1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * This is the new netlink-based wireless configuration interface.
4 *
5 * Copyright 2006-2010 Johannes Berg <johannes@sipsolutions.net>
6 * Copyright 2013-2014 Intel Mobile Communications GmbH
7 * Copyright 2015-2017 Intel Deutschland GmbH
8 * Copyright (C) 2018-2023 Intel Corporation
9 */
10
11 #include <linux/if.h>
12 #include <linux/module.h>
13 #include <linux/err.h>
14 #include <linux/slab.h>
15 #include <linux/list.h>
16 #include <linux/if_ether.h>
17 #include <linux/ieee80211.h>
18 #include <linux/nl80211.h>
19 #include <linux/rtnetlink.h>
20 #include <linux/netlink.h>
21 #include <linux/nospec.h>
22 #include <linux/etherdevice.h>
23 #include <linux/if_vlan.h>
24 #include <net/net_namespace.h>
25 #include <net/genetlink.h>
26 #include <net/cfg80211.h>
27 #include <net/sock.h>
28 #include <net/inet_connection_sock.h>
29 #include "core.h"
30 #include "nl80211.h"
31 #include "reg.h"
32 #include "rdev-ops.h"
33
34 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
35 struct genl_info *info,
36 struct cfg80211_crypto_settings *settings,
37 int cipher_limit);
38
39 /* the netlink family */
40 static struct genl_family nl80211_fam;
41
42 /* multicast groups */
43 enum nl80211_multicast_groups {
44 NL80211_MCGRP_CONFIG,
45 NL80211_MCGRP_SCAN,
46 NL80211_MCGRP_REGULATORY,
47 NL80211_MCGRP_MLME,
48 NL80211_MCGRP_VENDOR,
49 NL80211_MCGRP_NAN,
50 NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
51 };
52
53 static const struct genl_multicast_group nl80211_mcgrps[] = {
54 [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
55 [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
56 [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
57 [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
58 [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
59 [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
60 #ifdef CONFIG_NL80211_TESTMODE
61 [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
62 #endif
63 };
64
65 /* returns ERR_PTR values */
66 static struct wireless_dev *
__cfg80211_wdev_from_attrs(struct cfg80211_registered_device * rdev,struct net * netns,struct nlattr ** attrs)67 __cfg80211_wdev_from_attrs(struct cfg80211_registered_device *rdev,
68 struct net *netns, struct nlattr **attrs)
69 {
70 struct wireless_dev *result = NULL;
71 bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
72 bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
73 u64 wdev_id = 0;
74 int wiphy_idx = -1;
75 int ifidx = -1;
76
77 if (!have_ifidx && !have_wdev_id)
78 return ERR_PTR(-EINVAL);
79
80 if (have_ifidx)
81 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
82 if (have_wdev_id) {
83 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
84 wiphy_idx = wdev_id >> 32;
85 }
86
87 if (rdev) {
88 struct wireless_dev *wdev;
89
90 lockdep_assert_held(&rdev->wiphy.mtx);
91
92 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
93 if (have_ifidx && wdev->netdev &&
94 wdev->netdev->ifindex == ifidx) {
95 result = wdev;
96 break;
97 }
98 if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
99 result = wdev;
100 break;
101 }
102 }
103
104 return result ?: ERR_PTR(-ENODEV);
105 }
106
107 ASSERT_RTNL();
108
109 list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
110 struct wireless_dev *wdev;
111
112 if (wiphy_net(&rdev->wiphy) != netns)
113 continue;
114
115 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
116 continue;
117
118 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
119 if (have_ifidx && wdev->netdev &&
120 wdev->netdev->ifindex == ifidx) {
121 result = wdev;
122 break;
123 }
124 if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
125 result = wdev;
126 break;
127 }
128 }
129
130 if (result)
131 break;
132 }
133
134 if (result)
135 return result;
136 return ERR_PTR(-ENODEV);
137 }
138
139 static struct cfg80211_registered_device *
__cfg80211_rdev_from_attrs(struct net * netns,struct nlattr ** attrs)140 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
141 {
142 struct cfg80211_registered_device *rdev = NULL, *tmp;
143 struct net_device *netdev;
144
145 ASSERT_RTNL();
146
147 if (!attrs[NL80211_ATTR_WIPHY] &&
148 !attrs[NL80211_ATTR_IFINDEX] &&
149 !attrs[NL80211_ATTR_WDEV])
150 return ERR_PTR(-EINVAL);
151
152 if (attrs[NL80211_ATTR_WIPHY])
153 rdev = cfg80211_rdev_by_wiphy_idx(
154 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
155
156 if (attrs[NL80211_ATTR_WDEV]) {
157 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
158 struct wireless_dev *wdev;
159 bool found = false;
160
161 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
162 if (tmp) {
163 /* make sure wdev exists */
164 list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
165 if (wdev->identifier != (u32)wdev_id)
166 continue;
167 found = true;
168 break;
169 }
170
171 if (!found)
172 tmp = NULL;
173
174 if (rdev && tmp != rdev)
175 return ERR_PTR(-EINVAL);
176 rdev = tmp;
177 }
178 }
179
180 if (attrs[NL80211_ATTR_IFINDEX]) {
181 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
182
183 netdev = __dev_get_by_index(netns, ifindex);
184 if (netdev) {
185 if (netdev->ieee80211_ptr)
186 tmp = wiphy_to_rdev(
187 netdev->ieee80211_ptr->wiphy);
188 else
189 tmp = NULL;
190
191 /* not wireless device -- return error */
192 if (!tmp)
193 return ERR_PTR(-EINVAL);
194
195 /* mismatch -- return error */
196 if (rdev && tmp != rdev)
197 return ERR_PTR(-EINVAL);
198
199 rdev = tmp;
200 }
201 }
202
203 if (!rdev)
204 return ERR_PTR(-ENODEV);
205
206 if (netns != wiphy_net(&rdev->wiphy))
207 return ERR_PTR(-ENODEV);
208
209 return rdev;
210 }
211
212 /*
213 * This function returns a pointer to the driver
214 * that the genl_info item that is passed refers to.
215 *
216 * The result of this can be a PTR_ERR and hence must
217 * be checked with IS_ERR() for errors.
218 */
219 static struct cfg80211_registered_device *
cfg80211_get_dev_from_info(struct net * netns,struct genl_info * info)220 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
221 {
222 return __cfg80211_rdev_from_attrs(netns, info->attrs);
223 }
224
validate_beacon_head(const struct nlattr * attr,struct netlink_ext_ack * extack)225 static int validate_beacon_head(const struct nlattr *attr,
226 struct netlink_ext_ack *extack)
227 {
228 const u8 *data = nla_data(attr);
229 unsigned int len = nla_len(attr);
230 const struct element *elem;
231 const struct ieee80211_mgmt *mgmt = (void *)data;
232 unsigned int fixedlen, hdrlen;
233 bool s1g_bcn;
234
235 if (len < offsetofend(typeof(*mgmt), frame_control))
236 goto err;
237
238 s1g_bcn = ieee80211_is_s1g_beacon(mgmt->frame_control);
239 if (s1g_bcn) {
240 fixedlen = offsetof(struct ieee80211_ext,
241 u.s1g_beacon.variable);
242 hdrlen = offsetof(struct ieee80211_ext, u.s1g_beacon);
243 } else {
244 fixedlen = offsetof(struct ieee80211_mgmt,
245 u.beacon.variable);
246 hdrlen = offsetof(struct ieee80211_mgmt, u.beacon);
247 }
248
249 if (len < fixedlen)
250 goto err;
251
252 if (ieee80211_hdrlen(mgmt->frame_control) != hdrlen)
253 goto err;
254
255 data += fixedlen;
256 len -= fixedlen;
257
258 for_each_element(elem, data, len) {
259 /* nothing */
260 }
261
262 if (for_each_element_completed(elem, data, len))
263 return 0;
264
265 err:
266 NL_SET_ERR_MSG_ATTR(extack, attr, "malformed beacon head");
267 return -EINVAL;
268 }
269
validate_ie_attr(const struct nlattr * attr,struct netlink_ext_ack * extack)270 static int validate_ie_attr(const struct nlattr *attr,
271 struct netlink_ext_ack *extack)
272 {
273 const u8 *data = nla_data(attr);
274 unsigned int len = nla_len(attr);
275 const struct element *elem;
276
277 for_each_element(elem, data, len) {
278 /* nothing */
279 }
280
281 if (for_each_element_completed(elem, data, len))
282 return 0;
283
284 NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements");
285 return -EINVAL;
286 }
287
validate_he_capa(const struct nlattr * attr,struct netlink_ext_ack * extack)288 static int validate_he_capa(const struct nlattr *attr,
289 struct netlink_ext_ack *extack)
290 {
291 if (!ieee80211_he_capa_size_ok(nla_data(attr), nla_len(attr)))
292 return -EINVAL;
293
294 return 0;
295 }
296
297 /* policy for the attributes */
298 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR];
299
300 static const struct nla_policy
301 nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = {
302 [NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, },
303 [NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY,
304 .len = U8_MAX },
305 [NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY,
306 .len = U8_MAX },
307 };
308
309 static const struct nla_policy
310 nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
311 [NL80211_PMSR_FTM_REQ_ATTR_ASAP] = { .type = NLA_FLAG },
312 [NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE] = { .type = NLA_U32 },
313 [NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] =
314 NLA_POLICY_MAX(NLA_U8, 15),
315 [NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 },
316 [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] =
317 NLA_POLICY_MAX(NLA_U8, 15),
318 [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] =
319 NLA_POLICY_MAX(NLA_U8, 31),
320 [NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 },
321 [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG },
322 [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG },
323 [NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED] = { .type = NLA_FLAG },
324 [NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED] = { .type = NLA_FLAG },
325 [NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK] = { .type = NLA_FLAG },
326 [NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR] = { .type = NLA_U8 },
327 };
328
329 static const struct nla_policy
330 nl80211_pmsr_req_data_policy[NL80211_PMSR_TYPE_MAX + 1] = {
331 [NL80211_PMSR_TYPE_FTM] =
332 NLA_POLICY_NESTED(nl80211_pmsr_ftm_req_attr_policy),
333 };
334
335 static const struct nla_policy
336 nl80211_pmsr_req_attr_policy[NL80211_PMSR_REQ_ATTR_MAX + 1] = {
337 [NL80211_PMSR_REQ_ATTR_DATA] =
338 NLA_POLICY_NESTED(nl80211_pmsr_req_data_policy),
339 [NL80211_PMSR_REQ_ATTR_GET_AP_TSF] = { .type = NLA_FLAG },
340 };
341
342 static const struct nla_policy
343 nl80211_pmsr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {
344 [NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR,
345 [NL80211_PMSR_PEER_ATTR_CHAN] = NLA_POLICY_NESTED(nl80211_policy),
346 [NL80211_PMSR_PEER_ATTR_REQ] =
347 NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy),
348 [NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT },
349 };
350
351 static const struct nla_policy
352 nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
353 [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT },
354 [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT },
355 [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },
356 [NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
357 [NL80211_PMSR_ATTR_PEERS] =
358 NLA_POLICY_NESTED_ARRAY(nl80211_pmsr_peer_attr_policy),
359 };
360
361 static const struct nla_policy
362 he_obss_pd_policy[NL80211_HE_OBSS_PD_ATTR_MAX + 1] = {
363 [NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET] =
364 NLA_POLICY_RANGE(NLA_U8, 1, 20),
365 [NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET] =
366 NLA_POLICY_RANGE(NLA_U8, 1, 20),
367 [NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET] =
368 NLA_POLICY_RANGE(NLA_U8, 1, 20),
369 [NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP] =
370 NLA_POLICY_EXACT_LEN(8),
371 [NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP] =
372 NLA_POLICY_EXACT_LEN(8),
373 [NL80211_HE_OBSS_PD_ATTR_SR_CTRL] = { .type = NLA_U8 },
374 };
375
376 static const struct nla_policy
377 he_bss_color_policy[NL80211_HE_BSS_COLOR_ATTR_MAX + 1] = {
378 [NL80211_HE_BSS_COLOR_ATTR_COLOR] = NLA_POLICY_RANGE(NLA_U8, 1, 63),
379 [NL80211_HE_BSS_COLOR_ATTR_DISABLED] = { .type = NLA_FLAG },
380 [NL80211_HE_BSS_COLOR_ATTR_PARTIAL] = { .type = NLA_FLAG },
381 };
382
383 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
384 [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
385 .len = NL80211_MAX_SUPP_RATES },
386 [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
387 .len = NL80211_MAX_SUPP_HT_RATES },
388 [NL80211_TXRATE_VHT] = NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_txrate_vht)),
389 [NL80211_TXRATE_GI] = { .type = NLA_U8 },
390 [NL80211_TXRATE_HE] = NLA_POLICY_EXACT_LEN(sizeof(struct nl80211_txrate_he)),
391 [NL80211_TXRATE_HE_GI] = NLA_POLICY_RANGE(NLA_U8,
392 NL80211_RATE_INFO_HE_GI_0_8,
393 NL80211_RATE_INFO_HE_GI_3_2),
394 [NL80211_TXRATE_HE_LTF] = NLA_POLICY_RANGE(NLA_U8,
395 NL80211_RATE_INFO_HE_1XLTF,
396 NL80211_RATE_INFO_HE_4XLTF),
397 };
398
399 static const struct nla_policy
400 nl80211_tid_config_attr_policy[NL80211_TID_CONFIG_ATTR_MAX + 1] = {
401 [NL80211_TID_CONFIG_ATTR_VIF_SUPP] = { .type = NLA_U64 },
402 [NL80211_TID_CONFIG_ATTR_PEER_SUPP] = { .type = NLA_U64 },
403 [NL80211_TID_CONFIG_ATTR_OVERRIDE] = { .type = NLA_FLAG },
404 [NL80211_TID_CONFIG_ATTR_TIDS] = NLA_POLICY_RANGE(NLA_U16, 1, 0xff),
405 [NL80211_TID_CONFIG_ATTR_NOACK] =
406 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
407 [NL80211_TID_CONFIG_ATTR_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
408 [NL80211_TID_CONFIG_ATTR_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
409 [NL80211_TID_CONFIG_ATTR_AMPDU_CTRL] =
410 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
411 [NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL] =
412 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
413 [NL80211_TID_CONFIG_ATTR_AMSDU_CTRL] =
414 NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
415 [NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE] =
416 NLA_POLICY_MAX(NLA_U8, NL80211_TX_RATE_FIXED),
417 [NL80211_TID_CONFIG_ATTR_TX_RATE] =
418 NLA_POLICY_NESTED(nl80211_txattr_policy),
419 };
420
421 static const struct nla_policy
422 nl80211_fils_discovery_policy[NL80211_FILS_DISCOVERY_ATTR_MAX + 1] = {
423 [NL80211_FILS_DISCOVERY_ATTR_INT_MIN] = NLA_POLICY_MAX(NLA_U32, 10000),
424 [NL80211_FILS_DISCOVERY_ATTR_INT_MAX] = NLA_POLICY_MAX(NLA_U32, 10000),
425 [NL80211_FILS_DISCOVERY_ATTR_TMPL] =
426 NLA_POLICY_RANGE(NLA_BINARY,
427 NL80211_FILS_DISCOVERY_TMPL_MIN_LEN,
428 IEEE80211_MAX_DATA_LEN),
429 };
430
431 static const struct nla_policy
432 nl80211_unsol_bcast_probe_resp_policy[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1] = {
433 [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] = NLA_POLICY_MAX(NLA_U32, 20),
434 [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL] = { .type = NLA_BINARY,
435 .len = IEEE80211_MAX_DATA_LEN }
436 };
437
438 static const struct nla_policy
439 sar_specs_policy[NL80211_SAR_ATTR_SPECS_MAX + 1] = {
440 [NL80211_SAR_ATTR_SPECS_POWER] = { .type = NLA_S32 },
441 [NL80211_SAR_ATTR_SPECS_RANGE_INDEX] = {.type = NLA_U32 },
442 };
443
444 static const struct nla_policy
445 sar_policy[NL80211_SAR_ATTR_MAX + 1] = {
446 [NL80211_SAR_ATTR_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_SAR_TYPE),
447 [NL80211_SAR_ATTR_SPECS] = NLA_POLICY_NESTED_ARRAY(sar_specs_policy),
448 };
449
450 static const struct nla_policy
451 nl80211_mbssid_config_policy[NL80211_MBSSID_CONFIG_ATTR_MAX + 1] = {
452 [NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES] = NLA_POLICY_MIN(NLA_U8, 2),
453 [NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY] =
454 NLA_POLICY_MIN(NLA_U8, 1),
455 [NL80211_MBSSID_CONFIG_ATTR_INDEX] = { .type = NLA_U8 },
456 [NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX] = { .type = NLA_U32 },
457 [NL80211_MBSSID_CONFIG_ATTR_EMA] = { .type = NLA_FLAG },
458 };
459
460 static const struct nla_policy
461 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
462 [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
463 [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
464 };
465
466 static struct netlink_range_validation nl80211_punct_bitmap_range = {
467 .min = 0,
468 .max = 0xffff,
469 };
470
471 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
472 [0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD },
473 [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
474 [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
475 .len = 20-1 },
476 [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
477
478 [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
479 [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
480 [NL80211_ATTR_WIPHY_EDMG_CHANNELS] = NLA_POLICY_RANGE(NLA_U8,
481 NL80211_EDMG_CHANNELS_MIN,
482 NL80211_EDMG_CHANNELS_MAX),
483 [NL80211_ATTR_WIPHY_EDMG_BW_CONFIG] = NLA_POLICY_RANGE(NLA_U8,
484 NL80211_EDMG_BW_CONFIG_MIN,
485 NL80211_EDMG_BW_CONFIG_MAX),
486
487 [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
488 [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
489 [NL80211_ATTR_CENTER_FREQ1_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
490 [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
491
492 [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
493 [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
494 [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
495 [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
496 [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
497 [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
498
499 [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX),
500 [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
501 [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
502
503 [NL80211_ATTR_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
504 [NL80211_ATTR_PREV_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
505
506 [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
507 [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
508 .len = WLAN_MAX_KEY_LEN },
509 [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 7),
510 [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
511 [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
512 [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
513 [NL80211_ATTR_KEY_TYPE] =
514 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES),
515
516 [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
517 [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
518 [NL80211_ATTR_BEACON_HEAD] =
519 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head,
520 IEEE80211_MAX_DATA_LEN),
521 [NL80211_ATTR_BEACON_TAIL] =
522 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
523 IEEE80211_MAX_DATA_LEN),
524 [NL80211_ATTR_STA_AID] =
525 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
526 [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
527 [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
528 [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
529 .len = NL80211_MAX_SUPP_RATES },
530 [NL80211_ATTR_STA_PLINK_ACTION] =
531 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1),
532 [NL80211_ATTR_STA_TX_POWER_SETTING] =
533 NLA_POLICY_RANGE(NLA_U8,
534 NL80211_TX_POWER_AUTOMATIC,
535 NL80211_TX_POWER_FIXED),
536 [NL80211_ATTR_STA_TX_POWER] = { .type = NLA_S16 },
537 [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
538 [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
539 [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
540 .len = IEEE80211_MAX_MESH_ID_LEN },
541 [NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT,
542
543 /* allow 3 for NUL-termination, we used to declare this NLA_STRING */
544 [NL80211_ATTR_REG_ALPHA2] = NLA_POLICY_RANGE(NLA_BINARY, 2, 3),
545 [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
546
547 [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
548 [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
549 [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
550 [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
551 .len = NL80211_MAX_SUPP_RATES },
552 [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
553
554 [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
555 [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
556
557 [NL80211_ATTR_HT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_HT_CAPABILITY_LEN),
558
559 [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
560 [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY,
561 validate_ie_attr,
562 IEEE80211_MAX_DATA_LEN),
563 [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
564 [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
565
566 [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
567 .len = IEEE80211_MAX_SSID_LEN },
568 [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
569 [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
570 [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
571 [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
572 [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32,
573 NL80211_MFP_NO,
574 NL80211_MFP_OPTIONAL),
575 [NL80211_ATTR_STA_FLAGS2] =
576 NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_sta_flag_update)),
577 [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
578 [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
579 [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
580 [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
581 [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
582 [NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 },
583 [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
584 [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
585 [NL80211_ATTR_PID] = { .type = NLA_U32 },
586 [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
587 [NL80211_ATTR_PMKID] = NLA_POLICY_EXACT_LEN_WARN(WLAN_PMKID_LEN),
588 [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
589 [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
590 [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
591 [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
592 .len = IEEE80211_MAX_DATA_LEN },
593 [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
594 [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32,
595 NL80211_PS_DISABLED,
596 NL80211_PS_ENABLED),
597 [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
598 [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
599 [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
600 [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
601 [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
602 [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
603 [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
604 [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
605 [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
606 [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
607 [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
608 [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
609 [NL80211_ATTR_STA_PLINK_STATE] =
610 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1),
611 [NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 },
612 [NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG },
613 [NL80211_ATTR_MESH_PEER_AID] =
614 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
615 [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
616 [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
617 [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
618 [NL80211_ATTR_HIDDEN_SSID] =
619 NLA_POLICY_RANGE(NLA_U32,
620 NL80211_HIDDEN_SSID_NOT_IN_USE,
621 NL80211_HIDDEN_SSID_ZERO_CONTENTS),
622 [NL80211_ATTR_IE_PROBE_RESP] =
623 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
624 IEEE80211_MAX_DATA_LEN),
625 [NL80211_ATTR_IE_ASSOC_RESP] =
626 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
627 IEEE80211_MAX_DATA_LEN),
628 [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
629 [NL80211_ATTR_STA_WME] = NLA_POLICY_NESTED(nl80211_sta_wme_policy),
630 [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
631 [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
632 [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
633 [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
634 [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
635 [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
636 [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
637 [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
638 [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
639 [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
640 .len = IEEE80211_MAX_DATA_LEN },
641 [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
642 [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
643 [NL80211_ATTR_HT_CAPABILITY_MASK] = {
644 .len = NL80211_HT_CAPABILITY_LEN
645 },
646 [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
647 [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
648 [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
649 [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
650 [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
651
652 /* need to include at least Auth Transaction and Status Code */
653 [NL80211_ATTR_AUTH_DATA] = NLA_POLICY_MIN_LEN(4),
654
655 [NL80211_ATTR_VHT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_VHT_CAPABILITY_LEN),
656 [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
657 [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127),
658 [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1),
659 [NL80211_ATTR_LOCAL_MESH_POWER_MODE] =
660 NLA_POLICY_RANGE(NLA_U32,
661 NL80211_MESH_POWER_UNKNOWN + 1,
662 NL80211_MESH_POWER_MAX),
663 [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
664 [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
665 [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
666 [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
667 [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
668 [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
669 [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
670 .len = NL80211_VHT_CAPABILITY_LEN,
671 },
672 [NL80211_ATTR_MDID] = { .type = NLA_U16 },
673 [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
674 .len = IEEE80211_MAX_DATA_LEN },
675 [NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 },
676 [NL80211_ATTR_MAX_CRIT_PROT_DURATION] =
677 NLA_POLICY_MAX(NLA_U16, NL80211_CRIT_PROTO_MAX_DURATION),
678 [NL80211_ATTR_PEER_AID] =
679 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
680 [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
681 [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
682 [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
683 [NL80211_ATTR_CNTDWN_OFFS_BEACON] = { .type = NLA_BINARY },
684 [NL80211_ATTR_CNTDWN_OFFS_PRESP] = { .type = NLA_BINARY },
685 [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = NLA_POLICY_MIN_LEN(2),
686 /*
687 * The value of the Length field of the Supported Operating
688 * Classes element is between 2 and 253.
