Linux Kernel  3.7.1
 All Data Structures Namespaces Files Functions Variables Typedefs Enumerations Enumerator Macros Groups Pages
nl80211.c
Go to the documentation of this file.
1 /*
2  * This is the new netlink-based wireless configuration interface.
3  *
4  * Copyright 2006-2010 Johannes Berg <[email protected]>
5  */
6 
7 #include <linux/if.h>
8 #include <linux/module.h>
9 #include <linux/err.h>
10 #include <linux/slab.h>
11 #include <linux/list.h>
12 #include <linux/if_ether.h>
13 #include <linux/ieee80211.h>
14 #include <linux/nl80211.h>
15 #include <linux/rtnetlink.h>
16 #include <linux/netlink.h>
17 #include <linux/etherdevice.h>
18 #include <net/net_namespace.h>
19 #include <net/genetlink.h>
20 #include <net/cfg80211.h>
21 #include <net/sock.h>
22 #include "core.h"
23 #include "nl80211.h"
24 #include "reg.h"
25 
26 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type);
27 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
28  struct genl_info *info,
29  struct cfg80211_crypto_settings *settings,
30  int cipher_limit);
31 
32 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
33  struct genl_info *info);
34 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
35  struct genl_info *info);
36 
37 /* the netlink family */
38 static struct genl_family nl80211_fam = {
39  .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
40  .name = "nl80211", /* have users key off the name instead */
41  .hdrsize = 0, /* no private header */
42  .version = 1, /* no particular meaning now */
43  .maxattr = NL80211_ATTR_MAX,
44  .netnsok = true,
45  .pre_doit = nl80211_pre_doit,
46  .post_doit = nl80211_post_doit,
47 };
48 
49 /* returns ERR_PTR values */
50 static struct wireless_dev *
51 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
52 {
53  struct cfg80211_registered_device *rdev;
54  struct wireless_dev *result = NULL;
55  bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
56  bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
57  u64 wdev_id;
58  int wiphy_idx = -1;
59  int ifidx = -1;
60 
61  assert_cfg80211_lock();
62 
63  if (!have_ifidx && !have_wdev_id)
64  return ERR_PTR(-EINVAL);
65 
66  if (have_ifidx)
67  ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
68  if (have_wdev_id) {
69  wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
70  wiphy_idx = wdev_id >> 32;
71  }
72 
73  list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
74  struct wireless_dev *wdev;
75 
76  if (wiphy_net(&rdev->wiphy) != netns)
77  continue;
78 
79  if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
80  continue;
81 
82  mutex_lock(&rdev->devlist_mtx);
83  list_for_each_entry(wdev, &rdev->wdev_list, list) {
84  if (have_ifidx && wdev->netdev &&
85  wdev->netdev->ifindex == ifidx) {
86  result = wdev;
87  break;
88  }
89  if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
90  result = wdev;
91  break;
92  }
93  }
94  mutex_unlock(&rdev->devlist_mtx);
95 
96  if (result)
97  break;
98  }
99 
100  if (result)
101  return result;
102  return ERR_PTR(-ENODEV);
103 }
104 
105 static struct cfg80211_registered_device *
106 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
107 {
108  struct cfg80211_registered_device *rdev = NULL, *tmp;
109  struct net_device *netdev;
110 
111  assert_cfg80211_lock();
112 
113  if (!attrs[NL80211_ATTR_WIPHY] &&
114  !attrs[NL80211_ATTR_IFINDEX] &&
115  !attrs[NL80211_ATTR_WDEV])
116  return ERR_PTR(-EINVAL);
117 
118  if (attrs[NL80211_ATTR_WIPHY])
119  rdev = cfg80211_rdev_by_wiphy_idx(
120  nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
121 
122  if (attrs[NL80211_ATTR_WDEV]) {
123  u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
124  struct wireless_dev *wdev;
125  bool found = false;
126 
127  tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
128  if (tmp) {
129  /* make sure wdev exists */
130  mutex_lock(&tmp->devlist_mtx);
131  list_for_each_entry(wdev, &tmp->wdev_list, list) {
132  if (wdev->identifier != (u32)wdev_id)
133  continue;
134  found = true;
135  break;
136  }
137  mutex_unlock(&tmp->devlist_mtx);
138 
139  if (!found)
140  tmp = NULL;
141 
142  if (rdev && tmp != rdev)
143  return ERR_PTR(-EINVAL);
144  rdev = tmp;
145  }
146  }
147 
148  if (attrs[NL80211_ATTR_IFINDEX]) {
149  int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
150  netdev = dev_get_by_index(netns, ifindex);
151  if (netdev) {
152  if (netdev->ieee80211_ptr)
153  tmp = wiphy_to_dev(
154  netdev->ieee80211_ptr->wiphy);
155  else
156  tmp = NULL;
157 
158  dev_put(netdev);
159 
160  /* not wireless device -- return error */
161  if (!tmp)
162  return ERR_PTR(-EINVAL);
163 
164  /* mismatch -- return error */
165  if (rdev && tmp != rdev)
166  return ERR_PTR(-EINVAL);
167 
168  rdev = tmp;
169  }
170  }
171 
172  if (!rdev)
173  return ERR_PTR(-ENODEV);
174 
175  if (netns != wiphy_net(&rdev->wiphy))
176  return ERR_PTR(-ENODEV);
177 
178  return rdev;
179 }
180 
181 /*
182  * This function returns a pointer to the driver
183  * that the genl_info item that is passed refers to.
184  * If successful, it returns non-NULL and also locks
185  * the driver's mutex!
186  *
187  * This means that you need to call cfg80211_unlock_rdev()
188  * before being allowed to acquire &cfg80211_mutex!
189  *
190  * This is necessary because we need to lock the global
191  * mutex to get an item off the list safely, and then
192  * we lock the rdev mutex so it doesn't go away under us.
193  *
194  * We don't want to keep cfg80211_mutex locked
195  * for all the time in order to allow requests on
196  * other interfaces to go through at the same time.
197  *
198  * The result of this can be a PTR_ERR and hence must
199  * be checked with IS_ERR() for errors.
200  */
201 static struct cfg80211_registered_device *
202 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
203 {
204  struct cfg80211_registered_device *rdev;
205 
206  mutex_lock(&cfg80211_mutex);
207  rdev = __cfg80211_rdev_from_attrs(netns, info->attrs);
208 
209  /* if it is not an error we grab the lock on
210  * it to assure it won't be going away while
211  * we operate on it */
212  if (!IS_ERR(rdev))
213  mutex_lock(&rdev->mtx);
214 
215  mutex_unlock(&cfg80211_mutex);
216 
217  return rdev;
218 }
219 
220 /* policy for the attributes */
221 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
222  [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
223  [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
224  .len = 20-1 },
225  [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
226  [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
227  [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
228  [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
229  [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
230  [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
231  [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
232  [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
233 
234  [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
235  [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
236  [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
237 
238  [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
239  [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
240 
241  [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
242  [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
243  .len = WLAN_MAX_KEY_LEN },
244  [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
245  [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
246  [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
247  [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
248  [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
249 
250  [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
251  [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
252  [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
253  .len = IEEE80211_MAX_DATA_LEN },
254  [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
255  .len = IEEE80211_MAX_DATA_LEN },
256  [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
257  [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
258  [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
259  [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
260  .len = NL80211_MAX_SUPP_RATES },
261  [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
262  [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
263  [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
264  [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
265  .len = IEEE80211_MAX_MESH_ID_LEN },
266  [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
267 
268  [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
269  [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
270 
271  [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
272  [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
273  [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
274  [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
275  .len = NL80211_MAX_SUPP_RATES },
276  [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
277 
278  [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
279  [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
280 
281  [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
282 
283  [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
284  [NL80211_ATTR_IE] = { .type = NLA_BINARY,
285  .len = IEEE80211_MAX_DATA_LEN },
286  [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
287  [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
288 
289  [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
290  .len = IEEE80211_MAX_SSID_LEN },
291  [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
292  [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
293  [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
294  [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
295  [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
296  [NL80211_ATTR_STA_FLAGS2] = {
297  .len = sizeof(struct nl80211_sta_flag_update),
298  },
299  [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
300  [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
301  [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
302  [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
303  [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
304  [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
305  [NL80211_ATTR_PID] = { .type = NLA_U32 },
306  [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
307  [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
308  .len = WLAN_PMKID_LEN },
309  [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
310  [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
311  [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
312  [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
313  .len = IEEE80211_MAX_DATA_LEN },
314  [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
315  [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
316  [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
317  [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
318  [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
319  [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
320  [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
321  [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
322  [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
323  [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
324  [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
325  [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
326  [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
327  [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
328  [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
329  [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
330  [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
331  [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
332  [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
333  [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
334  .len = IEEE80211_MAX_DATA_LEN },
335  [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
336  .len = IEEE80211_MAX_DATA_LEN },
337  [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
338  [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
339  [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
340  [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
341  [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
342  [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
343  [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
344  [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
345  [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
346  [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
347  .len = IEEE80211_MAX_DATA_LEN },
348  [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
349  [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
350  [NL80211_ATTR_HT_CAPABILITY_MASK] = {
351  .len = NL80211_HT_CAPABILITY_LEN
352  },
353  [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
354  [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
355  [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
356  [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
357  [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
358 };
359 
360 /* policy for the key attributes */
361 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
362  [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
363  [NL80211_KEY_IDX] = { .type = NLA_U8 },
364  [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
365  [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
366  [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
367  [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
368  [NL80211_KEY_TYPE] = { .type = NLA_U32 },
369  [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
370 };
371 
372 /* policy for the key default flags */
373 static const struct nla_policy
374 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
375  [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
376  [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
377 };
378 
379 /* policy for WoWLAN attributes */
380 static const struct nla_policy
381 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
382  [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
383  [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
384  [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
385  [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
386  [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
387  [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
388  [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
389  [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
390 };
391 
392 /* policy for GTK rekey offload attributes */
393 static const struct nla_policy
394 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
395  [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
396  [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
397  [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
398 };
399 
400 static const struct nla_policy
401 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
402  [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
403  .len = IEEE80211_MAX_SSID_LEN },
404  [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
405 };
406 
407 /* ifidx get helper */
408 static int nl80211_get_ifidx(struct netlink_callback *cb)
409 {
410  int res;
411 
412  res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
413  nl80211_fam.attrbuf, nl80211_fam.maxattr,
414  nl80211_policy);
415  if (res)
416  return res;
417 
418  if (!nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX])
419  return -EINVAL;
420 
421  res = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_IFINDEX]);
422  if (!res)
423  return -EINVAL;
424  return res;
425 }
426 
427 static int nl80211_prepare_netdev_dump(struct sk_buff *skb,
428  struct netlink_callback *cb,
429  struct cfg80211_registered_device **rdev,
430  struct net_device **dev)
431 {
432  int ifidx = cb->args[0];
433  int err;
434 
435  if (!ifidx)
436  ifidx = nl80211_get_ifidx(cb);
437  if (ifidx < 0)
438  return ifidx;
439 
440  cb->args[0] = ifidx;
441 
442  rtnl_lock();
443 
444  *dev = __dev_get_by_index(sock_net(skb->sk), ifidx);
445  if (!*dev) {
446  err = -ENODEV;
447  goto out_rtnl;
448  }
449 
450  *rdev = cfg80211_get_dev_from_ifindex(sock_net(skb->sk), ifidx);
451  if (IS_ERR(*rdev)) {
452  err = PTR_ERR(*rdev);
453  goto out_rtnl;
454  }
455 
456  return 0;
457  out_rtnl:
458  rtnl_unlock();
459  return err;
460 }
461 
462 static void nl80211_finish_netdev_dump(struct cfg80211_registered_device *rdev)
463 {
464  cfg80211_unlock_rdev(rdev);
465  rtnl_unlock();
466 }
467 
468 /* IE validation */
469 static bool is_valid_ie_attr(const struct nlattr *attr)
470 {
471  const u8 *pos;
472  int len;
473 
474  if (!attr)
475  return true;
476 
477  pos = nla_data(attr);
478  len = nla_len(attr);
479 
480  while (len) {
481  u8 elemlen;
482 
483  if (len < 2)
484  return false;
485  len -= 2;
486 
487  elemlen = pos[1];
488  if (elemlen > len)
489  return false;
490 
491  len -= elemlen;
492  pos += 2 + elemlen;
493  }
494 
495  return true;
496 }
497 
498 /* message building helper */
499 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
500  int flags, u8 cmd)
501 {
502  /* since there is no private header just add the generic one */
503  return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
504 }
505 
506 static int nl80211_msg_put_channel(struct sk_buff *msg,
507  struct ieee80211_channel *chan)
508 {
509  if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
510  chan->center_freq))
511  goto nla_put_failure;
512 
513  if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
514  nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
515  goto nla_put_failure;
516  if ((chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
517  nla_put_flag(msg, NL80211_FREQUENCY_ATTR_PASSIVE_SCAN))
518  goto nla_put_failure;
519  if ((chan->flags & IEEE80211_CHAN_NO_IBSS) &&
520  nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IBSS))
521  goto nla_put_failure;
522  if ((chan->flags & IEEE80211_CHAN_RADAR) &&
523  nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
524  goto nla_put_failure;
525 
526  if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
527  DBM_TO_MBM(chan->max_power)))
528  goto nla_put_failure;
529 
530  return 0;
531 
532  nla_put_failure:
533  return -ENOBUFS;
534 }
535 
536 /* netlink command implementations */
537 
538 struct key_parse {
539  struct key_params p;
540  int idx;
541  int type;
542  bool def, defmgmt;
543  bool def_uni, def_multi;
544 };
545 
546 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
547 {
548  struct nlattr *tb[NL80211_KEY_MAX + 1];
549  int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
550  nl80211_key_policy);
551  if (err)
552  return err;
553 
554  k->def = !!tb[NL80211_KEY_DEFAULT];
555  k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
556 
557  if (k->def) {
558  k->def_uni = true;
559  k->def_multi = true;
560  }
561  if (k->defmgmt)
562  k->def_multi = true;
563 
564  if (tb[NL80211_KEY_IDX])
565  k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
566 
567  if (tb[NL80211_KEY_DATA]) {
568  k->p.key = nla_data(tb[NL80211_KEY_DATA]);
569  k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
570  }
571 
572  if (tb[NL80211_KEY_SEQ]) {
573  k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
574  k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
575  }
576 
577  if (tb[NL80211_KEY_CIPHER])
578  k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
579 
580  if (tb[NL80211_KEY_TYPE]) {
581  k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
582  if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
583  return -EINVAL;
584  }
585 
586  if (tb[NL80211_KEY_DEFAULT_TYPES]) {
587  struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
588  err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
589  tb[NL80211_KEY_DEFAULT_TYPES],
590  nl80211_key_default_policy);
591  if (err)
592  return err;
593 
594  k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
595  k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
596  }
597 
598  return 0;
599 }
600 
601 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
602 {
603  if (info->attrs[NL80211_ATTR_KEY_DATA]) {
604  k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
605  k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
606  }
607 
608  if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
609  k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
610  k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
611  }
612 
613  if (info->attrs[NL80211_ATTR_KEY_IDX])
614  k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
615 
616  if (info->attrs[NL80211_ATTR_KEY_CIPHER])
617  k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
618 
619  k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
620  k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
621 
622  if (k->def) {
623  k->def_uni = true;
624  k->def_multi = true;
625  }
626  if (k->defmgmt)
627  k->def_multi = true;
628 
629  if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
630  k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
631  if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
632  return -EINVAL;
633  }
634 
635  if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
636  struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
637  int err = nla_parse_nested(
638  kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
639  info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
640  nl80211_key_default_policy);
641  if (err)
642  return err;
643 
644  k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
645  k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
646  }
647 
648  return 0;
649 }
650 
651 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
652 {
653  int err;
654 
655  memset(k, 0, sizeof(*k));
656  k->idx = -1;
657  k->type = -1;
658 
659  if (info->attrs[NL80211_ATTR_KEY])
660  err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
661  else
662  err = nl80211_parse_key_old(info, k);
663 
664  if (err)
665  return err;
666 
667  if (k->def && k->defmgmt)
668  return -EINVAL;
669 
670  if (k->defmgmt) {
671  if (k->def_uni || !k->def_multi)
672  return -EINVAL;
673  }
674 
675  if (k->idx != -1) {
676  if (k->defmgmt) {
677  if (k->idx < 4 || k->idx > 5)
678  return -EINVAL;
679  } else if (k->def) {
680  if (k->idx < 0 || k->idx > 3)
681  return -EINVAL;
682  } else {
683  if (k->idx < 0 || k->idx > 5)
684  return -EINVAL;
685  }
686  }
687 
688  return 0;
689 }
690 
691 static struct cfg80211_cached_keys *
692 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
693  struct nlattr *keys)
694 {
695  struct key_parse parse;
696  struct nlattr *key;
697  struct cfg80211_cached_keys *result;
698  int rem, err, def = 0;
699 
700  result = kzalloc(sizeof(*result), GFP_KERNEL);
701  if (!result)
702  return ERR_PTR(-ENOMEM);
703 
704  result->def = -1;
705  result->defmgmt = -1;
706 
707  nla_for_each_nested(key, keys, rem) {
708  memset(&parse, 0, sizeof(parse));
709  parse.idx = -1;
710 
711  err = nl80211_parse_key_new(key, &parse);
712  if (err)
713  goto error;
714  err = -EINVAL;
715  if (!parse.p.key)
716  goto error;
717  if (parse.idx < 0 || parse.idx > 4)
718  goto error;
719  if (parse.def) {
720  if (def)
721  goto error;
722  def = 1;
723  result->def = parse.idx;
724  if (!parse.def_uni || !parse.def_multi)
725  goto error;
726  } else if (parse.defmgmt)
727  goto error;
728  err = cfg80211_validate_key_settings(rdev, &parse.p,
729  parse.idx, false, NULL);
730  if (err)
731  goto error;
732  result->params[parse.idx].cipher = parse.p.cipher;
733  result->params[parse.idx].key_len = parse.p.key_len;
734  result->params[parse.idx].key = result->data[parse.idx];
735  memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
736  }
737 
738  return result;
739  error:
740  kfree(result);
741  return ERR_PTR(err);
742 }
743 
744 static int nl80211_key_allowed(struct wireless_dev *wdev)
745 {
746  ASSERT_WDEV_LOCK(wdev);
747 
748  switch (wdev->iftype) {
749  case NL80211_IFTYPE_AP:
750  case NL80211_IFTYPE_AP_VLAN:
751  case NL80211_IFTYPE_P2P_GO:
752  case NL80211_IFTYPE_MESH_POINT:
753  break;
754  case NL80211_IFTYPE_ADHOC:
755  if (!wdev->current_bss)
756  return -ENOLINK;
757  break;
758  case NL80211_IFTYPE_STATION:
759  case NL80211_IFTYPE_P2P_CLIENT:
760  if (wdev->sme_state != CFG80211_SME_CONNECTED)
761  return -ENOLINK;
762  break;
763  default:
764  return -EINVAL;
765  }
766 
767  return 0;
768 }
769 
770 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
771 {
772  struct nlattr *nl_modes = nla_nest_start(msg, attr);
773  int i;
774 
775  if (!nl_modes)
776  goto nla_put_failure;
777 
778  i = 0;
779  while (ifmodes) {
780  if ((ifmodes & 1) && nla_put_flag(msg, i))
781  goto nla_put_failure;
782  ifmodes >>= 1;
783  i++;
784  }
785 
786  nla_nest_end(msg, nl_modes);
787  return 0;
788 
789 nla_put_failure:
790  return -ENOBUFS;
791 }
792 
793 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
794  struct sk_buff *msg)
795 {
796  struct nlattr *nl_combis;
797  int i, j;
798 
799  nl_combis = nla_nest_start(msg,
800  NL80211_ATTR_INTERFACE_COMBINATIONS);
801  if (!nl_combis)
802  goto nla_put_failure;
803 
804  for (i = 0; i < wiphy->n_iface_combinations; i++) {
805  const struct ieee80211_iface_combination *c;
806  struct nlattr *nl_combi, *nl_limits;
807 
808  c = &wiphy->iface_combinations[i];
809 
810  nl_combi = nla_nest_start(msg, i + 1);
811  if (!nl_combi)
812  goto nla_put_failure;
813 
814  nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
815  if (!nl_limits)
816  goto nla_put_failure;
817 
818  for (j = 0; j < c->n_limits; j++) {
819  struct nlattr *nl_limit;
820 
821  nl_limit = nla_nest_start(msg, j + 1);
822  if (!nl_limit)
823  goto nla_put_failure;
824  if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
825  c->limits[j].max))
826  goto nla_put_failure;
827  if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
828  c->limits[j].types))
829  goto nla_put_failure;
830  nla_nest_end(msg, nl_limit);
831  }
832 
833  nla_nest_end(msg, nl_limits);
834 
835  if (c->beacon_int_infra_match &&
836  nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
837  goto nla_put_failure;
838  if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
839  c->num_different_channels) ||
840  nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
841  c->max_interfaces))
842  goto nla_put_failure;
843 
844  nla_nest_end(msg, nl_combi);
845  }
846 
847  nla_nest_end(msg, nl_combis);
848 
849  return 0;
850 nla_put_failure:
851  return -ENOBUFS;
852 }
853 
854 static int nl80211_send_wiphy(struct sk_buff *msg, u32 portid, u32 seq, int flags,
855  struct cfg80211_registered_device *dev)
856 {
857  void *hdr;
858  struct nlattr *nl_bands, *nl_band;
859  struct nlattr *nl_freqs, *nl_freq;
860  struct nlattr *nl_rates, *nl_rate;
861  struct nlattr *nl_cmds;
862  enum ieee80211_band band;
863  struct ieee80211_channel *chan;
864  struct ieee80211_rate *rate;
865  int i;
866  const struct ieee80211_txrx_stypes *mgmt_stypes =
867  dev->wiphy.mgmt_stypes;
868 
869  hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_WIPHY);
870  if (!hdr)
871  return -1;
872 
873  if (nla_put_u32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx) ||
874  nla_put_string(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy)) ||
875  nla_put_u32(msg, NL80211_ATTR_GENERATION,
876  cfg80211_rdev_list_generation) ||
877  nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
878  dev->wiphy.retry_short) ||
879  nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
880  dev->wiphy.retry_long) ||
881  nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
882  dev->wiphy.frag_threshold) ||
883  nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
884  dev->wiphy.rts_threshold) ||
885  nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
886  dev->wiphy.coverage_class) ||
887  nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
888  dev->wiphy.max_scan_ssids) ||
889  nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
890  dev->wiphy.max_sched_scan_ssids) ||
891  nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
892  dev->wiphy.max_scan_ie_len) ||
893  nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
894  dev->wiphy.max_sched_scan_ie_len) ||
895  nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
896  dev->wiphy.max_match_sets))
897  goto nla_put_failure;
898 
899  if ((dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
900  nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
901  goto nla_put_failure;
902  if ((dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
903  nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
904  goto nla_put_failure;
905  if ((dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
906  nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
907  goto nla_put_failure;
908  if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
909  nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
910  goto nla_put_failure;
911  if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
912  nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
913  goto nla_put_failure;
914  if ((dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
915  nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
916  goto nla_put_failure;
917 
918  if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
919  sizeof(u32) * dev->wiphy.n_cipher_suites,
920  dev->wiphy.cipher_suites))
921  goto nla_put_failure;
922 
923  if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
924  dev->wiphy.max_num_pmkids))
925  goto nla_put_failure;
926 
927  if ((dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
928  nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
929  goto nla_put_failure;
930 
931  if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
932  dev->wiphy.available_antennas_tx) ||
933  nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
934  dev->wiphy.available_antennas_rx))
935  goto nla_put_failure;
936 
937  if ((dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
938  nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
939  dev->wiphy.probe_resp_offload))
940  goto nla_put_failure;
941 
942  if ((dev->wiphy.available_antennas_tx ||
943  dev->wiphy.available_antennas_rx) && dev->ops->get_antenna) {
944  u32 tx_ant = 0, rx_ant = 0;
945  int res;
946  res = dev->ops->get_antenna(&dev->wiphy, &tx_ant, &rx_ant);
947  if (!res) {
948  if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_TX,
949  tx_ant) ||
950  nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_RX,
951  rx_ant))
952  goto nla_put_failure;
953  }
954  }
955 
956  if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
957  dev->wiphy.interface_modes))
958  goto nla_put_failure;
959 
960  nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
961  if (!nl_bands)
962  goto nla_put_failure;
963 
964  for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
965  if (!dev->wiphy.bands[band])
966  continue;
967 
968  nl_band = nla_nest_start(msg, band);
969  if (!nl_band)
970  goto nla_put_failure;
971 
972  /* add HT info */
973  if (dev->wiphy.bands[band]->ht_cap.ht_supported &&
974  (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
975  sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
976  &dev->wiphy.bands[band]->ht_cap.mcs) ||
977  nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
978  dev->wiphy.bands[band]->ht_cap.cap) ||
979  nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
980  dev->wiphy.bands[band]->ht_cap.ampdu_factor) ||
981  nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
982  dev->wiphy.bands[band]->ht_cap.ampdu_density)))
983  goto nla_put_failure;
984 
985  /* add VHT info */
986  if (dev->wiphy.bands[band]->vht_cap.vht_supported &&
987  (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
988  sizeof(dev->wiphy.bands[band]->vht_cap.vht_mcs),
989  &dev->wiphy.bands[band]->vht_cap.vht_mcs) ||
990  nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
991  dev->wiphy.bands[band]->vht_cap.cap)))
992  goto nla_put_failure;
993 
994  /* add frequencies */
995  nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
996  if (!nl_freqs)
997  goto nla_put_failure;
998 
999  for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
1000  nl_freq = nla_nest_start(msg, i);
1001  if (!nl_freq)
1002  goto nla_put_failure;
1003 
1004  chan = &dev->wiphy.bands[band]->channels[i];
1005 
1006  if (nl80211_msg_put_channel(msg, chan))
1007  goto nla_put_failure;
1008 
1009  nla_nest_end(msg, nl_freq);
1010  }
1011 
1012  nla_nest_end(msg, nl_freqs);
1013 
1014  /* add bitrates */
1015  nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1016  if (!nl_rates)
1017  goto nla_put_failure;
1018 
1019  for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
1020  nl_rate = nla_nest_start(msg, i);
1021  if (!nl_rate)
1022  goto nla_put_failure;
1023 
1024  rate = &dev->wiphy.bands[band]->bitrates[i];
1025  if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1026  rate->bitrate))
1027  goto nla_put_failure;
1028  if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1029  nla_put_flag(msg,
1030  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1031  goto nla_put_failure;
1032 
1033  nla_nest_end(msg, nl_rate);
1034  }
1035 
1036  nla_nest_end(msg, nl_rates);
1037 
1038  nla_nest_end(msg, nl_band);
1039  }
1040  nla_nest_end(msg, nl_bands);
1041 
1042  nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1043  if (!nl_cmds)
1044  goto nla_put_failure;
1045 
1046  i = 0;
1047 #define CMD(op, n) \
1048  do { \
1049  if (dev->ops->op) { \
1050  i++; \
1051  if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1052  goto nla_put_failure; \
1053  } \
1054  } while (0)
1055 
1056  CMD(add_virtual_intf, NEW_INTERFACE);
1057  CMD(change_virtual_intf, SET_INTERFACE);
1058  CMD(add_key, NEW_KEY);
1059  CMD(start_ap, START_AP);
1060  CMD(add_station, NEW_STATION);
1061  CMD(add_mpath, NEW_MPATH);
1062  CMD(update_mesh_config, SET_MESH_CONFIG);
1063  CMD(change_bss, SET_BSS);
1064  CMD(auth, AUTHENTICATE);
1065  CMD(assoc, ASSOCIATE);
1066  CMD(deauth, DEAUTHENTICATE);
1067  CMD(disassoc, DISASSOCIATE);
1068  CMD(join_ibss, JOIN_IBSS);
1069  CMD(join_mesh, JOIN_MESH);
1070  CMD(set_pmksa, SET_PMKSA);
1071  CMD(del_pmksa, DEL_PMKSA);
1072  CMD(flush_pmksa, FLUSH_PMKSA);
1073  if (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1074  CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1075  CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1076  CMD(mgmt_tx, FRAME);
1077  CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1078  if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1079  i++;
1080  if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1081  goto nla_put_failure;
1082  }
1083  if (dev->ops->set_monitor_channel || dev->ops->start_ap ||
1084  dev->ops->join_mesh) {
1085  i++;
1086  if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1087  goto nla_put_failure;
1088  }
1089  CMD(set_wds_peer, SET_WDS_PEER);
1090  if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1091  CMD(tdls_mgmt, TDLS_MGMT);
1092  CMD(tdls_oper, TDLS_OPER);
1093  }
1094  if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1095  CMD(sched_scan_start, START_SCHED_SCAN);
1096  CMD(probe_client, PROBE_CLIENT);
1097  CMD(set_noack_map, SET_NOACK_MAP);
1098  if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1099  i++;
1100  if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1101  goto nla_put_failure;
1102  }
1103  CMD(start_p2p_device, START_P2P_DEVICE);
1104 
1105 #ifdef CONFIG_NL80211_TESTMODE
1106  CMD(testmode_cmd, TESTMODE);
1107 #endif
1108 
1109 #undef CMD
1110 
1111  if (dev->ops->connect || dev->ops->auth) {
1112  i++;
1113  if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1114  goto nla_put_failure;
1115  }
1116 
1117  if (dev->ops->disconnect || dev->ops->deauth) {
1118  i++;
1119  if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1120  goto nla_put_failure;
1121  }
1122 
1123  nla_nest_end(msg, nl_cmds);
1124 
1125  if (dev->ops->remain_on_channel &&
1126  (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1127  nla_put_u32(msg, NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1128  dev->wiphy.max_remain_on_channel_duration))
1129  goto nla_put_failure;
1130 
1131  if ((dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1132  nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1133  goto nla_put_failure;
1134 
1135  if (mgmt_stypes) {
1136  u16 stypes;
1137  struct nlattr *nl_ftypes, *nl_ifs;
1138  enum nl80211_iftype ift;
1139 
1140  nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1141  if (!nl_ifs)
1142  goto nla_put_failure;
1143 
1144  for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1145  nl_ftypes = nla_nest_start(msg, ift);
1146  if (!nl_ftypes)
1147  goto nla_put_failure;
1148  i = 0;
1149  stypes = mgmt_stypes[ift].tx;
1150  while (stypes) {
1151  if ((stypes & 1) &&
1152  nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1153  (i << 4) | IEEE80211_FTYPE_MGMT))
1154  goto nla_put_failure;
1155  stypes >>= 1;
1156  i++;
1157  }
1158  nla_nest_end(msg, nl_ftypes);
1159  }
1160 
1161  nla_nest_end(msg, nl_ifs);
1162 
1163  nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1164  if (!nl_ifs)
1165  goto nla_put_failure;
1166 
1167  for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1168  nl_ftypes = nla_nest_start(msg, ift);
1169  if (!nl_ftypes)
1170  goto nla_put_failure;
1171  i = 0;
1172  stypes = mgmt_stypes[ift].rx;
1173  while (stypes) {
1174  if ((stypes & 1) &&
1175  nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1176  (i << 4) | IEEE80211_FTYPE_MGMT))
1177  goto nla_put_failure;
1178  stypes >>= 1;
1179  i++;
1180  }
1181  nla_nest_end(msg, nl_ftypes);
1182  }
1183  nla_nest_end(msg, nl_ifs);
1184  }
1185 
1186 #ifdef CONFIG_PM
1187  if (dev->wiphy.wowlan.flags || dev->wiphy.wowlan.n_patterns) {
1188  struct nlattr *nl_wowlan;
1189 
1190  nl_wowlan = nla_nest_start(msg,
1191  NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1192  if (!nl_wowlan)
1193  goto nla_put_failure;
1194 
1195  if (((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_ANY) &&
1196  nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1197  ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_DISCONNECT) &&
1198  nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1199  ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1200  nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1201  ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1202  nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1203  ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1204  nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1205  ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1206  nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1207  ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1208  nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1209  ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1210  nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1211  goto nla_put_failure;
1212  if (dev->wiphy.wowlan.n_patterns) {
1213  struct nl80211_wowlan_pattern_support pat = {
1214  .max_patterns = dev->wiphy.wowlan.n_patterns,
1215  .min_pattern_len =
1216  dev->wiphy.wowlan.pattern_min_len,
1217  .max_pattern_len =
1218  dev->wiphy.wowlan.pattern_max_len,
1219  };
1220  if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1221  sizeof(pat), &pat))
1222  goto nla_put_failure;
1223  }
1224 
1225  nla_nest_end(msg, nl_wowlan);
1226  }
1227 #endif
1228 
1229  if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1230  dev->wiphy.software_iftypes))
1231  goto nla_put_failure;
1232 
1233  if (nl80211_put_iface_combinations(&dev->wiphy, msg))
1234  goto nla_put_failure;
1235 
1236  if ((dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1237  nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1238  dev->wiphy.ap_sme_capa))
1239  goto nla_put_failure;
1240 
1241  if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS,
1242  dev->wiphy.features))
1243  goto nla_put_failure;
1244 
1245  if (dev->wiphy.ht_capa_mod_mask &&
1246  nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1247  sizeof(*dev->wiphy.ht_capa_mod_mask),
1248  dev->wiphy.ht_capa_mod_mask))
1249  goto nla_put_failure;
1250 
1251  return genlmsg_end(msg, hdr);
1252 
1253  nla_put_failure:
1254  genlmsg_cancel(msg, hdr);
1255  return -EMSGSIZE;
1256 }
1257 
1258 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1259 {
1260  int idx = 0;
1261  int start = cb->args[0];
1262  struct cfg80211_registered_device *dev;
1263 
1264  mutex_lock(&cfg80211_mutex);
1265  list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1266  if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
1267  continue;
1268  if (++idx <= start)
1269  continue;
1270  if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).portid,
1271  cb->nlh->nlmsg_seq, NLM_F_MULTI,
1272  dev) < 0) {
1273  idx--;
1274  break;
1275  }
1276  }
1277  mutex_unlock(&cfg80211_mutex);
1278 
1279  cb->args[0] = idx;
1280 
1281  return skb->len;
1282 }
1283 
1284 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1285 {
1286  struct sk_buff *msg;
1287  struct cfg80211_registered_device *dev = info->user_ptr[0];
1288 
1289  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1290  if (!msg)
1291  return -ENOMEM;
1292 
1293  if (nl80211_send_wiphy(msg, info->snd_portid, info->snd_seq, 0, dev) < 0) {
1294  nlmsg_free(msg);
1295  return -ENOBUFS;
1296  }
1297 
1298  return genlmsg_reply(msg, info);
1299 }
1300 
1301 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1302  [NL80211_TXQ_ATTR_QUEUE] = { .type = NLA_U8 },
1303  [NL80211_TXQ_ATTR_TXOP] = { .type = NLA_U16 },
1304  [NL80211_TXQ_ATTR_CWMIN] = { .type = NLA_U16 },
1305  [NL80211_TXQ_ATTR_CWMAX] = { .type = NLA_U16 },
1306  [NL80211_TXQ_ATTR_AIFS] = { .type = NLA_U8 },
1307 };
1308 
1309 static int parse_txq_params(struct nlattr *tb[],
1310  struct ieee80211_txq_params *txq_params)
1311 {
1312  if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1313  !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1314  !tb[NL80211_TXQ_ATTR_AIFS])
1315  return -EINVAL;
1316 
1317  txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1318  txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1319  txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1320  txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1321  txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1322 
1323  if (txq_params->ac >= NL80211_NUM_ACS)
1324  return -EINVAL;
1325 
1326  return 0;
1327 }
1328 
1329 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1330 {
1331  /*
1332  * You can only set the channel explicitly for WDS interfaces,
1333  * all others have their channel managed via their respective
1334  * "establish a connection" command (connect, join, ...)
