1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * This is the new netlink-based wireless configuration interface.
4 *
5 * Copyright 2006-2010 Johannes Berg <johannes@sipsolutions.net>
6 * Copyright 2013-2014 Intel Mobile Communications GmbH
7 * Copyright 2015-2017 Intel Deutschland GmbH
8 * Copyright (C) 2018-2020 Intel Corporation
9 */
10
11 #include <linux/if.h>
12 #include <linux/module.h>
13 #include <linux/err.h>
14 #include <linux/slab.h>
15 #include <linux/list.h>
16 #include <linux/if_ether.h>
17 #include <linux/ieee80211.h>
18 #include <linux/nl80211.h>
19 #include <linux/rtnetlink.h>
20 #include <linux/netlink.h>
21 #include <linux/nospec.h>
22 #include <linux/etherdevice.h>
23 #include <linux/if_vlan.h>
24 #include <net/net_namespace.h>
25 #include <net/genetlink.h>
26 #include <net/cfg80211.h>
27 #include <net/sock.h>
28 #include <net/inet_connection_sock.h>
29 #include "core.h"
30 #include "nl80211.h"
31 #include "reg.h"
32 #include "rdev-ops.h"
33
34 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
35 struct genl_info *info,
36 struct cfg80211_crypto_settings *settings,
37 int cipher_limit);
38
39 /* the netlink family */
40 static struct genl_family nl80211_fam;
41
42 /* multicast groups */
43 enum nl80211_multicast_groups {
44 NL80211_MCGRP_CONFIG,
45 NL80211_MCGRP_SCAN,
46 NL80211_MCGRP_REGULATORY,
47 NL80211_MCGRP_MLME,
48 NL80211_MCGRP_VENDOR,
49 NL80211_MCGRP_NAN,
50 NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
51 };
52
53 static const struct genl_multicast_group nl80211_mcgrps[] = {
54 [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
55 [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
56 [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
57 [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
58 [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
59 [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
60 #ifdef CONFIG_NL80211_TESTMODE
61 [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
62 #endif
63 };
64
65 /* returns ERR_PTR values */
66 static struct wireless_dev *
__cfg80211_wdev_from_attrs(struct net * netns,struct nlattr ** attrs)67 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
68 {
69 struct cfg80211_registered_device *rdev;
70 struct wireless_dev *result = NULL;
71 bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
72 bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
73 u64 wdev_id;
74 int wiphy_idx = -1;
75 int ifidx = -1;
76
77 ASSERT_RTNL();
78
79 if (!have_ifidx && !have_wdev_id)
80 return ERR_PTR(-EINVAL);
81
82 if (have_ifidx)
83 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
84 if (have_wdev_id) {
85 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
86 wiphy_idx = wdev_id >> 32;
87 }
88
89 list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
90 struct wireless_dev *wdev;
91
92 if (wiphy_net(&rdev->wiphy) != netns)
93 continue;
94
95 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
96 continue;
97
98 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
99 if (have_ifidx && wdev->netdev &&
100 wdev->netdev->ifindex == ifidx) {
101 result = wdev;
102 break;
103 }
104 if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
105 result = wdev;
106 break;
107 }
108 }
109
110 if (result)
111 break;
112 }
113
114 if (result)
115 return result;
116 return ERR_PTR(-ENODEV);
117 }
118
119 static struct cfg80211_registered_device *
__cfg80211_rdev_from_attrs(struct net * netns,struct nlattr ** attrs)120 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
121 {
122 struct cfg80211_registered_device *rdev = NULL, *tmp;
123 struct net_device *netdev;
124
125 ASSERT_RTNL();
126
127 if (!attrs[NL80211_ATTR_WIPHY] &&
128 !attrs[NL80211_ATTR_IFINDEX] &&
129 !attrs[NL80211_ATTR_WDEV])
130 return ERR_PTR(-EINVAL);
131
132 if (attrs[NL80211_ATTR_WIPHY])
133 rdev = cfg80211_rdev_by_wiphy_idx(
134 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
135
136 if (attrs[NL80211_ATTR_WDEV]) {
137 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
138 struct wireless_dev *wdev;
139 bool found = false;
140
141 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
142 if (tmp) {
143 /* make sure wdev exists */
144 list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
145 if (wdev->identifier != (u32)wdev_id)
146 continue;
147 found = true;
148 break;
149 }
150
151 if (!found)
152 tmp = NULL;
153
154 if (rdev && tmp != rdev)
155 return ERR_PTR(-EINVAL);
156 rdev = tmp;
157 }
158 }
159
160 if (attrs[NL80211_ATTR_IFINDEX]) {
161 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
162
163 netdev = __dev_get_by_index(netns, ifindex);
164 if (netdev) {
165 if (netdev->ieee80211_ptr)
166 tmp = wiphy_to_rdev(
167 netdev->ieee80211_ptr->wiphy);
168 else
169 tmp = NULL;
170
171 /* not wireless device -- return error */
172 if (!tmp)
173 return ERR_PTR(-EINVAL);
174
175 /* mismatch -- return error */
176 if (rdev && tmp != rdev)
177 return ERR_PTR(-EINVAL);
178
179 rdev = tmp;
180 }
181 }
182
183 if (!rdev)
184 return ERR_PTR(-ENODEV);
185
186 if (netns != wiphy_net(&rdev->wiphy))
187 return ERR_PTR(-ENODEV);
188
189 return rdev;
190 }
191
192 /*
193 * This function returns a pointer to the driver
194 * that the genl_info item that is passed refers to.
195 *
196 * The result of this can be a PTR_ERR and hence must
197 * be checked with IS_ERR() for errors.
198 */
199 static struct cfg80211_registered_device *
cfg80211_get_dev_from_info(struct net * netns,struct genl_info * info)200 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
201 {
202 return __cfg80211_rdev_from_attrs(netns, info->attrs);
203 }
204
validate_beacon_head(const struct nlattr * attr,struct netlink_ext_ack * extack)205 static int validate_beacon_head(const struct nlattr *attr,
206 struct netlink_ext_ack *extack)
207 {
208 const u8 *data = nla_data(attr);
209 unsigned int len = nla_len(attr);
210 const struct element *elem;
211 const struct ieee80211_mgmt *mgmt = (void *)data;
212 bool s1g_bcn = ieee80211_is_s1g_beacon(mgmt->frame_control);
213 unsigned int fixedlen, hdrlen;
214
215 if (s1g_bcn) {
216 fixedlen = offsetof(struct ieee80211_ext,
217 u.s1g_beacon.variable);
218 hdrlen = offsetof(struct ieee80211_ext, u.s1g_beacon);
219 } else {
220 fixedlen = offsetof(struct ieee80211_mgmt,
221 u.beacon.variable);
222 hdrlen = offsetof(struct ieee80211_mgmt, u.beacon);
223 }
224
225 if (len < fixedlen)
226 goto err;
227
228 if (ieee80211_hdrlen(mgmt->frame_control) != hdrlen)
229 goto err;
230
231 data += fixedlen;
232 len -= fixedlen;
233
234 for_each_element(elem, data, len) {
235 /* nothing */
236 }
237
238 if (for_each_element_completed(elem, data, len))
239 return 0;
240
241 err:
242 NL_SET_ERR_MSG_ATTR(extack, attr, "malformed beacon head");
243 return -EINVAL;
244 }
245
validate_ie_attr(const struct nlattr * attr,struct netlink_ext_ack * extack)246 static int validate_ie_attr(const struct nlattr *attr,
247 struct netlink_ext_ack *extack)
248 {
249 const u8 *data = nla_data(attr);
250 unsigned int len = nla_len(attr);
251 const struct element *elem;
252
253 for_each_element(elem, data, len) {
254 /* nothing */
255 }
256
257 if (for_each_element_completed(elem, data, len))
258 return 0;
259
260 NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements");
261 return -EINVAL;
262 }
263
264 /* policy for the attributes */
265 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR];
266
267 static const struct nla_policy
268 nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = {
269 [NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, },
270 [NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY,
271 .len = U8_MAX },
272 [NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY,
273 .len = U8_MAX },
274 };
275
276 static const struct nla_policy
277 nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
278 [NL80211_PMSR_FTM_REQ_ATTR_ASAP] = { .type = NLA_FLAG },
279 [NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE] = { .type = NLA_U32 },
280 [NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] =
281 NLA_POLICY_MAX(NLA_U8, 15),
282 [NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 },
283 [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] =
284 NLA_POLICY_MAX(NLA_U8, 15),
285 [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] =
286 NLA_POLICY_MAX(NLA_U8, 31),
287 [NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 },
288 [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG },
289 [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG },
290 [NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED] = { .type = NLA_FLAG },
291 [NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED] = { .type = NLA_FLAG },
292 };
293
294 static const struct nla_policy
295 nl80211_pmsr_req_data_policy[NL80211_PMSR_TYPE_MAX + 1] = {
296 [NL80211_PMSR_TYPE_FTM] =
297 NLA_POLICY_NESTED(nl80211_pmsr_ftm_req_attr_policy),
298 };
299
300 static const struct nla_policy
301 nl80211_pmsr_req_attr_policy[NL80211_PMSR_REQ_ATTR_MAX + 1] = {
302 [NL80211_PMSR_REQ_ATTR_DATA] =
303 NLA_POLICY_NESTED(nl80211_pmsr_req_data_policy),
304 [NL80211_PMSR_REQ_ATTR_GET_AP_TSF] = { .type = NLA_FLAG },
305 };
306
307 static const struct nla_policy
308 nl80211_psmr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {
309 [NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR,
310 [NL80211_PMSR_PEER_ATTR_CHAN] = NLA_POLICY_NESTED(nl80211_policy),
311 [NL80211_PMSR_PEER_ATTR_REQ] =
312 NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy),
313 [NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT },
314 };
315
316 static const struct nla_policy
317 nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
318 [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT },
319 [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT },
320 [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },
321 [NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
322 [NL80211_PMSR_ATTR_PEERS] =
323 NLA_POLICY_NESTED_ARRAY(nl80211_psmr_peer_attr_policy),
324 };
325
326 static const struct nla_policy
327 he_obss_pd_policy[NL80211_HE_OBSS_PD_ATTR_MAX + 1] = {
328 [NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET] =
329 NLA_POLICY_RANGE(NLA_U8, 1, 20),
330 [NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET] =
331 NLA_POLICY_RANGE(NLA_U8, 1, 20),
332 [NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET] =
333 NLA_POLICY_RANGE(NLA_U8, 1, 20),
334 [NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP] =
335 NLA_POLICY_EXACT_LEN(8),
336 [NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP] =
337 NLA_POLICY_EXACT_LEN(8),
338 [NL80211_HE_OBSS_PD_ATTR_SR_CTRL] = { .type = NLA_U8 },
339 };
340
341 static const struct nla_policy
342 he_bss_color_policy[NL80211_HE_BSS_COLOR_ATTR_MAX + 1] = {
343 [NL80211_HE_BSS_COLOR_ATTR_COLOR] = NLA_POLICY_RANGE(NLA_U8, 1, 63),
344 [NL80211_HE_BSS_COLOR_ATTR_DISABLED] = { .type = NLA_FLAG },
345 [NL80211_HE_BSS_COLOR_ATTR_PARTIAL] = { .type = NLA_FLAG },
346 };
347
348 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
349 [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
350 .len = NL80211_MAX_SUPP_RATES },
351 [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
352 .len = NL80211_MAX_SUPP_HT_RATES },
353 [NL80211_TXRATE_VHT] = NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_txrate_vht)),
354 [NL80211_TXRATE_GI] = { .type = NLA_U8 },
355 [NL80211_TXRATE_HE] = NLA_POLICY_EXACT_LEN(sizeof(struct nl80211_txrate_he)),
356 [NL80211_TXRATE_HE_GI] = NLA_POLICY_RANGE(NLA_U8,
357 NL80211_RATE_INFO_HE_GI_0_8,
358 NL80211_RATE_INFO_HE_GI_3_2),
359 [NL80211_TXRATE_HE_LTF] = NLA_POLICY_RANGE(NLA_U8,
360 NL80211_RATE_INFO_HE_1XLTF,
361 NL80211_RATE_INFO_HE_4XLTF),
362 };
363
364 static const struct nla_policy
365 nl80211_tid_config_attr_policy[NL80211_TID_CONFIG_ATTR_MAX + 1] = {
366 [NL80211_TID_CONFIG_ATTR_VIF_SUPP] = { .type = NLA_U64 },
367 [NL80211_TID_CONFIG_ATTR_PEER_SUPP] = { .type = NLA_U64 },
368 [NL80211_TID_CONFIG_ATTR_OVERRIDE] = { .type = NLA_FLAG },
369 [NL80211_TID_CONFIG_ATTR_TIDS] = NLA_POLICY_RANGE(NLA_U16, 1, 0xff),
370 [NL80211_TID_CONFIG_ATTR_NOACK] =
371 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
372 [NL80211_TID_CONFIG_ATTR_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
373 [NL80211_TID_CONFIG_ATTR_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
374 [NL80211_TID_CONFIG_ATTR_AMPDU_CTRL] =
375 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
376 [NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL] =
377 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
378 [NL80211_TID_CONFIG_ATTR_AMSDU_CTRL] =
379 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
380 [NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE] =
381 NLA_POLICY_MAX(NLA_U8, NL80211_TX_RATE_FIXED),
382 [NL80211_TID_CONFIG_ATTR_TX_RATE] =
383 NLA_POLICY_NESTED(nl80211_txattr_policy),
384 };
385
386 static const struct nla_policy
387 nl80211_fils_discovery_policy[NL80211_FILS_DISCOVERY_ATTR_MAX + 1] = {
388 [NL80211_FILS_DISCOVERY_ATTR_INT_MIN] = NLA_POLICY_MAX(NLA_U32, 10000),
389 [NL80211_FILS_DISCOVERY_ATTR_INT_MAX] = NLA_POLICY_MAX(NLA_U32, 10000),
390 NLA_POLICY_RANGE(NLA_BINARY,
391 NL80211_FILS_DISCOVERY_TMPL_MIN_LEN,
392 IEEE80211_MAX_DATA_LEN),
393 };
394
395 static const struct nla_policy
396 nl80211_unsol_bcast_probe_resp_policy[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1] = {
397 [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] = NLA_POLICY_MAX(NLA_U32, 20),
398 [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL] = { .type = NLA_BINARY,
399 .len = IEEE80211_MAX_DATA_LEN }
400 };
401
402 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
403 [0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD },
404 [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
405 [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
406 .len = 20-1 },
407 [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
408
409 [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
410 [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
411 [NL80211_ATTR_WIPHY_EDMG_CHANNELS] = NLA_POLICY_RANGE(NLA_U8,
412 NL80211_EDMG_CHANNELS_MIN,
413 NL80211_EDMG_CHANNELS_MAX),
414 [NL80211_ATTR_WIPHY_EDMG_BW_CONFIG] = NLA_POLICY_RANGE(NLA_U8,
415 NL80211_EDMG_BW_CONFIG_MIN,
416 NL80211_EDMG_BW_CONFIG_MAX),
417
418 [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
419 [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
420 [NL80211_ATTR_CENTER_FREQ1_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
421 [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
422
423 [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
424 [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
425 [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
426 [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
427 [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
428 [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
429
430 [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX),
431 [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
432 [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
433
434 [NL80211_ATTR_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
435 [NL80211_ATTR_PREV_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
436
437 [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
438 [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
439 .len = WLAN_MAX_KEY_LEN },
440 [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 7),
441 [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
442 [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
443 [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
444 [NL80211_ATTR_KEY_TYPE] =
445 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES),
446
447 [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
448 [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
449 [NL80211_ATTR_BEACON_HEAD] =
450 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head,
451 IEEE80211_MAX_DATA_LEN),
452 [NL80211_ATTR_BEACON_TAIL] =
453 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
454 IEEE80211_MAX_DATA_LEN),
455 [NL80211_ATTR_STA_AID] =
456 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
457 [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
458 [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
459 [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
460 .len = NL80211_MAX_SUPP_RATES },
461 [NL80211_ATTR_STA_PLINK_ACTION] =
462 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1),
463 [NL80211_ATTR_STA_TX_POWER_SETTING] =
464 NLA_POLICY_RANGE(NLA_U8,
465 NL80211_TX_POWER_AUTOMATIC,
466 NL80211_TX_POWER_FIXED),
467 [NL80211_ATTR_STA_TX_POWER] = { .type = NLA_S16 },
468 [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
469 [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
470 [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
471 .len = IEEE80211_MAX_MESH_ID_LEN },
472 [NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT,
473
474 [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
475 [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
476
477 [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
478 [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
479 [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
480 [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
481 .len = NL80211_MAX_SUPP_RATES },
482 [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
483
484 [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
485 [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
486
487 [NL80211_ATTR_HT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_HT_CAPABILITY_LEN),
488
489 [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
490 [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY,
491 validate_ie_attr,
492 IEEE80211_MAX_DATA_LEN),
493 [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
494 [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
495
496 [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
497 .len = IEEE80211_MAX_SSID_LEN },
498 [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
499 [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
500 [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
501 [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
502 [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32,
503 NL80211_MFP_NO,
504 NL80211_MFP_OPTIONAL),
505 [NL80211_ATTR_STA_FLAGS2] = {
506 .len = sizeof(struct nl80211_sta_flag_update),
507 },
508 [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
509 [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
510 [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
511 [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
512 [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
513 [NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 },
514 [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
515 [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
516 [NL80211_ATTR_PID] = { .type = NLA_U32 },
517 [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
518 [NL80211_ATTR_PMKID] = NLA_POLICY_EXACT_LEN_WARN(WLAN_PMKID_LEN),
519 [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
520 [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
521 [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
522 [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
523 .len = IEEE80211_MAX_DATA_LEN },
524 [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
525 [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32,
526 NL80211_PS_DISABLED,
527 NL80211_PS_ENABLED),
528 [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
529 [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
530 [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
531 [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
532 [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
533 [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
534 [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
535 [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
536 [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
537 [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
538 [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
539 [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
540 [NL80211_ATTR_STA_PLINK_STATE] =
541 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1),
542 [NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 },
543 [NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG },
544 [NL80211_ATTR_MESH_PEER_AID] =
545 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
546 [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
547 [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
548 [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
549 [NL80211_ATTR_HIDDEN_SSID] =
550 NLA_POLICY_RANGE(NLA_U32,
551 NL80211_HIDDEN_SSID_NOT_IN_USE,
552 NL80211_HIDDEN_SSID_ZERO_CONTENTS),
553 [NL80211_ATTR_IE_PROBE_RESP] =
554 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
555 IEEE80211_MAX_DATA_LEN),
556 [NL80211_ATTR_IE_ASSOC_RESP] =
557 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
558 IEEE80211_MAX_DATA_LEN),
559 [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
560 [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
561 [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
562 [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
563 [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
564 [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
565 [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
566 [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
567 [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
568 [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
569 [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
570 .len = IEEE80211_MAX_DATA_LEN },
571 [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
572 [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
573 [NL80211_ATTR_HT_CAPABILITY_MASK] = {
574 .len = NL80211_HT_CAPABILITY_LEN
575 },
576 [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
577 [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
578 [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
579 [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
580 [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
581
582 /* need to include at least Auth Transaction and Status Code */
583 [NL80211_ATTR_AUTH_DATA] = NLA_POLICY_MIN_LEN(4),
584
585 [NL80211_ATTR_VHT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_VHT_CAPABILITY_LEN),
586 [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
587 [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127),
588 [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1),
589 [NL80211_ATTR_LOCAL_MESH_POWER_MODE] =
590 NLA_POLICY_RANGE(NLA_U32,
591 NL80211_MESH_POWER_UNKNOWN + 1,
592 NL80211_MESH_POWER_MAX),
593 [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
594 [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
595 [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
596 [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
597 [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
598 [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
599 [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
600 .len = NL80211_VHT_CAPABILITY_LEN,
601 },
602 [NL80211_ATTR_MDID] = { .type = NLA_U16 },
603 [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
604 .len = IEEE80211_MAX_DATA_LEN },
605 [NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 },
606 [NL80211_ATTR_MAX_CRIT_PROT_DURATION] =
607 NLA_POLICY_MAX(NLA_U16, NL80211_CRIT_PROTO_MAX_DURATION),
608 [NL80211_ATTR_PEER_AID] =
609 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
610 [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
611 [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
612 [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
613 [NL80211_ATTR_CNTDWN_OFFS_BEACON] = { .type = NLA_BINARY },
614 [NL80211_ATTR_CNTDWN_OFFS_PRESP] = { .type = NLA_BINARY },
615 [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = NLA_POLICY_MIN_LEN(2),
616 /*
617 * The value of the Length field of the Supported Operating
618 * Classes element is between 2 and 253.
619 */
620 [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] =
621 NLA_POLICY_RANGE(NLA_BINARY, 2, 253),
622 [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
623 [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
624 [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
625 [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
626 [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
627 [NL80211_ATTR_QOS_MAP] = NLA_POLICY_RANGE(NLA_BINARY,
628 IEEE80211_QOS_MAP_LEN_MIN,
629 IEEE80211_QOS_MAP_LEN_MAX),
630 [NL80211_ATTR_MAC_HINT] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
631 [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
632 [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
633 [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
634 [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
635 [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
636 [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1),
637 [NL80211_ATTR_USER_PRIO] =
638 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1),
639 [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
640 [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
641 [NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 },
642 [NL80211_ATTR_MAC_MASK] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
643 [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
644 [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
645 [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
646 [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
647 [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
648 [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
649 [NL80211_ATTR_STA_SUPPORT_P2P_PS] =
650 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1),
651 [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
652 .len = VHT_MUMIMO_GROUPS_DATA_LEN
653 },
654 [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
655 [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1),
656 [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
657 [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
658 [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
659 .len = FILS_MAX_KEK_LEN },
660 [NL80211_ATTR_FILS_NONCES] = NLA_POLICY_EXACT_LEN_WARN(2 * FILS_NONCE_LEN),
661 [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
662 [NL80211_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
663 [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
664 [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
665 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
666 },
667 [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
668 [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
669 .len = FILS_ERP_MAX_USERNAME_LEN },
670 [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
671 .len = FILS_ERP_MAX_REALM_LEN },
672 [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
673 [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
674 .len = FILS_ERP_MAX_RRK_LEN },
675 [NL80211_ATTR_FILS_CACHE_ID] = NLA_POLICY_EXACT_LEN_WARN(2),
676 [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
677 [NL80211_ATTR_PMKR0_NAME] = NLA_POLICY_EXACT_LEN(WLAN_PMK_NAME_LEN),
678 [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
679 [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
680
681 [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
682 [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
683 [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 },
684 [NL80211_ATTR_HE_CAPABILITY] =
685 NLA_POLICY_RANGE(NLA_BINARY,
686 NL80211_HE_MIN_CAPABILITY_LEN,
687 NL80211_HE_MAX_CAPABILITY_LEN),
688 [NL80211_ATTR_FTM_RESPONDER] =
689 NLA_POLICY_NESTED(nl80211_ftm_responder_policy),
690 [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1),
691 [NL80211_ATTR_PEER_MEASUREMENTS] =
692 NLA_POLICY_NESTED(nl80211_pmsr_attr_policy),
693 [NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1),
694 [NL80211_ATTR_SAE_PASSWORD] = { .type = NLA_BINARY,
695 .len = SAE_PASSWORD_MAX_LEN },
696 [NL80211_ATTR_TWT_RESPONDER] = { .type = NLA_FLAG },
697 [NL80211_ATTR_HE_OBSS_PD] = NLA_POLICY_NESTED(he_obss_pd_policy),
698 [NL80211_ATTR_VLAN_ID] = NLA_POLICY_RANGE(NLA_U16, 1, VLAN_N_VID - 2),
699 [NL80211_ATTR_HE_BSS_COLOR] = NLA_POLICY_NESTED(he_bss_color_policy),
700 [NL80211_ATTR_TID_CONFIG] =
701 NLA_POLICY_NESTED_ARRAY(nl80211_tid_config_attr_policy),
702 [NL80211_ATTR_CONTROL_PORT_NO_PREAUTH] = { .type = NLA_FLAG },
703 [NL80211_ATTR_PMK_LIFETIME] = NLA_POLICY_MIN(NLA_U32, 1),
704 [NL80211_ATTR_PMK_REAUTH_THRESHOLD] = NLA_POLICY_RANGE(NLA_U8, 1, 100),
705 [NL80211_ATTR_RECEIVE_MULTICAST] = { .type = NLA_FLAG },
706 [NL80211_ATTR_WIPHY_FREQ_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
707 [NL80211_ATTR_SCAN_FREQ_KHZ] = { .type = NLA_NESTED },
708 [NL80211_ATTR_HE_6GHZ_CAPABILITY] =
709 NLA_POLICY_EXACT_LEN(sizeof(struct ieee80211_he_6ghz_capa)),
710 [NL80211_ATTR_FILS_DISCOVERY] =
711 NLA_POLICY_NESTED(nl80211_fils_discovery_policy),
712 [NL80211_ATTR_UNSOL_BCAST_PROBE_RESP] =
713 NLA_POLICY_NESTED(nl80211_unsol_bcast_probe_resp_policy),
714 [NL80211_ATTR_S1G_CAPABILITY] =
715 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
716 [NL80211_ATTR_S1G_CAPABILITY_MASK] =
717 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
718 };
719
720 /* policy for the key attributes */
721 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
722 [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
723 [NL80211_KEY_IDX] = { .type = NLA_U8 },
724 [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
725 [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
726 [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
727 [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
728 [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1),
729 [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
730 [NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX),
731 };
732
733 /* policy for the key default flags */
734 static const struct nla_policy
735 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
736 [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
737 [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
738 };
739
740 #ifdef CONFIG_PM
741 /* policy for WoWLAN attributes */
742 static const struct nla_policy
743 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
744 [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
745 [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
746 [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
747 [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
748 [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
749 [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
750 [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
751 [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
752 [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
753 [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
754 };
755
756 static const struct nla_policy
757 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
758 [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
759 [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
760 [NL80211_WOWLAN_TCP_DST_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
761 [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
762 [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
763 [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
764 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
765 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
766 },
767 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
768 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
769 },
770 [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
771 [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
772 [NL80211_WOWLAN_TCP_WAKE_MASK] = NLA_POLICY_MIN_LEN(1),
773 };
774 #endif /* CONFIG_PM */
775
776 /* policy for coalesce rule attributes */
777 static const struct nla_policy
778 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
779 [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
780 [NL80211_ATTR_COALESCE_RULE_CONDITION] =
781 NLA_POLICY_RANGE(NLA_U32,
782 NL80211_COALESCE_CONDITION_MATCH,
783 NL80211_COALESCE_CONDITION_NO_MATCH),
784 [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
785 };
786
787 /* policy for GTK rekey offload attributes */
788 static const struct nla_policy
789 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
790 [NL80211_REKEY_DATA_KEK] = {
791 .type = NLA_BINARY,
792 .len = NL80211_KEK_EXT_LEN
793 },
794 [NL80211_REKEY_DATA_KCK] = {
795 .type = NLA_BINARY,
796 .len = NL80211_KCK_EXT_LEN
797 },
798 [NL80211_REKEY_DATA_REPLAY_CTR] = NLA_POLICY_EXACT_LEN(NL80211_REPLAY_CTR_LEN),
799 [NL80211_REKEY_DATA_AKM] = { .type = NLA_U32 },
800 };
801
802 static const struct nla_policy
803 nl80211_match_band_rssi_policy[NUM_NL80211_BANDS] = {
804 [NL80211_BAND_2GHZ] = { .type = NLA_S32 },
805 [NL80211_BAND_5GHZ] = { .type = NLA_S32 },
806 [NL80211_BAND_6GHZ] = { .type = NLA_S32 },
807 [NL80211_BAND_60GHZ] = { .type = NLA_S32 },
808 };
809
810 static const struct nla_policy
811 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
812 [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
813 .len = IEEE80211_MAX_SSID_LEN },
814 [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
815 [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
816 [NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI] =
817 NLA_POLICY_NESTED(nl80211_match_band_rssi_policy),
818 };
819
820 static const struct nla_policy
821 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
822 [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
823 [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
824 };
825
826 static const struct nla_policy
827 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
828 [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
829 [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
830 [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
831 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
832 },
833 };
834
835 /* policy for NAN function attributes */
836 static const struct nla_policy
837 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
838 [NL80211_NAN_FUNC_TYPE] =
839 NLA_POLICY_MAX(NLA_U8, NL80211_NAN_FUNC_MAX_TYPE),
840 [NL80211_NAN_FUNC_SERVICE_ID] = {
841 .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
842 [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
843 [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
844 [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
845 [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
846 [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
847 [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
848 [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
849 [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
850 [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
851 .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
852 [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
853 [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
854 [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
855 [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
856 [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
857 };
858
859 /* policy for Service Response Filter attributes */
860 static const struct nla_policy
861 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
862 [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
863 [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
864 .len = NL80211_NAN_FUNC_SRF_MAX_LEN },
865 [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
866 [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
867 };
868
869 /* policy for packet pattern attributes */
870 static const struct nla_policy
871 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
872 [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
873 [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
874 [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
875 };
876
nl80211_prepare_wdev_dump(struct netlink_callback * cb,struct cfg80211_registered_device ** rdev,struct wireless_dev ** wdev)877 int nl80211_prepare_wdev_dump(struct netlink_callback *cb,
878 struct cfg80211_registered_device **rdev,
879 struct wireless_dev **wdev)
880 {
881 int err;
882
883 if (!cb->args[0]) {
884 struct nlattr **attrbuf;
885
886 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
887 GFP_KERNEL);
888 if (!attrbuf)
889 return -ENOMEM;
890
891 err = nlmsg_parse_deprecated(cb->nlh,
892 GENL_HDRLEN + nl80211_fam.hdrsize,
893 attrbuf, nl80211_fam.maxattr,
894 nl80211_policy, NULL);
895 if (err) {
896 kfree(attrbuf);
897 return err;
898 }
899
900 *wdev = __cfg80211_wdev_from_attrs(sock_net(cb->skb->sk),
901 attrbuf);
902 kfree(attrbuf);
903 if (IS_ERR(*wdev))
904 return PTR_ERR(*wdev);
905 *rdev = wiphy_to_rdev((*wdev)->wiphy);
906 /* 0 is the first index - add 1 to parse only once */
907 cb->args[0] = (*rdev)->wiphy_idx + 1;
908 cb->args[1] = (*wdev)->identifier;
909 } else {
910 /* subtract the 1 again here */
911 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
912 struct wireless_dev *tmp;
913
914 if (!wiphy)
915 return -ENODEV;
916 *rdev = wiphy_to_rdev(wiphy);
917 *wdev = NULL;
918
919 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
920 if (tmp->identifier == cb->args[1]) {
921 *wdev = tmp;
922 break;
923 }
924 }
925
926 if (!*wdev)
927 return -ENODEV;
928 }
929
930 return 0;
931 }
932
933 /* message building helper */
nl80211hdr_put(struct sk_buff * skb,u32 portid,u32 seq,int flags,u8 cmd)934 void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
935 int flags, u8 cmd)
936 {
937 /* since there is no private header just add the generic one */
938 return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
939 }
940
nl80211_msg_put_wmm_rules(struct sk_buff * msg,const struct ieee80211_reg_rule * rule)941 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
942 const struct ieee80211_reg_rule *rule)
943 {
944 int j;
945 struct nlattr *nl_wmm_rules =
946 nla_nest_start_noflag(msg, NL80211_FREQUENCY_ATTR_WMM);
947
948 if (!nl_wmm_rules)
949 goto nla_put_failure;
950
951 for (j = 0; j < IEEE80211_NUM_ACS; j++) {
952 struct nlattr *nl_wmm_rule = nla_nest_start_noflag(msg, j);
953
954 if (!nl_wmm_rule)
955 goto nla_put_failure;
956
957 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
958 rule->wmm_rule.client[j].cw_min) ||
959 nla_put_u16(msg, NL80211_WMMR_CW_MAX,
960 rule->wmm_rule.client[j].cw_max) ||
961 nla_put_u8(msg, NL80211_WMMR_AIFSN,
962 rule->wmm_rule.client[j].aifsn) ||
963 nla_put_u16(msg, NL80211_WMMR_TXOP,
964 rule->wmm_rule.client[j].cot))
965 goto nla_put_failure;
966
967 nla_nest_end(msg, nl_wmm_rule);
968 }
969 nla_nest_end(msg, nl_wmm_rules);
970
971 return 0;
972
973 nla_put_failure:
974 return -ENOBUFS;
975 }
976
nl80211_msg_put_channel(struct sk_buff * msg,struct wiphy * wiphy,struct ieee80211_channel * chan,bool large)977 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
978 struct ieee80211_channel *chan,
979 bool large)
980 {
981 /* Some channels must be completely excluded from the
982 * list to protect old user-space tools from breaking
983 */
984 if (!large && chan->flags &
985 (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
986 return 0;
987 if (!large && chan->freq_offset)
988 return 0;
989
990 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
991 chan->center_freq))
992 goto nla_put_failure;
993
994 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_OFFSET, chan->freq_offset))
995 goto nla_put_failure;
996
997 if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
998 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
999 goto nla_put_failure;
1000 if (chan->flags & IEEE80211_CHAN_NO_IR) {
1001 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
1002 goto nla_put_failure;
1003 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
1004 goto nla_put_failure;
1005 }
1006 if (chan->flags & IEEE80211_CHAN_RADAR) {
1007 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
1008 goto nla_put_failure;
1009 if (large) {
1010 u32 time;
1011
1012 time = elapsed_jiffies_msecs(chan->dfs_state_entered);
1013
1014 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
1015 chan->dfs_state))
1016 goto nla_put_failure;
1017 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
1018 time))
1019 goto nla_put_failure;
1020 if (nla_put_u32(msg,
1021 NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
1022 chan->dfs_cac_ms))
1023 goto nla_put_failure;
1024 }
1025 }
1026
1027 if (large) {
1028 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
1029 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
1030 goto nla_put_failure;
1031 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
1032 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
1033 goto nla_put_failure;
1034 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
1035 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
1036 goto nla_put_failure;
1037 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
1038 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
1039 goto nla_put_failure;
1040 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
1041 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
1042 goto nla_put_failure;
1043 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
1044 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
1045 goto nla_put_failure;
1046 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
1047 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
1048 goto nla_put_failure;
1049 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
1050 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
1051 goto nla_put_failure;
1052 if ((chan->flags & IEEE80211_CHAN_NO_HE) &&
1053 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HE))
1054 goto nla_put_failure;
1055 if ((chan->flags & IEEE80211_CHAN_1MHZ) &&
1056 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_1MHZ))
1057 goto nla_put_failure;
1058 if ((chan->flags & IEEE80211_CHAN_2MHZ) &&
1059 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_2MHZ))
1060 goto nla_put_failure;
1061 if ((chan->flags & IEEE80211_CHAN_4MHZ) &&
1062 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_4MHZ))
1063 goto nla_put_failure;
1064 if ((chan->flags & IEEE80211_CHAN_8MHZ) &&
1065 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_8MHZ))
1066 goto nla_put_failure;
1067 if ((chan->flags & IEEE80211_CHAN_16MHZ) &&
1068 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_16MHZ))
1069 goto nla_put_failure;
1070 }
1071
1072 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
1073 DBM_TO_MBM(chan->max_power)))
1074 goto nla_put_failure;
1075
1076 if (large) {
1077 const struct ieee80211_reg_rule *rule =
1078 freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
1079
1080 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) {
1081 if (nl80211_msg_put_wmm_rules(msg, rule))
1082 goto nla_put_failure;
1083 }
1084 }
1085
1086 return 0;
1087
1088 nla_put_failure:
1089 return -ENOBUFS;
1090 }
1091
nl80211_put_txq_stats(struct sk_buff * msg,struct cfg80211_txq_stats * txqstats,int attrtype)1092 static bool nl80211_put_txq_stats(struct sk_buff *msg,
1093 struct cfg80211_txq_stats *txqstats,
1094 int attrtype)
1095 {
1096 struct nlattr *txqattr;
1097
1098 #define PUT_TXQVAL_U32(attr, memb) do { \
1099 if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) && \
1100 nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \
1101 return false; \
1102 } while (0)
1103
1104 txqattr = nla_nest_start_noflag(msg, attrtype);
1105 if (!txqattr)
1106 return false;
1107
1108 PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes);
1109 PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets);
1110 PUT_TXQVAL_U32(FLOWS, flows);
1111 PUT_TXQVAL_U32(DROPS, drops);
1112 PUT_TXQVAL_U32(ECN_MARKS, ecn_marks);
1113 PUT_TXQVAL_U32(OVERLIMIT, overlimit);
1114 PUT_TXQVAL_U32(OVERMEMORY, overmemory);
1115 PUT_TXQVAL_U32(COLLISIONS, collisions);
1116 PUT_TXQVAL_U32(TX_BYTES, tx_bytes);
1117 PUT_TXQVAL_U32(TX_PACKETS, tx_packets);
1118 PUT_TXQVAL_U32(MAX_FLOWS, max_flows);
1119 nla_nest_end(msg, txqattr);
1120
1121 #undef PUT_TXQVAL_U32
1122 return true;
1123 }
1124
1125 /* netlink command implementations */
1126
1127 struct key_parse {
1128 struct key_params p;
1129 int idx;
1130 int type;
1131 bool def, defmgmt, defbeacon;
1132 bool def_uni, def_multi;
1133 };
1134
nl80211_parse_key_new(struct genl_info * info,struct nlattr * key,struct key_parse * k)1135 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
1136 struct key_parse *k)
1137 {
1138 struct nlattr *tb[NL80211_KEY_MAX + 1];
1139 int err = nla_parse_nested_deprecated(tb, NL80211_KEY_MAX, key,
1140 nl80211_key_policy,
1141 info->extack);
1142 if (err)
1143 return err;
1144
1145 k->def = !!tb[NL80211_KEY_DEFAULT];
1146 k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
1147 k->defbeacon = !!tb[NL80211_KEY_DEFAULT_BEACON];
1148
1149 if (k->def) {
1150 k->def_uni = true;
1151 k->def_multi = true;
1152 }
1153 if (k->defmgmt || k->defbeacon)
1154 k->def_multi = true;
1155
1156 if (tb[NL80211_KEY_IDX])
1157 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
1158
1159 if (tb[NL80211_KEY_DATA]) {
1160 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
1161 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
1162 }
1163
1164 if (tb[NL80211_KEY_SEQ]) {
1165 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
1166 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
1167 }
1168
1169 if (tb[NL80211_KEY_CIPHER])
1170 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
1171
1172 if (tb[NL80211_KEY_TYPE])
1173 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
1174
1175 if (tb[NL80211_KEY_DEFAULT_TYPES]) {
1176 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1177
1178 err = nla_parse_nested_deprecated(kdt,
1179 NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1180 tb[NL80211_KEY_DEFAULT_TYPES],
1181 nl80211_key_default_policy,
1182 info->extack);
1183 if (err)
1184 return err;
1185
1186 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1187 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1188 }
1189
1190 if (tb[NL80211_KEY_MODE])
1191 k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]);
1192
1193 return 0;
1194 }
1195
nl80211_parse_key_old(struct genl_info * info,struct key_parse * k)1196 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
1197 {
1198 if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1199 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1200 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1201 }
1202
1203 if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
1204 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
1205 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
1206 }
1207
1208 if (info->attrs[NL80211_ATTR_KEY_IDX])
1209 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1210
1211 if (info->attrs[NL80211_ATTR_KEY_CIPHER])
1212 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1213
1214 k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
1215 k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
1216
1217 if (k->def) {
1218 k->def_uni = true;
1219 k->def_multi = true;
1220 }
1221 if (k->defmgmt)
1222 k->def_multi = true;
1223
1224 if (info->attrs[NL80211_ATTR_KEY_TYPE])
1225 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1226
1227 if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
1228 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1229 int err = nla_parse_nested_deprecated(kdt,
1230 NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1231 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
1232 nl80211_key_default_policy,
1233 info->extack);
1234 if (err)
1235 return err;
1236
1237 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1238 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1239 }
1240
1241 return 0;
1242 }
1243
nl80211_parse_key(struct genl_info * info,struct key_parse * k)1244 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
1245 {
1246 int err;
1247
1248 memset(k, 0, sizeof(*k));
1249 k->idx = -1;
1250 k->type = -1;
1251
1252 if (info->attrs[NL80211_ATTR_KEY])
1253 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
1254 else
1255 err = nl80211_parse_key_old(info, k);
1256
1257 if (err)
1258 return err;
1259
1260 if ((k->def ? 1 : 0) + (k->defmgmt ? 1 : 0) +
1261 (k->defbeacon ? 1 : 0) > 1) {
1262 GENL_SET_ERR_MSG(info,
1263 "key with multiple default flags is invalid");
1264 return -EINVAL;
1265 }
1266
1267 if (k->defmgmt || k->defbeacon) {
1268 if (k->def_uni || !k->def_multi) {
1269 GENL_SET_ERR_MSG(info,
1270 "defmgmt/defbeacon key must be mcast");
1271 return -EINVAL;
1272 }
1273 }
1274
1275 if (k->idx != -1) {
1276 if (k->defmgmt) {
1277 if (k->idx < 4 || k->idx > 5) {
1278 GENL_SET_ERR_MSG(info,
1279 "defmgmt key idx not 4 or 5");
1280 return -EINVAL;
1281 }
1282 } else if (k->defbeacon) {
1283 if (k->idx < 6 || k->idx > 7) {
1284 GENL_SET_ERR_MSG(info,
1285 "defbeacon key idx not 6 or 7");
1286 return -EINVAL;
1287 }
1288 } else if (k->def) {
1289 if (k->idx < 0 || k->idx > 3) {
1290 GENL_SET_ERR_MSG(info, "def key idx not 0-3");
1291 return -EINVAL;
1292 }
1293 } else {
1294 if (k->idx < 0 || k->idx > 7) {
1295 GENL_SET_ERR_MSG(info, "key idx not 0-7");
1296 return -EINVAL;
1297 }
1298 }
1299 }
1300
1301 return 0;
1302 }
1303
1304 static struct cfg80211_cached_keys *
nl80211_parse_connkeys(struct cfg80211_registered_device * rdev,struct genl_info * info,bool * no_ht)1305 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
1306 struct genl_info *info, bool *no_ht)
1307 {
1308 struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
1309 struct key_parse parse;
1310 struct nlattr *key;
1311 struct cfg80211_cached_keys *result;
1312 int rem, err, def = 0;
1313 bool have_key = false;
1314
1315 nla_for_each_nested(key, keys, rem) {
1316 have_key = true;
1317 break;
1318 }
1319
1320 if (!have_key)
1321 return NULL;
1322
1323 result = kzalloc(sizeof(*result), GFP_KERNEL);
1324 if (!result)
1325 return ERR_PTR(-ENOMEM);
1326
1327 result->def = -1;
1328
1329 nla_for_each_nested(key, keys, rem) {
1330 memset(&parse, 0, sizeof(parse));
1331 parse.idx = -1;
1332
1333 err = nl80211_parse_key_new(info, key, &parse);
1334 if (err)
1335 goto error;
1336 err = -EINVAL;
1337 if (!parse.p.key)
1338 goto error;
1339 if (parse.idx < 0 || parse.idx > 3) {
1340 GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
1341 goto error;
1342 }
1343 if (parse.def) {
1344 if (def) {
1345 GENL_SET_ERR_MSG(info,
1346 "only one key can be default");
1347 goto error;
1348 }
1349 def = 1;
1350 result->def = parse.idx;
1351 if (!parse.def_uni || !parse.def_multi)
1352 goto error;
1353 } else if (parse.defmgmt)
1354 goto error;
1355 err = cfg80211_validate_key_settings(rdev, &parse.p,
1356 parse.idx, false, NULL);
1357 if (err)
1358 goto error;
1359 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1360 parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
1361 GENL_SET_ERR_MSG(info, "connect key must be WEP");
1362 err = -EINVAL;
1363 goto error;
1364 }
1365 result->params[parse.idx].cipher = parse.p.cipher;
1366 result->params[parse.idx].key_len = parse.p.key_len;
1367 result->params[parse.idx].key = result->data[parse.idx];
1368 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
1369
1370 /* must be WEP key if we got here */
1371 if (no_ht)
1372 *no_ht = true;
1373 }
1374
1375 if (result->def < 0) {
1376 err = -EINVAL;
1377 GENL_SET_ERR_MSG(info, "need a default/TX key");
1378 goto error;
1379 }
1380
1381 return result;
1382 error:
1383 kfree(result);
1384 return ERR_PTR(err);
1385 }
1386
nl80211_key_allowed(struct wireless_dev * wdev)1387 static int nl80211_key_allowed(struct wireless_dev *wdev)
1388 {
1389 ASSERT_WDEV_LOCK(wdev);
1390
1391 switch (wdev->iftype) {
1392 case NL80211_IFTYPE_AP:
1393 case NL80211_IFTYPE_AP_VLAN:
1394 case NL80211_IFTYPE_P2P_GO:
1395 case NL80211_IFTYPE_MESH_POINT:
1396 break;
1397 case NL80211_IFTYPE_ADHOC:
1398 case NL80211_IFTYPE_STATION:
1399 case NL80211_IFTYPE_P2P_CLIENT:
1400 if (!wdev->current_bss)
1401 return -ENOLINK;
1402 break;
1403 case NL80211_IFTYPE_UNSPECIFIED:
1404 case NL80211_IFTYPE_OCB:
1405 case NL80211_IFTYPE_MONITOR:
1406 case NL80211_IFTYPE_NAN:
1407 case NL80211_IFTYPE_P2P_DEVICE:
1408 case NL80211_IFTYPE_WDS:
1409 case NUM_NL80211_IFTYPES:
1410 return -EINVAL;
1411 }
1412
1413 return 0;
1414 }
1415
nl80211_get_valid_chan(struct wiphy * wiphy,u32 freq)1416 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1417 u32 freq)
1418 {
1419 struct ieee80211_channel *chan;
1420
1421 chan = ieee80211_get_channel_khz(wiphy, freq);
1422 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1423 return NULL;
1424 return chan;
1425 }
1426
nl80211_put_iftypes(struct sk_buff * msg,u32 attr,u16 ifmodes)1427 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1428 {
1429 struct nlattr *nl_modes = nla_nest_start_noflag(msg, attr);
1430 int i;
1431
1432 if (!nl_modes)
1433 goto nla_put_failure;
1434
1435 i = 0;
1436 while (ifmodes) {
1437 if ((ifmodes & 1) && nla_put_flag(msg, i))
1438 goto nla_put_failure;
1439 ifmodes >>= 1;
1440 i++;
1441 }
1442
1443 nla_nest_end(msg, nl_modes);
1444 return 0;
1445
1446 nla_put_failure:
1447 return -ENOBUFS;
1448 }
1449
nl80211_put_iface_combinations(struct wiphy * wiphy,struct sk_buff * msg,bool large)1450 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1451 struct sk_buff *msg,
1452 bool large)
1453 {
1454 struct nlattr *nl_combis;
1455 int i, j;
1456
1457 nl_combis = nla_nest_start_noflag(msg,
1458 NL80211_ATTR_INTERFACE_COMBINATIONS);
1459 if (!nl_combis)
1460 goto nla_put_failure;
1461
1462 for (i = 0; i < wiphy->n_iface_combinations; i++) {
1463 const struct ieee80211_iface_combination *c;
1464 struct nlattr *nl_combi, *nl_limits;
1465
1466 c = &wiphy->iface_combinations[i];
1467
1468 nl_combi = nla_nest_start_noflag(msg, i + 1);
1469 if (!nl_combi)
1470 goto nla_put_failure;
1471
1472 nl_limits = nla_nest_start_noflag(msg,
1473 NL80211_IFACE_COMB_LIMITS);
1474 if (!nl_limits)
1475 goto nla_put_failure;
1476
1477 for (j = 0; j < c->n_limits; j++) {
1478 struct nlattr *nl_limit;
1479
1480 nl_limit = nla_nest_start_noflag(msg, j + 1);
1481 if (!nl_limit)
1482 goto nla_put_failure;
1483 if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1484 c->limits[j].max))
1485 goto nla_put_failure;
1486 if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1487 c->limits[j].types))
1488 goto nla_put_failure;
1489 nla_nest_end(msg, nl_limit);
1490 }
1491
1492 nla_nest_end(msg, nl_limits);
1493
1494 if (c->beacon_int_infra_match &&
1495 nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1496 goto nla_put_failure;
1497 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1498 c->num_different_channels) ||
1499 nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1500 c->max_interfaces))
1501 goto nla_put_failure;
1502 if (large &&
1503 (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1504 c->radar_detect_widths) ||
1505 nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1506 c->radar_detect_regions)))
1507 goto nla_put_failure;
1508 if (c->beacon_int_min_gcd &&
1509 nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1510 c->beacon_int_min_gcd))
1511 goto nla_put_failure;
1512
1513 nla_nest_end(msg, nl_combi);
1514 }
1515
1516 nla_nest_end(msg, nl_combis);
1517
1518 return 0;
1519 nla_put_failure:
1520 return -ENOBUFS;
1521 }
1522
1523 #ifdef CONFIG_PM
nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device * rdev,struct sk_buff * msg)1524 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1525 struct sk_buff *msg)
1526 {
1527 const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1528 struct nlattr *nl_tcp;
1529
1530 if (!tcp)
1531 return 0;
1532
1533 nl_tcp = nla_nest_start_noflag(msg,
1534 NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1535 if (!nl_tcp)
1536 return -ENOBUFS;
1537
1538 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1539 tcp->data_payload_max))
1540 return -ENOBUFS;
1541
1542 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1543 tcp->data_payload_max))
1544 return -ENOBUFS;
1545
1546 if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1547 return -ENOBUFS;
1548
1549 if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1550 sizeof(*tcp->tok), tcp->tok))
1551 return -ENOBUFS;
1552
1553 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1554 tcp->data_interval_max))
1555 return -ENOBUFS;
1556
1557 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1558 tcp->wake_payload_max))
1559 return -ENOBUFS;
1560
1561 nla_nest_end(msg, nl_tcp);
1562 return 0;
1563 }
1564
nl80211_send_wowlan(struct sk_buff * msg,struct cfg80211_registered_device * rdev,bool large)1565 static int nl80211_send_wowlan(struct sk_buff *msg,
1566 struct cfg80211_registered_device *rdev,
1567 bool large)
1568 {
1569 struct nlattr *nl_wowlan;
1570
1571 if (!rdev->wiphy.wowlan)
1572 return 0;
1573
1574 nl_wowlan = nla_nest_start_noflag(msg,
1575 NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1576 if (!nl_wowlan)
1577 return -ENOBUFS;
1578
1579 if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1580 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1581 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1582 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1583 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1584 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1585 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1586 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1587 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1588 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1589 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1590 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1591 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1592 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1593 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1594 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1595 return -ENOBUFS;
1596
1597 if (rdev->wiphy.wowlan->n_patterns) {
1598 struct nl80211_pattern_support pat = {
1599 .max_patterns = rdev->wiphy.wowlan->n_patterns,
1600 .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1601 .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1602 .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1603 };
1604
1605 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1606 sizeof(pat), &pat))
1607 return -ENOBUFS;
1608 }
1609
1610 if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1611 nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1612 rdev->wiphy.wowlan->max_nd_match_sets))
1613 return -ENOBUFS;
1614
1615 if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1616 return -ENOBUFS;
1617
1618 nla_nest_end(msg, nl_wowlan);
1619
1620 return 0;
1621 }
1622 #endif
1623
nl80211_send_coalesce(struct sk_buff * msg,struct cfg80211_registered_device * rdev)1624 static int nl80211_send_coalesce(struct sk_buff *msg,
1625 struct cfg80211_registered_device *rdev)
1626 {
1627 struct nl80211_coalesce_rule_support rule;
1628
1629 if (!rdev->wiphy.coalesce)
1630 return 0;
1631
1632 rule.max_rules = rdev->wiphy.coalesce->n_rules;
1633 rule.max_delay = rdev->wiphy.coalesce->max_delay;
1634 rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1635 rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1636 rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1637 rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1638
1639 if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1640 return -ENOBUFS;
1641
1642 return 0;
1643 }
1644
1645 static int
nl80211_send_iftype_data(struct sk_buff * msg,const struct ieee80211_supported_band * sband,const struct ieee80211_sband_iftype_data * iftdata)1646 nl80211_send_iftype_data(struct sk_buff *msg,
1647 const struct ieee80211_supported_band *sband,
1648 const struct ieee80211_sband_iftype_data *iftdata)
1649 {
1650 const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap;
1651
1652 if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES,
1653 iftdata->types_mask))
1654 return -ENOBUFS;
1655
1656 if (he_cap->has_he) {
1657 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC,
1658 sizeof(he_cap->he_cap_elem.mac_cap_info),
1659 he_cap->he_cap_elem.mac_cap_info) ||
1660 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY,
1661 sizeof(he_cap->he_cap_elem.phy_cap_info),
1662 he_cap->he_cap_elem.phy_cap_info) ||
1663 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET,
1664 sizeof(he_cap->he_mcs_nss_supp),
1665 &he_cap->he_mcs_nss_supp) ||
1666 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
1667 sizeof(he_cap->ppe_thres), he_cap->ppe_thres))
1668 return -ENOBUFS;
1669 }
1670
1671 if (sband->band == NL80211_BAND_6GHZ &&
1672 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_6GHZ_CAPA,
1673 sizeof(iftdata->he_6ghz_capa),
1674 &iftdata->he_6ghz_capa))
1675 return -ENOBUFS;
1676
1677 return 0;
1678 }
1679
nl80211_send_band_rateinfo(struct sk_buff * msg,struct ieee80211_supported_band * sband,bool large)1680 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1681 struct ieee80211_supported_band *sband,
1682 bool large)
1683 {
1684 struct nlattr *nl_rates, *nl_rate;
1685 struct ieee80211_rate *rate;
1686 int i;
1687
1688 /* add HT info */
1689 if (sband->ht_cap.ht_supported &&
1690 (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1691 sizeof(sband->ht_cap.mcs),
1692 &sband->ht_cap.mcs) ||
1693 nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1694 sband->ht_cap.cap) ||
1695 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1696 sband->ht_cap.ampdu_factor) ||
1697 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1698 sband->ht_cap.ampdu_density)))
1699 return -ENOBUFS;
1700
1701 /* add VHT info */
1702 if (sband->vht_cap.vht_supported &&
1703 (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1704 sizeof(sband->vht_cap.vht_mcs),
1705 &sband->vht_cap.vht_mcs) ||
1706 nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1707 sband->vht_cap.cap)))
1708 return -ENOBUFS;
1709
1710 if (large && sband->n_iftype_data) {
1711 struct nlattr *nl_iftype_data =
1712 nla_nest_start_noflag(msg,
1713 NL80211_BAND_ATTR_IFTYPE_DATA);
1714 int err;
1715
1716 if (!nl_iftype_data)
1717 return -ENOBUFS;
1718
1719 for (i = 0; i < sband->n_iftype_data; i++) {
1720 struct nlattr *iftdata;
1721
1722 iftdata = nla_nest_start_noflag(msg, i + 1);
1723 if (!iftdata)
1724 return -ENOBUFS;
1725
1726 err = nl80211_send_iftype_data(msg, sband,
1727 &sband->iftype_data[i]);
1728 if (err)
1729 return err;
1730
1731 nla_nest_end(msg, iftdata);
1732 }
1733
1734 nla_nest_end(msg, nl_iftype_data);
1735 }
1736
1737 /* add EDMG info */
1738 if (large && sband->edmg_cap.channels &&
1739 (nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_CHANNELS,
1740 sband->edmg_cap.channels) ||
1741 nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_BW_CONFIG,
1742 sband->edmg_cap.bw_config)))
1743
1744 return -ENOBUFS;
1745
1746 /* add bitrates */
1747 nl_rates = nla_nest_start_noflag(msg, NL80211_BAND_ATTR_RATES);
1748 if (!nl_rates)
1749 return -ENOBUFS;
1750
1751 for (i = 0; i < sband->n_bitrates; i++) {
1752 nl_rate = nla_nest_start_noflag(msg, i);
1753 if (!nl_rate)
1754 return -ENOBUFS;
1755
1756 rate = &sband->bitrates[i];
1757 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1758 rate->bitrate))
1759 return -ENOBUFS;
1760 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1761 nla_put_flag(msg,
1762 NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1763 return -ENOBUFS;
1764
1765 nla_nest_end(msg, nl_rate);
1766 }
1767
1768 nla_nest_end(msg, nl_rates);
1769
1770 return 0;
1771 }
1772
1773 static int
nl80211_send_mgmt_stypes(struct sk_buff * msg,const struct ieee80211_txrx_stypes * mgmt_stypes)1774 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1775 const struct ieee80211_txrx_stypes *mgmt_stypes)
1776 {
1777 u16 stypes;
1778 struct nlattr *nl_ftypes, *nl_ifs;
1779 enum nl80211_iftype ift;
1780 int i;
1781
1782 if (!mgmt_stypes)
1783 return 0;
1784
1785 nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_TX_FRAME_TYPES);
1786 if (!nl_ifs)
1787 return -ENOBUFS;
1788
1789 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1790 nl_ftypes = nla_nest_start_noflag(msg, ift);
1791 if (!nl_ftypes)
1792 return -ENOBUFS;
1793 i = 0;
1794 stypes = mgmt_stypes[ift].tx;
1795 while (stypes) {
1796 if ((stypes & 1) &&
1797 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1798 (i << 4) | IEEE80211_FTYPE_MGMT))
1799 return -ENOBUFS;
1800 stypes >>= 1;
1801 i++;
1802 }
1803 nla_nest_end(msg, nl_ftypes);
1804 }
1805
1806 nla_nest_end(msg, nl_ifs);
1807
1808 nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_RX_FRAME_TYPES);
1809 if (!nl_ifs)
1810 return -ENOBUFS;
1811
1812 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1813 nl_ftypes = nla_nest_start_noflag(msg, ift);
1814 if (!nl_ftypes)
1815 return -ENOBUFS;
1816 i = 0;
1817 stypes = mgmt_stypes[ift].rx;
1818 while (stypes) {
1819 if ((stypes & 1) &&
1820 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1821 (i << 4) | IEEE80211_FTYPE_MGMT))
1822 return -ENOBUFS;
1823 stypes >>= 1;
1824 i++;
1825 }
1826 nla_nest_end(msg, nl_ftypes);
1827 }
1828 nla_nest_end(msg, nl_ifs);
1829
1830 return 0;
1831 }
1832
1833 #define CMD(op, n) \
1834 do { \
1835 if (rdev->ops->op) { \
1836 i++; \
1837 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1838 goto nla_put_failure; \
1839 } \
1840 } while (0)
1841
nl80211_add_commands_unsplit(struct cfg80211_registered_device * rdev,struct sk_buff * msg)1842 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
1843 struct sk_buff *msg)
1844 {
1845 int i = 0;
1846
1847 /*
1848 * do *NOT* add anything into this function, new things need to be
1849 * advertised only to new versions of userspace that can deal with
1850 * the split (and they can't possibly care about new features...
1851 */
1852 CMD(add_virtual_intf, NEW_INTERFACE);
1853 CMD(change_virtual_intf, SET_INTERFACE);
1854 CMD(add_key, NEW_KEY);
1855 CMD(start_ap, START_AP);
1856 CMD(add_station, NEW_STATION);
1857 CMD(add_mpath, NEW_MPATH);
1858 CMD(update_mesh_config, SET_MESH_CONFIG);
1859 CMD(change_bss, SET_BSS);
1860 CMD(auth, AUTHENTICATE);
1861 CMD(assoc, ASSOCIATE);
1862 CMD(deauth, DEAUTHENTICATE);
1863 CMD(disassoc, DISASSOCIATE);
1864 CMD(join_ibss, JOIN_IBSS);
1865 CMD(join_mesh, JOIN_MESH);
1866 CMD(set_pmksa, SET_PMKSA);
1867 CMD(del_pmksa, DEL_PMKSA);
1868 CMD(flush_pmksa, FLUSH_PMKSA);
1869 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1870 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1871 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1872 CMD(mgmt_tx, FRAME);
1873 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1874 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1875 i++;
1876 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1877 goto nla_put_failure;
1878 }
1879 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1880 rdev->ops->join_mesh) {
1881 i++;
1882 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1883 goto nla_put_failure;
1884 }
1885 CMD(set_wds_peer, SET_WDS_PEER);
1886 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1887 CMD(tdls_mgmt, TDLS_MGMT);
1888 CMD(tdls_oper, TDLS_OPER);
1889 }
1890 if (rdev->wiphy.max_sched_scan_reqs)
1891 CMD(sched_scan_start, START_SCHED_SCAN);
1892 CMD(probe_client, PROBE_CLIENT);
1893 CMD(set_noack_map, SET_NOACK_MAP);
1894 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1895 i++;
1896 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1897 goto nla_put_failure;
1898 }
1899 CMD(start_p2p_device, START_P2P_DEVICE);
1900 CMD(set_mcast_rate, SET_MCAST_RATE);
1901 #ifdef CONFIG_NL80211_TESTMODE
1902 CMD(testmode_cmd, TESTMODE);
1903 #endif
1904
1905 if (rdev->ops->connect || rdev->ops->auth) {
1906 i++;
1907 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1908 goto nla_put_failure;
1909 }
1910
1911 if (rdev->ops->disconnect || rdev->ops->deauth) {
1912 i++;
1913 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1914 goto nla_put_failure;
1915 }
1916
1917 return i;
1918 nla_put_failure:
1919 return -ENOBUFS;
1920 }
1921
1922 static int
nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities * cap,struct sk_buff * msg)1923 nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap,
1924 struct sk_buff *msg)
1925 {
1926 struct nlattr *ftm;
1927
1928 if (!cap->ftm.supported)
1929 return 0;
1930
1931 ftm = nla_nest_start_noflag(msg, NL80211_PMSR_TYPE_FTM);
1932 if (!ftm)
1933 return -ENOBUFS;
1934
1935 if (cap->ftm.asap && nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_ASAP))
1936 return -ENOBUFS;
1937 if (cap->ftm.non_asap &&
1938 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP))
1939 return -ENOBUFS;
1940 if (cap->ftm.request_lci &&
1941 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI))
1942 return -ENOBUFS;
1943 if (cap->ftm.request_civicloc &&
1944 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC))
1945 return -ENOBUFS;
1946 if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES,
1947 cap->ftm.preambles))
1948 return -ENOBUFS;
1949 if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS,
1950 cap->ftm.bandwidths))
1951 return -ENOBUFS;
1952 if (cap->ftm.max_bursts_exponent >= 0 &&
1953 nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT,
1954 cap->ftm.max_bursts_exponent))
1955 return -ENOBUFS;
1956 if (cap->ftm.max_ftms_per_burst &&
1957 nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST,
1958 cap->ftm.max_ftms_per_burst))
1959 return -ENOBUFS;
1960 if (cap->ftm.trigger_based &&
1961 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED))
1962 return -ENOBUFS;
1963 if (cap->ftm.non_trigger_based &&
1964 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED))
1965 return -ENOBUFS;
1966
1967 nla_nest_end(msg, ftm);
1968 return 0;
1969 }
1970
nl80211_send_pmsr_capa(struct cfg80211_registered_device * rdev,struct sk_buff * msg)1971 static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,
1972 struct sk_buff *msg)
1973 {
1974 const struct cfg80211_pmsr_capabilities *cap = rdev->wiphy.pmsr_capa;
1975 struct nlattr *pmsr, *caps;
1976
1977 if (!cap)
1978 return 0;
1979
1980 /*
1981 * we don't need to clean up anything here since the caller
1982 * will genlmsg_cancel() if we fail
1983 */
1984
1985 pmsr = nla_nest_start_noflag(msg, NL80211_ATTR_PEER_MEASUREMENTS);
1986 if (!pmsr)
1987 return -ENOBUFS;
1988
1989 if (nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEERS, cap->max_peers))
1990 return -ENOBUFS;
1991
1992 if (cap->report_ap_tsf &&
1993 nla_put_flag(msg, NL80211_PMSR_ATTR_REPORT_AP_TSF))
1994 return -ENOBUFS;
1995
1996 if (cap->randomize_mac_addr &&
1997 nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR))
1998 return -ENOBUFS;
1999
2000 caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA);
2001 if (!caps)
2002 return -ENOBUFS;
2003
2004 if (nl80211_send_pmsr_ftm_capa(cap, msg))
2005 return -ENOBUFS;
2006
2007 nla_nest_end(msg, caps);
2008 nla_nest_end(msg, pmsr);
2009
2010 return 0;
2011 }
2012
2013 static int
nl80211_put_iftype_akm_suites(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2014 nl80211_put_iftype_akm_suites(struct cfg80211_registered_device *rdev,
2015 struct sk_buff *msg)
2016 {
2017 int i;
2018 struct nlattr *nested, *nested_akms;
2019 const struct wiphy_iftype_akm_suites *iftype_akms;
2020
2021 if (!rdev->wiphy.num_iftype_akm_suites ||
2022 !rdev->wiphy.iftype_akm_suites)
2023 return 0;
2024
2025 nested = nla_nest_start(msg, NL80211_ATTR_IFTYPE_AKM_SUITES);
2026 if (!nested)
2027 return -ENOBUFS;
2028
2029 for (i = 0; i < rdev->wiphy.num_iftype_akm_suites; i++) {
2030 nested_akms = nla_nest_start(msg, i + 1);
2031 if (!nested_akms)
2032 return -ENOBUFS;
2033
2034 iftype_akms = &rdev->wiphy.iftype_akm_suites[i];
2035
2036 if (nl80211_put_iftypes(msg, NL80211_IFTYPE_AKM_ATTR_IFTYPES,
2037 iftype_akms->iftypes_mask))
2038 return -ENOBUFS;
2039
2040 if (nla_put(msg, NL80211_IFTYPE_AKM_ATTR_SUITES,
2041 sizeof(u32) * iftype_akms->n_akm_suites,
2042 iftype_akms->akm_suites)) {
2043 return -ENOBUFS;
2044 }
2045 nla_nest_end(msg, nested_akms);
2046 }
2047
2048 nla_nest_end(msg, nested);
2049
2050 return 0;
2051 }
2052
2053 static int
nl80211_put_tid_config_support(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2054 nl80211_put_tid_config_support(struct cfg80211_registered_device *rdev,
2055 struct sk_buff *msg)
2056 {
2057 struct nlattr *supp;
2058
2059 if (!rdev->wiphy.tid_config_support.vif &&
2060 !rdev->wiphy.tid_config_support.peer)
2061 return 0;
2062
2063 supp = nla_nest_start(msg, NL80211_ATTR_TID_CONFIG);
2064 if (!supp)
2065 return -ENOSPC;
2066
2067 if (rdev->wiphy.tid_config_support.vif &&
2068 nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_VIF_SUPP,
2069 rdev->wiphy.tid_config_support.vif,
2070 NL80211_TID_CONFIG_ATTR_PAD))
2071 goto fail;
2072
2073 if (rdev->wiphy.tid_config_support.peer &&
2074 nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_PEER_SUPP,
2075 rdev->wiphy.tid_config_support.peer,
2076 NL80211_TID_CONFIG_ATTR_PAD))
2077 goto fail;
2078
2079 /* for now we just use the same value ... makes more sense */
2080 if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_SHORT,
2081 rdev->wiphy.tid_config_support.max_retry))
2082 goto fail;
2083 if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_LONG,
2084 rdev->wiphy.tid_config_support.max_retry))
2085 goto fail;
2086
2087 nla_nest_end(msg, supp);
2088
2089 return 0;
2090 fail:
2091 nla_nest_cancel(msg, supp);
2092 return -ENOBUFS;
2093 }
2094
2095 struct nl80211_dump_wiphy_state {
2096 s64 filter_wiphy;
2097 long start;
2098 long split_start, band_start, chan_start, capa_start;
2099 bool split;
2100 };
2101
nl80211_send_wiphy(struct cfg80211_registered_device * rdev,enum nl80211_commands cmd,struct sk_buff * msg,u32 portid,u32 seq,int flags,struct nl80211_dump_wiphy_state * state)2102 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
2103 enum nl80211_commands cmd,
2104 struct sk_buff *msg, u32 portid, u32 seq,
2105 int flags, struct nl80211_dump_wiphy_state *state)
2106 {
2107 void *hdr;
2108 struct nlattr *nl_bands, *nl_band;
2109 struct nlattr *nl_freqs, *nl_freq;
2110 struct nlattr *nl_cmds;
2111 enum nl80211_band band;
2112 struct ieee80211_channel *chan;
2113 int i;
2114 const struct ieee80211_txrx_stypes *mgmt_stypes =
2115 rdev->wiphy.mgmt_stypes;
2116 u32 features;
2117
2118 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2119 if (!hdr)
2120 return -ENOBUFS;
2121
2122 if (WARN_ON(!state))
2123 return -EINVAL;
2124
2125 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2126 nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
2127 wiphy_name(&rdev->wiphy)) ||
2128 nla_put_u32(msg, NL80211_ATTR_GENERATION,
2129 cfg80211_rdev_list_generation))
2130 goto nla_put_failure;
2131
2132 if (cmd != NL80211_CMD_NEW_WIPHY)
2133 goto finish;
2134
2135 switch (state->split_start) {
2136 case 0:
2137 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
2138 rdev->wiphy.retry_short) ||
2139 nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
2140 rdev->wiphy.retry_long) ||
2141 nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
2142 rdev->wiphy.frag_threshold) ||
2143 nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
2144 rdev->wiphy.rts_threshold) ||
2145 nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
2146 rdev->wiphy.coverage_class) ||
2147 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
2148 rdev->wiphy.max_scan_ssids) ||
2149 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
2150 rdev->wiphy.max_sched_scan_ssids) ||
2151 nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
2152 rdev->wiphy.max_scan_ie_len) ||
2153 nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
2154 rdev->wiphy.max_sched_scan_ie_len) ||
2155 nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
2156 rdev->wiphy.max_match_sets))
2157 goto nla_put_failure;
2158
2159 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
2160 nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
2161 goto nla_put_failure;
2162 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
2163 nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
2164 goto nla_put_failure;
2165 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
2166 nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
2167 goto nla_put_failure;
2168 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
2169 nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
2170 goto nla_put_failure;
2171 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
2172 nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
2173 goto nla_put_failure;
2174 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
2175 nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
2176 goto nla_put_failure;
2177 state->split_start++;
2178 if (state->split)
2179 break;
2180 fallthrough;
2181 case 1:
2182 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
2183 sizeof(u32) * rdev->wiphy.n_cipher_suites,
2184 rdev->wiphy.cipher_suites))
2185 goto nla_put_failure;
2186
2187 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
2188 rdev->wiphy.max_num_pmkids))
2189 goto nla_put_failure;
2190
2191 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
2192 nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
2193 goto nla_put_failure;
2194
2195 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
2196 rdev->wiphy.available_antennas_tx) ||
2197 nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
2198 rdev->wiphy.available_antennas_rx))
2199 goto nla_put_failure;
2200
2201 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
2202 nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
2203 rdev->wiphy.probe_resp_offload))
2204 goto nla_put_failure;
2205
2206 if ((rdev->wiphy.available_antennas_tx ||
2207 rdev->wiphy.available_antennas_rx) &&
2208 rdev->ops->get_antenna) {
2209 u32 tx_ant = 0, rx_ant = 0;
2210 int res;
2211
2212 res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
2213 if (!res) {
2214 if (nla_put_u32(msg,
2215 NL80211_ATTR_WIPHY_ANTENNA_TX,
2216 tx_ant) ||
2217 nla_put_u32(msg,
2218 NL80211_ATTR_WIPHY_ANTENNA_RX,
2219 rx_ant))
2220 goto nla_put_failure;
2221 }
2222 }
2223
2224 state->split_start++;
2225 if (state->split)
2226 break;
2227 fallthrough;
2228 case 2:
2229 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
2230 rdev->wiphy.interface_modes))
2231 goto nla_put_failure;
2232 state->split_start++;
2233 if (state->split)
2234 break;
2235 fallthrough;
2236 case 3:
2237 nl_bands = nla_nest_start_noflag(msg,
2238 NL80211_ATTR_WIPHY_BANDS);
2239 if (!nl_bands)
2240 goto nla_put_failure;
2241
2242 for (band = state->band_start;
2243 band < NUM_NL80211_BANDS; band++) {
2244 struct ieee80211_supported_band *sband;
2245
2246 /* omit higher bands for ancient software */
2247 if (band > NL80211_BAND_5GHZ && !state->split)
2248 break;
2249
2250 sband = rdev->wiphy.bands[band];
2251
2252 if (!sband)
2253 continue;
2254
2255 nl_band = nla_nest_start_noflag(msg, band);
2256 if (!nl_band)
2257 goto nla_put_failure;
2258
2259 switch (state->chan_start) {
2260 case 0:
2261 if (nl80211_send_band_rateinfo(msg, sband,
2262 state->split))
2263 goto nla_put_failure;
2264 state->chan_start++;
2265 if (state->split)
2266 break;
2267 fallthrough;
2268 default:
2269 /* add frequencies */
2270 nl_freqs = nla_nest_start_noflag(msg,
2271 NL80211_BAND_ATTR_FREQS);
2272 if (!nl_freqs)
2273 goto nla_put_failure;
2274
2275 for (i = state->chan_start - 1;
2276 i < sband->n_channels;
2277 i++) {
2278 nl_freq = nla_nest_start_noflag(msg,
2279 i);
2280 if (!nl_freq)
2281 goto nla_put_failure;
2282
2283 chan = &sband->channels[i];
2284
2285 if (nl80211_msg_put_channel(
2286 msg, &rdev->wiphy, chan,
2287 state->split))
2288 goto nla_put_failure;
2289
2290 nla_nest_end(msg, nl_freq);
2291 if (state->split)
2292 break;
2293 }
2294 if (i < sband->n_channels)
2295 state->chan_start = i + 2;
2296 else
2297 state->chan_start = 0;
2298 nla_nest_end(msg, nl_freqs);
2299 }
2300
2301 nla_nest_end(msg, nl_band);
2302
2303 if (state->split) {
2304 /* start again here */
2305 if (state->chan_start)
2306 band--;
2307 break;
2308 }
2309 }
2310 nla_nest_end(msg, nl_bands);
2311
2312 if (band < NUM_NL80211_BANDS)
2313 state->band_start = band + 1;
2314 else
2315 state->band_start = 0;
2316
2317 /* if bands & channels are done, continue outside */
2318 if (state->band_start == 0 && state->chan_start == 0)
2319 state->split_start++;
2320 if (state->split)
2321 break;
2322 fallthrough;
2323 case 4:
2324 nl_cmds = nla_nest_start_noflag(msg,
2325 NL80211_ATTR_SUPPORTED_COMMANDS);
2326 if (!nl_cmds)
2327 goto nla_put_failure;
2328
2329 i = nl80211_add_commands_unsplit(rdev, msg);
2330 if (i < 0)
2331 goto nla_put_failure;
2332 if (state->split) {
2333 CMD(crit_proto_start, CRIT_PROTOCOL_START);
2334 CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
2335 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
2336 CMD(channel_switch, CHANNEL_SWITCH);
2337 CMD(set_qos_map, SET_QOS_MAP);
2338 if (rdev->wiphy.features &
2339 NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
2340 CMD(add_tx_ts, ADD_TX_TS);
2341 CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
2342 CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
2343 CMD(update_ft_ies, UPDATE_FT_IES);
2344 }
2345 #undef CMD
2346
2347 nla_nest_end(msg, nl_cmds);
2348 state->split_start++;
2349 if (state->split)
2350 break;
2351 fallthrough;
2352 case 5:
2353 if (rdev->ops->remain_on_channel &&
2354 (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
2355 nla_put_u32(msg,
2356 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
2357 rdev->wiphy.max_remain_on_channel_duration))
2358 goto nla_put_failure;
2359
2360 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
2361 nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
2362 goto nla_put_failure;
2363
2364 state->split_start++;
2365 if (state->split)
2366 break;
2367 fallthrough;
2368 case 6:
2369 #ifdef CONFIG_PM
2370 if (nl80211_send_wowlan(msg, rdev, state->split))
2371 goto nla_put_failure;
2372 state->split_start++;
2373 if (state->split)
2374 break;
2375 #else
2376 state->split_start++;
2377 #endif
2378 fallthrough;
2379 case 7:
2380 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
2381 rdev->wiphy.software_iftypes))
2382 goto nla_put_failure;
2383
2384 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
2385 state->split))
2386 goto nla_put_failure;
2387
2388 state->split_start++;
2389 if (state->split)
2390 break;
2391 fallthrough;
2392 case 8:
2393 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
2394 nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
2395 rdev->wiphy.ap_sme_capa))
2396 goto nla_put_failure;
2397
2398 features = rdev->wiphy.features;
2399 /*
2400 * We can only add the per-channel limit information if the
2401 * dump is split, otherwise it makes it too big. Therefore
2402 * only advertise it in that case.