689 */
690 [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] =
691 NLA_POLICY_RANGE(NLA_BINARY, 2, 253),
692 [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
693 [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
694 [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
695 [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
696 [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
697 [NL80211_ATTR_QOS_MAP] = NLA_POLICY_RANGE(NLA_BINARY,
698 IEEE80211_QOS_MAP_LEN_MIN,
699 IEEE80211_QOS_MAP_LEN_MAX),
700 [NL80211_ATTR_MAC_HINT] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
701 [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
702 [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
703 [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
704 [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
705 [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
706 [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1),
707 [NL80211_ATTR_USER_PRIO] =
708 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1),
709 [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
710 [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
711 [NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 },
712 [NL80211_ATTR_MAC_MASK] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
713 [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
714 [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
715 [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
716 [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
717 [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
718 [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
719 [NL80211_ATTR_STA_SUPPORT_P2P_PS] =
720 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1),
721 [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
722 .len = VHT_MUMIMO_GROUPS_DATA_LEN
723 },
724 [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
725 [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1),
726 [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
727 [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
728 [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
729 .len = FILS_MAX_KEK_LEN },
730 [NL80211_ATTR_FILS_NONCES] = NLA_POLICY_EXACT_LEN_WARN(2 * FILS_NONCE_LEN),
731 [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
732 [NL80211_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
733 [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
734 [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
735 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
736 },
737 [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
738 [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
739 .len = FILS_ERP_MAX_USERNAME_LEN },
740 [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
741 .len = FILS_ERP_MAX_REALM_LEN },
742 [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
743 [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
744 .len = FILS_ERP_MAX_RRK_LEN },
745 [NL80211_ATTR_FILS_CACHE_ID] = NLA_POLICY_EXACT_LEN_WARN(2),
746 [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
747 [NL80211_ATTR_PMKR0_NAME] = NLA_POLICY_EXACT_LEN(WLAN_PMK_NAME_LEN),
748 [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
749 [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
750
751 [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
752 [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
753 [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 },
754 [NL80211_ATTR_HE_CAPABILITY] =
755 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_he_capa,
756 NL80211_HE_MAX_CAPABILITY_LEN),
757 [NL80211_ATTR_FTM_RESPONDER] =
758 NLA_POLICY_NESTED(nl80211_ftm_responder_policy),
759 [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1),
760 [NL80211_ATTR_PEER_MEASUREMENTS] =
761 NLA_POLICY_NESTED(nl80211_pmsr_attr_policy),
762 [NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1),
763 [NL80211_ATTR_SAE_PASSWORD] = { .type = NLA_BINARY,
764 .len = SAE_PASSWORD_MAX_LEN },
765 [NL80211_ATTR_TWT_RESPONDER] = { .type = NLA_FLAG },
766 [NL80211_ATTR_HE_OBSS_PD] = NLA_POLICY_NESTED(he_obss_pd_policy),
767 [NL80211_ATTR_VLAN_ID] = NLA_POLICY_RANGE(NLA_U16, 1, VLAN_N_VID - 2),
768 [NL80211_ATTR_HE_BSS_COLOR] = NLA_POLICY_NESTED(he_bss_color_policy),
769 [NL80211_ATTR_TID_CONFIG] =
770 NLA_POLICY_NESTED_ARRAY(nl80211_tid_config_attr_policy),
771 [NL80211_ATTR_CONTROL_PORT_NO_PREAUTH] = { .type = NLA_FLAG },
772 [NL80211_ATTR_PMK_LIFETIME] = NLA_POLICY_MIN(NLA_U32, 1),
773 [NL80211_ATTR_PMK_REAUTH_THRESHOLD] = NLA_POLICY_RANGE(NLA_U8, 1, 100),
774 [NL80211_ATTR_RECEIVE_MULTICAST] = { .type = NLA_FLAG },
775 [NL80211_ATTR_WIPHY_FREQ_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
776 [NL80211_ATTR_SCAN_FREQ_KHZ] = { .type = NLA_NESTED },
777 [NL80211_ATTR_HE_6GHZ_CAPABILITY] =
778 NLA_POLICY_EXACT_LEN(sizeof(struct ieee80211_he_6ghz_capa)),
779 [NL80211_ATTR_FILS_DISCOVERY] =
780 NLA_POLICY_NESTED(nl80211_fils_discovery_policy),
781 [NL80211_ATTR_UNSOL_BCAST_PROBE_RESP] =
782 NLA_POLICY_NESTED(nl80211_unsol_bcast_probe_resp_policy),
783 [NL80211_ATTR_S1G_CAPABILITY] =
784 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
785 [NL80211_ATTR_S1G_CAPABILITY_MASK] =
786 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
787 [NL80211_ATTR_SAE_PWE] =
788 NLA_POLICY_RANGE(NLA_U8, NL80211_SAE_PWE_HUNT_AND_PECK,
789 NL80211_SAE_PWE_BOTH),
790 [NL80211_ATTR_RECONNECT_REQUESTED] = { .type = NLA_REJECT },
791 [NL80211_ATTR_SAR_SPEC] = NLA_POLICY_NESTED(sar_policy),
792 [NL80211_ATTR_DISABLE_HE] = { .type = NLA_FLAG },
793 [NL80211_ATTR_OBSS_COLOR_BITMAP] = { .type = NLA_U64 },
794 [NL80211_ATTR_COLOR_CHANGE_COUNT] = { .type = NLA_U8 },
795 [NL80211_ATTR_COLOR_CHANGE_COLOR] = { .type = NLA_U8 },
796 [NL80211_ATTR_COLOR_CHANGE_ELEMS] = NLA_POLICY_NESTED(nl80211_policy),
797 [NL80211_ATTR_MBSSID_CONFIG] =
798 NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
799 [NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
800 [NL80211_ATTR_RADAR_BACKGROUND] = { .type = NLA_FLAG },
801 [NL80211_ATTR_AP_SETTINGS_FLAGS] = { .type = NLA_U32 },
802 [NL80211_ATTR_EHT_CAPABILITY] =
803 NLA_POLICY_RANGE(NLA_BINARY,
804 NL80211_EHT_MIN_CAPABILITY_LEN,
805 NL80211_EHT_MAX_CAPABILITY_LEN),
806 [NL80211_ATTR_DISABLE_EHT] = { .type = NLA_FLAG },
807 [NL80211_ATTR_MLO_LINKS] =
808 NLA_POLICY_NESTED_ARRAY(nl80211_policy),
809 [NL80211_ATTR_MLO_LINK_ID] =
810 NLA_POLICY_RANGE(NLA_U8, 0, IEEE80211_MLD_MAX_NUM_LINKS),
811 [NL80211_ATTR_MLD_ADDR] = NLA_POLICY_EXACT_LEN(ETH_ALEN),
812 [NL80211_ATTR_MLO_SUPPORT] = { .type = NLA_FLAG },
813 [NL80211_ATTR_MAX_NUM_AKM_SUITES] = { .type = NLA_REJECT },
814 [NL80211_ATTR_PUNCT_BITMAP] =
815 NLA_POLICY_FULL_RANGE(NLA_U32, &nl80211_punct_bitmap_range),
816
817 [NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS] = { .type = NLA_U16 },
818 [NL80211_ATTR_HW_TIMESTAMP_ENABLED] = { .type = NLA_FLAG },
819 [NL80211_ATTR_EMA_RNR_ELEMS] = { .type = NLA_NESTED },
820 [NL80211_ATTR_MLO_LINK_DISABLED] = { .type = NLA_FLAG },
821 };
822
823 /* policy for the key attributes */
824 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
825 [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
826 [NL80211_KEY_IDX] = { .type = NLA_U8 },
827 [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
828 [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
829 [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
830 [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
831 [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1),
832 [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
833 [NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX),
834 };
835
836 /* policy for the key default flags */
837 static const struct nla_policy
838 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
839 [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
840 [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
841 };
842
843 #ifdef CONFIG_PM
844 /* policy for WoWLAN attributes */
845 static const struct nla_policy
846 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
847 [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
848 [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
849 [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
850 [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
851 [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
852 [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
853 [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
854 [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
855 [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
856 [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
857 };
858
859 static const struct nla_policy
860 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
861 [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
862 [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
863 [NL80211_WOWLAN_TCP_DST_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
864 [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
865 [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
866 [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
867 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
868 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
869 },
870 [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
871 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
872 },
873 [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
874 [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
875 [NL80211_WOWLAN_TCP_WAKE_MASK] = NLA_POLICY_MIN_LEN(1),
876 };
877 #endif /* CONFIG_PM */
878
879 /* policy for coalesce rule attributes */
880 static const struct nla_policy
881 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
882 [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
883 [NL80211_ATTR_COALESCE_RULE_CONDITION] =
884 NLA_POLICY_RANGE(NLA_U32,
885 NL80211_COALESCE_CONDITION_MATCH,
886 NL80211_COALESCE_CONDITION_NO_MATCH),
887 [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
888 };
889
890 /* policy for GTK rekey offload attributes */
891 static const struct nla_policy
892 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
893 [NL80211_REKEY_DATA_KEK] = {
894 .type = NLA_BINARY,
895 .len = NL80211_KEK_EXT_LEN
896 },
897 [NL80211_REKEY_DATA_KCK] = {
898 .type = NLA_BINARY,
899 .len = NL80211_KCK_EXT_LEN_32
900 },
901 [NL80211_REKEY_DATA_REPLAY_CTR] = NLA_POLICY_EXACT_LEN(NL80211_REPLAY_CTR_LEN),
902 [NL80211_REKEY_DATA_AKM] = { .type = NLA_U32 },
903 };
904
905 static const struct nla_policy
906 nl80211_match_band_rssi_policy[NUM_NL80211_BANDS] = {
907 [NL80211_BAND_2GHZ] = { .type = NLA_S32 },
908 [NL80211_BAND_5GHZ] = { .type = NLA_S32 },
909 [NL80211_BAND_6GHZ] = { .type = NLA_S32 },
910 [NL80211_BAND_60GHZ] = { .type = NLA_S32 },
911 [NL80211_BAND_LC] = { .type = NLA_S32 },
912 };
913
914 static const struct nla_policy
915 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
916 [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
917 .len = IEEE80211_MAX_SSID_LEN },
918 [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
919 [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
920 [NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI] =
921 NLA_POLICY_NESTED(nl80211_match_band_rssi_policy),
922 };
923
924 static const struct nla_policy
925 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
926 [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
927 [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
928 };
929
930 static const struct nla_policy
931 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
932 [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
933 [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
934 [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
935 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
936 },
937 };
938
939 /* policy for NAN function attributes */
940 static const struct nla_policy
941 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
942 [NL80211_NAN_FUNC_TYPE] =
943 NLA_POLICY_MAX(NLA_U8, NL80211_NAN_FUNC_MAX_TYPE),
944 [NL80211_NAN_FUNC_SERVICE_ID] = {
945 .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
946 [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
947 [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
948 [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
949 [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
950 [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
951 [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
952 [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
953 [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
954 [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
955 .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
956 [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
957 [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
958 [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
959 [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
960 [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
961 };
962
963 /* policy for Service Response Filter attributes */
964 static const struct nla_policy
965 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
966 [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
967 [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
968 .len = NL80211_NAN_FUNC_SRF_MAX_LEN },
969 [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
970 [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
971 };
972
973 /* policy for packet pattern attributes */
974 static const struct nla_policy
975 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
976 [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
977 [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
978 [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
979 };
980
nl80211_prepare_wdev_dump(struct netlink_callback * cb,struct cfg80211_registered_device ** rdev,struct wireless_dev ** wdev,struct nlattr ** attrbuf)981 static int nl80211_prepare_wdev_dump(struct netlink_callback *cb,
982 struct cfg80211_registered_device **rdev,
983 struct wireless_dev **wdev,
984 struct nlattr **attrbuf)
985 {
986 int err;
987
988 if (!cb->args[0]) {
989 struct nlattr **attrbuf_free = NULL;
990
991 if (!attrbuf) {
992 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
993 GFP_KERNEL);
994 if (!attrbuf)
995 return -ENOMEM;
996 attrbuf_free = attrbuf;
997 }
998
999 err = nlmsg_parse_deprecated(cb->nlh,
1000 GENL_HDRLEN + nl80211_fam.hdrsize,
1001 attrbuf, nl80211_fam.maxattr,
1002 nl80211_policy, NULL);
1003 if (err) {
1004 kfree(attrbuf_free);
1005 return err;
1006 }
1007
1008 rtnl_lock();
1009 *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(cb->skb->sk),
1010 attrbuf);
1011 kfree(attrbuf_free);
1012 if (IS_ERR(*wdev)) {
1013 rtnl_unlock();
1014 return PTR_ERR(*wdev);
1015 }
1016 *rdev = wiphy_to_rdev((*wdev)->wiphy);
1017 mutex_lock(&(*rdev)->wiphy.mtx);
1018 rtnl_unlock();
1019 /* 0 is the first index - add 1 to parse only once */
1020 cb->args[0] = (*rdev)->wiphy_idx + 1;
1021 cb->args[1] = (*wdev)->identifier;
1022 } else {
1023 /* subtract the 1 again here */
1024 struct wiphy *wiphy;
1025 struct wireless_dev *tmp;
1026
1027 rtnl_lock();
1028 wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
1029 if (!wiphy) {
1030 rtnl_unlock();
1031 return -ENODEV;
1032 }
1033 *rdev = wiphy_to_rdev(wiphy);
1034 *wdev = NULL;
1035
1036 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
1037 if (tmp->identifier == cb->args[1]) {
1038 *wdev = tmp;
1039 break;
1040 }
1041 }
1042
1043 if (!*wdev) {
1044 rtnl_unlock();
1045 return -ENODEV;
1046 }
1047 mutex_lock(&(*rdev)->wiphy.mtx);
1048 rtnl_unlock();
1049 }
1050
1051 return 0;
1052 }
1053
1054 /* message building helper */
