1 /*
2 * This is the new netlink-based wireless configuration interface.
3 *
4 * Copyright 2006-2010 Johannes Berg <johannes@sipsolutions.net>
5 * Copyright 2013-2014 Intel Mobile Communications GmbH
6 * Copyright 2015-2016 Intel Deutschland GmbH
7 */
8
9 #include <linux/if.h>
10 #include <linux/module.h>
11 #include <linux/err.h>
12 #include <linux/slab.h>
13 #include <linux/list.h>
14 #include <linux/if_ether.h>
15 #include <linux/ieee80211.h>
16 #include <linux/nl80211.h>
17 #include <linux/rtnetlink.h>
18 #include <linux/netlink.h>
19 #include <linux/nospec.h>
20 #include <linux/etherdevice.h>
21 #include <net/net_namespace.h>
22 #include <net/genetlink.h>
23 #include <net/cfg80211.h>
24 #include <net/sock.h>
25 #include <net/inet_connection_sock.h>
26 #include "core.h"
27 #include "nl80211.h"
28 #include "reg.h"
29 #include "rdev-ops.h"
30
31 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
32 struct genl_info *info,
33 struct cfg80211_crypto_settings *settings,
34 int cipher_limit);
35
36 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
37 struct genl_info *info);
38 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
39 struct genl_info *info);
40
41 /* the netlink family */
42 static struct genl_family nl80211_fam = {
43 .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
44 .name = NL80211_GENL_NAME, /* have users key off the name instead */
45 .hdrsize = 0, /* no private header */
46 .version = 1, /* no particular meaning now */
47 .maxattr = NL80211_ATTR_MAX,
48 .netnsok = true,
49 .pre_doit = nl80211_pre_doit,
50 .post_doit = nl80211_post_doit,
51 };
52
53 /* multicast groups */
54 enum nl80211_multicast_groups {
55 NL80211_MCGRP_CONFIG,
56 NL80211_MCGRP_SCAN,
57 NL80211_MCGRP_REGULATORY,
58 NL80211_MCGRP_MLME,
59 NL80211_MCGRP_VENDOR,
60 NL80211_MCGRP_NAN,
61 NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
62 };
63
64 static const struct genl_multicast_group nl80211_mcgrps[] = {
65 [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
66 [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
67 [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
68 [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
69 [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
70 [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
71 #ifdef CONFIG_NL80211_TESTMODE
72 [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
73 #endif
74 };
75
76 /* returns ERR_PTR values */
77 static struct wireless_dev *
__cfg80211_wdev_from_attrs(struct net * netns,struct nlattr ** attrs)78 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
79 {
80 struct cfg80211_registered_device *rdev;
81 struct wireless_dev *result = NULL;
82 bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
83 bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
84 u64 wdev_id;
85 int wiphy_idx = -1;
86 int ifidx = -1;
87
88 ASSERT_RTNL();
89
90 if (!have_ifidx && !have_wdev_id)
91 return ERR_PTR(-EINVAL);
92
93 if (have_ifidx)
94 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
95 if (have_wdev_id) {
96 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
97 wiphy_idx = wdev_id >> 32;
98 }
99
100 list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
101 struct wireless_dev *wdev;
102
103 if (wiphy_net(&rdev->wiphy) != netns)
104 continue;
105
106 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
107 continue;
108
109 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
110 if (have_ifidx && wdev->netdev &&
111 wdev->netdev->ifindex == ifidx) {
112 result = wdev;
113 break;
114 }
115 if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
116 result = wdev;
117 break;
118 }
119 }
120
121 if (result)
122 break;
123 }
124
125 if (result)
126 return result;
127 return ERR_PTR(-ENODEV);
128 }
129
130 static struct cfg80211_registered_device *
__cfg80211_rdev_from_attrs(struct net * netns,struct nlattr ** attrs)131 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
132 {
133 struct cfg80211_registered_device *rdev = NULL, *tmp;
134 struct net_device *netdev;
135
136 ASSERT_RTNL();
137
138 if (!attrs[NL80211_ATTR_WIPHY] &&
139 !attrs[NL80211_ATTR_IFINDEX] &&
140 !attrs[NL80211_ATTR_WDEV])
141 return ERR_PTR(-EINVAL);
142
143 if (attrs[NL80211_ATTR_WIPHY])
144 rdev = cfg80211_rdev_by_wiphy_idx(
145 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
146
147 if (attrs[NL80211_ATTR_WDEV]) {
148 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
149 struct wireless_dev *wdev;
150 bool found = false;
151
152 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
153 if (tmp) {
154 /* make sure wdev exists */
155 list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
156 if (wdev->identifier != (u32)wdev_id)
157 continue;
158 found = true;
159 break;
160 }
161
162 if (!found)
163 tmp = NULL;
164
165 if (rdev && tmp != rdev)
166 return ERR_PTR(-EINVAL);
167 rdev = tmp;
168 }
169 }
170
171 if (attrs[NL80211_ATTR_IFINDEX]) {
172 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
173
174 netdev = __dev_get_by_index(netns, ifindex);
175 if (netdev) {
176 if (netdev->ieee80211_ptr)
177 tmp = wiphy_to_rdev(
178 netdev->ieee80211_ptr->wiphy);
179 else
180 tmp = NULL;
181
182 /* not wireless device -- return error */
183 if (!tmp)
184 return ERR_PTR(-EINVAL);
185
186 /* mismatch -- return error */
187 if (rdev && tmp != rdev)
188 return ERR_PTR(-EINVAL);
189
190 rdev = tmp;
191 }
192 }
193
194 if (!rdev)
195 return ERR_PTR(-ENODEV);
196
197 if (netns != wiphy_net(&rdev->wiphy))
198 return ERR_PTR(-ENODEV);
199
200 return rdev;
201 }
202
203 /*
204 * This function returns a pointer to the driver
205 * that the genl_info item that is passed refers to.
206 *
207 * The result of this can be a PTR_ERR and hence must
208 * be checked with IS_ERR() for errors.
209 */
210 static struct cfg80211_registered_device *
cfg80211_get_dev_from_info(struct net * netns,struct genl_info * info)211 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
212 {
213 return __cfg80211_rdev_from_attrs(netns, info->attrs);
214 }
215
216 /* policy for the attributes */
217 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
218 [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
219 [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
220 .len = 20-1 },
221 [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
222
223 [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
224 [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
225 [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
226 [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
227 [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
228
229 [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
230 [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
231 [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
232 [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
233 [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
234 [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
235
236 [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
237 [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
238 [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
239
240 [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
241 [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
242
243 [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
244 [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
245 .len = WLAN_MAX_KEY_LEN },
246 [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
247 [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
248 [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
249 [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
250 [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
251
252 [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
253 [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
254 [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
255 .len = IEEE80211_MAX_DATA_LEN },
256 [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
257 .len = IEEE80211_MAX_DATA_LEN },
258 [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
259 [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
260 [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
261 [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
262 .len = NL80211_MAX_SUPP_RATES },
263 [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
264 [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
265 [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
266 [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
267 .len = IEEE80211_MAX_MESH_ID_LEN },
268 [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
269
270 [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
271 [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
272
273 [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
274 [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
275 [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
276 [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
277 .len = NL80211_MAX_SUPP_RATES },
278 [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
279
280 [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
281 [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
282
283 [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
284
285 [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
286 [NL80211_ATTR_IE] = { .type = NLA_BINARY,
287 .len = IEEE80211_MAX_DATA_LEN },
288 [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
289 [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
290
291 [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
292 .len = IEEE80211_MAX_SSID_LEN },
293 [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
294 [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
295 [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
296 [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
297 [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
298 [NL80211_ATTR_STA_FLAGS2] = {
299 .len = sizeof(struct nl80211_sta_flag_update),
300 },
301 [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
302 [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
303 [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
304 [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
305 [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
306 [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
307 [NL80211_ATTR_PID] = { .type = NLA_U32 },
308 [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
309 [NL80211_ATTR_PMKID] = { .len = WLAN_PMKID_LEN },
310 [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
311 [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
312 [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
313 [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
314 .len = IEEE80211_MAX_DATA_LEN },
315 [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
316 [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
317 [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
318 [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
319 [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
320 [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
321 [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
322 [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
323 [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
324 [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
325 [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
326 [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
327 [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
328 [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
329 [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
330 [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
331 [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
332 [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
333 [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
334 [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
335 .len = IEEE80211_MAX_DATA_LEN },
336 [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
337 .len = IEEE80211_MAX_DATA_LEN },
338 [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
339 [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
340 [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
341 [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
342 [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
343 [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
344 [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
345 [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
346 [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
347 [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
348 [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
349 .len = IEEE80211_MAX_DATA_LEN },
350 [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
351 [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
352 [NL80211_ATTR_HT_CAPABILITY_MASK] = {
353 .len = NL80211_HT_CAPABILITY_LEN
354 },
355 [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
356 [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
357 [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
358 [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
359 [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
360 [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
361 [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
362 [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
363 [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
364 [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
365 [NL80211_ATTR_LOCAL_MESH_POWER_MODE] = {. type = NLA_U32 },
366 [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
367 [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
368 [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
369 [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
370 [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
371 [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
372 [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
373 .len = NL80211_VHT_CAPABILITY_LEN,
374 },
375 [NL80211_ATTR_MDID] = { .type = NLA_U16 },
376 [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
377 .len = IEEE80211_MAX_DATA_LEN },
378 [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
379 [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
380 [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
381 [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
382 [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
383 [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
384 [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
385 [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
386 [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
387 [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
388 [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
389 [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
390 [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
391 [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
392 .len = IEEE80211_QOS_MAP_LEN_MAX },
393 [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
394 [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
395 [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
396 [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
397 [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
398 [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
399 [NL80211_ATTR_TSID] = { .type = NLA_U8 },
400 [NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 },
401 [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
402 [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
403 [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN },
404 [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
405 [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
406 [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
407 [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
408 [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
409 [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
410 [NL80211_ATTR_STA_SUPPORT_P2P_PS] = { .type = NLA_U8 },
411 [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
412 .len = VHT_MUMIMO_GROUPS_DATA_LEN
413 },
414 [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = { .len = ETH_ALEN },
415 [NL80211_ATTR_NAN_MASTER_PREF] = { .type = NLA_U8 },
416 [NL80211_ATTR_NAN_DUAL] = { .type = NLA_U8 },
417 [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
418 [NL80211_ATTR_BSSID] = { .len = ETH_ALEN },
419 };
420
421 /* policy for the key attributes */
422 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
423 [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
424 [NL80211_KEY_IDX] = { .type = NLA_U8 },
425 [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
426 [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
427 [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
428 [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
429 [NL80211_KEY_TYPE] = { .type = NLA_U32 },
430 [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
431 };
432
433 /* policy for the key default flags */
434 static const struct nla_policy
435 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
436 [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
437 [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
438 };
439
440 /* policy for WoWLAN attributes */
441 static const struct nla_policy
442 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
443 [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
444 [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
445 [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
446 [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
447 [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
448 [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
449 [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
450 [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
451 [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
452 [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
453 };
454
455 static const struct nla_policy
456 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
457 [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
458 [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
459 [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
460 [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
461 [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
462 [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
463 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
464 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
465 },
466 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
467 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
468 },
469 [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
470 [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
471 [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
472 };
473
474 /* policy for coalesce rule attributes */
475 static const struct nla_policy
476 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
477 [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
478 [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
479 [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
480 };
481
482 /* policy for GTK rekey offload attributes */
483 static const struct nla_policy
484 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
485 [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
486 [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
487 [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
488 };
489
490 static const struct nla_policy
491 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
492 [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
493 .len = IEEE80211_MAX_SSID_LEN },
494 [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
495 };
496
497 static const struct nla_policy
498 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
499 [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
500 [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
501 };
502
503 static const struct nla_policy
504 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
505 [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
506 [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
507 [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
508 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
509 },
510 };
511
512 /* policy for NAN function attributes */
513 static const struct nla_policy
514 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
515 [NL80211_NAN_FUNC_TYPE] = { .type = NLA_U8 },
516 [NL80211_NAN_FUNC_SERVICE_ID] = {
517 .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
518 [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
519 [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
520 [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
521 [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
522 [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
523 [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = { .len = ETH_ALEN },
524 [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
525 [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
526 [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
527 .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
528 [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
529 [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
530 [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
531 [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
532 [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
533 };
534
535 /* policy for Service Response Filter attributes */
536 static const struct nla_policy
537 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
538 [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
539 [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
540 .len = NL80211_NAN_FUNC_SRF_MAX_LEN },
541 [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
542 [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
543 };
544
545 /* policy for packet pattern attributes */
546 static const struct nla_policy
547 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
548 [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
549 [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
550 [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
551 };
552
nl80211_prepare_wdev_dump(struct sk_buff * skb,struct netlink_callback * cb,struct cfg80211_registered_device ** rdev,struct wireless_dev ** wdev)553 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
554 struct netlink_callback *cb,
555 struct cfg80211_registered_device **rdev,
556 struct wireless_dev **wdev)
557 {
558 int err;
559
560 if (!cb->args[0]) {
561 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
562 nl80211_fam.attrbuf, nl80211_fam.maxattr,
563 nl80211_policy);
564 if (err)
565 return err;
566
567 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
568 nl80211_fam.attrbuf);
569 if (IS_ERR(*wdev))
570 return PTR_ERR(*wdev);
571 *rdev = wiphy_to_rdev((*wdev)->wiphy);
572 /* 0 is the first index - add 1 to parse only once */
573 cb->args[0] = (*rdev)->wiphy_idx + 1;
574 cb->args[1] = (*wdev)->identifier;
575 } else {
576 /* subtract the 1 again here */
577 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
578 struct wireless_dev *tmp;
579
580 if (!wiphy)
581 return -ENODEV;
582 *rdev = wiphy_to_rdev(wiphy);
583 *wdev = NULL;
584
585 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
586 if (tmp->identifier == cb->args[1]) {
587 *wdev = tmp;
588 break;
589 }
590 }
591
592 if (!*wdev)
593 return -ENODEV;
594 }
595
596 return 0;
597 }
598
599 /* IE validation */
is_valid_ie_attr(const struct nlattr * attr)600 static bool is_valid_ie_attr(const struct nlattr *attr)
601 {
602 const u8 *pos;
603 int len;
604
605 if (!attr)
606 return true;
607
608 pos = nla_data(attr);
609 len = nla_len(attr);
610
611 while (len) {
612 u8 elemlen;
613
614 if (len < 2)
615 return false;
616 len -= 2;
617
618 elemlen = pos[1];
619 if (elemlen > len)
620 return false;
621
622 len -= elemlen;
623 pos += 2 + elemlen;
624 }
625
626 return true;
627 }
628
629 /* message building helper */
nl80211hdr_put(struct sk_buff * skb,u32 portid,u32 seq,int flags,u8 cmd)630 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
631 int flags, u8 cmd)
632 {
633 /* since there is no private header just add the generic one */
634 return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
635 }
636
nl80211_msg_put_channel(struct sk_buff * msg,struct ieee80211_channel * chan,bool large)637 static int nl80211_msg_put_channel(struct sk_buff *msg,
638 struct ieee80211_channel *chan,
639 bool large)
640 {
641 /* Some channels must be completely excluded from the
642 * list to protect old user-space tools from breaking
643 */
644 if (!large && chan->flags &
645 (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
646 return 0;
647
648 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
649 chan->center_freq))
650 goto nla_put_failure;
651
652 if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
653 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
654 goto nla_put_failure;
655 if (chan->flags & IEEE80211_CHAN_NO_IR) {
656 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
657 goto nla_put_failure;
658 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
659 goto nla_put_failure;
660 }
661 if (chan->flags & IEEE80211_CHAN_RADAR) {
662 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
663 goto nla_put_failure;
664 if (large) {
665 u32 time;
666
667 time = elapsed_jiffies_msecs(chan->dfs_state_entered);
668
669 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
670 chan->dfs_state))
671 goto nla_put_failure;
672 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
673 time))
674 goto nla_put_failure;
675 if (nla_put_u32(msg,
676 NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
677 chan->dfs_cac_ms))
678 goto nla_put_failure;
679 }
680 }
681
682 if (large) {
683 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
684 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
685 goto nla_put_failure;
686 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
687 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
688 goto nla_put_failure;
689 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
690 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
691 goto nla_put_failure;
692 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
693 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
694 goto nla_put_failure;
695 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
696 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
697 goto nla_put_failure;
698 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
699 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
700 goto nla_put_failure;
701 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
702 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
703 goto nla_put_failure;
704 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
705 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
706 goto nla_put_failure;
707 }
708
709 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
710 DBM_TO_MBM(chan->max_power)))
711 goto nla_put_failure;
712
713 return 0;
714
715 nla_put_failure:
716 return -ENOBUFS;
717 }
718
719 /* netlink command implementations */
720
721 struct key_parse {
722 struct key_params p;
723 int idx;
724 int type;
725 bool def, defmgmt;
726 bool def_uni, def_multi;
727 };
728
nl80211_parse_key_new(struct nlattr * key,struct key_parse * k)729 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
730 {
731 struct nlattr *tb[NL80211_KEY_MAX + 1];
732 int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
733 nl80211_key_policy);
734 if (err)
735 return err;
736
737 k->def = !!tb[NL80211_KEY_DEFAULT];
738 k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
739
740 if (k->def) {
741 k->def_uni = true;
742 k->def_multi = true;
743 }
744 if (k->defmgmt)
745 k->def_multi = true;
746
747 if (tb[NL80211_KEY_IDX])
748 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
749
750 if (tb[NL80211_KEY_DATA]) {
751 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
752 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
753 }
754
755 if (tb[NL80211_KEY_SEQ]) {
756 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
757 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
758 }
759
760 if (tb[NL80211_KEY_CIPHER])
761 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
762
763 if (tb[NL80211_KEY_TYPE]) {
764 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
765 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
766 return -EINVAL;
767 }
768
769 if (tb[NL80211_KEY_DEFAULT_TYPES]) {
770 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
771
772 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
773 tb[NL80211_KEY_DEFAULT_TYPES],
774 nl80211_key_default_policy);
775 if (err)
776 return err;
777
778 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
779 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
780 }
781
782 return 0;
783 }
784
nl80211_parse_key_old(struct genl_info * info,struct key_parse * k)785 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
786 {
787 if (info->attrs[NL80211_ATTR_KEY_DATA]) {
788 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
789 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
790 }
791
792 if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
793 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
794 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
795 }
796
797 if (info->attrs[NL80211_ATTR_KEY_IDX])
798 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
799
800 if (info->attrs[NL80211_ATTR_KEY_CIPHER])
801 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
802
803 k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
804 k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
805
806 if (k->def) {
807 k->def_uni = true;
808 k->def_multi = true;
809 }
810 if (k->defmgmt)
811 k->def_multi = true;
812
813 if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
814 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
815 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
816 return -EINVAL;
817 }
818
819 if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
820 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
821 int err = nla_parse_nested(
822 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
823 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
824 nl80211_key_default_policy);
825 if (err)
826 return err;
827
828 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
829 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
830 }
831
832 return 0;
833 }
834
nl80211_parse_key(struct genl_info * info,struct key_parse * k)835 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
836 {
837 int err;
838
839 memset(k, 0, sizeof(*k));
840 k->idx = -1;
841 k->type = -1;
842
843 if (info->attrs[NL80211_ATTR_KEY])
844 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
845 else
846 err = nl80211_parse_key_old(info, k);
847
848 if (err)
849 return err;
850
851 if (k->def && k->defmgmt)
852 return -EINVAL;
853
854 if (k->defmgmt) {
855 if (k->def_uni || !k->def_multi)
856 return -EINVAL;
857 }
858
859 if (k->idx != -1) {
860 if (k->defmgmt) {
861 if (k->idx < 4 || k->idx > 5)
862 return -EINVAL;
863 } else if (k->def) {
864 if (k->idx < 0 || k->idx > 3)
865 return -EINVAL;
866 } else {
867 if (k->idx < 0 || k->idx > 5)
868 return -EINVAL;
869 }
870 }
871
872 return 0;
873 }
874
875 static struct cfg80211_cached_keys *
nl80211_parse_connkeys(struct cfg80211_registered_device * rdev,struct nlattr * keys,bool * no_ht)876 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
877 struct nlattr *keys, bool *no_ht)
878 {
879 struct key_parse parse;
880 struct nlattr *key;
881 struct cfg80211_cached_keys *result;
882 int rem, err, def = 0;
883 bool have_key = false;
884
885 nla_for_each_nested(key, keys, rem) {
886 have_key = true;
887 break;
888 }
889
890 if (!have_key)
891 return NULL;
892
893 result = kzalloc(sizeof(*result), GFP_KERNEL);
894 if (!result)
895 return ERR_PTR(-ENOMEM);
896
897 result->def = -1;
898
899 nla_for_each_nested(key, keys, rem) {
900 memset(&parse, 0, sizeof(parse));
901 parse.idx = -1;
902
903 err = nl80211_parse_key_new(key, &parse);
904 if (err)
905 goto error;
906 err = -EINVAL;
907 if (!parse.p.key)
908 goto error;
909 if (parse.idx < 0 || parse.idx > 3)
910 goto error;
911 if (parse.def) {
912 if (def)
913 goto error;
914 def = 1;
915 result->def = parse.idx;
916 if (!parse.def_uni || !parse.def_multi)
917 goto error;
918 } else if (parse.defmgmt)
919 goto error;
920 err = cfg80211_validate_key_settings(rdev, &parse.p,
921 parse.idx, false, NULL);
922 if (err)
923 goto error;
924 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
925 parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
926 err = -EINVAL;
927 goto error;
928 }
929 result->params[parse.idx].cipher = parse.p.cipher;
930 result->params[parse.idx].key_len = parse.p.key_len;
931 result->params[parse.idx].key = result->data[parse.idx];
932 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
933
934 /* must be WEP key if we got here */
935 if (no_ht)
936 *no_ht = true;
937 }
938
939 if (result->def < 0) {
940 err = -EINVAL;
941 goto error;
942 }
943
944 return result;
945 error:
946 kfree(result);
947 return ERR_PTR(err);
948 }
949
nl80211_key_allowed(struct wireless_dev * wdev)950 static int nl80211_key_allowed(struct wireless_dev *wdev)
951 {
952 ASSERT_WDEV_LOCK(wdev);
953
954 switch (wdev->iftype) {
955 case NL80211_IFTYPE_AP:
956 case NL80211_IFTYPE_AP_VLAN:
957 case NL80211_IFTYPE_P2P_GO:
958 case NL80211_IFTYPE_MESH_POINT:
959 break;
960 case NL80211_IFTYPE_ADHOC:
961 case NL80211_IFTYPE_STATION:
962 case NL80211_IFTYPE_P2P_CLIENT:
963 if (!wdev->current_bss)
964 return -ENOLINK;
965 break;
966 case NL80211_IFTYPE_UNSPECIFIED:
967 case NL80211_IFTYPE_OCB:
968 case NL80211_IFTYPE_MONITOR:
969 case NL80211_IFTYPE_NAN:
970 case NL80211_IFTYPE_P2P_DEVICE:
971 case NL80211_IFTYPE_WDS:
972 case NUM_NL80211_IFTYPES:
973 return -EINVAL;
974 }
975
976 return 0;
977 }
978
nl80211_get_valid_chan(struct wiphy * wiphy,struct nlattr * tb)979 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
980 struct nlattr *tb)
981 {
982 struct ieee80211_channel *chan;
983
984 if (tb == NULL)
985 return NULL;
986 chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
987 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
988 return NULL;
989 return chan;
990 }
991
nl80211_put_iftypes(struct sk_buff * msg,u32 attr,u16 ifmodes)992 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
993 {
994 struct nlattr *nl_modes = nla_nest_start(msg, attr);
995 int i;
996
997 if (!nl_modes)
998 goto nla_put_failure;
999
1000 i = 0;
1001 while (ifmodes) {
1002 if ((ifmodes & 1) && nla_put_flag(msg, i))
1003 goto nla_put_failure;
1004 ifmodes >>= 1;
1005 i++;
1006 }
1007
1008 nla_nest_end(msg, nl_modes);
1009 return 0;
1010
1011 nla_put_failure:
1012 return -ENOBUFS;
1013 }
1014
nl80211_put_iface_combinations(struct wiphy * wiphy,struct sk_buff * msg,bool large)1015 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1016 struct sk_buff *msg,
1017 bool large)
1018 {
1019 struct nlattr *nl_combis;
1020 int i, j;
1021
1022 nl_combis = nla_nest_start(msg,
1023 NL80211_ATTR_INTERFACE_COMBINATIONS);
1024 if (!nl_combis)
1025 goto nla_put_failure;
1026
1027 for (i = 0; i < wiphy->n_iface_combinations; i++) {
1028 const struct ieee80211_iface_combination *c;
1029 struct nlattr *nl_combi, *nl_limits;
1030
1031 c = &wiphy->iface_combinations[i];
1032
1033 nl_combi = nla_nest_start(msg, i + 1);
1034 if (!nl_combi)
1035 goto nla_put_failure;
1036
1037 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
1038 if (!nl_limits)
1039 goto nla_put_failure;
1040
1041 for (j = 0; j < c->n_limits; j++) {
1042 struct nlattr *nl_limit;
1043
1044 nl_limit = nla_nest_start(msg, j + 1);
1045 if (!nl_limit)
1046 goto nla_put_failure;
1047 if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1048 c->limits[j].max))
1049 goto nla_put_failure;
1050 if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1051 c->limits[j].types))
1052 goto nla_put_failure;
1053 nla_nest_end(msg, nl_limit);
1054 }
1055
1056 nla_nest_end(msg, nl_limits);
1057
1058 if (c->beacon_int_infra_match &&
1059 nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1060 goto nla_put_failure;
1061 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1062 c->num_different_channels) ||
1063 nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1064 c->max_interfaces))
1065 goto nla_put_failure;
1066 if (large &&
1067 (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1068 c->radar_detect_widths) ||
1069 nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1070 c->radar_detect_regions)))
1071 goto nla_put_failure;
1072
1073 nla_nest_end(msg, nl_combi);
1074 }
1075
1076 nla_nest_end(msg, nl_combis);
1077
1078 return 0;
1079 nla_put_failure:
1080 return -ENOBUFS;
1081 }
1082
1083 #ifdef CONFIG_PM
nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device * rdev,struct sk_buff * msg)1084 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1085 struct sk_buff *msg)
1086 {
1087 const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1088 struct nlattr *nl_tcp;
1089
1090 if (!tcp)
1091 return 0;
1092
1093 nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1094 if (!nl_tcp)
1095 return -ENOBUFS;
1096
1097 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1098 tcp->data_payload_max))
1099 return -ENOBUFS;
1100
1101 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1102 tcp->data_payload_max))
1103 return -ENOBUFS;
1104
1105 if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1106 return -ENOBUFS;
1107
1108 if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1109 sizeof(*tcp->tok), tcp->tok))
1110 return -ENOBUFS;
1111
1112 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1113 tcp->data_interval_max))
1114 return -ENOBUFS;
1115
1116 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1117 tcp->wake_payload_max))
1118 return -ENOBUFS;
1119
1120 nla_nest_end(msg, nl_tcp);
1121 return 0;
1122 }
1123
nl80211_send_wowlan(struct sk_buff * msg,struct cfg80211_registered_device * rdev,bool large)1124 static int nl80211_send_wowlan(struct sk_buff *msg,
1125 struct cfg80211_registered_device *rdev,
1126 bool large)
1127 {
1128 struct nlattr *nl_wowlan;
1129
1130 if (!rdev->wiphy.wowlan)
1131 return 0;
1132
1133 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1134 if (!nl_wowlan)
1135 return -ENOBUFS;
1136
1137 if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1138 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1139 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1140 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1141 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1142 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1143 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1144 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1145 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1146 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1147 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1148 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1149 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1150 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1151 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1152 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1153 return -ENOBUFS;
1154
1155 if (rdev->wiphy.wowlan->n_patterns) {
1156 struct nl80211_pattern_support pat = {
1157 .max_patterns = rdev->wiphy.wowlan->n_patterns,
1158 .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1159 .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1160 .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1161 };
1162
1163 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1164 sizeof(pat), &pat))
1165 return -ENOBUFS;
1166 }
1167
1168 if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1169 nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1170 rdev->wiphy.wowlan->max_nd_match_sets))
1171 return -ENOBUFS;
1172
1173 if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1174 return -ENOBUFS;
1175
1176 nla_nest_end(msg, nl_wowlan);
1177
1178 return 0;
1179 }
1180 #endif
1181
nl80211_send_coalesce(struct sk_buff * msg,struct cfg80211_registered_device * rdev)1182 static int nl80211_send_coalesce(struct sk_buff *msg,
1183 struct cfg80211_registered_device *rdev)
1184 {
1185 struct nl80211_coalesce_rule_support rule;
1186
1187 if (!rdev->wiphy.coalesce)
1188 return 0;
1189
1190 rule.max_rules = rdev->wiphy.coalesce->n_rules;
1191 rule.max_delay = rdev->wiphy.coalesce->max_delay;
1192 rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1193 rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1194 rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1195 rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1196
1197 if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1198 return -ENOBUFS;
1199
1200 return 0;
1201 }
1202
nl80211_send_band_rateinfo(struct sk_buff * msg,struct ieee80211_supported_band * sband)1203 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1204 struct ieee80211_supported_band *sband)
1205 {
1206 struct nlattr *nl_rates, *nl_rate;
1207 struct ieee80211_rate *rate;
1208 int i;
1209
1210 /* add HT info */
1211 if (sband->ht_cap.ht_supported &&
1212 (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1213 sizeof(sband->ht_cap.mcs),
1214 &sband->ht_cap.mcs) ||
1215 nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1216 sband->ht_cap.cap) ||
1217 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1218 sband->ht_cap.ampdu_factor) ||
1219 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1220 sband->ht_cap.ampdu_density)))
1221 return -ENOBUFS;
1222
1223 /* add VHT info */
1224 if (sband->vht_cap.vht_supported &&
1225 (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1226 sizeof(sband->vht_cap.vht_mcs),
1227 &sband->vht_cap.vht_mcs) ||
1228 nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1229 sband->vht_cap.cap)))
1230 return -ENOBUFS;
1231
1232 /* add bitrates */
1233 nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1234 if (!nl_rates)
1235 return -ENOBUFS;
1236
1237 for (i = 0; i < sband->n_bitrates; i++) {
1238 nl_rate = nla_nest_start(msg, i);
1239 if (!nl_rate)
1240 return -ENOBUFS;
1241
1242 rate = &sband->bitrates[i];
1243 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1244 rate->bitrate))
1245 return -ENOBUFS;
1246 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1247 nla_put_flag(msg,
1248 NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1249 return -ENOBUFS;
1250
1251 nla_nest_end(msg, nl_rate);
1252 }
1253
1254 nla_nest_end(msg, nl_rates);
1255
1256 return 0;
1257 }
1258
1259 static int
nl80211_send_mgmt_stypes(struct sk_buff * msg,const struct ieee80211_txrx_stypes * mgmt_stypes)1260 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1261 const struct ieee80211_txrx_stypes *mgmt_stypes)
1262 {
1263 u16 stypes;
1264 struct nlattr *nl_ftypes, *nl_ifs;
1265 enum nl80211_iftype ift;
1266 int i;
1267
1268 if (!mgmt_stypes)
1269 return 0;
1270
1271 nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1272 if (!nl_ifs)
1273 return -ENOBUFS;
1274
1275 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1276 nl_ftypes = nla_nest_start(msg, ift);
1277 if (!nl_ftypes)
1278 return -ENOBUFS;
1279 i = 0;
1280 stypes = mgmt_stypes[ift].tx;
1281 while (stypes) {
1282 if ((stypes & 1) &&
1283 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1284 (i << 4) | IEEE80211_FTYPE_MGMT))
1285 return -ENOBUFS;
1286 stypes >>= 1;
1287 i++;
1288 }
1289 nla_nest_end(msg, nl_ftypes);
1290 }
1291
1292 nla_nest_end(msg, nl_ifs);
1293
1294 nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1295 if (!nl_ifs)
1296 return -ENOBUFS;
1297
1298 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1299 nl_ftypes = nla_nest_start(msg, ift);
1300 if (!nl_ftypes)
1301 return -ENOBUFS;
1302 i = 0;
1303 stypes = mgmt_stypes[ift].rx;
1304 while (stypes) {
1305 if ((stypes & 1) &&
1306 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1307 (i << 4) | IEEE80211_FTYPE_MGMT))
1308 return -ENOBUFS;
1309 stypes >>= 1;
1310 i++;
1311 }
1312 nla_nest_end(msg, nl_ftypes);
1313 }
1314 nla_nest_end(msg, nl_ifs);
1315
1316 return 0;
1317 }
1318
1319 struct nl80211_dump_wiphy_state {
1320 s64 filter_wiphy;
1321 long start;
1322 long split_start, band_start, chan_start, capa_start;
1323 bool split;
1324 };
1325
nl80211_send_wiphy(struct cfg80211_registered_device * rdev,enum nl80211_commands cmd,struct sk_buff * msg,u32 portid,u32 seq,int flags,struct nl80211_dump_wiphy_state * state)1326 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1327 enum nl80211_commands cmd,
1328 struct sk_buff *msg, u32 portid, u32 seq,
1329 int flags, struct nl80211_dump_wiphy_state *state)
1330 {
1331 void *hdr;
1332 struct nlattr *nl_bands, *nl_band;
1333 struct nlattr *nl_freqs, *nl_freq;
1334 struct nlattr *nl_cmds;
1335 enum nl80211_band band;
1336 struct ieee80211_channel *chan;
1337 int i;
1338 const struct ieee80211_txrx_stypes *mgmt_stypes =
1339 rdev->wiphy.mgmt_stypes;
1340 u32 features;
1341
1342 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1343 if (!hdr)
1344 return -ENOBUFS;
1345
1346 if (WARN_ON(!state))
1347 return -EINVAL;
1348
1349 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1350 nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1351 wiphy_name(&rdev->wiphy)) ||
1352 nla_put_u32(msg, NL80211_ATTR_GENERATION,
1353 cfg80211_rdev_list_generation))
1354 goto nla_put_failure;
1355
1356 if (cmd != NL80211_CMD_NEW_WIPHY)
1357 goto finish;
1358
1359 switch (state->split_start) {
1360 case 0:
1361 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1362 rdev->wiphy.retry_short) ||
1363 nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1364 rdev->wiphy.retry_long) ||
1365 nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1366 rdev->wiphy.frag_threshold) ||
1367 nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1368 rdev->wiphy.rts_threshold) ||
1369 nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1370 rdev->wiphy.coverage_class) ||
1371 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1372 rdev->wiphy.max_scan_ssids) ||
1373 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1374 rdev->wiphy.max_sched_scan_ssids) ||
1375 nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1376 rdev->wiphy.max_scan_ie_len) ||
1377 nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1378 rdev->wiphy.max_sched_scan_ie_len) ||
1379 nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1380 rdev->wiphy.max_match_sets) ||
1381 nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
1382 rdev->wiphy.max_sched_scan_plans) ||
1383 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
1384 rdev->wiphy.max_sched_scan_plan_interval) ||
1385 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
1386 rdev->wiphy.max_sched_scan_plan_iterations))
1387 goto nla_put_failure;
1388
1389 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1390 nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1391 goto nla_put_failure;
1392 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1393 nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1394 goto nla_put_failure;
1395 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1396 nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1397 goto nla_put_failure;
1398 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1399 nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1400 goto nla_put_failure;
1401 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1402 nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1403 goto nla_put_failure;
1404 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1405 nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1406 goto nla_put_failure;
1407 state->split_start++;
1408 if (state->split)
1409 break;
1410 case 1:
1411 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1412 sizeof(u32) * rdev->wiphy.n_cipher_suites,
1413 rdev->wiphy.cipher_suites))
1414 goto nla_put_failure;
1415
1416 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1417 rdev->wiphy.max_num_pmkids))
1418 goto nla_put_failure;
1419
1420 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1421 nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1422 goto nla_put_failure;
1423
1424 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1425 rdev->wiphy.available_antennas_tx) ||
1426 nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1427 rdev->wiphy.available_antennas_rx))
1428 goto nla_put_failure;
1429
1430 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1431 nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1432 rdev->wiphy.probe_resp_offload))
1433 goto nla_put_failure;
1434
1435 if ((rdev->wiphy.available_antennas_tx ||
1436 rdev->wiphy.available_antennas_rx) &&
1437 rdev->ops->get_antenna) {
1438 u32 tx_ant = 0, rx_ant = 0;
1439 int res;
1440
1441 res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1442 if (!res) {
1443 if (nla_put_u32(msg,
1444 NL80211_ATTR_WIPHY_ANTENNA_TX,
1445 tx_ant) ||
1446 nla_put_u32(msg,
1447 NL80211_ATTR_WIPHY_ANTENNA_RX,
1448 rx_ant))
1449 goto nla_put_failure;
1450 }
1451 }
1452
1453 state->split_start++;
1454 if (state->split)
1455 break;
1456 case 2:
1457 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1458 rdev->wiphy.interface_modes))
1459 goto nla_put_failure;
1460 state->split_start++;
1461 if (state->split)
1462 break;
1463 case 3:
1464 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1465 if (!nl_bands)
1466 goto nla_put_failure;
1467
1468 for (band = state->band_start;
1469 band < NUM_NL80211_BANDS; band++) {
1470 struct ieee80211_supported_band *sband;
1471
1472 sband = rdev->wiphy.bands[band];
1473
1474 if (!sband)
1475 continue;
1476
1477 nl_band = nla_nest_start(msg, band);
1478 if (!nl_band)
1479 goto nla_put_failure;
1480
1481 switch (state->chan_start) {
1482 case 0:
1483 if (nl80211_send_band_rateinfo(msg, sband))
1484 goto nla_put_failure;
1485 state->chan_start++;
1486 if (state->split)
1487 break;
1488 default:
1489 /* add frequencies */
1490 nl_freqs = nla_nest_start(
1491 msg, NL80211_BAND_ATTR_FREQS);
1492 if (!nl_freqs)
1493 goto nla_put_failure;
1494
1495 for (i = state->chan_start - 1;
1496 i < sband->n_channels;
1497 i++) {
1498 nl_freq = nla_nest_start(msg, i);
1499 if (!nl_freq)
1500 goto nla_put_failure;
1501
1502 chan = &sband->channels[i];
1503
1504 if (nl80211_msg_put_channel(
1505 msg, chan,
1506 state->split))
1507 goto nla_put_failure;
1508
1509 nla_nest_end(msg, nl_freq);
1510 if (state->split)
1511 break;
1512 }
1513 if (i < sband->n_channels)
1514 state->chan_start = i + 2;
1515 else
1516 state->chan_start = 0;
1517 nla_nest_end(msg, nl_freqs);
1518 }
1519
1520 nla_nest_end(msg, nl_band);
1521
1522 if (state->split) {
1523 /* start again here */
1524 if (state->chan_start)
1525 band--;
1526 break;
1527 }
1528 }
1529 nla_nest_end(msg, nl_bands);
1530
1531 if (band < NUM_NL80211_BANDS)
1532 state->band_start = band + 1;
1533 else
1534 state->band_start = 0;
1535
1536 /* if bands & channels are done, continue outside */
1537 if (state->band_start == 0 && state->chan_start == 0)
1538 state->split_start++;
1539 if (state->split)
1540 break;
1541 case 4:
1542 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1543 if (!nl_cmds)
1544 goto nla_put_failure;
1545
1546 i = 0;
1547 #define CMD(op, n) \
1548 do { \
1549 if (rdev->ops->op) { \
1550 i++; \
1551 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1552 goto nla_put_failure; \
1553 } \
1554 } while (0)
1555
1556 CMD(add_virtual_intf, NEW_INTERFACE);
1557 CMD(change_virtual_intf, SET_INTERFACE);
1558 CMD(add_key, NEW_KEY);
1559 CMD(start_ap, START_AP);
1560 CMD(add_station, NEW_STATION);
1561 CMD(add_mpath, NEW_MPATH);
1562 CMD(update_mesh_config, SET_MESH_CONFIG);
1563 CMD(change_bss, SET_BSS);
1564 CMD(auth, AUTHENTICATE);
1565 CMD(assoc, ASSOCIATE);
1566 CMD(deauth, DEAUTHENTICATE);
1567 CMD(disassoc, DISASSOCIATE);
1568 CMD(join_ibss, JOIN_IBSS);
1569 CMD(join_mesh, JOIN_MESH);
1570 CMD(set_pmksa, SET_PMKSA);
1571 CMD(del_pmksa, DEL_PMKSA);
1572 CMD(flush_pmksa, FLUSH_PMKSA);
1573 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1574 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1575 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1576 CMD(mgmt_tx, FRAME);
1577 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1578 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1579 i++;
1580 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1581 goto nla_put_failure;
1582 }
1583 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1584 rdev->ops->join_mesh) {
1585 i++;
1586 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1587 goto nla_put_failure;
1588 }
1589 CMD(set_wds_peer, SET_WDS_PEER);
1590 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1591 CMD(tdls_mgmt, TDLS_MGMT);
1592 CMD(tdls_oper, TDLS_OPER);
1593 }
1594 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1595 CMD(sched_scan_start, START_SCHED_SCAN);
1596 CMD(probe_client, PROBE_CLIENT);
1597 CMD(set_noack_map, SET_NOACK_MAP);
1598 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1599 i++;
1600 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1601 goto nla_put_failure;
1602 }
1603 CMD(start_p2p_device, START_P2P_DEVICE);
1604 CMD(set_mcast_rate, SET_MCAST_RATE);
1605 #ifdef CONFIG_NL80211_TESTMODE
1606 CMD(testmode_cmd, TESTMODE);
1607 #endif
1608 if (state->split) {
1609 CMD(crit_proto_start, CRIT_PROTOCOL_START);
1610 CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1611 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1612 CMD(channel_switch, CHANNEL_SWITCH);
1613 CMD(set_qos_map, SET_QOS_MAP);
1614 if (rdev->wiphy.features &
1615 NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
1616 CMD(add_tx_ts, ADD_TX_TS);
1617 }
1618 /* add into the if now */
1619 #undef CMD
1620
1621 if (rdev->ops->connect || rdev->ops->auth) {
1622 i++;
1623 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1624 goto nla_put_failure;
1625 }
1626
1627 if (rdev->ops->disconnect || rdev->ops->deauth) {
1628 i++;
1629 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1630 goto nla_put_failure;
1631 }
1632
1633 nla_nest_end(msg, nl_cmds);
1634 state->split_start++;
1635 if (state->split)
1636 break;
1637 case 5:
1638 if (rdev->ops->remain_on_channel &&
1639 (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1640 nla_put_u32(msg,
1641 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1642 rdev->wiphy.max_remain_on_channel_duration))
1643 goto nla_put_failure;
1644
1645 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1646 nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1647 goto nla_put_failure;
1648
1649 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1650 goto nla_put_failure;
1651 state->split_start++;
1652 if (state->split)
1653 break;
1654 case 6:
1655 #ifdef CONFIG_PM
1656 if (nl80211_send_wowlan(msg, rdev, state->split))
1657 goto nla_put_failure;
1658 state->split_start++;
1659 if (state->split)
1660 break;
1661 #else
1662 state->split_start++;
1663 #endif
1664 case 7:
1665 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1666 rdev->wiphy.software_iftypes))
1667 goto nla_put_failure;
1668
1669 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
1670 state->split))
1671 goto nla_put_failure;
1672
1673 state->split_start++;
1674 if (state->split)
1675 break;
1676 case 8:
1677 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1678 nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1679 rdev->wiphy.ap_sme_capa))
1680 goto nla_put_failure;
1681
1682 features = rdev->wiphy.features;
1683 /*
1684 * We can only add the per-channel limit information if the
1685 * dump is split, otherwise it makes it too big. Therefore
1686 * only advertise it in that case.
1687 */
1688 if (state->split)
1689 features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1690 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1691 goto nla_put_failure;
1692
1693 if (rdev->wiphy.ht_capa_mod_mask &&
1694 nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1695 sizeof(*rdev->wiphy.ht_capa_mod_mask),
1696 rdev->wiphy.ht_capa_mod_mask))
1697 goto nla_put_failure;
1698
1699 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1700 rdev->wiphy.max_acl_mac_addrs &&
1701 nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1702 rdev->wiphy.max_acl_mac_addrs))
1703 goto nla_put_failure;
1704
1705 /*
1706 * Any information below this point is only available to
1707 * applications that can deal with it being split. This
1708 * helps ensure that newly added capabilities don't break
1709 * older tools by overrunning their buffers.
1710 *
1711 * We still increment split_start so that in the split
1712 * case we'll continue with more data in the next round,
1713 * but break unconditionally so unsplit data stops here.
1714 */
1715 state->split_start++;
1716 break;
1717 case 9:
1718 if (rdev->wiphy.extended_capabilities &&
1719 (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1720 rdev->wiphy.extended_capabilities_len,
1721 rdev->wiphy.extended_capabilities) ||
1722 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1723 rdev->wiphy.extended_capabilities_len,
1724 rdev->wiphy.extended_capabilities_mask)))
1725 goto nla_put_failure;
1726
1727 if (rdev->wiphy.vht_capa_mod_mask &&
1728 nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1729 sizeof(*rdev->wiphy.vht_capa_mod_mask),
1730 rdev->wiphy.vht_capa_mod_mask))
1731 goto nla_put_failure;
1732
1733 state->split_start++;
1734 break;
1735 case 10:
1736 if (nl80211_send_coalesce(msg, rdev))
1737 goto nla_put_failure;
1738
1739 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1740 (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1741 nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1742 goto nla_put_failure;
1743
1744 if (rdev->wiphy.max_ap_assoc_sta &&
1745 nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
1746 rdev->wiphy.max_ap_assoc_sta))
1747 goto nla_put_failure;
1748
1749 state->split_start++;
1750 break;
1751 case 11:
1752 if (rdev->wiphy.n_vendor_commands) {
1753 const struct nl80211_vendor_cmd_info *info;
1754 struct nlattr *nested;
1755
1756 nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1757 if (!nested)
1758 goto nla_put_failure;
1759
1760 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
1761 info = &rdev->wiphy.vendor_commands[i].info;
1762 if (nla_put(msg, i + 1, sizeof(*info), info))
1763 goto nla_put_failure;
1764 }
1765 nla_nest_end(msg, nested);
1766 }
1767
1768 if (rdev->wiphy.n_vendor_events) {
1769 const struct nl80211_vendor_cmd_info *info;
1770 struct nlattr *nested;
1771
1772 nested = nla_nest_start(msg,
1773 NL80211_ATTR_VENDOR_EVENTS);
1774 if (!nested)
1775 goto nla_put_failure;
1776
1777 for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
1778 info = &rdev->wiphy.vendor_events[i];
1779 if (nla_put(msg, i + 1, sizeof(*info), info))
1780 goto nla_put_failure;
1781 }
1782 nla_nest_end(msg, nested);
1783 }
1784 state->split_start++;
1785 break;
1786 case 12:
1787 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
1788 nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
1789 rdev->wiphy.max_num_csa_counters))
1790 goto nla_put_failure;
1791
1792 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
1793 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
1794 goto nla_put_failure;
1795
1796 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
1797 sizeof(rdev->wiphy.ext_features),
1798 rdev->wiphy.ext_features))
1799 goto nla_put_failure;
1800
1801 if (rdev->wiphy.bss_select_support) {
1802 struct nlattr *nested;
1803 u32 bss_select_support = rdev->wiphy.bss_select_support;
1804
1805 nested = nla_nest_start(msg, NL80211_ATTR_BSS_SELECT);
1806 if (!nested)
1807 goto nla_put_failure;
1808
1809 i = 0;
1810 while (bss_select_support) {
1811 if ((bss_select_support & 1) &&
1812 nla_put_flag(msg, i))
1813 goto nla_put_failure;
1814 i++;
1815 bss_select_support >>= 1;
1816 }
1817 nla_nest_end(msg, nested);
1818 }
1819
1820 state->split_start++;
1821 break;
1822 case 13:
1823 if (rdev->wiphy.num_iftype_ext_capab &&
1824 rdev->wiphy.iftype_ext_capab) {
1825 struct nlattr *nested_ext_capab, *nested;
1826
1827 nested = nla_nest_start(msg,
1828 NL80211_ATTR_IFTYPE_EXT_CAPA);
1829 if (!nested)
1830 goto nla_put_failure;
1831
1832 for (i = state->capa_start;
1833 i < rdev->wiphy.num_iftype_ext_capab; i++) {
1834 const struct wiphy_iftype_ext_capab *capab;
1835
1836 capab = &rdev->wiphy.iftype_ext_capab[i];
1837
1838 nested_ext_capab = nla_nest_start(msg, i);
1839 if (!nested_ext_capab ||
1840 nla_put_u32(msg, NL80211_ATTR_IFTYPE,
1841 capab->iftype) ||
1842 nla_put(msg, NL80211_ATTR_EXT_CAPA,
1843 capab->extended_capabilities_len,
1844 capab->extended_capabilities) ||
1845 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1846 capab->extended_capabilities_len,
1847 capab->extended_capabilities_mask))
1848 goto nla_put_failure;
1849
1850 nla_nest_end(msg, nested_ext_capab);
1851 if (state->split)
1852 break;
1853 }
1854 nla_nest_end(msg, nested);
1855 if (i < rdev->wiphy.num_iftype_ext_capab) {
1856 state->capa_start = i + 1;
1857 break;
1858 }
1859 }
1860
1861 /* done */
1862 state->split_start = 0;
1863 break;
1864 }
1865 finish:
1866 genlmsg_end(msg, hdr);
1867 return 0;
1868
1869 nla_put_failure:
1870 genlmsg_cancel(msg, hdr);
1871 return -EMSGSIZE;
1872 }
1873
nl80211_dump_wiphy_parse(struct sk_buff * skb,struct netlink_callback * cb,struct nl80211_dump_wiphy_state * state)1874 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
1875 struct netlink_callback *cb,
1876 struct nl80211_dump_wiphy_state *state)
1877 {
1878 struct nlattr **tb = nl80211_fam.attrbuf;
1879 int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1880 tb, nl80211_fam.maxattr, nl80211_policy);
1881 /* ignore parse errors for backward compatibility */
1882 if (ret)
1883 return 0;
1884
1885 state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1886 if (tb[NL80211_ATTR_WIPHY])
1887 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1888 if (tb[NL80211_ATTR_WDEV])
1889 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1890 if (tb[NL80211_ATTR_IFINDEX]) {
1891 struct net_device *netdev;
1892 struct cfg80211_registered_device *rdev;
1893 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1894
1895 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1896 if (!netdev)
1897 return -ENODEV;
1898 if (netdev->ieee80211_ptr) {
1899 rdev = wiphy_to_rdev(
1900 netdev->ieee80211_ptr->wiphy);
1901 state->filter_wiphy = rdev->wiphy_idx;
1902 }
1903 }
1904
1905 return 0;
1906 }
1907
nl80211_dump_wiphy(struct sk_buff * skb,struct netlink_callback * cb)1908 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1909 {
1910 int idx = 0, ret;
1911 struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1912 struct cfg80211_registered_device *rdev;
1913
1914 rtnl_lock();
1915 if (!state) {
1916 state = kzalloc(sizeof(*state), GFP_KERNEL);
1917 if (!state) {
1918 rtnl_unlock();
1919 return -ENOMEM;
1920 }
1921 state->filter_wiphy = -1;
1922 ret = nl80211_dump_wiphy_parse(skb, cb, state);
1923 if (ret) {
1924 kfree(state);
1925 rtnl_unlock();
1926 return ret;
1927 }
1928 cb->args[0] = (long)state;
1929 }
1930
1931 list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1932 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1933 continue;
1934 if (++idx <= state->start)
1935 continue;
1936 if (state->filter_wiphy != -1 &&
1937 state->filter_wiphy != rdev->wiphy_idx)
1938 continue;
1939 /* attempt to fit multiple wiphy data chunks into the skb */
1940 do {
1941 ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
1942 skb,
1943 NETLINK_CB(cb->skb).portid,
1944 cb->nlh->nlmsg_seq,
1945 NLM_F_MULTI, state);
1946 if (ret < 0) {
1947 /*
1948 * If sending the wiphy data didn't fit (ENOBUFS
1949 * or EMSGSIZE returned), this SKB is still
1950 * empty (so it's not too big because another
1951 * wiphy dataset is already in the skb) and
1952 * we've not tried to adjust the dump allocation
1953 * yet ... then adjust the alloc size to be
1954 * bigger, and return 1 but with the empty skb.
1955 * This results in an empty message being RX'ed
1956 * in userspace, but that is ignored.
1957 *
1958 * We can then retry with the larger buffer.
