp);
13944 return;
13945
13946 nla_put_failure:
13947 genlmsg_cancel(msg, hdr);
13948 nlmsg_free(msg);
13949 }
13950 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
13951
13952 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
13953 struct net_device *netdev, const u8 *addr,
13954 enum nl80211_key_type key_type, int key_id,
13955 const u8 *tsc, gfp_t gfp)
13956 {
13957 struct sk_buff *msg;
13958 void *hdr;
13959
13960 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13961 if (!msg)
13962 return;
13963
13964 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
13965 if (!hdr) {
13966 nlmsg_free(msg);
13967 return;
13968 }
13969
13970 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13971 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13972 (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
13973 nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
13974 (key_id != -1 &&
13975 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
13976 (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
13977 goto nla_put_failure;
13978
13979 genlmsg_end(msg, hdr);
13980
13981 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13982 NL80211_MCGRP_MLME, gfp);
13983 return;
13984
13985 nla_put_failure:
13986 genlmsg_cancel(msg, hdr);
13987 nlmsg_free(msg);
13988 }
13989
13990 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
13991 struct ieee80211_channel *channel_before,
13992 struct ieee80211_channel *channel_after)
13993 {
13994 struct sk_buff *msg;
13995 void *hdr;
13996 struct nlattr *nl_freq;
13997
13998 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
13999 if (!msg)
14000 return;
14001
14002 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
14003 if (!hdr) {
14004 nlmsg_free(msg);
14005 return;
14006 }
14007
14008 /*
14009 * Since we are applying the beacon hint to a wiphy we know its
14010 * wiphy_idx is valid
14011 */
14012 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
14013 goto nla_put_failure;
14014
14015 /* Before */
14016 nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
14017 if (!nl_freq)
14018 goto nla_put_failure;
14019 if (nl80211_msg_put_channel(msg, channel_before, false))
14020 goto nla_put_failure;
14021 nla_nest_end(msg, nl_freq);
14022
14023 /* After */
14024 nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
14025 if (!nl_freq)
14026 goto nla_put_failure;
14027 if (nl80211_msg_put_channel(msg, channel_after, false))
14028 goto nla_put_failure;
14029 nla_nest_end(msg, nl_freq);
14030
14031 genlmsg_end(msg, hdr);
14032
14033 rcu_read_lock();
14034 genlmsg_multicast_allns(&nl80211_fam, msg, 0,
14035 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
14036 rcu_read_unlock();
14037
14038 return;
14039
14040 nla_put_failure:
14041 genlmsg_cancel(msg, hdr);
14042 nlmsg_free(msg);
14043 }
14044
14045 static void nl80211_send_remain_on_chan_event(
14046 int cmd, struct cfg80211_registered_device *rdev,
14047 struct wireless_dev *wdev, u64 cookie,
14048 struct ieee80211_channel *chan,
14049 unsigned int duration, gfp_t gfp)
14050 {
14051 struct sk_buff *msg;
14052 void *hdr;
14053
14054 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14055 if (!msg)
14056 return;
14057
14058 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14059 if (!hdr) {
14060 nlmsg_free(msg);
14061 return;
14062 }
14063
14064 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14065 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14066 wdev->netdev->ifindex)) ||
14067 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14068 NL80211_ATTR_PAD) ||
14069 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
14070 nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
14071 NL80211_CHAN_NO_HT) ||
14072 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14073 NL80211_ATTR_PAD))
14074 goto nla_put_failure;
14075
14076 if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
14077 nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
14078 goto nla_put_failure;
14079
14080 genlmsg_end(msg, hdr);
14081
14082 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14083 NL80211_MCGRP_MLME, gfp);
14084 return;
14085
14086 nla_put_failure:
14087 genlmsg_cancel(msg, hdr);
14088 nlmsg_free(msg);
14089 }
14090
14091 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
14092 struct ieee80211_channel *chan,
14093 unsigned int duration, gfp_t gfp)
14094 {
14095 struct wiphy *wiphy = wdev->wiphy;
14096 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14097
14098 trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
14099 nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
14100 rdev, wdev, cookie, chan,
14101 duration, gfp);
14102 }
14103 EXPORT_SYMBOL(cfg80211_ready_on_channel);
14104
14105 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
14106 struct ieee80211_channel *chan,
14107 gfp_t gfp)
14108 {
14109 struct wiphy *wiphy = wdev->wiphy;
14110 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14111