nl80211hdr_put(struct sk_buff * skb,u32 portid,u32 seq,int flags,u8 cmd)1055 void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
1056 int flags, u8 cmd)
1057 {
1058 /* since there is no private header just add the generic one */
1059 return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
1060 }
1061
nl80211_msg_put_wmm_rules(struct sk_buff * msg,const struct ieee80211_reg_rule * rule)1062 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
1063 const struct ieee80211_reg_rule *rule)
1064 {
1065 int j;
1066 struct nlattr *nl_wmm_rules =
1067 nla_nest_start_noflag(msg, NL80211_FREQUENCY_ATTR_WMM);
1068
1069 if (!nl_wmm_rules)
1070 goto nla_put_failure;
1071
1072 for (j = 0; j < IEEE80211_NUM_ACS; j++) {
1073 struct nlattr *nl_wmm_rule = nla_nest_start_noflag(msg, j);
1074
1075 if (!nl_wmm_rule)
1076 goto nla_put_failure;
1077
1078 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
1079 rule->wmm_rule.client[j].cw_min) ||
1080 nla_put_u16(msg, NL80211_WMMR_CW_MAX,
1081 rule->wmm_rule.client[j].cw_max) ||
1082 nla_put_u8(msg, NL80211_WMMR_AIFSN,
1083 rule->wmm_rule.client[j].aifsn) ||
1084 nla_put_u16(msg, NL80211_WMMR_TXOP,
1085 rule->wmm_rule.client[j].cot))
1086 goto nla_put_failure;
1087
1088 nla_nest_end(msg, nl_wmm_rule);
1089 }
1090 nla_nest_end(msg, nl_wmm_rules);
1091
1092 return 0;
1093
1094 nla_put_failure:
1095 return -ENOBUFS;
1096 }
1097
nl80211_msg_put_channel(struct sk_buff * msg,struct wiphy * wiphy,struct ieee80211_channel * chan,bool large)1098 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
1099 struct ieee80211_channel *chan,
1100 bool large)
1101 {
1102 /* Some channels must be completely excluded from the
1103 * list to protect old user-space tools from breaking
1104 */
1105 if (!large && chan->flags &
1106 (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
1107 return 0;
1108 if (!large && chan->freq_offset)
1109 return 0;
1110
1111 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
1112 chan->center_freq))
1113 goto nla_put_failure;
1114
1115 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_OFFSET, chan->freq_offset))
1116 goto nla_put_failure;
1117
1118 if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
1119 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
1120 goto nla_put_failure;
1121 if (chan->flags & IEEE80211_CHAN_NO_IR) {
1122 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
1123 goto nla_put_failure;
1124 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
1125 goto nla_put_failure;
1126 }
1127 if (chan->flags & IEEE80211_CHAN_RADAR) {
1128 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
1129 goto nla_put_failure;
1130 if (large) {
1131 u32 time;
1132
1133 time = elapsed_jiffies_msecs(chan->dfs_state_entered);
1134
1135 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
1136 chan->dfs_state))
1137 goto nla_put_failure;
1138 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
1139 time))
1140 goto nla_put_failure;
1141 if (nla_put_u32(msg,
1142 NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
1143 chan->dfs_cac_ms))
1144 goto nla_put_failure;
1145 }
1146 }
1147
1148 if (large) {
1149 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
1150 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
1151 goto nla_put_failure;
1152 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
1153 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
1154 goto nla_put_failure;
1155 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
1156 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
1157 goto nla_put_failure;
1158 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
1159 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
1160 goto nla_put_failure;
1161 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
1162 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
1163 goto nla_put_failure;
1164 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
1165 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
1166 goto nla_put_failure;
1167 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
1168 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
1169 goto nla_put_failure;
1170 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
1171 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
1172 goto nla_put_failure;
1173 if ((chan->flags & IEEE80211_CHAN_NO_HE) &&
1174 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HE))
1175 goto nla_put_failure;
1176 if ((chan->flags & IEEE80211_CHAN_1MHZ) &&
1177 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_1MHZ))
1178 goto nla_put_failure;
1179 if ((chan->flags & IEEE80211_CHAN_2MHZ) &&
1180 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_2MHZ))
1181 goto nla_put_failure;
1182 if ((chan->flags & IEEE80211_CHAN_4MHZ) &&
1183 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_4MHZ))
1184 goto nla_put_failure;
1185 if ((chan->flags & IEEE80211_CHAN_8MHZ) &&
1186 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_8MHZ))
1187 goto nla_put_failure;
1188 if ((chan->flags & IEEE80211_CHAN_16MHZ) &&
1189 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_16MHZ))
1190 goto nla_put_failure;
1191 if ((chan->flags & IEEE80211_CHAN_NO_320MHZ) &&
1192 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_320MHZ))
1193 goto nla_put_failure;
1194 if ((chan->flags & IEEE80211_CHAN_NO_EHT) &&
1195 nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_EHT))
1196 goto nla_put_failure;
1197 }
1198
1199 if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
1200 DBM_TO_MBM(chan->max_power)))
1201 goto nla_put_failure;
1202
1203 if (large) {
1204 const struct ieee80211_reg_rule *rule =
1205 freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
1206
1207 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) {
1208 if (nl80211_msg_put_wmm_rules(msg, rule))
1209 goto nla_put_failure;
1210 }
1211 }
1212
1213 return 0;
1214
1215 nla_put_failure:
1216 return -ENOBUFS;
1217 }
1218
nl80211_put_txq_stats(struct sk_buff * msg,struct cfg80211_txq_stats * txqstats,int attrtype)1219 static bool nl80211_put_txq_stats(struct sk_buff *msg,
1220 struct cfg80211_txq_stats *txqstats,
1221 int attrtype)
1222 {
1223 struct nlattr *txqattr;
1224
1225 #define PUT_TXQVAL_U32(attr, memb) do { \
1226 if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) && \
1227 nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \
1228 return false; \
1229 } while (0)
1230
1231 txqattr = nla_nest_start_noflag(msg, attrtype);
1232 if (!txqattr)
1233 return false;
1234
1235 PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes);
1236 PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets);
1237 PUT_TXQVAL_U32(FLOWS, flows);
1238 PUT_TXQVAL_U32(DROPS, drops);
1239 PUT_TXQVAL_U32(ECN_MARKS, ecn_marks);
1240 PUT_TXQVAL_U32(OVERLIMIT, overlimit);
1241 PUT_TXQVAL_U32(OVERMEMORY, overmemory);
1242 PUT_TXQVAL_U32(COLLISIONS, collisions);
1243 PUT_TXQVAL_U32(TX_BYTES, tx_bytes);
1244 PUT_TXQVAL_U32(TX_PACKETS, tx_packets);
1245 PUT_TXQVAL_U32(MAX_FLOWS, max_flows);
1246 nla_nest_end(msg, txqattr);
1247
1248 #undef PUT_TXQVAL_U32
1249 return true;
1250 }
1251
1252 /* netlink command implementations */
1253
1254 /**
1255 * nl80211_link_id - return link ID
1256 * @attrs: attributes to look at
1257 *
1258 * Returns: the link ID or 0 if not given
1259 *
1260 * Note this function doesn't do any validation of the link
1261 * ID validity wrt. links that were actually added, so it must
1262 * be called only from ops with %NL80211_FLAG_MLO_VALID_LINK_ID
1263 * or if additional validation is done.
1264 */
nl80211_link_id(struct nlattr ** attrs)1265 static unsigned int nl80211_link_id(struct nlattr **attrs)
1266 {
1267 struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID];
1268
1269 if (!linkid)
1270 return 0;
1271
1272 return nla_get_u8(linkid);
1273 }
1274
nl80211_link_id_or_invalid(struct nlattr ** attrs)1275 static int nl80211_link_id_or_invalid(struct nlattr **attrs)
1276 {
1277 struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID];
1278
1279 if (!linkid)
1280 return -1;
1281
1282 return nla_get_u8(linkid);
1283 }
1284
1285 struct key_parse {
1286 struct key_params p;
1287 int idx;
1288 int type;
1289 bool def, defmgmt, defbeacon;
1290 bool def_uni, def_multi;
1291 };
1292
nl80211_parse_key_new(struct genl_info * info,struct nlattr * key,struct key_parse * k)1293 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
1294 struct key_parse *k)
1295 {
1296 struct nlattr *tb[NL80211_KEY_MAX + 1];
1297 int err = nla_parse_nested_deprecated(tb, NL80211_KEY_MAX, key,
1298 nl80211_key_policy,
1299 info->extack);
1300 if (err)
1301 return err;
1302
1303 k->def = !!tb[NL80211_KEY_DEFAULT];
1304 k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
1305 k->defbeacon = !!tb[NL80211_KEY_DEFAULT_BEACON];
1306
1307 if (k->def) {
1308 k->def_uni = true;
1309 k->def_multi = true;
1310 }
1311 if (k->defmgmt || k->defbeacon)
1312 k->def_multi = true;
1313
1314 if (tb[NL80211_KEY_IDX])
1315 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
1316
1317 if (tb[NL80211_KEY_DATA]) {
1318 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
1319 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
1320 }
1321
1322 if (tb[NL80211_KEY_SEQ]) {
1323 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
1324 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
1325 }
1326
1327 if (tb[NL80211_KEY_CIPHER])
1328 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
1329
1330 if (tb[NL80211_KEY_TYPE])
1331 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
1332
1333 if (tb[NL80211_KEY_DEFAULT_TYPES]) {
1334 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1335
1336 err = nla_parse_nested_deprecated(kdt,
1337 NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1338 tb[NL80211_KEY_DEFAULT_TYPES],
1339 nl80211_key_default_policy,
1340 info->extack);
1341 if (err)
1342 return err;
1343
1344 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1345 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1346 }
1347
1348 if (tb[NL80211_KEY_MODE])
1349 k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]);
1350
1351 return 0;
1352 }
1353
nl80211_parse_key_old(struct genl_info * info,struct key_parse * k)1354 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
1355 {
1356 if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1357 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1358 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1359 }
1360
1361 if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
1362 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
1363 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
1364 }
1365
1366 if (info->attrs[NL80211_ATTR_KEY_IDX])
1367 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1368
1369 if (info->attrs[NL80211_ATTR_KEY_CIPHER])
1370 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1371
1372 k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
1373 k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
1374
1375 if (k->def) {
1376 k->def_uni = true;
1377 k->def_multi = true;
1378 }
1379 if (k->defmgmt)
1380 k->def_multi = true;
1381
1382 if (info->attrs[NL80211_ATTR_KEY_TYPE])
1383 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1384
1385 if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
1386 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1387 int err = nla_parse_nested_deprecated(kdt,
1388 NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1389 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
1390 nl80211_key_default_policy,
1391 info->extack);
1392 if (err)
1393 return err;
1394
1395 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1396 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1397 }
1398
1399 return 0;
1400 }
1401
nl80211_parse_key(struct genl_info * info,struct key_parse * k)1402 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
1403 {
1404 int err;
1405
1406 memset(k, 0, sizeof(*k));
1407 k->idx = -1;
1408 k->type = -1;
1409
1410 if (info->attrs[NL80211_ATTR_KEY])
1411 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
1412 else
1413 err = nl80211_parse_key_old(info, k);
1414
1415 if (err)
1416 return err;
1417
1418 if ((k->def ? 1 : 0) + (k->defmgmt ? 1 : 0) +
1419 (k->defbeacon ? 1 : 0) > 1) {
1420 GENL_SET_ERR_MSG(info,
1421 "key with multiple default flags is invalid");
1422 return -EINVAL;
1423 }
1424
1425 if (k->defmgmt || k->defbeacon) {
1426 if (k->def_uni || !k->def_multi) {
1427 GENL_SET_ERR_MSG(info,
1428 "defmgmt/defbeacon key must be mcast");
1429 return -EINVAL;
1430 }
1431 }
1432
1433 if (k->idx != -1) {
1434 if (k->defmgmt) {
1435 if (k->idx < 4 || k->idx > 5) {
1436 GENL_SET_ERR_MSG(info,
1437 "defmgmt key idx not 4 or 5");
1438 return -EINVAL;
1439 }
1440 } else if (k->defbeacon) {
1441 if (k->idx < 6 || k->idx > 7) {
1442 GENL_SET_ERR_MSG(info,
1443 "defbeacon key idx not 6 or 7");
1444 return -EINVAL;
1445 }
1446 } else if (k->def) {
1447 if (k->idx < 0 || k->idx > 3) {
1448 GENL_SET_ERR_MSG(info, "def key idx not 0-3");
1449 return -EINVAL;
1450 }
1451 } else {
1452 if (k->idx < 0 || k->idx > 7) {
1453 GENL_SET_ERR_MSG(info, "key idx not 0-7");
1454 return -EINVAL;
1455 }
1456 }
1457 }
1458
1459 return 0;
1460 }
1461
1462 static struct cfg80211_cached_keys *
nl80211_parse_connkeys(struct cfg80211_registered_device * rdev,struct genl_info * info,bool * no_ht)1463 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
1464 struct genl_info *info, bool *no_ht)
1465 {
1466 struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
1467 struct key_parse parse;
1468 struct nlattr *key;
1469 struct cfg80211_cached_keys *result;
1470 int rem, err, def = 0;
1471 bool have_key = false;
1472
1473 nla_for_each_nested(key, keys, rem) {
1474 have_key = true;
1475 break;
1476 }
1477
1478 if (!have_key)
1479 return NULL;
1480
1481 result = kzalloc(sizeof(*result), GFP_KERNEL);
1482 if (!result)
1483 return ERR_PTR(-ENOMEM);
1484
1485 result->def = -1;
1486
1487 nla_for_each_nested(key, keys, rem) {
1488 memset(&parse, 0, sizeof(parse));
1489 parse.idx = -1;
1490
1491 err = nl80211_parse_key_new(info, key, &parse);
1492 if (err)
1493 goto error;
1494 err = -EINVAL;
1495 if (!parse.p.key)
1496 goto error;
1497 if (parse.idx < 0 || parse.idx > 3) {
1498 GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
1499 goto error;
1500 }
1501 if (parse.def) {
1502 if (def) {
1503 GENL_SET_ERR_MSG(info,
1504 "only one key can be default");
1505 goto error;
1506 }
1507 def = 1;
1508 result->def = parse.idx;
1509 if (!parse.def_uni || !parse.def_multi)
1510 goto error;
1511 } else if (parse.defmgmt)
1512 goto error;
1513 err = cfg80211_validate_key_settings(rdev, &parse.p,
1514 parse.idx, false, NULL);
1515 if (err)
1516 goto error;
1517 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1518 parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
1519 GENL_SET_ERR_MSG(info, "connect key must be WEP");
1520 err = -EINVAL;
1521 goto error;
1522 }
1523 result->params[parse.idx].cipher = parse.p.cipher;
1524 result->params[parse.idx].key_len = parse.p.key_len;
1525 result->params[parse.idx].key = result->data[parse.idx];
1526 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
1527
1528 /* must be WEP key if we got here */
1529 if (no_ht)
1530 *no_ht = true;
1531 }
1532
1533 if (result->def < 0) {
1534 err = -EINVAL;
1535 GENL_SET_ERR_MSG(info, "need a default/TX key");
1536 goto error;
1537 }
1538
1539 return result;
1540 error:
1541 kfree(result);
1542 return ERR_PTR(err);
1543 }
1544
nl80211_key_allowed(struct wireless_dev * wdev)1545 static int nl80211_key_allowed(struct wireless_dev *wdev)
1546 {
1547 ASSERT_WDEV_LOCK(wdev);
1548
1549 switch (wdev->iftype) {
1550 case NL80211_IFTYPE_AP:
1551 case NL80211_IFTYPE_AP_VLAN:
1552 case NL80211_IFTYPE_P2P_GO:
1553 case NL80211_IFTYPE_MESH_POINT:
1554 break;
1555 case NL80211_IFTYPE_ADHOC:
1556 if (wdev->u.ibss.current_bss)
1557 return 0;