1959 */
1960 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1961 !skb->len && !state->split &&
1962 cb->min_dump_alloc < 4096) {
1963 cb->min_dump_alloc = 4096;
1964 state->split_start = 0;
1965 rtnl_unlock();
1966 return 1;
1967 }
1968 idx--;
1969 break;
1970 }
1971 } while (state->split_start > 0);
1972 break;
1973 }
1974 rtnl_unlock();
1975
1976 state->start = idx;
1977
1978 return skb->len;
1979 }
1980
nl80211_dump_wiphy_done(struct netlink_callback * cb)1981 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
1982 {
1983 kfree((void *)cb->args[0]);
1984 return 0;
1985 }
1986
nl80211_get_wiphy(struct sk_buff * skb,struct genl_info * info)1987 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1988 {
1989 struct sk_buff *msg;
1990 struct cfg80211_registered_device *rdev = info->user_ptr[0];
1991 struct nl80211_dump_wiphy_state state = {};
1992
1993 msg = nlmsg_new(4096, GFP_KERNEL);
1994 if (!msg)
1995 return -ENOMEM;
1996
1997 if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
1998 info->snd_portid, info->snd_seq, 0,
1999 &state) < 0) {
2000 nlmsg_free(msg);
2001 return -ENOBUFS;
2002 }
2003
2004 return genlmsg_reply(msg, info);
2005 }
2006
2007 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
2008 [NL80211_TXQ_ATTR_QUEUE] = { .type = NLA_U8 },
2009 [NL80211_TXQ_ATTR_TXOP] = { .type = NLA_U16 },
2010 [NL80211_TXQ_ATTR_CWMIN] = { .type = NLA_U16 },
2011 [NL80211_TXQ_ATTR_CWMAX] = { .type = NLA_U16 },
2012 [NL80211_TXQ_ATTR_AIFS] = { .type = NLA_U8 },
2013 };
2014
parse_txq_params(struct nlattr * tb[],struct ieee80211_txq_params * txq_params)2015 static int parse_txq_params(struct nlattr *tb[],
2016 struct ieee80211_txq_params *txq_params)
2017 {
2018 u8 ac;
2019
2020 if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
2021 !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
2022 !tb[NL80211_TXQ_ATTR_AIFS])
2023 return -EINVAL;
2024
2025 ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
2026 txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
2027 txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
2028 txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
2029 txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
2030
2031 if (ac >= NL80211_NUM_ACS)
2032 return -EINVAL;
2033 txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
2034 return 0;
2035 }
2036
nl80211_can_set_dev_channel(struct wireless_dev * wdev)2037 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
2038 {
2039 /*
2040 * You can only set the channel explicitly for WDS interfaces,
2041 * all others have their channel managed via their respective
2042 * "establish a connection" command (connect, join, ...)
2043 *
2044 * For AP/GO and mesh mode, the channel can be set with the
2045 * channel userspace API, but is only stored and passed to the
2046 * low-level driver when the AP starts or the mesh is joined.
2047 * This is for backward compatibility, userspace can also give
2048 * the channel in the start-ap or join-mesh commands instead.
2049 *
2050 * Monitors are special as they are normally slaved to
2051 * whatever else is going on, so they have their own special
2052 * operation to set the monitor channel if possible.
2053 */
2054 return !wdev ||
2055 wdev->iftype == NL80211_IFTYPE_AP ||
2056 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
2057 wdev->iftype == NL80211_IFTYPE_MONITOR ||
2058 wdev->iftype == NL80211_IFTYPE_P2P_GO;
2059 }
2060
nl80211_parse_chandef(struct cfg80211_registered_device * rdev,struct genl_info * info,struct cfg80211_chan_def * chandef)2061 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
2062 struct genl_info *info,
2063 struct cfg80211_chan_def *chandef)
2064 {
2065 u32 control_freq;
2066
2067 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
2068 return -EINVAL;
2069
2070 control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
2071
2072 chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
2073 chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
2074 chandef->center_freq1 = control_freq;
2075 chandef->center_freq2 = 0;
2076
2077 /* Primary channel not allowed */
2078 if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
2079 return -EINVAL;
2080
2081 if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
2082 enum nl80211_channel_type chantype;
2083
2084 chantype = nla_get_u32(
2085 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
2086
2087 switch (chantype) {
2088 case NL80211_CHAN_NO_HT:
2089 case NL80211_CHAN_HT20:
2090 case NL80211_CHAN_HT40PLUS:
2091 case NL80211_CHAN_HT40MINUS:
2092 cfg80211_chandef_create(chandef, chandef->chan,
2093 chantype);
2094 break;
2095 default:
2096 return -EINVAL;
2097 }
2098 } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
2099 chandef->width =
2100 nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
2101 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
2102 chandef->center_freq1 =
2103 nla_get_u32(
2104 info->attrs[NL80211_ATTR_CENTER_FREQ1]);
2105 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
2106 chandef->center_freq2 =
2107 nla_get_u32(
2108 info->attrs[NL80211_ATTR_CENTER_FREQ2]);
2109 }
2110
2111 if (!cfg80211_chandef_valid(chandef))
2112 return -EINVAL;
2113
2114 if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
2115 IEEE80211_CHAN_DISABLED))
2116 return -EINVAL;
2117
2118 if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
2119 chandef->width == NL80211_CHAN_WIDTH_10) &&
2120 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
2121 return -EINVAL;
2122
2123 return 0;
2124 }
2125
__nl80211_set_channel(struct cfg80211_registered_device * rdev,struct net_device * dev,struct genl_info * info)2126 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
2127 struct net_device *dev,
2128 struct genl_info *info)
2129 {
2130 struct cfg80211_chan_def chandef;
2131 int result;
2132 enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
2133 struct wireless_dev *wdev = NULL;
2134
2135 if (dev)
2136 wdev = dev->ieee80211_ptr;
2137 if (!nl80211_can_set_dev_channel(wdev))
2138 return -EOPNOTSUPP;
2139 if (wdev)
2140 iftype = wdev->iftype;
2141
2142 result = nl80211_parse_chandef(rdev, info, &chandef);
2143 if (result)
2144 return result;
2145
2146 switch (iftype) {
2147 case NL80211_IFTYPE_AP:
2148 case NL80211_IFTYPE_P2P_GO:
2149 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
2150 iftype)) {
2151 result = -EINVAL;
2152 break;
2153 }
2154 if (wdev->beacon_interval) {
2155 if (!dev || !rdev->ops->set_ap_chanwidth ||
2156 !(rdev->wiphy.features &
2157 NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
2158 result = -EBUSY;
2159 break;
2160 }
2161
2162 /* Only allow dynamic channel width changes */
2163 if (chandef.chan != wdev->preset_chandef.chan) {
2164 result = -EBUSY;
2165 break;
2166 }
2167 result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2168 if (result)
2169 break;
2170 }
2171 wdev->preset_chandef = chandef;
2172 result = 0;
2173 break;
2174 case NL80211_IFTYPE_MESH_POINT:
2175 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2176 break;
2177 case NL80211_IFTYPE_MONITOR:
2178 result = cfg80211_set_monitor_channel(rdev, &chandef);
2179 break;
2180 default:
2181 result = -EINVAL;
2182 }
2183
2184 return result;
2185 }
2186
nl80211_set_channel(struct sk_buff * skb,struct genl_info * info)2187 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2188 {
2189 struct cfg80211_registered_device *rdev = info->user_ptr[0];
2190 struct net_device *netdev = info->user_ptr[1];
2191
2192 return __nl80211_set_channel(rdev, netdev, info);
2193 }
2194
nl80211_set_wds_peer(struct sk_buff * skb,struct genl_info * info)2195 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2196 {
2197 struct cfg80211_registered_device *rdev = info->user_ptr[0];
2198 struct net_device *dev = info->user_ptr[1];
2199 struct wireless_dev *wdev = dev->ieee80211_ptr;
2200 const u8 *bssid;
2201
2202 if (!info->attrs[NL80211_ATTR_MAC])
2203 return -EINVAL;
2204
2205 if (netif_running(dev))
2206 return -EBUSY;
2207
2208 if (!rdev->ops->set_wds_peer)
2209 return -EOPNOTSUPP;
2210
2211 if (wdev->iftype != NL80211_IFTYPE_WDS)
2212 return -EOPNOTSUPP;
2213
2214 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2215 return rdev_set_wds_peer(rdev, dev, bssid);
2216 }
2217
nl80211_set_wiphy(struct sk_buff * skb,struct genl_info * info)2218 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2219 {
2220 struct cfg80211_registered_device *rdev;
2221 struct net_device *netdev = NULL;
2222 struct wireless_dev *wdev;
2223 int result = 0, rem_txq_params = 0;
2224 struct nlattr *nl_txq_params;
2225 u32 changed;
2226 u8 retry_short = 0, retry_long = 0;
2227 u32 frag_threshold = 0, rts_threshold = 0;
2228 u8 coverage_class = 0;
2229
2230 ASSERT_RTNL();
2231
2232 /*
2233 * Try to find the wiphy and netdev. Normally this
2234 * function shouldn't need the netdev, but this is
2235 * done for backward compatibility -- previously
2236 * setting the channel was done per wiphy, but now
2237 * it is per netdev. Previous userland like hostapd
2238 * also passed a netdev to set_wiphy, so that it is
2239 * possible to let that go to the right netdev!
2240 */
2241
2242 if (info->attrs[NL80211_ATTR_IFINDEX]) {
2243 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2244
2245 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2246 if (netdev && netdev->ieee80211_ptr)
2247 rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2248 else
2249 netdev = NULL;
2250 }
2251
2252 if (!netdev) {
2253 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2254 info->attrs);
2255 if (IS_ERR(rdev))
2256 return PTR_ERR(rdev);
2257 wdev = NULL;
2258 netdev = NULL;
2259 result = 0;
2260 } else
2261 wdev = netdev->ieee80211_ptr;
2262
2263 /*
2264 * end workaround code, by now the rdev is available
2265 * and locked, and wdev may or may not be NULL.
2266 */
2267
2268 if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2269 result = cfg80211_dev_rename(
2270 rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2271
2272 if (result)
2273 return result;
2274
2275 if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2276 struct ieee80211_txq_params txq_params;
2277 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2278
2279 if (!rdev->ops->set_txq_params)
2280 return -EOPNOTSUPP;
2281
2282 if (!netdev)
2283 return -EINVAL;
2284
2285 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2286 netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2287 return -EINVAL;
2288
2289 if (!netif_running(netdev))
2290 return -ENETDOWN;
2291
2292 nla_for_each_nested(nl_txq_params,
2293 info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2294 rem_txq_params) {
2295 result = nla_parse(tb, NL80211_TXQ_ATTR_MAX,
2296 nla_data(nl_txq_params),
2297 nla_len(nl_txq_params),
2298 txq_params_policy);
2299 if (result)
2300 return result;
2301 result = parse_txq_params(tb, &txq_params);
2302 if (result)
2303 return result;
2304
2305 result = rdev_set_txq_params(rdev, netdev,
2306 &txq_params);
2307 if (result)
2308 return result;
2309 }
2310 }
2311
2312 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2313 result = __nl80211_set_channel(
2314 rdev,
2315 nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2316 info);
2317 if (result)
2318 return result;
2319 }
2320
2321 if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2322 struct wireless_dev *txp_wdev = wdev;
2323 enum nl80211_tx_power_setting type;
2324 int idx, mbm = 0;
2325
2326 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2327 txp_wdev = NULL;
2328
2329 if (!rdev->ops->set_tx_power)
2330 return -EOPNOTSUPP;
2331
2332 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2333 type = nla_get_u32(info->attrs[idx]);
2334
2335 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2336 (type != NL80211_TX_POWER_AUTOMATIC))
2337 return -EINVAL;
2338
2339 if (type != NL80211_TX_POWER_AUTOMATIC) {
2340 idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2341 mbm = nla_get_u32(info->attrs[idx]);
2342 }
2343
2344 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2345 if (result)
2346 return result;
2347 }
2348
2349 if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2350 info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2351 u32 tx_ant, rx_ant;
2352
2353 if ((!rdev->wiphy.available_antennas_tx &&
2354 !rdev->wiphy.available_antennas_rx) ||
2355 !rdev->ops->set_antenna)
2356 return -EOPNOTSUPP;
2357
2358 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2359 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2360
2361 /* reject antenna configurations which don't match the
2362 * available antenna masks, except for the "all" mask */
2363 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2364 (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2365 return -EINVAL;
2366
2367 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2368 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2369
2370 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2371 if (result)
2372 return result;
2373 }
2374
2375 changed = 0;
2376
2377 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2378 retry_short = nla_get_u8(
2379 info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2380 if (retry_short == 0)
2381 return -EINVAL;
2382
2383 changed |= WIPHY_PARAM_RETRY_SHORT;
2384 }
2385
2386 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2387 retry_long = nla_get_u8(
2388 info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2389 if (retry_long == 0)
2390 return -EINVAL;
2391
2392 changed |= WIPHY_PARAM_RETRY_LONG;
2393 }
2394
2395 if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2396 frag_threshold = nla_get_u32(
2397 info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2398 if (frag_threshold < 256)
2399 return -EINVAL;
2400
2401 if (frag_threshold != (u32) -1) {
2402 /*
2403 * Fragments (apart from the last one) are required to
2404 * have even length. Make the fragmentation code
2405 * simpler by stripping LSB should someone try to use
2406 * odd threshold value.
2407 */
2408 frag_threshold &= ~0x1;
2409 }
2410 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2411 }
2412
2413 if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2414 rts_threshold = nla_get_u32(
2415 info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2416 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2417 }
2418
2419 if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2420 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
2421 return -EINVAL;
2422
2423 coverage_class = nla_get_u8(
2424 info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2425 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2426 }
2427
2428 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
2429 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
2430 return -EOPNOTSUPP;
2431
2432 changed |= WIPHY_PARAM_DYN_ACK;
2433 }
2434
2435 if (changed) {
2436 u8 old_retry_short, old_retry_long;
2437 u32 old_frag_threshold, old_rts_threshold;
2438 u8 old_coverage_class;
2439
2440 if (!rdev->ops->set_wiphy_params)
2441 return -EOPNOTSUPP;
2442
2443 old_retry_short = rdev->wiphy.retry_short;
2444 old_retry_long = rdev->wiphy.retry_long;
2445 old_frag_threshold = rdev->wiphy.frag_threshold;
2446 old_rts_threshold = rdev->wiphy.rts_threshold;
2447 old_coverage_class = rdev->wiphy.coverage_class;
2448
2449 if (changed & WIPHY_PARAM_RETRY_SHORT)
2450 rdev->wiphy.retry_short = retry_short;
2451 if (changed & WIPHY_PARAM_RETRY_LONG)
2452 rdev->wiphy.retry_long = retry_long;
2453 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2454 rdev->wiphy.frag_threshold = frag_threshold;
2455 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2456 rdev->wiphy.rts_threshold = rts_threshold;
2457 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2458 rdev->wiphy.coverage_class = coverage_class;
2459
2460 result = rdev_set_wiphy_params(rdev, changed);
2461 if (result) {
2462 rdev->wiphy.retry_short = old_retry_short;
2463 rdev->wiphy.retry_long = old_retry_long;
2464 rdev->wiphy.frag_threshold = old_frag_threshold;
2465 rdev->wiphy.rts_threshold = old_rts_threshold;
2466 rdev->wiphy.coverage_class = old_coverage_class;
2467 return result;
2468 }
2469 }
2470 return 0;
2471 }
2472
wdev_id(struct wireless_dev * wdev)2473 static inline u64 wdev_id(struct wireless_dev *wdev)
2474 {
2475 return (u64)wdev->identifier |
2476 ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
2477 }
2478
nl80211_send_chandef(struct sk_buff * msg,const struct cfg80211_chan_def * chandef)2479 static int nl80211_send_chandef(struct sk_buff *msg,
2480 const struct cfg80211_chan_def *chandef)
2481 {
2482 if (WARN_ON(!cfg80211_chandef_valid(chandef)))
2483 return -EINVAL;
2484
2485 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2486 chandef->chan->center_freq))
2487 return -ENOBUFS;
2488 switch (chandef->width) {
2489 case NL80211_CHAN_WIDTH_20_NOHT:
2490 case NL80211_CHAN_WIDTH_20:
2491 case NL80211_CHAN_WIDTH_40:
2492 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2493 cfg80211_get_chandef_type(chandef)))
2494 return -ENOBUFS;
2495 break;
2496 default:
2497 break;
2498 }
2499 if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2500 return -ENOBUFS;
2501 if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2502 return -ENOBUFS;
2503 if (chandef->center_freq2 &&
2504 nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2505 return -ENOBUFS;
2506 return 0;
2507 }
2508
nl80211_send_iface(struct sk_buff * msg,u32 portid,u32 seq,int flags,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,bool removal)2509 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2510 struct cfg80211_registered_device *rdev,
2511 struct wireless_dev *wdev, bool removal)
2512 {
2513 struct net_device *dev = wdev->netdev;
2514 u8 cmd = NL80211_CMD_NEW_INTERFACE;
2515 void *hdr;
2516
2517 if (removal)
2518 cmd = NL80211_CMD_DEL_INTERFACE;
2519
2520 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2521 if (!hdr)
2522 return -1;
2523
2524 if (dev &&
2525 (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2526 nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2527 goto nla_put_failure;
2528
2529 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2530 nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2531 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
2532 NL80211_ATTR_PAD) ||
2533 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2534 nla_put_u32(msg, NL80211_ATTR_GENERATION,
2535 rdev->devlist_generation ^
2536 (cfg80211_rdev_list_generation << 2)))
2537 goto nla_put_failure;
2538
2539 if (rdev->ops->get_channel) {
2540 int ret;
2541 struct cfg80211_chan_def chandef;
2542
2543 ret = rdev_get_channel(rdev, wdev, &chandef);
2544 if (ret == 0) {
2545 if (nl80211_send_chandef(msg, &chandef))
2546 goto nla_put_failure;
2547 }
2548 }
2549
2550 if (rdev->ops->get_tx_power) {
2551 int dbm, ret;
2552
2553 ret = rdev_get_tx_power(rdev, wdev, &dbm);
2554 if (ret == 0 &&
2555 nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
2556 DBM_TO_MBM(dbm)))
2557 goto nla_put_failure;
2558 }
2559
2560 if (wdev->ssid_len) {
2561 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2562 goto nla_put_failure;
2563 }
2564
2565 genlmsg_end(msg, hdr);
2566 return 0;
2567
2568 nla_put_failure:
2569 genlmsg_cancel(msg, hdr);
2570 return -EMSGSIZE;
2571 }
2572
nl80211_dump_interface(struct sk_buff * skb,struct netlink_callback * cb)2573 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2574 {
2575 int wp_idx = 0;
2576 int if_idx = 0;
2577 int wp_start = cb->args[0];
2578 int if_start = cb->args[1];
2579 int filter_wiphy = -1;
2580 struct cfg80211_registered_device *rdev;
2581 struct wireless_dev *wdev;
2582 int ret;
2583
2584 rtnl_lock();
2585 if (!cb->args[2]) {
2586 struct nl80211_dump_wiphy_state state = {
2587 .filter_wiphy = -1,
2588 };
2589
2590 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
2591 if (ret)
2592 goto out_unlock;
2593
2594 filter_wiphy = state.filter_wiphy;
2595
2596 /*
2597 * if filtering, set cb->args[2] to +1 since 0 is the default
2598 * value needed to determine that parsing is necessary.
2599 */
2600 if (filter_wiphy >= 0)
2601 cb->args[2] = filter_wiphy + 1;
2602 else
2603 cb->args[2] = -1;
2604 } else if (cb->args[2] > 0) {
2605 filter_wiphy = cb->args[2] - 1;
2606 }
2607
2608 list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2609 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2610 continue;
2611 if (wp_idx < wp_start) {
2612 wp_idx++;
2613 continue;
2614 }
2615
2616 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
2617 continue;
2618
2619 if_idx = 0;
2620
2621 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
2622 if (if_idx < if_start) {
2623 if_idx++;
2624 continue;
2625 }
2626 if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2627 cb->nlh->nlmsg_seq, NLM_F_MULTI,
2628 rdev, wdev, false) < 0) {
2629 goto out;
2630 }
2631 if_idx++;
2632 }
2633
2634 wp_idx++;
2635 }
2636 out:
2637 cb->args[0] = wp_idx;
2638 cb->args[1] = if_idx;
2639
2640 ret = skb->len;
2641 out_unlock:
2642 rtnl_unlock();
2643
2644 return ret;
2645 }
2646
nl80211_get_interface(struct sk_buff * skb,struct genl_info * info)2647 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2648 {
2649 struct sk_buff *msg;
2650 struct cfg80211_registered_device *rdev = info->user_ptr[0];
2651 struct wireless_dev *wdev = info->user_ptr[1];
2652
2653 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2654 if (!msg)
2655 return -ENOMEM;
2656
2657 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2658 rdev, wdev, false) < 0) {
2659 nlmsg_free(msg);
2660 return -ENOBUFS;
2661 }
2662
2663 return genlmsg_reply(msg, info);
2664 }
2665
2666 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2667 [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2668 [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2669 [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2670 [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2671 [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2672 [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2673 };
2674
parse_monitor_flags(struct nlattr * nla,u32 * mntrflags)2675 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2676 {
2677 struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2678 int flag;
2679
2680 *mntrflags = 0;
2681
2682 if (!nla)
2683 return -EINVAL;
2684
2685 if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2686 nla, mntr_flags_policy))
2687 return -EINVAL;
2688
2689 for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2690 if (flags[flag])
2691 *mntrflags |= (1<<flag);
2692
2693 return 0;
2694 }
2695
nl80211_valid_4addr(struct cfg80211_registered_device * rdev,struct net_device * netdev,u8 use_4addr,enum nl80211_iftype iftype)2696 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2697 struct net_device *netdev, u8 use_4addr,
2698 enum nl80211_iftype iftype)
2699 {
2700 if (!use_4addr) {
2701 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2702 return -EBUSY;
2703 return 0;
2704 }
2705
2706 switch (iftype) {
2707 case NL80211_IFTYPE_AP_VLAN:
2708 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2709 return 0;
2710 break;
2711 case NL80211_IFTYPE_STATION:
2712 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2713 return 0;
2714 break;
2715 default:
2716 break;
2717 }
2718
2719 return -EOPNOTSUPP;
2720 }
2721
nl80211_set_interface(struct sk_buff * skb,struct genl_info * info)2722 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2723 {
2724 struct cfg80211_registered_device *rdev = info->user_ptr[0];
2725 struct vif_params params;
2726 int err;
2727 enum nl80211_iftype otype, ntype;
2728 struct net_device *dev = info->user_ptr[1];
2729 u32 _flags, *flags = NULL;
2730 bool change = false;
2731
2732 memset(¶ms, 0, sizeof(params));
2733
2734 otype = ntype = dev->ieee80211_ptr->iftype;
2735
2736 if (info->attrs[NL80211_ATTR_IFTYPE]) {
2737 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2738 if (otype != ntype)
2739 change = true;
2740 if (ntype > NL80211_IFTYPE_MAX)
2741 return -EINVAL;
2742 }
2743
2744 if (info->attrs[NL80211_ATTR_MESH_ID]) {
2745 struct wireless_dev *wdev = dev->ieee80211_ptr;
2746
2747 if (ntype != NL80211_IFTYPE_MESH_POINT)
2748 return -EINVAL;
2749 if (netif_running(dev))
2750 return -EBUSY;
2751
2752 wdev_lock(wdev);
2753 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2754 IEEE80211_MAX_MESH_ID_LEN);
2755 wdev->mesh_id_up_len =
2756 nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2757 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2758 wdev->mesh_id_up_len);
2759 wdev_unlock(wdev);
2760 }
2761
2762 if (info->attrs[NL80211_ATTR_4ADDR]) {
2763 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2764 change = true;
2765 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2766 if (err)
2767 return err;
2768 } else {
2769 params.use_4addr = -1;
2770 }
2771
2772 if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2773 if (ntype != NL80211_IFTYPE_MONITOR)
2774 return -EINVAL;
2775 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2776 &_flags);
2777 if (err)
2778 return err;
2779
2780 flags = &_flags;
2781 change = true;
2782 }
2783
2784 if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
2785 const u8 *mumimo_groups;
2786 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
2787
2788 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
2789 return -EOPNOTSUPP;
2790
2791 mumimo_groups =
2792 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
2793
2794 /* bits 0 and 63 are reserved and must be zero */
2795 if ((mumimo_groups[0] & BIT(7)) ||
2796 (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(0)))
2797 return -EINVAL;
2798
2799 memcpy(params.vht_mumimo_groups, mumimo_groups,
2800 VHT_MUMIMO_GROUPS_DATA_LEN);
2801 change = true;
2802 }
2803
2804 if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
2805 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
2806
2807 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
2808 return -EOPNOTSUPP;
2809
2810 nla_memcpy(params.macaddr,
2811 info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR],
2812 ETH_ALEN);
2813 change = true;
2814 }
2815
2816 if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
2817 !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2818 return -EOPNOTSUPP;
2819
2820 if (change)
2821 err = cfg80211_change_iface(rdev, dev, ntype, flags, ¶ms);
2822 else
2823 err = 0;
2824
2825 if (!err && params.use_4addr != -1)
2826 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2827
2828 return err;
2829 }
2830
nl80211_new_interface(struct sk_buff * skb,struct genl_info * info)2831 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2832 {
2833 struct cfg80211_registered_device *rdev = info->user_ptr[0];
2834 struct vif_params params;
2835 struct wireless_dev *wdev;
2836 struct sk_buff *msg;
2837 int err;
2838 enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2839 u32 flags;
2840
2841 /* to avoid failing a new interface creation due to pending removal */
2842 cfg80211_destroy_ifaces(rdev);
2843
2844 memset(¶ms, 0, sizeof(params));
2845
2846 if (!info->attrs[NL80211_ATTR_IFNAME])
2847 return -EINVAL;
2848
2849 if (info->attrs[NL80211_ATTR_IFTYPE]) {
2850 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2851 if (type > NL80211_IFTYPE_MAX)
2852 return -EINVAL;
2853 }
2854
2855 if (!rdev->ops->add_virtual_intf ||
2856 !(rdev->wiphy.interface_modes & (1 << type)))
2857 return -EOPNOTSUPP;
2858
2859 if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
2860 rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
2861 info->attrs[NL80211_ATTR_MAC]) {
2862 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2863 ETH_ALEN);
2864 if (!is_valid_ether_addr(params.macaddr))
2865 return -EADDRNOTAVAIL;
2866 }
2867
2868 if (info->attrs[NL80211_ATTR_4ADDR]) {
2869 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2870 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2871 if (err)
2872 return err;
2873 }
2874
2875 err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2876 info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2877 &flags);
2878
2879 if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
2880 !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2881 return -EOPNOTSUPP;
2882
2883 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2884 if (!msg)
2885 return -ENOMEM;
2886
2887 wdev = rdev_add_virtual_intf(rdev,
2888 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2889 NET_NAME_USER, type, err ? NULL : &flags,
2890 ¶ms);
2891 if (WARN_ON(!wdev)) {
2892 nlmsg_free(msg);
2893 return -EPROTO;
2894 } else if (IS_ERR(wdev)) {
2895 nlmsg_free(msg);
2896 return PTR_ERR(wdev);
2897 }
2898
2899 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
2900 wdev->owner_nlportid = info->snd_portid;
2901
2902 switch (type) {
2903 case NL80211_IFTYPE_MESH_POINT:
2904 if (!info->attrs[NL80211_ATTR_MESH_ID])
2905 break;
2906 wdev_lock(wdev);
2907 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2908 IEEE80211_MAX_MESH_ID_LEN);
2909 wdev->mesh_id_up_len =
2910 nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2911 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2912 wdev->mesh_id_up_len);
2913 wdev_unlock(wdev);
2914 break;
2915 case NL80211_IFTYPE_NAN:
2916 case NL80211_IFTYPE_P2P_DEVICE:
2917 /*
2918 * P2P Device and NAN do not have a netdev, so don't go
2919 * through the netdev notifier and must be added here
2920 */
2921 mutex_init(&wdev->mtx);
2922 INIT_LIST_HEAD(&wdev->event_list);
2923 spin_lock_init(&wdev->event_lock);
2924 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2925 spin_lock_init(&wdev->mgmt_registrations_lock);
2926
2927 wdev->identifier = ++rdev->wdev_id;
2928 list_add_rcu(&wdev->list, &rdev->wiphy.wdev_list);
2929 rdev->devlist_generation++;
2930 break;
2931 default:
2932 break;
2933 }
2934
2935 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2936 rdev, wdev, false) < 0) {
2937 nlmsg_free(msg);
2938 return -ENOBUFS;
2939 }
2940
2941 /*
2942 * For wdevs which have no associated netdev object (e.g. of type
2943 * NL80211_IFTYPE_P2P_DEVICE), emit the NEW_INTERFACE event here.
2944 * For all other types, the event will be generated from the
2945 * netdev notifier
2946 */
2947 if (!wdev->netdev)
2948 nl80211_notify_iface(rdev, wdev, NL80211_CMD_NEW_INTERFACE);
2949
2950 return genlmsg_reply(msg, info);
2951 }
2952
nl80211_del_interface(struct sk_buff * skb,struct genl_info * info)2953 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2954 {
2955 struct cfg80211_registered_device *rdev = info->user_ptr[0];
2956 struct wireless_dev *wdev = info->user_ptr[1];
2957
2958 if (!rdev->ops->del_virtual_intf)
2959 return -EOPNOTSUPP;
2960
2961 /*
2962 * If we remove a wireless device without a netdev then clear
2963 * user_ptr[1] so that nl80211_post_doit won't dereference it
2964 * to check if it needs to do dev_put(). Otherwise it crashes
2965 * since the wdev has been freed, unlike with a netdev where
2966 * we need the dev_put() for the netdev to really be freed.
2967 */
2968 if (!wdev->netdev)
2969 info->user_ptr[1] = NULL;
2970
2971 return rdev_del_virtual_intf(rdev, wdev);
2972 }
2973
nl80211_set_noack_map(struct sk_buff * skb,struct genl_info * info)2974 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2975 {
2976 struct cfg80211_registered_device *rdev = info->user_ptr[0];
2977 struct net_device *dev = info->user_ptr[1];
2978 u16 noack_map;
2979
2980 if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2981 return -EINVAL;
2982
2983 if (!rdev->ops->set_noack_map)
2984 return -EOPNOTSUPP;
2985
2986 noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2987
2988 return rdev_set_noack_map(rdev, dev, noack_map);
2989 }
2990
2991 struct get_key_cookie {
2992 struct sk_buff *msg;
2993 int error;
2994 int idx;
2995 };
2996
get_key_callback(void * c,struct key_params * params)2997 static void get_key_callback(void *c, struct key_params *params)
2998 {
2999 struct nlattr *key;
3000 struct get_key_cookie *cookie = c;
3001
3002 if ((params->key &&
3003 nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
3004 params->key_len, params->key)) ||
3005 (params->seq &&
3006 nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
3007 params->seq_len, params->seq)) ||
3008 (params->cipher &&
3009 nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
3010 params->cipher)))
3011 goto nla_put_failure;
3012
3013 key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
3014 if (!key)
3015 goto nla_put_failure;
3016
3017 if ((params->key &&
3018 nla_put(cookie->msg, NL80211_KEY_DATA,
3019 params->key_len, params->key)) ||
3020 (params->seq &&
3021 nla_put(cookie->msg, NL80211_KEY_SEQ,
3022 params->seq_len, params->seq)) ||
3023 (params->cipher &&
3024 nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
3025 params->cipher)))
3026 goto nla_put_failure;
3027
3028 if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
3029 goto nla_put_failure;
3030
3031 nla_nest_end(cookie->msg, key);
3032
3033 return;
3034 nla_put_failure:
3035 cookie->error = 1;
3036 }
3037
nl80211_get_key(struct sk_buff * skb,struct genl_info * info)3038 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
3039 {
3040 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3041 int err;
3042 struct net_device *dev = info->user_ptr[1];
3043 u8 key_idx = 0;
3044 const u8 *mac_addr = NULL;
3045 bool pairwise;
3046 struct get_key_cookie cookie = {
3047 .error = 0,
3048 };
3049 void *hdr;
3050 struct sk_buff *msg;
3051
3052 if (info->attrs[NL80211_ATTR_KEY_IDX])
3053 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
3054
3055 if (key_idx > 5)
3056 return -EINVAL;
3057
3058 if (info->attrs[NL80211_ATTR_MAC])
3059 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3060
3061 pairwise = !!mac_addr;
3062 if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
3063 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
3064
3065 if (kt >= NUM_NL80211_KEYTYPES)
3066 return -EINVAL;
3067 if (kt != NL80211_KEYTYPE_GROUP &&
3068 kt != NL80211_KEYTYPE_PAIRWISE)
3069 return -EINVAL;
3070 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
3071 }
3072
3073 if (!rdev->ops->get_key)
3074 return -EOPNOTSUPP;
3075
3076 if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3077 return -ENOENT;
3078
3079 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3080 if (!msg)
3081 return -ENOMEM;
3082
3083 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
3084 NL80211_CMD_NEW_KEY);
3085 if (!hdr)
3086 goto nla_put_failure;
3087
3088 cookie.msg = msg;
3089 cookie.idx = key_idx;
3090
3091 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3092 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
3093 goto nla_put_failure;
3094 if (mac_addr &&
3095 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
3096 goto nla_put_failure;
3097
3098 err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
3099 get_key_callback);
3100
3101 if (err)
3102 goto free_msg;
3103
3104 if (cookie.error)
3105 goto nla_put_failure;
3106
3107 genlmsg_end(msg, hdr);
3108 return genlmsg_reply(msg, info);
3109
3110 nla_put_failure:
3111 err = -ENOBUFS;
3112 free_msg:
3113 nlmsg_free(msg);
3114 return err;
3115 }
3116
nl80211_set_key(struct sk_buff * skb,struct genl_info * info)3117 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
3118 {
3119 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3120 struct key_parse key;
3121 int err;
3122 struct net_device *dev = info->user_ptr[1];
3123
3124 err = nl80211_parse_key(info, &key);
3125 if (err)
3126 return err;
3127
3128 if (key.idx < 0)
3129 return -EINVAL;
3130
3131 /* only support setting default key */
3132 if (!key.def && !key.defmgmt)
3133 return -EINVAL;
3134
3135 wdev_lock(dev->ieee80211_ptr);
3136
3137 if (key.def) {
3138 if (!rdev->ops->set_default_key) {
3139 err = -EOPNOTSUPP;
3140 goto out;
3141 }
3142
3143 err = nl80211_key_allowed(dev->ieee80211_ptr);
3144 if (err)
3145 goto out;
3146
3147 err = rdev_set_default_key(rdev, dev, key.idx,
3148 key.def_uni, key.def_multi);
3149
3150 if (err)
3151 goto out;
3152
3153 #ifdef CONFIG_CFG80211_WEXT
3154 dev->ieee80211_ptr->wext.default_key = key.idx;
3155 #endif
3156 } else {
3157 if (key.def_uni || !key.def_multi) {
3158 err = -EINVAL;
3159 goto out;
3160 }
3161
3162 if (!rdev->ops->set_default_mgmt_key) {
3163 err = -EOPNOTSUPP;
3164 goto out;
3165 }
3166
3167 err = nl80211_key_allowed(dev->ieee80211_ptr);
3168 if (err)
3169 goto out;
3170
3171 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
3172 if (err)
3173 goto out;
3174
3175 #ifdef CONFIG_CFG80211_WEXT
3176 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
3177 #endif
3178 }
3179
3180 out:
3181 wdev_unlock(dev->ieee80211_ptr);
3182
3183 return err;
3184 }
3185
nl80211_new_key(struct sk_buff * skb,struct genl_info * info)3186 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
3187 {
3188 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3189 int err;
3190 struct net_device *dev = info->user_ptr[1];
3191 struct key_parse key;
3192 const u8 *mac_addr = NULL;
3193
3194 err = nl80211_parse_key(info, &key);
3195 if (err)
3196 return err;
3197
3198 if (!key.p.key)
3199 return -EINVAL;
3200
3201 if (info->attrs[NL80211_ATTR_MAC])
3202 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3203
3204 if (key.type == -1) {
3205 if (mac_addr)
3206 key.type = NL80211_KEYTYPE_PAIRWISE;
3207 else
3208 key.type = NL80211_KEYTYPE_GROUP;
3209 }
3210
3211 /* for now */
3212 if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3213 key.type != NL80211_KEYTYPE_GROUP)
3214 return -EINVAL;
3215
3216 if (!rdev->ops->add_key)
3217 return -EOPNOTSUPP;
3218
3219 if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
3220 key.type == NL80211_KEYTYPE_PAIRWISE,
3221 mac_addr))
3222 return -EINVAL;
3223
3224 wdev_lock(dev->ieee80211_ptr);
3225 err = nl80211_key_allowed(dev->ieee80211_ptr);
3226 if (!err)
3227 err = rdev_add_key(rdev, dev, key.idx,
3228 key.type == NL80211_KEYTYPE_PAIRWISE,
3229 mac_addr, &key.p);
3230 wdev_unlock(dev->ieee80211_ptr);
3231
3232 return err;
3233 }
3234
nl80211_del_key(struct sk_buff * skb,struct genl_info * info)3235 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
3236 {
3237 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3238 int err;
3239 struct net_device *dev = info->user_ptr[1];
3240 u8 *mac_addr = NULL;
3241 struct key_parse key;
3242
3243 err = nl80211_parse_key(info, &key);
3244 if (err)
3245 return err;
3246
3247 if (info->attrs[NL80211_ATTR_MAC])
3248 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3249
3250 if (key.type == -1) {
3251 if (mac_addr)
3252 key.type = NL80211_KEYTYPE_PAIRWISE;
3253 else
3254 key.type = NL80211_KEYTYPE_GROUP;
3255 }
3256
3257 /* for now */
3258 if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3259 key.type != NL80211_KEYTYPE_GROUP)
3260 return -EINVAL;
3261
3262 if (!rdev->ops->del_key)
3263 return -EOPNOTSUPP;
3264
3265 wdev_lock(dev->ieee80211_ptr);
3266 err = nl80211_key_allowed(dev->ieee80211_ptr);
3267
3268 if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
3269 !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3270 err = -ENOENT;
3271
3272 if (!err)
3273 err = rdev_del_key(rdev, dev, key.idx,
3274 key.type == NL80211_KEYTYPE_PAIRWISE,
3275 mac_addr);
3276
3277 #ifdef CONFIG_CFG80211_WEXT
3278 if (!err) {
3279 if (key.idx == dev->ieee80211_ptr->wext.default_key)
3280 dev->ieee80211_ptr->wext.default_key = -1;
3281 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
3282 dev->ieee80211_ptr->wext.default_mgmt_key = -1;
3283 }
3284 #endif
3285 wdev_unlock(dev->ieee80211_ptr);
3286
3287 return err;
3288 }
3289
3290 /* This function returns an error or the number of nested attributes */
validate_acl_mac_addrs(struct nlattr * nl_attr)3291 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
3292 {
3293 struct nlattr *attr;
3294 int n_entries = 0, tmp;
3295
3296 nla_for_each_nested(attr, nl_attr, tmp) {
3297 if (nla_len(attr) != ETH_ALEN)
3298 return -EINVAL;
3299
3300 n_entries++;
3301 }
3302
3303 return n_entries;
3304 }
3305
3306 /*
3307 * This function parses ACL information and allocates memory for ACL data.
3308 * On successful return, the calling function is responsible to free the
3309 * ACL buffer returned by this function.
3310 */
parse_acl_data(struct wiphy * wiphy,struct genl_info * info)3311 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3312 struct genl_info *info)
3313 {
3314 enum nl80211_acl_policy acl_policy;
3315 struct nlattr *attr;
3316 struct cfg80211_acl_data *acl;
3317 int i = 0, n_entries, tmp;
3318
3319 if (!wiphy->max_acl_mac_addrs)
3320 return ERR_PTR(-EOPNOTSUPP);
3321
3322 if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3323 return ERR_PTR(-EINVAL);
3324
3325 acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3326 if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3327 acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3328 return ERR_PTR(-EINVAL);
3329
3330 if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3331 return ERR_PTR(-EINVAL);
3332
3333 n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3334 if (n_entries < 0)
3335 return ERR_PTR(n_entries);
3336
3337 if (n_entries > wiphy->max_acl_mac_addrs)
3338 return ERR_PTR(-ENOTSUPP);
3339
3340 acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
3341 GFP_KERNEL);
3342 if (!acl)
3343 return ERR_PTR(-ENOMEM);
3344
3345 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3346 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3347 i++;
3348 }
3349
3350 acl->n_acl_entries = n_entries;
3351 acl->acl_policy = acl_policy;
3352
3353 return acl;
3354 }
3355
nl80211_set_mac_acl(struct sk_buff * skb,struct genl_info * info)3356 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3357 {
3358 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3359 struct net_device *dev = info->user_ptr[1];
3360 struct cfg80211_acl_data *acl;
3361 int err;
3362
3363 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3364 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3365 return -EOPNOTSUPP;
3366
3367 if (!dev->ieee80211_ptr->beacon_interval)
3368 return -EINVAL;
3369
3370 acl = parse_acl_data(&rdev->wiphy, info);
3371 if (IS_ERR(acl))
3372 return PTR_ERR(acl);
3373
3374 err = rdev_set_mac_acl(rdev, dev, acl);
3375
3376 kfree(acl);
3377
3378 return err;
3379 }
3380
rateset_to_mask(struct ieee80211_supported_band * sband,u8 * rates,u8 rates_len)3381 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
3382 u8 *rates, u8 rates_len)
3383 {
3384 u8 i;
3385 u32 mask = 0;
3386
3387 for (i = 0; i < rates_len; i++) {
3388 int rate = (rates[i] & 0x7f) * 5;
3389 int ridx;
3390
3391 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
3392 struct ieee80211_rate *srate =
3393 &sband->bitrates[ridx];
3394 if (rate == srate->bitrate) {
3395 mask |= 1 << ridx;
3396 break;
3397 }
3398 }
3399 if (ridx == sband->n_bitrates)
3400 return 0; /* rate not found */
3401 }
3402
3403 return mask;
3404 }
3405
ht_rateset_to_mask(struct ieee80211_supported_band * sband,u8 * rates,u8 rates_len,u8 mcs[IEEE80211_HT_MCS_MASK_LEN])3406 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
3407 u8 *rates, u8 rates_len,
3408 u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
3409 {
3410 u8 i;
3411
3412 memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
3413
3414 for (i = 0; i < rates_len; i++) {
3415 int ridx, rbit;
3416
3417 ridx = rates[i] / 8;
3418 rbit = BIT(rates[i] % 8);
3419
3420 /* check validity */
3421 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
3422 return false;
3423
3424 /* check availability */
3425 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
3426 mcs[ridx] |= rbit;
3427 else
3428 return false;
3429 }
3430
3431 return true;
3432 }
3433
vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)3434 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
3435 {
3436 u16 mcs_mask = 0;
3437
3438 switch (vht_mcs_map) {
3439 case IEEE80211_VHT_MCS_NOT_SUPPORTED:
3440 break;
3441 case IEEE80211_VHT_MCS_SUPPORT_0_7:
3442 mcs_mask = 0x00FF;
3443 break;
3444 case IEEE80211_VHT_MCS_SUPPORT_0_8:
3445 mcs_mask = 0x01FF;
3446 break;
3447 case IEEE80211_VHT_MCS_SUPPORT_0_9:
3448 mcs_mask = 0x03FF;
3449 break;
3450 default:
3451 break;
3452 }
3453
3454 return mcs_mask;
3455 }
3456
vht_build_mcs_mask(u16 vht_mcs_map,u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])3457 static void vht_build_mcs_mask(u16 vht_mcs_map,
3458 u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
3459 {
3460 u8 nss;
3461
3462 for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
3463 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
3464 vht_mcs_map >>= 2;
3465 }
3466 }
3467
vht_set_mcs_mask(struct ieee80211_supported_band * sband,struct nl80211_txrate_vht * txrate,u16 mcs[NL80211_VHT_NSS_MAX])3468 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
3469 struct nl80211_txrate_vht *txrate,
3470 u16 mcs[NL80211_VHT_NSS_MAX])
3471 {
3472 u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
3473 u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
3474 u8 i;
3475
3476 if (!sband->vht_cap.vht_supported)
3477 return false;
3478
3479 memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
3480
3481 /* Build vht_mcs_mask from VHT capabilities */
3482 vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
3483
3484 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
3485 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
3486 mcs[i] = txrate->mcs[i];
3487 else
3488 return false;
3489 }
3490
3491 return true;
3492 }
3493
3494 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
3495 [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
3496 .len = NL80211_MAX_SUPP_RATES },
3497 [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
3498 .len = NL80211_MAX_SUPP_HT_RATES },
3499 [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
3500 [NL80211_TXRATE_GI] = { .type = NLA_U8 },
3501 };
3502
nl80211_parse_tx_bitrate_mask(struct genl_info * info,struct cfg80211_bitrate_mask * mask)3503 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
3504 struct cfg80211_bitrate_mask *mask)
3505 {
3506 struct nlattr *tb[NL80211_TXRATE_MAX + 1];
3507 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3508 int rem, i;
3509 struct nlattr *tx_rates;
3510 struct ieee80211_supported_band *sband;
3511 u16 vht_tx_mcs_map;
3512
3513 memset(mask, 0, sizeof(*mask));
3514 /* Default to all rates enabled */
3515 for (i = 0; i < NUM_NL80211_BANDS; i++) {
3516 sband = rdev->wiphy.bands[i];
3517
3518 if (!sband)
3519 continue;
3520
3521 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
3522 memcpy(mask->control[i].ht_mcs,
3523 sband->ht_cap.mcs.rx_mask,
3524 sizeof(mask->control[i].ht_mcs));
3525
3526 if (!sband->vht_cap.vht_supported)
3527 continue;
3528
3529 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
3530 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
3531 }
3532
3533 /* if no rates are given set it back to the defaults */
3534 if (!info->attrs[NL80211_ATTR_TX_RATES])
3535 goto out;
3536
3537 /* The nested attribute uses enum nl80211_band as the index. This maps
3538 * directly to the enum nl80211_band values used in cfg80211.
3539 */
3540 BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
3541 nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
3542 enum nl80211_band band = nla_type(tx_rates);
3543 int err;
3544
3545 if (band < 0 || band >= NUM_NL80211_BANDS)
3546 return -EINVAL;
3547 sband = rdev->wiphy.bands[band];
3548 if (sband == NULL)
3549 return -EINVAL;
3550 err = nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
3551 nla_len(tx_rates), nl80211_txattr_policy);
3552 if (err)
3553 return err;
3554 if (tb[NL80211_TXRATE_LEGACY]) {
3555 mask->control[band].legacy = rateset_to_mask(
3556 sband,
3557 nla_data(tb[NL80211_TXRATE_LEGACY]),
3558 nla_len(tb[NL80211_TXRATE_LEGACY]));
3559 if ((mask->control[band].legacy == 0) &&
3560 nla_len(tb[NL80211_TXRATE_LEGACY]))
3561 return -EINVAL;
3562 }
3563 if (tb[NL80211_TXRATE_HT]) {
3564 if (!ht_rateset_to_mask(
3565 sband,
3566 nla_data(tb[NL80211_TXRATE_HT]),
3567 nla_len(tb[NL80211_TXRATE_HT]),
3568 mask->control[band].ht_mcs))
3569 return -EINVAL;
3570 }
3571 if (tb[NL80211_TXRATE_VHT]) {
3572 if (!vht_set_mcs_mask(
3573 sband,
3574 nla_data(tb[NL80211_TXRATE_VHT]),
3575 mask->control[band].vht_mcs))
3576 return -EINVAL;
3577 }
3578 if (tb[NL80211_TXRATE_GI]) {
3579 mask->control[band].gi =
3580 nla_get_u8(tb[NL80211_TXRATE_GI]);
3581 if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
3582 return -EINVAL;
3583 }
3584
3585 if (mask->control[band].legacy == 0) {
3586 /* don't allow empty legacy rates if HT or VHT
3587 * are not even supported.
3588 */
3589 if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
3590 rdev->wiphy.bands[band]->vht_cap.vht_supported))
3591 return -EINVAL;
3592
3593 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
3594 if (mask->control[band].ht_mcs[i])
3595 goto out;
3596
3597 for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
3598 if (mask->control[band].vht_mcs[i])
3599 goto out;
3600
3601 /* legacy and mcs rates may not be both empty */
3602 return -EINVAL;
3603 }
3604 }
3605
3606 out:
3607 return 0;
3608 }
3609
validate_beacon_tx_rate(struct cfg80211_registered_device * rdev,enum nl80211_band band,struct cfg80211_bitrate_mask * beacon_rate)3610 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
3611 enum nl80211_band band,
3612 struct cfg80211_bitrate_mask *beacon_rate)
3613 {
3614 u32 count_ht, count_vht, i;
3615 u32 rate = beacon_rate->control[band].legacy;
3616
3617 /* Allow only one rate */
3618 if (hweight32(rate) > 1)
3619 return -EINVAL;
3620
3621 count_ht = 0;
3622 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3623 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
3624 return -EINVAL;
3625 } else if (beacon_rate->control[band].ht_mcs[i]) {
3626 count_ht++;
3627 if (count_ht > 1)
3628 return -EINVAL;
3629 }
3630 if (count_ht && rate)
3631 return -EINVAL;
3632 }
3633
3634 count_vht = 0;
3635 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
3636 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
3637 return -EINVAL;
3638 } else if (beacon_rate->control[band].vht_mcs[i]) {
3639 count_vht++;
3640 if (count_vht > 1)
3641 return -EINVAL;
3642 }
3643 if (count_vht && rate)
3644 return -EINVAL;
3645 }
3646
3647 if ((count_ht && count_vht) || (!rate && !count_ht && !count_vht))
3648 return -EINVAL;
3649
3650 if (rate &&
3651 !wiphy_ext_feature_isset(&rdev->wiphy,
3652 NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
3653 return -EINVAL;
3654 if (count_ht &&
3655 !wiphy_ext_feature_isset(&rdev->wiphy,
3656 NL80211_EXT_FEATURE_BEACON_RATE_HT))
3657 return -EINVAL;
3658 if (count_vht &&
3659 !wiphy_ext_feature_isset(&rdev->wiphy,
3660 NL80211_EXT_FEATURE_BEACON_RATE_VHT))
3661 return -EINVAL;
3662
3663 return 0;
3664 }
3665
nl80211_parse_beacon(struct nlattr * attrs[],struct cfg80211_beacon_data * bcn)3666 static int nl80211_parse_beacon(struct nlattr *attrs[],
3667 struct cfg80211_beacon_data *bcn)
3668 {
3669 bool haveinfo = false;
3670
3671 if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
3672 !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
3673 !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
3674 !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
3675 return -EINVAL;
3676
3677 memset(bcn, 0, sizeof(*bcn));
3678
3679 if (attrs[NL80211_ATTR_BEACON_HEAD]) {
3680 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
3681 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
3682 if (!bcn->head_len)
3683 return -EINVAL;
3684 haveinfo = true;
3685 }
3686
3687 if (attrs[NL80211_ATTR_BEACON_TAIL]) {
3688 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
3689 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
3690 haveinfo = true;
3691 }
3692
3693 if (!haveinfo)
3694 return -EINVAL;
3695
3696 if (attrs[NL80211_ATTR_IE]) {
3697 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
3698 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
3699 }
3700
3701 if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
3702 bcn->proberesp_ies =
3703 nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3704 bcn->proberesp_ies_len =
3705 nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3706 }
3707
3708 if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
3709 bcn->assocresp_ies =
3710 nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3711 bcn->assocresp_ies_len =
3712 nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3713 }
3714
3715 if (attrs[NL80211_ATTR_PROBE_RESP]) {
3716 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
3717 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
3718 }
3719
3720 return 0;
3721 }
3722
nl80211_get_ap_channel(struct cfg80211_registered_device * rdev,struct cfg80211_ap_settings * params)3723 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
3724 struct cfg80211_ap_settings *params)
3725 {
3726 struct wireless_dev *wdev;
3727 bool ret = false;
3728
3729 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
3730 if (wdev->iftype != NL80211_IFTYPE_AP &&
3731 wdev->iftype != NL80211_IFTYPE_P2P_GO)
3732 continue;
3733
3734 if (!wdev->preset_chandef.chan)
3735 continue;
3736
3737 params->chandef = wdev->preset_chandef;
3738 ret = true;
3739 break;
3740 }
3741
3742 return ret;
3743 }
3744
nl80211_valid_auth_type(struct cfg80211_registered_device * rdev,enum nl80211_auth_type auth_type,enum nl80211_commands cmd)3745 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3746 enum nl80211_auth_type auth_type,
3747 enum nl80211_commands cmd)
3748 {
3749 if (auth_type > NL80211_AUTHTYPE_MAX)
3750 return false;
3751
3752 switch (cmd) {
3753 case NL80211_CMD_AUTHENTICATE:
3754 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3755 auth_type == NL80211_AUTHTYPE_SAE)
3756 return false;
3757 return true;
3758 case NL80211_CMD_CONNECT:
3759 case NL80211_CMD_START_AP:
3760 /* SAE not supported yet */
3761 if (auth_type == NL80211_AUTHTYPE_SAE)
3762 return false;
3763 return true;
3764 default:
3765 return false;
3766 }
3767 }
3768
nl80211_start_ap(struct sk_buff * skb,struct genl_info * info)3769 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3770 {
3771 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3772 struct net_device *dev = info->user_ptr[1];
3773 struct wireless_dev *wdev = dev->ieee80211_ptr;
3774 struct cfg80211_ap_settings params;
3775 int err;
3776
3777 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3778 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3779 return -EOPNOTSUPP;
3780
3781 if (!rdev->ops->start_ap)
3782 return -EOPNOTSUPP;
3783
3784 if (wdev->beacon_interval)
3785 return -EALREADY;
3786
3787 memset(¶ms, 0, sizeof(params));
3788
3789 /* these are required for START_AP */
3790 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3791 !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3792 !info->attrs[NL80211_ATTR_BEACON_HEAD])
3793 return -EINVAL;
3794
3795 err = nl80211_parse_beacon(info->attrs, ¶ms.beacon);
3796 if (err)
3797 return err;
3798
3799 params.beacon_interval =
3800 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3801 params.dtim_period =
3802 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3803
3804 err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
3805 if (err)
3806 return err;
3807
3808 /*
3809 * In theory, some of these attributes should be required here
3810 * but since they were not used when the command was originally
3811 * added, keep them optional for old user space programs to let
3812 * them continue to work with drivers that do not need the
3813 * additional information -- drivers must check!