14112 trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
14113 nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
14114 rdev, wdev, cookie, chan, 0, gfp);
14115 }
14116 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
14117
14118 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
14119 struct station_info *sinfo, gfp_t gfp)
14120 {
14121 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
14122 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14123 struct sk_buff *msg;
14124
14125 trace_cfg80211_new_sta(dev, mac_addr, sinfo);
14126
14127 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14128 if (!msg)
14129 return;
14130
14131 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
14132 rdev, dev, mac_addr, sinfo) < 0) {
14133 nlmsg_free(msg);
14134 return;
14135 }
14136
14137 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14138 NL80211_MCGRP_MLME, gfp);
14139 }
14140 EXPORT_SYMBOL(cfg80211_new_sta);
14141
14142 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
14143 struct station_info *sinfo, gfp_t gfp)
14144 {
14145 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
14146 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14147 struct sk_buff *msg;
14148 struct station_info empty_sinfo = {};
14149
14150 if (!sinfo)
14151 sinfo = &empty_sinfo;
14152
14153 trace_cfg80211_del_sta(dev, mac_addr);
14154
14155 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14156 if (!msg)
14157 return;
14158
14159 if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
14160 rdev, dev, mac_addr, sinfo) < 0) {
14161 nlmsg_free(msg);
14162 return;
14163 }
14164
14165 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14166 NL80211_MCGRP_MLME, gfp);
14167 }
14168 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
14169
14170 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
14171 enum nl80211_connect_failed_reason reason,
14172 gfp_t gfp)
14173 {
14174 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
14175 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14176 struct sk_buff *msg;
14177 void *hdr;
14178
14179 msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
14180 if (!msg)
14181 return;
14182
14183 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
14184 if (!hdr) {
14185 nlmsg_free(msg);
14186 return;
14187 }
14188
14189 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14190 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
14191 nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
14192 goto nla_put_failure;
14193
14194 genlmsg_end(msg, hdr);
14195
14196 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14197 NL80211_MCGRP_MLME, gfp);
14198 return;
14199
14200 nla_put_failure:
14201 genlmsg_cancel(msg, hdr);
14202 nlmsg_free(msg);
14203 }
14204 EXPORT_SYMBOL(cfg80211_conn_failed);
14205
14206 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
14207 const u8 *addr, gfp_t gfp)
14208 {
14209 struct wireless_dev *wdev = dev->ieee80211_ptr;
14210 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14211 struct sk_buff *msg;
14212 void *hdr;
14213 u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
14214
14215 if (!nlportid)
14216 return false;
14217
14218 msg = nlmsg_new(100, gfp);
14219 if (!msg)
14220 return true;
14221
14222 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14223 if (!hdr) {
14224 nlmsg_free(msg);
14225 return true;
14226 }
14227
14228 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14229 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14230 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
14231 goto nla_put_failure;
14232
14233 genlmsg_end(msg, hdr);
14234 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
14235 return true;
14236
14237 nla_put_failure:
14238 genlmsg_cancel(msg, hdr);
14239 nlmsg_free(msg);
14240 return true;
14241 }
14242
14243 bool cfg80211_rx_spurious_frame(struct net_device *dev,
14244 const u8 *addr, gfp_t gfp)
14245 {
14246 struct wireless_dev *wdev = dev->ieee80211_ptr;
14247 bool ret;
14248
14249 trace_cfg80211_rx_spurious_frame(dev, addr);
14250
14251 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
14252 wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
14253 trace_cfg80211_return_bool(false);
14254 return false;
14255 }
14256 ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
14257 addr, gfp);
14258 trace_cfg80211_return_bool(ret);
14259 return ret;
14260 }
14261 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
14262
14263 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
14264 const u8 *addr, gfp_t gfp)
14265 {
14266 struct wireless_dev *wdev = dev->ieee80211_ptr;
14267 bool ret;
14268
14269 trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
14270
14271 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
14272 wdev->iftype != NL80211_IFTYPE_P2P_GO &&
14273 wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
14274 trace_cfg80211_return_bool(false);
14275 return false;
14276 }
14277 ret = __nl80211_unexpected_frame(dev,