1335  *
1336  * For AP/GO and mesh mode, the channel can be set with the
1337  * channel userspace API, but is only stored and passed to the
1338  * low-level driver when the AP starts or the mesh is joined.
1339  * This is for backward compatibility, userspace can also give
1340  * the channel in the start-ap or join-mesh commands instead.
1341  *
1342  * Monitors are special as they are normally slaved to
1343  * whatever else is going on, so they have their own special
1344  * operation to set the monitor channel if possible.
1345  */
1346  return !wdev ||
1347  wdev->iftype == NL80211_IFTYPE_AP ||
1348  wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1349  wdev->iftype == NL80211_IFTYPE_MONITOR ||
1350  wdev->iftype == NL80211_IFTYPE_P2P_GO;
1351 }
1352 
1353 static bool nl80211_valid_channel_type(struct genl_info *info,
1354  enum nl80211_channel_type *channel_type)
1355 {
1356  enum nl80211_channel_type tmp;
1357 
1358  if (!info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE])
1359  return false;
1360 
1361  tmp = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1362  if (tmp != NL80211_CHAN_NO_HT &&
1363  tmp != NL80211_CHAN_HT20 &&
1364  tmp != NL80211_CHAN_HT40PLUS &&
1365  tmp != NL80211_CHAN_HT40MINUS)
1366  return false;
1367 
1368  if (channel_type)
1369  *channel_type = tmp;
1370 
1371  return true;
1372 }
1373 
1374 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1375  struct wireless_dev *wdev,
1376  struct genl_info *info)
1377 {
1378  struct ieee80211_channel *channel;
1379  enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
1380  u32 freq;
1381  int result;
1382  enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1383 
1384  if (wdev)
1385  iftype = wdev->iftype;
1386 
1387  if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1388  return -EINVAL;
1389 
1390  if (!nl80211_can_set_dev_channel(wdev))
1391  return -EOPNOTSUPP;
1392 
1393  if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE] &&
1394  !nl80211_valid_channel_type(info, &channel_type))
1395  return -EINVAL;
1396 
1397  freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1398 
1399  mutex_lock(&rdev->devlist_mtx);
1400  switch (iftype) {
1401  case NL80211_IFTYPE_AP:
1402  case NL80211_IFTYPE_P2P_GO:
1403  if (wdev->beacon_interval) {
1404  result = -EBUSY;
1405  break;
1406  }
1407  channel = rdev_freq_to_chan(rdev, freq, channel_type);
1408  if (!channel || !cfg80211_can_beacon_sec_chan(&rdev->wiphy,
1409  channel,
1410  channel_type)) {
1411  result = -EINVAL;
1412  break;
1413  }
1414  wdev->preset_chan = channel;
1415  wdev->preset_chantype = channel_type;
1416  result = 0;
1417  break;
1418  case NL80211_IFTYPE_MESH_POINT:
1419  result = cfg80211_set_mesh_freq(rdev, wdev, freq, channel_type);
1420  break;
1421  case NL80211_IFTYPE_MONITOR:
1422  result = cfg80211_set_monitor_channel(rdev, freq, channel_type);
1423  break;
1424  default:
1425  result = -EINVAL;
1426  }
1427  mutex_unlock(&rdev->devlist_mtx);
1428 
1429  return result;
1430 }
1431 
1432 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1433 {
1434  struct cfg80211_registered_device *rdev = info->user_ptr[0];
1435  struct net_device *netdev = info->user_ptr[1];
1436 
1437  return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1438 }
1439 
1440 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1441 {
1442  struct cfg80211_registered_device *rdev = info->user_ptr[0];
1443  struct net_device *dev = info->user_ptr[1];
1444  struct wireless_dev *wdev = dev->ieee80211_ptr;
1445  const u8 *bssid;
1446 
1447  if (!info->attrs[NL80211_ATTR_MAC])
1448  return -EINVAL;
1449 
1450  if (netif_running(dev))
1451  return -EBUSY;
1452 
1453  if (!rdev->ops->set_wds_peer)
1454  return -EOPNOTSUPP;
1455 
1456  if (wdev->iftype != NL80211_IFTYPE_WDS)
1457  return -EOPNOTSUPP;
1458 
1459  bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1460  return rdev->ops->set_wds_peer(wdev->wiphy, dev, bssid);
1461 }
1462 
1463 
1464 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1465 {
1466  struct cfg80211_registered_device *rdev;
1467  struct net_device *netdev = NULL;
1468  struct wireless_dev *wdev;
1469  int result = 0, rem_txq_params = 0;
1470  struct nlattr *nl_txq_params;
1471  u32 changed;
1472  u8 retry_short = 0, retry_long = 0;
1473  u32 frag_threshold = 0, rts_threshold = 0;
1474  u8 coverage_class = 0;
1475 
1476  /*
1477  * Try to find the wiphy and netdev. Normally this
1478  * function shouldn't need the netdev, but this is
1479  * done for backward compatibility -- previously
1480  * setting the channel was done per wiphy, but now
1481  * it is per netdev. Previous userland like hostapd
1482  * also passed a netdev to set_wiphy, so that it is
1483  * possible to let that go to the right netdev!
1484  */
1485  mutex_lock(&cfg80211_mutex);
1486 
1487  if (info->attrs[NL80211_ATTR_IFINDEX]) {
1488  int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1489 
1490  netdev = dev_get_by_index(genl_info_net(info), ifindex);
1491  if (netdev && netdev->ieee80211_ptr) {
1492  rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1493  mutex_lock(&rdev->mtx);
1494  } else
1495  netdev = NULL;
1496  }
1497 
1498  if (!netdev) {
1499  rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
1500  info->attrs);
1501  if (IS_ERR(rdev)) {
1502  mutex_unlock(&cfg80211_mutex);
1503  return PTR_ERR(rdev);
1504  }
1505  wdev = NULL;
1506  netdev = NULL;
1507  result = 0;
1508 
1509  mutex_lock(&rdev->mtx);
1510  } else if (nl80211_can_set_dev_channel(netdev->ieee80211_ptr))
1511  wdev = netdev->ieee80211_ptr;
1512  else
1513  wdev = NULL;
1514 
1515  /*
1516  * end workaround code, by now the rdev is available
1517  * and locked, and wdev may or may not be NULL.
1518  */
1519 
1520  if (info->attrs[NL80211_ATTR_WIPHY_NAME])
1521  result = cfg80211_dev_rename(
1522  rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
1523 
1524  mutex_unlock(&cfg80211_mutex);
1525 
1526  if (result)
1527  goto bad_res;
1528 
1529  if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
1530  struct ieee80211_txq_params txq_params;
1531  struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
1532 
1533  if (!rdev->ops->set_txq_params) {
1534  result = -EOPNOTSUPP;
1535  goto bad_res;
1536  }
1537 
1538  if (!netdev) {
1539  result = -EINVAL;
1540  goto bad_res;
1541  }
1542 
1543  if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
1544  netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
1545  result = -EINVAL;
1546  goto bad_res;
1547  }
1548 
1549  if (!netif_running(netdev)) {
1550  result = -ENETDOWN;
1551  goto bad_res;
1552  }
1553 
1554  nla_for_each_nested(nl_txq_params,
1555  info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1556  rem_txq_params) {
1557  nla_parse(tb, NL80211_TXQ_ATTR_MAX,
1558  nla_data(nl_txq_params),
1559  nla_len(nl_txq_params),
1560  txq_params_policy);
1561  result = parse_txq_params(tb, &txq_params);
1562  if (result)
1563  goto bad_res;
1564 
1565  result = rdev->ops->set_txq_params(&rdev->wiphy,
1566  netdev,
1567  &txq_params);
1568  if (result)
1569  goto bad_res;
1570  }
1571  }
1572 
1573  if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
1574  result = __nl80211_set_channel(rdev, wdev, info);
1575  if (result)
1576  goto bad_res;
1577  }
1578 
1579  if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
1580  enum nl80211_tx_power_setting type;
1581  int idx, mbm = 0;
1582 
1583  if (!rdev->ops->set_tx_power) {
1584  result = -EOPNOTSUPP;
1585  goto bad_res;
1586  }
1587 
1588  idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
1589  type = nla_get_u32(info->attrs[idx]);
1590 
1591  if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
1592  (type != NL80211_TX_POWER_AUTOMATIC)) {
1593  result = -EINVAL;
1594  goto bad_res;
1595  }
1596 
1597  if (type != NL80211_TX_POWER_AUTOMATIC) {
1598  idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
1599  mbm = nla_get_u32(info->attrs[idx]);
1600  }
1601 
1602  result = rdev->ops->set_tx_power(&rdev->wiphy, type, mbm);
1603  if (result)
1604  goto bad_res;
1605  }
1606 
1607  if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
1608  info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
1609  u32 tx_ant, rx_ant;
1610  if ((!rdev->wiphy.available_antennas_tx &&
1611  !rdev->wiphy.available_antennas_rx) ||
1612  !rdev->ops->set_antenna) {
1613  result = -EOPNOTSUPP;
1614  goto bad_res;
1615  }
1616 
1617  tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
1618  rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
1619 
1620  /* reject antenna configurations which don't match the
1621  * available antenna masks, except for the "all" mask */
1622  if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
1623  (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
1624  result = -EINVAL;
1625  goto bad_res;
1626  }
1627 
1628  tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
1629  rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
1630 
1631  result = rdev->ops->set_antenna(&rdev->wiphy, tx_ant, rx_ant);
1632  if (result)
1633  goto bad_res;
1634  }
1635 
1636  changed = 0;
1637 
1638  if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
1639  retry_short = nla_get_u8(
1640  info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
1641  if (retry_short == 0) {
1642  result = -EINVAL;
1643  goto bad_res;
1644  }
1645  changed |= WIPHY_PARAM_RETRY_SHORT;
1646  }
1647 
1648  if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
1649  retry_long = nla_get_u8(
1650  info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
1651  if (retry_long == 0) {
1652  result = -EINVAL;
1653  goto bad_res;
1654  }
1655  changed |= WIPHY_PARAM_RETRY_LONG;
1656  }
1657 
1658  if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
1659  frag_threshold = nla_get_u32(
1660  info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
1661  if (frag_threshold < 256) {
1662  result = -EINVAL;
1663  goto bad_res;
1664  }
1665  if (frag_threshold != (u32) -1) {
1666  /*
1667  * Fragments (apart from the last one) are required to
1668  * have even length. Make the fragmentation code
1669  * simpler by stripping LSB should someone try to use
1670  * odd threshold value.
1671  */
1672  frag_threshold &= ~0x1;
1673  }
1674  changed |= WIPHY_PARAM_FRAG_THRESHOLD;
1675  }
1676 
1677  if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
1678  rts_threshold = nla_get_u32(
1679  info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
1680  changed |= WIPHY_PARAM_RTS_THRESHOLD;
1681  }
1682 
1683  if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
1684  coverage_class = nla_get_u8(
1685  info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
1686  changed |= WIPHY_PARAM_COVERAGE_CLASS;
1687  }
1688 
1689  if (changed) {
1690  u8 old_retry_short, old_retry_long;
1691  u32 old_frag_threshold, old_rts_threshold;
1692  u8 old_coverage_class;
1693 
1694  if (!rdev->ops->set_wiphy_params) {
1695  result = -EOPNOTSUPP;
1696  goto bad_res;
1697  }
1698 
1699  old_retry_short = rdev->wiphy.retry_short;
1700  old_retry_long = rdev->wiphy.retry_long;
1701  old_frag_threshold = rdev->wiphy.frag_threshold;
1702  old_rts_threshold = rdev->wiphy.rts_threshold;
1703  old_coverage_class = rdev->wiphy.coverage_class;
1704 
1705  if (changed & WIPHY_PARAM_RETRY_SHORT)
1706  rdev->wiphy.retry_short = retry_short;
1707  if (changed & WIPHY_PARAM_RETRY_LONG)
1708  rdev->wiphy.retry_long = retry_long;
1709  if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
1710  rdev->wiphy.frag_threshold = frag_threshold;
1711  if (changed & WIPHY_PARAM_RTS_THRESHOLD)
1712  rdev->wiphy.rts_threshold = rts_threshold;
1713  if (changed & WIPHY_PARAM_COVERAGE_CLASS)
1714  rdev->wiphy.coverage_class = coverage_class;
1715 
1716  result = rdev->ops->set_wiphy_params(&rdev->wiphy, changed);
1717  if (result) {
1718  rdev->wiphy.retry_short = old_retry_short;
1719  rdev->wiphy.retry_long = old_retry_long;
1720  rdev->wiphy.frag_threshold = old_frag_threshold;
1721  rdev->wiphy.rts_threshold = old_rts_threshold;
1722  rdev->wiphy.coverage_class = old_coverage_class;
1723  }
1724  }
1725 
1726  bad_res:
1727  mutex_unlock(&rdev->mtx);
1728  if (netdev)
1729  dev_put(netdev);
1730  return result;
1731 }
1732 
1733 static inline u64 wdev_id(struct wireless_dev *wdev)
1734 {
1735  return (u64)wdev->identifier |
1736  ((u64)wiphy_to_dev(wdev->wiphy)->wiphy_idx << 32);
1737 }
1738 
1739 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
1740  struct cfg80211_registered_device *rdev,
1741  struct wireless_dev *wdev)
1742 {
1743  struct net_device *dev = wdev->netdev;
1744  void *hdr;
1745 
1746  hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_INTERFACE);
1747  if (!hdr)
1748  return -1;
1749 
1750  if (dev &&
1751  (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
1752  nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
1753  goto nla_put_failure;
1754 
1755  if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1756  nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
1757  nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
1758  nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
1759  nla_put_u32(msg, NL80211_ATTR_GENERATION,
1760  rdev->devlist_generation ^
1761  (cfg80211_rdev_list_generation << 2)))
1762  goto nla_put_failure;
1763 
1764  if (rdev->ops->get_channel) {
1765  struct ieee80211_channel *chan;
1766  enum nl80211_channel_type channel_type;
1767 
1768  chan = rdev->ops->get_channel(&rdev->wiphy, wdev,
1769  &channel_type);
1770  if (chan &&
1771  (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
1772  chan->center_freq) ||
1773  nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
1774  channel_type)))
1775  goto nla_put_failure;
1776  }
1777 
1778  return genlmsg_end(msg, hdr);
1779 
1780  nla_put_failure:
1781  genlmsg_cancel(msg, hdr);
1782  return -EMSGSIZE;
1783 }
1784 
1785 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
1786 {
1787  int wp_idx = 0;
1788  int if_idx = 0;
1789  int wp_start = cb->args[0];
1790  int if_start = cb->args[1];
1791  struct cfg80211_registered_device *rdev;
1792  struct wireless_dev *wdev;
1793 
1794  mutex_lock(&cfg80211_mutex);
1795  list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1796  if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1797  continue;
1798  if (wp_idx < wp_start) {
1799  wp_idx++;
1800  continue;
1801  }
1802  if_idx = 0;
1803 
1804  mutex_lock(&rdev->devlist_mtx);
1805  list_for_each_entry(wdev, &rdev->wdev_list, list) {
1806  if (if_idx < if_start) {
1807  if_idx++;
1808  continue;
1809  }
1810  if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
1811  cb->nlh->nlmsg_seq, NLM_F_MULTI,
1812  rdev, wdev) < 0) {
1813  mutex_unlock(&rdev->devlist_mtx);
1814  goto out;
1815  }
1816  if_idx++;
1817  }
1818  mutex_unlock(&rdev->devlist_mtx);
1819 
1820  wp_idx++;
1821  }
1822  out:
1823  mutex_unlock(&cfg80211_mutex);
1824 
1825  cb->args[0] = wp_idx;
1826  cb->args[1] = if_idx;
1827 
1828  return skb->len;
1829 }
1830 
1831 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
1832 {
1833  struct sk_buff *msg;
1834  struct cfg80211_registered_device *dev = info->user_ptr[0];
1835  struct wireless_dev *wdev = info->user_ptr[1];
1836 
1837  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
1838  if (!msg)
1839  return -ENOMEM;
1840 
1841  if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
1842  dev, wdev) < 0) {
1843  nlmsg_free(msg);
1844  return -ENOBUFS;
1845  }
1846 
1847  return genlmsg_reply(msg, info);
1848 }
1849 
1850 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
1851  [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
1852  [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
1853  [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
1854  [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
1855  [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
1856 };
1857 
1858 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
1859 {
1860  struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
1861  int flag;
1862 
1863  *mntrflags = 0;
1864 
1865  if (!nla)
1866  return -EINVAL;
1867 
1868  if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
1869  nla, mntr_flags_policy))
1870  return -EINVAL;
1871 
1872  for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
1873  if (flags[flag])
1874  *mntrflags |= (1<<flag);
1875 
1876  return 0;
1877 }
1878 
1879 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
1880  struct net_device *netdev, u8 use_4addr,
1881  enum nl80211_iftype iftype)
1882 {
1883  if (!use_4addr) {
1884  if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
1885  return -EBUSY;
1886  return 0;
1887  }
1888 
1889  switch (iftype) {
1890  case NL80211_IFTYPE_AP_VLAN:
1891  if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
1892  return 0;
1893  break;
1894  case NL80211_IFTYPE_STATION:
1895  if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
1896  return 0;
1897  break;
1898  default:
1899  break;
1900  }
1901 
1902  return -EOPNOTSUPP;
1903 }
1904 
1905 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
1906 {
1907  struct cfg80211_registered_device *rdev = info->user_ptr[0];
1908  struct vif_params params;
1909  int err;
1910  enum nl80211_iftype otype, ntype;
1911  struct net_device *dev = info->user_ptr[1];
1912  u32 _flags, *flags = NULL;
1913  bool change = false;
1914 
1915  memset(&params, 0, sizeof(params));
1916 
1917  otype = ntype = dev->ieee80211_ptr->iftype;
1918 
1919  if (info->attrs[NL80211_ATTR_IFTYPE]) {
1920  ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1921  if (otype != ntype)
1922  change = true;
1923  if (ntype > NL80211_IFTYPE_MAX)
1924  return -EINVAL;
1925  }
1926 
1927  if (info->attrs[NL80211_ATTR_MESH_ID]) {
1928  struct wireless_dev *wdev = dev->ieee80211_ptr;
1929 
1930  if (ntype != NL80211_IFTYPE_MESH_POINT)
1931  return -EINVAL;
1932  if (netif_running(dev))
1933  return -EBUSY;
1934 
1935  wdev_lock(wdev);
1936  BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
1937  IEEE80211_MAX_MESH_ID_LEN);
1938  wdev->mesh_id_up_len =
1939  nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
1940  memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
1941  wdev->mesh_id_up_len);
1942  wdev_unlock(wdev);
1943  }
1944 
1945  if (info->attrs[NL80211_ATTR_4ADDR]) {
1946  params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
1947  change = true;
1948  err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
1949  if (err)
1950  return err;
1951  } else {
1952  params.use_4addr = -1;
1953  }
1954 
1955  if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
1956  if (ntype != NL80211_IFTYPE_MONITOR)
1957  return -EINVAL;
1958  err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
1959  &_flags);
1960  if (err)
1961  return err;
1962 
1963  flags = &_flags;
1964  change = true;
1965  }
1966 
1967  if (change)
1968  err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
1969  else
1970  err = 0;
1971 
1972  if (!err && params.use_4addr != -1)
1973  dev->ieee80211_ptr->use_4addr = params.use_4addr;
1974 
1975  return err;
1976 }
1977 
1978 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
1979 {
1980  struct cfg80211_registered_device *rdev = info->user_ptr[0];
1981  struct vif_params params;
1982  struct wireless_dev *wdev;
1983  struct sk_buff *msg;
1984  int err;
1985  enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
1986  u32 flags;
1987 
1988  memset(&params, 0, sizeof(params));
1989 
1990  if (!info->attrs[NL80211_ATTR_IFNAME])
1991  return -EINVAL;
1992 
1993  if (info->attrs[NL80211_ATTR_IFTYPE]) {
1994  type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
1995  if (type > NL80211_IFTYPE_MAX)
1996  return -EINVAL;
1997  }
1998 
1999  if (!rdev->ops->add_virtual_intf ||
2000  !(rdev->wiphy.interface_modes & (1 << type)))
2001  return -EOPNOTSUPP;
2002 
2003  if (info->attrs[NL80211_ATTR_4ADDR]) {
2004  params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2005  err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2006  if (err)
2007  return err;
2008  }
2009 
2010  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2011  if (!msg)
2012  return -ENOMEM;
2013 
2014  err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2015  info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2016  &flags);
2017  wdev = rdev->ops->add_virtual_intf(&rdev->wiphy,
2018  nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2019  type, err ? NULL : &flags, &params);
2020  if (IS_ERR(wdev)) {
2021  nlmsg_free(msg);
2022  return PTR_ERR(wdev);
2023  }
2024 
2025  switch (type) {
2026  case NL80211_IFTYPE_MESH_POINT:
2027  if (!info->attrs[NL80211_ATTR_MESH_ID])
2028  break;
2029  wdev_lock(wdev);
2030  BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2031  IEEE80211_MAX_MESH_ID_LEN);
2032  wdev->mesh_id_up_len =
2033  nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2034  memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2035  wdev->mesh_id_up_len);
2036  wdev_unlock(wdev);
2037  break;
2038  case NL80211_IFTYPE_P2P_DEVICE:
2039  /*
2040  * P2P Device doesn't have a netdev, so doesn't go
2041  * through the netdev notifier and must be added here
2042  */
2043  mutex_init(&wdev->mtx);
2044  INIT_LIST_HEAD(&wdev->event_list);
2045  spin_lock_init(&wdev->event_lock);
2046  INIT_LIST_HEAD(&wdev->mgmt_registrations);
2047  spin_lock_init(&wdev->mgmt_registrations_lock);
2048 
2049  mutex_lock(&rdev->devlist_mtx);
2050  wdev->identifier = ++rdev->wdev_id;
2051  list_add_rcu(&wdev->list, &rdev->wdev_list);
2052  rdev->devlist_generation++;
2053  mutex_unlock(&rdev->devlist_mtx);
2054  break;
2055  default:
2056  break;
2057  }
2058 
2059  if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2060  rdev, wdev) < 0) {
2061  nlmsg_free(msg);
2062  return -ENOBUFS;
2063  }
2064 
2065  return genlmsg_reply(msg, info);
2066 }
2067 
2068 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2069 {
2070  struct cfg80211_registered_device *rdev = info->user_ptr[0];
2071  struct wireless_dev *wdev = info->user_ptr[1];
2072 
2073  if (!rdev->ops->del_virtual_intf)
2074  return -EOPNOTSUPP;
2075 
2076  /*
2077  * If we remove a wireless device without a netdev then clear
2078  * user_ptr[1] so that nl80211_post_doit won't dereference it
2079  * to check if it needs to do dev_put(). Otherwise it crashes
2080  * since the wdev has been freed, unlike with a netdev where
2081  * we need the dev_put() for the netdev to really be freed.
2082  */
2083  if (!wdev->netdev)
2084  info->user_ptr[1] = NULL;
2085 
2086  return rdev->ops->del_virtual_intf(&rdev->wiphy, wdev);
2087 }
2088 
2089 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2090 {
2091  struct cfg80211_registered_device *rdev = info->user_ptr[0];
2092  struct net_device *dev = info->user_ptr[1];
2093  u16 noack_map;
2094 
2095  if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2096  return -EINVAL;
2097 
2098  if (!rdev->ops->set_noack_map)
2099  return -EOPNOTSUPP;
2100 
2101  noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2102 
2103  return rdev->ops->set_noack_map(&rdev->wiphy, dev, noack_map);
2104 }
2105 
2106 struct get_key_cookie {
2107  struct sk_buff *msg;
2108  int error;
2109  int idx;
2110 };
2111 
2112 static void get_key_callback(void *c, struct key_params *params)
2113 {
2114  struct nlattr *key;
2115  struct get_key_cookie *cookie = c;
2116 
2117  if ((params->key &&
2118  nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2119  params->key_len, params->key)) ||
2120  (params->seq &&
2121  nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2122  params->seq_len, params->seq)) ||
2123  (params->cipher &&
2124  nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2125  params->cipher)))
2126  goto nla_put_failure;
2127 
2128  key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2129  if (!key)
2130  goto nla_put_failure;
2131 
2132  if ((params->key &&
2133  nla_put(cookie->msg, NL80211_KEY_DATA,
2134  params->key_len, params->key)) ||
2135  (params->seq &&
2136  nla_put(cookie->msg, NL80211_KEY_SEQ,
2137  params->seq_len, params->seq)) ||
2138  (params->cipher &&
2139  nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2140  params->cipher)))
2141  goto nla_put_failure;
2142 
2143  if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2144  goto nla_put_failure;
2145 
2146  nla_nest_end(cookie->msg, key);
2147 
2148  return;
2149  nla_put_failure:
2150  cookie->error = 1;
2151 }
2152 
2153 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2154 {
2155  struct cfg80211_registered_device *rdev = info->user_ptr[0];
2156  int err;
2157  struct net_device *dev = info->user_ptr[1];
2158  u8 key_idx = 0;
2159  const u8 *mac_addr = NULL;
2160  bool pairwise;
2161  struct get_key_cookie cookie = {
2162  .error = 0,
2163  };
2164  void *hdr;
2165  struct sk_buff *msg;
2166 
2167  if (info->attrs[NL80211_ATTR_KEY_IDX])
2168  key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2169 
2170  if (key_idx > 5)
2171  return -EINVAL;
2172 
2173  if (info->attrs[NL80211_ATTR_MAC])
2174  mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2175 
2176  pairwise = !!mac_addr;
2177  if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2178  u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2179  if (kt >= NUM_NL80211_KEYTYPES)
2180  return -EINVAL;
2181  if (kt != NL80211_KEYTYPE_GROUP &&
2182  kt != NL80211_KEYTYPE_PAIRWISE)
2183  return -EINVAL;
2184  pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2185  }
2186 
2187  if (!rdev->ops->get_key)
2188  return -EOPNOTSUPP;
2189 
2190  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2191  if (!msg)
2192  return -ENOMEM;
2193 
2194  hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2195  NL80211_CMD_NEW_KEY);
2196  if (IS_ERR(hdr))
2197  return PTR_ERR(hdr);
2198 
2199  cookie.msg = msg;
2200  cookie.idx = key_idx;
2201 
2202  if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2203  nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2204  goto nla_put_failure;
2205  if (mac_addr &&
2206  nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2207  goto nla_put_failure;
2208 
2209  if (pairwise && mac_addr &&
2210  !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2211  return -ENOENT;
2212 
2213  err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, pairwise,
2214  mac_addr, &cookie, get_key_callback);
2215 
2216  if (err)
2217  goto free_msg;
2218 
2219  if (cookie.error)
2220  goto nla_put_failure;
2221 
2222  genlmsg_end(msg, hdr);
2223  return genlmsg_reply(msg, info);
2224 
2225  nla_put_failure:
2226  err = -ENOBUFS;
2227  free_msg:
2228  nlmsg_free(msg);
2229  return err;
2230 }
2231 
2232 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2233 {
2234  struct cfg80211_registered_device *rdev = info->user_ptr[0];
2235  struct key_parse key;
2236  int err;
2237  struct net_device *dev = info->user_ptr[1];
2238 
2239  err = nl80211_parse_key(info, &key);
2240  if (err)
2241  return err;
2242 
2243  if (key.idx < 0)
2244  return -EINVAL;
2245 
2246  /* only support setting default key */
2247  if (!key.def && !key.defmgmt)
2248  return -EINVAL;
2249 
2250  wdev_lock(dev->ieee80211_ptr);
2251 
2252  if (key.def) {
2253  if (!rdev->ops->set_default_key) {
2254  err = -EOPNOTSUPP;
2255  goto out;
2256  }
2257 
2258  err = nl80211_key_allowed(dev->ieee80211_ptr);
2259  if (err)
2260  goto out;
2261 
2262  err = rdev->ops->set_default_key(&rdev->wiphy, dev, key.idx,
2263  key.def_uni, key.def_multi);
2264 
2265  if (err)
2266  goto out;
2267 
2268 #ifdef CONFIG_CFG80211_WEXT
2269  dev->ieee80211_ptr->wext.default_key = key.idx;
2270 #endif
2271  } else {
2272  if (key.def_uni || !key.def_multi) {
2273  err = -EINVAL;
2274  goto out;
2275  }
2276 
2277  if (!rdev->ops->set_default_mgmt_key) {
2278  err = -EOPNOTSUPP;
2279  goto out;
2280  }
2281 
2282  err = nl80211_key_allowed(dev->ieee80211_ptr);
2283  if (err)
2284  goto out;
2285 
2286  err = rdev->ops->set_default_mgmt_key(&rdev->wiphy,
2287  dev, key.idx);
2288  if (err)
2289  goto out;
2290 
2291 #ifdef CONFIG_CFG80211_WEXT
2292  dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2293 #endif
2294  }
2295 
2296  out:
2297  wdev_unlock(dev->ieee80211_ptr);
2298 
2299  return err;
2300 }
2301 
2302 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2303 {
2304  struct cfg80211_registered_device *rdev = info->user_ptr[0];
2305  int err;
2306  struct net_device *dev = info->user_ptr[1];
2307  struct key_parse key;
2308  const u8 *mac_addr = NULL;
2309 
2310  err = nl80211_parse_key(info, &key);
2311  if (err)
2312  return err;
2313 
2314  if (!key.p.key)
2315  return -EINVAL;
2316 
2317  if (info->attrs[NL80211_ATTR_MAC])
2318  mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2319 
2320  if (key.type == -1) {
2321  if (mac_addr)
2322  key.type = NL80211_KEYTYPE_PAIRWISE;
2323  else
2324  key.type = NL80211_KEYTYPE_GROUP;
2325  }
2326 
2327  /* for now */
2328  if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2329  key.type != NL80211_KEYTYPE_GROUP)
2330  return -EINVAL;
2331 
2332  if (!rdev->ops->add_key)
2333  return -EOPNOTSUPP;
2334 
2335  if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
2336  key.type == NL80211_KEYTYPE_PAIRWISE,
2337  mac_addr))
2338  return -EINVAL;
2339 
2340  wdev_lock(dev->ieee80211_ptr);
2341  err = nl80211_key_allowed(dev->ieee80211_ptr);
2342  if (!err)
2343  err = rdev->ops->add_key(&rdev->wiphy, dev, key.idx,
2344  key.type == NL80211_KEYTYPE_PAIRWISE,
2345  mac_addr, &key.p);
2346  wdev_unlock(dev->ieee80211_ptr);
2347 
2348  return err;
2349 }
2350 
2351 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
2352 {
2353  struct cfg80211_registered_device *rdev = info->user_ptr[0];
2354  int err;
2355  struct net_device *dev = info->user_ptr[1];
2356  u8 *mac_addr = NULL;
2357  struct key_parse key;
2358 
2359  err = nl80211_parse_key(info, &key);
2360  if (err)
2361  return err;
2362 
2363  if (info->attrs[NL80211_ATTR_MAC])
2364  mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2365 
2366  if (key.type == -1) {
2367  if (mac_addr)
2368  key.type = NL80211_KEYTYPE_PAIRWISE;
2369  else
2370  key.type = NL80211_KEYTYPE_GROUP;
2371  }
2372 
2373  /* for now */
2374  if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2375  key.type != NL80211_KEYTYPE_GROUP)
2376  return -EINVAL;
2377 
2378  if (!rdev->ops->del_key)
2379  return -EOPNOTSUPP;
2380 
2381  wdev_lock(dev->ieee80211_ptr);
2382  err = nl80211_key_allowed(dev->ieee80211_ptr);
2383 
2384  if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
2385  !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2386  err = -ENOENT;
2387 
2388  if (!err)
2389  err = rdev->ops->del_key(&rdev->wiphy, dev, key.idx,
2390  key.type == NL80211_KEYTYPE_PAIRWISE,
2391  mac_addr);
2392 
2393 #ifdef CONFIG_CFG80211_WEXT
2394  if (!err) {
2395  if (key.idx == dev->ieee80211_ptr->wext.default_key)
2396  dev->ieee80211_ptr->wext.default_key = -1;
2397  else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2398  dev->ieee80211_ptr->wext.default_mgmt_key = -1;
2399  }
2400 #endif
2401  wdev_unlock(dev->ieee80211_ptr);
2402 
2403  return err;
2404 }
2405 
2406 static int nl80211_parse_beacon(struct genl_info *info,
2407  struct cfg80211_beacon_data *bcn)
2408 {
2409  bool haveinfo = false;
2410 
2411  if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_BEACON_TAIL]) ||
2412  !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]) ||
2413  !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
2414  !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]))
2415  return -EINVAL;
2416 
2417  memset(bcn, 0, sizeof(*bcn));
2418 
2419  if (info->attrs[NL80211_ATTR_BEACON_HEAD]) {
2420  bcn->head = nla_data(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2421  bcn->head_len = nla_len(info->attrs[NL80211_ATTR_BEACON_HEAD]);
2422  if (!bcn->head_len)
2423  return -EINVAL;
2424  haveinfo = true;
2425  }
2426 
2427  if (info->attrs[NL80211_ATTR_BEACON_TAIL]) {
2428  bcn->tail = nla_data(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2429  bcn->tail_len =
2430  nla_len(info->attrs[NL80211_ATTR_BEACON_TAIL]);
2431  haveinfo = true;
2432  }
2433 
2434  if (!haveinfo)
2435  return -EINVAL;
2436 
2437  if (info->attrs[NL80211_ATTR_IE]) {
2438  bcn->beacon_ies = nla_data(info->attrs[NL80211_ATTR_IE]);
2439  bcn->beacon_ies_len = nla_len(info->attrs[NL80211_ATTR_IE]);
2440  }
2441 
2442  if (info->attrs[NL80211_ATTR_IE_PROBE_RESP]) {
2443  bcn->proberesp_ies =
2444  nla_data(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2445  bcn->proberesp_ies_len =
2446  nla_len(info->attrs[NL80211_ATTR_IE_PROBE_RESP]);
2447  }
2448 
2449  if (info->attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
2450  bcn->assocresp_ies =
2451  nla_data(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2452  bcn->assocresp_ies_len =
2453  nla_len(info->attrs[NL80211_ATTR_IE_ASSOC_RESP]);
2454  }
2455 
2456  if (info->attrs[NL80211_ATTR_PROBE_RESP]) {
2457  bcn->probe_resp =
2458  nla_data(info->attrs[NL80211_ATTR_PROBE_RESP]);
2459  bcn->probe_resp_len =
2460  nla_len(info->attrs[NL80211_ATTR_PROBE_RESP]);
2461  }
2462 
2463  return 0;
2464 }
2465 
2466 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
2467  struct cfg80211_ap_settings *params)
2468 {
2469  struct wireless_dev *wdev;
2470  bool ret = false;
2471 
2472  mutex_lock(&rdev->devlist_mtx);
2473 
2474  list_for_each_entry(wdev, &rdev->wdev_list, list) {
2475  if (wdev->iftype != NL80211_IFTYPE_AP &&
2476  wdev->iftype != NL80211_IFTYPE_P2P_GO)
2477  continue;
2478 
2479  if (!wdev->preset_chan)
2480  continue;
2481 
2482  params->channel = wdev->preset_chan;
2483  params->channel_type = wdev->preset_chantype;
2484  ret = true;
2485  break;
2486  }
2487 
2488  mutex_unlock(&rdev->devlist_mtx);
2489 
2490  return ret;
2491 }
2492 
2493 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
2494 {
2495  struct cfg80211_registered_device *rdev = info->user_ptr[0];
2496  struct net_device *dev = info->user_ptr[1];
2497  struct wireless_dev *wdev = dev->ieee80211_ptr;
2498  struct cfg80211_ap_settings params;
2499  int err;
2500 
2501  if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2502  dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2503  return -EOPNOTSUPP;
2504 
2505  if (!rdev->ops->start_ap)
2506  return -EOPNOTSUPP;
2507 
2508  if (wdev->beacon_interval)
2509  return -EALREADY;
2510 
2511  memset(&params, 0, sizeof(params));
2512 
2513  /* these are required for START_AP */
2514  if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
2515  !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
2516  !info->attrs[NL80211_ATTR_BEACON_HEAD])
2517  return -EINVAL;
2518 
2519  err = nl80211_parse_beacon(info, &params.beacon);
2520  if (err)
2521  return err;
2522 
2523  params.beacon_interval =
2524  nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
2525  params.dtim_period =
2526  nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
2527 
2528  err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
2529  if (err)
2530  return err;
2531 
2532  /*
2533  * In theory, some of these attributes should be required here
2534  * but since they were not used when the command was originally
2535  * added, keep them optional for old user space programs to let
2536  * them continue to work with drivers that do not need the
2537  * additional information -- drivers must check!