1558 return -ENOLINK;
1559 case NL80211_IFTYPE_STATION:
1560 case NL80211_IFTYPE_P2P_CLIENT:
1561 if (wdev->connected)
1562 return 0;
1563 return -ENOLINK;
1564 case NL80211_IFTYPE_NAN:
1565 if (wiphy_ext_feature_isset(wdev->wiphy,
1566 NL80211_EXT_FEATURE_SECURE_NAN))
1567 return 0;
1568 return -EINVAL;
1569 case NL80211_IFTYPE_UNSPECIFIED:
1570 case NL80211_IFTYPE_OCB:
1571 case NL80211_IFTYPE_MONITOR:
1572 case NL80211_IFTYPE_P2P_DEVICE:
1573 case NL80211_IFTYPE_WDS:
1574 case NUM_NL80211_IFTYPES:
1575 return -EINVAL;
1576 }
1577
1578 return 0;
1579 }
1580
nl80211_get_valid_chan(struct wiphy * wiphy,u32 freq)1581 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1582 u32 freq)
1583 {
1584 struct ieee80211_channel *chan;
1585
1586 chan = ieee80211_get_channel_khz(wiphy, freq);
1587 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1588 return NULL;
1589 return chan;
1590 }
1591
nl80211_put_iftypes(struct sk_buff * msg,u32 attr,u16 ifmodes)1592 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1593 {
1594 struct nlattr *nl_modes = nla_nest_start_noflag(msg, attr);
1595 int i;
1596
1597 if (!nl_modes)
1598 goto nla_put_failure;
1599
1600 i = 0;
1601 while (ifmodes) {
1602 if ((ifmodes & 1) && nla_put_flag(msg, i))
1603 goto nla_put_failure;
1604 ifmodes >>= 1;
1605 i++;
1606 }
1607
1608 nla_nest_end(msg, nl_modes);
1609 return 0;
1610
1611 nla_put_failure:
1612 return -ENOBUFS;
1613 }
1614
nl80211_put_iface_combinations(struct wiphy * wiphy,struct sk_buff * msg,bool large)1615 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1616 struct sk_buff *msg,
1617 bool large)
1618 {
1619 struct nlattr *nl_combis;
1620 int i, j;
1621
1622 nl_combis = nla_nest_start_noflag(msg,
1623 NL80211_ATTR_INTERFACE_COMBINATIONS);
1624 if (!nl_combis)
1625 goto nla_put_failure;
1626
1627 for (i = 0; i < wiphy->n_iface_combinations; i++) {
1628 const struct ieee80211_iface_combination *c;
1629 struct nlattr *nl_combi, *nl_limits;
1630
1631 c = &wiphy->iface_combinations[i];
1632
1633 nl_combi = nla_nest_start_noflag(msg, i + 1);
1634 if (!nl_combi)
1635 goto nla_put_failure;
1636
1637 nl_limits = nla_nest_start_noflag(msg,
1638 NL80211_IFACE_COMB_LIMITS);
1639 if (!nl_limits)
1640 goto nla_put_failure;
1641
1642 for (j = 0; j < c->n_limits; j++) {
1643 struct nlattr *nl_limit;
1644
1645 nl_limit = nla_nest_start_noflag(msg, j + 1);
1646 if (!nl_limit)
1647 goto nla_put_failure;
1648 if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1649 c->limits[j].max))
1650 goto nla_put_failure;
1651 if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1652 c->limits[j].types))
1653 goto nla_put_failure;
1654 nla_nest_end(msg, nl_limit);
1655 }
1656
1657 nla_nest_end(msg, nl_limits);
1658
1659 if (c->beacon_int_infra_match &&
1660 nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1661 goto nla_put_failure;
1662 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1663 c->num_different_channels) ||
1664 nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1665 c->max_interfaces))
1666 goto nla_put_failure;
1667 if (large &&
1668 (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1669 c->radar_detect_widths) ||
1670 nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1671 c->radar_detect_regions)))
1672 goto nla_put_failure;
1673 if (c->beacon_int_min_gcd &&
1674 nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1675 c->beacon_int_min_gcd))
1676 goto nla_put_failure;
1677
1678 nla_nest_end(msg, nl_combi);
1679 }
1680
1681 nla_nest_end(msg, nl_combis);
1682
1683 return 0;
1684 nla_put_failure:
1685 return -ENOBUFS;
1686 }
1687
1688 #ifdef CONFIG_PM
nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device * rdev,struct sk_buff * msg)1689 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1690 struct sk_buff *msg)
1691 {
1692 const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1693 struct nlattr *nl_tcp;
1694
1695 if (!tcp)
1696 return 0;
1697
1698 nl_tcp = nla_nest_start_noflag(msg,
1699 NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1700 if (!nl_tcp)
1701 return -ENOBUFS;
1702
1703 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1704 tcp->data_payload_max))
1705 return -ENOBUFS;
1706
1707 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1708 tcp->data_payload_max))
1709 return -ENOBUFS;
1710
1711 if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1712 return -ENOBUFS;
1713
1714 if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1715 sizeof(*tcp->tok), tcp->tok))
1716 return -ENOBUFS;
1717
1718 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1719 tcp->data_interval_max))
1720 return -ENOBUFS;
1721
1722 if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1723 tcp->wake_payload_max))
1724 return -ENOBUFS;
1725
1726 nla_nest_end(msg, nl_tcp);
1727 return 0;
1728 }
1729
nl80211_send_wowlan(struct sk_buff * msg,struct cfg80211_registered_device * rdev,bool large)1730 static int nl80211_send_wowlan(struct sk_buff *msg,
1731 struct cfg80211_registered_device *rdev,
1732 bool large)
1733 {
1734 struct nlattr *nl_wowlan;
1735
1736 if (!rdev->wiphy.wowlan)
1737 return 0;
1738
1739 nl_wowlan = nla_nest_start_noflag(msg,
1740 NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1741 if (!nl_wowlan)
1742 return -ENOBUFS;
1743
1744 if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1745 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1746 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1747 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1748 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1749 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1750 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1751 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1752 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1753 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1754 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1755 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1756 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1757 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1758 ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1759 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1760 return -ENOBUFS;
1761
1762 if (rdev->wiphy.wowlan->n_patterns) {
1763 struct nl80211_pattern_support pat = {
1764 .max_patterns = rdev->wiphy.wowlan->n_patterns,
1765 .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1766 .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1767 .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1768 };
1769
1770 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1771 sizeof(pat), &pat))
1772 return -ENOBUFS;
1773 }
1774
1775 if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1776 nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1777 rdev->wiphy.wowlan->max_nd_match_sets))
1778 return -ENOBUFS;
1779
1780 if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1781 return -ENOBUFS;
1782
1783 nla_nest_end(msg, nl_wowlan);
1784
1785 return 0;
1786 }
1787 #endif
1788
nl80211_send_coalesce(struct sk_buff * msg,struct cfg80211_registered_device * rdev)1789 static int nl80211_send_coalesce(struct sk_buff *msg,
1790 struct cfg80211_registered_device *rdev)
1791 {
1792 struct nl80211_coalesce_rule_support rule;
1793
1794 if (!rdev->wiphy.coalesce)
1795 return 0;
1796
1797 rule.max_rules = rdev->wiphy.coalesce->n_rules;
1798 rule.max_delay = rdev->wiphy.coalesce->max_delay;
1799 rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1800 rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1801 rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1802 rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1803
1804 if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1805 return -ENOBUFS;
1806
1807 return 0;
1808 }
1809
1810 static int
nl80211_send_iftype_data(struct sk_buff * msg,const struct ieee80211_supported_band * sband,const struct ieee80211_sband_iftype_data * iftdata)1811 nl80211_send_iftype_data(struct sk_buff *msg,
1812 const struct ieee80211_supported_band *sband,
1813 const struct ieee80211_sband_iftype_data *iftdata)
1814 {
1815 const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap;
1816 const struct ieee80211_sta_eht_cap *eht_cap = &iftdata->eht_cap;
1817
1818 if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES,
1819 iftdata->types_mask))
1820 return -ENOBUFS;
1821
1822 if (he_cap->has_he) {
1823 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC,
1824 sizeof(he_cap->he_cap_elem.mac_cap_info),
1825 he_cap->he_cap_elem.mac_cap_info) ||
1826 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY,
1827 sizeof(he_cap->he_cap_elem.phy_cap_info),
1828 he_cap->he_cap_elem.phy_cap_info) ||
1829 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET,
1830 sizeof(he_cap->he_mcs_nss_supp),
1831 &he_cap->he_mcs_nss_supp) ||
1832 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
1833 sizeof(he_cap->ppe_thres), he_cap->ppe_thres))
1834 return -ENOBUFS;
1835 }
1836
1837 if (eht_cap->has_eht && he_cap->has_he) {
1838 u8 mcs_nss_size, ppe_thresh_size;
1839 u16 ppe_thres_hdr;
1840 bool is_ap;
1841
1842 is_ap = iftdata->types_mask & BIT(NL80211_IFTYPE_AP) ||
1843 iftdata->types_mask & BIT(NL80211_IFTYPE_P2P_GO);
1844
1845 mcs_nss_size =
1846 ieee80211_eht_mcs_nss_size(&he_cap->he_cap_elem,
1847 &eht_cap->eht_cap_elem,
1848 is_ap);
1849
1850 ppe_thres_hdr = get_unaligned_le16(&eht_cap->eht_ppe_thres[0]);
1851 ppe_thresh_size =
1852 ieee80211_eht_ppe_size(ppe_thres_hdr,
1853 eht_cap->eht_cap_elem.phy_cap_info);
1854
1855 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MAC,
1856 sizeof(eht_cap->eht_cap_elem.mac_cap_info),
1857 eht_cap->eht_cap_elem.mac_cap_info) ||
1858 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PHY,
1859 sizeof(eht_cap->eht_cap_elem.phy_cap_info),
1860 eht_cap->eht_cap_elem.phy_cap_info) ||
1861 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MCS_SET,
1862 mcs_nss_size, &eht_cap->eht_mcs_nss_supp) ||
1863 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PPE,
1864 ppe_thresh_size, eht_cap->eht_ppe_thres))
1865 return -ENOBUFS;
1866 }
1867
1868 if (sband->band == NL80211_BAND_6GHZ &&
1869 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_6GHZ_CAPA,
1870 sizeof(iftdata->he_6ghz_capa),
1871 &iftdata->he_6ghz_capa))
1872 return -ENOBUFS;
1873
1874 if (iftdata->vendor_elems.data && iftdata->vendor_elems.len &&
1875 nla_put(msg, NL80211_BAND_IFTYPE_ATTR_VENDOR_ELEMS,
1876 iftdata->vendor_elems.len, iftdata->vendor_elems.data))
1877 return -ENOBUFS;
1878
1879 return 0;
1880 }
1881
nl80211_send_band_rateinfo(struct sk_buff * msg,struct ieee80211_supported_band * sband,bool large)1882 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1883 struct ieee80211_supported_band *sband,
1884 bool large)
1885 {
1886 struct nlattr *nl_rates, *nl_rate;
1887 struct ieee80211_rate *rate;
1888 int i;
1889
1890 /* add HT info */
1891 if (sband->ht_cap.ht_supported &&
1892 (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1893 sizeof(sband->ht_cap.mcs),
1894 &sband->ht_cap.mcs) ||
1895 nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1896 sband->ht_cap.cap) ||
1897 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1898 sband->ht_cap.ampdu_factor) ||
1899 nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1900 sband->ht_cap.ampdu_density)))
1901 return -ENOBUFS;
1902
1903 /* add VHT info */
1904 if (sband->vht_cap.vht_supported &&
1905 (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1906 sizeof(sband->vht_cap.vht_mcs),
1907 &sband->vht_cap.vht_mcs) ||
1908 nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1909 sband->vht_cap.cap)))
1910 return -ENOBUFS;
1911
1912 if (large && sband->n_iftype_data) {
1913 struct nlattr *nl_iftype_data =
1914 nla_nest_start_noflag(msg,
1915 NL80211_BAND_ATTR_IFTYPE_DATA);
1916 int err;
1917
1918 if (!nl_iftype_data)
1919 return -ENOBUFS;
1920
1921 for (i = 0; i < sband->n_iftype_data; i++) {
1922 struct nlattr *iftdata;
1923
1924 iftdata = nla_nest_start_noflag(msg, i + 1);
1925 if (!iftdata)
1926 return -ENOBUFS;
1927
1928 err = nl80211_send_iftype_data(msg, sband,
1929 &sband->iftype_data[i]);
1930 if (err)
1931 return err;
1932
1933 nla_nest_end(msg, iftdata);
1934 }
1935
1936 nla_nest_end(msg, nl_iftype_data);
1937 }
1938
1939 /* add EDMG info */
1940 if (large && sband->edmg_cap.channels &&
1941 (nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_CHANNELS,
1942 sband->edmg_cap.channels) ||
1943 nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_BW_CONFIG,
1944 sband->edmg_cap.bw_config)))
1945
1946 return -ENOBUFS;
1947
1948 /* add bitrates */
1949 nl_rates = nla_nest_start_noflag(msg, NL80211_BAND_ATTR_RATES);
1950 if (!nl_rates)
1951 return -ENOBUFS;
1952
1953 for (i = 0; i < sband->n_bitrates; i++) {
1954 nl_rate = nla_nest_start_noflag(msg, i);
1955 if (!nl_rate)
1956 return -ENOBUFS;
1957
1958 rate = &sband->bitrates[i];
1959 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1960 rate->bitrate))
1961 return -ENOBUFS;
1962 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1963 nla_put_flag(msg,
1964 NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1965 return -ENOBUFS;
1966
1967 nla_nest_end(msg, nl_rate);
1968 }
1969
1970 nla_nest_end(msg, nl_rates);
1971
1972 /* S1G capabilities */
1973 if (sband->band == NL80211_BAND_S1GHZ && sband->s1g_cap.s1g &&
1974 (nla_put(msg, NL80211_BAND_ATTR_S1G_CAPA,
1975 sizeof(sband->s1g_cap.cap),
1976 sband->s1g_cap.cap) ||
1977 nla_put(msg, NL80211_BAND_ATTR_S1G_MCS_NSS_SET,
1978 sizeof(sband->s1g_cap.nss_mcs),
1979 sband->s1g_cap.nss_mcs)))
1980 return -ENOBUFS;
1981
1982 return 0;
1983 }
1984
1985 static int
nl80211_send_mgmt_stypes(struct sk_buff * msg,const struct ieee80211_txrx_stypes * mgmt_stypes)1986 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1987 const struct ieee80211_txrx_stypes *mgmt_stypes)
1988 {
1989 u16 stypes;
1990 struct nlattr *nl_ftypes, *nl_ifs;
1991 enum nl80211_iftype ift;
1992 int i;
1993
1994 if (!mgmt_stypes)
1995 return 0;
1996
1997 nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_TX_FRAME_TYPES);
1998 if (!nl_ifs)
1999 return -ENOBUFS;
2000
2001 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
2002 nl_ftypes = nla_nest_start_noflag(msg, ift);
2003 if (!nl_ftypes)
2004 return -ENOBUFS;
2005 i = 0;
2006 stypes = mgmt_stypes[ift].tx;
2007 while (stypes) {
2008 if ((stypes & 1) &&
2009 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
2010 (i << 4) | IEEE80211_FTYPE_MGMT))
2011 return -ENOBUFS;
2012 stypes >>= 1;
2013 i++;
2014 }
2015 nla_nest_end(msg, nl_ftypes);
2016 }
2017
2018 nla_nest_end(msg, nl_ifs);
2019
2020 nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_RX_FRAME_TYPES);
2021 if (!nl_ifs)
2022 return -ENOBUFS;
2023
2024 for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
2025 nl_ftypes = nla_nest_start_noflag(msg, ift);
2026 if (!nl_ftypes)
2027 return -ENOBUFS;
2028 i = 0;
2029 stypes = mgmt_stypes[ift].rx;
2030 while (stypes) {
2031 if ((stypes & 1) &&
2032 nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
2033 (i << 4) | IEEE80211_FTYPE_MGMT))
2034 return -ENOBUFS;
2035 stypes >>= 1;
2036 i++;
2037 }
2038 nla_nest_end(msg, nl_ftypes);
2039 }
2040 nla_nest_end(msg, nl_ifs);
2041
2042 return 0;
2043 }
2044
2045 #define CMD(op, n) \
2046 do { \
2047 if (rdev->ops->op) { \
2048 i++; \
2049 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
2050 goto nla_put_failure; \
2051 } \
2052 } while (0)
2053
nl80211_add_commands_unsplit(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2054 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
2055 struct sk_buff *msg)
2056 {
2057 int i = 0;
2058
2059 /*
2060 * do *NOT* add anything into this function, new things need to be
2061 * advertised only to new versions of userspace that can deal with
2062 * the split (and they can't possibly care about new features...