14278 NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
14279 addr, gfp);
14280 trace_cfg80211_return_bool(ret);
14281 return ret;
14282 }
14283 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
14284
14285 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
14286 struct wireless_dev *wdev, u32 nlportid,
14287 int freq, int sig_dbm,
14288 const u8 *buf, size_t len, u32 flags, gfp_t gfp)
14289 {
14290 struct net_device *netdev = wdev->netdev;
14291 struct sk_buff *msg;
14292 void *hdr;
14293
14294 msg = nlmsg_new(100 + len, gfp);
14295 if (!msg)
14296 return -ENOMEM;
14297
14298 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
14299 if (!hdr) {
14300 nlmsg_free(msg);
14301 return -ENOMEM;
14302 }
14303
14304 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14305 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14306 netdev->ifindex)) ||
14307 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14308 NL80211_ATTR_PAD) ||
14309 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
14310 (sig_dbm &&
14311 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
14312 nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
14313 (flags &&
14314 nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
14315 goto nla_put_failure;
14316
14317 genlmsg_end(msg, hdr);
14318
14319 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
14320
14321 nla_put_failure:
14322 genlmsg_cancel(msg, hdr);
14323 nlmsg_free(msg);
14324 return -ENOBUFS;
14325 }
14326
14327 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
14328 const u8 *buf, size_t len, bool ack, gfp_t gfp)
14329 {
14330 struct wiphy *wiphy = wdev->wiphy;
14331 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14332 struct net_device *netdev = wdev->netdev;
14333 struct sk_buff *msg;
14334 void *hdr;
14335
14336 trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
14337
14338 msg = nlmsg_new(100 + len, gfp);
14339 if (!msg)
14340 return;
14341
14342 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
14343 if (!hdr) {
14344 nlmsg_free(msg);
14345 return;
14346 }
14347
14348 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14349 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14350 netdev->ifindex)) ||
14351 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14352 NL80211_ATTR_PAD) ||
14353 nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
14354 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14355 NL80211_ATTR_PAD) ||
14356 (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
14357 goto nla_put_failure;
14358
14359 genlmsg_end(msg, hdr);
14360
14361 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14362 NL80211_MCGRP_MLME, gfp);
14363 return;
14364
14365 nla_put_failure:
14366 genlmsg_cancel(msg, hdr);
14367 nlmsg_free(msg);
14368 }
14369 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
14370
14371 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
14372 const char *mac, gfp_t gfp)
14373 {
14374 struct wireless_dev *wdev = dev->ieee80211_ptr;
14375 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14376 struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14377 void **cb;
14378
14379 if (!msg)
14380 return NULL;
14381
14382 cb = (void **)msg->cb;
14383
14384 cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
14385 if (!cb[0]) {
14386 nlmsg_free(msg);
14387 return NULL;
14388 }
14389
14390 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14391 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
14392 goto nla_put_failure;
14393
14394 if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
14395 goto nla_put_failure;
14396
14397 cb[1] = nla_nest_start(msg, NL80211_ATTR_CQM);
14398 if (!cb[1])
14399 goto nla_put_failure;
14400
14401 cb[2] = rdev;
14402
14403 return msg;
14404 nla_put_failure:
14405 nlmsg_free(msg);
14406 return NULL;
14407 }
14408
14409 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
14410 {
14411 void **cb = (void **)msg->cb;
14412 struct cfg80211_registered_device *rdev = cb[2];
14413
14414 nla_nest_end(msg, cb[1]);
14415 genlmsg_end(msg, cb[0]);
14416
14417 memset(msg->cb, 0, sizeof(msg->cb));
14418
14419 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14420 NL80211_MCGRP_MLME, gfp);
14421 }
14422
14423 void cfg80211_cqm_rssi_notify(struct net_device *dev,
14424 enum nl80211_cqm_rssi_threshold_event rssi_event,
14425 s32 rssi_level, gfp_t gfp)
14426 {
14427 struct sk_buff *msg;
14428 struct wireless_dev *wdev = dev->ieee80211_ptr;
14429 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14430
14431 trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
14432
14433 if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
14434 rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
14435 return;
14436
14437 if (wdev->cqm_config) {
14438 wdev->cqm_config->last_rssi_event_value = rssi_level;
14439
14440 cfg80211_cqm_rssi_update(rdev, dev);
14441
14442 if (rssi_level == 0)
14443 rssi_level = wdev->cqm_config->last_rssi_event_value;