3814 */
3815 if (info->attrs[NL80211_ATTR_SSID]) {
3816 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3817 params.ssid_len =
3818 nla_len(info->attrs[NL80211_ATTR_SSID]);
3819 if (params.ssid_len == 0 ||
3820 params.ssid_len > IEEE80211_MAX_SSID_LEN)
3821 return -EINVAL;
3822 }
3823
3824 if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3825 params.hidden_ssid = nla_get_u32(
3826 info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3827 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3828 params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3829 params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3830 return -EINVAL;
3831 }
3832
3833 params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3834
3835 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3836 params.auth_type = nla_get_u32(
3837 info->attrs[NL80211_ATTR_AUTH_TYPE]);
3838 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3839 NL80211_CMD_START_AP))
3840 return -EINVAL;
3841 } else
3842 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3843
3844 err = nl80211_crypto_settings(rdev, info, ¶ms.crypto,
3845 NL80211_MAX_NR_CIPHER_SUITES);
3846 if (err)
3847 return err;
3848
3849 if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3850 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3851 return -EOPNOTSUPP;
3852 params.inactivity_timeout = nla_get_u16(
3853 info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3854 }
3855
3856 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3857 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3858 return -EINVAL;
3859 params.p2p_ctwindow =
3860 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3861 if (params.p2p_ctwindow > 127)
3862 return -EINVAL;
3863 if (params.p2p_ctwindow != 0 &&
3864 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3865 return -EINVAL;
3866 }
3867
3868 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3869 u8 tmp;
3870
3871 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3872 return -EINVAL;
3873 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3874 if (tmp > 1)
3875 return -EINVAL;
3876 params.p2p_opp_ps = tmp;
3877 if (params.p2p_opp_ps != 0 &&
3878 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3879 return -EINVAL;
3880 }
3881
3882 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3883 err = nl80211_parse_chandef(rdev, info, ¶ms.chandef);
3884 if (err)
3885 return err;
3886 } else if (wdev->preset_chandef.chan) {
3887 params.chandef = wdev->preset_chandef;
3888 } else if (!nl80211_get_ap_channel(rdev, ¶ms))
3889 return -EINVAL;
3890
3891 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms.chandef,
3892 wdev->iftype))
3893 return -EINVAL;
3894
3895 if (info->attrs[NL80211_ATTR_TX_RATES]) {
3896 err = nl80211_parse_tx_bitrate_mask(info, ¶ms.beacon_rate);
3897 if (err)
3898 return err;
3899
3900 err = validate_beacon_tx_rate(rdev, params.chandef.chan->band,
3901 ¶ms.beacon_rate);
3902 if (err)
3903 return err;
3904 }
3905
3906 if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
3907 params.smps_mode =
3908 nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
3909 switch (params.smps_mode) {
3910 case NL80211_SMPS_OFF:
3911 break;
3912 case NL80211_SMPS_STATIC:
3913 if (!(rdev->wiphy.features &
3914 NL80211_FEATURE_STATIC_SMPS))
3915 return -EINVAL;
3916 break;
3917 case NL80211_SMPS_DYNAMIC:
3918 if (!(rdev->wiphy.features &
3919 NL80211_FEATURE_DYNAMIC_SMPS))
3920 return -EINVAL;
3921 break;
3922 default:
3923 return -EINVAL;
3924 }
3925 } else {
3926 params.smps_mode = NL80211_SMPS_OFF;
3927 }
3928
3929 params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
3930 if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ])
3931 return -EOPNOTSUPP;
3932
3933 if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
3934 params.acl = parse_acl_data(&rdev->wiphy, info);
3935 if (IS_ERR(params.acl))
3936 return PTR_ERR(params.acl);
3937 }
3938
3939 wdev_lock(wdev);
3940 err = rdev_start_ap(rdev, dev, ¶ms);
3941 if (!err) {
3942 wdev->preset_chandef = params.chandef;
3943 wdev->beacon_interval = params.beacon_interval;
3944 wdev->chandef = params.chandef;
3945 wdev->ssid_len = params.ssid_len;
3946 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3947 }
3948 wdev_unlock(wdev);
3949
3950 kfree(params.acl);
3951
3952 return err;
3953 }
3954
nl80211_set_beacon(struct sk_buff * skb,struct genl_info * info)3955 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
3956 {
3957 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3958 struct net_device *dev = info->user_ptr[1];
3959 struct wireless_dev *wdev = dev->ieee80211_ptr;
3960 struct cfg80211_beacon_data params;
3961 int err;
3962
3963 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3964 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3965 return -EOPNOTSUPP;
3966
3967 if (!rdev->ops->change_beacon)
3968 return -EOPNOTSUPP;
3969
3970 if (!wdev->beacon_interval)
3971 return -EINVAL;
3972
3973 err = nl80211_parse_beacon(info->attrs, ¶ms);
3974 if (err)
3975 return err;
3976
3977 wdev_lock(wdev);
3978 err = rdev_change_beacon(rdev, dev, ¶ms);
3979 wdev_unlock(wdev);
3980
3981 return err;
3982 }
3983
nl80211_stop_ap(struct sk_buff * skb,struct genl_info * info)3984 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3985 {
3986 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3987 struct net_device *dev = info->user_ptr[1];
3988
3989 return cfg80211_stop_ap(rdev, dev, false);
3990 }
3991
3992 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
3993 [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
3994 [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
3995 [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3996 [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
3997 [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
3998 [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
3999 };
4000
parse_station_flags(struct genl_info * info,enum nl80211_iftype iftype,struct station_parameters * params)4001 static int parse_station_flags(struct genl_info *info,
4002 enum nl80211_iftype iftype,
4003 struct station_parameters *params)
4004 {
4005 struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
4006 struct nlattr *nla;
4007 int flag;
4008
4009 /*
4010 * Try parsing the new attribute first so userspace
4011 * can specify both for older kernels.
4012 */
4013 nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
4014 if (nla) {
4015 struct nl80211_sta_flag_update *sta_flags;
4016
4017 sta_flags = nla_data(nla);
4018 params->sta_flags_mask = sta_flags->mask;
4019 params->sta_flags_set = sta_flags->set;
4020 params->sta_flags_set &= params->sta_flags_mask;
4021 if ((params->sta_flags_mask |
4022 params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
4023 return -EINVAL;
4024 return 0;
4025 }
4026
4027 /* if present, parse the old attribute */
4028
4029 nla = info->attrs[NL80211_ATTR_STA_FLAGS];
4030 if (!nla)
4031 return 0;
4032
4033 if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
4034 nla, sta_flags_policy))
4035 return -EINVAL;
4036
4037 /*
4038 * Only allow certain flags for interface types so that
4039 * other attributes are silently ignored. Remember that
4040 * this is backward compatibility code with old userspace
4041 * and shouldn't be hit in other cases anyway.
4042 */
4043 switch (iftype) {
4044 case NL80211_IFTYPE_AP:
4045 case NL80211_IFTYPE_AP_VLAN:
4046 case NL80211_IFTYPE_P2P_GO:
4047 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4048 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4049 BIT(NL80211_STA_FLAG_WME) |
4050 BIT(NL80211_STA_FLAG_MFP);
4051 break;
4052 case NL80211_IFTYPE_P2P_CLIENT:
4053 case NL80211_IFTYPE_STATION:
4054 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4055 BIT(NL80211_STA_FLAG_TDLS_PEER);
4056 break;
4057 case NL80211_IFTYPE_MESH_POINT:
4058 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4059 BIT(NL80211_STA_FLAG_MFP) |
4060 BIT(NL80211_STA_FLAG_AUTHORIZED);
4061 default:
4062 return -EINVAL;
4063 }
4064
4065 for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
4066 if (flags[flag]) {
4067 params->sta_flags_set |= (1<<flag);
4068
4069 /* no longer support new API additions in old API */
4070 if (flag > NL80211_STA_FLAG_MAX_OLD_API)
4071 return -EINVAL;
4072 }
4073 }
4074
4075 return 0;
4076 }
4077
nl80211_put_sta_rate(struct sk_buff * msg,struct rate_info * info,int attr)4078 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
4079 int attr)
4080 {
4081 struct nlattr *rate;
4082 u32 bitrate;
4083 u16 bitrate_compat;
4084 enum nl80211_rate_info rate_flg;
4085
4086 rate = nla_nest_start(msg, attr);
4087 if (!rate)
4088 return false;
4089
4090 /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
4091 bitrate = cfg80211_calculate_bitrate(info);
4092 /* report 16-bit bitrate only if we can */
4093 bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
4094 if (bitrate > 0 &&
4095 nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
4096 return false;
4097 if (bitrate_compat > 0 &&
4098 nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
4099 return false;
4100
4101 switch (info->bw) {
4102 case RATE_INFO_BW_5:
4103 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
4104 break;
4105 case RATE_INFO_BW_10:
4106 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
4107 break;
4108 default:
4109 WARN_ON(1);
4110 /* fall through */
4111 case RATE_INFO_BW_20:
4112 rate_flg = 0;
4113 break;
4114 case RATE_INFO_BW_40:
4115 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
4116 break;
4117 case RATE_INFO_BW_80:
4118 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
4119 break;
4120 case RATE_INFO_BW_160:
4121 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
4122 break;
4123 }
4124
4125 if (rate_flg && nla_put_flag(msg, rate_flg))
4126 return false;
4127
4128 if (info->flags & RATE_INFO_FLAGS_MCS) {
4129 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
4130 return false;
4131 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4132 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4133 return false;
4134 } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
4135 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
4136 return false;
4137 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
4138 return false;
4139 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4140 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4141 return false;
4142 }
4143
4144 nla_nest_end(msg, rate);
4145 return true;
4146 }
4147
nl80211_put_signal(struct sk_buff * msg,u8 mask,s8 * signal,int id)4148 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
4149 int id)
4150 {
4151 void *attr;
4152 int i = 0;
4153
4154 if (!mask)
4155 return true;
4156
4157 attr = nla_nest_start(msg, id);
4158 if (!attr)
4159 return false;
4160
4161 for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
4162 if (!(mask & BIT(i)))
4163 continue;
4164
4165 if (nla_put_u8(msg, i, signal[i]))
4166 return false;
4167 }
4168
4169 nla_nest_end(msg, attr);
4170
4171 return true;
4172 }
4173
nl80211_send_station(struct sk_buff * msg,u32 cmd,u32 portid,u32 seq,int flags,struct cfg80211_registered_device * rdev,struct net_device * dev,const u8 * mac_addr,struct station_info * sinfo)4174 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
4175 u32 seq, int flags,
4176 struct cfg80211_registered_device *rdev,
4177 struct net_device *dev,
4178 const u8 *mac_addr, struct station_info *sinfo)
4179 {
4180 void *hdr;
4181 struct nlattr *sinfoattr, *bss_param;
4182
4183 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
4184 if (!hdr)
4185 return -1;
4186
4187 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4188 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
4189 nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
4190 goto nla_put_failure;
4191
4192 sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
4193 if (!sinfoattr)
4194 goto nla_put_failure;
4195
4196 #define PUT_SINFO(attr, memb, type) do { \
4197 BUILD_BUG_ON(sizeof(type) == sizeof(u64)); \
4198 if (sinfo->filled & (1ULL << NL80211_STA_INFO_ ## attr) && \
4199 nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr, \
4200 sinfo->memb)) \
4201 goto nla_put_failure; \
4202 } while (0)
4203 #define PUT_SINFO_U64(attr, memb) do { \
4204 if (sinfo->filled & (1ULL << NL80211_STA_INFO_ ## attr) && \
4205 nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr, \
4206 sinfo->memb, NL80211_STA_INFO_PAD)) \
4207 goto nla_put_failure; \
4208 } while (0)
4209
4210 PUT_SINFO(CONNECTED_TIME, connected_time, u32);
4211 PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
4212
4213 if (sinfo->filled & (BIT(NL80211_STA_INFO_RX_BYTES) |
4214 BIT(NL80211_STA_INFO_RX_BYTES64)) &&
4215 nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
4216 (u32)sinfo->rx_bytes))
4217 goto nla_put_failure;
4218
4219 if (sinfo->filled & (BIT(NL80211_STA_INFO_TX_BYTES) |
4220 BIT(NL80211_STA_INFO_TX_BYTES64)) &&
4221 nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
4222 (u32)sinfo->tx_bytes))
4223 goto nla_put_failure;
4224
4225 PUT_SINFO_U64(RX_BYTES64, rx_bytes);
4226 PUT_SINFO_U64(TX_BYTES64, tx_bytes);
4227 PUT_SINFO(LLID, llid, u16);
4228 PUT_SINFO(PLID, plid, u16);
4229 PUT_SINFO(PLINK_STATE, plink_state, u8);
4230 PUT_SINFO_U64(RX_DURATION, rx_duration);
4231
4232 switch (rdev->wiphy.signal_type) {
4233 case CFG80211_SIGNAL_TYPE_MBM:
4234 PUT_SINFO(SIGNAL, signal, u8);
4235 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
4236 break;
4237 default:
4238 break;
4239 }
4240 if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL)) {
4241 if (!nl80211_put_signal(msg, sinfo->chains,
4242 sinfo->chain_signal,
4243 NL80211_STA_INFO_CHAIN_SIGNAL))
4244 goto nla_put_failure;
4245 }
4246 if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
4247 if (!nl80211_put_signal(msg, sinfo->chains,
4248 sinfo->chain_signal_avg,
4249 NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
4250 goto nla_put_failure;
4251 }
4252 if (sinfo->filled & BIT(NL80211_STA_INFO_TX_BITRATE)) {
4253 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
4254 NL80211_STA_INFO_TX_BITRATE))
4255 goto nla_put_failure;
4256 }
4257 if (sinfo->filled & BIT(NL80211_STA_INFO_RX_BITRATE)) {
4258 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
4259 NL80211_STA_INFO_RX_BITRATE))
4260 goto nla_put_failure;
4261 }
4262
4263 PUT_SINFO(RX_PACKETS, rx_packets, u32);
4264 PUT_SINFO(TX_PACKETS, tx_packets, u32);
4265 PUT_SINFO(TX_RETRIES, tx_retries, u32);
4266 PUT_SINFO(TX_FAILED, tx_failed, u32);
4267 PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
4268 PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
4269 PUT_SINFO(LOCAL_PM, local_pm, u32);
4270 PUT_SINFO(PEER_PM, peer_pm, u32);
4271 PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
4272
4273 if (sinfo->filled & BIT(NL80211_STA_INFO_BSS_PARAM)) {
4274 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
4275 if (!bss_param)
4276 goto nla_put_failure;
4277
4278 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
4279 nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
4280 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
4281 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
4282 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
4283 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
4284 nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
4285 sinfo->bss_param.dtim_period) ||
4286 nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
4287 sinfo->bss_param.beacon_interval))
4288 goto nla_put_failure;
4289
4290 nla_nest_end(msg, bss_param);
4291 }
4292 if ((sinfo->filled & BIT(NL80211_STA_INFO_STA_FLAGS)) &&
4293 nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
4294 sizeof(struct nl80211_sta_flag_update),
4295 &sinfo->sta_flags))
4296 goto nla_put_failure;
4297
4298 PUT_SINFO_U64(T_OFFSET, t_offset);
4299 PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
4300 PUT_SINFO_U64(BEACON_RX, rx_beacon);
4301 PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
4302
4303 #undef PUT_SINFO
4304 #undef PUT_SINFO_U64
4305
4306 if (sinfo->filled & BIT(NL80211_STA_INFO_TID_STATS)) {
4307 struct nlattr *tidsattr;
4308 int tid;
4309
4310 tidsattr = nla_nest_start(msg, NL80211_STA_INFO_TID_STATS);
4311 if (!tidsattr)
4312 goto nla_put_failure;
4313
4314 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
4315 struct cfg80211_tid_stats *tidstats;
4316 struct nlattr *tidattr;
4317
4318 tidstats = &sinfo->pertid[tid];
4319
4320 if (!tidstats->filled)
4321 continue;
4322
4323 tidattr = nla_nest_start(msg, tid + 1);
4324 if (!tidattr)
4325 goto nla_put_failure;
4326
4327 #define PUT_TIDVAL_U64(attr, memb) do { \
4328 if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) && \
4329 nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr, \
4330 tidstats->memb, NL80211_TID_STATS_PAD)) \
4331 goto nla_put_failure; \
4332 } while (0)
4333
4334 PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
4335 PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
4336 PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
4337 PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
4338
4339 #undef PUT_TIDVAL_U64
4340 nla_nest_end(msg, tidattr);
4341 }
4342
4343 nla_nest_end(msg, tidsattr);
4344 }
4345
4346 nla_nest_end(msg, sinfoattr);
4347
4348 if (sinfo->assoc_req_ies_len &&
4349 nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
4350 sinfo->assoc_req_ies))
4351 goto nla_put_failure;
4352
4353 genlmsg_end(msg, hdr);
4354 return 0;
4355
4356 nla_put_failure:
4357 genlmsg_cancel(msg, hdr);
4358 return -EMSGSIZE;
4359 }
4360
nl80211_dump_station(struct sk_buff * skb,struct netlink_callback * cb)4361 static int nl80211_dump_station(struct sk_buff *skb,
4362 struct netlink_callback *cb)
4363 {
4364 struct station_info sinfo;
4365 struct cfg80211_registered_device *rdev;
4366 struct wireless_dev *wdev;
4367 u8 mac_addr[ETH_ALEN];
4368 int sta_idx = cb->args[2];
4369 int err;
4370
4371 rtnl_lock();
4372 err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4373 if (err)
4374 goto out_err;
4375
4376 if (!wdev->netdev) {
4377 err = -EINVAL;
4378 goto out_err;
4379 }
4380
4381 if (!rdev->ops->dump_station) {
4382 err = -EOPNOTSUPP;
4383 goto out_err;
4384 }
4385
4386 while (1) {
4387 memset(&sinfo, 0, sizeof(sinfo));
4388 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
4389 mac_addr, &sinfo);
4390 if (err == -ENOENT)
4391 break;
4392 if (err)
4393 goto out_err;
4394
4395 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
4396 NETLINK_CB(cb->skb).portid,
4397 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4398 rdev, wdev->netdev, mac_addr,
4399 &sinfo) < 0)
4400 goto out;
4401
4402 sta_idx++;
4403 }
4404
4405 out:
4406 cb->args[2] = sta_idx;
4407 err = skb->len;
4408 out_err:
4409 rtnl_unlock();
4410
4411 return err;
4412 }
4413
nl80211_get_station(struct sk_buff * skb,struct genl_info * info)4414 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
4415 {
4416 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4417 struct net_device *dev = info->user_ptr[1];
4418 struct station_info sinfo;
4419 struct sk_buff *msg;
4420 u8 *mac_addr = NULL;
4421 int err;
4422
4423 memset(&sinfo, 0, sizeof(sinfo));
4424
4425 if (!info->attrs[NL80211_ATTR_MAC])
4426 return -EINVAL;
4427
4428 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4429
4430 if (!rdev->ops->get_station)
4431 return -EOPNOTSUPP;
4432
4433 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
4434 if (err)
4435 return err;
4436
4437 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4438 if (!msg)
4439 return -ENOMEM;
4440
4441 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
4442 info->snd_portid, info->snd_seq, 0,
4443 rdev, dev, mac_addr, &sinfo) < 0) {
4444 nlmsg_free(msg);
4445 return -ENOBUFS;
4446 }
4447
4448 return genlmsg_reply(msg, info);
4449 }
4450
cfg80211_check_station_change(struct wiphy * wiphy,struct station_parameters * params,enum cfg80211_station_type statype)4451 int cfg80211_check_station_change(struct wiphy *wiphy,
4452 struct station_parameters *params,
4453 enum cfg80211_station_type statype)
4454 {
4455 if (params->listen_interval != -1 &&
4456 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4457 return -EINVAL;
4458
4459 if (params->support_p2p_ps != -1 &&
4460 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4461 return -EINVAL;
4462
4463 if (params->aid &&
4464 !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
4465 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4466 return -EINVAL;
4467
4468 /* When you run into this, adjust the code below for the new flag */
4469 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4470
4471 switch (statype) {
4472 case CFG80211_STA_MESH_PEER_KERNEL:
4473 case CFG80211_STA_MESH_PEER_USER:
4474 /*
4475 * No ignoring the TDLS flag here -- the userspace mesh
4476 * code doesn't have the bug of including TDLS in the
4477 * mask everywhere.
4478 */
4479 if (params->sta_flags_mask &
4480 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4481 BIT(NL80211_STA_FLAG_MFP) |
4482 BIT(NL80211_STA_FLAG_AUTHORIZED)))
4483 return -EINVAL;
4484 break;
4485 case CFG80211_STA_TDLS_PEER_SETUP:
4486 case CFG80211_STA_TDLS_PEER_ACTIVE:
4487 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4488 return -EINVAL;
4489 /* ignore since it can't change */
4490 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4491 break;
4492 default:
4493 /* disallow mesh-specific things */
4494 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
4495 return -EINVAL;
4496 if (params->local_pm)
4497 return -EINVAL;
4498 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4499 return -EINVAL;
4500 }
4501
4502 if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4503 statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
4504 /* TDLS can't be set, ... */
4505 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
4506 return -EINVAL;
4507 /*
4508 * ... but don't bother the driver with it. This works around
4509 * a hostapd/wpa_supplicant issue -- it always includes the
4510 * TLDS_PEER flag in the mask even for AP mode.
4511 */
4512 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4513 }
4514
4515 if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4516 statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4517 /* reject other things that can't change */
4518 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
4519 return -EINVAL;
4520 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
4521 return -EINVAL;
4522 if (params->supported_rates)
4523 return -EINVAL;
4524 if (params->ext_capab || params->ht_capa || params->vht_capa)
4525 return -EINVAL;
4526 }
4527
4528 if (statype != CFG80211_STA_AP_CLIENT &&
4529 statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4530 if (params->vlan)
4531 return -EINVAL;
4532 }
4533
4534 switch (statype) {
4535 case CFG80211_STA_AP_MLME_CLIENT:
4536 /* Use this only for authorizing/unauthorizing a station */
4537 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
4538 return -EOPNOTSUPP;
4539 break;
4540 case CFG80211_STA_AP_CLIENT:
4541 case CFG80211_STA_AP_CLIENT_UNASSOC:
4542 /* accept only the listed bits */
4543 if (params->sta_flags_mask &
4544 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4545 BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4546 BIT(NL80211_STA_FLAG_ASSOCIATED) |
4547 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4548 BIT(NL80211_STA_FLAG_WME) |
4549 BIT(NL80211_STA_FLAG_MFP)))
4550 return -EINVAL;
4551
4552 /* but authenticated/associated only if driver handles it */
4553 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4554 params->sta_flags_mask &
4555 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4556 BIT(NL80211_STA_FLAG_ASSOCIATED)))
4557 return -EINVAL;
4558 break;
4559 case CFG80211_STA_IBSS:
4560 case CFG80211_STA_AP_STA:
4561 /* reject any changes other than AUTHORIZED */
4562 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
4563 return -EINVAL;
4564 break;
4565 case CFG80211_STA_TDLS_PEER_SETUP:
4566 /* reject any changes other than AUTHORIZED or WME */
4567 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4568 BIT(NL80211_STA_FLAG_WME)))
4569 return -EINVAL;
4570 /* force (at least) rates when authorizing */
4571 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
4572 !params->supported_rates)
4573 return -EINVAL;
4574 break;
4575 case CFG80211_STA_TDLS_PEER_ACTIVE:
4576 /* reject any changes */
4577 return -EINVAL;
4578 case CFG80211_STA_MESH_PEER_KERNEL:
4579 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4580 return -EINVAL;
4581 break;
4582 case CFG80211_STA_MESH_PEER_USER:
4583 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
4584 params->plink_action != NL80211_PLINK_ACTION_BLOCK)
4585 return -EINVAL;
4586 break;
4587 }
4588
4589 return 0;
4590 }
4591 EXPORT_SYMBOL(cfg80211_check_station_change);
4592
4593 /*
4594 * Get vlan interface making sure it is running and on the right wiphy.
4595 */
get_vlan(struct genl_info * info,struct cfg80211_registered_device * rdev)4596 static struct net_device *get_vlan(struct genl_info *info,
4597 struct cfg80211_registered_device *rdev)
4598 {
4599 struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
4600 struct net_device *v;
4601 int ret;
4602
4603 if (!vlanattr)
4604 return NULL;
4605
4606 v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
4607 if (!v)
4608 return ERR_PTR(-ENODEV);
4609
4610 if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
4611 ret = -EINVAL;
4612 goto error;
4613 }
4614
4615 if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4616 v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4617 v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
4618 ret = -EINVAL;
4619 goto error;
4620 }
4621
4622 if (!netif_running(v)) {
4623 ret = -ENETDOWN;
4624 goto error;
4625 }
4626
4627 return v;
4628 error:
4629 dev_put(v);
4630 return ERR_PTR(ret);
4631 }
4632
4633 static const struct nla_policy
4634 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
4635 [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
4636 [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
4637 };
4638
nl80211_parse_sta_wme(struct genl_info * info,struct station_parameters * params)4639 static int nl80211_parse_sta_wme(struct genl_info *info,
4640 struct station_parameters *params)
4641 {
4642 struct nlattr *tb[NL80211_STA_WME_MAX + 1];
4643 struct nlattr *nla;
4644 int err;
4645
4646 /* parse WME attributes if present */
4647 if (!info->attrs[NL80211_ATTR_STA_WME])
4648 return 0;
4649
4650 nla = info->attrs[NL80211_ATTR_STA_WME];
4651 err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
4652 nl80211_sta_wme_policy);
4653 if (err)
4654 return err;
4655
4656 if (tb[NL80211_STA_WME_UAPSD_QUEUES])
4657 params->uapsd_queues = nla_get_u8(
4658 tb[NL80211_STA_WME_UAPSD_QUEUES]);
4659 if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
4660 return -EINVAL;
4661
4662 if (tb[NL80211_STA_WME_MAX_SP])
4663 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
4664
4665 if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
4666 return -EINVAL;
4667
4668 params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
4669
4670 return 0;
4671 }
4672
nl80211_parse_sta_channel_info(struct genl_info * info,struct station_parameters * params)4673 static int nl80211_parse_sta_channel_info(struct genl_info *info,
4674 struct station_parameters *params)
4675 {
4676 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
4677 params->supported_channels =
4678 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4679 params->supported_channels_len =
4680 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4681 /*
4682 * Need to include at least one (first channel, number of
4683 * channels) tuple for each subband, and must have proper
4684 * tuples for the rest of the data as well.
4685 */
4686 if (params->supported_channels_len < 2)
4687 return -EINVAL;
4688 if (params->supported_channels_len % 2)
4689 return -EINVAL;
4690 }
4691
4692 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
4693 params->supported_oper_classes =
4694 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4695 params->supported_oper_classes_len =
4696 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4697 /*
4698 * The value of the Length field of the Supported Operating
4699 * Classes element is between 2 and 253.
4700 */
4701 if (params->supported_oper_classes_len < 2 ||
4702 params->supported_oper_classes_len > 253)
4703 return -EINVAL;
4704 }
4705 return 0;
4706 }
4707
nl80211_set_station_tdls(struct genl_info * info,struct station_parameters * params)4708 static int nl80211_set_station_tdls(struct genl_info *info,
4709 struct station_parameters *params)
4710 {
4711 int err;
4712 /* Dummy STA entry gets updated once the peer capabilities are known */
4713 if (info->attrs[NL80211_ATTR_PEER_AID])
4714 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4715 if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4716 params->ht_capa =
4717 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4718 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4719 params->vht_capa =
4720 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4721
4722 err = nl80211_parse_sta_channel_info(info, params);
4723 if (err)
4724 return err;
4725
4726 return nl80211_parse_sta_wme(info, params);
4727 }
4728
nl80211_set_station(struct sk_buff * skb,struct genl_info * info)4729 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
4730 {
4731 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4732 struct net_device *dev = info->user_ptr[1];
4733 struct station_parameters params;
4734 u8 *mac_addr;
4735 int err;
4736
4737 memset(¶ms, 0, sizeof(params));
4738
4739 if (!rdev->ops->change_station)
4740 return -EOPNOTSUPP;
4741
4742 /*
4743 * AID and listen_interval properties can be set only for unassociated
4744 * station. Include these parameters here and will check them in
4745 * cfg80211_check_station_change().
4746 */
4747 if (info->attrs[NL80211_ATTR_STA_AID])
4748 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4749
4750 if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4751 params.listen_interval =
4752 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4753 else
4754 params.listen_interval = -1;
4755
4756 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
4757 u8 tmp;
4758
4759 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
4760 if (tmp >= NUM_NL80211_P2P_PS_STATUS)
4761 return -EINVAL;
4762
4763 params.support_p2p_ps = tmp;
4764 } else {
4765 params.support_p2p_ps = -1;
4766 }
4767
4768 if (!info->attrs[NL80211_ATTR_MAC])
4769 return -EINVAL;
4770
4771 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4772
4773 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
4774 params.supported_rates =
4775 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4776 params.supported_rates_len =
4777 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4778 }
4779
4780 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4781 params.capability =
4782 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4783 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4784 }
4785
4786 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4787 params.ext_capab =
4788 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4789 params.ext_capab_len =
4790 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4791 }
4792
4793 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms))
4794 return -EINVAL;
4795
4796 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4797 params.plink_action =
4798 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4799 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4800 return -EINVAL;
4801 }
4802
4803 if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
4804 params.plink_state =
4805 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
4806 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
4807 return -EINVAL;
4808 if (info->attrs[NL80211_ATTR_MESH_PEER_AID]) {
4809 params.peer_aid = nla_get_u16(
4810 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
4811 if (params.peer_aid > IEEE80211_MAX_AID)
4812 return -EINVAL;
4813 }
4814 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
4815 }
4816
4817 if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
4818 enum nl80211_mesh_power_mode pm = nla_get_u32(
4819 info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
4820
4821 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
4822 pm > NL80211_MESH_POWER_MAX)
4823 return -EINVAL;
4824
4825 params.local_pm = pm;
4826 }
4827
4828 /* Include parameters for TDLS peer (will check later) */
4829 err = nl80211_set_station_tdls(info, ¶ms);
4830 if (err)
4831 return err;
4832
4833 params.vlan = get_vlan(info, rdev);
4834 if (IS_ERR(params.vlan))
4835 return PTR_ERR(params.vlan);
4836
4837 switch (dev->ieee80211_ptr->iftype) {
4838 case NL80211_IFTYPE_AP:
4839 case NL80211_IFTYPE_AP_VLAN:
4840 case NL80211_IFTYPE_P2P_GO:
4841 case NL80211_IFTYPE_P2P_CLIENT:
4842 case NL80211_IFTYPE_STATION:
4843 case NL80211_IFTYPE_ADHOC:
4844 case NL80211_IFTYPE_MESH_POINT:
4845 break;
4846 default:
4847 err = -EOPNOTSUPP;
4848 goto out_put_vlan;
4849 }
4850
4851 /* driver will call cfg80211_check_station_change() */
4852 err = rdev_change_station(rdev, dev, mac_addr, ¶ms);
4853
4854 out_put_vlan:
4855 if (params.vlan)
4856 dev_put(params.vlan);
4857
4858 return err;
4859 }
4860
nl80211_new_station(struct sk_buff * skb,struct genl_info * info)4861 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
4862 {
4863 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4864 int err;
4865 struct net_device *dev = info->user_ptr[1];
4866 struct station_parameters params;
4867 u8 *mac_addr = NULL;
4868 u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4869 BIT(NL80211_STA_FLAG_ASSOCIATED);
4870
4871 memset(¶ms, 0, sizeof(params));
4872
4873 if (!rdev->ops->add_station)
4874 return -EOPNOTSUPP;
4875
4876 if (!info->attrs[NL80211_ATTR_MAC])
4877 return -EINVAL;
4878
4879 if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4880 return -EINVAL;
4881
4882 if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
4883 return -EINVAL;
4884
4885 if (!info->attrs[NL80211_ATTR_STA_AID] &&
4886 !info->attrs[NL80211_ATTR_PEER_AID])
4887 return -EINVAL;
4888
4889 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4890 params.supported_rates =
4891 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4892 params.supported_rates_len =
4893 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4894 params.listen_interval =
4895 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4896
4897 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
4898 u8 tmp;
4899
4900 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
4901 if (tmp >= NUM_NL80211_P2P_PS_STATUS)
4902 return -EINVAL;
4903
4904 params.support_p2p_ps = tmp;
4905 } else {
4906 /*
4907 * if not specified, assume it's supported for P2P GO interface,
4908 * and is NOT supported for AP interface
4909 */
4910 params.support_p2p_ps =
4911 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
4912 }
4913
4914 if (info->attrs[NL80211_ATTR_PEER_AID])
4915 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4916 else
4917 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4918 if (!params.aid || params.aid > IEEE80211_MAX_AID)
4919 return -EINVAL;
4920
4921 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4922 params.capability =
4923 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4924 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4925 }
4926
4927 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4928 params.ext_capab =
4929 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4930 params.ext_capab_len =
4931 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4932 }
4933
4934 if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4935 params.ht_capa =
4936 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4937
4938 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4939 params.vht_capa =
4940 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4941
4942 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
4943 params.opmode_notif_used = true;
4944 params.opmode_notif =
4945 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
4946 }
4947
4948 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4949 params.plink_action =
4950 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4951 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4952 return -EINVAL;
4953 }
4954
4955 err = nl80211_parse_sta_channel_info(info, ¶ms);
4956 if (err)
4957 return err;
4958
4959 err = nl80211_parse_sta_wme(info, ¶ms);
4960 if (err)
4961 return err;
4962
4963 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms))
4964 return -EINVAL;
4965
4966 /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
4967 * as userspace might just pass through the capabilities from the IEs
4968 * directly, rather than enforcing this restriction and returning an
4969 * error in this case.
4970 */
4971 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
4972 params.ht_capa = NULL;
4973 params.vht_capa = NULL;
4974 }
4975
4976 /* When you run into this, adjust the code below for the new flag */
4977 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4978
4979 switch (dev->ieee80211_ptr->iftype) {
4980 case NL80211_IFTYPE_AP:
4981 case NL80211_IFTYPE_AP_VLAN:
4982 case NL80211_IFTYPE_P2P_GO:
4983 /* ignore WME attributes if iface/sta is not capable */
4984 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
4985 !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
4986 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4987
4988 /* TDLS peers cannot be added */
4989 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4990 info->attrs[NL80211_ATTR_PEER_AID])
4991 return -EINVAL;
4992 /* but don't bother the driver with it */
4993 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4994
4995 /* allow authenticated/associated only if driver handles it */
4996 if (!(rdev->wiphy.features &
4997 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4998 params.sta_flags_mask & auth_assoc)
4999 return -EINVAL;
5000
5001 /* Older userspace, or userspace wanting to be compatible with
5002 * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
5003 * and assoc flags in the mask, but assumes the station will be
5004 * added as associated anyway since this was the required driver
5005 * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
5006 * introduced.
5007 * In order to not bother drivers with this quirk in the API
5008 * set the flags in both the mask and set for new stations in
5009 * this case.
5010 */
5011 if (!(params.sta_flags_mask & auth_assoc)) {
5012 params.sta_flags_mask |= auth_assoc;
5013 params.sta_flags_set |= auth_assoc;
5014 }
5015
5016 /* must be last in here for error handling */
5017 params.vlan = get_vlan(info, rdev);
5018 if (IS_ERR(params.vlan))
5019 return PTR_ERR(params.vlan);
5020 break;
5021 case NL80211_IFTYPE_MESH_POINT:
5022 /* ignore uAPSD data */
5023 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5024
5025 /* associated is disallowed */
5026 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
5027 return -EINVAL;
5028 /* TDLS peers cannot be added */
5029 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5030 info->attrs[NL80211_ATTR_PEER_AID])
5031 return -EINVAL;
5032 break;
5033 case NL80211_IFTYPE_STATION:
5034 case NL80211_IFTYPE_P2P_CLIENT:
5035 /* ignore uAPSD data */
5036 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5037
5038 /* these are disallowed */
5039 if (params.sta_flags_mask &
5040 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
5041 BIT(NL80211_STA_FLAG_AUTHENTICATED)))
5042 return -EINVAL;
5043 /* Only TDLS peers can be added */
5044 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
5045 return -EINVAL;
5046 /* Can only add if TDLS ... */
5047 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
5048 return -EOPNOTSUPP;
5049 /* ... with external setup is supported */
5050 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
5051 return -EOPNOTSUPP;
5052 /*
5053 * Older wpa_supplicant versions always mark the TDLS peer
5054 * as authorized, but it shouldn't yet be.
5055 */
5056 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
5057 break;
5058 default:
5059 return -EOPNOTSUPP;
5060 }
5061
5062 /* be aware of params.vlan when changing code here */
5063
5064 err = rdev_add_station(rdev, dev, mac_addr, ¶ms);
5065
5066 if (params.vlan)
5067 dev_put(params.vlan);
5068 return err;
5069 }
5070
nl80211_del_station(struct sk_buff * skb,struct genl_info * info)5071 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
5072 {
5073 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5074 struct net_device *dev = info->user_ptr[1];
5075 struct station_del_parameters params;
5076
5077 memset(¶ms, 0, sizeof(params));
5078
5079 if (info->attrs[NL80211_ATTR_MAC])
5080 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
5081
5082 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5083 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5084 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5085 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5086 return -EINVAL;
5087
5088 if (!rdev->ops->del_station)
5089 return -EOPNOTSUPP;
5090
5091 if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
5092 params.subtype =
5093 nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
5094 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
5095 params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
5096 return -EINVAL;
5097 } else {
5098 /* Default to Deauthentication frame */
5099 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
5100 }
5101
5102 if (info->attrs[NL80211_ATTR_REASON_CODE]) {
5103 params.reason_code =
5104 nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5105 if (params.reason_code == 0)
5106 return -EINVAL; /* 0 is reserved */
5107 } else {
5108 /* Default to reason code 2 */
5109 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
5110 }
5111
5112 return rdev_del_station(rdev, dev, ¶ms);
5113 }
5114
nl80211_send_mpath(struct sk_buff * msg,u32 portid,u32 seq,int flags,struct net_device * dev,u8 * dst,u8 * next_hop,struct mpath_info * pinfo)5115 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
5116 int flags, struct net_device *dev,
5117 u8 *dst, u8 *next_hop,
5118 struct mpath_info *pinfo)
5119 {
5120 void *hdr;
5121 struct nlattr *pinfoattr;
5122
5123 hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
5124 if (!hdr)
5125 return -1;
5126
5127 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5128 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
5129 nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
5130 nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
5131 goto nla_put_failure;
5132
5133 pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
5134 if (!pinfoattr)
5135 goto nla_put_failure;
5136 if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
5137 nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
5138 pinfo->frame_qlen))
5139 goto nla_put_failure;
5140 if (((pinfo->filled & MPATH_INFO_SN) &&
5141 nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
5142 ((pinfo->filled & MPATH_INFO_METRIC) &&
5143 nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
5144 pinfo->metric)) ||
5145 ((pinfo->filled & MPATH_INFO_EXPTIME) &&
5146 nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
5147 pinfo->exptime)) ||
5148 ((pinfo->filled & MPATH_INFO_FLAGS) &&
5149 nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
5150 pinfo->flags)) ||
5151 ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
5152 nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
5153 pinfo->discovery_timeout)) ||
5154 ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
5155 nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
5156 pinfo->discovery_retries)))
5157 goto nla_put_failure;
5158
5159 nla_nest_end(msg, pinfoattr);
5160
5161 genlmsg_end(msg, hdr);
5162 return 0;
5163
5164 nla_put_failure:
5165 genlmsg_cancel(msg, hdr);
5166 return -EMSGSIZE;
5167 }
5168
nl80211_dump_mpath(struct sk_buff * skb,struct netlink_callback * cb)5169 static int nl80211_dump_mpath(struct sk_buff *skb,
5170 struct netlink_callback *cb)
5171 {
5172 struct mpath_info pinfo;
5173 struct cfg80211_registered_device *rdev;
5174 struct wireless_dev *wdev;
5175 u8 dst[ETH_ALEN];
5176 u8 next_hop[ETH_ALEN];
5177 int path_idx = cb->args[2];
5178 int err;
5179
5180 rtnl_lock();
5181 err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5182 if (err)
5183 goto out_err;
5184
5185 if (!rdev->ops->dump_mpath) {
5186 err = -EOPNOTSUPP;
5187 goto out_err;
5188 }
5189
5190 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
5191 err = -EOPNOTSUPP;
5192 goto out_err;
5193 }
5194
5195 while (1) {
5196 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
5197 next_hop, &pinfo);
5198 if (err == -ENOENT)
5199 break;
5200 if (err)
5201 goto out_err;
5202
5203 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
5204 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5205 wdev->netdev, dst, next_hop,
5206 &pinfo) < 0)
5207 goto out;
5208
5209 path_idx++;
5210 }
5211
5212 out:
5213 cb->args[2] = path_idx;
5214 err = skb->len;
5215 out_err:
5216 rtnl_unlock();
5217 return err;
5218 }
5219
nl80211_get_mpath(struct sk_buff * skb,struct genl_info * info)5220 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
5221 {
5222 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5223 int err;
5224 struct net_device *dev = info->user_ptr[1];
5225 struct mpath_info pinfo;
5226 struct sk_buff *msg;
5227 u8 *dst = NULL;
5228 u8 next_hop[ETH_ALEN];
5229
5230 memset(&pinfo, 0, sizeof(pinfo));
5231
5232 if (!info->attrs[NL80211_ATTR_MAC])
5233 return -EINVAL;
5234
5235 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5236
5237 if (!rdev->ops->get_mpath)
5238 return -EOPNOTSUPP;
5239
5240 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5241 return -EOPNOTSUPP;
5242
5243 err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
5244 if (err)
5245 return err;
5246
5247 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5248 if (!msg)
5249 return -ENOMEM;
5250
5251 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
5252 dev, dst, next_hop, &pinfo) < 0) {
5253 nlmsg_free(msg);
5254 return -ENOBUFS;
5255 }
5256
5257 return genlmsg_reply(msg, info);
5258 }
5259
nl80211_set_mpath(struct sk_buff * skb,struct genl_info * info)5260 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
5261 {
5262 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5263 struct net_device *dev = info->user_ptr[1];
5264 u8 *dst = NULL;
5265 u8 *next_hop = NULL;
5266
5267 if (!info->attrs[NL80211_ATTR_MAC])
5268 return -EINVAL;
5269
5270 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
5271 return -EINVAL;
5272
5273 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5274 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
5275
5276 if (!rdev->ops->change_mpath)
5277 return -EOPNOTSUPP;
5278
5279 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5280 return -EOPNOTSUPP;
5281
5282 return rdev_change_mpath(rdev, dev, dst, next_hop);
5283 }
5284
nl80211_new_mpath(struct sk_buff * skb,struct genl_info * info)5285 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
5286 {
5287 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5288 struct net_device *dev = info->user_ptr[1];
5289 u8 *dst = NULL;
5290 u8 *next_hop = NULL;
5291
5292 if (!info->attrs[NL80211_ATTR_MAC])
5293 return -EINVAL;
5294
5295 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
5296 return -EINVAL;
5297
5298 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5299 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
5300
5301 if (!rdev->ops->add_mpath)
5302 return -EOPNOTSUPP;
5303
5304 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5305 return -EOPNOTSUPP;
5306
5307 return rdev_add_mpath(rdev, dev, dst, next_hop);
5308 }
5309
nl80211_del_mpath(struct sk_buff * skb,struct genl_info * info)5310 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
5311 {
5312 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5313 struct net_device *dev = info->user_ptr[1];
5314 u8 *dst = NULL;
5315
5316 if (info->attrs[NL80211_ATTR_MAC])
5317 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5318
5319 if (!rdev->ops->del_mpath)
5320 return -EOPNOTSUPP;
5321
5322 return rdev_del_mpath(rdev, dev, dst);
5323 }
5324
nl80211_get_mpp(struct sk_buff * skb,struct genl_info * info)5325 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
5326 {
5327 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5328 int err;
5329 struct net_device *dev = info->user_ptr[1];
5330 struct mpath_info pinfo;
5331 struct sk_buff *msg;
5332 u8 *dst = NULL;
5333 u8 mpp[ETH_ALEN];
5334
5335 memset(&pinfo, 0, sizeof(pinfo));
5336
5337 if (!info->attrs[NL80211_ATTR_MAC])
5338 return -EINVAL;
5339
5340 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5341
5342 if (!rdev->ops->get_mpp)
5343 return -EOPNOTSUPP;
5344
5345 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5346 return -EOPNOTSUPP;
5347
5348 err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
5349 if (err)
5350 return err;
5351
5352 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5353 if (!msg)
5354 return -ENOMEM;
5355
5356 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
5357 dev, dst, mpp, &pinfo) < 0) {
5358 nlmsg_free(msg);
5359 return -ENOBUFS;
5360 }
5361
5362 return genlmsg_reply(msg, info);
5363 }
5364
nl80211_dump_mpp(struct sk_buff * skb,struct netlink_callback * cb)5365 static int nl80211_dump_mpp(struct sk_buff *skb,
5366 struct netlink_callback *cb)
5367 {
5368 struct mpath_info pinfo;
5369 struct cfg80211_registered_device *rdev;
5370 struct wireless_dev *wdev;
5371 u8 dst[ETH_ALEN];
5372 u8 mpp[ETH_ALEN];
5373 int path_idx = cb->args[2];
5374 int err;
5375
5376 rtnl_lock();
5377 err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5378 if (err)
5379 goto out_err;
5380
5381 if (!rdev->ops->dump_mpp) {
5382 err = -EOPNOTSUPP;
5383 goto out_err;
5384 }
5385
5386 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
5387 err = -EOPNOTSUPP;
5388 goto out_err;
5389 }
5390
5391 while (1) {
5392 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
5393 mpp, &pinfo);
5394 if (err == -ENOENT)
5395 break;
5396 if (err)
5397 goto out_err;
5398
5399 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
5400 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5401 wdev->netdev, dst, mpp,
5402 &pinfo) < 0)
5403 goto out;
5404
5405 path_idx++;
5406 }
5407
5408 out:
5409 cb->args[2] = path_idx;
5410 err = skb->len;
5411 out_err:
5412 rtnl_unlock();
5413 return err;
5414 }
5415
nl80211_set_bss(struct sk_buff * skb,struct genl_info * info)5416 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
5417 {
5418 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5419 struct net_device *dev = info->user_ptr[1];
5420 struct wireless_dev *wdev = dev->ieee80211_ptr;
5421 struct bss_parameters params;
5422 int err;
5423
5424 memset(¶ms, 0, sizeof(params));
5425 /* default to not changing parameters */
5426 params.use_cts_prot = -1;
5427 params.use_short_preamble = -1;
5428 params.use_short_slot_time = -1;
5429 params.ap_isolate = -1;
5430 params.ht_opmode = -1;
5431 params.p2p_ctwindow = -1;
5432 params.p2p_opp_ps = -1;
5433
5434 if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
5435 params.use_cts_prot =
5436 nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
5437 if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
5438 params.use_short_preamble =
5439 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
5440 if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
5441 params.use_short_slot_time =
5442 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
5443 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
5444 params.basic_rates =
5445 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5446 params.basic_rates_len =
5447 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5448 }
5449 if (info->attrs[NL80211_ATTR_AP_ISOLATE])
5450 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
5451 if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
5452 params.ht_opmode =
5453 nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
5454
5455 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
5456 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5457 return -EINVAL;
5458 params.p2p_ctwindow =
5459 nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
5460 if (params.p2p_ctwindow < 0)
5461 return -EINVAL;
5462 if (params.p2p_ctwindow != 0 &&
5463 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
5464 return -EINVAL;
5465 }
5466
5467 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
5468 u8 tmp;
5469
5470 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5471 return -EINVAL;
5472 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
5473 if (tmp > 1)
5474 return -EINVAL;
5475 params.p2p_opp_ps = tmp;
5476 if (params.p2p_opp_ps &&
5477 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
5478 return -EINVAL;
5479 }
5480
5481 if (!rdev->ops->change_bss)
5482 return -EOPNOTSUPP;
5483
5484 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5485 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5486 return -EOPNOTSUPP;
5487
5488 wdev_lock(wdev);
5489 err = rdev_change_bss(rdev, dev, ¶ms);
5490 wdev_unlock(wdev);
5491
5492 return err;
5493 }
5494
nl80211_req_set_reg(struct sk_buff * skb,struct genl_info * info)5495 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
5496 {
5497 char *data = NULL;
5498 bool is_indoor;
5499 enum nl80211_user_reg_hint_type user_reg_hint_type;
5500 u32 owner_nlportid;
5501
5502 /*
5503 * You should only get this when cfg80211 hasn't yet initialized
5504 * completely when built-in to the kernel right between the time
5505 * window between nl80211_init() and regulatory_init(), if that is
5506 * even possible.