2538  */
2539  if (info->attrs[NL80211_ATTR_SSID]) {
2540  params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
2541  params.ssid_len =
2542  nla_len(info->attrs[NL80211_ATTR_SSID]);
2543  if (params.ssid_len == 0 ||
2544  params.ssid_len > IEEE80211_MAX_SSID_LEN)
2545  return -EINVAL;
2546  }
2547 
2548  if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
2549  params.hidden_ssid = nla_get_u32(
2550  info->attrs[NL80211_ATTR_HIDDEN_SSID]);
2551  if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
2552  params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
2553  params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
2554  return -EINVAL;
2555  }
2556 
2557  params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
2558 
2559  if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
2560  params.auth_type = nla_get_u32(
2561  info->attrs[NL80211_ATTR_AUTH_TYPE]);
2562  if (!nl80211_valid_auth_type(params.auth_type))
2563  return -EINVAL;
2564  } else
2565  params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
2566 
2567  err = nl80211_crypto_settings(rdev, info, &params.crypto,
2568  NL80211_MAX_NR_CIPHER_SUITES);
2569  if (err)
2570  return err;
2571 
2572  if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
2573  if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
2574  return -EOPNOTSUPP;
2575  params.inactivity_timeout = nla_get_u16(
2576  info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
2577  }
2578 
2579  if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2580  enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
2581 
2582  if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE] &&
2583  !nl80211_valid_channel_type(info, &channel_type))
2584  return -EINVAL;
2585 
2586  params.channel = rdev_freq_to_chan(rdev,
2587  nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]),
2588  channel_type);
2589  if (!params.channel)
2590  return -EINVAL;
2591  params.channel_type = channel_type;
2592  } else if (wdev->preset_chan) {
2593  params.channel = wdev->preset_chan;
2594  params.channel_type = wdev->preset_chantype;
2595  } else if (!nl80211_get_ap_channel(rdev, &params))
2596  return -EINVAL;
2597 
2598  if (!cfg80211_can_beacon_sec_chan(&rdev->wiphy, params.channel,
2599  params.channel_type))
2600  return -EINVAL;
2601 
2602  mutex_lock(&rdev->devlist_mtx);
2603  err = cfg80211_can_use_chan(rdev, wdev, params.channel,
2604  CHAN_MODE_SHARED);
2605  mutex_unlock(&rdev->devlist_mtx);
2606 
2607  if (err)
2608  return err;
2609 
2610  err = rdev->ops->start_ap(&rdev->wiphy, dev, &params);
2611  if (!err) {
2612  wdev->preset_chan = params.channel;
2613  wdev->preset_chantype = params.channel_type;
2614  wdev->beacon_interval = params.beacon_interval;
2615  wdev->channel = params.channel;
2616  }
2617  return err;
2618 }
2619 
2620 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
2621 {
2622  struct cfg80211_registered_device *rdev = info->user_ptr[0];
2623  struct net_device *dev = info->user_ptr[1];
2624  struct wireless_dev *wdev = dev->ieee80211_ptr;
2625  struct cfg80211_beacon_data params;
2626  int err;
2627 
2628  if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2629  dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2630  return -EOPNOTSUPP;
2631 
2632  if (!rdev->ops->change_beacon)
2633  return -EOPNOTSUPP;
2634 
2635  if (!wdev->beacon_interval)
2636  return -EINVAL;
2637 
2638  err = nl80211_parse_beacon(info, &params);
2639  if (err)
2640  return err;
2641 
2642  return rdev->ops->change_beacon(&rdev->wiphy, dev, &params);
2643 }
2644 
2645 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
2646 {
2647  struct cfg80211_registered_device *rdev = info->user_ptr[0];
2648  struct net_device *dev = info->user_ptr[1];
2649 
2650  return cfg80211_stop_ap(rdev, dev);
2651 }
2652 
2653 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
2654  [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
2655  [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
2656  [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
2657  [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
2658  [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
2659  [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
2660 };
2661 
2662 static int parse_station_flags(struct genl_info *info,
2663  enum nl80211_iftype iftype,
2664  struct station_parameters *params)
2665 {
2666  struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
2667  struct nlattr *nla;
2668  int flag;
2669 
2670  /*
2671  * Try parsing the new attribute first so userspace
2672  * can specify both for older kernels.
2673  */
2674  nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
2675  if (nla) {
2676  struct nl80211_sta_flag_update *sta_flags;
2677 
2678  sta_flags = nla_data(nla);
2679  params->sta_flags_mask = sta_flags->mask;
2680  params->sta_flags_set = sta_flags->set;
2681  if ((params->sta_flags_mask |
2682  params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
2683  return -EINVAL;
2684  return 0;
2685  }
2686 
2687  /* if present, parse the old attribute */
2688 
2689  nla = info->attrs[NL80211_ATTR_STA_FLAGS];
2690  if (!nla)
2691  return 0;
2692 
2693  if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
2694  nla, sta_flags_policy))
2695  return -EINVAL;
2696 
2697  /*
2698  * Only allow certain flags for interface types so that
2699  * other attributes are silently ignored. Remember that
2700  * this is backward compatibility code with old userspace
2701  * and shouldn't be hit in other cases anyway.
2702  */
2703  switch (iftype) {
2704  case NL80211_IFTYPE_AP:
2705  case NL80211_IFTYPE_AP_VLAN:
2706  case NL80211_IFTYPE_P2P_GO:
2707  params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
2708  BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
2709  BIT(NL80211_STA_FLAG_WME) |
2710  BIT(NL80211_STA_FLAG_MFP);
2711  break;
2712  case NL80211_IFTYPE_P2P_CLIENT:
2713  case NL80211_IFTYPE_STATION:
2714  params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
2715  BIT(NL80211_STA_FLAG_TDLS_PEER);
2716  break;
2717  case NL80211_IFTYPE_MESH_POINT:
2718  params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
2719  BIT(NL80211_STA_FLAG_MFP) |
2720  BIT(NL80211_STA_FLAG_AUTHORIZED);
2721  default:
2722  return -EINVAL;
2723  }
2724 
2725  for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
2726  if (flags[flag]) {
2727  params->sta_flags_set |= (1<<flag);
2728 
2729  /* no longer support new API additions in old API */
2730  if (flag > NL80211_STA_FLAG_MAX_OLD_API)
2731  return -EINVAL;
2732  }
2733  }
2734 
2735  return 0;
2736 }
2737 
2738 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
2739  int attr)
2740 {
2741  struct nlattr *rate;
2742  u32 bitrate;
2743  u16 bitrate_compat;
2744 
2745  rate = nla_nest_start(msg, attr);
2746  if (!rate)
2747  goto nla_put_failure;
2748 
2749  /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
2750  bitrate = cfg80211_calculate_bitrate(info);
2751  /* report 16-bit bitrate only if we can */
2752  bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
2753  if ((bitrate > 0 &&
2754  nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate)) ||
2755  (bitrate_compat > 0 &&
2756  nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat)) ||
2757  ((info->flags & RATE_INFO_FLAGS_MCS) &&
2758  nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs)) ||
2759  ((info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH) &&
2760  nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH)) ||
2761  ((info->flags & RATE_INFO_FLAGS_SHORT_GI) &&
2762  nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI)))
2763  goto nla_put_failure;
2764 
2765  nla_nest_end(msg, rate);
2766  return true;
2767 
2768 nla_put_failure:
2769  return false;
2770 }
2771 
2772 static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
2773  int flags,
2774  struct cfg80211_registered_device *rdev,
2775  struct net_device *dev,
2776  const u8 *mac_addr, struct station_info *sinfo)
2777 {
2778  void *hdr;
2779  struct nlattr *sinfoattr, *bss_param;
2780 
2781  hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
2782  if (!hdr)
2783  return -1;
2784 
2785  if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2786  nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
2787  nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
2788  goto nla_put_failure;
2789 
2790  sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
2791  if (!sinfoattr)
2792  goto nla_put_failure;
2793  if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
2794  nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
2795  sinfo->connected_time))
2796  goto nla_put_failure;
2797  if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
2798  nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
2799  sinfo->inactive_time))
2800  goto nla_put_failure;
2801  if ((sinfo->filled & STATION_INFO_RX_BYTES) &&
2802  nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
2803  sinfo->rx_bytes))
2804  goto nla_put_failure;
2805  if ((sinfo->filled & STATION_INFO_TX_BYTES) &&
2806  nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
2807  sinfo->tx_bytes))
2808  goto nla_put_failure;
2809  if ((sinfo->filled & STATION_INFO_LLID) &&
2810  nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
2811  goto nla_put_failure;
2812  if ((sinfo->filled & STATION_INFO_PLID) &&
2813  nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
2814  goto nla_put_failure;
2815  if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
2816  nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
2817  sinfo->plink_state))
2818  goto nla_put_failure;
2819  switch (rdev->wiphy.signal_type) {
2820  case CFG80211_SIGNAL_TYPE_MBM:
2821  if ((sinfo->filled & STATION_INFO_SIGNAL) &&
2822  nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
2823  sinfo->signal))
2824  goto nla_put_failure;
2825  if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
2826  nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
2827  sinfo->signal_avg))
2828  goto nla_put_failure;
2829  break;
2830  default:
2831  break;
2832  }
2833  if (sinfo->filled & STATION_INFO_TX_BITRATE) {
2834  if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
2835  NL80211_STA_INFO_TX_BITRATE))
2836  goto nla_put_failure;
2837  }
2838  if (sinfo->filled & STATION_INFO_RX_BITRATE) {
2839  if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
2840  NL80211_STA_INFO_RX_BITRATE))
2841  goto nla_put_failure;
2842  }
2843  if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
2844  nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
2845  sinfo->rx_packets))
2846  goto nla_put_failure;
2847  if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
2848  nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
2849  sinfo->tx_packets))
2850  goto nla_put_failure;
2851  if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
2852  nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
2853  sinfo->tx_retries))
2854  goto nla_put_failure;
2855  if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
2856  nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
2857  sinfo->tx_failed))
2858  goto nla_put_failure;
2859  if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
2860  nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
2861  sinfo->beacon_loss_count))
2862  goto nla_put_failure;
2863  if (sinfo->filled & STATION_INFO_BSS_PARAM) {
2864  bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
2865  if (!bss_param)
2866  goto nla_put_failure;
2867 
2868  if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
2869  nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
2870  ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
2871  nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
2872  ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
2873  nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
2874  nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
2875  sinfo->bss_param.dtim_period) ||
2876  nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
2877  sinfo->bss_param.beacon_interval))
2878  goto nla_put_failure;
2879 
2880  nla_nest_end(msg, bss_param);
2881  }
2882  if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
2883  nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
2884  sizeof(struct nl80211_sta_flag_update),
2885  &sinfo->sta_flags))
2886  goto nla_put_failure;
2887  if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
2888  nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
2889  sinfo->t_offset))
2890  goto nla_put_failure;
2891  nla_nest_end(msg, sinfoattr);
2892 
2893  if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
2894  nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
2895  sinfo->assoc_req_ies))
2896  goto nla_put_failure;
2897 
2898  return genlmsg_end(msg, hdr);
2899 
2900  nla_put_failure:
2901  genlmsg_cancel(msg, hdr);
2902  return -EMSGSIZE;
2903 }
2904 
2905 static int nl80211_dump_station(struct sk_buff *skb,
2906  struct netlink_callback *cb)
2907 {
2908  struct station_info sinfo;
2909  struct cfg80211_registered_device *dev;
2910  struct net_device *netdev;
2911  u8 mac_addr[ETH_ALEN];
2912  int sta_idx = cb->args[1];
2913  int err;
2914 
2915  err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
2916  if (err)
2917  return err;
2918 
2919  if (!dev->ops->dump_station) {
2920  err = -EOPNOTSUPP;
2921  goto out_err;
2922  }
2923 
2924  while (1) {
2925  memset(&sinfo, 0, sizeof(sinfo));
2926  err = dev->ops->dump_station(&dev->wiphy, netdev, sta_idx,
2927  mac_addr, &sinfo);
2928  if (err == -ENOENT)
2929  break;
2930  if (err)
2931  goto out_err;
2932 
2933  if (nl80211_send_station(skb,
2934  NETLINK_CB(cb->skb).portid,
2935  cb->nlh->nlmsg_seq, NLM_F_MULTI,
2936  dev, netdev, mac_addr,
2937  &sinfo) < 0)
2938  goto out;
2939 
2940  sta_idx++;
2941  }
2942 
2943 
2944  out:
2945  cb->args[1] = sta_idx;
2946  err = skb->len;
2947  out_err:
2948  nl80211_finish_netdev_dump(dev);
2949 
2950  return err;
2951 }
2952 
2953 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
2954 {
2955  struct cfg80211_registered_device *rdev = info->user_ptr[0];
2956  struct net_device *dev = info->user_ptr[1];
2957  struct station_info sinfo;
2958  struct sk_buff *msg;
2959  u8 *mac_addr = NULL;
2960  int err;
2961 
2962  memset(&sinfo, 0, sizeof(sinfo));
2963 
2964  if (!info->attrs[NL80211_ATTR_MAC])
2965  return -EINVAL;
2966 
2967  mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2968 
2969  if (!rdev->ops->get_station)
2970  return -EOPNOTSUPP;
2971 
2972  err = rdev->ops->get_station(&rdev->wiphy, dev, mac_addr, &sinfo);
2973  if (err)
2974  return err;
2975 
2976  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2977  if (!msg)
2978  return -ENOMEM;
2979 
2980  if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
2981  rdev, dev, mac_addr, &sinfo) < 0) {
2982  nlmsg_free(msg);
2983  return -ENOBUFS;
2984  }
2985 
2986  return genlmsg_reply(msg, info);
2987 }
2988 
2989 /*
2990  * Get vlan interface making sure it is running and on the right wiphy.
2991  */
2992 static struct net_device *get_vlan(struct genl_info *info,
2993  struct cfg80211_registered_device *rdev)
2994 {
2995  struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
2996  struct net_device *v;
2997  int ret;
2998 
2999  if (!vlanattr)
3000  return NULL;
3001 
3002  v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
3003  if (!v)
3004  return ERR_PTR(-ENODEV);
3005 
3006  if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
3007  ret = -EINVAL;
3008  goto error;
3009  }
3010 
3011  if (!netif_running(v)) {
3012  ret = -ENETDOWN;
3013  goto error;
3014  }
3015 
3016  return v;
3017  error:
3018  dev_put(v);
3019  return ERR_PTR(ret);
3020 }
3021 
3022 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
3023 {
3024  struct cfg80211_registered_device *rdev = info->user_ptr[0];
3025  int err;
3026  struct net_device *dev = info->user_ptr[1];
3027  struct station_parameters params;
3028  u8 *mac_addr = NULL;
3029 
3030  memset(&params, 0, sizeof(params));
3031 
3032  params.listen_interval = -1;
3033  params.plink_state = -1;
3034 
3035  if (info->attrs[NL80211_ATTR_STA_AID])
3036  return -EINVAL;
3037 
3038  if (!info->attrs[NL80211_ATTR_MAC])
3039  return -EINVAL;
3040 
3041  mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3042 
3043  if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
3044  params.supported_rates =
3045  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3046  params.supported_rates_len =
3047  nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3048  }
3049 
3050  if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3051  params.listen_interval =
3052  nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
3053 
3054  if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3055  params.ht_capa =
3056  nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3057 
3058  if (!rdev->ops->change_station)
3059  return -EOPNOTSUPP;
3060 
3061  if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
3062  return -EINVAL;
3063 
3064  if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
3065  params.plink_action =
3066  nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
3067 
3068  if (info->attrs[NL80211_ATTR_STA_PLINK_STATE])
3069  params.plink_state =
3070  nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
3071 
3072  switch (dev->ieee80211_ptr->iftype) {
3073  case NL80211_IFTYPE_AP:
3074  case NL80211_IFTYPE_AP_VLAN:
3075  case NL80211_IFTYPE_P2P_GO:
3076  /* disallow mesh-specific things */
3077  if (params.plink_action)
3078  return -EINVAL;
3079 
3080  /* TDLS can't be set, ... */
3081  if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3082  return -EINVAL;
3083  /*
3084  * ... but don't bother the driver with it. This works around
3085  * a hostapd/wpa_supplicant issue -- it always includes the
3086  * TLDS_PEER flag in the mask even for AP mode.
3087  */
3088  params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3089 
3090  /* accept only the listed bits */
3091  if (params.sta_flags_mask &
3092  ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3093  BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3094  BIT(NL80211_STA_FLAG_WME) |
3095  BIT(NL80211_STA_FLAG_MFP)))
3096  return -EINVAL;
3097 
3098  /* must be last in here for error handling */
3099  params.vlan = get_vlan(info, rdev);
3100  if (IS_ERR(params.vlan))
3101  return PTR_ERR(params.vlan);
3102  break;
3103  case NL80211_IFTYPE_P2P_CLIENT:
3104  case NL80211_IFTYPE_STATION:
3105  /*
3106  * Don't allow userspace to change the TDLS_PEER flag,
3107  * but silently ignore attempts to change it since we
3108  * don't have state here to verify that it doesn't try
3109  * to change the flag.
3110  */
3111  params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3112  /* fall through */
3113  case NL80211_IFTYPE_ADHOC:
3114  /* disallow things sta doesn't support */
3115  if (params.plink_action)
3116  return -EINVAL;
3117  if (params.ht_capa)
3118  return -EINVAL;
3119  if (params.listen_interval >= 0)
3120  return -EINVAL;
3121  /* reject any changes other than AUTHORIZED */
3122  if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
3123  return -EINVAL;
3124  break;
3125  case NL80211_IFTYPE_MESH_POINT:
3126  /* disallow things mesh doesn't support */
3127  if (params.vlan)
3128  return -EINVAL;
3129  if (params.ht_capa)
3130  return -EINVAL;
3131  if (params.listen_interval >= 0)
3132  return -EINVAL;
3133  /*
3134  * No special handling for TDLS here -- the userspace
3135  * mesh code doesn't have this bug.
3136  */
3137  if (params.sta_flags_mask &
3138  ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3139  BIT(NL80211_STA_FLAG_MFP) |
3140  BIT(NL80211_STA_FLAG_AUTHORIZED)))
3141  return -EINVAL;
3142  break;
3143  default:
3144  return -EOPNOTSUPP;
3145  }
3146 
3147  /* be aware of params.vlan when changing code here */
3148 
3149  err = rdev->ops->change_station(&rdev->wiphy, dev, mac_addr, &params);
3150 
3151  if (params.vlan)
3152  dev_put(params.vlan);
3153 
3154  return err;
3155 }
3156 
3157 static struct nla_policy
3158 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
3159  [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
3160  [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
3161 };
3162 
3163 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
3164 {
3165  struct cfg80211_registered_device *rdev = info->user_ptr[0];
3166  int err;
3167  struct net_device *dev = info->user_ptr[1];
3168  struct station_parameters params;
3169  u8 *mac_addr = NULL;
3170 
3171  memset(&params, 0, sizeof(params));
3172 
3173  if (!info->attrs[NL80211_ATTR_MAC])
3174  return -EINVAL;
3175 
3176  if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
3177  return -EINVAL;
3178 
3179  if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
3180  return -EINVAL;
3181 
3182  if (!info->attrs[NL80211_ATTR_STA_AID])
3183  return -EINVAL;
3184 
3185  mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3186  params.supported_rates =
3187  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3188  params.supported_rates_len =
3189  nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
3190  params.listen_interval =
3191  nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
3192 
3193  params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
3194  if (!params.aid || params.aid > IEEE80211_MAX_AID)
3195  return -EINVAL;
3196 
3197  if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3198  params.ht_capa =
3199  nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3200 
3201  if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
3202  params.plink_action =
3203  nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
3204 
3205  if (!rdev->ops->add_station)
3206  return -EOPNOTSUPP;
3207 
3208  if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
3209  return -EINVAL;
3210 
3211  switch (dev->ieee80211_ptr->iftype) {
3212  case NL80211_IFTYPE_AP:
3213  case NL80211_IFTYPE_AP_VLAN:
3214  case NL80211_IFTYPE_P2P_GO:
3215  /* parse WME attributes if sta is WME capable */
3216  if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
3217  (params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)) &&
3218  info->attrs[NL80211_ATTR_STA_WME]) {
3219  struct nlattr *tb[NL80211_STA_WME_MAX + 1];
3220  struct nlattr *nla;
3221 
3222  nla = info->attrs[NL80211_ATTR_STA_WME];
3223  err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
3224  nl80211_sta_wme_policy);
3225  if (err)
3226  return err;
3227 
3228  if (tb[NL80211_STA_WME_UAPSD_QUEUES])
3229  params.uapsd_queues =
3230  nla_get_u8(tb[NL80211_STA_WME_UAPSD_QUEUES]);
3231  if (params.uapsd_queues &
3232  ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
3233  return -EINVAL;
3234 
3235  if (tb[NL80211_STA_WME_MAX_SP])
3236  params.max_sp =
3237  nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
3238 
3239  if (params.max_sp &
3240  ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
3241  return -EINVAL;
3242 
3243  params.sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
3244  }
3245  /* TDLS peers cannot be added */
3246  if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3247  return -EINVAL;
3248  /* but don't bother the driver with it */
3249  params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3250 
3251  /* must be last in here for error handling */
3252  params.vlan = get_vlan(info, rdev);
3253  if (IS_ERR(params.vlan))
3254  return PTR_ERR(params.vlan);
3255  break;
3256  case NL80211_IFTYPE_MESH_POINT:
3257  /* TDLS peers cannot be added */
3258  if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3259  return -EINVAL;
3260  break;
3261  case NL80211_IFTYPE_STATION:
3262  /* Only TDLS peers can be added */
3263  if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3264  return -EINVAL;
3265  /* Can only add if TDLS ... */
3266  if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
3267  return -EOPNOTSUPP;
3268  /* ... with external setup is supported */
3269  if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
3270  return -EOPNOTSUPP;
3271  break;
3272  default:
3273  return -EOPNOTSUPP;
3274  }
3275 
3276  /* be aware of params.vlan when changing code here */
3277 
3278  err = rdev->ops->add_station(&rdev->wiphy, dev, mac_addr, &params);
3279 
3280  if (params.vlan)
3281  dev_put(params.vlan);
3282  return err;
3283 }
3284 
3285 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
3286 {
3287  struct cfg80211_registered_device *rdev = info->user_ptr[0];
3288  struct net_device *dev = info->user_ptr[1];
3289  u8 *mac_addr = NULL;
3290 
3291  if (info->attrs[NL80211_ATTR_MAC])
3292  mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3293 
3294  if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3295  dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
3296  dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
3297  dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3298  return -EINVAL;
3299 
3300  if (!rdev->ops->del_station)
3301  return -EOPNOTSUPP;
3302 
3303  return rdev->ops->del_station(&rdev->wiphy, dev, mac_addr);
3304 }
3305 
3306 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
3307  int flags, struct net_device *dev,
3308  u8 *dst, u8 *next_hop,
3309  struct mpath_info *pinfo)
3310 {
3311  void *hdr;
3312  struct nlattr *pinfoattr;
3313 
3314  hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3315  if (!hdr)
3316  return -1;
3317 
3318  if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3319  nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
3320  nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
3321  nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
3322  goto nla_put_failure;
3323 
3324  pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
3325  if (!pinfoattr)
3326  goto nla_put_failure;
3327  if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
3328  nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
3329  pinfo->frame_qlen))
3330  goto nla_put_failure;
3331  if (((pinfo->filled & MPATH_INFO_SN) &&
3332  nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
3333  ((pinfo->filled & MPATH_INFO_METRIC) &&
3334  nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
3335  pinfo->metric)) ||
3336  ((pinfo->filled & MPATH_INFO_EXPTIME) &&
3337  nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
3338  pinfo->exptime)) ||
3339  ((pinfo->filled & MPATH_INFO_FLAGS) &&
3340  nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
3341  pinfo->flags)) ||
3342  ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
3343  nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
3344  pinfo->discovery_timeout)) ||
3345  ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
3346  nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
3347  pinfo->discovery_retries)))
3348  goto nla_put_failure;
3349 
3350  nla_nest_end(msg, pinfoattr);
3351 
3352  return genlmsg_end(msg, hdr);
3353 
3354  nla_put_failure:
3355  genlmsg_cancel(msg, hdr);
3356  return -EMSGSIZE;
3357 }
3358 
3359 static int nl80211_dump_mpath(struct sk_buff *skb,
3360  struct netlink_callback *cb)
3361 {
3362  struct mpath_info pinfo;
3363  struct cfg80211_registered_device *dev;
3364  struct net_device *netdev;
3365  u8 dst[ETH_ALEN];
3366  u8 next_hop[ETH_ALEN];
3367  int path_idx = cb->args[1];
3368  int err;
3369 
3370  err = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
3371  if (err)
3372  return err;
3373 
3374  if (!dev->ops->dump_mpath) {
3375  err = -EOPNOTSUPP;
3376  goto out_err;
3377  }
3378 
3379  if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT) {
3380  err = -EOPNOTSUPP;
3381  goto out_err;
3382  }
3383 
3384  while (1) {
3385  err = dev->ops->dump_mpath(&dev->wiphy, netdev, path_idx,
3386  dst, next_hop, &pinfo);
3387  if (err == -ENOENT)
3388  break;
3389  if (err)
3390  goto out_err;
3391 
3392  if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
3393  cb->nlh->nlmsg_seq, NLM_F_MULTI,
3394  netdev, dst, next_hop,
3395  &pinfo) < 0)
3396  goto out;
3397 
3398  path_idx++;
3399  }
3400 
3401 
3402  out:
3403  cb->args[1] = path_idx;
3404  err = skb->len;
3405  out_err:
3406  nl80211_finish_netdev_dump(dev);
3407  return err;
3408 }
3409 
3410 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
3411 {
3412  struct cfg80211_registered_device *rdev = info->user_ptr[0];
3413  int err;
3414  struct net_device *dev = info->user_ptr[1];
3415  struct mpath_info pinfo;
3416  struct sk_buff *msg;
3417  u8 *dst = NULL;
3418  u8 next_hop[ETH_ALEN];
3419 
3420  memset(&pinfo, 0, sizeof(pinfo));
3421 
3422  if (!info->attrs[NL80211_ATTR_MAC])
3423  return -EINVAL;
3424 
3425  dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3426 
3427  if (!rdev->ops->get_mpath)
3428  return -EOPNOTSUPP;
3429 
3430  if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3431  return -EOPNOTSUPP;
3432 
3433  err = rdev->ops->get_mpath(&rdev->wiphy, dev, dst, next_hop, &pinfo);
3434  if (err)
3435  return err;
3436 
3437  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3438  if (!msg)
3439  return -ENOMEM;
3440 
3441  if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
3442  dev, dst, next_hop, &pinfo) < 0) {
3443  nlmsg_free(msg);
3444  return -ENOBUFS;
3445  }
3446 
3447  return genlmsg_reply(msg, info);
3448 }
3449 
3450 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
3451 {
3452  struct cfg80211_registered_device *rdev = info->user_ptr[0];
3453  struct net_device *dev = info->user_ptr[1];
3454  u8 *dst = NULL;
3455  u8 *next_hop = NULL;
3456 
3457  if (!info->attrs[NL80211_ATTR_MAC])
3458  return -EINVAL;
3459 
3460  if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
3461  return -EINVAL;
3462 
3463  dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3464  next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
3465 
3466  if (!rdev->ops->change_mpath)
3467  return -EOPNOTSUPP;
3468 
3469  if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3470  return -EOPNOTSUPP;
3471 
3472  return rdev->ops->change_mpath(&rdev->wiphy, dev, dst, next_hop);
3473 }
3474 
3475 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
3476 {
3477  struct cfg80211_registered_device *rdev = info->user_ptr[0];
3478  struct net_device *dev = info->user_ptr[1];
3479  u8 *dst = NULL;
3480  u8 *next_hop = NULL;
3481 
3482  if (!info->attrs[NL80211_ATTR_MAC])
3483  return -EINVAL;
3484 
3485  if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
3486  return -EINVAL;
3487 
3488  dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3489  next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
3490 
3491  if (!rdev->ops->add_mpath)
3492  return -EOPNOTSUPP;
3493 
3494  if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
3495  return -EOPNOTSUPP;
3496 
3497  return rdev->ops->add_mpath(&rdev->wiphy, dev, dst, next_hop);
3498 }
3499 
3500 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
3501 {
3502  struct cfg80211_registered_device *rdev = info->user_ptr[0];
3503  struct net_device *dev = info->user_ptr[1];
3504  u8 *dst = NULL;
3505 
3506  if (info->attrs[NL80211_ATTR_MAC])
3507  dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
3508 
3509  if (!rdev->ops->del_mpath)
3510  return -EOPNOTSUPP;
3511 
3512  return rdev->ops->del_mpath(&rdev->wiphy, dev, dst);
3513 }
3514 
3515 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
3516 {
3517  struct cfg80211_registered_device *rdev = info->user_ptr[0];
3518  struct net_device *dev = info->user_ptr[1];
3519  struct bss_parameters params;
3520 
3521  memset(&params, 0, sizeof(params));
3522  /* default to not changing parameters */
3523  params.use_cts_prot = -1;
3524  params.use_short_preamble = -1;
3525  params.use_short_slot_time = -1;
3526  params.ap_isolate = -1;
3527  params.ht_opmode = -1;
3528 
3529  if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
3530  params.use_cts_prot =
3531  nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
3532  if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
3533  params.use_short_preamble =
3534  nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
3535  if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
3536  params.use_short_slot_time =
3537  nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
3538  if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
3539  params.basic_rates =
3540  nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
3541  params.basic_rates_len =
3542  nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
3543  }
3544  if (info->attrs[NL80211_ATTR_AP_ISOLATE])
3545  params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
3546  if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
3547  params.ht_opmode =
3548  nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
3549 
3550  if (!rdev->ops->change_bss)
3551  return -EOPNOTSUPP;
3552 
3553  if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3554  dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3555  return -EOPNOTSUPP;
3556 
3557  return rdev->ops->change_bss(&rdev->wiphy, dev, &params);
3558 }
3559 
3560 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
3561  [NL80211_ATTR_REG_RULE_FLAGS] = { .type = NLA_U32 },
3562  [NL80211_ATTR_FREQ_RANGE_START] = { .type = NLA_U32 },
3563  [NL80211_ATTR_FREQ_RANGE_END] = { .type = NLA_U32 },
3564  [NL80211_ATTR_FREQ_RANGE_MAX_BW] = { .type = NLA_U32 },
3565  [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN] = { .type = NLA_U32 },
3566  [NL80211_ATTR_POWER_RULE_MAX_EIRP] = { .type = NLA_U32 },
3567 };
3568 
3569 static int parse_reg_rule(struct nlattr *tb[],
3570  struct ieee80211_reg_rule *reg_rule)
3571 {
3572  struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
3573  struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
3574 
3575  if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
3576  return -EINVAL;
3577  if (!tb[NL80211_ATTR_FREQ_RANGE_START])
3578  return -EINVAL;
3579  if (!tb[NL80211_ATTR_FREQ_RANGE_END])
3580  return -EINVAL;
3581  if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
3582  return -EINVAL;
3583  if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
3584  return -EINVAL;
3585 
3586  reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
3587 
3588  freq_range->start_freq_khz =
3589  nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
3590  freq_range->end_freq_khz =
3591  nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
3592  freq_range->max_bandwidth_khz =
3593  nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
3594 
3595  power_rule->max_eirp =
3596  nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
3597 
3598  if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
3599  power_rule->max_antenna_gain =
3600  nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
3601 
3602  return 0;
3603 }
3604 
3605 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
3606 {
3607  int r;
3608  char *data = NULL;
3609  enum nl80211_user_reg_hint_type user_reg_hint_type;
3610 
3611  /*
3612  * You should only get this when cfg80211 hasn't yet initialized
3613  * completely when built-in to the kernel right between the time
3614  * window between nl80211_init() and regulatory_init(), if that is
3615  * even possible.