14444 }
14445
14446 msg = cfg80211_prepare_cqm(dev, NULL, gfp);
14447 if (!msg)
14448 return;
14449
14450 if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
14451 rssi_event))
14452 goto nla_put_failure;
14453
14454 if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
14455 rssi_level))
14456 goto nla_put_failure;
14457
14458 cfg80211_send_cqm(msg, gfp);
14459
14460 return;
14461
14462 nla_put_failure:
14463 nlmsg_free(msg);
14464 }
14465 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
14466
14467 void cfg80211_cqm_txe_notify(struct net_device *dev,
14468 const u8 *peer, u32 num_packets,
14469 u32 rate, u32 intvl, gfp_t gfp)
14470 {
14471 struct sk_buff *msg;
14472
14473 msg = cfg80211_prepare_cqm(dev, peer, gfp);
14474 if (!msg)
14475 return;
14476
14477 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
14478 goto nla_put_failure;
14479
14480 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
14481 goto nla_put_failure;
14482
14483 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
14484 goto nla_put_failure;
14485
14486 cfg80211_send_cqm(msg, gfp);
14487 return;
14488
14489 nla_put_failure:
14490 nlmsg_free(msg);
14491 }
14492 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
14493
14494 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
14495 const u8 *peer, u32 num_packets, gfp_t gfp)
14496 {
14497 struct sk_buff *msg;
14498
14499 trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
14500
14501 msg = cfg80211_prepare_cqm(dev, peer, gfp);
14502 if (!msg)
14503 return;
14504
14505 if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
14506 goto nla_put_failure;
14507
14508 cfg80211_send_cqm(msg, gfp);
14509 return;
14510
14511 nla_put_failure:
14512 nlmsg_free(msg);
14513 }
14514 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
14515
14516 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
14517 {
14518 struct sk_buff *msg;
14519
14520 msg = cfg80211_prepare_cqm(dev, NULL, gfp);
14521 if (!msg)
14522 return;
14523
14524 if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
14525 goto nla_put_failure;
14526
14527 cfg80211_send_cqm(msg, gfp);
14528 return;
14529
14530 nla_put_failure:
14531 nlmsg_free(msg);
14532 }
14533 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
14534
14535 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
14536 struct net_device *netdev, const u8 *bssid,
14537 const u8 *replay_ctr, gfp_t gfp)
14538 {
14539 struct sk_buff *msg;
14540 struct nlattr *rekey_attr;
14541 void *hdr;
14542
14543 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14544 if (!msg)
14545 return;
14546
14547 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
14548 if (!hdr) {
14549 nlmsg_free(msg);
14550 return;
14551 }
14552
14553 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14554 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14555 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
14556 goto nla_put_failure;
14557
14558 rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
14559 if (!rekey_attr)
14560 goto nla_put_failure;
14561
14562 if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
14563 NL80211_REPLAY_CTR_LEN, replay_ctr))
14564 goto nla_put_failure;
14565
14566 nla_nest_end(msg, rekey_attr);
14567
14568 genlmsg_end(msg, hdr);
14569
14570 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14571 NL80211_MCGRP_MLME, gfp);
14572 return;
14573
14574 nla_put_failure:
14575 genlmsg_cancel(msg, hdr);
14576 nlmsg_free(msg);
14577 }
14578
14579 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
14580 const u8 *replay_ctr, gfp_t gfp)
14581 {
14582 struct wireless_dev *wdev = dev->ieee80211_ptr;
14583 struct wiphy *wiphy = wdev->wiphy;
14584 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14585
14586 trace_cfg80211_gtk_rekey_notify(dev, bssid);
14587 nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
14588 }
14589 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
14590
14591 static void
14592 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
14593 struct net_device *netdev, int index,
14594 const u8 *bssid, bool preauth, gfp_t gfp)
14595 {
14596 struct sk_buff *msg;
14597 struct nlattr *attr;
14598 void *hdr;
14599
14600 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14601 if (!msg)
14602 return;
14603
14604 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
14605 if (!hdr) {
14606 nlmsg_free(msg);
14607 return;
14608 }
14609
14610 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14611 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
14612 goto nla_put_failure;
14613
14614 attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
14615 if (!attr)
14616 goto nla_put_failure;
14617
14618 if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
14619 nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
14620 (preauth &&
14621 nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
14622 goto nla_put_failure;
14623
14624 nla_nest_end(msg, attr);
14625