5507 */
5508 if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
5509 return -EINPROGRESS;
5510
5511 if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
5512 user_reg_hint_type =
5513 nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
5514 else
5515 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
5516
5517 switch (user_reg_hint_type) {
5518 case NL80211_USER_REG_HINT_USER:
5519 case NL80211_USER_REG_HINT_CELL_BASE:
5520 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5521 return -EINVAL;
5522
5523 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5524 return regulatory_hint_user(data, user_reg_hint_type);
5525 case NL80211_USER_REG_HINT_INDOOR:
5526 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
5527 owner_nlportid = info->snd_portid;
5528 is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
5529 } else {
5530 owner_nlportid = 0;
5531 is_indoor = true;
5532 }
5533
5534 return regulatory_hint_indoor(is_indoor, owner_nlportid);
5535 default:
5536 return -EINVAL;
5537 }
5538 }
5539
nl80211_get_mesh_config(struct sk_buff * skb,struct genl_info * info)5540 static int nl80211_get_mesh_config(struct sk_buff *skb,
5541 struct genl_info *info)
5542 {
5543 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5544 struct net_device *dev = info->user_ptr[1];
5545 struct wireless_dev *wdev = dev->ieee80211_ptr;
5546 struct mesh_config cur_params;
5547 int err = 0;
5548 void *hdr;
5549 struct nlattr *pinfoattr;
5550 struct sk_buff *msg;
5551
5552 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5553 return -EOPNOTSUPP;
5554
5555 if (!rdev->ops->get_mesh_config)
5556 return -EOPNOTSUPP;
5557
5558 wdev_lock(wdev);
5559 /* If not connected, get default parameters */
5560 if (!wdev->mesh_id_len)
5561 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
5562 else
5563 err = rdev_get_mesh_config(rdev, dev, &cur_params);
5564 wdev_unlock(wdev);
5565
5566 if (err)
5567 return err;
5568
5569 /* Draw up a netlink message to send back */
5570 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5571 if (!msg)
5572 return -ENOMEM;
5573 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5574 NL80211_CMD_GET_MESH_CONFIG);
5575 if (!hdr)
5576 goto out;
5577 pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
5578 if (!pinfoattr)
5579 goto nla_put_failure;
5580 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5581 nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
5582 cur_params.dot11MeshRetryTimeout) ||
5583 nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5584 cur_params.dot11MeshConfirmTimeout) ||
5585 nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
5586 cur_params.dot11MeshHoldingTimeout) ||
5587 nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
5588 cur_params.dot11MeshMaxPeerLinks) ||
5589 nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
5590 cur_params.dot11MeshMaxRetries) ||
5591 nla_put_u8(msg, NL80211_MESHCONF_TTL,
5592 cur_params.dot11MeshTTL) ||
5593 nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
5594 cur_params.element_ttl) ||
5595 nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5596 cur_params.auto_open_plinks) ||
5597 nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5598 cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
5599 nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5600 cur_params.dot11MeshHWMPmaxPREQretries) ||
5601 nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
5602 cur_params.path_refresh_time) ||
5603 nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5604 cur_params.min_discovery_timeout) ||
5605 nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5606 cur_params.dot11MeshHWMPactivePathTimeout) ||
5607 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5608 cur_params.dot11MeshHWMPpreqMinInterval) ||
5609 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5610 cur_params.dot11MeshHWMPperrMinInterval) ||
5611 nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5612 cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
5613 nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
5614 cur_params.dot11MeshHWMPRootMode) ||
5615 nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5616 cur_params.dot11MeshHWMPRannInterval) ||
5617 nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5618 cur_params.dot11MeshGateAnnouncementProtocol) ||
5619 nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
5620 cur_params.dot11MeshForwarding) ||
5621 nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
5622 cur_params.rssi_threshold) ||
5623 nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
5624 cur_params.ht_opmode) ||
5625 nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5626 cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
5627 nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5628 cur_params.dot11MeshHWMProotInterval) ||
5629 nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5630 cur_params.dot11MeshHWMPconfirmationInterval) ||
5631 nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
5632 cur_params.power_mode) ||
5633 nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
5634 cur_params.dot11MeshAwakeWindowDuration) ||
5635 nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
5636 cur_params.plink_timeout))
5637 goto nla_put_failure;
5638 nla_nest_end(msg, pinfoattr);
5639 genlmsg_end(msg, hdr);
5640 return genlmsg_reply(msg, info);
5641
5642 nla_put_failure:
5643 genlmsg_cancel(msg, hdr);
5644 out:
5645 nlmsg_free(msg);
5646 return -ENOBUFS;
5647 }
5648
5649 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
5650 [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
5651 [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
5652 [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
5653 [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
5654 [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
5655 [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
5656 [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
5657 [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
5658 [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
5659 [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
5660 [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
5661 [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
5662 [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
5663 [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
5664 [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
5665 [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
5666 [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
5667 [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
5668 [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
5669 [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
5670 [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
5671 [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
5672 [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
5673 [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
5674 [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
5675 [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
5676 [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
5677 [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
5678 };
5679
5680 static const struct nla_policy
5681 nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
5682 [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
5683 [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
5684 [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
5685 [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
5686 [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
5687 [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
5688 [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
5689 .len = IEEE80211_MAX_DATA_LEN },
5690 [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
5691 };
5692
nl80211_check_bool(const struct nlattr * nla,u8 min,u8 max,bool * out)5693 static int nl80211_check_bool(const struct nlattr *nla, u8 min, u8 max, bool *out)
5694 {
5695 u8 val = nla_get_u8(nla);
5696 if (val < min || val > max)
5697 return -EINVAL;
5698 *out = val;
5699 return 0;
5700 }
5701
nl80211_check_u8(const struct nlattr * nla,u8 min,u8 max,u8 * out)5702 static int nl80211_check_u8(const struct nlattr *nla, u8 min, u8 max, u8 *out)
5703 {
5704 u8 val = nla_get_u8(nla);
5705 if (val < min || val > max)
5706 return -EINVAL;
5707 *out = val;
5708 return 0;
5709 }
5710
nl80211_check_u16(const struct nlattr * nla,u16 min,u16 max,u16 * out)5711 static int nl80211_check_u16(const struct nlattr *nla, u16 min, u16 max, u16 *out)
5712 {
5713 u16 val = nla_get_u16(nla);
5714 if (val < min || val > max)
5715 return -EINVAL;
5716 *out = val;
5717 return 0;
5718 }
5719
nl80211_check_u32(const struct nlattr * nla,u32 min,u32 max,u32 * out)5720 static int nl80211_check_u32(const struct nlattr *nla, u32 min, u32 max, u32 *out)
5721 {
5722 u32 val = nla_get_u32(nla);
5723 if (val < min || val > max)
5724 return -EINVAL;
5725 *out = val;
5726 return 0;
5727 }
5728
nl80211_check_s32(const struct nlattr * nla,s32 min,s32 max,s32 * out)5729 static int nl80211_check_s32(const struct nlattr *nla, s32 min, s32 max, s32 *out)
5730 {
5731 s32 val = nla_get_s32(nla);
5732 if (val < min || val > max)
5733 return -EINVAL;
5734 *out = val;
5735 return 0;
5736 }
5737
nl80211_check_power_mode(const struct nlattr * nla,enum nl80211_mesh_power_mode min,enum nl80211_mesh_power_mode max,enum nl80211_mesh_power_mode * out)5738 static int nl80211_check_power_mode(const struct nlattr *nla,
5739 enum nl80211_mesh_power_mode min,
5740 enum nl80211_mesh_power_mode max,
5741 enum nl80211_mesh_power_mode *out)
5742 {
5743 u32 val = nla_get_u32(nla);
5744 if (val < min || val > max)
5745 return -EINVAL;
5746 *out = val;
5747 return 0;
5748 }
5749
nl80211_parse_mesh_config(struct genl_info * info,struct mesh_config * cfg,u32 * mask_out)5750 static int nl80211_parse_mesh_config(struct genl_info *info,
5751 struct mesh_config *cfg,
5752 u32 *mask_out)
5753 {
5754 struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
5755 u32 mask = 0;
5756 u16 ht_opmode;
5757
5758 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
5759 do { \
5760 if (tb[attr]) { \
5761 if (fn(tb[attr], min, max, &cfg->param)) \
5762 return -EINVAL; \
5763 mask |= (1 << (attr - 1)); \
5764 } \
5765 } while (0)
5766
5767 if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
5768 return -EINVAL;
5769 if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
5770 info->attrs[NL80211_ATTR_MESH_CONFIG],
5771 nl80211_meshconf_params_policy))
5772 return -EINVAL;
5773
5774 /* This makes sure that there aren't more than 32 mesh config
5775 * parameters (otherwise our bitfield scheme would not work.) */
5776 BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
5777
5778 /* Fill in the params struct */
5779 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
5780 mask, NL80211_MESHCONF_RETRY_TIMEOUT,
5781 nl80211_check_u16);
5782 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
5783 mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5784 nl80211_check_u16);
5785 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
5786 mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
5787 nl80211_check_u16);
5788 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
5789 mask, NL80211_MESHCONF_MAX_PEER_LINKS,
5790 nl80211_check_u16);
5791 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
5792 mask, NL80211_MESHCONF_MAX_RETRIES,
5793 nl80211_check_u8);
5794 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
5795 mask, NL80211_MESHCONF_TTL, nl80211_check_u8);
5796 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
5797 mask, NL80211_MESHCONF_ELEMENT_TTL,
5798 nl80211_check_u8);
5799 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
5800 mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5801 nl80211_check_bool);
5802 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
5803 1, 255, mask,
5804 NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5805 nl80211_check_u32);
5806 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
5807 mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5808 nl80211_check_u8);
5809 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
5810 mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
5811 nl80211_check_u32);
5812 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
5813 mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5814 nl80211_check_u16);
5815 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
5816 1, 65535, mask,
5817 NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5818 nl80211_check_u32);
5819 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
5820 1, 65535, mask,
5821 NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5822 nl80211_check_u16);
5823 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
5824 1, 65535, mask,
5825 NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5826 nl80211_check_u16);
5827 FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5828 dot11MeshHWMPnetDiameterTraversalTime,
5829 1, 65535, mask,
5830 NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5831 nl80211_check_u16);
5832 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
5833 mask, NL80211_MESHCONF_HWMP_ROOTMODE,
5834 nl80211_check_u8);
5835 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
5836 mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5837 nl80211_check_u16);
5838 FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5839 dot11MeshGateAnnouncementProtocol, 0, 1,
5840 mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5841 nl80211_check_bool);
5842 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
5843 mask, NL80211_MESHCONF_FORWARDING,
5844 nl80211_check_bool);
5845 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
5846 mask, NL80211_MESHCONF_RSSI_THRESHOLD,
5847 nl80211_check_s32);
5848 /*
5849 * Check HT operation mode based on
5850 * IEEE 802.11 2012 8.4.2.59 HT Operation element.
5851 */
5852 if (tb[NL80211_MESHCONF_HT_OPMODE]) {
5853 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
5854
5855 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
5856 IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
5857 IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
5858 return -EINVAL;
5859
5860 if ((ht_opmode & IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT) &&
5861 (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
5862 return -EINVAL;
5863
5864 switch (ht_opmode & IEEE80211_HT_OP_MODE_PROTECTION) {
5865 case IEEE80211_HT_OP_MODE_PROTECTION_NONE:
5866 case IEEE80211_HT_OP_MODE_PROTECTION_20MHZ:
5867 if (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)
5868 return -EINVAL;
5869 break;
5870 case IEEE80211_HT_OP_MODE_PROTECTION_NONMEMBER:
5871 case IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED:
5872 if (!(ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
5873 return -EINVAL;
5874 break;
5875 }
5876 cfg->ht_opmode = ht_opmode;
5877 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
5878 }
5879 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
5880 1, 65535, mask,
5881 NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5882 nl80211_check_u32);
5883 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
5884 mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5885 nl80211_check_u16);
5886 FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5887 dot11MeshHWMPconfirmationInterval,
5888 1, 65535, mask,
5889 NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5890 nl80211_check_u16);
5891 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
5892 NL80211_MESH_POWER_ACTIVE,
5893 NL80211_MESH_POWER_MAX,
5894 mask, NL80211_MESHCONF_POWER_MODE,
5895 nl80211_check_power_mode);
5896 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
5897 0, 65535, mask,
5898 NL80211_MESHCONF_AWAKE_WINDOW, nl80211_check_u16);
5899 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 0, 0xffffffff,
5900 mask, NL80211_MESHCONF_PLINK_TIMEOUT,
5901 nl80211_check_u32);
5902 if (mask_out)
5903 *mask_out = mask;
5904
5905 return 0;
5906
5907 #undef FILL_IN_MESH_PARAM_IF_SET
5908 }
5909
nl80211_parse_mesh_setup(struct genl_info * info,struct mesh_setup * setup)5910 static int nl80211_parse_mesh_setup(struct genl_info *info,
5911 struct mesh_setup *setup)
5912 {
5913 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5914 struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
5915
5916 if (!info->attrs[NL80211_ATTR_MESH_SETUP])
5917 return -EINVAL;
5918 if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
5919 info->attrs[NL80211_ATTR_MESH_SETUP],
5920 nl80211_mesh_setup_params_policy))
5921 return -EINVAL;
5922
5923 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
5924 setup->sync_method =
5925 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
5926 IEEE80211_SYNC_METHOD_VENDOR :
5927 IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
5928
5929 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
5930 setup->path_sel_proto =
5931 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
5932 IEEE80211_PATH_PROTOCOL_VENDOR :
5933 IEEE80211_PATH_PROTOCOL_HWMP;
5934
5935 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
5936 setup->path_metric =
5937 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
5938 IEEE80211_PATH_METRIC_VENDOR :
5939 IEEE80211_PATH_METRIC_AIRTIME;
5940
5941 if (tb[NL80211_MESH_SETUP_IE]) {
5942 struct nlattr *ieattr =
5943 tb[NL80211_MESH_SETUP_IE];
5944 if (!is_valid_ie_attr(ieattr))
5945 return -EINVAL;
5946 setup->ie = nla_data(ieattr);
5947 setup->ie_len = nla_len(ieattr);
5948 }
5949 if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
5950 !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
5951 return -EINVAL;
5952 setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
5953 setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
5954 setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
5955 if (setup->is_secure)
5956 setup->user_mpm = true;
5957
5958 if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
5959 if (!setup->user_mpm)
5960 return -EINVAL;
5961 setup->auth_id =
5962 nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
5963 }
5964
5965 return 0;
5966 }
5967
nl80211_update_mesh_config(struct sk_buff * skb,struct genl_info * info)5968 static int nl80211_update_mesh_config(struct sk_buff *skb,
5969 struct genl_info *info)
5970 {
5971 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5972 struct net_device *dev = info->user_ptr[1];
5973 struct wireless_dev *wdev = dev->ieee80211_ptr;
5974 struct mesh_config cfg;
5975 u32 mask;
5976 int err;
5977
5978 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5979 return -EOPNOTSUPP;
5980
5981 if (!rdev->ops->update_mesh_config)
5982 return -EOPNOTSUPP;
5983
5984 err = nl80211_parse_mesh_config(info, &cfg, &mask);
5985 if (err)
5986 return err;
5987
5988 wdev_lock(wdev);
5989 if (!wdev->mesh_id_len)
5990 err = -ENOLINK;
5991
5992 if (!err)
5993 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
5994
5995 wdev_unlock(wdev);
5996
5997 return err;
5998 }
5999
nl80211_put_regdom(const struct ieee80211_regdomain * regdom,struct sk_buff * msg)6000 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
6001 struct sk_buff *msg)
6002 {
6003 struct nlattr *nl_reg_rules;
6004 unsigned int i;
6005
6006 if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
6007 (regdom->dfs_region &&
6008 nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
6009 goto nla_put_failure;
6010
6011 nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
6012 if (!nl_reg_rules)
6013 goto nla_put_failure;
6014
6015 for (i = 0; i < regdom->n_reg_rules; i++) {
6016 struct nlattr *nl_reg_rule;
6017 const struct ieee80211_reg_rule *reg_rule;
6018 const struct ieee80211_freq_range *freq_range;
6019 const struct ieee80211_power_rule *power_rule;
6020 unsigned int max_bandwidth_khz;
6021
6022 reg_rule = ®dom->reg_rules[i];
6023 freq_range = ®_rule->freq_range;
6024 power_rule = ®_rule->power_rule;
6025
6026 nl_reg_rule = nla_nest_start(msg, i);
6027 if (!nl_reg_rule)
6028 goto nla_put_failure;
6029
6030 max_bandwidth_khz = freq_range->max_bandwidth_khz;
6031 if (!max_bandwidth_khz)
6032 max_bandwidth_khz = reg_get_max_bandwidth(regdom,
6033 reg_rule);
6034
6035 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
6036 reg_rule->flags) ||
6037 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
6038 freq_range->start_freq_khz) ||
6039 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
6040 freq_range->end_freq_khz) ||
6041 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
6042 max_bandwidth_khz) ||
6043 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
6044 power_rule->max_antenna_gain) ||
6045 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
6046 power_rule->max_eirp) ||
6047 nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
6048 reg_rule->dfs_cac_ms))
6049 goto nla_put_failure;
6050
6051 nla_nest_end(msg, nl_reg_rule);
6052 }
6053
6054 nla_nest_end(msg, nl_reg_rules);
6055 return 0;
6056
6057 nla_put_failure:
6058 return -EMSGSIZE;
6059 }
6060
nl80211_get_reg_do(struct sk_buff * skb,struct genl_info * info)6061 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
6062 {
6063 const struct ieee80211_regdomain *regdom = NULL;
6064 struct cfg80211_registered_device *rdev;
6065 struct wiphy *wiphy = NULL;
6066 struct sk_buff *msg;
6067 void *hdr;
6068
6069 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6070 if (!msg)
6071 return -ENOBUFS;
6072
6073 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6074 NL80211_CMD_GET_REG);
6075 if (!hdr)
6076 goto put_failure;
6077
6078 if (info->attrs[NL80211_ATTR_WIPHY]) {
6079 bool self_managed;
6080
6081 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
6082 if (IS_ERR(rdev)) {
6083 nlmsg_free(msg);
6084 return PTR_ERR(rdev);
6085 }
6086
6087 wiphy = &rdev->wiphy;
6088 self_managed = wiphy->regulatory_flags &
6089 REGULATORY_WIPHY_SELF_MANAGED;
6090 regdom = get_wiphy_regdom(wiphy);
6091
6092 /* a self-managed-reg device must have a private regdom */
6093 if (WARN_ON(!regdom && self_managed)) {
6094 nlmsg_free(msg);
6095 return -EINVAL;
6096 }
6097
6098 if (regdom &&
6099 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6100 goto nla_put_failure;
6101 }
6102
6103 if (!wiphy && reg_last_request_cell_base() &&
6104 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6105 NL80211_USER_REG_HINT_CELL_BASE))
6106 goto nla_put_failure;
6107
6108 rcu_read_lock();
6109
6110 if (!regdom)
6111 regdom = rcu_dereference(cfg80211_regdomain);
6112
6113 if (nl80211_put_regdom(regdom, msg))
6114 goto nla_put_failure_rcu;
6115
6116 rcu_read_unlock();
6117
6118 genlmsg_end(msg, hdr);
6119 return genlmsg_reply(msg, info);
6120
6121 nla_put_failure_rcu:
6122 rcu_read_unlock();
6123 nla_put_failure:
6124 genlmsg_cancel(msg, hdr);
6125 put_failure:
6126 nlmsg_free(msg);
6127 return -EMSGSIZE;
6128 }
6129
nl80211_send_regdom(struct sk_buff * msg,struct netlink_callback * cb,u32 seq,int flags,struct wiphy * wiphy,const struct ieee80211_regdomain * regdom)6130 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
6131 u32 seq, int flags, struct wiphy *wiphy,
6132 const struct ieee80211_regdomain *regdom)
6133 {
6134 void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
6135 NL80211_CMD_GET_REG);
6136
6137 if (!hdr)
6138 return -1;
6139
6140 genl_dump_check_consistent(cb, hdr, &nl80211_fam);
6141
6142 if (nl80211_put_regdom(regdom, msg))
6143 goto nla_put_failure;
6144
6145 if (!wiphy && reg_last_request_cell_base() &&
6146 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6147 NL80211_USER_REG_HINT_CELL_BASE))
6148 goto nla_put_failure;
6149
6150 if (wiphy &&
6151 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6152 goto nla_put_failure;
6153
6154 if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
6155 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
6156 goto nla_put_failure;
6157
6158 genlmsg_end(msg, hdr);
6159 return 0;
6160
6161 nla_put_failure:
6162 genlmsg_cancel(msg, hdr);
6163 return -EMSGSIZE;
6164 }
6165
nl80211_get_reg_dump(struct sk_buff * skb,struct netlink_callback * cb)6166 static int nl80211_get_reg_dump(struct sk_buff *skb,
6167 struct netlink_callback *cb)
6168 {
6169 const struct ieee80211_regdomain *regdom = NULL;
6170 struct cfg80211_registered_device *rdev;
6171 int err, reg_idx, start = cb->args[2];
6172
6173 rtnl_lock();
6174
6175 if (cfg80211_regdomain && start == 0) {
6176 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6177 NLM_F_MULTI, NULL,
6178 rtnl_dereference(cfg80211_regdomain));
6179 if (err < 0)
6180 goto out_err;
6181 }
6182
6183 /* the global regdom is idx 0 */
6184 reg_idx = 1;
6185 list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
6186 regdom = get_wiphy_regdom(&rdev->wiphy);
6187 if (!regdom)
6188 continue;
6189
6190 if (++reg_idx <= start)
6191 continue;
6192
6193 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6194 NLM_F_MULTI, &rdev->wiphy, regdom);
6195 if (err < 0) {
6196 reg_idx--;
6197 break;
6198 }
6199 }
6200
6201 cb->args[2] = reg_idx;
6202 err = skb->len;
6203 out_err:
6204 rtnl_unlock();
6205 return err;
6206 }
6207
6208 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
6209 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
6210 [NL80211_ATTR_REG_RULE_FLAGS] = { .type = NLA_U32 },
6211 [NL80211_ATTR_FREQ_RANGE_START] = { .type = NLA_U32 },
6212 [NL80211_ATTR_FREQ_RANGE_END] = { .type = NLA_U32 },
6213 [NL80211_ATTR_FREQ_RANGE_MAX_BW] = { .type = NLA_U32 },
6214 [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN] = { .type = NLA_U32 },
6215 [NL80211_ATTR_POWER_RULE_MAX_EIRP] = { .type = NLA_U32 },
6216 [NL80211_ATTR_DFS_CAC_TIME] = { .type = NLA_U32 },
6217 };
6218
parse_reg_rule(struct nlattr * tb[],struct ieee80211_reg_rule * reg_rule)6219 static int parse_reg_rule(struct nlattr *tb[],
6220 struct ieee80211_reg_rule *reg_rule)
6221 {
6222 struct ieee80211_freq_range *freq_range = ®_rule->freq_range;
6223 struct ieee80211_power_rule *power_rule = ®_rule->power_rule;
6224
6225 if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
6226 return -EINVAL;
6227 if (!tb[NL80211_ATTR_FREQ_RANGE_START])
6228 return -EINVAL;
6229 if (!tb[NL80211_ATTR_FREQ_RANGE_END])
6230 return -EINVAL;
6231 if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
6232 return -EINVAL;
6233 if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
6234 return -EINVAL;
6235
6236 reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
6237
6238 freq_range->start_freq_khz =
6239 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
6240 freq_range->end_freq_khz =
6241 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
6242 freq_range->max_bandwidth_khz =
6243 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
6244
6245 power_rule->max_eirp =
6246 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
6247
6248 if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
6249 power_rule->max_antenna_gain =
6250 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
6251
6252 if (tb[NL80211_ATTR_DFS_CAC_TIME])
6253 reg_rule->dfs_cac_ms =
6254 nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
6255
6256 return 0;
6257 }
6258
nl80211_set_reg(struct sk_buff * skb,struct genl_info * info)6259 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
6260 {
6261 struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
6262 struct nlattr *nl_reg_rule;
6263 char *alpha2;
6264 int rem_reg_rules, r;
6265 u32 num_rules = 0, rule_idx = 0, size_of_regd;
6266 enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
6267 struct ieee80211_regdomain *rd;
6268
6269 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
6270 return -EINVAL;
6271
6272 if (!info->attrs[NL80211_ATTR_REG_RULES])
6273 return -EINVAL;
6274
6275 alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
6276
6277 if (info->attrs[NL80211_ATTR_DFS_REGION])
6278 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
6279
6280 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6281 rem_reg_rules) {
6282 num_rules++;
6283 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
6284 return -EINVAL;
6285 }
6286
6287 if (!reg_is_valid_request(alpha2))
6288 return -EINVAL;
6289
6290 size_of_regd = sizeof(struct ieee80211_regdomain) +
6291 num_rules * sizeof(struct ieee80211_reg_rule);
6292
6293 rd = kzalloc(size_of_regd, GFP_KERNEL);
6294 if (!rd)
6295 return -ENOMEM;
6296
6297 rd->n_reg_rules = num_rules;
6298 rd->alpha2[0] = alpha2[0];
6299 rd->alpha2[1] = alpha2[1];
6300
6301 /*
6302 * Disable DFS master mode if the DFS region was
6303 * not supported or known on this kernel.
6304 */
6305 if (reg_supported_dfs_region(dfs_region))
6306 rd->dfs_region = dfs_region;
6307
6308 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6309 rem_reg_rules) {
6310 r = nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
6311 nla_data(nl_reg_rule), nla_len(nl_reg_rule),
6312 reg_rule_policy);
6313 if (r)
6314 goto bad_reg;
6315 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
6316 if (r)
6317 goto bad_reg;
6318
6319 rule_idx++;
6320
6321 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
6322 r = -EINVAL;
6323 goto bad_reg;
6324 }
6325 }
6326
6327 /* set_regdom takes ownership of rd */
6328 return set_regdom(rd, REGD_SOURCE_CRDA);
6329 bad_reg:
6330 kfree(rd);
6331 return r;
6332 }
6333 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
6334
validate_scan_freqs(struct nlattr * freqs)6335 static int validate_scan_freqs(struct nlattr *freqs)
6336 {
6337 struct nlattr *attr1, *attr2;
6338 int n_channels = 0, tmp1, tmp2;
6339
6340 nla_for_each_nested(attr1, freqs, tmp1)
6341 if (nla_len(attr1) != sizeof(u32))
6342 return 0;
6343
6344 nla_for_each_nested(attr1, freqs, tmp1) {
6345 n_channels++;
6346 /*
6347 * Some hardware has a limited channel list for
6348 * scanning, and it is pretty much nonsensical
6349 * to scan for a channel twice, so disallow that
6350 * and don't require drivers to check that the
6351 * channel list they get isn't longer than what
6352 * they can scan, as long as they can scan all
6353 * the channels they registered at once.
6354 */
6355 nla_for_each_nested(attr2, freqs, tmp2)
6356 if (attr1 != attr2 &&
6357 nla_get_u32(attr1) == nla_get_u32(attr2))
6358 return 0;
6359 }
6360
6361 return n_channels;
6362 }
6363
is_band_valid(struct wiphy * wiphy,enum nl80211_band b)6364 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
6365 {
6366 return b < NUM_NL80211_BANDS && wiphy->bands[b];
6367 }
6368
parse_bss_select(struct nlattr * nla,struct wiphy * wiphy,struct cfg80211_bss_selection * bss_select)6369 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
6370 struct cfg80211_bss_selection *bss_select)
6371 {
6372 struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
6373 struct nlattr *nest;
6374 int err;
6375 bool found = false;
6376 int i;
6377
6378 /* only process one nested attribute */
6379 nest = nla_data(nla);
6380 if (!nla_ok(nest, nla_len(nest)))
6381 return -EINVAL;
6382
6383 err = nla_parse(attr, NL80211_BSS_SELECT_ATTR_MAX, nla_data(nest),
6384 nla_len(nest), nl80211_bss_select_policy);
6385 if (err)
6386 return err;
6387
6388 /* only one attribute may be given */
6389 for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
6390 if (attr[i]) {
6391 if (found)
6392 return -EINVAL;
6393 found = true;
6394 }
6395 }
6396
6397 bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
6398
6399 if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
6400 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
6401
6402 if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
6403 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
6404 bss_select->param.band_pref =
6405 nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
6406 if (!is_band_valid(wiphy, bss_select->param.band_pref))
6407 return -EINVAL;
6408 }
6409
6410 if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
6411 struct nl80211_bss_select_rssi_adjust *adj_param;
6412
6413 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
6414 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
6415 bss_select->param.adjust.band = adj_param->band;
6416 bss_select->param.adjust.delta = adj_param->delta;
6417 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
6418 return -EINVAL;
6419 }
6420
6421 /* user-space did not provide behaviour attribute */
6422 if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
6423 return -EINVAL;
6424
6425 if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
6426 return -EINVAL;
6427
6428 return 0;
6429 }
6430
nl80211_parse_random_mac(struct nlattr ** attrs,u8 * mac_addr,u8 * mac_addr_mask)6431 static int nl80211_parse_random_mac(struct nlattr **attrs,
6432 u8 *mac_addr, u8 *mac_addr_mask)
6433 {
6434 int i;
6435
6436 if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
6437 eth_zero_addr(mac_addr);
6438 eth_zero_addr(mac_addr_mask);
6439 mac_addr[0] = 0x2;
6440 mac_addr_mask[0] = 0x3;
6441
6442 return 0;
6443 }
6444
6445 /* need both or none */
6446 if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
6447 return -EINVAL;
6448
6449 memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
6450 memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
6451
6452 /* don't allow or configure an mcast address */
6453 if (!is_multicast_ether_addr(mac_addr_mask) ||
6454 is_multicast_ether_addr(mac_addr))
6455 return -EINVAL;
6456
6457 /*
6458 * allow users to pass a MAC address that has bits set outside
6459 * of the mask, but don't bother drivers with having to deal
6460 * with such bits
6461 */
6462 for (i = 0; i < ETH_ALEN; i++)
6463 mac_addr[i] &= mac_addr_mask[i];
6464
6465 return 0;
6466 }
6467
nl80211_trigger_scan(struct sk_buff * skb,struct genl_info * info)6468 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
6469 {
6470 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6471 struct wireless_dev *wdev = info->user_ptr[1];
6472 struct cfg80211_scan_request *request;
6473 struct nlattr *attr;
6474 struct wiphy *wiphy;
6475 int err, tmp, n_ssids = 0, n_channels, i;
6476 size_t ie_len;
6477
6478 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6479 return -EINVAL;
6480
6481 wiphy = &rdev->wiphy;
6482
6483 if (wdev->iftype == NL80211_IFTYPE_NAN)
6484 return -EOPNOTSUPP;
6485
6486 if (!rdev->ops->scan)
6487 return -EOPNOTSUPP;
6488
6489 if (rdev->scan_req || rdev->scan_msg) {
6490 err = -EBUSY;
6491 goto unlock;
6492 }
6493
6494 if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6495 n_channels = validate_scan_freqs(
6496 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
6497 if (!n_channels) {
6498 err = -EINVAL;
6499 goto unlock;
6500 }
6501 } else {
6502 n_channels = ieee80211_get_num_supported_channels(wiphy);
6503 }
6504
6505 if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
6506 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
6507 n_ssids++;
6508
6509 if (n_ssids > wiphy->max_scan_ssids) {
6510 err = -EINVAL;
6511 goto unlock;
6512 }
6513
6514 if (info->attrs[NL80211_ATTR_IE])
6515 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6516 else
6517 ie_len = 0;
6518
6519 if (ie_len > wiphy->max_scan_ie_len) {
6520 err = -EINVAL;
6521 goto unlock;
6522 }
6523
6524 request = kzalloc(sizeof(*request)
6525 + sizeof(*request->ssids) * n_ssids
6526 + sizeof(*request->channels) * n_channels
6527 + ie_len, GFP_KERNEL);
6528 if (!request) {
6529 err = -ENOMEM;
6530 goto unlock;
6531 }
6532
6533 if (n_ssids)
6534 request->ssids = (void *)&request->channels[n_channels];
6535 request->n_ssids = n_ssids;
6536 if (ie_len) {
6537 if (n_ssids)
6538 request->ie = (void *)(request->ssids + n_ssids);
6539 else
6540 request->ie = (void *)(request->channels + n_channels);
6541 }
6542
6543 i = 0;
6544 if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6545 /* user specified, bail out if channel not found */
6546 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
6547 struct ieee80211_channel *chan;
6548
6549 chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
6550
6551 if (!chan) {
6552 err = -EINVAL;
6553 goto out_free;
6554 }
6555
6556 /* ignore disabled channels */
6557 if (chan->flags & IEEE80211_CHAN_DISABLED)
6558 continue;
6559
6560 request->channels[i] = chan;
6561 i++;
6562 }
6563 } else {
6564 enum nl80211_band band;
6565
6566 /* all channels */
6567 for (band = 0; band < NUM_NL80211_BANDS; band++) {
6568 int j;
6569
6570 if (!wiphy->bands[band])
6571 continue;
6572 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
6573 struct ieee80211_channel *chan;
6574
6575 chan = &wiphy->bands[band]->channels[j];
6576
6577 if (chan->flags & IEEE80211_CHAN_DISABLED)
6578 continue;
6579
6580 request->channels[i] = chan;
6581 i++;
6582 }
6583 }
6584 }
6585
6586 if (!i) {
6587 err = -EINVAL;
6588 goto out_free;
6589 }
6590
6591 request->n_channels = i;
6592
6593 i = 0;
6594 if (n_ssids) {
6595 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
6596 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
6597 err = -EINVAL;
6598 goto out_free;
6599 }
6600 request->ssids[i].ssid_len = nla_len(attr);
6601 memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
6602 i++;
6603 }
6604 }
6605
6606 if (info->attrs[NL80211_ATTR_IE]) {
6607 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6608 memcpy((void *)request->ie,
6609 nla_data(info->attrs[NL80211_ATTR_IE]),
6610 request->ie_len);
6611 }
6612
6613 for (i = 0; i < NUM_NL80211_BANDS; i++)
6614 if (wiphy->bands[i])
6615 request->rates[i] =
6616 (1 << wiphy->bands[i]->n_bitrates) - 1;
6617
6618 if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
6619 nla_for_each_nested(attr,
6620 info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
6621 tmp) {
6622 enum nl80211_band band = nla_type(attr);
6623
6624 if (band < 0 || band >= NUM_NL80211_BANDS) {
6625 err = -EINVAL;
6626 goto out_free;
6627 }
6628
6629 if (!wiphy->bands[band])
6630 continue;
6631
6632 err = ieee80211_get_ratemask(wiphy->bands[band],
6633 nla_data(attr),
6634 nla_len(attr),
6635 &request->rates[band]);
6636 if (err)
6637 goto out_free;
6638 }
6639 }
6640
6641 if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
6642 if (!wiphy_ext_feature_isset(wiphy,
6643 NL80211_EXT_FEATURE_SET_SCAN_DWELL)) {
6644 err = -EOPNOTSUPP;
6645 goto out_free;
6646 }
6647
6648 request->duration =
6649 nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
6650 request->duration_mandatory =
6651 nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
6652 }
6653
6654 if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
6655 request->flags = nla_get_u32(
6656 info->attrs[NL80211_ATTR_SCAN_FLAGS]);
6657 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
6658 !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
6659 err = -EOPNOTSUPP;
6660 goto out_free;
6661 }
6662
6663 if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
6664 if (!(wiphy->features &
6665 NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR)) {
6666 err = -EOPNOTSUPP;
6667 goto out_free;
6668 }
6669
6670 if (wdev->current_bss) {
6671 err = -EOPNOTSUPP;
6672 goto out_free;
6673 }
6674
6675 err = nl80211_parse_random_mac(info->attrs,
6676 request->mac_addr,
6677 request->mac_addr_mask);
6678 if (err)
6679 goto out_free;
6680 }
6681 }
6682
6683 request->no_cck =
6684 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
6685
6686 /* Initial implementation used NL80211_ATTR_MAC to set the specific
6687 * BSSID to scan for. This was problematic because that same attribute
6688 * was already used for another purpose (local random MAC address). The
6689 * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
6690 * compatibility with older userspace components, also use the
6691 * NL80211_ATTR_MAC value here if it can be determined to be used for
6692 * the specific BSSID use case instead of the random MAC address
6693 * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
6694 */
6695 if (info->attrs[NL80211_ATTR_BSSID])
6696 memcpy(request->bssid,
6697 nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
6698 else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
6699 info->attrs[NL80211_ATTR_MAC])
6700 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
6701 ETH_ALEN);
6702 else
6703 eth_broadcast_addr(request->bssid);
6704
6705 request->wdev = wdev;
6706 request->wiphy = &rdev->wiphy;
6707 request->scan_start = jiffies;
6708
6709 rdev->scan_req = request;
6710 err = rdev_scan(rdev, request);
6711
6712 if (!err) {
6713 nl80211_send_scan_start(rdev, wdev);
6714 if (wdev->netdev)
6715 dev_hold(wdev->netdev);
6716 } else {
6717 out_free:
6718 rdev->scan_req = NULL;
6719 kfree(request);
6720 }
6721
6722 unlock:
6723 return err;
6724 }
6725
nl80211_abort_scan(struct sk_buff * skb,struct genl_info * info)6726 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
6727 {
6728 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6729 struct wireless_dev *wdev = info->user_ptr[1];
6730
6731 if (!rdev->ops->abort_scan)
6732 return -EOPNOTSUPP;
6733
6734 if (rdev->scan_msg)
6735 return 0;
6736
6737 if (!rdev->scan_req)
6738 return -ENOENT;
6739
6740 rdev_abort_scan(rdev, wdev);
6741 return 0;
6742 }
6743
6744 static int
nl80211_parse_sched_scan_plans(struct wiphy * wiphy,int n_plans,struct cfg80211_sched_scan_request * request,struct nlattr ** attrs)6745 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
6746 struct cfg80211_sched_scan_request *request,
6747 struct nlattr **attrs)
6748 {
6749 int tmp, err, i = 0;
6750 struct nlattr *attr;
6751
6752 if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
6753 u32 interval;
6754
6755 /*
6756 * If scan plans are not specified,
6757 * %NL80211_ATTR_SCHED_SCAN_INTERVAL must be specified. In this
6758 * case one scan plan will be set with the specified scan
6759 * interval and infinite number of iterations.
6760 */
6761 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
6762 return -EINVAL;
6763
6764 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
6765 if (!interval)
6766 return -EINVAL;
6767
6768 request->scan_plans[0].interval =
6769 DIV_ROUND_UP(interval, MSEC_PER_SEC);
6770 if (!request->scan_plans[0].interval)
6771 return -EINVAL;
6772
6773 if (request->scan_plans[0].interval >
6774 wiphy->max_sched_scan_plan_interval)
6775 request->scan_plans[0].interval =
6776 wiphy->max_sched_scan_plan_interval;
6777
6778 return 0;
6779 }
6780
6781 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
6782 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
6783
6784 if (WARN_ON(i >= n_plans))
6785 return -EINVAL;
6786
6787 err = nla_parse(plan, NL80211_SCHED_SCAN_PLAN_MAX,
6788 nla_data(attr), nla_len(attr),
6789 nl80211_plan_policy);
6790 if (err)
6791 return err;
6792
6793 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
6794 return -EINVAL;
6795
6796 request->scan_plans[i].interval =
6797 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
6798 if (!request->scan_plans[i].interval ||
6799 request->scan_plans[i].interval >
6800 wiphy->max_sched_scan_plan_interval)
6801 return -EINVAL;
6802
6803 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
6804 request->scan_plans[i].iterations =
6805 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
6806 if (!request->scan_plans[i].iterations ||
6807 (request->scan_plans[i].iterations >
6808 wiphy->max_sched_scan_plan_iterations))
6809 return -EINVAL;
6810 } else if (i < n_plans - 1) {
6811 /*
6812 * All scan plans but the last one must specify
6813 * a finite number of iterations
6814 */
6815 return -EINVAL;
6816 }
6817
6818 i++;
6819 }
6820
6821 /*
6822 * The last scan plan must not specify the number of
6823 * iterations, it is supposed to run infinitely
6824 */
6825 if (request->scan_plans[n_plans - 1].iterations)
6826 return -EINVAL;
6827
6828 return 0;
6829 }
6830
6831 static struct cfg80211_sched_scan_request *
nl80211_parse_sched_scan(struct wiphy * wiphy,struct wireless_dev * wdev,struct nlattr ** attrs)6832 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
6833 struct nlattr **attrs)
6834 {
6835 struct cfg80211_sched_scan_request *request;
6836 struct nlattr *attr;
6837 int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
6838 enum nl80211_band band;
6839 size_t ie_len;
6840 struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
6841 s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
6842
6843 if (!is_valid_ie_attr(attrs[NL80211_ATTR_IE]))
6844 return ERR_PTR(-EINVAL);
6845
6846 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6847 n_channels = validate_scan_freqs(
6848 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
6849 if (!n_channels)
6850 return ERR_PTR(-EINVAL);
6851 } else {
6852 n_channels = ieee80211_get_num_supported_channels(wiphy);
6853 }
6854
6855 if (attrs[NL80211_ATTR_SCAN_SSIDS])
6856 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
6857 tmp)
6858 n_ssids++;
6859
6860 if (n_ssids > wiphy->max_sched_scan_ssids)
6861 return ERR_PTR(-EINVAL);
6862
6863 /*
6864 * First, count the number of 'real' matchsets. Due to an issue with
6865 * the old implementation, matchsets containing only the RSSI attribute
6866 * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
6867 * RSSI for all matchsets, rather than their own matchset for reporting
6868 * all APs with a strong RSSI. This is needed to be compatible with
6869 * older userspace that treated a matchset with only the RSSI as the
6870 * global RSSI for all other matchsets - if there are other matchsets.
6871 */
6872 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
6873 nla_for_each_nested(attr,
6874 attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
6875 tmp) {
6876 struct nlattr *rssi;
6877
6878 err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
6879 nla_data(attr), nla_len(attr),
6880 nl80211_match_policy);
6881 if (err)
6882 return ERR_PTR(err);
6883 /* add other standalone attributes here */
6884 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]) {
6885 n_match_sets++;
6886 continue;
6887 }
6888 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
6889 if (rssi)
6890 default_match_rssi = nla_get_s32(rssi);
6891 }
6892 }
6893
6894 /* However, if there's no other matchset, add the RSSI one */
6895 if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
6896 n_match_sets = 1;
6897
6898 if (n_match_sets > wiphy->max_match_sets)
6899 return ERR_PTR(-EINVAL);
6900
6901 if (attrs[NL80211_ATTR_IE])
6902 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
6903 else
6904 ie_len = 0;
6905
6906 if (ie_len > wiphy->max_sched_scan_ie_len)
6907 return ERR_PTR(-EINVAL);
6908
6909 if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
6910 /*
6911 * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
6912 * each scan plan already specifies its own interval
6913 */
6914 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
6915 return ERR_PTR(-EINVAL);
6916
6917 nla_for_each_nested(attr,
6918 attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
6919 n_plans++;
6920 } else {
6921 /*
6922 * The scan interval attribute is kept for backward
6923 * compatibility. If no scan plans are specified and sched scan
6924 * interval is specified, one scan plan will be set with this
6925 * scan interval and infinite number of iterations.
6926 */
6927 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
6928 return ERR_PTR(-EINVAL);
6929
6930 n_plans = 1;
6931 }
6932
6933 if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
6934 return ERR_PTR(-EINVAL);
6935
6936 request = kzalloc(sizeof(*request)
6937 + sizeof(*request->ssids) * n_ssids
6938 + sizeof(*request->match_sets) * n_match_sets
6939 + sizeof(*request->scan_plans) * n_plans
6940 + sizeof(*request->channels) * n_channels
6941 + ie_len, GFP_KERNEL);
6942 if (!request)
6943 return ERR_PTR(-ENOMEM);
6944
6945 if (n_ssids)
6946 request->ssids = (void *)&request->channels[n_channels];
6947 request->n_ssids = n_ssids;
6948 if (ie_len) {
6949 if (n_ssids)
6950 request->ie = (void *)(request->ssids + n_ssids);
6951 else
6952 request->ie = (void *)(request->channels + n_channels);
6953 }
6954
6955 if (n_match_sets) {
6956 if (request->ie)
6957 request->match_sets = (void *)(request->ie + ie_len);
6958 else if (n_ssids)
6959 request->match_sets =
6960 (void *)(request->ssids + n_ssids);
6961 else
6962 request->match_sets =
6963 (void *)(request->channels + n_channels);
6964 }
6965 request->n_match_sets = n_match_sets;
6966
6967 if (n_match_sets)
6968 request->scan_plans = (void *)(request->match_sets +
6969 n_match_sets);
6970 else if (request->ie)
6971 request->scan_plans = (void *)(request->ie + ie_len);
6972 else if (n_ssids)
6973 request->scan_plans = (void *)(request->ssids + n_ssids);
6974 else
6975 request->scan_plans = (void *)(request->channels + n_channels);
6976
6977 request->n_scan_plans = n_plans;
6978
6979 i = 0;
6980 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6981 /* user specified, bail out if channel not found */
6982 nla_for_each_nested(attr,
6983 attrs[NL80211_ATTR_SCAN_FREQUENCIES],
6984 tmp) {
6985 struct ieee80211_channel *chan;
6986
6987 chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
6988
6989 if (!chan) {
6990 err = -EINVAL;
6991 goto out_free;
6992 }
6993
6994 /* ignore disabled channels */
6995 if (chan->flags & IEEE80211_CHAN_DISABLED)
6996 continue;
6997
6998 request->channels[i] = chan;
6999 i++;
7000 }
7001 } else {
7002 /* all channels */
7003 for (band = 0; band < NUM_NL80211_BANDS; band++) {
7004 int j;
7005
7006 if (!wiphy->bands[band])
7007 continue;
7008 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
7009 struct ieee80211_channel *chan;
7010
7011 chan = &wiphy->bands[band]->channels[j];
7012
7013 if (chan->flags & IEEE80211_CHAN_DISABLED)
7014 continue;
7015
7016 request->channels[i] = chan;
7017 i++;
7018 }
7019 }
7020 }
7021
7022 if (!i) {
7023 err = -EINVAL;
7024 goto out_free;
7025 }
7026
7027 request->n_channels = i;
7028
7029 i = 0;
7030 if (n_ssids) {
7031 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7032 tmp) {
7033 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
7034 err = -EINVAL;
7035 goto out_free;
7036 }
7037 request->ssids[i].ssid_len = nla_len(attr);
7038 memcpy(request->ssids[i].ssid, nla_data(attr),
7039 nla_len(attr));
7040 i++;
7041 }
7042 }
7043
7044 i = 0;
7045 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7046 nla_for_each_nested(attr,
7047 attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7048 tmp) {
7049 struct nlattr *ssid, *rssi;
7050
7051 err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7052 nla_data(attr), nla_len(attr),
7053 nl80211_match_policy);
7054 if (err)
7055 goto out_free;
7056 ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
7057 if (ssid) {
7058 if (WARN_ON(i >= n_match_sets)) {
7059 /* this indicates a programming error,
7060 * the loop above should have verified
7061 * things properly
7062 */
7063 err = -EINVAL;
7064 goto out_free;
7065 }
7066
7067 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
7068 err = -EINVAL;
7069 goto out_free;
7070 }
7071 memcpy(request->match_sets[i].ssid.ssid,
7072 nla_data(ssid), nla_len(ssid));
7073 request->match_sets[i].ssid.ssid_len =
7074 nla_len(ssid);
7075 /* special attribute - old implementation w/a */
7076 request->match_sets[i].rssi_thold =
7077 default_match_rssi;
7078 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
7079 if (rssi)
7080 request->match_sets[i].rssi_thold =
7081 nla_get_s32(rssi);
7082 }
7083 i++;
7084 }
7085
7086 /* there was no other matchset, so the RSSI one is alone */
7087 if (i == 0 && n_match_sets)
7088 request->match_sets[0].rssi_thold = default_match_rssi;
7089
7090 request->min_rssi_thold = INT_MAX;
7091 for (i = 0; i < n_match_sets; i++)
7092 request->min_rssi_thold =
7093 min(request->match_sets[i].rssi_thold,
7094 request->min_rssi_thold);
7095 } else {
7096 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
7097 }
7098
7099 if (ie_len) {
7100 request->ie_len = ie_len;
7101 memcpy((void *)request->ie,
7102 nla_data(attrs[NL80211_ATTR_IE]),
7103 request->ie_len);
7104 }
7105
7106 if (attrs[NL80211_ATTR_SCAN_FLAGS]) {
7107 request->flags = nla_get_u32(
7108 attrs[NL80211_ATTR_SCAN_FLAGS]);
7109 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
7110 !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
7111 err = -EOPNOTSUPP;
7112 goto out_free;
7113 }
7114
7115 if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
7116 u32 flg = NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
7117
7118 if (!wdev) /* must be net-detect */
7119 flg = NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
7120
7121 if (!(wiphy->features & flg)) {
7122 err = -EOPNOTSUPP;
7123 goto out_free;
7124 }
7125
7126 if (wdev && wdev->current_bss) {
7127 err = -EOPNOTSUPP;
7128 goto out_free;
7129 }
7130
7131 err = nl80211_parse_random_mac(attrs, request->mac_addr,
7132 request->mac_addr_mask);
7133 if (err)
7134 goto out_free;
7135 }
7136 }
7137
7138 if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
7139 request->delay =
7140 nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
7141
7142 err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
7143 if (err)
7144 goto out_free;
7145
7146 request->scan_start = jiffies;
7147
7148 return request;
7149
7150 out_free:
7151 kfree(request);
7152 return ERR_PTR(err);
7153 }
7154
nl80211_start_sched_scan(struct sk_buff * skb,struct genl_info * info)7155 static int nl80211_start_sched_scan(struct sk_buff *skb,
7156 struct genl_info *info)
7157 {
7158 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7159 struct net_device *dev = info->user_ptr[1];
7160 struct wireless_dev *wdev = dev->ieee80211_ptr;
7161 struct cfg80211_sched_scan_request *sched_scan_req;
7162 int err;
7163
7164 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
7165 !rdev->ops->sched_scan_start)
7166 return -EOPNOTSUPP;
7167
7168 if (rdev->sched_scan_req)
7169 return -EINPROGRESS;
7170
7171 sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
7172 info->attrs);
7173
7174 err = PTR_ERR_OR_ZERO(sched_scan_req);
7175 if (err)
7176 goto out_err;
7177
7178 err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
7179 if (err)
7180 goto out_free;
7181
7182 sched_scan_req->dev = dev;
7183 sched_scan_req->wiphy = &rdev->wiphy;
7184
7185 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
7186 sched_scan_req->owner_nlportid = info->snd_portid;
7187
7188 rcu_assign_pointer(rdev->sched_scan_req, sched_scan_req);
7189
7190 nl80211_send_sched_scan(rdev, dev,
7191 NL80211_CMD_START_SCHED_SCAN);
7192 return 0;
7193
7194 out_free:
7195 kfree(sched_scan_req);
7196 out_err:
7197 return err;
7198 }
7199
nl80211_stop_sched_scan(struct sk_buff * skb,struct genl_info * info)7200 static int nl80211_stop_sched_scan(struct sk_buff *skb,
7201 struct genl_info *info)
7202 {
7203 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7204
7205 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
7206 !rdev->ops->sched_scan_stop)
7207 return -EOPNOTSUPP;
7208
7209 return __cfg80211_stop_sched_scan(rdev, false);
7210 }
7211
nl80211_start_radar_detection(struct sk_buff * skb,struct genl_info * info)7212 static int nl80211_start_radar_detection(struct sk_buff *skb,
7213 struct genl_info *info)
7214 {
7215 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7216 struct net_device *dev = info->user_ptr[1];
7217 struct wireless_dev *wdev = dev->ieee80211_ptr;
7218 struct cfg80211_chan_def chandef;
7219 enum nl80211_dfs_regions dfs_region;
7220 unsigned int cac_time_ms;
7221 int err;
7222
7223 dfs_region = reg_get_dfs_region(wdev->wiphy);
7224 if (dfs_region == NL80211_DFS_UNSET)
7225 return -EINVAL;
7226
7227 err = nl80211_parse_chandef(rdev, info, &chandef);
7228 if (err)
7229 return err;
7230
7231 if (netif_carrier_ok(dev))
7232 return -EBUSY;
7233
7234 if (wdev->cac_started)
7235 return -EBUSY;
7236
7237 err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef,
7238 wdev->iftype);
7239 if (err < 0)
7240 return err;
7241
7242 if (err == 0)
7243 return -EINVAL;
7244
7245 if (!cfg80211_chandef_dfs_usable(wdev->wiphy, &chandef))
7246 return -EINVAL;
7247
7248 if (!rdev->ops->start_radar_detection)
7249 return -EOPNOTSUPP;
7250
7251 cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
7252 if (WARN_ON(!cac_time_ms))
7253 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
7254
7255 err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
7256 if (!err) {
7257 wdev->chandef = chandef;
7258 wdev->cac_started = true;
7259 wdev->cac_start_time = jiffies;
7260 wdev->cac_time_ms = cac_time_ms;
7261 }
7262 return err;
7263 }
7264
nl80211_channel_switch(struct sk_buff * skb,struct genl_info * info)7265 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
7266 {
7267 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7268 struct net_device *dev = info->user_ptr[1];
7269 struct wireless_dev *wdev = dev->ieee80211_ptr;
7270 struct cfg80211_csa_settings params;
7271 /* csa_attrs is defined static to avoid waste of stack size - this
7272 * function is called under RTNL lock, so this should not be a problem.
7273 */
7274 static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
7275 int err;
7276 bool need_new_beacon = false;
7277 int len, i;
7278 u32 cs_count;
7279
7280 if (!rdev->ops->channel_switch ||
7281 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
7282 return -EOPNOTSUPP;
7283
7284 switch (dev->ieee80211_ptr->iftype) {
7285 case NL80211_IFTYPE_AP:
7286 case NL80211_IFTYPE_P2P_GO:
7287 need_new_beacon = true;
7288
7289 /* useless if AP is not running */
7290 if (!wdev->beacon_interval)
7291 return -ENOTCONN;
7292 break;
7293 case NL80211_IFTYPE_ADHOC:
7294 if (!wdev->ssid_len)
7295 return -ENOTCONN;
7296 break;
7297 case NL80211_IFTYPE_MESH_POINT:
7298 if (!wdev->mesh_id_len)
7299 return -ENOTCONN;
7300 break;
7301 default:
7302 return -EOPNOTSUPP;
7303 }
7304
7305 memset(¶ms, 0, sizeof(params));
7306
7307 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
7308 !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
7309 return -EINVAL;
7310
7311 /* only important for AP, IBSS and mesh create IEs internally */
7312 if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
7313 return -EINVAL;
7314
7315 /* Even though the attribute is u32, the specification says
7316 * u8, so let's make sure we don't overflow.