3616  */
3617  mutex_lock(&cfg80211_mutex);
3618  if (unlikely(!cfg80211_regdomain)) {
3619  mutex_unlock(&cfg80211_mutex);
3620  return -EINPROGRESS;
3621  }
3622  mutex_unlock(&cfg80211_mutex);
3623 
3624  if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
3625  return -EINVAL;
3626 
3627  data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
3628 
3629  if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
3630  user_reg_hint_type =
3631  nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
3632  else
3633  user_reg_hint_type = NL80211_USER_REG_HINT_USER;
3634 
3635  switch (user_reg_hint_type) {
3636  case NL80211_USER_REG_HINT_USER:
3637  case NL80211_USER_REG_HINT_CELL_BASE:
3638  break;
3639  default:
3640  return -EINVAL;
3641  }
3642 
3643  r = regulatory_hint_user(data, user_reg_hint_type);
3644 
3645  return r;
3646 }
3647 
3648 static int nl80211_get_mesh_config(struct sk_buff *skb,
3649  struct genl_info *info)
3650 {
3651  struct cfg80211_registered_device *rdev = info->user_ptr[0];
3652  struct net_device *dev = info->user_ptr[1];
3653  struct wireless_dev *wdev = dev->ieee80211_ptr;
3654  struct mesh_config cur_params;
3655  int err = 0;
3656  void *hdr;
3657  struct nlattr *pinfoattr;
3658  struct sk_buff *msg;
3659 
3660  if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
3661  return -EOPNOTSUPP;
3662 
3663  if (!rdev->ops->get_mesh_config)
3664  return -EOPNOTSUPP;
3665 
3666  wdev_lock(wdev);
3667  /* If not connected, get default parameters */
3668  if (!wdev->mesh_id_len)
3669  memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
3670  else
3671  err = rdev->ops->get_mesh_config(&rdev->wiphy, dev,
3672  &cur_params);
3673  wdev_unlock(wdev);
3674 
3675  if (err)
3676  return err;
3677 
3678  /* Draw up a netlink message to send back */
3679  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3680  if (!msg)
3681  return -ENOMEM;
3682  hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
3683  NL80211_CMD_GET_MESH_CONFIG);
3684  if (!hdr)
3685  goto out;
3686  pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
3687  if (!pinfoattr)
3688  goto nla_put_failure;
3689  if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3690  nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
3691  cur_params.dot11MeshRetryTimeout) ||
3692  nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
3693  cur_params.dot11MeshConfirmTimeout) ||
3694  nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
3695  cur_params.dot11MeshHoldingTimeout) ||
3696  nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
3697  cur_params.dot11MeshMaxPeerLinks) ||
3698  nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
3699  cur_params.dot11MeshMaxRetries) ||
3700  nla_put_u8(msg, NL80211_MESHCONF_TTL,
3701  cur_params.dot11MeshTTL) ||
3702  nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
3703  cur_params.element_ttl) ||
3704  nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
3705  cur_params.auto_open_plinks) ||
3706  nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
3707  cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
3708  nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
3709  cur_params.dot11MeshHWMPmaxPREQretries) ||
3710  nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
3711  cur_params.path_refresh_time) ||
3712  nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
3713  cur_params.min_discovery_timeout) ||
3714  nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
3715  cur_params.dot11MeshHWMPactivePathTimeout) ||
3716  nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
3717  cur_params.dot11MeshHWMPpreqMinInterval) ||
3718  nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
3719  cur_params.dot11MeshHWMPperrMinInterval) ||
3720  nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
3721  cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
3722  nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
3723  cur_params.dot11MeshHWMPRootMode) ||
3724  nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
3725  cur_params.dot11MeshHWMPRannInterval) ||
3726  nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
3727  cur_params.dot11MeshGateAnnouncementProtocol) ||
3728  nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
3729  cur_params.dot11MeshForwarding) ||
3730  nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
3731  cur_params.rssi_threshold) ||
3732  nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
3733  cur_params.ht_opmode) ||
3734  nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
3735  cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
3736  nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
3737  cur_params.dot11MeshHWMProotInterval) ||
3738  nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
3739  cur_params.dot11MeshHWMPconfirmationInterval))
3740  goto nla_put_failure;
3741  nla_nest_end(msg, pinfoattr);
3742  genlmsg_end(msg, hdr);
3743  return genlmsg_reply(msg, info);
3744 
3745  nla_put_failure:
3746  genlmsg_cancel(msg, hdr);
3747  out:
3748  nlmsg_free(msg);
3749  return -ENOBUFS;
3750 }
3751 
3752 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
3753  [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
3754  [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
3755  [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
3756  [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
3757  [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
3758  [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
3759  [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
3760  [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
3761  [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
3762  [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
3763  [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
3764  [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
3765  [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
3766  [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
3767  [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
3768  [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
3769  [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
3770  [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
3771  [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
3772  [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
3773  [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
3774  [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
3775  [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
3776  [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
3777  [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
3778 };
3779 
3780 static const struct nla_policy
3781  nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
3782  [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
3783  [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
3784  [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
3785  [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
3786  [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
3787  .len = IEEE80211_MAX_DATA_LEN },
3788  [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
3789 };
3790 
3791 static int nl80211_parse_mesh_config(struct genl_info *info,
3792  struct mesh_config *cfg,
3793  u32 *mask_out)
3794 {
3795  struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
3796  u32 mask = 0;
3797 
3798 #define FILL_IN_MESH_PARAM_IF_SET(table, cfg, param, mask, attr_num, nla_fn) \
3799 do {\
3800  if (table[attr_num]) {\
3801  cfg->param = nla_fn(table[attr_num]); \
3802  mask |= (1 << (attr_num - 1)); \
3803  } \
3804 } while (0);\
3805 
3806 
3807  if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
3808  return -EINVAL;
3809  if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
3810  info->attrs[NL80211_ATTR_MESH_CONFIG],
3811  nl80211_meshconf_params_policy))
3812  return -EINVAL;
3813 
3814  /* This makes sure that there aren't more than 32 mesh config
3815  * parameters (otherwise our bitfield scheme would not work.) */
3816  BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
3817 
3818  /* Fill in the params struct */
3819  FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout,
3820  mask, NL80211_MESHCONF_RETRY_TIMEOUT,
3821  nla_get_u16);
3822  FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout,
3823  mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
3824  nla_get_u16);
3825  FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout,
3826  mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
3827  nla_get_u16);
3828  FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks,
3829  mask, NL80211_MESHCONF_MAX_PEER_LINKS,
3830  nla_get_u16);
3831  FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries,
3832  mask, NL80211_MESHCONF_MAX_RETRIES,
3833  nla_get_u8);
3834  FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL,
3835  mask, NL80211_MESHCONF_TTL, nla_get_u8);
3836  FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl,
3837  mask, NL80211_MESHCONF_ELEMENT_TTL,
3838  nla_get_u8);
3839  FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks,
3840  mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
3841  nla_get_u8);
3842  FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor, mask,
3843  NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
3844  nla_get_u32);
3845  FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries,
3846  mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
3847  nla_get_u8);
3848  FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time,
3849  mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
3850  nla_get_u32);
3851  FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout,
3852  mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
3853  nla_get_u16);
3854  FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout, mask,
3855  NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
3856  nla_get_u32);
3857  FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
3858  mask, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
3859  nla_get_u16);
3860  FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
3861  mask, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
3862  nla_get_u16);
3863  FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3864  dot11MeshHWMPnetDiameterTraversalTime, mask,
3865  NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
3866  nla_get_u16);
3867  FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
3868  NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
3869  FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
3870  NL80211_MESHCONF_HWMP_RANN_INTERVAL,
3871  nla_get_u16);
3872  FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3873  dot11MeshGateAnnouncementProtocol, mask,
3874  NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
3875  nla_get_u8);
3876  FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding,
3877  mask, NL80211_MESHCONF_FORWARDING,
3878  nla_get_u8);
3879  FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold,
3880  mask, NL80211_MESHCONF_RSSI_THRESHOLD,
3881  nla_get_u32);
3882  FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode,
3883  mask, NL80211_MESHCONF_HT_OPMODE,
3884  nla_get_u16);
3885  FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
3886  mask,
3887  NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
3888  nla_get_u32);
3889  FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval,
3890  mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
3891  nla_get_u16);
3892  FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
3893  dot11MeshHWMPconfirmationInterval, mask,
3894  NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
3895  nla_get_u16);
3896  if (mask_out)
3897  *mask_out = mask;
3898 
3899  return 0;
3900 
3901 #undef FILL_IN_MESH_PARAM_IF_SET
3902 }
3903 
3904 static int nl80211_parse_mesh_setup(struct genl_info *info,
3905  struct mesh_setup *setup)
3906 {
3907  struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
3908 
3909  if (!info->attrs[NL80211_ATTR_MESH_SETUP])
3910  return -EINVAL;
3911  if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
3912  info->attrs[NL80211_ATTR_MESH_SETUP],
3913  nl80211_mesh_setup_params_policy))
3914  return -EINVAL;
3915 
3916  if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
3917  setup->sync_method =
3918  (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
3919  IEEE80211_SYNC_METHOD_VENDOR :
3920  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
3921 
3922  if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
3923  setup->path_sel_proto =
3924  (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
3925  IEEE80211_PATH_PROTOCOL_VENDOR :
3926  IEEE80211_PATH_PROTOCOL_HWMP;
3927 
3928  if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
3929  setup->path_metric =
3930  (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
3931  IEEE80211_PATH_METRIC_VENDOR :
3932  IEEE80211_PATH_METRIC_AIRTIME;
3933 
3934 
3935  if (tb[NL80211_MESH_SETUP_IE]) {
3936  struct nlattr *ieattr =
3937  tb[NL80211_MESH_SETUP_IE];
3938  if (!is_valid_ie_attr(ieattr))
3939  return -EINVAL;
3940  setup->ie = nla_data(ieattr);
3941  setup->ie_len = nla_len(ieattr);
3942  }
3943  setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
3944  setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
3945 
3946  return 0;
3947 }
3948 
3949 static int nl80211_update_mesh_config(struct sk_buff *skb,
3950  struct genl_info *info)
3951 {
3952  struct cfg80211_registered_device *rdev = info->user_ptr[0];
3953  struct net_device *dev = info->user_ptr[1];
3954  struct wireless_dev *wdev = dev->ieee80211_ptr;
3955  struct mesh_config cfg;
3956  u32 mask;
3957  int err;
3958 
3959  if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
3960  return -EOPNOTSUPP;
3961 
3962  if (!rdev->ops->update_mesh_config)
3963  return -EOPNOTSUPP;
3964 
3965  err = nl80211_parse_mesh_config(info, &cfg, &mask);
3966  if (err)
3967  return err;
3968 
3969  wdev_lock(wdev);
3970  if (!wdev->mesh_id_len)
3971  err = -ENOLINK;
3972 
3973  if (!err)
3974  err = rdev->ops->update_mesh_config(&rdev->wiphy, dev,
3975  mask, &cfg);
3976 
3977  wdev_unlock(wdev);
3978 
3979  return err;
3980 }
3981 
3982 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
3983 {
3984  struct sk_buff *msg;
3985  void *hdr = NULL;
3986  struct nlattr *nl_reg_rules;
3987  unsigned int i;
3988  int err = -EINVAL;
3989 
3990  mutex_lock(&cfg80211_mutex);
3991 
3992  if (!cfg80211_regdomain)
3993  goto out;
3994 
3995  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3996  if (!msg) {
3997  err = -ENOBUFS;
3998  goto out;
3999  }
4000 
4001  hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4002  NL80211_CMD_GET_REG);
4003  if (!hdr)
4004  goto put_failure;
4005 
4006  if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
4007  cfg80211_regdomain->alpha2) ||
4008  (cfg80211_regdomain->dfs_region &&
4009  nla_put_u8(msg, NL80211_ATTR_DFS_REGION,
4010  cfg80211_regdomain->dfs_region)))
4011  goto nla_put_failure;
4012 
4013  if (reg_last_request_cell_base() &&
4014  nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
4015  NL80211_USER_REG_HINT_CELL_BASE))
4016  goto nla_put_failure;
4017 
4018  nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
4019  if (!nl_reg_rules)
4020  goto nla_put_failure;
4021 
4022  for (i = 0; i < cfg80211_regdomain->n_reg_rules; i++) {
4023  struct nlattr *nl_reg_rule;
4024  const struct ieee80211_reg_rule *reg_rule;
4025  const struct ieee80211_freq_range *freq_range;
4026  const struct ieee80211_power_rule *power_rule;
4027 
4028  reg_rule = &cfg80211_regdomain->reg_rules[i];
4029  freq_range = &reg_rule->freq_range;
4030  power_rule = &reg_rule->power_rule;
4031 
4032  nl_reg_rule = nla_nest_start(msg, i);
4033  if (!nl_reg_rule)
4034  goto nla_put_failure;
4035 
4036  if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
4037  reg_rule->flags) ||
4038  nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
4039  freq_range->start_freq_khz) ||
4040  nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
4041  freq_range->end_freq_khz) ||
4042  nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
4043  freq_range->max_bandwidth_khz) ||
4044  nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
4045  power_rule->max_antenna_gain) ||
4046  nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
4047  power_rule->max_eirp))
4048  goto nla_put_failure;
4049 
4050  nla_nest_end(msg, nl_reg_rule);
4051  }
4052 
4053  nla_nest_end(msg, nl_reg_rules);
4054 
4055  genlmsg_end(msg, hdr);
4056  err = genlmsg_reply(msg, info);
4057  goto out;
4058 
4059 nla_put_failure:
4060  genlmsg_cancel(msg, hdr);
4061 put_failure:
4062  nlmsg_free(msg);
4063  err = -EMSGSIZE;
4064 out:
4065  mutex_unlock(&cfg80211_mutex);
4066  return err;
4067 }
4068 
4069 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
4070 {
4071  struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
4072  struct nlattr *nl_reg_rule;
4073  char *alpha2 = NULL;
4074  int rem_reg_rules = 0, r = 0;
4075  u32 num_rules = 0, rule_idx = 0, size_of_regd;
4076  u8 dfs_region = 0;
4077  struct ieee80211_regdomain *rd = NULL;
4078 
4079  if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4080  return -EINVAL;
4081 
4082  if (!info->attrs[NL80211_ATTR_REG_RULES])
4083  return -EINVAL;
4084 
4085  alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4086 
4087  if (info->attrs[NL80211_ATTR_DFS_REGION])
4088  dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
4089 
4090  nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
4091  rem_reg_rules) {
4092  num_rules++;
4093  if (num_rules > NL80211_MAX_SUPP_REG_RULES)
4094  return -EINVAL;
4095  }
4096 
4097  mutex_lock(&cfg80211_mutex);
4098 
4099  if (!reg_is_valid_request(alpha2)) {
4100  r = -EINVAL;
4101  goto bad_reg;
4102  }
4103 
4104  size_of_regd = sizeof(struct ieee80211_regdomain) +
4105  (num_rules * sizeof(struct ieee80211_reg_rule));
4106 
4107  rd = kzalloc(size_of_regd, GFP_KERNEL);
4108  if (!rd) {
4109  r = -ENOMEM;
4110  goto bad_reg;
4111  }
4112 
4113  rd->n_reg_rules = num_rules;
4114  rd->alpha2[0] = alpha2[0];
4115  rd->alpha2[1] = alpha2[1];
4116 
4117  /*
4118  * Disable DFS master mode if the DFS region was
4119  * not supported or known on this kernel.
4120  */
4121  if (reg_supported_dfs_region(dfs_region))
4122  rd->dfs_region = dfs_region;
4123 
4124  nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
4125  rem_reg_rules) {
4126  nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
4127  nla_data(nl_reg_rule), nla_len(nl_reg_rule),
4128  reg_rule_policy);
4129  r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
4130  if (r)
4131  goto bad_reg;
4132 
4133  rule_idx++;
4134 
4135  if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
4136  r = -EINVAL;
4137  goto bad_reg;
4138  }
4139  }
4140 
4141  BUG_ON(rule_idx != num_rules);
4142 
4143  r = set_regdom(rd);
4144 
4145  mutex_unlock(&cfg80211_mutex);
4146 
4147  return r;
4148 
4149  bad_reg:
4150  mutex_unlock(&cfg80211_mutex);
4151  kfree(rd);
4152  return r;
4153 }
4154 
4155 static int validate_scan_freqs(struct nlattr *freqs)
4156 {
4157  struct nlattr *attr1, *attr2;
4158  int n_channels = 0, tmp1, tmp2;
4159 
4160  nla_for_each_nested(attr1, freqs, tmp1) {
4161  n_channels++;
4162  /*
4163  * Some hardware has a limited channel list for
4164  * scanning, and it is pretty much nonsensical
4165  * to scan for a channel twice, so disallow that
4166  * and don't require drivers to check that the
4167  * channel list they get isn't longer than what
4168  * they can scan, as long as they can scan all
4169  * the channels they registered at once.
4170  */
4171  nla_for_each_nested(attr2, freqs, tmp2)
4172  if (attr1 != attr2 &&
4173  nla_get_u32(attr1) == nla_get_u32(attr2))
4174  return 0;
4175  }
4176 
4177  return n_channels;
4178 }
4179 
4180 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
4181 {
4182  struct cfg80211_registered_device *rdev = info->user_ptr[0];
4183  struct wireless_dev *wdev = info->user_ptr[1];
4184  struct cfg80211_scan_request *request;
4185  struct nlattr *attr;
4186  struct wiphy *wiphy;
4187  int err, tmp, n_ssids = 0, n_channels, i;
4188  size_t ie_len;
4189 
4190  if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4191  return -EINVAL;
4192 
4193  wiphy = &rdev->wiphy;
4194 
4195  if (!rdev->ops->scan)
4196  return -EOPNOTSUPP;
4197 
4198  if (rdev->scan_req)
4199  return -EBUSY;
4200 
4201  if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4202  n_channels = validate_scan_freqs(
4203  info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
4204  if (!n_channels)
4205  return -EINVAL;
4206  } else {
4207  enum ieee80211_band band;
4208  n_channels = 0;
4209 
4210  for (band = 0; band < IEEE80211_NUM_BANDS; band++)
4211  if (wiphy->bands[band])
4212  n_channels += wiphy->bands[band]->n_channels;
4213  }
4214 
4215  if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
4216  nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
4217  n_ssids++;
4218 
4219  if (n_ssids > wiphy->max_scan_ssids)
4220  return -EINVAL;
4221 
4222  if (info->attrs[NL80211_ATTR_IE])
4223  ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4224  else
4225  ie_len = 0;
4226 
4227  if (ie_len > wiphy->max_scan_ie_len)
4228  return -EINVAL;
4229 
4230  request = kzalloc(sizeof(*request)
4231  + sizeof(*request->ssids) * n_ssids
4232  + sizeof(*request->channels) * n_channels
4233  + ie_len, GFP_KERNEL);
4234  if (!request)
4235  return -ENOMEM;
4236 
4237  if (n_ssids)
4238  request->ssids = (void *)&request->channels[n_channels];
4239  request->n_ssids = n_ssids;
4240  if (ie_len) {
4241  if (request->ssids)
4242  request->ie = (void *)(request->ssids + n_ssids);
4243  else
4244  request->ie = (void *)(request->channels + n_channels);
4245  }
4246 
4247  i = 0;
4248  if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4249  /* user specified, bail out if channel not found */
4250  nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
4251  struct ieee80211_channel *chan;
4252 
4253  chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
4254 
4255  if (!chan) {
4256  err = -EINVAL;
4257  goto out_free;
4258  }
4259 
4260  /* ignore disabled channels */
4261  if (chan->flags & IEEE80211_CHAN_DISABLED)
4262  continue;
4263 
4264  request->channels[i] = chan;
4265  i++;
4266  }
4267  } else {
4268  enum ieee80211_band band;
4269 
4270  /* all channels */
4271  for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
4272  int j;
4273  if (!wiphy->bands[band])
4274  continue;
4275  for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
4276  struct ieee80211_channel *chan;
4277 
4278  chan = &wiphy->bands[band]->channels[j];
4279 
4280  if (chan->flags & IEEE80211_CHAN_DISABLED)
4281  continue;
4282 
4283  request->channels[i] = chan;
4284  i++;
4285  }
4286  }
4287  }
4288 
4289  if (!i) {
4290  err = -EINVAL;
4291  goto out_free;
4292  }
4293 
4294  request->n_channels = i;
4295 
4296  i = 0;
4297  if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
4298  nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
4299  if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
4300  err = -EINVAL;
4301  goto out_free;
4302  }
4303  request->ssids[i].ssid_len = nla_len(attr);
4304  memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
4305  i++;
4306  }
4307  }
4308 
4309  if (info->attrs[NL80211_ATTR_IE]) {
4310  request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4311  memcpy((void *)request->ie,
4312  nla_data(info->attrs[NL80211_ATTR_IE]),
4313  request->ie_len);
4314  }
4315 
4316  for (i = 0; i < IEEE80211_NUM_BANDS; i++)
4317  if (wiphy->bands[i])
4318  request->rates[i] =
4319  (1 << wiphy->bands[i]->n_bitrates) - 1;
4320 
4321  if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
4322  nla_for_each_nested(attr,
4323  info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
4324  tmp) {
4325  enum ieee80211_band band = nla_type(attr);
4326 
4327  if (band < 0 || band >= IEEE80211_NUM_BANDS) {
4328  err = -EINVAL;
4329  goto out_free;
4330  }
4331  err = ieee80211_get_ratemask(wiphy->bands[band],
4332  nla_data(attr),
4333  nla_len(attr),
4334  &request->rates[band]);
4335  if (err)
4336  goto out_free;
4337  }
4338  }
4339 
4340  request->no_cck =
4341  nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
4342 
4343  request->wdev = wdev;
4344  request->wiphy = &rdev->wiphy;
4345 
4346  rdev->scan_req = request;
4347  err = rdev->ops->scan(&rdev->wiphy, request);
4348 
4349  if (!err) {
4350  nl80211_send_scan_start(rdev, wdev);
4351  if (wdev->netdev)
4352  dev_hold(wdev->netdev);
4353  } else {
4354  out_free:
4355  rdev->scan_req = NULL;
4356  kfree(request);
4357  }
4358 
4359  return err;
4360 }
4361 
4362 static int nl80211_start_sched_scan(struct sk_buff *skb,
4363  struct genl_info *info)
4364 {
4365  struct cfg80211_sched_scan_request *request;
4366  struct cfg80211_registered_device *rdev = info->user_ptr[0];
4367  struct net_device *dev = info->user_ptr[1];
4368  struct nlattr *attr;
4369  struct wiphy *wiphy;
4370  int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
4371  u32 interval;
4372  enum ieee80211_band band;
4373  size_t ie_len;
4374  struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
4375 
4376  if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
4377  !rdev->ops->sched_scan_start)
4378  return -EOPNOTSUPP;
4379 
4380  if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4381  return -EINVAL;
4382 
4383  if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
4384  return -EINVAL;
4385 
4386  interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
4387  if (interval == 0)
4388  return -EINVAL;
4389 
4390  wiphy = &rdev->wiphy;
4391 
4392  if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4393  n_channels = validate_scan_freqs(
4394  info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
4395  if (!n_channels)
4396  return -EINVAL;
4397  } else {
4398  n_channels = 0;
4399 
4400  for (band = 0; band < IEEE80211_NUM_BANDS; band++)
4401  if (wiphy->bands[band])
4402  n_channels += wiphy->bands[band]->n_channels;
4403  }
4404 
4405  if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
4406  nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
4407  tmp)
4408  n_ssids++;
4409 
4410  if (n_ssids > wiphy->max_sched_scan_ssids)
4411  return -EINVAL;
4412 
4413  if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
4414  nla_for_each_nested(attr,
4415  info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
4416  tmp)
4417  n_match_sets++;
4418 
4419  if (n_match_sets > wiphy->max_match_sets)
4420  return -EINVAL;
4421 
4422  if (info->attrs[NL80211_ATTR_IE])
4423  ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4424  else
4425  ie_len = 0;
4426 
4427  if (ie_len > wiphy->max_sched_scan_ie_len)
4428  return -EINVAL;
4429 
4430  mutex_lock(&rdev->sched_scan_mtx);
4431 
4432  if (rdev->sched_scan_req) {
4433  err = -EINPROGRESS;
4434  goto out;
4435  }
4436 
4437  request = kzalloc(sizeof(*request)
4438  + sizeof(*request->ssids) * n_ssids
4439  + sizeof(*request->match_sets) * n_match_sets
4440  + sizeof(*request->channels) * n_channels
4441  + ie_len, GFP_KERNEL);
4442  if (!request) {
4443  err = -ENOMEM;
4444  goto out;
4445  }
4446 
4447  if (n_ssids)
4448  request->ssids = (void *)&request->channels[n_channels];
4449  request->n_ssids = n_ssids;
4450  if (ie_len) {
4451  if (request->ssids)
4452  request->ie = (void *)(request->ssids + n_ssids);
4453  else
4454  request->ie = (void *)(request->channels + n_channels);
4455  }
4456 
4457  if (n_match_sets) {
4458  if (request->ie)
4459  request->match_sets = (void *)(request->ie + ie_len);
4460  else if (request->ssids)
4461  request->match_sets =
4462  (void *)(request->ssids + n_ssids);
4463  else
4464  request->match_sets =
4465  (void *)(request->channels + n_channels);
4466  }
4467  request->n_match_sets = n_match_sets;
4468 
4469  i = 0;
4470  if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
4471  /* user specified, bail out if channel not found */
4472  nla_for_each_nested(attr,
4473  info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
4474  tmp) {
4475  struct ieee80211_channel *chan;
4476 
4477  chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
4478 
4479  if (!chan) {
4480  err = -EINVAL;
4481  goto out_free;
4482  }
4483 
4484  /* ignore disabled channels */
4485  if (chan->flags & IEEE80211_CHAN_DISABLED)
4486  continue;
4487 
4488  request->channels[i] = chan;
4489  i++;
4490  }
4491  } else {
4492  /* all channels */
4493  for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
4494  int j;
4495  if (!wiphy->bands[band])
4496  continue;
4497  for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
4498  struct ieee80211_channel *chan;
4499 
4500  chan = &wiphy->bands[band]->channels[j];
4501 
4502  if (chan->flags & IEEE80211_CHAN_DISABLED)
4503  continue;
4504 
4505  request->channels[i] = chan;
4506  i++;
4507  }
4508  }
4509  }
4510 
4511  if (!i) {
4512  err = -EINVAL;
4513  goto out_free;
4514  }
4515 
4516  request->n_channels = i;
4517 
4518  i = 0;
4519  if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
4520  nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
4521  tmp) {
4522  if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
4523  err = -EINVAL;
4524  goto out_free;
4525  }
4526  request->ssids[i].ssid_len = nla_len(attr);
4527  memcpy(request->ssids[i].ssid, nla_data(attr),
4528  nla_len(attr));
4529  i++;
4530  }
4531  }
4532 
4533  i = 0;
4534  if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
4535  nla_for_each_nested(attr,
4536  info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
4537  tmp) {
4538  struct nlattr *ssid, *rssi;
4539 
4540  nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
4541  nla_data(attr), nla_len(attr),
4542  nl80211_match_policy);
4543  ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
4544  if (ssid) {
4545  if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
4546  err = -EINVAL;
4547  goto out_free;
4548  }
4549  memcpy(request->match_sets[i].ssid.ssid,
4550  nla_data(ssid), nla_len(ssid));
4551  request->match_sets[i].ssid.ssid_len =
4552  nla_len(ssid);
4553  }
4554  rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
4555  if (rssi)
4556  request->rssi_thold = nla_get_u32(rssi);
4557  else
4558  request->rssi_thold =
4559  NL80211_SCAN_RSSI_THOLD_OFF;
4560  i++;
4561  }
4562  }
4563 
4564  if (info->attrs[NL80211_ATTR_IE]) {
4565  request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4566  memcpy((void *)request->ie,
4567  nla_data(info->attrs[NL80211_ATTR_IE]),
4568  request->ie_len);
4569  }
4570 
4571  request->dev = dev;
4572  request->wiphy = &rdev->wiphy;
4573  request->interval = interval;
4574 
4575  err = rdev->ops->sched_scan_start(&rdev->wiphy, dev, request);
4576  if (!err) {
4577  rdev->sched_scan_req = request;
4578  nl80211_send_sched_scan(rdev, dev,
4579  NL80211_CMD_START_SCHED_SCAN);
4580  goto out;
4581  }
4582 
4583 out_free:
4584  kfree(request);
4585 out:
4586  mutex_unlock(&rdev->sched_scan_mtx);
4587  return err;
4588 }
4589 
4590 static int nl80211_stop_sched_scan(struct sk_buff *skb,
4591  struct genl_info *info)
4592 {
4593  struct cfg80211_registered_device *rdev = info->user_ptr[0];
4594  int err;
4595 
4596  if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
4597  !rdev->ops->sched_scan_stop)
4598  return -EOPNOTSUPP;
4599 
4600  mutex_lock(&rdev->sched_scan_mtx);
4601  err = __cfg80211_stop_sched_scan(rdev, false);
4602  mutex_unlock(&rdev->sched_scan_mtx);
4603 
4604  return err;
4605 }
4606 
4607 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
4608  u32 seq, int flags,
4609  struct cfg80211_registered_device *rdev,
4610  struct wireless_dev *wdev,
4611  struct cfg80211_internal_bss *intbss)
4612 {
4613  struct cfg80211_bss *res = &intbss->pub;
4614  void *hdr;
4615  struct nlattr *bss;
4616 
4617  ASSERT_WDEV_LOCK(wdev);
4618 
4619  hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
4620  NL80211_CMD_NEW_SCAN_RESULTS);
4621  if (!hdr)
4622  return -1;
4623 
4624  genl_dump_check_consistent(cb, hdr, &nl80211_fam);
4625 
4626  if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation) ||
4627  nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
4628  goto nla_put_failure;
4629 
4630  bss = nla_nest_start(msg, NL80211_ATTR_BSS);
4631  if (!bss)
4632  goto nla_put_failure;
4633  if ((!is_zero_ether_addr(res->bssid) &&
4634  nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)) ||
4635  (res->information_elements && res->len_information_elements &&
4636  nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
4637  res->len_information_elements,
4638  res->information_elements)) ||
4639  (res->beacon_ies && res->len_beacon_ies &&
4640  res->beacon_ies != res->information_elements &&
4641  nla_put(msg, NL80211_BSS_BEACON_IES,
4642  res->len_beacon_ies, res->beacon_ies)))
4643  goto nla_put_failure;
4644  if (res->tsf &&
4645  nla_put_u64(msg, NL80211_BSS_TSF, res->tsf))
4646  goto nla_put_failure;
4647  if (res->beacon_interval &&
4648  nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
4649  goto nla_put_failure;
4650  if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
4651  nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
4652  nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
4653  jiffies_to_msecs(jiffies - intbss->ts)))
4654  goto nla_put_failure;
4655 
4656  switch (rdev->wiphy.signal_type) {
4657  case CFG80211_SIGNAL_TYPE_MBM:
4658  if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
4659  goto nla_put_failure;
4660  break;
4661  case CFG80211_SIGNAL_TYPE_UNSPEC:
4662  if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
4663  goto nla_put_failure;
4664  break;
4665  default:
4666  break;
4667  }
4668 
4669  switch (wdev->iftype) {
4670  case NL80211_IFTYPE_P2P_CLIENT:
4671  case NL80211_IFTYPE_STATION:
4672  if (intbss == wdev->current_bss &&
4673  nla_put_u32(msg, NL80211_BSS_STATUS,
4674  NL80211_BSS_STATUS_ASSOCIATED))
4675  goto nla_put_failure;
4676  break;
4677  case NL80211_IFTYPE_ADHOC:
4678  if (intbss == wdev->current_bss &&
4679  nla_put_u32(msg, NL80211_BSS_STATUS,
4680  NL80211_BSS_STATUS_IBSS_JOINED))
4681  goto nla_put_failure;
4682  break;
4683  default:
4684  break;
4685  }
4686 
4687  nla_nest_end(msg, bss);
4688 
4689  return genlmsg_end(msg, hdr);
4690 
4691  nla_put_failure:
4692  genlmsg_cancel(msg, hdr);
4693  return -EMSGSIZE;
4694 }
4695 
4696 static int nl80211_dump_scan(struct sk_buff *skb,
4697  struct netlink_callback *cb)
4698 {
4699  struct cfg80211_registered_device *rdev;
4700  struct net_device *dev;
4701  struct cfg80211_internal_bss *scan;
4702  struct wireless_dev *wdev;
4703  int start = cb->args[1], idx = 0;
4704  int err;
4705 