14626 genlmsg_end(msg, hdr);
14627
14628 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14629 NL80211_MCGRP_MLME, gfp);
14630 return;
14631
14632 nla_put_failure:
14633 genlmsg_cancel(msg, hdr);
14634 nlmsg_free(msg);
14635 }
14636
14637 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
14638 const u8 *bssid, bool preauth, gfp_t gfp)
14639 {
14640 struct wireless_dev *wdev = dev->ieee80211_ptr;
14641 struct wiphy *wiphy = wdev->wiphy;
14642 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14643
14644 trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
14645 nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
14646 }
14647 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
14648
14649 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
14650 struct net_device *netdev,
14651 struct cfg80211_chan_def *chandef,
14652 gfp_t gfp,
14653 enum nl80211_commands notif,
14654 u8 count)
14655 {
14656 struct sk_buff *msg;
14657 void *hdr;
14658
14659 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14660 if (!msg)
14661 return;
14662
14663 hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
14664 if (!hdr) {
14665 nlmsg_free(msg);
14666 return;
14667 }
14668
14669 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
14670 goto nla_put_failure;
14671
14672 if (nl80211_send_chandef(msg, chandef))
14673 goto nla_put_failure;
14674
14675 if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) &&
14676 (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)))
14677 goto nla_put_failure;
14678
14679 genlmsg_end(msg, hdr);
14680
14681 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14682 NL80211_MCGRP_MLME, gfp);
14683 return;
14684
14685 nla_put_failure:
14686 genlmsg_cancel(msg, hdr);
14687 nlmsg_free(msg);
14688 }
14689
14690 void cfg80211_ch_switch_notify(struct net_device *dev,
14691 struct cfg80211_chan_def *chandef)
14692 {
14693 struct wireless_dev *wdev = dev->ieee80211_ptr;
14694 struct wiphy *wiphy = wdev->wiphy;
14695 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14696
14697 ASSERT_WDEV_LOCK(wdev);
14698
14699 trace_cfg80211_ch_switch_notify(dev, chandef);
14700
14701 wdev->chandef = *chandef;
14702 wdev->preset_chandef = *chandef;
14703 nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
14704 NL80211_CMD_CH_SWITCH_NOTIFY, 0);
14705 }
14706 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
14707
14708 void cfg80211_ch_switch_started_notify(struct net_device *dev,
14709 struct cfg80211_chan_def *chandef,
14710 u8 count)
14711 {
14712 struct wireless_dev *wdev = dev->ieee80211_ptr;
14713 struct wiphy *wiphy = wdev->wiphy;
14714 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14715
14716 trace_cfg80211_ch_switch_started_notify(dev, chandef);
14717
14718 nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
14719 NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count);
14720 }
14721 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
14722
14723 void
14724 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
14725 const struct cfg80211_chan_def *chandef,
14726 enum nl80211_radar_event event,
14727 struct net_device *netdev, gfp_t gfp)
14728 {
14729 struct sk_buff *msg;
14730 void *hdr;
14731
14732 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14733 if (!msg)
14734 return;
14735
14736 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
14737 if (!hdr) {
14738 nlmsg_free(msg);
14739 return;
14740 }
14741
14742 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
14743 goto nla_put_failure;
14744
14745 /* NOP and radar events don't need a netdev parameter */
14746 if (netdev) {
14747 struct wireless_dev *wdev = netdev->ieee80211_ptr;
14748
14749 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14750 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14751 NL80211_ATTR_PAD))
14752 goto nla_put_failure;
14753 }
14754
14755 if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
14756 goto nla_put_failure;
14757
14758 if (nl80211_send_chandef(msg, chandef))
14759 goto nla_put_failure;
14760
14761 genlmsg_end(msg, hdr);
14762
14763 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14764 NL80211_MCGRP_MLME, gfp);
14765 return;
14766
14767 nla_put_failure:
14768 genlmsg_cancel(msg, hdr);
14769 nlmsg_free(msg);
14770 }
14771
14772 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
14773 u64 cookie, bool acked, gfp_t gfp)
14774 {
14775 struct wireless_dev *wdev = dev->ieee80211_ptr;
14776 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14777 struct sk_buff *msg;
14778 void *hdr;
14779
14780 trace_cfg80211_probe_status(dev, addr, cookie, acked);
14781
14782 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14783
14784 if (!msg)
14785 return;
14786
14787 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
14788 if (!hdr) {
14789 nlmsg_free(msg);
14790 return;
14791 }
14792
14793 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14794 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14795 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