7317 */
7318 cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
7319 if (cs_count > 255)
7320 return -EINVAL;
7321
7322 params.count = cs_count;
7323
7324 if (!need_new_beacon)
7325 goto skip_beacons;
7326
7327 err = nl80211_parse_beacon(info->attrs, ¶ms.beacon_after);
7328 if (err)
7329 return err;
7330
7331 err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
7332 info->attrs[NL80211_ATTR_CSA_IES],
7333 nl80211_policy);
7334 if (err)
7335 return err;
7336
7337 err = nl80211_parse_beacon(csa_attrs, ¶ms.beacon_csa);
7338 if (err)
7339 return err;
7340
7341 if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
7342 return -EINVAL;
7343
7344 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
7345 if (!len || (len % sizeof(u16)))
7346 return -EINVAL;
7347
7348 params.n_counter_offsets_beacon = len / sizeof(u16);
7349 if (rdev->wiphy.max_num_csa_counters &&
7350 (params.n_counter_offsets_beacon >
7351 rdev->wiphy.max_num_csa_counters))
7352 return -EINVAL;
7353
7354 params.counter_offsets_beacon =
7355 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
7356
7357 /* sanity checks - counters should fit and be the same */
7358 for (i = 0; i < params.n_counter_offsets_beacon; i++) {
7359 u16 offset = params.counter_offsets_beacon[i];
7360
7361 if (offset >= params.beacon_csa.tail_len)
7362 return -EINVAL;
7363
7364 if (params.beacon_csa.tail[offset] != params.count)
7365 return -EINVAL;
7366 }
7367
7368 if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
7369 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
7370 if (!len || (len % sizeof(u16)))
7371 return -EINVAL;
7372
7373 params.n_counter_offsets_presp = len / sizeof(u16);
7374 if (rdev->wiphy.max_num_csa_counters &&
7375 (params.n_counter_offsets_presp >
7376 rdev->wiphy.max_num_csa_counters))
7377 return -EINVAL;
7378
7379 params.counter_offsets_presp =
7380 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
7381
7382 /* sanity checks - counters should fit and be the same */
7383 for (i = 0; i < params.n_counter_offsets_presp; i++) {
7384 u16 offset = params.counter_offsets_presp[i];
7385
7386 if (offset >= params.beacon_csa.probe_resp_len)
7387 return -EINVAL;
7388
7389 if (params.beacon_csa.probe_resp[offset] !=
7390 params.count)
7391 return -EINVAL;
7392 }
7393 }
7394
7395 skip_beacons:
7396 err = nl80211_parse_chandef(rdev, info, ¶ms.chandef);
7397 if (err)
7398 return err;
7399
7400 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms.chandef,
7401 wdev->iftype))
7402 return -EINVAL;
7403
7404 err = cfg80211_chandef_dfs_required(wdev->wiphy,
7405 ¶ms.chandef,
7406 wdev->iftype);
7407 if (err < 0)
7408 return err;
7409
7410 if (err > 0)
7411 params.radar_required = true;
7412
7413 if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
7414 params.block_tx = true;
7415
7416 wdev_lock(wdev);
7417 err = rdev_channel_switch(rdev, dev, ¶ms);
7418 wdev_unlock(wdev);
7419
7420 return err;
7421 }
7422
nl80211_send_bss(struct sk_buff * msg,struct netlink_callback * cb,u32 seq,int flags,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,struct cfg80211_internal_bss * intbss)7423 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
7424 u32 seq, int flags,
7425 struct cfg80211_registered_device *rdev,
7426 struct wireless_dev *wdev,
7427 struct cfg80211_internal_bss *intbss)
7428 {
7429 struct cfg80211_bss *res = &intbss->pub;
7430 const struct cfg80211_bss_ies *ies;
7431 void *hdr;
7432 struct nlattr *bss;
7433
7434 ASSERT_WDEV_LOCK(wdev);
7435
7436 hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
7437 NL80211_CMD_NEW_SCAN_RESULTS);
7438 if (!hdr)
7439 return -1;
7440
7441 genl_dump_check_consistent(cb, hdr, &nl80211_fam);
7442
7443 if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
7444 goto nla_put_failure;
7445 if (wdev->netdev &&
7446 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
7447 goto nla_put_failure;
7448 if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
7449 NL80211_ATTR_PAD))
7450 goto nla_put_failure;
7451
7452 bss = nla_nest_start(msg, NL80211_ATTR_BSS);
7453 if (!bss)
7454 goto nla_put_failure;
7455 if ((!is_zero_ether_addr(res->bssid) &&
7456 nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
7457 goto nla_put_failure;
7458
7459 rcu_read_lock();
7460 /* indicate whether we have probe response data or not */
7461 if (rcu_access_pointer(res->proberesp_ies) &&
7462 nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
7463 goto fail_unlock_rcu;
7464
7465 /* this pointer prefers to be pointed to probe response data
7466 * but is always valid
7467 */
7468 ies = rcu_dereference(res->ies);
7469 if (ies) {
7470 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
7471 NL80211_BSS_PAD))
7472 goto fail_unlock_rcu;
7473 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
7474 ies->len, ies->data))
7475 goto fail_unlock_rcu;
7476 }
7477
7478 /* and this pointer is always (unless driver didn't know) beacon data */
7479 ies = rcu_dereference(res->beacon_ies);
7480 if (ies && ies->from_beacon) {
7481 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
7482 NL80211_BSS_PAD))
7483 goto fail_unlock_rcu;
7484 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
7485 ies->len, ies->data))
7486 goto fail_unlock_rcu;
7487 }
7488 rcu_read_unlock();
7489
7490 if (res->beacon_interval &&
7491 nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
7492 goto nla_put_failure;
7493 if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
7494 nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
7495 nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
7496 nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
7497 jiffies_to_msecs(jiffies - intbss->ts)))
7498 goto nla_put_failure;
7499
7500 if (intbss->parent_tsf &&
7501 (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
7502 intbss->parent_tsf, NL80211_BSS_PAD) ||
7503 nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
7504 intbss->parent_bssid)))
7505 goto nla_put_failure;
7506
7507 if (intbss->ts_boottime &&
7508 nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
7509 intbss->ts_boottime, NL80211_BSS_PAD))
7510 goto nla_put_failure;
7511
7512 switch (rdev->wiphy.signal_type) {
7513 case CFG80211_SIGNAL_TYPE_MBM:
7514 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
7515 goto nla_put_failure;
7516 break;
7517 case CFG80211_SIGNAL_TYPE_UNSPEC:
7518 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
7519 goto nla_put_failure;
7520 break;
7521 default:
7522 break;
7523 }
7524
7525 switch (wdev->iftype) {
7526 case NL80211_IFTYPE_P2P_CLIENT:
7527 case NL80211_IFTYPE_STATION:
7528 if (intbss == wdev->current_bss &&
7529 nla_put_u32(msg, NL80211_BSS_STATUS,
7530 NL80211_BSS_STATUS_ASSOCIATED))
7531 goto nla_put_failure;
7532 break;
7533 case NL80211_IFTYPE_ADHOC:
7534 if (intbss == wdev->current_bss &&
7535 nla_put_u32(msg, NL80211_BSS_STATUS,
7536 NL80211_BSS_STATUS_IBSS_JOINED))
7537 goto nla_put_failure;
7538 break;
7539 default:
7540 break;
7541 }
7542
7543 nla_nest_end(msg, bss);
7544
7545 genlmsg_end(msg, hdr);
7546 return 0;
7547
7548 fail_unlock_rcu:
7549 rcu_read_unlock();
7550 nla_put_failure:
7551 genlmsg_cancel(msg, hdr);
7552 return -EMSGSIZE;
7553 }
7554
nl80211_dump_scan(struct sk_buff * skb,struct netlink_callback * cb)7555 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
7556 {
7557 struct cfg80211_registered_device *rdev;
7558 struct cfg80211_internal_bss *scan;
7559 struct wireless_dev *wdev;
7560 int start = cb->args[2], idx = 0;
7561 int err;
7562
7563 rtnl_lock();
7564 err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
7565 if (err) {
7566 rtnl_unlock();
7567 return err;
7568 }
7569
7570 wdev_lock(wdev);
7571 spin_lock_bh(&rdev->bss_lock);
7572 cfg80211_bss_expire(rdev);
7573
7574 cb->seq = rdev->bss_generation;
7575
7576 list_for_each_entry(scan, &rdev->bss_list, list) {
7577 if (++idx <= start)
7578 continue;
7579 if (nl80211_send_bss(skb, cb,
7580 cb->nlh->nlmsg_seq, NLM_F_MULTI,
7581 rdev, wdev, scan) < 0) {
7582 idx--;
7583 break;
7584 }
7585 }
7586
7587 spin_unlock_bh(&rdev->bss_lock);
7588 wdev_unlock(wdev);
7589
7590 cb->args[2] = idx;
7591 rtnl_unlock();
7592
7593 return skb->len;
7594 }
7595
nl80211_send_survey(struct sk_buff * msg,u32 portid,u32 seq,int flags,struct net_device * dev,bool allow_radio_stats,struct survey_info * survey)7596 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
7597 int flags, struct net_device *dev,
7598 bool allow_radio_stats,
7599 struct survey_info *survey)
7600 {
7601 void *hdr;
7602 struct nlattr *infoattr;
7603
7604 /* skip radio stats if userspace didn't request them */
7605 if (!survey->channel && !allow_radio_stats)
7606 return 0;
7607
7608 hdr = nl80211hdr_put(msg, portid, seq, flags,
7609 NL80211_CMD_NEW_SURVEY_RESULTS);
7610 if (!hdr)
7611 return -ENOMEM;
7612
7613 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
7614 goto nla_put_failure;
7615
7616 infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
7617 if (!infoattr)
7618 goto nla_put_failure;
7619
7620 if (survey->channel &&
7621 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
7622 survey->channel->center_freq))
7623 goto nla_put_failure;
7624
7625 if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
7626 nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
7627 goto nla_put_failure;
7628 if ((survey->filled & SURVEY_INFO_IN_USE) &&
7629 nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
7630 goto nla_put_failure;
7631 if ((survey->filled & SURVEY_INFO_TIME) &&
7632 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
7633 survey->time, NL80211_SURVEY_INFO_PAD))
7634 goto nla_put_failure;
7635 if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
7636 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
7637 survey->time_busy, NL80211_SURVEY_INFO_PAD))
7638 goto nla_put_failure;
7639 if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
7640 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
7641 survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
7642 goto nla_put_failure;
7643 if ((survey->filled & SURVEY_INFO_TIME_RX) &&
7644 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
7645 survey->time_rx, NL80211_SURVEY_INFO_PAD))
7646 goto nla_put_failure;
7647 if ((survey->filled & SURVEY_INFO_TIME_TX) &&
7648 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
7649 survey->time_tx, NL80211_SURVEY_INFO_PAD))
7650 goto nla_put_failure;
7651 if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
7652 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
7653 survey->time_scan, NL80211_SURVEY_INFO_PAD))
7654 goto nla_put_failure;
7655
7656 nla_nest_end(msg, infoattr);
7657
7658 genlmsg_end(msg, hdr);
7659 return 0;
7660
7661 nla_put_failure:
7662 genlmsg_cancel(msg, hdr);
7663 return -EMSGSIZE;
7664 }
7665
nl80211_dump_survey(struct sk_buff * skb,struct netlink_callback * cb)7666 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
7667 {
7668 struct survey_info survey;
7669 struct cfg80211_registered_device *rdev;
7670 struct wireless_dev *wdev;
7671 int survey_idx = cb->args[2];
7672 int res;
7673 bool radio_stats;
7674
7675 rtnl_lock();
7676 res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
7677 if (res)
7678 goto out_err;
7679
7680 /* prepare_wdev_dump parsed the attributes */
7681 radio_stats = nl80211_fam.attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
7682
7683 if (!wdev->netdev) {
7684 res = -EINVAL;
7685 goto out_err;
7686 }
7687
7688 if (!rdev->ops->dump_survey) {
7689 res = -EOPNOTSUPP;
7690 goto out_err;
7691 }
7692
7693 while (1) {
7694 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
7695 if (res == -ENOENT)
7696 break;
7697 if (res)
7698 goto out_err;
7699
7700 /* don't send disabled channels, but do send non-channel data */
7701 if (survey.channel &&
7702 survey.channel->flags & IEEE80211_CHAN_DISABLED) {
7703 survey_idx++;
7704 continue;
7705 }
7706
7707 if (nl80211_send_survey(skb,
7708 NETLINK_CB(cb->skb).portid,
7709 cb->nlh->nlmsg_seq, NLM_F_MULTI,
7710 wdev->netdev, radio_stats, &survey) < 0)
7711 goto out;
7712 survey_idx++;
7713 }
7714
7715 out:
7716 cb->args[2] = survey_idx;
7717 res = skb->len;
7718 out_err:
7719 rtnl_unlock();
7720 return res;
7721 }
7722
nl80211_valid_wpa_versions(u32 wpa_versions)7723 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
7724 {
7725 return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
7726 NL80211_WPA_VERSION_2));
7727 }
7728
nl80211_authenticate(struct sk_buff * skb,struct genl_info * info)7729 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
7730 {
7731 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7732 struct net_device *dev = info->user_ptr[1];
7733 struct ieee80211_channel *chan;
7734 const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
7735 int err, ssid_len, ie_len = 0, sae_data_len = 0;
7736 enum nl80211_auth_type auth_type;
7737 struct key_parse key;
7738 bool local_state_change;
7739
7740 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7741 return -EINVAL;
7742
7743 if (!info->attrs[NL80211_ATTR_MAC])
7744 return -EINVAL;
7745
7746 if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
7747 return -EINVAL;
7748
7749 if (!info->attrs[NL80211_ATTR_SSID])
7750 return -EINVAL;
7751
7752 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
7753 return -EINVAL;
7754
7755 err = nl80211_parse_key(info, &key);
7756 if (err)
7757 return err;
7758
7759 if (key.idx >= 0) {
7760 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
7761 return -EINVAL;
7762 if (!key.p.key || !key.p.key_len)
7763 return -EINVAL;
7764 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
7765 key.p.key_len != WLAN_KEY_LEN_WEP40) &&
7766 (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
7767 key.p.key_len != WLAN_KEY_LEN_WEP104))
7768 return -EINVAL;
7769 if (key.idx > 3)
7770 return -EINVAL;
7771 } else {
7772 key.p.key_len = 0;
7773 key.p.key = NULL;
7774 }
7775
7776 if (key.idx >= 0) {
7777 int i;
7778 bool ok = false;
7779
7780 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
7781 if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
7782 ok = true;
7783 break;
7784 }
7785 }
7786 if (!ok)
7787 return -EINVAL;
7788 }
7789
7790 if (!rdev->ops->auth)
7791 return -EOPNOTSUPP;
7792
7793 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7794 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7795 return -EOPNOTSUPP;
7796
7797 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7798 chan = nl80211_get_valid_chan(&rdev->wiphy,
7799 info->attrs[NL80211_ATTR_WIPHY_FREQ]);
7800 if (!chan)
7801 return -EINVAL;
7802
7803 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7804 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7805
7806 if (info->attrs[NL80211_ATTR_IE]) {
7807 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7808 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7809 }
7810
7811 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
7812 if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
7813 return -EINVAL;
7814
7815 if (auth_type == NL80211_AUTHTYPE_SAE &&
7816 !info->attrs[NL80211_ATTR_SAE_DATA])
7817 return -EINVAL;
7818
7819 if (info->attrs[NL80211_ATTR_SAE_DATA]) {
7820 if (auth_type != NL80211_AUTHTYPE_SAE)
7821 return -EINVAL;
7822 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
7823 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
7824 /* need to include at least Auth Transaction and Status Code */
7825 if (sae_data_len < 4)
7826 return -EINVAL;
7827 }
7828
7829 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
7830
7831 /*
7832 * Since we no longer track auth state, ignore
7833 * requests to only change local state.
7834 */
7835 if (local_state_change)
7836 return 0;
7837
7838 wdev_lock(dev->ieee80211_ptr);
7839 err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
7840 ssid, ssid_len, ie, ie_len,
7841 key.p.key, key.p.key_len, key.idx,
7842 sae_data, sae_data_len);
7843 wdev_unlock(dev->ieee80211_ptr);
7844 return err;
7845 }
7846
nl80211_crypto_settings(struct cfg80211_registered_device * rdev,struct genl_info * info,struct cfg80211_crypto_settings * settings,int cipher_limit)7847 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
7848 struct genl_info *info,
7849 struct cfg80211_crypto_settings *settings,
7850 int cipher_limit)
7851 {
7852 memset(settings, 0, sizeof(*settings));
7853
7854 settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
7855
7856 if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
7857 u16 proto;
7858
7859 proto = nla_get_u16(
7860 info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
7861 settings->control_port_ethertype = cpu_to_be16(proto);
7862 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
7863 proto != ETH_P_PAE)
7864 return -EINVAL;
7865 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
7866 settings->control_port_no_encrypt = true;
7867 } else
7868 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
7869
7870 if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
7871 void *data;
7872 int len, i;
7873
7874 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
7875 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
7876 settings->n_ciphers_pairwise = len / sizeof(u32);
7877
7878 if (len % sizeof(u32))
7879 return -EINVAL;
7880
7881 if (settings->n_ciphers_pairwise > cipher_limit)
7882 return -EINVAL;
7883
7884 memcpy(settings->ciphers_pairwise, data, len);
7885
7886 for (i = 0; i < settings->n_ciphers_pairwise; i++)
7887 if (!cfg80211_supported_cipher_suite(
7888 &rdev->wiphy,
7889 settings->ciphers_pairwise[i]))
7890 return -EINVAL;
7891 }
7892
7893 if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
7894 settings->cipher_group =
7895 nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
7896 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
7897 settings->cipher_group))
7898 return -EINVAL;
7899 }
7900
7901 if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
7902 settings->wpa_versions =
7903 nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
7904 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
7905 return -EINVAL;
7906 }
7907
7908 if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
7909 void *data;
7910 int len;
7911
7912 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
7913 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
7914 settings->n_akm_suites = len / sizeof(u32);
7915
7916 if (len % sizeof(u32))
7917 return -EINVAL;
7918
7919 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
7920 return -EINVAL;
7921
7922 memcpy(settings->akm_suites, data, len);
7923 }
7924
7925 return 0;
7926 }
7927
nl80211_associate(struct sk_buff * skb,struct genl_info * info)7928 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
7929 {
7930 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7931 struct net_device *dev = info->user_ptr[1];
7932 struct ieee80211_channel *chan;
7933 struct cfg80211_assoc_request req = {};
7934 const u8 *bssid, *ssid;
7935 int err, ssid_len = 0;
7936
7937 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7938 return -EINVAL;
7939
7940 if (!info->attrs[NL80211_ATTR_MAC] ||
7941 !info->attrs[NL80211_ATTR_SSID] ||
7942 !info->attrs[NL80211_ATTR_WIPHY_FREQ])
7943 return -EINVAL;
7944
7945 if (!rdev->ops->assoc)
7946 return -EOPNOTSUPP;
7947
7948 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7949 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7950 return -EOPNOTSUPP;
7951
7952 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7953
7954 chan = nl80211_get_valid_chan(&rdev->wiphy,
7955 info->attrs[NL80211_ATTR_WIPHY_FREQ]);
7956 if (!chan)
7957 return -EINVAL;
7958
7959 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7960 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7961
7962 if (info->attrs[NL80211_ATTR_IE]) {
7963 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7964 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7965 }
7966
7967 if (info->attrs[NL80211_ATTR_USE_MFP]) {
7968 enum nl80211_mfp mfp =
7969 nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
7970 if (mfp == NL80211_MFP_REQUIRED)
7971 req.use_mfp = true;
7972 else if (mfp != NL80211_MFP_NO)
7973 return -EINVAL;
7974 }
7975
7976 if (info->attrs[NL80211_ATTR_PREV_BSSID])
7977 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
7978
7979 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
7980 req.flags |= ASSOC_REQ_DISABLE_HT;
7981
7982 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7983 memcpy(&req.ht_capa_mask,
7984 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
7985 sizeof(req.ht_capa_mask));
7986
7987 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7988 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7989 return -EINVAL;
7990 memcpy(&req.ht_capa,
7991 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7992 sizeof(req.ht_capa));
7993 }
7994
7995 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
7996 req.flags |= ASSOC_REQ_DISABLE_VHT;
7997
7998 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7999 memcpy(&req.vht_capa_mask,
8000 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
8001 sizeof(req.vht_capa_mask));
8002
8003 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
8004 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8005 return -EINVAL;
8006 memcpy(&req.vht_capa,
8007 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
8008 sizeof(req.vht_capa));
8009 }
8010
8011 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
8012 if (!((rdev->wiphy.features &
8013 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
8014 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
8015 !wiphy_ext_feature_isset(&rdev->wiphy,
8016 NL80211_EXT_FEATURE_RRM))
8017 return -EINVAL;
8018 req.flags |= ASSOC_REQ_USE_RRM;
8019 }
8020
8021 err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
8022 if (!err) {
8023 wdev_lock(dev->ieee80211_ptr);
8024 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
8025 ssid, ssid_len, &req);
8026 wdev_unlock(dev->ieee80211_ptr);
8027 }
8028
8029 return err;
8030 }
8031
nl80211_deauthenticate(struct sk_buff * skb,struct genl_info * info)8032 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
8033 {
8034 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8035 struct net_device *dev = info->user_ptr[1];
8036 const u8 *ie = NULL, *bssid;
8037 int ie_len = 0, err;
8038 u16 reason_code;
8039 bool local_state_change;
8040
8041 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8042 return -EINVAL;
8043
8044 if (!info->attrs[NL80211_ATTR_MAC])
8045 return -EINVAL;
8046
8047 if (!info->attrs[NL80211_ATTR_REASON_CODE])
8048 return -EINVAL;
8049
8050 if (!rdev->ops->deauth)
8051 return -EOPNOTSUPP;
8052
8053 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8054 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8055 return -EOPNOTSUPP;
8056
8057 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8058
8059 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8060 if (reason_code == 0) {
8061 /* Reason Code 0 is reserved */
8062 return -EINVAL;
8063 }
8064
8065 if (info->attrs[NL80211_ATTR_IE]) {
8066 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8067 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8068 }
8069
8070 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8071
8072 wdev_lock(dev->ieee80211_ptr);
8073 err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
8074 local_state_change);
8075 wdev_unlock(dev->ieee80211_ptr);
8076 return err;
8077 }
8078
nl80211_disassociate(struct sk_buff * skb,struct genl_info * info)8079 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
8080 {
8081 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8082 struct net_device *dev = info->user_ptr[1];
8083 const u8 *ie = NULL, *bssid;
8084 int ie_len = 0, err;
8085 u16 reason_code;
8086 bool local_state_change;
8087
8088 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8089 return -EINVAL;
8090
8091 if (!info->attrs[NL80211_ATTR_MAC])
8092 return -EINVAL;
8093
8094 if (!info->attrs[NL80211_ATTR_REASON_CODE])
8095 return -EINVAL;
8096
8097 if (!rdev->ops->disassoc)
8098 return -EOPNOTSUPP;
8099
8100 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8101 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8102 return -EOPNOTSUPP;
8103
8104 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8105
8106 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8107 if (reason_code == 0) {
8108 /* Reason Code 0 is reserved */
8109 return -EINVAL;
8110 }
8111
8112 if (info->attrs[NL80211_ATTR_IE]) {
8113 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8114 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8115 }
8116
8117 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8118
8119 wdev_lock(dev->ieee80211_ptr);
8120 err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
8121 local_state_change);
8122 wdev_unlock(dev->ieee80211_ptr);
8123 return err;
8124 }
8125
8126 static bool
nl80211_parse_mcast_rate(struct cfg80211_registered_device * rdev,int mcast_rate[NUM_NL80211_BANDS],int rateval)8127 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
8128 int mcast_rate[NUM_NL80211_BANDS],
8129 int rateval)
8130 {
8131 struct wiphy *wiphy = &rdev->wiphy;
8132 bool found = false;
8133 int band, i;
8134
8135 for (band = 0; band < NUM_NL80211_BANDS; band++) {
8136 struct ieee80211_supported_band *sband;
8137
8138 sband = wiphy->bands[band];
8139 if (!sband)
8140 continue;
8141
8142 for (i = 0; i < sband->n_bitrates; i++) {
8143 if (sband->bitrates[i].bitrate == rateval) {
8144 mcast_rate[band] = i + 1;
8145 found = true;
8146 break;
8147 }
8148 }
8149 }
8150
8151 return found;
8152 }
8153
nl80211_join_ibss(struct sk_buff * skb,struct genl_info * info)8154 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
8155 {
8156 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8157 struct net_device *dev = info->user_ptr[1];
8158 struct cfg80211_ibss_params ibss;
8159 struct wiphy *wiphy;
8160 struct cfg80211_cached_keys *connkeys = NULL;
8161 int err;
8162
8163 memset(&ibss, 0, sizeof(ibss));
8164
8165 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8166 return -EINVAL;
8167
8168 if (!info->attrs[NL80211_ATTR_SSID] ||
8169 !nla_len(info->attrs[NL80211_ATTR_SSID]))
8170 return -EINVAL;
8171
8172 ibss.beacon_interval = 100;
8173
8174 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
8175 ibss.beacon_interval =
8176 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
8177
8178 err = cfg80211_validate_beacon_int(rdev, ibss.beacon_interval);
8179 if (err)
8180 return err;
8181
8182 if (!rdev->ops->join_ibss)
8183 return -EOPNOTSUPP;
8184
8185 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
8186 return -EOPNOTSUPP;
8187
8188 wiphy = &rdev->wiphy;
8189
8190 if (info->attrs[NL80211_ATTR_MAC]) {
8191 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8192
8193 if (!is_valid_ether_addr(ibss.bssid))
8194 return -EINVAL;
8195 }
8196 ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8197 ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8198
8199 if (info->attrs[NL80211_ATTR_IE]) {
8200 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8201 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8202 }
8203
8204 err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
8205 if (err)
8206 return err;
8207
8208 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
8209 NL80211_IFTYPE_ADHOC))
8210 return -EINVAL;
8211
8212 switch (ibss.chandef.width) {
8213 case NL80211_CHAN_WIDTH_5:
8214 case NL80211_CHAN_WIDTH_10:
8215 case NL80211_CHAN_WIDTH_20_NOHT:
8216 break;
8217 case NL80211_CHAN_WIDTH_20:
8218 case NL80211_CHAN_WIDTH_40:
8219 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
8220 return -EINVAL;
8221 break;
8222 case NL80211_CHAN_WIDTH_80:
8223 case NL80211_CHAN_WIDTH_80P80:
8224 case NL80211_CHAN_WIDTH_160:
8225 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
8226 return -EINVAL;
8227 if (!wiphy_ext_feature_isset(&rdev->wiphy,
8228 NL80211_EXT_FEATURE_VHT_IBSS))
8229 return -EINVAL;
8230 break;
8231 default:
8232 return -EINVAL;
8233 }
8234
8235 ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
8236 ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
8237
8238 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
8239 u8 *rates =
8240 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8241 int n_rates =
8242 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8243 struct ieee80211_supported_band *sband =
8244 wiphy->bands[ibss.chandef.chan->band];
8245
8246 err = ieee80211_get_ratemask(sband, rates, n_rates,
8247 &ibss.basic_rates);
8248 if (err)
8249 return err;
8250 }
8251
8252 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8253 memcpy(&ibss.ht_capa_mask,
8254 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8255 sizeof(ibss.ht_capa_mask));
8256
8257 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8258 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8259 return -EINVAL;
8260 memcpy(&ibss.ht_capa,
8261 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8262 sizeof(ibss.ht_capa));
8263 }
8264
8265 if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
8266 !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
8267 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
8268 return -EINVAL;
8269
8270 if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
8271 bool no_ht = false;
8272
8273 connkeys = nl80211_parse_connkeys(rdev,
8274 info->attrs[NL80211_ATTR_KEYS],
8275 &no_ht);
8276 if (IS_ERR(connkeys))
8277 return PTR_ERR(connkeys);
8278
8279 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
8280 no_ht) {
8281 kzfree(connkeys);
8282 return -EINVAL;
8283 }
8284 }
8285
8286 ibss.control_port =
8287 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
8288
8289 ibss.userspace_handles_dfs =
8290 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
8291
8292 err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
8293 if (err)
8294 kzfree(connkeys);
8295 return err;
8296 }
8297
nl80211_leave_ibss(struct sk_buff * skb,struct genl_info * info)8298 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
8299 {
8300 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8301 struct net_device *dev = info->user_ptr[1];
8302
8303 if (!rdev->ops->leave_ibss)
8304 return -EOPNOTSUPP;
8305
8306 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
8307 return -EOPNOTSUPP;
8308
8309 return cfg80211_leave_ibss(rdev, dev, false);
8310 }
8311
nl80211_set_mcast_rate(struct sk_buff * skb,struct genl_info * info)8312 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
8313 {
8314 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8315 struct net_device *dev = info->user_ptr[1];
8316 int mcast_rate[NUM_NL80211_BANDS];
8317 u32 nla_rate;
8318 int err;
8319
8320 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
8321 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
8322 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
8323 return -EOPNOTSUPP;
8324
8325 if (!rdev->ops->set_mcast_rate)
8326 return -EOPNOTSUPP;
8327
8328 memset(mcast_rate, 0, sizeof(mcast_rate));
8329
8330 if (!info->attrs[NL80211_ATTR_MCAST_RATE])
8331 return -EINVAL;
8332
8333 nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
8334 if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
8335 return -EINVAL;
8336
8337 err = rdev_set_mcast_rate(rdev, dev, mcast_rate);
8338
8339 return err;
8340 }
8341
8342 static struct sk_buff *
__cfg80211_alloc_vendor_skb(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,int approxlen,u32 portid,u32 seq,enum nl80211_commands cmd,enum nl80211_attrs attr,const struct nl80211_vendor_cmd_info * info,gfp_t gfp)8343 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
8344 struct wireless_dev *wdev, int approxlen,
8345 u32 portid, u32 seq, enum nl80211_commands cmd,
8346 enum nl80211_attrs attr,
8347 const struct nl80211_vendor_cmd_info *info,
8348 gfp_t gfp)
8349 {
8350 struct sk_buff *skb;
8351 void *hdr;
8352 struct nlattr *data;
8353
8354 skb = nlmsg_new(approxlen + 100, gfp);
8355 if (!skb)
8356 return NULL;
8357
8358 hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
8359 if (!hdr) {
8360 kfree_skb(skb);
8361 return NULL;
8362 }
8363
8364 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
8365 goto nla_put_failure;
8366
8367 if (info) {
8368 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
8369 info->vendor_id))
8370 goto nla_put_failure;
8371 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
8372 info->subcmd))
8373 goto nla_put_failure;
8374 }
8375
8376 if (wdev) {
8377 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
8378 wdev_id(wdev), NL80211_ATTR_PAD))
8379 goto nla_put_failure;
8380 if (wdev->netdev &&
8381 nla_put_u32(skb, NL80211_ATTR_IFINDEX,
8382 wdev->netdev->ifindex))
8383 goto nla_put_failure;
8384 }
8385
8386 data = nla_nest_start(skb, attr);
8387 if (!data)
8388 goto nla_put_failure;
8389
8390 ((void **)skb->cb)[0] = rdev;
8391 ((void **)skb->cb)[1] = hdr;
8392 ((void **)skb->cb)[2] = data;
8393
8394 return skb;
8395
8396 nla_put_failure:
8397 kfree_skb(skb);
8398 return NULL;
8399 }
8400
__cfg80211_alloc_event_skb(struct wiphy * wiphy,struct wireless_dev * wdev,enum nl80211_commands cmd,enum nl80211_attrs attr,int vendor_event_idx,int approxlen,gfp_t gfp)8401 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
8402 struct wireless_dev *wdev,
8403 enum nl80211_commands cmd,
8404 enum nl80211_attrs attr,
8405 int vendor_event_idx,
8406 int approxlen, gfp_t gfp)
8407 {
8408 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
8409 const struct nl80211_vendor_cmd_info *info;
8410
8411 switch (cmd) {
8412 case NL80211_CMD_TESTMODE:
8413 if (WARN_ON(vendor_event_idx != -1))
8414 return NULL;
8415 info = NULL;
8416 break;
8417 case NL80211_CMD_VENDOR:
8418 if (WARN_ON(vendor_event_idx < 0 ||
8419 vendor_event_idx >= wiphy->n_vendor_events))
8420 return NULL;
8421 info = &wiphy->vendor_events[vendor_event_idx];
8422 break;
8423 default:
8424 WARN_ON(1);
8425 return NULL;
8426 }
8427
8428 return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, 0, 0,
8429 cmd, attr, info, gfp);
8430 }
8431 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
8432
__cfg80211_send_event_skb(struct sk_buff * skb,gfp_t gfp)8433 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
8434 {
8435 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
8436 void *hdr = ((void **)skb->cb)[1];
8437 struct nlattr *data = ((void **)skb->cb)[2];
8438 enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
8439
8440 /* clear CB data for netlink core to own from now on */
8441 memset(skb->cb, 0, sizeof(skb->cb));
8442
8443 nla_nest_end(skb, data);
8444 genlmsg_end(skb, hdr);
8445
8446 if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
8447 mcgrp = NL80211_MCGRP_VENDOR;
8448
8449 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
8450 mcgrp, gfp);
8451 }
8452 EXPORT_SYMBOL(__cfg80211_send_event_skb);
8453
8454 #ifdef CONFIG_NL80211_TESTMODE
nl80211_testmode_do(struct sk_buff * skb,struct genl_info * info)8455 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
8456 {
8457 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8458 struct wireless_dev *wdev =
8459 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
8460 int err;
8461
8462 if (!rdev->ops->testmode_cmd)
8463 return -EOPNOTSUPP;
8464
8465 if (IS_ERR(wdev)) {
8466 err = PTR_ERR(wdev);
8467 if (err != -EINVAL)
8468 return err;
8469 wdev = NULL;
8470 } else if (wdev->wiphy != &rdev->wiphy) {
8471 return -EINVAL;
8472 }
8473
8474 if (!info->attrs[NL80211_ATTR_TESTDATA])
8475 return -EINVAL;
8476
8477 rdev->cur_cmd_info = info;
8478 err = rdev_testmode_cmd(rdev, wdev,
8479 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
8480 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
8481 rdev->cur_cmd_info = NULL;
8482
8483 return err;
8484 }
8485
nl80211_testmode_dump(struct sk_buff * skb,struct netlink_callback * cb)8486 static int nl80211_testmode_dump(struct sk_buff *skb,
8487 struct netlink_callback *cb)
8488 {
8489 struct cfg80211_registered_device *rdev;
8490 int err;
8491 long phy_idx;
8492 void *data = NULL;
8493 int data_len = 0;
8494
8495 rtnl_lock();
8496
8497 if (cb->args[0]) {
8498 /*
8499 * 0 is a valid index, but not valid for args[0],
8500 * so we need to offset by 1.
8501 */
8502 phy_idx = cb->args[0] - 1;
8503 } else {
8504 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
8505 nl80211_fam.attrbuf, nl80211_fam.maxattr,
8506 nl80211_policy);
8507 if (err)
8508 goto out_err;
8509
8510 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
8511 nl80211_fam.attrbuf);
8512 if (IS_ERR(rdev)) {
8513 err = PTR_ERR(rdev);
8514 goto out_err;
8515 }
8516 phy_idx = rdev->wiphy_idx;
8517 rdev = NULL;
8518
8519 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
8520 cb->args[1] =
8521 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
8522 }
8523
8524 if (cb->args[1]) {
8525 data = nla_data((void *)cb->args[1]);
8526 data_len = nla_len((void *)cb->args[1]);
8527 }
8528
8529 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
8530 if (!rdev) {
8531 err = -ENOENT;
8532 goto out_err;
8533 }
8534
8535 if (!rdev->ops->testmode_dump) {
8536 err = -EOPNOTSUPP;
8537 goto out_err;
8538 }
8539
8540 while (1) {
8541 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
8542 cb->nlh->nlmsg_seq, NLM_F_MULTI,
8543 NL80211_CMD_TESTMODE);
8544 struct nlattr *tmdata;
8545
8546 if (!hdr)
8547 break;
8548
8549 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
8550 genlmsg_cancel(skb, hdr);
8551 break;
8552 }
8553
8554 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
8555 if (!tmdata) {
8556 genlmsg_cancel(skb, hdr);
8557 break;
8558 }
8559 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
8560 nla_nest_end(skb, tmdata);
8561
8562 if (err == -ENOBUFS || err == -ENOENT) {
8563 genlmsg_cancel(skb, hdr);
8564 break;
8565 } else if (err) {
8566 genlmsg_cancel(skb, hdr);
8567 goto out_err;
8568 }
8569
8570 genlmsg_end(skb, hdr);
8571 }
8572
8573 err = skb->len;
8574 /* see above */
8575 cb->args[0] = phy_idx + 1;
8576 out_err:
8577 rtnl_unlock();
8578 return err;
8579 }
8580 #endif
8581
nl80211_connect(struct sk_buff * skb,struct genl_info * info)8582 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
8583 {
8584 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8585 struct net_device *dev = info->user_ptr[1];
8586 struct cfg80211_connect_params connect;
8587 struct wiphy *wiphy;
8588 struct cfg80211_cached_keys *connkeys = NULL;
8589 int err;
8590
8591 memset(&connect, 0, sizeof(connect));
8592
8593 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8594 return -EINVAL;
8595
8596 if (!info->attrs[NL80211_ATTR_SSID] ||
8597 !nla_len(info->attrs[NL80211_ATTR_SSID]))
8598 return -EINVAL;
8599
8600 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
8601 connect.auth_type =
8602 nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
8603 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
8604 NL80211_CMD_CONNECT))
8605 return -EINVAL;
8606 } else
8607 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
8608
8609 connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
8610
8611 err = nl80211_crypto_settings(rdev, info, &connect.crypto,
8612 NL80211_MAX_NR_CIPHER_SUITES);
8613 if (err)
8614 return err;
8615
8616 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8617 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8618 return -EOPNOTSUPP;
8619
8620 wiphy = &rdev->wiphy;
8621
8622 connect.bg_scan_period = -1;
8623 if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
8624 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
8625 connect.bg_scan_period =
8626 nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
8627 }
8628
8629 if (info->attrs[NL80211_ATTR_MAC])
8630 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8631 else if (info->attrs[NL80211_ATTR_MAC_HINT])
8632 connect.bssid_hint =
8633 nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
8634 connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8635 connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8636
8637 if (info->attrs[NL80211_ATTR_IE]) {
8638 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8639 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8640 }
8641
8642 if (info->attrs[NL80211_ATTR_USE_MFP]) {
8643 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
8644 if (connect.mfp != NL80211_MFP_REQUIRED &&
8645 connect.mfp != NL80211_MFP_NO)
8646 return -EINVAL;
8647 } else {
8648 connect.mfp = NL80211_MFP_NO;
8649 }
8650
8651 if (info->attrs[NL80211_ATTR_PREV_BSSID])
8652 connect.prev_bssid =
8653 nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
8654
8655 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
8656 connect.channel = nl80211_get_valid_chan(
8657 wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8658 if (!connect.channel)
8659 return -EINVAL;
8660 } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
8661 connect.channel_hint = nl80211_get_valid_chan(
8662 wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
8663 if (!connect.channel_hint)
8664 return -EINVAL;
8665 }
8666
8667 if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
8668 connkeys = nl80211_parse_connkeys(rdev,
8669 info->attrs[NL80211_ATTR_KEYS], NULL);
8670 if (IS_ERR(connkeys))
8671 return PTR_ERR(connkeys);
8672 }
8673
8674 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
8675 connect.flags |= ASSOC_REQ_DISABLE_HT;
8676
8677 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8678 memcpy(&connect.ht_capa_mask,
8679 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8680 sizeof(connect.ht_capa_mask));
8681
8682 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8683 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
8684 kzfree(connkeys);
8685 return -EINVAL;
8686 }
8687 memcpy(&connect.ht_capa,
8688 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8689 sizeof(connect.ht_capa));
8690 }
8691
8692 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
8693 connect.flags |= ASSOC_REQ_DISABLE_VHT;
8694
8695 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8696 memcpy(&connect.vht_capa_mask,
8697 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
8698 sizeof(connect.vht_capa_mask));
8699
8700 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
8701 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
8702 kzfree(connkeys);
8703 return -EINVAL;
8704 }
8705 memcpy(&connect.vht_capa,
8706 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
8707 sizeof(connect.vht_capa));
8708 }
8709
8710 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
8711 if (!((rdev->wiphy.features &
8712 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
8713 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
8714 !wiphy_ext_feature_isset(&rdev->wiphy,
8715 NL80211_EXT_FEATURE_RRM)) {
8716 kzfree(connkeys);
8717 return -EINVAL;
8718 }
8719 connect.flags |= ASSOC_REQ_USE_RRM;
8720 }
8721
8722 connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
8723 if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
8724 kzfree(connkeys);
8725 return -EOPNOTSUPP;
8726 }
8727
8728 if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
8729 /* bss selection makes no sense if bssid is set */
8730 if (connect.bssid) {
8731 kzfree(connkeys);
8732 return -EINVAL;
8733 }
8734
8735 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
8736 wiphy, &connect.bss_select);
8737 if (err) {
8738 kzfree(connkeys);
8739 return err;
8740 }
8741 }
8742
8743 wdev_lock(dev->ieee80211_ptr);
8744 err = cfg80211_connect(rdev, dev, &connect, connkeys,
8745 connect.prev_bssid);
8746 wdev_unlock(dev->ieee80211_ptr);
8747 if (err)
8748 kzfree(connkeys);
8749 return err;
8750 }
8751
nl80211_disconnect(struct sk_buff * skb,struct genl_info * info)8752 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
8753 {
8754 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8755 struct net_device *dev = info->user_ptr[1];
8756 u16 reason;
8757 int ret;
8758
8759 if (!info->attrs[NL80211_ATTR_REASON_CODE])
8760 reason = WLAN_REASON_DEAUTH_LEAVING;
8761 else
8762 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8763
8764 if (reason == 0)
8765 return -EINVAL;
8766
8767 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8768 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8769 return -EOPNOTSUPP;
8770
8771 wdev_lock(dev->ieee80211_ptr);
8772 ret = cfg80211_disconnect(rdev, dev, reason, true);
8773 wdev_unlock(dev->ieee80211_ptr);
8774 return ret;
8775 }
8776
nl80211_wiphy_netns(struct sk_buff * skb,struct genl_info * info)8777 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
8778 {
8779 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8780 struct net *net;
8781 int err;
8782
8783 if (info->attrs[NL80211_ATTR_PID]) {
8784 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
8785
8786 net = get_net_ns_by_pid(pid);
8787 } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
8788 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
8789
8790 net = get_net_ns_by_fd(fd);
8791 } else {
8792 return -EINVAL;
8793 }
8794
8795 if (IS_ERR(net))
8796 return PTR_ERR(net);
8797
8798 err = 0;
8799
8800 /* check if anything to do */
8801 if (!net_eq(wiphy_net(&rdev->wiphy), net))
8802 err = cfg80211_switch_netns(rdev, net);
8803
8804 put_net(net);
8805 return err;
8806 }
8807
nl80211_setdel_pmksa(struct sk_buff * skb,struct genl_info * info)8808 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
8809 {
8810 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8811 int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
8812 struct cfg80211_pmksa *pmksa) = NULL;
8813 struct net_device *dev = info->user_ptr[1];
8814 struct cfg80211_pmksa pmksa;
8815
8816 memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
8817
8818 if (!info->attrs[NL80211_ATTR_MAC])
8819 return -EINVAL;
8820
8821 if (!info->attrs[NL80211_ATTR_PMKID])
8822 return -EINVAL;
8823
8824 pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
8825 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8826
8827 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8828 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8829 return -EOPNOTSUPP;
8830
8831 switch (info->genlhdr->cmd) {
8832 case NL80211_CMD_SET_PMKSA:
8833 rdev_ops = rdev->ops->set_pmksa;
8834 break;
8835 case NL80211_CMD_DEL_PMKSA:
8836 rdev_ops = rdev->ops->del_pmksa;
8837 break;
8838 default:
8839 WARN_ON(1);
8840 break;
8841 }
8842
8843 if (!rdev_ops)
8844 return -EOPNOTSUPP;
8845
8846 return rdev_ops(&rdev->wiphy, dev, &pmksa);
8847 }
8848
nl80211_flush_pmksa(struct sk_buff * skb,struct genl_info * info)8849 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
8850 {
8851 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8852 struct net_device *dev = info->user_ptr[1];
8853
8854 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8855 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8856 return -EOPNOTSUPP;
8857
8858 if (!rdev->ops->flush_pmksa)
8859 return -EOPNOTSUPP;
8860
8861 return rdev_flush_pmksa(rdev, dev);
8862 }
8863
nl80211_tdls_mgmt(struct sk_buff * skb,struct genl_info * info)8864 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
8865 {
8866 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8867 struct net_device *dev = info->user_ptr[1];
8868 u8 action_code, dialog_token;
8869 u32 peer_capability = 0;
8870 u16 status_code;
8871 u8 *peer;
8872 bool initiator;
8873
8874 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
8875 !rdev->ops->tdls_mgmt)
8876 return -EOPNOTSUPP;
8877
8878 if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
8879 !info->attrs[NL80211_ATTR_STATUS_CODE] ||
8880 !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
8881 !info->attrs[NL80211_ATTR_IE] ||
8882 !info->attrs[NL80211_ATTR_MAC])
8883 return -EINVAL;
8884
8885 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
8886 action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
8887 status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
8888 dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
8889 initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
8890 if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
8891 peer_capability =
8892 nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
8893
8894 return rdev_tdls_mgmt(rdev, dev, peer, action_code,
8895 dialog_token, status_code, peer_capability,
8896 initiator,
8897 nla_data(info->attrs[NL80211_ATTR_IE]),
8898 nla_len(info->attrs[NL80211_ATTR_IE]));
8899 }
8900
nl80211_tdls_oper(struct sk_buff * skb,struct genl_info * info)8901 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
8902 {
8903 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8904 struct net_device *dev = info->user_ptr[1];
8905 enum nl80211_tdls_operation operation;
8906 u8 *peer;
8907
8908 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
8909 !rdev->ops->tdls_oper)
8910 return -EOPNOTSUPP;
8911
8912 if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
8913 !info->attrs[NL80211_ATTR_MAC])
8914 return -EINVAL;
8915
8916 operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
8917 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
8918
8919 return rdev_tdls_oper(rdev, dev, peer, operation);
8920 }
8921
nl80211_remain_on_channel(struct sk_buff * skb,struct genl_info * info)8922 static int nl80211_remain_on_channel(struct sk_buff *skb,
8923 struct genl_info *info)
8924 {
8925 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8926 struct wireless_dev *wdev = info->user_ptr[1];
8927 struct cfg80211_chan_def chandef;
8928 struct sk_buff *msg;
8929 void *hdr;
8930 u64 cookie;
8931 u32 duration;
8932 int err;
8933
8934 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
8935 !info->attrs[NL80211_ATTR_DURATION])
8936 return -EINVAL;
8937
8938 duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
8939
8940 if (!rdev->ops->remain_on_channel ||
8941 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
8942 return -EOPNOTSUPP;
8943
8944 /*
8945 * We should be on that channel for at least a minimum amount of
8946 * time (10ms) but no longer than the driver supports.
8947 */
8948 if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
8949 duration > rdev->wiphy.max_remain_on_channel_duration)
8950 return -EINVAL;
8951
8952 err = nl80211_parse_chandef(rdev, info, &chandef);
8953 if (err)
8954 return err;
8955
8956 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8957 if (!msg)
8958 return -ENOMEM;
8959
8960 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8961 NL80211_CMD_REMAIN_ON_CHANNEL);
8962 if (!hdr) {
8963 err = -ENOBUFS;
8964 goto free_msg;
8965 }
8966
8967 err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
8968 duration, &cookie);
8969
8970 if (err)
8971 goto free_msg;
8972
8973 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
8974 NL80211_ATTR_PAD))
8975 goto nla_put_failure;
8976
8977 genlmsg_end(msg, hdr);
8978
8979 return genlmsg_reply(msg, info);
8980
8981 nla_put_failure:
8982 err = -ENOBUFS;
8983 free_msg:
8984 nlmsg_free(msg);
8985 return err;
8986 }
8987
nl80211_cancel_remain_on_channel(struct sk_buff * skb,struct genl_info * info)8988 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
8989 struct genl_info *info)
8990 {
8991 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8992 struct wireless_dev *wdev = info->user_ptr[1];
8993 u64 cookie;
8994
8995 if (!info->attrs[NL80211_ATTR_COOKIE])
8996 return -EINVAL;
8997
8998 if (!rdev->ops->cancel_remain_on_channel)
8999 return -EOPNOTSUPP;
9000
9001 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
9002
9003 return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
9004 }
9005
nl80211_set_tx_bitrate_mask(struct sk_buff * skb,struct genl_info * info)9006 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
9007 struct genl_info *info)
9008 {
9009 struct cfg80211_bitrate_mask mask;
9010 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9011 struct net_device *dev = info->user_ptr[1];
9012 int err;
9013
9014 if (!rdev->ops->set_bitrate_mask)
9015 return -EOPNOTSUPP;
9016
9017 err = nl80211_parse_tx_bitrate_mask(info, &mask);
9018 if (err)
9019 return err;
9020
9021 return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
9022 }
9023
nl80211_register_mgmt(struct sk_buff * skb,struct genl_info * info)9024 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
9025 {
9026 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9027 struct wireless_dev *wdev = info->user_ptr[1];
9028 u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
9029
9030 if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
9031 return -EINVAL;
9032
9033 if (info->attrs[NL80211_ATTR_FRAME_TYPE])
9034 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
9035
9036 switch (wdev->iftype) {
9037 case NL80211_IFTYPE_STATION:
9038 case NL80211_IFTYPE_ADHOC:
9039 case NL80211_IFTYPE_P2P_CLIENT:
9040 case NL80211_IFTYPE_AP:
9041 case NL80211_IFTYPE_AP_VLAN:
9042 case NL80211_IFTYPE_MESH_POINT:
9043 case NL80211_IFTYPE_P2P_GO:
9044 case NL80211_IFTYPE_P2P_DEVICE:
9045 break;
9046 case NL80211_IFTYPE_NAN:
9047 default:
9048 return -EOPNOTSUPP;
9049 }
9050
9051 /* not much point in registering if we can't reply */
9052 if (!rdev->ops->mgmt_tx)
9053 return -EOPNOTSUPP;
9054
9055 return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
9056 nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
9057 nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
9058 }
9059
nl80211_tx_mgmt(struct sk_buff * skb,struct genl_info * info)9060 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
9061 {
9062 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9063 struct wireless_dev *wdev = info->user_ptr[1];
9064 struct cfg80211_chan_def chandef;
9065 int err;
9066 void *hdr = NULL;
9067 u64 cookie;
9068 struct sk_buff *msg = NULL;
9069 struct cfg80211_mgmt_tx_params params = {
9070 .dont_wait_for_ack =
9071 info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
9072 };
9073
9074 if (!info->attrs[NL80211_ATTR_FRAME])
9075 return -EINVAL;
9076
9077 if (!rdev->ops->mgmt_tx)
9078 return -EOPNOTSUPP;
9079
9080 switch (wdev->iftype) {
9081 case NL80211_IFTYPE_P2P_DEVICE:
9082 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
9083 return -EINVAL;
9084 case NL80211_IFTYPE_STATION:
9085 case NL80211_IFTYPE_ADHOC:
9086 case NL80211_IFTYPE_P2P_CLIENT:
9087 case NL80211_IFTYPE_AP:
9088 case NL80211_IFTYPE_AP_VLAN:
9089 case NL80211_IFTYPE_MESH_POINT:
9090 case NL80211_IFTYPE_P2P_GO:
9091 break;
9092 case NL80211_IFTYPE_NAN:
9093 default:
9094 return -EOPNOTSUPP;
9095 }
9096
9097 if (info->attrs[NL80211_ATTR_DURATION]) {
9098 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
9099 return -EINVAL;
9100 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
9101
9102 /*
9103 * We should wait on the channel for at least a minimum amount
9104 * of time (10ms) but no longer than the driver supports.