4706  err = nl80211_prepare_netdev_dump(skb, cb, &rdev, &dev);
4707  if (err)
4708  return err;
4709 
4710  wdev = dev->ieee80211_ptr;
4711 
4712  wdev_lock(wdev);
4713  spin_lock_bh(&rdev->bss_lock);
4714  cfg80211_bss_expire(rdev);
4715 
4716  cb->seq = rdev->bss_generation;
4717 
4718  list_for_each_entry(scan, &rdev->bss_list, list) {
4719  if (++idx <= start)
4720  continue;
4721  if (nl80211_send_bss(skb, cb,
4722  cb->nlh->nlmsg_seq, NLM_F_MULTI,
4723  rdev, wdev, scan) < 0) {
4724  idx--;
4725  break;
4726  }
4727  }
4728 
4729  spin_unlock_bh(&rdev->bss_lock);
4730  wdev_unlock(wdev);
4731 
4732  cb->args[1] = idx;
4733  nl80211_finish_netdev_dump(rdev);
4734 
4735  return skb->len;
4736 }
4737 
4738 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
4739  int flags, struct net_device *dev,
4740  struct survey_info *survey)
4741 {
4742  void *hdr;
4743  struct nlattr *infoattr;
4744 
4745  hdr = nl80211hdr_put(msg, portid, seq, flags,
4746  NL80211_CMD_NEW_SURVEY_RESULTS);
4747  if (!hdr)
4748  return -ENOMEM;
4749 
4750  if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
4751  goto nla_put_failure;
4752 
4753  infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
4754  if (!infoattr)
4755  goto nla_put_failure;
4756 
4757  if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
4758  survey->channel->center_freq))
4759  goto nla_put_failure;
4760 
4761  if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
4762  nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
4763  goto nla_put_failure;
4764  if ((survey->filled & SURVEY_INFO_IN_USE) &&
4765  nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
4766  goto nla_put_failure;
4767  if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
4768  nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
4769  survey->channel_time))
4770  goto nla_put_failure;
4771  if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
4772  nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
4773  survey->channel_time_busy))
4774  goto nla_put_failure;
4775  if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
4776  nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
4777  survey->channel_time_ext_busy))
4778  goto nla_put_failure;
4779  if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
4780  nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
4781  survey->channel_time_rx))
4782  goto nla_put_failure;
4783  if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
4784  nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
4785  survey->channel_time_tx))
4786  goto nla_put_failure;
4787 
4788  nla_nest_end(msg, infoattr);
4789 
4790  return genlmsg_end(msg, hdr);
4791 
4792  nla_put_failure:
4793  genlmsg_cancel(msg, hdr);
4794  return -EMSGSIZE;
4795 }
4796 
4797 static int nl80211_dump_survey(struct sk_buff *skb,
4798  struct netlink_callback *cb)
4799 {
4800  struct survey_info survey;
4801  struct cfg80211_registered_device *dev;
4802  struct net_device *netdev;
4803  int survey_idx = cb->args[1];
4804  int res;
4805 
4806  res = nl80211_prepare_netdev_dump(skb, cb, &dev, &netdev);
4807  if (res)
4808  return res;
4809 
4810  if (!dev->ops->dump_survey) {
4811  res = -EOPNOTSUPP;
4812  goto out_err;
4813  }
4814 
4815  while (1) {
4816  struct ieee80211_channel *chan;
4817 
4818  res = dev->ops->dump_survey(&dev->wiphy, netdev, survey_idx,
4819  &survey);
4820  if (res == -ENOENT)
4821  break;
4822  if (res)
4823  goto out_err;
4824 
4825  /* Survey without a channel doesn't make sense */
4826  if (!survey.channel) {
4827  res = -EINVAL;
4828  goto out;
4829  }
4830 
4831  chan = ieee80211_get_channel(&dev->wiphy,
4832  survey.channel->center_freq);
4833  if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
4834  survey_idx++;
4835  continue;
4836  }
4837 
4838  if (nl80211_send_survey(skb,
4839  NETLINK_CB(cb->skb).portid,
4840  cb->nlh->nlmsg_seq, NLM_F_MULTI,
4841  netdev,
4842  &survey) < 0)
4843  goto out;
4844  survey_idx++;
4845  }
4846 
4847  out:
4848  cb->args[1] = survey_idx;
4849  res = skb->len;
4850  out_err:
4851  nl80211_finish_netdev_dump(dev);
4852  return res;
4853 }
4854 
4855 static bool nl80211_valid_auth_type(enum nl80211_auth_type auth_type)
4856 {
4857  return auth_type <= NL80211_AUTHTYPE_MAX;
4858 }
4859 
4860 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
4861 {
4862  return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
4863  NL80211_WPA_VERSION_2));
4864 }
4865 
4866 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
4867 {
4868  struct cfg80211_registered_device *rdev = info->user_ptr[0];
4869  struct net_device *dev = info->user_ptr[1];
4870  struct ieee80211_channel *chan;
4871  const u8 *bssid, *ssid, *ie = NULL;
4872  int err, ssid_len, ie_len = 0;
4873  enum nl80211_auth_type auth_type;
4874  struct key_parse key;
4875  bool local_state_change;
4876 
4877  if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
4878  return -EINVAL;
4879 
4880  if (!info->attrs[NL80211_ATTR_MAC])
4881  return -EINVAL;
4882 
4883  if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
4884  return -EINVAL;
4885 
4886  if (!info->attrs[NL80211_ATTR_SSID])
4887  return -EINVAL;
4888 
4889  if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
4890  return -EINVAL;
4891 
4892  err = nl80211_parse_key(info, &key);
4893  if (err)
4894  return err;
4895 
4896  if (key.idx >= 0) {
4897  if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
4898  return -EINVAL;
4899  if (!key.p.key || !key.p.key_len)
4900  return -EINVAL;
4901  if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
4902  key.p.key_len != WLAN_KEY_LEN_WEP40) &&
4903  (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
4904  key.p.key_len != WLAN_KEY_LEN_WEP104))
4905  return -EINVAL;
4906  if (key.idx > 4)
4907  return -EINVAL;
4908  } else {
4909  key.p.key_len = 0;
4910  key.p.key = NULL;
4911  }
4912 
4913  if (key.idx >= 0) {
4914  int i;
4915  bool ok = false;
4916  for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
4917  if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
4918  ok = true;
4919  break;
4920  }
4921  }
4922  if (!ok)
4923  return -EINVAL;
4924  }
4925 
4926  if (!rdev->ops->auth)
4927  return -EOPNOTSUPP;
4928 
4929  if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
4930  dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
4931  return -EOPNOTSUPP;
4932 
4933  bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
4934  chan = ieee80211_get_channel(&rdev->wiphy,
4935  nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
4936  if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
4937  return -EINVAL;
4938 
4939  ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4940  ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
4941 
4942  if (info->attrs[NL80211_ATTR_IE]) {
4943  ie = nla_data(info->attrs[NL80211_ATTR_IE]);
4944  ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
4945  }
4946 
4947  auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
4948  if (!nl80211_valid_auth_type(auth_type))
4949  return -EINVAL;
4950 
4951  local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
4952 
4953  /*
4954  * Since we no longer track auth state, ignore
4955  * requests to only change local state.
4956  */
4957  if (local_state_change)
4958  return 0;
4959 
4960  return cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
4961  ssid, ssid_len, ie, ie_len,
4962  key.p.key, key.p.key_len, key.idx);
4963 }
4964 
4965 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
4966  struct genl_info *info,
4967  struct cfg80211_crypto_settings *settings,
4968  int cipher_limit)
4969 {
4970  memset(settings, 0, sizeof(*settings));
4971 
4972  settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
4973 
4974  if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
4975  u16 proto;
4976  proto = nla_get_u16(
4977  info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
4978  settings->control_port_ethertype = cpu_to_be16(proto);
4979  if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
4980  proto != ETH_P_PAE)
4981  return -EINVAL;
4982  if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
4983  settings->control_port_no_encrypt = true;
4984  } else
4985  settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
4986 
4987  if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
4988  void *data;
4989  int len, i;
4990 
4991  data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
4992  len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
4993  settings->n_ciphers_pairwise = len / sizeof(u32);
4994 
4995  if (len % sizeof(u32))
4996  return -EINVAL;
4997 
4998  if (settings->n_ciphers_pairwise > cipher_limit)
4999  return -EINVAL;
5000 
5001  memcpy(settings->ciphers_pairwise, data, len);
5002 
5003  for (i = 0; i < settings->n_ciphers_pairwise; i++)
5004  if (!cfg80211_supported_cipher_suite(
5005  &rdev->wiphy,
5006  settings->ciphers_pairwise[i]))
5007  return -EINVAL;
5008  }
5009 
5010  if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
5011  settings->cipher_group =
5012  nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
5013  if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
5014  settings->cipher_group))
5015  return -EINVAL;
5016  }
5017 
5018  if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
5019  settings->wpa_versions =
5020  nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
5021  if (!nl80211_valid_wpa_versions(settings->wpa_versions))
5022  return -EINVAL;
5023  }
5024 
5025  if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
5026  void *data;
5027  int len;
5028 
5029  data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
5030  len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
5031  settings->n_akm_suites = len / sizeof(u32);
5032 
5033  if (len % sizeof(u32))
5034  return -EINVAL;
5035 
5036  if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
5037  return -EINVAL;
5038 
5039  memcpy(settings->akm_suites, data, len);
5040  }
5041 
5042  return 0;
5043 }
5044 
5045 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
5046 {
5047  struct cfg80211_registered_device *rdev = info->user_ptr[0];
5048  struct net_device *dev = info->user_ptr[1];
5049  struct cfg80211_crypto_settings crypto;
5050  struct ieee80211_channel *chan;
5051  const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
5052  int err, ssid_len, ie_len = 0;
5053  bool use_mfp = false;
5054  u32 flags = 0;
5055  struct ieee80211_ht_cap *ht_capa = NULL;
5056  struct ieee80211_ht_cap *ht_capa_mask = NULL;
5057 
5058  if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5059  return -EINVAL;
5060 
5061  if (!info->attrs[NL80211_ATTR_MAC] ||
5062  !info->attrs[NL80211_ATTR_SSID] ||
5063  !info->attrs[NL80211_ATTR_WIPHY_FREQ])
5064  return -EINVAL;
5065 
5066  if (!rdev->ops->assoc)
5067  return -EOPNOTSUPP;
5068 
5069  if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5070  dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5071  return -EOPNOTSUPP;
5072 
5073  bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5074 
5075  chan = ieee80211_get_channel(&rdev->wiphy,
5076  nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5077  if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
5078  return -EINVAL;
5079 
5080  ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5081  ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5082 
5083  if (info->attrs[NL80211_ATTR_IE]) {
5084  ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5085  ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5086  }
5087 
5088  if (info->attrs[NL80211_ATTR_USE_MFP]) {
5089  enum nl80211_mfp mfp =
5090  nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
5091  if (mfp == NL80211_MFP_REQUIRED)
5092  use_mfp = true;
5093  else if (mfp != NL80211_MFP_NO)
5094  return -EINVAL;
5095  }
5096 
5097  if (info->attrs[NL80211_ATTR_PREV_BSSID])
5098  prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
5099 
5100  if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
5101  flags |= ASSOC_REQ_DISABLE_HT;
5102 
5103  if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
5104  ht_capa_mask =
5105  nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]);
5106 
5107  if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
5108  if (!ht_capa_mask)
5109  return -EINVAL;
5110  ht_capa = nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5111  }
5112 
5113  err = nl80211_crypto_settings(rdev, info, &crypto, 1);
5114  if (!err)
5115  err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
5116  ssid, ssid_len, ie, ie_len, use_mfp,
5117  &crypto, flags, ht_capa,
5118  ht_capa_mask);
5119 
5120  return err;
5121 }
5122 
5123 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
5124 {
5125  struct cfg80211_registered_device *rdev = info->user_ptr[0];
5126  struct net_device *dev = info->user_ptr[1];
5127  const u8 *ie = NULL, *bssid;
5128  int ie_len = 0;
5129  u16 reason_code;
5130  bool local_state_change;
5131 
5132  if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5133  return -EINVAL;
5134 
5135  if (!info->attrs[NL80211_ATTR_MAC])
5136  return -EINVAL;
5137 
5138  if (!info->attrs[NL80211_ATTR_REASON_CODE])
5139  return -EINVAL;
5140 
5141  if (!rdev->ops->deauth)
5142  return -EOPNOTSUPP;
5143 
5144  if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5145  dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5146  return -EOPNOTSUPP;
5147 
5148  bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5149 
5150  reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5151  if (reason_code == 0) {
5152  /* Reason Code 0 is reserved */
5153  return -EINVAL;
5154  }
5155 
5156  if (info->attrs[NL80211_ATTR_IE]) {
5157  ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5158  ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5159  }
5160 
5161  local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5162 
5163  return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
5164  local_state_change);
5165 }
5166 
5167 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
5168 {
5169  struct cfg80211_registered_device *rdev = info->user_ptr[0];
5170  struct net_device *dev = info->user_ptr[1];
5171  const u8 *ie = NULL, *bssid;
5172  int ie_len = 0;
5173  u16 reason_code;
5174  bool local_state_change;
5175 
5176  if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5177  return -EINVAL;
5178 
5179  if (!info->attrs[NL80211_ATTR_MAC])
5180  return -EINVAL;
5181 
5182  if (!info->attrs[NL80211_ATTR_REASON_CODE])
5183  return -EINVAL;
5184 
5185  if (!rdev->ops->disassoc)
5186  return -EOPNOTSUPP;
5187 
5188  if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5189  dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5190  return -EOPNOTSUPP;
5191 
5192  bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5193 
5194  reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5195  if (reason_code == 0) {
5196  /* Reason Code 0 is reserved */
5197  return -EINVAL;
5198  }
5199 
5200  if (info->attrs[NL80211_ATTR_IE]) {
5201  ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5202  ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5203  }
5204 
5205  local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
5206 
5207  return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
5208  local_state_change);
5209 }
5210 
5211 static bool
5212 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
5213  int mcast_rate[IEEE80211_NUM_BANDS],
5214  int rateval)
5215 {
5216  struct wiphy *wiphy = &rdev->wiphy;
5217  bool found = false;
5218  int band, i;
5219 
5220  for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5221  struct ieee80211_supported_band *sband;
5222 
5223  sband = wiphy->bands[band];
5224  if (!sband)
5225  continue;
5226 
5227  for (i = 0; i < sband->n_bitrates; i++) {
5228  if (sband->bitrates[i].bitrate == rateval) {
5229  mcast_rate[band] = i + 1;
5230  found = true;
5231  break;
5232  }
5233  }
5234  }
5235 
5236  return found;
5237 }
5238 
5239 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
5240 {
5241  struct cfg80211_registered_device *rdev = info->user_ptr[0];
5242  struct net_device *dev = info->user_ptr[1];
5243  struct cfg80211_ibss_params ibss;
5244  struct wiphy *wiphy;
5245  struct cfg80211_cached_keys *connkeys = NULL;
5246  int err;
5247 
5248  memset(&ibss, 0, sizeof(ibss));
5249 
5250  if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5251  return -EINVAL;
5252 
5253  if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
5254  !info->attrs[NL80211_ATTR_SSID] ||
5255  !nla_len(info->attrs[NL80211_ATTR_SSID]))
5256  return -EINVAL;
5257 
5258  ibss.beacon_interval = 100;
5259 
5260  if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
5261  ibss.beacon_interval =
5262  nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
5263  if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
5264  return -EINVAL;
5265  }
5266 
5267  if (!rdev->ops->join_ibss)
5268  return -EOPNOTSUPP;
5269 
5270  if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
5271  return -EOPNOTSUPP;
5272 
5273  wiphy = &rdev->wiphy;
5274 
5275  if (info->attrs[NL80211_ATTR_MAC]) {
5276  ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5277 
5278  if (!is_valid_ether_addr(ibss.bssid))
5279  return -EINVAL;
5280  }
5281  ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5282  ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5283 
5284  if (info->attrs[NL80211_ATTR_IE]) {
5285  ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5286  ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5287  }
5288 
5289  if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
5290  enum nl80211_channel_type channel_type;
5291 
5292  if (!nl80211_valid_channel_type(info, &channel_type))
5293  return -EINVAL;
5294 
5295  if (channel_type != NL80211_CHAN_NO_HT &&
5296  !(wiphy->features & NL80211_FEATURE_HT_IBSS))
5297  return -EINVAL;
5298 
5299  ibss.channel_type = channel_type;
5300  } else {
5301  ibss.channel_type = NL80211_CHAN_NO_HT;
5302  }
5303 
5304  ibss.channel = rdev_freq_to_chan(rdev,
5305  nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]),
5306  ibss.channel_type);
5307  if (!ibss.channel ||
5308  ibss.channel->flags & IEEE80211_CHAN_NO_IBSS ||
5309  ibss.channel->flags & IEEE80211_CHAN_DISABLED)
5310  return -EINVAL;
5311 
5312  /* Both channels should be able to initiate communication */
5313  if ((ibss.channel_type == NL80211_CHAN_HT40PLUS ||
5314  ibss.channel_type == NL80211_CHAN_HT40MINUS) &&
5315  !cfg80211_can_beacon_sec_chan(&rdev->wiphy, ibss.channel,
5316  ibss.channel_type))
5317  return -EINVAL;
5318 
5319  ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
5320  ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
5321 
5322  if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
5323  u8 *rates =
5324  nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5325  int n_rates =
5326  nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5327  struct ieee80211_supported_band *sband =
5328  wiphy->bands[ibss.channel->band];
5329 
5330  err = ieee80211_get_ratemask(sband, rates, n_rates,
5331  &ibss.basic_rates);
5332  if (err)
5333  return err;
5334  }
5335 
5336  if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
5337  !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
5338  nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
5339  return -EINVAL;
5340 
5341  if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
5342  connkeys = nl80211_parse_connkeys(rdev,
5343  info->attrs[NL80211_ATTR_KEYS]);
5344  if (IS_ERR(connkeys))
5345  return PTR_ERR(connkeys);
5346  }
5347 
5348  ibss.control_port =
5349  nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
5350 
5351  err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
5352  if (err)
5353  kfree(connkeys);
5354  return err;
5355 }
5356 
5357 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
5358 {
5359  struct cfg80211_registered_device *rdev = info->user_ptr[0];
5360  struct net_device *dev = info->user_ptr[1];
5361 
5362  if (!rdev->ops->leave_ibss)
5363  return -EOPNOTSUPP;
5364 
5365  if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
5366  return -EOPNOTSUPP;
5367 
5368  return cfg80211_leave_ibss(rdev, dev, false);
5369 }
5370 
5371 #ifdef CONFIG_NL80211_TESTMODE
5372 static struct genl_multicast_group nl80211_testmode_mcgrp = {
5373  .name = "testmode",
5374 };
5375 
5376 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
5377 {
5378  struct cfg80211_registered_device *rdev = info->user_ptr[0];
5379  int err;
5380 
5381  if (!info->attrs[NL80211_ATTR_TESTDATA])
5382  return -EINVAL;
5383 
5384  err = -EOPNOTSUPP;
5385  if (rdev->ops->testmode_cmd) {
5386  rdev->testmode_info = info;
5387  err = rdev->ops->testmode_cmd(&rdev->wiphy,
5388  nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
5389  nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
5390  rdev->testmode_info = NULL;
5391  }
5392 
5393  return err;
5394 }
5395 
5396 static int nl80211_testmode_dump(struct sk_buff *skb,
5397  struct netlink_callback *cb)
5398 {
5399  struct cfg80211_registered_device *rdev;
5400  int err;
5401  long phy_idx;
5402  void *data = NULL;
5403  int data_len = 0;
5404 
5405  if (cb->args[0]) {
5406  /*
5407  * 0 is a valid index, but not valid for args[0],
5408  * so we need to offset by 1.
5409  */
5410  phy_idx = cb->args[0] - 1;
5411  } else {
5412  err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
5413  nl80211_fam.attrbuf, nl80211_fam.maxattr,
5414  nl80211_policy);
5415  if (err)
5416  return err;
5417 
5418  mutex_lock(&cfg80211_mutex);
5419  rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
5420  nl80211_fam.attrbuf);
5421  if (IS_ERR(rdev)) {
5422  mutex_unlock(&cfg80211_mutex);
5423  return PTR_ERR(rdev);
5424  }
5425  phy_idx = rdev->wiphy_idx;
5426  rdev = NULL;
5427  mutex_unlock(&cfg80211_mutex);
5428 
5429  if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
5430  cb->args[1] =
5431  (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
5432  }
5433 
5434  if (cb->args[1]) {
5435  data = nla_data((void *)cb->args[1]);
5436  data_len = nla_len((void *)cb->args[1]);
5437  }
5438 
5439  mutex_lock(&cfg80211_mutex);
5440  rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
5441  if (!rdev) {
5442  mutex_unlock(&cfg80211_mutex);
5443  return -ENOENT;
5444  }
5445  cfg80211_lock_rdev(rdev);
5446  mutex_unlock(&cfg80211_mutex);
5447 
5448  if (!rdev->ops->testmode_dump) {
5449  err = -EOPNOTSUPP;
5450  goto out_err;
5451  }
5452 
5453  while (1) {
5454  void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
5455  cb->nlh->nlmsg_seq, NLM_F_MULTI,
5456  NL80211_CMD_TESTMODE);
5457  struct nlattr *tmdata;
5458 
5459  if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
5460  genlmsg_cancel(skb, hdr);
5461  break;
5462  }
5463 
5464  tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
5465  if (!tmdata) {
5466  genlmsg_cancel(skb, hdr);
5467  break;
5468  }
5469  err = rdev->ops->testmode_dump(&rdev->wiphy, skb, cb,
5470  data, data_len);
5471  nla_nest_end(skb, tmdata);
5472 
5473  if (err == -ENOBUFS || err == -ENOENT) {
5474  genlmsg_cancel(skb, hdr);
5475  break;
5476  } else if (err) {
5477  genlmsg_cancel(skb, hdr);
5478  goto out_err;
5479  }
5480 
5481  genlmsg_end(skb, hdr);
5482  }
5483 
5484  err = skb->len;
5485  /* see above */
5486  cb->args[0] = phy_idx + 1;
5487  out_err:
5488  cfg80211_unlock_rdev(rdev);
5489  return err;
5490 }
5491 
5492 static struct sk_buff *
5493 __cfg80211_testmode_alloc_skb(struct cfg80211_registered_device *rdev,
5494  int approxlen, u32 portid, u32 seq, gfp_t gfp)
5495 {
5496  struct sk_buff *skb;
5497  void *hdr;
5498  struct nlattr *data;
5499 
5500  skb = nlmsg_new(approxlen + 100, gfp);
5501  if (!skb)
5502  return NULL;
5503 
5504  hdr = nl80211hdr_put(skb, portid, seq, 0, NL80211_CMD_TESTMODE);
5505  if (!hdr) {
5506  kfree_skb(skb);
5507  return NULL;
5508  }
5509 
5510  if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
5511  goto nla_put_failure;
5512  data = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
5513 
5514  ((void **)skb->cb)[0] = rdev;
5515  ((void **)skb->cb)[1] = hdr;
5516  ((void **)skb->cb)[2] = data;
5517 
5518  return skb;
5519 
5520  nla_put_failure:
5521  kfree_skb(skb);
5522  return NULL;
5523 }
5524 
5525 struct sk_buff *cfg80211_testmode_alloc_reply_skb(struct wiphy *wiphy,
5526  int approxlen)
5527 {
5528  struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
5529 
5530  if (WARN_ON(!rdev->testmode_info))
5531  return NULL;
5532 
5533  return __cfg80211_testmode_alloc_skb(rdev, approxlen,
5534  rdev->testmode_info->snd_portid,
5535  rdev->testmode_info->snd_seq,
5536  GFP_KERNEL);
5537 }
5538 EXPORT_SYMBOL(cfg80211_testmode_alloc_reply_skb);
5539 
5540 int cfg80211_testmode_reply(struct sk_buff *skb)
5541 {
5542  struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
5543  void *hdr = ((void **)skb->cb)[1];
5544  struct nlattr *data = ((void **)skb->cb)[2];
5545 
5546  if (WARN_ON(!rdev->testmode_info)) {
5547  kfree_skb(skb);
5548  return -EINVAL;
5549  }
5550 
5551  nla_nest_end(skb, data);
5552  genlmsg_end(skb, hdr);
5553  return genlmsg_reply(skb, rdev->testmode_info);
5554 }
5555 EXPORT_SYMBOL(cfg80211_testmode_reply);
5556 
5557 struct sk_buff *cfg80211_testmode_alloc_event_skb(struct wiphy *wiphy,
5558  int approxlen, gfp_t gfp)
5559 {
5560  struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
5561 
5562  return __cfg80211_testmode_alloc_skb(rdev, approxlen, 0, 0, gfp);
5563 }
5564 EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
5565 
5566 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
5567 {
5568  void *hdr = ((void **)skb->cb)[1];
5569  struct nlattr *data = ((void **)skb->cb)[2];
5570 
5571  nla_nest_end(skb, data);
5572  genlmsg_end(skb, hdr);
5573  genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
5574 }
5575 EXPORT_SYMBOL(cfg80211_testmode_event);
5576 #endif
5577 
5578 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
5579 {
5580  struct cfg80211_registered_device *rdev = info->user_ptr[0];
5581  struct net_device *dev = info->user_ptr[1];
5582  struct cfg80211_connect_params connect;
5583  struct wiphy *wiphy;
5584  struct cfg80211_cached_keys *connkeys = NULL;
5585  int err;
5586 
5587  memset(&connect, 0, sizeof(connect));
5588 
5589  if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5590  return -EINVAL;
5591 
5592  if (!info->attrs[NL80211_ATTR_SSID] ||
5593  !nla_len(info->attrs[NL80211_ATTR_SSID]))
5594  return -EINVAL;
5595 
5596  if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
5597  connect.auth_type =
5598  nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
5599  if (!nl80211_valid_auth_type(connect.auth_type))
5600  return -EINVAL;
5601  } else
5602  connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
5603 
5604  connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
5605 
5606  err = nl80211_crypto_settings(rdev, info, &connect.crypto,
5607  NL80211_MAX_NR_CIPHER_SUITES);
5608  if (err)
5609  return err;
5610 
5611  if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5612  dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5613  return -EOPNOTSUPP;
5614 
5615  wiphy = &rdev->wiphy;
5616 
5617  connect.bg_scan_period = -1;
5618  if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
5619  (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
5620  connect.bg_scan_period =
5621  nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
5622  }
5623 
5624  if (info->attrs[NL80211_ATTR_MAC])
5625  connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5626  connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5627  connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
5628 
5629  if (info->attrs[NL80211_ATTR_IE]) {
5630  connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
5631  connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5632  }
5633 
5634  if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
5635  connect.channel =
5636  ieee80211_get_channel(wiphy,
5637  nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
5638  if (!connect.channel ||
5639  connect.channel->flags & IEEE80211_CHAN_DISABLED)
5640  return -EINVAL;
5641  }
5642 
5643  if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
5644  connkeys = nl80211_parse_connkeys(rdev,
5645  info->attrs[NL80211_ATTR_KEYS]);
5646  if (IS_ERR(connkeys))
5647  return PTR_ERR(connkeys);
5648  }
5649 
5650  if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
5651  connect.flags |= ASSOC_REQ_DISABLE_HT;
5652 
5653  if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
5654  memcpy(&connect.ht_capa_mask,
5655  nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
5656  sizeof(connect.ht_capa_mask));
5657 
5658  if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
5659  if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
5660  kfree(connkeys);
5661  return -EINVAL;
5662  }
5663  memcpy(&connect.ht_capa,
5664  nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
5665  sizeof(connect.ht_capa));
5666  }
5667 
5668  err = cfg80211_connect(rdev, dev, &connect, connkeys);
5669  if (err)
5670  kfree(connkeys);
5671  return err;
5672 }
5673 
5674 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
5675 {
5676  struct cfg80211_registered_device *rdev = info->user_ptr[0];
5677  struct net_device *dev = info->user_ptr[1];
5678  u16 reason;
5679 
5680  if (!info->attrs[NL80211_ATTR_REASON_CODE])
5681  reason = WLAN_REASON_DEAUTH_LEAVING;
5682  else
5683  reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5684 
5685  if (reason == 0)
5686  return -EINVAL;
5687 
5688  if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5689  dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5690  return -EOPNOTSUPP;
5691 
5692  return cfg80211_disconnect(rdev, dev, reason, true);
5693 }
5694 
5695 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
5696 {
5697  struct cfg80211_registered_device *rdev = info->user_ptr[0];
5698  struct net *net;
5699  int err;
5700  u32 pid;
5701 
5702  if (!info->attrs[NL80211_ATTR_PID])
5703  return -EINVAL;
5704 
5705  pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
5706 
5707  net = get_net_ns_by_pid(pid);
5708  if (IS_ERR(net))
5709  return PTR_ERR(net);
5710 
5711  err = 0;
5712 
5713  /* check if anything to do */
5714  if (!net_eq(wiphy_net(&rdev->wiphy), net))
5715  err = cfg80211_switch_netns(rdev, net);
5716 
5717  put_net(net);
5718  return err;
5719 }
5720 
5721 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
5722 {
5723  struct cfg80211_registered_device *rdev = info->user_ptr[0];
5724  int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
5725  struct cfg80211_pmksa *pmksa) = NULL;
5726  struct net_device *dev = info->user_ptr[1];
5727  struct cfg80211_pmksa pmksa;
5728 
5729  memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
5730 
5731  if (!info->attrs[NL80211_ATTR_MAC])
5732  return -EINVAL;
5733 
5734  if (!info->attrs[NL80211_ATTR_PMKID])
5735  return -EINVAL;
5736 
5737  pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
5738  pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
5739 
5740  if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5741  dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5742  return -EOPNOTSUPP;
5743 
5744  switch (info->genlhdr->cmd) {
5745  case NL80211_CMD_SET_PMKSA:
5746  rdev_ops = rdev->ops->set_pmksa;
5747  break;
5748  case NL80211_CMD_DEL_PMKSA:
5749  rdev_ops = rdev->ops->del_pmksa;
5750  break;
5751  default:
5752  WARN_ON(1);
5753  break;
5754  }
5755 
5756  if (!rdev_ops)
5757  return -EOPNOTSUPP;
5758 
5759  return rdev_ops(&rdev->wiphy, dev, &pmksa);
5760 }
5761 
5762 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
5763 {
5764  struct cfg80211_registered_device *rdev = info->user_ptr[0];
5765  struct net_device *dev = info->user_ptr[1];
5766 
5767  if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
5768  dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
5769  return -EOPNOTSUPP;
5770 
5771  if (!rdev->ops->flush_pmksa)
5772  return -EOPNOTSUPP;
5773 
5774  return rdev->ops->flush_pmksa(&rdev->wiphy, dev);
5775 }
5776 
5777 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
5778 {
5779  struct cfg80211_registered_device *rdev = info->user_ptr[0];
5780  struct net_device *dev = info->user_ptr[1];
5781  u8 action_code, dialog_token;
5782  u16 status_code;
5783  u8 *peer;
5784 
5785  if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
5786  !rdev->ops->tdls_mgmt)
5787  return -EOPNOTSUPP;
5788 
5789  if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
5790  !info->attrs[NL80211_ATTR_STATUS_CODE] ||
5791  !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
5792  !info->attrs[NL80211_ATTR_IE] ||
5793  !info->attrs[NL80211_ATTR_MAC])
5794  return -EINVAL;
5795 
5796  peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
5797  action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
5798  status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
5799  dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
5800 
5801  return rdev->ops->tdls_mgmt(&rdev->wiphy, dev, peer, action_code,
5802  dialog_token, status_code,
5803  nla_data(info->attrs[NL80211_ATTR_IE]),
5804  nla_len(info->attrs[NL80211_ATTR_IE]));
5805 }
5806 
5807 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
5808 {
5809  struct cfg80211_registered_device *rdev = info->user_ptr[0];
5810  struct net_device *dev = info->user_ptr[1];
5811  enum nl80211_tdls_operation operation;
5812  u8 *peer;
5813 
5814  if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
5815  !rdev->ops->tdls_oper)
5816  return -EOPNOTSUPP;
5817 
5818  if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
5819  !info->attrs[NL80211_ATTR_MAC])
5820  return -EINVAL;
5821 
5822  operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
5823  peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
5824 
5825  return rdev->ops->tdls_oper(&rdev->wiphy, dev, peer, operation);
5826 }
5827 
5828 static int nl80211_remain_on_channel(struct sk_buff *skb,
5829  struct genl_info *info)
5830 {
5831  struct cfg80211_registered_device *rdev = info->user_ptr[0];
5832  struct wireless_dev *wdev = info->user_ptr[1];
5833  struct ieee80211_channel *chan;
5834  struct sk_buff *msg;
5835  void *hdr;
5836  u64 cookie;
5837  enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
5838  u32 freq, duration;
5839  int err;
5840 
5841  if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
5842  !info->attrs[NL80211_ATTR_DURATION])
5843  return -EINVAL;
5844 
5845  duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
5846 
5847  if (!rdev->ops->remain_on_channel ||
5848  !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
5849  return -EOPNOTSUPP;
5850 
5851  /*
5852  * We should be on that channel for at least a minimum amount of
5853  * time (10ms) but no longer than the driver supports.