14796 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14797 NL80211_ATTR_PAD) ||
14798 (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
14799 goto nla_put_failure;
14800
14801 genlmsg_end(msg, hdr);
14802
14803 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14804 NL80211_MCGRP_MLME, gfp);
14805 return;
14806
14807 nla_put_failure:
14808 genlmsg_cancel(msg, hdr);
14809 nlmsg_free(msg);
14810 }
14811 EXPORT_SYMBOL(cfg80211_probe_status);
14812
14813 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
14814 const u8 *frame, size_t len,
14815 int freq, int sig_dbm)
14816 {
14817 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14818 struct sk_buff *msg;
14819 void *hdr;
14820 struct cfg80211_beacon_registration *reg;
14821
14822 trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
14823
14824 spin_lock_bh(&rdev->beacon_registrations_lock);
14825 list_for_each_entry(reg, &rdev->beacon_registrations, list) {
14826 msg = nlmsg_new(len + 100, GFP_ATOMIC);
14827 if (!msg) {
14828 spin_unlock_bh(&rdev->beacon_registrations_lock);
14829 return;
14830 }
14831
14832 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
14833 if (!hdr)
14834 goto nla_put_failure;
14835
14836 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14837 (freq &&
14838 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
14839 (sig_dbm &&
14840 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
14841 nla_put(msg, NL80211_ATTR_FRAME, len, frame))
14842 goto nla_put_failure;
14843
14844 genlmsg_end(msg, hdr);
14845
14846 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
14847 }
14848 spin_unlock_bh(&rdev->beacon_registrations_lock);
14849 return;
14850
14851 nla_put_failure:
14852 spin_unlock_bh(&rdev->beacon_registrations_lock);
14853 if (hdr)
14854 genlmsg_cancel(msg, hdr);
14855 nlmsg_free(msg);
14856 }
14857 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
14858
14859 #ifdef CONFIG_PM
14860 static int cfg80211_net_detect_results(struct sk_buff *msg,
14861 struct cfg80211_wowlan_wakeup *wakeup)
14862 {
14863 struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
14864 struct nlattr *nl_results, *nl_match, *nl_freqs;
14865 int i, j;
14866
14867 nl_results = nla_nest_start(
14868 msg, NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
14869 if (!nl_results)
14870 return -EMSGSIZE;
14871
14872 for (i = 0; i < nd->n_matches; i++) {
14873 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
14874
14875 nl_match = nla_nest_start(msg, i);
14876 if (!nl_match)
14877 break;
14878
14879 /* The SSID attribute is optional in nl80211, but for
14880 * simplicity reasons it's always present in the
14881 * cfg80211 structure. If a driver can't pass the
14882 * SSID, that needs to be changed. A zero length SSID
14883 * is still a valid SSID (wildcard), so it cannot be
14884 * used for this purpose.
14885 */
14886 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
14887 match->ssid.ssid)) {
14888 nla_nest_cancel(msg, nl_match);
14889 goto out;
14890 }
14891
14892 if (match->n_channels) {
14893 nl_freqs = nla_nest_start(
14894 msg, NL80211_ATTR_SCAN_FREQUENCIES);
14895 if (!nl_freqs) {
14896 nla_nest_cancel(msg, nl_match);
14897 goto out;
14898 }
14899
14900 for (j = 0; j < match->n_channels; j++) {
14901 if (nla_put_u32(msg, j, match->channels[j])) {
14902 nla_nest_cancel(msg, nl_freqs);
14903 nla_nest_cancel(msg, nl_match);
14904 goto out;
14905 }
14906 }
14907
14908 nla_nest_end(msg, nl_freqs);
14909 }
14910
14911 nla_nest_end(msg, nl_match);
14912 }
14913
14914 out:
14915 nla_nest_end(msg, nl_results);
14916 return 0;
14917 }
14918
14919 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
14920 struct cfg80211_wowlan_wakeup *wakeup,
14921 gfp_t gfp)
14922 {
14923 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14924 struct sk_buff *msg;
14925 void *hdr;
14926 int size = 200;
14927
14928 trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
14929
14930 if (wakeup)
14931 size += wakeup->packet_present_len;
14932
14933 msg = nlmsg_new(size, gfp);
14934 if (!msg)
14935 return;
14936
14937 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
14938 if (!hdr)
14939 goto free_msg;
14940
14941 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14942 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14943 NL80211_ATTR_PAD))
14944 goto free_msg;
14945
14946 if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14947 wdev->netdev->ifindex))
14948 goto free_msg;
14949
14950 if (wakeup) {
14951 struct nlattr *reasons;
14952
14953 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
14954 if (!reasons)
14955 goto free_msg;
14956
14957 if (wakeup->disconnect &&
14958 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
14959 goto free_msg;
14960 if (wakeup->magic_pkt &&
14961 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
14962 goto free_msg;
14963 if (wakeup->gtk_rekey_failure &&
14964 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