9105 */
9106 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
9107 params.wait > rdev->wiphy.max_remain_on_channel_duration)
9108 return -EINVAL;
9109 }
9110
9111 params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
9112
9113 if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
9114 return -EINVAL;
9115
9116 params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
9117
9118 /* get the channel if any has been specified, otherwise pass NULL to
9119 * the driver. The latter will use the current one
9120 */
9121 chandef.chan = NULL;
9122 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
9123 err = nl80211_parse_chandef(rdev, info, &chandef);
9124 if (err)
9125 return err;
9126 }
9127
9128 if (!chandef.chan && params.offchan)
9129 return -EINVAL;
9130
9131 params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
9132 params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
9133
9134 if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
9135 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
9136 int i;
9137
9138 if (len % sizeof(u16))
9139 return -EINVAL;
9140
9141 params.n_csa_offsets = len / sizeof(u16);
9142 params.csa_offsets =
9143 nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
9144
9145 /* check that all the offsets fit the frame */
9146 for (i = 0; i < params.n_csa_offsets; i++) {
9147 if (params.csa_offsets[i] >= params.len)
9148 return -EINVAL;
9149 }
9150 }
9151
9152 if (!params.dont_wait_for_ack) {
9153 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9154 if (!msg)
9155 return -ENOMEM;
9156
9157 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9158 NL80211_CMD_FRAME);
9159 if (!hdr) {
9160 err = -ENOBUFS;
9161 goto free_msg;
9162 }
9163 }
9164
9165 params.chan = chandef.chan;
9166 err = cfg80211_mlme_mgmt_tx(rdev, wdev, ¶ms, &cookie);
9167 if (err)
9168 goto free_msg;
9169
9170 if (msg) {
9171 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
9172 NL80211_ATTR_PAD))
9173 goto nla_put_failure;
9174
9175 genlmsg_end(msg, hdr);
9176 return genlmsg_reply(msg, info);
9177 }
9178
9179 return 0;
9180
9181 nla_put_failure:
9182 err = -ENOBUFS;
9183 free_msg:
9184 nlmsg_free(msg);
9185 return err;
9186 }
9187
nl80211_tx_mgmt_cancel_wait(struct sk_buff * skb,struct genl_info * info)9188 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
9189 {
9190 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9191 struct wireless_dev *wdev = info->user_ptr[1];
9192 u64 cookie;
9193
9194 if (!info->attrs[NL80211_ATTR_COOKIE])
9195 return -EINVAL;
9196
9197 if (!rdev->ops->mgmt_tx_cancel_wait)
9198 return -EOPNOTSUPP;
9199
9200 switch (wdev->iftype) {
9201 case NL80211_IFTYPE_STATION:
9202 case NL80211_IFTYPE_ADHOC:
9203 case NL80211_IFTYPE_P2P_CLIENT:
9204 case NL80211_IFTYPE_AP:
9205 case NL80211_IFTYPE_AP_VLAN:
9206 case NL80211_IFTYPE_P2P_GO:
9207 case NL80211_IFTYPE_P2P_DEVICE:
9208 break;
9209 case NL80211_IFTYPE_NAN:
9210 default:
9211 return -EOPNOTSUPP;
9212 }
9213
9214 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
9215
9216 return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
9217 }
9218
nl80211_set_power_save(struct sk_buff * skb,struct genl_info * info)9219 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
9220 {
9221 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9222 struct wireless_dev *wdev;
9223 struct net_device *dev = info->user_ptr[1];
9224 u8 ps_state;
9225 bool state;
9226 int err;
9227
9228 if (!info->attrs[NL80211_ATTR_PS_STATE])
9229 return -EINVAL;
9230
9231 ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
9232
9233 if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
9234 return -EINVAL;
9235
9236 wdev = dev->ieee80211_ptr;
9237
9238 if (!rdev->ops->set_power_mgmt)
9239 return -EOPNOTSUPP;
9240
9241 state = (ps_state == NL80211_PS_ENABLED) ? true : false;
9242
9243 if (state == wdev->ps)
9244 return 0;
9245
9246 err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
9247 if (!err)
9248 wdev->ps = state;
9249 return err;
9250 }
9251
nl80211_get_power_save(struct sk_buff * skb,struct genl_info * info)9252 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
9253 {
9254 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9255 enum nl80211_ps_state ps_state;
9256 struct wireless_dev *wdev;
9257 struct net_device *dev = info->user_ptr[1];
9258 struct sk_buff *msg;
9259 void *hdr;
9260 int err;
9261
9262 wdev = dev->ieee80211_ptr;
9263
9264 if (!rdev->ops->set_power_mgmt)
9265 return -EOPNOTSUPP;
9266
9267 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9268 if (!msg)
9269 return -ENOMEM;
9270
9271 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9272 NL80211_CMD_GET_POWER_SAVE);
9273 if (!hdr) {
9274 err = -ENOBUFS;
9275 goto free_msg;
9276 }
9277
9278 if (wdev->ps)
9279 ps_state = NL80211_PS_ENABLED;
9280 else
9281 ps_state = NL80211_PS_DISABLED;
9282
9283 if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
9284 goto nla_put_failure;
9285
9286 genlmsg_end(msg, hdr);
9287 return genlmsg_reply(msg, info);
9288
9289 nla_put_failure:
9290 err = -ENOBUFS;
9291 free_msg:
9292 nlmsg_free(msg);
9293 return err;
9294 }
9295
9296 static const struct nla_policy
9297 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
9298 [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
9299 [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
9300 [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
9301 [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
9302 [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
9303 [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
9304 };
9305
nl80211_set_cqm_txe(struct genl_info * info,u32 rate,u32 pkts,u32 intvl)9306 static int nl80211_set_cqm_txe(struct genl_info *info,
9307 u32 rate, u32 pkts, u32 intvl)
9308 {
9309 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9310 struct net_device *dev = info->user_ptr[1];
9311 struct wireless_dev *wdev = dev->ieee80211_ptr;
9312
9313 if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
9314 return -EINVAL;
9315
9316 if (!rdev->ops->set_cqm_txe_config)
9317 return -EOPNOTSUPP;
9318
9319 if (wdev->iftype != NL80211_IFTYPE_STATION &&
9320 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
9321 return -EOPNOTSUPP;
9322
9323 return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
9324 }
9325
nl80211_set_cqm_rssi(struct genl_info * info,s32 threshold,u32 hysteresis)9326 static int nl80211_set_cqm_rssi(struct genl_info *info,
9327 s32 threshold, u32 hysteresis)
9328 {
9329 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9330 struct net_device *dev = info->user_ptr[1];
9331 struct wireless_dev *wdev = dev->ieee80211_ptr;
9332
9333 if (threshold > 0)
9334 return -EINVAL;
9335
9336 /* disabling - hysteresis should also be zero then */
9337 if (threshold == 0)
9338 hysteresis = 0;
9339
9340 if (!rdev->ops->set_cqm_rssi_config)
9341 return -EOPNOTSUPP;
9342
9343 if (wdev->iftype != NL80211_IFTYPE_STATION &&
9344 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
9345 return -EOPNOTSUPP;
9346
9347 return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
9348 }
9349
nl80211_set_cqm(struct sk_buff * skb,struct genl_info * info)9350 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
9351 {
9352 struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
9353 struct nlattr *cqm;
9354 int err;
9355
9356 cqm = info->attrs[NL80211_ATTR_CQM];
9357 if (!cqm)
9358 return -EINVAL;
9359
9360 err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
9361 nl80211_attr_cqm_policy);
9362 if (err)
9363 return err;
9364
9365 if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
9366 attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
9367 s32 threshold = nla_get_s32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
9368 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
9369
9370 return nl80211_set_cqm_rssi(info, threshold, hysteresis);
9371 }
9372
9373 if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
9374 attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
9375 attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
9376 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
9377 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
9378 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
9379
9380 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
9381 }
9382
9383 return -EINVAL;
9384 }
9385
nl80211_join_ocb(struct sk_buff * skb,struct genl_info * info)9386 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
9387 {
9388 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9389 struct net_device *dev = info->user_ptr[1];
9390 struct ocb_setup setup = {};
9391 int err;
9392
9393 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
9394 if (err)
9395 return err;
9396
9397 return cfg80211_join_ocb(rdev, dev, &setup);
9398 }
9399
nl80211_leave_ocb(struct sk_buff * skb,struct genl_info * info)9400 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
9401 {
9402 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9403 struct net_device *dev = info->user_ptr[1];
9404
9405 return cfg80211_leave_ocb(rdev, dev);
9406 }
9407
nl80211_join_mesh(struct sk_buff * skb,struct genl_info * info)9408 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
9409 {
9410 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9411 struct net_device *dev = info->user_ptr[1];
9412 struct mesh_config cfg;
9413 struct mesh_setup setup;
9414 int err;
9415
9416 /* start with default */
9417 memcpy(&cfg, &default_mesh_config, sizeof(cfg));
9418 memcpy(&setup, &default_mesh_setup, sizeof(setup));
9419
9420 if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
9421 /* and parse parameters if given */
9422 err = nl80211_parse_mesh_config(info, &cfg, NULL);
9423 if (err)
9424 return err;
9425 }
9426
9427 if (!info->attrs[NL80211_ATTR_MESH_ID] ||
9428 !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
9429 return -EINVAL;
9430
9431 setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
9432 setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
9433
9434 if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
9435 !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
9436 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
9437 return -EINVAL;
9438
9439 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
9440 setup.beacon_interval =
9441 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
9442
9443 err = cfg80211_validate_beacon_int(rdev, setup.beacon_interval);
9444 if (err)
9445 return err;
9446 }
9447
9448 if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
9449 setup.dtim_period =
9450 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
9451 if (setup.dtim_period < 1 || setup.dtim_period > 100)
9452 return -EINVAL;
9453 }
9454
9455 if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
9456 /* parse additional setup parameters if given */
9457 err = nl80211_parse_mesh_setup(info, &setup);
9458 if (err)
9459 return err;
9460 }
9461
9462 if (setup.user_mpm)
9463 cfg.auto_open_plinks = false;
9464
9465 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
9466 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
9467 if (err)
9468 return err;
9469 } else {
9470 /* cfg80211_join_mesh() will sort it out */
9471 setup.chandef.chan = NULL;
9472 }
9473
9474 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
9475 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9476 int n_rates =
9477 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9478 struct ieee80211_supported_band *sband;
9479
9480 if (!setup.chandef.chan)
9481 return -EINVAL;
9482
9483 sband = rdev->wiphy.bands[setup.chandef.chan->band];
9484
9485 err = ieee80211_get_ratemask(sband, rates, n_rates,
9486 &setup.basic_rates);
9487 if (err)
9488 return err;
9489 }
9490
9491 if (info->attrs[NL80211_ATTR_TX_RATES]) {
9492 err = nl80211_parse_tx_bitrate_mask(info, &setup.beacon_rate);
9493 if (err)
9494 return err;
9495
9496 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
9497 &setup.beacon_rate);
9498 if (err)
9499 return err;
9500 }
9501
9502 return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
9503 }
9504
nl80211_leave_mesh(struct sk_buff * skb,struct genl_info * info)9505 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
9506 {
9507 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9508 struct net_device *dev = info->user_ptr[1];
9509
9510 return cfg80211_leave_mesh(rdev, dev);
9511 }
9512
9513 #ifdef CONFIG_PM
nl80211_send_wowlan_patterns(struct sk_buff * msg,struct cfg80211_registered_device * rdev)9514 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
9515 struct cfg80211_registered_device *rdev)
9516 {
9517 struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
9518 struct nlattr *nl_pats, *nl_pat;
9519 int i, pat_len;
9520
9521 if (!wowlan->n_patterns)
9522 return 0;
9523
9524 nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
9525 if (!nl_pats)
9526 return -ENOBUFS;
9527
9528 for (i = 0; i < wowlan->n_patterns; i++) {
9529 nl_pat = nla_nest_start(msg, i + 1);
9530 if (!nl_pat)
9531 return -ENOBUFS;
9532 pat_len = wowlan->patterns[i].pattern_len;
9533 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
9534 wowlan->patterns[i].mask) ||
9535 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
9536 wowlan->patterns[i].pattern) ||
9537 nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
9538 wowlan->patterns[i].pkt_offset))
9539 return -ENOBUFS;
9540 nla_nest_end(msg, nl_pat);
9541 }
9542 nla_nest_end(msg, nl_pats);
9543
9544 return 0;
9545 }
9546
nl80211_send_wowlan_tcp(struct sk_buff * msg,struct cfg80211_wowlan_tcp * tcp)9547 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
9548 struct cfg80211_wowlan_tcp *tcp)
9549 {
9550 struct nlattr *nl_tcp;
9551
9552 if (!tcp)
9553 return 0;
9554
9555 nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
9556 if (!nl_tcp)
9557 return -ENOBUFS;
9558
9559 if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
9560 nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
9561 nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
9562 nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
9563 nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
9564 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
9565 tcp->payload_len, tcp->payload) ||
9566 nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
9567 tcp->data_interval) ||
9568 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
9569 tcp->wake_len, tcp->wake_data) ||
9570 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
9571 DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
9572 return -ENOBUFS;
9573
9574 if (tcp->payload_seq.len &&
9575 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
9576 sizeof(tcp->payload_seq), &tcp->payload_seq))
9577 return -ENOBUFS;
9578
9579 if (tcp->payload_tok.len &&
9580 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
9581 sizeof(tcp->payload_tok) + tcp->tokens_size,
9582 &tcp->payload_tok))
9583 return -ENOBUFS;
9584
9585 nla_nest_end(msg, nl_tcp);
9586
9587 return 0;
9588 }
9589
nl80211_send_wowlan_nd(struct sk_buff * msg,struct cfg80211_sched_scan_request * req)9590 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
9591 struct cfg80211_sched_scan_request *req)
9592 {
9593 struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
9594 int i;
9595
9596 if (!req)
9597 return 0;
9598
9599 nd = nla_nest_start(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
9600 if (!nd)
9601 return -ENOBUFS;
9602
9603 if (req->n_scan_plans == 1 &&
9604 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
9605 req->scan_plans[0].interval * 1000))
9606 return -ENOBUFS;
9607
9608 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
9609 return -ENOBUFS;
9610
9611 freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
9612 if (!freqs)
9613 return -ENOBUFS;
9614
9615 for (i = 0; i < req->n_channels; i++) {
9616 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
9617 return -ENOBUFS;
9618 }
9619
9620 nla_nest_end(msg, freqs);
9621
9622 if (req->n_match_sets) {
9623 matches = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
9624 if (!matches)
9625 return -ENOBUFS;
9626
9627 for (i = 0; i < req->n_match_sets; i++) {
9628 match = nla_nest_start(msg, i);
9629 if (!match)
9630 return -ENOBUFS;
9631
9632 if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
9633 req->match_sets[i].ssid.ssid_len,
9634 req->match_sets[i].ssid.ssid))
9635 return -ENOBUFS;
9636 nla_nest_end(msg, match);
9637 }
9638 nla_nest_end(msg, matches);
9639 }
9640
9641 scan_plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
9642 if (!scan_plans)
9643 return -ENOBUFS;
9644
9645 for (i = 0; i < req->n_scan_plans; i++) {
9646 scan_plan = nla_nest_start(msg, i + 1);
9647 if (!scan_plan)
9648 return -ENOBUFS;
9649
9650 if (!scan_plan ||
9651 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
9652 req->scan_plans[i].interval) ||
9653 (req->scan_plans[i].iterations &&
9654 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
9655 req->scan_plans[i].iterations)))
9656 return -ENOBUFS;
9657 nla_nest_end(msg, scan_plan);
9658 }
9659 nla_nest_end(msg, scan_plans);
9660
9661 nla_nest_end(msg, nd);
9662
9663 return 0;
9664 }
9665
nl80211_get_wowlan(struct sk_buff * skb,struct genl_info * info)9666 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
9667 {
9668 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9669 struct sk_buff *msg;
9670 void *hdr;
9671 u32 size = NLMSG_DEFAULT_SIZE;
9672
9673 if (!rdev->wiphy.wowlan)
9674 return -EOPNOTSUPP;
9675
9676 if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
9677 /* adjust size to have room for all the data */
9678 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
9679 rdev->wiphy.wowlan_config->tcp->payload_len +
9680 rdev->wiphy.wowlan_config->tcp->wake_len +
9681 rdev->wiphy.wowlan_config->tcp->wake_len / 8;
9682 }
9683
9684 msg = nlmsg_new(size, GFP_KERNEL);
9685 if (!msg)
9686 return -ENOMEM;
9687
9688 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9689 NL80211_CMD_GET_WOWLAN);
9690 if (!hdr)
9691 goto nla_put_failure;
9692
9693 if (rdev->wiphy.wowlan_config) {
9694 struct nlattr *nl_wowlan;
9695
9696 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
9697 if (!nl_wowlan)
9698 goto nla_put_failure;
9699
9700 if ((rdev->wiphy.wowlan_config->any &&
9701 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
9702 (rdev->wiphy.wowlan_config->disconnect &&
9703 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
9704 (rdev->wiphy.wowlan_config->magic_pkt &&
9705 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
9706 (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
9707 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
9708 (rdev->wiphy.wowlan_config->eap_identity_req &&
9709 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
9710 (rdev->wiphy.wowlan_config->four_way_handshake &&
9711 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
9712 (rdev->wiphy.wowlan_config->rfkill_release &&
9713 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
9714 goto nla_put_failure;
9715
9716 if (nl80211_send_wowlan_patterns(msg, rdev))
9717 goto nla_put_failure;
9718
9719 if (nl80211_send_wowlan_tcp(msg,
9720 rdev->wiphy.wowlan_config->tcp))
9721 goto nla_put_failure;
9722
9723 if (nl80211_send_wowlan_nd(
9724 msg,
9725 rdev->wiphy.wowlan_config->nd_config))
9726 goto nla_put_failure;
9727
9728 nla_nest_end(msg, nl_wowlan);
9729 }
9730
9731 genlmsg_end(msg, hdr);
9732 return genlmsg_reply(msg, info);
9733
9734 nla_put_failure:
9735 nlmsg_free(msg);
9736 return -ENOBUFS;
9737 }
9738
nl80211_parse_wowlan_tcp(struct cfg80211_registered_device * rdev,struct nlattr * attr,struct cfg80211_wowlan * trig)9739 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
9740 struct nlattr *attr,
9741 struct cfg80211_wowlan *trig)
9742 {
9743 struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
9744 struct cfg80211_wowlan_tcp *cfg;
9745 struct nl80211_wowlan_tcp_data_token *tok = NULL;
9746 struct nl80211_wowlan_tcp_data_seq *seq = NULL;
9747 u32 size;
9748 u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
9749 int err, port;
9750
9751 if (!rdev->wiphy.wowlan->tcp)
9752 return -EINVAL;
9753
9754 err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
9755 nla_data(attr), nla_len(attr),
9756 nl80211_wowlan_tcp_policy);
9757 if (err)
9758 return err;
9759
9760 if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
9761 !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
9762 !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
9763 !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
9764 !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
9765 !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
9766 !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
9767 !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
9768 return -EINVAL;
9769
9770 data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
9771 if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
9772 return -EINVAL;
9773
9774 if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
9775 rdev->wiphy.wowlan->tcp->data_interval_max ||
9776 nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
9777 return -EINVAL;
9778
9779 wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
9780 if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
9781 return -EINVAL;
9782
9783 wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
9784 if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
9785 return -EINVAL;
9786
9787 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
9788 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
9789
9790 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
9791 tokens_size = tokln - sizeof(*tok);
9792
9793 if (!tok->len || tokens_size % tok->len)
9794 return -EINVAL;
9795 if (!rdev->wiphy.wowlan->tcp->tok)
9796 return -EINVAL;
9797 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
9798 return -EINVAL;
9799 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
9800 return -EINVAL;
9801 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
9802 return -EINVAL;
9803 if (tok->offset + tok->len > data_size)
9804 return -EINVAL;
9805 }
9806
9807 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
9808 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
9809 if (!rdev->wiphy.wowlan->tcp->seq)
9810 return -EINVAL;
9811 if (seq->len == 0 || seq->len > 4)
9812 return -EINVAL;
9813 if (seq->len + seq->offset > data_size)
9814 return -EINVAL;
9815 }
9816
9817 size = sizeof(*cfg);
9818 size += data_size;
9819 size += wake_size + wake_mask_size;
9820 size += tokens_size;
9821
9822 cfg = kzalloc(size, GFP_KERNEL);
9823 if (!cfg)
9824 return -ENOMEM;
9825 cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
9826 cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
9827 memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
9828 ETH_ALEN);
9829 if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
9830 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
9831 else
9832 port = 0;
9833 #ifdef CONFIG_INET
9834 /* allocate a socket and port for it and use it */
9835 err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
9836 IPPROTO_TCP, &cfg->sock, 1);
9837 if (err) {
9838 kfree(cfg);
9839 return err;
9840 }
9841 if (inet_csk_get_port(cfg->sock->sk, port)) {
9842 sock_release(cfg->sock);
9843 kfree(cfg);
9844 return -EADDRINUSE;
9845 }
9846 cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
9847 #else
9848 if (!port) {
9849 kfree(cfg);
9850 return -EINVAL;
9851 }
9852 cfg->src_port = port;
9853 #endif
9854
9855 cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
9856 cfg->payload_len = data_size;
9857 cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
9858 memcpy((void *)cfg->payload,
9859 nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
9860 data_size);
9861 if (seq)
9862 cfg->payload_seq = *seq;
9863 cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
9864 cfg->wake_len = wake_size;
9865 cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
9866 memcpy((void *)cfg->wake_data,
9867 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
9868 wake_size);
9869 cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
9870 data_size + wake_size;
9871 memcpy((void *)cfg->wake_mask,
9872 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
9873 wake_mask_size);
9874 if (tok) {
9875 cfg->tokens_size = tokens_size;
9876 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
9877 }
9878
9879 trig->tcp = cfg;
9880
9881 return 0;
9882 }
9883
nl80211_parse_wowlan_nd(struct cfg80211_registered_device * rdev,const struct wiphy_wowlan_support * wowlan,struct nlattr * attr,struct cfg80211_wowlan * trig)9884 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
9885 const struct wiphy_wowlan_support *wowlan,
9886 struct nlattr *attr,
9887 struct cfg80211_wowlan *trig)
9888 {
9889 struct nlattr **tb;
9890 int err;
9891
9892 tb = kzalloc(NUM_NL80211_ATTR * sizeof(*tb), GFP_KERNEL);
9893 if (!tb)
9894 return -ENOMEM;
9895
9896 if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
9897 err = -EOPNOTSUPP;
9898 goto out;
9899 }
9900
9901 err = nla_parse(tb, NL80211_ATTR_MAX,
9902 nla_data(attr), nla_len(attr),
9903 nl80211_policy);
9904 if (err)
9905 goto out;
9906
9907 trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb);
9908 err = PTR_ERR_OR_ZERO(trig->nd_config);
9909 if (err)
9910 trig->nd_config = NULL;
9911
9912 out:
9913 kfree(tb);
9914 return err;
9915 }
9916
nl80211_set_wowlan(struct sk_buff * skb,struct genl_info * info)9917 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
9918 {
9919 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9920 struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
9921 struct cfg80211_wowlan new_triggers = {};
9922 struct cfg80211_wowlan *ntrig;
9923 const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
9924 int err, i;
9925 bool prev_enabled = rdev->wiphy.wowlan_config;
9926 bool regular = false;
9927
9928 if (!wowlan)
9929 return -EOPNOTSUPP;
9930
9931 if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
9932 cfg80211_rdev_free_wowlan(rdev);
9933 rdev->wiphy.wowlan_config = NULL;
9934 goto set_wakeup;
9935 }
9936
9937 err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
9938 nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
9939 nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
9940 nl80211_wowlan_policy);
9941 if (err)
9942 return err;
9943
9944 if (tb[NL80211_WOWLAN_TRIG_ANY]) {
9945 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
9946 return -EINVAL;
9947 new_triggers.any = true;
9948 }
9949
9950 if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
9951 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
9952 return -EINVAL;
9953 new_triggers.disconnect = true;
9954 regular = true;
9955 }
9956
9957 if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
9958 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
9959 return -EINVAL;
9960 new_triggers.magic_pkt = true;
9961 regular = true;
9962 }
9963
9964 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
9965 return -EINVAL;
9966
9967 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
9968 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
9969 return -EINVAL;
9970 new_triggers.gtk_rekey_failure = true;
9971 regular = true;
9972 }
9973
9974 if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
9975 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
9976 return -EINVAL;
9977 new_triggers.eap_identity_req = true;
9978 regular = true;
9979 }
9980
9981 if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
9982 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
9983 return -EINVAL;
9984 new_triggers.four_way_handshake = true;
9985 regular = true;
9986 }
9987
9988 if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
9989 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
9990 return -EINVAL;
9991 new_triggers.rfkill_release = true;
9992 regular = true;
9993 }
9994
9995 if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
9996 struct nlattr *pat;
9997 int n_patterns = 0;
9998 int rem, pat_len, mask_len, pkt_offset;
9999 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
10000
10001 regular = true;
10002
10003 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
10004 rem)
10005 n_patterns++;
10006 if (n_patterns > wowlan->n_patterns)
10007 return -EINVAL;
10008
10009 new_triggers.patterns = kcalloc(n_patterns,
10010 sizeof(new_triggers.patterns[0]),
10011 GFP_KERNEL);
10012 if (!new_triggers.patterns)
10013 return -ENOMEM;
10014
10015 new_triggers.n_patterns = n_patterns;
10016 i = 0;
10017
10018 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
10019 rem) {
10020 u8 *mask_pat;
10021
10022 nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
10023 nla_len(pat), nl80211_packet_pattern_policy);
10024 err = -EINVAL;
10025 if (!pat_tb[NL80211_PKTPAT_MASK] ||
10026 !pat_tb[NL80211_PKTPAT_PATTERN])
10027 goto error;
10028 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
10029 mask_len = DIV_ROUND_UP(pat_len, 8);
10030 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
10031 goto error;
10032 if (pat_len > wowlan->pattern_max_len ||
10033 pat_len < wowlan->pattern_min_len)
10034 goto error;
10035
10036 if (!pat_tb[NL80211_PKTPAT_OFFSET])
10037 pkt_offset = 0;
10038 else
10039 pkt_offset = nla_get_u32(
10040 pat_tb[NL80211_PKTPAT_OFFSET]);
10041 if (pkt_offset > wowlan->max_pkt_offset)
10042 goto error;
10043 new_triggers.patterns[i].pkt_offset = pkt_offset;
10044
10045 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
10046 if (!mask_pat) {
10047 err = -ENOMEM;
10048 goto error;
10049 }
10050 new_triggers.patterns[i].mask = mask_pat;
10051 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
10052 mask_len);
10053 mask_pat += mask_len;
10054 new_triggers.patterns[i].pattern = mask_pat;
10055 new_triggers.patterns[i].pattern_len = pat_len;
10056 memcpy(mask_pat,
10057 nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
10058 pat_len);
10059 i++;
10060 }
10061 }
10062
10063 if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
10064 regular = true;
10065 err = nl80211_parse_wowlan_tcp(
10066 rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
10067 &new_triggers);
10068 if (err)
10069 goto error;
10070 }
10071
10072 if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
10073 regular = true;
10074 err = nl80211_parse_wowlan_nd(
10075 rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
10076 &new_triggers);
10077 if (err)
10078 goto error;
10079 }
10080
10081 /* The 'any' trigger means the device continues operating more or less
10082 * as in its normal operation mode and wakes up the host on most of the
10083 * normal interrupts (like packet RX, ...)
10084 * It therefore makes little sense to combine with the more constrained
10085 * wakeup trigger modes.
10086 */
10087 if (new_triggers.any && regular) {
10088 err = -EINVAL;
10089 goto error;
10090 }
10091
10092 ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
10093 if (!ntrig) {
10094 err = -ENOMEM;
10095 goto error;
10096 }
10097 cfg80211_rdev_free_wowlan(rdev);
10098 rdev->wiphy.wowlan_config = ntrig;
10099
10100 set_wakeup:
10101 if (rdev->ops->set_wakeup &&
10102 prev_enabled != !!rdev->wiphy.wowlan_config)
10103 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
10104
10105 return 0;
10106 error:
10107 for (i = 0; i < new_triggers.n_patterns; i++)
10108 kfree(new_triggers.patterns[i].mask);
10109 kfree(new_triggers.patterns);
10110 if (new_triggers.tcp && new_triggers.tcp->sock)
10111 sock_release(new_triggers.tcp->sock);
10112 kfree(new_triggers.tcp);
10113 kfree(new_triggers.nd_config);
10114 return err;
10115 }
10116 #endif
10117
nl80211_send_coalesce_rules(struct sk_buff * msg,struct cfg80211_registered_device * rdev)10118 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
10119 struct cfg80211_registered_device *rdev)
10120 {
10121 struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
10122 int i, j, pat_len;
10123 struct cfg80211_coalesce_rules *rule;
10124
10125 if (!rdev->coalesce->n_rules)
10126 return 0;
10127
10128 nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
10129 if (!nl_rules)
10130 return -ENOBUFS;
10131
10132 for (i = 0; i < rdev->coalesce->n_rules; i++) {
10133 nl_rule = nla_nest_start(msg, i + 1);
10134 if (!nl_rule)
10135 return -ENOBUFS;
10136
10137 rule = &rdev->coalesce->rules[i];
10138 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
10139 rule->delay))
10140 return -ENOBUFS;
10141
10142 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
10143 rule->condition))
10144 return -ENOBUFS;
10145
10146 nl_pats = nla_nest_start(msg,
10147 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
10148 if (!nl_pats)
10149 return -ENOBUFS;
10150
10151 for (j = 0; j < rule->n_patterns; j++) {
10152 nl_pat = nla_nest_start(msg, j + 1);
10153 if (!nl_pat)
10154 return -ENOBUFS;
10155 pat_len = rule->patterns[j].pattern_len;
10156 if (nla_put(msg, NL80211_PKTPAT_MASK,
10157 DIV_ROUND_UP(pat_len, 8),
10158 rule->patterns[j].mask) ||
10159 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
10160 rule->patterns[j].pattern) ||
10161 nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
10162 rule->patterns[j].pkt_offset))
10163 return -ENOBUFS;
10164 nla_nest_end(msg, nl_pat);
10165 }
10166 nla_nest_end(msg, nl_pats);
10167 nla_nest_end(msg, nl_rule);
10168 }
10169 nla_nest_end(msg, nl_rules);
10170
10171 return 0;
10172 }
10173
nl80211_get_coalesce(struct sk_buff * skb,struct genl_info * info)10174 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
10175 {
10176 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10177 struct sk_buff *msg;
10178 void *hdr;
10179
10180 if (!rdev->wiphy.coalesce)
10181 return -EOPNOTSUPP;
10182
10183 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10184 if (!msg)
10185 return -ENOMEM;
10186
10187 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10188 NL80211_CMD_GET_COALESCE);
10189 if (!hdr)
10190 goto nla_put_failure;
10191
10192 if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
10193 goto nla_put_failure;
10194
10195 genlmsg_end(msg, hdr);
10196 return genlmsg_reply(msg, info);
10197
10198 nla_put_failure:
10199 nlmsg_free(msg);
10200 return -ENOBUFS;
10201 }
10202
cfg80211_rdev_free_coalesce(struct cfg80211_registered_device * rdev)10203 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
10204 {
10205 struct cfg80211_coalesce *coalesce = rdev->coalesce;
10206 int i, j;
10207 struct cfg80211_coalesce_rules *rule;
10208
10209 if (!coalesce)
10210 return;
10211
10212 for (i = 0; i < coalesce->n_rules; i++) {
10213 rule = &coalesce->rules[i];
10214 for (j = 0; j < rule->n_patterns; j++)
10215 kfree(rule->patterns[j].mask);
10216 kfree(rule->patterns);
10217 }
10218 kfree(coalesce->rules);
10219 kfree(coalesce);
10220 rdev->coalesce = NULL;
10221 }
10222
nl80211_parse_coalesce_rule(struct cfg80211_registered_device * rdev,struct nlattr * rule,struct cfg80211_coalesce_rules * new_rule)10223 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
10224 struct nlattr *rule,
10225 struct cfg80211_coalesce_rules *new_rule)
10226 {
10227 int err, i;
10228 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
10229 struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
10230 int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
10231 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
10232
10233 err = nla_parse(tb, NL80211_ATTR_COALESCE_RULE_MAX, nla_data(rule),
10234 nla_len(rule), nl80211_coalesce_policy);
10235 if (err)
10236 return err;
10237
10238 if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
10239 new_rule->delay =
10240 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
10241 if (new_rule->delay > coalesce->max_delay)
10242 return -EINVAL;
10243
10244 if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
10245 new_rule->condition =
10246 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
10247 if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
10248 new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
10249 return -EINVAL;
10250
10251 if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
10252 return -EINVAL;
10253
10254 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
10255 rem)
10256 n_patterns++;
10257 if (n_patterns > coalesce->n_patterns)
10258 return -EINVAL;
10259
10260 new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
10261 GFP_KERNEL);
10262 if (!new_rule->patterns)
10263 return -ENOMEM;
10264
10265 new_rule->n_patterns = n_patterns;
10266 i = 0;
10267
10268 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
10269 rem) {
10270 u8 *mask_pat;
10271
10272 nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
10273 nla_len(pat), nl80211_packet_pattern_policy);
10274 if (!pat_tb[NL80211_PKTPAT_MASK] ||
10275 !pat_tb[NL80211_PKTPAT_PATTERN])
10276 return -EINVAL;
10277 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
10278 mask_len = DIV_ROUND_UP(pat_len, 8);
10279 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
10280 return -EINVAL;
10281 if (pat_len > coalesce->pattern_max_len ||
10282 pat_len < coalesce->pattern_min_len)
10283 return -EINVAL;
10284
10285 if (!pat_tb[NL80211_PKTPAT_OFFSET])
10286 pkt_offset = 0;
10287 else
10288 pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
10289 if (pkt_offset > coalesce->max_pkt_offset)
10290 return -EINVAL;
10291 new_rule->patterns[i].pkt_offset = pkt_offset;
10292
10293 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
10294 if (!mask_pat)
10295 return -ENOMEM;
10296
10297 new_rule->patterns[i].mask = mask_pat;
10298 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
10299 mask_len);
10300
10301 mask_pat += mask_len;
10302 new_rule->patterns[i].pattern = mask_pat;
10303 new_rule->patterns[i].pattern_len = pat_len;
10304 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
10305 pat_len);
10306 i++;
10307 }
10308
10309 return 0;
10310 }
10311
nl80211_set_coalesce(struct sk_buff * skb,struct genl_info * info)10312 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
10313 {
10314 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10315 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
10316 struct cfg80211_coalesce new_coalesce = {};
10317 struct cfg80211_coalesce *n_coalesce;
10318 int err, rem_rule, n_rules = 0, i, j;
10319 struct nlattr *rule;
10320 struct cfg80211_coalesce_rules *tmp_rule;
10321
10322 if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
10323 return -EOPNOTSUPP;
10324
10325 if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
10326 cfg80211_rdev_free_coalesce(rdev);
10327 rdev_set_coalesce(rdev, NULL);
10328 return 0;
10329 }
10330
10331 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
10332 rem_rule)
10333 n_rules++;
10334 if (n_rules > coalesce->n_rules)
10335 return -EINVAL;
10336
10337 new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
10338 GFP_KERNEL);
10339 if (!new_coalesce.rules)
10340 return -ENOMEM;
10341
10342 new_coalesce.n_rules = n_rules;
10343 i = 0;
10344
10345 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
10346 rem_rule) {
10347 err = nl80211_parse_coalesce_rule(rdev, rule,
10348 &new_coalesce.rules[i]);
10349 if (err)
10350 goto error;
10351
10352 i++;
10353 }
10354
10355 err = rdev_set_coalesce(rdev, &new_coalesce);
10356 if (err)
10357 goto error;
10358
10359 n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
10360 if (!n_coalesce) {
10361 err = -ENOMEM;
10362 goto error;
10363 }
10364 cfg80211_rdev_free_coalesce(rdev);
10365 rdev->coalesce = n_coalesce;
10366
10367 return 0;
10368 error:
10369 for (i = 0; i < new_coalesce.n_rules; i++) {
10370 tmp_rule = &new_coalesce.rules[i];
10371 for (j = 0; j < tmp_rule->n_patterns; j++)
10372 kfree(tmp_rule->patterns[j].mask);
10373 kfree(tmp_rule->patterns);
10374 }
10375 kfree(new_coalesce.rules);
10376
10377 return err;
10378 }
10379
nl80211_set_rekey_data(struct sk_buff * skb,struct genl_info * info)10380 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
10381 {
10382 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10383 struct net_device *dev = info->user_ptr[1];
10384 struct wireless_dev *wdev = dev->ieee80211_ptr;
10385 struct nlattr *tb[NUM_NL80211_REKEY_DATA];
10386 struct cfg80211_gtk_rekey_data rekey_data;
10387 int err;
10388
10389 if (!info->attrs[NL80211_ATTR_REKEY_DATA])
10390 return -EINVAL;
10391
10392 err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
10393 nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
10394 nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
10395 nl80211_rekey_policy);
10396 if (err)
10397 return err;
10398
10399 if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
10400 !tb[NL80211_REKEY_DATA_KCK])
10401 return -EINVAL;
10402 if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
10403 return -ERANGE;
10404 if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
10405 return -ERANGE;
10406 if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
10407 return -ERANGE;
10408
10409 rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
10410 rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
10411 rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
10412
10413 wdev_lock(wdev);
10414 if (!wdev->current_bss) {
10415 err = -ENOTCONN;
10416 goto out;
10417 }
10418
10419 if (!rdev->ops->set_rekey_data) {
10420 err = -EOPNOTSUPP;
10421 goto out;
10422 }
10423
10424 err = rdev_set_rekey_data(rdev, dev, &rekey_data);
10425 out:
10426 wdev_unlock(wdev);
10427 return err;
10428 }
10429
nl80211_register_unexpected_frame(struct sk_buff * skb,struct genl_info * info)10430 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
10431 struct genl_info *info)
10432 {
10433 struct net_device *dev = info->user_ptr[1];
10434 struct wireless_dev *wdev = dev->ieee80211_ptr;
10435
10436 if (wdev->iftype != NL80211_IFTYPE_AP &&
10437 wdev->iftype != NL80211_IFTYPE_P2P_GO)
10438 return -EINVAL;
10439
10440 if (wdev->ap_unexpected_nlportid)
10441 return -EBUSY;
10442
10443 wdev->ap_unexpected_nlportid = info->snd_portid;
10444 return 0;
10445 }
10446
nl80211_probe_client(struct sk_buff * skb,struct genl_info * info)10447 static int nl80211_probe_client(struct sk_buff *skb,
10448 struct genl_info *info)
10449 {
10450 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10451 struct net_device *dev = info->user_ptr[1];
10452 struct wireless_dev *wdev = dev->ieee80211_ptr;
10453 struct sk_buff *msg;
10454 void *hdr;
10455 const u8 *addr;
10456 u64 cookie;
10457 int err;
10458
10459 if (wdev->iftype != NL80211_IFTYPE_AP &&
10460 wdev->iftype != NL80211_IFTYPE_P2P_GO)
10461 return -EOPNOTSUPP;
10462
10463 if (!info->attrs[NL80211_ATTR_MAC])
10464 return -EINVAL;
10465
10466 if (!rdev->ops->probe_client)
10467 return -EOPNOTSUPP;
10468
10469 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10470 if (!msg)
10471 return -ENOMEM;
10472
10473 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10474 NL80211_CMD_PROBE_CLIENT);
10475 if (!hdr) {
10476 err = -ENOBUFS;
10477 goto free_msg;
10478 }
10479
10480 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
10481
10482 err = rdev_probe_client(rdev, dev, addr, &cookie);
10483 if (err)
10484 goto free_msg;
10485
10486 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
10487 NL80211_ATTR_PAD))
10488 goto nla_put_failure;
10489
10490 genlmsg_end(msg, hdr);
10491
10492 return genlmsg_reply(msg, info);
10493
10494 nla_put_failure:
10495 err = -ENOBUFS;
10496 free_msg:
10497 nlmsg_free(msg);
10498 return err;
10499 }
10500
nl80211_register_beacons(struct sk_buff * skb,struct genl_info * info)10501 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
10502 {
10503 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10504 struct cfg80211_beacon_registration *reg, *nreg;
10505 int rv;
10506
10507 if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
10508 return -EOPNOTSUPP;
10509
10510 nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
10511 if (!nreg)
10512 return -ENOMEM;
10513
10514 /* First, check if already registered. */
10515 spin_lock_bh(&rdev->beacon_registrations_lock);
10516 list_for_each_entry(reg, &rdev->beacon_registrations, list) {
10517 if (reg->nlportid == info->snd_portid) {
10518 rv = -EALREADY;
10519 goto out_err;
10520 }
10521 }
10522 /* Add it to the list */
10523 nreg->nlportid = info->snd_portid;
10524 list_add(&nreg->list, &rdev->beacon_registrations);
10525
10526 spin_unlock_bh(&rdev->beacon_registrations_lock);
10527
10528 return 0;
10529 out_err:
10530 spin_unlock_bh(&rdev->beacon_registrations_lock);
10531 kfree(nreg);
10532 return rv;
10533 }
10534
nl80211_start_p2p_device(struct sk_buff * skb,struct genl_info * info)10535 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
10536 {
10537 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10538 struct wireless_dev *wdev = info->user_ptr[1];
10539 int err;
10540
10541 if (!rdev->ops->start_p2p_device)
10542 return -EOPNOTSUPP;
10543
10544 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
10545 return -EOPNOTSUPP;
10546
10547 if (wdev->p2p_started)
10548 return 0;
10549
10550 if (rfkill_blocked(rdev->rfkill))
10551 return -ERFKILL;
10552
10553 err = rdev_start_p2p_device(rdev, wdev);
10554 if (err)
10555 return err;
10556
10557 wdev->p2p_started = true;
10558 rdev->opencount++;
10559
10560 return 0;
10561 }
10562
nl80211_stop_p2p_device(struct sk_buff * skb,struct genl_info * info)10563 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
10564 {
10565 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10566 struct wireless_dev *wdev = info->user_ptr[1];
10567
10568 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
10569 return -EOPNOTSUPP;
10570
10571 if (!rdev->ops->stop_p2p_device)
10572 return -EOPNOTSUPP;
10573
10574 cfg80211_stop_p2p_device(rdev, wdev);
10575
10576 return 0;
10577 }
10578
nl80211_start_nan(struct sk_buff * skb,struct genl_info * info)10579 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
10580 {
10581 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10582 struct wireless_dev *wdev = info->user_ptr[1];
10583 struct cfg80211_nan_conf conf = {};
10584 int err;
10585
10586 if (wdev->iftype != NL80211_IFTYPE_NAN)
10587 return -EOPNOTSUPP;
10588
10589 if (wdev->nan_started)
10590 return -EEXIST;
10591
10592 if (rfkill_blocked(rdev->rfkill))
10593 return -ERFKILL;
10594
10595 if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
10596 return -EINVAL;
10597
10598 if (!info->attrs[NL80211_ATTR_NAN_DUAL])
10599 return -EINVAL;
10600
10601 conf.master_pref =
10602 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
10603 if (!conf.master_pref)
10604 return -EINVAL;
10605
10606 conf.dual = nla_get_u8(info->attrs[NL80211_ATTR_NAN_DUAL]);
10607
10608 err = rdev_start_nan(rdev, wdev, &conf);
10609 if (err)
10610 return err;
10611
10612 wdev->nan_started = true;
10613 rdev->opencount++;
10614
10615 return 0;
10616 }
10617
nl80211_stop_nan(struct sk_buff * skb,struct genl_info * info)10618 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
10619 {
10620 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10621 struct wireless_dev *wdev = info->user_ptr[1];
10622
10623 if (wdev->iftype != NL80211_IFTYPE_NAN)
10624 return -EOPNOTSUPP;
10625
10626 cfg80211_stop_nan(rdev, wdev);
10627
10628 return 0;
10629 }
10630
validate_nan_filter(struct nlattr * filter_attr)10631 static int validate_nan_filter(struct nlattr *filter_attr)
10632 {
10633 struct nlattr *attr;
10634 int len = 0, n_entries = 0, rem;
10635
10636 nla_for_each_nested(attr, filter_attr, rem) {
10637 len += nla_len(attr);
10638 n_entries++;
10639 }
10640
10641 if (len >= U8_MAX)
10642 return -EINVAL;
10643
10644 return n_entries;
10645 }
10646
handle_nan_filter(struct nlattr * attr_filter,struct cfg80211_nan_func * func,bool tx)10647 static int handle_nan_filter(struct nlattr *attr_filter,
10648 struct cfg80211_nan_func *func,
10649 bool tx)
10650 {
10651 struct nlattr *attr;
10652 int n_entries, rem, i;
10653 struct cfg80211_nan_func_filter *filter;
10654
10655 n_entries = validate_nan_filter(attr_filter);
10656 if (n_entries < 0)
10657 return n_entries;
10658
10659 BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
10660
10661 filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
10662 if (!filter)
10663 return -ENOMEM;
10664
10665 i = 0;
10666 nla_for_each_nested(attr, attr_filter, rem) {
10667 filter[i].filter = kmemdup(nla_data(attr), nla_len(attr),
10668 GFP_KERNEL);
10669 filter[i].len = nla_len(attr);
10670 i++;
10671 }
10672 if (tx) {
10673 func->num_tx_filters = n_entries;
10674 func->tx_filters = filter;
10675 } else {
10676 func->num_rx_filters = n_entries;
10677 func->rx_filters = filter;
10678 }
10679
10680 return 0;
10681 }
10682
nl80211_nan_add_func(struct sk_buff * skb,struct genl_info * info)10683 static int nl80211_nan_add_func(struct sk_buff *skb,
10684 struct genl_info *info)
10685 {
10686 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10687 struct wireless_dev *wdev = info->user_ptr[1];
10688 struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
10689 struct cfg80211_nan_func *func;
10690 struct sk_buff *msg = NULL;
10691 void *hdr = NULL;
10692 int err = 0;
10693
10694 if (wdev->iftype != NL80211_IFTYPE_NAN)
10695 return -EOPNOTSUPP;
10696
10697 if (!wdev->nan_started)
10698 return -ENOTCONN;
10699
10700 if (!info->attrs[NL80211_ATTR_NAN_FUNC])
10701 return -EINVAL;
10702
10703 if (wdev->owner_nlportid &&
10704 wdev->owner_nlportid != info->snd_portid)
10705 return -ENOTCONN;
10706
10707 err = nla_parse(tb, NL80211_NAN_FUNC_ATTR_MAX,
10708 nla_data(info->attrs[NL80211_ATTR_NAN_FUNC]),
10709 nla_len(info->attrs[NL80211_ATTR_NAN_FUNC]),
10710 nl80211_nan_func_policy);
10711 if (err)
10712 return err;
10713
10714 func = kzalloc(sizeof(*func), GFP_KERNEL);
10715 if (!func)
10716 return -ENOMEM;
10717
10718 func->cookie = wdev->wiphy->cookie_counter++;
10719
10720 if (!tb[NL80211_NAN_FUNC_TYPE] ||
10721 nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]) > NL80211_NAN_FUNC_MAX_TYPE) {
10722 err = -EINVAL;
10723 goto out;
10724 }
10725
10726
10727 func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
10728
10729 if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
10730 err = -EINVAL;
10731 goto out;
10732 }
10733
10734 memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
10735 sizeof(func->service_id));
10736
10737 func->close_range =
10738 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
10739
10740 if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
10741 func->serv_spec_info_len =
10742 nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
10743 func->serv_spec_info =
10744 kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
10745 func->serv_spec_info_len,
10746 GFP_KERNEL);
10747 if (!func->serv_spec_info) {
10748 err = -ENOMEM;
10749 goto out;
10750 }
10751 }
10752
10753 if (tb[NL80211_NAN_FUNC_TTL])
10754 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
10755
10756 switch (func->type) {
10757 case NL80211_NAN_FUNC_PUBLISH:
10758 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
10759 err = -EINVAL;
10760 goto out;
10761 }
10762
10763 func->publish_type =
10764 nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
10765 func->publish_bcast =
10766 nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
10767
10768 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
10769 func->publish_bcast) {
10770 err = -EINVAL;
10771 goto out;
10772 }
10773 break;
10774 case NL80211_NAN_FUNC_SUBSCRIBE:
10775 func->subscribe_active =
10776 nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
10777 break;
10778 case NL80211_NAN_FUNC_FOLLOW_UP:
10779 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
10780 !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
10781 !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
10782 err = -EINVAL;
10783 goto out;
10784 }
10785
10786 func->followup_id =
10787 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
10788 func->followup_reqid =
10789 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
10790 memcpy(func->followup_dest.addr,
10791 nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
10792 sizeof(func->followup_dest.addr));
10793 if (func->ttl) {
10794 err = -EINVAL;
10795 goto out;
10796 }
10797 break;
10798 default:
10799 err = -EINVAL;
10800 goto out;
10801 }
10802
10803 if (tb[NL80211_NAN_FUNC_SRF]) {
10804 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
10805
10806 err = nla_parse(srf_tb, NL80211_NAN_SRF_ATTR_MAX,
10807 nla_data(tb[NL80211_NAN_FUNC_SRF]),
10808 nla_len(tb[NL80211_NAN_FUNC_SRF]), NULL);
10809 if (err)
10810 goto out;
10811
10812 func->srf_include =
10813 nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
10814
10815 if (srf_tb[NL80211_NAN_SRF_BF]) {
10816 if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
10817 !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
10818 err = -EINVAL;
10819 goto out;
10820 }
10821
10822 func->srf_bf_len =
10823 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
10824 func->srf_bf =
10825 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
10826 func->srf_bf_len, GFP_KERNEL);
10827 if (!func->srf_bf) {
10828 err = -ENOMEM;
10829 goto out;
10830 }
10831
10832 func->srf_bf_idx =
10833 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
10834 } else {
10835 struct nlattr *attr, *mac_attr =
10836 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
10837 int n_entries, rem, i = 0;
10838
10839 if (!mac_attr) {
10840 err = -EINVAL;
10841 goto out;
10842 }
10843
10844 n_entries = validate_acl_mac_addrs(mac_attr);
10845 if (n_entries <= 0) {
10846 err = -EINVAL;
10847 goto out;
10848 }
10849
10850 func->srf_num_macs = n_entries;
10851 func->srf_macs =
10852 kzalloc(sizeof(*func->srf_macs) * n_entries,
10853 GFP_KERNEL);
10854 if (!func->srf_macs) {
10855 err = -ENOMEM;
10856 goto out;
10857 }
10858
10859 nla_for_each_nested(attr, mac_attr, rem)
10860 memcpy(func->srf_macs[i++].addr, nla_data(attr),
10861 sizeof(*func->srf_macs));
10862 }
10863 }
10864
10865 if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
10866 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
10867 func, true);
10868 if (err)
10869 goto out;
10870 }
10871
10872 if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
10873 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
10874 func, false);
10875 if (err)
10876 goto out;
10877 }
10878
10879 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10880 if (!msg) {
10881 err = -ENOMEM;
10882 goto out;
10883 }
10884
10885 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10886 NL80211_CMD_ADD_NAN_FUNCTION);
10887 /* This can't really happen - we just allocated 4KB */
10888 if (WARN_ON(!hdr)) {
10889 err = -ENOMEM;
10890 goto out;
10891 }
10892
10893 err = rdev_add_nan_func(rdev, wdev, func);
10894 out:
10895 if (err < 0) {
10896 cfg80211_free_nan_func(func);
10897 nlmsg_free(msg);
10898 return err;
10899 }
10900
10901 /* propagate the instance id and cookie to userspace */
10902 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
10903 NL80211_ATTR_PAD))
10904 goto nla_put_failure;
10905
10906 func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC);
10907 if (!func_attr)
10908 goto nla_put_failure;
10909
10910 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
10911 func->instance_id))
10912 goto nla_put_failure;
10913
10914 nla_nest_end(msg, func_attr);
10915
10916 genlmsg_end(msg, hdr);
10917 return genlmsg_reply(msg, info);
10918
10919 nla_put_failure:
10920 nlmsg_free(msg);
10921 return -ENOBUFS;
10922 }
10923
nl80211_nan_del_func(struct sk_buff * skb,struct genl_info * info)10924 static int nl80211_nan_del_func(struct sk_buff *skb,
10925 struct genl_info *info)
10926 {
10927 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10928 struct wireless_dev *wdev = info->user_ptr[1];
10929 u64 cookie;
10930
10931 if (wdev->iftype != NL80211_IFTYPE_NAN)
10932 return -EOPNOTSUPP;
10933
10934 if (!wdev->nan_started)
10935 return -ENOTCONN;
10936
10937 if (!info->attrs[NL80211_ATTR_COOKIE])
10938 return -EINVAL;
10939
10940 if (wdev->owner_nlportid &&
10941 wdev->owner_nlportid != info->snd_portid)
10942 return -ENOTCONN;
10943
10944 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
10945
10946 rdev_del_nan_func(rdev, wdev, cookie);
10947
10948 return 0;
10949 }
10950
nl80211_nan_change_config(struct sk_buff * skb,struct genl_info * info)10951 static int nl80211_nan_change_config(struct sk_buff *skb,
10952 struct genl_info *info)
10953 {
10954 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10955 struct wireless_dev *wdev = info->user_ptr[1];
10956 struct cfg80211_nan_conf conf = {};
10957 u32 changed = 0;
10958
10959 if (wdev->iftype != NL80211_IFTYPE_NAN)
10960 return -EOPNOTSUPP;
10961
10962 if (!wdev->nan_started)
10963 return -ENOTCONN;
10964
10965 if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
10966 conf.master_pref =
10967 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
10968 if (conf.master_pref <= 1 || conf.master_pref == 255)
10969 return -EINVAL;
10970
10971 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
10972 }
10973
10974 if (info->attrs[NL80211_ATTR_NAN_DUAL]) {
10975 conf.dual = nla_get_u8(info->attrs[NL80211_ATTR_NAN_DUAL]);
10976 changed |= CFG80211_NAN_CONF_CHANGED_DUAL;
10977 }
10978
10979 if (!changed)
10980 return -EINVAL;
10981
10982 return rdev_nan_change_conf(rdev, wdev, &conf, changed);
10983 }
10984
cfg80211_nan_match(struct wireless_dev * wdev,struct cfg80211_nan_match_params * match,gfp_t gfp)10985 void cfg80211_nan_match(struct wireless_dev *wdev,
10986 struct cfg80211_nan_match_params *match, gfp_t gfp)
10987 {
10988 struct wiphy *wiphy = wdev->wiphy;
10989 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10990 struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
10991 struct sk_buff *msg;
10992 void *hdr;
10993
10994 if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
10995 return;
10996
10997 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10998 if (!msg)
10999 return;
11000
11001 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
11002 if (!hdr) {
11003 nlmsg_free(msg);
11004 return;
11005 }
11006
11007 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11008 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11009 wdev->netdev->ifindex)) ||
11010 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
11011 NL80211_ATTR_PAD))
11012 goto nla_put_failure;
11013
11014 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
11015 NL80211_ATTR_PAD) ||
11016 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
11017 goto nla_put_failure;
11018
11019 match_attr = nla_nest_start(msg, NL80211_ATTR_NAN_MATCH);
11020 if (!match_attr)
11021 goto nla_put_failure;
11022