2063 */
2064 CMD(add_virtual_intf, NEW_INTERFACE);
2065 CMD(change_virtual_intf, SET_INTERFACE);
2066 CMD(add_key, NEW_KEY);
2067 CMD(start_ap, START_AP);
2068 CMD(add_station, NEW_STATION);
2069 CMD(add_mpath, NEW_MPATH);
2070 CMD(update_mesh_config, SET_MESH_CONFIG);
2071 CMD(change_bss, SET_BSS);
2072 CMD(auth, AUTHENTICATE);
2073 CMD(assoc, ASSOCIATE);
2074 CMD(deauth, DEAUTHENTICATE);
2075 CMD(disassoc, DISASSOCIATE);
2076 CMD(join_ibss, JOIN_IBSS);
2077 CMD(join_mesh, JOIN_MESH);
2078 CMD(set_pmksa, SET_PMKSA);
2079 CMD(del_pmksa, DEL_PMKSA);
2080 CMD(flush_pmksa, FLUSH_PMKSA);
2081 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
2082 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
2083 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
2084 CMD(mgmt_tx, FRAME);
2085 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
2086 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
2087 i++;
2088 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
2089 goto nla_put_failure;
2090 }
2091 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
2092 rdev->ops->join_mesh) {
2093 i++;
2094 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
2095 goto nla_put_failure;
2096 }
2097 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
2098 CMD(tdls_mgmt, TDLS_MGMT);
2099 CMD(tdls_oper, TDLS_OPER);
2100 }
2101 if (rdev->wiphy.max_sched_scan_reqs)
2102 CMD(sched_scan_start, START_SCHED_SCAN);
2103 CMD(probe_client, PROBE_CLIENT);
2104 CMD(set_noack_map, SET_NOACK_MAP);
2105 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
2106 i++;
2107 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
2108 goto nla_put_failure;
2109 }
2110 CMD(start_p2p_device, START_P2P_DEVICE);
2111 CMD(set_mcast_rate, SET_MCAST_RATE);
2112 #ifdef CONFIG_NL80211_TESTMODE
2113 CMD(testmode_cmd, TESTMODE);
2114 #endif
2115
2116 if (rdev->ops->connect || rdev->ops->auth) {
2117 i++;
2118 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
2119 goto nla_put_failure;
2120 }
2121
2122 if (rdev->ops->disconnect || rdev->ops->deauth) {
2123 i++;
2124 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
2125 goto nla_put_failure;
2126 }
2127
2128 return i;
2129 nla_put_failure:
2130 return -ENOBUFS;
2131 }
2132
2133 static int
nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities * cap,struct sk_buff * msg)2134 nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap,
2135 struct sk_buff *msg)
2136 {
2137 struct nlattr *ftm;
2138
2139 if (!cap->ftm.supported)
2140 return 0;
2141
2142 ftm = nla_nest_start_noflag(msg, NL80211_PMSR_TYPE_FTM);
2143 if (!ftm)
2144 return -ENOBUFS;
2145
2146 if (cap->ftm.asap && nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_ASAP))
2147 return -ENOBUFS;
2148 if (cap->ftm.non_asap &&
2149 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP))
2150 return -ENOBUFS;
2151 if (cap->ftm.request_lci &&
2152 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI))
2153 return -ENOBUFS;
2154 if (cap->ftm.request_civicloc &&
2155 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC))
2156 return -ENOBUFS;
2157 if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES,
2158 cap->ftm.preambles))
2159 return -ENOBUFS;
2160 if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS,
2161 cap->ftm.bandwidths))
2162 return -ENOBUFS;
2163 if (cap->ftm.max_bursts_exponent >= 0 &&
2164 nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT,
2165 cap->ftm.max_bursts_exponent))
2166 return -ENOBUFS;
2167 if (cap->ftm.max_ftms_per_burst &&
2168 nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST,
2169 cap->ftm.max_ftms_per_burst))
2170 return -ENOBUFS;
2171 if (cap->ftm.trigger_based &&
2172 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED))
2173 return -ENOBUFS;
2174 if (cap->ftm.non_trigger_based &&
2175 nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED))
2176 return -ENOBUFS;
2177
2178 nla_nest_end(msg, ftm);
2179 return 0;
2180 }
2181
nl80211_send_pmsr_capa(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2182 static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,
2183 struct sk_buff *msg)
2184 {
2185 const struct cfg80211_pmsr_capabilities *cap = rdev->wiphy.pmsr_capa;
2186 struct nlattr *pmsr, *caps;
2187
2188 if (!cap)
2189 return 0;
2190
2191 /*
2192 * we don't need to clean up anything here since the caller
2193 * will genlmsg_cancel() if we fail
2194 */
2195
2196 pmsr = nla_nest_start_noflag(msg, NL80211_ATTR_PEER_MEASUREMENTS);
2197 if (!pmsr)
2198 return -ENOBUFS;
2199
2200 if (nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEERS, cap->max_peers))
2201 return -ENOBUFS;
2202
2203 if (cap->report_ap_tsf &&
2204 nla_put_flag(msg, NL80211_PMSR_ATTR_REPORT_AP_TSF))
2205 return -ENOBUFS;
2206
2207 if (cap->randomize_mac_addr &&
2208 nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR))
2209 return -ENOBUFS;
2210
2211 caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA);
2212 if (!caps)
2213 return -ENOBUFS;
2214
2215 if (nl80211_send_pmsr_ftm_capa(cap, msg))
2216 return -ENOBUFS;
2217
2218 nla_nest_end(msg, caps);
2219 nla_nest_end(msg, pmsr);
2220
2221 return 0;
2222 }
2223
2224 static int
nl80211_put_iftype_akm_suites(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2225 nl80211_put_iftype_akm_suites(struct cfg80211_registered_device *rdev,
2226 struct sk_buff *msg)
2227 {
2228 int i;
2229 struct nlattr *nested, *nested_akms;
2230 const struct wiphy_iftype_akm_suites *iftype_akms;
2231
2232 if (!rdev->wiphy.num_iftype_akm_suites ||
2233 !rdev->wiphy.iftype_akm_suites)
2234 return 0;
2235
2236 nested = nla_nest_start(msg, NL80211_ATTR_IFTYPE_AKM_SUITES);
2237 if (!nested)
2238 return -ENOBUFS;
2239
2240 for (i = 0; i < rdev->wiphy.num_iftype_akm_suites; i++) {
2241 nested_akms = nla_nest_start(msg, i + 1);
2242 if (!nested_akms)
2243 return -ENOBUFS;
2244
2245 iftype_akms = &rdev->wiphy.iftype_akm_suites[i];
2246
2247 if (nl80211_put_iftypes(msg, NL80211_IFTYPE_AKM_ATTR_IFTYPES,
2248 iftype_akms->iftypes_mask))
2249 return -ENOBUFS;
2250
2251 if (nla_put(msg, NL80211_IFTYPE_AKM_ATTR_SUITES,
2252 sizeof(u32) * iftype_akms->n_akm_suites,
2253 iftype_akms->akm_suites)) {
2254 return -ENOBUFS;
2255 }
2256 nla_nest_end(msg, nested_akms);
2257 }
2258
2259 nla_nest_end(msg, nested);
2260
2261 return 0;
2262 }
2263
2264 static int
nl80211_put_tid_config_support(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2265 nl80211_put_tid_config_support(struct cfg80211_registered_device *rdev,
2266 struct sk_buff *msg)
2267 {
2268 struct nlattr *supp;
2269
2270 if (!rdev->wiphy.tid_config_support.vif &&
2271 !rdev->wiphy.tid_config_support.peer)
2272 return 0;
2273
2274 supp = nla_nest_start(msg, NL80211_ATTR_TID_CONFIG);
2275 if (!supp)
2276 return -ENOSPC;
2277
2278 if (rdev->wiphy.tid_config_support.vif &&
2279 nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_VIF_SUPP,
2280 rdev->wiphy.tid_config_support.vif,
2281 NL80211_TID_CONFIG_ATTR_PAD))
2282 goto fail;
2283
2284 if (rdev->wiphy.tid_config_support.peer &&
2285 nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_PEER_SUPP,
2286 rdev->wiphy.tid_config_support.peer,
2287 NL80211_TID_CONFIG_ATTR_PAD))
2288 goto fail;
2289
2290 /* for now we just use the same value ... makes more sense */
2291 if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_SHORT,
2292 rdev->wiphy.tid_config_support.max_retry))
2293 goto fail;
2294 if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_LONG,
2295 rdev->wiphy.tid_config_support.max_retry))
2296 goto fail;
2297
2298 nla_nest_end(msg, supp);
2299
2300 return 0;
2301 fail:
2302 nla_nest_cancel(msg, supp);
2303 return -ENOBUFS;
2304 }
2305
2306 static int
nl80211_put_sar_specs(struct cfg80211_registered_device * rdev,struct sk_buff * msg)2307 nl80211_put_sar_specs(struct cfg80211_registered_device *rdev,
2308 struct sk_buff *msg)
2309 {
2310 struct nlattr *sar_capa, *specs, *sub_freq_range;
2311 u8 num_freq_ranges;
2312 int i;
2313
2314 if (!rdev->wiphy.sar_capa)
2315 return 0;
2316
2317 num_freq_ranges = rdev->wiphy.sar_capa->num_freq_ranges;
2318
2319 sar_capa = nla_nest_start(msg, NL80211_ATTR_SAR_SPEC);
2320 if (!sar_capa)
2321 return -ENOSPC;
2322
2323 if (nla_put_u32(msg, NL80211_SAR_ATTR_TYPE, rdev->wiphy.sar_capa->type))
2324 goto fail;
2325
2326 specs = nla_nest_start(msg, NL80211_SAR_ATTR_SPECS);
2327 if (!specs)
2328 goto fail;
2329
2330 /* report supported freq_ranges */
2331 for (i = 0; i < num_freq_ranges; i++) {
2332 sub_freq_range = nla_nest_start(msg, i + 1);
2333 if (!sub_freq_range)
2334 goto fail;
2335
2336 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_START_FREQ,
2337 rdev->wiphy.sar_capa->freq_ranges[i].start_freq))
2338 goto fail;
2339
2340 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_END_FREQ,
2341 rdev->wiphy.sar_capa->freq_ranges[i].end_freq))
2342 goto fail;
2343
2344 nla_nest_end(msg, sub_freq_range);
2345 }
2346
2347 nla_nest_end(msg, specs);
2348 nla_nest_end(msg, sar_capa);
2349
2350 return 0;
2351 fail:
2352 nla_nest_cancel(msg, sar_capa);
2353 return -ENOBUFS;
2354 }
2355
nl80211_put_mbssid_support(struct wiphy * wiphy,struct sk_buff * msg)2356 static int nl80211_put_mbssid_support(struct wiphy *wiphy, struct sk_buff *msg)
2357 {
2358 struct nlattr *config;
2359
2360 if (!wiphy->mbssid_max_interfaces)
2361 return 0;
2362
2363 config = nla_nest_start(msg, NL80211_ATTR_MBSSID_CONFIG);
2364 if (!config)
2365 return -ENOBUFS;
2366
2367 if (nla_put_u8(msg, NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES,
2368 wiphy->mbssid_max_interfaces))
2369 goto fail;
2370
2371 if (wiphy->ema_max_profile_periodicity &&
2372 nla_put_u8(msg,
2373 NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY,
2374 wiphy->ema_max_profile_periodicity))
2375 goto fail;
2376
2377 nla_nest_end(msg, config);
2378 return 0;
2379
2380 fail:
2381 nla_nest_cancel(msg, config);
2382 return -ENOBUFS;
2383 }
2384
2385 struct nl80211_dump_wiphy_state {
2386 s64 filter_wiphy;
2387 long start;
2388 long split_start, band_start, chan_start, capa_start;
2389 bool split;
2390 };
2391
nl80211_send_wiphy(struct cfg80211_registered_device * rdev,enum nl80211_commands cmd,struct sk_buff * msg,u32 portid,u32 seq,int flags,struct nl80211_dump_wiphy_state * state)2392 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
2393 enum nl80211_commands cmd,
2394 struct sk_buff *msg, u32 portid, u32 seq,
2395 int flags, struct nl80211_dump_wiphy_state *state)
2396 {
2397 void *hdr;
2398 struct nlattr *nl_bands, *nl_band;
2399 struct nlattr *nl_freqs, *nl_freq;
2400 struct nlattr *nl_cmds;
2401 enum nl80211_band band;
2402 struct ieee80211_channel *chan;
2403 int i;
2404 const struct ieee80211_txrx_stypes *mgmt_stypes =
2405 rdev->wiphy.mgmt_stypes;
2406 u32 features;
2407
2408 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2409 if (!hdr)
2410 return -ENOBUFS;
2411
2412 if (WARN_ON(!state))
2413 return -EINVAL;
2414
2415 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2416 nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
2417 wiphy_name(&rdev->wiphy)) ||
2418 nla_put_u32(msg, NL80211_ATTR_GENERATION,
2419 cfg80211_rdev_list_generation))
2420 goto nla_put_failure;
2421
2422 if (cmd != NL80211_CMD_NEW_WIPHY)
2423 goto finish;
2424
2425 switch (state->split_start) {
2426 case 0:
2427 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
2428 rdev->wiphy.retry_short) ||
2429 nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
2430 rdev->wiphy.retry_long) ||
2431 nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
2432 rdev->wiphy.frag_threshold) ||
2433 nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
2434 rdev->wiphy.rts_threshold) ||
2435 nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
2436 rdev->wiphy.coverage_class) ||
2437 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
2438 rdev->wiphy.max_scan_ssids) ||
2439 nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
2440 rdev->wiphy.max_sched_scan_ssids) ||
2441 nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
2442 rdev->wiphy.max_scan_ie_len) ||
2443 nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
2444 rdev->wiphy.max_sched_scan_ie_len) ||
2445 nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
2446 rdev->wiphy.max_match_sets))
2447 goto nla_put_failure;
2448
2449 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
2450 nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
2451 goto nla_put_failure;
2452 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
2453 nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
2454 goto nla_put_failure;
2455 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
2456 nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
2457 goto nla_put_failure;
2458 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
2459 nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
2460 goto nla_put_failure;
2461 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
2462 nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
2463 goto nla_put_failure;
2464 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
2465 nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
2466 goto nla_put_failure;
2467 state->split_start++;
2468 if (state->split)
2469 break;
2470 fallthrough;
2471 case 1:
2472 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
2473 sizeof(u32) * rdev->wiphy.n_cipher_suites,
2474 rdev->wiphy.cipher_suites))
2475 goto nla_put_failure;
2476
2477 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
2478 rdev->wiphy.max_num_pmkids))
2479 goto nla_put_failure;
2480
2481 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
2482 nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
2483 goto nla_put_failure;
2484
2485 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
2486 rdev->wiphy.available_antennas_tx) ||
2487 nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
2488 rdev->wiphy.available_antennas_rx))
2489 goto nla_put_failure;
2490
2491 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
2492 nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
2493 rdev->wiphy.probe_resp_offload))
2494 goto nla_put_failure;
2495
2496 if ((rdev->wiphy.available_antennas_tx ||
2497 rdev->wiphy.available_antennas_rx) &&
2498 rdev->ops->get_antenna) {
2499 u32 tx_ant = 0, rx_ant = 0;
2500 int res;
2501
2502 res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
2503 if (!res) {
2504 if (nla_put_u32(msg,
2505 NL80211_ATTR_WIPHY_ANTENNA_TX,
2506 tx_ant) ||
2507 nla_put_u32(msg,
2508 NL80211_ATTR_WIPHY_ANTENNA_RX,
2509 rx_ant))
2510 goto nla_put_failure;
2511 }
2512 }
2513
2514 state->split_start++;
2515 if (state->split)
2516 break;
2517 fallthrough;
2518 case 2:
2519 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
2520 rdev->wiphy.interface_modes))
2521 goto nla_put_failure;
2522 state->split_start++;
2523 if (state->split)
2524 break;
2525 fallthrough;
2526 case 3:
2527 nl_bands = nla_nest_start_noflag(msg,
2528 NL80211_ATTR_WIPHY_BANDS);
2529 if (!nl_bands)
2530 goto nla_put_failure;
2531
2532 for (band = state->band_start;
2533 band < (state->split ?
2534 NUM_NL80211_BANDS :
2535 NL80211_BAND_60GHZ + 1);
2536 band++) {
2537 struct ieee80211_supported_band *sband;
2538
2539 /* omit higher bands for ancient software */
2540 if (band > NL80211_BAND_5GHZ && !state->split)
2541 break;
2542
2543 sband = rdev->wiphy.bands[band];
2544
2545 if (!sband)
2546 continue;
2547
2548 nl_band = nla_nest_start_noflag(msg, band);
2549 if (!nl_band)
2550 goto nla_put_failure;
2551
2552 switch (state->chan_start) {
2553 case 0:
2554 if (nl80211_send_band_rateinfo(msg, sband,
2555 state->split))
2556 goto nla_put_failure;
2557 state->chan_start++;
2558 if (state->split)
2559 break;
2560 fallthrough;
2561 default:
2562 /* add frequencies */
2563 nl_freqs = nla_nest_start_noflag(msg,
2564 NL80211_BAND_ATTR_FREQS);
2565 if (!nl_freqs)
2566 goto nla_put_failure;
2567
2568 for (i = state->chan_start - 1;
2569 i < sband->n_channels;
2570 i++) {
2571 nl_freq = nla_nest_start_noflag(msg,
2572 i);
2573 if (!nl_freq)
2574 goto nla_put_failure;
2575
2576 chan = &sband->channels[i];
2577
2578 if (nl80211_msg_put_channel(
2579 msg, &rdev->wiphy, chan,
2580 state->split))
2581 goto nla_put_failure;
2582
2583 nla_nest_end(msg, nl_freq);
2584 if (state->split)
2585 break;
2586 }
2587 if (i < sband->n_channels)
2588 state->chan_start = i + 2;
2589 else
2590 state->chan_start = 0;
2591 nla_nest_end(msg, nl_freqs);
2592 }
2593
2594 nla_nest_end(msg, nl_band);
2595
2596 if (state->split) {
2597 /* start again here */
2598 if (state->chan_start)
2599 band--;
2600 break;
2601 }
2602 }
2603 nla_nest_end(msg, nl_bands);
2604
2605 if (band < NUM_NL80211_BANDS)
2606 state->band_start = band + 1;
2607 else
2608 state->band_start = 0;
2609
2610 /* if bands & channels are done, continue outside */
2611 if (state->band_start == 0 && state->chan_start == 0)
2612 state->split_start++;
2613 if (state->split)
2614 break;
2615 fallthrough;
2616 case 4:
2617 nl_cmds = nla_nest_start_noflag(msg,
2618 NL80211_ATTR_SUPPORTED_COMMANDS);
2619 if (!nl_cmds)
2620 goto nla_put_failure;
2621
2622 i = nl80211_add_commands_unsplit(rdev, msg);
2623 if (i < 0)
2624 goto nla_put_failure;
2625 if (state->split) {
2626 CMD(crit_proto_start, CRIT_PROTOCOL_START);
2627 CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
2628 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
2629 CMD(channel_switch, CHANNEL_SWITCH);
2630 CMD(set_qos_map, SET_QOS_MAP);
2631 if (rdev->wiphy.features &
2632 NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
2633 CMD(add_tx_ts, ADD_TX_TS);
2634 CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
2635 CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
2636 CMD(update_ft_ies, UPDATE_FT_IES);
2637 if (rdev->wiphy.sar_capa)
2638 CMD(set_sar_specs, SET_SAR_SPECS);
2639 }
2640 #undef CMD
2641
2642 nla_nest_end(msg, nl_cmds);
2643 state->split_start++;
2644 if (state->split)
2645 break;
2646 fallthrough;
2647 case 5:
2648 if (rdev->ops->remain_on_channel &&
2649 (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
2650 nla_put_u32(msg,
2651 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
2652 rdev->wiphy.max_remain_on_channel_duration))
2653 goto nla_put_failure;
2654
2655 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
2656 nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
2657 goto nla_put_failure;
2658
2659 state->split_start++;
2660 if (state->split)
2661 break;
2662 fallthrough;
2663 case 6:
2664 #ifdef CONFIG_PM
2665 if (nl80211_send_wowlan(msg, rdev, state->split))
2666 goto nla_put_failure;
2667 state->split_start++;
2668 if (state->split)
2669 break;
2670 #else
2671 state->split_start++;
2672 #endif
2673 fallthrough;
2674 case 7:
2675 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
2676 rdev->wiphy.software_iftypes))
2677 goto nla_put_failure;
2678
2679 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
2680 state->split))
2681 goto nla_put_failure;
2682
2683 state->split_start++;
2684 if (state->split)
2685 break;
2686 fallthrough;
2687 case 8:
2688 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
2689 nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
2690 rdev->wiphy.ap_sme_capa))
2691 goto nla_put_failure;
2692
2693 features = rdev->wiphy.features;
2694 /*
2695 * We can only add the per-channel limit information if the
2696 * dump is split, otherwise it makes it too big. Therefore
2697 * only advertise it in that case.
2698 */
2699 if (state->split)
2700 features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
2701 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
2702 goto nla_put_failure;
2703
2704 if (rdev->wiphy.ht_capa_mod_mask &&
2705 nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
2706 sizeof(*rdev->wiphy.ht_capa_mod_mask),
2707 rdev->wiphy.ht_capa_mod_mask))
2708 goto nla_put_failure;
2709
2710 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
2711 rdev->wiphy.max_acl_mac_addrs &&
2712 nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
2713 rdev->wiphy.max_acl_mac_addrs))
2714 goto nla_put_failure;
2715
2716 /*
2717 * Any information below this point is only available to
2718 * applications that can deal with it being split. This
2719 * helps ensure that newly added capabilities don't break
2720 * older tools by overrunning their buffers.