14965 goto free_msg;
14966 if (wakeup->eap_identity_req &&
14967 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
14968 goto free_msg;
14969 if (wakeup->four_way_handshake &&
14970 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
14971 goto free_msg;
14972 if (wakeup->rfkill_release &&
14973 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
14974 goto free_msg;
14975
14976 if (wakeup->pattern_idx >= 0 &&
14977 nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
14978 wakeup->pattern_idx))
14979 goto free_msg;
14980
14981 if (wakeup->tcp_match &&
14982 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
14983 goto free_msg;
14984
14985 if (wakeup->tcp_connlost &&
14986 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
14987 goto free_msg;
14988
14989 if (wakeup->tcp_nomoretokens &&
14990 nla_put_flag(msg,
14991 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
14992 goto free_msg;
14993
14994 if (wakeup->packet) {
14995 u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
14996 u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
14997
14998 if (!wakeup->packet_80211) {
14999 pkt_attr =
15000 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
15001 len_attr =
15002 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
15003 }
15004
15005 if (wakeup->packet_len &&
15006 nla_put_u32(msg, len_attr, wakeup->packet_len))
15007 goto free_msg;
15008
15009 if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
15010 wakeup->packet))
15011 goto free_msg;
15012 }
15013
15014 if (wakeup->net_detect &&
15015 cfg80211_net_detect_results(msg, wakeup))
15016 goto free_msg;
15017
15018 nla_nest_end(msg, reasons);
15019 }
15020
15021 genlmsg_end(msg, hdr);
15022
15023 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15024 NL80211_MCGRP_MLME, gfp);
15025 return;
15026
15027 free_msg:
15028 nlmsg_free(msg);
15029 }
15030 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
15031 #endif
15032
15033 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
15034 enum nl80211_tdls_operation oper,
15035 u16 reason_code, gfp_t gfp)
15036 {
15037 struct wireless_dev *wdev = dev->ieee80211_ptr;
15038 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15039 struct sk_buff *msg;
15040 void *hdr;
15041
15042 trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
15043 reason_code);
15044
15045 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15046 if (!msg)
15047 return;
15048
15049 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
15050 if (!hdr) {
15051 nlmsg_free(msg);
15052 return;
15053 }
15054
15055 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15056 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15057 nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
15058 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
15059 (reason_code > 0 &&
15060 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
15061 goto nla_put_failure;
15062
15063 genlmsg_end(msg, hdr);
15064
15065 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15066 NL80211_MCGRP_MLME, gfp);
15067 return;
15068
15069 nla_put_failure:
15070 genlmsg_cancel(msg, hdr);
15071 nlmsg_free(msg);
15072 }
15073 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
15074
15075 static int nl80211_netlink_notify(struct notifier_block * nb,
15076 unsigned long state,
15077 void *_notify)
15078 {
15079 struct netlink_notify *notify = _notify;
15080 struct cfg80211_registered_device *rdev;
15081 struct wireless_dev *wdev;
15082 struct cfg80211_beacon_registration *reg, *tmp;
15083
15084 if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
15085 return NOTIFY_DONE;
15086
15087 rcu_read_lock();
15088
15089 list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
15090 struct cfg80211_sched_scan_request *sched_scan_req;
15091
15092 list_for_each_entry_rcu(sched_scan_req,
15093 &rdev->sched_scan_req_list,
15094 list) {
15095 if (sched_scan_req->owner_nlportid == notify->portid) {
15096 sched_scan_req->nl_owner_dead = true;
15097 schedule_work(&rdev->sched_scan_stop_wk);
15098 }
15099 }
15100
15101 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
15102 cfg80211_mlme_unregister_socket(wdev, notify->portid);
15103
15104 if (wdev->owner_nlportid == notify->portid) {
15105 wdev->nl_owner_dead = true;
15106 schedule_work(&rdev->destroy_work);
15107 } else if (wdev->conn_owner_nlportid == notify->portid) {
15108 schedule_work(&wdev->disconnect_wk);
15109 }
15110 }
15111
15112 spin_lock_bh(&rdev->beacon_registrations_lock);
15113 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
15114 list) {
15115 if (reg->nlportid == notify->portid) {
15116 list_del(&reg->list);
15117 kfree(reg);
15118 break;
15119 }
15120 }
15121 spin_unlock_bh(&rdev->beacon_registrations_lock);
15122 }
15123
15124 rcu_read_unlock();
15125
15126 /*
15127 * It is possible that the user space process that is controlling the
15128 * indoor setting disappeared, so notify the regulatory core.