11023 local_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_LOCAL);
11024 if (!local_func_attr)
11025 goto nla_put_failure;
11026
11027 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
11028 goto nla_put_failure;
11029
11030 nla_nest_end(msg, local_func_attr);
11031
11032 peer_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_PEER);
11033 if (!peer_func_attr)
11034 goto nla_put_failure;
11035
11036 if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
11037 nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
11038 goto nla_put_failure;
11039
11040 if (match->info && match->info_len &&
11041 nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
11042 match->info))
11043 goto nla_put_failure;
11044
11045 nla_nest_end(msg, peer_func_attr);
11046 nla_nest_end(msg, match_attr);
11047 genlmsg_end(msg, hdr);
11048
11049 if (!wdev->owner_nlportid)
11050 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
11051 msg, 0, NL80211_MCGRP_NAN, gfp);
11052 else
11053 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
11054 wdev->owner_nlportid);
11055
11056 return;
11057
11058 nla_put_failure:
11059 nlmsg_free(msg);
11060 }
11061 EXPORT_SYMBOL(cfg80211_nan_match);
11062
cfg80211_nan_func_terminated(struct wireless_dev * wdev,u8 inst_id,enum nl80211_nan_func_term_reason reason,u64 cookie,gfp_t gfp)11063 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
11064 u8 inst_id,
11065 enum nl80211_nan_func_term_reason reason,
11066 u64 cookie, gfp_t gfp)
11067 {
11068 struct wiphy *wiphy = wdev->wiphy;
11069 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11070 struct sk_buff *msg;
11071 struct nlattr *func_attr;
11072 void *hdr;
11073
11074 if (WARN_ON(!inst_id))
11075 return;
11076
11077 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11078 if (!msg)
11079 return;
11080
11081 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
11082 if (!hdr) {
11083 nlmsg_free(msg);
11084 return;
11085 }
11086
11087 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11088 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11089 wdev->netdev->ifindex)) ||
11090 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
11091 NL80211_ATTR_PAD))
11092 goto nla_put_failure;
11093
11094 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11095 NL80211_ATTR_PAD))
11096 goto nla_put_failure;
11097
11098 func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC);
11099 if (!func_attr)
11100 goto nla_put_failure;
11101
11102 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
11103 nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
11104 goto nla_put_failure;
11105
11106 nla_nest_end(msg, func_attr);
11107 genlmsg_end(msg, hdr);
11108
11109 if (!wdev->owner_nlportid)
11110 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
11111 msg, 0, NL80211_MCGRP_NAN, gfp);
11112 else
11113 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
11114 wdev->owner_nlportid);
11115
11116 return;
11117
11118 nla_put_failure:
11119 nlmsg_free(msg);
11120 }
11121 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
11122
nl80211_get_protocol_features(struct sk_buff * skb,struct genl_info * info)11123 static int nl80211_get_protocol_features(struct sk_buff *skb,
11124 struct genl_info *info)
11125 {
11126 void *hdr;
11127 struct sk_buff *msg;
11128
11129 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11130 if (!msg)
11131 return -ENOMEM;
11132
11133 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11134 NL80211_CMD_GET_PROTOCOL_FEATURES);
11135 if (!hdr)
11136 goto nla_put_failure;
11137
11138 if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
11139 NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
11140 goto nla_put_failure;
11141
11142 genlmsg_end(msg, hdr);
11143 return genlmsg_reply(msg, info);
11144
11145 nla_put_failure:
11146 kfree_skb(msg);
11147 return -ENOBUFS;
11148 }
11149
nl80211_update_ft_ies(struct sk_buff * skb,struct genl_info * info)11150 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
11151 {
11152 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11153 struct cfg80211_update_ft_ies_params ft_params;
11154 struct net_device *dev = info->user_ptr[1];
11155
11156 if (!rdev->ops->update_ft_ies)
11157 return -EOPNOTSUPP;
11158
11159 if (!info->attrs[NL80211_ATTR_MDID] ||
11160 !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
11161 return -EINVAL;
11162
11163 memset(&ft_params, 0, sizeof(ft_params));
11164 ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
11165 ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11166 ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11167
11168 return rdev_update_ft_ies(rdev, dev, &ft_params);
11169 }
11170
nl80211_crit_protocol_start(struct sk_buff * skb,struct genl_info * info)11171 static int nl80211_crit_protocol_start(struct sk_buff *skb,
11172 struct genl_info *info)
11173 {
11174 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11175 struct wireless_dev *wdev = info->user_ptr[1];
11176 enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
11177 u16 duration;
11178 int ret;
11179
11180 if (!rdev->ops->crit_proto_start)
11181 return -EOPNOTSUPP;
11182
11183 if (WARN_ON(!rdev->ops->crit_proto_stop))
11184 return -EINVAL;
11185
11186 if (rdev->crit_proto_nlportid)
11187 return -EBUSY;
11188
11189 /* determine protocol if provided */
11190 if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
11191 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
11192
11193 if (proto >= NUM_NL80211_CRIT_PROTO)
11194 return -EINVAL;
11195
11196 /* timeout must be provided */
11197 if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
11198 return -EINVAL;
11199
11200 duration =
11201 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
11202
11203 if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
11204 return -ERANGE;
11205
11206 ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
11207 if (!ret)
11208 rdev->crit_proto_nlportid = info->snd_portid;
11209
11210 return ret;
11211 }
11212
nl80211_crit_protocol_stop(struct sk_buff * skb,struct genl_info * info)11213 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
11214 struct genl_info *info)
11215 {
11216 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11217 struct wireless_dev *wdev = info->user_ptr[1];
11218
11219 if (!rdev->ops->crit_proto_stop)
11220 return -EOPNOTSUPP;
11221
11222 if (rdev->crit_proto_nlportid) {
11223 rdev->crit_proto_nlportid = 0;
11224 rdev_crit_proto_stop(rdev, wdev);
11225 }
11226 return 0;
11227 }
11228
nl80211_vendor_cmd(struct sk_buff * skb,struct genl_info * info)11229 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
11230 {
11231 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11232 struct wireless_dev *wdev =
11233 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
11234 int i, err;
11235 u32 vid, subcmd;
11236
11237 if (!rdev->wiphy.vendor_commands)
11238 return -EOPNOTSUPP;
11239
11240 if (IS_ERR(wdev)) {
11241 err = PTR_ERR(wdev);
11242 if (err != -EINVAL)
11243 return err;
11244 wdev = NULL;
11245 } else if (wdev->wiphy != &rdev->wiphy) {
11246 return -EINVAL;
11247 }
11248
11249 if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
11250 !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
11251 return -EINVAL;
11252
11253 vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
11254 subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
11255 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
11256 const struct wiphy_vendor_command *vcmd;
11257 void *data = NULL;
11258 int len = 0;
11259
11260 vcmd = &rdev->wiphy.vendor_commands[i];
11261
11262 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
11263 continue;
11264
11265 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
11266 WIPHY_VENDOR_CMD_NEED_NETDEV)) {
11267 if (!wdev)
11268 return -EINVAL;
11269 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
11270 !wdev->netdev)
11271 return -EINVAL;
11272
11273 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
11274 if (wdev->netdev &&
11275 !netif_running(wdev->netdev))
11276 return -ENETDOWN;
11277 if (!wdev->netdev && !wdev->p2p_started)
11278 return -ENETDOWN;
11279 }
11280
11281 if (!vcmd->doit)
11282 return -EOPNOTSUPP;
11283 } else {
11284 wdev = NULL;
11285 }
11286
11287 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
11288 data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
11289 len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
11290 }
11291
11292 rdev->cur_cmd_info = info;
11293 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
11294 data, len);
11295 rdev->cur_cmd_info = NULL;
11296 return err;
11297 }
11298
11299 return -EOPNOTSUPP;
11300 }
11301
nl80211_prepare_vendor_dump(struct sk_buff * skb,struct netlink_callback * cb,struct cfg80211_registered_device ** rdev,struct wireless_dev ** wdev)11302 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
11303 struct netlink_callback *cb,
11304 struct cfg80211_registered_device **rdev,
11305 struct wireless_dev **wdev)
11306 {
11307 u32 vid, subcmd;
11308 unsigned int i;
11309 int vcmd_idx = -1;
11310 int err;
11311 void *data = NULL;
11312 unsigned int data_len = 0;
11313
11314 if (cb->args[0]) {
11315 /* subtract the 1 again here */
11316 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
11317 struct wireless_dev *tmp;
11318
11319 if (!wiphy)
11320 return -ENODEV;
11321 *rdev = wiphy_to_rdev(wiphy);
11322 *wdev = NULL;
11323
11324 if (cb->args[1]) {
11325 list_for_each_entry(tmp, &wiphy->wdev_list, list) {
11326 if (tmp->identifier == cb->args[1] - 1) {
11327 *wdev = tmp;
11328 break;
11329 }
11330 }
11331 }
11332
11333 /* keep rtnl locked in successful case */
11334 return 0;
11335 }
11336
11337 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
11338 nl80211_fam.attrbuf, nl80211_fam.maxattr,
11339 nl80211_policy);
11340 if (err)
11341 return err;
11342
11343 if (!nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_ID] ||
11344 !nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_SUBCMD])
11345 return -EINVAL;
11346
11347 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
11348 nl80211_fam.attrbuf);
11349 if (IS_ERR(*wdev))
11350 *wdev = NULL;
11351
11352 *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
11353 nl80211_fam.attrbuf);
11354 if (IS_ERR(*rdev))
11355 return PTR_ERR(*rdev);
11356
11357 vid = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_ID]);
11358 subcmd = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
11359
11360 for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
11361 const struct wiphy_vendor_command *vcmd;
11362
11363 vcmd = &(*rdev)->wiphy.vendor_commands[i];
11364
11365 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
11366 continue;
11367
11368 if (!vcmd->dumpit)
11369 return -EOPNOTSUPP;
11370
11371 vcmd_idx = i;
11372 break;
11373 }
11374
11375 if (vcmd_idx < 0)
11376 return -EOPNOTSUPP;
11377
11378 if (nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_DATA]) {
11379 data = nla_data(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_DATA]);
11380 data_len = nla_len(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_DATA]);
11381 }
11382
11383 /* 0 is the first index - add 1 to parse only once */
11384 cb->args[0] = (*rdev)->wiphy_idx + 1;
11385 /* add 1 to know if it was NULL */
11386 cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
11387 cb->args[2] = vcmd_idx;
11388 cb->args[3] = (unsigned long)data;
11389 cb->args[4] = data_len;
11390
11391 /* keep rtnl locked in successful case */
11392 return 0;
11393 }
11394
nl80211_vendor_cmd_dump(struct sk_buff * skb,struct netlink_callback * cb)11395 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
11396 struct netlink_callback *cb)
11397 {
11398 struct cfg80211_registered_device *rdev;
11399 struct wireless_dev *wdev;
11400 unsigned int vcmd_idx;
11401 const struct wiphy_vendor_command *vcmd;
11402 void *data;
11403 int data_len;
11404 int err;
11405 struct nlattr *vendor_data;
11406
11407 rtnl_lock();
11408 err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
11409 if (err)
11410 goto out;
11411
11412 vcmd_idx = cb->args[2];
11413 data = (void *)cb->args[3];
11414 data_len = cb->args[4];
11415 vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
11416
11417 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
11418 WIPHY_VENDOR_CMD_NEED_NETDEV)) {
11419 if (!wdev) {
11420 err = -EINVAL;
11421 goto out;
11422 }
11423 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
11424 !wdev->netdev) {
11425 err = -EINVAL;
11426 goto out;
11427 }
11428
11429 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
11430 if (wdev->netdev &&
11431 !netif_running(wdev->netdev)) {
11432 err = -ENETDOWN;
11433 goto out;
11434 }
11435 if (!wdev->netdev && !wdev->p2p_started) {
11436 err = -ENETDOWN;
11437 goto out;
11438 }
11439 }
11440 }
11441
11442 while (1) {
11443 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
11444 cb->nlh->nlmsg_seq, NLM_F_MULTI,
11445 NL80211_CMD_VENDOR);
11446 if (!hdr)
11447 break;
11448
11449 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11450 (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
11451 wdev_id(wdev),
11452 NL80211_ATTR_PAD))) {
11453 genlmsg_cancel(skb, hdr);
11454 break;
11455 }
11456
11457 vendor_data = nla_nest_start(skb, NL80211_ATTR_VENDOR_DATA);
11458 if (!vendor_data) {
11459 genlmsg_cancel(skb, hdr);
11460 break;
11461 }
11462
11463 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
11464 (unsigned long *)&cb->args[5]);
11465 nla_nest_end(skb, vendor_data);
11466
11467 if (err == -ENOBUFS || err == -ENOENT) {
11468 genlmsg_cancel(skb, hdr);
11469 break;
11470 } else if (err) {
11471 genlmsg_cancel(skb, hdr);
11472 goto out;
11473 }
11474
11475 genlmsg_end(skb, hdr);
11476 }
11477
11478 err = skb->len;
11479 out:
11480 rtnl_unlock();
11481 return err;
11482 }
11483
__cfg80211_alloc_reply_skb(struct wiphy * wiphy,enum nl80211_commands cmd,enum nl80211_attrs attr,int approxlen)11484 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
11485 enum nl80211_commands cmd,
11486 enum nl80211_attrs attr,
11487 int approxlen)
11488 {
11489 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11490
11491 if (WARN_ON(!rdev->cur_cmd_info))
11492 return NULL;
11493
11494 return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
11495 rdev->cur_cmd_info->snd_portid,
11496 rdev->cur_cmd_info->snd_seq,
11497 cmd, attr, NULL, GFP_KERNEL);
11498 }
11499 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
11500
cfg80211_vendor_cmd_reply(struct sk_buff * skb)11501 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
11502 {
11503 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
11504 void *hdr = ((void **)skb->cb)[1];
11505 struct nlattr *data = ((void **)skb->cb)[2];
11506
11507 /* clear CB data for netlink core to own from now on */
11508 memset(skb->cb, 0, sizeof(skb->cb));
11509
11510 if (WARN_ON(!rdev->cur_cmd_info)) {
11511 kfree_skb(skb);
11512 return -EINVAL;
11513 }
11514
11515 nla_nest_end(skb, data);
11516 genlmsg_end(skb, hdr);
11517 return genlmsg_reply(skb, rdev->cur_cmd_info);
11518 }
11519 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
11520
nl80211_set_qos_map(struct sk_buff * skb,struct genl_info * info)11521 static int nl80211_set_qos_map(struct sk_buff *skb,
11522 struct genl_info *info)
11523 {
11524 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11525 struct cfg80211_qos_map *qos_map = NULL;
11526 struct net_device *dev = info->user_ptr[1];
11527 u8 *pos, len, num_des, des_len, des;
11528 int ret;
11529
11530 if (!rdev->ops->set_qos_map)
11531 return -EOPNOTSUPP;
11532
11533 if (info->attrs[NL80211_ATTR_QOS_MAP]) {
11534 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
11535 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
11536
11537 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
11538 len > IEEE80211_QOS_MAP_LEN_MAX)
11539 return -EINVAL;
11540
11541 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
11542 if (!qos_map)
11543 return -ENOMEM;
11544
11545 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
11546 if (num_des) {
11547 des_len = num_des *
11548 sizeof(struct cfg80211_dscp_exception);
11549 memcpy(qos_map->dscp_exception, pos, des_len);
11550 qos_map->num_des = num_des;
11551 for (des = 0; des < num_des; des++) {
11552 if (qos_map->dscp_exception[des].up > 7) {
11553 kfree(qos_map);
11554 return -EINVAL;
11555 }
11556 }
11557 pos += des_len;
11558 }
11559 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
11560 }
11561
11562 wdev_lock(dev->ieee80211_ptr);
11563 ret = nl80211_key_allowed(dev->ieee80211_ptr);
11564 if (!ret)
11565 ret = rdev_set_qos_map(rdev, dev, qos_map);
11566 wdev_unlock(dev->ieee80211_ptr);
11567
11568 kfree(qos_map);
11569 return ret;
11570 }
11571
nl80211_add_tx_ts(struct sk_buff * skb,struct genl_info * info)11572 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
11573 {
11574 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11575 struct net_device *dev = info->user_ptr[1];
11576 struct wireless_dev *wdev = dev->ieee80211_ptr;
11577 const u8 *peer;
11578 u8 tsid, up;
11579 u16 admitted_time = 0;
11580 int err;
11581
11582 if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
11583 return -EOPNOTSUPP;
11584
11585 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
11586 !info->attrs[NL80211_ATTR_USER_PRIO])
11587 return -EINVAL;
11588
11589 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
11590 if (tsid >= IEEE80211_NUM_TIDS)
11591 return -EINVAL;
11592
11593 up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
11594 if (up >= IEEE80211_NUM_UPS)
11595 return -EINVAL;
11596
11597 /* WMM uses TIDs 0-7 even for TSPEC */
11598 if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
11599 /* TODO: handle 802.11 TSPEC/admission control
11600 * need more attributes for that (e.g. BA session requirement);
11601 * change the WMM adminssion test above to allow both then
11602 */
11603 return -EINVAL;
11604 }
11605
11606 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
11607
11608 if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
11609 admitted_time =
11610 nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
11611 if (!admitted_time)
11612 return -EINVAL;
11613 }
11614
11615 wdev_lock(wdev);
11616 switch (wdev->iftype) {
11617 case NL80211_IFTYPE_STATION:
11618 case NL80211_IFTYPE_P2P_CLIENT:
11619 if (wdev->current_bss)
11620 break;
11621 err = -ENOTCONN;
11622 goto out;
11623 default:
11624 err = -EOPNOTSUPP;
11625 goto out;
11626 }
11627
11628 err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
11629
11630 out:
11631 wdev_unlock(wdev);
11632 return err;
11633 }
11634
nl80211_del_tx_ts(struct sk_buff * skb,struct genl_info * info)11635 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
11636 {
11637 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11638 struct net_device *dev = info->user_ptr[1];
11639 struct wireless_dev *wdev = dev->ieee80211_ptr;
11640 const u8 *peer;
11641 u8 tsid;
11642 int err;
11643
11644 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
11645 return -EINVAL;
11646
11647 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
11648 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
11649
11650 wdev_lock(wdev);
11651 err = rdev_del_tx_ts(rdev, dev, tsid, peer);
11652 wdev_unlock(wdev);
11653
11654 return err;
11655 }
11656
nl80211_tdls_channel_switch(struct sk_buff * skb,struct genl_info * info)11657 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
11658 struct genl_info *info)
11659 {
11660 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11661 struct net_device *dev = info->user_ptr[1];
11662 struct wireless_dev *wdev = dev->ieee80211_ptr;
11663 struct cfg80211_chan_def chandef = {};
11664 const u8 *addr;
11665 u8 oper_class;
11666 int err;
11667
11668 if (!rdev->ops->tdls_channel_switch ||
11669 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
11670 return -EOPNOTSUPP;
11671
11672 switch (dev->ieee80211_ptr->iftype) {
11673 case NL80211_IFTYPE_STATION:
11674 case NL80211_IFTYPE_P2P_CLIENT:
11675 break;
11676 default:
11677 return -EOPNOTSUPP;
11678 }
11679
11680 if (!info->attrs[NL80211_ATTR_MAC] ||
11681 !info->attrs[NL80211_ATTR_OPER_CLASS])
11682 return -EINVAL;
11683
11684 err = nl80211_parse_chandef(rdev, info, &chandef);
11685 if (err)
11686 return err;
11687
11688 /*
11689 * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
11690 * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
11691 * specification is not defined for them.
11692 */
11693 if (chandef.chan->band == NL80211_BAND_2GHZ &&
11694 chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
11695 chandef.width != NL80211_CHAN_WIDTH_20)
11696 return -EINVAL;
11697
11698 /* we will be active on the TDLS link */
11699 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
11700 wdev->iftype))
11701 return -EINVAL;
11702
11703 /* don't allow switching to DFS channels */
11704 if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
11705 return -EINVAL;
11706
11707 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
11708 oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
11709
11710 wdev_lock(wdev);
11711 err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
11712 wdev_unlock(wdev);
11713
11714 return err;
11715 }
11716
nl80211_tdls_cancel_channel_switch(struct sk_buff * skb,struct genl_info * info)11717 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
11718 struct genl_info *info)
11719 {
11720 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11721 struct net_device *dev = info->user_ptr[1];
11722 struct wireless_dev *wdev = dev->ieee80211_ptr;
11723 const u8 *addr;
11724
11725 if (!rdev->ops->tdls_channel_switch ||
11726 !rdev->ops->tdls_cancel_channel_switch ||
11727 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
11728 return -EOPNOTSUPP;
11729
11730 switch (dev->ieee80211_ptr->iftype) {
11731 case NL80211_IFTYPE_STATION:
11732 case NL80211_IFTYPE_P2P_CLIENT:
11733 break;
11734 default:
11735 return -EOPNOTSUPP;
11736 }
11737
11738 if (!info->attrs[NL80211_ATTR_MAC])
11739 return -EINVAL;
11740
11741 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
11742
11743 wdev_lock(wdev);
11744 rdev_tdls_cancel_channel_switch(rdev, dev, addr);
11745 wdev_unlock(wdev);
11746
11747 return 0;
11748 }
11749
11750 #define NL80211_FLAG_NEED_WIPHY 0x01
11751 #define NL80211_FLAG_NEED_NETDEV 0x02
11752 #define NL80211_FLAG_NEED_RTNL 0x04
11753 #define NL80211_FLAG_CHECK_NETDEV_UP 0x08
11754 #define NL80211_FLAG_NEED_NETDEV_UP (NL80211_FLAG_NEED_NETDEV |\
11755 NL80211_FLAG_CHECK_NETDEV_UP)
11756 #define NL80211_FLAG_NEED_WDEV 0x10
11757 /* If a netdev is associated, it must be UP, P2P must be started */
11758 #define NL80211_FLAG_NEED_WDEV_UP (NL80211_FLAG_NEED_WDEV |\
11759 NL80211_FLAG_CHECK_NETDEV_UP)
11760 #define NL80211_FLAG_CLEAR_SKB 0x20
11761
nl80211_pre_doit(const struct genl_ops * ops,struct sk_buff * skb,struct genl_info * info)11762 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
11763 struct genl_info *info)
11764 {
11765 struct cfg80211_registered_device *rdev;
11766 struct wireless_dev *wdev;
11767 struct net_device *dev;
11768 bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
11769
11770 if (rtnl)
11771 rtnl_lock();
11772
11773 if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
11774 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
11775 if (IS_ERR(rdev)) {
11776 if (rtnl)
11777 rtnl_unlock();
11778 return PTR_ERR(rdev);
11779 }
11780 info->user_ptr[0] = rdev;
11781 } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
11782 ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
11783 ASSERT_RTNL();
11784
11785 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
11786 info->attrs);
11787 if (IS_ERR(wdev)) {
11788 if (rtnl)
11789 rtnl_unlock();
11790 return PTR_ERR(wdev);
11791 }
11792
11793 dev = wdev->netdev;
11794 rdev = wiphy_to_rdev(wdev->wiphy);
11795
11796 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
11797 if (!dev) {
11798 if (rtnl)
11799 rtnl_unlock();
11800 return -EINVAL;
11801 }
11802
11803 info->user_ptr[1] = dev;
11804 } else {
11805 info->user_ptr[1] = wdev;
11806 }
11807
11808 if (dev) {
11809 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
11810 !netif_running(dev)) {
11811 if (rtnl)
11812 rtnl_unlock();
11813 return -ENETDOWN;
11814 }
11815
11816 dev_hold(dev);
11817 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
11818 if (wdev->iftype == NL80211_IFTYPE_P2P_DEVICE &&
11819 !wdev->p2p_started) {
11820 if (rtnl)
11821 rtnl_unlock();
11822 return -ENETDOWN;
11823 }
11824 if (wdev->iftype == NL80211_IFTYPE_NAN &&
11825 !wdev->nan_started) {
11826 if (rtnl)
11827 rtnl_unlock();
11828 return -ENETDOWN;
11829 }
11830 }
11831
11832 info->user_ptr[0] = rdev;
11833 }
11834
11835 return 0;
11836 }
11837
nl80211_post_doit(const struct genl_ops * ops,struct sk_buff * skb,struct genl_info * info)11838 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
11839 struct genl_info *info)
11840 {
11841 if (info->user_ptr[1]) {
11842 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
11843 struct wireless_dev *wdev = info->user_ptr[1];
11844
11845 if (wdev->netdev)
11846 dev_put(wdev->netdev);
11847 } else {
11848 dev_put(info->user_ptr[1]);
11849 }
11850 }
11851
11852 if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
11853 rtnl_unlock();
11854
11855 /* If needed, clear the netlink message payload from the SKB
11856 * as it might contain key data that shouldn't stick around on
11857 * the heap after the SKB is freed. The netlink message header
11858 * is still needed for further processing, so leave it intact.
11859 */
11860 if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
11861 struct nlmsghdr *nlh = nlmsg_hdr(skb);
11862
11863 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
11864 }
11865 }
11866
11867 static const struct genl_ops nl80211_ops[] = {
11868 {
11869 .cmd = NL80211_CMD_GET_WIPHY,
11870 .doit = nl80211_get_wiphy,
11871 .dumpit = nl80211_dump_wiphy,
11872 .done = nl80211_dump_wiphy_done,
11873 .policy = nl80211_policy,
11874 /* can be retrieved by unprivileged users */
11875 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11876 NL80211_FLAG_NEED_RTNL,
11877 },
11878 {
11879 .cmd = NL80211_CMD_SET_WIPHY,
11880 .doit = nl80211_set_wiphy,
11881 .policy = nl80211_policy,
11882 .flags = GENL_UNS_ADMIN_PERM,
11883 .internal_flags = NL80211_FLAG_NEED_RTNL,
11884 },
11885 {
11886 .cmd = NL80211_CMD_GET_INTERFACE,
11887 .doit = nl80211_get_interface,
11888 .dumpit = nl80211_dump_interface,
11889 .policy = nl80211_policy,
11890 /* can be retrieved by unprivileged users */
11891 .internal_flags = NL80211_FLAG_NEED_WDEV |
11892 NL80211_FLAG_NEED_RTNL,
11893 },
11894 {
11895 .cmd = NL80211_CMD_SET_INTERFACE,
11896 .doit = nl80211_set_interface,
11897 .policy = nl80211_policy,
11898 .flags = GENL_UNS_ADMIN_PERM,
11899 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11900 NL80211_FLAG_NEED_RTNL,
11901 },
11902 {
11903 .cmd = NL80211_CMD_NEW_INTERFACE,
11904 .doit = nl80211_new_interface,
11905 .policy = nl80211_policy,
11906 .flags = GENL_UNS_ADMIN_PERM,
11907 .internal_flags = NL80211_FLAG_NEED_WIPHY |
11908 NL80211_FLAG_NEED_RTNL,
11909 },
11910 {
11911 .cmd = NL80211_CMD_DEL_INTERFACE,
11912 .doit = nl80211_del_interface,
11913 .policy = nl80211_policy,
11914 .flags = GENL_UNS_ADMIN_PERM,
11915 .internal_flags = NL80211_FLAG_NEED_WDEV |
11916 NL80211_FLAG_NEED_RTNL,
11917 },
11918 {
11919 .cmd = NL80211_CMD_GET_KEY,
11920 .doit = nl80211_get_key,
11921 .policy = nl80211_policy,
11922 .flags = GENL_UNS_ADMIN_PERM,
11923 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11924 NL80211_FLAG_NEED_RTNL,
11925 },
11926 {
11927 .cmd = NL80211_CMD_SET_KEY,
11928 .doit = nl80211_set_key,
11929 .policy = nl80211_policy,
11930 .flags = GENL_UNS_ADMIN_PERM,
11931 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11932 NL80211_FLAG_NEED_RTNL |
11933 NL80211_FLAG_CLEAR_SKB,
11934 },
11935 {
11936 .cmd = NL80211_CMD_NEW_KEY,
11937 .doit = nl80211_new_key,
11938 .policy = nl80211_policy,
11939 .flags = GENL_UNS_ADMIN_PERM,
11940 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11941 NL80211_FLAG_NEED_RTNL |
11942 NL80211_FLAG_CLEAR_SKB,
11943 },
11944 {
11945 .cmd = NL80211_CMD_DEL_KEY,
11946 .doit = nl80211_del_key,
11947 .policy = nl80211_policy,
11948 .flags = GENL_UNS_ADMIN_PERM,
11949 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11950 NL80211_FLAG_NEED_RTNL,
11951 },
11952 {
11953 .cmd = NL80211_CMD_SET_BEACON,
11954 .policy = nl80211_policy,
11955 .flags = GENL_UNS_ADMIN_PERM,
11956 .doit = nl80211_set_beacon,
11957 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11958 NL80211_FLAG_NEED_RTNL,
11959 },
11960 {
11961 .cmd = NL80211_CMD_START_AP,
11962 .policy = nl80211_policy,
11963 .flags = GENL_UNS_ADMIN_PERM,
11964 .doit = nl80211_start_ap,
11965 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11966 NL80211_FLAG_NEED_RTNL,
11967 },
11968 {
11969 .cmd = NL80211_CMD_STOP_AP,
11970 .policy = nl80211_policy,
11971 .flags = GENL_UNS_ADMIN_PERM,
11972 .doit = nl80211_stop_ap,
11973 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11974 NL80211_FLAG_NEED_RTNL,
11975 },
11976 {
11977 .cmd = NL80211_CMD_GET_STATION,
11978 .doit = nl80211_get_station,
11979 .dumpit = nl80211_dump_station,
11980 .policy = nl80211_policy,
11981 .internal_flags = NL80211_FLAG_NEED_NETDEV |
11982 NL80211_FLAG_NEED_RTNL,
11983 },
11984 {
11985 .cmd = NL80211_CMD_SET_STATION,
11986 .doit = nl80211_set_station,
11987 .policy = nl80211_policy,
11988 .flags = GENL_UNS_ADMIN_PERM,
11989 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11990 NL80211_FLAG_NEED_RTNL,
11991 },
11992 {
11993 .cmd = NL80211_CMD_NEW_STATION,
11994 .doit = nl80211_new_station,
11995 .policy = nl80211_policy,
11996 .flags = GENL_UNS_ADMIN_PERM,
11997 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11998 NL80211_FLAG_NEED_RTNL,
11999 },
12000 {
12001 .cmd = NL80211_CMD_DEL_STATION,
12002 .doit = nl80211_del_station,
12003 .policy = nl80211_policy,
12004 .flags = GENL_UNS_ADMIN_PERM,
12005 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12006 NL80211_FLAG_NEED_RTNL,
12007 },
12008 {
12009 .cmd = NL80211_CMD_GET_MPATH,
12010 .doit = nl80211_get_mpath,
12011 .dumpit = nl80211_dump_mpath,
12012 .policy = nl80211_policy,
12013 .flags = GENL_UNS_ADMIN_PERM,
12014 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12015 NL80211_FLAG_NEED_RTNL,
12016 },
12017 {
12018 .cmd = NL80211_CMD_GET_MPP,
12019 .doit = nl80211_get_mpp,
12020 .dumpit = nl80211_dump_mpp,
12021 .policy = nl80211_policy,
12022 .flags = GENL_UNS_ADMIN_PERM,
12023 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12024 NL80211_FLAG_NEED_RTNL,
12025 },
12026 {
12027 .cmd = NL80211_CMD_SET_MPATH,
12028 .doit = nl80211_set_mpath,
12029 .policy = nl80211_policy,
12030 .flags = GENL_UNS_ADMIN_PERM,
12031 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12032 NL80211_FLAG_NEED_RTNL,
12033 },
12034 {
12035 .cmd = NL80211_CMD_NEW_MPATH,
12036 .doit = nl80211_new_mpath,
12037 .policy = nl80211_policy,
12038 .flags = GENL_UNS_ADMIN_PERM,
12039 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12040 NL80211_FLAG_NEED_RTNL,
12041 },
12042 {
12043 .cmd = NL80211_CMD_DEL_MPATH,
12044 .doit = nl80211_del_mpath,
12045 .policy = nl80211_policy,
12046 .flags = GENL_UNS_ADMIN_PERM,
12047 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12048 NL80211_FLAG_NEED_RTNL,
12049 },
12050 {
12051 .cmd = NL80211_CMD_SET_BSS,
12052 .doit = nl80211_set_bss,
12053 .policy = nl80211_policy,
12054 .flags = GENL_UNS_ADMIN_PERM,
12055 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12056 NL80211_FLAG_NEED_RTNL,
12057 },
12058 {
12059 .cmd = NL80211_CMD_GET_REG,
12060 .doit = nl80211_get_reg_do,
12061 .dumpit = nl80211_get_reg_dump,
12062 .policy = nl80211_policy,
12063 .internal_flags = NL80211_FLAG_NEED_RTNL,
12064 /* can be retrieved by unprivileged users */
12065 },
12066 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
12067 {
12068 .cmd = NL80211_CMD_SET_REG,
12069 .doit = nl80211_set_reg,
12070 .policy = nl80211_policy,
12071 .flags = GENL_ADMIN_PERM,
12072 .internal_flags = NL80211_FLAG_NEED_RTNL,
12073 },
12074 #endif
12075 {
12076 .cmd = NL80211_CMD_REQ_SET_REG,
12077 .doit = nl80211_req_set_reg,
12078 .policy = nl80211_policy,
12079 .flags = GENL_ADMIN_PERM,
12080 },
12081 {
12082 .cmd = NL80211_CMD_GET_MESH_CONFIG,
12083 .doit = nl80211_get_mesh_config,
12084 .policy = nl80211_policy,
12085 /* can be retrieved by unprivileged users */
12086 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12087 NL80211_FLAG_NEED_RTNL,
12088 },
12089 {
12090 .cmd = NL80211_CMD_SET_MESH_CONFIG,
12091 .doit = nl80211_update_mesh_config,
12092 .policy = nl80211_policy,
12093 .flags = GENL_UNS_ADMIN_PERM,
12094 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12095 NL80211_FLAG_NEED_RTNL,
12096 },
12097 {
12098 .cmd = NL80211_CMD_TRIGGER_SCAN,
12099 .doit = nl80211_trigger_scan,
12100 .policy = nl80211_policy,
12101 .flags = GENL_UNS_ADMIN_PERM,
12102 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12103 NL80211_FLAG_NEED_RTNL,
12104 },
12105 {
12106 .cmd = NL80211_CMD_ABORT_SCAN,
12107 .doit = nl80211_abort_scan,
12108 .policy = nl80211_policy,
12109 .flags = GENL_UNS_ADMIN_PERM,
12110 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12111 NL80211_FLAG_NEED_RTNL,
12112 },
12113 {
12114 .cmd = NL80211_CMD_GET_SCAN,
12115 .policy = nl80211_policy,
12116 .dumpit = nl80211_dump_scan,
12117 },
12118 {
12119 .cmd = NL80211_CMD_START_SCHED_SCAN,
12120 .doit = nl80211_start_sched_scan,
12121 .policy = nl80211_policy,
12122 .flags = GENL_UNS_ADMIN_PERM,
12123 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12124 NL80211_FLAG_NEED_RTNL,
12125 },
12126 {
12127 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
12128 .doit = nl80211_stop_sched_scan,
12129 .policy = nl80211_policy,
12130 .flags = GENL_UNS_ADMIN_PERM,
12131 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12132 NL80211_FLAG_NEED_RTNL,
12133 },
12134 {
12135 .cmd = NL80211_CMD_AUTHENTICATE,
12136 .doit = nl80211_authenticate,
12137 .policy = nl80211_policy,
12138 .flags = GENL_UNS_ADMIN_PERM,
12139 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12140 NL80211_FLAG_NEED_RTNL |
12141 NL80211_FLAG_CLEAR_SKB,
12142 },
12143 {
12144 .cmd = NL80211_CMD_ASSOCIATE,
12145 .doit = nl80211_associate,
12146 .policy = nl80211_policy,
12147 .flags = GENL_UNS_ADMIN_PERM,
12148 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12149 NL80211_FLAG_NEED_RTNL,
12150 },
12151 {
12152 .cmd = NL80211_CMD_DEAUTHENTICATE,
12153 .doit = nl80211_deauthenticate,
12154 .policy = nl80211_policy,
12155 .flags = GENL_UNS_ADMIN_PERM,
12156 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12157 NL80211_FLAG_NEED_RTNL,
12158 },
12159 {
12160 .cmd = NL80211_CMD_DISASSOCIATE,
12161 .doit = nl80211_disassociate,
12162 .policy = nl80211_policy,
12163 .flags = GENL_UNS_ADMIN_PERM,
12164 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12165 NL80211_FLAG_NEED_RTNL,
12166 },
12167 {
12168 .cmd = NL80211_CMD_JOIN_IBSS,
12169 .doit = nl80211_join_ibss,
12170 .policy = nl80211_policy,
12171 .flags = GENL_UNS_ADMIN_PERM,
12172 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12173 NL80211_FLAG_NEED_RTNL,
12174 },
12175 {
12176 .cmd = NL80211_CMD_LEAVE_IBSS,
12177 .doit = nl80211_leave_ibss,
12178 .policy = nl80211_policy,
12179 .flags = GENL_UNS_ADMIN_PERM,
12180 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12181 NL80211_FLAG_NEED_RTNL,
12182 },
12183 #ifdef CONFIG_NL80211_TESTMODE
12184 {
12185 .cmd = NL80211_CMD_TESTMODE,
12186 .doit = nl80211_testmode_do,
12187 .dumpit = nl80211_testmode_dump,
12188 .policy = nl80211_policy,
12189 .flags = GENL_UNS_ADMIN_PERM,
12190 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12191 NL80211_FLAG_NEED_RTNL,
12192 },
12193 #endif
12194 {
12195 .cmd = NL80211_CMD_CONNECT,
12196 .doit = nl80211_connect,
12197 .policy = nl80211_policy,
12198 .flags = GENL_UNS_ADMIN_PERM,
12199 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12200 NL80211_FLAG_NEED_RTNL,
12201 },
12202 {
12203 .cmd = NL80211_CMD_DISCONNECT,
12204 .doit = nl80211_disconnect,
12205 .policy = nl80211_policy,
12206 .flags = GENL_UNS_ADMIN_PERM,
12207 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12208 NL80211_FLAG_NEED_RTNL,
12209 },
12210 {
12211 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
12212 .doit = nl80211_wiphy_netns,
12213 .policy = nl80211_policy,
12214 .flags = GENL_UNS_ADMIN_PERM,
12215 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12216 NL80211_FLAG_NEED_RTNL,
12217 },
12218 {
12219 .cmd = NL80211_CMD_GET_SURVEY,
12220 .policy = nl80211_policy,
12221 .dumpit = nl80211_dump_survey,
12222 },
12223 {
12224 .cmd = NL80211_CMD_SET_PMKSA,
12225 .doit = nl80211_setdel_pmksa,
12226 .policy = nl80211_policy,
12227 .flags = GENL_UNS_ADMIN_PERM,
12228 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12229 NL80211_FLAG_NEED_RTNL,
12230 },
12231 {
12232 .cmd = NL80211_CMD_DEL_PMKSA,
12233 .doit = nl80211_setdel_pmksa,
12234 .policy = nl80211_policy,
12235 .flags = GENL_UNS_ADMIN_PERM,
12236 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12237 NL80211_FLAG_NEED_RTNL,
12238 },
12239 {
12240 .cmd = NL80211_CMD_FLUSH_PMKSA,
12241 .doit = nl80211_flush_pmksa,
12242 .policy = nl80211_policy,
12243 .flags = GENL_UNS_ADMIN_PERM,
12244 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12245 NL80211_FLAG_NEED_RTNL,
12246 },
12247 {
12248 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
12249 .doit = nl80211_remain_on_channel,
12250 .policy = nl80211_policy,
12251 .flags = GENL_UNS_ADMIN_PERM,
12252 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12253 NL80211_FLAG_NEED_RTNL,
12254 },
12255 {
12256 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
12257 .doit = nl80211_cancel_remain_on_channel,
12258 .policy = nl80211_policy,
12259 .flags = GENL_UNS_ADMIN_PERM,
12260 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12261 NL80211_FLAG_NEED_RTNL,
12262 },
12263 {
12264 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
12265 .doit = nl80211_set_tx_bitrate_mask,
12266 .policy = nl80211_policy,
12267 .flags = GENL_UNS_ADMIN_PERM,
12268 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12269 NL80211_FLAG_NEED_RTNL,
12270 },
12271 {
12272 .cmd = NL80211_CMD_REGISTER_FRAME,
12273 .doit = nl80211_register_mgmt,
12274 .policy = nl80211_policy,
12275 .flags = GENL_UNS_ADMIN_PERM,
12276 .internal_flags = NL80211_FLAG_NEED_WDEV |
12277 NL80211_FLAG_NEED_RTNL,
12278 },
12279 {
12280 .cmd = NL80211_CMD_FRAME,
12281 .doit = nl80211_tx_mgmt,
12282 .policy = nl80211_policy,
12283 .flags = GENL_UNS_ADMIN_PERM,
12284 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12285 NL80211_FLAG_NEED_RTNL,
12286 },
12287 {
12288 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
12289 .doit = nl80211_tx_mgmt_cancel_wait,
12290 .policy = nl80211_policy,
12291 .flags = GENL_UNS_ADMIN_PERM,
12292 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12293 NL80211_FLAG_NEED_RTNL,
12294 },
12295 {
12296 .cmd = NL80211_CMD_SET_POWER_SAVE,
12297 .doit = nl80211_set_power_save,
12298 .policy = nl80211_policy,
12299 .flags = GENL_UNS_ADMIN_PERM,
12300 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12301 NL80211_FLAG_NEED_RTNL,
12302 },
12303 {
12304 .cmd = NL80211_CMD_GET_POWER_SAVE,
12305 .doit = nl80211_get_power_save,
12306 .policy = nl80211_policy,
12307 /* can be retrieved by unprivileged users */
12308 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12309 NL80211_FLAG_NEED_RTNL,
12310 },
12311 {
12312 .cmd = NL80211_CMD_SET_CQM,
12313 .doit = nl80211_set_cqm,
12314 .policy = nl80211_policy,
12315 .flags = GENL_UNS_ADMIN_PERM,
12316 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12317 NL80211_FLAG_NEED_RTNL,
12318 },
12319 {
12320 .cmd = NL80211_CMD_SET_CHANNEL,
12321 .doit = nl80211_set_channel,
12322 .policy = nl80211_policy,
12323 .flags = GENL_UNS_ADMIN_PERM,
12324 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12325 NL80211_FLAG_NEED_RTNL,
12326 },
12327 {
12328 .cmd = NL80211_CMD_SET_WDS_PEER,
12329 .doit = nl80211_set_wds_peer,
12330 .policy = nl80211_policy,
12331 .flags = GENL_UNS_ADMIN_PERM,
12332 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12333 NL80211_FLAG_NEED_RTNL,
12334 },
12335 {
12336 .cmd = NL80211_CMD_JOIN_MESH,
12337 .doit = nl80211_join_mesh,
12338 .policy = nl80211_policy,
12339 .flags = GENL_UNS_ADMIN_PERM,
12340 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12341 NL80211_FLAG_NEED_RTNL,
12342 },
12343 {
12344 .cmd = NL80211_CMD_LEAVE_MESH,
12345 .doit = nl80211_leave_mesh,
12346 .policy = nl80211_policy,
12347 .flags = GENL_UNS_ADMIN_PERM,
12348 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12349 NL80211_FLAG_NEED_RTNL,
12350 },
12351 {
12352 .cmd = NL80211_CMD_JOIN_OCB,
12353 .doit = nl80211_join_ocb,
12354 .policy = nl80211_policy,
12355 .flags = GENL_UNS_ADMIN_PERM,
12356 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12357 NL80211_FLAG_NEED_RTNL,
12358 },
12359 {
12360 .cmd = NL80211_CMD_LEAVE_OCB,
12361 .doit = nl80211_leave_ocb,
12362 .policy = nl80211_policy,
12363 .flags = GENL_UNS_ADMIN_PERM,
12364 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12365 NL80211_FLAG_NEED_RTNL,
12366 },
12367 #ifdef CONFIG_PM
12368 {
12369 .cmd = NL80211_CMD_GET_WOWLAN,
12370 .doit = nl80211_get_wowlan,
12371 .policy = nl80211_policy,
12372 /* can be retrieved by unprivileged users */
12373 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12374 NL80211_FLAG_NEED_RTNL,
12375 },
12376 {
12377 .cmd = NL80211_CMD_SET_WOWLAN,
12378 .doit = nl80211_set_wowlan,
12379 .policy = nl80211_policy,
12380 .flags = GENL_UNS_ADMIN_PERM,
12381 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12382 NL80211_FLAG_NEED_RTNL,
12383 },
12384 #endif
12385 {
12386 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
12387 .doit = nl80211_set_rekey_data,
12388 .policy = nl80211_policy,
12389 .flags = GENL_UNS_ADMIN_PERM,
12390 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12391 NL80211_FLAG_NEED_RTNL |
12392 NL80211_FLAG_CLEAR_SKB,
12393 },
12394 {
12395 .cmd = NL80211_CMD_TDLS_MGMT,
12396 .doit = nl80211_tdls_mgmt,
12397 .policy = nl80211_policy,
12398 .flags = GENL_UNS_ADMIN_PERM,
12399 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12400 NL80211_FLAG_NEED_RTNL,
12401 },
12402 {
12403 .cmd = NL80211_CMD_TDLS_OPER,
12404 .doit = nl80211_tdls_oper,
12405 .policy = nl80211_policy,
12406 .flags = GENL_UNS_ADMIN_PERM,
12407 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12408 NL80211_FLAG_NEED_RTNL,
12409 },
12410 {
12411 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
12412 .doit = nl80211_register_unexpected_frame,
12413 .policy = nl80211_policy,
12414 .flags = GENL_UNS_ADMIN_PERM,
12415 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12416 NL80211_FLAG_NEED_RTNL,
12417 },
12418 {
12419 .cmd = NL80211_CMD_PROBE_CLIENT,
12420 .doit = nl80211_probe_client,
12421 .policy = nl80211_policy,
12422 .flags = GENL_UNS_ADMIN_PERM,
12423 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12424 NL80211_FLAG_NEED_RTNL,
12425 },
12426 {
12427 .cmd = NL80211_CMD_REGISTER_BEACONS,
12428 .doit = nl80211_register_beacons,
12429 .policy = nl80211_policy,
12430 .flags = GENL_UNS_ADMIN_PERM,
12431 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12432 NL80211_FLAG_NEED_RTNL,
12433 },
12434 {
12435 .cmd = NL80211_CMD_SET_NOACK_MAP,
12436 .doit = nl80211_set_noack_map,
12437 .policy = nl80211_policy,
12438 .flags = GENL_UNS_ADMIN_PERM,
12439 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12440 NL80211_FLAG_NEED_RTNL,
12441 },
12442 {
12443 .cmd = NL80211_CMD_START_P2P_DEVICE,
12444 .doit = nl80211_start_p2p_device,
12445 .policy = nl80211_policy,
12446 .flags = GENL_UNS_ADMIN_PERM,
12447 .internal_flags = NL80211_FLAG_NEED_WDEV |
12448 NL80211_FLAG_NEED_RTNL,
12449 },
12450 {
12451 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
12452 .doit = nl80211_stop_p2p_device,
12453 .policy = nl80211_policy,
12454 .flags = GENL_UNS_ADMIN_PERM,
12455 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12456 NL80211_FLAG_NEED_RTNL,
12457 },
12458 {
12459 .cmd = NL80211_CMD_START_NAN,
12460 .doit = nl80211_start_nan,
12461 .policy = nl80211_policy,
12462 .flags = GENL_ADMIN_PERM,
12463 .internal_flags = NL80211_FLAG_NEED_WDEV |
12464 NL80211_FLAG_NEED_RTNL,
12465 },
12466 {
12467 .cmd = NL80211_CMD_STOP_NAN,
12468 .doit = nl80211_stop_nan,
12469 .policy = nl80211_policy,
12470 .flags = GENL_ADMIN_PERM,
12471 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12472 NL80211_FLAG_NEED_RTNL,
12473 },
12474 {
12475 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
12476 .doit = nl80211_nan_add_func,
12477 .policy = nl80211_policy,
12478 .flags = GENL_ADMIN_PERM,
12479 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12480 NL80211_FLAG_NEED_RTNL,
12481 },
12482 {
12483 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
12484 .doit = nl80211_nan_del_func,
12485 .policy = nl80211_policy,
12486 .flags = GENL_ADMIN_PERM,
12487 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12488 NL80211_FLAG_NEED_RTNL,
12489 },
12490 {
12491 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
12492 .doit = nl80211_nan_change_config,
12493 .policy = nl80211_policy,
12494 .flags = GENL_ADMIN_PERM,
12495 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12496 NL80211_FLAG_NEED_RTNL,
12497 },
12498 {
12499 .cmd = NL80211_CMD_SET_MCAST_RATE,
12500 .doit = nl80211_set_mcast_rate,
12501 .policy = nl80211_policy,
12502 .flags = GENL_UNS_ADMIN_PERM,
12503 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12504 NL80211_FLAG_NEED_RTNL,
12505 },
12506 {
12507 .cmd = NL80211_CMD_SET_MAC_ACL,
12508 .doit = nl80211_set_mac_acl,
12509 .policy = nl80211_policy,
12510 .flags = GENL_UNS_ADMIN_PERM,
12511 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12512 NL80211_FLAG_NEED_RTNL,
12513 },
12514 {
12515 .cmd = NL80211_CMD_RADAR_DETECT,
12516 .doit = nl80211_start_radar_detection,
12517 .policy = nl80211_policy,
12518 .flags = GENL_UNS_ADMIN_PERM,
12519 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12520 NL80211_FLAG_NEED_RTNL,
12521 },
12522 {
12523 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
12524 .doit = nl80211_get_protocol_features,
12525 .policy = nl80211_policy,
12526 },
12527 {
12528 .cmd = NL80211_CMD_UPDATE_FT_IES,
12529 .doit = nl80211_update_ft_ies,
12530 .policy = nl80211_policy,
12531 .flags = GENL_UNS_ADMIN_PERM,
12532 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12533 NL80211_FLAG_NEED_RTNL,
12534 },
12535 {
12536 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
12537 .doit = nl80211_crit_protocol_start,
12538 .policy = nl80211_policy,
12539 .flags = GENL_UNS_ADMIN_PERM,
12540 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12541 NL80211_FLAG_NEED_RTNL,
12542 },
12543 {
12544 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
12545 .doit = nl80211_crit_protocol_stop,
12546 .policy = nl80211_policy,
12547 .flags = GENL_UNS_ADMIN_PERM,
12548 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12549 NL80211_FLAG_NEED_RTNL,
12550 },
12551 {
12552 .cmd = NL80211_CMD_GET_COALESCE,
12553 .doit = nl80211_get_coalesce,
12554 .policy = nl80211_policy,
12555 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12556 NL80211_FLAG_NEED_RTNL,
12557 },
12558 {
12559 .cmd = NL80211_CMD_SET_COALESCE,
12560 .doit = nl80211_set_coalesce,
12561 .policy = nl80211_policy,
12562 .flags = GENL_UNS_ADMIN_PERM,
12563 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12564 NL80211_FLAG_NEED_RTNL,
12565 },
12566 {
12567 .cmd = NL80211_CMD_CHANNEL_SWITCH,
12568 .doit = nl80211_channel_switch,
12569 .policy = nl80211_policy,
12570 .flags = GENL_UNS_ADMIN_PERM,
12571 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12572 NL80211_FLAG_NEED_RTNL,
12573 },
12574 {
12575 .cmd = NL80211_CMD_VENDOR,
12576 .doit = nl80211_vendor_cmd,
12577 .dumpit = nl80211_vendor_cmd_dump,
12578 .policy = nl80211_policy,
12579 .flags = GENL_UNS_ADMIN_PERM,
12580 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12581 NL80211_FLAG_NEED_RTNL,
12582 },
12583 {
12584 .cmd = NL80211_CMD_SET_QOS_MAP,
12585 .doit = nl80211_set_qos_map,
12586 .policy = nl80211_policy,
12587 .flags = GENL_UNS_ADMIN_PERM,
12588 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12589 NL80211_FLAG_NEED_RTNL,
12590 },
12591 {
12592 .cmd = NL80211_CMD_ADD_TX_TS,
12593 .doit = nl80211_add_tx_ts,
12594 .policy = nl80211_policy,
12595 .flags = GENL_UNS_ADMIN_PERM,
12596 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12597 NL80211_FLAG_NEED_RTNL,
12598 },
12599 {
12600 .cmd = NL80211_CMD_DEL_TX_TS,
12601 .doit = nl80211_del_tx_ts,
12602 .policy = nl80211_policy,
12603 .flags = GENL_UNS_ADMIN_PERM,
12604 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12605 NL80211_FLAG_NEED_RTNL,
12606 },
12607 {
12608 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
12609 .doit = nl80211_tdls_channel_switch,
12610 .policy = nl80211_policy,
12611 .flags = GENL_UNS_ADMIN_PERM,
12612 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12613 NL80211_FLAG_NEED_RTNL,
12614 },
12615 {
12616 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
12617 .doit = nl80211_tdls_cancel_channel_switch,
12618 .policy = nl80211_policy,
12619 .flags = GENL_UNS_ADMIN_PERM,
12620 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12621 NL80211_FLAG_NEED_RTNL,
12622 },
12623 };
12624
12625 /* notification functions */
12626
nl80211_notify_wiphy(struct cfg80211_registered_device * rdev,enum nl80211_commands cmd)12627 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
12628 enum nl80211_commands cmd)
12629 {
12630 struct sk_buff *msg;
12631 struct nl80211_dump_wiphy_state state = {};
12632
12633 WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
12634 cmd != NL80211_CMD_DEL_WIPHY);
12635
12636 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12637 if (!msg)
12638 return;
12639
12640 if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
12641 nlmsg_free(msg);
12642 return;
12643 }
12644
12645 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12646 NL80211_MCGRP_CONFIG, GFP_KERNEL);
12647 }
12648
nl80211_notify_iface(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,enum nl80211_commands cmd)12649 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
12650 struct wireless_dev *wdev,
12651 enum nl80211_commands cmd)
12652 {
12653 struct sk_buff *msg;
12654
12655 WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
12656 cmd != NL80211_CMD_DEL_INTERFACE);
12657
12658 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12659 if (!msg)
12660 return;
12661
12662 if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev,
12663 cmd == NL80211_CMD_DEL_INTERFACE) < 0) {
12664 nlmsg_free(msg);
12665 return;
12666 }
12667
12668 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12669 NL80211_MCGRP_CONFIG, GFP_KERNEL);
12670 }
12671
nl80211_add_scan_req(struct sk_buff * msg,struct cfg80211_registered_device * rdev)12672 static int nl80211_add_scan_req(struct sk_buff *msg,
12673 struct cfg80211_registered_device *rdev)
12674 {
12675 struct cfg80211_scan_request *req = rdev->scan_req;
12676 struct nlattr *nest;
12677 int i;
12678
12679 if (WARN_ON(!req))
12680 return 0;
12681
12682 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
12683 if (!nest)
12684 goto nla_put_failure;
12685 for (i = 0; i < req->n_ssids; i++) {
12686 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
12687 goto nla_put_failure;
12688 }
12689 nla_nest_end(msg, nest);
12690
12691 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
12692 if (!nest)
12693 goto nla_put_failure;
12694 for (i = 0; i < req->n_channels; i++) {
12695 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
12696 goto nla_put_failure;
12697 }
12698 nla_nest_end(msg, nest);
12699
12700 if (req->ie &&
12701 nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
12702 goto nla_put_failure;
12703
12704 if (req->flags &&
12705 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
12706 goto nla_put_failure;
12707
12708 if (req->info.scan_start_tsf &&
12709 (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
12710 req->info.scan_start_tsf, NL80211_BSS_PAD) ||
12711 nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
12712 req->info.tsf_bssid)))
12713 goto nla_put_failure;
12714
12715 return 0;
12716 nla_put_failure:
12717 return -ENOBUFS;
12718 }
12719
nl80211_send_scan_msg(struct sk_buff * msg,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,u32 portid,u32 seq,int flags,u32 cmd)12720 static int nl80211_send_scan_msg(struct sk_buff *msg,
12721 struct cfg80211_registered_device *rdev,
12722 struct wireless_dev *wdev,
12723 u32 portid, u32 seq, int flags,
12724 u32 cmd)
12725 {
12726 void *hdr;
12727
12728 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
12729 if (!hdr)
12730 return -1;
12731
12732 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12733 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12734 wdev->netdev->ifindex)) ||
12735 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
12736 NL80211_ATTR_PAD))
12737 goto nla_put_failure;
12738
12739 /* ignore errors and send incomplete event anyway */
12740 nl80211_add_scan_req(msg, rdev);
12741
12742 genlmsg_end(msg, hdr);
12743 return 0;
12744
12745 nla_put_failure:
12746 genlmsg_cancel(msg, hdr);
12747 return -EMSGSIZE;
12748 }
12749
12750 static int
nl80211_send_sched_scan_msg(struct sk_buff * msg,struct cfg80211_registered_device * rdev,struct net_device * netdev,u32 portid,u32 seq,int flags,u32 cmd)12751 nl80211_send_sched_scan_msg(struct sk_buff *msg,
12752 struct cfg80211_registered_device *rdev,
12753 struct net_device *netdev,
12754 u32 portid, u32 seq, int flags, u32 cmd)
12755 {
12756 void *hdr;
12757
12758 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
12759 if (!hdr)
12760 return -1;
12761
12762 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12763 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
12764 goto nla_put_failure;
12765
12766 genlmsg_end(msg, hdr);
12767 return 0;
12768
12769 nla_put_failure:
12770 genlmsg_cancel(msg, hdr);
12771 return -EMSGSIZE;
12772 }
12773
nl80211_send_scan_start(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev)12774 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
12775 struct wireless_dev *wdev)
12776 {
12777 struct sk_buff *msg;
12778
12779 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12780 if (!msg)
12781 return;
12782
12783 if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
12784 NL80211_CMD_TRIGGER_SCAN) < 0) {
12785 nlmsg_free(msg);
12786 return;
12787 }
12788
12789 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12790 NL80211_MCGRP_SCAN, GFP_KERNEL);
12791 }
12792
nl80211_build_scan_msg(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,bool aborted)12793 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
12794 struct wireless_dev *wdev, bool aborted)
12795 {
12796 struct sk_buff *msg;
12797
12798 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12799 if (!msg)
12800 return NULL;
12801
12802 if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
12803 aborted ? NL80211_CMD_SCAN_ABORTED :
12804 NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
12805 nlmsg_free(msg);
12806 return NULL;
12807 }
12808
12809 return msg;
12810 }
12811
nl80211_send_scan_result(struct cfg80211_registered_device * rdev,struct sk_buff * msg)12812 void nl80211_send_scan_result(struct cfg80211_registered_device *rdev,
12813 struct sk_buff *msg)
12814 {
12815 if (!msg)
12816 return;
12817
12818 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12819 NL80211_MCGRP_SCAN, GFP_KERNEL);
12820 }
12821
nl80211_send_sched_scan_results(struct cfg80211_registered_device * rdev,struct net_device * netdev)12822 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
12823 struct net_device *netdev)
12824 {
12825 struct sk_buff *msg;
12826
12827 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12828 if (!msg)
12829 return;
12830
12831 if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
12832 NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
12833 nlmsg_free(msg);
12834 return;
12835 }
12836
12837 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12838 NL80211_MCGRP_SCAN, GFP_KERNEL);
12839 }
12840
nl80211_send_sched_scan(struct cfg80211_registered_device * rdev,struct net_device * netdev,u32 cmd)12841 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
12842 struct net_device *netdev, u32 cmd)
12843 {
12844 struct sk_buff *msg;
12845
12846 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12847 if (!msg)
12848 return;
12849
12850 if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
12851 nlmsg_free(msg);
12852 return;
12853 }
12854
12855 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12856 NL80211_MCGRP_SCAN, GFP_KERNEL);
12857 }
12858
nl80211_reg_change_event_fill(struct sk_buff * msg,struct regulatory_request * request)12859 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
12860 struct regulatory_request *request)
12861 {
12862 /* Userspace can always count this one always being set */
12863 if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
12864 goto nla_put_failure;
12865
12866 if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
12867 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
12868 NL80211_REGDOM_TYPE_WORLD))
12869 goto nla_put_failure;
12870 } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
12871 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
12872 NL80211_REGDOM_TYPE_CUSTOM_WORLD))
12873 goto nla_put_failure;
12874 } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
12875 request->intersect) {
12876 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
12877 NL80211_REGDOM_TYPE_INTERSECTION))
12878 goto nla_put_failure;
12879 } else {
12880 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
12881 NL80211_REGDOM_TYPE_COUNTRY) ||
12882 nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
12883 request->alpha2))
12884 goto nla_put_failure;
12885 }
12886
12887 if (request->wiphy_idx != WIPHY_IDX_INVALID) {
12888 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
12889
12890 if (wiphy &&
12891 nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
12892 goto nla_put_failure;
12893
12894 if (wiphy &&
12895 wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
12896 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
12897 goto nla_put_failure;
12898 }
12899
12900 return true;
12901
12902 nla_put_failure:
12903 return false;
12904 }
12905
12906 /*
12907 * This can happen on global regulatory changes or device specific settings
12908 * based on custom regulatory domains.