2403 */
2404 if (state->split)
2405 features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
2406 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
2407 goto nla_put_failure;
2408
2409 if (rdev->wiphy.ht_capa_mod_mask &&
2410 nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
2411 sizeof(*rdev->wiphy.ht_capa_mod_mask),
2412 rdev->wiphy.ht_capa_mod_mask))
2413 goto nla_put_failure;
2414
2415 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
2416 rdev->wiphy.max_acl_mac_addrs &&
2417 nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
2418 rdev->wiphy.max_acl_mac_addrs))
2419 goto nla_put_failure;
2420
2421 /*
2422 * Any information below this point is only available to
2423 * applications that can deal with it being split. This
2424 * helps ensure that newly added capabilities don't break
2425 * older tools by overrunning their buffers.
2426 *
2427 * We still increment split_start so that in the split
2428 * case we'll continue with more data in the next round,
2429 * but break unconditionally so unsplit data stops here.
2430 */
2431 if (state->split)
2432 state->split_start++;
2433 else
2434 state->split_start = 0;
2435 break;
2436 case 9:
2437 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
2438 goto nla_put_failure;
2439
2440 if (nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
2441 rdev->wiphy.max_sched_scan_plans) ||
2442 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
2443 rdev->wiphy.max_sched_scan_plan_interval) ||
2444 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
2445 rdev->wiphy.max_sched_scan_plan_iterations))
2446 goto nla_put_failure;
2447
2448 if (rdev->wiphy.extended_capabilities &&
2449 (nla_put(msg, NL80211_ATTR_EXT_CAPA,
2450 rdev->wiphy.extended_capabilities_len,
2451 rdev->wiphy.extended_capabilities) ||
2452 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2453 rdev->wiphy.extended_capabilities_len,
2454 rdev->wiphy.extended_capabilities_mask)))
2455 goto nla_put_failure;
2456
2457 if (rdev->wiphy.vht_capa_mod_mask &&
2458 nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
2459 sizeof(*rdev->wiphy.vht_capa_mod_mask),
2460 rdev->wiphy.vht_capa_mod_mask))
2461 goto nla_put_failure;
2462
2463 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
2464 rdev->wiphy.perm_addr))
2465 goto nla_put_failure;
2466
2467 if (!is_zero_ether_addr(rdev->wiphy.addr_mask) &&
2468 nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
2469 rdev->wiphy.addr_mask))
2470 goto nla_put_failure;
2471
2472 if (rdev->wiphy.n_addresses > 1) {
2473 void *attr;
2474
2475 attr = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS);
2476 if (!attr)
2477 goto nla_put_failure;
2478
2479 for (i = 0; i < rdev->wiphy.n_addresses; i++)
2480 if (nla_put(msg, i + 1, ETH_ALEN,
2481 rdev->wiphy.addresses[i].addr))
2482 goto nla_put_failure;
2483
2484 nla_nest_end(msg, attr);
2485 }
2486
2487 state->split_start++;
2488 break;
2489 case 10:
2490 if (nl80211_send_coalesce(msg, rdev))
2491 goto nla_put_failure;
2492
2493 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
2494 (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
2495 nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
2496 goto nla_put_failure;
2497
2498 if (rdev->wiphy.max_ap_assoc_sta &&
2499 nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
2500 rdev->wiphy.max_ap_assoc_sta))
2501 goto nla_put_failure;
2502
2503 state->split_start++;
2504 break;
2505 case 11:
2506 if (rdev->wiphy.n_vendor_commands) {
2507 const struct nl80211_vendor_cmd_info *info;
2508 struct nlattr *nested;
2509
2510 nested = nla_nest_start_noflag(msg,
2511 NL80211_ATTR_VENDOR_DATA);
2512 if (!nested)
2513 goto nla_put_failure;
2514
2515 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
2516 info = &rdev->wiphy.vendor_commands[i].info;
2517 if (nla_put(msg, i + 1, sizeof(*info), info))
2518 goto nla_put_failure;
2519 }
2520 nla_nest_end(msg, nested);
2521 }
2522
2523 if (rdev->wiphy.n_vendor_events) {
2524 const struct nl80211_vendor_cmd_info *info;
2525 struct nlattr *nested;
2526
2527 nested = nla_nest_start_noflag(msg,
2528 NL80211_ATTR_VENDOR_EVENTS);
2529 if (!nested)
2530 goto nla_put_failure;
2531
2532 for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
2533 info = &rdev->wiphy.vendor_events[i];
2534 if (nla_put(msg, i + 1, sizeof(*info), info))
2535 goto nla_put_failure;
2536 }
2537 nla_nest_end(msg, nested);
2538 }
2539 state->split_start++;
2540 break;
2541 case 12:
2542 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
2543 nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
2544 rdev->wiphy.max_num_csa_counters))
2545 goto nla_put_failure;
2546
2547 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
2548 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
2549 goto nla_put_failure;
2550
2551 if (rdev->wiphy.max_sched_scan_reqs &&
2552 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
2553 rdev->wiphy.max_sched_scan_reqs))
2554 goto nla_put_failure;
2555
2556 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
2557 sizeof(rdev->wiphy.ext_features),
2558 rdev->wiphy.ext_features))
2559 goto nla_put_failure;
2560
2561 if (rdev->wiphy.bss_select_support) {
2562 struct nlattr *nested;
2563 u32 bss_select_support = rdev->wiphy.bss_select_support;
2564
2565 nested = nla_nest_start_noflag(msg,
2566 NL80211_ATTR_BSS_SELECT);
2567 if (!nested)
2568 goto nla_put_failure;
2569
2570 i = 0;
2571 while (bss_select_support) {
2572 if ((bss_select_support & 1) &&
2573 nla_put_flag(msg, i))
2574 goto nla_put_failure;
2575 i++;
2576 bss_select_support >>= 1;
2577 }
2578 nla_nest_end(msg, nested);
2579 }
2580
2581 state->split_start++;
2582 break;
2583 case 13:
2584 if (rdev->wiphy.num_iftype_ext_capab &&
2585 rdev->wiphy.iftype_ext_capab) {
2586 struct nlattr *nested_ext_capab, *nested;
2587
2588 nested = nla_nest_start_noflag(msg,
2589 NL80211_ATTR_IFTYPE_EXT_CAPA);
2590 if (!nested)
2591 goto nla_put_failure;
2592
2593 for (i = state->capa_start;
2594 i < rdev->wiphy.num_iftype_ext_capab; i++) {
2595 const struct wiphy_iftype_ext_capab *capab;
2596
2597 capab = &rdev->wiphy.iftype_ext_capab[i];
2598
2599 nested_ext_capab = nla_nest_start_noflag(msg,
2600 i);
2601 if (!nested_ext_capab ||
2602 nla_put_u32(msg, NL80211_ATTR_IFTYPE,
2603 capab->iftype) ||
2604 nla_put(msg, NL80211_ATTR_EXT_CAPA,
2605 capab->extended_capabilities_len,
2606 capab->extended_capabilities) ||
2607 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2608 capab->extended_capabilities_len,
2609 capab->extended_capabilities_mask))
2610 goto nla_put_failure;
2611
2612 nla_nest_end(msg, nested_ext_capab);
2613 if (state->split)
2614 break;
2615 }
2616 nla_nest_end(msg, nested);
2617 if (i < rdev->wiphy.num_iftype_ext_capab) {
2618 state->capa_start = i + 1;
2619 break;
2620 }
2621 }
2622
2623 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
2624 rdev->wiphy.nan_supported_bands))
2625 goto nla_put_failure;
2626
2627 if (wiphy_ext_feature_isset(&rdev->wiphy,
2628 NL80211_EXT_FEATURE_TXQS)) {
2629 struct cfg80211_txq_stats txqstats = {};
2630 int res;
2631
2632 res = rdev_get_txq_stats(rdev, NULL, &txqstats);
2633 if (!res &&
2634 !nl80211_put_txq_stats(msg, &txqstats,
2635 NL80211_ATTR_TXQ_STATS))
2636 goto nla_put_failure;
2637
2638 if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT,
2639 rdev->wiphy.txq_limit))
2640 goto nla_put_failure;
2641 if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT,
2642 rdev->wiphy.txq_memory_limit))
2643 goto nla_put_failure;
2644 if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM,
2645 rdev->wiphy.txq_quantum))
2646 goto nla_put_failure;
2647 }
2648
2649 state->split_start++;
2650 break;
2651 case 14:
2652 if (nl80211_send_pmsr_capa(rdev, msg))
2653 goto nla_put_failure;
2654
2655 state->split_start++;
2656 break;
2657 case 15:
2658 if (rdev->wiphy.akm_suites &&
2659 nla_put(msg, NL80211_ATTR_AKM_SUITES,
2660 sizeof(u32) * rdev->wiphy.n_akm_suites,
2661 rdev->wiphy.akm_suites))
2662 goto nla_put_failure;
2663
2664 if (nl80211_put_iftype_akm_suites(rdev, msg))
2665 goto nla_put_failure;
2666
2667 if (nl80211_put_tid_config_support(rdev, msg))
2668 goto nla_put_failure;
2669
2670 /* done */
2671 state->split_start = 0;
2672 break;
2673 }
2674 finish:
2675 genlmsg_end(msg, hdr);
2676 return 0;
2677
2678 nla_put_failure:
2679 genlmsg_cancel(msg, hdr);
2680 return -EMSGSIZE;
2681 }
2682
nl80211_dump_wiphy_parse(struct sk_buff * skb,struct netlink_callback * cb,struct nl80211_dump_wiphy_state * state)2683 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
2684 struct netlink_callback *cb,
2685 struct nl80211_dump_wiphy_state *state)
2686 {
2687 struct nlattr **tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
2688 int ret;
2689
2690 if (!tb)
2691 return -ENOMEM;
2692
2693 ret = nlmsg_parse_deprecated(cb->nlh,
2694 GENL_HDRLEN + nl80211_fam.hdrsize,
2695 tb, nl80211_fam.maxattr,
2696 nl80211_policy, NULL);
2697 /* ignore parse errors for backward compatibility */
2698 if (ret) {
2699 ret = 0;
2700 goto out;
2701 }
2702
2703 state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
2704 if (tb[NL80211_ATTR_WIPHY])
2705 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
2706 if (tb[NL80211_ATTR_WDEV])
2707 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
2708 if (tb[NL80211_ATTR_IFINDEX]) {
2709 struct net_device *netdev;
2710 struct cfg80211_registered_device *rdev;
2711 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
2712
2713 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
2714 if (!netdev) {
2715 ret = -ENODEV;
2716 goto out;
2717 }
2718 if (netdev->ieee80211_ptr) {
2719 rdev = wiphy_to_rdev(
2720 netdev->ieee80211_ptr->wiphy);
2721 state->filter_wiphy = rdev->wiphy_idx;
2722 }
2723 }
2724
2725 ret = 0;
2726 out:
2727 kfree(tb);
2728 return ret;
2729 }
2730
nl80211_dump_wiphy(struct sk_buff * skb,struct netlink_callback * cb)2731 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
2732 {
2733 int idx = 0, ret;
2734 struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
2735 struct cfg80211_registered_device *rdev;
2736
2737 rtnl_lock();
2738 if (!state) {
2739 state = kzalloc(sizeof(*state), GFP_KERNEL);
2740 if (!state) {
2741 rtnl_unlock();
2742 return -ENOMEM;
2743 }
2744 state->filter_wiphy = -1;
2745 ret = nl80211_dump_wiphy_parse(skb, cb, state);
2746 if (ret) {
2747 kfree(state);
2748 rtnl_unlock();
2749 return ret;
2750 }
2751 cb->args[0] = (long)state;
2752 }
2753
2754 list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2755 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2756 continue;
2757 if (++idx <= state->start)
2758 continue;
2759 if (state->filter_wiphy != -1 &&
2760 state->filter_wiphy != rdev->wiphy_idx)
2761 continue;
2762 /* attempt to fit multiple wiphy data chunks into the skb */
2763 do {
2764 ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
2765 skb,
2766 NETLINK_CB(cb->skb).portid,
2767 cb->nlh->nlmsg_seq,
2768 NLM_F_MULTI, state);
2769 if (ret < 0) {
2770 /*
2771 * If sending the wiphy data didn't fit (ENOBUFS
2772 * or EMSGSIZE returned), this SKB is still
2773 * empty (so it's not too big because another
2774 * wiphy dataset is already in the skb) and
2775 * we've not tried to adjust the dump allocation
2776 * yet ... then adjust the alloc size to be
2777 * bigger, and return 1 but with the empty skb.
2778 * This results in an empty message being RX'ed
2779 * in userspace, but that is ignored.
2780 *
2781 * We can then retry with the larger buffer.
2782 */
2783 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
2784 !skb->len && !state->split &&
2785 cb->min_dump_alloc < 4096) {
2786 cb->min_dump_alloc = 4096;
2787 state->split_start = 0;
2788 rtnl_unlock();
2789 return 1;
2790 }
2791 idx--;
2792 break;
2793 }
2794 } while (state->split_start > 0);
2795 break;
2796 }
2797 rtnl_unlock();
2798
2799 state->start = idx;
2800
2801 return skb->len;
2802 }
2803
nl80211_dump_wiphy_done(struct netlink_callback * cb)2804 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
2805 {
2806 kfree((void *)cb->args[0]);
2807 return 0;
2808 }
2809
nl80211_get_wiphy(struct sk_buff * skb,struct genl_info * info)2810 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
2811 {
2812 struct sk_buff *msg;
2813 struct cfg80211_registered_device *rdev = info->user_ptr[0];
2814 struct nl80211_dump_wiphy_state state = {};
2815
2816 msg = nlmsg_new(4096, GFP_KERNEL);
2817 if (!msg)
2818 return -ENOMEM;
2819
2820 if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
2821 info->snd_portid, info->snd_seq, 0,
2822 &state) < 0) {
2823 nlmsg_free(msg);
2824 return -ENOBUFS;
2825 }
2826
2827 return genlmsg_reply(msg, info);
2828 }
2829
2830 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
2831 [NL80211_TXQ_ATTR_QUEUE] = { .type = NLA_U8 },
2832 [NL80211_TXQ_ATTR_TXOP] = { .type = NLA_U16 },
2833 [NL80211_TXQ_ATTR_CWMIN] = { .type = NLA_U16 },
2834 [NL80211_TXQ_ATTR_CWMAX] = { .type = NLA_U16 },
2835 [NL80211_TXQ_ATTR_AIFS] = { .type = NLA_U8 },
2836 };
2837
parse_txq_params(struct nlattr * tb[],struct ieee80211_txq_params * txq_params)2838 static int parse_txq_params(struct nlattr *tb[],
2839 struct ieee80211_txq_params *txq_params)
2840 {
2841 u8 ac;
2842
2843 if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
2844 !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
2845 !tb[NL80211_TXQ_ATTR_AIFS])
2846 return -EINVAL;
2847
2848 ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
2849 txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
2850 txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
2851 txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
2852 txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
2853
2854 if (ac >= NL80211_NUM_ACS)
2855 return -EINVAL;
2856 txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
2857 return 0;
2858 }
2859
nl80211_can_set_dev_channel(struct wireless_dev * wdev)2860 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
2861 {
2862 /*
2863 * You can only set the channel explicitly for WDS interfaces,
2864 * all others have their channel managed via their respective
2865 * "establish a connection" command (connect, join, ...)
2866 *
2867 * For AP/GO and mesh mode, the channel can be set with the
2868 * channel userspace API, but is only stored and passed to the
2869 * low-level driver when the AP starts or the mesh is joined.
2870 * This is for backward compatibility, userspace can also give
2871 * the channel in the start-ap or join-mesh commands instead.
2872 *
2873 * Monitors are special as they are normally slaved to
2874 * whatever else is going on, so they have their own special
2875 * operation to set the monitor channel if possible.
2876 */
2877 return !wdev ||
2878 wdev->iftype == NL80211_IFTYPE_AP ||
2879 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
2880 wdev->iftype == NL80211_IFTYPE_MONITOR ||
2881 wdev->iftype == NL80211_IFTYPE_P2P_GO;
2882 }
2883
nl80211_parse_chandef(struct cfg80211_registered_device * rdev,struct genl_info * info,struct cfg80211_chan_def * chandef)2884 int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
2885 struct genl_info *info,
2886 struct cfg80211_chan_def *chandef)
2887 {
2888 struct netlink_ext_ack *extack = info->extack;
2889 struct nlattr **attrs = info->attrs;
2890 u32 control_freq;
2891
2892 if (!attrs[NL80211_ATTR_WIPHY_FREQ])
2893 return -EINVAL;
2894
2895 control_freq = MHZ_TO_KHZ(
2896 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
2897 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
2898 control_freq +=
2899 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
2900
2901 memset(chandef, 0, sizeof(*chandef));
2902 chandef->chan = ieee80211_get_channel_khz(&rdev->wiphy, control_freq);
2903 chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
2904 chandef->center_freq1 = KHZ_TO_MHZ(control_freq);
2905 chandef->freq1_offset = control_freq % 1000;
2906 chandef->center_freq2 = 0;
2907
2908 /* Primary channel not allowed */
2909 if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED) {
2910 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
2911 "Channel is disabled");
2912 return -EINVAL;
2913 }
2914
2915 if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
2916 enum nl80211_channel_type chantype;
2917
2918 chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
2919
2920 switch (chantype) {
2921 case NL80211_CHAN_NO_HT:
2922 case NL80211_CHAN_HT20:
2923 case NL80211_CHAN_HT40PLUS:
2924 case NL80211_CHAN_HT40MINUS:
2925 cfg80211_chandef_create(chandef, chandef->chan,
2926 chantype);
2927 /* user input for center_freq is incorrect */
2928 if (attrs[NL80211_ATTR_CENTER_FREQ1] &&
2929 chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) {
2930 NL_SET_ERR_MSG_ATTR(extack,
2931 attrs[NL80211_ATTR_CENTER_FREQ1],
2932 "bad center frequency 1");
2933 return -EINVAL;
2934 }
2935 /* center_freq2 must be zero */
2936 if (attrs[NL80211_ATTR_CENTER_FREQ2] &&
2937 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) {
2938 NL_SET_ERR_MSG_ATTR(extack,
2939 attrs[NL80211_ATTR_CENTER_FREQ2],
2940 "center frequency 2 can't be used");
2941 return -EINVAL;
2942 }
2943 break;
2944 default:
2945 NL_SET_ERR_MSG_ATTR(extack,
2946 attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
2947 "invalid channel type");
2948 return -EINVAL;
2949 }
2950 } else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
2951 chandef->width =
2952 nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]);
2953 if (attrs[NL80211_ATTR_CENTER_FREQ1]) {
2954 chandef->center_freq1 =
2955 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]);
2956 if (attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET])
2957 chandef->freq1_offset = nla_get_u32(
2958 attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET]);
2959 else
2960 chandef->freq1_offset = 0;
2961 }
2962 if (attrs[NL80211_ATTR_CENTER_FREQ2])
2963 chandef->center_freq2 =
2964 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]);
2965 }
2966
2967 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
2968 chandef->edmg.channels =
2969 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
2970
2971 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
2972 chandef->edmg.bw_config =
2973 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
2974 } else {
2975 chandef->edmg.bw_config = 0;
2976 chandef->edmg.channels = 0;
2977 }
2978
2979 if (!cfg80211_chandef_valid(chandef)) {
2980 NL_SET_ERR_MSG(extack, "invalid channel definition");
2981 return -EINVAL;
2982 }
2983
2984 if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
2985 IEEE80211_CHAN_DISABLED)) {
2986 NL_SET_ERR_MSG(extack, "(extension) channel is disabled");
2987 return -EINVAL;
2988 }
2989
2990 if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
2991 chandef->width == NL80211_CHAN_WIDTH_10) &&
2992 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) {
2993 NL_SET_ERR_MSG(extack, "5/10 MHz not supported");
2994 return -EINVAL;
2995 }
2996
2997 return 0;
2998 }
2999
__nl80211_set_channel(struct cfg80211_registered_device * rdev,struct net_device * dev,struct genl_info * info)3000 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
3001 struct net_device *dev,
3002 struct genl_info *info)
3003 {
3004 struct cfg80211_chan_def chandef;
3005 int result;
3006 enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
3007 struct wireless_dev *wdev = NULL;
3008
3009 if (dev)
3010 wdev = dev->ieee80211_ptr;
3011 if (!nl80211_can_set_dev_channel(wdev))
3012 return -EOPNOTSUPP;
3013 if (wdev)
3014 iftype = wdev->iftype;
3015
3016 result = nl80211_parse_chandef(rdev, info, &chandef);
3017 if (result)
3018 return result;
3019
3020 switch (iftype) {
3021 case NL80211_IFTYPE_AP:
3022 case NL80211_IFTYPE_P2P_GO:
3023 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
3024 iftype)) {
3025 result = -EINVAL;
3026 break;
3027 }
3028 if (wdev->beacon_interval) {
3029 if (!dev || !rdev->ops->set_ap_chanwidth ||
3030 !(rdev->wiphy.features &
3031 NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
3032 result = -EBUSY;
3033 break;
3034 }
3035
3036 /* Only allow dynamic channel width changes */
3037 if (chandef.chan != wdev->preset_chandef.chan) {
3038 result = -EBUSY;
3039 break;
3040 }
3041 result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
3042 if (result)
3043 break;
3044 }
3045 wdev->preset_chandef = chandef;
3046 result = 0;
3047 break;
3048 case NL80211_IFTYPE_MESH_POINT:
3049 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
3050 break;
3051 case NL80211_IFTYPE_MONITOR:
3052 result = cfg80211_set_monitor_channel(rdev, &chandef);
3053 break;
3054 default:
3055 result = -EINVAL;
3056 }
3057
3058 return result;
3059 }
3060
nl80211_set_channel(struct sk_buff * skb,struct genl_info * info)3061 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
3062 {
3063 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3064 struct net_device *netdev = info->user_ptr[1];
3065
3066 return __nl80211_set_channel(rdev, netdev, info);
3067 }
3068
nl80211_set_wds_peer(struct sk_buff * skb,struct genl_info * info)3069 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
3070 {
3071 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3072 struct net_device *dev = info->user_ptr[1];
3073 struct wireless_dev *wdev = dev->ieee80211_ptr;
3074 const u8 *bssid;
3075
3076 if (!info->attrs[NL80211_ATTR_MAC])
3077 return -EINVAL;
3078
3079 if (netif_running(dev))
3080 return -EBUSY;
3081
3082 if (!rdev->ops->set_wds_peer)
3083 return -EOPNOTSUPP;
3084
3085 if (wdev->iftype != NL80211_IFTYPE_WDS)
3086 return -EOPNOTSUPP;
3087
3088 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
3089 return rdev_set_wds_peer(rdev, dev, bssid);
3090 }
3091
nl80211_set_wiphy(struct sk_buff * skb,struct genl_info * info)3092 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
3093 {
3094 struct cfg80211_registered_device *rdev;
3095 struct net_device *netdev = NULL;
3096 struct wireless_dev *wdev;
3097 int result = 0, rem_txq_params = 0;
3098 struct nlattr *nl_txq_params;
3099 u32 changed;
3100 u8 retry_short = 0, retry_long = 0;
3101 u32 frag_threshold = 0, rts_threshold = 0;
3102 u8 coverage_class = 0;
3103 u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0;
3104
3105 ASSERT_RTNL();
3106
3107 /*
3108 * Try to find the wiphy and netdev. Normally this
3109 * function shouldn't need the netdev, but this is
3110 * done for backward compatibility -- previously
3111 * setting the channel was done per wiphy, but now
3112 * it is per netdev. Previous userland like hostapd
3113 * also passed a netdev to set_wiphy, so that it is
3114 * possible to let that go to the right netdev!
3115 */
3116
3117 if (info->attrs[NL80211_ATTR_IFINDEX]) {
3118 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
3119
3120 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
3121 if (netdev && netdev->ieee80211_ptr)
3122 rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
3123 else
3124 netdev = NULL;
3125 }
3126
3127 if (!netdev) {
3128 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
3129 info->attrs);
3130 if (IS_ERR(rdev))
3131 return PTR_ERR(rdev);
3132 wdev = NULL;
3133 netdev = NULL;
3134 result = 0;
3135 } else
3136 wdev = netdev->ieee80211_ptr;
3137
3138 /*
3139 * end workaround code, by now the rdev is available
3140 * and locked, and wdev may or may not be NULL.
3141 */
3142
3143 if (info->attrs[NL80211_ATTR_WIPHY_NAME])
3144 result = cfg80211_dev_rename(
3145 rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
3146
3147 if (result)
3148 return result;
3149
3150 if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
3151 struct ieee80211_txq_params txq_params;
3152 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
3153
3154 if (!rdev->ops->set_txq_params)
3155 return -EOPNOTSUPP;
3156
3157 if (!netdev)
3158 return -EINVAL;
3159
3160 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3161 netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3162 return -EINVAL;
3163
3164 if (!netif_running(netdev))
3165 return -ENETDOWN;
3166
3167 nla_for_each_nested(nl_txq_params,
3168 info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
3169 rem_txq_params) {
3170 result = nla_parse_nested_deprecated(tb,
3171 NL80211_TXQ_ATTR_MAX,
3172 nl_txq_params,
3173 txq_params_policy,
3174 info->extack);
3175 if (result)
3176 return result;
3177 result = parse_txq_params(tb, &txq_params);
3178 if (result)
3179 return result;
3180
3181 result = rdev_set_txq_params(rdev, netdev,
3182 &txq_params);
3183 if (result)
3184 return result;
3185 }
3186 }
3187
3188 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3189 result = __nl80211_set_channel(
3190 rdev,
3191 nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
3192 info);
3193 if (result)
3194 return result;
3195 }
3196
3197 if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
3198 struct wireless_dev *txp_wdev = wdev;
3199 enum nl80211_tx_power_setting type;
3200 int idx, mbm = 0;
3201
3202 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
3203 txp_wdev = NULL;
3204
3205 if (!rdev->ops->set_tx_power)
3206 return -EOPNOTSUPP;
3207
3208 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
3209 type = nla_get_u32(info->attrs[idx]);
3210
3211 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
3212 (type != NL80211_TX_POWER_AUTOMATIC))
3213 return -EINVAL;
3214
3215 if (type != NL80211_TX_POWER_AUTOMATIC) {
3216 idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
3217 mbm = nla_get_u32(info->attrs[idx]);
3218 }
3219
3220 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
3221 if (result)
3222 return result;
3223 }
3224
3225 if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
3226 info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
3227 u32 tx_ant, rx_ant;
3228
3229 if ((!rdev->wiphy.available_antennas_tx &&
3230 !rdev->wiphy.available_antennas_rx) ||
3231 !rdev->ops->set_antenna)
3232 return -EOPNOTSUPP;
3233
3234 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
3235 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
3236
3237 /* reject antenna configurations which don't match the
3238 * available antenna masks, except for the "all" mask */
3239 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
3240 (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
3241 return -EINVAL;
3242
3243 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
3244 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
3245
3246 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
3247 if (result)
3248 return result;
3249 }
3250
3251 changed = 0;
3252
3253 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
3254 retry_short = nla_get_u8(
3255 info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
3256
3257 changed |= WIPHY_PARAM_RETRY_SHORT;
3258 }
3259
3260 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
3261 retry_long = nla_get_u8(
3262 info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
3263
3264 changed |= WIPHY_PARAM_RETRY_LONG;
3265 }
3266
3267 if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
3268 frag_threshold = nla_get_u32(
3269 info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
3270 if (frag_threshold < 256)
3271 return -EINVAL;
3272
3273 if (frag_threshold != (u32) -1) {
3274 /*
3275 * Fragments (apart from the last one) are required to
3276 * have even length. Make the fragmentation code
3277 * simpler by stripping LSB should someone try to use
3278 * odd threshold value.
3279 */
3280 frag_threshold &= ~0x1;
3281 }
3282 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
3283 }
3284
3285 if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
3286 rts_threshold = nla_get_u32(
3287 info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
3288 changed |= WIPHY_PARAM_RTS_THRESHOLD;
3289 }
3290
3291 if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
3292 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
3293 return -EINVAL;
3294
3295 coverage_class = nla_get_u8(
3296 info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
3297 changed |= WIPHY_PARAM_COVERAGE_CLASS;
3298 }
3299
3300 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
3301 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
3302 return -EOPNOTSUPP;
3303
3304 changed |= WIPHY_PARAM_DYN_ACK;
3305 }
3306
3307 if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) {
3308 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3309 NL80211_EXT_FEATURE_TXQS))
3310 return -EOPNOTSUPP;
3311 txq_limit = nla_get_u32(
3312 info->attrs[NL80211_ATTR_TXQ_LIMIT]);
3313 changed |= WIPHY_PARAM_TXQ_LIMIT;
3314 }
3315
3316 if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) {
3317 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3318 NL80211_EXT_FEATURE_TXQS))
3319 return -EOPNOTSUPP;
3320 txq_memory_limit = nla_get_u32(
3321 info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]);
3322 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT;
3323 }
3324
3325 if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) {
3326 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3327 NL80211_EXT_FEATURE_TXQS))
3328 return -EOPNOTSUPP;
3329 txq_quantum = nla_get_u32(
3330 info->attrs[NL80211_ATTR_TXQ_QUANTUM]);
3331 changed |= WIPHY_PARAM_TXQ_QUANTUM;
3332 }
3333
3334 if (changed) {
3335 u8 old_retry_short, old_retry_long;
3336 u32 old_frag_threshold, old_rts_threshold;
3337 u8 old_coverage_class;
3338 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum;
3339
3340 if (!rdev->ops->set_wiphy_params)
3341 return -EOPNOTSUPP;
3342
3343 old_retry_short = rdev->wiphy.retry_short;
3344 old_retry_long = rdev->wiphy.retry_long;
3345 old_frag_threshold = rdev->wiphy.frag_threshold;
3346 old_rts_threshold = rdev->wiphy.rts_threshold;
3347 old_coverage_class = rdev->wiphy.coverage_class;
3348 old_txq_limit = rdev->wiphy.txq_limit;
3349 old_txq_memory_limit = rdev->wiphy.txq_memory_limit;
3350 old_txq_quantum = rdev->wiphy.txq_quantum;
3351
3352 if (changed & WIPHY_PARAM_RETRY_SHORT)
3353 rdev->wiphy.retry_short = retry_short;
3354 if (changed & WIPHY_PARAM_RETRY_LONG)
3355 rdev->wiphy.retry_long = retry_long;
3356 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
3357 rdev->wiphy.frag_threshold = frag_threshold;
3358 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
3359 rdev->wiphy.rts_threshold = rts_threshold;
3360 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
3361 rdev->wiphy.coverage_class = coverage_class;
3362 if (changed & WIPHY_PARAM_TXQ_LIMIT)
3363 rdev->wiphy.txq_limit = txq_limit;
3364 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT)
3365 rdev->wiphy.txq_memory_limit = txq_memory_limit;
3366 if (changed & WIPHY_PARAM_TXQ_QUANTUM)
3367 rdev->wiphy.txq_quantum = txq_quantum;
3368
3369 result = rdev_set_wiphy_params(rdev, changed);
3370 if (result) {
3371 rdev->wiphy.retry_short = old_retry_short;
3372 rdev->wiphy.retry_long = old_retry_long;
3373 rdev->wiphy.frag_threshold = old_frag_threshold;
3374 rdev->wiphy.rts_threshold = old_rts_threshold;
3375 rdev->wiphy.coverage_class = old_coverage_class;
3376 rdev->wiphy.txq_limit = old_txq_limit;
3377 rdev->wiphy.txq_memory_limit = old_txq_memory_limit;
3378 rdev->wiphy.txq_quantum = old_txq_quantum;
3379 return result;
3380 }
3381 }
3382 return 0;
3383 }
3384
nl80211_send_chandef(struct sk_buff * msg,const struct cfg80211_chan_def * chandef)3385 static int nl80211_send_chandef(struct sk_buff *msg,
3386 const struct cfg80211_chan_def *chandef)
3387 {
3388 if (WARN_ON(!cfg80211_chandef_valid(chandef)))
3389 return -EINVAL;
3390
3391 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
3392 chandef->chan->center_freq))
3393 return -ENOBUFS;
3394 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
3395 chandef->chan->freq_offset))
3396 return -ENOBUFS;
3397 switch (chandef->width) {
3398 case NL80211_CHAN_WIDTH_20_NOHT:
3399 case NL80211_CHAN_WIDTH_20:
3400 case NL80211_CHAN_WIDTH_40:
3401 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
3402 cfg80211_get_chandef_type(chandef)))
3403 return -ENOBUFS;
3404 break;
3405 default:
3406 break;
3407 }
3408 if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
3409 return -ENOBUFS;
3410 if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
3411 return -ENOBUFS;
3412 if (chandef->center_freq2 &&
3413 nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
3414 return -ENOBUFS;
3415 return 0;
3416 }
3417
nl80211_send_iface(struct sk_buff * msg,u32 portid,u32 seq,int flags,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,enum nl80211_commands cmd)3418 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
3419 struct cfg80211_registered_device *rdev,
3420 struct wireless_dev *wdev,
3421 enum nl80211_commands cmd)
3422 {
3423 struct net_device *dev = wdev->netdev;
3424 void *hdr;
3425
3426 WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
3427 cmd != NL80211_CMD_DEL_INTERFACE &&
3428 cmd != NL80211_CMD_SET_INTERFACE);
3429
3430 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
3431 if (!hdr)
3432 return -1;
3433
3434 if (dev &&
3435 (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3436 nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
3437 goto nla_put_failure;
3438
3439 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
3440 nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
3441 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
3442 NL80211_ATTR_PAD) ||
3443 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
3444 nla_put_u32(msg, NL80211_ATTR_GENERATION,
3445 rdev->devlist_generation ^
3446 (cfg80211_rdev_list_generation << 2)) ||
3447 nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr))
3448 goto nla_put_failure;
3449
3450 if (rdev->ops->get_channel) {
3451 int ret;
3452 struct cfg80211_chan_def chandef = {};
3453
3454 ret = rdev_get_channel(rdev, wdev, &chandef);
3455 if (ret == 0) {
3456 if (nl80211_send_chandef(msg, &chandef))
3457 goto nla_put_failure;
3458 }
3459 }
3460
3461 if (rdev->ops->get_tx_power) {
3462 int dbm, ret;
3463
3464 ret = rdev_get_tx_power(rdev, wdev, &dbm);
3465 if (ret == 0 &&
3466 nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
3467 DBM_TO_MBM(dbm)))
3468 goto nla_put_failure;
3469 }
3470
3471 wdev_lock(wdev);
3472 switch (wdev->iftype) {
3473 case NL80211_IFTYPE_AP:
3474 if (wdev->ssid_len &&
3475 nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
3476 goto nla_put_failure_locked;
3477 break;
3478 case NL80211_IFTYPE_STATION:
3479 case NL80211_IFTYPE_P2P_CLIENT:
3480 case NL80211_IFTYPE_ADHOC: {
3481 const u8 *ssid_ie;
3482 if (!wdev->current_bss)
3483 break;
3484 rcu_read_lock();
3485 ssid_ie = ieee80211_bss_get_ie(&wdev->current_bss->pub,
3486 WLAN_EID_SSID);
3487 if (ssid_ie &&
3488 nla_put(msg, NL80211_ATTR_SSID, ssid_ie[1], ssid_ie + 2))
3489 goto nla_put_failure_rcu_locked;
3490 rcu_read_unlock();
3491 break;
3492 }
3493 default:
3494 /* nothing */
3495 break;
3496 }
3497 wdev_unlock(wdev);
3498
3499 if (rdev->ops->get_txq_stats) {
3500 struct cfg80211_txq_stats txqstats = {};
3501 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats);
3502
3503 if (ret == 0 &&
3504 !nl80211_put_txq_stats(msg, &txqstats,
3505 NL80211_ATTR_TXQ_STATS))
3506 goto nla_put_failure;
3507 }
3508
3509 genlmsg_end(msg, hdr);
3510 return 0;
3511
3512 nla_put_failure_rcu_locked:
3513 rcu_read_unlock();
3514 nla_put_failure_locked:
3515 wdev_unlock(wdev);
3516 nla_put_failure:
3517 genlmsg_cancel(msg, hdr);
3518 return -EMSGSIZE;
3519 }
3520
nl80211_dump_interface(struct sk_buff * skb,struct netlink_callback * cb)3521 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
3522 {
3523 int wp_idx = 0;
3524 int if_idx = 0;
3525 int wp_start = cb->args[0];
3526 int if_start = cb->args[1];
3527 int filter_wiphy = -1;
3528 struct cfg80211_registered_device *rdev;
3529 struct wireless_dev *wdev;
3530 int ret;
3531
3532 rtnl_lock();
3533 if (!cb->args[2]) {
3534 struct nl80211_dump_wiphy_state state = {
3535 .filter_wiphy = -1,
3536 };
3537
3538 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
3539 if (ret)
3540 goto out_unlock;
3541
3542 filter_wiphy = state.filter_wiphy;
3543
3544 /*
3545 * if filtering, set cb->args[2] to +1 since 0 is the default
3546 * value needed to determine that parsing is necessary.
3547 */
3548 if (filter_wiphy >= 0)
3549 cb->args[2] = filter_wiphy + 1;
3550 else
3551 cb->args[2] = -1;
3552 } else if (cb->args[2] > 0) {
3553 filter_wiphy = cb->args[2] - 1;
3554 }
3555
3556 list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
3557 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
3558 continue;
3559 if (wp_idx < wp_start) {
3560 wp_idx++;
3561 continue;
3562 }
3563
3564 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
3565 continue;
3566
3567 if_idx = 0;
3568
3569 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
3570 if (if_idx < if_start) {
3571 if_idx++;
3572 continue;
3573 }
3574 if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
3575 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3576 rdev, wdev,
3577 NL80211_CMD_NEW_INTERFACE) < 0) {
3578 goto out;
3579 }
3580 if_idx++;
3581 }
3582
3583 wp_idx++;
3584 }
3585 out:
3586 cb->args[0] = wp_idx;
3587 cb->args[1] = if_idx;
3588
3589 ret = skb->len;
3590 out_unlock:
3591 rtnl_unlock();
3592
3593 return ret;
3594 }
3595
nl80211_get_interface(struct sk_buff * skb,struct genl_info * info)3596 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
3597 {
3598 struct sk_buff *msg;
3599 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3600 struct wireless_dev *wdev = info->user_ptr[1];
3601
3602 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3603 if (!msg)
3604 return -ENOMEM;
3605
3606 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3607 rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
3608 nlmsg_free(msg);
3609 return -ENOBUFS;
3610 }
3611
3612 return genlmsg_reply(msg, info);
3613 }
3614
3615 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
3616 [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
3617 [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
3618 [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
3619 [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
3620 [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
3621 [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
3622 };
3623
parse_monitor_flags(struct nlattr * nla,u32 * mntrflags)3624 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
3625 {
3626 struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
3627 int flag;
3628
3629 *mntrflags = 0;
3630
3631 if (!nla)
3632 return -EINVAL;
3633
3634 if (nla_parse_nested_deprecated(flags, NL80211_MNTR_FLAG_MAX, nla, mntr_flags_policy, NULL))
3635 return -EINVAL;
3636
3637 for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
3638 if (flags[flag])
3639 *mntrflags |= (1<<flag);
3640
3641 *mntrflags |= MONITOR_FLAG_CHANGED;
3642
3643 return 0;
3644 }
3645
nl80211_parse_mon_options(struct cfg80211_registered_device * rdev,enum nl80211_iftype type,struct genl_info * info,struct vif_params * params)3646 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
3647 enum nl80211_iftype type,
3648 struct genl_info *info,
3649 struct vif_params *params)
3650 {
3651 bool change = false;
3652 int err;
3653
3654 if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
3655 if (type != NL80211_IFTYPE_MONITOR)
3656 return -EINVAL;
3657
3658 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
3659 ¶ms->flags);
3660 if (err)
3661 return err;
3662
3663 change = true;
3664 }
3665
3666 if (params->flags & MONITOR_FLAG_ACTIVE &&
3667 !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
3668 return -EOPNOTSUPP;
3669
3670 if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
3671 const u8 *mumimo_groups;
3672 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3673
3674 if (type != NL80211_IFTYPE_MONITOR)
3675 return -EINVAL;
3676
3677 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3678 return -EOPNOTSUPP;
3679
3680 mumimo_groups =
3681 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
3682
3683 /* bits 0 and 63 are reserved and must be zero */
3684 if ((mumimo_groups[0] & BIT(0)) ||
3685 (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
3686 return -EINVAL;
3687
3688 params->vht_mumimo_groups = mumimo_groups;
3689 change = true;
3690 }
3691
3692 if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
3693 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3694
3695 if (type != NL80211_IFTYPE_MONITOR)
3696 return -EINVAL;
3697
3698 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3699 return -EOPNOTSUPP;
3700
3701 params->vht_mumimo_follow_addr =
3702 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
3703 change = true;
3704 }
3705
3706 return change ? 1 : 0;
3707 }
3708
nl80211_valid_4addr(struct cfg80211_registered_device * rdev,struct net_device * netdev,u8 use_4addr,enum nl80211_iftype iftype)3709 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
3710 struct net_device *netdev, u8 use_4addr,
3711 enum nl80211_iftype iftype)
3712 {
3713 if (!use_4addr) {
3714 if (netdev && netif_is_bridge_port(netdev))
3715 return -EBUSY;
3716 return 0;
3717 }
3718
3719 switch (iftype) {
3720 case NL80211_IFTYPE_AP_VLAN:
3721 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
3722 return 0;
3723 break;
3724 case NL80211_IFTYPE_STATION:
3725 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
3726 return 0;
3727 break;
3728 default:
3729 break;
3730 }
3731
3732 return -EOPNOTSUPP;
3733 }
3734
nl80211_set_interface(struct sk_buff * skb,struct genl_info * info)3735 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
3736 {
3737 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3738 struct vif_params params;
3739 int err;
3740 enum nl80211_iftype otype, ntype;
3741 struct net_device *dev = info->user_ptr[1];
3742 bool change = false;
3743
3744 memset(¶ms, 0, sizeof(params));
3745
3746 otype = ntype = dev->ieee80211_ptr->iftype;
3747
3748 if (info->attrs[NL80211_ATTR_IFTYPE]) {
3749 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3750 if (otype != ntype)
3751 change = true;
3752 }
3753
3754 if (info->attrs[NL80211_ATTR_MESH_ID]) {
3755 struct wireless_dev *wdev = dev->ieee80211_ptr;
3756
3757 if (ntype != NL80211_IFTYPE_MESH_POINT)
3758 return -EINVAL;
3759 if (netif_running(dev))
3760 return -EBUSY;
3761
3762 wdev_lock(wdev);
3763 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3764 IEEE80211_MAX_MESH_ID_LEN);
3765 wdev->mesh_id_up_len =
3766 nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3767 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3768 wdev->mesh_id_up_len);
3769 wdev_unlock(wdev);
3770 }
3771
3772 if (info->attrs[NL80211_ATTR_4ADDR]) {
3773 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3774 change = true;
3775 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
3776 if (err)
3777 return err;
3778 } else {
3779 params.use_4addr = -1;
3780 }
3781
3782 err = nl80211_parse_mon_options(rdev, ntype, info, ¶ms);
3783 if (err < 0)
3784 return err;
3785 if (err > 0)
3786 change = true;
3787
3788 if (change)
3789 err = cfg80211_change_iface(rdev, dev, ntype, ¶ms);
3790 else
3791 err = 0;
3792
3793 if (!err && params.use_4addr != -1)
3794 dev->ieee80211_ptr->use_4addr = params.use_4addr;
3795
3796 if (change && !err) {
3797 struct wireless_dev *wdev = dev->ieee80211_ptr;
3798
3799 nl80211_notify_iface(rdev, wdev, NL80211_CMD_SET_INTERFACE);
3800 }
3801
3802 return err;
3803 }
3804
nl80211_new_interface(struct sk_buff * skb,struct genl_info * info)3805 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
3806 {
3807 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3808 struct vif_params params;
3809 struct wireless_dev *wdev;
3810 struct sk_buff *msg;
3811 int err;
3812 enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
3813
3814 /* to avoid failing a new interface creation due to pending removal */
3815 cfg80211_destroy_ifaces(rdev);
3816
3817 memset(¶ms, 0, sizeof(params));
3818
3819 if (!info->attrs[NL80211_ATTR_IFNAME])
3820 return -EINVAL;
3821
3822 if (info->attrs[NL80211_ATTR_IFTYPE])
3823 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3824
3825 if (!rdev->ops->add_virtual_intf)
3826 return -EOPNOTSUPP;
3827
3828 if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
3829 rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
3830 info->attrs[NL80211_ATTR_MAC]) {
3831 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
3832 ETH_ALEN);
3833 if (!is_valid_ether_addr(params.macaddr))
3834 return -EADDRNOTAVAIL;
3835 }
3836
3837 if (info->attrs[NL80211_ATTR_4ADDR]) {
3838 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3839 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
3840 if (err)
3841 return err;
3842 }
3843
3844 if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0))
3845 return -EOPNOTSUPP;
3846
3847 err = nl80211_parse_mon_options(rdev, type, info, ¶ms);
3848 if (err < 0)
3849 return err;
3850
3851 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3852 if (!msg)
3853 return -ENOMEM;
3854
3855 wdev = rdev_add_virtual_intf(rdev,
3856 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
3857 NET_NAME_USER, type, ¶ms);
3858 if (WARN_ON(!wdev)) {
3859 nlmsg_free(msg);
3860 return -EPROTO;
3861 } else if (IS_ERR(wdev)) {
3862 nlmsg_free(msg);
3863 return PTR_ERR(wdev);
3864 }
3865
3866 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
3867 wdev->owner_nlportid = info->snd_portid;
3868
3869 switch (type) {
3870 case NL80211_IFTYPE_MESH_POINT:
3871 if (!info->attrs[NL80211_ATTR_MESH_ID])
3872 break;
3873 wdev_lock(wdev);
3874 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3875 IEEE80211_MAX_MESH_ID_LEN);
3876 wdev->mesh_id_up_len =
3877 nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3878 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3879 wdev->mesh_id_up_len);
3880 wdev_unlock(wdev);
3881 break;
3882 case NL80211_IFTYPE_NAN:
3883 case NL80211_IFTYPE_P2P_DEVICE:
3884 /*
3885 * P2P Device and NAN do not have a netdev, so don't go
3886 * through the netdev notifier and must be added here
3887 */
3888 cfg80211_init_wdev(wdev);
3889 cfg80211_register_wdev(rdev, wdev);
3890 break;
3891 default:
3892 break;
3893 }
3894
3895 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3896 rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
3897 nlmsg_free(msg);
3898 return -ENOBUFS;
3899 }
3900
3901 return genlmsg_reply(msg, info);
3902 }
3903
nl80211_del_interface(struct sk_buff * skb,struct genl_info * info)3904 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
3905 {
3906 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3907 struct wireless_dev *wdev = info->user_ptr[1];
3908
3909 if (!rdev->ops->del_virtual_intf)
3910 return -EOPNOTSUPP;
3911
3912 /*
3913 * If we remove a wireless device without a netdev then clear
3914 * user_ptr[1] so that nl80211_post_doit won't dereference it
3915 * to check if it needs to do dev_put(). Otherwise it crashes
3916 * since the wdev has been freed, unlike with a netdev where
3917 * we need the dev_put() for the netdev to really be freed.
3918 */
3919 if (!wdev->netdev)
3920 info->user_ptr[1] = NULL;
3921
3922 return rdev_del_virtual_intf(rdev, wdev);
3923 }
3924
nl80211_set_noack_map(struct sk_buff * skb,struct genl_info * info)3925 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
3926 {
3927 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3928 struct net_device *dev = info->user_ptr[1];
3929 u16 noack_map;
3930
3931 if (!info->attrs[NL80211_ATTR_NOACK_MAP])
3932 return -EINVAL;
3933
3934 if (!rdev->ops->set_noack_map)
3935 return -EOPNOTSUPP;
3936
3937 noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
3938
3939 return rdev_set_noack_map(rdev, dev, noack_map);
3940 }
3941
3942 struct get_key_cookie {
3943 struct sk_buff *msg;
3944 int error;
3945 int idx;
3946 };
3947
get_key_callback(void * c,struct key_params * params)3948 static void get_key_callback(void *c, struct key_params *params)
3949 {
3950 struct nlattr *key;
3951 struct get_key_cookie *cookie = c;
3952
3953 if ((params->key &&
3954 nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
3955 params->key_len, params->key)) ||
3956 (params->seq &&
3957 nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
3958 params->seq_len, params->seq)) ||
3959 (params->cipher &&
3960 nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
3961 params->cipher)))
3962 goto nla_put_failure;
3963
3964 key = nla_nest_start_noflag(cookie->msg, NL80211_ATTR_KEY);
3965 if (!key)
3966 goto nla_put_failure;
3967
3968 if ((params->key &&
3969 nla_put(cookie->msg, NL80211_KEY_DATA,
3970 params->key_len, params->key)) ||
3971 (params->seq &&
3972 nla_put(cookie->msg, NL80211_KEY_SEQ,
3973 params->seq_len, params->seq)) ||
3974 (params->cipher &&
3975 nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
3976 params->cipher)))
3977 goto nla_put_failure;
3978
3979 if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx))
3980 goto nla_put_failure;
3981
3982 nla_nest_end(cookie->msg, key);
3983
3984 return;
3985 nla_put_failure:
3986 cookie->error = 1;
3987 }
3988
nl80211_get_key(struct sk_buff * skb,struct genl_info * info)3989 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
3990 {
3991 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3992 int err;
3993 struct net_device *dev = info->user_ptr[1];
3994 u8 key_idx = 0;
3995 const u8 *mac_addr = NULL;
3996 bool pairwise;
3997 struct get_key_cookie cookie = {
3998 .error = 0,
3999 };
4000 void *hdr;
4001 struct sk_buff *msg;
4002 bool bigtk_support = false;
4003
4004 if (wiphy_ext_feature_isset(&rdev->wiphy,
4005 NL80211_EXT_FEATURE_BEACON_PROTECTION))
4006 bigtk_support = true;
4007
4008 if ((dev->ieee80211_ptr->iftype == NL80211_IFTYPE_STATION ||
4009 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_CLIENT) &&
4010 wiphy_ext_feature_isset(&rdev->wiphy,
4011 NL80211_EXT_FEATURE_BEACON_PROTECTION_CLIENT))
4012 bigtk_support = true;
4013
4014 if (info->attrs[NL80211_ATTR_KEY_IDX]) {
4015 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
4016
4017 if (key_idx >= 6 && key_idx <= 7 && !bigtk_support) {
4018 GENL_SET_ERR_MSG(info, "BIGTK not supported");
4019 return -EINVAL;
4020 }
4021 }
4022
4023 if (info->attrs[NL80211_ATTR_MAC])
4024 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4025
4026 pairwise = !!mac_addr;
4027 if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
4028 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
4029
4030 if (kt != NL80211_KEYTYPE_GROUP &&
4031 kt != NL80211_KEYTYPE_PAIRWISE)
4032 return -EINVAL;
4033 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
4034 }
4035
4036 if (!rdev->ops->get_key)
4037 return -EOPNOTSUPP;
4038
4039 if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4040 return -ENOENT;
4041
4042 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4043 if (!msg)
4044 return -ENOMEM;
4045
4046 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4047 NL80211_CMD_NEW_KEY);
4048 if (!hdr)
4049 goto nla_put_failure;
4050
4051 cookie.msg = msg;
4052 cookie.idx = key_idx;
4053
4054 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4055 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
4056 goto nla_put_failure;
4057 if (mac_addr &&
4058 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
4059 goto nla_put_failure;
4060
4061 err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
4062 get_key_callback);
4063
4064 if (err)
4065 goto free_msg;
4066
4067 if (cookie.error)
4068 goto nla_put_failure;
4069
4070 genlmsg_end(msg, hdr);
4071 return genlmsg_reply(msg, info);
4072
4073 nla_put_failure:
4074 err = -ENOBUFS;
4075 free_msg:
4076 nlmsg_free(msg);
4077 return err;
4078 }
4079
nl80211_set_key(struct sk_buff * skb,struct genl_info * info)4080 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
4081 {
4082 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4083 struct key_parse key;
4084 int err;
4085 struct net_device *dev = info->user_ptr[1];
4086
4087 err = nl80211_parse_key(info, &key);
4088 if (err)
4089 return err;
4090
4091 if (key.idx < 0)
4092 return -EINVAL;
4093
4094 /* Only support setting default key and
4095 * Extended Key ID action NL80211_KEY_SET_TX.
4096 */
4097 if (!key.def && !key.defmgmt && !key.defbeacon &&
4098 !(key.p.mode == NL80211_KEY_SET_TX))
4099 return -EINVAL;
4100
4101 wdev_lock(dev->ieee80211_ptr);
4102
4103 if (key.def) {
4104 if (!rdev->ops->set_default_key) {
4105 err = -EOPNOTSUPP;
4106 goto out;
4107 }
4108
4109 err = nl80211_key_allowed(dev->ieee80211_ptr);
4110 if (err)
4111 goto out;
4112
4113 err = rdev_set_default_key(rdev, dev, key.idx,
4114 key.def_uni, key.def_multi);
4115
4116 if (err)
4117 goto out;
4118
4119 #ifdef CONFIG_CFG80211_WEXT
4120 dev->ieee80211_ptr->wext.default_key = key.idx;
4121 #endif
4122 } else if (key.defmgmt) {
4123 if (key.def_uni || !key.def_multi) {
4124 err = -EINVAL;
4125 goto out;
4126 }
4127
4128 if (!rdev->ops->set_default_mgmt_key) {
4129 err = -EOPNOTSUPP;
4130 goto out;
4131 }
4132
4133 err = nl80211_key_allowed(dev->ieee80211_ptr);
4134 if (err)
4135 goto out;
4136
4137 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
4138 if (err)
4139 goto out;
4140
4141 #ifdef CONFIG_CFG80211_WEXT
4142 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
4143 #endif
4144 } else if (key.defbeacon) {
4145 if (key.def_uni || !key.def_multi) {
4146 err = -EINVAL;
4147 goto out;
4148 }
4149
4150 if (!rdev->ops->set_default_beacon_key) {
4151 err = -EOPNOTSUPP;
4152 goto out;
4153 }
4154
4155 err = nl80211_key_allowed(dev->ieee80211_ptr);
4156 if (err)
4157 goto out;
4158
4159 err = rdev_set_default_beacon_key(rdev, dev, key.idx);
4160 if (err)
4161 goto out;
4162 } else if (key.p.mode == NL80211_KEY_SET_TX &&
4163 wiphy_ext_feature_isset(&rdev->wiphy,
4164 NL80211_EXT_FEATURE_EXT_KEY_ID)) {
4165 u8 *mac_addr = NULL;
4166
4167 if (info->attrs[NL80211_ATTR_MAC])
4168 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4169
4170 if (!mac_addr || key.idx < 0 || key.idx > 1) {
4171 err = -EINVAL;
4172 goto out;
4173 }
4174
4175 err = rdev_add_key(rdev, dev, key.idx,
4176 NL80211_KEYTYPE_PAIRWISE,
4177 mac_addr, &key.p);
4178 } else {
4179 err = -EINVAL;
4180 }
4181 out:
4182 wdev_unlock(dev->ieee80211_ptr);
4183
4184 return err;
4185 }
4186
nl80211_new_key(struct sk_buff * skb,struct genl_info * info)4187 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
4188 {
4189 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4190 int err;
4191 struct net_device *dev = info->user_ptr[1];
4192 struct key_parse key;
4193 const u8 *mac_addr = NULL;
4194
4195 err = nl80211_parse_key(info, &key);
4196 if (err)
4197 return err;
4198
4199 if (!key.p.key) {
4200 GENL_SET_ERR_MSG(info, "no key");
4201 return -EINVAL;
4202 }
4203
4204 if (info->attrs[NL80211_ATTR_MAC])
4205 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4206
4207 if (key.type == -1) {
4208 if (mac_addr)
4209 key.type = NL80211_KEYTYPE_PAIRWISE;
4210 else
4211 key.type = NL80211_KEYTYPE_GROUP;
4212 }
4213
4214 /* for now */
4215 if (key.type != NL80211_KEYTYPE_PAIRWISE &&
4216 key.type != NL80211_KEYTYPE_GROUP) {
4217 GENL_SET_ERR_MSG(info, "key type not pairwise or group");
4218 return -EINVAL;
4219 }
4220
4221 if (key.type == NL80211_KEYTYPE_GROUP &&
4222 info->attrs[NL80211_ATTR_VLAN_ID])
4223 key.p.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
4224
4225 if (!rdev->ops->add_key)
4226 return -EOPNOTSUPP;
4227
4228 if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
4229 key.type == NL80211_KEYTYPE_PAIRWISE,
4230 mac_addr)) {
4231 GENL_SET_ERR_MSG(info, "key setting validation failed");
4232 return -EINVAL;
4233 }
4234
4235 wdev_lock(dev->ieee80211_ptr);
4236 err = nl80211_key_allowed(dev->ieee80211_ptr);
4237 if (err)
4238 GENL_SET_ERR_MSG(info, "key not allowed");
4239 if (!err) {
4240 err = rdev_add_key(rdev, dev, key.idx,
4241 key.type == NL80211_KEYTYPE_PAIRWISE,
4242 mac_addr, &key.p);
4243 if (err)
4244 GENL_SET_ERR_MSG(info, "key addition failed");
4245 }
4246 wdev_unlock(dev->ieee80211_ptr);
4247
4248 return err;
4249 }
4250
nl80211_del_key(struct sk_buff * skb,struct genl_info * info)4251 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
4252 {
4253 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4254 int err;
4255 struct net_device *dev = info->user_ptr[1];
4256 u8 *mac_addr = NULL;
4257 struct key_parse key;
4258
4259 err = nl80211_parse_key(info, &key);
4260 if (err)
4261 return err;
4262
4263 if (key.idx < 0)
4264 return -EINVAL;
4265
4266 if (info->attrs[NL80211_ATTR_MAC])
4267 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4268
4269 if (key.type == -1) {
4270 if (mac_addr)
4271 key.type = NL80211_KEYTYPE_PAIRWISE;
4272 else
4273 key.type = NL80211_KEYTYPE_GROUP;
4274 }
4275
4276 /* for now */
4277 if (key.type != NL80211_KEYTYPE_PAIRWISE &&
4278 key.type != NL80211_KEYTYPE_GROUP)
4279 return -EINVAL;
4280
4281 if (!rdev->ops->del_key)
4282 return -EOPNOTSUPP;
4283
4284 wdev_lock(dev->ieee80211_ptr);
4285 err = nl80211_key_allowed(dev->ieee80211_ptr);
4286
4287 if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
4288 !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4289 err = -ENOENT;
4290
4291 if (!err)
4292 err = rdev_del_key(rdev, dev, key.idx,
4293 key.type == NL80211_KEYTYPE_PAIRWISE,
4294 mac_addr);
4295
4296 #ifdef CONFIG_CFG80211_WEXT
4297 if (!err) {
4298 if (key.idx == dev->ieee80211_ptr->wext.default_key)
4299 dev->ieee80211_ptr->wext.default_key = -1;
4300 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
4301 dev->ieee80211_ptr->wext.default_mgmt_key = -1;
4302 }
4303 #endif
4304 wdev_unlock(dev->ieee80211_ptr);
4305
4306 return err;
4307 }
4308
4309 /* This function returns an error or the number of nested attributes */
validate_acl_mac_addrs(struct nlattr * nl_attr)4310 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
4311 {
4312 struct nlattr *attr;
4313 int n_entries = 0, tmp;
4314
4315 nla_for_each_nested(attr, nl_attr, tmp) {
4316 if (nla_len(attr) != ETH_ALEN)
4317 return -EINVAL;
4318
4319 n_entries++;
4320 }
4321
4322 return n_entries;
4323 }
4324
4325 /*
4326 * This function parses ACL information and allocates memory for ACL data.
4327 * On successful return, the calling function is responsible to free the
4328 * ACL buffer returned by this function.