5854  */
5855  if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
5856  duration > rdev->wiphy.max_remain_on_channel_duration)
5857  return -EINVAL;
5858 
5859  if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE] &&
5860  !nl80211_valid_channel_type(info, &channel_type))
5861  return -EINVAL;
5862 
5863  freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
5864  chan = rdev_freq_to_chan(rdev, freq, channel_type);
5865  if (chan == NULL)
5866  return -EINVAL;
5867 
5868  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5869  if (!msg)
5870  return -ENOMEM;
5871 
5872  hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5873  NL80211_CMD_REMAIN_ON_CHANNEL);
5874 
5875  if (IS_ERR(hdr)) {
5876  err = PTR_ERR(hdr);
5877  goto free_msg;
5878  }
5879 
5880  err = rdev->ops->remain_on_channel(&rdev->wiphy, wdev, chan,
5881  channel_type, duration, &cookie);
5882 
5883  if (err)
5884  goto free_msg;
5885 
5886  if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
5887  goto nla_put_failure;
5888 
5889  genlmsg_end(msg, hdr);
5890 
5891  return genlmsg_reply(msg, info);
5892 
5893  nla_put_failure:
5894  err = -ENOBUFS;
5895  free_msg:
5896  nlmsg_free(msg);
5897  return err;
5898 }
5899 
5900 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
5901  struct genl_info *info)
5902 {
5903  struct cfg80211_registered_device *rdev = info->user_ptr[0];
5904  struct wireless_dev *wdev = info->user_ptr[1];
5905  u64 cookie;
5906 
5907  if (!info->attrs[NL80211_ATTR_COOKIE])
5908  return -EINVAL;
5909 
5910  if (!rdev->ops->cancel_remain_on_channel)
5911  return -EOPNOTSUPP;
5912 
5913  cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
5914 
5915  return rdev->ops->cancel_remain_on_channel(&rdev->wiphy, wdev, cookie);
5916 }
5917 
5918 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
5919  u8 *rates, u8 rates_len)
5920 {
5921  u8 i;
5922  u32 mask = 0;
5923 
5924  for (i = 0; i < rates_len; i++) {
5925  int rate = (rates[i] & 0x7f) * 5;
5926  int ridx;
5927  for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
5928  struct ieee80211_rate *srate =
5929  &sband->bitrates[ridx];
5930  if (rate == srate->bitrate) {
5931  mask |= 1 << ridx;
5932  break;
5933  }
5934  }
5935  if (ridx == sband->n_bitrates)
5936  return 0; /* rate not found */
5937  }
5938 
5939  return mask;
5940 }
5941 
5942 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
5943  u8 *rates, u8 rates_len,
5944  u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
5945 {
5946  u8 i;
5947 
5948  memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
5949 
5950  for (i = 0; i < rates_len; i++) {
5951  int ridx, rbit;
5952 
5953  ridx = rates[i] / 8;
5954  rbit = BIT(rates[i] % 8);
5955 
5956  /* check validity */
5957  if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
5958  return false;
5959 
5960  /* check availability */
5961  if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
5962  mcs[ridx] |= rbit;
5963  else
5964  return false;
5965  }
5966 
5967  return true;
5968 }
5969 
5970 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
5971  [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
5972  .len = NL80211_MAX_SUPP_RATES },
5973  [NL80211_TXRATE_MCS] = { .type = NLA_BINARY,
5974  .len = NL80211_MAX_SUPP_HT_RATES },
5975 };
5976 
5977 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
5978  struct genl_info *info)
5979 {
5980  struct nlattr *tb[NL80211_TXRATE_MAX + 1];
5981  struct cfg80211_registered_device *rdev = info->user_ptr[0];
5982  struct cfg80211_bitrate_mask mask;
5983  int rem, i;
5984  struct net_device *dev = info->user_ptr[1];
5985  struct nlattr *tx_rates;
5986  struct ieee80211_supported_band *sband;
5987 
5988  if (info->attrs[NL80211_ATTR_TX_RATES] == NULL)
5989  return -EINVAL;
5990 
5991  if (!rdev->ops->set_bitrate_mask)
5992  return -EOPNOTSUPP;
5993 
5994  memset(&mask, 0, sizeof(mask));
5995  /* Default to all rates enabled */
5996  for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
5997  sband = rdev->wiphy.bands[i];
5998  mask.control[i].legacy =
5999  sband ? (1 << sband->n_bitrates) - 1 : 0;
6000  if (sband)
6001  memcpy(mask.control[i].mcs,
6002  sband->ht_cap.mcs.rx_mask,
6003  sizeof(mask.control[i].mcs));
6004  else
6005  memset(mask.control[i].mcs, 0,
6006  sizeof(mask.control[i].mcs));
6007  }
6008 
6009  /*
6010  * The nested attribute uses enum nl80211_band as the index. This maps
6011  * directly to the enum ieee80211_band values used in cfg80211.
6012  */
6013  BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
6014  nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
6015  {
6016  enum ieee80211_band band = nla_type(tx_rates);
6017  if (band < 0 || band >= IEEE80211_NUM_BANDS)
6018  return -EINVAL;
6019  sband = rdev->wiphy.bands[band];
6020  if (sband == NULL)
6021  return -EINVAL;
6022  nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
6023  nla_len(tx_rates), nl80211_txattr_policy);
6024  if (tb[NL80211_TXRATE_LEGACY]) {
6025  mask.control[band].legacy = rateset_to_mask(
6026  sband,
6027  nla_data(tb[NL80211_TXRATE_LEGACY]),
6028  nla_len(tb[NL80211_TXRATE_LEGACY]));
6029  if ((mask.control[band].legacy == 0) &&
6030  nla_len(tb[NL80211_TXRATE_LEGACY]))
6031  return -EINVAL;
6032  }
6033  if (tb[NL80211_TXRATE_MCS]) {
6034  if (!ht_rateset_to_mask(
6035  sband,
6036  nla_data(tb[NL80211_TXRATE_MCS]),
6037  nla_len(tb[NL80211_TXRATE_MCS]),
6038  mask.control[band].mcs))
6039  return -EINVAL;
6040  }
6041 
6042  if (mask.control[band].legacy == 0) {
6043  /* don't allow empty legacy rates if HT
6044  * is not even supported. */
6045  if (!rdev->wiphy.bands[band]->ht_cap.ht_supported)
6046  return -EINVAL;
6047 
6048  for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
6049  if (mask.control[band].mcs[i])
6050  break;
6051 
6052  /* legacy and mcs rates may not be both empty */
6053  if (i == IEEE80211_HT_MCS_MASK_LEN)
6054  return -EINVAL;
6055  }
6056  }
6057 
6058  return rdev->ops->set_bitrate_mask(&rdev->wiphy, dev, NULL, &mask);
6059 }
6060 
6061 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
6062 {
6063  struct cfg80211_registered_device *rdev = info->user_ptr[0];
6064  struct wireless_dev *wdev = info->user_ptr[1];
6065  u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
6066 
6067  if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
6068  return -EINVAL;
6069 
6070  if (info->attrs[NL80211_ATTR_FRAME_TYPE])
6071  frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
6072 
6073  switch (wdev->iftype) {
6074  case NL80211_IFTYPE_STATION:
6075  case NL80211_IFTYPE_ADHOC:
6076  case NL80211_IFTYPE_P2P_CLIENT:
6077  case NL80211_IFTYPE_AP:
6078  case NL80211_IFTYPE_AP_VLAN:
6079  case NL80211_IFTYPE_MESH_POINT:
6080  case NL80211_IFTYPE_P2P_GO:
6081  case NL80211_IFTYPE_P2P_DEVICE:
6082  break;
6083  default:
6084  return -EOPNOTSUPP;
6085  }
6086 
6087  /* not much point in registering if we can't reply */
6088  if (!rdev->ops->mgmt_tx)
6089  return -EOPNOTSUPP;
6090 
6091  return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
6092  nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
6093  nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
6094 }
6095 
6096 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
6097 {
6098  struct cfg80211_registered_device *rdev = info->user_ptr[0];
6099  struct wireless_dev *wdev = info->user_ptr[1];
6100  struct ieee80211_channel *chan;
6101  enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
6102  bool channel_type_valid = false;
6103  u32 freq;
6104  int err;
6105  void *hdr = NULL;
6106  u64 cookie;
6107  struct sk_buff *msg = NULL;
6108  unsigned int wait = 0;
6109  bool offchan, no_cck, dont_wait_for_ack;
6110 
6111  dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
6112 
6113  if (!info->attrs[NL80211_ATTR_FRAME] ||
6114  !info->attrs[NL80211_ATTR_WIPHY_FREQ])
6115  return -EINVAL;
6116 
6117  if (!rdev->ops->mgmt_tx)
6118  return -EOPNOTSUPP;
6119 
6120  switch (wdev->iftype) {
6121  case NL80211_IFTYPE_STATION:
6122  case NL80211_IFTYPE_ADHOC:
6123  case NL80211_IFTYPE_P2P_CLIENT:
6124  case NL80211_IFTYPE_AP:
6125  case NL80211_IFTYPE_AP_VLAN:
6126  case NL80211_IFTYPE_MESH_POINT:
6127  case NL80211_IFTYPE_P2P_GO:
6128  case NL80211_IFTYPE_P2P_DEVICE:
6129  break;
6130  default:
6131  return -EOPNOTSUPP;
6132  }
6133 
6134  if (info->attrs[NL80211_ATTR_DURATION]) {
6135  if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
6136  return -EINVAL;
6137  wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
6138 
6139  /*
6140  * We should wait on the channel for at least a minimum amount
6141  * of time (10ms) but no longer than the driver supports.
6142  */
6143  if (wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
6144  wait > rdev->wiphy.max_remain_on_channel_duration)
6145  return -EINVAL;
6146 
6147  }
6148 
6149  if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
6150  if (!nl80211_valid_channel_type(info, &channel_type))
6151  return -EINVAL;
6152  channel_type_valid = true;
6153  }
6154 
6155  offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
6156 
6157  if (offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
6158  return -EINVAL;
6159 
6160  no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
6161 
6162  freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
6163  chan = rdev_freq_to_chan(rdev, freq, channel_type);
6164  if (chan == NULL)
6165  return -EINVAL;
6166 
6167  if (!dont_wait_for_ack) {
6168  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6169  if (!msg)
6170  return -ENOMEM;
6171 
6172  hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6173  NL80211_CMD_FRAME);
6174 
6175  if (IS_ERR(hdr)) {
6176  err = PTR_ERR(hdr);
6177  goto free_msg;
6178  }
6179  }
6180 
6181  err = cfg80211_mlme_mgmt_tx(rdev, wdev, chan, offchan, channel_type,
6182  channel_type_valid, wait,
6183  nla_data(info->attrs[NL80211_ATTR_FRAME]),
6184  nla_len(info->attrs[NL80211_ATTR_FRAME]),
6185  no_cck, dont_wait_for_ack, &cookie);
6186  if (err)
6187  goto free_msg;
6188 
6189  if (msg) {
6190  if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
6191  goto nla_put_failure;
6192 
6193  genlmsg_end(msg, hdr);
6194  return genlmsg_reply(msg, info);
6195  }
6196 
6197  return 0;
6198 
6199  nla_put_failure:
6200  err = -ENOBUFS;
6201  free_msg:
6202  nlmsg_free(msg);
6203  return err;
6204 }
6205 
6206 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
6207 {
6208  struct cfg80211_registered_device *rdev = info->user_ptr[0];
6209  struct wireless_dev *wdev = info->user_ptr[1];
6210  u64 cookie;
6211 
6212  if (!info->attrs[NL80211_ATTR_COOKIE])
6213  return -EINVAL;
6214 
6215  if (!rdev->ops->mgmt_tx_cancel_wait)
6216  return -EOPNOTSUPP;
6217 
6218  switch (wdev->iftype) {
6219  case NL80211_IFTYPE_STATION:
6220  case NL80211_IFTYPE_ADHOC:
6221  case NL80211_IFTYPE_P2P_CLIENT:
6222  case NL80211_IFTYPE_AP:
6223  case NL80211_IFTYPE_AP_VLAN:
6224  case NL80211_IFTYPE_P2P_GO:
6225  case NL80211_IFTYPE_P2P_DEVICE:
6226  break;
6227  default:
6228  return -EOPNOTSUPP;
6229  }
6230 
6231  cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
6232 
6233  return rdev->ops->mgmt_tx_cancel_wait(&rdev->wiphy, wdev, cookie);
6234 }
6235 
6236 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
6237 {
6238  struct cfg80211_registered_device *rdev = info->user_ptr[0];
6239  struct wireless_dev *wdev;
6240  struct net_device *dev = info->user_ptr[1];
6241  u8 ps_state;
6242  bool state;
6243  int err;
6244 
6245  if (!info->attrs[NL80211_ATTR_PS_STATE])
6246  return -EINVAL;
6247 
6248  ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
6249 
6250  if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
6251  return -EINVAL;
6252 
6253  wdev = dev->ieee80211_ptr;
6254 
6255  if (!rdev->ops->set_power_mgmt)
6256  return -EOPNOTSUPP;
6257 
6258  state = (ps_state == NL80211_PS_ENABLED) ? true : false;
6259 
6260  if (state == wdev->ps)
6261  return 0;
6262 
6263  err = rdev->ops->set_power_mgmt(wdev->wiphy, dev, state,
6264  wdev->ps_timeout);
6265  if (!err)
6266  wdev->ps = state;
6267  return err;
6268 }
6269 
6270 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
6271 {
6272  struct cfg80211_registered_device *rdev = info->user_ptr[0];
6273  enum nl80211_ps_state ps_state;
6274  struct wireless_dev *wdev;
6275  struct net_device *dev = info->user_ptr[1];
6276  struct sk_buff *msg;
6277  void *hdr;
6278  int err;
6279 
6280  wdev = dev->ieee80211_ptr;
6281 
6282  if (!rdev->ops->set_power_mgmt)
6283  return -EOPNOTSUPP;
6284 
6285  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6286  if (!msg)
6287  return -ENOMEM;
6288 
6289  hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6290  NL80211_CMD_GET_POWER_SAVE);
6291  if (!hdr) {
6292  err = -ENOBUFS;
6293  goto free_msg;
6294  }
6295 
6296  if (wdev->ps)
6297  ps_state = NL80211_PS_ENABLED;
6298  else
6299  ps_state = NL80211_PS_DISABLED;
6300 
6301  if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
6302  goto nla_put_failure;
6303 
6304  genlmsg_end(msg, hdr);
6305  return genlmsg_reply(msg, info);
6306 
6307  nla_put_failure:
6308  err = -ENOBUFS;
6309  free_msg:
6310  nlmsg_free(msg);
6311  return err;
6312 }
6313 
6314 static struct nla_policy
6315 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
6316  [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
6317  [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
6318  [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
6319  [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
6320  [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
6321  [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
6322 };
6323 
6324 static int nl80211_set_cqm_txe(struct genl_info *info,
6325  u32 rate, u32 pkts, u32 intvl)
6326 {
6327  struct cfg80211_registered_device *rdev = info->user_ptr[0];
6328  struct wireless_dev *wdev;
6329  struct net_device *dev = info->user_ptr[1];
6330 
6331  if ((rate < 0 || rate > 100) ||
6332  (intvl < 0 || intvl > NL80211_CQM_TXE_MAX_INTVL))
6333  return -EINVAL;
6334 
6335  wdev = dev->ieee80211_ptr;
6336 
6337  if (!rdev->ops->set_cqm_txe_config)
6338  return -EOPNOTSUPP;
6339 
6340  if (wdev->iftype != NL80211_IFTYPE_STATION &&
6341  wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
6342  return -EOPNOTSUPP;
6343 
6344  return rdev->ops->set_cqm_txe_config(wdev->wiphy, dev,
6345  rate, pkts, intvl);
6346 }
6347 
6348 static int nl80211_set_cqm_rssi(struct genl_info *info,
6349  s32 threshold, u32 hysteresis)
6350 {
6351  struct cfg80211_registered_device *rdev = info->user_ptr[0];
6352  struct wireless_dev *wdev;
6353  struct net_device *dev = info->user_ptr[1];
6354 
6355  if (threshold > 0)
6356  return -EINVAL;
6357 
6358  wdev = dev->ieee80211_ptr;
6359 
6360  if (!rdev->ops->set_cqm_rssi_config)
6361  return -EOPNOTSUPP;
6362 
6363  if (wdev->iftype != NL80211_IFTYPE_STATION &&
6364  wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
6365  return -EOPNOTSUPP;
6366 
6367  return rdev->ops->set_cqm_rssi_config(wdev->wiphy, dev,
6368  threshold, hysteresis);
6369 }
6370 
6371 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
6372 {
6373  struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
6374  struct nlattr *cqm;
6375  int err;
6376 
6377  cqm = info->attrs[NL80211_ATTR_CQM];
6378  if (!cqm) {
6379  err = -EINVAL;
6380  goto out;
6381  }
6382 
6383  err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
6384  nl80211_attr_cqm_policy);
6385  if (err)
6386  goto out;
6387 
6388  if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
6389  attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
6390  s32 threshold;
6391  u32 hysteresis;
6392  threshold = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
6393  hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
6394  err = nl80211_set_cqm_rssi(info, threshold, hysteresis);
6395  } else if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
6396  attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
6397  attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
6398  u32 rate, pkts, intvl;
6399  rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
6400  pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
6401  intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
6402  err = nl80211_set_cqm_txe(info, rate, pkts, intvl);
6403  } else
6404  err = -EINVAL;
6405 
6406 out:
6407  return err;
6408 }
6409 
6410 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
6411 {
6412  struct cfg80211_registered_device *rdev = info->user_ptr[0];
6413  struct net_device *dev = info->user_ptr[1];
6414  struct mesh_config cfg;
6415  struct mesh_setup setup;
6416  int err;
6417 
6418  /* start with default */
6419  memcpy(&cfg, &default_mesh_config, sizeof(cfg));
6420  memcpy(&setup, &default_mesh_setup, sizeof(setup));
6421 
6422  if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
6423  /* and parse parameters if given */
6424  err = nl80211_parse_mesh_config(info, &cfg, NULL);
6425  if (err)
6426  return err;
6427  }
6428 
6429  if (!info->attrs[NL80211_ATTR_MESH_ID] ||
6430  !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
6431  return -EINVAL;
6432 
6433  setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
6434  setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
6435 
6436  if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
6437  !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
6438  nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
6439  return -EINVAL;
6440 
6441  if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
6442  /* parse additional setup parameters if given */
6443  err = nl80211_parse_mesh_setup(info, &setup);
6444  if (err)
6445  return err;
6446  }
6447 
6448  if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
6449  enum nl80211_channel_type channel_type = NL80211_CHAN_NO_HT;
6450 
6451  if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE] &&
6452  !nl80211_valid_channel_type(info, &channel_type))
6453  return -EINVAL;
6454 
6455  setup.channel = rdev_freq_to_chan(rdev,
6456  nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]),
6457  channel_type);
6458  if (!setup.channel)
6459  return -EINVAL;
6460  setup.channel_type = channel_type;
6461  } else {
6462  /* cfg80211_join_mesh() will sort it out */
6463  setup.channel = NULL;
6464  }
6465 
6466  return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
6467 }
6468 
6469 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
6470 {
6471  struct cfg80211_registered_device *rdev = info->user_ptr[0];
6472  struct net_device *dev = info->user_ptr[1];
6473 
6474  return cfg80211_leave_mesh(rdev, dev);
6475 }
6476 
6477 #ifdef CONFIG_PM
6478 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
6479 {
6480  struct cfg80211_registered_device *rdev = info->user_ptr[0];
6481  struct sk_buff *msg;
6482  void *hdr;
6483 
6484  if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
6485  return -EOPNOTSUPP;
6486 
6487  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6488  if (!msg)
6489  return -ENOMEM;
6490 
6491  hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6492  NL80211_CMD_GET_WOWLAN);
6493  if (!hdr)
6494  goto nla_put_failure;
6495 
6496  if (rdev->wowlan) {
6497  struct nlattr *nl_wowlan;
6498 
6499  nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
6500  if (!nl_wowlan)
6501  goto nla_put_failure;
6502 
6503  if ((rdev->wowlan->any &&
6504  nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
6505  (rdev->wowlan->disconnect &&
6506  nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
6507  (rdev->wowlan->magic_pkt &&
6508  nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
6509  (rdev->wowlan->gtk_rekey_failure &&
6510  nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
6511  (rdev->wowlan->eap_identity_req &&
6512  nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
6513  (rdev->wowlan->four_way_handshake &&
6514  nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
6515  (rdev->wowlan->rfkill_release &&
6516  nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
6517  goto nla_put_failure;
6518  if (rdev->wowlan->n_patterns) {
6519  struct nlattr *nl_pats, *nl_pat;
6520  int i, pat_len;
6521 
6522  nl_pats = nla_nest_start(msg,
6523  NL80211_WOWLAN_TRIG_PKT_PATTERN);
6524  if (!nl_pats)
6525  goto nla_put_failure;
6526 
6527  for (i = 0; i < rdev->wowlan->n_patterns; i++) {
6528  nl_pat = nla_nest_start(msg, i + 1);
6529  if (!nl_pat)
6530  goto nla_put_failure;
6531  pat_len = rdev->wowlan->patterns[i].pattern_len;
6532  if (nla_put(msg, NL80211_WOWLAN_PKTPAT_MASK,
6533  DIV_ROUND_UP(pat_len, 8),
6534  rdev->wowlan->patterns[i].mask) ||
6535  nla_put(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
6536  pat_len,
6537  rdev->wowlan->patterns[i].pattern))
6538  goto nla_put_failure;
6539  nla_nest_end(msg, nl_pat);
6540  }
6541  nla_nest_end(msg, nl_pats);
6542  }
6543 
6544  nla_nest_end(msg, nl_wowlan);
6545  }
6546 
6547  genlmsg_end(msg, hdr);
6548  return genlmsg_reply(msg, info);
6549 
6550 nla_put_failure:
6551  nlmsg_free(msg);
6552  return -ENOBUFS;
6553 }
6554 
6555 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
6556 {
6557  struct cfg80211_registered_device *rdev = info->user_ptr[0];
6558  struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
6559  struct cfg80211_wowlan new_triggers = {};
6560  struct cfg80211_wowlan *ntrig;
6561  struct wiphy_wowlan_support *wowlan = &rdev->wiphy.wowlan;
6562  int err, i;
6563  bool prev_enabled = rdev->wowlan;
6564 
6565  if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns)
6566  return -EOPNOTSUPP;
6567 
6568  if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
6569  cfg80211_rdev_free_wowlan(rdev);
6570  rdev->wowlan = NULL;
6571  goto set_wakeup;
6572  }
6573 
6574  err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
6575  nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
6576  nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
6577  nl80211_wowlan_policy);
6578  if (err)
6579  return err;
6580 
6581  if (tb[NL80211_WOWLAN_TRIG_ANY]) {
6582  if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
6583  return -EINVAL;
6584  new_triggers.any = true;
6585  }
6586 
6587  if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
6588  if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
6589  return -EINVAL;
6590  new_triggers.disconnect = true;
6591  }
6592 
6593  if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
6594  if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
6595  return -EINVAL;
6596  new_triggers.magic_pkt = true;
6597  }
6598 
6599  if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
6600  return -EINVAL;
6601 
6602  if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
6603  if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
6604  return -EINVAL;
6605  new_triggers.gtk_rekey_failure = true;
6606  }
6607 
6608  if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
6609  if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
6610  return -EINVAL;
6611  new_triggers.eap_identity_req = true;
6612  }
6613 
6614  if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
6615  if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
6616  return -EINVAL;
6617  new_triggers.four_way_handshake = true;
6618  }
6619 
6620  if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
6621  if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
6622  return -EINVAL;
6623  new_triggers.rfkill_release = true;
6624  }
6625 
6626  if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
6627  struct nlattr *pat;
6628  int n_patterns = 0;
6629  int rem, pat_len, mask_len;
6630  struct nlattr *pat_tb[NUM_NL80211_WOWLAN_PKTPAT];
6631 
6632  nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
6633  rem)
6634  n_patterns++;
6635  if (n_patterns > wowlan->n_patterns)
6636  return -EINVAL;
6637 
6638  new_triggers.patterns = kcalloc(n_patterns,
6639  sizeof(new_triggers.patterns[0]),
6640  GFP_KERNEL);
6641  if (!new_triggers.patterns)
6642  return -ENOMEM;
6643 
6644  new_triggers.n_patterns = n_patterns;
6645  i = 0;
6646 
6647  nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
6648  rem) {
6649  nla_parse(pat_tb, MAX_NL80211_WOWLAN_PKTPAT,
6650  nla_data(pat), nla_len(pat), NULL);
6651  err = -EINVAL;
6652  if (!pat_tb[NL80211_WOWLAN_PKTPAT_MASK] ||
6653  !pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN])
6654  goto error;
6655  pat_len = nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]);
6656  mask_len = DIV_ROUND_UP(pat_len, 8);
6657  if (nla_len(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]) !=
6658  mask_len)
6659  goto error;
6660  if (pat_len > wowlan->pattern_max_len ||
6661  pat_len < wowlan->pattern_min_len)
6662  goto error;
6663 
6664  new_triggers.patterns[i].mask =
6665  kmalloc(mask_len + pat_len, GFP_KERNEL);
6666  if (!new_triggers.patterns[i].mask) {
6667  err = -ENOMEM;
6668  goto error;
6669  }
6670  new_triggers.patterns[i].pattern =
6671  new_triggers.patterns[i].mask + mask_len;
6672  memcpy(new_triggers.patterns[i].mask,
6673  nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_MASK]),
6674  mask_len);
6675  new_triggers.patterns[i].pattern_len = pat_len;
6676  memcpy(new_triggers.patterns[i].pattern,
6677  nla_data(pat_tb[NL80211_WOWLAN_PKTPAT_PATTERN]),
6678  pat_len);
6679  i++;
6680  }
6681  }
6682 
6683  ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
6684  if (!ntrig) {
6685  err = -ENOMEM;
6686  goto error;
6687  }
6688  cfg80211_rdev_free_wowlan(rdev);
6689  rdev->wowlan = ntrig;
6690 
6691  set_wakeup:
6692  if (rdev->ops->set_wakeup && prev_enabled != !!rdev->wowlan)
6693  rdev->ops->set_wakeup(&rdev->wiphy, rdev->wowlan);
6694 
6695  return 0;
6696  error:
6697  for (i = 0; i < new_triggers.n_patterns; i++)
6698  kfree(new_triggers.patterns[i].mask);
6699  kfree(new_triggers.patterns);
6700  return err;
6701 }
6702 #endif
6703 
6704 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
6705 {
6706  struct cfg80211_registered_device *rdev = info->user_ptr[0];
6707  struct net_device *dev = info->user_ptr[1];
6708  struct wireless_dev *wdev = dev->ieee80211_ptr;
6709  struct nlattr *tb[NUM_NL80211_REKEY_DATA];
6710  struct cfg80211_gtk_rekey_data rekey_data;
6711  int err;
6712 
6713  if (!info->attrs[NL80211_ATTR_REKEY_DATA])
6714  return -EINVAL;
6715 
6716  err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
6717  nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
6718  nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
6719  nl80211_rekey_policy);
6720  if (err)
6721  return err;
6722 
6723  if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
6724  return -ERANGE;
6725  if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
6726  return -ERANGE;
6727  if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
6728  return -ERANGE;
6729 
6730  memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
6731  NL80211_KEK_LEN);
6732  memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
6733  NL80211_KCK_LEN);
6734  memcpy(rekey_data.replay_ctr,
6735  nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
6736  NL80211_REPLAY_CTR_LEN);
6737 
6738  wdev_lock(wdev);
6739  if (!wdev->current_bss) {
6740  err = -ENOTCONN;
6741  goto out;
6742  }
6743 
6744  if (!rdev->ops->set_rekey_data) {
6745  err = -EOPNOTSUPP;
6746  goto out;
6747  }
6748 
6749  err = rdev->ops->set_rekey_data(&rdev->wiphy, dev, &rekey_data);
6750  out:
6751  wdev_unlock(wdev);
6752  return err;
6753 }
6754 
6755 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
6756  struct genl_info *info)
6757 {
6758  struct net_device *dev = info->user_ptr[1];
6759  struct wireless_dev *wdev = dev->ieee80211_ptr;
6760 
6761  if (wdev->iftype != NL80211_IFTYPE_AP &&
6762  wdev->iftype != NL80211_IFTYPE_P2P_GO)
6763  return -EINVAL;
6764 
6765  if (wdev->ap_unexpected_nlportid)
6766  return -EBUSY;
6767 
6768  wdev->ap_unexpected_nlportid = info->snd_portid;
6769  return 0;
6770 }
6771 
6772 static int nl80211_probe_client(struct sk_buff *skb,
6773  struct genl_info *info)
6774 {
6775  struct cfg80211_registered_device *rdev = info->user_ptr[0];
6776  struct net_device *dev = info->user_ptr[1];
6777  struct wireless_dev *wdev = dev->ieee80211_ptr;
6778  struct sk_buff *msg;
6779  void *hdr;
6780  const u8 *addr;
6781  u64 cookie;
6782  int err;
6783 
6784  if (wdev->iftype != NL80211_IFTYPE_AP &&
6785  wdev->iftype != NL80211_IFTYPE_P2P_GO)
6786  return -EOPNOTSUPP;