12909 */
nl80211_common_reg_change_event(enum nl80211_commands cmd_id,struct regulatory_request * request)12910 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
12911 struct regulatory_request *request)
12912 {
12913 struct sk_buff *msg;
12914 void *hdr;
12915
12916 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12917 if (!msg)
12918 return;
12919
12920 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
12921 if (!hdr) {
12922 nlmsg_free(msg);
12923 return;
12924 }
12925
12926 if (nl80211_reg_change_event_fill(msg, request) == false)
12927 goto nla_put_failure;
12928
12929 genlmsg_end(msg, hdr);
12930
12931 rcu_read_lock();
12932 genlmsg_multicast_allns(&nl80211_fam, msg, 0,
12933 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
12934 rcu_read_unlock();
12935
12936 return;
12937
12938 nla_put_failure:
12939 genlmsg_cancel(msg, hdr);
12940 nlmsg_free(msg);
12941 }
12942
nl80211_send_mlme_event(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,enum nl80211_commands cmd,gfp_t gfp,int uapsd_queues)12943 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
12944 struct net_device *netdev,
12945 const u8 *buf, size_t len,
12946 enum nl80211_commands cmd, gfp_t gfp,
12947 int uapsd_queues)
12948 {
12949 struct sk_buff *msg;
12950 void *hdr;
12951
12952 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12953 if (!msg)
12954 return;
12955
12956 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
12957 if (!hdr) {
12958 nlmsg_free(msg);
12959 return;
12960 }
12961
12962 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12963 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12964 nla_put(msg, NL80211_ATTR_FRAME, len, buf))
12965 goto nla_put_failure;
12966
12967 if (uapsd_queues >= 0) {
12968 struct nlattr *nla_wmm =
12969 nla_nest_start(msg, NL80211_ATTR_STA_WME);
12970 if (!nla_wmm)
12971 goto nla_put_failure;
12972
12973 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
12974 uapsd_queues))
12975 goto nla_put_failure;
12976
12977 nla_nest_end(msg, nla_wmm);
12978 }
12979
12980 genlmsg_end(msg, hdr);
12981
12982 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12983 NL80211_MCGRP_MLME, gfp);
12984 return;
12985
12986 nla_put_failure:
12987 genlmsg_cancel(msg, hdr);
12988 nlmsg_free(msg);
12989 }
12990
nl80211_send_rx_auth(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,gfp_t gfp)12991 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
12992 struct net_device *netdev, const u8 *buf,
12993 size_t len, gfp_t gfp)
12994 {
12995 nl80211_send_mlme_event(rdev, netdev, buf, len,
12996 NL80211_CMD_AUTHENTICATE, gfp, -1);
12997 }
12998
nl80211_send_rx_assoc(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,gfp_t gfp,int uapsd_queues)12999 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
13000 struct net_device *netdev, const u8 *buf,
13001 size_t len, gfp_t gfp, int uapsd_queues)
13002 {
13003 nl80211_send_mlme_event(rdev, netdev, buf, len,
13004 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues);
13005 }
13006
nl80211_send_deauth(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,gfp_t gfp)13007 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
13008 struct net_device *netdev, const u8 *buf,
13009 size_t len, gfp_t gfp)
13010 {
13011 nl80211_send_mlme_event(rdev, netdev, buf, len,
13012 NL80211_CMD_DEAUTHENTICATE, gfp, -1);
13013 }
13014
nl80211_send_disassoc(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,gfp_t gfp)13015 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
13016 struct net_device *netdev, const u8 *buf,
13017 size_t len, gfp_t gfp)
13018 {
13019 nl80211_send_mlme_event(rdev, netdev, buf, len,
13020 NL80211_CMD_DISASSOCIATE, gfp, -1);
13021 }
13022
cfg80211_rx_unprot_mlme_mgmt(struct net_device * dev,const u8 * buf,size_t len)13023 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
13024 size_t len)
13025 {
13026 struct wireless_dev *wdev = dev->ieee80211_ptr;
13027 struct wiphy *wiphy = wdev->wiphy;
13028 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13029 const struct ieee80211_mgmt *mgmt = (void *)buf;
13030 u32 cmd;
13031
13032 if (WARN_ON(len < 2))
13033 return;
13034
13035 if (ieee80211_is_deauth(mgmt->frame_control))
13036 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
13037 else
13038 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
13039
13040 trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
13041 nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1);
13042 }
13043 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
13044
nl80211_send_mlme_timeout(struct cfg80211_registered_device * rdev,struct net_device * netdev,int cmd,const u8 * addr,gfp_t gfp)13045 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
13046 struct net_device *netdev, int cmd,
13047 const u8 *addr, gfp_t gfp)
13048 {
13049 struct sk_buff *msg;
13050 void *hdr;
13051
13052 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13053 if (!msg)
13054 return;
13055
13056 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
13057 if (!hdr) {
13058 nlmsg_free(msg);
13059 return;
13060 }
13061
13062 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13063 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13064 nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
13065 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
13066 goto nla_put_failure;
13067
13068 genlmsg_end(msg, hdr);
13069
13070 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13071 NL80211_MCGRP_MLME, gfp);
13072 return;
13073
13074 nla_put_failure:
13075 genlmsg_cancel(msg, hdr);
13076 nlmsg_free(msg);
13077 }
13078
nl80211_send_auth_timeout(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * addr,gfp_t gfp)13079 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
13080 struct net_device *netdev, const u8 *addr,
13081 gfp_t gfp)
13082 {
13083 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
13084 addr, gfp);
13085 }
13086
nl80211_send_assoc_timeout(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * addr,gfp_t gfp)13087 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
13088 struct net_device *netdev, const u8 *addr,
13089 gfp_t gfp)
13090 {
13091 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
13092 addr, gfp);
13093 }
13094
nl80211_send_connect_result(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * bssid,const u8 * req_ie,size_t req_ie_len,const u8 * resp_ie,size_t resp_ie_len,int status,gfp_t gfp)13095 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
13096 struct net_device *netdev, const u8 *bssid,
13097 const u8 *req_ie, size_t req_ie_len,
13098 const u8 *resp_ie, size_t resp_ie_len,
13099 int status, gfp_t gfp)
13100 {
13101 struct sk_buff *msg;
13102 void *hdr;
13103
13104 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13105 if (!msg)
13106 return;
13107
13108 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
13109 if (!hdr) {
13110 nlmsg_free(msg);
13111 return;
13112 }
13113
13114 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13115 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13116 (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
13117 nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
13118 status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
13119 status) ||
13120 (status < 0 && nla_put_flag(msg, NL80211_ATTR_TIMED_OUT)) ||
13121 (req_ie &&
13122 nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
13123 (resp_ie &&
13124 nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
13125 goto nla_put_failure;
13126
13127 genlmsg_end(msg, hdr);
13128
13129 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13130 NL80211_MCGRP_MLME, gfp);
13131 return;
13132
13133 nla_put_failure:
13134 genlmsg_cancel(msg, hdr);
13135 nlmsg_free(msg);
13136 }
13137
nl80211_send_roamed(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * bssid,const u8 * req_ie,size_t req_ie_len,const u8 * resp_ie,size_t resp_ie_len,gfp_t gfp)13138 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
13139 struct net_device *netdev, const u8 *bssid,
13140 const u8 *req_ie, size_t req_ie_len,
13141 const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
13142 {
13143 struct sk_buff *msg;
13144 void *hdr;
13145
13146 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13147 if (!msg)
13148 return;
13149
13150 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
13151 if (!hdr) {
13152 nlmsg_free(msg);
13153 return;
13154 }
13155
13156 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13157 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13158 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
13159 (req_ie &&
13160 nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
13161 (resp_ie &&
13162 nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
13163 goto nla_put_failure;
13164
13165 genlmsg_end(msg, hdr);
13166
13167 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13168 NL80211_MCGRP_MLME, gfp);
13169 return;
13170
13171 nla_put_failure:
13172 genlmsg_cancel(msg, hdr);
13173 nlmsg_free(msg);
13174 }
13175
nl80211_send_disconnected(struct cfg80211_registered_device * rdev,struct net_device * netdev,u16 reason,const u8 * ie,size_t ie_len,bool from_ap)13176 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
13177 struct net_device *netdev, u16 reason,
13178 const u8 *ie, size_t ie_len, bool from_ap)
13179 {
13180 struct sk_buff *msg;
13181 void *hdr;
13182
13183 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13184 if (!msg)
13185 return;
13186
13187 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
13188 if (!hdr) {
13189 nlmsg_free(msg);
13190 return;
13191 }
13192
13193 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13194 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13195 (from_ap && reason &&
13196 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
13197 (from_ap &&
13198 nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
13199 (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
13200 goto nla_put_failure;
13201
13202 genlmsg_end(msg, hdr);
13203
13204 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13205 NL80211_MCGRP_MLME, GFP_KERNEL);
13206 return;
13207
13208 nla_put_failure:
13209 genlmsg_cancel(msg, hdr);
13210 nlmsg_free(msg);
13211 }
13212
nl80211_send_ibss_bssid(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * bssid,gfp_t gfp)13213 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
13214 struct net_device *netdev, const u8 *bssid,
13215 gfp_t gfp)
13216 {
13217 struct sk_buff *msg;
13218 void *hdr;
13219
13220 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13221 if (!msg)
13222 return;
13223
13224 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
13225 if (!hdr) {
13226 nlmsg_free(msg);
13227 return;
13228 }
13229
13230 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13231 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13232 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
13233 goto nla_put_failure;
13234
13235 genlmsg_end(msg, hdr);
13236
13237 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13238 NL80211_MCGRP_MLME, gfp);
13239 return;
13240
13241 nla_put_failure:
13242 genlmsg_cancel(msg, hdr);
13243 nlmsg_free(msg);
13244 }
13245
cfg80211_notify_new_peer_candidate(struct net_device * dev,const u8 * addr,const u8 * ie,u8 ie_len,gfp_t gfp)13246 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
13247 const u8* ie, u8 ie_len, gfp_t gfp)
13248 {
13249 struct wireless_dev *wdev = dev->ieee80211_ptr;
13250 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
13251 struct sk_buff *msg;
13252 void *hdr;
13253
13254 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
13255 return;
13256
13257 trace_cfg80211_notify_new_peer_candidate(dev, addr);
13258
13259 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13260 if (!msg)
13261 return;
13262
13263 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
13264 if (!hdr) {
13265 nlmsg_free(msg);
13266 return;
13267 }
13268
13269 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13270 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
13271 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
13272 (ie_len && ie &&
13273 nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
13274 goto nla_put_failure;
13275
13276 genlmsg_end(msg, hdr);
13277
13278 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13279 NL80211_MCGRP_MLME, gfp);
13280 return;
13281
13282 nla_put_failure:
13283 genlmsg_cancel(msg, hdr);
13284 nlmsg_free(msg);
13285 }
13286 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
13287
nl80211_michael_mic_failure(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * addr,enum nl80211_key_type key_type,int key_id,const u8 * tsc,gfp_t gfp)13288 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
13289 struct net_device *netdev, const u8 *addr,
13290 enum nl80211_key_type key_type, int key_id,
13291 const u8 *tsc, gfp_t gfp)
13292 {
13293 struct sk_buff *msg;
13294 void *hdr;
13295
13296 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13297 if (!msg)
13298 return;
13299
13300 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
13301 if (!hdr) {
13302 nlmsg_free(msg);
13303 return;
13304 }
13305
13306 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13307 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13308 (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
13309 nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
13310 (key_id != -1 &&
13311 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
13312 (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
13313 goto nla_put_failure;
13314
13315 genlmsg_end(msg, hdr);
13316
13317 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13318 NL80211_MCGRP_MLME, gfp);
13319 return;
13320
13321 nla_put_failure:
13322 genlmsg_cancel(msg, hdr);
13323 nlmsg_free(msg);
13324 }
13325
nl80211_send_beacon_hint_event(struct wiphy * wiphy,struct ieee80211_channel * channel_before,struct ieee80211_channel * channel_after)13326 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
13327 struct ieee80211_channel *channel_before,
13328 struct ieee80211_channel *channel_after)
13329 {
13330 struct sk_buff *msg;
13331 void *hdr;
13332 struct nlattr *nl_freq;
13333
13334 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
13335 if (!msg)
13336 return;
13337
13338 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
13339 if (!hdr) {
13340 nlmsg_free(msg);
13341 return;
13342 }
13343
13344 /*
13345 * Since we are applying the beacon hint to a wiphy we know its
13346 * wiphy_idx is valid
13347 */
13348 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
13349 goto nla_put_failure;
13350
13351 /* Before */
13352 nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
13353 if (!nl_freq)
13354 goto nla_put_failure;
13355 if (nl80211_msg_put_channel(msg, channel_before, false))
13356 goto nla_put_failure;
13357 nla_nest_end(msg, nl_freq);
13358
13359 /* After */
13360 nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
13361 if (!nl_freq)
13362 goto nla_put_failure;
13363 if (nl80211_msg_put_channel(msg, channel_after, false))
13364 goto nla_put_failure;
13365 nla_nest_end(msg, nl_freq);
13366
13367 genlmsg_end(msg, hdr);
13368
13369 rcu_read_lock();
13370 genlmsg_multicast_allns(&nl80211_fam, msg, 0,
13371 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
13372 rcu_read_unlock();
13373
13374 return;
13375
13376 nla_put_failure:
13377 genlmsg_cancel(msg, hdr);
13378 nlmsg_free(msg);
13379 }
13380
nl80211_send_remain_on_chan_event(int cmd,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,unsigned int duration,gfp_t gfp)13381 static void nl80211_send_remain_on_chan_event(
13382 int cmd, struct cfg80211_registered_device *rdev,
13383 struct wireless_dev *wdev, u64 cookie,
13384 struct ieee80211_channel *chan,
13385 unsigned int duration, gfp_t gfp)
13386 {
13387 struct sk_buff *msg;
13388 void *hdr;
13389
13390 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13391 if (!msg)
13392 return;
13393
13394 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
13395 if (!hdr) {
13396 nlmsg_free(msg);
13397 return;
13398 }
13399
13400 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13401 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
13402 wdev->netdev->ifindex)) ||
13403 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
13404 NL80211_ATTR_PAD) ||
13405 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
13406 nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
13407 NL80211_CHAN_NO_HT) ||
13408 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
13409 NL80211_ATTR_PAD))
13410 goto nla_put_failure;
13411
13412 if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
13413 nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
13414 goto nla_put_failure;
13415
13416 genlmsg_end(msg, hdr);
13417
13418 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13419 NL80211_MCGRP_MLME, gfp);
13420 return;
13421
13422 nla_put_failure:
13423 genlmsg_cancel(msg, hdr);
13424 nlmsg_free(msg);
13425 }
13426
cfg80211_ready_on_channel(struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,unsigned int duration,gfp_t gfp)13427 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
13428 struct ieee80211_channel *chan,
13429 unsigned int duration, gfp_t gfp)
13430 {
13431 struct wiphy *wiphy = wdev->wiphy;
13432 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13433
13434 trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
13435 nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
13436 rdev, wdev, cookie, chan,
13437 duration, gfp);
13438 }
13439 EXPORT_SYMBOL(cfg80211_ready_on_channel);
13440
cfg80211_remain_on_channel_expired(struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,gfp_t gfp)13441 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
13442 struct ieee80211_channel *chan,
13443 gfp_t gfp)
13444 {
13445 struct wiphy *wiphy = wdev->wiphy;
13446 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13447
13448 trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
13449 nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
13450 rdev, wdev, cookie, chan, 0, gfp);
13451 }
13452 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
13453
cfg80211_new_sta(struct net_device * dev,const u8 * mac_addr,struct station_info * sinfo,gfp_t gfp)13454 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
13455 struct station_info *sinfo, gfp_t gfp)
13456 {
13457 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
13458 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13459 struct sk_buff *msg;
13460
13461 trace_cfg80211_new_sta(dev, mac_addr, sinfo);
13462
13463 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13464 if (!msg)
13465 return;
13466
13467 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
13468 rdev, dev, mac_addr, sinfo) < 0) {
13469 nlmsg_free(msg);
13470 return;
13471 }
13472
13473 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13474 NL80211_MCGRP_MLME, gfp);
13475 }
13476 EXPORT_SYMBOL(cfg80211_new_sta);
13477
cfg80211_del_sta_sinfo(struct net_device * dev,const u8 * mac_addr,struct station_info * sinfo,gfp_t gfp)13478 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
13479 struct station_info *sinfo, gfp_t gfp)
13480 {
13481 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
13482 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13483 struct sk_buff *msg;
13484 struct station_info empty_sinfo = {};
13485
13486 if (!sinfo)
13487 sinfo = &empty_sinfo;
13488
13489 trace_cfg80211_del_sta(dev, mac_addr);
13490
13491 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13492 if (!msg)
13493 return;
13494
13495 if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
13496 rdev, dev, mac_addr, sinfo) < 0) {
13497 nlmsg_free(msg);
13498 return;
13499 }
13500
13501 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13502 NL80211_MCGRP_MLME, gfp);
13503 }
13504 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
13505
cfg80211_conn_failed(struct net_device * dev,const u8 * mac_addr,enum nl80211_connect_failed_reason reason,gfp_t gfp)13506 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
13507 enum nl80211_connect_failed_reason reason,
13508 gfp_t gfp)
13509 {
13510 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
13511 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13512 struct sk_buff *msg;
13513 void *hdr;
13514
13515 msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
13516 if (!msg)
13517 return;
13518
13519 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
13520 if (!hdr) {
13521 nlmsg_free(msg);
13522 return;
13523 }
13524
13525 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
13526 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
13527 nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
13528 goto nla_put_failure;
13529
13530 genlmsg_end(msg, hdr);
13531
13532 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13533 NL80211_MCGRP_MLME, gfp);
13534 return;
13535
13536 nla_put_failure:
13537 genlmsg_cancel(msg, hdr);
13538 nlmsg_free(msg);
13539 }
13540 EXPORT_SYMBOL(cfg80211_conn_failed);
13541
__nl80211_unexpected_frame(struct net_device * dev,u8 cmd,const u8 * addr,gfp_t gfp)13542 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
13543 const u8 *addr, gfp_t gfp)
13544 {
13545 struct wireless_dev *wdev = dev->ieee80211_ptr;
13546 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
13547 struct sk_buff *msg;
13548 void *hdr;
13549 u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
13550
13551 if (!nlportid)
13552 return false;
13553
13554 msg = nlmsg_new(100, gfp);
13555 if (!msg)
13556 return true;
13557
13558 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
13559 if (!hdr) {
13560 nlmsg_free(msg);
13561 return true;
13562 }
13563
13564 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13565 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
13566 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
13567 goto nla_put_failure;
13568
13569 genlmsg_end(msg, hdr);
13570 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
13571 return true;
13572
13573 nla_put_failure:
13574 genlmsg_cancel(msg, hdr);
13575 nlmsg_free(msg);
13576 return true;
13577 }
13578
cfg80211_rx_spurious_frame(struct net_device * dev,const u8 * addr,gfp_t gfp)13579 bool cfg80211_rx_spurious_frame(struct net_device *dev,
13580 const u8 *addr, gfp_t gfp)
13581 {
13582 struct wireless_dev *wdev = dev->ieee80211_ptr;
13583 bool ret;
13584
13585 trace_cfg80211_rx_spurious_frame(dev, addr);
13586
13587 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
13588 wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
13589 trace_cfg80211_return_bool(false);
13590 return false;
13591 }
13592 ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
13593 addr, gfp);
13594 trace_cfg80211_return_bool(ret);
13595 return ret;
13596 }
13597 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
13598
cfg80211_rx_unexpected_4addr_frame(struct net_device * dev,const u8 * addr,gfp_t gfp)13599 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
13600 const u8 *addr, gfp_t gfp)
13601 {
13602 struct wireless_dev *wdev = dev->ieee80211_ptr;
13603 bool ret;
13604
13605 trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
13606
13607 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
13608 wdev->iftype != NL80211_IFTYPE_P2P_GO &&
13609 wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
13610 trace_cfg80211_return_bool(false);
13611 return false;
13612 }
13613 ret = __nl80211_unexpected_frame(dev,
13614 NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
13615 addr, gfp);
13616 trace_cfg80211_return_bool(ret);
13617 return ret;
13618 }
13619 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
13620
nl80211_send_mgmt(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,u32 nlportid,int freq,int sig_dbm,const u8 * buf,size_t len,u32 flags,gfp_t gfp)13621 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
13622 struct wireless_dev *wdev, u32 nlportid,
13623 int freq, int sig_dbm,
13624 const u8 *buf, size_t len, u32 flags, gfp_t gfp)
13625 {
13626 struct net_device *netdev = wdev->netdev;
13627 struct sk_buff *msg;
13628 void *hdr;
13629
13630 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13631 if (!msg)
13632 return -ENOMEM;
13633
13634 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
13635 if (!hdr) {
13636 nlmsg_free(msg);
13637 return -ENOMEM;
13638 }
13639
13640 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13641 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
13642 netdev->ifindex)) ||
13643 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
13644 NL80211_ATTR_PAD) ||
13645 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
13646 (sig_dbm &&
13647 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
13648 nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
13649 (flags &&
13650 nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
13651 goto nla_put_failure;
13652
13653 genlmsg_end(msg, hdr);
13654
13655 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
13656
13657 nla_put_failure:
13658 genlmsg_cancel(msg, hdr);
13659 nlmsg_free(msg);
13660 return -ENOBUFS;
13661 }
13662
cfg80211_mgmt_tx_status(struct wireless_dev * wdev,u64 cookie,const u8 * buf,size_t len,bool ack,gfp_t gfp)13663 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
13664 const u8 *buf, size_t len, bool ack, gfp_t gfp)
13665 {
13666 struct wiphy *wiphy = wdev->wiphy;
13667 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13668 struct net_device *netdev = wdev->netdev;
13669 struct sk_buff *msg;
13670 void *hdr;
13671
13672 trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
13673
13674 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13675 if (!msg)
13676 return;
13677
13678 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
13679 if (!hdr) {
13680 nlmsg_free(msg);
13681 return;
13682 }
13683
13684 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13685 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
13686 netdev->ifindex)) ||
13687 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
13688 NL80211_ATTR_PAD) ||
13689 nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
13690 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
13691 NL80211_ATTR_PAD) ||
13692 (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
13693 goto nla_put_failure;
13694
13695 genlmsg_end(msg, hdr);
13696
13697 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13698 NL80211_MCGRP_MLME, gfp);
13699 return;
13700
13701 nla_put_failure:
13702 genlmsg_cancel(msg, hdr);
13703 nlmsg_free(msg);
13704 }
13705 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
13706
cfg80211_prepare_cqm(struct net_device * dev,const char * mac,gfp_t gfp)13707 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
13708 const char *mac, gfp_t gfp)
13709 {
13710 struct wireless_dev *wdev = dev->ieee80211_ptr;
13711 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
13712 struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13713 void **cb;
13714
13715 if (!msg)
13716 return NULL;
13717
13718 cb = (void **)msg->cb;
13719
13720 cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
13721 if (!cb[0]) {
13722 nlmsg_free(msg);
13723 return NULL;
13724 }
13725
13726 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13727 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
13728 goto nla_put_failure;
13729
13730 if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
13731 goto nla_put_failure;
13732
13733 cb[1] = nla_nest_start(msg, NL80211_ATTR_CQM);
13734 if (!cb[1])
13735 goto nla_put_failure;
13736
13737 cb[2] = rdev;
13738
13739 return msg;
13740 nla_put_failure:
13741 nlmsg_free(msg);
13742 return NULL;
13743 }
13744
cfg80211_send_cqm(struct sk_buff * msg,gfp_t gfp)13745 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
13746 {
13747 void **cb = (void **)msg->cb;
13748 struct cfg80211_registered_device *rdev = cb[2];
13749
13750 nla_nest_end(msg, cb[1]);
13751 genlmsg_end(msg, cb[0]);
13752
13753 memset(msg->cb, 0, sizeof(msg->cb));
13754
13755 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13756 NL80211_MCGRP_MLME, gfp);
13757 }
13758
cfg80211_cqm_rssi_notify(struct net_device * dev,enum nl80211_cqm_rssi_threshold_event rssi_event,gfp_t gfp)13759 void cfg80211_cqm_rssi_notify(struct net_device *dev,
13760 enum nl80211_cqm_rssi_threshold_event rssi_event,
13761 gfp_t gfp)
13762 {
13763 struct sk_buff *msg;
13764
13765 trace_cfg80211_cqm_rssi_notify(dev, rssi_event);
13766
13767 if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
13768 rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
13769 return;
13770
13771 msg = cfg80211_prepare_cqm(dev, NULL, gfp);
13772 if (!msg)
13773 return;
13774
13775 if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
13776 rssi_event))
13777 goto nla_put_failure;
13778
13779 cfg80211_send_cqm(msg, gfp);
13780
13781 return;
13782
13783 nla_put_failure:
13784 nlmsg_free(msg);
13785 }
13786 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
13787
cfg80211_cqm_txe_notify(struct net_device * dev,const u8 * peer,u32 num_packets,u32 rate,u32 intvl,gfp_t gfp)13788 void cfg80211_cqm_txe_notify(struct net_device *dev,
13789 const u8 *peer, u32 num_packets,
13790 u32 rate, u32 intvl, gfp_t gfp)
13791 {
13792 struct sk_buff *msg;
13793
13794 msg = cfg80211_prepare_cqm(dev, peer, gfp);
13795 if (!msg)
13796 return;
13797
13798 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
13799 goto nla_put_failure;
13800
13801 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
13802 goto nla_put_failure;
13803
13804 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
13805 goto nla_put_failure;
13806
13807 cfg80211_send_cqm(msg, gfp);
13808 return;
13809
13810 nla_put_failure:
13811 nlmsg_free(msg);
13812 }
13813 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
13814
cfg80211_cqm_pktloss_notify(struct net_device * dev,const u8 * peer,u32 num_packets,gfp_t gfp)13815 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
13816 const u8 *peer, u32 num_packets, gfp_t gfp)
13817 {
13818 struct sk_buff *msg;
13819
13820 trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
13821
13822 msg = cfg80211_prepare_cqm(dev, peer, gfp);
13823 if (!msg)
13824 return;
13825
13826 if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
13827 goto nla_put_failure;
13828
13829 cfg80211_send_cqm(msg, gfp);
13830 return;
13831
13832 nla_put_failure:
13833 nlmsg_free(msg);
13834 }
13835 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
13836
cfg80211_cqm_beacon_loss_notify(struct net_device * dev,gfp_t gfp)13837 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
13838 {
13839 struct sk_buff *msg;
13840
13841 msg = cfg80211_prepare_cqm(dev, NULL, gfp);
13842 if (!msg)
13843 return;
13844
13845 if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
13846 goto nla_put_failure;
13847
13848 cfg80211_send_cqm(msg, gfp);
13849 return;
13850
13851 nla_put_failure:
13852 nlmsg_free(msg);
13853 }
13854 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
13855
nl80211_gtk_rekey_notify(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * bssid,const u8 * replay_ctr,gfp_t gfp)13856 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
13857 struct net_device *netdev, const u8 *bssid,
13858 const u8 *replay_ctr, gfp_t gfp)
13859 {
13860 struct sk_buff *msg;
13861 struct nlattr *rekey_attr;
13862 void *hdr;
13863
13864 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13865 if (!msg)
13866 return;
13867
13868 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
13869 if (!hdr) {
13870 nlmsg_free(msg);
13871 return;
13872 }
13873
13874 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13875 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13876 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
13877 goto nla_put_failure;
13878
13879 rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
13880 if (!rekey_attr)
13881 goto nla_put_failure;
13882
13883 if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
13884 NL80211_REPLAY_CTR_LEN, replay_ctr))
13885 goto nla_put_failure;
13886
13887 nla_nest_end(msg, rekey_attr);
13888
13889 genlmsg_end(msg, hdr);
13890
13891 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13892 NL80211_MCGRP_MLME, gfp);
13893 return;
13894
13895 nla_put_failure:
13896 genlmsg_cancel(msg, hdr);
13897 nlmsg_free(msg);
13898 }
13899
cfg80211_gtk_rekey_notify(struct net_device * dev,const u8 * bssid,const u8 * replay_ctr,gfp_t gfp)13900 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
13901 const u8 *replay_ctr, gfp_t gfp)
13902 {
13903 struct wireless_dev *wdev = dev->ieee80211_ptr;
13904 struct wiphy *wiphy = wdev->wiphy;
13905 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13906
13907 trace_cfg80211_gtk_rekey_notify(dev, bssid);
13908 nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
13909 }
13910 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
13911
13912 static void
nl80211_pmksa_candidate_notify(struct cfg80211_registered_device * rdev,struct net_device * netdev,int index,const u8 * bssid,bool preauth,gfp_t gfp)13913 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
13914 struct net_device *netdev, int index,
13915 const u8 *bssid, bool preauth, gfp_t gfp)
13916 {
13917 struct sk_buff *msg;
13918 struct nlattr *attr;
13919 void *hdr;
13920
13921 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13922 if (!msg)
13923 return;
13924
13925 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
13926 if (!hdr) {
13927 nlmsg_free(msg);
13928 return;
13929 }
13930
13931 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13932 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
13933 goto nla_put_failure;
13934
13935 attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
13936 if (!attr)
13937 goto nla_put_failure;
13938
13939 if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
13940 nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
13941 (preauth &&
13942 nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
13943 goto nla_put_failure;
13944
13945 nla_nest_end(msg, attr);
13946
13947 genlmsg_end(msg, hdr);
13948
13949 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13950 NL80211_MCGRP_MLME, gfp);
13951 return;
13952
13953 nla_put_failure:
13954 genlmsg_cancel(msg, hdr);
13955 nlmsg_free(msg);
13956 }
13957
cfg80211_pmksa_candidate_notify(struct net_device * dev,int index,const u8 * bssid,bool preauth,gfp_t gfp)13958 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
13959 const u8 *bssid, bool preauth, gfp_t gfp)
13960 {
13961 struct wireless_dev *wdev = dev->ieee80211_ptr;
13962 struct wiphy *wiphy = wdev->wiphy;
13963 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13964
13965 trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
13966 nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
13967 }
13968 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
13969
nl80211_ch_switch_notify(struct cfg80211_registered_device * rdev,struct net_device * netdev,struct cfg80211_chan_def * chandef,gfp_t gfp,enum nl80211_commands notif,u8 count)13970 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
13971 struct net_device *netdev,
13972 struct cfg80211_chan_def *chandef,
13973 gfp_t gfp,
13974 enum nl80211_commands notif,
13975 u8 count)
13976 {
13977 struct sk_buff *msg;
13978 void *hdr;
13979
13980 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13981 if (!msg)
13982 return;
13983
13984 hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
13985 if (!hdr) {
13986 nlmsg_free(msg);
13987 return;
13988 }
13989
13990 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
13991 goto nla_put_failure;
13992
13993 if (nl80211_send_chandef(msg, chandef))
13994 goto nla_put_failure;
13995
13996 if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) &&
13997 (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)))
13998 goto nla_put_failure;
13999
14000 genlmsg_end(msg, hdr);
14001
14002 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14003 NL80211_MCGRP_MLME, gfp);
14004 return;
14005
14006 nla_put_failure:
14007 genlmsg_cancel(msg, hdr);
14008 nlmsg_free(msg);
14009 }
14010
cfg80211_ch_switch_notify(struct net_device * dev,struct cfg80211_chan_def * chandef)14011 void cfg80211_ch_switch_notify(struct net_device *dev,
14012 struct cfg80211_chan_def *chandef)
14013 {
14014 struct wireless_dev *wdev = dev->ieee80211_ptr;
14015 struct wiphy *wiphy = wdev->wiphy;
14016 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14017
14018 ASSERT_WDEV_LOCK(wdev);
14019
14020 trace_cfg80211_ch_switch_notify(dev, chandef);
14021
14022 wdev->chandef = *chandef;
14023 wdev->preset_chandef = *chandef;
14024 nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
14025 NL80211_CMD_CH_SWITCH_NOTIFY, 0);
14026 }
14027 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
14028
cfg80211_ch_switch_started_notify(struct net_device * dev,struct cfg80211_chan_def * chandef,u8 count)14029 void cfg80211_ch_switch_started_notify(struct net_device *dev,
14030 struct cfg80211_chan_def *chandef,
14031 u8 count)
14032 {
14033 struct wireless_dev *wdev = dev->ieee80211_ptr;
14034 struct wiphy *wiphy = wdev->wiphy;
14035 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14036
14037 trace_cfg80211_ch_switch_started_notify(dev, chandef);
14038
14039 nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
14040 NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count);
14041 }
14042 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
14043
14044 void
nl80211_radar_notify(struct cfg80211_registered_device * rdev,const struct cfg80211_chan_def * chandef,enum nl80211_radar_event event,struct net_device * netdev,gfp_t gfp)14045 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
14046 const struct cfg80211_chan_def *chandef,
14047 enum nl80211_radar_event event,
14048 struct net_device *netdev, gfp_t gfp)
14049 {
14050 struct sk_buff *msg;
14051 void *hdr;
14052
14053 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14054 if (!msg)
14055 return;
14056
14057 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
14058 if (!hdr) {
14059 nlmsg_free(msg);
14060 return;
14061 }
14062
14063 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
14064 goto nla_put_failure;
14065
14066 /* NOP and radar events don't need a netdev parameter */
14067 if (netdev) {
14068 struct wireless_dev *wdev = netdev->ieee80211_ptr;
14069
14070 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14071 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14072 NL80211_ATTR_PAD))
14073 goto nla_put_failure;
14074 }
14075
14076 if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
14077 goto nla_put_failure;
14078
14079 if (nl80211_send_chandef(msg, chandef))
14080 goto nla_put_failure;
14081
14082 genlmsg_end(msg, hdr);
14083
14084 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14085 NL80211_MCGRP_MLME, gfp);
14086 return;
14087
14088 nla_put_failure:
14089 genlmsg_cancel(msg, hdr);
14090 nlmsg_free(msg);
14091 }
14092
cfg80211_probe_status(struct net_device * dev,const u8 * addr,u64 cookie,bool acked,gfp_t gfp)14093 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
14094 u64 cookie, bool acked, gfp_t gfp)
14095 {
14096 struct wireless_dev *wdev = dev->ieee80211_ptr;
14097 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14098 struct sk_buff *msg;
14099 void *hdr;
14100
14101 trace_cfg80211_probe_status(dev, addr, cookie, acked);
14102
14103 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14104
14105 if (!msg)
14106 return;
14107
14108 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
14109 if (!hdr) {
14110 nlmsg_free(msg);
14111 return;
14112 }
14113
14114 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14115 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14116 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
14117 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14118 NL80211_ATTR_PAD) ||
14119 (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
14120 goto nla_put_failure;
14121
14122 genlmsg_end(msg, hdr);
14123
14124 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14125 NL80211_MCGRP_MLME, gfp);
14126 return;
14127
14128 nla_put_failure:
14129 genlmsg_cancel(msg, hdr);
14130 nlmsg_free(msg);
14131 }
14132 EXPORT_SYMBOL(cfg80211_probe_status);
14133
cfg80211_report_obss_beacon(struct wiphy * wiphy,const u8 * frame,size_t len,int freq,int sig_dbm)14134 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
14135 const u8 *frame, size_t len,
14136 int freq, int sig_dbm)
14137 {
14138 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14139 struct sk_buff *msg;
14140 void *hdr;
14141 struct cfg80211_beacon_registration *reg;
14142
14143 trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
14144
14145 spin_lock_bh(&rdev->beacon_registrations_lock);
14146 list_for_each_entry(reg, &rdev->beacon_registrations, list) {
14147 msg = nlmsg_new(len + 100, GFP_ATOMIC);
14148 if (!msg) {
14149 spin_unlock_bh(&rdev->beacon_registrations_lock);
14150 return;
14151 }
14152
14153 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
14154 if (!hdr)
14155 goto nla_put_failure;
14156
14157 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14158 (freq &&
14159 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
14160 (sig_dbm &&
14161 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
14162 nla_put(msg, NL80211_ATTR_FRAME, len, frame))
14163 goto nla_put_failure;
14164
14165 genlmsg_end(msg, hdr);
14166
14167 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
14168 }
14169 spin_unlock_bh(&rdev->beacon_registrations_lock);
14170 return;
14171
14172 nla_put_failure:
14173 spin_unlock_bh(&rdev->beacon_registrations_lock);
14174 if (hdr)
14175 genlmsg_cancel(msg, hdr);
14176 nlmsg_free(msg);
14177 }
14178 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
14179
14180 #ifdef CONFIG_PM
cfg80211_net_detect_results(struct sk_buff * msg,struct cfg80211_wowlan_wakeup * wakeup)14181 static int cfg80211_net_detect_results(struct sk_buff *msg,
14182 struct cfg80211_wowlan_wakeup *wakeup)
14183 {
14184 struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
14185 struct nlattr *nl_results, *nl_match, *nl_freqs;
14186 int i, j;
14187
14188 nl_results = nla_nest_start(
14189 msg, NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
14190 if (!nl_results)
14191 return -EMSGSIZE;
14192
14193 for (i = 0; i < nd->n_matches; i++) {
14194 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
14195
14196 nl_match = nla_nest_start(msg, i);
14197 if (!nl_match)
14198 break;
14199
14200 /* The SSID attribute is optional in nl80211, but for
14201 * simplicity reasons it's always present in the
14202 * cfg80211 structure. If a driver can't pass the
14203 * SSID, that needs to be changed. A zero length SSID
14204 * is still a valid SSID (wildcard), so it cannot be
14205 * used for this purpose.
14206 */
14207 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
14208 match->ssid.ssid)) {
14209 nla_nest_cancel(msg, nl_match);
14210 goto out;
14211 }
14212
14213 if (match->n_channels) {
14214 nl_freqs = nla_nest_start(
14215 msg, NL80211_ATTR_SCAN_FREQUENCIES);
14216 if (!nl_freqs) {
14217 nla_nest_cancel(msg, nl_match);
14218 goto out;
14219 }
14220
14221 for (j = 0; j < match->n_channels; j++) {
14222 if (nla_put_u32(msg, j, match->channels[j])) {
14223 nla_nest_cancel(msg, nl_freqs);
14224 nla_nest_cancel(msg, nl_match);
14225 goto out;
14226 }
14227 }
14228
14229 nla_nest_end(msg, nl_freqs);
14230 }
14231
14232 nla_nest_end(msg, nl_match);
14233 }
14234
14235 out:
14236 nla_nest_end(msg, nl_results);
14237 return 0;
14238 }
14239
cfg80211_report_wowlan_wakeup(struct wireless_dev * wdev,struct cfg80211_wowlan_wakeup * wakeup,gfp_t gfp)14240 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
14241 struct cfg80211_wowlan_wakeup *wakeup,
14242 gfp_t gfp)
14243 {
14244 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14245 struct sk_buff *msg;
14246 void *hdr;
14247 int size = 200;
14248
14249 trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
14250
14251 if (wakeup)
14252 size += wakeup->packet_present_len;
14253
14254 msg = nlmsg_new(size, gfp);
14255 if (!msg)
14256 return;
14257
14258 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
14259 if (!hdr)
14260 goto free_msg;
14261
14262 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14263 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14264 NL80211_ATTR_PAD))
14265 goto free_msg;
14266
14267 if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14268 wdev->netdev->ifindex))
14269 goto free_msg;
14270
14271 if (wakeup) {
14272 struct nlattr *reasons;
14273
14274 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
14275 if (!reasons)
14276 goto free_msg;
14277
14278 if (wakeup->disconnect &&
14279 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
14280 goto free_msg;
14281 if (wakeup->magic_pkt &&
14282 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
14283 goto free_msg;
14284 if (wakeup->gtk_rekey_failure &&
14285 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
14286 goto free_msg;
14287 if (wakeup->eap_identity_req &&
14288 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
14289 goto free_msg;
14290 if (wakeup->four_way_handshake &&
14291 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
14292 goto free_msg;
14293 if (wakeup->rfkill_release &&
14294 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
14295 goto free_msg;
14296
14297 if (wakeup->pattern_idx >= 0 &&
14298 nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
14299 wakeup->pattern_idx))
14300 goto free_msg;
14301
14302 if (wakeup->tcp_match &&
14303 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
14304 goto free_msg;
14305
14306 if (wakeup->tcp_connlost &&
14307 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
14308 goto free_msg;
14309
14310 if (wakeup->tcp_nomoretokens &&
14311 nla_put_flag(msg,
14312 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
14313 goto free_msg;
14314
14315 if (wakeup->packet) {
14316 u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
14317 u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
14318
14319 if (!wakeup->packet_80211) {
14320 pkt_attr =
14321 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
14322 len_attr =
14323 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
14324 }
14325
14326 if (wakeup->packet_len &&
14327 nla_put_u32(msg, len_attr, wakeup->packet_len))
14328 goto free_msg;
14329
14330 if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
14331 wakeup->packet))
14332 goto free_msg;
14333 }
14334
14335 if (wakeup->net_detect &&
14336 cfg80211_net_detect_results(msg, wakeup))
14337 goto free_msg;
14338
14339 nla_nest_end(msg, reasons);
14340 }
14341
14342 genlmsg_end(msg, hdr);
14343
14344 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14345 NL80211_MCGRP_MLME, gfp);
14346 return;
14347
14348 free_msg:
14349 nlmsg_free(msg);
14350 }
14351 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
14352 #endif
14353
cfg80211_tdls_oper_request(struct net_device * dev,const u8 * peer,enum nl80211_tdls_operation oper,u16 reason_code,gfp_t gfp)14354 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
14355 enum nl80211_tdls_operation oper,
14356 u16 reason_code, gfp_t gfp)
14357 {
14358 struct wireless_dev *wdev = dev->ieee80211_ptr;
14359 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14360 struct sk_buff *msg;
14361 void *hdr;
14362
14363 trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
14364 reason_code);
14365
14366 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14367 if (!msg)
14368 return;
14369
14370 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
14371 if (!hdr) {
14372 nlmsg_free(msg);
14373 return;
14374 }
14375
14376 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14377 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14378 nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
14379 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
14380 (reason_code > 0 &&
14381 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
14382 goto nla_put_failure;
14383
14384 genlmsg_end(msg, hdr);
14385
14386 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14387 NL80211_MCGRP_MLME, gfp);
14388 return;
14389
14390 nla_put_failure:
14391 genlmsg_cancel(msg, hdr);
14392 nlmsg_free(msg);
14393 }
14394 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
14395
nl80211_netlink_notify(struct notifier_block * nb,unsigned long state,void * _notify)14396 static int nl80211_netlink_notify(struct notifier_block * nb,
14397 unsigned long state,
14398 void *_notify)
14399 {
14400 struct netlink_notify *notify = _notify;
14401 struct cfg80211_registered_device *rdev;
14402 struct wireless_dev *wdev;
14403 struct cfg80211_beacon_registration *reg, *tmp;
14404
14405 if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
14406 return NOTIFY_DONE;
14407
14408 rcu_read_lock();
14409
14410 list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
14411 bool schedule_destroy_work = false;
14412 struct cfg80211_sched_scan_request *sched_scan_req =
14413 rcu_dereference(rdev->sched_scan_req);
14414
14415 if (sched_scan_req && notify->portid &&
14416 sched_scan_req->owner_nlportid == notify->portid) {
14417 sched_scan_req->owner_nlportid = 0;
14418
14419 if (rdev->ops->sched_scan_stop &&
14420 rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
14421 schedule_work(&rdev->sched_scan_stop_wk);
14422 }
14423
14424 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
14425 cfg80211_mlme_unregister_socket(wdev, notify->portid);
14426
14427 if (wdev->owner_nlportid == notify->portid)
14428 schedule_destroy_work = true;
14429 }
14430
14431 spin_lock_bh(&rdev->beacon_registrations_lock);
14432 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
14433 list) {
14434 if (reg->nlportid == notify->portid) {
14435 list_del(®->list);
14436 kfree(reg);
14437 break;
14438 }
14439 }
14440 spin_unlock_bh(&rdev->beacon_registrations_lock);
14441
14442 if (schedule_destroy_work) {
14443 struct cfg80211_iface_destroy *destroy;
14444
14445 destroy = kzalloc(sizeof(*destroy), GFP_ATOMIC);
14446 if (destroy) {
14447 destroy->nlportid = notify->portid;
14448 spin_lock(&rdev->destroy_list_lock);
14449 list_add(&destroy->list, &rdev->destroy_list);
14450 spin_unlock(&rdev->destroy_list_lock);
14451 schedule_work(&rdev->destroy_work);
14452 }
14453 }
14454 }
14455
14456 rcu_read_unlock();
14457
14458 /*
14459 * It is possible that the user space process that is controlling the
14460 * indoor setting disappeared, so notify the regulatory core.
14461 */
14462 regulatory_netlink_notify(notify->portid);
14463 return NOTIFY_OK;
14464 }
14465
14466 static struct notifier_block nl80211_netlink_notifier = {
14467 .notifier_call = nl80211_netlink_notify,
14468 };
14469
cfg80211_ft_event(struct net_device * netdev,struct cfg80211_ft_event_params * ft_event)14470 void cfg80211_ft_event(struct net_device *netdev,
14471 struct cfg80211_ft_event_params *ft_event)
14472 {
14473 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
14474 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14475 struct sk_buff *msg;
14476 void *hdr;
14477
14478 trace_cfg80211_ft_event(wiphy, netdev, ft_event);
14479
14480 if (!ft_event->target_ap)
14481 return;
14482
14483 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14484 if (!msg)
14485 return;
14486
14487 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
14488 if (!hdr)
14489 goto out;
14490
14491 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14492 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14493 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
14494 goto out;
14495
14496 if (ft_event->ies &&
14497 nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
14498 goto out;
14499 if (ft_event->ric_ies &&
14500 nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
14501 ft_event->ric_ies))
14502 goto out;
14503
14504 genlmsg_end(msg, hdr);
14505
14506 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14507 NL80211_MCGRP_MLME, GFP_KERNEL);
14508 return;
14509 out:
14510 nlmsg_free(msg);
14511 }
14512 EXPORT_SYMBOL(cfg80211_ft_event);
14513
cfg80211_crit_proto_stopped(struct wireless_dev * wdev,gfp_t gfp)14514 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
14515 {
14516 struct cfg80211_registered_device *rdev;
14517 struct sk_buff *msg;
14518 void *hdr;
14519 u32 nlportid;
14520
14521 rdev = wiphy_to_rdev(wdev->wiphy);
14522 if (!rdev->crit_proto_nlportid)
14523 return;
14524
14525 nlportid = rdev->crit_proto_nlportid;
14526 rdev->crit_proto_nlportid = 0;
14527
14528 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14529 if (!msg)
14530 return;
14531
14532 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
14533 if (!hdr)
14534 goto nla_put_failure;
14535
14536 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14537 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14538 NL80211_ATTR_PAD))
14539 goto nla_put_failure;
14540
14541 genlmsg_end(msg, hdr);
14542
14543 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
14544 return;
14545
14546 nla_put_failure:
14547 if (hdr)
14548 genlmsg_cancel(msg, hdr);
14549 nlmsg_free(msg);
14550 }
14551 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
14552
nl80211_send_ap_stopped(struct wireless_dev * wdev)14553 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
14554 {
14555 struct wiphy *wiphy = wdev->wiphy;
14556 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14557 struct sk_buff *msg;
14558 void *hdr;
14559
14560 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14561 if (!msg)
14562 return;
14563
14564 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
14565 if (!hdr)
14566 goto out;
14567
14568 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14569 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
14570 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14571 NL80211_ATTR_PAD))
14572 goto out;
14573
14574 genlmsg_end(msg, hdr);
14575
14576 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
14577 NL80211_MCGRP_MLME, GFP_KERNEL);
14578 return;
14579 out:
14580 nlmsg_free(msg);
14581 }
14582
14583 /* initialisation/exit functions */
14584
nl80211_init(void)14585 int nl80211_init(void)
14586 {
14587 int err;
14588
14589 err = genl_register_family_with_ops_groups(&nl80211_fam, nl80211_ops,
14590 nl80211_mcgrps);
14591 if (err)
14592 return err;
14593
14594 err = netlink_register_notifier(&nl80211_netlink_notifier);
14595 if (err)
14596 goto err_out;
14597
14598 return 0;
14599 err_out:
14600 genl_unregister_family(&nl80211_fam);
14601 return err;
14602 }
14603
nl80211_exit(void)14604 void nl80211_exit(void)
14605 {
14606 netlink_unregister_notifier(&nl80211_netlink_notifier);
14607 genl_unregister_family(&nl80211_fam);
14608 }
14609