4329 */
parse_acl_data(struct wiphy * wiphy,struct genl_info * info)4330 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
4331 struct genl_info *info)
4332 {
4333 enum nl80211_acl_policy acl_policy;
4334 struct nlattr *attr;
4335 struct cfg80211_acl_data *acl;
4336 int i = 0, n_entries, tmp;
4337
4338 if (!wiphy->max_acl_mac_addrs)
4339 return ERR_PTR(-EOPNOTSUPP);
4340
4341 if (!info->attrs[NL80211_ATTR_ACL_POLICY])
4342 return ERR_PTR(-EINVAL);
4343
4344 acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
4345 if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
4346 acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
4347 return ERR_PTR(-EINVAL);
4348
4349 if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
4350 return ERR_PTR(-EINVAL);
4351
4352 n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
4353 if (n_entries < 0)
4354 return ERR_PTR(n_entries);
4355
4356 if (n_entries > wiphy->max_acl_mac_addrs)
4357 return ERR_PTR(-ENOTSUPP);
4358
4359 acl = kzalloc(struct_size(acl, mac_addrs, n_entries), GFP_KERNEL);
4360 if (!acl)
4361 return ERR_PTR(-ENOMEM);
4362
4363 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
4364 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
4365 i++;
4366 }
4367
4368 acl->n_acl_entries = n_entries;
4369 acl->acl_policy = acl_policy;
4370
4371 return acl;
4372 }
4373
nl80211_set_mac_acl(struct sk_buff * skb,struct genl_info * info)4374 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
4375 {
4376 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4377 struct net_device *dev = info->user_ptr[1];
4378 struct cfg80211_acl_data *acl;
4379 int err;
4380
4381 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4382 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4383 return -EOPNOTSUPP;
4384
4385 if (!dev->ieee80211_ptr->beacon_interval)
4386 return -EINVAL;
4387
4388 acl = parse_acl_data(&rdev->wiphy, info);
4389 if (IS_ERR(acl))
4390 return PTR_ERR(acl);
4391
4392 err = rdev_set_mac_acl(rdev, dev, acl);
4393
4394 kfree(acl);
4395
4396 return err;
4397 }
4398
rateset_to_mask(struct ieee80211_supported_band * sband,u8 * rates,u8 rates_len)4399 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
4400 u8 *rates, u8 rates_len)
4401 {
4402 u8 i;
4403 u32 mask = 0;
4404
4405 for (i = 0; i < rates_len; i++) {
4406 int rate = (rates[i] & 0x7f) * 5;
4407 int ridx;
4408
4409 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
4410 struct ieee80211_rate *srate =
4411 &sband->bitrates[ridx];
4412 if (rate == srate->bitrate) {
4413 mask |= 1 << ridx;
4414 break;
4415 }
4416 }
4417 if (ridx == sband->n_bitrates)
4418 return 0; /* rate not found */
4419 }
4420
4421 return mask;
4422 }
4423
ht_rateset_to_mask(struct ieee80211_supported_band * sband,u8 * rates,u8 rates_len,u8 mcs[IEEE80211_HT_MCS_MASK_LEN])4424 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
4425 u8 *rates, u8 rates_len,
4426 u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
4427 {
4428 u8 i;
4429
4430 memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
4431
4432 for (i = 0; i < rates_len; i++) {
4433 int ridx, rbit;
4434
4435 ridx = rates[i] / 8;
4436 rbit = BIT(rates[i] % 8);
4437
4438 /* check validity */
4439 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
4440 return false;
4441
4442 /* check availability */
4443 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
4444 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
4445 mcs[ridx] |= rbit;
4446 else
4447 return false;
4448 }
4449
4450 return true;
4451 }
4452
vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)4453 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
4454 {
4455 u16 mcs_mask = 0;
4456
4457 switch (vht_mcs_map) {
4458 case IEEE80211_VHT_MCS_NOT_SUPPORTED:
4459 break;
4460 case IEEE80211_VHT_MCS_SUPPORT_0_7:
4461 mcs_mask = 0x00FF;
4462 break;
4463 case IEEE80211_VHT_MCS_SUPPORT_0_8:
4464 mcs_mask = 0x01FF;
4465 break;
4466 case IEEE80211_VHT_MCS_SUPPORT_0_9:
4467 mcs_mask = 0x03FF;
4468 break;
4469 default:
4470 break;
4471 }
4472
4473 return mcs_mask;
4474 }
4475
vht_build_mcs_mask(u16 vht_mcs_map,u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])4476 static void vht_build_mcs_mask(u16 vht_mcs_map,
4477 u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
4478 {
4479 u8 nss;
4480
4481 for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
4482 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
4483 vht_mcs_map >>= 2;
4484 }
4485 }
4486
vht_set_mcs_mask(struct ieee80211_supported_band * sband,struct nl80211_txrate_vht * txrate,u16 mcs[NL80211_VHT_NSS_MAX])4487 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
4488 struct nl80211_txrate_vht *txrate,
4489 u16 mcs[NL80211_VHT_NSS_MAX])
4490 {
4491 u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
4492 u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
4493 u8 i;
4494
4495 if (!sband->vht_cap.vht_supported)
4496 return false;
4497
4498 memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
4499
4500 /* Build vht_mcs_mask from VHT capabilities */
4501 vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
4502
4503 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
4504 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
4505 mcs[i] = txrate->mcs[i];
4506 else
4507 return false;
4508 }
4509
4510 return true;
4511 }
4512
he_mcs_map_to_mcs_mask(u8 he_mcs_map)4513 static u16 he_mcs_map_to_mcs_mask(u8 he_mcs_map)
4514 {
4515 switch (he_mcs_map) {
4516 case IEEE80211_HE_MCS_NOT_SUPPORTED:
4517 return 0;
4518 case IEEE80211_HE_MCS_SUPPORT_0_7:
4519 return 0x00FF;
4520 case IEEE80211_HE_MCS_SUPPORT_0_9:
4521 return 0x03FF;
4522 case IEEE80211_HE_MCS_SUPPORT_0_11:
4523 return 0xFFF;
4524 default:
4525 break;
4526 }
4527 return 0;
4528 }
4529
he_build_mcs_mask(u16 he_mcs_map,u16 he_mcs_mask[NL80211_HE_NSS_MAX])4530 static void he_build_mcs_mask(u16 he_mcs_map,
4531 u16 he_mcs_mask[NL80211_HE_NSS_MAX])
4532 {
4533 u8 nss;
4534
4535 for (nss = 0; nss < NL80211_HE_NSS_MAX; nss++) {
4536 he_mcs_mask[nss] = he_mcs_map_to_mcs_mask(he_mcs_map & 0x03);
4537 he_mcs_map >>= 2;
4538 }
4539 }
4540
he_get_txmcsmap(struct genl_info * info,const struct ieee80211_sta_he_cap * he_cap)4541 static u16 he_get_txmcsmap(struct genl_info *info,
4542 const struct ieee80211_sta_he_cap *he_cap)
4543 {
4544 struct net_device *dev = info->user_ptr[1];
4545 struct wireless_dev *wdev = dev->ieee80211_ptr;
4546 __le16 tx_mcs;
4547
4548 switch (wdev->chandef.width) {
4549 case NL80211_CHAN_WIDTH_80P80:
4550 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80p80;
4551 break;
4552 case NL80211_CHAN_WIDTH_160:
4553 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_160;
4554 break;
4555 default:
4556 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80;
4557 break;
4558 }
4559 return le16_to_cpu(tx_mcs);
4560 }
4561
he_set_mcs_mask(struct genl_info * info,struct wireless_dev * wdev,struct ieee80211_supported_band * sband,struct nl80211_txrate_he * txrate,u16 mcs[NL80211_HE_NSS_MAX])4562 static bool he_set_mcs_mask(struct genl_info *info,
4563 struct wireless_dev *wdev,
4564 struct ieee80211_supported_band *sband,
4565 struct nl80211_txrate_he *txrate,
4566 u16 mcs[NL80211_HE_NSS_MAX])
4567 {
4568 const struct ieee80211_sta_he_cap *he_cap;
4569 u16 tx_mcs_mask[NL80211_HE_NSS_MAX] = {};
4570 u16 tx_mcs_map = 0;
4571 u8 i;
4572
4573 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
4574 if (!he_cap)
4575 return false;
4576
4577 memset(mcs, 0, sizeof(u16) * NL80211_HE_NSS_MAX);
4578
4579 tx_mcs_map = he_get_txmcsmap(info, he_cap);
4580
4581 /* Build he_mcs_mask from HE capabilities */
4582 he_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
4583
4584 for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
4585 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
4586 mcs[i] = txrate->mcs[i];
4587 else
4588 return false;
4589 }
4590
4591 return true;
4592 }
4593
nl80211_parse_tx_bitrate_mask(struct genl_info * info,struct nlattr * attrs[],enum nl80211_attrs attr,struct cfg80211_bitrate_mask * mask,struct net_device * dev)4594 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
4595 struct nlattr *attrs[],
4596 enum nl80211_attrs attr,
4597 struct cfg80211_bitrate_mask *mask,
4598 struct net_device *dev)
4599 {
4600 struct nlattr *tb[NL80211_TXRATE_MAX + 1];
4601 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4602 struct wireless_dev *wdev = dev->ieee80211_ptr;
4603 int rem, i;
4604 struct nlattr *tx_rates;
4605 struct ieee80211_supported_band *sband;
4606 u16 vht_tx_mcs_map, he_tx_mcs_map;
4607
4608 memset(mask, 0, sizeof(*mask));
4609 /* Default to all rates enabled */
4610 for (i = 0; i < NUM_NL80211_BANDS; i++) {
4611 const struct ieee80211_sta_he_cap *he_cap;
4612
4613 sband = rdev->wiphy.bands[i];
4614
4615 if (!sband)
4616 continue;
4617
4618 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
4619 memcpy(mask->control[i].ht_mcs,
4620 sband->ht_cap.mcs.rx_mask,
4621 sizeof(mask->control[i].ht_mcs));
4622
4623 if (!sband->vht_cap.vht_supported)
4624 continue;
4625
4626 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
4627 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
4628
4629 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
4630 if (!he_cap)
4631 continue;
4632
4633 he_tx_mcs_map = he_get_txmcsmap(info, he_cap);
4634 he_build_mcs_mask(he_tx_mcs_map, mask->control[i].he_mcs);
4635
4636 mask->control[i].he_gi = 0xFF;
4637 mask->control[i].he_ltf = 0xFF;
4638 }
4639
4640 /* if no rates are given set it back to the defaults */
4641 if (!attrs[attr])
4642 goto out;
4643
4644 /* The nested attribute uses enum nl80211_band as the index. This maps
4645 * directly to the enum nl80211_band values used in cfg80211.
4646 */
4647 BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
4648 nla_for_each_nested(tx_rates, attrs[attr], rem) {
4649 enum nl80211_band band = nla_type(tx_rates);
4650 int err;
4651
4652 if (band < 0 || band >= NUM_NL80211_BANDS)
4653 return -EINVAL;
4654 sband = rdev->wiphy.bands[band];
4655 if (sband == NULL)
4656 return -EINVAL;
4657 err = nla_parse_nested_deprecated(tb, NL80211_TXRATE_MAX,
4658 tx_rates,
4659 nl80211_txattr_policy,
4660 info->extack);
4661 if (err)
4662 return err;
4663 if (tb[NL80211_TXRATE_LEGACY]) {
4664 mask->control[band].legacy = rateset_to_mask(
4665 sband,
4666 nla_data(tb[NL80211_TXRATE_LEGACY]),
4667 nla_len(tb[NL80211_TXRATE_LEGACY]));
4668 if ((mask->control[band].legacy == 0) &&
4669 nla_len(tb[NL80211_TXRATE_LEGACY]))
4670 return -EINVAL;
4671 }
4672 if (tb[NL80211_TXRATE_HT]) {
4673 if (!ht_rateset_to_mask(
4674 sband,
4675 nla_data(tb[NL80211_TXRATE_HT]),
4676 nla_len(tb[NL80211_TXRATE_HT]),
4677 mask->control[band].ht_mcs))
4678 return -EINVAL;
4679 }
4680 if (tb[NL80211_TXRATE_VHT]) {
4681 if (!vht_set_mcs_mask(
4682 sband,
4683 nla_data(tb[NL80211_TXRATE_VHT]),
4684 mask->control[band].vht_mcs))
4685 return -EINVAL;
4686 }
4687 if (tb[NL80211_TXRATE_GI]) {
4688 mask->control[band].gi =
4689 nla_get_u8(tb[NL80211_TXRATE_GI]);
4690 if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
4691 return -EINVAL;
4692 }
4693 if (tb[NL80211_TXRATE_HE] &&
4694 !he_set_mcs_mask(info, wdev, sband,
4695 nla_data(tb[NL80211_TXRATE_HE]),
4696 mask->control[band].he_mcs))
4697 return -EINVAL;
4698 if (tb[NL80211_TXRATE_HE_GI])
4699 mask->control[band].he_gi =
4700 nla_get_u8(tb[NL80211_TXRATE_HE_GI]);
4701 if (tb[NL80211_TXRATE_HE_LTF])
4702 mask->control[band].he_ltf =
4703 nla_get_u8(tb[NL80211_TXRATE_HE_LTF]);
4704
4705 if (mask->control[band].legacy == 0) {
4706 /* don't allow empty legacy rates if HT, VHT or HE
4707 * are not even supported.
4708 */
4709 if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
4710 rdev->wiphy.bands[band]->vht_cap.vht_supported ||
4711 ieee80211_get_he_iftype_cap(sband, wdev->iftype)))
4712 return -EINVAL;
4713
4714 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
4715 if (mask->control[band].ht_mcs[i])
4716 goto out;
4717
4718 for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
4719 if (mask->control[band].vht_mcs[i])
4720 goto out;
4721
4722 for (i = 0; i < NL80211_HE_NSS_MAX; i++)
4723 if (mask->control[band].he_mcs[i])
4724 goto out;
4725
4726 /* legacy and mcs rates may not be both empty */
4727 return -EINVAL;
4728 }
4729 }
4730
4731 out:
4732 return 0;
4733 }
4734
validate_beacon_tx_rate(struct cfg80211_registered_device * rdev,enum nl80211_band band,struct cfg80211_bitrate_mask * beacon_rate)4735 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
4736 enum nl80211_band band,
4737 struct cfg80211_bitrate_mask *beacon_rate)
4738 {
4739 u32 count_ht, count_vht, i;
4740 u32 rate = beacon_rate->control[band].legacy;
4741
4742 /* Allow only one rate */
4743 if (hweight32(rate) > 1)
4744 return -EINVAL;
4745
4746 count_ht = 0;
4747 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
4748 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
4749 return -EINVAL;
4750 } else if (beacon_rate->control[band].ht_mcs[i]) {
4751 count_ht++;
4752 if (count_ht > 1)
4753 return -EINVAL;
4754 }
4755 if (count_ht && rate)
4756 return -EINVAL;
4757 }
4758
4759 count_vht = 0;
4760 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
4761 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
4762 return -EINVAL;
4763 } else if (beacon_rate->control[band].vht_mcs[i]) {
4764 count_vht++;
4765 if (count_vht > 1)
4766 return -EINVAL;
4767 }
4768 if (count_vht && rate)
4769 return -EINVAL;
4770 }
4771
4772 if ((count_ht && count_vht) || (!rate && !count_ht && !count_vht))
4773 return -EINVAL;
4774
4775 if (rate &&
4776 !wiphy_ext_feature_isset(&rdev->wiphy,
4777 NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
4778 return -EINVAL;
4779 if (count_ht &&
4780 !wiphy_ext_feature_isset(&rdev->wiphy,
4781 NL80211_EXT_FEATURE_BEACON_RATE_HT))
4782 return -EINVAL;
4783 if (count_vht &&
4784 !wiphy_ext_feature_isset(&rdev->wiphy,
4785 NL80211_EXT_FEATURE_BEACON_RATE_VHT))
4786 return -EINVAL;
4787
4788 return 0;
4789 }
4790
nl80211_parse_beacon(struct cfg80211_registered_device * rdev,struct nlattr * attrs[],struct cfg80211_beacon_data * bcn)4791 static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
4792 struct nlattr *attrs[],
4793 struct cfg80211_beacon_data *bcn)
4794 {
4795 bool haveinfo = false;
4796 int err;
4797
4798 memset(bcn, 0, sizeof(*bcn));
4799
4800 if (attrs[NL80211_ATTR_BEACON_HEAD]) {
4801 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
4802 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
4803 if (!bcn->head_len)
4804 return -EINVAL;
4805 haveinfo = true;
4806 }
4807
4808 if (attrs[NL80211_ATTR_BEACON_TAIL]) {
4809 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
4810 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
4811 haveinfo = true;
4812 }
4813
4814 if (!haveinfo)
4815 return -EINVAL;
4816
4817 if (attrs[NL80211_ATTR_IE]) {
4818 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
4819 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
4820 }
4821
4822 if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
4823 bcn->proberesp_ies =
4824 nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
4825 bcn->proberesp_ies_len =
4826 nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
4827 }
4828
4829 if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
4830 bcn->assocresp_ies =
4831 nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
4832 bcn->assocresp_ies_len =
4833 nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
4834 }
4835
4836 if (attrs[NL80211_ATTR_PROBE_RESP]) {
4837 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
4838 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
4839 }
4840
4841 if (attrs[NL80211_ATTR_FTM_RESPONDER]) {
4842 struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1];
4843
4844 err = nla_parse_nested_deprecated(tb,
4845 NL80211_FTM_RESP_ATTR_MAX,
4846 attrs[NL80211_ATTR_FTM_RESPONDER],
4847 NULL, NULL);
4848 if (err)
4849 return err;
4850
4851 if (tb[NL80211_FTM_RESP_ATTR_ENABLED] &&
4852 wiphy_ext_feature_isset(&rdev->wiphy,
4853 NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER))
4854 bcn->ftm_responder = 1;
4855 else
4856 return -EOPNOTSUPP;
4857
4858 if (tb[NL80211_FTM_RESP_ATTR_LCI]) {
4859 bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]);
4860 bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]);
4861 }
4862
4863 if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) {
4864 bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
4865 bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
4866 }
4867 } else {
4868 bcn->ftm_responder = -1;
4869 }
4870
4871 return 0;
4872 }
4873
nl80211_parse_he_obss_pd(struct nlattr * attrs,struct ieee80211_he_obss_pd * he_obss_pd)4874 static int nl80211_parse_he_obss_pd(struct nlattr *attrs,
4875 struct ieee80211_he_obss_pd *he_obss_pd)
4876 {
4877 struct nlattr *tb[NL80211_HE_OBSS_PD_ATTR_MAX + 1];
4878 int err;
4879
4880 err = nla_parse_nested(tb, NL80211_HE_OBSS_PD_ATTR_MAX, attrs,
4881 he_obss_pd_policy, NULL);
4882 if (err)
4883 return err;
4884
4885 if (!tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL])
4886 return -EINVAL;
4887
4888 he_obss_pd->sr_ctrl = nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL]);
4889
4890 if (tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET])
4891 he_obss_pd->min_offset =
4892 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]);
4893 if (tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET])
4894 he_obss_pd->max_offset =
4895 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]);
4896 if (tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET])
4897 he_obss_pd->non_srg_max_offset =
4898 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET]);
4899
4900 if (he_obss_pd->min_offset > he_obss_pd->max_offset)
4901 return -EINVAL;
4902
4903 if (tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP])
4904 memcpy(he_obss_pd->bss_color_bitmap,
4905 nla_data(tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP]),
4906 sizeof(he_obss_pd->bss_color_bitmap));
4907
4908 if (tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP])
4909 memcpy(he_obss_pd->partial_bssid_bitmap,
4910 nla_data(tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP]),
4911 sizeof(he_obss_pd->partial_bssid_bitmap));
4912
4913 he_obss_pd->enable = true;
4914
4915 return 0;
4916 }
4917
nl80211_parse_he_bss_color(struct nlattr * attrs,struct cfg80211_he_bss_color * he_bss_color)4918 static int nl80211_parse_he_bss_color(struct nlattr *attrs,
4919 struct cfg80211_he_bss_color *he_bss_color)
4920 {
4921 struct nlattr *tb[NL80211_HE_BSS_COLOR_ATTR_MAX + 1];
4922 int err;
4923
4924 err = nla_parse_nested(tb, NL80211_HE_BSS_COLOR_ATTR_MAX, attrs,
4925 he_bss_color_policy, NULL);
4926 if (err)
4927 return err;
4928
4929 if (!tb[NL80211_HE_BSS_COLOR_ATTR_COLOR])
4930 return -EINVAL;
4931
4932 he_bss_color->color =
4933 nla_get_u8(tb[NL80211_HE_BSS_COLOR_ATTR_COLOR]);
4934 he_bss_color->enabled =
4935 !nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_DISABLED]);
4936 he_bss_color->partial =
4937 nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_PARTIAL]);
4938
4939 return 0;
4940 }
4941
nl80211_parse_fils_discovery(struct cfg80211_registered_device * rdev,struct nlattr * attrs,struct cfg80211_ap_settings * params)4942 static int nl80211_parse_fils_discovery(struct cfg80211_registered_device *rdev,
4943 struct nlattr *attrs,
4944 struct cfg80211_ap_settings *params)
4945 {
4946 struct nlattr *tb[NL80211_FILS_DISCOVERY_ATTR_MAX + 1];
4947 int ret;
4948 struct cfg80211_fils_discovery *fd = ¶ms->fils_discovery;
4949
4950 if (!wiphy_ext_feature_isset(&rdev->wiphy,
4951 NL80211_EXT_FEATURE_FILS_DISCOVERY))
4952 return -EINVAL;
4953
4954 ret = nla_parse_nested(tb, NL80211_FILS_DISCOVERY_ATTR_MAX, attrs,
4955 NULL, NULL);
4956 if (ret)
4957 return ret;
4958
4959 if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] ||
4960 !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] ||
4961 !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL])
4962 return -EINVAL;
4963
4964 fd->tmpl_len = nla_len(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
4965 fd->tmpl = nla_data(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
4966 fd->min_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN]);
4967 fd->max_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX]);
4968
4969 return 0;
4970 }
4971
4972 static int
nl80211_parse_unsol_bcast_probe_resp(struct cfg80211_registered_device * rdev,struct nlattr * attrs,struct cfg80211_ap_settings * params)4973 nl80211_parse_unsol_bcast_probe_resp(struct cfg80211_registered_device *rdev,
4974 struct nlattr *attrs,
4975 struct cfg80211_ap_settings *params)
4976 {
4977 struct nlattr *tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1];
4978 int ret;
4979 struct cfg80211_unsol_bcast_probe_resp *presp =
4980 ¶ms->unsol_bcast_probe_resp;
4981
4982 if (!wiphy_ext_feature_isset(&rdev->wiphy,
4983 NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP))
4984 return -EINVAL;
4985
4986 ret = nla_parse_nested(tb, NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX,
4987 attrs, NULL, NULL);
4988 if (ret)
4989 return ret;
4990
4991 if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] ||
4992 !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL])
4993 return -EINVAL;
4994
4995 presp->tmpl = nla_data(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
4996 presp->tmpl_len = nla_len(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
4997 presp->interval = nla_get_u32(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT]);
4998 return 0;
4999 }
5000
nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings * params,const u8 * rates)5001 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
5002 const u8 *rates)
5003 {
5004 int i;
5005
5006 if (!rates)
5007 return;
5008
5009 for (i = 0; i < rates[1]; i++) {
5010 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
5011 params->ht_required = true;
5012 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
5013 params->vht_required = true;
5014 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HE_PHY)
5015 params->he_required = true;
5016 }
5017 }
5018
5019 /*
5020 * Since the nl80211 API didn't include, from the beginning, attributes about
5021 * HT/VHT requirements/capabilities, we parse them out of the IEs for the
5022 * benefit of drivers that rebuild IEs in the firmware.
5023 */
nl80211_calculate_ap_params(struct cfg80211_ap_settings * params)5024 static void nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
5025 {
5026 const struct cfg80211_beacon_data *bcn = ¶ms->beacon;
5027 size_t ies_len = bcn->tail_len;
5028 const u8 *ies = bcn->tail;
5029 const u8 *rates;
5030 const u8 *cap;
5031
5032 rates = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies, ies_len);
5033 nl80211_check_ap_rate_selectors(params, rates);
5034
5035 rates = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
5036 nl80211_check_ap_rate_selectors(params, rates);
5037
5038 cap = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies, ies_len);
5039 if (cap && cap[1] >= sizeof(*params->ht_cap))
5040 params->ht_cap = (void *)(cap + 2);
5041 cap = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
5042 if (cap && cap[1] >= sizeof(*params->vht_cap))
5043 params->vht_cap = (void *)(cap + 2);
5044 cap = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len);
5045 if (cap && cap[1] >= sizeof(*params->he_cap) + 1)
5046 params->he_cap = (void *)(cap + 3);
5047 cap = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_OPERATION, ies, ies_len);
5048 if (cap && cap[1] >= sizeof(*params->he_oper) + 1)
5049 params->he_oper = (void *)(cap + 3);
5050 }
5051
nl80211_get_ap_channel(struct cfg80211_registered_device * rdev,struct cfg80211_ap_settings * params)5052 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
5053 struct cfg80211_ap_settings *params)
5054 {
5055 struct wireless_dev *wdev;
5056 bool ret = false;
5057
5058 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
5059 if (wdev->iftype != NL80211_IFTYPE_AP &&
5060 wdev->iftype != NL80211_IFTYPE_P2P_GO)
5061 continue;
5062
5063 if (!wdev->preset_chandef.chan)
5064 continue;
5065
5066 params->chandef = wdev->preset_chandef;
5067 ret = true;
5068 break;
5069 }
5070
5071 return ret;
5072 }
5073
nl80211_valid_auth_type(struct cfg80211_registered_device * rdev,enum nl80211_auth_type auth_type,enum nl80211_commands cmd)5074 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
5075 enum nl80211_auth_type auth_type,
5076 enum nl80211_commands cmd)
5077 {
5078 if (auth_type > NL80211_AUTHTYPE_MAX)
5079 return false;
5080
5081 switch (cmd) {
5082 case NL80211_CMD_AUTHENTICATE:
5083 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
5084 auth_type == NL80211_AUTHTYPE_SAE)
5085 return false;
5086 if (!wiphy_ext_feature_isset(&rdev->wiphy,
5087 NL80211_EXT_FEATURE_FILS_STA) &&
5088 (auth_type == NL80211_AUTHTYPE_FILS_SK ||
5089 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5090 auth_type == NL80211_AUTHTYPE_FILS_PK))
5091 return false;
5092 return true;
5093 case NL80211_CMD_CONNECT:
5094 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
5095 !wiphy_ext_feature_isset(&rdev->wiphy,
5096 NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
5097 auth_type == NL80211_AUTHTYPE_SAE)
5098 return false;
5099
5100 /* FILS with SK PFS or PK not supported yet */
5101 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5102 auth_type == NL80211_AUTHTYPE_FILS_PK)
5103 return false;
5104 if (!wiphy_ext_feature_isset(
5105 &rdev->wiphy,
5106 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
5107 auth_type == NL80211_AUTHTYPE_FILS_SK)
5108 return false;
5109 return true;
5110 case NL80211_CMD_START_AP:
5111 if (!wiphy_ext_feature_isset(&rdev->wiphy,
5112 NL80211_EXT_FEATURE_SAE_OFFLOAD_AP) &&
5113 auth_type == NL80211_AUTHTYPE_SAE)
5114 return false;
5115 /* FILS not supported yet */
5116 if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
5117 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5118 auth_type == NL80211_AUTHTYPE_FILS_PK)
5119 return false;
5120 return true;
5121 default:
5122 return false;
5123 }
5124 }
5125
nl80211_start_ap(struct sk_buff * skb,struct genl_info * info)5126 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
5127 {
5128 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5129 struct net_device *dev = info->user_ptr[1];
5130 struct wireless_dev *wdev = dev->ieee80211_ptr;
5131 struct cfg80211_ap_settings params;
5132 int err;
5133
5134 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5135 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5136 return -EOPNOTSUPP;
5137
5138 if (!rdev->ops->start_ap)
5139 return -EOPNOTSUPP;
5140
5141 if (wdev->beacon_interval)
5142 return -EALREADY;
5143
5144 memset(¶ms, 0, sizeof(params));
5145
5146 /* these are required for START_AP */
5147 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
5148 !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
5149 !info->attrs[NL80211_ATTR_BEACON_HEAD])
5150 return -EINVAL;
5151
5152 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms.beacon);
5153 if (err)
5154 return err;
5155
5156 params.beacon_interval =
5157 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
5158 params.dtim_period =
5159 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
5160
5161 err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
5162 params.beacon_interval);
5163 if (err)
5164 return err;
5165
5166 /*
5167 * In theory, some of these attributes should be required here
5168 * but since they were not used when the command was originally
5169 * added, keep them optional for old user space programs to let
5170 * them continue to work with drivers that do not need the
5171 * additional information -- drivers must check!
5172 */
5173 if (info->attrs[NL80211_ATTR_SSID]) {
5174 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5175 params.ssid_len =
5176 nla_len(info->attrs[NL80211_ATTR_SSID]);
5177 if (params.ssid_len == 0)
5178 return -EINVAL;
5179 }
5180
5181 if (info->attrs[NL80211_ATTR_HIDDEN_SSID])
5182 params.hidden_ssid = nla_get_u32(
5183 info->attrs[NL80211_ATTR_HIDDEN_SSID]);
5184
5185 params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
5186
5187 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
5188 params.auth_type = nla_get_u32(
5189 info->attrs[NL80211_ATTR_AUTH_TYPE]);
5190 if (!nl80211_valid_auth_type(rdev, params.auth_type,
5191 NL80211_CMD_START_AP))
5192 return -EINVAL;
5193 } else
5194 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
5195
5196 err = nl80211_crypto_settings(rdev, info, ¶ms.crypto,
5197 NL80211_MAX_NR_CIPHER_SUITES);
5198 if (err)
5199 return err;
5200
5201 if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
5202 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
5203 return -EOPNOTSUPP;
5204 params.inactivity_timeout = nla_get_u16(
5205 info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
5206 }
5207
5208 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
5209 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5210 return -EINVAL;
5211 params.p2p_ctwindow =
5212 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
5213 if (params.p2p_ctwindow != 0 &&
5214 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
5215 return -EINVAL;
5216 }
5217
5218 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
5219 u8 tmp;
5220
5221 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5222 return -EINVAL;
5223 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
5224 params.p2p_opp_ps = tmp;
5225 if (params.p2p_opp_ps != 0 &&
5226 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
5227 return -EINVAL;
5228 }
5229
5230 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
5231 err = nl80211_parse_chandef(rdev, info, ¶ms.chandef);
5232 if (err)
5233 return err;
5234 } else if (wdev->preset_chandef.chan) {
5235 params.chandef = wdev->preset_chandef;
5236 } else if (!nl80211_get_ap_channel(rdev, ¶ms))
5237 return -EINVAL;
5238
5239 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms.chandef,
5240 wdev->iftype))
5241 return -EINVAL;
5242
5243 if (info->attrs[NL80211_ATTR_TX_RATES]) {
5244 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
5245 NL80211_ATTR_TX_RATES,
5246 ¶ms.beacon_rate,
5247 dev);
5248 if (err)
5249 return err;
5250
5251 err = validate_beacon_tx_rate(rdev, params.chandef.chan->band,
5252 ¶ms.beacon_rate);
5253 if (err)
5254 return err;
5255 }
5256
5257 if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
5258 params.smps_mode =
5259 nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
5260 switch (params.smps_mode) {
5261 case NL80211_SMPS_OFF:
5262 break;
5263 case NL80211_SMPS_STATIC:
5264 if (!(rdev->wiphy.features &
5265 NL80211_FEATURE_STATIC_SMPS))
5266 return -EINVAL;
5267 break;
5268 case NL80211_SMPS_DYNAMIC:
5269 if (!(rdev->wiphy.features &
5270 NL80211_FEATURE_DYNAMIC_SMPS))
5271 return -EINVAL;
5272 break;
5273 default:
5274 return -EINVAL;
5275 }
5276 } else {
5277 params.smps_mode = NL80211_SMPS_OFF;
5278 }
5279
5280 params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
5281 if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ])
5282 return -EOPNOTSUPP;
5283
5284 if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
5285 params.acl = parse_acl_data(&rdev->wiphy, info);
5286 if (IS_ERR(params.acl))
5287 return PTR_ERR(params.acl);
5288 }
5289
5290 params.twt_responder =
5291 nla_get_flag(info->attrs[NL80211_ATTR_TWT_RESPONDER]);
5292
5293 if (info->attrs[NL80211_ATTR_HE_OBSS_PD]) {
5294 err = nl80211_parse_he_obss_pd(
5295 info->attrs[NL80211_ATTR_HE_OBSS_PD],
5296 ¶ms.he_obss_pd);
5297 if (err)
5298 goto out;
5299 }
5300
5301 if (info->attrs[NL80211_ATTR_HE_BSS_COLOR]) {
5302 err = nl80211_parse_he_bss_color(
5303 info->attrs[NL80211_ATTR_HE_BSS_COLOR],
5304 ¶ms.he_bss_color);
5305 if (err)
5306 goto out;
5307 }
5308
5309 if (info->attrs[NL80211_ATTR_FILS_DISCOVERY]) {
5310 err = nl80211_parse_fils_discovery(rdev,
5311 info->attrs[NL80211_ATTR_FILS_DISCOVERY],
5312 ¶ms);
5313 if (err)
5314 goto out;
5315 }
5316
5317 if (info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) {
5318 err = nl80211_parse_unsol_bcast_probe_resp(
5319 rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP],
5320 ¶ms);
5321 if (err)
5322 return err;
5323 }
5324
5325 nl80211_calculate_ap_params(¶ms);
5326
5327 if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])
5328 params.flags |= AP_SETTINGS_EXTERNAL_AUTH_SUPPORT;
5329
5330 wdev_lock(wdev);
5331 err = rdev_start_ap(rdev, dev, ¶ms);
5332 if (!err) {
5333 wdev->preset_chandef = params.chandef;
5334 wdev->beacon_interval = params.beacon_interval;
5335 wdev->chandef = params.chandef;
5336 wdev->ssid_len = params.ssid_len;
5337 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
5338
5339 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
5340 wdev->conn_owner_nlportid = info->snd_portid;
5341 }
5342 wdev_unlock(wdev);
5343
5344 out:
5345 kfree(params.acl);
5346
5347 return err;
5348 }
5349
nl80211_set_beacon(struct sk_buff * skb,struct genl_info * info)5350 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
5351 {
5352 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5353 struct net_device *dev = info->user_ptr[1];
5354 struct wireless_dev *wdev = dev->ieee80211_ptr;
5355 struct cfg80211_beacon_data params;
5356 int err;
5357
5358 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5359 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5360 return -EOPNOTSUPP;
5361
5362 if (!rdev->ops->change_beacon)
5363 return -EOPNOTSUPP;
5364
5365 if (!wdev->beacon_interval)
5366 return -EINVAL;
5367
5368 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms);
5369 if (err)
5370 return err;
5371
5372 wdev_lock(wdev);
5373 err = rdev_change_beacon(rdev, dev, ¶ms);
5374 wdev_unlock(wdev);
5375
5376 return err;
5377 }
5378
nl80211_stop_ap(struct sk_buff * skb,struct genl_info * info)5379 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
5380 {
5381 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5382 struct net_device *dev = info->user_ptr[1];
5383
5384 return cfg80211_stop_ap(rdev, dev, false);
5385 }
5386
5387 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
5388 [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
5389 [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
5390 [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
5391 [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
5392 [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
5393 [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
5394 };
5395
parse_station_flags(struct genl_info * info,enum nl80211_iftype iftype,struct station_parameters * params)5396 static int parse_station_flags(struct genl_info *info,
5397 enum nl80211_iftype iftype,
5398 struct station_parameters *params)
5399 {
5400 struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
5401 struct nlattr *nla;
5402 int flag;
5403
5404 /*
5405 * Try parsing the new attribute first so userspace
5406 * can specify both for older kernels.
5407 */
5408 nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
5409 if (nla) {
5410 struct nl80211_sta_flag_update *sta_flags;
5411
5412 sta_flags = nla_data(nla);
5413 params->sta_flags_mask = sta_flags->mask;
5414 params->sta_flags_set = sta_flags->set;
5415 params->sta_flags_set &= params->sta_flags_mask;
5416 if ((params->sta_flags_mask |
5417 params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
5418 return -EINVAL;
5419 return 0;
5420 }
5421
5422 /* if present, parse the old attribute */
5423
5424 nla = info->attrs[NL80211_ATTR_STA_FLAGS];
5425 if (!nla)
5426 return 0;
5427
5428 if (nla_parse_nested_deprecated(flags, NL80211_STA_FLAG_MAX, nla, sta_flags_policy, info->extack))
5429 return -EINVAL;
5430
5431 /*
5432 * Only allow certain flags for interface types so that
5433 * other attributes are silently ignored. Remember that
5434 * this is backward compatibility code with old userspace
5435 * and shouldn't be hit in other cases anyway.
5436 */
5437 switch (iftype) {
5438 case NL80211_IFTYPE_AP:
5439 case NL80211_IFTYPE_AP_VLAN:
5440 case NL80211_IFTYPE_P2P_GO:
5441 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
5442 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
5443 BIT(NL80211_STA_FLAG_WME) |
5444 BIT(NL80211_STA_FLAG_MFP);
5445 break;
5446 case NL80211_IFTYPE_P2P_CLIENT:
5447 case NL80211_IFTYPE_STATION:
5448 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
5449 BIT(NL80211_STA_FLAG_TDLS_PEER);
5450 break;
5451 case NL80211_IFTYPE_MESH_POINT:
5452 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5453 BIT(NL80211_STA_FLAG_MFP) |
5454 BIT(NL80211_STA_FLAG_AUTHORIZED);
5455 break;
5456 default:
5457 return -EINVAL;
5458 }
5459
5460 for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
5461 if (flags[flag]) {
5462 params->sta_flags_set |= (1<<flag);
5463
5464 /* no longer support new API additions in old API */
5465 if (flag > NL80211_STA_FLAG_MAX_OLD_API)
5466 return -EINVAL;
5467 }
5468 }
5469
5470 return 0;
5471 }
5472
nl80211_put_sta_rate(struct sk_buff * msg,struct rate_info * info,int attr)5473 bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, int attr)
5474 {
5475 struct nlattr *rate;
5476 u32 bitrate;
5477 u16 bitrate_compat;
5478 enum nl80211_rate_info rate_flg;
5479
5480 rate = nla_nest_start_noflag(msg, attr);
5481 if (!rate)
5482 return false;
5483
5484 /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
5485 bitrate = cfg80211_calculate_bitrate(info);
5486 /* report 16-bit bitrate only if we can */
5487 bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
5488 if (bitrate > 0 &&
5489 nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
5490 return false;
5491 if (bitrate_compat > 0 &&
5492 nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
5493 return false;
5494
5495 switch (info->bw) {
5496 case RATE_INFO_BW_5:
5497 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
5498 break;
5499 case RATE_INFO_BW_10:
5500 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
5501 break;
5502 default:
5503 WARN_ON(1);
5504 fallthrough;
5505 case RATE_INFO_BW_20:
5506 rate_flg = 0;
5507 break;
5508 case RATE_INFO_BW_40:
5509 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
5510 break;
5511 case RATE_INFO_BW_80:
5512 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
5513 break;
5514 case RATE_INFO_BW_160:
5515 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
5516 break;
5517 case RATE_INFO_BW_HE_RU:
5518 rate_flg = 0;
5519 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS));
5520 }
5521
5522 if (rate_flg && nla_put_flag(msg, rate_flg))
5523 return false;
5524
5525 if (info->flags & RATE_INFO_FLAGS_MCS) {
5526 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
5527 return false;
5528 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
5529 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
5530 return false;
5531 } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
5532 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
5533 return false;
5534 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
5535 return false;
5536 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
5537 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
5538 return false;
5539 } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) {
5540 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs))
5541 return false;
5542 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss))
5543 return false;
5544 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi))
5545 return false;
5546 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm))
5547 return false;
5548 if (info->bw == RATE_INFO_BW_HE_RU &&
5549 nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC,
5550 info->he_ru_alloc))
5551 return false;
5552 }
5553
5554 nla_nest_end(msg, rate);
5555 return true;
5556 }
5557
nl80211_put_signal(struct sk_buff * msg,u8 mask,s8 * signal,int id)5558 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
5559 int id)
5560 {
5561 void *attr;
5562 int i = 0;
5563
5564 if (!mask)
5565 return true;
5566
5567 attr = nla_nest_start_noflag(msg, id);
5568 if (!attr)
5569 return false;
5570
5571 for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
5572 if (!(mask & BIT(i)))
5573 continue;
5574
5575 if (nla_put_u8(msg, i, signal[i]))
5576 return false;
5577 }
5578
5579 nla_nest_end(msg, attr);
5580
5581 return true;
5582 }
5583
nl80211_send_station(struct sk_buff * msg,u32 cmd,u32 portid,u32 seq,int flags,struct cfg80211_registered_device * rdev,struct net_device * dev,const u8 * mac_addr,struct station_info * sinfo)5584 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
5585 u32 seq, int flags,
5586 struct cfg80211_registered_device *rdev,
5587 struct net_device *dev,
5588 const u8 *mac_addr, struct station_info *sinfo)
5589 {
5590 void *hdr;
5591 struct nlattr *sinfoattr, *bss_param;
5592
5593 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
5594 if (!hdr) {
5595 cfg80211_sinfo_release_content(sinfo);
5596 return -1;
5597 }
5598
5599 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5600 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
5601 nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
5602 goto nla_put_failure;
5603
5604 sinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_STA_INFO);
5605 if (!sinfoattr)
5606 goto nla_put_failure;
5607
5608 #define PUT_SINFO(attr, memb, type) do { \
5609 BUILD_BUG_ON(sizeof(type) == sizeof(u64)); \
5610 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \
5611 nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr, \
5612 sinfo->memb)) \
5613 goto nla_put_failure; \
5614 } while (0)
5615 #define PUT_SINFO_U64(attr, memb) do { \
5616 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \
5617 nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr, \
5618 sinfo->memb, NL80211_STA_INFO_PAD)) \
5619 goto nla_put_failure; \
5620 } while (0)
5621
5622 PUT_SINFO(CONNECTED_TIME, connected_time, u32);
5623 PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
5624 PUT_SINFO_U64(ASSOC_AT_BOOTTIME, assoc_at);
5625
5626 if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
5627 BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
5628 nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
5629 (u32)sinfo->rx_bytes))
5630 goto nla_put_failure;
5631
5632 if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
5633 BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
5634 nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
5635 (u32)sinfo->tx_bytes))
5636 goto nla_put_failure;
5637
5638 PUT_SINFO_U64(RX_BYTES64, rx_bytes);
5639 PUT_SINFO_U64(TX_BYTES64, tx_bytes);
5640 PUT_SINFO(LLID, llid, u16);
5641 PUT_SINFO(PLID, plid, u16);
5642 PUT_SINFO(PLINK_STATE, plink_state, u8);
5643 PUT_SINFO_U64(RX_DURATION, rx_duration);
5644 PUT_SINFO_U64(TX_DURATION, tx_duration);
5645
5646 if (wiphy_ext_feature_isset(&rdev->wiphy,
5647 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
5648 PUT_SINFO(AIRTIME_WEIGHT, airtime_weight, u16);
5649
5650 switch (rdev->wiphy.signal_type) {
5651 case CFG80211_SIGNAL_TYPE_MBM:
5652 PUT_SINFO(SIGNAL, signal, u8);
5653 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
5654 break;
5655 default:
5656 break;
5657 }
5658 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
5659 if (!nl80211_put_signal(msg, sinfo->chains,
5660 sinfo->chain_signal,
5661 NL80211_STA_INFO_CHAIN_SIGNAL))
5662 goto nla_put_failure;
5663 }
5664 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
5665 if (!nl80211_put_signal(msg, sinfo->chains,
5666 sinfo->chain_signal_avg,
5667 NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
5668 goto nla_put_failure;
5669 }
5670 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
5671 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
5672 NL80211_STA_INFO_TX_BITRATE))
5673 goto nla_put_failure;
5674 }
5675 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
5676 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
5677 NL80211_STA_INFO_RX_BITRATE))
5678 goto nla_put_failure;
5679 }
5680
5681 PUT_SINFO(RX_PACKETS, rx_packets, u32);
5682 PUT_SINFO(TX_PACKETS, tx_packets, u32);
5683 PUT_SINFO(TX_RETRIES, tx_retries, u32);
5684 PUT_SINFO(TX_FAILED, tx_failed, u32);
5685 PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
5686 PUT_SINFO(AIRTIME_LINK_METRIC, airtime_link_metric, u32);
5687 PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
5688 PUT_SINFO(LOCAL_PM, local_pm, u32);
5689 PUT_SINFO(PEER_PM, peer_pm, u32);
5690 PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
5691 PUT_SINFO(CONNECTED_TO_GATE, connected_to_gate, u8);
5692 PUT_SINFO(CONNECTED_TO_AS, connected_to_as, u8);
5693
5694 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
5695 bss_param = nla_nest_start_noflag(msg,
5696 NL80211_STA_INFO_BSS_PARAM);
5697 if (!bss_param)
5698 goto nla_put_failure;
5699
5700 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
5701 nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
5702 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
5703 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
5704 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
5705 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
5706 nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
5707 sinfo->bss_param.dtim_period) ||
5708 nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
5709 sinfo->bss_param.beacon_interval))
5710 goto nla_put_failure;
5711
5712 nla_nest_end(msg, bss_param);
5713 }
5714 if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) &&
5715 nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
5716 sizeof(struct nl80211_sta_flag_update),
5717 &sinfo->sta_flags))
5718 goto nla_put_failure;
5719
5720 PUT_SINFO_U64(T_OFFSET, t_offset);
5721 PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
5722 PUT_SINFO_U64(BEACON_RX, rx_beacon);
5723 PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
5724 PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32);
5725 PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32);
5726 if (wiphy_ext_feature_isset(&rdev->wiphy,
5727 NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) {
5728 PUT_SINFO(ACK_SIGNAL, ack_signal, u8);
5729 PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8);
5730 }
5731
5732 #undef PUT_SINFO
5733 #undef PUT_SINFO_U64
5734
5735 if (sinfo->pertid) {
5736 struct nlattr *tidsattr;
5737 int tid;
5738
5739 tidsattr = nla_nest_start_noflag(msg,
5740 NL80211_STA_INFO_TID_STATS);
5741 if (!tidsattr)
5742 goto nla_put_failure;
5743
5744 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
5745 struct cfg80211_tid_stats *tidstats;
5746 struct nlattr *tidattr;
5747
5748 tidstats = &sinfo->pertid[tid];
5749
5750 if (!tidstats->filled)
5751 continue;
5752
5753 tidattr = nla_nest_start_noflag(msg, tid + 1);
5754 if (!tidattr)
5755 goto nla_put_failure;
5756
5757 #define PUT_TIDVAL_U64(attr, memb) do { \
5758 if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) && \
5759 nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr, \
5760 tidstats->memb, NL80211_TID_STATS_PAD)) \
5761 goto nla_put_failure; \
5762 } while (0)
5763
5764 PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
5765 PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
5766 PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
5767 PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
5768
5769 #undef PUT_TIDVAL_U64
5770 if ((tidstats->filled &
5771 BIT(NL80211_TID_STATS_TXQ_STATS)) &&
5772 !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
5773 NL80211_TID_STATS_TXQ_STATS))
5774 goto nla_put_failure;
5775
5776 nla_nest_end(msg, tidattr);
5777 }
5778
5779 nla_nest_end(msg, tidsattr);
5780 }
5781
5782 nla_nest_end(msg, sinfoattr);
5783
5784 if (sinfo->assoc_req_ies_len &&
5785 nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
5786 sinfo->assoc_req_ies))
5787 goto nla_put_failure;
5788
5789 cfg80211_sinfo_release_content(sinfo);
5790 genlmsg_end(msg, hdr);
5791 return 0;
5792
5793 nla_put_failure:
5794 cfg80211_sinfo_release_content(sinfo);
5795 genlmsg_cancel(msg, hdr);
5796 return -EMSGSIZE;
5797 }
5798
nl80211_dump_station(struct sk_buff * skb,struct netlink_callback * cb)5799 static int nl80211_dump_station(struct sk_buff *skb,
5800 struct netlink_callback *cb)
5801 {
5802 struct station_info sinfo;
5803 struct cfg80211_registered_device *rdev;
5804 struct wireless_dev *wdev;
5805 u8 mac_addr[ETH_ALEN];
5806 int sta_idx = cb->args[2];
5807 int err;
5808
5809 rtnl_lock();
5810 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
5811 if (err)
5812 goto out_err;
5813
5814 if (!wdev->netdev) {
5815 err = -EINVAL;
5816 goto out_err;
5817 }
5818
5819 if (!rdev->ops->dump_station) {
5820 err = -EOPNOTSUPP;
5821 goto out_err;
5822 }
5823
5824 while (1) {
5825 memset(&sinfo, 0, sizeof(sinfo));
5826 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
5827 mac_addr, &sinfo);
5828 if (err == -ENOENT)
5829 break;
5830 if (err)
5831 goto out_err;
5832
5833 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
5834 NETLINK_CB(cb->skb).portid,
5835 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5836 rdev, wdev->netdev, mac_addr,
5837 &sinfo) < 0)
5838 goto out;
5839
5840 sta_idx++;
5841 }
5842
5843 out:
5844 cb->args[2] = sta_idx;
5845 err = skb->len;
5846 out_err:
5847 rtnl_unlock();
5848
5849 return err;
5850 }
5851
nl80211_get_station(struct sk_buff * skb,struct genl_info * info)5852 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
5853 {
5854 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5855 struct net_device *dev = info->user_ptr[1];
5856 struct station_info sinfo;
5857 struct sk_buff *msg;
5858 u8 *mac_addr = NULL;
5859 int err;
5860
5861 memset(&sinfo, 0, sizeof(sinfo));
5862
5863 if (!info->attrs[NL80211_ATTR_MAC])
5864 return -EINVAL;
5865
5866 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5867
5868 if (!rdev->ops->get_station)
5869 return -EOPNOTSUPP;
5870
5871 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
5872 if (err)
5873 return err;
5874
5875 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5876 if (!msg) {
5877 cfg80211_sinfo_release_content(&sinfo);
5878 return -ENOMEM;
5879 }
5880
5881 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
5882 info->snd_portid, info->snd_seq, 0,
5883 rdev, dev, mac_addr, &sinfo) < 0) {
5884 nlmsg_free(msg);
5885 return -ENOBUFS;
5886 }
5887
5888 return genlmsg_reply(msg, info);
5889 }
5890
cfg80211_check_station_change(struct wiphy * wiphy,struct station_parameters * params,enum cfg80211_station_type statype)5891 int cfg80211_check_station_change(struct wiphy *wiphy,
5892 struct station_parameters *params,
5893 enum cfg80211_station_type statype)
5894 {
5895 if (params->listen_interval != -1 &&
5896 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
5897 return -EINVAL;
5898
5899 if (params->support_p2p_ps != -1 &&
5900 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
5901 return -EINVAL;
5902
5903 if (params->aid &&
5904 !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
5905 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
5906 return -EINVAL;
5907
5908 /* When you run into this, adjust the code below for the new flag */
5909 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
5910
5911 switch (statype) {
5912 case CFG80211_STA_MESH_PEER_KERNEL:
5913 case CFG80211_STA_MESH_PEER_USER:
5914 /*
5915 * No ignoring the TDLS flag here -- the userspace mesh
5916 * code doesn't have the bug of including TDLS in the
5917 * mask everywhere.
5918 */
5919 if (params->sta_flags_mask &
5920 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5921 BIT(NL80211_STA_FLAG_MFP) |
5922 BIT(NL80211_STA_FLAG_AUTHORIZED)))
5923 return -EINVAL;
5924 break;
5925 case CFG80211_STA_TDLS_PEER_SETUP:
5926 case CFG80211_STA_TDLS_PEER_ACTIVE:
5927 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
5928 return -EINVAL;
5929 /* ignore since it can't change */
5930 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
5931 break;
5932 default:
5933 /* disallow mesh-specific things */
5934 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
5935 return -EINVAL;
5936 if (params->local_pm)
5937 return -EINVAL;
5938 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
5939 return -EINVAL;
5940 }
5941
5942 if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
5943 statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
5944 /* TDLS can't be set, ... */
5945 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
5946 return -EINVAL;
5947 /*
5948 * ... but don't bother the driver with it. This works around
5949 * a hostapd/wpa_supplicant issue -- it always includes the
5950 * TLDS_PEER flag in the mask even for AP mode.
5951 */
5952 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
5953 }
5954
5955 if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
5956 statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
5957 /* reject other things that can't change */
5958 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
5959 return -EINVAL;
5960 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
5961 return -EINVAL;
5962 if (params->supported_rates)
5963 return -EINVAL;
5964 if (params->ext_capab || params->ht_capa || params->vht_capa ||
5965 params->he_capa)
5966 return -EINVAL;
5967 }
5968
5969 if (statype != CFG80211_STA_AP_CLIENT &&
5970 statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
5971 if (params->vlan)
5972 return -EINVAL;
5973 }
5974
5975 switch (statype) {
5976 case CFG80211_STA_AP_MLME_CLIENT:
5977 /* Use this only for authorizing/unauthorizing a station */
5978 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
5979 return -EOPNOTSUPP;
5980 break;
5981 case CFG80211_STA_AP_CLIENT:
5982 case CFG80211_STA_AP_CLIENT_UNASSOC:
5983 /* accept only the listed bits */
5984 if (params->sta_flags_mask &
5985 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
5986 BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5987 BIT(NL80211_STA_FLAG_ASSOCIATED) |
5988 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
5989 BIT(NL80211_STA_FLAG_WME) |
5990 BIT(NL80211_STA_FLAG_MFP)))
5991 return -EINVAL;
5992
5993 /* but authenticated/associated only if driver handles it */
5994 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
5995 params->sta_flags_mask &
5996 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5997 BIT(NL80211_STA_FLAG_ASSOCIATED)))
5998 return -EINVAL;
5999 break;
6000 case CFG80211_STA_IBSS:
6001 case CFG80211_STA_AP_STA:
6002 /* reject any changes other than AUTHORIZED */
6003 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
6004 return -EINVAL;
6005 break;
6006 case CFG80211_STA_TDLS_PEER_SETUP:
6007 /* reject any changes other than AUTHORIZED or WME */
6008 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
6009 BIT(NL80211_STA_FLAG_WME)))
6010 return -EINVAL;
6011 /* force (at least) rates when authorizing */
6012 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
6013 !params->supported_rates)
6014 return -EINVAL;
6015 break;
6016 case CFG80211_STA_TDLS_PEER_ACTIVE:
6017 /* reject any changes */
6018 return -EINVAL;
6019 case CFG80211_STA_MESH_PEER_KERNEL:
6020 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
6021 return -EINVAL;
6022 break;
6023 case CFG80211_STA_MESH_PEER_USER:
6024 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
6025 params->plink_action != NL80211_PLINK_ACTION_BLOCK)
6026 return -EINVAL;
6027 break;
6028 }
6029
6030 /*
6031 * Older kernel versions ignored this attribute entirely, so don't
6032 * reject attempts to update it but mark it as unused instead so the
6033 * driver won't look at the data.
6034 */
6035 if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
6036 statype != CFG80211_STA_TDLS_PEER_SETUP)
6037 params->opmode_notif_used = false;
6038
6039 return 0;
6040 }
6041 EXPORT_SYMBOL(cfg80211_check_station_change);
6042
6043 /*
6044 * Get vlan interface making sure it is running and on the right wiphy.
6045 */
get_vlan(struct genl_info * info,struct cfg80211_registered_device * rdev)6046 static struct net_device *get_vlan(struct genl_info *info,
6047 struct cfg80211_registered_device *rdev)
6048 {
6049 struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
6050 struct net_device *v;
6051 int ret;
6052
6053 if (!vlanattr)
6054 return NULL;
6055
6056 v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
6057 if (!v)
6058 return ERR_PTR(-ENODEV);
6059
6060 if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
6061 ret = -EINVAL;
6062 goto error;
6063 }
6064
6065 if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
6066 v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6067 v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
6068 ret = -EINVAL;
6069 goto error;
6070 }
6071
6072 if (!netif_running(v)) {
6073 ret = -ENETDOWN;
6074 goto error;
6075 }
6076
6077 return v;
6078 error:
6079 dev_put(v);
6080 return ERR_PTR(ret);
6081 }
6082
6083 static const struct nla_policy
6084 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
6085 [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
6086 [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
6087 };
6088
nl80211_parse_sta_wme(struct genl_info * info,struct station_parameters * params)6089 static int nl80211_parse_sta_wme(struct genl_info *info,
6090 struct station_parameters *params)
6091 {
6092 struct nlattr *tb[NL80211_STA_WME_MAX + 1];
6093 struct nlattr *nla;
6094 int err;
6095
6096 /* parse WME attributes if present */
6097 if (!info->attrs[NL80211_ATTR_STA_WME])
6098 return 0;
6099
6100 nla = info->attrs[NL80211_ATTR_STA_WME];
6101 err = nla_parse_nested_deprecated(tb, NL80211_STA_WME_MAX, nla,
6102 nl80211_sta_wme_policy,
6103 info->extack);
6104 if (err)
6105 return err;
6106
6107 if (tb[NL80211_STA_WME_UAPSD_QUEUES])
6108 params->uapsd_queues = nla_get_u8(
6109 tb[NL80211_STA_WME_UAPSD_QUEUES]);
6110 if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
6111 return -EINVAL;
6112
6113 if (tb[NL80211_STA_WME_MAX_SP])
6114 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
6115
6116 if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
6117 return -EINVAL;
6118
6119 params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
6120
6121 return 0;
6122 }
6123
nl80211_parse_sta_channel_info(struct genl_info * info,struct station_parameters * params)6124 static int nl80211_parse_sta_channel_info(struct genl_info *info,
6125 struct station_parameters *params)
6126 {
6127 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
6128 params->supported_channels =
6129 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
6130 params->supported_channels_len =
6131 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
6132 /*
6133 * Need to include at least one (first channel, number of
6134 * channels) tuple for each subband (checked in policy),
6135 * and must have proper tuples for the rest of the data as well.
6136 */
6137 if (params->supported_channels_len % 2)
6138 return -EINVAL;
6139 }
6140
6141 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
6142 params->supported_oper_classes =
6143 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
6144 params->supported_oper_classes_len =
6145 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
6146 }
6147 return 0;
6148 }
6149
nl80211_set_station_tdls(struct genl_info * info,struct station_parameters * params)6150 static int nl80211_set_station_tdls(struct genl_info *info,
6151 struct station_parameters *params)
6152 {
6153 int err;
6154 /* Dummy STA entry gets updated once the peer capabilities are known */
6155 if (info->attrs[NL80211_ATTR_PEER_AID])
6156 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
6157 if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
6158 params->ht_capa =
6159 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
6160 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
6161 params->vht_capa =
6162 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
6163 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
6164 params->he_capa =
6165 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
6166 params->he_capa_len =
6167 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
6168 }
6169
6170 err = nl80211_parse_sta_channel_info(info, params);
6171 if (err)
6172 return err;
6173
6174 return nl80211_parse_sta_wme(info, params);
6175 }
6176
nl80211_parse_sta_txpower_setting(struct genl_info * info,struct station_parameters * params)6177 static int nl80211_parse_sta_txpower_setting(struct genl_info *info,
6178 struct station_parameters *params)
6179 {
6180 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6181 int idx;
6182
6183 if (info->attrs[NL80211_ATTR_STA_TX_POWER_SETTING]) {
6184 if (!rdev->ops->set_tx_power ||
6185 !wiphy_ext_feature_isset(&rdev->wiphy,
6186 NL80211_EXT_FEATURE_STA_TX_PWR))
6187 return -EOPNOTSUPP;
6188
6189 idx = NL80211_ATTR_STA_TX_POWER_SETTING;
6190 params->txpwr.type = nla_get_u8(info->attrs[idx]);
6191
6192 if (params->txpwr.type == NL80211_TX_POWER_LIMITED) {
6193 idx = NL80211_ATTR_STA_TX_POWER;
6194
6195 if (info->attrs[idx])
6196 params->txpwr.power =
6197 nla_get_s16(info->attrs[idx]);
6198 else
6199 return -EINVAL;
6200 }
6201 params->sta_modify_mask |= STATION_PARAM_APPLY_STA_TXPOWER;
6202 }
6203
6204 return 0;
6205 }
6206
nl80211_set_station(struct sk_buff * skb,struct genl_info * info)6207 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
6208 {
6209 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6210 struct net_device *dev = info->user_ptr[1];
6211 struct station_parameters params;
6212 u8 *mac_addr;
6213 int err;
6214
6215 memset(¶ms, 0, sizeof(params));
6216
6217 if (!rdev->ops->change_station)
6218 return -EOPNOTSUPP;
6219
6220 /*
6221 * AID and listen_interval properties can be set only for unassociated
6222 * station. Include these parameters here and will check them in
6223 * cfg80211_check_station_change().
6224 */
6225 if (info->attrs[NL80211_ATTR_STA_AID])
6226 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
6227
6228 if (info->attrs[NL80211_ATTR_VLAN_ID])
6229 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
6230
6231 if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
6232 params.listen_interval =
6233 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
6234 else
6235 params.listen_interval = -1;
6236
6237 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS])
6238 params.support_p2p_ps =
6239 nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
6240 else
6241 params.support_p2p_ps = -1;
6242
6243 if (!info->attrs[NL80211_ATTR_MAC])
6244 return -EINVAL;
6245
6246 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
6247
6248 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
6249 params.supported_rates =
6250 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
6251 params.supported_rates_len =
6252 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
6253 }
6254
6255 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
6256 params.capability =
6257 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
6258 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
6259 }
6260
6261 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
6262 params.ext_capab =
6263 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
6264 params.ext_capab_len =
6265 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
6266 }
6267
6268 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms))
6269 return -EINVAL;
6270
6271 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
6272 params.plink_action =
6273 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
6274
6275 if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
6276 params.plink_state =
6277 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
6278 if (info->attrs[NL80211_ATTR_MESH_PEER_AID])
6279 params.peer_aid = nla_get_u16(
6280 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
6281 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
6282 }
6283
6284 if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE])
6285 params.local_pm = nla_get_u32(
6286 info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
6287
6288 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
6289 params.opmode_notif_used = true;
6290 params.opmode_notif =
6291 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
6292 }
6293
6294 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
6295 params.he_6ghz_capa =
6296 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
6297
6298 if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
6299 params.airtime_weight =
6300 nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
6301
6302 if (params.airtime_weight &&
6303 !wiphy_ext_feature_isset(&rdev->wiphy,
6304 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
6305 return -EOPNOTSUPP;
6306
6307 err = nl80211_parse_sta_txpower_setting(info, ¶ms);
6308 if (err)
6309 return err;
6310
6311 /* Include parameters for TDLS peer (will check later) */
6312 err = nl80211_set_station_tdls(info, ¶ms);
6313 if (err)
6314 return err;
6315
6316 params.vlan = get_vlan(info, rdev);
6317 if (IS_ERR(params.vlan))
6318 return PTR_ERR(params.vlan);
6319
6320 switch (dev->ieee80211_ptr->iftype) {
6321 case NL80211_IFTYPE_AP:
6322 case NL80211_IFTYPE_AP_VLAN:
6323 case NL80211_IFTYPE_P2P_GO:
6324 case NL80211_IFTYPE_P2P_CLIENT:
6325 case NL80211_IFTYPE_STATION:
6326 case NL80211_IFTYPE_ADHOC:
6327 case NL80211_IFTYPE_MESH_POINT:
6328 break;
6329 default:
6330 err = -EOPNOTSUPP;
6331 goto out_put_vlan;
6332 }
6333
6334 /* driver will call cfg80211_check_station_change() */
6335 err = rdev_change_station(rdev, dev, mac_addr, ¶ms);
6336
6337 out_put_vlan:
6338 if (params.vlan)
6339 dev_put(params.vlan);
6340
6341 return err;
6342 }
6343
nl80211_new_station(struct sk_buff * skb,struct genl_info * info)6344 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
6345 {
6346 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6347 int err;
6348 struct net_device *dev = info->user_ptr[1];
6349 struct station_parameters params;
6350 u8 *mac_addr = NULL;
6351 u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6352 BIT(NL80211_STA_FLAG_ASSOCIATED);
6353
6354 memset(¶ms, 0, sizeof(params));
6355
6356 if (!rdev->ops->add_station)
6357 return -EOPNOTSUPP;
6358
6359 if (!info->attrs[NL80211_ATTR_MAC])
6360 return -EINVAL;
6361
6362 if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
6363 return -EINVAL;
6364
6365 if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
6366 return -EINVAL;
6367
6368 if (!info->attrs[NL80211_ATTR_STA_AID] &&
6369 !info->attrs[NL80211_ATTR_PEER_AID])
6370 return -EINVAL;
6371
6372 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
6373 params.supported_rates =
6374 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
6375 params.supported_rates_len =
6376 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
6377 params.listen_interval =
6378 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
6379
6380 if (info->attrs[NL80211_ATTR_VLAN_ID])
6381 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
6382
6383 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
6384 params.support_p2p_ps =
6385 nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
6386 } else {
6387 /*
6388 * if not specified, assume it's supported for P2P GO interface,
6389 * and is NOT supported for AP interface
6390 */
6391 params.support_p2p_ps =
6392 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
6393 }
6394
6395 if (info->attrs[NL80211_ATTR_PEER_AID])
6396 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
6397 else
6398 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
6399
6400 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
6401 params.capability =
6402 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
6403 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
6404 }
6405
6406 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
6407 params.ext_capab =
6408 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
6409 params.ext_capab_len =
6410 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
6411 }
6412
6413 if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
6414 params.ht_capa =
6415 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
6416
6417 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
6418 params.vht_capa =
6419 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
6420
6421 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
6422 params.he_capa =
6423 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
6424 params.he_capa_len =
6425 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
6426 }
6427
6428 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
6429 params.he_6ghz_capa =
6430 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
6431
6432 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
6433 params.opmode_notif_used = true;
6434 params.opmode_notif =
6435 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
6436 }
6437
6438 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
6439 params.plink_action =
6440 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
6441
6442 if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
6443 params.airtime_weight =
6444 nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
6445
6446 if (params.airtime_weight &&
6447 !wiphy_ext_feature_isset(&rdev->wiphy,
6448 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
6449 return -EOPNOTSUPP;
6450
6451 err = nl80211_parse_sta_txpower_setting(info, ¶ms);
6452 if (err)
6453 return err;
6454
6455 err = nl80211_parse_sta_channel_info(info, ¶ms);
6456 if (err)
6457 return err;
6458
6459 err = nl80211_parse_sta_wme(info, ¶ms);
6460 if (err)
6461 return err;
6462
6463 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms))
6464 return -EINVAL;
6465
6466 /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
6467 * as userspace might just pass through the capabilities from the IEs
6468 * directly, rather than enforcing this restriction and returning an
6469 * error in this case.
6470 */
6471 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
6472 params.ht_capa = NULL;
6473 params.vht_capa = NULL;
6474
6475 /* HE requires WME */
6476 if (params.he_capa_len || params.he_6ghz_capa)
6477 return -EINVAL;
6478 }
6479
6480 /* Ensure that HT/VHT capabilities are not set for 6 GHz HE STA */
6481 if (params.he_6ghz_capa && (params.ht_capa || params.vht_capa))
6482 return -EINVAL;
6483
6484 /* When you run into this, adjust the code below for the new flag */
6485 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
6486
6487 switch (dev->ieee80211_ptr->iftype) {
6488 case NL80211_IFTYPE_AP:
6489 case NL80211_IFTYPE_AP_VLAN:
6490 case NL80211_IFTYPE_P2P_GO:
6491 /* ignore WME attributes if iface/sta is not capable */
6492 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
6493 !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
6494 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
6495
6496 /* TDLS peers cannot be added */
6497 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
6498 info->attrs[NL80211_ATTR_PEER_AID])
6499 return -EINVAL;
6500 /* but don't bother the driver with it */
6501 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
6502
6503 /* allow authenticated/associated only if driver handles it */
6504 if (!(rdev->wiphy.features &
6505 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
6506 params.sta_flags_mask & auth_assoc)
6507 return -EINVAL;
6508
6509 /* Older userspace, or userspace wanting to be compatible with
6510 * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
6511 * and assoc flags in the mask, but assumes the station will be
6512 * added as associated anyway since this was the required driver
6513 * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
6514 * introduced.
6515 * In order to not bother drivers with this quirk in the API
6516 * set the flags in both the mask and set for new stations in
6517 * this case.
6518 */
6519 if (!(params.sta_flags_mask & auth_assoc)) {
6520 params.sta_flags_mask |= auth_assoc;
6521 params.sta_flags_set |= auth_assoc;
6522 }
6523
6524 /* must be last in here for error handling */
6525 params.vlan = get_vlan(info, rdev);
6526 if (IS_ERR(params.vlan))
6527 return PTR_ERR(params.vlan);
6528 break;
6529 case NL80211_IFTYPE_MESH_POINT:
6530 /* ignore uAPSD data */
6531 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
6532
6533 /* associated is disallowed */
6534 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
6535 return -EINVAL;
6536 /* TDLS peers cannot be added */
6537 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
6538 info->attrs[NL80211_ATTR_PEER_AID])
6539 return -EINVAL;
6540 break;
6541 case NL80211_IFTYPE_STATION:
6542 case NL80211_IFTYPE_P2P_CLIENT:
6543 /* ignore uAPSD data */
6544 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
6545
6546 /* these are disallowed */
6547 if (params.sta_flags_mask &
6548 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
6549 BIT(NL80211_STA_FLAG_AUTHENTICATED)))
6550 return -EINVAL;
6551 /* Only TDLS peers can be added */
6552 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
6553 return -EINVAL;
6554 /* Can only add if TDLS ... */
6555 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
6556 return -EOPNOTSUPP;
6557 /* ... with external setup is supported */
6558 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
6559 return -EOPNOTSUPP;
6560 /*
6561 * Older wpa_supplicant versions always mark the TDLS peer
6562 * as authorized, but it shouldn't yet be.