2721 *
2722 * We still increment split_start so that in the split
2723 * case we'll continue with more data in the next round,
2724 * but break unconditionally so unsplit data stops here.
2725 */
2726 if (state->split)
2727 state->split_start++;
2728 else
2729 state->split_start = 0;
2730 break;
2731 case 9:
2732 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
2733 goto nla_put_failure;
2734
2735 if (nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
2736 rdev->wiphy.max_sched_scan_plans) ||
2737 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
2738 rdev->wiphy.max_sched_scan_plan_interval) ||
2739 nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
2740 rdev->wiphy.max_sched_scan_plan_iterations))
2741 goto nla_put_failure;
2742
2743 if (rdev->wiphy.extended_capabilities &&
2744 (nla_put(msg, NL80211_ATTR_EXT_CAPA,
2745 rdev->wiphy.extended_capabilities_len,
2746 rdev->wiphy.extended_capabilities) ||
2747 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2748 rdev->wiphy.extended_capabilities_len,
2749 rdev->wiphy.extended_capabilities_mask)))
2750 goto nla_put_failure;
2751
2752 if (rdev->wiphy.vht_capa_mod_mask &&
2753 nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
2754 sizeof(*rdev->wiphy.vht_capa_mod_mask),
2755 rdev->wiphy.vht_capa_mod_mask))
2756 goto nla_put_failure;
2757
2758 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
2759 rdev->wiphy.perm_addr))
2760 goto nla_put_failure;
2761
2762 if (!is_zero_ether_addr(rdev->wiphy.addr_mask) &&
2763 nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
2764 rdev->wiphy.addr_mask))
2765 goto nla_put_failure;
2766
2767 if (rdev->wiphy.n_addresses > 1) {
2768 void *attr;
2769
2770 attr = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS);
2771 if (!attr)
2772 goto nla_put_failure;
2773
2774 for (i = 0; i < rdev->wiphy.n_addresses; i++)
2775 if (nla_put(msg, i + 1, ETH_ALEN,
2776 rdev->wiphy.addresses[i].addr))
2777 goto nla_put_failure;
2778
2779 nla_nest_end(msg, attr);
2780 }
2781
2782 state->split_start++;
2783 break;
2784 case 10:
2785 if (nl80211_send_coalesce(msg, rdev))
2786 goto nla_put_failure;
2787
2788 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
2789 (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
2790 nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
2791 goto nla_put_failure;
2792
2793 if (rdev->wiphy.max_ap_assoc_sta &&
2794 nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
2795 rdev->wiphy.max_ap_assoc_sta))
2796 goto nla_put_failure;
2797
2798 state->split_start++;
2799 break;
2800 case 11:
2801 if (rdev->wiphy.n_vendor_commands) {
2802 const struct nl80211_vendor_cmd_info *info;
2803 struct nlattr *nested;
2804
2805 nested = nla_nest_start_noflag(msg,
2806 NL80211_ATTR_VENDOR_DATA);
2807 if (!nested)
2808 goto nla_put_failure;
2809
2810 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
2811 info = &rdev->wiphy.vendor_commands[i].info;
2812 if (nla_put(msg, i + 1, sizeof(*info), info))
2813 goto nla_put_failure;
2814 }
2815 nla_nest_end(msg, nested);
2816 }
2817
2818 if (rdev->wiphy.n_vendor_events) {
2819 const struct nl80211_vendor_cmd_info *info;
2820 struct nlattr *nested;
2821
2822 nested = nla_nest_start_noflag(msg,
2823 NL80211_ATTR_VENDOR_EVENTS);
2824 if (!nested)
2825 goto nla_put_failure;
2826
2827 for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
2828 info = &rdev->wiphy.vendor_events[i];
2829 if (nla_put(msg, i + 1, sizeof(*info), info))
2830 goto nla_put_failure;
2831 }
2832 nla_nest_end(msg, nested);
2833 }
2834 state->split_start++;
2835 break;
2836 case 12:
2837 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
2838 nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
2839 rdev->wiphy.max_num_csa_counters))
2840 goto nla_put_failure;
2841
2842 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
2843 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
2844 goto nla_put_failure;
2845
2846 if (rdev->wiphy.max_sched_scan_reqs &&
2847 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
2848 rdev->wiphy.max_sched_scan_reqs))
2849 goto nla_put_failure;
2850
2851 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
2852 sizeof(rdev->wiphy.ext_features),
2853 rdev->wiphy.ext_features))
2854 goto nla_put_failure;
2855
2856 if (rdev->wiphy.bss_select_support) {
2857 struct nlattr *nested;
2858 u32 bss_select_support = rdev->wiphy.bss_select_support;
2859
2860 nested = nla_nest_start_noflag(msg,
2861 NL80211_ATTR_BSS_SELECT);
2862 if (!nested)
2863 goto nla_put_failure;
2864
2865 i = 0;
2866 while (bss_select_support) {
2867 if ((bss_select_support & 1) &&
2868 nla_put_flag(msg, i))
2869 goto nla_put_failure;
2870 i++;
2871 bss_select_support >>= 1;
2872 }
2873 nla_nest_end(msg, nested);
2874 }
2875
2876 state->split_start++;
2877 break;
2878 case 13:
2879 if (rdev->wiphy.num_iftype_ext_capab &&
2880 rdev->wiphy.iftype_ext_capab) {
2881 struct nlattr *nested_ext_capab, *nested;
2882
2883 nested = nla_nest_start_noflag(msg,
2884 NL80211_ATTR_IFTYPE_EXT_CAPA);
2885 if (!nested)
2886 goto nla_put_failure;
2887
2888 for (i = state->capa_start;
2889 i < rdev->wiphy.num_iftype_ext_capab; i++) {
2890 const struct wiphy_iftype_ext_capab *capab;
2891
2892 capab = &rdev->wiphy.iftype_ext_capab[i];
2893
2894 nested_ext_capab = nla_nest_start_noflag(msg,
2895 i);
2896 if (!nested_ext_capab ||
2897 nla_put_u32(msg, NL80211_ATTR_IFTYPE,
2898 capab->iftype) ||
2899 nla_put(msg, NL80211_ATTR_EXT_CAPA,
2900 capab->extended_capabilities_len,
2901 capab->extended_capabilities) ||
2902 nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2903 capab->extended_capabilities_len,
2904 capab->extended_capabilities_mask))
2905 goto nla_put_failure;
2906
2907 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO &&
2908 (nla_put_u16(msg,
2909 NL80211_ATTR_EML_CAPABILITY,
2910 capab->eml_capabilities) ||
2911 nla_put_u16(msg,
2912 NL80211_ATTR_MLD_CAPA_AND_OPS,
2913 capab->mld_capa_and_ops)))
2914 goto nla_put_failure;
2915
2916 nla_nest_end(msg, nested_ext_capab);
2917 if (state->split)
2918 break;
2919 }
2920 nla_nest_end(msg, nested);
2921 if (i < rdev->wiphy.num_iftype_ext_capab) {
2922 state->capa_start = i + 1;
2923 break;
2924 }
2925 }
2926
2927 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
2928 rdev->wiphy.nan_supported_bands))
2929 goto nla_put_failure;
2930
2931 if (wiphy_ext_feature_isset(&rdev->wiphy,
2932 NL80211_EXT_FEATURE_TXQS)) {
2933 struct cfg80211_txq_stats txqstats = {};
2934 int res;
2935
2936 res = rdev_get_txq_stats(rdev, NULL, &txqstats);
2937 if (!res &&
2938 !nl80211_put_txq_stats(msg, &txqstats,
2939 NL80211_ATTR_TXQ_STATS))
2940 goto nla_put_failure;
2941
2942 if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT,
2943 rdev->wiphy.txq_limit))
2944 goto nla_put_failure;
2945 if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT,
2946 rdev->wiphy.txq_memory_limit))
2947 goto nla_put_failure;
2948 if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM,
2949 rdev->wiphy.txq_quantum))
2950 goto nla_put_failure;
2951 }
2952
2953 state->split_start++;
2954 break;
2955 case 14:
2956 if (nl80211_send_pmsr_capa(rdev, msg))
2957 goto nla_put_failure;
2958
2959 state->split_start++;
2960 break;
2961 case 15:
2962 if (rdev->wiphy.akm_suites &&
2963 nla_put(msg, NL80211_ATTR_AKM_SUITES,
2964 sizeof(u32) * rdev->wiphy.n_akm_suites,
2965 rdev->wiphy.akm_suites))
2966 goto nla_put_failure;
2967
2968 if (nl80211_put_iftype_akm_suites(rdev, msg))
2969 goto nla_put_failure;
2970
2971 if (nl80211_put_tid_config_support(rdev, msg))
2972 goto nla_put_failure;
2973 state->split_start++;
2974 break;
2975 case 16:
2976 if (nl80211_put_sar_specs(rdev, msg))
2977 goto nla_put_failure;
2978
2979 if (nl80211_put_mbssid_support(&rdev->wiphy, msg))
2980 goto nla_put_failure;
2981
2982 if (nla_put_u16(msg, NL80211_ATTR_MAX_NUM_AKM_SUITES,
2983 rdev->wiphy.max_num_akm_suites))
2984 goto nla_put_failure;
2985
2986 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO)
2987 nla_put_flag(msg, NL80211_ATTR_MLO_SUPPORT);
2988
2989 if (rdev->wiphy.hw_timestamp_max_peers &&
2990 nla_put_u16(msg, NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS,
2991 rdev->wiphy.hw_timestamp_max_peers))
2992 goto nla_put_failure;
2993
2994 /* done */
2995 state->split_start = 0;
2996 break;
2997 }
2998 finish:
2999 genlmsg_end(msg, hdr);
3000 return 0;
3001
3002 nla_put_failure:
3003 genlmsg_cancel(msg, hdr);
3004 return -EMSGSIZE;
3005 }
3006
nl80211_dump_wiphy_parse(struct sk_buff * skb,struct netlink_callback * cb,struct nl80211_dump_wiphy_state * state)3007 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
3008 struct netlink_callback *cb,
3009 struct nl80211_dump_wiphy_state *state)
3010 {
3011 struct nlattr **tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
3012 int ret;
3013
3014 if (!tb)
3015 return -ENOMEM;
3016
3017 ret = nlmsg_parse_deprecated(cb->nlh,
3018 GENL_HDRLEN + nl80211_fam.hdrsize,
3019 tb, nl80211_fam.maxattr,
3020 nl80211_policy, NULL);
3021 /* ignore parse errors for backward compatibility */
3022 if (ret) {
3023 ret = 0;
3024 goto out;
3025 }
3026
3027 state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
3028 if (tb[NL80211_ATTR_WIPHY])
3029 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
3030 if (tb[NL80211_ATTR_WDEV])
3031 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
3032 if (tb[NL80211_ATTR_IFINDEX]) {
3033 struct net_device *netdev;
3034 struct cfg80211_registered_device *rdev;
3035 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
3036
3037 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
3038 if (!netdev) {
3039 ret = -ENODEV;
3040 goto out;
3041 }
3042 if (netdev->ieee80211_ptr) {
3043 rdev = wiphy_to_rdev(
3044 netdev->ieee80211_ptr->wiphy);
3045 state->filter_wiphy = rdev->wiphy_idx;
3046 }
3047 }
3048
3049 ret = 0;
3050 out:
3051 kfree(tb);
3052 return ret;
3053 }
3054
nl80211_dump_wiphy(struct sk_buff * skb,struct netlink_callback * cb)3055 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
3056 {
3057 int idx = 0, ret;
3058 struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
3059 struct cfg80211_registered_device *rdev;
3060
3061 rtnl_lock();
3062 if (!state) {
3063 state = kzalloc(sizeof(*state), GFP_KERNEL);
3064 if (!state) {
3065 rtnl_unlock();
3066 return -ENOMEM;
3067 }
3068 state->filter_wiphy = -1;
3069 ret = nl80211_dump_wiphy_parse(skb, cb, state);
3070 if (ret) {
3071 kfree(state);
3072 rtnl_unlock();
3073 return ret;
3074 }
3075 cb->args[0] = (long)state;
3076 }
3077
3078 list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
3079 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
3080 continue;
3081 if (++idx <= state->start)
3082 continue;
3083 if (state->filter_wiphy != -1 &&
3084 state->filter_wiphy != rdev->wiphy_idx)
3085 continue;
3086 wiphy_lock(&rdev->wiphy);
3087 /* attempt to fit multiple wiphy data chunks into the skb */
3088 do {
3089 ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
3090 skb,
3091 NETLINK_CB(cb->skb).portid,
3092 cb->nlh->nlmsg_seq,
3093 NLM_F_MULTI, state);
3094 if (ret < 0) {
3095 /*
3096 * If sending the wiphy data didn't fit (ENOBUFS
3097 * or EMSGSIZE returned), this SKB is still
3098 * empty (so it's not too big because another
3099 * wiphy dataset is already in the skb) and
3100 * we've not tried to adjust the dump allocation
3101 * yet ... then adjust the alloc size to be
3102 * bigger, and return 1 but with the empty skb.
3103 * This results in an empty message being RX'ed
3104 * in userspace, but that is ignored.
3105 *
3106 * We can then retry with the larger buffer.
3107 */
3108 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
3109 !skb->len && !state->split &&
3110 cb->min_dump_alloc < 4096) {
3111 cb->min_dump_alloc = 4096;
3112 state->split_start = 0;
3113 wiphy_unlock(&rdev->wiphy);
3114 rtnl_unlock();
3115 return 1;
3116 }
3117 idx--;
3118 break;
3119 }
3120 } while (state->split_start > 0);
3121 wiphy_unlock(&rdev->wiphy);
3122 break;
3123 }
3124 rtnl_unlock();
3125
3126 state->start = idx;
3127
3128 return skb->len;
3129 }
3130
nl80211_dump_wiphy_done(struct netlink_callback * cb)3131 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
3132 {
3133 kfree((void *)cb->args[0]);
3134 return 0;
3135 }
3136
nl80211_get_wiphy(struct sk_buff * skb,struct genl_info * info)3137 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
3138 {
3139 struct sk_buff *msg;
3140 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3141 struct nl80211_dump_wiphy_state state = {};
3142
3143 msg = nlmsg_new(4096, GFP_KERNEL);
3144 if (!msg)
3145 return -ENOMEM;
3146
3147 if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
3148 info->snd_portid, info->snd_seq, 0,
3149 &state) < 0) {
3150 nlmsg_free(msg);
3151 return -ENOBUFS;
3152 }
3153
3154 return genlmsg_reply(msg, info);
3155 }
3156
3157 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
3158 [NL80211_TXQ_ATTR_QUEUE] = { .type = NLA_U8 },
3159 [NL80211_TXQ_ATTR_TXOP] = { .type = NLA_U16 },
3160 [NL80211_TXQ_ATTR_CWMIN] = { .type = NLA_U16 },
3161 [NL80211_TXQ_ATTR_CWMAX] = { .type = NLA_U16 },
3162 [NL80211_TXQ_ATTR_AIFS] = { .type = NLA_U8 },
3163 };
3164
parse_txq_params(struct nlattr * tb[],struct ieee80211_txq_params * txq_params)3165 static int parse_txq_params(struct nlattr *tb[],
3166 struct ieee80211_txq_params *txq_params)
3167 {
3168 u8 ac;
3169
3170 if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
3171 !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
3172 !tb[NL80211_TXQ_ATTR_AIFS])
3173 return -EINVAL;
3174
3175 ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
3176 txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
3177 txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
3178 txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
3179 txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
3180
3181 if (ac >= NL80211_NUM_ACS)
3182 return -EINVAL;
3183 txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
3184 return 0;
3185 }
3186
nl80211_can_set_dev_channel(struct wireless_dev * wdev)3187 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
3188 {
3189 /*
3190 * You can only set the channel explicitly for some interfaces,
3191 * most have their channel managed via their respective
3192 * "establish a connection" command (connect, join, ...)
3193 *
3194 * For AP/GO and mesh mode, the channel can be set with the
3195 * channel userspace API, but is only stored and passed to the
3196 * low-level driver when the AP starts or the mesh is joined.
3197 * This is for backward compatibility, userspace can also give
3198 * the channel in the start-ap or join-mesh commands instead.
3199 *
3200 * Monitors are special as they are normally slaved to
3201 * whatever else is going on, so they have their own special
3202 * operation to set the monitor channel if possible.