6787 
6788  if (!info->attrs[NL80211_ATTR_MAC])
6789  return -EINVAL;
6790 
6791  if (!rdev->ops->probe_client)
6792  return -EOPNOTSUPP;
6793 
6794  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6795  if (!msg)
6796  return -ENOMEM;
6797 
6798  hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6799  NL80211_CMD_PROBE_CLIENT);
6800 
6801  if (IS_ERR(hdr)) {
6802  err = PTR_ERR(hdr);
6803  goto free_msg;
6804  }
6805 
6806  addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
6807 
6808  err = rdev->ops->probe_client(&rdev->wiphy, dev, addr, &cookie);
6809  if (err)
6810  goto free_msg;
6811 
6812  if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
6813  goto nla_put_failure;
6814 
6815  genlmsg_end(msg, hdr);
6816 
6817  return genlmsg_reply(msg, info);
6818 
6819  nla_put_failure:
6820  err = -ENOBUFS;
6821  free_msg:
6822  nlmsg_free(msg);
6823  return err;
6824 }
6825 
6826 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
6827 {
6828  struct cfg80211_registered_device *rdev = info->user_ptr[0];
6829 
6830  if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
6831  return -EOPNOTSUPP;
6832 
6833  if (rdev->ap_beacons_nlportid)
6834  return -EBUSY;
6835 
6836  rdev->ap_beacons_nlportid = info->snd_portid;
6837 
6838  return 0;
6839 }
6840 
6841 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
6842 {
6843  struct cfg80211_registered_device *rdev = info->user_ptr[0];
6844  struct wireless_dev *wdev = info->user_ptr[1];
6845  int err;
6846 
6847  if (!rdev->ops->start_p2p_device)
6848  return -EOPNOTSUPP;
6849 
6850  if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
6851  return -EOPNOTSUPP;
6852 
6853  if (wdev->p2p_started)
6854  return 0;
6855 
6856  mutex_lock(&rdev->devlist_mtx);
6857  err = cfg80211_can_add_interface(rdev, wdev->iftype);
6858  mutex_unlock(&rdev->devlist_mtx);
6859  if (err)
6860  return err;
6861 
6862  err = rdev->ops->start_p2p_device(&rdev->wiphy, wdev);
6863  if (err)
6864  return err;
6865 
6866  wdev->p2p_started = true;
6867  mutex_lock(&rdev->devlist_mtx);
6868  rdev->opencount++;
6869  mutex_unlock(&rdev->devlist_mtx);
6870 
6871  return 0;
6872 }
6873 
6874 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
6875 {
6876  struct cfg80211_registered_device *rdev = info->user_ptr[0];
6877  struct wireless_dev *wdev = info->user_ptr[1];
6878 
6879  if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
6880  return -EOPNOTSUPP;
6881 
6882  if (!rdev->ops->stop_p2p_device)
6883  return -EOPNOTSUPP;
6884 
6885  if (!wdev->p2p_started)
6886  return 0;
6887 
6888  rdev->ops->stop_p2p_device(&rdev->wiphy, wdev);
6889  wdev->p2p_started = false;
6890 
6891  mutex_lock(&rdev->devlist_mtx);
6892  rdev->opencount--;
6893  mutex_unlock(&rdev->devlist_mtx);
6894 
6895  if (WARN_ON(rdev->scan_req && rdev->scan_req->wdev == wdev)) {
6896  rdev->scan_req->aborted = true;
6897  ___cfg80211_scan_done(rdev, true);
6898  }
6899 
6900  return 0;
6901 }
6902 
6903 #define NL80211_FLAG_NEED_WIPHY 0x01
6904 #define NL80211_FLAG_NEED_NETDEV 0x02
6905 #define NL80211_FLAG_NEED_RTNL 0x04
6906 #define NL80211_FLAG_CHECK_NETDEV_UP 0x08
6907 #define NL80211_FLAG_NEED_NETDEV_UP (NL80211_FLAG_NEED_NETDEV |\
6908  NL80211_FLAG_CHECK_NETDEV_UP)
6909 #define NL80211_FLAG_NEED_WDEV 0x10
6910 /* If a netdev is associated, it must be UP, P2P must be started */
6911 #define NL80211_FLAG_NEED_WDEV_UP (NL80211_FLAG_NEED_WDEV |\
6912  NL80211_FLAG_CHECK_NETDEV_UP)
6913 
6914 static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
6915  struct genl_info *info)
6916 {
6917  struct cfg80211_registered_device *rdev;
6918  struct wireless_dev *wdev;
6919  struct net_device *dev;
6920  bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
6921 
6922  if (rtnl)
6923  rtnl_lock();
6924 
6925  if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
6926  rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
6927  if (IS_ERR(rdev)) {
6928  if (rtnl)
6929  rtnl_unlock();
6930  return PTR_ERR(rdev);
6931  }
6932  info->user_ptr[0] = rdev;
6933  } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
6934  ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
6935  mutex_lock(&cfg80211_mutex);
6936  wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
6937  info->attrs);
6938  if (IS_ERR(wdev)) {
6939  mutex_unlock(&cfg80211_mutex);
6940  if (rtnl)
6941  rtnl_unlock();
6942  return PTR_ERR(wdev);
6943  }
6944 
6945  dev = wdev->netdev;
6946  rdev = wiphy_to_dev(wdev->wiphy);
6947 
6948  if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
6949  if (!dev) {
6950  mutex_unlock(&cfg80211_mutex);
6951  if (rtnl)
6952  rtnl_unlock();
6953  return -EINVAL;
6954  }
6955 
6956  info->user_ptr[1] = dev;
6957  } else {
6958  info->user_ptr[1] = wdev;
6959  }
6960 
6961  if (dev) {
6962  if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
6963  !netif_running(dev)) {
6964  mutex_unlock(&cfg80211_mutex);
6965  if (rtnl)
6966  rtnl_unlock();
6967  return -ENETDOWN;
6968  }
6969 
6970  dev_hold(dev);
6971  } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
6972  if (!wdev->p2p_started) {
6973  mutex_unlock(&cfg80211_mutex);
6974  if (rtnl)
6975  rtnl_unlock();
6976  return -ENETDOWN;
6977  }
6978  }
6979 
6980  cfg80211_lock_rdev(rdev);
6981 
6982  mutex_unlock(&cfg80211_mutex);
6983 
6984  info->user_ptr[0] = rdev;
6985  }
6986 
6987  return 0;
6988 }
6989 
6990 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
6991  struct genl_info *info)
6992 {
6993  if (info->user_ptr[0])
6994  cfg80211_unlock_rdev(info->user_ptr[0]);
6995  if (info->user_ptr[1]) {
6996  if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
6997  struct wireless_dev *wdev = info->user_ptr[1];
6998 
6999  if (wdev->netdev)
7000  dev_put(wdev->netdev);
7001  } else {
7002  dev_put(info->user_ptr[1]);
7003  }
7004  }
7005  if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
7006  rtnl_unlock();
7007 }
7008 
7009 static struct genl_ops nl80211_ops[] = {
7010  {
7011  .cmd = NL80211_CMD_GET_WIPHY,
7012  .doit = nl80211_get_wiphy,
7013  .dumpit = nl80211_dump_wiphy,
7014  .policy = nl80211_policy,
7015  /* can be retrieved by unprivileged users */
7016  .internal_flags = NL80211_FLAG_NEED_WIPHY,
7017  },
7018  {
7019  .cmd = NL80211_CMD_SET_WIPHY,
7020  .doit = nl80211_set_wiphy,
7021  .policy = nl80211_policy,
7022  .flags = GENL_ADMIN_PERM,
7023  .internal_flags = NL80211_FLAG_NEED_RTNL,
7024  },
7025  {
7026  .cmd = NL80211_CMD_GET_INTERFACE,
7027  .doit = nl80211_get_interface,
7028  .dumpit = nl80211_dump_interface,
7029  .policy = nl80211_policy,
7030  /* can be retrieved by unprivileged users */
7031  .internal_flags = NL80211_FLAG_NEED_WDEV,
7032  },
7033  {
7034  .cmd = NL80211_CMD_SET_INTERFACE,
7035  .doit = nl80211_set_interface,
7036  .policy = nl80211_policy,
7037  .flags = GENL_ADMIN_PERM,
7038  .internal_flags = NL80211_FLAG_NEED_NETDEV |
7039  NL80211_FLAG_NEED_RTNL,
7040  },
7041  {
7042  .cmd = NL80211_CMD_NEW_INTERFACE,
7043  .doit = nl80211_new_interface,
7044  .policy = nl80211_policy,
7045  .flags = GENL_ADMIN_PERM,
7046  .internal_flags = NL80211_FLAG_NEED_WIPHY |
7047  NL80211_FLAG_NEED_RTNL,
7048  },
7049  {
7050  .cmd = NL80211_CMD_DEL_INTERFACE,
7051  .doit = nl80211_del_interface,
7052  .policy = nl80211_policy,
7053  .flags = GENL_ADMIN_PERM,
7054  .internal_flags = NL80211_FLAG_NEED_WDEV |
7055  NL80211_FLAG_NEED_RTNL,
7056  },
7057  {
7058  .cmd = NL80211_CMD_GET_KEY,
7059  .doit = nl80211_get_key,
7060  .policy = nl80211_policy,
7061  .flags = GENL_ADMIN_PERM,
7062  .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7063  NL80211_FLAG_NEED_RTNL,
7064  },
7065  {
7066  .cmd = NL80211_CMD_SET_KEY,
7067  .doit = nl80211_set_key,
7068  .policy = nl80211_policy,
7069  .flags = GENL_ADMIN_PERM,
7070  .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7071  NL80211_FLAG_NEED_RTNL,
7072  },
7073  {
7074  .cmd = NL80211_CMD_NEW_KEY,
7075  .doit = nl80211_new_key,
7076  .policy = nl80211_policy,
7077  .flags = GENL_ADMIN_PERM,
7078  .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7079  NL80211_FLAG_NEED_RTNL,
7080  },
7081  {
7082  .cmd = NL80211_CMD_DEL_KEY,
7083  .doit = nl80211_del_key,
7084  .policy = nl80211_policy,
7085  .flags = GENL_ADMIN_PERM,
7086  .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7087  NL80211_FLAG_NEED_RTNL,
7088  },
7089  {
7090  .cmd = NL80211_CMD_SET_BEACON,
7091  .policy = nl80211_policy,
7092  .flags = GENL_ADMIN_PERM,
7093  .doit = nl80211_set_beacon,
7094  .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7095  NL80211_FLAG_NEED_RTNL,
7096  },
7097  {
7098  .cmd = NL80211_CMD_START_AP,
7099  .policy = nl80211_policy,
7100  .flags = GENL_ADMIN_PERM,
7101  .doit = nl80211_start_ap,
7102  .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7103  NL80211_FLAG_NEED_RTNL,
7104  },
7105  {
7106  .cmd = NL80211_CMD_STOP_AP,
7107  .policy = nl80211_policy,
7108  .flags = GENL_ADMIN_PERM,
7109  .doit = nl80211_stop_ap,
7110  .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7111  NL80211_FLAG_NEED_RTNL,
7112  },
7113  {
7114  .cmd = NL80211_CMD_GET_STATION,
7115  .doit = nl80211_get_station,
7116  .dumpit = nl80211_dump_station,
7117  .policy = nl80211_policy,
7118  .internal_flags = NL80211_FLAG_NEED_NETDEV |
7119  NL80211_FLAG_NEED_RTNL,
7120  },
7121  {
7122  .cmd = NL80211_CMD_SET_STATION,
7123  .doit = nl80211_set_station,
7124  .policy = nl80211_policy,
7125  .flags = GENL_ADMIN_PERM,
7126  .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7127  NL80211_FLAG_NEED_RTNL,
7128  },
7129  {
7130  .cmd = NL80211_CMD_NEW_STATION,
7131  .doit = nl80211_new_station,
7132  .policy = nl80211_policy,
7133  .flags = GENL_ADMIN_PERM,
7134  .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7135  NL80211_FLAG_NEED_RTNL,
7136  },
7137  {
7138  .cmd = NL80211_CMD_DEL_STATION,
7139  .doit = nl80211_del_station,
7140  .policy = nl80211_policy,
7141  .flags = GENL_ADMIN_PERM,
7142  .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7143  NL80211_FLAG_NEED_RTNL,
7144  },
7145  {
7146  .cmd = NL80211_CMD_GET_MPATH,
7147  .doit = nl80211_get_mpath,
7148  .dumpit = nl80211_dump_mpath,
7149  .policy = nl80211_policy,
7150  .flags = GENL_ADMIN_PERM,
7151  .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7152  NL80211_FLAG_NEED_RTNL,
7153  },
7154  {
7155  .cmd = NL80211_CMD_SET_MPATH,
7156  .doit = nl80211_set_mpath,
7157  .policy = nl80211_policy,
7158  .flags = GENL_ADMIN_PERM,
7159  .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7160  NL80211_FLAG_NEED_RTNL,
7161  },
7162  {
7163  .cmd = NL80211_CMD_NEW_MPATH,
7164  .doit = nl80211_new_mpath,
7165  .policy = nl80211_policy,
7166  .flags = GENL_ADMIN_PERM,
7167  .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7168  NL80211_FLAG_NEED_RTNL,
7169  },
7170  {
7171  .cmd = NL80211_CMD_DEL_MPATH,
7172  .doit = nl80211_del_mpath,
7173  .policy = nl80211_policy,
7174  .flags = GENL_ADMIN_PERM,
7175  .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7176  NL80211_FLAG_NEED_RTNL,
7177  },
7178  {
7179  .cmd = NL80211_CMD_SET_BSS,
7180  .doit = nl80211_set_bss,
7181  .policy = nl80211_policy,
7182  .flags = GENL_ADMIN_PERM,
7183  .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7184  NL80211_FLAG_NEED_RTNL,
7185  },
7186  {
7187  .cmd = NL80211_CMD_GET_REG,
7188  .doit = nl80211_get_reg,
7189  .policy = nl80211_policy,
7190  /* can be retrieved by unprivileged users */
7191  },
7192  {
7193  .cmd = NL80211_CMD_SET_REG,
7194  .doit = nl80211_set_reg,
7195  .policy = nl80211_policy,
7196  .flags = GENL_ADMIN_PERM,
7197  },
7198  {
7199  .cmd = NL80211_CMD_REQ_SET_REG,
7200  .doit = nl80211_req_set_reg,
7201  .policy = nl80211_policy,
7202  .flags = GENL_ADMIN_PERM,
7203  },
7204  {
7205  .cmd = NL80211_CMD_GET_MESH_CONFIG,
7206  .doit = nl80211_get_mesh_config,
7207  .policy = nl80211_policy,
7208  /* can be retrieved by unprivileged users */
7209  .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7210  NL80211_FLAG_NEED_RTNL,
7211  },
7212  {
7213  .cmd = NL80211_CMD_SET_MESH_CONFIG,
7214  .doit = nl80211_update_mesh_config,
7215  .policy = nl80211_policy,
7216  .flags = GENL_ADMIN_PERM,
7217  .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7218  NL80211_FLAG_NEED_RTNL,
7219  },
7220  {
7221  .cmd = NL80211_CMD_TRIGGER_SCAN,
7222  .doit = nl80211_trigger_scan,
7223  .policy = nl80211_policy,
7224  .flags = GENL_ADMIN_PERM,
7225  .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
7226  NL80211_FLAG_NEED_RTNL,
7227  },
7228  {
7229  .cmd = NL80211_CMD_GET_SCAN,
7230  .policy = nl80211_policy,
7231  .dumpit = nl80211_dump_scan,
7232  },
7233  {
7234  .cmd = NL80211_CMD_START_SCHED_SCAN,
7235  .doit = nl80211_start_sched_scan,
7236  .policy = nl80211_policy,
7237  .flags = GENL_ADMIN_PERM,
7238  .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7239  NL80211_FLAG_NEED_RTNL,
7240  },
7241  {
7242  .cmd = NL80211_CMD_STOP_SCHED_SCAN,
7243  .doit = nl80211_stop_sched_scan,
7244  .policy = nl80211_policy,
7245  .flags = GENL_ADMIN_PERM,
7246  .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7247  NL80211_FLAG_NEED_RTNL,
7248  },
7249  {
7250  .cmd = NL80211_CMD_AUTHENTICATE,
7251  .doit = nl80211_authenticate,
7252  .policy = nl80211_policy,
7253  .flags = GENL_ADMIN_PERM,
7254  .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7255  NL80211_FLAG_NEED_RTNL,
7256  },
7257  {
7258  .cmd = NL80211_CMD_ASSOCIATE,
7259  .doit = nl80211_associate,
7260  .policy = nl80211_policy,
7261  .flags = GENL_ADMIN_PERM,
7262  .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7263  NL80211_FLAG_NEED_RTNL,
7264  },
7265  {
7266  .cmd = NL80211_CMD_DEAUTHENTICATE,
7267  .doit = nl80211_deauthenticate,
7268  .policy = nl80211_policy,
7269  .flags = GENL_ADMIN_PERM,
7270  .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7271  NL80211_FLAG_NEED_RTNL,
7272  },
7273  {
7274  .cmd = NL80211_CMD_DISASSOCIATE,
7275  .doit = nl80211_disassociate,
7276  .policy = nl80211_policy,
7277  .flags = GENL_ADMIN_PERM,
7278  .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7279  NL80211_FLAG_NEED_RTNL,
7280  },
7281  {
7282  .cmd = NL80211_CMD_JOIN_IBSS,
7283  .doit = nl80211_join_ibss,
7284  .policy = nl80211_policy,
7285  .flags = GENL_ADMIN_PERM,
7286  .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7287  NL80211_FLAG_NEED_RTNL,
7288  },
7289  {
7290  .cmd = NL80211_CMD_LEAVE_IBSS,
7291  .doit = nl80211_leave_ibss,
7292  .policy = nl80211_policy,
7293  .flags = GENL_ADMIN_PERM,
7294  .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7295  NL80211_FLAG_NEED_RTNL,
7296  },
7297 #ifdef CONFIG_NL80211_TESTMODE
7298  {
7299  .cmd = NL80211_CMD_TESTMODE,
7300  .doit = nl80211_testmode_do,
7301  .dumpit = nl80211_testmode_dump,
7302  .policy = nl80211_policy,
7303  .flags = GENL_ADMIN_PERM,
7304  .internal_flags = NL80211_FLAG_NEED_WIPHY |
7305  NL80211_FLAG_NEED_RTNL,
7306  },
7307 #endif
7308  {
7309  .cmd = NL80211_CMD_CONNECT,
7310  .doit = nl80211_connect,
7311  .policy = nl80211_policy,
7312  .flags = GENL_ADMIN_PERM,
7313  .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7314  NL80211_FLAG_NEED_RTNL,
7315  },
7316  {
7317  .cmd = NL80211_CMD_DISCONNECT,
7318  .doit = nl80211_disconnect,
7319  .policy = nl80211_policy,
7320  .flags = GENL_ADMIN_PERM,
7321  .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7322  NL80211_FLAG_NEED_RTNL,
7323  },
7324  {
7325  .cmd = NL80211_CMD_SET_WIPHY_NETNS,
7326  .doit = nl80211_wiphy_netns,
7327  .policy = nl80211_policy,
7328  .flags = GENL_ADMIN_PERM,
7329  .internal_flags = NL80211_FLAG_NEED_WIPHY |
7330  NL80211_FLAG_NEED_RTNL,
7331  },
7332  {
7333  .cmd = NL80211_CMD_GET_SURVEY,
7334  .policy = nl80211_policy,
7335  .dumpit = nl80211_dump_survey,
7336  },
7337  {
7338  .cmd = NL80211_CMD_SET_PMKSA,
7339  .doit = nl80211_setdel_pmksa,
7340  .policy = nl80211_policy,
7341  .flags = GENL_ADMIN_PERM,
7342  .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7343  NL80211_FLAG_NEED_RTNL,
7344  },
7345  {
7346  .cmd = NL80211_CMD_DEL_PMKSA,
7347  .doit = nl80211_setdel_pmksa,
7348  .policy = nl80211_policy,
7349  .flags = GENL_ADMIN_PERM,
7350  .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7351  NL80211_FLAG_NEED_RTNL,
7352  },
7353  {
7354  .cmd = NL80211_CMD_FLUSH_PMKSA,
7355  .doit = nl80211_flush_pmksa,
7356  .policy = nl80211_policy,
7357  .flags = GENL_ADMIN_PERM,
7358  .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7359  NL80211_FLAG_NEED_RTNL,
7360  },
7361  {
7362  .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
7363  .doit = nl80211_remain_on_channel,
7364  .policy = nl80211_policy,
7365  .flags = GENL_ADMIN_PERM,
7366  .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
7367  NL80211_FLAG_NEED_RTNL,
7368  },
7369  {
7370  .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
7371  .doit = nl80211_cancel_remain_on_channel,
7372  .policy = nl80211_policy,
7373  .flags = GENL_ADMIN_PERM,
7374  .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
7375  NL80211_FLAG_NEED_RTNL,
7376  },
7377  {
7378  .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
7379  .doit = nl80211_set_tx_bitrate_mask,
7380  .policy = nl80211_policy,
7381  .flags = GENL_ADMIN_PERM,
7382  .internal_flags = NL80211_FLAG_NEED_NETDEV |
7383  NL80211_FLAG_NEED_RTNL,
7384  },
7385  {
7386  .cmd = NL80211_CMD_REGISTER_FRAME,
7387  .doit = nl80211_register_mgmt,
7388  .policy = nl80211_policy,
7389  .flags = GENL_ADMIN_PERM,
7390  .internal_flags = NL80211_FLAG_NEED_WDEV |
7391  NL80211_FLAG_NEED_RTNL,
7392  },
7393  {
7394  .cmd = NL80211_CMD_FRAME,
7395  .doit = nl80211_tx_mgmt,
7396  .policy = nl80211_policy,
7397  .flags = GENL_ADMIN_PERM,
7398  .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
7399  NL80211_FLAG_NEED_RTNL,
7400  },
7401  {
7402  .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
7403  .doit = nl80211_tx_mgmt_cancel_wait,
7404  .policy = nl80211_policy,
7405  .flags = GENL_ADMIN_PERM,
7406  .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
7407  NL80211_FLAG_NEED_RTNL,
7408  },
7409  {
7410  .cmd = NL80211_CMD_SET_POWER_SAVE,
7411  .doit = nl80211_set_power_save,
7412  .policy = nl80211_policy,
7413  .flags = GENL_ADMIN_PERM,
7414  .internal_flags = NL80211_FLAG_NEED_NETDEV |
7415  NL80211_FLAG_NEED_RTNL,
7416  },
7417  {
7418  .cmd = NL80211_CMD_GET_POWER_SAVE,
7419  .doit = nl80211_get_power_save,
7420  .policy = nl80211_policy,
7421  /* can be retrieved by unprivileged users */
7422  .internal_flags = NL80211_FLAG_NEED_NETDEV |
7423  NL80211_FLAG_NEED_RTNL,
7424  },
7425  {
7426  .cmd = NL80211_CMD_SET_CQM,
7427  .doit = nl80211_set_cqm,
7428  .policy = nl80211_policy,
7429  .flags = GENL_ADMIN_PERM,
7430  .internal_flags = NL80211_FLAG_NEED_NETDEV |
7431  NL80211_FLAG_NEED_RTNL,
7432  },
7433  {
7434  .cmd = NL80211_CMD_SET_CHANNEL,
7435  .doit = nl80211_set_channel,
7436  .policy = nl80211_policy,
7437  .flags = GENL_ADMIN_PERM,
7438  .internal_flags = NL80211_FLAG_NEED_NETDEV |
7439  NL80211_FLAG_NEED_RTNL,
7440  },
7441  {
7442  .cmd = NL80211_CMD_SET_WDS_PEER,
7443  .doit = nl80211_set_wds_peer,
7444  .policy = nl80211_policy,
7445  .flags = GENL_ADMIN_PERM,
7446  .internal_flags = NL80211_FLAG_NEED_NETDEV |
7447  NL80211_FLAG_NEED_RTNL,
7448  },
7449  {
7450  .cmd = NL80211_CMD_JOIN_MESH,
7451  .doit = nl80211_join_mesh,
7452  .policy = nl80211_policy,
7453  .flags = GENL_ADMIN_PERM,
7454  .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7455  NL80211_FLAG_NEED_RTNL,
7456  },
7457  {
7458  .cmd = NL80211_CMD_LEAVE_MESH,
7459  .doit = nl80211_leave_mesh,
7460  .policy = nl80211_policy,
7461  .flags = GENL_ADMIN_PERM,
7462  .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7463  NL80211_FLAG_NEED_RTNL,
7464  },
7465 #ifdef CONFIG_PM
7466  {
7467  .cmd = NL80211_CMD_GET_WOWLAN,
7468  .doit = nl80211_get_wowlan,
7469  .policy = nl80211_policy,
7470  /* can be retrieved by unprivileged users */
7471  .internal_flags = NL80211_FLAG_NEED_WIPHY |
7472  NL80211_FLAG_NEED_RTNL,
7473  },
7474  {
7475  .cmd = NL80211_CMD_SET_WOWLAN,
7476  .doit = nl80211_set_wowlan,
7477  .policy = nl80211_policy,
7478  .flags = GENL_ADMIN_PERM,
7479  .internal_flags = NL80211_FLAG_NEED_WIPHY |
7480  NL80211_FLAG_NEED_RTNL,
7481  },
7482 #endif
7483  {
7484  .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
7485  .doit = nl80211_set_rekey_data,
7486  .policy = nl80211_policy,
7487  .flags = GENL_ADMIN_PERM,
7488  .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7489  NL80211_FLAG_NEED_RTNL,
7490  },
7491  {
7492  .cmd = NL80211_CMD_TDLS_MGMT,
7493  .doit = nl80211_tdls_mgmt,
7494  .policy = nl80211_policy,
7495  .flags = GENL_ADMIN_PERM,
7496  .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7497  NL80211_FLAG_NEED_RTNL,
7498  },
7499  {
7500  .cmd = NL80211_CMD_TDLS_OPER,
7501  .doit = nl80211_tdls_oper,
7502  .policy = nl80211_policy,
7503  .flags = GENL_ADMIN_PERM,
7504  .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7505  NL80211_FLAG_NEED_RTNL,
7506  },
7507  {
7508  .cmd = NL80211_CMD_UNEXPECTED_FRAME,
7509  .doit = nl80211_register_unexpected_frame,
7510  .policy = nl80211_policy,
7511  .flags = GENL_ADMIN_PERM,
7512  .internal_flags = NL80211_FLAG_NEED_NETDEV |
7513  NL80211_FLAG_NEED_RTNL,
7514  },
7515  {
7516  .cmd = NL80211_CMD_PROBE_CLIENT,
7517  .doit = nl80211_probe_client,
7518  .policy = nl80211_policy,
7519  .flags = GENL_ADMIN_PERM,
7520  .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
7521  NL80211_FLAG_NEED_RTNL,
7522  },
7523  {
7524  .cmd = NL80211_CMD_REGISTER_BEACONS,
7525  .doit = nl80211_register_beacons,
7526  .policy = nl80211_policy,
7527  .flags = GENL_ADMIN_PERM,
7528  .internal_flags = NL80211_FLAG_NEED_WIPHY |
7529  NL80211_FLAG_NEED_RTNL,
7530  },
7531  {
7532  .cmd = NL80211_CMD_SET_NOACK_MAP,
7533  .doit = nl80211_set_noack_map,
7534  .policy = nl80211_policy,
7535  .flags = GENL_ADMIN_PERM,
7536  .internal_flags = NL80211_FLAG_NEED_NETDEV |
7537  NL80211_FLAG_NEED_RTNL,
7538  },
7539  {
7540  .cmd = NL80211_CMD_START_P2P_DEVICE,
7541  .doit = nl80211_start_p2p_device,
7542  .policy = nl80211_policy,
7543  .flags = GENL_ADMIN_PERM,
7544  .internal_flags = NL80211_FLAG_NEED_WDEV |
7545  NL80211_FLAG_NEED_RTNL,
7546  },
7547  {
7548  .cmd = NL80211_CMD_STOP_P2P_DEVICE,
7549  .doit = nl80211_stop_p2p_device,
7550  .policy = nl80211_policy,
7551  .flags = GENL_ADMIN_PERM,
7552  .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
7553  NL80211_FLAG_NEED_RTNL,
7554  },
7555 };
7556 
7557 static struct genl_multicast_group nl80211_mlme_mcgrp = {
7558  .name = "mlme",
7559 };
7560 
7561 /* multicast groups */
7562 static struct genl_multicast_group nl80211_config_mcgrp = {
7563  .name = "config",
7564 };
7565 static struct genl_multicast_group nl80211_scan_mcgrp = {
7566  .name = "scan",
7567 };
7568 static struct genl_multicast_group nl80211_regulatory_mcgrp = {
7569  .name = "regulatory",
7570 };
7571 
7572 /* notification functions */
7573 
7574 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
7575 {
7576  struct sk_buff *msg;
7577 
7578  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7579  if (!msg)
7580  return;
7581 
7582  if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
7583  nlmsg_free(msg);
7584  return;
7585  }
7586 
7587  genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7588  nl80211_config_mcgrp.id, GFP_KERNEL);
7589 }
7590 
7591 static int nl80211_add_scan_req(struct sk_buff *msg,
7592  struct cfg80211_registered_device *rdev)
7593 {
7594  struct cfg80211_scan_request *req = rdev->scan_req;
7595  struct nlattr *nest;
7596  int i;
7597 
7598  ASSERT_RDEV_LOCK(rdev);
7599 
7600  if (WARN_ON(!req))
7601  return 0;
7602 
7603  nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
7604  if (!nest)
7605  goto nla_put_failure;
7606  for (i = 0; i < req->n_ssids; i++) {
7607  if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
7608  goto nla_put_failure;
7609  }
7610  nla_nest_end(msg, nest);
7611 
7612  nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
7613  if (!nest)
7614  goto nla_put_failure;
7615  for (i = 0; i < req->n_channels; i++) {
7616  if (nla_put_u32(msg, i, req->channels[i]->center_freq))
7617  goto nla_put_failure;
7618  }
7619  nla_nest_end(msg, nest);
7620 
7621  if (req->ie &&
7622  nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
7623  goto nla_put_failure;
7624 
7625  return 0;
7626  nla_put_failure:
7627  return -ENOBUFS;
7628 }
7629 
7630 static int nl80211_send_scan_msg(struct sk_buff *msg,
7631  struct cfg80211_registered_device *rdev,
7632  struct wireless_dev *wdev,
7633  u32 portid, u32 seq, int flags,
7634  u32 cmd)
7635 {
7636  void *hdr;
7637 
7638  hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
7639  if (!hdr)
7640  return -1;
7641 
7642  if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
7643  (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
7644  wdev->netdev->ifindex)) ||
7645  nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
7646  goto nla_put_failure;
7647 
7648  /* ignore errors and send incomplete event anyway */
7649  nl80211_add_scan_req(msg, rdev);
7650 
7651  return genlmsg_end(msg, hdr);
7652 
7653  nla_put_failure:
7654  genlmsg_cancel(msg, hdr);
7655  return -EMSGSIZE;
7656 }
7657 
7658 static int
7659 nl80211_send_sched_scan_msg(struct sk_buff *msg,
7660  struct cfg80211_registered_device *rdev,
7661  struct net_device *netdev,
7662  u32 portid, u32 seq, int flags, u32 cmd)
7663 {
7664  void *hdr;
7665 
7666  hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
7667  if (!hdr)
7668  return -1;
7669 
7670  if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
7671  nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
7672  goto nla_put_failure;
7673 
7674  return genlmsg_end(msg, hdr);
7675 
7676  nla_put_failure:
7677  genlmsg_cancel(msg, hdr);
7678  return -EMSGSIZE;
7679 }
7680 
7681 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
7682  struct wireless_dev *wdev)
7683 {
7684  struct sk_buff *msg;
7685 
7686  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7687  if (!msg)
7688  return;
7689 
7690  if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
7691  NL80211_CMD_TRIGGER_SCAN) < 0) {
7692  nlmsg_free(msg);
7693  return;
7694  }
7695 
7696  genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7697  nl80211_scan_mcgrp.id, GFP_KERNEL);
7698 }
7699 
7700 void nl80211_send_scan_done(struct cfg80211_registered_device *rdev,
7701  struct wireless_dev *wdev)
7702 {
7703  struct sk_buff *msg;
7704 
7705  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7706  if (!msg)
7707  return;
7708 
7709  if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
7710  NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
7711  nlmsg_free(msg);
7712  return;
7713  }
7714 
7715  genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7716  nl80211_scan_mcgrp.id, GFP_KERNEL);
7717 }
7718 
7719 void nl80211_send_scan_aborted(struct cfg80211_registered_device *rdev,
7720  struct wireless_dev *wdev)
7721 {
7722  struct sk_buff *msg;
7723 
7724  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7725  if (!msg)
7726  return;
7727 
7728  if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
7729  NL80211_CMD_SCAN_ABORTED) < 0) {
7730  nlmsg_free(msg);
7731  return;
7732  }
7733 
7734  genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7735  nl80211_scan_mcgrp.id, GFP_KERNEL);
7736 }
7737 
7738 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
7739  struct net_device *netdev)
7740 {
7741  struct sk_buff *msg;
7742 
7743  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7744  if (!msg)
7745  return;
7746 
7747  if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
7748  NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
7749  nlmsg_free(msg);
7750  return;
7751  }
7752 
7753  genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7754  nl80211_scan_mcgrp.id, GFP_KERNEL);
7755 }
7756 
7757 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
7758  struct net_device *netdev, u32 cmd)
7759 {
7760  struct sk_buff *msg;
7761 
7762  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7763  if (!msg)
7764  return;
7765 
7766  if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
7767  nlmsg_free(msg);
7768  return;
7769  }
7770 
7771  genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7772  nl80211_scan_mcgrp.id, GFP_KERNEL);
7773 }
7774 
7775 /*
7776  * This can happen on global regulatory changes or device specific settings
7777  * based on custom world regulatory domains.