6563 */
6564 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
6565 break;
6566 default:
6567 return -EOPNOTSUPP;
6568 }
6569
6570 /* be aware of params.vlan when changing code here */
6571
6572 err = rdev_add_station(rdev, dev, mac_addr, ¶ms);
6573
6574 if (params.vlan)
6575 dev_put(params.vlan);
6576 return err;
6577 }
6578
nl80211_del_station(struct sk_buff * skb,struct genl_info * info)6579 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
6580 {
6581 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6582 struct net_device *dev = info->user_ptr[1];
6583 struct station_del_parameters params;
6584
6585 memset(¶ms, 0, sizeof(params));
6586
6587 if (info->attrs[NL80211_ATTR_MAC])
6588 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
6589
6590 switch (dev->ieee80211_ptr->iftype) {
6591 case NL80211_IFTYPE_AP:
6592 case NL80211_IFTYPE_AP_VLAN:
6593 case NL80211_IFTYPE_MESH_POINT:
6594 case NL80211_IFTYPE_P2P_GO:
6595 /* always accept these */
6596 break;
6597 case NL80211_IFTYPE_ADHOC:
6598 /* conditionally accept */
6599 if (wiphy_ext_feature_isset(&rdev->wiphy,
6600 NL80211_EXT_FEATURE_DEL_IBSS_STA))
6601 break;
6602 return -EINVAL;
6603 default:
6604 return -EINVAL;
6605 }
6606
6607 if (!rdev->ops->del_station)
6608 return -EOPNOTSUPP;
6609
6610 if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
6611 params.subtype =
6612 nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
6613 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
6614 params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
6615 return -EINVAL;
6616 } else {
6617 /* Default to Deauthentication frame */
6618 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
6619 }
6620
6621 if (info->attrs[NL80211_ATTR_REASON_CODE]) {
6622 params.reason_code =
6623 nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6624 if (params.reason_code == 0)
6625 return -EINVAL; /* 0 is reserved */
6626 } else {
6627 /* Default to reason code 2 */
6628 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
6629 }
6630
6631 return rdev_del_station(rdev, dev, ¶ms);
6632 }
6633
nl80211_send_mpath(struct sk_buff * msg,u32 portid,u32 seq,int flags,struct net_device * dev,u8 * dst,u8 * next_hop,struct mpath_info * pinfo)6634 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
6635 int flags, struct net_device *dev,
6636 u8 *dst, u8 *next_hop,
6637 struct mpath_info *pinfo)
6638 {
6639 void *hdr;
6640 struct nlattr *pinfoattr;
6641
6642 hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
6643 if (!hdr)
6644 return -1;
6645
6646 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
6647 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
6648 nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
6649 nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
6650 goto nla_put_failure;
6651
6652 pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MPATH_INFO);
6653 if (!pinfoattr)
6654 goto nla_put_failure;
6655 if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
6656 nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
6657 pinfo->frame_qlen))
6658 goto nla_put_failure;
6659 if (((pinfo->filled & MPATH_INFO_SN) &&
6660 nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
6661 ((pinfo->filled & MPATH_INFO_METRIC) &&
6662 nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
6663 pinfo->metric)) ||
6664 ((pinfo->filled & MPATH_INFO_EXPTIME) &&
6665 nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
6666 pinfo->exptime)) ||
6667 ((pinfo->filled & MPATH_INFO_FLAGS) &&
6668 nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
6669 pinfo->flags)) ||
6670 ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
6671 nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
6672 pinfo->discovery_timeout)) ||
6673 ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
6674 nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
6675 pinfo->discovery_retries)) ||
6676 ((pinfo->filled & MPATH_INFO_HOP_COUNT) &&
6677 nla_put_u8(msg, NL80211_MPATH_INFO_HOP_COUNT,
6678 pinfo->hop_count)) ||
6679 ((pinfo->filled & MPATH_INFO_PATH_CHANGE) &&
6680 nla_put_u32(msg, NL80211_MPATH_INFO_PATH_CHANGE,
6681 pinfo->path_change_count)))
6682 goto nla_put_failure;
6683
6684 nla_nest_end(msg, pinfoattr);
6685
6686 genlmsg_end(msg, hdr);
6687 return 0;
6688
6689 nla_put_failure:
6690 genlmsg_cancel(msg, hdr);
6691 return -EMSGSIZE;
6692 }
6693
nl80211_dump_mpath(struct sk_buff * skb,struct netlink_callback * cb)6694 static int nl80211_dump_mpath(struct sk_buff *skb,
6695 struct netlink_callback *cb)
6696 {
6697 struct mpath_info pinfo;
6698 struct cfg80211_registered_device *rdev;
6699 struct wireless_dev *wdev;
6700 u8 dst[ETH_ALEN];
6701 u8 next_hop[ETH_ALEN];
6702 int path_idx = cb->args[2];
6703 int err;
6704
6705 rtnl_lock();
6706 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
6707 if (err)
6708 goto out_err;
6709
6710 if (!rdev->ops->dump_mpath) {
6711 err = -EOPNOTSUPP;
6712 goto out_err;
6713 }
6714
6715 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
6716 err = -EOPNOTSUPP;
6717 goto out_err;
6718 }
6719
6720 while (1) {
6721 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
6722 next_hop, &pinfo);
6723 if (err == -ENOENT)
6724 break;
6725 if (err)
6726 goto out_err;
6727
6728 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
6729 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6730 wdev->netdev, dst, next_hop,
6731 &pinfo) < 0)
6732 goto out;
6733
6734 path_idx++;
6735 }
6736
6737 out:
6738 cb->args[2] = path_idx;
6739 err = skb->len;
6740 out_err:
6741 rtnl_unlock();
6742 return err;
6743 }
6744
nl80211_get_mpath(struct sk_buff * skb,struct genl_info * info)6745 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
6746 {
6747 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6748 int err;
6749 struct net_device *dev = info->user_ptr[1];
6750 struct mpath_info pinfo;
6751 struct sk_buff *msg;
6752 u8 *dst = NULL;
6753 u8 next_hop[ETH_ALEN];
6754
6755 memset(&pinfo, 0, sizeof(pinfo));
6756
6757 if (!info->attrs[NL80211_ATTR_MAC])
6758 return -EINVAL;
6759
6760 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6761
6762 if (!rdev->ops->get_mpath)
6763 return -EOPNOTSUPP;
6764
6765 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6766 return -EOPNOTSUPP;
6767
6768 err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
6769 if (err)
6770 return err;
6771
6772 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6773 if (!msg)
6774 return -ENOMEM;
6775
6776 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
6777 dev, dst, next_hop, &pinfo) < 0) {
6778 nlmsg_free(msg);
6779 return -ENOBUFS;
6780 }
6781
6782 return genlmsg_reply(msg, info);
6783 }
6784
nl80211_set_mpath(struct sk_buff * skb,struct genl_info * info)6785 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
6786 {
6787 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6788 struct net_device *dev = info->user_ptr[1];
6789 u8 *dst = NULL;
6790 u8 *next_hop = NULL;
6791
6792 if (!info->attrs[NL80211_ATTR_MAC])
6793 return -EINVAL;
6794
6795 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
6796 return -EINVAL;
6797
6798 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6799 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
6800
6801 if (!rdev->ops->change_mpath)
6802 return -EOPNOTSUPP;
6803
6804 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6805 return -EOPNOTSUPP;
6806
6807 return rdev_change_mpath(rdev, dev, dst, next_hop);
6808 }
6809
nl80211_new_mpath(struct sk_buff * skb,struct genl_info * info)6810 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
6811 {
6812 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6813 struct net_device *dev = info->user_ptr[1];
6814 u8 *dst = NULL;
6815 u8 *next_hop = NULL;
6816
6817 if (!info->attrs[NL80211_ATTR_MAC])
6818 return -EINVAL;
6819
6820 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
6821 return -EINVAL;
6822
6823 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6824 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
6825
6826 if (!rdev->ops->add_mpath)
6827 return -EOPNOTSUPP;
6828
6829 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6830 return -EOPNOTSUPP;
6831
6832 return rdev_add_mpath(rdev, dev, dst, next_hop);
6833 }
6834
nl80211_del_mpath(struct sk_buff * skb,struct genl_info * info)6835 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
6836 {
6837 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6838 struct net_device *dev = info->user_ptr[1];
6839 u8 *dst = NULL;
6840
6841 if (info->attrs[NL80211_ATTR_MAC])
6842 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6843
6844 if (!rdev->ops->del_mpath)
6845 return -EOPNOTSUPP;
6846
6847 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6848 return -EOPNOTSUPP;
6849
6850 return rdev_del_mpath(rdev, dev, dst);
6851 }
6852
nl80211_get_mpp(struct sk_buff * skb,struct genl_info * info)6853 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
6854 {
6855 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6856 int err;
6857 struct net_device *dev = info->user_ptr[1];
6858 struct mpath_info pinfo;
6859 struct sk_buff *msg;
6860 u8 *dst = NULL;
6861 u8 mpp[ETH_ALEN];
6862
6863 memset(&pinfo, 0, sizeof(pinfo));
6864
6865 if (!info->attrs[NL80211_ATTR_MAC])
6866 return -EINVAL;
6867
6868 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6869
6870 if (!rdev->ops->get_mpp)
6871 return -EOPNOTSUPP;
6872
6873 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6874 return -EOPNOTSUPP;
6875
6876 err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
6877 if (err)
6878 return err;
6879
6880 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6881 if (!msg)
6882 return -ENOMEM;
6883
6884 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
6885 dev, dst, mpp, &pinfo) < 0) {
6886 nlmsg_free(msg);
6887 return -ENOBUFS;
6888 }
6889
6890 return genlmsg_reply(msg, info);
6891 }
6892
nl80211_dump_mpp(struct sk_buff * skb,struct netlink_callback * cb)6893 static int nl80211_dump_mpp(struct sk_buff *skb,
6894 struct netlink_callback *cb)
6895 {
6896 struct mpath_info pinfo;
6897 struct cfg80211_registered_device *rdev;
6898 struct wireless_dev *wdev;
6899 u8 dst[ETH_ALEN];
6900 u8 mpp[ETH_ALEN];
6901 int path_idx = cb->args[2];
6902 int err;
6903
6904 rtnl_lock();
6905 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
6906 if (err)
6907 goto out_err;
6908
6909 if (!rdev->ops->dump_mpp) {
6910 err = -EOPNOTSUPP;
6911 goto out_err;
6912 }
6913
6914 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
6915 err = -EOPNOTSUPP;
6916 goto out_err;
6917 }
6918
6919 while (1) {
6920 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
6921 mpp, &pinfo);
6922 if (err == -ENOENT)
6923 break;
6924 if (err)
6925 goto out_err;
6926
6927 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
6928 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6929 wdev->netdev, dst, mpp,
6930 &pinfo) < 0)
6931 goto out;
6932
6933 path_idx++;
6934 }
6935
6936 out:
6937 cb->args[2] = path_idx;
6938 err = skb->len;
6939 out_err:
6940 rtnl_unlock();
6941 return err;
6942 }
6943
nl80211_set_bss(struct sk_buff * skb,struct genl_info * info)6944 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
6945 {
6946 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6947 struct net_device *dev = info->user_ptr[1];
6948 struct wireless_dev *wdev = dev->ieee80211_ptr;
6949 struct bss_parameters params;
6950 int err;
6951
6952 memset(¶ms, 0, sizeof(params));
6953 /* default to not changing parameters */
6954 params.use_cts_prot = -1;
6955 params.use_short_preamble = -1;
6956 params.use_short_slot_time = -1;
6957 params.ap_isolate = -1;
6958 params.ht_opmode = -1;
6959 params.p2p_ctwindow = -1;
6960 params.p2p_opp_ps = -1;
6961
6962 if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
6963 params.use_cts_prot =
6964 nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
6965 if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
6966 params.use_short_preamble =
6967 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
6968 if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
6969 params.use_short_slot_time =
6970 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
6971 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
6972 params.basic_rates =
6973 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6974 params.basic_rates_len =
6975 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6976 }
6977 if (info->attrs[NL80211_ATTR_AP_ISOLATE])
6978 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
6979 if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
6980 params.ht_opmode =
6981 nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
6982
6983 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
6984 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6985 return -EINVAL;
6986 params.p2p_ctwindow =
6987 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
6988 if (params.p2p_ctwindow != 0 &&
6989 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
6990 return -EINVAL;
6991 }
6992
6993 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
6994 u8 tmp;
6995
6996 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6997 return -EINVAL;
6998 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
6999 params.p2p_opp_ps = tmp;
7000 if (params.p2p_opp_ps &&
7001 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
7002 return -EINVAL;
7003 }
7004
7005 if (!rdev->ops->change_bss)
7006 return -EOPNOTSUPP;
7007
7008 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
7009 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
7010 return -EOPNOTSUPP;
7011
7012 wdev_lock(wdev);
7013 err = rdev_change_bss(rdev, dev, ¶ms);
7014 wdev_unlock(wdev);
7015
7016 return err;
7017 }
7018
nl80211_req_set_reg(struct sk_buff * skb,struct genl_info * info)7019 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
7020 {
7021 char *data = NULL;
7022 bool is_indoor;
7023 enum nl80211_user_reg_hint_type user_reg_hint_type;
7024 u32 owner_nlportid;
7025
7026 /*
7027 * You should only get this when cfg80211 hasn't yet initialized
7028 * completely when built-in to the kernel right between the time
7029 * window between nl80211_init() and regulatory_init(), if that is
7030 * even possible.
7031 */
7032 if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
7033 return -EINPROGRESS;
7034
7035 if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
7036 user_reg_hint_type =
7037 nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
7038 else
7039 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
7040
7041 switch (user_reg_hint_type) {
7042 case NL80211_USER_REG_HINT_USER:
7043 case NL80211_USER_REG_HINT_CELL_BASE:
7044 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
7045 return -EINVAL;
7046
7047 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
7048 return regulatory_hint_user(data, user_reg_hint_type);
7049 case NL80211_USER_REG_HINT_INDOOR:
7050 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
7051 owner_nlportid = info->snd_portid;
7052 is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
7053 } else {
7054 owner_nlportid = 0;
7055 is_indoor = true;
7056 }
7057
7058 return regulatory_hint_indoor(is_indoor, owner_nlportid);
7059 default:
7060 return -EINVAL;
7061 }
7062 }
7063
nl80211_reload_regdb(struct sk_buff * skb,struct genl_info * info)7064 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
7065 {
7066 return reg_reload_regdb();
7067 }
7068
nl80211_get_mesh_config(struct sk_buff * skb,struct genl_info * info)7069 static int nl80211_get_mesh_config(struct sk_buff *skb,
7070 struct genl_info *info)
7071 {
7072 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7073 struct net_device *dev = info->user_ptr[1];
7074 struct wireless_dev *wdev = dev->ieee80211_ptr;
7075 struct mesh_config cur_params;
7076 int err = 0;
7077 void *hdr;
7078 struct nlattr *pinfoattr;
7079 struct sk_buff *msg;
7080
7081 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
7082 return -EOPNOTSUPP;
7083
7084 if (!rdev->ops->get_mesh_config)
7085 return -EOPNOTSUPP;
7086
7087 wdev_lock(wdev);
7088 /* If not connected, get default parameters */
7089 if (!wdev->mesh_id_len)
7090 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
7091 else
7092 err = rdev_get_mesh_config(rdev, dev, &cur_params);
7093 wdev_unlock(wdev);
7094
7095 if (err)
7096 return err;
7097
7098 /* Draw up a netlink message to send back */
7099 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7100 if (!msg)
7101 return -ENOMEM;
7102 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7103 NL80211_CMD_GET_MESH_CONFIG);
7104 if (!hdr)
7105 goto out;
7106 pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MESH_CONFIG);
7107 if (!pinfoattr)
7108 goto nla_put_failure;
7109 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
7110 nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
7111 cur_params.dot11MeshRetryTimeout) ||
7112 nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
7113 cur_params.dot11MeshConfirmTimeout) ||
7114 nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
7115 cur_params.dot11MeshHoldingTimeout) ||
7116 nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
7117 cur_params.dot11MeshMaxPeerLinks) ||
7118 nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
7119 cur_params.dot11MeshMaxRetries) ||
7120 nla_put_u8(msg, NL80211_MESHCONF_TTL,
7121 cur_params.dot11MeshTTL) ||
7122 nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
7123 cur_params.element_ttl) ||
7124 nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
7125 cur_params.auto_open_plinks) ||
7126 nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
7127 cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
7128 nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
7129 cur_params.dot11MeshHWMPmaxPREQretries) ||
7130 nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
7131 cur_params.path_refresh_time) ||
7132 nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
7133 cur_params.min_discovery_timeout) ||
7134 nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
7135 cur_params.dot11MeshHWMPactivePathTimeout) ||
7136 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
7137 cur_params.dot11MeshHWMPpreqMinInterval) ||
7138 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
7139 cur_params.dot11MeshHWMPperrMinInterval) ||
7140 nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
7141 cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
7142 nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
7143 cur_params.dot11MeshHWMPRootMode) ||
7144 nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
7145 cur_params.dot11MeshHWMPRannInterval) ||
7146 nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
7147 cur_params.dot11MeshGateAnnouncementProtocol) ||
7148 nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
7149 cur_params.dot11MeshForwarding) ||
7150 nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
7151 cur_params.rssi_threshold) ||
7152 nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
7153 cur_params.ht_opmode) ||
7154 nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
7155 cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
7156 nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
7157 cur_params.dot11MeshHWMProotInterval) ||
7158 nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
7159 cur_params.dot11MeshHWMPconfirmationInterval) ||
7160 nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
7161 cur_params.power_mode) ||
7162 nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
7163 cur_params.dot11MeshAwakeWindowDuration) ||
7164 nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
7165 cur_params.plink_timeout) ||
7166 nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_GATE,
7167 cur_params.dot11MeshConnectedToMeshGate) ||
7168 nla_put_u8(msg, NL80211_MESHCONF_NOLEARN,
7169 cur_params.dot11MeshNolearn) ||
7170 nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_AS,
7171 cur_params.dot11MeshConnectedToAuthServer))
7172 goto nla_put_failure;
7173 nla_nest_end(msg, pinfoattr);
7174 genlmsg_end(msg, hdr);
7175 return genlmsg_reply(msg, info);
7176
7177 nla_put_failure:
7178 out:
7179 nlmsg_free(msg);
7180 return -ENOBUFS;
7181 }
7182
7183 static const struct nla_policy
7184 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
7185 [NL80211_MESHCONF_RETRY_TIMEOUT] =
7186 NLA_POLICY_RANGE(NLA_U16, 1, 255),
7187 [NL80211_MESHCONF_CONFIRM_TIMEOUT] =
7188 NLA_POLICY_RANGE(NLA_U16, 1, 255),
7189 [NL80211_MESHCONF_HOLDING_TIMEOUT] =
7190 NLA_POLICY_RANGE(NLA_U16, 1, 255),
7191 [NL80211_MESHCONF_MAX_PEER_LINKS] =
7192 NLA_POLICY_RANGE(NLA_U16, 0, 255),
7193 [NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16),
7194 [NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
7195 [NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
7196 [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1),
7197 [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] =
7198 NLA_POLICY_RANGE(NLA_U32, 1, 255),
7199 [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
7200 [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
7201 [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1),
7202 [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
7203 [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] =
7204 NLA_POLICY_MIN(NLA_U16, 1),
7205 [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] =
7206 NLA_POLICY_MIN(NLA_U16, 1),
7207 [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] =
7208 NLA_POLICY_MIN(NLA_U16, 1),
7209 [NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4),
7210 [NL80211_MESHCONF_HWMP_RANN_INTERVAL] =
7211 NLA_POLICY_MIN(NLA_U16, 1),
7212 [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1),
7213 [NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1),
7214 [NL80211_MESHCONF_RSSI_THRESHOLD] =
7215 NLA_POLICY_RANGE(NLA_S32, -255, 0),
7216 [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
7217 [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
7218 [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] =
7219 NLA_POLICY_MIN(NLA_U16, 1),
7220 [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] =
7221 NLA_POLICY_MIN(NLA_U16, 1),
7222 [NL80211_MESHCONF_POWER_MODE] =
7223 NLA_POLICY_RANGE(NLA_U32,
7224 NL80211_MESH_POWER_ACTIVE,
7225 NL80211_MESH_POWER_MAX),
7226 [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
7227 [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
7228 [NL80211_MESHCONF_CONNECTED_TO_GATE] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
7229 [NL80211_MESHCONF_NOLEARN] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
7230 [NL80211_MESHCONF_CONNECTED_TO_AS] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
7231 };
7232
7233 static const struct nla_policy
7234 nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
7235 [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
7236 [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
7237 [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
7238 [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
7239 [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
7240 [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
7241 [NL80211_MESH_SETUP_IE] =
7242 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
7243 IEEE80211_MAX_DATA_LEN),
7244 [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
7245 };
7246
nl80211_parse_mesh_config(struct genl_info * info,struct mesh_config * cfg,u32 * mask_out)7247 static int nl80211_parse_mesh_config(struct genl_info *info,
7248 struct mesh_config *cfg,
7249 u32 *mask_out)
7250 {
7251 struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
7252 u32 mask = 0;
7253 u16 ht_opmode;
7254
7255 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn) \
7256 do { \
7257 if (tb[attr]) { \
7258 cfg->param = fn(tb[attr]); \
7259 mask |= BIT((attr) - 1); \
7260 } \
7261 } while (0)
7262
7263 if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
7264 return -EINVAL;
7265 if (nla_parse_nested_deprecated(tb, NL80211_MESHCONF_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_CONFIG], nl80211_meshconf_params_policy, info->extack))
7266 return -EINVAL;
7267
7268 /* This makes sure that there aren't more than 32 mesh config
7269 * parameters (otherwise our bitfield scheme would not work.) */
7270 BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
7271
7272 /* Fill in the params struct */
7273 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask,
7274 NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
7275 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask,
7276 NL80211_MESHCONF_CONFIRM_TIMEOUT,
7277 nla_get_u16);
7278 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask,
7279 NL80211_MESHCONF_HOLDING_TIMEOUT,
7280 nla_get_u16);
7281 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask,
7282 NL80211_MESHCONF_MAX_PEER_LINKS,
7283 nla_get_u16);
7284 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask,
7285 NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
7286 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask,
7287 NL80211_MESHCONF_TTL, nla_get_u8);
7288 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask,
7289 NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
7290 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask,
7291 NL80211_MESHCONF_AUTO_OPEN_PLINKS,
7292 nla_get_u8);
7293 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
7294 mask,
7295 NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
7296 nla_get_u32);
7297 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask,
7298 NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
7299 nla_get_u8);
7300 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask,
7301 NL80211_MESHCONF_PATH_REFRESH_TIME,
7302 nla_get_u32);
7303 if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) &&
7304 (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535))
7305 return -EINVAL;
7306 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask,
7307 NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
7308 nla_get_u16);
7309 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
7310 mask,
7311 NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
7312 nla_get_u32);
7313 if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) &&
7314 (cfg->dot11MeshHWMPactivePathTimeout < 1 ||
7315 cfg->dot11MeshHWMPactivePathTimeout > 65535))
7316 return -EINVAL;
7317 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask,
7318 NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
7319 nla_get_u16);
7320 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask,
7321 NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
7322 nla_get_u16);
7323 FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
7324 dot11MeshHWMPnetDiameterTraversalTime, mask,
7325 NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
7326 nla_get_u16);
7327 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
7328 NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
7329 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
7330 NL80211_MESHCONF_HWMP_RANN_INTERVAL,
7331 nla_get_u16);
7332 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol,
7333 mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
7334 nla_get_u8);
7335 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask,
7336 NL80211_MESHCONF_FORWARDING, nla_get_u8);
7337 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask,
7338 NL80211_MESHCONF_RSSI_THRESHOLD,
7339 nla_get_s32);
7340 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToMeshGate, mask,
7341 NL80211_MESHCONF_CONNECTED_TO_GATE,
7342 nla_get_u8);
7343 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToAuthServer, mask,
7344 NL80211_MESHCONF_CONNECTED_TO_AS,
7345 nla_get_u8);
7346 /*
7347 * Check HT operation mode based on
7348 * IEEE 802.11-2016 9.4.2.57 HT Operation element.
7349 */
7350 if (tb[NL80211_MESHCONF_HT_OPMODE]) {
7351 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
7352
7353 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
7354 IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
7355 IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
7356 return -EINVAL;
7357
7358 /* NON_HT_STA bit is reserved, but some programs set it */
7359 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
7360
7361 cfg->ht_opmode = ht_opmode;
7362 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
7363 }
7364 FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
7365 dot11MeshHWMPactivePathToRootTimeout, mask,
7366 NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
7367 nla_get_u32);
7368 if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) &&
7369 (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 ||
7370 cfg->dot11MeshHWMPactivePathToRootTimeout > 65535))
7371 return -EINVAL;
7372 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask,
7373 NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
7374 nla_get_u16);
7375 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval,
7376 mask,
7377 NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
7378 nla_get_u16);
7379 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask,
7380 NL80211_MESHCONF_POWER_MODE, nla_get_u32);
7381 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask,
7382 NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
7383 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask,
7384 NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32);
7385 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNolearn, mask,
7386 NL80211_MESHCONF_NOLEARN, nla_get_u8);
7387 if (mask_out)
7388 *mask_out = mask;
7389
7390 return 0;
7391
7392 #undef FILL_IN_MESH_PARAM_IF_SET
7393 }
7394
nl80211_parse_mesh_setup(struct genl_info * info,struct mesh_setup * setup)7395 static int nl80211_parse_mesh_setup(struct genl_info *info,
7396 struct mesh_setup *setup)
7397 {
7398 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7399 struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
7400
7401 if (!info->attrs[NL80211_ATTR_MESH_SETUP])
7402 return -EINVAL;
7403 if (nla_parse_nested_deprecated(tb, NL80211_MESH_SETUP_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_SETUP], nl80211_mesh_setup_params_policy, info->extack))
7404 return -EINVAL;
7405
7406 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
7407 setup->sync_method =
7408 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
7409 IEEE80211_SYNC_METHOD_VENDOR :
7410 IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
7411
7412 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
7413 setup->path_sel_proto =
7414 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
7415 IEEE80211_PATH_PROTOCOL_VENDOR :
7416 IEEE80211_PATH_PROTOCOL_HWMP;
7417
7418 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
7419 setup->path_metric =
7420 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
7421 IEEE80211_PATH_METRIC_VENDOR :
7422 IEEE80211_PATH_METRIC_AIRTIME;
7423
7424 if (tb[NL80211_MESH_SETUP_IE]) {
7425 struct nlattr *ieattr =
7426 tb[NL80211_MESH_SETUP_IE];
7427 setup->ie = nla_data(ieattr);
7428 setup->ie_len = nla_len(ieattr);
7429 }
7430 if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
7431 !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
7432 return -EINVAL;
7433 setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
7434 setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
7435 setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
7436 if (setup->is_secure)
7437 setup->user_mpm = true;
7438
7439 if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
7440 if (!setup->user_mpm)
7441 return -EINVAL;
7442 setup->auth_id =
7443 nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
7444 }
7445
7446 return 0;
7447 }
7448
nl80211_update_mesh_config(struct sk_buff * skb,struct genl_info * info)7449 static int nl80211_update_mesh_config(struct sk_buff *skb,
7450 struct genl_info *info)
7451 {
7452 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7453 struct net_device *dev = info->user_ptr[1];
7454 struct wireless_dev *wdev = dev->ieee80211_ptr;
7455 struct mesh_config cfg;
7456 u32 mask;
7457 int err;
7458
7459 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
7460 return -EOPNOTSUPP;
7461
7462 if (!rdev->ops->update_mesh_config)
7463 return -EOPNOTSUPP;
7464
7465 err = nl80211_parse_mesh_config(info, &cfg, &mask);
7466 if (err)
7467 return err;
7468
7469 wdev_lock(wdev);
7470 if (!wdev->mesh_id_len)
7471 err = -ENOLINK;
7472
7473 if (!err)
7474 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
7475
7476 wdev_unlock(wdev);
7477
7478 return err;
7479 }
7480
nl80211_put_regdom(const struct ieee80211_regdomain * regdom,struct sk_buff * msg)7481 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
7482 struct sk_buff *msg)
7483 {
7484 struct nlattr *nl_reg_rules;
7485 unsigned int i;
7486
7487 if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
7488 (regdom->dfs_region &&
7489 nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
7490 goto nla_put_failure;
7491
7492 nl_reg_rules = nla_nest_start_noflag(msg, NL80211_ATTR_REG_RULES);
7493 if (!nl_reg_rules)
7494 goto nla_put_failure;
7495
7496 for (i = 0; i < regdom->n_reg_rules; i++) {
7497 struct nlattr *nl_reg_rule;
7498 const struct ieee80211_reg_rule *reg_rule;
7499 const struct ieee80211_freq_range *freq_range;
7500 const struct ieee80211_power_rule *power_rule;
7501 unsigned int max_bandwidth_khz;
7502
7503 reg_rule = ®dom->reg_rules[i];
7504 freq_range = ®_rule->freq_range;
7505 power_rule = ®_rule->power_rule;
7506
7507 nl_reg_rule = nla_nest_start_noflag(msg, i);
7508 if (!nl_reg_rule)
7509 goto nla_put_failure;
7510
7511 max_bandwidth_khz = freq_range->max_bandwidth_khz;
7512 if (!max_bandwidth_khz)
7513 max_bandwidth_khz = reg_get_max_bandwidth(regdom,
7514 reg_rule);
7515
7516 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
7517 reg_rule->flags) ||
7518 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
7519 freq_range->start_freq_khz) ||
7520 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
7521 freq_range->end_freq_khz) ||
7522 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
7523 max_bandwidth_khz) ||
7524 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
7525 power_rule->max_antenna_gain) ||
7526 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
7527 power_rule->max_eirp) ||
7528 nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
7529 reg_rule->dfs_cac_ms))
7530 goto nla_put_failure;
7531
7532 nla_nest_end(msg, nl_reg_rule);
7533 }
7534
7535 nla_nest_end(msg, nl_reg_rules);
7536 return 0;
7537
7538 nla_put_failure:
7539 return -EMSGSIZE;
7540 }
7541
nl80211_get_reg_do(struct sk_buff * skb,struct genl_info * info)7542 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
7543 {
7544 const struct ieee80211_regdomain *regdom = NULL;
7545 struct cfg80211_registered_device *rdev;
7546 struct wiphy *wiphy = NULL;
7547 struct sk_buff *msg;
7548 void *hdr;
7549
7550 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7551 if (!msg)
7552 return -ENOBUFS;
7553
7554 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7555 NL80211_CMD_GET_REG);
7556 if (!hdr)
7557 goto put_failure;
7558
7559 if (info->attrs[NL80211_ATTR_WIPHY]) {
7560 bool self_managed;
7561
7562 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
7563 if (IS_ERR(rdev)) {
7564 nlmsg_free(msg);
7565 return PTR_ERR(rdev);
7566 }
7567
7568 wiphy = &rdev->wiphy;
7569 self_managed = wiphy->regulatory_flags &
7570 REGULATORY_WIPHY_SELF_MANAGED;
7571 regdom = get_wiphy_regdom(wiphy);
7572
7573 /* a self-managed-reg device must have a private regdom */
7574 if (WARN_ON(!regdom && self_managed)) {
7575 nlmsg_free(msg);
7576 return -EINVAL;
7577 }
7578
7579 if (regdom &&
7580 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
7581 goto nla_put_failure;
7582 }
7583
7584 if (!wiphy && reg_last_request_cell_base() &&
7585 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
7586 NL80211_USER_REG_HINT_CELL_BASE))
7587 goto nla_put_failure;
7588
7589 rcu_read_lock();
7590
7591 if (!regdom)
7592 regdom = rcu_dereference(cfg80211_regdomain);
7593
7594 if (nl80211_put_regdom(regdom, msg))
7595 goto nla_put_failure_rcu;
7596
7597 rcu_read_unlock();
7598
7599 genlmsg_end(msg, hdr);
7600 return genlmsg_reply(msg, info);
7601
7602 nla_put_failure_rcu:
7603 rcu_read_unlock();
7604 nla_put_failure:
7605 put_failure:
7606 nlmsg_free(msg);
7607 return -EMSGSIZE;
7608 }
7609
nl80211_send_regdom(struct sk_buff * msg,struct netlink_callback * cb,u32 seq,int flags,struct wiphy * wiphy,const struct ieee80211_regdomain * regdom)7610 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
7611 u32 seq, int flags, struct wiphy *wiphy,
7612 const struct ieee80211_regdomain *regdom)
7613 {
7614 void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
7615 NL80211_CMD_GET_REG);
7616
7617 if (!hdr)
7618 return -1;
7619
7620 genl_dump_check_consistent(cb, hdr);
7621
7622 if (nl80211_put_regdom(regdom, msg))
7623 goto nla_put_failure;
7624
7625 if (!wiphy && reg_last_request_cell_base() &&
7626 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
7627 NL80211_USER_REG_HINT_CELL_BASE))
7628 goto nla_put_failure;
7629
7630 if (wiphy &&
7631 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
7632 goto nla_put_failure;
7633
7634 if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
7635 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
7636 goto nla_put_failure;
7637
7638 genlmsg_end(msg, hdr);
7639 return 0;
7640
7641 nla_put_failure:
7642 genlmsg_cancel(msg, hdr);
7643 return -EMSGSIZE;
7644 }
7645
nl80211_get_reg_dump(struct sk_buff * skb,struct netlink_callback * cb)7646 static int nl80211_get_reg_dump(struct sk_buff *skb,
7647 struct netlink_callback *cb)
7648 {
7649 const struct ieee80211_regdomain *regdom = NULL;
7650 struct cfg80211_registered_device *rdev;
7651 int err, reg_idx, start = cb->args[2];
7652
7653 rtnl_lock();
7654
7655 if (cfg80211_regdomain && start == 0) {
7656 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
7657 NLM_F_MULTI, NULL,
7658 rtnl_dereference(cfg80211_regdomain));
7659 if (err < 0)
7660 goto out_err;
7661 }
7662
7663 /* the global regdom is idx 0 */
7664 reg_idx = 1;
7665 list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
7666 regdom = get_wiphy_regdom(&rdev->wiphy);
7667 if (!regdom)
7668 continue;
7669
7670 if (++reg_idx <= start)
7671 continue;
7672
7673 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
7674 NLM_F_MULTI, &rdev->wiphy, regdom);
7675 if (err < 0) {
7676 reg_idx--;
7677 break;
7678 }
7679 }
7680
7681 cb->args[2] = reg_idx;
7682 err = skb->len;
7683 out_err:
7684 rtnl_unlock();
7685 return err;
7686 }
7687
7688 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
7689 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
7690 [NL80211_ATTR_REG_RULE_FLAGS] = { .type = NLA_U32 },
7691 [NL80211_ATTR_FREQ_RANGE_START] = { .type = NLA_U32 },
7692 [NL80211_ATTR_FREQ_RANGE_END] = { .type = NLA_U32 },
7693 [NL80211_ATTR_FREQ_RANGE_MAX_BW] = { .type = NLA_U32 },
7694 [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN] = { .type = NLA_U32 },
7695 [NL80211_ATTR_POWER_RULE_MAX_EIRP] = { .type = NLA_U32 },
7696 [NL80211_ATTR_DFS_CAC_TIME] = { .type = NLA_U32 },
7697 };
7698
parse_reg_rule(struct nlattr * tb[],struct ieee80211_reg_rule * reg_rule)7699 static int parse_reg_rule(struct nlattr *tb[],
7700 struct ieee80211_reg_rule *reg_rule)
7701 {
7702 struct ieee80211_freq_range *freq_range = ®_rule->freq_range;
7703 struct ieee80211_power_rule *power_rule = ®_rule->power_rule;
7704
7705 if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
7706 return -EINVAL;
7707 if (!tb[NL80211_ATTR_FREQ_RANGE_START])
7708 return -EINVAL;
7709 if (!tb[NL80211_ATTR_FREQ_RANGE_END])
7710 return -EINVAL;
7711 if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
7712 return -EINVAL;
7713 if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
7714 return -EINVAL;
7715
7716 reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
7717
7718 freq_range->start_freq_khz =
7719 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
7720 freq_range->end_freq_khz =
7721 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
7722 freq_range->max_bandwidth_khz =
7723 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
7724
7725 power_rule->max_eirp =
7726 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
7727
7728 if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
7729 power_rule->max_antenna_gain =
7730 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
7731
7732 if (tb[NL80211_ATTR_DFS_CAC_TIME])
7733 reg_rule->dfs_cac_ms =
7734 nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
7735
7736 return 0;
7737 }
7738
nl80211_set_reg(struct sk_buff * skb,struct genl_info * info)7739 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
7740 {
7741 struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
7742 struct nlattr *nl_reg_rule;
7743 char *alpha2;
7744 int rem_reg_rules, r;
7745 u32 num_rules = 0, rule_idx = 0;
7746 enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
7747 struct ieee80211_regdomain *rd;
7748
7749 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
7750 return -EINVAL;
7751
7752 if (!info->attrs[NL80211_ATTR_REG_RULES])
7753 return -EINVAL;
7754
7755 alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
7756
7757 if (info->attrs[NL80211_ATTR_DFS_REGION])
7758 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
7759
7760 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
7761 rem_reg_rules) {
7762 num_rules++;
7763 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
7764 return -EINVAL;
7765 }
7766
7767 if (!reg_is_valid_request(alpha2))
7768 return -EINVAL;
7769
7770 rd = kzalloc(struct_size(rd, reg_rules, num_rules), GFP_KERNEL);
7771 if (!rd)
7772 return -ENOMEM;
7773
7774 rd->n_reg_rules = num_rules;
7775 rd->alpha2[0] = alpha2[0];
7776 rd->alpha2[1] = alpha2[1];
7777
7778 /*
7779 * Disable DFS master mode if the DFS region was
7780 * not supported or known on this kernel.
7781 */
7782 if (reg_supported_dfs_region(dfs_region))
7783 rd->dfs_region = dfs_region;
7784
7785 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
7786 rem_reg_rules) {
7787 r = nla_parse_nested_deprecated(tb, NL80211_REG_RULE_ATTR_MAX,
7788 nl_reg_rule, reg_rule_policy,
7789 info->extack);
7790 if (r)
7791 goto bad_reg;
7792 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
7793 if (r)
7794 goto bad_reg;
7795
7796 rule_idx++;
7797
7798 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
7799 r = -EINVAL;
7800 goto bad_reg;
7801 }
7802 }
7803
7804 /* set_regdom takes ownership of rd */
7805 return set_regdom(rd, REGD_SOURCE_CRDA);
7806 bad_reg:
7807 kfree(rd);
7808 return r;
7809 }
7810 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
7811
validate_scan_freqs(struct nlattr * freqs)7812 static int validate_scan_freqs(struct nlattr *freqs)
7813 {
7814 struct nlattr *attr1, *attr2;
7815 int n_channels = 0, tmp1, tmp2;
7816
7817 nla_for_each_nested(attr1, freqs, tmp1)
7818 if (nla_len(attr1) != sizeof(u32))
7819 return 0;
7820
7821 nla_for_each_nested(attr1, freqs, tmp1) {
7822 n_channels++;
7823 /*
7824 * Some hardware has a limited channel list for
7825 * scanning, and it is pretty much nonsensical
7826 * to scan for a channel twice, so disallow that
7827 * and don't require drivers to check that the
7828 * channel list they get isn't longer than what
7829 * they can scan, as long as they can scan all
7830 * the channels they registered at once.
7831 */
7832 nla_for_each_nested(attr2, freqs, tmp2)
7833 if (attr1 != attr2 &&
7834 nla_get_u32(attr1) == nla_get_u32(attr2))
7835 return 0;
7836 }
7837
7838 return n_channels;
7839 }
7840
is_band_valid(struct wiphy * wiphy,enum nl80211_band b)7841 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
7842 {
7843 return b < NUM_NL80211_BANDS && wiphy->bands[b];
7844 }
7845
parse_bss_select(struct nlattr * nla,struct wiphy * wiphy,struct cfg80211_bss_selection * bss_select)7846 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
7847 struct cfg80211_bss_selection *bss_select)
7848 {
7849 struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
7850 struct nlattr *nest;
7851 int err;
7852 bool found = false;
7853 int i;
7854
7855 /* only process one nested attribute */
7856 nest = nla_data(nla);
7857 if (!nla_ok(nest, nla_len(nest)))
7858 return -EINVAL;
7859
7860 err = nla_parse_nested_deprecated(attr, NL80211_BSS_SELECT_ATTR_MAX,
7861 nest, nl80211_bss_select_policy,
7862 NULL);
7863 if (err)
7864 return err;
7865
7866 /* only one attribute may be given */
7867 for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
7868 if (attr[i]) {
7869 if (found)
7870 return -EINVAL;
7871 found = true;
7872 }
7873 }
7874
7875 bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
7876
7877 if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
7878 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
7879
7880 if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
7881 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
7882 bss_select->param.band_pref =
7883 nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
7884 if (!is_band_valid(wiphy, bss_select->param.band_pref))
7885 return -EINVAL;
7886 }
7887
7888 if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
7889 struct nl80211_bss_select_rssi_adjust *adj_param;
7890
7891 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
7892 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
7893 bss_select->param.adjust.band = adj_param->band;
7894 bss_select->param.adjust.delta = adj_param->delta;
7895 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
7896 return -EINVAL;
7897 }
7898
7899 /* user-space did not provide behaviour attribute */
7900 if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
7901 return -EINVAL;
7902
7903 if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
7904 return -EINVAL;
7905
7906 return 0;
7907 }
7908
nl80211_parse_random_mac(struct nlattr ** attrs,u8 * mac_addr,u8 * mac_addr_mask)7909 int nl80211_parse_random_mac(struct nlattr **attrs,
7910 u8 *mac_addr, u8 *mac_addr_mask)
7911 {
7912 int i;
7913
7914 if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
7915 eth_zero_addr(mac_addr);
7916 eth_zero_addr(mac_addr_mask);
7917 mac_addr[0] = 0x2;
7918 mac_addr_mask[0] = 0x3;
7919
7920 return 0;
7921 }
7922
7923 /* need both or none */
7924 if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
7925 return -EINVAL;
7926
7927 memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
7928 memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
7929
7930 /* don't allow or configure an mcast address */
7931 if (!is_multicast_ether_addr(mac_addr_mask) ||
7932 is_multicast_ether_addr(mac_addr))
7933 return -EINVAL;
7934
7935 /*
7936 * allow users to pass a MAC address that has bits set outside
7937 * of the mask, but don't bother drivers with having to deal
7938 * with such bits
7939 */
7940 for (i = 0; i < ETH_ALEN; i++)
7941 mac_addr[i] &= mac_addr_mask[i];
7942
7943 return 0;
7944 }
7945
cfg80211_off_channel_oper_allowed(struct wireless_dev * wdev)7946 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev)
7947 {
7948 ASSERT_WDEV_LOCK(wdev);
7949
7950 if (!cfg80211_beaconing_iface_active(wdev))
7951 return true;
7952
7953 if (!(wdev->chandef.chan->flags & IEEE80211_CHAN_RADAR))
7954 return true;
7955
7956 return regulatory_pre_cac_allowed(wdev->wiphy);
7957 }
7958
nl80211_check_scan_feat(struct wiphy * wiphy,u32 flags,u32 flag,enum nl80211_ext_feature_index feat)7959 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag,
7960 enum nl80211_ext_feature_index feat)
7961 {
7962 if (!(flags & flag))
7963 return true;
7964 if (wiphy_ext_feature_isset(wiphy, feat))
7965 return true;
7966 return false;
7967 }
7968
7969 static int
nl80211_check_scan_flags(struct wiphy * wiphy,struct wireless_dev * wdev,void * request,struct nlattr ** attrs,bool is_sched_scan)7970 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
7971 void *request, struct nlattr **attrs,
7972 bool is_sched_scan)
7973 {
7974 u8 *mac_addr, *mac_addr_mask;
7975 u32 *flags;
7976 enum nl80211_feature_flags randomness_flag;
7977
7978 if (!attrs[NL80211_ATTR_SCAN_FLAGS])
7979 return 0;
7980
7981 if (is_sched_scan) {
7982 struct cfg80211_sched_scan_request *req = request;
7983
7984 randomness_flag = wdev ?
7985 NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
7986 NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
7987 flags = &req->flags;
7988 mac_addr = req->mac_addr;
7989 mac_addr_mask = req->mac_addr_mask;
7990 } else {
7991 struct cfg80211_scan_request *req = request;
7992
7993 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
7994 flags = &req->flags;
7995 mac_addr = req->mac_addr;
7996 mac_addr_mask = req->mac_addr_mask;
7997 }
7998
7999 *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
8000
8001 if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
8002 !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
8003 !nl80211_check_scan_feat(wiphy, *flags,
8004 NL80211_SCAN_FLAG_LOW_SPAN,
8005 NL80211_EXT_FEATURE_LOW_SPAN_SCAN) ||
8006 !nl80211_check_scan_feat(wiphy, *flags,
8007 NL80211_SCAN_FLAG_LOW_POWER,
8008 NL80211_EXT_FEATURE_LOW_POWER_SCAN) ||
8009 !nl80211_check_scan_feat(wiphy, *flags,
8010 NL80211_SCAN_FLAG_HIGH_ACCURACY,
8011 NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) ||
8012 !nl80211_check_scan_feat(wiphy, *flags,
8013 NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME,
8014 NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) ||
8015 !nl80211_check_scan_feat(wiphy, *flags,
8016 NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP,
8017 NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) ||
8018 !nl80211_check_scan_feat(wiphy, *flags,
8019 NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION,
8020 NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) ||
8021 !nl80211_check_scan_feat(wiphy, *flags,
8022 NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE,
8023 NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) ||
8024 !nl80211_check_scan_feat(wiphy, *flags,
8025 NL80211_SCAN_FLAG_RANDOM_SN,
8026 NL80211_EXT_FEATURE_SCAN_RANDOM_SN) ||
8027 !nl80211_check_scan_feat(wiphy, *flags,
8028 NL80211_SCAN_FLAG_MIN_PREQ_CONTENT,
8029 NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT))
8030 return -EOPNOTSUPP;
8031
8032 if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
8033 int err;
8034
8035 if (!(wiphy->features & randomness_flag) ||
8036 (wdev && wdev->current_bss))
8037 return -EOPNOTSUPP;
8038
8039 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
8040 if (err)
8041 return err;
8042 }
8043
8044 return 0;
8045 }
8046
nl80211_trigger_scan(struct sk_buff * skb,struct genl_info * info)8047 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
8048 {
8049 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8050 struct wireless_dev *wdev = info->user_ptr[1];
8051 struct cfg80211_scan_request *request;
8052 struct nlattr *scan_freqs = NULL;
8053 bool scan_freqs_khz = false;
8054 struct nlattr *attr;
8055 struct wiphy *wiphy;
8056 int err, tmp, n_ssids = 0, n_channels, i;
8057 size_t ie_len;
8058
8059 wiphy = &rdev->wiphy;
8060
8061 if (wdev->iftype == NL80211_IFTYPE_NAN)
8062 return -EOPNOTSUPP;
8063
8064 if (!rdev->ops->scan)
8065 return -EOPNOTSUPP;
8066
8067 if (rdev->scan_req || rdev->scan_msg)
8068 return -EBUSY;
8069
8070 if (info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ]) {
8071 if (!wiphy_ext_feature_isset(wiphy,
8072 NL80211_EXT_FEATURE_SCAN_FREQ_KHZ))
8073 return -EOPNOTSUPP;
8074 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ];
8075 scan_freqs_khz = true;
8076 } else if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES])
8077 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQUENCIES];
8078
8079 if (scan_freqs) {
8080 n_channels = validate_scan_freqs(scan_freqs);
8081 if (!n_channels)
8082 return -EINVAL;
8083 } else {
8084 n_channels = ieee80211_get_num_supported_channels(wiphy);
8085 }
8086
8087 if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
8088 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
8089 n_ssids++;
8090
8091 if (n_ssids > wiphy->max_scan_ssids)
8092 return -EINVAL;
8093
8094 if (info->attrs[NL80211_ATTR_IE])
8095 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8096 else
8097 ie_len = 0;
8098
8099 if (ie_len > wiphy->max_scan_ie_len)
8100 return -EINVAL;
8101
8102 request = kzalloc(sizeof(*request)
8103 + sizeof(*request->ssids) * n_ssids
8104 + sizeof(*request->channels) * n_channels
8105 + ie_len, GFP_KERNEL);
8106 if (!request)
8107 return -ENOMEM;
8108
8109 if (n_ssids)
8110 request->ssids = (void *)&request->channels[n_channels];
8111 request->n_ssids = n_ssids;
8112 if (ie_len) {
8113 if (n_ssids)
8114 request->ie = (void *)(request->ssids + n_ssids);
8115 else
8116 request->ie = (void *)(request->channels + n_channels);
8117 }
8118
8119 i = 0;
8120 if (scan_freqs) {
8121 /* user specified, bail out if channel not found */
8122 nla_for_each_nested(attr, scan_freqs, tmp) {
8123 struct ieee80211_channel *chan;
8124 int freq = nla_get_u32(attr);
8125
8126 if (!scan_freqs_khz)
8127 freq = MHZ_TO_KHZ(freq);
8128
8129 chan = ieee80211_get_channel_khz(wiphy, freq);
8130 if (!chan) {
8131 err = -EINVAL;
8132 goto out_free;
8133 }
8134
8135 /* ignore disabled channels */
8136 if (chan->flags & IEEE80211_CHAN_DISABLED)
8137 continue;
8138
8139 request->channels[i] = chan;
8140 i++;
8141 }
8142 } else {
8143 enum nl80211_band band;
8144
8145 /* all channels */
8146 for (band = 0; band < NUM_NL80211_BANDS; band++) {
8147 int j;
8148
8149 if (!wiphy->bands[band])
8150 continue;
8151 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
8152 struct ieee80211_channel *chan;
8153
8154 chan = &wiphy->bands[band]->channels[j];
8155
8156 if (chan->flags & IEEE80211_CHAN_DISABLED)
8157 continue;
8158
8159 request->channels[i] = chan;
8160 i++;
8161 }
8162 }
8163 }
8164
8165 if (!i) {
8166 err = -EINVAL;
8167 goto out_free;
8168 }
8169
8170 request->n_channels = i;
8171
8172 wdev_lock(wdev);
8173 if (!cfg80211_off_channel_oper_allowed(wdev)) {
8174 struct ieee80211_channel *chan;
8175
8176 if (request->n_channels != 1) {
8177 wdev_unlock(wdev);
8178 err = -EBUSY;
8179 goto out_free;
8180 }
8181
8182 chan = request->channels[0];
8183 if (chan->center_freq != wdev->chandef.chan->center_freq) {
8184 wdev_unlock(wdev);
8185 err = -EBUSY;
8186 goto out_free;
8187 }
8188 }
8189 wdev_unlock(wdev);
8190
8191 i = 0;
8192 if (n_ssids) {
8193 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
8194 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
8195 err = -EINVAL;
8196 goto out_free;
8197 }
8198 request->ssids[i].ssid_len = nla_len(attr);
8199 memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
8200 i++;
8201 }
8202 }
8203
8204 if (info->attrs[NL80211_ATTR_IE]) {
8205 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8206 memcpy((void *)request->ie,
8207 nla_data(info->attrs[NL80211_ATTR_IE]),
8208 request->ie_len);
8209 }
8210
8211 for (i = 0; i < NUM_NL80211_BANDS; i++)
8212 if (wiphy->bands[i])
8213 request->rates[i] =
8214 (1 << wiphy->bands[i]->n_bitrates) - 1;
8215
8216 if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
8217 nla_for_each_nested(attr,
8218 info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
8219 tmp) {
8220 enum nl80211_band band = nla_type(attr);
8221
8222 if (band < 0 || band >= NUM_NL80211_BANDS) {
8223 err = -EINVAL;
8224 goto out_free;
8225 }
8226
8227 if (!wiphy->bands[band])
8228 continue;
8229
8230 err = ieee80211_get_ratemask(wiphy->bands[band],
8231 nla_data(attr),
8232 nla_len(attr),
8233 &request->rates[band]);
8234 if (err)
8235 goto out_free;
8236 }
8237 }
8238
8239 if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
8240 if (!wiphy_ext_feature_isset(wiphy,
8241 NL80211_EXT_FEATURE_SET_SCAN_DWELL)) {
8242 err = -EOPNOTSUPP;
8243 goto out_free;
8244 }
8245
8246 request->duration =
8247 nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
8248 request->duration_mandatory =
8249 nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
8250 }
8251
8252 err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs,
8253 false);
8254 if (err)
8255 goto out_free;
8256
8257 request->no_cck =
8258 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
8259
8260 /* Initial implementation used NL80211_ATTR_MAC to set the specific
8261 * BSSID to scan for. This was problematic because that same attribute
8262 * was already used for another purpose (local random MAC address). The
8263 * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
8264 * compatibility with older userspace components, also use the
8265 * NL80211_ATTR_MAC value here if it can be determined to be used for
8266 * the specific BSSID use case instead of the random MAC address
8267 * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
8268 */
8269 if (info->attrs[NL80211_ATTR_BSSID])
8270 memcpy(request->bssid,
8271 nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
8272 else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
8273 info->attrs[NL80211_ATTR_MAC])
8274 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
8275 ETH_ALEN);
8276 else
8277 eth_broadcast_addr(request->bssid);
8278
8279 request->wdev = wdev;
8280 request->wiphy = &rdev->wiphy;
8281 request->scan_start = jiffies;
8282
8283 rdev->scan_req = request;
8284 err = cfg80211_scan(rdev);
8285
8286 if (err)
8287 goto out_free;
8288
8289 nl80211_send_scan_start(rdev, wdev);
8290 if (wdev->netdev)
8291 dev_hold(wdev->netdev);
8292
8293 return 0;
8294
8295 out_free:
8296 rdev->scan_req = NULL;
8297 kfree(request);
8298
8299 return err;
8300 }
8301
nl80211_abort_scan(struct sk_buff * skb,struct genl_info * info)8302 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
8303 {
8304 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8305 struct wireless_dev *wdev = info->user_ptr[1];
8306
8307 if (!rdev->ops->abort_scan)
8308 return -EOPNOTSUPP;
8309
8310 if (rdev->scan_msg)
8311 return 0;
8312
8313 if (!rdev->scan_req)
8314 return -ENOENT;
8315
8316 rdev_abort_scan(rdev, wdev);
8317 return 0;
8318 }
8319
8320 static int
nl80211_parse_sched_scan_plans(struct wiphy * wiphy,int n_plans,struct cfg80211_sched_scan_request * request,struct nlattr ** attrs)8321 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
8322 struct cfg80211_sched_scan_request *request,
8323 struct nlattr **attrs)
8324 {
8325 int tmp, err, i = 0;
8326 struct nlattr *attr;
8327
8328 if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
8329 u32 interval;
8330
8331 /*
8332 * If scan plans are not specified,
8333 * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
8334 * case one scan plan will be set with the specified scan
8335 * interval and infinite number of iterations.
8336 */
8337 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
8338 if (!interval)
8339 return -EINVAL;
8340
8341 request->scan_plans[0].interval =
8342 DIV_ROUND_UP(interval, MSEC_PER_SEC);
8343 if (!request->scan_plans[0].interval)
8344 return -EINVAL;
8345
8346 if (request->scan_plans[0].interval >
8347 wiphy->max_sched_scan_plan_interval)
8348 request->scan_plans[0].interval =
8349 wiphy->max_sched_scan_plan_interval;
8350
8351 return 0;
8352 }
8353
8354 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
8355 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
8356
8357 if (WARN_ON(i >= n_plans))
8358 return -EINVAL;
8359
8360 err = nla_parse_nested_deprecated(plan,
8361 NL80211_SCHED_SCAN_PLAN_MAX,
8362 attr, nl80211_plan_policy,
8363 NULL);
8364 if (err)
8365 return err;
8366
8367 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
8368 return -EINVAL;
8369
8370 request->scan_plans[i].interval =
8371 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
8372 if (!request->scan_plans[i].interval ||
8373 request->scan_plans[i].interval >
8374 wiphy->max_sched_scan_plan_interval)
8375 return -EINVAL;
8376
8377 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
8378 request->scan_plans[i].iterations =
8379 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
8380 if (!request->scan_plans[i].iterations ||
8381 (request->scan_plans[i].iterations >
8382 wiphy->max_sched_scan_plan_iterations))
8383 return -EINVAL;
8384 } else if (i < n_plans - 1) {
8385 /*
8386 * All scan plans but the last one must specify
8387 * a finite number of iterations
8388 */
8389 return -EINVAL;
8390 }
8391
8392 i++;
8393 }
8394
8395 /*
8396 * The last scan plan must not specify the number of
8397 * iterations, it is supposed to run infinitely
8398 */
8399 if (request->scan_plans[n_plans - 1].iterations)
8400 return -EINVAL;
8401
8402 return 0;
8403 }
8404
8405 static int
nl80211_parse_sched_scan_per_band_rssi(struct wiphy * wiphy,struct cfg80211_match_set * match_sets,struct nlattr * tb_band_rssi,s32 rssi_thold)8406 nl80211_parse_sched_scan_per_band_rssi(struct wiphy *wiphy,
8407 struct cfg80211_match_set *match_sets,
8408 struct nlattr *tb_band_rssi,
8409 s32 rssi_thold)
8410 {
8411 struct nlattr *attr;
8412 int i, tmp, ret = 0;
8413
8414 if (!wiphy_ext_feature_isset(wiphy,
8415 NL80211_EXT_FEATURE_SCHED_SCAN_BAND_SPECIFIC_RSSI_THOLD)) {
8416 if (tb_band_rssi)
8417 ret = -EOPNOTSUPP;
8418 else
8419 for (i = 0; i < NUM_NL80211_BANDS; i++)
8420 match_sets->per_band_rssi_thold[i] =
8421 NL80211_SCAN_RSSI_THOLD_OFF;
8422 return ret;
8423 }
8424
8425 for (i = 0; i < NUM_NL80211_BANDS; i++)
8426 match_sets->per_band_rssi_thold[i] = rssi_thold;
8427
8428 nla_for_each_nested(attr, tb_band_rssi, tmp) {
8429 enum nl80211_band band = nla_type(attr);
8430
8431 if (band < 0 || band >= NUM_NL80211_BANDS)
8432 return -EINVAL;
8433
8434 match_sets->per_band_rssi_thold[band] = nla_get_s32(attr);
8435 }
8436
8437 return 0;
8438 }
8439
8440 static struct cfg80211_sched_scan_request *
nl80211_parse_sched_scan(struct wiphy * wiphy,struct wireless_dev * wdev,struct nlattr ** attrs,int max_match_sets)8441 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
8442 struct nlattr **attrs, int max_match_sets)
8443 {
8444 struct cfg80211_sched_scan_request *request;
8445 struct nlattr *attr;
8446 int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
8447 enum nl80211_band band;
8448 size_t ie_len;
8449 struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
8450 s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
8451
8452 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
8453 n_channels = validate_scan_freqs(
8454 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
8455 if (!n_channels)
8456 return ERR_PTR(-EINVAL);
8457 } else {
8458 n_channels = ieee80211_get_num_supported_channels(wiphy);
8459 }
8460
8461 if (attrs[NL80211_ATTR_SCAN_SSIDS])
8462 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
8463 tmp)
8464 n_ssids++;
8465
8466 if (n_ssids > wiphy->max_sched_scan_ssids)
8467 return ERR_PTR(-EINVAL);
8468
8469 /*
8470 * First, count the number of 'real' matchsets. Due to an issue with
8471 * the old implementation, matchsets containing only the RSSI attribute
8472 * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
8473 * RSSI for all matchsets, rather than their own matchset for reporting
8474 * all APs with a strong RSSI. This is needed to be compatible with
8475 * older userspace that treated a matchset with only the RSSI as the
8476 * global RSSI for all other matchsets - if there are other matchsets.
8477 */
8478 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
8479 nla_for_each_nested(attr,
8480 attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
8481 tmp) {
8482 struct nlattr *rssi;
8483
8484 err = nla_parse_nested_deprecated(tb,
8485 NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
8486 attr,
8487 nl80211_match_policy,
8488 NULL);
8489 if (err)
8490 return ERR_PTR(err);
8491
8492 /* SSID and BSSID are mutually exclusive */
8493 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
8494 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
8495 return ERR_PTR(-EINVAL);
8496
8497 /* add other standalone attributes here */
8498 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
8499 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
8500 n_match_sets++;
8501 continue;
8502 }
8503 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
8504 if (rssi)
8505 default_match_rssi = nla_get_s32(rssi);
8506 }
8507 }
8508
8509 /* However, if there's no other matchset, add the RSSI one */
8510 if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
8511 n_match_sets = 1;
8512
8513 if (n_match_sets > max_match_sets)
8514 return ERR_PTR(-EINVAL);
8515
8516 if (attrs[NL80211_ATTR_IE])
8517 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
8518 else
8519 ie_len = 0;
8520
8521 if (ie_len > wiphy->max_sched_scan_ie_len)
8522 return ERR_PTR(-EINVAL);
8523
8524 if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
8525 /*
8526 * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
8527 * each scan plan already specifies its own interval
8528 */
8529 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
8530 return ERR_PTR(-EINVAL);
8531
8532 nla_for_each_nested(attr,
8533 attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
8534 n_plans++;
8535 } else {
8536 /*
8537 * The scan interval attribute is kept for backward
8538 * compatibility. If no scan plans are specified and sched scan
8539 * interval is specified, one scan plan will be set with this
8540 * scan interval and infinite number of iterations.
8541 */
8542 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
8543 return ERR_PTR(-EINVAL);
8544
8545 n_plans = 1;
8546 }
8547
8548 if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
8549 return ERR_PTR(-EINVAL);
8550
8551 if (!wiphy_ext_feature_isset(
8552 wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
8553 (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
8554 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
8555 return ERR_PTR(-EINVAL);
8556
8557 request = kzalloc(sizeof(*request)
8558 + sizeof(*request->ssids) * n_ssids
8559 + sizeof(*request->match_sets) * n_match_sets
8560 + sizeof(*request->scan_plans) * n_plans
8561 + sizeof(*request->channels) * n_channels
8562 + ie_len, GFP_KERNEL);
8563 if (!request)
8564 return ERR_PTR(-ENOMEM);
8565
8566 if (n_ssids)
8567 request->ssids = (void *)&request->channels[n_channels];
8568 request->n_ssids = n_ssids;
8569 if (ie_len) {
8570 if (n_ssids)
8571 request->ie = (void *)(request->ssids + n_ssids);
8572 else
8573 request->ie = (void *)(request->channels + n_channels);
8574 }
8575
8576 if (n_match_sets) {
8577 if (request->ie)
8578 request->match_sets = (void *)(request->ie + ie_len);
8579 else if (n_ssids)
8580 request->match_sets =
8581 (void *)(request->ssids + n_ssids);
8582 else
8583 request->match_sets =
8584 (void *)(request->channels + n_channels);
8585 }
8586 request->n_match_sets = n_match_sets;
8587
8588 if (n_match_sets)
8589 request->scan_plans = (void *)(request->match_sets +
8590 n_match_sets);
8591 else if (request->ie)
8592 request->scan_plans = (void *)(request->ie + ie_len);
8593 else if (n_ssids)
8594 request->scan_plans = (void *)(request->ssids + n_ssids);
8595 else
8596 request->scan_plans = (void *)(request->channels + n_channels);
8597
8598 request->n_scan_plans = n_plans;
8599
8600 i = 0;
8601 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
8602 /* user specified, bail out if channel not found */
8603 nla_for_each_nested(attr,
8604 attrs[NL80211_ATTR_SCAN_FREQUENCIES],
8605 tmp) {
8606 struct ieee80211_channel *chan;
8607
8608 chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
8609
8610 if (!chan) {
8611 err = -EINVAL;
8612 goto out_free;
8613 }
8614
8615 /* ignore disabled channels */
8616 if (chan->flags & IEEE80211_CHAN_DISABLED)
8617 continue;
8618
8619 request->channels[i] = chan;
8620 i++;
8621 }
8622 } else {
8623 /* all channels */
8624 for (band = 0; band < NUM_NL80211_BANDS; band++) {
8625 int j;
8626
8627 if (!wiphy->bands[band])
8628 continue;
8629 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
8630 struct ieee80211_channel *chan;
8631
8632 chan = &wiphy->bands[band]->channels[j];
8633
8634 if (chan->flags & IEEE80211_CHAN_DISABLED)
8635 continue;
8636
8637 request->channels[i] = chan;
8638 i++;
8639 }
8640 }
8641 }
8642
8643 if (!i) {
8644 err = -EINVAL;
8645 goto out_free;
8646 }
8647
8648 request->n_channels = i;
8649
8650 i = 0;
8651 if (n_ssids) {
8652 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
8653 tmp) {
8654 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
8655 err = -EINVAL;
8656 goto out_free;
8657 }
8658 request->ssids[i].ssid_len = nla_len(attr);
8659 memcpy(request->ssids[i].ssid, nla_data(attr),
8660 nla_len(attr));
8661 i++;
8662 }
8663 }
8664
8665 i = 0;
8666 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
8667 nla_for_each_nested(attr,
8668 attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
8669 tmp) {
8670 struct nlattr *ssid, *bssid, *rssi;
8671
8672 err = nla_parse_nested_deprecated(tb,
8673 NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
8674 attr,
8675 nl80211_match_policy,
8676 NULL);
8677 if (err)
8678 goto out_free;
8679 ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
8680 bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
8681
8682 if (!ssid && !bssid) {
8683 i++;
8684 continue;
8685 }
8686
8687 if (WARN_ON(i >= n_match_sets)) {
8688 /* this indicates a programming error,
8689 * the loop above should have verified
8690 * things properly
8691 */
8692 err = -EINVAL;
8693 goto out_free;
8694 }
8695
8696 if (ssid) {
8697 memcpy(request->match_sets[i].ssid.ssid,
8698 nla_data(ssid), nla_len(ssid));
8699 request->match_sets[i].ssid.ssid_len =
8700 nla_len(ssid);
8701 }
8702 if (bssid)
8703 memcpy(request->match_sets[i].bssid,
8704 nla_data(bssid), ETH_ALEN);
8705
8706 /* special attribute - old implementation w/a */
8707 request->match_sets[i].rssi_thold = default_match_rssi;
8708 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
8709 if (rssi)
8710 request->match_sets[i].rssi_thold =
8711 nla_get_s32(rssi);
8712
8713 /* Parse per band RSSI attribute */
8714 err = nl80211_parse_sched_scan_per_band_rssi(wiphy,
8715 &request->match_sets[i],
8716 tb[NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI],
8717 request->match_sets[i].rssi_thold);
8718 if (err)
8719 goto out_free;
8720
8721 i++;
8722 }
8723
8724 /* there was no other matchset, so the RSSI one is alone */
8725 if (i == 0 && n_match_sets)
8726 request->match_sets[0].rssi_thold = default_match_rssi;
8727
8728 request->min_rssi_thold = INT_MAX;
8729 for (i = 0; i < n_match_sets; i++)
8730 request->min_rssi_thold =
8731 min(request->match_sets[i].rssi_thold,
8732 request->min_rssi_thold);
8733 } else {
8734 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
8735 }
8736
8737 if (ie_len) {
8738 request->ie_len = ie_len;
8739 memcpy((void *)request->ie,
8740 nla_data(attrs[NL80211_ATTR_IE]),
8741 request->ie_len);
8742 }
8743
8744 err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true);
8745 if (err)
8746 goto out_free;
8747
8748 if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
8749 request->delay =
8750 nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
8751
8752 if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
8753 request->relative_rssi = nla_get_s8(
8754 attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
8755 request->relative_rssi_set = true;
8756 }
8757
8758 if (request->relative_rssi_set &&
8759 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
8760 struct nl80211_bss_select_rssi_adjust *rssi_adjust;
8761
8762 rssi_adjust = nla_data(
8763 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
8764 request->rssi_adjust.band = rssi_adjust->band;
8765 request->rssi_adjust.delta = rssi_adjust->delta;
8766 if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
8767 err = -EINVAL;
8768 goto out_free;
8769 }
8770 }
8771
8772 err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
8773 if (err)
8774 goto out_free;
8775
8776 request->scan_start = jiffies;
8777
8778 return request;
8779
8780 out_free:
8781 kfree(request);
8782 return ERR_PTR(err);
8783 }
8784
nl80211_start_sched_scan(struct sk_buff * skb,struct genl_info * info)8785 static int nl80211_start_sched_scan(struct sk_buff *skb,
8786 struct genl_info *info)
8787 {
8788 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8789 struct net_device *dev = info->user_ptr[1];
8790 struct wireless_dev *wdev = dev->ieee80211_ptr;
8791 struct cfg80211_sched_scan_request *sched_scan_req;
8792 bool want_multi;
8793 int err;
8794
8795 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
8796 return -EOPNOTSUPP;
8797
8798 want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
8799 err = cfg80211_sched_scan_req_possible(rdev, want_multi);
8800 if (err)
8801 return err;
8802
8803 sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
8804 info->attrs,
8805 rdev->wiphy.max_match_sets);
8806
8807 err = PTR_ERR_OR_ZERO(sched_scan_req);
8808 if (err)
8809 goto out_err;
8810
8811 /* leave request id zero for legacy request
8812 * or if driver does not support multi-scheduled scan
8813 */
8814 if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1)
8815 sched_scan_req->reqid = cfg80211_assign_cookie(rdev);
8816
8817 err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
8818 if (err)
8819 goto out_free;
8820
8821 sched_scan_req->dev = dev;
8822 sched_scan_req->wiphy = &rdev->wiphy;
8823
8824 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
8825 sched_scan_req->owner_nlportid = info->snd_portid;
8826
8827 cfg80211_add_sched_scan_req(rdev, sched_scan_req);
8828
8829 nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
8830 return 0;
8831
8832 out_free:
8833 kfree(sched_scan_req);
8834 out_err:
8835 return err;
8836 }
8837
nl80211_stop_sched_scan(struct sk_buff * skb,struct genl_info * info)8838 static int nl80211_stop_sched_scan(struct sk_buff *skb,
8839 struct genl_info *info)
8840 {
8841 struct cfg80211_sched_scan_request *req;
8842 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8843 u64 cookie;
8844
8845 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
8846 return -EOPNOTSUPP;
8847
8848 if (info->attrs[NL80211_ATTR_COOKIE]) {
8849 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
8850 return __cfg80211_stop_sched_scan(rdev, cookie, false);
8851 }
8852
8853 req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
8854 struct cfg80211_sched_scan_request,
8855 list);
8856 if (!req || req->reqid ||
8857 (req->owner_nlportid &&
8858 req->owner_nlportid != info->snd_portid))
8859 return -ENOENT;
8860
8861 return cfg80211_stop_sched_scan_req(rdev, req, false);
8862 }
8863
nl80211_start_radar_detection(struct sk_buff * skb,struct genl_info * info)8864 static int nl80211_start_radar_detection(struct sk_buff *skb,
8865 struct genl_info *info)
8866 {
8867 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8868 struct net_device *dev = info->user_ptr[1];
8869 struct wireless_dev *wdev = dev->ieee80211_ptr;
8870 struct wiphy *wiphy = wdev->wiphy;
8871 struct cfg80211_chan_def chandef;
8872 enum nl80211_dfs_regions dfs_region;
8873 unsigned int cac_time_ms;
8874 int err;
8875
8876 dfs_region = reg_get_dfs_region(wiphy);
8877 if (dfs_region == NL80211_DFS_UNSET)
8878 return -EINVAL;
8879
8880 err = nl80211_parse_chandef(rdev, info, &chandef);
8881 if (err)
8882 return err;
8883
8884 if (netif_carrier_ok(dev))
8885 return -EBUSY;
8886
8887 if (wdev->cac_started)
8888 return -EBUSY;
8889
8890 err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
8891 if (err < 0)
8892 return err;
8893
8894 if (err == 0)
8895 return -EINVAL;
8896
8897 if (!cfg80211_chandef_dfs_usable(wiphy, &chandef))
8898 return -EINVAL;
8899
8900 /* CAC start is offloaded to HW and can't be started manually */
8901 if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD))
8902 return -EOPNOTSUPP;
8903
8904 if (!rdev->ops->start_radar_detection)
8905 return -EOPNOTSUPP;
8906
8907 cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
8908 if (WARN_ON(!cac_time_ms))
8909 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
8910
8911 err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
8912 if (!err) {
8913 wdev->chandef = chandef;
8914 wdev->cac_started = true;
8915 wdev->cac_start_time = jiffies;
8916 wdev->cac_time_ms = cac_time_ms;
8917 }
8918 return err;
8919 }
8920
nl80211_notify_radar_detection(struct sk_buff * skb,struct genl_info * info)8921 static int nl80211_notify_radar_detection(struct sk_buff *skb,
8922 struct genl_info *info)
8923 {
8924 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8925 struct net_device *dev = info->user_ptr[1];
8926 struct wireless_dev *wdev = dev->ieee80211_ptr;
8927 struct wiphy *wiphy = wdev->wiphy;
8928 struct cfg80211_chan_def chandef;
8929 enum nl80211_dfs_regions dfs_region;
8930 int err;
8931
8932 dfs_region = reg_get_dfs_region(wiphy);
8933 if (dfs_region == NL80211_DFS_UNSET) {
8934 GENL_SET_ERR_MSG(info,
8935 "DFS Region is not set. Unexpected Radar indication");
8936 return -EINVAL;
8937 }
8938
8939 err = nl80211_parse_chandef(rdev, info, &chandef);
8940 if (err) {
8941 GENL_SET_ERR_MSG(info, "Unable to extract chandef info");
8942 return err;
8943 }
8944
8945 err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
8946 if (err < 0) {
8947 GENL_SET_ERR_MSG(info, "chandef is invalid");
8948 return err;
8949 }
8950
8951 if (err == 0) {
8952 GENL_SET_ERR_MSG(info,
8953 "Unexpected Radar indication for chandef/iftype");
8954 return -EINVAL;
8955 }
8956
8957 /* Do not process this notification if radar is already detected
8958 * by kernel on this channel, and return success.