3203 */
3204 return !wdev ||
3205 wdev->iftype == NL80211_IFTYPE_AP ||
3206 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
3207 wdev->iftype == NL80211_IFTYPE_MONITOR ||
3208 wdev->iftype == NL80211_IFTYPE_P2P_GO;
3209 }
3210
nl80211_parse_punct_bitmap(struct cfg80211_registered_device * rdev,struct genl_info * info,const struct cfg80211_chan_def * chandef,u16 * punct_bitmap)3211 static int nl80211_parse_punct_bitmap(struct cfg80211_registered_device *rdev,
3212 struct genl_info *info,
3213 const struct cfg80211_chan_def *chandef,
3214 u16 *punct_bitmap)
3215 {
3216 if (!wiphy_ext_feature_isset(&rdev->wiphy, NL80211_EXT_FEATURE_PUNCT))
3217 return -EINVAL;
3218
3219 *punct_bitmap = nla_get_u32(info->attrs[NL80211_ATTR_PUNCT_BITMAP]);
3220 if (!cfg80211_valid_disable_subchannel_bitmap(punct_bitmap, chandef))
3221 return -EINVAL;
3222
3223 return 0;
3224 }
3225
nl80211_parse_chandef(struct cfg80211_registered_device * rdev,struct genl_info * info,struct cfg80211_chan_def * chandef)3226 int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
3227 struct genl_info *info,
3228 struct cfg80211_chan_def *chandef)
3229 {
3230 struct netlink_ext_ack *extack = info->extack;
3231 struct nlattr **attrs = info->attrs;
3232 u32 control_freq;
3233
3234 if (!attrs[NL80211_ATTR_WIPHY_FREQ]) {
3235 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
3236 "Frequency is missing");
3237 return -EINVAL;
3238 }
3239
3240 control_freq = MHZ_TO_KHZ(
3241 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3242 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
3243 control_freq +=
3244 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
3245
3246 memset(chandef, 0, sizeof(*chandef));
3247 chandef->chan = ieee80211_get_channel_khz(&rdev->wiphy, control_freq);
3248 chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
3249 chandef->center_freq1 = KHZ_TO_MHZ(control_freq);
3250 chandef->freq1_offset = control_freq % 1000;
3251 chandef->center_freq2 = 0;
3252
3253 /* Primary channel not allowed */
3254 if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED) {
3255 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
3256 "Channel is disabled");
3257 return -EINVAL;
3258 }
3259
3260 if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
3261 enum nl80211_channel_type chantype;
3262
3263 chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
3264
3265 switch (chantype) {
3266 case NL80211_CHAN_NO_HT:
3267 case NL80211_CHAN_HT20:
3268 case NL80211_CHAN_HT40PLUS:
3269 case NL80211_CHAN_HT40MINUS:
3270 cfg80211_chandef_create(chandef, chandef->chan,
3271 chantype);
3272 /* user input for center_freq is incorrect */
3273 if (attrs[NL80211_ATTR_CENTER_FREQ1] &&
3274 chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) {
3275 NL_SET_ERR_MSG_ATTR(extack,
3276 attrs[NL80211_ATTR_CENTER_FREQ1],
3277 "bad center frequency 1");
3278 return -EINVAL;
3279 }
3280 /* center_freq2 must be zero */
3281 if (attrs[NL80211_ATTR_CENTER_FREQ2] &&
3282 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) {
3283 NL_SET_ERR_MSG_ATTR(extack,
3284 attrs[NL80211_ATTR_CENTER_FREQ2],
3285 "center frequency 2 can't be used");
3286 return -EINVAL;
3287 }
3288 break;
3289 default:
3290 NL_SET_ERR_MSG_ATTR(extack,
3291 attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
3292 "invalid channel type");
3293 return -EINVAL;
3294 }
3295 } else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
3296 chandef->width =
3297 nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]);
3298 if (chandef->chan->band == NL80211_BAND_S1GHZ) {
3299 /* User input error for channel width doesn't match channel */
3300 if (chandef->width != ieee80211_s1g_channel_width(chandef->chan)) {
3301 NL_SET_ERR_MSG_ATTR(extack,
3302 attrs[NL80211_ATTR_CHANNEL_WIDTH],
3303 "bad channel width");
3304 return -EINVAL;
3305 }
3306 }
3307 if (attrs[NL80211_ATTR_CENTER_FREQ1]) {
3308 chandef->center_freq1 =
3309 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]);
3310 if (attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET])
3311 chandef->freq1_offset = nla_get_u32(
3312 attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET]);
3313 else
3314 chandef->freq1_offset = 0;
3315 }
3316 if (attrs[NL80211_ATTR_CENTER_FREQ2])
3317 chandef->center_freq2 =
3318 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]);
3319 }
3320
3321 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
3322 chandef->edmg.channels =
3323 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
3324
3325 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
3326 chandef->edmg.bw_config =
3327 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
3328 } else {
3329 chandef->edmg.bw_config = 0;
3330 chandef->edmg.channels = 0;
3331 }
3332
3333 if (!cfg80211_chandef_valid(chandef)) {
3334 NL_SET_ERR_MSG(extack, "invalid channel definition");
3335 return -EINVAL;
3336 }
3337
3338 if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
3339 IEEE80211_CHAN_DISABLED)) {
3340 NL_SET_ERR_MSG(extack, "(extension) channel is disabled");
3341 return -EINVAL;
3342 }
3343
3344 if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
3345 chandef->width == NL80211_CHAN_WIDTH_10) &&
3346 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) {
3347 NL_SET_ERR_MSG(extack, "5/10 MHz not supported");
3348 return -EINVAL;
3349 }
3350
3351 return 0;
3352 }
3353
__nl80211_set_channel(struct cfg80211_registered_device * rdev,struct net_device * dev,struct genl_info * info,int _link_id)3354 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
3355 struct net_device *dev,
3356 struct genl_info *info,
3357 int _link_id)
3358 {
3359 struct cfg80211_chan_def chandef;
3360 int result;
3361 enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
3362 struct wireless_dev *wdev = NULL;
3363 int link_id = _link_id;
3364
3365 if (dev)
3366 wdev = dev->ieee80211_ptr;
3367 if (!nl80211_can_set_dev_channel(wdev))
3368 return -EOPNOTSUPP;
3369 if (wdev)
3370 iftype = wdev->iftype;
3371
3372 if (link_id < 0) {
3373 if (wdev && wdev->valid_links)
3374 return -EINVAL;
3375 link_id = 0;
3376 }
3377
3378 result = nl80211_parse_chandef(rdev, info, &chandef);
3379 if (result)
3380 return result;
3381
3382 switch (iftype) {
3383 case NL80211_IFTYPE_AP:
3384 case NL80211_IFTYPE_P2P_GO:
3385 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
3386 iftype))
3387 return -EINVAL;
3388 if (wdev->links[link_id].ap.beacon_interval) {
3389 struct ieee80211_channel *cur_chan;
3390
3391 if (!dev || !rdev->ops->set_ap_chanwidth ||
3392 !(rdev->wiphy.features &
3393 NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE))
3394 return -EBUSY;
3395
3396 /* Only allow dynamic channel width changes */
3397 cur_chan = wdev->links[link_id].ap.chandef.chan;
3398 if (chandef.chan != cur_chan)
3399 return -EBUSY;
3400
3401 result = rdev_set_ap_chanwidth(rdev, dev, link_id,
3402 &chandef);
3403 if (result)
3404 return result;
3405 wdev->links[link_id].ap.chandef = chandef;
3406 } else {
3407 wdev->u.ap.preset_chandef = chandef;
3408 }
3409 return 0;
3410 case NL80211_IFTYPE_MESH_POINT:
3411 return cfg80211_set_mesh_channel(rdev, wdev, &chandef);
3412 case NL80211_IFTYPE_MONITOR:
3413 return cfg80211_set_monitor_channel(rdev, &chandef);
3414 default:
3415 break;
3416 }
3417
3418 return -EINVAL;
3419 }
3420
nl80211_set_channel(struct sk_buff * skb,struct genl_info * info)3421 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
3422 {
3423 struct cfg80211_registered_device *rdev = info->user_ptr[0];
3424 int link_id = nl80211_link_id_or_invalid(info->attrs);
3425 struct net_device *netdev = info->user_ptr[1];
3426 int ret;
3427
3428 wdev_lock(netdev->ieee80211_ptr);
3429 ret = __nl80211_set_channel(rdev, netdev, info, link_id);
3430 wdev_unlock(netdev->ieee80211_ptr);
3431
3432 return ret;
3433 }
3434
nl80211_set_wiphy(struct sk_buff * skb,struct genl_info * info)3435 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
3436 {
3437 struct cfg80211_registered_device *rdev = NULL;
3438 struct net_device *netdev = NULL;
3439 struct wireless_dev *wdev;
3440 int result = 0, rem_txq_params = 0;
3441 struct nlattr *nl_txq_params;
3442 u32 changed;
3443 u8 retry_short = 0, retry_long = 0;
3444 u32 frag_threshold = 0, rts_threshold = 0;
3445 u8 coverage_class = 0;
3446 u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0;
3447
3448 rtnl_lock();
3449 /*
3450 * Try to find the wiphy and netdev. Normally this
3451 * function shouldn't need the netdev, but this is
3452 * done for backward compatibility -- previously
3453 * setting the channel was done per wiphy, but now
3454 * it is per netdev. Previous userland like hostapd
3455 * also passed a netdev to set_wiphy, so that it is
3456 * possible to let that go to the right netdev!
3457 */
3458
3459 if (info->attrs[NL80211_ATTR_IFINDEX]) {
3460 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
3461
3462 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
3463 if (netdev && netdev->ieee80211_ptr)
3464 rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
3465 else
3466 netdev = NULL;
3467 }
3468
3469 if (!netdev) {
3470 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
3471 info->attrs);
3472 if (IS_ERR(rdev)) {
3473 rtnl_unlock();
3474 return PTR_ERR(rdev);
3475 }
3476 wdev = NULL;
3477 netdev = NULL;
3478 result = 0;
3479 } else
3480 wdev = netdev->ieee80211_ptr;
3481
3482 wiphy_lock(&rdev->wiphy);
3483
3484 /*
3485 * end workaround code, by now the rdev is available
3486 * and locked, and wdev may or may not be NULL.
3487 */
3488
3489 if (info->attrs[NL80211_ATTR_WIPHY_NAME])
3490 result = cfg80211_dev_rename(
3491 rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
3492 rtnl_unlock();
3493
3494 if (result)
3495 goto out;
3496
3497 if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
3498 struct ieee80211_txq_params txq_params;
3499 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
3500
3501 if (!rdev->ops->set_txq_params) {
3502 result = -EOPNOTSUPP;
3503 goto out;
3504 }
3505
3506 if (!netdev) {
3507 result = -EINVAL;
3508 goto out;
3509 }
3510
3511 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3512 netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
3513 result = -EINVAL;
3514 goto out;
3515 }
3516
3517 if (!netif_running(netdev)) {
3518 result = -ENETDOWN;
3519 goto out;
3520 }
3521
3522 nla_for_each_nested(nl_txq_params,
3523 info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
3524 rem_txq_params) {
3525 result = nla_parse_nested_deprecated(tb,
3526 NL80211_TXQ_ATTR_MAX,
3527 nl_txq_params,
3528 txq_params_policy,
3529 info->extack);
3530 if (result)
3531 goto out;
3532 result = parse_txq_params(tb, &txq_params);
3533 if (result)
3534 goto out;
3535
3536 txq_params.link_id =
3537 nl80211_link_id_or_invalid(info->attrs);
3538
3539 wdev_lock(netdev->ieee80211_ptr);
3540 if (txq_params.link_id >= 0 &&
3541 !(netdev->ieee80211_ptr->valid_links &
3542 BIT(txq_params.link_id)))
3543 result = -ENOLINK;
3544 else if (txq_params.link_id >= 0 &&
3545 !netdev->ieee80211_ptr->valid_links)
3546 result = -EINVAL;
3547 else
3548 result = rdev_set_txq_params(rdev, netdev,
3549 &txq_params);
3550 wdev_unlock(netdev->ieee80211_ptr);
3551 if (result)
3552 goto out;
3553 }
3554 }
3555
3556 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3557 int link_id = nl80211_link_id_or_invalid(info->attrs);
3558
3559 if (wdev) {
3560 wdev_lock(wdev);
3561 result = __nl80211_set_channel(
3562 rdev,
3563 nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
3564 info, link_id);
3565 wdev_unlock(wdev);
3566 } else {
3567 result = __nl80211_set_channel(rdev, netdev, info, link_id);
3568 }
3569
3570 if (result)
3571 goto out;
3572 }
3573
3574 if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
3575 struct wireless_dev *txp_wdev = wdev;
3576 enum nl80211_tx_power_setting type;
3577 int idx, mbm = 0;
3578
3579 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
3580 txp_wdev = NULL;
3581
3582 if (!rdev->ops->set_tx_power) {
3583 result = -EOPNOTSUPP;
3584 goto out;
3585 }
3586
3587 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
3588 type = nla_get_u32(info->attrs[idx]);
3589
3590 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
3591 (type != NL80211_TX_POWER_AUTOMATIC)) {
3592 result = -EINVAL;
3593 goto out;
3594 }
3595
3596 if (type != NL80211_TX_POWER_AUTOMATIC) {
3597 idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
3598 mbm = nla_get_u32(info->attrs[idx]);
3599 }
3600
3601 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
3602 if (result)
3603 goto out;
3604 }
3605
3606 if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
3607 info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
3608 u32 tx_ant, rx_ant;
3609
3610 if ((!rdev->wiphy.available_antennas_tx &&
3611 !rdev->wiphy.available_antennas_rx) ||
3612 !rdev->ops->set_antenna) {
3613 result = -EOPNOTSUPP;
3614 goto out;
3615 }
3616
3617 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
3618 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
3619
3620 /* reject antenna configurations which don't match the
3621 * available antenna masks, except for the "all" mask */
3622 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
3623 (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
3624 result = -EINVAL;
3625 goto out;
3626 }
3627
3628 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
3629 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
3630
3631 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
3632 if (result)
3633 goto out;
3634 }
3635
3636 changed = 0;
3637
3638 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
3639 retry_short = nla_get_u8(
3640 info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
3641
3642 changed |= WIPHY_PARAM_RETRY_SHORT;
3643 }
3644
3645 if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
3646 retry_long = nla_get_u8(
3647 info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
3648
3649 changed |= WIPHY_PARAM_RETRY_LONG;
3650 }
3651
3652 if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
3653 frag_threshold = nla_get_u32(
3654 info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
3655 if (frag_threshold < 256) {
3656 result = -EINVAL;
3657 goto out;
3658 }
3659
3660 if (frag_threshold != (u32) -1) {
3661 /*
3662 * Fragments (apart from the last one) are required to
3663 * have even length. Make the fragmentation code
3664 * simpler by stripping LSB should someone try to use
3665 * odd threshold value.
3666 */
3667 frag_threshold &= ~0x1;
3668 }
3669 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
3670 }
3671
3672 if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
3673 rts_threshold = nla_get_u32(
3674 info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
3675 changed |= WIPHY_PARAM_RTS_THRESHOLD;
3676 }
3677
3678 if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
3679 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
3680 result = -EINVAL;
3681 goto out;
3682 }
3683
3684 coverage_class = nla_get_u8(
3685 info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
3686 changed |= WIPHY_PARAM_COVERAGE_CLASS;
3687 }
3688
3689 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
3690 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION)) {
3691 result = -EOPNOTSUPP;
3692 goto out;
3693 }
3694
3695 changed |= WIPHY_PARAM_DYN_ACK;
3696 }
3697
3698 if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) {
3699 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3700 NL80211_EXT_FEATURE_TXQS)) {
3701 result = -EOPNOTSUPP;
3702 goto out;
3703 }
3704 txq_limit = nla_get_u32(
3705 info->attrs[NL80211_ATTR_TXQ_LIMIT]);
3706 changed |= WIPHY_PARAM_TXQ_LIMIT;
3707 }
3708
3709 if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) {
3710 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3711 NL80211_EXT_FEATURE_TXQS)) {
3712 result = -EOPNOTSUPP;
3713 goto out;
3714 }
3715 txq_memory_limit = nla_get_u32(
3716 info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]);
3717 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT;
3718 }
3719
3720 if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) {
3721 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3722 NL80211_EXT_FEATURE_TXQS)) {
3723 result = -EOPNOTSUPP;
3724 goto out;
3725 }
3726 txq_quantum = nla_get_u32(
3727 info->attrs[NL80211_ATTR_TXQ_QUANTUM]);
3728 changed |= WIPHY_PARAM_TXQ_QUANTUM;
3729 }
3730
3731 if (changed) {
3732 u8 old_retry_short, old_retry_long;
3733 u32 old_frag_threshold, old_rts_threshold;
3734 u8 old_coverage_class;
3735 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum;
3736
3737 if (!rdev->ops->set_wiphy_params) {
3738 result = -EOPNOTSUPP;
3739 goto out;
3740 }
3741
3742 old_retry_short = rdev->wiphy.retry_short;
3743 old_retry_long = rdev->wiphy.retry_long;
3744 old_frag_threshold = rdev->wiphy.frag_threshold;
3745 old_rts_threshold = rdev->wiphy.rts_threshold;
3746 old_coverage_class = rdev->wiphy.coverage_class;
3747 old_txq_limit = rdev->wiphy.txq_limit;
3748 old_txq_memory_limit = rdev->wiphy.txq_memory_limit;
3749 old_txq_quantum = rdev->wiphy.txq_quantum;
3750
3751 if (changed & WIPHY_PARAM_RETRY_SHORT)
3752 rdev->wiphy.retry_short = retry_short;
3753 if (changed & WIPHY_PARAM_RETRY_LONG)
3754 rdev->wiphy.retry_long = retry_long;
3755 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
3756 rdev->wiphy.frag_threshold = frag_threshold;
3757 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
3758 rdev->wiphy.rts_threshold = rts_threshold;
3759 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
3760 rdev->wiphy.coverage_class = coverage_class;
3761 if (changed & WIPHY_PARAM_TXQ_LIMIT)
3762 rdev->wiphy.txq_limit = txq_limit;
3763 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT)
3764 rdev->wiphy.txq_memory_limit = txq_memory_limit;
3765 if (changed & WIPHY_PARAM_TXQ_QUANTUM)
3766 rdev->wiphy.txq_quantum = txq_quantum;
3767
3768 result = rdev_set_wiphy_params(rdev, changed);
3769 if (result) {
3770 rdev->wiphy.retry_short = old_retry_short;
3771 rdev->wiphy.retry_long = old_retry_long;
3772 rdev->wiphy.frag_threshold = old_frag_threshold;
3773 rdev->wiphy.rts_threshold = old_rts_threshold;
3774 rdev->wiphy.coverage_class = old_coverage_class;
3775 rdev->wiphy.txq_limit = old_txq_limit;
3776 rdev->wiphy.txq_memory_limit = old_txq_memory_limit;
3777 rdev->wiphy.txq_quantum = old_txq_quantum;
3778 goto out;
3779 }
3780 }
3781
3782 result = 0;
3783
3784 out:
3785 wiphy_unlock(&rdev->wiphy);
3786 return result;
3787 }
3788
nl80211_send_chandef(struct sk_buff * msg,const struct cfg80211_chan_def * chandef)3789 int nl80211_send_chandef(struct sk_buff *msg, const struct cfg80211_chan_def *chandef)
3790 {
3791 if (WARN_ON(!cfg80211_chandef_valid(chandef)))
3792 return -EINVAL;
3793
3794 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
3795 chandef->chan->center_freq))
3796 return -ENOBUFS;
3797 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
3798 chandef->chan->freq_offset))
3799 return -ENOBUFS;
3800 switch (chandef->width) {
3801 case NL80211_CHAN_WIDTH_20_NOHT:
3802 case NL80211_CHAN_WIDTH_20:
3803 case NL80211_CHAN_WIDTH_40:
3804 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
3805 cfg80211_get_chandef_type(chandef)))
3806 return -ENOBUFS;
3807 break;
3808 default:
3809 break;
3810 }
3811 if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
3812 return -ENOBUFS;
3813 if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
3814 return -ENOBUFS;
3815 if (chandef->center_freq2 &&
3816 nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
3817 return -ENOBUFS;
3818 return 0;
3819 }
3820 EXPORT_SYMBOL(nl80211_send_chandef);
3821
nl80211_send_iface(struct sk_buff * msg,u32 portid,u32 seq,int flags,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,enum nl80211_commands cmd)3822 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
3823 struct cfg80211_registered_device *rdev,
3824 struct wireless_dev *wdev,
3825 enum nl80211_commands cmd)
3826 {
3827 struct net_device *dev = wdev->netdev;
3828 void *hdr;
3829
3830 WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
3831 cmd != NL80211_CMD_DEL_INTERFACE &&
3832 cmd != NL80211_CMD_SET_INTERFACE);
3833
3834 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
3835 if (!hdr)
3836 return -1;
3837
3838 if (dev &&
3839 (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3840 nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
3841 goto nla_put_failure;
3842
3843 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
3844 nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
3845 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
3846 NL80211_ATTR_PAD) ||
3847 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
3848 nla_put_u32(msg, NL80211_ATTR_GENERATION,
3849 rdev->devlist_generation ^
3850 (cfg80211_rdev_list_generation << 2)) ||
3851 nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr))
3852 goto nla_put_failure;
3853
3854 if (rdev->ops->get_channel && !wdev->valid_links) {
3855 struct cfg80211_chan_def chandef = {};
3856 int ret;
3857
3858 ret = rdev_get_channel(rdev, wdev, 0, &chandef);
3859 if (ret == 0 && nl80211_send_chandef(msg, &chandef))
3860 goto nla_put_failure;
3861 }
3862
3863 if (rdev->ops->get_tx_power) {
3864 int dbm, ret;
3865
3866 ret = rdev_get_tx_power(rdev, wdev, &dbm);
3867 if (ret == 0 &&
3868 nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
3869 DBM_TO_MBM(dbm)))
3870 goto nla_put_failure;
3871 }
3872
3873 wdev_lock(wdev);
3874 switch (wdev->iftype) {
3875 case NL80211_IFTYPE_AP:
3876 case NL80211_IFTYPE_P2P_GO:
3877 if (wdev->u.ap.ssid_len &&
3878 nla_put(msg, NL80211_ATTR_SSID, wdev->u.ap.ssid_len,
3879 wdev->u.ap.ssid))
3880 goto nla_put_failure_locked;
3881 break;
3882 case NL80211_IFTYPE_STATION:
3883 case NL80211_IFTYPE_P2P_CLIENT:
3884 if (wdev->u.client.ssid_len &&
3885 nla_put(msg, NL80211_ATTR_SSID, wdev->u.client.ssid_len,
3886 wdev->u.client.ssid))
3887 goto nla_put_failure_locked;
3888 break;
3889 case NL80211_IFTYPE_ADHOC:
3890 if (wdev->u.ibss.ssid_len &&
3891 nla_put(msg, NL80211_ATTR_SSID, wdev->u.ibss.ssid_len,
3892 wdev->u.ibss.ssid))
3893 goto nla_put_failure_locked;
3894 break;
3895 default:
3896 /* nothing */
3897 break;
3898 }
3899 wdev_unlock(wdev);
3900
3901 if (rdev->ops->get_txq_stats) {
3902 struct cfg80211_txq_stats txqstats = {};
3903 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats);
3904
3905 if (ret == 0 &&
3906 !nl80211_put_txq_stats(msg, &txqstats,
3907 NL80211_ATTR_TXQ_STATS))
3908 goto nla_put_failure;
3909 }
3910
3911 if (wdev->valid_links) {
3912 unsigned int link_id;
3913 struct nlattr *links = nla_nest_start(msg,
3914 NL80211_ATTR_MLO_LINKS);
3915
3916 if (!links)
3917 goto nla_put_failure;
3918
3919 for_each_valid_link(wdev, link_id) {
3920 struct nlattr *link = nla_nest_start(msg, link_id + 1);
3921 struct cfg80211_chan_def chandef = {};
3922 int ret;
3923
3924 if (!link)
3925 goto nla_put_failure;
3926
3927 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
3928 goto nla_put_failure;
3929 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
3930 wdev->links[link_id].addr))
3931 goto nla_put_failure;
3932
3933 ret = rdev_get_channel(rdev, wdev, link_id, &chandef);
3934 if (ret == 0 && nl80211_send_chandef(msg, &chandef))
3935 goto nla_put_failure;
3936
3937 nla_nest_end(msg, link);
3938 }
3939
3940 nla_nest_end(msg, links);
3941 }
3942
3943 genlmsg_end(msg, hdr);
3944 return 0;
3945
3946 nla_put_failure_locked:
3947 wdev_unlock(wdev);
3948 nla_put_failure:
3949 genlmsg_cancel(msg, hdr);
3950 return -EMSGSIZE;
3951 }
3952
nl80211_dump_interface(struct sk_buff * skb,struct netlink_callback * cb)3953 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
3954 {
3955 int wp_idx = 0;
3956 int if_idx = 0;
3957 int wp_start = cb->args[0];
3958 int if_start = cb->args[1];
3959 int filter_wiphy = -1;
3960 struct cfg80211_registered_device *rdev;
3961 struct wireless_dev *wdev;
3962 int ret;
3963
3964 rtnl_lock();
3965 if (!cb->args[2]) {
3966 struct nl80211_dump_wiphy_state state = {
3967 .filter_wiphy = -1,
3968 };
3969
3970 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
3971 if (ret)
3972 goto out_unlock;
3973
3974 filter_wiphy = state.filter_wiphy;
3975
3976 /*
3977 * if filtering, set cb->args[2] to +1 since 0 is the default
3978 * value needed to determine that parsing is necessary.