7778  */
7779 void nl80211_send_reg_change_event(struct regulatory_request *request)
7780 {
7781  struct sk_buff *msg;
7782  void *hdr;
7783 
7784  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7785  if (!msg)
7786  return;
7787 
7788  hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
7789  if (!hdr) {
7790  nlmsg_free(msg);
7791  return;
7792  }
7793 
7794  /* Userspace can always count this one always being set */
7795  if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
7796  goto nla_put_failure;
7797 
7798  if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
7799  if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
7800  NL80211_REGDOM_TYPE_WORLD))
7801  goto nla_put_failure;
7802  } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
7803  if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
7804  NL80211_REGDOM_TYPE_CUSTOM_WORLD))
7805  goto nla_put_failure;
7806  } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
7807  request->intersect) {
7808  if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
7809  NL80211_REGDOM_TYPE_INTERSECTION))
7810  goto nla_put_failure;
7811  } else {
7812  if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
7813  NL80211_REGDOM_TYPE_COUNTRY) ||
7814  nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
7815  request->alpha2))
7816  goto nla_put_failure;
7817  }
7818 
7819  if (wiphy_idx_valid(request->wiphy_idx) &&
7820  nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
7821  goto nla_put_failure;
7822 
7823  genlmsg_end(msg, hdr);
7824 
7825  rcu_read_lock();
7826  genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
7827  GFP_ATOMIC);
7828  rcu_read_unlock();
7829 
7830  return;
7831 
7832 nla_put_failure:
7833  genlmsg_cancel(msg, hdr);
7834  nlmsg_free(msg);
7835 }
7836 
7837 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
7838  struct net_device *netdev,
7839  const u8 *buf, size_t len,
7840  enum nl80211_commands cmd, gfp_t gfp)
7841 {
7842  struct sk_buff *msg;
7843  void *hdr;
7844 
7845  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
7846  if (!msg)
7847  return;
7848 
7849  hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
7850  if (!hdr) {
7851  nlmsg_free(msg);
7852  return;
7853  }
7854 
7855  if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
7856  nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
7857  nla_put(msg, NL80211_ATTR_FRAME, len, buf))
7858  goto nla_put_failure;
7859 
7860  genlmsg_end(msg, hdr);
7861 
7862  genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7863  nl80211_mlme_mcgrp.id, gfp);
7864  return;
7865 
7866  nla_put_failure:
7867  genlmsg_cancel(msg, hdr);
7868  nlmsg_free(msg);
7869 }
7870 
7871 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
7872  struct net_device *netdev, const u8 *buf,
7873  size_t len, gfp_t gfp)
7874 {
7875  nl80211_send_mlme_event(rdev, netdev, buf, len,
7876  NL80211_CMD_AUTHENTICATE, gfp);
7877 }
7878 
7879 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
7880  struct net_device *netdev, const u8 *buf,
7881  size_t len, gfp_t gfp)
7882 {
7883  nl80211_send_mlme_event(rdev, netdev, buf, len,
7884  NL80211_CMD_ASSOCIATE, gfp);
7885 }
7886 
7887 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
7888  struct net_device *netdev, const u8 *buf,
7889  size_t len, gfp_t gfp)
7890 {
7891  nl80211_send_mlme_event(rdev, netdev, buf, len,
7892  NL80211_CMD_DEAUTHENTICATE, gfp);
7893 }
7894 
7895 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
7896  struct net_device *netdev, const u8 *buf,
7897  size_t len, gfp_t gfp)
7898 {
7899  nl80211_send_mlme_event(rdev, netdev, buf, len,
7900  NL80211_CMD_DISASSOCIATE, gfp);
7901 }
7902 
7903 void nl80211_send_unprot_deauth(struct cfg80211_registered_device *rdev,
7904  struct net_device *netdev, const u8 *buf,
7905  size_t len, gfp_t gfp)
7906 {
7907  nl80211_send_mlme_event(rdev, netdev, buf, len,
7908  NL80211_CMD_UNPROT_DEAUTHENTICATE, gfp);
7909 }
7910 
7911 void nl80211_send_unprot_disassoc(struct cfg80211_registered_device *rdev,
7912  struct net_device *netdev, const u8 *buf,
7913  size_t len, gfp_t gfp)
7914 {
7915  nl80211_send_mlme_event(rdev, netdev, buf, len,
7916  NL80211_CMD_UNPROT_DISASSOCIATE, gfp);
7917 }
7918 
7919 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
7920  struct net_device *netdev, int cmd,
7921  const u8 *addr, gfp_t gfp)
7922 {
7923  struct sk_buff *msg;
7924  void *hdr;
7925 
7926  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
7927  if (!msg)
7928  return;
7929 
7930  hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
7931  if (!hdr) {
7932  nlmsg_free(msg);
7933  return;
7934  }
7935 
7936  if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
7937  nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
7938  nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
7939  nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
7940  goto nla_put_failure;
7941 
7942  genlmsg_end(msg, hdr);
7943 
7944  genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
7945  nl80211_mlme_mcgrp.id, gfp);
7946  return;
7947 
7948  nla_put_failure:
7949  genlmsg_cancel(msg, hdr);
7950  nlmsg_free(msg);
7951 }
7952 
7953 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
7954  struct net_device *netdev, const u8 *addr,
7955  gfp_t gfp)
7956 {
7957  nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
7958  addr, gfp);
7959 }
7960 
7961 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
7962  struct net_device *netdev, const u8 *addr,
7963  gfp_t gfp)
7964 {
7965  nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
7966  addr, gfp);
7967 }
7968 
7969 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
7970  struct net_device *netdev, const u8 *bssid,
7971  const u8 *req_ie, size_t req_ie_len,
7972  const u8 *resp_ie, size_t resp_ie_len,
7973  u16 status, gfp_t gfp)
7974 {
7975  struct sk_buff *msg;
7976  void *hdr;
7977 
7978  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
7979  if (!msg)
7980  return;
7981 
7982  hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
7983  if (!hdr) {
7984  nlmsg_free(msg);
7985  return;
7986  }
7987 
7988  if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
7989  nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
7990  (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
7991  nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
7992  (req_ie &&
7993  nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
7994  (resp_ie &&
7995  nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
7996  goto nla_put_failure;
7997 
7998  genlmsg_end(msg, hdr);
7999 
8000  genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8001  nl80211_mlme_mcgrp.id, gfp);
8002  return;
8003 
8004  nla_put_failure:
8005  genlmsg_cancel(msg, hdr);
8006  nlmsg_free(msg);
8007 
8008 }
8009 
8010 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
8011  struct net_device *netdev, const u8 *bssid,
8012  const u8 *req_ie, size_t req_ie_len,
8013  const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
8014 {
8015  struct sk_buff *msg;
8016  void *hdr;
8017 
8018  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8019  if (!msg)
8020  return;
8021 
8022  hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
8023  if (!hdr) {
8024  nlmsg_free(msg);
8025  return;
8026  }
8027 
8028  if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8029  nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8030  nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
8031  (req_ie &&
8032  nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
8033  (resp_ie &&
8034  nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
8035  goto nla_put_failure;
8036 
8037  genlmsg_end(msg, hdr);
8038 
8039  genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8040  nl80211_mlme_mcgrp.id, gfp);
8041  return;
8042 
8043  nla_put_failure:
8044  genlmsg_cancel(msg, hdr);
8045  nlmsg_free(msg);
8046 
8047 }
8048 
8049 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
8050  struct net_device *netdev, u16 reason,
8051  const u8 *ie, size_t ie_len, bool from_ap)
8052 {
8053  struct sk_buff *msg;
8054  void *hdr;
8055 
8056  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8057  if (!msg)
8058  return;
8059 
8060  hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
8061  if (!hdr) {
8062  nlmsg_free(msg);
8063  return;
8064  }
8065 
8066  if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8067  nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8068  (from_ap && reason &&
8069  nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
8070  (from_ap &&
8071  nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
8072  (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
8073  goto nla_put_failure;
8074 
8075  genlmsg_end(msg, hdr);
8076 
8077  genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8078  nl80211_mlme_mcgrp.id, GFP_KERNEL);
8079  return;
8080 
8081  nla_put_failure:
8082  genlmsg_cancel(msg, hdr);
8083  nlmsg_free(msg);
8084 
8085 }
8086 
8087 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
8088  struct net_device *netdev, const u8 *bssid,
8089  gfp_t gfp)
8090 {
8091  struct sk_buff *msg;
8092  void *hdr;
8093 
8094  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8095  if (!msg)
8096  return;
8097 
8098  hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
8099  if (!hdr) {
8100  nlmsg_free(msg);
8101  return;
8102  }
8103 
8104  if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8105  nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8106  nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
8107  goto nla_put_failure;
8108 
8109  genlmsg_end(msg, hdr);
8110 
8111  genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8112  nl80211_mlme_mcgrp.id, gfp);
8113  return;
8114 
8115  nla_put_failure:
8116  genlmsg_cancel(msg, hdr);
8117  nlmsg_free(msg);
8118 }
8119 
8120 void nl80211_send_new_peer_candidate(struct cfg80211_registered_device *rdev,
8121  struct net_device *netdev,
8122  const u8 *macaddr, const u8* ie, u8 ie_len,
8123  gfp_t gfp)
8124 {
8125  struct sk_buff *msg;
8126  void *hdr;
8127 
8128  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8129  if (!msg)
8130  return;
8131 
8132  hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
8133  if (!hdr) {
8134  nlmsg_free(msg);
8135  return;
8136  }
8137 
8138  if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8139  nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8140  nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, macaddr) ||
8141  (ie_len && ie &&
8142  nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
8143  goto nla_put_failure;
8144 
8145  genlmsg_end(msg, hdr);
8146 
8147  genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8148  nl80211_mlme_mcgrp.id, gfp);
8149  return;
8150 
8151  nla_put_failure:
8152  genlmsg_cancel(msg, hdr);
8153  nlmsg_free(msg);
8154 }
8155 
8156 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
8157  struct net_device *netdev, const u8 *addr,
8158  enum nl80211_key_type key_type, int key_id,
8159  const u8 *tsc, gfp_t gfp)
8160 {
8161  struct sk_buff *msg;
8162  void *hdr;
8163 
8164  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8165  if (!msg)
8166  return;
8167 
8168  hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
8169  if (!hdr) {
8170  nlmsg_free(msg);
8171  return;
8172  }
8173 
8174  if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8175  nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8176  (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
8177  nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
8178  (key_id != -1 &&
8179  nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
8180  (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
8181  goto nla_put_failure;
8182 
8183  genlmsg_end(msg, hdr);
8184 
8185  genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8186  nl80211_mlme_mcgrp.id, gfp);
8187  return;
8188 
8189  nla_put_failure:
8190  genlmsg_cancel(msg, hdr);
8191  nlmsg_free(msg);
8192 }
8193 
8194 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
8195  struct ieee80211_channel *channel_before,
8196  struct ieee80211_channel *channel_after)
8197 {
8198  struct sk_buff *msg;
8199  void *hdr;
8200  struct nlattr *nl_freq;
8201 
8202  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
8203  if (!msg)
8204  return;
8205 
8206  hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
8207  if (!hdr) {
8208  nlmsg_free(msg);
8209  return;
8210  }
8211 
8212  /*
8213  * Since we are applying the beacon hint to a wiphy we know its
8214  * wiphy_idx is valid
8215  */
8216  if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
8217  goto nla_put_failure;
8218 
8219  /* Before */
8220  nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
8221  if (!nl_freq)
8222  goto nla_put_failure;
8223  if (nl80211_msg_put_channel(msg, channel_before))
8224  goto nla_put_failure;
8225  nla_nest_end(msg, nl_freq);
8226 
8227  /* After */
8228  nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
8229  if (!nl_freq)
8230  goto nla_put_failure;
8231  if (nl80211_msg_put_channel(msg, channel_after))
8232  goto nla_put_failure;
8233  nla_nest_end(msg, nl_freq);
8234 
8235  genlmsg_end(msg, hdr);
8236 
8237  rcu_read_lock();
8238  genlmsg_multicast_allns(msg, 0, nl80211_regulatory_mcgrp.id,
8239  GFP_ATOMIC);
8240  rcu_read_unlock();
8241 
8242  return;
8243 
8244 nla_put_failure:
8245  genlmsg_cancel(msg, hdr);
8246  nlmsg_free(msg);
8247 }
8248 
8249 static void nl80211_send_remain_on_chan_event(
8250  int cmd, struct cfg80211_registered_device *rdev,
8251  struct wireless_dev *wdev, u64 cookie,
8252  struct ieee80211_channel *chan,
8253  enum nl80211_channel_type channel_type,
8254  unsigned int duration, gfp_t gfp)
8255 {
8256  struct sk_buff *msg;
8257  void *hdr;
8258 
8259  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8260  if (!msg)
8261  return;
8262 
8263  hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
8264  if (!hdr) {
8265  nlmsg_free(msg);
8266  return;
8267  }
8268 
8269  if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8270  (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
8271  wdev->netdev->ifindex)) ||
8272  nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
8273  nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
8274  nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, channel_type) ||
8275  nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
8276  goto nla_put_failure;
8277 
8278  if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
8279  nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
8280  goto nla_put_failure;
8281 
8282  genlmsg_end(msg, hdr);
8283 
8284  genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8285  nl80211_mlme_mcgrp.id, gfp);
8286  return;
8287 
8288  nla_put_failure:
8289  genlmsg_cancel(msg, hdr);
8290  nlmsg_free(msg);
8291 }
8292 
8293 void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
8294  struct wireless_dev *wdev, u64 cookie,
8295  struct ieee80211_channel *chan,
8296  enum nl80211_channel_type channel_type,
8297  unsigned int duration, gfp_t gfp)
8298 {
8299  nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
8300  rdev, wdev, cookie, chan,
8301  channel_type, duration, gfp);
8302 }
8303 
8304 void nl80211_send_remain_on_channel_cancel(
8305  struct cfg80211_registered_device *rdev,
8306  struct wireless_dev *wdev,
8307  u64 cookie, struct ieee80211_channel *chan,
8308  enum nl80211_channel_type channel_type, gfp_t gfp)
8309 {
8310  nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
8311  rdev, wdev, cookie, chan,
8312  channel_type, 0, gfp);
8313 }
8314 
8315 void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
8316  struct net_device *dev, const u8 *mac_addr,
8317  struct station_info *sinfo, gfp_t gfp)
8318 {
8319  struct sk_buff *msg;
8320 
8321  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8322  if (!msg)
8323  return;
8324 
8325  if (nl80211_send_station(msg, 0, 0, 0,
8326  rdev, dev, mac_addr, sinfo) < 0) {
8327  nlmsg_free(msg);
8328  return;
8329  }
8330 
8331  genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8332  nl80211_mlme_mcgrp.id, gfp);
8333 }
8334 
8335 void nl80211_send_sta_del_event(struct cfg80211_registered_device *rdev,
8336  struct net_device *dev, const u8 *mac_addr,
8337  gfp_t gfp)
8338 {
8339  struct sk_buff *msg;
8340  void *hdr;
8341 
8342  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8343  if (!msg)
8344  return;
8345 
8346  hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
8347  if (!hdr) {
8348  nlmsg_free(msg);
8349  return;
8350  }
8351 
8352  if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8353  nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
8354  goto nla_put_failure;
8355 
8356  genlmsg_end(msg, hdr);
8357 
8358  genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8359  nl80211_mlme_mcgrp.id, gfp);
8360  return;
8361 
8362  nla_put_failure:
8363  genlmsg_cancel(msg, hdr);
8364  nlmsg_free(msg);
8365 }
8366 
8367 void nl80211_send_conn_failed_event(struct cfg80211_registered_device *rdev,
8368  struct net_device *dev, const u8 *mac_addr,
8369  enum nl80211_connect_failed_reason reason,
8370  gfp_t gfp)
8371 {
8372  struct sk_buff *msg;
8373  void *hdr;
8374 
8375  msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
8376  if (!msg)
8377  return;
8378 
8379  hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
8380  if (!hdr) {
8381  nlmsg_free(msg);
8382  return;
8383  }
8384 
8385  if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8386  nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
8387  nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
8388  goto nla_put_failure;
8389 
8390  genlmsg_end(msg, hdr);
8391 
8392  genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8393  nl80211_mlme_mcgrp.id, gfp);
8394  return;
8395 
8396  nla_put_failure:
8397  genlmsg_cancel(msg, hdr);
8398  nlmsg_free(msg);
8399 }
8400 
8401 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
8402  const u8 *addr, gfp_t gfp)
8403 {
8404  struct wireless_dev *wdev = dev->ieee80211_ptr;
8405  struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
8406  struct sk_buff *msg;
8407  void *hdr;
8408  int err;
8409  u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
8410 
8411  if (!nlportid)
8412  return false;
8413 
8414  msg = nlmsg_new(100, gfp);
8415  if (!msg)
8416  return true;
8417 
8418  hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
8419  if (!hdr) {
8420  nlmsg_free(msg);
8421  return true;
8422  }
8423 
8424  if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8425  nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8426  nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
8427  goto nla_put_failure;
8428 
8429  err = genlmsg_end(msg, hdr);
8430  if (err < 0) {
8431  nlmsg_free(msg);
8432  return true;
8433  }
8434 
8435  genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
8436  return true;
8437 
8438  nla_put_failure:
8439  genlmsg_cancel(msg, hdr);
8440  nlmsg_free(msg);
8441  return true;
8442 }
8443 
8444 bool nl80211_unexpected_frame(struct net_device *dev, const u8 *addr, gfp_t gfp)
8445 {
8446  return __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
8447  addr, gfp);
8448 }
8449 
8450 bool nl80211_unexpected_4addr_frame(struct net_device *dev,
8451  const u8 *addr, gfp_t gfp)
8452 {
8453  return __nl80211_unexpected_frame(dev,
8454  NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
8455  addr, gfp);
8456 }
8457 
8458 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
8459  struct wireless_dev *wdev, u32 nlportid,
8460  int freq, int sig_dbm,
8461  const u8 *buf, size_t len, gfp_t gfp)
8462 {
8463  struct net_device *netdev = wdev->netdev;
8464  struct sk_buff *msg;
8465  void *hdr;
8466 
8467  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8468  if (!msg)
8469  return -ENOMEM;
8470 
8471  hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
8472  if (!hdr) {
8473  nlmsg_free(msg);
8474  return -ENOMEM;
8475  }
8476 
8477  if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8478  (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
8479  netdev->ifindex)) ||
8480  nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
8481  (sig_dbm &&
8482  nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
8483  nla_put(msg, NL80211_ATTR_FRAME, len, buf))
8484  goto nla_put_failure;
8485 
8486  genlmsg_end(msg, hdr);
8487 
8488  return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
8489 
8490  nla_put_failure:
8491  genlmsg_cancel(msg, hdr);
8492  nlmsg_free(msg);
8493  return -ENOBUFS;
8494 }
8495 
8496 void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev,
8497  struct wireless_dev *wdev, u64 cookie,
8498  const u8 *buf, size_t len, bool ack,
8499  gfp_t gfp)
8500 {
8501  struct net_device *netdev = wdev->netdev;
8502  struct sk_buff *msg;
8503  void *hdr;
8504 
8505  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8506  if (!msg)
8507  return;
8508 
8509  hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
8510  if (!hdr) {
8511  nlmsg_free(msg);
8512  return;
8513  }
8514 
8515  if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8516  (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
8517  netdev->ifindex)) ||
8518  nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
8519  nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
8520  (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
8521  goto nla_put_failure;
8522 
8523  genlmsg_end(msg, hdr);
8524 
8525  genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
8526  return;
8527 
8528  nla_put_failure:
8529  genlmsg_cancel(msg, hdr);
8530  nlmsg_free(msg);
8531 }
8532 
8533 void
8534 nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
8535  struct net_device *netdev,
8536  enum nl80211_cqm_rssi_threshold_event rssi_event,
8537  gfp_t gfp)
8538 {
8539  struct sk_buff *msg;
8540  struct nlattr *pinfoattr;
8541  void *hdr;
8542 
8543  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8544  if (!msg)
8545  return;
8546 
8547  hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
8548  if (!hdr) {
8549  nlmsg_free(msg);
8550  return;
8551  }
8552 
8553  if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8554  nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
8555  goto nla_put_failure;
8556 
8557  pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
8558  if (!pinfoattr)
8559  goto nla_put_failure;
8560 
8561  if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
8562  rssi_event))
8563  goto nla_put_failure;
8564 
8565  nla_nest_end(msg, pinfoattr);
8566 
8567  genlmsg_end(msg, hdr);
8568 
8569  genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8570  nl80211_mlme_mcgrp.id, gfp);
8571  return;
8572 
8573  nla_put_failure:
8574  genlmsg_cancel(msg, hdr);
8575  nlmsg_free(msg);
8576 }
8577 
8578 void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
8579  struct net_device *netdev, const u8 *bssid,
8580  const u8 *replay_ctr, gfp_t gfp)
8581 {
8582  struct sk_buff *msg;
8583  struct nlattr *rekey_attr;
8584  void *hdr;
8585 
8586  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8587  if (!msg)
8588  return;
8589 
8590  hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
8591  if (!hdr) {
8592  nlmsg_free(msg);
8593  return;
8594  }
8595 
8596  if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8597  nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8598  nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
8599  goto nla_put_failure;
8600 
8601  rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
8602  if (!rekey_attr)
8603  goto nla_put_failure;
8604 
8605  if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
8606  NL80211_REPLAY_CTR_LEN, replay_ctr))
8607  goto nla_put_failure;
8608 
8609  nla_nest_end(msg, rekey_attr);
8610 
8611  genlmsg_end(msg, hdr);
8612 
8613  genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8614  nl80211_mlme_mcgrp.id, gfp);
8615  return;
8616 
8617  nla_put_failure:
8618  genlmsg_cancel(msg, hdr);
8619  nlmsg_free(msg);
8620 }
8621 
8622 void nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
8623  struct net_device *netdev, int index,
8624  const u8 *bssid, bool preauth, gfp_t gfp)
8625 {
8626  struct sk_buff *msg;
8627  struct nlattr *attr;
8628  void *hdr;
8629 
8630  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8631  if (!msg)
8632  return;
8633 
8634  hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
8635  if (!hdr) {
8636  nlmsg_free(msg);
8637  return;
8638  }
8639 
8640  if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8641  nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
8642  goto nla_put_failure;
8643 
8644  attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
8645  if (!attr)
8646  goto nla_put_failure;
8647 
8648  if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
8649  nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
8650  (preauth &&
8651  nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
8652  goto nla_put_failure;
8653 
8654  nla_nest_end(msg, attr);
8655 
8656  genlmsg_end(msg, hdr);
8657 
8658  genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8659  nl80211_mlme_mcgrp.id, gfp);
8660  return;
8661 
8662  nla_put_failure:
8663  genlmsg_cancel(msg, hdr);
8664  nlmsg_free(msg);
8665 }
8666 
8667 void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
8668  struct net_device *netdev, int freq,
8669  enum nl80211_channel_type type, gfp_t gfp)
8670 {
8671  struct sk_buff *msg;
8672  void *hdr;
8673 
8674  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8675  if (!msg)
8676  return;
8677 
8678  hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CH_SWITCH_NOTIFY);
8679  if (!hdr) {
8680  nlmsg_free(msg);
8681  return;
8682  }
8683 
8684  if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8685  nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
8686  nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, type))
8687  goto nla_put_failure;
8688 
8689  genlmsg_end(msg, hdr);
8690 
8691  genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8692  nl80211_mlme_mcgrp.id, gfp);
8693  return;
8694 
8695  nla_put_failure:
8696  genlmsg_cancel(msg, hdr);
8697  nlmsg_free(msg);
8698 }
8699 
8700 void
8701 nl80211_send_cqm_txe_notify(struct cfg80211_registered_device *rdev,
8702  struct net_device *netdev, const u8 *peer,
8703  u32 num_packets, u32 rate, u32 intvl, gfp_t gfp)
8704 {
8705  struct sk_buff *msg;
8706  struct nlattr *pinfoattr;
8707  void *hdr;
8708 
8709  msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
8710  if (!msg)
8711  return;
8712 
8713  hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
8714  if (!hdr) {
8715  nlmsg_free(msg);
8716  return;
8717  }
8718 
8719  if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8720  nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8721  nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
8722  goto nla_put_failure;
8723 
8724  pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
8725  if (!pinfoattr)
8726  goto nla_put_failure;
8727 
8728  if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
8729  goto nla_put_failure;
8730 
8731  if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
8732  goto nla_put_failure;
8733 
8734  if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
8735  goto nla_put_failure;
8736 
8737  nla_nest_end(msg, pinfoattr);
8738 
8739  genlmsg_end(msg, hdr);
8740 
8741  genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8742  nl80211_mlme_mcgrp.id, gfp);
8743  return;
8744 
8745  nla_put_failure:
8746  genlmsg_cancel(msg, hdr);
8747  nlmsg_free(msg);
8748 }
8749 
8750 void
8751 nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
8752  struct net_device *netdev, const u8 *peer,
8753  u32 num_packets, gfp_t gfp)
8754 {
8755  struct sk_buff *msg;
8756  struct nlattr *pinfoattr;
8757  void *hdr;
8758 
8759  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8760  if (!msg)
8761  return;
8762 
8763  hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
8764  if (!hdr) {
8765  nlmsg_free(msg);
8766  return;
8767  }
8768 
8769  if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8770  nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
8771  nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
8772  goto nla_put_failure;
8773 
8774  pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
8775  if (!pinfoattr)
8776  goto nla_put_failure;
8777 
8778  if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
8779  goto nla_put_failure;
8780 
8781  nla_nest_end(msg, pinfoattr);
8782 
8783  genlmsg_end(msg, hdr);
8784 
8785  genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8786  nl80211_mlme_mcgrp.id, gfp);
8787  return;
8788 
8789  nla_put_failure:
8790  genlmsg_cancel(msg, hdr);
8791  nlmsg_free(msg);
8792 }
8793 
8794 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
8795  u64 cookie, bool acked, gfp_t gfp)
8796 {
8797  struct wireless_dev *wdev = dev->ieee80211_ptr;
8798  struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
8799  struct sk_buff *msg;
8800  void *hdr;
8801  int err;
8802 
8803  msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
8804  if (!msg)
8805  return;
8806 
8807  hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
8808  if (!hdr) {
8809  nlmsg_free(msg);
8810  return;
8811  }
8812 
8813  if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8814  nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8815  nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
8816  nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
8817  (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
8818  goto nla_put_failure;
8819 
8820  err = genlmsg_end(msg, hdr);
8821  if (err < 0) {
8822  nlmsg_free(msg);
8823  return;
8824  }
8825 
8826  genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
8827  nl80211_mlme_mcgrp.id, gfp);
8828  return;
8829 
8830  nla_put_failure:
8831  genlmsg_cancel(msg, hdr);
8832  nlmsg_free(msg);
8833 }
8834 EXPORT_SYMBOL(cfg80211_probe_status);
8835 
8836 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
8837  const u8 *frame, size_t len,
8838  int freq, int sig_dbm, gfp_t gfp)
8839 {
8840  struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
8841  struct sk_buff *msg;
8842  void *hdr;
8843  u32 nlportid = ACCESS_ONCE(rdev->ap_beacons_nlportid);
8844 
8845  if (!nlportid)
8846  return;
8847 
8848  msg = nlmsg_new(len + 100, gfp);
8849  if (!msg)
8850  return;
8851 
8852  hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
8853  if (!hdr) {
8854  nlmsg_free(msg);
8855  return;
8856  }
8857 
8858  if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
8859  (freq &&
8860  nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
8861  (sig_dbm &&
8862  nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
8863  nla_put(msg, NL80211_ATTR_FRAME, len, frame))
8864  goto nla_put_failure;
8865 
8866  genlmsg_end(msg, hdr);
8867 
8868  genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
8869  return;
8870 
8871  nla_put_failure:
8872  genlmsg_cancel(msg, hdr);
8873  nlmsg_free(msg);
8874 }
8875 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
8876 
8877 static int nl80211_netlink_notify(struct notifier_block * nb,
8878  unsigned long state,
8879  void *_notify)
8880 {
8881  struct netlink_notify *notify = _notify;
8882  struct cfg80211_registered_device *rdev;
8883  struct wireless_dev *wdev;
8884 
8885  if (state != NETLINK_URELEASE)
8886  return NOTIFY_DONE;
8887 
8888  rcu_read_lock();
8889 
8890  list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
8891  list_for_each_entry_rcu(wdev, &rdev->wdev_list, list)
8892  cfg80211_mlme_unregister_socket(wdev, notify->portid);
8893  if (rdev->ap_beacons_nlportid == notify->portid)
8894  rdev->ap_beacons_nlportid = 0;
8895  }
8896 
8897  rcu_read_unlock();
8898 
8899  return NOTIFY_DONE;
8900 }
8901 
8902 static struct notifier_block nl80211_netlink_notifier = {
8903  .notifier_call = nl80211_netlink_notify,
8904 };
8905 
8906 /* initialisation/exit functions */
8907 
8908 int nl80211_init(void)
8909 {
8910  int err;
8911 
8912  err = genl_register_family_with_ops(&nl80211_fam,
8913  nl80211_ops, ARRAY_SIZE(nl80211_ops));
8914  if (err)
8915  return err;
8916 
8917  err = genl_register_mc_group(&nl80211_fam, &nl80211_config_mcgrp);
8918  if (err)
8919  goto err_out;
8920 
8921  err = genl_register_mc_group(&nl80211_fam, &nl80211_scan_mcgrp);
8922  if (err)
8923  goto err_out;
8924 
8925  err = genl_register_mc_group(&nl80211_fam, &nl80211_regulatory_mcgrp);
8926  if (err)
8927  goto err_out;
8928 
8929  err = genl_register_mc_group(&nl80211_fam, &nl80211_mlme_mcgrp);
8930  if (err)
8931  goto err_out;
8932 
8933 #ifdef CONFIG_NL80211_TESTMODE
8934  err = genl_register_mc_group(&nl80211_fam, &nl80211_testmode_mcgrp);
8935  if (err)
8936  goto err_out;
8937 #endif
8938 
8939  err = netlink_register_notifier(&nl80211_netlink_notifier);
8940  if (err)
8941  goto err_out;
8942 
8943  return 0;
8944  err_out:
8945  genl_unregister_family(&nl80211_fam);
8946  return err;
8947 }
8948 
8949 void nl80211_exit(void)
8950 {
8951  netlink_unregister_notifier(&nl80211_netlink_notifier);
8952  genl_unregister_family(&nl80211_fam);
8953 }
Generated on Thu Jan 10 2013 15:02:33 for Linux Kernel by   doxygen 1.8.2