8959 */
8960 if (chandef.chan->dfs_state == NL80211_DFS_UNAVAILABLE)
8961 return 0;
8962
8963 cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_UNAVAILABLE);
8964
8965 cfg80211_sched_dfs_chan_update(rdev);
8966
8967 rdev->radar_chandef = chandef;
8968
8969 /* Propagate this notification to other radios as well */
8970 queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
8971
8972 return 0;
8973 }
8974
nl80211_channel_switch(struct sk_buff * skb,struct genl_info * info)8975 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
8976 {
8977 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8978 struct net_device *dev = info->user_ptr[1];
8979 struct wireless_dev *wdev = dev->ieee80211_ptr;
8980 struct cfg80211_csa_settings params;
8981 /* csa_attrs is defined static to avoid waste of stack size - this
8982 * function is called under RTNL lock, so this should not be a problem.
8983 */
8984 static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
8985 int err;
8986 bool need_new_beacon = false;
8987 bool need_handle_dfs_flag = true;
8988 int len, i;
8989 u32 cs_count;
8990
8991 if (!rdev->ops->channel_switch ||
8992 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
8993 return -EOPNOTSUPP;
8994
8995 switch (dev->ieee80211_ptr->iftype) {
8996 case NL80211_IFTYPE_AP:
8997 case NL80211_IFTYPE_P2P_GO:
8998 need_new_beacon = true;
8999 /* For all modes except AP the handle_dfs flag needs to be
9000 * supplied to tell the kernel that userspace will handle radar
9001 * events when they happen. Otherwise a switch to a channel
9002 * requiring DFS will be rejected.
9003 */
9004 need_handle_dfs_flag = false;
9005
9006 /* useless if AP is not running */
9007 if (!wdev->beacon_interval)
9008 return -ENOTCONN;
9009 break;
9010 case NL80211_IFTYPE_ADHOC:
9011 if (!wdev->ssid_len)
9012 return -ENOTCONN;
9013 break;
9014 case NL80211_IFTYPE_MESH_POINT:
9015 if (!wdev->mesh_id_len)
9016 return -ENOTCONN;
9017 break;
9018 default:
9019 return -EOPNOTSUPP;
9020 }
9021
9022 memset(¶ms, 0, sizeof(params));
9023 params.beacon_csa.ftm_responder = -1;
9024
9025 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
9026 !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
9027 return -EINVAL;
9028
9029 /* only important for AP, IBSS and mesh create IEs internally */
9030 if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
9031 return -EINVAL;
9032
9033 /* Even though the attribute is u32, the specification says
9034 * u8, so let's make sure we don't overflow.
9035 */
9036 cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
9037 if (cs_count > 255)
9038 return -EINVAL;
9039
9040 params.count = cs_count;
9041
9042 if (!need_new_beacon)
9043 goto skip_beacons;
9044
9045 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms.beacon_after);
9046 if (err)
9047 return err;
9048
9049 err = nla_parse_nested_deprecated(csa_attrs, NL80211_ATTR_MAX,
9050 info->attrs[NL80211_ATTR_CSA_IES],
9051 nl80211_policy, info->extack);
9052 if (err)
9053 return err;
9054
9055 err = nl80211_parse_beacon(rdev, csa_attrs, ¶ms.beacon_csa);
9056 if (err)
9057 return err;
9058
9059 if (!csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON])
9060 return -EINVAL;
9061
9062 len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
9063 if (!len || (len % sizeof(u16)))
9064 return -EINVAL;
9065
9066 params.n_counter_offsets_beacon = len / sizeof(u16);
9067 if (rdev->wiphy.max_num_csa_counters &&
9068 (params.n_counter_offsets_beacon >
9069 rdev->wiphy.max_num_csa_counters))
9070 return -EINVAL;
9071
9072 params.counter_offsets_beacon =
9073 nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
9074
9075 /* sanity checks - counters should fit and be the same */
9076 for (i = 0; i < params.n_counter_offsets_beacon; i++) {
9077 u16 offset = params.counter_offsets_beacon[i];
9078
9079 if (offset >= params.beacon_csa.tail_len)
9080 return -EINVAL;
9081
9082 if (params.beacon_csa.tail[offset] != params.count)
9083 return -EINVAL;
9084 }
9085
9086 if (csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]) {
9087 len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
9088 if (!len || (len % sizeof(u16)))
9089 return -EINVAL;
9090
9091 params.n_counter_offsets_presp = len / sizeof(u16);
9092 if (rdev->wiphy.max_num_csa_counters &&
9093 (params.n_counter_offsets_presp >
9094 rdev->wiphy.max_num_csa_counters))
9095 return -EINVAL;
9096
9097 params.counter_offsets_presp =
9098 nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
9099
9100 /* sanity checks - counters should fit and be the same */
9101 for (i = 0; i < params.n_counter_offsets_presp; i++) {
9102 u16 offset = params.counter_offsets_presp[i];
9103
9104 if (offset >= params.beacon_csa.probe_resp_len)
9105 return -EINVAL;
9106
9107 if (params.beacon_csa.probe_resp[offset] !=
9108 params.count)
9109 return -EINVAL;
9110 }
9111 }
9112
9113 skip_beacons:
9114 err = nl80211_parse_chandef(rdev, info, ¶ms.chandef);
9115 if (err)
9116 return err;
9117
9118 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms.chandef,
9119 wdev->iftype))
9120 return -EINVAL;
9121
9122 err = cfg80211_chandef_dfs_required(wdev->wiphy,
9123 ¶ms.chandef,
9124 wdev->iftype);
9125 if (err < 0)
9126 return err;
9127
9128 if (err > 0) {
9129 params.radar_required = true;
9130 if (need_handle_dfs_flag &&
9131 !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
9132 return -EINVAL;
9133 }
9134 }
9135
9136 if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
9137 params.block_tx = true;
9138
9139 wdev_lock(wdev);
9140 err = rdev_channel_switch(rdev, dev, ¶ms);
9141 wdev_unlock(wdev);
9142
9143 return err;
9144 }
9145
nl80211_send_bss(struct sk_buff * msg,struct netlink_callback * cb,u32 seq,int flags,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,struct cfg80211_internal_bss * intbss)9146 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
9147 u32 seq, int flags,
9148 struct cfg80211_registered_device *rdev,
9149 struct wireless_dev *wdev,
9150 struct cfg80211_internal_bss *intbss)
9151 {
9152 struct cfg80211_bss *res = &intbss->pub;
9153 const struct cfg80211_bss_ies *ies;
9154 void *hdr;
9155 struct nlattr *bss;
9156
9157 ASSERT_WDEV_LOCK(wdev);
9158
9159 hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
9160 NL80211_CMD_NEW_SCAN_RESULTS);
9161 if (!hdr)
9162 return -1;
9163
9164 genl_dump_check_consistent(cb, hdr);
9165
9166 if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
9167 goto nla_put_failure;
9168 if (wdev->netdev &&
9169 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
9170 goto nla_put_failure;
9171 if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
9172 NL80211_ATTR_PAD))
9173 goto nla_put_failure;
9174
9175 bss = nla_nest_start_noflag(msg, NL80211_ATTR_BSS);
9176 if (!bss)
9177 goto nla_put_failure;
9178 if ((!is_zero_ether_addr(res->bssid) &&
9179 nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
9180 goto nla_put_failure;
9181
9182 rcu_read_lock();
9183 /* indicate whether we have probe response data or not */
9184 if (rcu_access_pointer(res->proberesp_ies) &&
9185 nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
9186 goto fail_unlock_rcu;
9187
9188 /* this pointer prefers to be pointed to probe response data
9189 * but is always valid
9190 */
9191 ies = rcu_dereference(res->ies);
9192 if (ies) {
9193 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
9194 NL80211_BSS_PAD))
9195 goto fail_unlock_rcu;
9196 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
9197 ies->len, ies->data))
9198 goto fail_unlock_rcu;
9199 }
9200
9201 /* and this pointer is always (unless driver didn't know) beacon data */
9202 ies = rcu_dereference(res->beacon_ies);
9203 if (ies && ies->from_beacon) {
9204 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
9205 NL80211_BSS_PAD))
9206 goto fail_unlock_rcu;
9207 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
9208 ies->len, ies->data))
9209 goto fail_unlock_rcu;
9210 }
9211 rcu_read_unlock();
9212
9213 if (res->beacon_interval &&
9214 nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
9215 goto nla_put_failure;
9216 if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
9217 nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
9218 nla_put_u32(msg, NL80211_BSS_FREQUENCY_OFFSET,
9219 res->channel->freq_offset) ||
9220 nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
9221 nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
9222 jiffies_to_msecs(jiffies - intbss->ts)))
9223 goto nla_put_failure;
9224
9225 if (intbss->parent_tsf &&
9226 (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
9227 intbss->parent_tsf, NL80211_BSS_PAD) ||
9228 nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
9229 intbss->parent_bssid)))
9230 goto nla_put_failure;
9231
9232 if (intbss->ts_boottime &&
9233 nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
9234 intbss->ts_boottime, NL80211_BSS_PAD))
9235 goto nla_put_failure;
9236
9237 if (!nl80211_put_signal(msg, intbss->pub.chains,
9238 intbss->pub.chain_signal,
9239 NL80211_BSS_CHAIN_SIGNAL))
9240 goto nla_put_failure;
9241
9242 switch (rdev->wiphy.signal_type) {
9243 case CFG80211_SIGNAL_TYPE_MBM:
9244 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
9245 goto nla_put_failure;
9246 break;
9247 case CFG80211_SIGNAL_TYPE_UNSPEC:
9248 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
9249 goto nla_put_failure;
9250 break;
9251 default:
9252 break;
9253 }
9254
9255 switch (wdev->iftype) {
9256 case NL80211_IFTYPE_P2P_CLIENT:
9257 case NL80211_IFTYPE_STATION:
9258 if (intbss == wdev->current_bss &&
9259 nla_put_u32(msg, NL80211_BSS_STATUS,
9260 NL80211_BSS_STATUS_ASSOCIATED))
9261 goto nla_put_failure;
9262 break;
9263 case NL80211_IFTYPE_ADHOC:
9264 if (intbss == wdev->current_bss &&
9265 nla_put_u32(msg, NL80211_BSS_STATUS,
9266 NL80211_BSS_STATUS_IBSS_JOINED))
9267 goto nla_put_failure;
9268 break;
9269 default:
9270 break;
9271 }
9272
9273 nla_nest_end(msg, bss);
9274
9275 genlmsg_end(msg, hdr);
9276 return 0;
9277
9278 fail_unlock_rcu:
9279 rcu_read_unlock();
9280 nla_put_failure:
9281 genlmsg_cancel(msg, hdr);
9282 return -EMSGSIZE;
9283 }
9284
nl80211_dump_scan(struct sk_buff * skb,struct netlink_callback * cb)9285 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
9286 {
9287 struct cfg80211_registered_device *rdev;
9288 struct cfg80211_internal_bss *scan;
9289 struct wireless_dev *wdev;
9290 int start = cb->args[2], idx = 0;
9291 int err;
9292
9293 rtnl_lock();
9294 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
9295 if (err) {
9296 rtnl_unlock();
9297 return err;
9298 }
9299
9300 wdev_lock(wdev);
9301 spin_lock_bh(&rdev->bss_lock);
9302
9303 /*
9304 * dump_scan will be called multiple times to break up the scan results
9305 * into multiple messages. It is unlikely that any more bss-es will be
9306 * expired after the first call, so only call only call this on the
9307 * first dump_scan invocation.
9308 */
9309 if (start == 0)
9310 cfg80211_bss_expire(rdev);
9311
9312 cb->seq = rdev->bss_generation;
9313
9314 list_for_each_entry(scan, &rdev->bss_list, list) {
9315 if (++idx <= start)
9316 continue;
9317 if (nl80211_send_bss(skb, cb,
9318 cb->nlh->nlmsg_seq, NLM_F_MULTI,
9319 rdev, wdev, scan) < 0) {
9320 idx--;
9321 break;
9322 }
9323 }
9324
9325 spin_unlock_bh(&rdev->bss_lock);
9326 wdev_unlock(wdev);
9327
9328 cb->args[2] = idx;
9329 rtnl_unlock();
9330
9331 return skb->len;
9332 }
9333
nl80211_send_survey(struct sk_buff * msg,u32 portid,u32 seq,int flags,struct net_device * dev,bool allow_radio_stats,struct survey_info * survey)9334 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
9335 int flags, struct net_device *dev,
9336 bool allow_radio_stats,
9337 struct survey_info *survey)
9338 {
9339 void *hdr;
9340 struct nlattr *infoattr;
9341
9342 /* skip radio stats if userspace didn't request them */
9343 if (!survey->channel && !allow_radio_stats)
9344 return 0;
9345
9346 hdr = nl80211hdr_put(msg, portid, seq, flags,
9347 NL80211_CMD_NEW_SURVEY_RESULTS);
9348 if (!hdr)
9349 return -ENOMEM;
9350
9351 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
9352 goto nla_put_failure;
9353
9354 infoattr = nla_nest_start_noflag(msg, NL80211_ATTR_SURVEY_INFO);
9355 if (!infoattr)
9356 goto nla_put_failure;
9357
9358 if (survey->channel &&
9359 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
9360 survey->channel->center_freq))
9361 goto nla_put_failure;
9362
9363 if (survey->channel && survey->channel->freq_offset &&
9364 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY_OFFSET,
9365 survey->channel->freq_offset))
9366 goto nla_put_failure;
9367
9368 if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
9369 nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
9370 goto nla_put_failure;
9371 if ((survey->filled & SURVEY_INFO_IN_USE) &&
9372 nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
9373 goto nla_put_failure;
9374 if ((survey->filled & SURVEY_INFO_TIME) &&
9375 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
9376 survey->time, NL80211_SURVEY_INFO_PAD))
9377 goto nla_put_failure;
9378 if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
9379 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
9380 survey->time_busy, NL80211_SURVEY_INFO_PAD))
9381 goto nla_put_failure;
9382 if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
9383 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
9384 survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
9385 goto nla_put_failure;
9386 if ((survey->filled & SURVEY_INFO_TIME_RX) &&
9387 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
9388 survey->time_rx, NL80211_SURVEY_INFO_PAD))
9389 goto nla_put_failure;
9390 if ((survey->filled & SURVEY_INFO_TIME_TX) &&
9391 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
9392 survey->time_tx, NL80211_SURVEY_INFO_PAD))
9393 goto nla_put_failure;
9394 if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
9395 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
9396 survey->time_scan, NL80211_SURVEY_INFO_PAD))
9397 goto nla_put_failure;
9398 if ((survey->filled & SURVEY_INFO_TIME_BSS_RX) &&
9399 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BSS_RX,
9400 survey->time_bss_rx, NL80211_SURVEY_INFO_PAD))
9401 goto nla_put_failure;
9402
9403 nla_nest_end(msg, infoattr);
9404
9405 genlmsg_end(msg, hdr);
9406 return 0;
9407
9408 nla_put_failure:
9409 genlmsg_cancel(msg, hdr);
9410 return -EMSGSIZE;
9411 }
9412
nl80211_dump_survey(struct sk_buff * skb,struct netlink_callback * cb)9413 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
9414 {
9415 struct nlattr **attrbuf;
9416 struct survey_info survey;
9417 struct cfg80211_registered_device *rdev;
9418 struct wireless_dev *wdev;
9419 int survey_idx = cb->args[2];
9420 int res;
9421 bool radio_stats;
9422
9423 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
9424 if (!attrbuf)
9425 return -ENOMEM;
9426
9427 rtnl_lock();
9428 res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
9429 if (res)
9430 goto out_err;
9431
9432 /* prepare_wdev_dump parsed the attributes */
9433 radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
9434
9435 if (!wdev->netdev) {
9436 res = -EINVAL;
9437 goto out_err;
9438 }
9439
9440 if (!rdev->ops->dump_survey) {
9441 res = -EOPNOTSUPP;
9442 goto out_err;
9443 }
9444
9445 while (1) {
9446 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
9447 if (res == -ENOENT)
9448 break;
9449 if (res)
9450 goto out_err;
9451
9452 /* don't send disabled channels, but do send non-channel data */
9453 if (survey.channel &&
9454 survey.channel->flags & IEEE80211_CHAN_DISABLED) {
9455 survey_idx++;
9456 continue;
9457 }
9458
9459 if (nl80211_send_survey(skb,
9460 NETLINK_CB(cb->skb).portid,
9461 cb->nlh->nlmsg_seq, NLM_F_MULTI,
9462 wdev->netdev, radio_stats, &survey) < 0)
9463 goto out;
9464 survey_idx++;
9465 }
9466
9467 out:
9468 cb->args[2] = survey_idx;
9469 res = skb->len;
9470 out_err:
9471 kfree(attrbuf);
9472 rtnl_unlock();
9473 return res;
9474 }
9475
nl80211_valid_wpa_versions(u32 wpa_versions)9476 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
9477 {
9478 return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
9479 NL80211_WPA_VERSION_2 |
9480 NL80211_WPA_VERSION_3));
9481 }
9482
nl80211_authenticate(struct sk_buff * skb,struct genl_info * info)9483 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
9484 {
9485 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9486 struct net_device *dev = info->user_ptr[1];
9487 struct ieee80211_channel *chan;
9488 const u8 *bssid, *ssid, *ie = NULL, *auth_data = NULL;
9489 int err, ssid_len, ie_len = 0, auth_data_len = 0;
9490 enum nl80211_auth_type auth_type;
9491 struct key_parse key;
9492 bool local_state_change;
9493 u32 freq;
9494
9495 if (!info->attrs[NL80211_ATTR_MAC])
9496 return -EINVAL;
9497
9498 if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
9499 return -EINVAL;
9500
9501 if (!info->attrs[NL80211_ATTR_SSID])
9502 return -EINVAL;
9503
9504 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
9505 return -EINVAL;
9506
9507 err = nl80211_parse_key(info, &key);
9508 if (err)
9509 return err;
9510
9511 if (key.idx >= 0) {
9512 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
9513 return -EINVAL;
9514 if (!key.p.key || !key.p.key_len)
9515 return -EINVAL;
9516 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
9517 key.p.key_len != WLAN_KEY_LEN_WEP40) &&
9518 (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
9519 key.p.key_len != WLAN_KEY_LEN_WEP104))
9520 return -EINVAL;
9521 if (key.idx > 3)
9522 return -EINVAL;
9523 } else {
9524 key.p.key_len = 0;
9525 key.p.key = NULL;
9526 }
9527
9528 if (key.idx >= 0) {
9529 int i;
9530 bool ok = false;
9531
9532 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
9533 if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
9534 ok = true;
9535 break;
9536 }
9537 }
9538 if (!ok)
9539 return -EINVAL;
9540 }
9541
9542 if (!rdev->ops->auth)
9543 return -EOPNOTSUPP;
9544
9545 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9546 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9547 return -EOPNOTSUPP;
9548
9549 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9550 freq = MHZ_TO_KHZ(nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
9551 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
9552 freq +=
9553 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
9554
9555 chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
9556 if (!chan)
9557 return -EINVAL;
9558
9559 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9560 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9561
9562 if (info->attrs[NL80211_ATTR_IE]) {
9563 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9564 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9565 }
9566
9567 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
9568 if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
9569 return -EINVAL;
9570
9571 if ((auth_type == NL80211_AUTHTYPE_SAE ||
9572 auth_type == NL80211_AUTHTYPE_FILS_SK ||
9573 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
9574 auth_type == NL80211_AUTHTYPE_FILS_PK) &&
9575 !info->attrs[NL80211_ATTR_AUTH_DATA])
9576 return -EINVAL;
9577
9578 if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
9579 if (auth_type != NL80211_AUTHTYPE_SAE &&
9580 auth_type != NL80211_AUTHTYPE_FILS_SK &&
9581 auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
9582 auth_type != NL80211_AUTHTYPE_FILS_PK)
9583 return -EINVAL;
9584 auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
9585 auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
9586 }
9587
9588 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
9589
9590 /*
9591 * Since we no longer track auth state, ignore
9592 * requests to only change local state.
9593 */
9594 if (local_state_change)
9595 return 0;
9596
9597 wdev_lock(dev->ieee80211_ptr);
9598 err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
9599 ssid, ssid_len, ie, ie_len,
9600 key.p.key, key.p.key_len, key.idx,
9601 auth_data, auth_data_len);
9602 wdev_unlock(dev->ieee80211_ptr);
9603 return err;
9604 }
9605
validate_pae_over_nl80211(struct cfg80211_registered_device * rdev,struct genl_info * info)9606 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev,
9607 struct genl_info *info)
9608 {
9609 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9610 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set");
9611 return -EINVAL;
9612 }
9613
9614 if (!rdev->ops->tx_control_port ||
9615 !wiphy_ext_feature_isset(&rdev->wiphy,
9616 NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
9617 return -EOPNOTSUPP;
9618
9619 return 0;
9620 }
9621
nl80211_crypto_settings(struct cfg80211_registered_device * rdev,struct genl_info * info,struct cfg80211_crypto_settings * settings,int cipher_limit)9622 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
9623 struct genl_info *info,
9624 struct cfg80211_crypto_settings *settings,
9625 int cipher_limit)
9626 {
9627 memset(settings, 0, sizeof(*settings));
9628
9629 settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
9630
9631 if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
9632 u16 proto;
9633
9634 proto = nla_get_u16(
9635 info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
9636 settings->control_port_ethertype = cpu_to_be16(proto);
9637 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
9638 proto != ETH_P_PAE)
9639 return -EINVAL;
9640 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
9641 settings->control_port_no_encrypt = true;
9642 } else
9643 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
9644
9645 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
9646 int r = validate_pae_over_nl80211(rdev, info);
9647
9648 if (r < 0)
9649 return r;
9650
9651 settings->control_port_over_nl80211 = true;
9652
9653 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_PREAUTH])
9654 settings->control_port_no_preauth = true;
9655 }
9656
9657 if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
9658 void *data;
9659 int len, i;
9660
9661 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
9662 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
9663 settings->n_ciphers_pairwise = len / sizeof(u32);
9664
9665 if (len % sizeof(u32))
9666 return -EINVAL;
9667
9668 if (settings->n_ciphers_pairwise > cipher_limit)
9669 return -EINVAL;
9670
9671 memcpy(settings->ciphers_pairwise, data, len);
9672
9673 for (i = 0; i < settings->n_ciphers_pairwise; i++)
9674 if (!cfg80211_supported_cipher_suite(
9675 &rdev->wiphy,
9676 settings->ciphers_pairwise[i]))
9677 return -EINVAL;
9678 }
9679
9680 if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
9681 settings->cipher_group =
9682 nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
9683 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
9684 settings->cipher_group))
9685 return -EINVAL;
9686 }
9687
9688 if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
9689 settings->wpa_versions =
9690 nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
9691 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
9692 return -EINVAL;
9693 }
9694
9695 if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
9696 void *data;
9697 int len;
9698
9699 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
9700 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
9701 settings->n_akm_suites = len / sizeof(u32);
9702
9703 if (len % sizeof(u32))
9704 return -EINVAL;
9705
9706 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
9707 return -EINVAL;
9708
9709 memcpy(settings->akm_suites, data, len);
9710 }
9711
9712 if (info->attrs[NL80211_ATTR_PMK]) {
9713 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
9714 return -EINVAL;
9715 if (!wiphy_ext_feature_isset(&rdev->wiphy,
9716 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK) &&
9717 !wiphy_ext_feature_isset(&rdev->wiphy,
9718 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK))
9719 return -EINVAL;
9720 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
9721 }
9722
9723 if (info->attrs[NL80211_ATTR_SAE_PASSWORD]) {
9724 if (!wiphy_ext_feature_isset(&rdev->wiphy,
9725 NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
9726 !wiphy_ext_feature_isset(&rdev->wiphy,
9727 NL80211_EXT_FEATURE_SAE_OFFLOAD_AP))
9728 return -EINVAL;
9729 settings->sae_pwd =
9730 nla_data(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
9731 settings->sae_pwd_len =
9732 nla_len(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
9733 }
9734
9735 return 0;
9736 }
9737
nl80211_associate(struct sk_buff * skb,struct genl_info * info)9738 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
9739 {
9740 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9741 struct net_device *dev = info->user_ptr[1];
9742 struct ieee80211_channel *chan;
9743 struct cfg80211_assoc_request req = {};
9744 const u8 *bssid, *ssid;
9745 int err, ssid_len = 0;
9746 u32 freq;
9747
9748 if (dev->ieee80211_ptr->conn_owner_nlportid &&
9749 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
9750 return -EPERM;
9751
9752 if (!info->attrs[NL80211_ATTR_MAC] ||
9753 !info->attrs[NL80211_ATTR_SSID] ||
9754 !info->attrs[NL80211_ATTR_WIPHY_FREQ])
9755 return -EINVAL;
9756
9757 if (!rdev->ops->assoc)
9758 return -EOPNOTSUPP;
9759
9760 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9761 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9762 return -EOPNOTSUPP;
9763
9764 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9765
9766 freq = MHZ_TO_KHZ(nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
9767 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
9768 freq +=
9769 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
9770 chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
9771 if (!chan)
9772 return -EINVAL;
9773
9774 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9775 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9776
9777 if (info->attrs[NL80211_ATTR_IE]) {
9778 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9779 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9780 }
9781
9782 if (info->attrs[NL80211_ATTR_USE_MFP]) {
9783 enum nl80211_mfp mfp =
9784 nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
9785 if (mfp == NL80211_MFP_REQUIRED)
9786 req.use_mfp = true;
9787 else if (mfp != NL80211_MFP_NO)
9788 return -EINVAL;
9789 }
9790
9791 if (info->attrs[NL80211_ATTR_PREV_BSSID])
9792 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
9793
9794 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
9795 req.flags |= ASSOC_REQ_DISABLE_HT;
9796
9797 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9798 memcpy(&req.ht_capa_mask,
9799 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
9800 sizeof(req.ht_capa_mask));
9801
9802 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
9803 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9804 return -EINVAL;
9805 memcpy(&req.ht_capa,
9806 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
9807 sizeof(req.ht_capa));
9808 }
9809
9810 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
9811 req.flags |= ASSOC_REQ_DISABLE_VHT;
9812
9813 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
9814 memcpy(&req.vht_capa_mask,
9815 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
9816 sizeof(req.vht_capa_mask));
9817
9818 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
9819 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
9820 return -EINVAL;
9821 memcpy(&req.vht_capa,
9822 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
9823 sizeof(req.vht_capa));
9824 }
9825
9826 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
9827 if (!((rdev->wiphy.features &
9828 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
9829 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
9830 !wiphy_ext_feature_isset(&rdev->wiphy,
9831 NL80211_EXT_FEATURE_RRM))
9832 return -EINVAL;
9833 req.flags |= ASSOC_REQ_USE_RRM;
9834 }
9835
9836 if (info->attrs[NL80211_ATTR_FILS_KEK]) {
9837 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
9838 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
9839 if (!info->attrs[NL80211_ATTR_FILS_NONCES])
9840 return -EINVAL;
9841 req.fils_nonces =
9842 nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
9843 }
9844
9845 if (info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]) {
9846 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY])
9847 return -EINVAL;
9848 memcpy(&req.s1g_capa_mask,
9849 nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]),
9850 sizeof(req.s1g_capa_mask));
9851 }
9852
9853 if (info->attrs[NL80211_ATTR_S1G_CAPABILITY]) {
9854 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK])
9855 return -EINVAL;
9856 memcpy(&req.s1g_capa,
9857 nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY]),
9858 sizeof(req.s1g_capa));
9859 }
9860
9861 err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
9862 if (!err) {
9863 wdev_lock(dev->ieee80211_ptr);
9864
9865 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
9866 ssid, ssid_len, &req);
9867
9868 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9869 dev->ieee80211_ptr->conn_owner_nlportid =
9870 info->snd_portid;
9871 memcpy(dev->ieee80211_ptr->disconnect_bssid,
9872 bssid, ETH_ALEN);
9873 }
9874
9875 wdev_unlock(dev->ieee80211_ptr);
9876 }
9877
9878 return err;
9879 }
9880
nl80211_deauthenticate(struct sk_buff * skb,struct genl_info * info)9881 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
9882 {
9883 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9884 struct net_device *dev = info->user_ptr[1];
9885 const u8 *ie = NULL, *bssid;
9886 int ie_len = 0, err;
9887 u16 reason_code;
9888 bool local_state_change;
9889
9890 if (dev->ieee80211_ptr->conn_owner_nlportid &&
9891 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
9892 return -EPERM;
9893
9894 if (!info->attrs[NL80211_ATTR_MAC])
9895 return -EINVAL;
9896
9897 if (!info->attrs[NL80211_ATTR_REASON_CODE])
9898 return -EINVAL;
9899
9900 if (!rdev->ops->deauth)
9901 return -EOPNOTSUPP;
9902
9903 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9904 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9905 return -EOPNOTSUPP;
9906
9907 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9908
9909 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
9910 if (reason_code == 0) {
9911 /* Reason Code 0 is reserved */
9912 return -EINVAL;
9913 }
9914
9915 if (info->attrs[NL80211_ATTR_IE]) {
9916 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9917 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9918 }
9919
9920 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
9921
9922 wdev_lock(dev->ieee80211_ptr);
9923 err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
9924 local_state_change);
9925 wdev_unlock(dev->ieee80211_ptr);
9926 return err;
9927 }
9928
nl80211_disassociate(struct sk_buff * skb,struct genl_info * info)9929 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
9930 {
9931 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9932 struct net_device *dev = info->user_ptr[1];
9933 const u8 *ie = NULL, *bssid;
9934 int ie_len = 0, err;
9935 u16 reason_code;
9936 bool local_state_change;
9937
9938 if (dev->ieee80211_ptr->conn_owner_nlportid &&
9939 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
9940 return -EPERM;
9941
9942 if (!info->attrs[NL80211_ATTR_MAC])
9943 return -EINVAL;
9944
9945 if (!info->attrs[NL80211_ATTR_REASON_CODE])
9946 return -EINVAL;
9947
9948 if (!rdev->ops->disassoc)
9949 return -EOPNOTSUPP;
9950
9951 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9952 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9953 return -EOPNOTSUPP;
9954
9955 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9956
9957 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
9958 if (reason_code == 0) {
9959 /* Reason Code 0 is reserved */
9960 return -EINVAL;
9961 }
9962
9963 if (info->attrs[NL80211_ATTR_IE]) {
9964 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9965 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9966 }
9967
9968 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
9969
9970 wdev_lock(dev->ieee80211_ptr);
9971 err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
9972 local_state_change);
9973 wdev_unlock(dev->ieee80211_ptr);
9974 return err;
9975 }
9976
9977 static bool
nl80211_parse_mcast_rate(struct cfg80211_registered_device * rdev,int mcast_rate[NUM_NL80211_BANDS],int rateval)9978 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
9979 int mcast_rate[NUM_NL80211_BANDS],
9980 int rateval)
9981 {
9982 struct wiphy *wiphy = &rdev->wiphy;
9983 bool found = false;
9984 int band, i;
9985
9986 for (band = 0; band < NUM_NL80211_BANDS; band++) {
9987 struct ieee80211_supported_band *sband;
9988
9989 sband = wiphy->bands[band];
9990 if (!sband)
9991 continue;
9992
9993 for (i = 0; i < sband->n_bitrates; i++) {
9994 if (sband->bitrates[i].bitrate == rateval) {
9995 mcast_rate[band] = i + 1;
9996 found = true;
9997 break;
9998 }
9999 }
10000 }
10001
10002 return found;
10003 }
10004
nl80211_join_ibss(struct sk_buff * skb,struct genl_info * info)10005 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
10006 {
10007 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10008 struct net_device *dev = info->user_ptr[1];
10009 struct cfg80211_ibss_params ibss;
10010 struct wiphy *wiphy;
10011 struct cfg80211_cached_keys *connkeys = NULL;
10012 int err;
10013
10014 memset(&ibss, 0, sizeof(ibss));
10015
10016 if (!info->attrs[NL80211_ATTR_SSID] ||
10017 !nla_len(info->attrs[NL80211_ATTR_SSID]))
10018 return -EINVAL;
10019
10020 ibss.beacon_interval = 100;
10021
10022 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
10023 ibss.beacon_interval =
10024 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
10025
10026 err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
10027 ibss.beacon_interval);
10028 if (err)
10029 return err;
10030
10031 if (!rdev->ops->join_ibss)
10032 return -EOPNOTSUPP;
10033
10034 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
10035 return -EOPNOTSUPP;
10036
10037 wiphy = &rdev->wiphy;
10038
10039 if (info->attrs[NL80211_ATTR_MAC]) {
10040 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10041
10042 if (!is_valid_ether_addr(ibss.bssid))
10043 return -EINVAL;
10044 }
10045 ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10046 ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10047
10048 if (info->attrs[NL80211_ATTR_IE]) {
10049 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10050 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10051 }
10052
10053 err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
10054 if (err)
10055 return err;
10056
10057 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
10058 NL80211_IFTYPE_ADHOC))
10059 return -EINVAL;
10060
10061 switch (ibss.chandef.width) {
10062 case NL80211_CHAN_WIDTH_5:
10063 case NL80211_CHAN_WIDTH_10:
10064 case NL80211_CHAN_WIDTH_20_NOHT:
10065 break;
10066 case NL80211_CHAN_WIDTH_20:
10067 case NL80211_CHAN_WIDTH_40:
10068 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
10069 return -EINVAL;
10070 break;
10071 case NL80211_CHAN_WIDTH_80:
10072 case NL80211_CHAN_WIDTH_80P80:
10073 case NL80211_CHAN_WIDTH_160:
10074 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
10075 return -EINVAL;
10076 if (!wiphy_ext_feature_isset(&rdev->wiphy,
10077 NL80211_EXT_FEATURE_VHT_IBSS))
10078 return -EINVAL;
10079 break;
10080 default:
10081 return -EINVAL;
10082 }
10083
10084 ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
10085 ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
10086
10087 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
10088 u8 *rates =
10089 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10090 int n_rates =
10091 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10092 struct ieee80211_supported_band *sband =
10093 wiphy->bands[ibss.chandef.chan->band];
10094
10095 err = ieee80211_get_ratemask(sband, rates, n_rates,
10096 &ibss.basic_rates);
10097 if (err)
10098 return err;
10099 }
10100
10101 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10102 memcpy(&ibss.ht_capa_mask,
10103 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
10104 sizeof(ibss.ht_capa_mask));
10105
10106 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
10107 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10108 return -EINVAL;
10109 memcpy(&ibss.ht_capa,
10110 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
10111 sizeof(ibss.ht_capa));
10112 }
10113
10114 if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
10115 !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
10116 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
10117 return -EINVAL;
10118
10119 if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
10120 bool no_ht = false;
10121
10122 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht);
10123 if (IS_ERR(connkeys))
10124 return PTR_ERR(connkeys);
10125
10126 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
10127 no_ht) {
10128 kfree_sensitive(connkeys);
10129 return -EINVAL;
10130 }
10131 }
10132
10133 ibss.control_port =
10134 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
10135
10136 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
10137 int r = validate_pae_over_nl80211(rdev, info);
10138
10139 if (r < 0) {
10140 kfree_sensitive(connkeys);
10141 return r;
10142 }
10143
10144 ibss.control_port_over_nl80211 = true;
10145 }
10146
10147 ibss.userspace_handles_dfs =
10148 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
10149
10150 wdev_lock(dev->ieee80211_ptr);
10151 err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
10152 if (err)
10153 kfree_sensitive(connkeys);
10154 else if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
10155 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
10156 wdev_unlock(dev->ieee80211_ptr);
10157
10158 return err;
10159 }
10160
nl80211_leave_ibss(struct sk_buff * skb,struct genl_info * info)10161 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
10162 {
10163 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10164 struct net_device *dev = info->user_ptr[1];
10165
10166 if (!rdev->ops->leave_ibss)
10167 return -EOPNOTSUPP;
10168
10169 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
10170 return -EOPNOTSUPP;
10171
10172 return cfg80211_leave_ibss(rdev, dev, false);
10173 }
10174
nl80211_set_mcast_rate(struct sk_buff * skb,struct genl_info * info)10175 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
10176 {
10177 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10178 struct net_device *dev = info->user_ptr[1];
10179 int mcast_rate[NUM_NL80211_BANDS];
10180 u32 nla_rate;
10181 int err;
10182
10183 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
10184 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
10185 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
10186 return -EOPNOTSUPP;
10187
10188 if (!rdev->ops->set_mcast_rate)
10189 return -EOPNOTSUPP;
10190
10191 memset(mcast_rate, 0, sizeof(mcast_rate));
10192
10193 if (!info->attrs[NL80211_ATTR_MCAST_RATE])
10194 return -EINVAL;
10195
10196 nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
10197 if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
10198 return -EINVAL;
10199
10200 err = rdev_set_mcast_rate(rdev, dev, mcast_rate);
10201
10202 return err;
10203 }
10204
10205 static struct sk_buff *
__cfg80211_alloc_vendor_skb(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,int approxlen,u32 portid,u32 seq,enum nl80211_commands cmd,enum nl80211_attrs attr,const struct nl80211_vendor_cmd_info * info,gfp_t gfp)10206 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
10207 struct wireless_dev *wdev, int approxlen,
10208 u32 portid, u32 seq, enum nl80211_commands cmd,
10209 enum nl80211_attrs attr,
10210 const struct nl80211_vendor_cmd_info *info,
10211 gfp_t gfp)
10212 {
10213 struct sk_buff *skb;
10214 void *hdr;
10215 struct nlattr *data;
10216
10217 skb = nlmsg_new(approxlen + 100, gfp);
10218 if (!skb)
10219 return NULL;
10220
10221 hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
10222 if (!hdr) {
10223 kfree_skb(skb);
10224 return NULL;
10225 }
10226
10227 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
10228 goto nla_put_failure;
10229
10230 if (info) {
10231 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
10232 info->vendor_id))
10233 goto nla_put_failure;
10234 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
10235 info->subcmd))
10236 goto nla_put_failure;
10237 }
10238
10239 if (wdev) {
10240 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
10241 wdev_id(wdev), NL80211_ATTR_PAD))
10242 goto nla_put_failure;
10243 if (wdev->netdev &&
10244 nla_put_u32(skb, NL80211_ATTR_IFINDEX,
10245 wdev->netdev->ifindex))
10246 goto nla_put_failure;
10247 }
10248
10249 data = nla_nest_start_noflag(skb, attr);
10250 if (!data)
10251 goto nla_put_failure;
10252
10253 ((void **)skb->cb)[0] = rdev;
10254 ((void **)skb->cb)[1] = hdr;
10255 ((void **)skb->cb)[2] = data;
10256
10257 return skb;
10258
10259 nla_put_failure:
10260 kfree_skb(skb);
10261 return NULL;
10262 }
10263
__cfg80211_alloc_event_skb(struct wiphy * wiphy,struct wireless_dev * wdev,enum nl80211_commands cmd,enum nl80211_attrs attr,unsigned int portid,int vendor_event_idx,int approxlen,gfp_t gfp)10264 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
10265 struct wireless_dev *wdev,
10266 enum nl80211_commands cmd,
10267 enum nl80211_attrs attr,
10268 unsigned int portid,
10269 int vendor_event_idx,
10270 int approxlen, gfp_t gfp)
10271 {
10272 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10273 const struct nl80211_vendor_cmd_info *info;
10274
10275 switch (cmd) {
10276 case NL80211_CMD_TESTMODE:
10277 if (WARN_ON(vendor_event_idx != -1))
10278 return NULL;
10279 info = NULL;
10280 break;
10281 case NL80211_CMD_VENDOR:
10282 if (WARN_ON(vendor_event_idx < 0 ||
10283 vendor_event_idx >= wiphy->n_vendor_events))
10284 return NULL;
10285 info = &wiphy->vendor_events[vendor_event_idx];
10286 break;
10287 default:
10288 WARN_ON(1);
10289 return NULL;
10290 }
10291
10292 return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, portid, 0,
10293 cmd, attr, info, gfp);
10294 }
10295 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
10296
__cfg80211_send_event_skb(struct sk_buff * skb,gfp_t gfp)10297 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
10298 {
10299 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
10300 void *hdr = ((void **)skb->cb)[1];
10301 struct nlmsghdr *nlhdr = nlmsg_hdr(skb);
10302 struct nlattr *data = ((void **)skb->cb)[2];
10303 enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
10304
10305 /* clear CB data for netlink core to own from now on */
10306 memset(skb->cb, 0, sizeof(skb->cb));
10307
10308 nla_nest_end(skb, data);
10309 genlmsg_end(skb, hdr);
10310
10311 if (nlhdr->nlmsg_pid) {
10312 genlmsg_unicast(wiphy_net(&rdev->wiphy), skb,
10313 nlhdr->nlmsg_pid);
10314 } else {
10315 if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
10316 mcgrp = NL80211_MCGRP_VENDOR;
10317
10318 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
10319 skb, 0, mcgrp, gfp);
10320 }
10321 }
10322 EXPORT_SYMBOL(__cfg80211_send_event_skb);
10323
10324 #ifdef CONFIG_NL80211_TESTMODE
nl80211_testmode_do(struct sk_buff * skb,struct genl_info * info)10325 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
10326 {
10327 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10328 struct wireless_dev *wdev =
10329 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
10330 int err;
10331
10332 if (!rdev->ops->testmode_cmd)
10333 return -EOPNOTSUPP;
10334
10335 if (IS_ERR(wdev)) {
10336 err = PTR_ERR(wdev);
10337 if (err != -EINVAL)
10338 return err;
10339 wdev = NULL;
10340 } else if (wdev->wiphy != &rdev->wiphy) {
10341 return -EINVAL;
10342 }
10343
10344 if (!info->attrs[NL80211_ATTR_TESTDATA])
10345 return -EINVAL;
10346
10347 rdev->cur_cmd_info = info;
10348 err = rdev_testmode_cmd(rdev, wdev,
10349 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
10350 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
10351 rdev->cur_cmd_info = NULL;
10352
10353 return err;
10354 }
10355
nl80211_testmode_dump(struct sk_buff * skb,struct netlink_callback * cb)10356 static int nl80211_testmode_dump(struct sk_buff *skb,
10357 struct netlink_callback *cb)
10358 {
10359 struct cfg80211_registered_device *rdev;
10360 struct nlattr **attrbuf = NULL;
10361 int err;
10362 long phy_idx;
10363 void *data = NULL;
10364 int data_len = 0;
10365
10366 rtnl_lock();
10367
10368 if (cb->args[0]) {
10369 /*
10370 * 0 is a valid index, but not valid for args[0],
10371 * so we need to offset by 1.
10372 */
10373 phy_idx = cb->args[0] - 1;
10374
10375 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
10376 if (!rdev) {
10377 err = -ENOENT;
10378 goto out_err;
10379 }
10380 } else {
10381 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
10382 GFP_KERNEL);
10383 if (!attrbuf) {
10384 err = -ENOMEM;
10385 goto out_err;
10386 }
10387
10388 err = nlmsg_parse_deprecated(cb->nlh,
10389 GENL_HDRLEN + nl80211_fam.hdrsize,
10390 attrbuf, nl80211_fam.maxattr,
10391 nl80211_policy, NULL);
10392 if (err)
10393 goto out_err;
10394
10395 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
10396 if (IS_ERR(rdev)) {
10397 err = PTR_ERR(rdev);
10398 goto out_err;
10399 }
10400 phy_idx = rdev->wiphy_idx;
10401
10402 if (attrbuf[NL80211_ATTR_TESTDATA])
10403 cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
10404 }
10405
10406 if (cb->args[1]) {
10407 data = nla_data((void *)cb->args[1]);
10408 data_len = nla_len((void *)cb->args[1]);
10409 }
10410
10411 if (!rdev->ops->testmode_dump) {
10412 err = -EOPNOTSUPP;
10413 goto out_err;
10414 }
10415
10416 while (1) {
10417 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
10418 cb->nlh->nlmsg_seq, NLM_F_MULTI,
10419 NL80211_CMD_TESTMODE);
10420 struct nlattr *tmdata;
10421
10422 if (!hdr)
10423 break;
10424
10425 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
10426 genlmsg_cancel(skb, hdr);
10427 break;
10428 }
10429
10430 tmdata = nla_nest_start_noflag(skb, NL80211_ATTR_TESTDATA);
10431 if (!tmdata) {
10432 genlmsg_cancel(skb, hdr);
10433 break;
10434 }
10435 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
10436 nla_nest_end(skb, tmdata);
10437
10438 if (err == -ENOBUFS || err == -ENOENT) {
10439 genlmsg_cancel(skb, hdr);
10440 break;
10441 } else if (err) {
10442 genlmsg_cancel(skb, hdr);
10443 goto out_err;
10444 }
10445
10446 genlmsg_end(skb, hdr);
10447 }
10448
10449 err = skb->len;
10450 /* see above */
10451 cb->args[0] = phy_idx + 1;
10452 out_err:
10453 kfree(attrbuf);
10454 rtnl_unlock();
10455 return err;
10456 }
10457 #endif
10458
nl80211_connect(struct sk_buff * skb,struct genl_info * info)10459 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
10460 {
10461 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10462 struct net_device *dev = info->user_ptr[1];
10463 struct cfg80211_connect_params connect;
10464 struct wiphy *wiphy;
10465 struct cfg80211_cached_keys *connkeys = NULL;
10466 u32 freq = 0;
10467 int err;
10468
10469 memset(&connect, 0, sizeof(connect));
10470
10471 if (!info->attrs[NL80211_ATTR_SSID] ||
10472 !nla_len(info->attrs[NL80211_ATTR_SSID]))
10473 return -EINVAL;
10474
10475 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
10476 connect.auth_type =
10477 nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
10478 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
10479 NL80211_CMD_CONNECT))
10480 return -EINVAL;
10481 } else
10482 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
10483
10484 connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
10485
10486 if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
10487 !wiphy_ext_feature_isset(&rdev->wiphy,
10488 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
10489 return -EINVAL;
10490 connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
10491
10492 err = nl80211_crypto_settings(rdev, info, &connect.crypto,
10493 NL80211_MAX_NR_CIPHER_SUITES);
10494 if (err)
10495 return err;
10496
10497 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10498 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10499 return -EOPNOTSUPP;
10500
10501 wiphy = &rdev->wiphy;
10502
10503 connect.bg_scan_period = -1;
10504 if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
10505 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
10506 connect.bg_scan_period =
10507 nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
10508 }
10509
10510 if (info->attrs[NL80211_ATTR_MAC])
10511 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10512 else if (info->attrs[NL80211_ATTR_MAC_HINT])
10513 connect.bssid_hint =
10514 nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
10515 connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10516 connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10517
10518 if (info->attrs[NL80211_ATTR_IE]) {
10519 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10520 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10521 }
10522
10523 if (info->attrs[NL80211_ATTR_USE_MFP]) {
10524 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
10525 if (connect.mfp == NL80211_MFP_OPTIONAL &&
10526 !wiphy_ext_feature_isset(&rdev->wiphy,
10527 NL80211_EXT_FEATURE_MFP_OPTIONAL))
10528 return -EOPNOTSUPP;
10529 } else {
10530 connect.mfp = NL80211_MFP_NO;
10531 }
10532
10533 if (info->attrs[NL80211_ATTR_PREV_BSSID])
10534 connect.prev_bssid =
10535 nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
10536
10537 if (info->attrs[NL80211_ATTR_WIPHY_FREQ])
10538 freq = MHZ_TO_KHZ(nla_get_u32(
10539 info->attrs[NL80211_ATTR_WIPHY_FREQ]));
10540 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
10541 freq +=
10542 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
10543
10544 if (freq) {
10545 connect.channel = nl80211_get_valid_chan(wiphy, freq);
10546 if (!connect.channel)
10547 return -EINVAL;
10548 } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
10549 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
10550 freq = MHZ_TO_KHZ(freq);
10551 connect.channel_hint = nl80211_get_valid_chan(wiphy, freq);
10552 if (!connect.channel_hint)
10553 return -EINVAL;
10554 }
10555
10556 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
10557 connect.edmg.channels =
10558 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
10559
10560 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
10561 connect.edmg.bw_config =
10562 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
10563 }
10564
10565 if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
10566 connkeys = nl80211_parse_connkeys(rdev, info, NULL);
10567 if (IS_ERR(connkeys))
10568 return PTR_ERR(connkeys);
10569 }
10570
10571 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
10572 connect.flags |= ASSOC_REQ_DISABLE_HT;
10573
10574 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10575 memcpy(&connect.ht_capa_mask,
10576 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
10577 sizeof(connect.ht_capa_mask));
10578
10579 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
10580 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
10581 kfree_sensitive(connkeys);
10582 return -EINVAL;
10583 }
10584 memcpy(&connect.ht_capa,
10585 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
10586 sizeof(connect.ht_capa));
10587 }
10588
10589 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
10590 connect.flags |= ASSOC_REQ_DISABLE_VHT;
10591
10592 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
10593 memcpy(&connect.vht_capa_mask,
10594 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
10595 sizeof(connect.vht_capa_mask));
10596
10597 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
10598 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
10599 kfree_sensitive(connkeys);
10600 return -EINVAL;
10601 }
10602 memcpy(&connect.vht_capa,
10603 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
10604 sizeof(connect.vht_capa));
10605 }
10606
10607 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
10608 if (!((rdev->wiphy.features &
10609 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
10610 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
10611 !wiphy_ext_feature_isset(&rdev->wiphy,
10612 NL80211_EXT_FEATURE_RRM)) {
10613 kfree_sensitive(connkeys);
10614 return -EINVAL;
10615 }
10616 connect.flags |= ASSOC_REQ_USE_RRM;
10617 }
10618
10619 connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
10620 if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
10621 kfree_sensitive(connkeys);
10622 return -EOPNOTSUPP;
10623 }
10624
10625 if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
10626 /* bss selection makes no sense if bssid is set */
10627 if (connect.bssid) {
10628 kfree_sensitive(connkeys);
10629 return -EINVAL;
10630 }
10631
10632 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
10633 wiphy, &connect.bss_select);
10634 if (err) {
10635 kfree_sensitive(connkeys);
10636 return err;
10637 }
10638 }
10639
10640 if (wiphy_ext_feature_isset(&rdev->wiphy,
10641 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
10642 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
10643 info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
10644 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
10645 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
10646 connect.fils_erp_username =
10647 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
10648 connect.fils_erp_username_len =
10649 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
10650 connect.fils_erp_realm =
10651 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
10652 connect.fils_erp_realm_len =
10653 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
10654 connect.fils_erp_next_seq_num =
10655 nla_get_u16(
10656 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
10657 connect.fils_erp_rrk =
10658 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
10659 connect.fils_erp_rrk_len =
10660 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
10661 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
10662 info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
10663 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
10664 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
10665 kfree_sensitive(connkeys);
10666 return -EINVAL;
10667 }
10668
10669 if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
10670 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
10671 kfree_sensitive(connkeys);
10672 GENL_SET_ERR_MSG(info,
10673 "external auth requires connection ownership");
10674 return -EINVAL;
10675 }
10676 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT;
10677 }
10678
10679 wdev_lock(dev->ieee80211_ptr);
10680
10681 err = cfg80211_connect(rdev, dev, &connect, connkeys,
10682 connect.prev_bssid);
10683 if (err)
10684 kfree_sensitive(connkeys);
10685
10686 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
10687 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
10688 if (connect.bssid)
10689 memcpy(dev->ieee80211_ptr->disconnect_bssid,
10690 connect.bssid, ETH_ALEN);
10691 else
10692 eth_zero_addr(dev->ieee80211_ptr->disconnect_bssid);
10693 }
10694
10695 wdev_unlock(dev->ieee80211_ptr);
10696
10697 return err;
10698 }
10699
nl80211_update_connect_params(struct sk_buff * skb,struct genl_info * info)10700 static int nl80211_update_connect_params(struct sk_buff *skb,
10701 struct genl_info *info)
10702 {
10703 struct cfg80211_connect_params connect = {};
10704 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10705 struct net_device *dev = info->user_ptr[1];
10706 struct wireless_dev *wdev = dev->ieee80211_ptr;
10707 bool fils_sk_offload;
10708 u32 auth_type;
10709 u32 changed = 0;
10710 int ret;
10711
10712 if (!rdev->ops->update_connect_params)
10713 return -EOPNOTSUPP;
10714
10715 if (info->attrs[NL80211_ATTR_IE]) {
10716 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10717 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10718 changed |= UPDATE_ASSOC_IES;
10719 }
10720
10721 fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy,
10722 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD);
10723
10724 /*
10725 * when driver supports fils-sk offload all attributes must be
10726 * provided. So the else covers "fils-sk-not-all" and
10727 * "no-fils-sk-any".
10728 */
10729 if (fils_sk_offload &&
10730 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
10731 info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
10732 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
10733 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
10734 connect.fils_erp_username =
10735 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
10736 connect.fils_erp_username_len =
10737 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
10738 connect.fils_erp_realm =
10739 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
10740 connect.fils_erp_realm_len =
10741 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
10742 connect.fils_erp_next_seq_num =
10743 nla_get_u16(
10744 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
10745 connect.fils_erp_rrk =
10746 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
10747 connect.fils_erp_rrk_len =
10748 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
10749 changed |= UPDATE_FILS_ERP_INFO;
10750 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
10751 info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
10752 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
10753 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
10754 return -EINVAL;
10755 }
10756
10757 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
10758 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
10759 if (!nl80211_valid_auth_type(rdev, auth_type,
10760 NL80211_CMD_CONNECT))
10761 return -EINVAL;
10762
10763 if (auth_type == NL80211_AUTHTYPE_FILS_SK &&
10764 fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO))
10765 return -EINVAL;
10766
10767 connect.auth_type = auth_type;
10768 changed |= UPDATE_AUTH_TYPE;
10769 }
10770
10771 wdev_lock(dev->ieee80211_ptr);
10772 if (!wdev->current_bss)
10773 ret = -ENOLINK;
10774 else
10775 ret = rdev_update_connect_params(rdev, dev, &connect, changed);
10776 wdev_unlock(dev->ieee80211_ptr);
10777
10778 return ret;
10779 }
10780
nl80211_disconnect(struct sk_buff * skb,struct genl_info * info)10781 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
10782 {
10783 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10784 struct net_device *dev = info->user_ptr[1];
10785 u16 reason;
10786 int ret;
10787
10788 if (dev->ieee80211_ptr->conn_owner_nlportid &&
10789 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
10790 return -EPERM;
10791
10792 if (!info->attrs[NL80211_ATTR_REASON_CODE])
10793 reason = WLAN_REASON_DEAUTH_LEAVING;
10794 else
10795 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
10796
10797 if (reason == 0)
10798 return -EINVAL;
10799
10800 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10801 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10802 return -EOPNOTSUPP;
10803
10804 wdev_lock(dev->ieee80211_ptr);
10805 ret = cfg80211_disconnect(rdev, dev, reason, true);
10806 wdev_unlock(dev->ieee80211_ptr);
10807 return ret;
10808 }
10809
nl80211_wiphy_netns(struct sk_buff * skb,struct genl_info * info)10810 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
10811 {
10812 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10813 struct net *net;
10814 int err;
10815
10816 if (info->attrs[NL80211_ATTR_PID]) {
10817 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
10818
10819 net = get_net_ns_by_pid(pid);
10820 } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
10821 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
10822
10823 net = get_net_ns_by_fd(fd);
10824 } else {
10825 return -EINVAL;
10826 }
10827
10828 if (IS_ERR(net))
10829 return PTR_ERR(net);
10830
10831 err = 0;
10832
10833 /* check if anything to do */
10834 if (!net_eq(wiphy_net(&rdev->wiphy), net))
10835 err = cfg80211_switch_netns(rdev, net);
10836
10837 put_net(net);
10838 return err;
10839 }
10840
nl80211_setdel_pmksa(struct sk_buff * skb,struct genl_info * info)10841 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
10842 {
10843 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10844 int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
10845 struct cfg80211_pmksa *pmksa) = NULL;
10846 struct net_device *dev = info->user_ptr[1];
10847 struct cfg80211_pmksa pmksa;
10848
10849 memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
10850
10851 if (!info->attrs[NL80211_ATTR_PMKID])
10852 return -EINVAL;
10853
10854 pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
10855
10856 if (info->attrs[NL80211_ATTR_MAC]) {
10857 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10858 } else if (info->attrs[NL80211_ATTR_SSID] &&
10859 info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
10860 (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA ||
10861 info->attrs[NL80211_ATTR_PMK])) {
10862 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10863 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10864 pmksa.cache_id =
10865 nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
10866 } else {
10867 return -EINVAL;
10868 }
10869 if (info->attrs[NL80211_ATTR_PMK]) {
10870 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
10871 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
10872 }
10873
10874 if (info->attrs[NL80211_ATTR_PMK_LIFETIME])
10875 pmksa.pmk_lifetime =
10876 nla_get_u32(info->attrs[NL80211_ATTR_PMK_LIFETIME]);
10877
10878 if (info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD])
10879 pmksa.pmk_reauth_threshold =
10880 nla_get_u8(
10881 info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD]);
10882
10883 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10884 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
10885 !(dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP &&
10886 wiphy_ext_feature_isset(&rdev->wiphy,
10887 NL80211_EXT_FEATURE_AP_PMKSA_CACHING)))
10888 return -EOPNOTSUPP;
10889
10890 switch (info->genlhdr->cmd) {
10891 case NL80211_CMD_SET_PMKSA:
10892 rdev_ops = rdev->ops->set_pmksa;
10893 break;
10894 case NL80211_CMD_DEL_PMKSA:
10895 rdev_ops = rdev->ops->del_pmksa;
10896 break;
10897 default:
10898 WARN_ON(1);
10899 break;
10900 }
10901
10902 if (!rdev_ops)
10903 return -EOPNOTSUPP;
10904
10905 return rdev_ops(&rdev->wiphy, dev, &pmksa);
10906 }
10907
nl80211_flush_pmksa(struct sk_buff * skb,struct genl_info * info)10908 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
10909 {
10910 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10911 struct net_device *dev = info->user_ptr[1];
10912
10913 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10914 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10915 return -EOPNOTSUPP;
10916
10917 if (!rdev->ops->flush_pmksa)
10918 return -EOPNOTSUPP;
10919
10920 return rdev_flush_pmksa(rdev, dev);
10921 }
10922
nl80211_tdls_mgmt(struct sk_buff * skb,struct genl_info * info)10923 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
10924 {
10925 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10926 struct net_device *dev = info->user_ptr[1];
10927 u8 action_code, dialog_token;
10928 u32 peer_capability = 0;
10929 u16 status_code;
10930 u8 *peer;
10931 bool initiator;
10932
10933 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
10934 !rdev->ops->tdls_mgmt)
10935 return -EOPNOTSUPP;
10936
10937 if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
10938 !info->attrs[NL80211_ATTR_STATUS_CODE] ||
10939 !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
10940 !info->attrs[NL80211_ATTR_IE] ||
10941 !info->attrs[NL80211_ATTR_MAC])
10942 return -EINVAL;
10943
10944 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
10945 action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
10946 status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
10947 dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
10948 initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
10949 if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
10950 peer_capability =
10951 nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
10952
10953 return rdev_tdls_mgmt(rdev, dev, peer, action_code,
10954 dialog_token, status_code, peer_capability,
10955 initiator,
10956 nla_data(info->attrs[NL80211_ATTR_IE]),
10957 nla_len(info->attrs[NL80211_ATTR_IE]));
10958 }
10959
nl80211_tdls_oper(struct sk_buff * skb,struct genl_info * info)10960 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
10961 {
10962 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10963 struct net_device *dev = info->user_ptr[1];
10964 enum nl80211_tdls_operation operation;
10965 u8 *peer;
10966
10967 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
10968 !rdev->ops->tdls_oper)
10969 return -EOPNOTSUPP;
10970
10971 if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
10972 !info->attrs[NL80211_ATTR_MAC])
10973 return -EINVAL;
10974
10975 operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
10976 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
10977
10978 return rdev_tdls_oper(rdev, dev, peer, operation);
10979 }
10980
nl80211_remain_on_channel(struct sk_buff * skb,struct genl_info * info)10981 static int nl80211_remain_on_channel(struct sk_buff *skb,
10982 struct genl_info *info)
10983 {
10984 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10985 struct wireless_dev *wdev = info->user_ptr[1];
10986 struct cfg80211_chan_def chandef;
10987 const struct cfg80211_chan_def *compat_chandef;
10988 struct sk_buff *msg;
10989 void *hdr;
10990 u64 cookie;
10991 u32 duration;
10992 int err;
10993
10994 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
10995 !info->attrs[NL80211_ATTR_DURATION])
10996 return -EINVAL;
10997
10998 duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
10999
11000 if (!rdev->ops->remain_on_channel ||
11001 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
11002 return -EOPNOTSUPP;
11003
11004 /*
11005 * We should be on that channel for at least a minimum amount of
11006 * time (10ms) but no longer than the driver supports.