15129 */
15130 regulatory_netlink_notify(notify->portid);
15131 return NOTIFY_OK;
15132 }
15133
15134 static struct notifier_block nl80211_netlink_notifier = {
15135 .notifier_call = nl80211_netlink_notify,
15136 };
15137
15138 void cfg80211_ft_event(struct net_device *netdev,
15139 struct cfg80211_ft_event_params *ft_event)
15140 {
15141 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
15142 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15143 struct sk_buff *msg;
15144 void *hdr;
15145
15146 trace_cfg80211_ft_event(wiphy, netdev, ft_event);
15147
15148 if (!ft_event->target_ap)
15149 return;
15150
15151 msg = nlmsg_new(100 + ft_event->ric_ies_len, GFP_KERNEL);
15152 if (!msg)
15153 return;
15154
15155 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
15156 if (!hdr)
15157 goto out;
15158
15159 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15160 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15161 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
15162 goto out;
15163
15164 if (ft_event->ies &&
15165 nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
15166 goto out;
15167 if (ft_event->ric_ies &&
15168 nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
15169 ft_event->ric_ies))
15170 goto out;
15171
15172 genlmsg_end(msg, hdr);
15173
15174 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15175 NL80211_MCGRP_MLME, GFP_KERNEL);
15176 return;
15177 out:
15178 nlmsg_free(msg);
15179 }
15180 EXPORT_SYMBOL(cfg80211_ft_event);
15181
15182 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
15183 {
15184 struct cfg80211_registered_device *rdev;
15185 struct sk_buff *msg;
15186 void *hdr;
15187 u32 nlportid;
15188
15189 rdev = wiphy_to_rdev(wdev->wiphy);
15190 if (!rdev->crit_proto_nlportid)
15191 return;
15192
15193 nlportid = rdev->crit_proto_nlportid;
15194 rdev->crit_proto_nlportid = 0;
15195
15196 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15197 if (!msg)
15198 return;
15199
15200 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
15201 if (!hdr)
15202 goto nla_put_failure;
15203
15204 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15205 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15206 NL80211_ATTR_PAD))
15207 goto nla_put_failure;
15208
15209 genlmsg_end(msg, hdr);
15210
15211 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
15212 return;
15213
15214 nla_put_failure:
15215 if (hdr)
15216 genlmsg_cancel(msg, hdr);
15217 nlmsg_free(msg);
15218 }
15219 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
15220
15221 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
15222 {
15223 struct wiphy *wiphy = wdev->wiphy;
15224 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15225 struct sk_buff *msg;
15226 void *hdr;
15227
15228 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15229 if (!msg)
15230 return;
15231
15232 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
15233 if (!hdr)
15234 goto out;
15235
15236 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15237 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
15238 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15239 NL80211_ATTR_PAD))
15240 goto out;
15241
15242 genlmsg_end(msg, hdr);
15243
15244 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
15245 NL80211_MCGRP_MLME, GFP_KERNEL);
15246 return;
15247 out:
15248 nlmsg_free(msg);
15249 }
15250
15251 /* initialisation/exit functions */
15252
15253 int __init nl80211_init(void)
15254 {
15255 int err;
15256
15257 err = genl_register_family(&nl80211_fam);
15258 if (err)
15259 return err;
15260
15261 err = netlink_register_notifier(&nl80211_netlink_notifier);
15262 if (err)
15263 goto err_out;
15264
15265 return 0;
15266 err_out:
15267 genl_unregister_family(&nl80211_fam);
15268 return err;
15269 }
15270
15271 void nl80211_exit(void)
15272 {
15273 netlink_unregister_notifier(&nl80211_netlink_notifier);
15274 genl_unregister_family(&nl80211_fam);
15275 }
Linux with added FPC-III support