11007 */
11008 if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
11009 duration > rdev->wiphy.max_remain_on_channel_duration)
11010 return -EINVAL;
11011
11012 err = nl80211_parse_chandef(rdev, info, &chandef);
11013 if (err)
11014 return err;
11015
11016 wdev_lock(wdev);
11017 if (!cfg80211_off_channel_oper_allowed(wdev) &&
11018 !cfg80211_chandef_identical(&wdev->chandef, &chandef)) {
11019 compat_chandef = cfg80211_chandef_compatible(&wdev->chandef,
11020 &chandef);
11021 if (compat_chandef != &chandef) {
11022 wdev_unlock(wdev);
11023 return -EBUSY;
11024 }
11025 }
11026 wdev_unlock(wdev);
11027
11028 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11029 if (!msg)
11030 return -ENOMEM;
11031
11032 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11033 NL80211_CMD_REMAIN_ON_CHANNEL);
11034 if (!hdr) {
11035 err = -ENOBUFS;
11036 goto free_msg;
11037 }
11038
11039 err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
11040 duration, &cookie);
11041
11042 if (err)
11043 goto free_msg;
11044
11045 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11046 NL80211_ATTR_PAD))
11047 goto nla_put_failure;
11048
11049 genlmsg_end(msg, hdr);
11050
11051 return genlmsg_reply(msg, info);
11052
11053 nla_put_failure:
11054 err = -ENOBUFS;
11055 free_msg:
11056 nlmsg_free(msg);
11057 return err;
11058 }
11059
nl80211_cancel_remain_on_channel(struct sk_buff * skb,struct genl_info * info)11060 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
11061 struct genl_info *info)
11062 {
11063 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11064 struct wireless_dev *wdev = info->user_ptr[1];
11065 u64 cookie;
11066
11067 if (!info->attrs[NL80211_ATTR_COOKIE])
11068 return -EINVAL;
11069
11070 if (!rdev->ops->cancel_remain_on_channel)
11071 return -EOPNOTSUPP;
11072
11073 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
11074
11075 return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
11076 }
11077
nl80211_set_tx_bitrate_mask(struct sk_buff * skb,struct genl_info * info)11078 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
11079 struct genl_info *info)
11080 {
11081 struct cfg80211_bitrate_mask mask;
11082 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11083 struct net_device *dev = info->user_ptr[1];
11084 int err;
11085
11086 if (!rdev->ops->set_bitrate_mask)
11087 return -EOPNOTSUPP;
11088
11089 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
11090 NL80211_ATTR_TX_RATES, &mask,
11091 dev);
11092 if (err)
11093 return err;
11094
11095 return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
11096 }
11097
nl80211_register_mgmt(struct sk_buff * skb,struct genl_info * info)11098 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
11099 {
11100 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11101 struct wireless_dev *wdev = info->user_ptr[1];
11102 u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
11103
11104 if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
11105 return -EINVAL;
11106
11107 if (info->attrs[NL80211_ATTR_FRAME_TYPE])
11108 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
11109
11110 switch (wdev->iftype) {
11111 case NL80211_IFTYPE_STATION:
11112 case NL80211_IFTYPE_ADHOC:
11113 case NL80211_IFTYPE_P2P_CLIENT:
11114 case NL80211_IFTYPE_AP:
11115 case NL80211_IFTYPE_AP_VLAN:
11116 case NL80211_IFTYPE_MESH_POINT:
11117 case NL80211_IFTYPE_P2P_GO:
11118 case NL80211_IFTYPE_P2P_DEVICE:
11119 break;
11120 case NL80211_IFTYPE_NAN:
11121 default:
11122 return -EOPNOTSUPP;
11123 }
11124
11125 /* not much point in registering if we can't reply */
11126 if (!rdev->ops->mgmt_tx)
11127 return -EOPNOTSUPP;
11128
11129 if (info->attrs[NL80211_ATTR_RECEIVE_MULTICAST] &&
11130 !wiphy_ext_feature_isset(&rdev->wiphy,
11131 NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS)) {
11132 GENL_SET_ERR_MSG(info,
11133 "multicast RX registrations are not supported");
11134 return -EOPNOTSUPP;
11135 }
11136
11137 return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
11138 nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
11139 nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]),
11140 info->attrs[NL80211_ATTR_RECEIVE_MULTICAST],
11141 info->extack);
11142 }
11143
nl80211_tx_mgmt(struct sk_buff * skb,struct genl_info * info)11144 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
11145 {
11146 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11147 struct wireless_dev *wdev = info->user_ptr[1];
11148 struct cfg80211_chan_def chandef;
11149 int err;
11150 void *hdr = NULL;
11151 u64 cookie;
11152 struct sk_buff *msg = NULL;
11153 struct cfg80211_mgmt_tx_params params = {
11154 .dont_wait_for_ack =
11155 info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
11156 };
11157
11158 if (!info->attrs[NL80211_ATTR_FRAME])
11159 return -EINVAL;
11160
11161 if (!rdev->ops->mgmt_tx)
11162 return -EOPNOTSUPP;
11163
11164 switch (wdev->iftype) {
11165 case NL80211_IFTYPE_P2P_DEVICE:
11166 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
11167 return -EINVAL;
11168 case NL80211_IFTYPE_STATION:
11169 case NL80211_IFTYPE_ADHOC:
11170 case NL80211_IFTYPE_P2P_CLIENT:
11171 case NL80211_IFTYPE_AP:
11172 case NL80211_IFTYPE_AP_VLAN:
11173 case NL80211_IFTYPE_MESH_POINT:
11174 case NL80211_IFTYPE_P2P_GO:
11175 break;
11176 case NL80211_IFTYPE_NAN:
11177 default:
11178 return -EOPNOTSUPP;
11179 }
11180
11181 if (info->attrs[NL80211_ATTR_DURATION]) {
11182 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
11183 return -EINVAL;
11184 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
11185
11186 /*
11187 * We should wait on the channel for at least a minimum amount
11188 * of time (10ms) but no longer than the driver supports.
11189 */
11190 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
11191 params.wait > rdev->wiphy.max_remain_on_channel_duration)
11192 return -EINVAL;
11193 }
11194
11195 params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
11196
11197 if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
11198 return -EINVAL;
11199
11200 params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
11201
11202 /* get the channel if any has been specified, otherwise pass NULL to
11203 * the driver. The latter will use the current one
11204 */
11205 chandef.chan = NULL;
11206 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
11207 err = nl80211_parse_chandef(rdev, info, &chandef);
11208 if (err)
11209 return err;
11210 }
11211
11212 if (!chandef.chan && params.offchan)
11213 return -EINVAL;
11214
11215 wdev_lock(wdev);
11216 if (params.offchan && !cfg80211_off_channel_oper_allowed(wdev)) {
11217 wdev_unlock(wdev);
11218 return -EBUSY;
11219 }
11220 wdev_unlock(wdev);
11221
11222 params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
11223 params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
11224
11225 if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
11226 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
11227 int i;
11228
11229 if (len % sizeof(u16))
11230 return -EINVAL;
11231
11232 params.n_csa_offsets = len / sizeof(u16);
11233 params.csa_offsets =
11234 nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
11235
11236 /* check that all the offsets fit the frame */
11237 for (i = 0; i < params.n_csa_offsets; i++) {
11238 if (params.csa_offsets[i] >= params.len)
11239 return -EINVAL;
11240 }
11241 }
11242
11243 if (!params.dont_wait_for_ack) {
11244 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11245 if (!msg)
11246 return -ENOMEM;
11247
11248 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11249 NL80211_CMD_FRAME);
11250 if (!hdr) {
11251 err = -ENOBUFS;
11252 goto free_msg;
11253 }
11254 }
11255
11256 params.chan = chandef.chan;
11257 err = cfg80211_mlme_mgmt_tx(rdev, wdev, ¶ms, &cookie);
11258 if (err)
11259 goto free_msg;
11260
11261 if (msg) {
11262 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11263 NL80211_ATTR_PAD))
11264 goto nla_put_failure;
11265
11266 genlmsg_end(msg, hdr);
11267 return genlmsg_reply(msg, info);
11268 }
11269
11270 return 0;
11271
11272 nla_put_failure:
11273 err = -ENOBUFS;
11274 free_msg:
11275 nlmsg_free(msg);
11276 return err;
11277 }
11278
nl80211_tx_mgmt_cancel_wait(struct sk_buff * skb,struct genl_info * info)11279 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
11280 {
11281 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11282 struct wireless_dev *wdev = info->user_ptr[1];
11283 u64 cookie;
11284
11285 if (!info->attrs[NL80211_ATTR_COOKIE])
11286 return -EINVAL;
11287
11288 if (!rdev->ops->mgmt_tx_cancel_wait)
11289 return -EOPNOTSUPP;
11290
11291 switch (wdev->iftype) {
11292 case NL80211_IFTYPE_STATION:
11293 case NL80211_IFTYPE_ADHOC:
11294 case NL80211_IFTYPE_P2P_CLIENT:
11295 case NL80211_IFTYPE_AP:
11296 case NL80211_IFTYPE_AP_VLAN:
11297 case NL80211_IFTYPE_P2P_GO:
11298 case NL80211_IFTYPE_P2P_DEVICE:
11299 break;
11300 case NL80211_IFTYPE_NAN:
11301 default:
11302 return -EOPNOTSUPP;
11303 }
11304
11305 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
11306
11307 return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
11308 }
11309
nl80211_set_power_save(struct sk_buff * skb,struct genl_info * info)11310 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
11311 {
11312 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11313 struct wireless_dev *wdev;
11314 struct net_device *dev = info->user_ptr[1];
11315 u8 ps_state;
11316 bool state;
11317 int err;
11318
11319 if (!info->attrs[NL80211_ATTR_PS_STATE])
11320 return -EINVAL;
11321
11322 ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
11323
11324 wdev = dev->ieee80211_ptr;
11325
11326 if (!rdev->ops->set_power_mgmt)
11327 return -EOPNOTSUPP;
11328
11329 state = (ps_state == NL80211_PS_ENABLED) ? true : false;
11330
11331 if (state == wdev->ps)
11332 return 0;
11333
11334 err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
11335 if (!err)
11336 wdev->ps = state;
11337 return err;
11338 }
11339
nl80211_get_power_save(struct sk_buff * skb,struct genl_info * info)11340 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
11341 {
11342 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11343 enum nl80211_ps_state ps_state;
11344 struct wireless_dev *wdev;
11345 struct net_device *dev = info->user_ptr[1];
11346 struct sk_buff *msg;
11347 void *hdr;
11348 int err;
11349
11350 wdev = dev->ieee80211_ptr;
11351
11352 if (!rdev->ops->set_power_mgmt)
11353 return -EOPNOTSUPP;
11354
11355 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11356 if (!msg)
11357 return -ENOMEM;
11358
11359 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11360 NL80211_CMD_GET_POWER_SAVE);
11361 if (!hdr) {
11362 err = -ENOBUFS;
11363 goto free_msg;
11364 }
11365
11366 if (wdev->ps)
11367 ps_state = NL80211_PS_ENABLED;
11368 else
11369 ps_state = NL80211_PS_DISABLED;
11370
11371 if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
11372 goto nla_put_failure;
11373
11374 genlmsg_end(msg, hdr);
11375 return genlmsg_reply(msg, info);
11376
11377 nla_put_failure:
11378 err = -ENOBUFS;
11379 free_msg:
11380 nlmsg_free(msg);
11381 return err;
11382 }
11383
11384 static const struct nla_policy
11385 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
11386 [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
11387 [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
11388 [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
11389 [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
11390 [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
11391 [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
11392 [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
11393 };
11394
nl80211_set_cqm_txe(struct genl_info * info,u32 rate,u32 pkts,u32 intvl)11395 static int nl80211_set_cqm_txe(struct genl_info *info,
11396 u32 rate, u32 pkts, u32 intvl)
11397 {
11398 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11399 struct net_device *dev = info->user_ptr[1];
11400 struct wireless_dev *wdev = dev->ieee80211_ptr;
11401
11402 if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
11403 return -EINVAL;
11404
11405 if (!rdev->ops->set_cqm_txe_config)
11406 return -EOPNOTSUPP;
11407
11408 if (wdev->iftype != NL80211_IFTYPE_STATION &&
11409 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
11410 return -EOPNOTSUPP;
11411
11412 return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
11413 }
11414
cfg80211_cqm_rssi_update(struct cfg80211_registered_device * rdev,struct net_device * dev)11415 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
11416 struct net_device *dev)
11417 {
11418 struct wireless_dev *wdev = dev->ieee80211_ptr;
11419 s32 last, low, high;
11420 u32 hyst;
11421 int i, n, low_index;
11422 int err;
11423
11424 /* RSSI reporting disabled? */
11425 if (!wdev->cqm_config)
11426 return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
11427
11428 /*
11429 * Obtain current RSSI value if possible, if not and no RSSI threshold
11430 * event has been received yet, we should receive an event after a
11431 * connection is established and enough beacons received to calculate
11432 * the average.
11433 */
11434 if (!wdev->cqm_config->last_rssi_event_value && wdev->current_bss &&
11435 rdev->ops->get_station) {
11436 struct station_info sinfo = {};
11437 u8 *mac_addr;
11438
11439 mac_addr = wdev->current_bss->pub.bssid;
11440
11441 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
11442 if (err)
11443 return err;
11444
11445 cfg80211_sinfo_release_content(&sinfo);
11446 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
11447 wdev->cqm_config->last_rssi_event_value =
11448 (s8) sinfo.rx_beacon_signal_avg;
11449 }
11450
11451 last = wdev->cqm_config->last_rssi_event_value;
11452 hyst = wdev->cqm_config->rssi_hyst;
11453 n = wdev->cqm_config->n_rssi_thresholds;
11454
11455 for (i = 0; i < n; i++) {
11456 i = array_index_nospec(i, n);
11457 if (last < wdev->cqm_config->rssi_thresholds[i])
11458 break;
11459 }
11460
11461 low_index = i - 1;
11462 if (low_index >= 0) {
11463 low_index = array_index_nospec(low_index, n);
11464 low = wdev->cqm_config->rssi_thresholds[low_index] - hyst;
11465 } else {
11466 low = S32_MIN;
11467 }
11468 if (i < n) {
11469 i = array_index_nospec(i, n);
11470 high = wdev->cqm_config->rssi_thresholds[i] + hyst - 1;
11471 } else {
11472 high = S32_MAX;
11473 }
11474
11475 return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
11476 }
11477
nl80211_set_cqm_rssi(struct genl_info * info,const s32 * thresholds,int n_thresholds,u32 hysteresis)11478 static int nl80211_set_cqm_rssi(struct genl_info *info,
11479 const s32 *thresholds, int n_thresholds,
11480 u32 hysteresis)
11481 {
11482 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11483 struct net_device *dev = info->user_ptr[1];
11484 struct wireless_dev *wdev = dev->ieee80211_ptr;
11485 int i, err;
11486 s32 prev = S32_MIN;
11487
11488 /* Check all values negative and sorted */
11489 for (i = 0; i < n_thresholds; i++) {
11490 if (thresholds[i] > 0 || thresholds[i] <= prev)
11491 return -EINVAL;
11492
11493 prev = thresholds[i];
11494 }
11495
11496 if (wdev->iftype != NL80211_IFTYPE_STATION &&
11497 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
11498 return -EOPNOTSUPP;
11499
11500 wdev_lock(wdev);
11501 cfg80211_cqm_config_free(wdev);
11502 wdev_unlock(wdev);
11503
11504 if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) {
11505 if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */
11506 return rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
11507
11508 return rdev_set_cqm_rssi_config(rdev, dev,
11509 thresholds[0], hysteresis);
11510 }
11511
11512 if (!wiphy_ext_feature_isset(&rdev->wiphy,
11513 NL80211_EXT_FEATURE_CQM_RSSI_LIST))
11514 return -EOPNOTSUPP;
11515
11516 if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
11517 n_thresholds = 0;
11518
11519 wdev_lock(wdev);
11520 if (n_thresholds) {
11521 struct cfg80211_cqm_config *cqm_config;
11522
11523 cqm_config = kzalloc(sizeof(struct cfg80211_cqm_config) +
11524 n_thresholds * sizeof(s32), GFP_KERNEL);
11525 if (!cqm_config) {
11526 err = -ENOMEM;
11527 goto unlock;
11528 }
11529
11530 cqm_config->rssi_hyst = hysteresis;
11531 cqm_config->n_rssi_thresholds = n_thresholds;
11532 memcpy(cqm_config->rssi_thresholds, thresholds,
11533 n_thresholds * sizeof(s32));
11534
11535 wdev->cqm_config = cqm_config;
11536 }
11537
11538 err = cfg80211_cqm_rssi_update(rdev, dev);
11539
11540 unlock:
11541 wdev_unlock(wdev);
11542
11543 return err;
11544 }
11545
nl80211_set_cqm(struct sk_buff * skb,struct genl_info * info)11546 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
11547 {
11548 struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
11549 struct nlattr *cqm;
11550 int err;
11551
11552 cqm = info->attrs[NL80211_ATTR_CQM];
11553 if (!cqm)
11554 return -EINVAL;
11555
11556 err = nla_parse_nested_deprecated(attrs, NL80211_ATTR_CQM_MAX, cqm,
11557 nl80211_attr_cqm_policy,
11558 info->extack);
11559 if (err)
11560 return err;
11561
11562 if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
11563 attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
11564 const s32 *thresholds =
11565 nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
11566 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
11567 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
11568
11569 if (len % 4)
11570 return -EINVAL;
11571
11572 return nl80211_set_cqm_rssi(info, thresholds, len / 4,
11573 hysteresis);
11574 }
11575
11576 if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
11577 attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
11578 attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
11579 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
11580 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
11581 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
11582
11583 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
11584 }
11585
11586 return -EINVAL;
11587 }
11588
nl80211_join_ocb(struct sk_buff * skb,struct genl_info * info)11589 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
11590 {
11591 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11592 struct net_device *dev = info->user_ptr[1];
11593 struct ocb_setup setup = {};
11594 int err;
11595
11596 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
11597 if (err)
11598 return err;
11599
11600 return cfg80211_join_ocb(rdev, dev, &setup);
11601 }
11602
nl80211_leave_ocb(struct sk_buff * skb,struct genl_info * info)11603 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
11604 {
11605 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11606 struct net_device *dev = info->user_ptr[1];
11607
11608 return cfg80211_leave_ocb(rdev, dev);
11609 }
11610
nl80211_join_mesh(struct sk_buff * skb,struct genl_info * info)11611 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
11612 {
11613 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11614 struct net_device *dev = info->user_ptr[1];
11615 struct mesh_config cfg;
11616 struct mesh_setup setup;
11617 int err;
11618
11619 /* start with default */
11620 memcpy(&cfg, &default_mesh_config, sizeof(cfg));
11621 memcpy(&setup, &default_mesh_setup, sizeof(setup));
11622
11623 if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
11624 /* and parse parameters if given */
11625 err = nl80211_parse_mesh_config(info, &cfg, NULL);
11626 if (err)
11627 return err;
11628 }
11629
11630 if (!info->attrs[NL80211_ATTR_MESH_ID] ||
11631 !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
11632 return -EINVAL;
11633
11634 setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
11635 setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
11636
11637 if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
11638 !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
11639 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
11640 return -EINVAL;
11641
11642 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
11643 setup.beacon_interval =
11644 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
11645
11646 err = cfg80211_validate_beacon_int(rdev,
11647 NL80211_IFTYPE_MESH_POINT,
11648 setup.beacon_interval);
11649 if (err)
11650 return err;
11651 }
11652
11653 if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
11654 setup.dtim_period =
11655 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
11656 if (setup.dtim_period < 1 || setup.dtim_period > 100)
11657 return -EINVAL;
11658 }
11659
11660 if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
11661 /* parse additional setup parameters if given */
11662 err = nl80211_parse_mesh_setup(info, &setup);
11663 if (err)
11664 return err;
11665 }
11666
11667 if (setup.user_mpm)
11668 cfg.auto_open_plinks = false;
11669
11670 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
11671 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
11672 if (err)
11673 return err;
11674 } else {
11675 /* __cfg80211_join_mesh() will sort it out */
11676 setup.chandef.chan = NULL;
11677 }
11678
11679 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
11680 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
11681 int n_rates =
11682 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
11683 struct ieee80211_supported_band *sband;
11684
11685 if (!setup.chandef.chan)
11686 return -EINVAL;
11687
11688 sband = rdev->wiphy.bands[setup.chandef.chan->band];
11689
11690 err = ieee80211_get_ratemask(sband, rates, n_rates,
11691 &setup.basic_rates);
11692 if (err)
11693 return err;
11694 }
11695
11696 if (info->attrs[NL80211_ATTR_TX_RATES]) {
11697 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
11698 NL80211_ATTR_TX_RATES,
11699 &setup.beacon_rate,
11700 dev);
11701 if (err)
11702 return err;
11703
11704 if (!setup.chandef.chan)
11705 return -EINVAL;
11706
11707 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
11708 &setup.beacon_rate);
11709 if (err)
11710 return err;
11711 }
11712
11713 setup.userspace_handles_dfs =
11714 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
11715
11716 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
11717 int r = validate_pae_over_nl80211(rdev, info);
11718
11719 if (r < 0)
11720 return r;
11721
11722 setup.control_port_over_nl80211 = true;
11723 }
11724
11725 wdev_lock(dev->ieee80211_ptr);
11726 err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg);
11727 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER])
11728 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
11729 wdev_unlock(dev->ieee80211_ptr);
11730
11731 return err;
11732 }
11733
nl80211_leave_mesh(struct sk_buff * skb,struct genl_info * info)11734 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
11735 {
11736 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11737 struct net_device *dev = info->user_ptr[1];
11738
11739 return cfg80211_leave_mesh(rdev, dev);
11740 }
11741
11742 #ifdef CONFIG_PM
nl80211_send_wowlan_patterns(struct sk_buff * msg,struct cfg80211_registered_device * rdev)11743 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
11744 struct cfg80211_registered_device *rdev)
11745 {
11746 struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
11747 struct nlattr *nl_pats, *nl_pat;
11748 int i, pat_len;
11749
11750 if (!wowlan->n_patterns)
11751 return 0;
11752
11753 nl_pats = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
11754 if (!nl_pats)
11755 return -ENOBUFS;
11756
11757 for (i = 0; i < wowlan->n_patterns; i++) {
11758 nl_pat = nla_nest_start_noflag(msg, i + 1);
11759 if (!nl_pat)
11760 return -ENOBUFS;
11761 pat_len = wowlan->patterns[i].pattern_len;
11762 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
11763 wowlan->patterns[i].mask) ||
11764 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
11765 wowlan->patterns[i].pattern) ||
11766 nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
11767 wowlan->patterns[i].pkt_offset))
11768 return -ENOBUFS;
11769 nla_nest_end(msg, nl_pat);
11770 }
11771 nla_nest_end(msg, nl_pats);
11772
11773 return 0;
11774 }
11775
nl80211_send_wowlan_tcp(struct sk_buff * msg,struct cfg80211_wowlan_tcp * tcp)11776 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
11777 struct cfg80211_wowlan_tcp *tcp)
11778 {
11779 struct nlattr *nl_tcp;
11780
11781 if (!tcp)
11782 return 0;
11783
11784 nl_tcp = nla_nest_start_noflag(msg,
11785 NL80211_WOWLAN_TRIG_TCP_CONNECTION);
11786 if (!nl_tcp)
11787 return -ENOBUFS;
11788
11789 if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
11790 nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
11791 nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
11792 nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
11793 nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
11794 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
11795 tcp->payload_len, tcp->payload) ||
11796 nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
11797 tcp->data_interval) ||
11798 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
11799 tcp->wake_len, tcp->wake_data) ||
11800 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
11801 DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
11802 return -ENOBUFS;
11803
11804 if (tcp->payload_seq.len &&
11805 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
11806 sizeof(tcp->payload_seq), &tcp->payload_seq))
11807 return -ENOBUFS;
11808
11809 if (tcp->payload_tok.len &&
11810 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
11811 sizeof(tcp->payload_tok) + tcp->tokens_size,
11812 &tcp->payload_tok))
11813 return -ENOBUFS;
11814
11815 nla_nest_end(msg, nl_tcp);
11816
11817 return 0;
11818 }
11819
nl80211_send_wowlan_nd(struct sk_buff * msg,struct cfg80211_sched_scan_request * req)11820 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
11821 struct cfg80211_sched_scan_request *req)
11822 {
11823 struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
11824 int i;
11825
11826 if (!req)
11827 return 0;
11828
11829 nd = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
11830 if (!nd)
11831 return -ENOBUFS;
11832
11833 if (req->n_scan_plans == 1 &&
11834 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
11835 req->scan_plans[0].interval * 1000))
11836 return -ENOBUFS;
11837
11838 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
11839 return -ENOBUFS;
11840
11841 if (req->relative_rssi_set) {
11842 struct nl80211_bss_select_rssi_adjust rssi_adjust;
11843
11844 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
11845 req->relative_rssi))
11846 return -ENOBUFS;
11847
11848 rssi_adjust.band = req->rssi_adjust.band;
11849 rssi_adjust.delta = req->rssi_adjust.delta;
11850 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
11851 sizeof(rssi_adjust), &rssi_adjust))
11852 return -ENOBUFS;
11853 }
11854
11855 freqs = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_FREQUENCIES);
11856 if (!freqs)
11857 return -ENOBUFS;
11858
11859 for (i = 0; i < req->n_channels; i++) {
11860 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
11861 return -ENOBUFS;
11862 }
11863
11864 nla_nest_end(msg, freqs);
11865
11866 if (req->n_match_sets) {
11867 matches = nla_nest_start_noflag(msg,
11868 NL80211_ATTR_SCHED_SCAN_MATCH);
11869 if (!matches)
11870 return -ENOBUFS;
11871
11872 for (i = 0; i < req->n_match_sets; i++) {
11873 match = nla_nest_start_noflag(msg, i);
11874 if (!match)
11875 return -ENOBUFS;
11876
11877 if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
11878 req->match_sets[i].ssid.ssid_len,
11879 req->match_sets[i].ssid.ssid))
11880 return -ENOBUFS;
11881 nla_nest_end(msg, match);
11882 }
11883 nla_nest_end(msg, matches);
11884 }
11885
11886 scan_plans = nla_nest_start_noflag(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
11887 if (!scan_plans)
11888 return -ENOBUFS;
11889
11890 for (i = 0; i < req->n_scan_plans; i++) {
11891 scan_plan = nla_nest_start_noflag(msg, i + 1);
11892 if (!scan_plan)
11893 return -ENOBUFS;
11894
11895 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
11896 req->scan_plans[i].interval) ||
11897 (req->scan_plans[i].iterations &&
11898 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
11899 req->scan_plans[i].iterations)))
11900 return -ENOBUFS;
11901 nla_nest_end(msg, scan_plan);
11902 }
11903 nla_nest_end(msg, scan_plans);
11904
11905 nla_nest_end(msg, nd);
11906
11907 return 0;
11908 }
11909
nl80211_get_wowlan(struct sk_buff * skb,struct genl_info * info)11910 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
11911 {
11912 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11913 struct sk_buff *msg;
11914 void *hdr;
11915 u32 size = NLMSG_DEFAULT_SIZE;
11916
11917 if (!rdev->wiphy.wowlan)
11918 return -EOPNOTSUPP;
11919
11920 if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
11921 /* adjust size to have room for all the data */
11922 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
11923 rdev->wiphy.wowlan_config->tcp->payload_len +
11924 rdev->wiphy.wowlan_config->tcp->wake_len +
11925 rdev->wiphy.wowlan_config->tcp->wake_len / 8;
11926 }
11927
11928 msg = nlmsg_new(size, GFP_KERNEL);
11929 if (!msg)
11930 return -ENOMEM;
11931
11932 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11933 NL80211_CMD_GET_WOWLAN);
11934 if (!hdr)
11935 goto nla_put_failure;
11936
11937 if (rdev->wiphy.wowlan_config) {
11938 struct nlattr *nl_wowlan;
11939
11940 nl_wowlan = nla_nest_start_noflag(msg,
11941 NL80211_ATTR_WOWLAN_TRIGGERS);
11942 if (!nl_wowlan)
11943 goto nla_put_failure;
11944
11945 if ((rdev->wiphy.wowlan_config->any &&
11946 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
11947 (rdev->wiphy.wowlan_config->disconnect &&
11948 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
11949 (rdev->wiphy.wowlan_config->magic_pkt &&
11950 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
11951 (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
11952 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
11953 (rdev->wiphy.wowlan_config->eap_identity_req &&
11954 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
11955 (rdev->wiphy.wowlan_config->four_way_handshake &&
11956 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
11957 (rdev->wiphy.wowlan_config->rfkill_release &&
11958 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
11959 goto nla_put_failure;
11960
11961 if (nl80211_send_wowlan_patterns(msg, rdev))
11962 goto nla_put_failure;
11963
11964 if (nl80211_send_wowlan_tcp(msg,
11965 rdev->wiphy.wowlan_config->tcp))
11966 goto nla_put_failure;
11967
11968 if (nl80211_send_wowlan_nd(
11969 msg,
11970 rdev->wiphy.wowlan_config->nd_config))
11971 goto nla_put_failure;
11972
11973 nla_nest_end(msg, nl_wowlan);
11974 }
11975
11976 genlmsg_end(msg, hdr);
11977 return genlmsg_reply(msg, info);
11978
11979 nla_put_failure:
11980 nlmsg_free(msg);
11981 return -ENOBUFS;
11982 }
11983
nl80211_parse_wowlan_tcp(struct cfg80211_registered_device * rdev,struct nlattr * attr,struct cfg80211_wowlan * trig)11984 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
11985 struct nlattr *attr,
11986 struct cfg80211_wowlan *trig)
11987 {
11988 struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
11989 struct cfg80211_wowlan_tcp *cfg;
11990 struct nl80211_wowlan_tcp_data_token *tok = NULL;
11991 struct nl80211_wowlan_tcp_data_seq *seq = NULL;
11992 u32 size;
11993 u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
11994 int err, port;
11995
11996 if (!rdev->wiphy.wowlan->tcp)
11997 return -EINVAL;
11998
11999 err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TCP, attr,
12000 nl80211_wowlan_tcp_policy, NULL);
12001 if (err)
12002 return err;
12003
12004 if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
12005 !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
12006 !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
12007 !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
12008 !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
12009 !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
12010 !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
12011 !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
12012 return -EINVAL;
12013
12014 data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
12015 if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
12016 return -EINVAL;
12017
12018 if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
12019 rdev->wiphy.wowlan->tcp->data_interval_max ||
12020 nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
12021 return -EINVAL;
12022
12023 wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
12024 if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
12025 return -EINVAL;
12026
12027 wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
12028 if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
12029 return -EINVAL;
12030
12031 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
12032 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
12033
12034 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
12035 tokens_size = tokln - sizeof(*tok);
12036
12037 if (!tok->len || tokens_size % tok->len)
12038 return -EINVAL;
12039 if (!rdev->wiphy.wowlan->tcp->tok)
12040 return -EINVAL;
12041 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
12042 return -EINVAL;
12043 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
12044 return -EINVAL;
12045 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
12046 return -EINVAL;
12047 if (tok->offset + tok->len > data_size)
12048 return -EINVAL;
12049 }
12050
12051 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
12052 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
12053 if (!rdev->wiphy.wowlan->tcp->seq)
12054 return -EINVAL;
12055 if (seq->len == 0 || seq->len > 4)
12056 return -EINVAL;
12057 if (seq->len + seq->offset > data_size)
12058 return -EINVAL;
12059 }
12060
12061 size = sizeof(*cfg);
12062 size += data_size;
12063 size += wake_size + wake_mask_size;
12064 size += tokens_size;
12065
12066 cfg = kzalloc(size, GFP_KERNEL);
12067 if (!cfg)
12068 return -ENOMEM;
12069 cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
12070 cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
12071 memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
12072 ETH_ALEN);
12073 if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
12074 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
12075 else
12076 port = 0;
12077 #ifdef CONFIG_INET
12078 /* allocate a socket and port for it and use it */
12079 err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
12080 IPPROTO_TCP, &cfg->sock, 1);
12081 if (err) {
12082 kfree(cfg);
12083 return err;
12084 }
12085 if (inet_csk_get_port(cfg->sock->sk, port)) {
12086 sock_release(cfg->sock);
12087 kfree(cfg);
12088 return -EADDRINUSE;
12089 }
12090 cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
12091 #else
12092 if (!port) {
12093 kfree(cfg);
12094 return -EINVAL;
12095 }
12096 cfg->src_port = port;
12097 #endif
12098
12099 cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
12100 cfg->payload_len = data_size;
12101 cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
12102 memcpy((void *)cfg->payload,
12103 nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
12104 data_size);
12105 if (seq)
12106 cfg->payload_seq = *seq;
12107 cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
12108 cfg->wake_len = wake_size;
12109 cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
12110 memcpy((void *)cfg->wake_data,
12111 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
12112 wake_size);
12113 cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
12114 data_size + wake_size;
12115 memcpy((void *)cfg->wake_mask,
12116 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
12117 wake_mask_size);
12118 if (tok) {
12119 cfg->tokens_size = tokens_size;
12120 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
12121 }
12122
12123 trig->tcp = cfg;
12124
12125 return 0;
12126 }
12127
nl80211_parse_wowlan_nd(struct cfg80211_registered_device * rdev,const struct wiphy_wowlan_support * wowlan,struct nlattr * attr,struct cfg80211_wowlan * trig)12128 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
12129 const struct wiphy_wowlan_support *wowlan,
12130 struct nlattr *attr,
12131 struct cfg80211_wowlan *trig)
12132 {
12133 struct nlattr **tb;
12134 int err;
12135
12136 tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
12137 if (!tb)
12138 return -ENOMEM;
12139
12140 if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
12141 err = -EOPNOTSUPP;
12142 goto out;
12143 }
12144
12145 err = nla_parse_nested_deprecated(tb, NL80211_ATTR_MAX, attr,
12146 nl80211_policy, NULL);
12147 if (err)
12148 goto out;
12149
12150 trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
12151 wowlan->max_nd_match_sets);
12152 err = PTR_ERR_OR_ZERO(trig->nd_config);
12153 if (err)
12154 trig->nd_config = NULL;
12155
12156 out:
12157 kfree(tb);
12158 return err;
12159 }
12160
nl80211_set_wowlan(struct sk_buff * skb,struct genl_info * info)12161 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
12162 {
12163 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12164 struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
12165 struct cfg80211_wowlan new_triggers = {};
12166 struct cfg80211_wowlan *ntrig;
12167 const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
12168 int err, i;
12169 bool prev_enabled = rdev->wiphy.wowlan_config;
12170 bool regular = false;
12171
12172 if (!wowlan)
12173 return -EOPNOTSUPP;
12174
12175 if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
12176 cfg80211_rdev_free_wowlan(rdev);
12177 rdev->wiphy.wowlan_config = NULL;
12178 goto set_wakeup;
12179 }
12180
12181 err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TRIG,
12182 info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
12183 nl80211_wowlan_policy, info->extack);
12184 if (err)
12185 return err;
12186
12187 if (tb[NL80211_WOWLAN_TRIG_ANY]) {
12188 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
12189 return -EINVAL;
12190 new_triggers.any = true;
12191 }
12192
12193 if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
12194 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
12195 return -EINVAL;
12196 new_triggers.disconnect = true;
12197 regular = true;
12198 }
12199
12200 if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
12201 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
12202 return -EINVAL;
12203 new_triggers.magic_pkt = true;
12204 regular = true;
12205 }
12206
12207 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
12208 return -EINVAL;
12209
12210 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
12211 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
12212 return -EINVAL;
12213 new_triggers.gtk_rekey_failure = true;
12214 regular = true;
12215 }
12216
12217 if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
12218 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
12219 return -EINVAL;
12220 new_triggers.eap_identity_req = true;
12221 regular = true;
12222 }
12223
12224 if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
12225 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
12226 return -EINVAL;
12227 new_triggers.four_way_handshake = true;
12228 regular = true;
12229 }
12230
12231 if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
12232 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
12233 return -EINVAL;
12234 new_triggers.rfkill_release = true;
12235 regular = true;
12236 }
12237
12238 if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
12239 struct nlattr *pat;
12240 int n_patterns = 0;
12241 int rem, pat_len, mask_len, pkt_offset;
12242 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
12243
12244 regular = true;
12245
12246 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
12247 rem)
12248 n_patterns++;
12249 if (n_patterns > wowlan->n_patterns)
12250 return -EINVAL;
12251
12252 new_triggers.patterns = kcalloc(n_patterns,
12253 sizeof(new_triggers.patterns[0]),
12254 GFP_KERNEL);
12255 if (!new_triggers.patterns)
12256 return -ENOMEM;
12257
12258 new_triggers.n_patterns = n_patterns;
12259 i = 0;
12260
12261 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
12262 rem) {
12263 u8 *mask_pat;
12264
12265 err = nla_parse_nested_deprecated(pat_tb,
12266 MAX_NL80211_PKTPAT,
12267 pat,
12268 nl80211_packet_pattern_policy,
12269 info->extack);
12270 if (err)
12271 goto error;
12272
12273 err = -EINVAL;
12274 if (!pat_tb[NL80211_PKTPAT_MASK] ||
12275 !pat_tb[NL80211_PKTPAT_PATTERN])
12276 goto error;
12277 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
12278 mask_len = DIV_ROUND_UP(pat_len, 8);
12279 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
12280 goto error;
12281 if (pat_len > wowlan->pattern_max_len ||
12282 pat_len < wowlan->pattern_min_len)
12283 goto error;
12284
12285 if (!pat_tb[NL80211_PKTPAT_OFFSET])
12286 pkt_offset = 0;
12287 else
12288 pkt_offset = nla_get_u32(
12289 pat_tb[NL80211_PKTPAT_OFFSET]);
12290 if (pkt_offset > wowlan->max_pkt_offset)
12291 goto error;
12292 new_triggers.patterns[i].pkt_offset = pkt_offset;
12293
12294 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
12295 if (!mask_pat) {
12296 err = -ENOMEM;
12297 goto error;
12298 }
12299 new_triggers.patterns[i].mask = mask_pat;
12300 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
12301 mask_len);
12302 mask_pat += mask_len;
12303 new_triggers.patterns[i].pattern = mask_pat;
12304 new_triggers.patterns[i].pattern_len = pat_len;
12305 memcpy(mask_pat,
12306 nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
12307 pat_len);
12308 i++;
12309 }
12310 }
12311
12312 if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
12313 regular = true;
12314 err = nl80211_parse_wowlan_tcp(
12315 rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
12316 &new_triggers);
12317 if (err)
12318 goto error;
12319 }
12320
12321 if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
12322 regular = true;
12323 err = nl80211_parse_wowlan_nd(
12324 rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
12325 &new_triggers);
12326 if (err)
12327 goto error;
12328 }
12329
12330 /* The 'any' trigger means the device continues operating more or less
12331 * as in its normal operation mode and wakes up the host on most of the
12332 * normal interrupts (like packet RX, ...)
12333 * It therefore makes little sense to combine with the more constrained
12334 * wakeup trigger modes.
12335 */
12336 if (new_triggers.any && regular) {
12337 err = -EINVAL;
12338 goto error;
12339 }
12340
12341 ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
12342 if (!ntrig) {
12343 err = -ENOMEM;
12344 goto error;
12345 }
12346 cfg80211_rdev_free_wowlan(rdev);
12347 rdev->wiphy.wowlan_config = ntrig;
12348
12349 set_wakeup:
12350 if (rdev->ops->set_wakeup &&
12351 prev_enabled != !!rdev->wiphy.wowlan_config)
12352 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
12353
12354 return 0;
12355 error:
12356 for (i = 0; i < new_triggers.n_patterns; i++)
12357 kfree(new_triggers.patterns[i].mask);
12358 kfree(new_triggers.patterns);
12359 if (new_triggers.tcp && new_triggers.tcp->sock)
12360 sock_release(new_triggers.tcp->sock);
12361 kfree(new_triggers.tcp);
12362 kfree(new_triggers.nd_config);
12363 return err;
12364 }
12365 #endif
12366
nl80211_send_coalesce_rules(struct sk_buff * msg,struct cfg80211_registered_device * rdev)12367 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
12368 struct cfg80211_registered_device *rdev)
12369 {
12370 struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
12371 int i, j, pat_len;
12372 struct cfg80211_coalesce_rules *rule;
12373
12374 if (!rdev->coalesce->n_rules)
12375 return 0;
12376
12377 nl_rules = nla_nest_start_noflag(msg, NL80211_ATTR_COALESCE_RULE);
12378 if (!nl_rules)
12379 return -ENOBUFS;
12380
12381 for (i = 0; i < rdev->coalesce->n_rules; i++) {
12382 nl_rule = nla_nest_start_noflag(msg, i + 1);
12383 if (!nl_rule)
12384 return -ENOBUFS;
12385
12386 rule = &rdev->coalesce->rules[i];
12387 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
12388 rule->delay))
12389 return -ENOBUFS;
12390
12391 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
12392 rule->condition))
12393 return -ENOBUFS;
12394
12395 nl_pats = nla_nest_start_noflag(msg,
12396 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
12397 if (!nl_pats)
12398 return -ENOBUFS;
12399
12400 for (j = 0; j < rule->n_patterns; j++) {
12401 nl_pat = nla_nest_start_noflag(msg, j + 1);
12402 if (!nl_pat)
12403 return -ENOBUFS;
12404 pat_len = rule->patterns[j].pattern_len;
12405 if (nla_put(msg, NL80211_PKTPAT_MASK,
12406 DIV_ROUND_UP(pat_len, 8),
12407 rule->patterns[j].mask) ||
12408 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
12409 rule->patterns[j].pattern) ||
12410 nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
12411 rule->patterns[j].pkt_offset))
12412 return -ENOBUFS;
12413 nla_nest_end(msg, nl_pat);
12414 }
12415 nla_nest_end(msg, nl_pats);
12416 nla_nest_end(msg, nl_rule);
12417 }
12418 nla_nest_end(msg, nl_rules);
12419
12420 return 0;
12421 }
12422
nl80211_get_coalesce(struct sk_buff * skb,struct genl_info * info)12423 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
12424 {
12425 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12426 struct sk_buff *msg;
12427 void *hdr;
12428
12429 if (!rdev->wiphy.coalesce)
12430 return -EOPNOTSUPP;
12431
12432 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12433 if (!msg)
12434 return -ENOMEM;
12435
12436 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12437 NL80211_CMD_GET_COALESCE);
12438 if (!hdr)
12439 goto nla_put_failure;
12440
12441 if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
12442 goto nla_put_failure;
12443
12444 genlmsg_end(msg, hdr);
12445 return genlmsg_reply(msg, info);
12446
12447 nla_put_failure:
12448 nlmsg_free(msg);
12449 return -ENOBUFS;
12450 }
12451
cfg80211_rdev_free_coalesce(struct cfg80211_registered_device * rdev)12452 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
12453 {
12454 struct cfg80211_coalesce *coalesce = rdev->coalesce;
12455 int i, j;
12456 struct cfg80211_coalesce_rules *rule;
12457
12458 if (!coalesce)
12459 return;
12460
12461 for (i = 0; i < coalesce->n_rules; i++) {
12462 rule = &coalesce->rules[i];
12463 for (j = 0; j < rule->n_patterns; j++)
12464 kfree(rule->patterns[j].mask);
12465 kfree(rule->patterns);
12466 }
12467 kfree(coalesce->rules);
12468 kfree(coalesce);
12469 rdev->coalesce = NULL;
12470 }
12471
nl80211_parse_coalesce_rule(struct cfg80211_registered_device * rdev,struct nlattr * rule,struct cfg80211_coalesce_rules * new_rule)12472 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
12473 struct nlattr *rule,
12474 struct cfg80211_coalesce_rules *new_rule)
12475 {
12476 int err, i;
12477 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
12478 struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
12479 int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
12480 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
12481
12482 err = nla_parse_nested_deprecated(tb, NL80211_ATTR_COALESCE_RULE_MAX,
12483 rule, nl80211_coalesce_policy, NULL);
12484 if (err)
12485 return err;
12486
12487 if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
12488 new_rule->delay =
12489 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
12490 if (new_rule->delay > coalesce->max_delay)
12491 return -EINVAL;
12492
12493 if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
12494 new_rule->condition =
12495 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
12496
12497 if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
12498 return -EINVAL;
12499
12500 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
12501 rem)
12502 n_patterns++;
12503 if (n_patterns > coalesce->n_patterns)
12504 return -EINVAL;
12505
12506 new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
12507 GFP_KERNEL);
12508 if (!new_rule->patterns)
12509 return -ENOMEM;
12510
12511 new_rule->n_patterns = n_patterns;
12512 i = 0;
12513
12514 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
12515 rem) {
12516 u8 *mask_pat;
12517
12518 err = nla_parse_nested_deprecated(pat_tb, MAX_NL80211_PKTPAT,
12519 pat,
12520 nl80211_packet_pattern_policy,
12521 NULL);
12522 if (err)
12523 return err;
12524
12525 if (!pat_tb[NL80211_PKTPAT_MASK] ||
12526 !pat_tb[NL80211_PKTPAT_PATTERN])
12527 return -EINVAL;
12528 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
12529 mask_len = DIV_ROUND_UP(pat_len, 8);
12530 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
12531 return -EINVAL;
12532 if (pat_len > coalesce->pattern_max_len ||
12533 pat_len < coalesce->pattern_min_len)
12534 return -EINVAL;
12535
12536 if (!pat_tb[NL80211_PKTPAT_OFFSET])
12537 pkt_offset = 0;
12538 else
12539 pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
12540 if (pkt_offset > coalesce->max_pkt_offset)
12541 return -EINVAL;
12542 new_rule->patterns[i].pkt_offset = pkt_offset;
12543
12544 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
12545 if (!mask_pat)
12546 return -ENOMEM;
12547
12548 new_rule->patterns[i].mask = mask_pat;
12549 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
12550 mask_len);
12551
12552 mask_pat += mask_len;
12553 new_rule->patterns[i].pattern = mask_pat;
12554 new_rule->patterns[i].pattern_len = pat_len;
12555 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
12556 pat_len);
12557 i++;
12558 }
12559
12560 return 0;
12561 }
12562
nl80211_set_coalesce(struct sk_buff * skb,struct genl_info * info)12563 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
12564 {
12565 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12566 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
12567 struct cfg80211_coalesce new_coalesce = {};
12568 struct cfg80211_coalesce *n_coalesce;
12569 int err, rem_rule, n_rules = 0, i, j;
12570 struct nlattr *rule;
12571 struct cfg80211_coalesce_rules *tmp_rule;
12572
12573 if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
12574 return -EOPNOTSUPP;
12575
12576 if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
12577 cfg80211_rdev_free_coalesce(rdev);
12578 rdev_set_coalesce(rdev, NULL);
12579 return 0;
12580 }
12581
12582 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
12583 rem_rule)
12584 n_rules++;
12585 if (n_rules > coalesce->n_rules)
12586 return -EINVAL;
12587
12588 new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
12589 GFP_KERNEL);
12590 if (!new_coalesce.rules)
12591 return -ENOMEM;
12592
12593 new_coalesce.n_rules = n_rules;
12594 i = 0;
12595
12596 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
12597 rem_rule) {
12598 err = nl80211_parse_coalesce_rule(rdev, rule,
12599 &new_coalesce.rules[i]);
12600 if (err)
12601 goto error;
12602
12603 i++;
12604 }
12605
12606 err = rdev_set_coalesce(rdev, &new_coalesce);
12607 if (err)
12608 goto error;
12609
12610 n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
12611 if (!n_coalesce) {
12612 err = -ENOMEM;
12613 goto error;
12614 }
12615 cfg80211_rdev_free_coalesce(rdev);
12616 rdev->coalesce = n_coalesce;
12617
12618 return 0;
12619 error:
12620 for (i = 0; i < new_coalesce.n_rules; i++) {
12621 tmp_rule = &new_coalesce.rules[i];
12622 for (j = 0; j < tmp_rule->n_patterns; j++)
12623 kfree(tmp_rule->patterns[j].mask);
12624 kfree(tmp_rule->patterns);
12625 }
12626 kfree(new_coalesce.rules);
12627
12628 return err;
12629 }
12630
nl80211_set_rekey_data(struct sk_buff * skb,struct genl_info * info)12631 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
12632 {
12633 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12634 struct net_device *dev = info->user_ptr[1];
12635 struct wireless_dev *wdev = dev->ieee80211_ptr;
12636 struct nlattr *tb[NUM_NL80211_REKEY_DATA];
12637 struct cfg80211_gtk_rekey_data rekey_data = {};
12638 int err;
12639
12640 if (!info->attrs[NL80211_ATTR_REKEY_DATA])
12641 return -EINVAL;
12642
12643 err = nla_parse_nested_deprecated(tb, MAX_NL80211_REKEY_DATA,
12644 info->attrs[NL80211_ATTR_REKEY_DATA],
12645 nl80211_rekey_policy, info->extack);
12646 if (err)
12647 return err;
12648
12649 if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
12650 !tb[NL80211_REKEY_DATA_KCK])
12651 return -EINVAL;
12652 if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN &&
12653 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
12654 nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KEK_EXT_LEN))
12655 return -ERANGE;
12656 if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN &&
12657 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
12658 nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KCK_EXT_LEN))
12659 return -ERANGE;
12660
12661 rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
12662 rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
12663 rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
12664 rekey_data.kek_len = nla_len(tb[NL80211_REKEY_DATA_KEK]);
12665 rekey_data.kck_len = nla_len(tb[NL80211_REKEY_DATA_KCK]);
12666 if (tb[NL80211_REKEY_DATA_AKM])
12667 rekey_data.akm = nla_get_u32(tb[NL80211_REKEY_DATA_AKM]);
12668
12669 wdev_lock(wdev);
12670 if (!wdev->current_bss) {
12671 err = -ENOTCONN;
12672 goto out;
12673 }
12674
12675 if (!rdev->ops->set_rekey_data) {
12676 err = -EOPNOTSUPP;
12677 goto out;
12678 }
12679
12680 err = rdev_set_rekey_data(rdev, dev, &rekey_data);
12681 out:
12682 wdev_unlock(wdev);
12683 return err;
12684 }
12685
nl80211_register_unexpected_frame(struct sk_buff * skb,struct genl_info * info)12686 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
12687 struct genl_info *info)
12688 {
12689 struct net_device *dev = info->user_ptr[1];
12690 struct wireless_dev *wdev = dev->ieee80211_ptr;
12691
12692 if (wdev->iftype != NL80211_IFTYPE_AP &&
12693 wdev->iftype != NL80211_IFTYPE_P2P_GO)
12694 return -EINVAL;
12695
12696 if (wdev->ap_unexpected_nlportid)
12697 return -EBUSY;
12698
12699 wdev->ap_unexpected_nlportid = info->snd_portid;
12700 return 0;
12701 }
12702
nl80211_probe_client(struct sk_buff * skb,struct genl_info * info)12703 static int nl80211_probe_client(struct sk_buff *skb,
12704 struct genl_info *info)
12705 {
12706 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12707 struct net_device *dev = info->user_ptr[1];
12708 struct wireless_dev *wdev = dev->ieee80211_ptr;
12709 struct sk_buff *msg;
12710 void *hdr;
12711 const u8 *addr;
12712 u64 cookie;
12713 int err;
12714
12715 if (wdev->iftype != NL80211_IFTYPE_AP &&
12716 wdev->iftype != NL80211_IFTYPE_P2P_GO)
12717 return -EOPNOTSUPP;
12718
12719 if (!info->attrs[NL80211_ATTR_MAC])
12720 return -EINVAL;
12721
12722 if (!rdev->ops->probe_client)
12723 return -EOPNOTSUPP;
12724
12725 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12726 if (!msg)
12727 return -ENOMEM;
12728
12729 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12730 NL80211_CMD_PROBE_CLIENT);
12731 if (!hdr) {
12732 err = -ENOBUFS;
12733 goto free_msg;
12734 }
12735
12736 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
12737
12738 err = rdev_probe_client(rdev, dev, addr, &cookie);
12739 if (err)
12740 goto free_msg;
12741
12742 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12743 NL80211_ATTR_PAD))
12744 goto nla_put_failure;
12745
12746 genlmsg_end(msg, hdr);
12747
12748 return genlmsg_reply(msg, info);
12749
12750 nla_put_failure:
12751 err = -ENOBUFS;
12752 free_msg:
12753 nlmsg_free(msg);
12754 return err;
12755 }
12756
nl80211_register_beacons(struct sk_buff * skb,struct genl_info * info)12757 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
12758 {
12759 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12760 struct cfg80211_beacon_registration *reg, *nreg;
12761 int rv;
12762
12763 if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
12764 return -EOPNOTSUPP;
12765
12766 nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
12767 if (!nreg)
12768 return -ENOMEM;
12769
12770 /* First, check if already registered. */
12771 spin_lock_bh(&rdev->beacon_registrations_lock);
12772 list_for_each_entry(reg, &rdev->beacon_registrations, list) {
12773 if (reg->nlportid == info->snd_portid) {
12774 rv = -EALREADY;
12775 goto out_err;
12776 }
12777 }
12778 /* Add it to the list */
12779 nreg->nlportid = info->snd_portid;
12780 list_add(&nreg->list, &rdev->beacon_registrations);
12781
12782 spin_unlock_bh(&rdev->beacon_registrations_lock);
12783
12784 return 0;
12785 out_err:
12786 spin_unlock_bh(&rdev->beacon_registrations_lock);
12787 kfree(nreg);
12788 return rv;
12789 }
12790
nl80211_start_p2p_device(struct sk_buff * skb,struct genl_info * info)12791 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
12792 {
12793 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12794 struct wireless_dev *wdev = info->user_ptr[1];
12795 int err;
12796
12797 if (!rdev->ops->start_p2p_device)
12798 return -EOPNOTSUPP;
12799
12800 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
12801 return -EOPNOTSUPP;
12802
12803 if (wdev_running(wdev))
12804 return 0;
12805
12806 if (rfkill_blocked(rdev->rfkill))
12807 return -ERFKILL;
12808
12809 err = rdev_start_p2p_device(rdev, wdev);
12810 if (err)
12811 return err;
12812
12813 wdev->is_running = true;
12814 rdev->opencount++;
12815
12816 return 0;
12817 }
12818
nl80211_stop_p2p_device(struct sk_buff * skb,struct genl_info * info)12819 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
12820 {
12821 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12822 struct wireless_dev *wdev = info->user_ptr[1];
12823
12824 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
12825 return -EOPNOTSUPP;
12826
12827 if (!rdev->ops->stop_p2p_device)
12828 return -EOPNOTSUPP;
12829
12830 cfg80211_stop_p2p_device(rdev, wdev);
12831
12832 return 0;
12833 }
12834
nl80211_start_nan(struct sk_buff * skb,struct genl_info * info)12835 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
12836 {
12837 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12838 struct wireless_dev *wdev = info->user_ptr[1];
12839 struct cfg80211_nan_conf conf = {};
12840 int err;
12841
12842 if (wdev->iftype != NL80211_IFTYPE_NAN)
12843 return -EOPNOTSUPP;
12844
12845 if (wdev_running(wdev))
12846 return -EEXIST;
12847
12848 if (rfkill_blocked(rdev->rfkill))
12849 return -ERFKILL;
12850
12851 if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
12852 return -EINVAL;
12853
12854 conf.master_pref =
12855 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
12856
12857 if (info->attrs[NL80211_ATTR_BANDS]) {
12858 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
12859
12860 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
12861 return -EOPNOTSUPP;
12862
12863 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
12864 return -EINVAL;
12865
12866 conf.bands = bands;
12867 }
12868
12869 err = rdev_start_nan(rdev, wdev, &conf);
12870 if (err)
12871 return err;
12872
12873 wdev->is_running = true;
12874 rdev->opencount++;
12875
12876 return 0;
12877 }
12878
nl80211_stop_nan(struct sk_buff * skb,struct genl_info * info)12879 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
12880 {
12881 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12882 struct wireless_dev *wdev = info->user_ptr[1];
12883
12884 if (wdev->iftype != NL80211_IFTYPE_NAN)
12885 return -EOPNOTSUPP;
12886
12887 cfg80211_stop_nan(rdev, wdev);
12888
12889 return 0;
12890 }
12891
validate_nan_filter(struct nlattr * filter_attr)12892 static int validate_nan_filter(struct nlattr *filter_attr)
12893 {
12894 struct nlattr *attr;
12895 int len = 0, n_entries = 0, rem;
12896
12897 nla_for_each_nested(attr, filter_attr, rem) {
12898 len += nla_len(attr);
12899 n_entries++;
12900 }
12901
12902 if (len >= U8_MAX)
12903 return -EINVAL;
12904
12905 return n_entries;
12906 }
12907
handle_nan_filter(struct nlattr * attr_filter,struct cfg80211_nan_func * func,bool tx)12908 static int handle_nan_filter(struct nlattr *attr_filter,
12909 struct cfg80211_nan_func *func,
12910 bool tx)
12911 {
12912 struct nlattr *attr;
12913 int n_entries, rem, i;
12914 struct cfg80211_nan_func_filter *filter;
12915
12916 n_entries = validate_nan_filter(attr_filter);
12917 if (n_entries < 0)
12918 return n_entries;
12919
12920 BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
12921
12922 filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
12923 if (!filter)
12924 return -ENOMEM;
12925
12926 i = 0;
12927 nla_for_each_nested(attr, attr_filter, rem) {
12928 filter[i].filter = nla_memdup(attr, GFP_KERNEL);
12929 filter[i].len = nla_len(attr);
12930 i++;
12931 }
12932 if (tx) {
12933 func->num_tx_filters = n_entries;
12934 func->tx_filters = filter;
12935 } else {
12936 func->num_rx_filters = n_entries;
12937 func->rx_filters = filter;
12938 }
12939
12940 return 0;
12941 }
12942
nl80211_nan_add_func(struct sk_buff * skb,struct genl_info * info)12943 static int nl80211_nan_add_func(struct sk_buff *skb,
12944 struct genl_info *info)
12945 {
12946 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12947 struct wireless_dev *wdev = info->user_ptr[1];
12948 struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
12949 struct cfg80211_nan_func *func;
12950 struct sk_buff *msg = NULL;
12951 void *hdr = NULL;
12952 int err = 0;
12953
12954 if (wdev->iftype != NL80211_IFTYPE_NAN)
12955 return -EOPNOTSUPP;
12956
12957 if (!wdev_running(wdev))
12958 return -ENOTCONN;
12959
12960 if (!info->attrs[NL80211_ATTR_NAN_FUNC])
12961 return -EINVAL;
12962
12963 err = nla_parse_nested_deprecated(tb, NL80211_NAN_FUNC_ATTR_MAX,
12964 info->attrs[NL80211_ATTR_NAN_FUNC],
12965 nl80211_nan_func_policy,
12966 info->extack);
12967 if (err)
12968 return err;
12969
12970 func = kzalloc(sizeof(*func), GFP_KERNEL);
12971 if (!func)
12972 return -ENOMEM;
12973
12974 func->cookie = cfg80211_assign_cookie(rdev);
12975
12976 if (!tb[NL80211_NAN_FUNC_TYPE]) {
12977 err = -EINVAL;
12978 goto out;
12979 }
12980
12981
12982 func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
12983
12984 if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
12985 err = -EINVAL;
12986 goto out;
12987 }
12988
12989 memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
12990 sizeof(func->service_id));
12991
12992 func->close_range =
12993 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
12994
12995 if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
12996 func->serv_spec_info_len =
12997 nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
12998 func->serv_spec_info =
12999 kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
13000 func->serv_spec_info_len,
13001 GFP_KERNEL);
13002 if (!func->serv_spec_info) {
13003 err = -ENOMEM;
13004 goto out;
13005 }
13006 }
13007
13008 if (tb[NL80211_NAN_FUNC_TTL])
13009 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
13010
13011 switch (func->type) {
13012 case NL80211_NAN_FUNC_PUBLISH:
13013 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
13014 err = -EINVAL;
13015 goto out;
13016 }
13017
13018 func->publish_type =
13019 nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
13020 func->publish_bcast =
13021 nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
13022
13023 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
13024 func->publish_bcast) {
13025 err = -EINVAL;
13026 goto out;
13027 }
13028 break;
13029 case NL80211_NAN_FUNC_SUBSCRIBE:
13030 func->subscribe_active =
13031 nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
13032 break;
13033 case NL80211_NAN_FUNC_FOLLOW_UP:
13034 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
13035 !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
13036 !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
13037 err = -EINVAL;
13038 goto out;
13039 }
13040
13041 func->followup_id =
13042 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
13043 func->followup_reqid =
13044 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
13045 memcpy(func->followup_dest.addr,
13046 nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
13047 sizeof(func->followup_dest.addr));
13048 if (func->ttl) {
13049 err = -EINVAL;
13050 goto out;
13051 }
13052 break;
13053 default:
13054 err = -EINVAL;
13055 goto out;
13056 }
13057
13058 if (tb[NL80211_NAN_FUNC_SRF]) {
13059 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
13060
13061 err = nla_parse_nested_deprecated(srf_tb,
13062 NL80211_NAN_SRF_ATTR_MAX,
13063 tb[NL80211_NAN_FUNC_SRF],
13064 nl80211_nan_srf_policy,
13065 info->extack);
13066 if (err)
13067 goto out;
13068
13069 func->srf_include =
13070 nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
13071
13072 if (srf_tb[NL80211_NAN_SRF_BF]) {
13073 if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
13074 !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
13075 err = -EINVAL;
13076 goto out;
13077 }
13078
13079 func->srf_bf_len =
13080 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
13081 func->srf_bf =
13082 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
13083 func->srf_bf_len, GFP_KERNEL);
13084 if (!func->srf_bf) {
13085 err = -ENOMEM;
13086 goto out;
13087 }
13088
13089 func->srf_bf_idx =
13090 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
13091 } else {
13092 struct nlattr *attr, *mac_attr =
13093 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
13094 int n_entries, rem, i = 0;
13095
13096 if (!mac_attr) {
13097 err = -EINVAL;
13098 goto out;
13099 }
13100
13101 n_entries = validate_acl_mac_addrs(mac_attr);
13102 if (n_entries <= 0) {
13103 err = -EINVAL;
13104 goto out;
13105 }
13106
13107 func->srf_num_macs = n_entries;
13108 func->srf_macs =
13109 kcalloc(n_entries, sizeof(*func->srf_macs),
13110 GFP_KERNEL);
13111 if (!func->srf_macs) {
13112 err = -ENOMEM;
13113 goto out;
13114 }
13115
13116 nla_for_each_nested(attr, mac_attr, rem)
13117 memcpy(func->srf_macs[i++].addr, nla_data(attr),
13118 sizeof(*func->srf_macs));
13119 }
13120 }
13121
13122 if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
13123 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
13124 func, true);
13125 if (err)
13126 goto out;
13127 }
13128
13129 if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
13130 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
13131 func, false);
13132 if (err)
13133 goto out;
13134 }
13135
13136 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13137 if (!msg) {
13138 err = -ENOMEM;
13139 goto out;
13140 }
13141
13142 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13143 NL80211_CMD_ADD_NAN_FUNCTION);
13144 /* This can't really happen - we just allocated 4KB */
13145 if (WARN_ON(!hdr)) {
13146 err = -ENOMEM;
13147 goto out;
13148 }
13149
13150 err = rdev_add_nan_func(rdev, wdev, func);
13151 out:
13152 if (err < 0) {
13153 cfg80211_free_nan_func(func);
13154 nlmsg_free(msg);
13155 return err;
13156 }
13157
13158 /* propagate the instance id and cookie to userspace */
13159 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
13160 NL80211_ATTR_PAD))
13161 goto nla_put_failure;
13162
13163 func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
13164 if (!func_attr)
13165 goto nla_put_failure;
13166
13167 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
13168 func->instance_id))
13169 goto nla_put_failure;
13170
13171 nla_nest_end(msg, func_attr);
13172
13173 genlmsg_end(msg, hdr);
13174 return genlmsg_reply(msg, info);
13175
13176 nla_put_failure:
13177 nlmsg_free(msg);
13178 return -ENOBUFS;
13179 }
13180
nl80211_nan_del_func(struct sk_buff * skb,struct genl_info * info)13181 static int nl80211_nan_del_func(struct sk_buff *skb,
13182 struct genl_info *info)
13183 {
13184 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13185 struct wireless_dev *wdev = info->user_ptr[1];
13186 u64 cookie;
13187
13188 if (wdev->iftype != NL80211_IFTYPE_NAN)
13189 return -EOPNOTSUPP;
13190
13191 if (!wdev_running(wdev))
13192 return -ENOTCONN;
13193
13194 if (!info->attrs[NL80211_ATTR_COOKIE])
13195 return -EINVAL;
13196
13197 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
13198
13199 rdev_del_nan_func(rdev, wdev, cookie);
13200
13201 return 0;
13202 }
13203
nl80211_nan_change_config(struct sk_buff * skb,struct genl_info * info)13204 static int nl80211_nan_change_config(struct sk_buff *skb,
13205 struct genl_info *info)
13206 {
13207 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13208 struct wireless_dev *wdev = info->user_ptr[1];
13209 struct cfg80211_nan_conf conf = {};
13210 u32 changed = 0;
13211
13212 if (wdev->iftype != NL80211_IFTYPE_NAN)
13213 return -EOPNOTSUPP;
13214
13215 if (!wdev_running(wdev))
13216 return -ENOTCONN;
13217
13218 if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
13219 conf.master_pref =
13220 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
13221 if (conf.master_pref <= 1 || conf.master_pref == 255)
13222 return -EINVAL;
13223
13224 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
13225 }
13226
13227 if (info->attrs[NL80211_ATTR_BANDS]) {
13228 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
13229
13230 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
13231 return -EOPNOTSUPP;
13232
13233 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
13234 return -EINVAL;
13235
13236 conf.bands = bands;
13237 changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
13238 }
13239
13240 if (!changed)
13241 return -EINVAL;
13242
13243 return rdev_nan_change_conf(rdev, wdev, &conf, changed);
13244 }
13245
cfg80211_nan_match(struct wireless_dev * wdev,struct cfg80211_nan_match_params * match,gfp_t gfp)13246 void cfg80211_nan_match(struct wireless_dev *wdev,
13247 struct cfg80211_nan_match_params *match, gfp_t gfp)
13248 {
13249 struct wiphy *wiphy = wdev->wiphy;
13250 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13251 struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
13252 struct sk_buff *msg;
13253 void *hdr;
13254
13255 if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
13256 return;
13257
13258 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13259 if (!msg)
13260 return;
13261
13262 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
13263 if (!hdr) {
13264 nlmsg_free(msg);
13265 return;
13266 }
13267
13268 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13269 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
13270 wdev->netdev->ifindex)) ||
13271 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
13272 NL80211_ATTR_PAD))
13273 goto nla_put_failure;
13274
13275 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
13276 NL80211_ATTR_PAD) ||
13277 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
13278 goto nla_put_failure;
13279
13280 match_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_MATCH);
13281 if (!match_attr)
13282 goto nla_put_failure;
13283
13284 local_func_attr = nla_nest_start_noflag(msg,
13285 NL80211_NAN_MATCH_FUNC_LOCAL);
13286 if (!local_func_attr)
13287 goto nla_put_failure;
13288
13289 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
13290 goto nla_put_failure;
13291
13292 nla_nest_end(msg, local_func_attr);
13293
13294 peer_func_attr = nla_nest_start_noflag(msg,
13295 NL80211_NAN_MATCH_FUNC_PEER);
13296 if (!peer_func_attr)
13297 goto nla_put_failure;
13298
13299 if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
13300 nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
13301 goto nla_put_failure;
13302
13303 if (match->info && match->info_len &&
13304 nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
13305 match->info))
13306 goto nla_put_failure;
13307
13308 nla_nest_end(msg, peer_func_attr);
13309 nla_nest_end(msg, match_attr);
13310 genlmsg_end(msg, hdr);
13311
13312 if (!wdev->owner_nlportid)
13313 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
13314 msg, 0, NL80211_MCGRP_NAN, gfp);
13315 else
13316 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
13317 wdev->owner_nlportid);
13318
13319 return;
13320
13321 nla_put_failure:
13322 nlmsg_free(msg);
13323 }
13324 EXPORT_SYMBOL(cfg80211_nan_match);
13325
cfg80211_nan_func_terminated(struct wireless_dev * wdev,u8 inst_id,enum nl80211_nan_func_term_reason reason,u64 cookie,gfp_t gfp)13326 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
13327 u8 inst_id,
13328 enum nl80211_nan_func_term_reason reason,
13329 u64 cookie, gfp_t gfp)
13330 {
13331 struct wiphy *wiphy = wdev->wiphy;
13332 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13333 struct sk_buff *msg;
13334 struct nlattr *func_attr;
13335 void *hdr;
13336
13337 if (WARN_ON(!inst_id))
13338 return;
13339
13340 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13341 if (!msg)
13342 return;
13343
13344 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
13345 if (!hdr) {
13346 nlmsg_free(msg);
13347 return;
13348 }
13349
13350 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13351 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
13352 wdev->netdev->ifindex)) ||
13353 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
13354 NL80211_ATTR_PAD))
13355 goto nla_put_failure;
13356
13357 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
13358 NL80211_ATTR_PAD))
13359 goto nla_put_failure;
13360
13361 func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
13362 if (!func_attr)
13363 goto nla_put_failure;
13364
13365 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
13366 nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
13367 goto nla_put_failure;
13368
13369 nla_nest_end(msg, func_attr);
13370 genlmsg_end(msg, hdr);
13371
13372 if (!wdev->owner_nlportid)
13373 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
13374 msg, 0, NL80211_MCGRP_NAN, gfp);
13375 else
13376 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
13377 wdev->owner_nlportid);
13378
13379 return;
13380
13381 nla_put_failure:
13382 nlmsg_free(msg);
13383 }
13384 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
13385
nl80211_get_protocol_features(struct sk_buff * skb,struct genl_info * info)13386 static int nl80211_get_protocol_features(struct sk_buff *skb,
13387 struct genl_info *info)
13388 {
13389 void *hdr;
13390 struct sk_buff *msg;
13391
13392 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13393 if (!msg)
13394 return -ENOMEM;
13395
13396 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13397 NL80211_CMD_GET_PROTOCOL_FEATURES);
13398 if (!hdr)
13399 goto nla_put_failure;
13400
13401 if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
13402 NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
13403 goto nla_put_failure;
13404
13405 genlmsg_end(msg, hdr);
13406 return genlmsg_reply(msg, info);
13407
13408 nla_put_failure:
13409 kfree_skb(msg);
13410 return -ENOBUFS;
13411 }
13412
nl80211_update_ft_ies(struct sk_buff * skb,struct genl_info * info)13413 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
13414 {
13415 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13416 struct cfg80211_update_ft_ies_params ft_params;
13417 struct net_device *dev = info->user_ptr[1];
13418
13419 if (!rdev->ops->update_ft_ies)
13420 return -EOPNOTSUPP;
13421
13422 if (!info->attrs[NL80211_ATTR_MDID] ||
13423 !info->attrs[NL80211_ATTR_IE])
13424 return -EINVAL;
13425
13426 memset(&ft_params, 0, sizeof(ft_params));
13427 ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
13428 ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
13429 ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
13430
13431 return rdev_update_ft_ies(rdev, dev, &ft_params);
13432 }
13433
nl80211_crit_protocol_start(struct sk_buff * skb,struct genl_info * info)13434 static int nl80211_crit_protocol_start(struct sk_buff *skb,
13435 struct genl_info *info)
13436 {
13437 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13438 struct wireless_dev *wdev = info->user_ptr[1];
13439 enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
13440 u16 duration;
13441 int ret;
13442
13443 if (!rdev->ops->crit_proto_start)
13444 return -EOPNOTSUPP;
13445
13446 if (WARN_ON(!rdev->ops->crit_proto_stop))
13447 return -EINVAL;
13448
13449 if (rdev->crit_proto_nlportid)
13450 return -EBUSY;
13451
13452 /* determine protocol if provided */
13453 if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
13454 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
13455
13456 if (proto >= NUM_NL80211_CRIT_PROTO)
13457 return -EINVAL;
13458
13459 /* timeout must be provided */
13460 if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
13461 return -EINVAL;
13462
13463 duration =
13464 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
13465
13466 ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
13467 if (!ret)
13468 rdev->crit_proto_nlportid = info->snd_portid;
13469
13470 return ret;
13471 }
13472
nl80211_crit_protocol_stop(struct sk_buff * skb,struct genl_info * info)13473 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
13474 struct genl_info *info)
13475 {
13476 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13477 struct wireless_dev *wdev = info->user_ptr[1];
13478
13479 if (!rdev->ops->crit_proto_stop)
13480 return -EOPNOTSUPP;
13481
13482 if (rdev->crit_proto_nlportid) {
13483 rdev->crit_proto_nlportid = 0;
13484 rdev_crit_proto_stop(rdev, wdev);
13485 }
13486 return 0;
13487 }
13488
nl80211_vendor_check_policy(const struct wiphy_vendor_command * vcmd,struct nlattr * attr,struct netlink_ext_ack * extack)13489 static int nl80211_vendor_check_policy(const struct wiphy_vendor_command *vcmd,
13490 struct nlattr *attr,
13491 struct netlink_ext_ack *extack)
13492 {
13493 if (vcmd->policy == VENDOR_CMD_RAW_DATA) {
13494 if (attr->nla_type & NLA_F_NESTED) {
13495 NL_SET_ERR_MSG_ATTR(extack, attr,
13496 "unexpected nested data");
13497 return -EINVAL;
13498 }
13499
13500 return 0;
13501 }
13502
13503 if (!(attr->nla_type & NLA_F_NESTED)) {
13504 NL_SET_ERR_MSG_ATTR(extack, attr, "expected nested data");
13505 return -EINVAL;
13506 }
13507
13508 return nla_validate_nested(attr, vcmd->maxattr, vcmd->policy, extack);
13509 }
13510
nl80211_vendor_cmd(struct sk_buff * skb,struct genl_info * info)13511 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
13512 {
13513 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13514 struct wireless_dev *wdev =
13515 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
13516 int i, err;
13517 u32 vid, subcmd;
13518
13519 if (!rdev->wiphy.vendor_commands)
13520 return -EOPNOTSUPP;
13521
13522 if (IS_ERR(wdev)) {
13523 err = PTR_ERR(wdev);
13524 if (err != -EINVAL)
13525 return err;
13526 wdev = NULL;
13527 } else if (wdev->wiphy != &rdev->wiphy) {
13528 return -EINVAL;
13529 }
13530
13531 if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
13532 !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
13533 return -EINVAL;
13534
13535 vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
13536 subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
13537 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
13538 const struct wiphy_vendor_command *vcmd;
13539 void *data = NULL;
13540 int len = 0;
13541
13542 vcmd = &rdev->wiphy.vendor_commands[i];
13543
13544 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
13545 continue;
13546
13547 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
13548 WIPHY_VENDOR_CMD_NEED_NETDEV)) {
13549 if (!wdev)
13550 return -EINVAL;
13551 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
13552 !wdev->netdev)
13553 return -EINVAL;
13554
13555 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
13556 if (!wdev_running(wdev))
13557 return -ENETDOWN;
13558 }
13559 } else {
13560 wdev = NULL;
13561 }
13562
13563 if (!vcmd->doit)
13564 return -EOPNOTSUPP;
13565
13566 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
13567 data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
13568 len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
13569
13570 err = nl80211_vendor_check_policy(vcmd,
13571 info->attrs[NL80211_ATTR_VENDOR_DATA],
13572 info->extack);
13573 if (err)
13574 return err;
13575 }
13576
13577 rdev->cur_cmd_info = info;
13578 err = vcmd->doit(&rdev->wiphy, wdev, data, len);
13579 rdev->cur_cmd_info = NULL;
13580 return err;
13581 }
13582
13583 return -EOPNOTSUPP;
13584 }
13585
nl80211_prepare_vendor_dump(struct sk_buff * skb,struct netlink_callback * cb,struct cfg80211_registered_device ** rdev,struct wireless_dev ** wdev)13586 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
13587 struct netlink_callback *cb,
13588 struct cfg80211_registered_device **rdev,
13589 struct wireless_dev **wdev)
13590 {
13591 struct nlattr **attrbuf;
13592 u32 vid, subcmd;
13593 unsigned int i;
13594 int vcmd_idx = -1;
13595 int err;
13596 void *data = NULL;
13597 unsigned int data_len = 0;
13598
13599 if (cb->args[0]) {
13600 /* subtract the 1 again here */
13601 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
13602 struct wireless_dev *tmp;
13603
13604 if (!wiphy)
13605 return -ENODEV;
13606 *rdev = wiphy_to_rdev(wiphy);
13607 *wdev = NULL;
13608
13609 if (cb->args[1]) {
13610 list_for_each_entry(tmp, &wiphy->wdev_list, list) {
13611 if (tmp->identifier == cb->args[1] - 1) {
13612 *wdev = tmp;
13613 break;
13614 }
13615 }
13616 }
13617
13618 /* keep rtnl locked in successful case */
13619 return 0;
13620 }
13621
13622 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
13623 if (!attrbuf)
13624 return -ENOMEM;
13625
13626 err = nlmsg_parse_deprecated(cb->nlh,
13627 GENL_HDRLEN + nl80211_fam.hdrsize,
13628 attrbuf, nl80211_fam.maxattr,
13629 nl80211_policy, NULL);
13630 if (err)
13631 goto out;
13632
13633 if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
13634 !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) {
13635 err = -EINVAL;
13636 goto out;
13637 }
13638
13639 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk), attrbuf);
13640 if (IS_ERR(*wdev))
13641 *wdev = NULL;
13642
13643 *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
13644 if (IS_ERR(*rdev)) {
13645 err = PTR_ERR(*rdev);
13646 goto out;
13647 }
13648
13649 vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
13650 subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
13651
13652 for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
13653 const struct wiphy_vendor_command *vcmd;
13654
13655 vcmd = &(*rdev)->wiphy.vendor_commands[i];
13656
13657 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
13658 continue;
13659
13660 if (!vcmd->dumpit) {
13661 err = -EOPNOTSUPP;
13662 goto out;
13663 }
13664
13665 vcmd_idx = i;
13666 break;
13667 }
13668
13669 if (vcmd_idx < 0) {
13670 err = -EOPNOTSUPP;
13671 goto out;
13672 }
13673
13674 if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
13675 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
13676 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
13677
13678 err = nl80211_vendor_check_policy(
13679 &(*rdev)->wiphy.vendor_commands[vcmd_idx],
13680 attrbuf[NL80211_ATTR_VENDOR_DATA],
13681 cb->extack);
13682 if (err)
13683 goto out;
13684 }
13685
13686 /* 0 is the first index - add 1 to parse only once */
13687 cb->args[0] = (*rdev)->wiphy_idx + 1;
13688 /* add 1 to know if it was NULL */
13689 cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
13690 cb->args[2] = vcmd_idx;
13691 cb->args[3] = (unsigned long)data;
13692 cb->args[4] = data_len;
13693
13694 /* keep rtnl locked in successful case */
13695 err = 0;
13696 out:
13697 kfree(attrbuf);
13698 return err;
13699 }
13700
nl80211_vendor_cmd_dump(struct sk_buff * skb,struct netlink_callback * cb)13701 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
13702 struct netlink_callback *cb)
13703 {
13704 struct cfg80211_registered_device *rdev;
13705 struct wireless_dev *wdev;
13706 unsigned int vcmd_idx;
13707 const struct wiphy_vendor_command *vcmd;
13708 void *data;
13709 int data_len;
13710 int err;
13711 struct nlattr *vendor_data;
13712
13713 rtnl_lock();
13714 err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
13715 if (err)
13716 goto out;
13717
13718 vcmd_idx = cb->args[2];
13719 data = (void *)cb->args[3];
13720 data_len = cb->args[4];
13721 vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
13722
13723 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
13724 WIPHY_VENDOR_CMD_NEED_NETDEV)) {
13725 if (!wdev) {
13726 err = -EINVAL;
13727 goto out;
13728 }
13729 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
13730 !wdev->netdev) {
13731 err = -EINVAL;
13732 goto out;
13733 }
13734
13735 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
13736 if (!wdev_running(wdev)) {
13737 err = -ENETDOWN;
13738 goto out;
13739 }
13740 }
13741 }
13742
13743 while (1) {
13744 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
13745 cb->nlh->nlmsg_seq, NLM_F_MULTI,
13746 NL80211_CMD_VENDOR);
13747 if (!hdr)
13748 break;
13749
13750 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13751 (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
13752 wdev_id(wdev),
13753 NL80211_ATTR_PAD))) {
13754 genlmsg_cancel(skb, hdr);
13755 break;
13756 }
13757
13758 vendor_data = nla_nest_start_noflag(skb,
13759 NL80211_ATTR_VENDOR_DATA);
13760 if (!vendor_data) {
13761 genlmsg_cancel(skb, hdr);
13762 break;
13763 }
13764
13765 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
13766 (unsigned long *)&cb->args[5]);
13767 nla_nest_end(skb, vendor_data);
13768
13769 if (err == -ENOBUFS || err == -ENOENT) {
13770 genlmsg_cancel(skb, hdr);
13771 break;
13772 } else if (err <= 0) {
13773 genlmsg_cancel(skb, hdr);
13774 goto out;
13775 }
13776
13777 genlmsg_end(skb, hdr);
13778 }
13779
13780 err = skb->len;
13781 out:
13782 rtnl_unlock();
13783 return err;
13784 }
13785
__cfg80211_alloc_reply_skb(struct wiphy * wiphy,enum nl80211_commands cmd,enum nl80211_attrs attr,int approxlen)13786 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
13787 enum nl80211_commands cmd,
13788 enum nl80211_attrs attr,
13789 int approxlen)
13790 {
13791 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13792
13793 if (WARN_ON(!rdev->cur_cmd_info))
13794 return NULL;
13795
13796 return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
13797 rdev->cur_cmd_info->snd_portid,
13798 rdev->cur_cmd_info->snd_seq,
13799 cmd, attr, NULL, GFP_KERNEL);
13800 }
13801 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
13802
cfg80211_vendor_cmd_reply(struct sk_buff * skb)13803 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
13804 {
13805 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
13806 void *hdr = ((void **)skb->cb)[1];
13807 struct nlattr *data = ((void **)skb->cb)[2];
13808
13809 /* clear CB data for netlink core to own from now on */
13810 memset(skb->cb, 0, sizeof(skb->cb));
13811
13812 if (WARN_ON(!rdev->cur_cmd_info)) {
13813 kfree_skb(skb);
13814 return -EINVAL;
13815 }
13816
13817 nla_nest_end(skb, data);
13818 genlmsg_end(skb, hdr);
13819 return genlmsg_reply(skb, rdev->cur_cmd_info);
13820 }
13821 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
13822
cfg80211_vendor_cmd_get_sender(struct wiphy * wiphy)13823 unsigned int cfg80211_vendor_cmd_get_sender(struct wiphy *wiphy)
13824 {
13825 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13826
13827 if (WARN_ON(!rdev->cur_cmd_info))
13828 return 0;
13829
13830 return rdev->cur_cmd_info->snd_portid;
13831 }
13832 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_get_sender);
13833
nl80211_set_qos_map(struct sk_buff * skb,struct genl_info * info)13834 static int nl80211_set_qos_map(struct sk_buff *skb,
13835 struct genl_info *info)
13836 {
13837 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13838 struct cfg80211_qos_map *qos_map = NULL;
13839 struct net_device *dev = info->user_ptr[1];
13840 u8 *pos, len, num_des, des_len, des;
13841 int ret;
13842
13843 if (!rdev->ops->set_qos_map)
13844 return -EOPNOTSUPP;
13845
13846 if (info->attrs[NL80211_ATTR_QOS_MAP]) {
13847 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
13848 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
13849
13850 if (len % 2)
13851 return -EINVAL;
13852
13853 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
13854 if (!qos_map)
13855 return -ENOMEM;
13856
13857 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
13858 if (num_des) {
13859 des_len = num_des *
13860 sizeof(struct cfg80211_dscp_exception);
13861 memcpy(qos_map->dscp_exception, pos, des_len);
13862 qos_map->num_des = num_des;
13863 for (des = 0; des < num_des; des++) {
13864 if (qos_map->dscp_exception[des].up > 7) {
13865 kfree(qos_map);
13866 return -EINVAL;
13867 }
13868 }
13869 pos += des_len;
13870 }
13871 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
13872 }
13873
13874 wdev_lock(dev->ieee80211_ptr);
13875 ret = nl80211_key_allowed(dev->ieee80211_ptr);
13876 if (!ret)
13877 ret = rdev_set_qos_map(rdev, dev, qos_map);
13878 wdev_unlock(dev->ieee80211_ptr);
13879
13880 kfree(qos_map);
13881 return ret;
13882 }
13883
nl80211_add_tx_ts(struct sk_buff * skb,struct genl_info * info)13884 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
13885 {
13886 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13887 struct net_device *dev = info->user_ptr[1];
13888 struct wireless_dev *wdev = dev->ieee80211_ptr;
13889 const u8 *peer;
13890 u8 tsid, up;
13891 u16 admitted_time = 0;
13892 int err;
13893
13894 if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
13895 return -EOPNOTSUPP;
13896
13897 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
13898 !info->attrs[NL80211_ATTR_USER_PRIO])
13899 return -EINVAL;
13900
13901 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
13902 up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
13903
13904 /* WMM uses TIDs 0-7 even for TSPEC */
13905 if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
13906 /* TODO: handle 802.11 TSPEC/admission control
13907 * need more attributes for that (e.g. BA session requirement);
13908 * change the WMM adminssion test above to allow both then
13909 */
13910 return -EINVAL;
13911 }
13912
13913 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
13914
13915 if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
13916 admitted_time =
13917 nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
13918 if (!admitted_time)
13919 return -EINVAL;
13920 }
13921
13922 wdev_lock(wdev);
13923 switch (wdev->iftype) {
13924 case NL80211_IFTYPE_STATION:
13925 case NL80211_IFTYPE_P2P_CLIENT:
13926 if (wdev->current_bss)
13927 break;
13928 err = -ENOTCONN;
13929 goto out;
13930 default:
13931 err = -EOPNOTSUPP;
13932 goto out;
13933 }
13934
13935 err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
13936
13937 out:
13938 wdev_unlock(wdev);
13939 return err;
13940 }
13941
nl80211_del_tx_ts(struct sk_buff * skb,struct genl_info * info)13942 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
13943 {
13944 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13945 struct net_device *dev = info->user_ptr[1];
13946 struct wireless_dev *wdev = dev->ieee80211_ptr;
13947 const u8 *peer;
13948 u8 tsid;
13949 int err;
13950
13951 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
13952 return -EINVAL;
13953
13954 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
13955 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
13956
13957 wdev_lock(wdev);
13958 err = rdev_del_tx_ts(rdev, dev, tsid, peer);
13959 wdev_unlock(wdev);
13960
13961 return err;
13962 }
13963
nl80211_tdls_channel_switch(struct sk_buff * skb,struct genl_info * info)13964 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
13965 struct genl_info *info)
13966 {
13967 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13968 struct net_device *dev = info->user_ptr[1];
13969 struct wireless_dev *wdev = dev->ieee80211_ptr;
13970 struct cfg80211_chan_def chandef = {};
13971 const u8 *addr;
13972 u8 oper_class;
13973 int err;
13974
13975 if (!rdev->ops->tdls_channel_switch ||
13976 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
13977 return -EOPNOTSUPP;
13978
13979 switch (dev->ieee80211_ptr->iftype) {
13980 case NL80211_IFTYPE_STATION:
13981 case NL80211_IFTYPE_P2P_CLIENT:
13982 break;
13983 default:
13984 return -EOPNOTSUPP;
13985 }
13986
13987 if (!info->attrs[NL80211_ATTR_MAC] ||
13988 !info->attrs[NL80211_ATTR_OPER_CLASS])
13989 return -EINVAL;
13990
13991 err = nl80211_parse_chandef(rdev, info, &chandef);
13992 if (err)
13993 return err;
13994
13995 /*
13996 * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
13997 * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
13998 * specification is not defined for them.
13999 */
14000 if (chandef.chan->band == NL80211_BAND_2GHZ &&
14001 chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
14002 chandef.width != NL80211_CHAN_WIDTH_20)
14003 return -EINVAL;
14004
14005 /* we will be active on the TDLS link */
14006 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
14007 wdev->iftype))
14008 return -EINVAL;
14009
14010 /* don't allow switching to DFS channels */
14011 if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
14012 return -EINVAL;
14013
14014 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
14015 oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
14016
14017 wdev_lock(wdev);
14018 err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
14019 wdev_unlock(wdev);
14020
14021 return err;
14022 }
14023
nl80211_tdls_cancel_channel_switch(struct sk_buff * skb,struct genl_info * info)14024 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
14025 struct genl_info *info)
14026 {
14027 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14028 struct net_device *dev = info->user_ptr[1];
14029 struct wireless_dev *wdev = dev->ieee80211_ptr;
14030 const u8 *addr;
14031
14032 if (!rdev->ops->tdls_channel_switch ||
14033 !rdev->ops->tdls_cancel_channel_switch ||
14034 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
14035 return -EOPNOTSUPP;
14036
14037 switch (dev->ieee80211_ptr->iftype) {
14038 case NL80211_IFTYPE_STATION:
14039 case NL80211_IFTYPE_P2P_CLIENT:
14040 break;
14041 default:
14042 return -EOPNOTSUPP;
14043 }
14044
14045 if (!info->attrs[NL80211_ATTR_MAC])
14046 return -EINVAL;
14047
14048 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
14049
14050 wdev_lock(wdev);
14051 rdev_tdls_cancel_channel_switch(rdev, dev, addr);
14052 wdev_unlock(wdev);
14053
14054 return 0;
14055 }
14056
nl80211_set_multicast_to_unicast(struct sk_buff * skb,struct genl_info * info)14057 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
14058 struct genl_info *info)
14059 {
14060 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14061 struct net_device *dev = info->user_ptr[1];
14062 struct wireless_dev *wdev = dev->ieee80211_ptr;
14063 const struct nlattr *nla;
14064 bool enabled;
14065
14066 if (!rdev->ops->set_multicast_to_unicast)
14067 return -EOPNOTSUPP;
14068
14069 if (wdev->iftype != NL80211_IFTYPE_AP &&
14070 wdev->iftype != NL80211_IFTYPE_P2P_GO)
14071 return -EOPNOTSUPP;
14072
14073 nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
14074 enabled = nla_get_flag(nla);
14075
14076 return rdev_set_multicast_to_unicast(rdev, dev, enabled);
14077 }
14078
nl80211_set_pmk(struct sk_buff * skb,struct genl_info * info)14079 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
14080 {
14081 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14082 struct net_device *dev = info->user_ptr[1];
14083 struct wireless_dev *wdev = dev->ieee80211_ptr;
14084 struct cfg80211_pmk_conf pmk_conf = {};
14085 int ret;
14086
14087 if (wdev->iftype != NL80211_IFTYPE_STATION &&
14088 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
14089 return -EOPNOTSUPP;
14090
14091 if (!wiphy_ext_feature_isset(&rdev->wiphy,
14092 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
14093 return -EOPNOTSUPP;
14094
14095 if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
14096 return -EINVAL;
14097
14098 wdev_lock(wdev);
14099 if (!wdev->current_bss) {
14100 ret = -ENOTCONN;
14101 goto out;
14102 }
14103
14104 pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
14105 if (memcmp(pmk_conf.aa, wdev->current_bss->pub.bssid, ETH_ALEN)) {
14106 ret = -EINVAL;
14107 goto out;
14108 }
14109
14110 pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
14111 pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
14112 if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
14113 pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) {
14114 ret = -EINVAL;
14115 goto out;
14116 }
14117
14118 if (info->attrs[NL80211_ATTR_PMKR0_NAME])
14119 pmk_conf.pmk_r0_name =
14120 nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
14121
14122 ret = rdev_set_pmk(rdev, dev, &pmk_conf);
14123 out:
14124 wdev_unlock(wdev);
14125 return ret;
14126 }
14127
nl80211_del_pmk(struct sk_buff * skb,struct genl_info * info)14128 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
14129 {
14130 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14131 struct net_device *dev = info->user_ptr[1];
14132 struct wireless_dev *wdev = dev->ieee80211_ptr;
14133 const u8 *aa;
14134 int ret;
14135
14136 if (wdev->iftype != NL80211_IFTYPE_STATION &&
14137 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
14138 return -EOPNOTSUPP;
14139
14140 if (!wiphy_ext_feature_isset(&rdev->wiphy,
14141 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
14142 return -EOPNOTSUPP;
14143
14144 if (!info->attrs[NL80211_ATTR_MAC])
14145 return -EINVAL;
14146
14147 wdev_lock(wdev);
14148 aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
14149 ret = rdev_del_pmk(rdev, dev, aa);
14150 wdev_unlock(wdev);
14151
14152 return ret;
14153 }
14154
nl80211_external_auth(struct sk_buff * skb,struct genl_info * info)14155 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)
14156 {
14157 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14158 struct net_device *dev = info->user_ptr[1];
14159 struct cfg80211_external_auth_params params;
14160
14161 if (!rdev->ops->external_auth)
14162 return -EOPNOTSUPP;
14163
14164 if (!info->attrs[NL80211_ATTR_SSID] &&
14165 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
14166 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
14167 return -EINVAL;
14168
14169 if (!info->attrs[NL80211_ATTR_BSSID])
14170 return -EINVAL;
14171
14172 if (!info->attrs[NL80211_ATTR_STATUS_CODE])
14173 return -EINVAL;
14174
14175 memset(¶ms, 0, sizeof(params));
14176
14177 if (info->attrs[NL80211_ATTR_SSID]) {
14178 params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
14179 if (params.ssid.ssid_len == 0)
14180 return -EINVAL;
14181 memcpy(params.ssid.ssid,
14182 nla_data(info->attrs[NL80211_ATTR_SSID]),
14183 params.ssid.ssid_len);
14184 }
14185
14186 memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]),
14187 ETH_ALEN);
14188
14189 params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
14190
14191 if (info->attrs[NL80211_ATTR_PMKID])
14192 params.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
14193
14194 return rdev_external_auth(rdev, dev, ¶ms);
14195 }
14196
nl80211_tx_control_port(struct sk_buff * skb,struct genl_info * info)14197 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)
14198 {
14199 bool dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
14200 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14201 struct net_device *dev = info->user_ptr[1];
14202 struct wireless_dev *wdev = dev->ieee80211_ptr;
14203 const u8 *buf;
14204 size_t len;
14205 u8 *dest;
14206 u16 proto;
14207 bool noencrypt;
14208 u64 cookie = 0;
14209 int err;
14210
14211 if (!wiphy_ext_feature_isset(&rdev->wiphy,
14212 NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
14213 return -EOPNOTSUPP;
14214
14215 if (!rdev->ops->tx_control_port)
14216 return -EOPNOTSUPP;
14217
14218 if (!info->attrs[NL80211_ATTR_FRAME] ||
14219 !info->attrs[NL80211_ATTR_MAC] ||
14220 !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
14221 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing");
14222 return -EINVAL;
14223 }
14224
14225 wdev_lock(wdev);
14226
14227 switch (wdev->iftype) {
14228 case NL80211_IFTYPE_AP:
14229 case NL80211_IFTYPE_P2P_GO:
14230 case NL80211_IFTYPE_MESH_POINT:
14231 break;
14232 case NL80211_IFTYPE_ADHOC:
14233 case NL80211_IFTYPE_STATION:
14234 case NL80211_IFTYPE_P2P_CLIENT:
14235 if (wdev->current_bss)
14236 break;
14237 err = -ENOTCONN;
14238 goto out;
14239 default:
14240 err = -EOPNOTSUPP;
14241 goto out;
14242 }
14243
14244 wdev_unlock(wdev);
14245
14246 buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
14247 len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
14248 dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
14249 proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
14250 noencrypt =
14251 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]);
14252
14253 err = rdev_tx_control_port(rdev, dev, buf, len,
14254 dest, cpu_to_be16(proto), noencrypt,
14255 dont_wait_for_ack ? NULL : &cookie);
14256 if (!err && !dont_wait_for_ack)
14257 nl_set_extack_cookie_u64(info->extack, cookie);
14258 return err;
14259 out:
14260 wdev_unlock(wdev);
14261 return err;
14262 }
14263
nl80211_get_ftm_responder_stats(struct sk_buff * skb,struct genl_info * info)14264 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb,
14265 struct genl_info *info)
14266 {
14267 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14268 struct net_device *dev = info->user_ptr[1];
14269 struct wireless_dev *wdev = dev->ieee80211_ptr;
14270 struct cfg80211_ftm_responder_stats ftm_stats = {};
14271 struct sk_buff *msg;
14272 void *hdr;
14273 struct nlattr *ftm_stats_attr;
14274 int err;
14275
14276 if (wdev->iftype != NL80211_IFTYPE_AP || !wdev->beacon_interval)
14277 return -EOPNOTSUPP;
14278
14279 err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats);
14280 if (err)
14281 return err;
14282
14283 if (!ftm_stats.filled)
14284 return -ENODATA;
14285
14286 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14287 if (!msg)
14288 return -ENOMEM;
14289
14290 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14291 NL80211_CMD_GET_FTM_RESPONDER_STATS);
14292 if (!hdr)
14293 goto nla_put_failure;
14294
14295 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
14296 goto nla_put_failure;
14297
14298 ftm_stats_attr = nla_nest_start_noflag(msg,
14299 NL80211_ATTR_FTM_RESPONDER_STATS);
14300 if (!ftm_stats_attr)
14301 goto nla_put_failure;
14302
14303 #define SET_FTM(field, name, type) \
14304 do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
14305 nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name, \
14306 ftm_stats.field)) \
14307 goto nla_put_failure; } while (0)
14308 #define SET_FTM_U64(field, name) \
14309 do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
14310 nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name, \
14311 ftm_stats.field, NL80211_FTM_STATS_PAD)) \
14312 goto nla_put_failure; } while (0)
14313
14314 SET_FTM(success_num, SUCCESS_NUM, u32);
14315 SET_FTM(partial_num, PARTIAL_NUM, u32);
14316 SET_FTM(failed_num, FAILED_NUM, u32);
14317 SET_FTM(asap_num, ASAP_NUM, u32);
14318 SET_FTM(non_asap_num, NON_ASAP_NUM, u32);
14319 SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC);
14320 SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32);
14321 SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32);
14322 SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32);
14323 #undef SET_FTM
14324
14325 nla_nest_end(msg, ftm_stats_attr);
14326
14327 genlmsg_end(msg, hdr);
14328 return genlmsg_reply(msg, info);
14329
14330 nla_put_failure:
14331 nlmsg_free(msg);
14332 return -ENOBUFS;
14333 }
14334
nl80211_update_owe_info(struct sk_buff * skb,struct genl_info * info)14335 static int nl80211_update_owe_info(struct sk_buff *skb, struct genl_info *info)
14336 {
14337 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14338 struct cfg80211_update_owe_info owe_info;
14339 struct net_device *dev = info->user_ptr[1];
14340
14341 if (!rdev->ops->update_owe_info)
14342 return -EOPNOTSUPP;
14343
14344 if (!info->attrs[NL80211_ATTR_STATUS_CODE] ||
14345 !info->attrs[NL80211_ATTR_MAC])
14346 return -EINVAL;
14347
14348 memset(&owe_info, 0, sizeof(owe_info));
14349 owe_info.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
14350 nla_memcpy(owe_info.peer, info->attrs[NL80211_ATTR_MAC], ETH_ALEN);
14351
14352 if (info->attrs[NL80211_ATTR_IE]) {
14353 owe_info.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
14354 owe_info.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
14355 }
14356
14357 return rdev_update_owe_info(rdev, dev, &owe_info);
14358 }
14359
nl80211_probe_mesh_link(struct sk_buff * skb,struct genl_info * info)14360 static int nl80211_probe_mesh_link(struct sk_buff *skb, struct genl_info *info)
14361 {
14362 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14363 struct net_device *dev = info->user_ptr[1];
14364 struct wireless_dev *wdev = dev->ieee80211_ptr;
14365 struct station_info sinfo = {};
14366 const u8 *buf;
14367 size_t len;
14368 u8 *dest;
14369 int err;
14370
14371 if (!rdev->ops->probe_mesh_link || !rdev->ops->get_station)
14372 return -EOPNOTSUPP;
14373
14374 if (!info->attrs[NL80211_ATTR_MAC] ||
14375 !info->attrs[NL80211_ATTR_FRAME]) {
14376 GENL_SET_ERR_MSG(info, "Frame or MAC missing");
14377 return -EINVAL;
14378 }
14379
14380 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
14381 return -EOPNOTSUPP;
14382
14383 dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
14384 buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
14385 len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
14386
14387 if (len < sizeof(struct ethhdr))
14388 return -EINVAL;
14389
14390 if (!ether_addr_equal(buf, dest) || is_multicast_ether_addr(buf) ||
14391 !ether_addr_equal(buf + ETH_ALEN, dev->dev_addr))
14392 return -EINVAL;
14393
14394 err = rdev_get_station(rdev, dev, dest, &sinfo);
14395 if (err)
14396 return err;
14397
14398 cfg80211_sinfo_release_content(&sinfo);
14399
14400 return rdev_probe_mesh_link(rdev, dev, dest, buf, len);
14401 }
14402
parse_tid_conf(struct cfg80211_registered_device * rdev,struct nlattr * attrs[],struct net_device * dev,struct cfg80211_tid_cfg * tid_conf,struct genl_info * info,const u8 * peer)14403 static int parse_tid_conf(struct cfg80211_registered_device *rdev,
14404 struct nlattr *attrs[], struct net_device *dev,
14405 struct cfg80211_tid_cfg *tid_conf,
14406 struct genl_info *info, const u8 *peer)
14407 {
14408 struct netlink_ext_ack *extack = info->extack;
14409 u64 mask;
14410 int err;
14411
14412 if (!attrs[NL80211_TID_CONFIG_ATTR_TIDS])
14413 return -EINVAL;
14414
14415 tid_conf->config_override =
14416 nla_get_flag(attrs[NL80211_TID_CONFIG_ATTR_OVERRIDE]);
14417 tid_conf->tids = nla_get_u16(attrs[NL80211_TID_CONFIG_ATTR_TIDS]);
14418
14419 if (tid_conf->config_override) {
14420 if (rdev->ops->reset_tid_config) {
14421 err = rdev_reset_tid_config(rdev, dev, peer,
14422 tid_conf->tids);
14423 if (err)
14424 return err;
14425 } else {
14426 return -EINVAL;
14427 }
14428 }
14429
14430 if (attrs[NL80211_TID_CONFIG_ATTR_NOACK]) {
14431 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_NOACK);
14432 tid_conf->noack =
14433 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_NOACK]);
14434 }
14435
14436 if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]) {
14437 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_SHORT);
14438 tid_conf->retry_short =
14439 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]);
14440
14441 if (tid_conf->retry_short > rdev->wiphy.max_data_retry_count)
14442 return -EINVAL;
14443 }
14444
14445 if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]) {
14446 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_LONG);
14447 tid_conf->retry_long =
14448 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]);
14449
14450 if (tid_conf->retry_long > rdev->wiphy.max_data_retry_count)
14451 return -EINVAL;
14452 }
14453
14454 if (attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]) {
14455 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL);
14456 tid_conf->ampdu =
14457 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]);
14458 }
14459
14460 if (attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]) {
14461 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL);
14462 tid_conf->rtscts =
14463 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]);
14464 }
14465
14466 if (attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]) {
14467 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMSDU_CTRL);
14468 tid_conf->amsdu =
14469 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]);
14470 }
14471
14472 if (attrs[NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE]) {
14473 u32 idx = NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE, attr;
14474
14475 tid_conf->txrate_type = nla_get_u8(attrs[idx]);
14476
14477 if (tid_conf->txrate_type != NL80211_TX_RATE_AUTOMATIC) {
14478 attr = NL80211_TID_CONFIG_ATTR_TX_RATE;
14479 err = nl80211_parse_tx_bitrate_mask(info, attrs, attr,
14480 &tid_conf->txrate_mask, dev);
14481 if (err)
14482 return err;
14483
14484 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE);
14485 }
14486 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE);
14487 }
14488
14489 if (peer)
14490 mask = rdev->wiphy.tid_config_support.peer;
14491 else
14492 mask = rdev->wiphy.tid_config_support.vif;
14493
14494 if (tid_conf->mask & ~mask) {
14495 NL_SET_ERR_MSG(extack, "unsupported TID configuration");
14496 return -ENOTSUPP;
14497 }
14498
14499 return 0;
14500 }
14501
nl80211_set_tid_config(struct sk_buff * skb,struct genl_info * info)14502 static int nl80211_set_tid_config(struct sk_buff *skb,
14503 struct genl_info *info)
14504 {
14505 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14506 struct nlattr *attrs[NL80211_TID_CONFIG_ATTR_MAX + 1];
14507 struct net_device *dev = info->user_ptr[1];
14508 struct cfg80211_tid_config *tid_config;
14509 struct nlattr *tid;
14510 int conf_idx = 0, rem_conf;
14511 int ret = -EINVAL;
14512 u32 num_conf = 0;
14513
14514 if (!info->attrs[NL80211_ATTR_TID_CONFIG])
14515 return -EINVAL;
14516
14517 if (!rdev->ops->set_tid_config)
14518 return -EOPNOTSUPP;
14519
14520 nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
14521 rem_conf)
14522 num_conf++;
14523
14524 tid_config = kzalloc(struct_size(tid_config, tid_conf, num_conf),
14525 GFP_KERNEL);
14526 if (!tid_config)
14527 return -ENOMEM;
14528
14529 tid_config->n_tid_conf = num_conf;
14530
14531 if (info->attrs[NL80211_ATTR_MAC])
14532 tid_config->peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
14533
14534 nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
14535 rem_conf) {
14536 ret = nla_parse_nested(attrs, NL80211_TID_CONFIG_ATTR_MAX,
14537 tid, NULL, NULL);
14538
14539 if (ret)
14540 goto bad_tid_conf;
14541
14542 ret = parse_tid_conf(rdev, attrs, dev,
14543 &tid_config->tid_conf[conf_idx],
14544 info, tid_config->peer);
14545 if (ret)
14546 goto bad_tid_conf;
14547
14548 conf_idx++;
14549 }
14550
14551 ret = rdev_set_tid_config(rdev, dev, tid_config);
14552
14553 bad_tid_conf:
14554 kfree(tid_config);
14555 return ret;
14556 }
14557
14558 #define NL80211_FLAG_NEED_WIPHY 0x01
14559 #define NL80211_FLAG_NEED_NETDEV 0x02
14560 #define NL80211_FLAG_NEED_RTNL 0x04
14561 #define NL80211_FLAG_CHECK_NETDEV_UP 0x08
14562 #define NL80211_FLAG_NEED_NETDEV_UP (NL80211_FLAG_NEED_NETDEV |\
14563 NL80211_FLAG_CHECK_NETDEV_UP)
14564 #define NL80211_FLAG_NEED_WDEV 0x10
14565 /* If a netdev is associated, it must be UP, P2P must be started */
14566 #define NL80211_FLAG_NEED_WDEV_UP (NL80211_FLAG_NEED_WDEV |\
14567 NL80211_FLAG_CHECK_NETDEV_UP)
14568 #define NL80211_FLAG_CLEAR_SKB 0x20
14569
nl80211_pre_doit(const struct genl_ops * ops,struct sk_buff * skb,struct genl_info * info)14570 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
14571 struct genl_info *info)
14572 {
14573 struct cfg80211_registered_device *rdev;
14574 struct wireless_dev *wdev;
14575 struct net_device *dev;
14576 bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
14577
14578 if (rtnl)
14579 rtnl_lock();
14580
14581 if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
14582 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
14583 if (IS_ERR(rdev)) {
14584 if (rtnl)
14585 rtnl_unlock();
14586 return PTR_ERR(rdev);
14587 }
14588 info->user_ptr[0] = rdev;
14589 } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
14590 ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
14591 ASSERT_RTNL();
14592
14593 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
14594 info->attrs);
14595 if (IS_ERR(wdev)) {
14596 if (rtnl)
14597 rtnl_unlock();
14598 return PTR_ERR(wdev);
14599 }
14600
14601 dev = wdev->netdev;
14602 rdev = wiphy_to_rdev(wdev->wiphy);
14603
14604 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
14605 if (!dev) {
14606 if (rtnl)
14607 rtnl_unlock();
14608 return -EINVAL;
14609 }
14610
14611 info->user_ptr[1] = dev;
14612 } else {
14613 info->user_ptr[1] = wdev;
14614 }
14615
14616 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
14617 !wdev_running(wdev)) {
14618 if (rtnl)
14619 rtnl_unlock();
14620 return -ENETDOWN;
14621 }
14622
14623 if (dev)
14624 dev_hold(dev);
14625
14626 info->user_ptr[0] = rdev;
14627 }
14628
14629 return 0;
14630 }
14631
nl80211_post_doit(const struct genl_ops * ops,struct sk_buff * skb,struct genl_info * info)14632 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
14633 struct genl_info *info)
14634 {
14635 if (info->user_ptr[1]) {
14636 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
14637 struct wireless_dev *wdev = info->user_ptr[1];
14638
14639 if (wdev->netdev)
14640 dev_put(wdev->netdev);
14641 } else {
14642 dev_put(info->user_ptr[1]);
14643 }
14644 }
14645
14646 if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
14647 rtnl_unlock();
14648
14649 /* If needed, clear the netlink message payload from the SKB
14650 * as it might contain key data that shouldn't stick around on
14651 * the heap after the SKB is freed. The netlink message header
14652 * is still needed for further processing, so leave it intact.
14653 */
14654 if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
14655 struct nlmsghdr *nlh = nlmsg_hdr(skb);
14656
14657 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
14658 }
14659 }
14660
14661 static const struct genl_ops nl80211_ops[] = {
14662 {
14663 .cmd = NL80211_CMD_GET_WIPHY,
14664 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14665 .doit = nl80211_get_wiphy,
14666 .dumpit = nl80211_dump_wiphy,
14667 .done = nl80211_dump_wiphy_done,
14668 /* can be retrieved by unprivileged users */
14669 .internal_flags = NL80211_FLAG_NEED_WIPHY |
14670 NL80211_FLAG_NEED_RTNL,
14671 },
14672 };
14673
14674 static const struct genl_small_ops nl80211_small_ops[] = {
14675 {
14676 .cmd = NL80211_CMD_SET_WIPHY,
14677 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14678 .doit = nl80211_set_wiphy,
14679 .flags = GENL_UNS_ADMIN_PERM,
14680 .internal_flags = NL80211_FLAG_NEED_RTNL,
14681 },
14682 {
14683 .cmd = NL80211_CMD_GET_INTERFACE,
14684 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14685 .doit = nl80211_get_interface,
14686 .dumpit = nl80211_dump_interface,
14687 /* can be retrieved by unprivileged users */
14688 .internal_flags = NL80211_FLAG_NEED_WDEV |
14689 NL80211_FLAG_NEED_RTNL,
14690 },
14691 {
14692 .cmd = NL80211_CMD_SET_INTERFACE,
14693 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14694 .doit = nl80211_set_interface,
14695 .flags = GENL_UNS_ADMIN_PERM,
14696 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14697 NL80211_FLAG_NEED_RTNL,
14698 },
14699 {
14700 .cmd = NL80211_CMD_NEW_INTERFACE,
14701 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14702 .doit = nl80211_new_interface,
14703 .flags = GENL_UNS_ADMIN_PERM,
14704 .internal_flags = NL80211_FLAG_NEED_WIPHY |
14705 NL80211_FLAG_NEED_RTNL,
14706 },
14707 {
14708 .cmd = NL80211_CMD_DEL_INTERFACE,
14709 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14710 .doit = nl80211_del_interface,
14711 .flags = GENL_UNS_ADMIN_PERM,
14712 .internal_flags = NL80211_FLAG_NEED_WDEV |
14713 NL80211_FLAG_NEED_RTNL,
14714 },
14715 {
14716 .cmd = NL80211_CMD_GET_KEY,
14717 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14718 .doit = nl80211_get_key,
14719 .flags = GENL_UNS_ADMIN_PERM,
14720 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14721 NL80211_FLAG_NEED_RTNL,
14722 },
14723 {
14724 .cmd = NL80211_CMD_SET_KEY,
14725 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14726 .doit = nl80211_set_key,
14727 .flags = GENL_UNS_ADMIN_PERM,
14728 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14729 NL80211_FLAG_NEED_RTNL |
14730 NL80211_FLAG_CLEAR_SKB,
14731 },
14732 {
14733 .cmd = NL80211_CMD_NEW_KEY,
14734 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14735 .doit = nl80211_new_key,
14736 .flags = GENL_UNS_ADMIN_PERM,
14737 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14738 NL80211_FLAG_NEED_RTNL |
14739 NL80211_FLAG_CLEAR_SKB,
14740 },
14741 {
14742 .cmd = NL80211_CMD_DEL_KEY,
14743 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14744 .doit = nl80211_del_key,
14745 .flags = GENL_UNS_ADMIN_PERM,
14746 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14747 NL80211_FLAG_NEED_RTNL,
14748 },
14749 {
14750 .cmd = NL80211_CMD_SET_BEACON,
14751 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14752 .flags = GENL_UNS_ADMIN_PERM,
14753 .doit = nl80211_set_beacon,
14754 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14755 NL80211_FLAG_NEED_RTNL,
14756 },
14757 {
14758 .cmd = NL80211_CMD_START_AP,
14759 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14760 .flags = GENL_UNS_ADMIN_PERM,
14761 .doit = nl80211_start_ap,
14762 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14763 NL80211_FLAG_NEED_RTNL,
14764 },
14765 {
14766 .cmd = NL80211_CMD_STOP_AP,
14767 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14768 .flags = GENL_UNS_ADMIN_PERM,
14769 .doit = nl80211_stop_ap,
14770 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14771 NL80211_FLAG_NEED_RTNL,
14772 },
14773 {
14774 .cmd = NL80211_CMD_GET_STATION,
14775 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14776 .doit = nl80211_get_station,
14777 .dumpit = nl80211_dump_station,
14778 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14779 NL80211_FLAG_NEED_RTNL,
14780 },
14781 {
14782 .cmd = NL80211_CMD_SET_STATION,
14783 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14784 .doit = nl80211_set_station,
14785 .flags = GENL_UNS_ADMIN_PERM,
14786 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14787 NL80211_FLAG_NEED_RTNL,
14788 },
14789 {
14790 .cmd = NL80211_CMD_NEW_STATION,
14791 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14792 .doit = nl80211_new_station,
14793 .flags = GENL_UNS_ADMIN_PERM,
14794 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14795 NL80211_FLAG_NEED_RTNL,
14796 },
14797 {
14798 .cmd = NL80211_CMD_DEL_STATION,
14799 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14800 .doit = nl80211_del_station,
14801 .flags = GENL_UNS_ADMIN_PERM,
14802 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14803 NL80211_FLAG_NEED_RTNL,
14804 },
14805 {
14806 .cmd = NL80211_CMD_GET_MPATH,
14807 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14808 .doit = nl80211_get_mpath,
14809 .dumpit = nl80211_dump_mpath,
14810 .flags = GENL_UNS_ADMIN_PERM,
14811 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14812 NL80211_FLAG_NEED_RTNL,
14813 },
14814 {
14815 .cmd = NL80211_CMD_GET_MPP,
14816 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14817 .doit = nl80211_get_mpp,
14818 .dumpit = nl80211_dump_mpp,
14819 .flags = GENL_UNS_ADMIN_PERM,
14820 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14821 NL80211_FLAG_NEED_RTNL,
14822 },
14823 {
14824 .cmd = NL80211_CMD_SET_MPATH,
14825 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14826 .doit = nl80211_set_mpath,
14827 .flags = GENL_UNS_ADMIN_PERM,
14828 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14829 NL80211_FLAG_NEED_RTNL,
14830 },
14831 {
14832 .cmd = NL80211_CMD_NEW_MPATH,
14833 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14834 .doit = nl80211_new_mpath,
14835 .flags = GENL_UNS_ADMIN_PERM,
14836 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14837 NL80211_FLAG_NEED_RTNL,
14838 },
14839 {
14840 .cmd = NL80211_CMD_DEL_MPATH,
14841 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14842 .doit = nl80211_del_mpath,
14843 .flags = GENL_UNS_ADMIN_PERM,
14844 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14845 NL80211_FLAG_NEED_RTNL,
14846 },
14847 {
14848 .cmd = NL80211_CMD_SET_BSS,
14849 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14850 .doit = nl80211_set_bss,
14851 .flags = GENL_UNS_ADMIN_PERM,
14852 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14853 NL80211_FLAG_NEED_RTNL,
14854 },
14855 {
14856 .cmd = NL80211_CMD_GET_REG,
14857 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14858 .doit = nl80211_get_reg_do,
14859 .dumpit = nl80211_get_reg_dump,
14860 .internal_flags = NL80211_FLAG_NEED_RTNL,
14861 /* can be retrieved by unprivileged users */
14862 },
14863 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
14864 {
14865 .cmd = NL80211_CMD_SET_REG,
14866 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14867 .doit = nl80211_set_reg,
14868 .flags = GENL_ADMIN_PERM,
14869 .internal_flags = NL80211_FLAG_NEED_RTNL,
14870 },
14871 #endif
14872 {
14873 .cmd = NL80211_CMD_REQ_SET_REG,
14874 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14875 .doit = nl80211_req_set_reg,
14876 .flags = GENL_ADMIN_PERM,
14877 },
14878 {
14879 .cmd = NL80211_CMD_RELOAD_REGDB,
14880 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14881 .doit = nl80211_reload_regdb,
14882 .flags = GENL_ADMIN_PERM,
14883 },
14884 {
14885 .cmd = NL80211_CMD_GET_MESH_CONFIG,
14886 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14887 .doit = nl80211_get_mesh_config,
14888 /* can be retrieved by unprivileged users */
14889 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14890 NL80211_FLAG_NEED_RTNL,
14891 },
14892 {
14893 .cmd = NL80211_CMD_SET_MESH_CONFIG,
14894 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14895 .doit = nl80211_update_mesh_config,
14896 .flags = GENL_UNS_ADMIN_PERM,
14897 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14898 NL80211_FLAG_NEED_RTNL,
14899 },
14900 {
14901 .cmd = NL80211_CMD_TRIGGER_SCAN,
14902 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14903 .doit = nl80211_trigger_scan,
14904 .flags = GENL_UNS_ADMIN_PERM,
14905 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14906 NL80211_FLAG_NEED_RTNL,
14907 },
14908 {
14909 .cmd = NL80211_CMD_ABORT_SCAN,
14910 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14911 .doit = nl80211_abort_scan,
14912 .flags = GENL_UNS_ADMIN_PERM,
14913 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14914 NL80211_FLAG_NEED_RTNL,
14915 },
14916 {
14917 .cmd = NL80211_CMD_GET_SCAN,
14918 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14919 .dumpit = nl80211_dump_scan,
14920 },
14921 {
14922 .cmd = NL80211_CMD_START_SCHED_SCAN,
14923 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14924 .doit = nl80211_start_sched_scan,
14925 .flags = GENL_UNS_ADMIN_PERM,
14926 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14927 NL80211_FLAG_NEED_RTNL,
14928 },
14929 {
14930 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
14931 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14932 .doit = nl80211_stop_sched_scan,
14933 .flags = GENL_UNS_ADMIN_PERM,
14934 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14935 NL80211_FLAG_NEED_RTNL,
14936 },
14937 {
14938 .cmd = NL80211_CMD_AUTHENTICATE,
14939 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14940 .doit = nl80211_authenticate,
14941 .flags = GENL_UNS_ADMIN_PERM,
14942 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14943 NL80211_FLAG_NEED_RTNL |
14944 NL80211_FLAG_CLEAR_SKB,
14945 },
14946 {
14947 .cmd = NL80211_CMD_ASSOCIATE,
14948 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14949 .doit = nl80211_associate,
14950 .flags = GENL_UNS_ADMIN_PERM,
14951 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14952 NL80211_FLAG_NEED_RTNL |
14953 NL80211_FLAG_CLEAR_SKB,
14954 },
14955 {
14956 .cmd = NL80211_CMD_DEAUTHENTICATE,
14957 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14958 .doit = nl80211_deauthenticate,
14959 .flags = GENL_UNS_ADMIN_PERM,
14960 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14961 NL80211_FLAG_NEED_RTNL,
14962 },
14963 {
14964 .cmd = NL80211_CMD_DISASSOCIATE,
14965 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14966 .doit = nl80211_disassociate,
14967 .flags = GENL_UNS_ADMIN_PERM,
14968 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14969 NL80211_FLAG_NEED_RTNL,
14970 },
14971 {
14972 .cmd = NL80211_CMD_JOIN_IBSS,
14973 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14974 .doit = nl80211_join_ibss,
14975 .flags = GENL_UNS_ADMIN_PERM,
14976 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14977 NL80211_FLAG_NEED_RTNL,
14978 },
14979 {
14980 .cmd = NL80211_CMD_LEAVE_IBSS,
14981 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14982 .doit = nl80211_leave_ibss,
14983 .flags = GENL_UNS_ADMIN_PERM,
14984 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14985 NL80211_FLAG_NEED_RTNL,
14986 },
14987 #ifdef CONFIG_NL80211_TESTMODE
14988 {
14989 .cmd = NL80211_CMD_TESTMODE,
14990 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14991 .doit = nl80211_testmode_do,
14992 .dumpit = nl80211_testmode_dump,
14993 .flags = GENL_UNS_ADMIN_PERM,
14994 .internal_flags = NL80211_FLAG_NEED_WIPHY |
14995 NL80211_FLAG_NEED_RTNL,
14996 },
14997 #endif
14998 {
14999 .cmd = NL80211_CMD_CONNECT,
15000 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15001 .doit = nl80211_connect,
15002 .flags = GENL_UNS_ADMIN_PERM,
15003 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15004 NL80211_FLAG_NEED_RTNL |
15005 NL80211_FLAG_CLEAR_SKB,
15006 },
15007 {
15008 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
15009 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15010 .doit = nl80211_update_connect_params,
15011 .flags = GENL_ADMIN_PERM,
15012 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15013 NL80211_FLAG_NEED_RTNL |
15014 NL80211_FLAG_CLEAR_SKB,
15015 },
15016 {
15017 .cmd = NL80211_CMD_DISCONNECT,
15018 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15019 .doit = nl80211_disconnect,
15020 .flags = GENL_UNS_ADMIN_PERM,
15021 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15022 NL80211_FLAG_NEED_RTNL,
15023 },
15024 {
15025 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
15026 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15027 .doit = nl80211_wiphy_netns,
15028 .flags = GENL_UNS_ADMIN_PERM,
15029 .internal_flags = NL80211_FLAG_NEED_WIPHY |
15030 NL80211_FLAG_NEED_RTNL,
15031 },
15032 {
15033 .cmd = NL80211_CMD_GET_SURVEY,
15034 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15035 .dumpit = nl80211_dump_survey,
15036 },
15037 {
15038 .cmd = NL80211_CMD_SET_PMKSA,
15039 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15040 .doit = nl80211_setdel_pmksa,
15041 .flags = GENL_UNS_ADMIN_PERM,
15042 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15043 NL80211_FLAG_NEED_RTNL |
15044 NL80211_FLAG_CLEAR_SKB,
15045 },
15046 {
15047 .cmd = NL80211_CMD_DEL_PMKSA,
15048 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15049 .doit = nl80211_setdel_pmksa,
15050 .flags = GENL_UNS_ADMIN_PERM,
15051 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15052 NL80211_FLAG_NEED_RTNL,
15053 },
15054 {
15055 .cmd = NL80211_CMD_FLUSH_PMKSA,
15056 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15057 .doit = nl80211_flush_pmksa,
15058 .flags = GENL_UNS_ADMIN_PERM,
15059 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15060 NL80211_FLAG_NEED_RTNL,
15061 },
15062 {
15063 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
15064 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15065 .doit = nl80211_remain_on_channel,
15066 .flags = GENL_UNS_ADMIN_PERM,
15067 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
15068 NL80211_FLAG_NEED_RTNL,
15069 },
15070 {
15071 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
15072 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15073 .doit = nl80211_cancel_remain_on_channel,
15074 .flags = GENL_UNS_ADMIN_PERM,
15075 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
15076 NL80211_FLAG_NEED_RTNL,
15077 },
15078 {
15079 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
15080 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15081 .doit = nl80211_set_tx_bitrate_mask,
15082 .flags = GENL_UNS_ADMIN_PERM,
15083 .internal_flags = NL80211_FLAG_NEED_NETDEV |
15084 NL80211_FLAG_NEED_RTNL,
15085 },
15086 {
15087 .cmd = NL80211_CMD_REGISTER_FRAME,
15088 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15089 .doit = nl80211_register_mgmt,
15090 .flags = GENL_UNS_ADMIN_PERM,
15091 .internal_flags = NL80211_FLAG_NEED_WDEV |
15092 NL80211_FLAG_NEED_RTNL,
15093 },
15094 {
15095 .cmd = NL80211_CMD_FRAME,
15096 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15097 .doit = nl80211_tx_mgmt,
15098 .flags = GENL_UNS_ADMIN_PERM,
15099 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
15100 NL80211_FLAG_NEED_RTNL,
15101 },
15102 {
15103 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
15104 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15105 .doit = nl80211_tx_mgmt_cancel_wait,
15106 .flags = GENL_UNS_ADMIN_PERM,
15107 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
15108 NL80211_FLAG_NEED_RTNL,
15109 },
15110 {
15111 .cmd = NL80211_CMD_SET_POWER_SAVE,
15112 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15113 .doit = nl80211_set_power_save,
15114 .flags = GENL_UNS_ADMIN_PERM,
15115 .internal_flags = NL80211_FLAG_NEED_NETDEV |
15116 NL80211_FLAG_NEED_RTNL,
15117 },
15118 {
15119 .cmd = NL80211_CMD_GET_POWER_SAVE,
15120 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15121 .doit = nl80211_get_power_save,
15122 /* can be retrieved by unprivileged users */
15123 .internal_flags = NL80211_FLAG_NEED_NETDEV |
15124 NL80211_FLAG_NEED_RTNL,
15125 },
15126 {
15127 .cmd = NL80211_CMD_SET_CQM,
15128 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15129 .doit = nl80211_set_cqm,
15130 .flags = GENL_UNS_ADMIN_PERM,
15131 .internal_flags = NL80211_FLAG_NEED_NETDEV |
15132 NL80211_FLAG_NEED_RTNL,
15133 },
15134 {
15135 .cmd = NL80211_CMD_SET_CHANNEL,
15136 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15137 .doit = nl80211_set_channel,
15138 .flags = GENL_UNS_ADMIN_PERM,
15139 .internal_flags = NL80211_FLAG_NEED_NETDEV |
15140 NL80211_FLAG_NEED_RTNL,
15141 },
15142 {
15143 .cmd = NL80211_CMD_SET_WDS_PEER,
15144 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15145 .doit = nl80211_set_wds_peer,
15146 .flags = GENL_UNS_ADMIN_PERM,
15147 .internal_flags = NL80211_FLAG_NEED_NETDEV |
15148 NL80211_FLAG_NEED_RTNL,
15149 },
15150 {
15151 .cmd = NL80211_CMD_JOIN_MESH,
15152 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15153 .doit = nl80211_join_mesh,
15154 .flags = GENL_UNS_ADMIN_PERM,
15155 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15156 NL80211_FLAG_NEED_RTNL,
15157 },
15158 {
15159 .cmd = NL80211_CMD_LEAVE_MESH,
15160 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15161 .doit = nl80211_leave_mesh,
15162 .flags = GENL_UNS_ADMIN_PERM,
15163 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15164 NL80211_FLAG_NEED_RTNL,
15165 },
15166 {
15167 .cmd = NL80211_CMD_JOIN_OCB,
15168 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15169 .doit = nl80211_join_ocb,
15170 .flags = GENL_UNS_ADMIN_PERM,
15171 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15172 NL80211_FLAG_NEED_RTNL,
15173 },
15174 {
15175 .cmd = NL80211_CMD_LEAVE_OCB,
15176 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15177 .doit = nl80211_leave_ocb,
15178 .flags = GENL_UNS_ADMIN_PERM,
15179 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15180 NL80211_FLAG_NEED_RTNL,
15181 },
15182 #ifdef CONFIG_PM
15183 {
15184 .cmd = NL80211_CMD_GET_WOWLAN,
15185 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15186 .doit = nl80211_get_wowlan,
15187 /* can be retrieved by unprivileged users */
15188 .internal_flags = NL80211_FLAG_NEED_WIPHY |
15189 NL80211_FLAG_NEED_RTNL,
15190 },
15191 {
15192 .cmd = NL80211_CMD_SET_WOWLAN,
15193 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15194 .doit = nl80211_set_wowlan,
15195 .flags = GENL_UNS_ADMIN_PERM,
15196 .internal_flags = NL80211_FLAG_NEED_WIPHY |
15197 NL80211_FLAG_NEED_RTNL,
15198 },
15199 #endif
15200 {
15201 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
15202 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15203 .doit = nl80211_set_rekey_data,
15204 .flags = GENL_UNS_ADMIN_PERM,
15205 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15206 NL80211_FLAG_NEED_RTNL |
15207 NL80211_FLAG_CLEAR_SKB,
15208 },
15209 {
15210 .cmd = NL80211_CMD_TDLS_MGMT,
15211 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15212 .doit = nl80211_tdls_mgmt,
15213 .flags = GENL_UNS_ADMIN_PERM,
15214 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15215 NL80211_FLAG_NEED_RTNL,
15216 },
15217 {
15218 .cmd = NL80211_CMD_TDLS_OPER,
15219 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15220 .doit = nl80211_tdls_oper,
15221 .flags = GENL_UNS_ADMIN_PERM,
15222 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15223 NL80211_FLAG_NEED_RTNL,
15224 },
15225 {
15226 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
15227 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15228 .doit = nl80211_register_unexpected_frame,
15229 .flags = GENL_UNS_ADMIN_PERM,
15230 .internal_flags = NL80211_FLAG_NEED_NETDEV |
15231 NL80211_FLAG_NEED_RTNL,
15232 },
15233 {
15234 .cmd = NL80211_CMD_PROBE_CLIENT,
15235 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15236 .doit = nl80211_probe_client,
15237 .flags = GENL_UNS_ADMIN_PERM,
15238 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15239 NL80211_FLAG_NEED_RTNL,
15240 },
15241 {
15242 .cmd = NL80211_CMD_REGISTER_BEACONS,
15243 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15244 .doit = nl80211_register_beacons,
15245 .flags = GENL_UNS_ADMIN_PERM,
15246 .internal_flags = NL80211_FLAG_NEED_WIPHY |
15247 NL80211_FLAG_NEED_RTNL,
15248 },
15249 {
15250 .cmd = NL80211_CMD_SET_NOACK_MAP,
15251 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15252 .doit = nl80211_set_noack_map,
15253 .flags = GENL_UNS_ADMIN_PERM,
15254 .internal_flags = NL80211_FLAG_NEED_NETDEV |
15255 NL80211_FLAG_NEED_RTNL,
15256 },
15257 {
15258 .cmd = NL80211_CMD_START_P2P_DEVICE,
15259 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15260 .doit = nl80211_start_p2p_device,
15261 .flags = GENL_UNS_ADMIN_PERM,
15262 .internal_flags = NL80211_FLAG_NEED_WDEV |
15263 NL80211_FLAG_NEED_RTNL,
15264 },
15265 {
15266 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
15267 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15268 .doit = nl80211_stop_p2p_device,
15269 .flags = GENL_UNS_ADMIN_PERM,
15270 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
15271 NL80211_FLAG_NEED_RTNL,
15272 },
15273 {
15274 .cmd = NL80211_CMD_START_NAN,
15275 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15276 .doit = nl80211_start_nan,
15277 .flags = GENL_ADMIN_PERM,
15278 .internal_flags = NL80211_FLAG_NEED_WDEV |
15279 NL80211_FLAG_NEED_RTNL,
15280 },
15281 {
15282 .cmd = NL80211_CMD_STOP_NAN,
15283 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15284 .doit = nl80211_stop_nan,
15285 .flags = GENL_ADMIN_PERM,
15286 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
15287 NL80211_FLAG_NEED_RTNL,
15288 },
15289 {
15290 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
15291 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15292 .doit = nl80211_nan_add_func,
15293 .flags = GENL_ADMIN_PERM,
15294 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
15295 NL80211_FLAG_NEED_RTNL,
15296 },
15297 {
15298 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
15299 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15300 .doit = nl80211_nan_del_func,
15301 .flags = GENL_ADMIN_PERM,
15302 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
15303 NL80211_FLAG_NEED_RTNL,
15304 },
15305 {
15306 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
15307 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15308 .doit = nl80211_nan_change_config,
15309 .flags = GENL_ADMIN_PERM,
15310 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
15311 NL80211_FLAG_NEED_RTNL,
15312 },
15313 {
15314 .cmd = NL80211_CMD_SET_MCAST_RATE,
15315 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15316 .doit = nl80211_set_mcast_rate,
15317 .flags = GENL_UNS_ADMIN_PERM,
15318 .internal_flags = NL80211_FLAG_NEED_NETDEV |
15319 NL80211_FLAG_NEED_RTNL,
15320 },
15321 {
15322 .cmd = NL80211_CMD_SET_MAC_ACL,
15323 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15324 .doit = nl80211_set_mac_acl,
15325 .flags = GENL_UNS_ADMIN_PERM,
15326 .internal_flags = NL80211_FLAG_NEED_NETDEV |
15327 NL80211_FLAG_NEED_RTNL,
15328 },
15329 {
15330 .cmd = NL80211_CMD_RADAR_DETECT,
15331 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15332 .doit = nl80211_start_radar_detection,
15333 .flags = GENL_UNS_ADMIN_PERM,
15334 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15335 NL80211_FLAG_NEED_RTNL,
15336 },
15337 {
15338 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
15339 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15340 .doit = nl80211_get_protocol_features,
15341 },
15342 {
15343 .cmd = NL80211_CMD_UPDATE_FT_IES,
15344 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15345 .doit = nl80211_update_ft_ies,
15346 .flags = GENL_UNS_ADMIN_PERM,
15347 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15348 NL80211_FLAG_NEED_RTNL,
15349 },
15350 {
15351 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
15352 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15353 .doit = nl80211_crit_protocol_start,
15354 .flags = GENL_UNS_ADMIN_PERM,
15355 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
15356 NL80211_FLAG_NEED_RTNL,
15357 },
15358 {
15359 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
15360 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15361 .doit = nl80211_crit_protocol_stop,
15362 .flags = GENL_UNS_ADMIN_PERM,
15363 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
15364 NL80211_FLAG_NEED_RTNL,
15365 },
15366 {
15367 .cmd = NL80211_CMD_GET_COALESCE,
15368 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15369 .doit = nl80211_get_coalesce,
15370 .internal_flags = NL80211_FLAG_NEED_WIPHY |
15371 NL80211_FLAG_NEED_RTNL,
15372 },
15373 {
15374 .cmd = NL80211_CMD_SET_COALESCE,
15375 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15376 .doit = nl80211_set_coalesce,
15377 .flags = GENL_UNS_ADMIN_PERM,
15378 .internal_flags = NL80211_FLAG_NEED_WIPHY |
15379 NL80211_FLAG_NEED_RTNL,
15380 },
15381 {
15382 .cmd = NL80211_CMD_CHANNEL_SWITCH,
15383 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15384 .doit = nl80211_channel_switch,
15385 .flags = GENL_UNS_ADMIN_PERM,
15386 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15387 NL80211_FLAG_NEED_RTNL,
15388 },
15389 {
15390 .cmd = NL80211_CMD_VENDOR,
15391 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15392 .doit = nl80211_vendor_cmd,
15393 .dumpit = nl80211_vendor_cmd_dump,
15394 .flags = GENL_UNS_ADMIN_PERM,
15395 .internal_flags = NL80211_FLAG_NEED_WIPHY |
15396 NL80211_FLAG_NEED_RTNL |
15397 NL80211_FLAG_CLEAR_SKB,
15398 },
15399 {
15400 .cmd = NL80211_CMD_SET_QOS_MAP,
15401 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15402 .doit = nl80211_set_qos_map,
15403 .flags = GENL_UNS_ADMIN_PERM,
15404 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15405 NL80211_FLAG_NEED_RTNL,
15406 },
15407 {
15408 .cmd = NL80211_CMD_ADD_TX_TS,
15409 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15410 .doit = nl80211_add_tx_ts,
15411 .flags = GENL_UNS_ADMIN_PERM,
15412 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15413 NL80211_FLAG_NEED_RTNL,
15414 },
15415 {
15416 .cmd = NL80211_CMD_DEL_TX_TS,
15417 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15418 .doit = nl80211_del_tx_ts,
15419 .flags = GENL_UNS_ADMIN_PERM,
15420 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15421 NL80211_FLAG_NEED_RTNL,
15422 },
15423 {
15424 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
15425 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15426 .doit = nl80211_tdls_channel_switch,
15427 .flags = GENL_UNS_ADMIN_PERM,
15428 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15429 NL80211_FLAG_NEED_RTNL,
15430 },
15431 {
15432 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
15433 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15434 .doit = nl80211_tdls_cancel_channel_switch,
15435 .flags = GENL_UNS_ADMIN_PERM,
15436 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15437 NL80211_FLAG_NEED_RTNL,
15438 },
15439 {
15440 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
15441 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15442 .doit = nl80211_set_multicast_to_unicast,
15443 .flags = GENL_UNS_ADMIN_PERM,
15444 .internal_flags = NL80211_FLAG_NEED_NETDEV |
15445 NL80211_FLAG_NEED_RTNL,
15446 },
15447 {
15448 .cmd = NL80211_CMD_SET_PMK,
15449 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15450 .doit = nl80211_set_pmk,
15451 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15452 NL80211_FLAG_NEED_RTNL |
15453 NL80211_FLAG_CLEAR_SKB,
15454 },
15455 {
15456 .cmd = NL80211_CMD_DEL_PMK,
15457 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15458 .doit = nl80211_del_pmk,
15459 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15460 NL80211_FLAG_NEED_RTNL,
15461 },
15462 {
15463 .cmd = NL80211_CMD_EXTERNAL_AUTH,
15464 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15465 .doit = nl80211_external_auth,
15466 .flags = GENL_ADMIN_PERM,
15467 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15468 NL80211_FLAG_NEED_RTNL,
15469 },
15470 {
15471 .cmd = NL80211_CMD_CONTROL_PORT_FRAME,
15472 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15473 .doit = nl80211_tx_control_port,
15474 .flags = GENL_UNS_ADMIN_PERM,
15475 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15476 NL80211_FLAG_NEED_RTNL,
15477 },
15478 {
15479 .cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS,
15480 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15481 .doit = nl80211_get_ftm_responder_stats,
15482 .internal_flags = NL80211_FLAG_NEED_NETDEV |
15483 NL80211_FLAG_NEED_RTNL,
15484 },
15485 {
15486 .cmd = NL80211_CMD_PEER_MEASUREMENT_START,
15487 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15488 .doit = nl80211_pmsr_start,
15489 .flags = GENL_UNS_ADMIN_PERM,
15490 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
15491 NL80211_FLAG_NEED_RTNL,
15492 },
15493 {
15494 .cmd = NL80211_CMD_NOTIFY_RADAR,
15495 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15496 .doit = nl80211_notify_radar_detection,
15497 .flags = GENL_UNS_ADMIN_PERM,
15498 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15499 NL80211_FLAG_NEED_RTNL,
15500 },
15501 {
15502 .cmd = NL80211_CMD_UPDATE_OWE_INFO,
15503 .doit = nl80211_update_owe_info,
15504 .flags = GENL_ADMIN_PERM,
15505 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15506 NL80211_FLAG_NEED_RTNL,
15507 },
15508 {
15509 .cmd = NL80211_CMD_PROBE_MESH_LINK,
15510 .doit = nl80211_probe_mesh_link,
15511 .flags = GENL_UNS_ADMIN_PERM,
15512 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15513 NL80211_FLAG_NEED_RTNL,
15514 },
15515 {
15516 .cmd = NL80211_CMD_SET_TID_CONFIG,
15517 .doit = nl80211_set_tid_config,
15518 .flags = GENL_UNS_ADMIN_PERM,
15519 .internal_flags = NL80211_FLAG_NEED_NETDEV |
15520 NL80211_FLAG_NEED_RTNL,
15521 },
15522 };
15523
15524 static struct genl_family nl80211_fam __ro_after_init = {
15525 .name = NL80211_GENL_NAME, /* have users key off the name instead */
15526 .hdrsize = 0, /* no private header */
15527 .version = 1, /* no particular meaning now */
15528 .maxattr = NL80211_ATTR_MAX,
15529 .policy = nl80211_policy,
15530 .netnsok = true,
15531 .pre_doit = nl80211_pre_doit,
15532 .post_doit = nl80211_post_doit,
15533 .module = THIS_MODULE,
15534 .ops = nl80211_ops,
15535 .n_ops = ARRAY_SIZE(nl80211_ops),
15536 .small_ops = nl80211_small_ops,
15537 .n_small_ops = ARRAY_SIZE(nl80211_small_ops),
15538 .mcgrps = nl80211_mcgrps,
15539 .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
15540 .parallel_ops = true,
15541 };
15542
15543 /* notification functions */
15544
nl80211_notify_wiphy(struct cfg80211_registered_device * rdev,enum nl80211_commands cmd)15545 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
15546 enum nl80211_commands cmd)
15547 {
15548 struct sk_buff *msg;
15549 struct nl80211_dump_wiphy_state state = {};
15550
15551 WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
15552 cmd != NL80211_CMD_DEL_WIPHY);
15553
15554 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15555 if (!msg)
15556 return;
15557
15558 if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
15559 nlmsg_free(msg);
15560 return;
15561 }
15562
15563 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15564 NL80211_MCGRP_CONFIG, GFP_KERNEL);
15565 }
15566
nl80211_notify_iface(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,enum nl80211_commands cmd)15567 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
15568 struct wireless_dev *wdev,
15569 enum nl80211_commands cmd)
15570 {
15571 struct sk_buff *msg;
15572
15573 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15574 if (!msg)
15575 return;
15576
15577 if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, cmd) < 0) {
15578 nlmsg_free(msg);
15579 return;
15580 }
15581
15582 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15583 NL80211_MCGRP_CONFIG, GFP_KERNEL);
15584 }
15585
nl80211_add_scan_req(struct sk_buff * msg,struct cfg80211_registered_device * rdev)15586 static int nl80211_add_scan_req(struct sk_buff *msg,
15587 struct cfg80211_registered_device *rdev)
15588 {
15589 struct cfg80211_scan_request *req = rdev->scan_req;
15590 struct nlattr *nest;
15591 int i;
15592 struct cfg80211_scan_info *info;
15593
15594 if (WARN_ON(!req))
15595 return 0;
15596
15597 nest = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_SSIDS);
15598 if (!nest)
15599 goto nla_put_failure;
15600 for (i = 0; i < req->n_ssids; i++) {
15601 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
15602 goto nla_put_failure;
15603 }
15604 nla_nest_end(msg, nest);
15605
15606 if (req->flags & NL80211_SCAN_FLAG_FREQ_KHZ) {
15607 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQ_KHZ);
15608 if (!nest)
15609 goto nla_put_failure;
15610 for (i = 0; i < req->n_channels; i++) {
15611 if (nla_put_u32(msg, i,
15612 ieee80211_channel_to_khz(req->channels[i])))
15613 goto nla_put_failure;
15614 }
15615 nla_nest_end(msg, nest);
15616 } else {
15617 nest = nla_nest_start_noflag(msg,
15618 NL80211_ATTR_SCAN_FREQUENCIES);
15619 if (!nest)
15620 goto nla_put_failure;
15621 for (i = 0; i < req->n_channels; i++) {
15622 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
15623 goto nla_put_failure;
15624 }
15625 nla_nest_end(msg, nest);
15626 }
15627
15628 if (req->ie &&
15629 nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
15630 goto nla_put_failure;
15631
15632 if (req->flags &&
15633 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
15634 goto nla_put_failure;
15635
15636 info = rdev->int_scan_req ? &rdev->int_scan_req->info :
15637 &rdev->scan_req->info;
15638 if (info->scan_start_tsf &&
15639 (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
15640 info->scan_start_tsf, NL80211_BSS_PAD) ||
15641 nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
15642 info->tsf_bssid)))
15643 goto nla_put_failure;
15644
15645 return 0;
15646 nla_put_failure:
15647 return -ENOBUFS;
15648 }
15649
nl80211_prep_scan_msg(struct sk_buff * msg,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,u32 portid,u32 seq,int flags,u32 cmd)15650 static int nl80211_prep_scan_msg(struct sk_buff *msg,
15651 struct cfg80211_registered_device *rdev,
15652 struct wireless_dev *wdev,
15653 u32 portid, u32 seq, int flags,
15654 u32 cmd)
15655 {
15656 void *hdr;
15657
15658 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
15659 if (!hdr)
15660 return -1;
15661
15662 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15663 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15664 wdev->netdev->ifindex)) ||
15665 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15666 NL80211_ATTR_PAD))
15667 goto nla_put_failure;
15668
15669 /* ignore errors and send incomplete event anyway */
15670 nl80211_add_scan_req(msg, rdev);
15671
15672 genlmsg_end(msg, hdr);
15673 return 0;
15674
15675 nla_put_failure:
15676 genlmsg_cancel(msg, hdr);
15677 return -EMSGSIZE;
15678 }
15679
15680 static int
nl80211_prep_sched_scan_msg(struct sk_buff * msg,struct cfg80211_sched_scan_request * req,u32 cmd)15681 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
15682 struct cfg80211_sched_scan_request *req, u32 cmd)
15683 {
15684 void *hdr;
15685
15686 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
15687 if (!hdr)
15688 return -1;
15689
15690 if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
15691 wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
15692 nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
15693 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
15694 NL80211_ATTR_PAD))
15695 goto nla_put_failure;
15696
15697 genlmsg_end(msg, hdr);
15698 return 0;
15699
15700 nla_put_failure:
15701 genlmsg_cancel(msg, hdr);
15702 return -EMSGSIZE;
15703 }
15704
nl80211_send_scan_start(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev)15705 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
15706 struct wireless_dev *wdev)
15707 {
15708 struct sk_buff *msg;
15709
15710 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15711 if (!msg)
15712 return;
15713
15714 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
15715 NL80211_CMD_TRIGGER_SCAN) < 0) {
15716 nlmsg_free(msg);
15717 return;
15718 }
15719
15720 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15721 NL80211_MCGRP_SCAN, GFP_KERNEL);
15722 }
15723
nl80211_build_scan_msg(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,bool aborted)15724 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
15725 struct wireless_dev *wdev, bool aborted)
15726 {
15727 struct sk_buff *msg;
15728
15729 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15730 if (!msg)
15731 return NULL;
15732
15733 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
15734 aborted ? NL80211_CMD_SCAN_ABORTED :
15735 NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
15736 nlmsg_free(msg);
15737 return NULL;
15738 }
15739
15740 return msg;
15741 }
15742
15743 /* send message created by nl80211_build_scan_msg() */
nl80211_send_scan_msg(struct cfg80211_registered_device * rdev,struct sk_buff * msg)15744 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
15745 struct sk_buff *msg)
15746 {
15747 if (!msg)
15748 return;
15749
15750 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15751 NL80211_MCGRP_SCAN, GFP_KERNEL);
15752 }
15753
nl80211_send_sched_scan(struct cfg80211_sched_scan_request * req,u32 cmd)15754 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
15755 {
15756 struct sk_buff *msg;
15757
15758 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15759 if (!msg)
15760 return;
15761
15762 if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
15763 nlmsg_free(msg);
15764 return;
15765 }
15766
15767 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
15768 NL80211_MCGRP_SCAN, GFP_KERNEL);
15769 }
15770
nl80211_reg_change_event_fill(struct sk_buff * msg,struct regulatory_request * request)15771 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
15772 struct regulatory_request *request)
15773 {
15774 /* Userspace can always count this one always being set */
15775 if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
15776 goto nla_put_failure;
15777
15778 if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
15779 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
15780 NL80211_REGDOM_TYPE_WORLD))
15781 goto nla_put_failure;
15782 } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
15783 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
15784 NL80211_REGDOM_TYPE_CUSTOM_WORLD))
15785 goto nla_put_failure;
15786 } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
15787 request->intersect) {
15788 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
15789 NL80211_REGDOM_TYPE_INTERSECTION))
15790 goto nla_put_failure;
15791 } else {
15792 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
15793 NL80211_REGDOM_TYPE_COUNTRY) ||
15794 nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
15795 request->alpha2))
15796 goto nla_put_failure;
15797 }
15798
15799 if (request->wiphy_idx != WIPHY_IDX_INVALID) {
15800 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
15801
15802 if (wiphy &&
15803 nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
15804 goto nla_put_failure;
15805
15806 if (wiphy &&
15807 wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
15808 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
15809 goto nla_put_failure;
15810 }
15811
15812 return true;
15813
15814 nla_put_failure:
15815 return false;
15816 }
15817
15818 /*
15819 * This can happen on global regulatory changes or device specific settings
15820 * based on custom regulatory domains.
15821 */
nl80211_common_reg_change_event(enum nl80211_commands cmd_id,struct regulatory_request * request)15822 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
15823 struct regulatory_request *request)
15824 {
15825 struct sk_buff *msg;
15826 void *hdr;
15827
15828 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15829 if (!msg)
15830 return;
15831
15832 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
15833 if (!hdr)
15834 goto nla_put_failure;
15835
15836 if (!nl80211_reg_change_event_fill(msg, request))
15837 goto nla_put_failure;
15838
15839 genlmsg_end(msg, hdr);
15840
15841 rcu_read_lock();
15842 genlmsg_multicast_allns(&nl80211_fam, msg, 0,
15843 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
15844 rcu_read_unlock();
15845
15846 return;
15847
15848 nla_put_failure:
15849 nlmsg_free(msg);
15850 }
15851
nl80211_send_mlme_event(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,enum nl80211_commands cmd,gfp_t gfp,int uapsd_queues,const u8 * req_ies,size_t req_ies_len)15852 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
15853 struct net_device *netdev,
15854 const u8 *buf, size_t len,
15855 enum nl80211_commands cmd, gfp_t gfp,
15856 int uapsd_queues, const u8 *req_ies,
15857 size_t req_ies_len)
15858 {
15859 struct sk_buff *msg;
15860 void *hdr;
15861
15862 msg = nlmsg_new(100 + len + req_ies_len, gfp);
15863 if (!msg)
15864 return;
15865
15866 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
15867 if (!hdr) {
15868 nlmsg_free(msg);
15869 return;
15870 }
15871
15872 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15873 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15874 nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
15875 (req_ies &&
15876 nla_put(msg, NL80211_ATTR_REQ_IE, req_ies_len, req_ies)))
15877 goto nla_put_failure;
15878
15879 if (uapsd_queues >= 0) {
15880 struct nlattr *nla_wmm =
15881 nla_nest_start_noflag(msg, NL80211_ATTR_STA_WME);
15882 if (!nla_wmm)
15883 goto nla_put_failure;
15884
15885 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
15886 uapsd_queues))
15887 goto nla_put_failure;
15888
15889 nla_nest_end(msg, nla_wmm);
15890 }
15891
15892 genlmsg_end(msg, hdr);
15893
15894 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15895 NL80211_MCGRP_MLME, gfp);
15896 return;
15897
15898 nla_put_failure:
15899 nlmsg_free(msg);
15900 }
15901
nl80211_send_rx_auth(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,gfp_t gfp)15902 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
15903 struct net_device *netdev, const u8 *buf,
15904 size_t len, gfp_t gfp)
15905 {
15906 nl80211_send_mlme_event(rdev, netdev, buf, len,
15907 NL80211_CMD_AUTHENTICATE, gfp, -1, NULL, 0);
15908 }
15909
nl80211_send_rx_assoc(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,gfp_t gfp,int uapsd_queues,const u8 * req_ies,size_t req_ies_len)15910 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
15911 struct net_device *netdev, const u8 *buf,
15912 size_t len, gfp_t gfp, int uapsd_queues,
15913 const u8 *req_ies, size_t req_ies_len)
15914 {
15915 nl80211_send_mlme_event(rdev, netdev, buf, len,
15916 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues,
15917 req_ies, req_ies_len);
15918 }
15919
nl80211_send_deauth(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,gfp_t gfp)15920 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
15921 struct net_device *netdev, const u8 *buf,
15922 size_t len, gfp_t gfp)
15923 {
15924 nl80211_send_mlme_event(rdev, netdev, buf, len,
15925 NL80211_CMD_DEAUTHENTICATE, gfp, -1, NULL, 0);
15926 }
15927
nl80211_send_disassoc(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,gfp_t gfp)15928 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
15929 struct net_device *netdev, const u8 *buf,
15930 size_t len, gfp_t gfp)
15931 {
15932 nl80211_send_mlme_event(rdev, netdev, buf, len,
15933 NL80211_CMD_DISASSOCIATE, gfp, -1, NULL, 0);
15934 }
15935
cfg80211_rx_unprot_mlme_mgmt(struct net_device * dev,const u8 * buf,size_t len)15936 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
15937 size_t len)
15938 {
15939 struct wireless_dev *wdev = dev->ieee80211_ptr;
15940 struct wiphy *wiphy = wdev->wiphy;
15941 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15942 const struct ieee80211_mgmt *mgmt = (void *)buf;
15943 u32 cmd;
15944
15945 if (WARN_ON(len < 2))
15946 return;
15947
15948 if (ieee80211_is_deauth(mgmt->frame_control)) {
15949 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
15950 } else if (ieee80211_is_disassoc(mgmt->frame_control)) {
15951 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
15952 } else if (ieee80211_is_beacon(mgmt->frame_control)) {
15953 if (wdev->unprot_beacon_reported &&
15954 elapsed_jiffies_msecs(wdev->unprot_beacon_reported) < 10000)
15955 return;
15956 cmd = NL80211_CMD_UNPROT_BEACON;
15957 wdev->unprot_beacon_reported = jiffies;
15958 } else {
15959 return;
15960 }
15961
15962 trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
15963 nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1,
15964 NULL, 0);
15965 }
15966 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
15967
nl80211_send_mlme_timeout(struct cfg80211_registered_device * rdev,struct net_device * netdev,int cmd,const u8 * addr,gfp_t gfp)15968 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
15969 struct net_device *netdev, int cmd,
15970 const u8 *addr, gfp_t gfp)
15971 {
15972 struct sk_buff *msg;
15973 void *hdr;
15974
15975 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15976 if (!msg)
15977 return;
15978
15979 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
15980 if (!hdr) {
15981 nlmsg_free(msg);
15982 return;
15983 }
15984
15985 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15986 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15987 nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
15988 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
15989 goto nla_put_failure;
15990
15991 genlmsg_end(msg, hdr);
15992
15993 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15994 NL80211_MCGRP_MLME, gfp);
15995 return;
15996
15997 nla_put_failure:
15998 nlmsg_free(msg);
15999 }
16000
nl80211_send_auth_timeout(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * addr,gfp_t gfp)16001 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
16002 struct net_device *netdev, const u8 *addr,
16003 gfp_t gfp)
16004 {
16005 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
16006 addr, gfp);
16007 }
16008
nl80211_send_assoc_timeout(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * addr,gfp_t gfp)16009 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
16010 struct net_device *netdev, const u8 *addr,
16011 gfp_t gfp)
16012 {
16013 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
16014 addr, gfp);
16015 }
16016
nl80211_send_connect_result(struct cfg80211_registered_device * rdev,struct net_device * netdev,struct cfg80211_connect_resp_params * cr,gfp_t gfp)16017 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
16018 struct net_device *netdev,
16019 struct cfg80211_connect_resp_params *cr,
16020 gfp_t gfp)
16021 {
16022 struct sk_buff *msg;
16023 void *hdr;
16024
16025 msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
16026 cr->fils.kek_len + cr->fils.pmk_len +
16027 (cr->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
16028 if (!msg)
16029 return;
16030
16031 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
16032 if (!hdr) {
16033 nlmsg_free(msg);
16034 return;
16035 }
16036
16037 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16038 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16039 (cr->bssid &&
16040 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cr->bssid)) ||
16041 nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
16042 cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
16043 cr->status) ||
16044 (cr->status < 0 &&
16045 (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
16046 nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
16047 cr->timeout_reason))) ||
16048 (cr->req_ie &&
16049 nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
16050 (cr->resp_ie &&
16051 nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
16052 cr->resp_ie)) ||
16053 (cr->fils.update_erp_next_seq_num &&
16054 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
16055 cr->fils.erp_next_seq_num)) ||
16056 (cr->status == WLAN_STATUS_SUCCESS &&
16057 ((cr->fils.kek &&
16058 nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len,
16059 cr->fils.kek)) ||
16060 (cr->fils.pmk &&
16061 nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) ||
16062 (cr->fils.pmkid &&
16063 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid)))))
16064 goto nla_put_failure;
16065
16066 genlmsg_end(msg, hdr);
16067
16068 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16069 NL80211_MCGRP_MLME, gfp);
16070 return;
16071
16072 nla_put_failure:
16073 nlmsg_free(msg);
16074 }
16075
nl80211_send_roamed(struct cfg80211_registered_device * rdev,struct net_device * netdev,struct cfg80211_roam_info * info,gfp_t gfp)16076 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
16077 struct net_device *netdev,
16078 struct cfg80211_roam_info *info, gfp_t gfp)
16079 {
16080 struct sk_buff *msg;
16081 void *hdr;
16082 const u8 *bssid = info->bss ? info->bss->bssid : info->bssid;
16083
16084 msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len +
16085 info->fils.kek_len + info->fils.pmk_len +
16086 (info->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
16087 if (!msg)
16088 return;
16089
16090 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
16091 if (!hdr) {
16092 nlmsg_free(msg);
16093 return;
16094 }
16095
16096 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16097 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16098 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
16099 (info->req_ie &&
16100 nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
16101 info->req_ie)) ||
16102 (info->resp_ie &&
16103 nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
16104 info->resp_ie)) ||
16105 (info->fils.update_erp_next_seq_num &&
16106 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
16107 info->fils.erp_next_seq_num)) ||
16108 (info->fils.kek &&
16109 nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len,
16110 info->fils.kek)) ||
16111 (info->fils.pmk &&
16112 nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) ||
16113 (info->fils.pmkid &&
16114 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid)))
16115 goto nla_put_failure;
16116
16117 genlmsg_end(msg, hdr);
16118
16119 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16120 NL80211_MCGRP_MLME, gfp);
16121 return;
16122
16123 nla_put_failure:
16124 nlmsg_free(msg);
16125 }
16126
nl80211_send_port_authorized(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * bssid)16127 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
16128 struct net_device *netdev, const u8 *bssid)
16129 {
16130 struct sk_buff *msg;
16131 void *hdr;
16132
16133 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16134 if (!msg)
16135 return;
16136
16137 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
16138 if (!hdr) {
16139 nlmsg_free(msg);
16140 return;
16141 }
16142
16143 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16144 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16145 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
16146 goto nla_put_failure;
16147
16148 genlmsg_end(msg, hdr);
16149
16150 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16151 NL80211_MCGRP_MLME, GFP_KERNEL);
16152 return;
16153
16154 nla_put_failure:
16155 nlmsg_free(msg);
16156 }
16157
nl80211_send_disconnected(struct cfg80211_registered_device * rdev,struct net_device * netdev,u16 reason,const u8 * ie,size_t ie_len,bool from_ap)16158 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
16159 struct net_device *netdev, u16 reason,
16160 const u8 *ie, size_t ie_len, bool from_ap)
16161 {
16162 struct sk_buff *msg;
16163 void *hdr;
16164
16165 msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
16166 if (!msg)
16167 return;
16168
16169 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
16170 if (!hdr) {
16171 nlmsg_free(msg);
16172 return;
16173 }
16174
16175 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16176 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16177 (reason &&
16178 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
16179 (from_ap &&
16180 nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
16181 (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
16182 goto nla_put_failure;
16183
16184 genlmsg_end(msg, hdr);
16185
16186 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16187 NL80211_MCGRP_MLME, GFP_KERNEL);
16188 return;
16189
16190 nla_put_failure:
16191 nlmsg_free(msg);
16192 }
16193
nl80211_send_ibss_bssid(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * bssid,gfp_t gfp)16194 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
16195 struct net_device *netdev, const u8 *bssid,
16196 gfp_t gfp)
16197 {
16198 struct sk_buff *msg;
16199 void *hdr;
16200
16201 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16202 if (!msg)
16203 return;
16204
16205 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
16206 if (!hdr) {
16207 nlmsg_free(msg);
16208 return;
16209 }
16210
16211 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16212 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16213 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
16214 goto nla_put_failure;
16215
16216 genlmsg_end(msg, hdr);
16217
16218 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16219 NL80211_MCGRP_MLME, gfp);
16220 return;
16221
16222 nla_put_failure:
16223 nlmsg_free(msg);
16224 }
16225
cfg80211_notify_new_peer_candidate(struct net_device * dev,const u8 * addr,const u8 * ie,u8 ie_len,int sig_dbm,gfp_t gfp)16226 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
16227 const u8 *ie, u8 ie_len,
16228 int sig_dbm, gfp_t gfp)
16229 {
16230 struct wireless_dev *wdev = dev->ieee80211_ptr;
16231 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16232 struct sk_buff *msg;
16233 void *hdr;
16234
16235 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
16236 return;
16237
16238 trace_cfg80211_notify_new_peer_candidate(dev, addr);
16239
16240 msg = nlmsg_new(100 + ie_len, gfp);
16241 if (!msg)
16242 return;
16243
16244 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
16245 if (!hdr) {
16246 nlmsg_free(msg);
16247 return;
16248 }
16249
16250 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16251 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16252 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
16253 (ie_len && ie &&
16254 nla_put(msg, NL80211_ATTR_IE, ie_len, ie)) ||
16255 (sig_dbm &&
16256 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)))
16257 goto nla_put_failure;
16258
16259 genlmsg_end(msg, hdr);
16260
16261 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16262 NL80211_MCGRP_MLME, gfp);
16263 return;
16264
16265 nla_put_failure:
16266 nlmsg_free(msg);
16267 }
16268 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
16269
nl80211_michael_mic_failure(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * addr,enum nl80211_key_type key_type,int key_id,const u8 * tsc,gfp_t gfp)16270 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
16271 struct net_device *netdev, const u8 *addr,
16272 enum nl80211_key_type key_type, int key_id,
16273 const u8 *tsc, gfp_t gfp)
16274 {
16275 struct sk_buff *msg;
16276 void *hdr;
16277
16278 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16279 if (!msg)
16280 return;
16281
16282 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
16283 if (!hdr) {
16284 nlmsg_free(msg);
16285 return;
16286 }
16287
16288 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16289 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16290 (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
16291 nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
16292 (key_id != -1 &&
16293 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
16294 (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
16295 goto nla_put_failure;
16296
16297 genlmsg_end(msg, hdr);
16298
16299 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16300 NL80211_MCGRP_MLME, gfp);
16301 return;
16302
16303 nla_put_failure:
16304 nlmsg_free(msg);
16305 }
16306
nl80211_send_beacon_hint_event(struct wiphy * wiphy,struct ieee80211_channel * channel_before,struct ieee80211_channel * channel_after)16307 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
16308 struct ieee80211_channel *channel_before,
16309 struct ieee80211_channel *channel_after)
16310 {
16311 struct sk_buff *msg;
16312 void *hdr;
16313 struct nlattr *nl_freq;
16314
16315 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
16316 if (!msg)
16317 return;
16318
16319 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
16320 if (!hdr) {
16321 nlmsg_free(msg);
16322 return;
16323 }
16324
16325 /*
16326 * Since we are applying the beacon hint to a wiphy we know its
16327 * wiphy_idx is valid
16328 */
16329 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
16330 goto nla_put_failure;
16331
16332 /* Before */
16333 nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_BEFORE);
16334 if (!nl_freq)
16335 goto nla_put_failure;
16336
16337 if (nl80211_msg_put_channel(msg, wiphy, channel_before, false))
16338 goto nla_put_failure;
16339 nla_nest_end(msg, nl_freq);
16340
16341 /* After */
16342 nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_AFTER);
16343 if (!nl_freq)
16344 goto nla_put_failure;
16345
16346 if (nl80211_msg_put_channel(msg, wiphy, channel_after, false))
16347 goto nla_put_failure;
16348 nla_nest_end(msg, nl_freq);
16349
16350 genlmsg_end(msg, hdr);
16351
16352 rcu_read_lock();
16353 genlmsg_multicast_allns(&nl80211_fam, msg, 0,
16354 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
16355 rcu_read_unlock();
16356
16357 return;
16358
16359 nla_put_failure:
16360 nlmsg_free(msg);
16361 }
16362
nl80211_send_remain_on_chan_event(int cmd,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,unsigned int duration,gfp_t gfp)16363 static void nl80211_send_remain_on_chan_event(
16364 int cmd, struct cfg80211_registered_device *rdev,
16365 struct wireless_dev *wdev, u64 cookie,
16366 struct ieee80211_channel *chan,
16367 unsigned int duration, gfp_t gfp)
16368 {
16369 struct sk_buff *msg;
16370 void *hdr;
16371
16372 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16373 if (!msg)
16374 return;
16375
16376 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
16377 if (!hdr) {
16378 nlmsg_free(msg);
16379 return;
16380 }
16381
16382 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16383 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
16384 wdev->netdev->ifindex)) ||
16385 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16386 NL80211_ATTR_PAD) ||
16387 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
16388 nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
16389 NL80211_CHAN_NO_HT) ||
16390 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
16391 NL80211_ATTR_PAD))
16392 goto nla_put_failure;
16393
16394 if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
16395 nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
16396 goto nla_put_failure;
16397
16398 genlmsg_end(msg, hdr);
16399
16400 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16401 NL80211_MCGRP_MLME, gfp);
16402 return;
16403
16404 nla_put_failure:
16405 nlmsg_free(msg);
16406 }
16407
cfg80211_ready_on_channel(struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,unsigned int duration,gfp_t gfp)16408 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
16409 struct ieee80211_channel *chan,
16410 unsigned int duration, gfp_t gfp)
16411 {
16412 struct wiphy *wiphy = wdev->wiphy;
16413 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16414
16415 trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
16416 nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
16417 rdev, wdev, cookie, chan,
16418 duration, gfp);
16419 }
16420 EXPORT_SYMBOL(cfg80211_ready_on_channel);
16421
cfg80211_remain_on_channel_expired(struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,gfp_t gfp)16422 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
16423 struct ieee80211_channel *chan,
16424 gfp_t gfp)
16425 {
16426 struct wiphy *wiphy = wdev->wiphy;
16427 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16428
16429 trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
16430 nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
16431 rdev, wdev, cookie, chan, 0, gfp);
16432 }
16433 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
16434
cfg80211_tx_mgmt_expired(struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,gfp_t gfp)16435 void cfg80211_tx_mgmt_expired(struct wireless_dev *wdev, u64 cookie,
16436 struct ieee80211_channel *chan,
16437 gfp_t gfp)
16438 {
16439 struct wiphy *wiphy = wdev->wiphy;
16440 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16441
16442 trace_cfg80211_tx_mgmt_expired(wdev, cookie, chan);
16443 nl80211_send_remain_on_chan_event(NL80211_CMD_FRAME_WAIT_CANCEL,
16444 rdev, wdev, cookie, chan, 0, gfp);
16445 }
16446 EXPORT_SYMBOL(cfg80211_tx_mgmt_expired);
16447
cfg80211_new_sta(struct net_device * dev,const u8 * mac_addr,struct station_info * sinfo,gfp_t gfp)16448 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
16449 struct station_info *sinfo, gfp_t gfp)
16450 {
16451 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
16452 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16453 struct sk_buff *msg;
16454
16455 trace_cfg80211_new_sta(dev, mac_addr, sinfo);
16456
16457 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16458 if (!msg)
16459 return;
16460
16461 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
16462 rdev, dev, mac_addr, sinfo) < 0) {
16463 nlmsg_free(msg);
16464 return;
16465 }
16466
16467 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16468 NL80211_MCGRP_MLME, gfp);
16469 }
16470 EXPORT_SYMBOL(cfg80211_new_sta);
16471
cfg80211_del_sta_sinfo(struct net_device * dev,const u8 * mac_addr,struct station_info * sinfo,gfp_t gfp)16472 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
16473 struct station_info *sinfo, gfp_t gfp)
16474 {
16475 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
16476 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16477 struct sk_buff *msg;
16478 struct station_info empty_sinfo = {};
16479
16480 if (!sinfo)
16481 sinfo = &empty_sinfo;
16482
16483 trace_cfg80211_del_sta(dev, mac_addr);
16484
16485 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16486 if (!msg) {
16487 cfg80211_sinfo_release_content(sinfo);
16488 return;
16489 }
16490
16491 if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
16492 rdev, dev, mac_addr, sinfo) < 0) {
16493 nlmsg_free(msg);
16494 return;
16495 }
16496
16497 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16498 NL80211_MCGRP_MLME, gfp);
16499 }
16500 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
16501
cfg80211_conn_failed(struct net_device * dev,const u8 * mac_addr,enum nl80211_connect_failed_reason reason,gfp_t gfp)16502 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
16503 enum nl80211_connect_failed_reason reason,
16504 gfp_t gfp)
16505 {
16506 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
16507 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16508 struct sk_buff *msg;
16509 void *hdr;
16510
16511 msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
16512 if (!msg)
16513 return;
16514
16515 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
16516 if (!hdr) {
16517 nlmsg_free(msg);
16518 return;
16519 }
16520
16521 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16522 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
16523 nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
16524 goto nla_put_failure;
16525
16526 genlmsg_end(msg, hdr);
16527
16528 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16529 NL80211_MCGRP_MLME, gfp);
16530 return;
16531
16532 nla_put_failure:
16533 nlmsg_free(msg);
16534 }
16535 EXPORT_SYMBOL(cfg80211_conn_failed);
16536
__nl80211_unexpected_frame(struct net_device * dev,u8 cmd,const u8 * addr,gfp_t gfp)16537 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
16538 const u8 *addr, gfp_t gfp)
16539 {
16540 struct wireless_dev *wdev = dev->ieee80211_ptr;
16541 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16542 struct sk_buff *msg;
16543 void *hdr;
16544 u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid);
16545
16546 if (!nlportid)
16547 return false;
16548
16549 msg = nlmsg_new(100, gfp);
16550 if (!msg)
16551 return true;
16552
16553 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
16554 if (!hdr) {
16555 nlmsg_free(msg);
16556 return true;
16557 }
16558
16559 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16560 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16561 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
16562 goto nla_put_failure;
16563
16564 genlmsg_end(msg, hdr);
16565 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
16566 return true;
16567
16568 nla_put_failure:
16569 nlmsg_free(msg);
16570 return true;
16571 }
16572
cfg80211_rx_spurious_frame(struct net_device * dev,const u8 * addr,gfp_t gfp)16573 bool cfg80211_rx_spurious_frame(struct net_device *dev,
16574 const u8 *addr, gfp_t gfp)
16575 {
16576 struct wireless_dev *wdev = dev->ieee80211_ptr;
16577 bool ret;
16578
16579 trace_cfg80211_rx_spurious_frame(dev, addr);
16580
16581 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
16582 wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
16583 trace_cfg80211_return_bool(false);
16584 return false;
16585 }
16586 ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
16587 addr, gfp);
16588 trace_cfg80211_return_bool(ret);
16589 return ret;
16590 }
16591 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
16592
cfg80211_rx_unexpected_4addr_frame(struct net_device * dev,const u8 * addr,gfp_t gfp)16593 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
16594 const u8 *addr, gfp_t gfp)
16595 {
16596 struct wireless_dev *wdev = dev->ieee80211_ptr;
16597 bool ret;
16598
16599 trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
16600
16601 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
16602 wdev->iftype != NL80211_IFTYPE_P2P_GO &&
16603 wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
16604 trace_cfg80211_return_bool(false);
16605 return false;
16606 }
16607 ret = __nl80211_unexpected_frame(dev,
16608 NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
16609 addr, gfp);
16610 trace_cfg80211_return_bool(ret);
16611 return ret;
16612 }
16613 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
16614
nl80211_send_mgmt(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,u32 nlportid,int freq,int sig_dbm,const u8 * buf,size_t len,u32 flags,gfp_t gfp)16615 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
16616 struct wireless_dev *wdev, u32 nlportid,
16617 int freq, int sig_dbm,
16618 const u8 *buf, size_t len, u32 flags, gfp_t gfp)
16619 {
16620 struct net_device *netdev = wdev->netdev;
16621 struct sk_buff *msg;
16622 void *hdr;
16623
16624 msg = nlmsg_new(100 + len, gfp);
16625 if (!msg)
16626 return -ENOMEM;
16627
16628 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
16629 if (!hdr) {
16630 nlmsg_free(msg);
16631 return -ENOMEM;
16632 }
16633
16634 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16635 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
16636 netdev->ifindex)) ||
16637 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16638 NL80211_ATTR_PAD) ||
16639 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, KHZ_TO_MHZ(freq)) ||
16640 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, freq % 1000) ||
16641 (sig_dbm &&
16642 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
16643 nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
16644 (flags &&
16645 nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
16646 goto nla_put_failure;
16647
16648 genlmsg_end(msg, hdr);
16649
16650 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
16651
16652 nla_put_failure:
16653 nlmsg_free(msg);
16654 return -ENOBUFS;
16655 }
16656
nl80211_frame_tx_status(struct wireless_dev * wdev,u64 cookie,const u8 * buf,size_t len,bool ack,gfp_t gfp,enum nl80211_commands command)16657 static void nl80211_frame_tx_status(struct wireless_dev *wdev, u64 cookie,
16658 const u8 *buf, size_t len, bool ack,
16659 gfp_t gfp, enum nl80211_commands command)
16660 {
16661 struct wiphy *wiphy = wdev->wiphy;
16662 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16663 struct net_device *netdev = wdev->netdev;
16664 struct sk_buff *msg;
16665 void *hdr;
16666
16667 if (command == NL80211_CMD_FRAME_TX_STATUS)
16668 trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
16669 else
16670 trace_cfg80211_control_port_tx_status(wdev, cookie, ack);
16671
16672 msg = nlmsg_new(100 + len, gfp);
16673 if (!msg)
16674 return;
16675
16676 hdr = nl80211hdr_put(msg, 0, 0, 0, command);
16677 if (!hdr) {
16678 nlmsg_free(msg);
16679 return;
16680 }
16681
16682 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16683 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
16684 netdev->ifindex)) ||
16685 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16686 NL80211_ATTR_PAD) ||
16687 nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
16688 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
16689 NL80211_ATTR_PAD) ||
16690 (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
16691 goto nla_put_failure;
16692
16693 genlmsg_end(msg, hdr);
16694
16695 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16696 NL80211_MCGRP_MLME, gfp);
16697 return;
16698
16699 nla_put_failure:
16700 nlmsg_free(msg);
16701 }
16702
cfg80211_control_port_tx_status(struct wireless_dev * wdev,u64 cookie,const u8 * buf,size_t len,bool ack,gfp_t gfp)16703 void cfg80211_control_port_tx_status(struct wireless_dev *wdev, u64 cookie,
16704 const u8 *buf, size_t len, bool ack,
16705 gfp_t gfp)
16706 {
16707 nl80211_frame_tx_status(wdev, cookie, buf, len, ack, gfp,
16708 NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS);
16709 }
16710 EXPORT_SYMBOL(cfg80211_control_port_tx_status);
16711
cfg80211_mgmt_tx_status(struct wireless_dev * wdev,u64 cookie,const u8 * buf,size_t len,bool ack,gfp_t gfp)16712 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
16713 const u8 *buf, size_t len, bool ack, gfp_t gfp)
16714 {
16715 nl80211_frame_tx_status(wdev, cookie, buf, len, ack, gfp,
16716 NL80211_CMD_FRAME_TX_STATUS);
16717 }
16718 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
16719
__nl80211_rx_control_port(struct net_device * dev,struct sk_buff * skb,bool unencrypted,gfp_t gfp)16720 static int __nl80211_rx_control_port(struct net_device *dev,
16721 struct sk_buff *skb,
16722 bool unencrypted, gfp_t gfp)
16723 {
16724 struct wireless_dev *wdev = dev->ieee80211_ptr;
16725 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16726 struct ethhdr *ehdr = eth_hdr(skb);
16727 const u8 *addr = ehdr->h_source;
16728 u16 proto = be16_to_cpu(skb->protocol);
16729 struct sk_buff *msg;
16730 void *hdr;
16731 struct nlattr *frame;
16732
16733 u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid);
16734
16735 if (!nlportid)
16736 return -ENOENT;
16737
16738 msg = nlmsg_new(100 + skb->len, gfp);
16739 if (!msg)
16740 return -ENOMEM;
16741
16742 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME);
16743 if (!hdr) {
16744 nlmsg_free(msg);
16745 return -ENOBUFS;
16746 }
16747
16748 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16749 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16750 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16751 NL80211_ATTR_PAD) ||
16752 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
16753 nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
16754 (unencrypted && nla_put_flag(msg,
16755 NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
16756 goto nla_put_failure;
16757
16758 frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len);
16759 if (!frame)
16760 goto nla_put_failure;
16761
16762 skb_copy_bits(skb, 0, nla_data(frame), skb->len);
16763 genlmsg_end(msg, hdr);
16764
16765 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
16766
16767 nla_put_failure:
16768 nlmsg_free(msg);
16769 return -ENOBUFS;
16770 }
16771
cfg80211_rx_control_port(struct net_device * dev,struct sk_buff * skb,bool unencrypted)16772 bool cfg80211_rx_control_port(struct net_device *dev,
16773 struct sk_buff *skb, bool unencrypted)
16774 {
16775 int ret;
16776
16777 trace_cfg80211_rx_control_port(dev, skb, unencrypted);
16778 ret = __nl80211_rx_control_port(dev, skb, unencrypted, GFP_ATOMIC);
16779 trace_cfg80211_return_bool(ret == 0);
16780 return ret == 0;
16781 }
16782 EXPORT_SYMBOL(cfg80211_rx_control_port);
16783
cfg80211_prepare_cqm(struct net_device * dev,const char * mac,gfp_t gfp)16784 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
16785 const char *mac, gfp_t gfp)
16786 {
16787 struct wireless_dev *wdev = dev->ieee80211_ptr;
16788 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16789 struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16790 void **cb;
16791
16792 if (!msg)
16793 return NULL;
16794
16795 cb = (void **)msg->cb;
16796
16797 cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
16798 if (!cb[0]) {
16799 nlmsg_free(msg);
16800 return NULL;
16801 }
16802
16803 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16804 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
16805 goto nla_put_failure;
16806
16807 if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
16808 goto nla_put_failure;
16809
16810 cb[1] = nla_nest_start_noflag(msg, NL80211_ATTR_CQM);
16811 if (!cb[1])
16812 goto nla_put_failure;
16813
16814 cb[2] = rdev;
16815
16816 return msg;
16817 nla_put_failure:
16818 nlmsg_free(msg);
16819 return NULL;
16820 }
16821
cfg80211_send_cqm(struct sk_buff * msg,gfp_t gfp)16822 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
16823 {
16824 void **cb = (void **)msg->cb;
16825 struct cfg80211_registered_device *rdev = cb[2];
16826
16827 nla_nest_end(msg, cb[1]);
16828 genlmsg_end(msg, cb[0]);
16829
16830 memset(msg->cb, 0, sizeof(msg->cb));
16831
16832 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16833 NL80211_MCGRP_MLME, gfp);
16834 }
16835
cfg80211_cqm_rssi_notify(struct net_device * dev,enum nl80211_cqm_rssi_threshold_event rssi_event,s32 rssi_level,gfp_t gfp)16836 void cfg80211_cqm_rssi_notify(struct net_device *dev,
16837 enum nl80211_cqm_rssi_threshold_event rssi_event,
16838 s32 rssi_level, gfp_t gfp)
16839 {
16840 struct sk_buff *msg;
16841 struct wireless_dev *wdev = dev->ieee80211_ptr;
16842 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16843
16844 trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
16845
16846 if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
16847 rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
16848 return;
16849
16850 if (wdev->cqm_config) {
16851 wdev->cqm_config->last_rssi_event_value = rssi_level;
16852
16853 cfg80211_cqm_rssi_update(rdev, dev);
16854
16855 if (rssi_level == 0)
16856 rssi_level = wdev->cqm_config->last_rssi_event_value;
16857 }
16858
16859 msg = cfg80211_prepare_cqm(dev, NULL, gfp);
16860 if (!msg)
16861 return;
16862
16863 if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
16864 rssi_event))
16865 goto nla_put_failure;
16866
16867 if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
16868 rssi_level))
16869 goto nla_put_failure;
16870
16871 cfg80211_send_cqm(msg, gfp);
16872
16873 return;
16874
16875 nla_put_failure:
16876 nlmsg_free(msg);
16877 }
16878 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
16879
cfg80211_cqm_txe_notify(struct net_device * dev,const u8 * peer,u32 num_packets,u32 rate,u32 intvl,gfp_t gfp)16880 void cfg80211_cqm_txe_notify(struct net_device *dev,
16881 const u8 *peer, u32 num_packets,
16882 u32 rate, u32 intvl, gfp_t gfp)
16883 {
16884 struct sk_buff *msg;
16885
16886 msg = cfg80211_prepare_cqm(dev, peer, gfp);
16887 if (!msg)
16888 return;
16889
16890 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
16891 goto nla_put_failure;
16892
16893 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
16894 goto nla_put_failure;
16895
16896 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
16897 goto nla_put_failure;
16898
16899 cfg80211_send_cqm(msg, gfp);
16900 return;
16901
16902 nla_put_failure:
16903 nlmsg_free(msg);
16904 }
16905 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
16906
cfg80211_cqm_pktloss_notify(struct net_device * dev,const u8 * peer,u32 num_packets,gfp_t gfp)16907 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
16908 const u8 *peer, u32 num_packets, gfp_t gfp)
16909 {
16910 struct sk_buff *msg;
16911
16912 trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
16913
16914 msg = cfg80211_prepare_cqm(dev, peer, gfp);
16915 if (!msg)
16916 return;
16917
16918 if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
16919 goto nla_put_failure;
16920
16921 cfg80211_send_cqm(msg, gfp);
16922 return;
16923
16924 nla_put_failure:
16925 nlmsg_free(msg);
16926 }
16927 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
16928
cfg80211_cqm_beacon_loss_notify(struct net_device * dev,gfp_t gfp)16929 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
16930 {
16931 struct sk_buff *msg;
16932
16933 msg = cfg80211_prepare_cqm(dev, NULL, gfp);
16934 if (!msg)
16935 return;
16936
16937 if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
16938 goto nla_put_failure;
16939
16940 cfg80211_send_cqm(msg, gfp);
16941 return;
16942
16943 nla_put_failure:
16944 nlmsg_free(msg);
16945 }
16946 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
16947
nl80211_gtk_rekey_notify(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * bssid,const u8 * replay_ctr,gfp_t gfp)16948 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
16949 struct net_device *netdev, const u8 *bssid,
16950 const u8 *replay_ctr, gfp_t gfp)
16951 {
16952 struct sk_buff *msg;
16953 struct nlattr *rekey_attr;
16954 void *hdr;
16955
16956 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16957 if (!msg)
16958 return;
16959
16960 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
16961 if (!hdr) {
16962 nlmsg_free(msg);
16963 return;
16964 }
16965
16966 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16967 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16968 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
16969 goto nla_put_failure;
16970
16971 rekey_attr = nla_nest_start_noflag(msg, NL80211_ATTR_REKEY_DATA);
16972 if (!rekey_attr)
16973 goto nla_put_failure;
16974
16975 if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
16976 NL80211_REPLAY_CTR_LEN, replay_ctr))
16977 goto nla_put_failure;
16978
16979 nla_nest_end(msg, rekey_attr);
16980
16981 genlmsg_end(msg, hdr);
16982
16983 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16984 NL80211_MCGRP_MLME, gfp);
16985 return;
16986
16987 nla_put_failure:
16988 nlmsg_free(msg);
16989 }
16990
cfg80211_gtk_rekey_notify(struct net_device * dev,const u8 * bssid,const u8 * replay_ctr,gfp_t gfp)16991 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
16992 const u8 *replay_ctr, gfp_t gfp)
16993 {
16994 struct wireless_dev *wdev = dev->ieee80211_ptr;
16995 struct wiphy *wiphy = wdev->wiphy;
16996 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16997
16998 trace_cfg80211_gtk_rekey_notify(dev, bssid);
16999 nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
17000 }
17001 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
17002
17003 static void
nl80211_pmksa_candidate_notify(struct cfg80211_registered_device * rdev,struct net_device * netdev,int index,const u8 * bssid,bool preauth,gfp_t gfp)17004 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
17005 struct net_device *netdev, int index,
17006 const u8 *bssid, bool preauth, gfp_t gfp)
17007 {
17008 struct sk_buff *msg;
17009 struct nlattr *attr;
17010 void *hdr;
17011
17012 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17013 if (!msg)
17014 return;
17015
17016 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
17017 if (!hdr) {
17018 nlmsg_free(msg);
17019 return;
17020 }
17021
17022 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17023 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
17024 goto nla_put_failure;
17025
17026 attr = nla_nest_start_noflag(msg, NL80211_ATTR_PMKSA_CANDIDATE);
17027 if (!attr)
17028 goto nla_put_failure;
17029
17030 if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
17031 nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
17032 (preauth &&
17033 nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
17034 goto nla_put_failure;
17035
17036 nla_nest_end(msg, attr);
17037
17038 genlmsg_end(msg, hdr);
17039
17040 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17041 NL80211_MCGRP_MLME, gfp);
17042 return;
17043
17044 nla_put_failure:
17045 nlmsg_free(msg);
17046 }
17047
cfg80211_pmksa_candidate_notify(struct net_device * dev,int index,const u8 * bssid,bool preauth,gfp_t gfp)17048 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
17049 const u8 *bssid, bool preauth, gfp_t gfp)
17050 {
17051 struct wireless_dev *wdev = dev->ieee80211_ptr;
17052 struct wiphy *wiphy = wdev->wiphy;
17053 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17054
17055 trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
17056 nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
17057 }
17058 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
17059
nl80211_ch_switch_notify(struct cfg80211_registered_device * rdev,struct net_device * netdev,struct cfg80211_chan_def * chandef,gfp_t gfp,enum nl80211_commands notif,u8 count)17060 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
17061 struct net_device *netdev,
17062 struct cfg80211_chan_def *chandef,
17063 gfp_t gfp,
17064 enum nl80211_commands notif,
17065 u8 count)
17066 {
17067 struct sk_buff *msg;
17068 void *hdr;
17069
17070 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17071 if (!msg)
17072 return;
17073
17074 hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
17075 if (!hdr) {
17076 nlmsg_free(msg);
17077 return;
17078 }
17079
17080 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
17081 goto nla_put_failure;
17082
17083 if (nl80211_send_chandef(msg, chandef))
17084 goto nla_put_failure;
17085
17086 if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) &&
17087 (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)))
17088 goto nla_put_failure;
17089
17090 genlmsg_end(msg, hdr);
17091
17092 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17093 NL80211_MCGRP_MLME, gfp);
17094 return;
17095
17096 nla_put_failure:
17097 nlmsg_free(msg);
17098 }
17099
cfg80211_ch_switch_notify(struct net_device * dev,struct cfg80211_chan_def * chandef)17100 void cfg80211_ch_switch_notify(struct net_device *dev,
17101 struct cfg80211_chan_def *chandef)
17102 {
17103 struct wireless_dev *wdev = dev->ieee80211_ptr;
17104 struct wiphy *wiphy = wdev->wiphy;
17105 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17106
17107 ASSERT_WDEV_LOCK(wdev);
17108
17109 trace_cfg80211_ch_switch_notify(dev, chandef);
17110
17111 wdev->chandef = *chandef;
17112 wdev->preset_chandef = *chandef;
17113
17114 if (wdev->iftype == NL80211_IFTYPE_STATION &&
17115 !WARN_ON(!wdev->current_bss))
17116 cfg80211_update_assoc_bss_entry(wdev, chandef->chan);
17117
17118 cfg80211_sched_dfs_chan_update(rdev);
17119
17120 nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
17121 NL80211_CMD_CH_SWITCH_NOTIFY, 0);
17122 }
17123 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
17124
cfg80211_ch_switch_started_notify(struct net_device * dev,struct cfg80211_chan_def * chandef,u8 count)17125 void cfg80211_ch_switch_started_notify(struct net_device *dev,
17126 struct cfg80211_chan_def *chandef,
17127 u8 count)
17128 {
17129 struct wireless_dev *wdev = dev->ieee80211_ptr;
17130 struct wiphy *wiphy = wdev->wiphy;
17131 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17132
17133 trace_cfg80211_ch_switch_started_notify(dev, chandef);
17134
17135 nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
17136 NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count);
17137 }
17138 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
17139
17140 void
nl80211_radar_notify(struct cfg80211_registered_device * rdev,const struct cfg80211_chan_def * chandef,enum nl80211_radar_event event,struct net_device * netdev,gfp_t gfp)17141 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
17142 const struct cfg80211_chan_def *chandef,
17143 enum nl80211_radar_event event,
17144 struct net_device *netdev, gfp_t gfp)
17145 {
17146 struct sk_buff *msg;
17147 void *hdr;
17148
17149 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17150 if (!msg)
17151 return;
17152
17153 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
17154 if (!hdr) {
17155 nlmsg_free(msg);
17156 return;
17157 }
17158
17159 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
17160 goto nla_put_failure;
17161
17162 /* NOP and radar events don't need a netdev parameter */
17163 if (netdev) {
17164 struct wireless_dev *wdev = netdev->ieee80211_ptr;
17165
17166 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17167 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17168 NL80211_ATTR_PAD))
17169 goto nla_put_failure;
17170 }
17171
17172 if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
17173 goto nla_put_failure;
17174
17175 if (nl80211_send_chandef(msg, chandef))
17176 goto nla_put_failure;
17177
17178 genlmsg_end(msg, hdr);
17179
17180 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17181 NL80211_MCGRP_MLME, gfp);
17182 return;
17183
17184 nla_put_failure:
17185 nlmsg_free(msg);
17186 }
17187
cfg80211_sta_opmode_change_notify(struct net_device * dev,const u8 * mac,struct sta_opmode_info * sta_opmode,gfp_t gfp)17188 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
17189 struct sta_opmode_info *sta_opmode,
17190 gfp_t gfp)
17191 {
17192 struct sk_buff *msg;
17193 struct wireless_dev *wdev = dev->ieee80211_ptr;
17194 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17195 void *hdr;
17196
17197 if (WARN_ON(!mac))
17198 return;
17199
17200 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17201 if (!msg)
17202 return;
17203
17204 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED);
17205 if (!hdr) {
17206 nlmsg_free(msg);
17207 return;
17208 }
17209
17210 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
17211 goto nla_put_failure;
17212
17213 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
17214 goto nla_put_failure;
17215
17216 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
17217 goto nla_put_failure;
17218
17219 if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) &&
17220 nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode))
17221 goto nla_put_failure;
17222
17223 if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
17224 nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
17225 goto nla_put_failure;
17226
17227 if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
17228 nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss))
17229 goto nla_put_failure;
17230
17231 genlmsg_end(msg, hdr);
17232
17233 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17234 NL80211_MCGRP_MLME, gfp);
17235
17236 return;
17237
17238 nla_put_failure:
17239 nlmsg_free(msg);
17240 }
17241 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify);
17242
cfg80211_probe_status(struct net_device * dev,const u8 * addr,u64 cookie,bool acked,s32 ack_signal,bool is_valid_ack_signal,gfp_t gfp)17243 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
17244 u64 cookie, bool acked, s32 ack_signal,
17245 bool is_valid_ack_signal, gfp_t gfp)
17246 {
17247 struct wireless_dev *wdev = dev->ieee80211_ptr;
17248 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17249 struct sk_buff *msg;
17250 void *hdr;
17251
17252 trace_cfg80211_probe_status(dev, addr, cookie, acked);
17253
17254 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17255
17256 if (!msg)
17257 return;
17258
17259 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
17260 if (!hdr) {
17261 nlmsg_free(msg);
17262 return;
17263 }
17264
17265 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17266 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
17267 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
17268 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
17269 NL80211_ATTR_PAD) ||
17270 (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
17271 (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL,
17272 ack_signal)))
17273 goto nla_put_failure;
17274
17275 genlmsg_end(msg, hdr);
17276
17277 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17278 NL80211_MCGRP_MLME, gfp);
17279 return;
17280
17281 nla_put_failure:
17282 nlmsg_free(msg);
17283 }
17284 EXPORT_SYMBOL(cfg80211_probe_status);
17285
cfg80211_report_obss_beacon_khz(struct wiphy * wiphy,const u8 * frame,size_t len,int freq,int sig_dbm)17286 void cfg80211_report_obss_beacon_khz(struct wiphy *wiphy, const u8 *frame,
17287 size_t len, int freq, int sig_dbm)
17288 {
17289 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17290 struct sk_buff *msg;
17291 void *hdr;
17292 struct cfg80211_beacon_registration *reg;
17293
17294 trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
17295
17296 spin_lock_bh(&rdev->beacon_registrations_lock);
17297 list_for_each_entry(reg, &rdev->beacon_registrations, list) {
17298 msg = nlmsg_new(len + 100, GFP_ATOMIC);
17299 if (!msg) {
17300 spin_unlock_bh(&rdev->beacon_registrations_lock);
17301 return;
17302 }
17303
17304 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
17305 if (!hdr)
17306 goto nla_put_failure;
17307
17308 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17309 (freq &&
17310 (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
17311 KHZ_TO_MHZ(freq)) ||
17312 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
17313 freq % 1000))) ||
17314 (sig_dbm &&
17315 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
17316 nla_put(msg, NL80211_ATTR_FRAME, len, frame))
17317 goto nla_put_failure;
17318
17319 genlmsg_end(msg, hdr);
17320
17321 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
17322 }
17323 spin_unlock_bh(&rdev->beacon_registrations_lock);
17324 return;
17325
17326 nla_put_failure:
17327 spin_unlock_bh(&rdev->beacon_registrations_lock);
17328 nlmsg_free(msg);
17329 }
17330 EXPORT_SYMBOL(cfg80211_report_obss_beacon_khz);
17331
17332 #ifdef CONFIG_PM
cfg80211_net_detect_results(struct sk_buff * msg,struct cfg80211_wowlan_wakeup * wakeup)17333 static int cfg80211_net_detect_results(struct sk_buff *msg,
17334 struct cfg80211_wowlan_wakeup *wakeup)
17335 {
17336 struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
17337 struct nlattr *nl_results, *nl_match, *nl_freqs;
17338 int i, j;
17339
17340 nl_results = nla_nest_start_noflag(msg,
17341 NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
17342 if (!nl_results)
17343 return -EMSGSIZE;
17344
17345 for (i = 0; i < nd->n_matches; i++) {
17346 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
17347
17348 nl_match = nla_nest_start_noflag(msg, i);
17349 if (!nl_match)
17350 break;
17351
17352 /* The SSID attribute is optional in nl80211, but for
17353 * simplicity reasons it's always present in the
17354 * cfg80211 structure. If a driver can't pass the
17355 * SSID, that needs to be changed. A zero length SSID
17356 * is still a valid SSID (wildcard), so it cannot be
17357 * used for this purpose.
17358 */
17359 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
17360 match->ssid.ssid)) {
17361 nla_nest_cancel(msg, nl_match);
17362 goto out;
17363 }
17364
17365 if (match->n_channels) {
17366 nl_freqs = nla_nest_start_noflag(msg,
17367 NL80211_ATTR_SCAN_FREQUENCIES);
17368 if (!nl_freqs) {
17369 nla_nest_cancel(msg, nl_match);
17370 goto out;
17371 }
17372
17373 for (j = 0; j < match->n_channels; j++) {
17374 if (nla_put_u32(msg, j, match->channels[j])) {
17375 nla_nest_cancel(msg, nl_freqs);
17376 nla_nest_cancel(msg, nl_match);
17377 goto out;
17378 }
17379 }
17380
17381 nla_nest_end(msg, nl_freqs);
17382 }
17383
17384 nla_nest_end(msg, nl_match);
17385 }
17386
17387 out:
17388 nla_nest_end(msg, nl_results);
17389 return 0;
17390 }
17391
cfg80211_report_wowlan_wakeup(struct wireless_dev * wdev,struct cfg80211_wowlan_wakeup * wakeup,gfp_t gfp)17392 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
17393 struct cfg80211_wowlan_wakeup *wakeup,
17394 gfp_t gfp)
17395 {
17396 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17397 struct sk_buff *msg;
17398 void *hdr;
17399 int size = 200;
17400
17401 trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
17402
17403 if (wakeup)
17404 size += wakeup->packet_present_len;
17405
17406 msg = nlmsg_new(size, gfp);
17407 if (!msg)
17408 return;
17409
17410 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
17411 if (!hdr)
17412 goto free_msg;
17413
17414 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17415 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17416 NL80211_ATTR_PAD))
17417 goto free_msg;
17418
17419 if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
17420 wdev->netdev->ifindex))
17421 goto free_msg;
17422
17423 if (wakeup) {
17424 struct nlattr *reasons;
17425
17426 reasons = nla_nest_start_noflag(msg,
17427 NL80211_ATTR_WOWLAN_TRIGGERS);
17428 if (!reasons)
17429 goto free_msg;
17430
17431 if (wakeup->disconnect &&
17432 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
17433 goto free_msg;
17434 if (wakeup->magic_pkt &&
17435 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
17436 goto free_msg;
17437 if (wakeup->gtk_rekey_failure &&
17438 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
17439 goto free_msg;
17440 if (wakeup->eap_identity_req &&
17441 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
17442 goto free_msg;
17443 if (wakeup->four_way_handshake &&
17444 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
17445 goto free_msg;
17446 if (wakeup->rfkill_release &&
17447 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
17448 goto free_msg;
17449
17450 if (wakeup->pattern_idx >= 0 &&
17451 nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
17452 wakeup->pattern_idx))
17453 goto free_msg;
17454
17455 if (wakeup->tcp_match &&
17456 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
17457 goto free_msg;
17458
17459 if (wakeup->tcp_connlost &&
17460 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
17461 goto free_msg;
17462
17463 if (wakeup->tcp_nomoretokens &&
17464 nla_put_flag(msg,
17465 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
17466 goto free_msg;
17467
17468 if (wakeup->packet) {
17469 u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
17470 u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
17471
17472 if (!wakeup->packet_80211) {
17473 pkt_attr =
17474 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
17475 len_attr =
17476 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
17477 }
17478
17479 if (wakeup->packet_len &&
17480 nla_put_u32(msg, len_attr, wakeup->packet_len))
17481 goto free_msg;
17482
17483 if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
17484 wakeup->packet))
17485 goto free_msg;
17486 }
17487
17488 if (wakeup->net_detect &&
17489 cfg80211_net_detect_results(msg, wakeup))
17490 goto free_msg;
17491
17492 nla_nest_end(msg, reasons);
17493 }
17494
17495 genlmsg_end(msg, hdr);
17496
17497 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17498 NL80211_MCGRP_MLME, gfp);
17499 return;
17500
17501 free_msg:
17502 nlmsg_free(msg);
17503 }
17504 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
17505 #endif
17506
cfg80211_tdls_oper_request(struct net_device * dev,const u8 * peer,enum nl80211_tdls_operation oper,u16 reason_code,gfp_t gfp)17507 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
17508 enum nl80211_tdls_operation oper,
17509 u16 reason_code, gfp_t gfp)
17510 {
17511 struct wireless_dev *wdev = dev->ieee80211_ptr;
17512 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17513 struct sk_buff *msg;
17514 void *hdr;
17515
17516 trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
17517 reason_code);
17518
17519 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17520 if (!msg)
17521 return;
17522
17523 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
17524 if (!hdr) {
17525 nlmsg_free(msg);
17526 return;
17527 }
17528
17529 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17530 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
17531 nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
17532 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
17533 (reason_code > 0 &&
17534 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
17535 goto nla_put_failure;
17536
17537 genlmsg_end(msg, hdr);
17538
17539 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17540 NL80211_MCGRP_MLME, gfp);
17541 return;
17542
17543 nla_put_failure:
17544 nlmsg_free(msg);
17545 }
17546 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
17547
nl80211_netlink_notify(struct notifier_block * nb,unsigned long state,void * _notify)17548 static int nl80211_netlink_notify(struct notifier_block * nb,
17549 unsigned long state,
17550 void *_notify)
17551 {
17552 struct netlink_notify *notify = _notify;
17553 struct cfg80211_registered_device *rdev;
17554 struct wireless_dev *wdev;
17555 struct cfg80211_beacon_registration *reg, *tmp;
17556
17557 if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
17558 return NOTIFY_DONE;
17559
17560 rcu_read_lock();
17561
17562 list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
17563 struct cfg80211_sched_scan_request *sched_scan_req;
17564
17565 list_for_each_entry_rcu(sched_scan_req,
17566 &rdev->sched_scan_req_list,
17567 list) {
17568 if (sched_scan_req->owner_nlportid == notify->portid) {
17569 sched_scan_req->nl_owner_dead = true;
17570 schedule_work(&rdev->sched_scan_stop_wk);
17571 }
17572 }
17573
17574 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
17575 cfg80211_mlme_unregister_socket(wdev, notify->portid);
17576
17577 if (wdev->owner_nlportid == notify->portid) {
17578 wdev->nl_owner_dead = true;
17579 schedule_work(&rdev->destroy_work);
17580 } else if (wdev->conn_owner_nlportid == notify->portid) {
17581 schedule_work(&wdev->disconnect_wk);
17582 }
17583
17584 cfg80211_release_pmsr(wdev, notify->portid);
17585 }
17586
17587 spin_lock_bh(&rdev->beacon_registrations_lock);
17588 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
17589 list) {
17590 if (reg->nlportid == notify->portid) {
17591 list_del(®->list);
17592 kfree(reg);
17593 break;
17594 }
17595 }
17596 spin_unlock_bh(&rdev->beacon_registrations_lock);
17597 }
17598
17599 rcu_read_unlock();
17600
17601 /*
17602 * It is possible that the user space process that is controlling the
17603 * indoor setting disappeared, so notify the regulatory core.
17604 */
17605 regulatory_netlink_notify(notify->portid);
17606 return NOTIFY_OK;
17607 }
17608
17609 static struct notifier_block nl80211_netlink_notifier = {
17610 .notifier_call = nl80211_netlink_notify,
17611 };
17612
cfg80211_ft_event(struct net_device * netdev,struct cfg80211_ft_event_params * ft_event)17613 void cfg80211_ft_event(struct net_device *netdev,
17614 struct cfg80211_ft_event_params *ft_event)
17615 {
17616 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
17617 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17618 struct sk_buff *msg;
17619 void *hdr;
17620
17621 trace_cfg80211_ft_event(wiphy, netdev, ft_event);
17622
17623 if (!ft_event->target_ap)
17624 return;
17625
17626 msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
17627 GFP_KERNEL);
17628 if (!msg)
17629 return;
17630
17631 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
17632 if (!hdr)
17633 goto out;
17634
17635 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17636 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17637 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
17638 goto out;
17639
17640 if (ft_event->ies &&
17641 nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
17642 goto out;
17643 if (ft_event->ric_ies &&
17644 nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
17645 ft_event->ric_ies))
17646 goto out;
17647
17648 genlmsg_end(msg, hdr);
17649
17650 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17651 NL80211_MCGRP_MLME, GFP_KERNEL);
17652 return;
17653 out:
17654 nlmsg_free(msg);
17655 }
17656 EXPORT_SYMBOL(cfg80211_ft_event);
17657
cfg80211_crit_proto_stopped(struct wireless_dev * wdev,gfp_t gfp)17658 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
17659 {
17660 struct cfg80211_registered_device *rdev;
17661 struct sk_buff *msg;
17662 void *hdr;
17663 u32 nlportid;
17664
17665 rdev = wiphy_to_rdev(wdev->wiphy);
17666 if (!rdev->crit_proto_nlportid)
17667 return;
17668
17669 nlportid = rdev->crit_proto_nlportid;
17670 rdev->crit_proto_nlportid = 0;
17671
17672 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17673 if (!msg)
17674 return;
17675
17676 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
17677 if (!hdr)
17678 goto nla_put_failure;
17679
17680 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17681 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17682 NL80211_ATTR_PAD))
17683 goto nla_put_failure;
17684
17685 genlmsg_end(msg, hdr);
17686
17687 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
17688 return;
17689
17690 nla_put_failure:
17691 nlmsg_free(msg);
17692 }
17693 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
17694
nl80211_send_ap_stopped(struct wireless_dev * wdev)17695 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
17696 {
17697 struct wiphy *wiphy = wdev->wiphy;
17698 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17699 struct sk_buff *msg;
17700 void *hdr;
17701
17702 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17703 if (!msg)
17704 return;
17705
17706 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
17707 if (!hdr)
17708 goto out;
17709
17710 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17711 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
17712 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17713 NL80211_ATTR_PAD))
17714 goto out;
17715
17716 genlmsg_end(msg, hdr);
17717
17718 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
17719 NL80211_MCGRP_MLME, GFP_KERNEL);
17720 return;
17721 out:
17722 nlmsg_free(msg);
17723 }
17724
cfg80211_external_auth_request(struct net_device * dev,struct cfg80211_external_auth_params * params,gfp_t gfp)17725 int cfg80211_external_auth_request(struct net_device *dev,
17726 struct cfg80211_external_auth_params *params,
17727 gfp_t gfp)
17728 {
17729 struct wireless_dev *wdev = dev->ieee80211_ptr;
17730 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17731 struct sk_buff *msg;
17732 void *hdr;
17733
17734 if (!wdev->conn_owner_nlportid)
17735 return -EINVAL;
17736
17737 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17738 if (!msg)
17739 return -ENOMEM;
17740
17741 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH);
17742 if (!hdr)
17743 goto nla_put_failure;
17744
17745 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17746 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
17747 nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, params->key_mgmt_suite) ||
17748 nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION,
17749 params->action) ||
17750 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) ||
17751 nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len,
17752 params->ssid.ssid))
17753 goto nla_put_failure;
17754
17755 genlmsg_end(msg, hdr);
17756 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
17757 wdev->conn_owner_nlportid);
17758 return 0;
17759
17760 nla_put_failure:
17761 nlmsg_free(msg);
17762 return -ENOBUFS;
17763 }
17764 EXPORT_SYMBOL(cfg80211_external_auth_request);
17765
cfg80211_update_owe_info_event(struct net_device * netdev,struct cfg80211_update_owe_info * owe_info,gfp_t gfp)17766 void cfg80211_update_owe_info_event(struct net_device *netdev,
17767 struct cfg80211_update_owe_info *owe_info,
17768 gfp_t gfp)
17769 {
17770 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
17771 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17772 struct sk_buff *msg;
17773 void *hdr;
17774
17775 trace_cfg80211_update_owe_info_event(wiphy, netdev, owe_info);
17776
17777 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17778 if (!msg)
17779 return;
17780
17781 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_UPDATE_OWE_INFO);
17782 if (!hdr)
17783 goto nla_put_failure;
17784
17785 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17786 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17787 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, owe_info->peer))
17788 goto nla_put_failure;
17789
17790 if (!owe_info->ie_len ||
17791 nla_put(msg, NL80211_ATTR_IE, owe_info->ie_len, owe_info->ie))
17792 goto nla_put_failure;
17793
17794 genlmsg_end(msg, hdr);
17795
17796 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17797 NL80211_MCGRP_MLME, gfp);
17798 return;
17799
17800 nla_put_failure:
17801 genlmsg_cancel(msg, hdr);
17802 nlmsg_free(msg);
17803 }
17804 EXPORT_SYMBOL(cfg80211_update_owe_info_event);
17805
17806 /* initialisation/exit functions */
17807
nl80211_init(void)17808 int __init nl80211_init(void)
17809 {
17810 int err;
17811
17812 err = genl_register_family(&nl80211_fam);
17813 if (err)
17814 return err;
17815
17816 err = netlink_register_notifier(&nl80211_netlink_notifier);
17817 if (err)
17818 goto err_out;
17819
17820 return 0;
17821 err_out:
17822 genl_unregister_family(&nl80211_fam);
17823 return err;
17824 }
17825
nl80211_exit(void)17826 void nl80211_exit(void)
17827 {
17828 netlink_unregister_notifier(&nl80211_netlink_notifier);
17829 genl_unregister_family(&nl80211_fam);
17830 }
17831