3979 */
3980 if (filter_wiphy >= 0)
3981 cb->args[2] = filter_wiphy + 1;
3982 else
3983 cb->args[2] = -1;
3984 } else if (cb->args[2] > 0) {
3985 filter_wiphy = cb->args[2] - 1;
3986 }
3987
3988 list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
3989 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
3990 continue;
3991 if (wp_idx < wp_start) {
3992 wp_idx++;
3993 continue;
3994 }
3995
3996 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
3997 continue;
3998
3999 if_idx = 0;
4000
4001 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
4002 if (if_idx < if_start) {
4003 if_idx++;
4004 continue;
4005 }
4006 if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
4007 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4008 rdev, wdev,
4009 NL80211_CMD_NEW_INTERFACE) < 0) {
4010 goto out;
4011 }
4012 if_idx++;
4013 }
4014
4015 wp_idx++;
4016 }
4017 out:
4018 cb->args[0] = wp_idx;
4019 cb->args[1] = if_idx;
4020
4021 ret = skb->len;
4022 out_unlock:
4023 rtnl_unlock();
4024
4025 return ret;
4026 }
4027
nl80211_get_interface(struct sk_buff * skb,struct genl_info * info)4028 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
4029 {
4030 struct sk_buff *msg;
4031 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4032 struct wireless_dev *wdev = info->user_ptr[1];
4033
4034 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4035 if (!msg)
4036 return -ENOMEM;
4037
4038 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
4039 rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
4040 nlmsg_free(msg);
4041 return -ENOBUFS;
4042 }
4043
4044 return genlmsg_reply(msg, info);
4045 }
4046
4047 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
4048 [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
4049 [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
4050 [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
4051 [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
4052 [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
4053 [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
4054 };
4055
parse_monitor_flags(struct nlattr * nla,u32 * mntrflags)4056 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
4057 {
4058 struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
4059 int flag;
4060
4061 *mntrflags = 0;
4062
4063 if (!nla)
4064 return -EINVAL;
4065
4066 if (nla_parse_nested_deprecated(flags, NL80211_MNTR_FLAG_MAX, nla, mntr_flags_policy, NULL))
4067 return -EINVAL;
4068
4069 for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
4070 if (flags[flag])
4071 *mntrflags |= (1<<flag);
4072
4073 *mntrflags |= MONITOR_FLAG_CHANGED;
4074
4075 return 0;
4076 }
4077
nl80211_parse_mon_options(struct cfg80211_registered_device * rdev,enum nl80211_iftype type,struct genl_info * info,struct vif_params * params)4078 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
4079 enum nl80211_iftype type,
4080 struct genl_info *info,
4081 struct vif_params *params)
4082 {
4083 bool change = false;
4084 int err;
4085
4086 if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
4087 if (type != NL80211_IFTYPE_MONITOR)
4088 return -EINVAL;
4089
4090 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
4091 ¶ms->flags);
4092 if (err)
4093 return err;
4094
4095 change = true;
4096 }
4097
4098 if (params->flags & MONITOR_FLAG_ACTIVE &&
4099 !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
4100 return -EOPNOTSUPP;
4101
4102 if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
4103 const u8 *mumimo_groups;
4104 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
4105
4106 if (type != NL80211_IFTYPE_MONITOR)
4107 return -EINVAL;
4108
4109 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
4110 return -EOPNOTSUPP;
4111
4112 mumimo_groups =
4113 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
4114
4115 /* bits 0 and 63 are reserved and must be zero */
4116 if ((mumimo_groups[0] & BIT(0)) ||
4117 (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
4118 return -EINVAL;
4119
4120 params->vht_mumimo_groups = mumimo_groups;
4121 change = true;
4122 }
4123
4124 if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
4125 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
4126
4127 if (type != NL80211_IFTYPE_MONITOR)
4128 return -EINVAL;
4129
4130 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
4131 return -EOPNOTSUPP;
4132
4133 params->vht_mumimo_follow_addr =
4134 nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
4135 change = true;
4136 }
4137
4138 return change ? 1 : 0;
4139 }
4140
nl80211_valid_4addr(struct cfg80211_registered_device * rdev,struct net_device * netdev,u8 use_4addr,enum nl80211_iftype iftype)4141 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
4142 struct net_device *netdev, u8 use_4addr,
4143 enum nl80211_iftype iftype)
4144 {
4145 if (!use_4addr) {
4146 if (netdev && netif_is_bridge_port(netdev))
4147 return -EBUSY;
4148 return 0;
4149 }
4150
4151 switch (iftype) {
4152 case NL80211_IFTYPE_AP_VLAN:
4153 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
4154 return 0;
4155 break;
4156 case NL80211_IFTYPE_STATION:
4157 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
4158 return 0;
4159 break;
4160 default:
4161 break;
4162 }
4163
4164 return -EOPNOTSUPP;
4165 }
4166
nl80211_set_interface(struct sk_buff * skb,struct genl_info * info)4167 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
4168 {
4169 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4170 struct vif_params params;
4171 int err;
4172 enum nl80211_iftype otype, ntype;
4173 struct net_device *dev = info->user_ptr[1];
4174 bool change = false;
4175
4176 memset(¶ms, 0, sizeof(params));
4177
4178 otype = ntype = dev->ieee80211_ptr->iftype;
4179
4180 if (info->attrs[NL80211_ATTR_IFTYPE]) {
4181 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
4182 if (otype != ntype)
4183 change = true;
4184 }
4185
4186 if (info->attrs[NL80211_ATTR_MESH_ID]) {
4187 struct wireless_dev *wdev = dev->ieee80211_ptr;
4188
4189 if (ntype != NL80211_IFTYPE_MESH_POINT)
4190 return -EINVAL;
4191 if (netif_running(dev))
4192 return -EBUSY;
4193
4194 wdev_lock(wdev);
4195 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
4196 IEEE80211_MAX_MESH_ID_LEN);
4197 wdev->u.mesh.id_up_len =
4198 nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
4199 memcpy(wdev->u.mesh.id,
4200 nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
4201 wdev->u.mesh.id_up_len);
4202 wdev_unlock(wdev);
4203 }
4204
4205 if (info->attrs[NL80211_ATTR_4ADDR]) {
4206 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
4207 change = true;
4208 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
4209 if (err)
4210 return err;
4211 } else {
4212 params.use_4addr = -1;
4213 }
4214
4215 err = nl80211_parse_mon_options(rdev, ntype, info, ¶ms);
4216 if (err < 0)
4217 return err;
4218 if (err > 0)
4219 change = true;
4220
4221 if (change)
4222 err = cfg80211_change_iface(rdev, dev, ntype, ¶ms);
4223 else
4224 err = 0;
4225
4226 if (!err && params.use_4addr != -1)
4227 dev->ieee80211_ptr->use_4addr = params.use_4addr;
4228
4229 if (change && !err) {
4230 struct wireless_dev *wdev = dev->ieee80211_ptr;
4231
4232 nl80211_notify_iface(rdev, wdev, NL80211_CMD_SET_INTERFACE);
4233 }
4234
4235 return err;
4236 }
4237
_nl80211_new_interface(struct sk_buff * skb,struct genl_info * info)4238 static int _nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
4239 {
4240 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4241 struct vif_params params;
4242 struct wireless_dev *wdev;
4243 struct sk_buff *msg;
4244 int err;
4245 enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
4246
4247 memset(¶ms, 0, sizeof(params));
4248
4249 if (!info->attrs[NL80211_ATTR_IFNAME])
4250 return -EINVAL;
4251
4252 if (info->attrs[NL80211_ATTR_IFTYPE])
4253 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
4254
4255 if (!rdev->ops->add_virtual_intf)
4256 return -EOPNOTSUPP;
4257
4258 if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
4259 rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
4260 info->attrs[NL80211_ATTR_MAC]) {
4261 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
4262 ETH_ALEN);
4263 if (!is_valid_ether_addr(params.macaddr))
4264 return -EADDRNOTAVAIL;
4265 }
4266
4267 if (info->attrs[NL80211_ATTR_4ADDR]) {
4268 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
4269 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
4270 if (err)
4271 return err;
4272 }
4273
4274 if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0))
4275 return -EOPNOTSUPP;
4276
4277 err = nl80211_parse_mon_options(rdev, type, info, ¶ms);
4278 if (err < 0)
4279 return err;
4280
4281 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4282 if (!msg)
4283 return -ENOMEM;
4284
4285 wdev = rdev_add_virtual_intf(rdev,
4286 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
4287 NET_NAME_USER, type, ¶ms);
4288 if (WARN_ON(!wdev)) {
4289 nlmsg_free(msg);
4290 return -EPROTO;
4291 } else if (IS_ERR(wdev)) {
4292 nlmsg_free(msg);
4293 return PTR_ERR(wdev);
4294 }
4295
4296 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
4297 wdev->owner_nlportid = info->snd_portid;
4298
4299 switch (type) {
4300 case NL80211_IFTYPE_MESH_POINT:
4301 if (!info->attrs[NL80211_ATTR_MESH_ID])
4302 break;
4303 wdev_lock(wdev);
4304 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
4305 IEEE80211_MAX_MESH_ID_LEN);
4306 wdev->u.mesh.id_up_len =
4307 nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
4308 memcpy(wdev->u.mesh.id,
4309 nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
4310 wdev->u.mesh.id_up_len);
4311 wdev_unlock(wdev);
4312 break;
4313 case NL80211_IFTYPE_NAN:
4314 case NL80211_IFTYPE_P2P_DEVICE:
4315 /*
4316 * P2P Device and NAN do not have a netdev, so don't go
4317 * through the netdev notifier and must be added here
4318 */
4319 cfg80211_init_wdev(wdev);
4320 cfg80211_register_wdev(rdev, wdev);
4321 break;
4322 default:
4323 break;
4324 }
4325
4326 if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
4327 rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
4328 nlmsg_free(msg);
4329 return -ENOBUFS;
4330 }
4331
4332 return genlmsg_reply(msg, info);
4333 }
4334
nl80211_new_interface(struct sk_buff * skb,struct genl_info * info)4335 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
4336 {
4337 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4338 int ret;
4339
4340 /* to avoid failing a new interface creation due to pending removal */
4341 cfg80211_destroy_ifaces(rdev);
4342
4343 wiphy_lock(&rdev->wiphy);
4344 ret = _nl80211_new_interface(skb, info);
4345 wiphy_unlock(&rdev->wiphy);
4346
4347 return ret;
4348 }
4349
nl80211_del_interface(struct sk_buff * skb,struct genl_info * info)4350 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
4351 {
4352 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4353 struct wireless_dev *wdev = info->user_ptr[1];
4354
4355 if (!rdev->ops->del_virtual_intf)
4356 return -EOPNOTSUPP;
4357
4358 /*
4359 * We hold RTNL, so this is safe, without RTNL opencount cannot
4360 * reach 0, and thus the rdev cannot be deleted.
4361 *
4362 * We need to do it for the dev_close(), since that will call
4363 * the netdev notifiers, and we need to acquire the mutex there
4364 * but don't know if we get there from here or from some other
4365 * place (e.g. "ip link set ... down").
4366 */
4367 mutex_unlock(&rdev->wiphy.mtx);
4368
4369 /*
4370 * If we remove a wireless device without a netdev then clear
4371 * user_ptr[1] so that nl80211_post_doit won't dereference it
4372 * to check if it needs to do dev_put(). Otherwise it crashes
4373 * since the wdev has been freed, unlike with a netdev where
4374 * we need the dev_put() for the netdev to really be freed.
4375 */
4376 if (!wdev->netdev)
4377 info->user_ptr[1] = NULL;
4378 else
4379 dev_close(wdev->netdev);
4380
4381 mutex_lock(&rdev->wiphy.mtx);
4382
4383 return cfg80211_remove_virtual_intf(rdev, wdev);
4384 }
4385
nl80211_set_noack_map(struct sk_buff * skb,struct genl_info * info)4386 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
4387 {
4388 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4389 struct net_device *dev = info->user_ptr[1];
4390 u16 noack_map;
4391
4392 if (!info->attrs[NL80211_ATTR_NOACK_MAP])
4393 return -EINVAL;
4394
4395 if (!rdev->ops->set_noack_map)
4396 return -EOPNOTSUPP;
4397
4398 noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
4399
4400 return rdev_set_noack_map(rdev, dev, noack_map);
4401 }
4402
nl80211_validate_key_link_id(struct genl_info * info,struct wireless_dev * wdev,int link_id,bool pairwise)4403 static int nl80211_validate_key_link_id(struct genl_info *info,
4404 struct wireless_dev *wdev,
4405 int link_id, bool pairwise)
4406 {
4407 if (pairwise) {
4408 if (link_id != -1) {
4409 GENL_SET_ERR_MSG(info,
4410 "link ID not allowed for pairwise key");
4411 return -EINVAL;
4412 }
4413
4414 return 0;
4415 }
4416
4417 if (wdev->valid_links) {
4418 if (link_id == -1) {
4419 GENL_SET_ERR_MSG(info,
4420 "link ID must for MLO group key");
4421 return -EINVAL;
4422 }
4423 if (!(wdev->valid_links & BIT(link_id))) {
4424 GENL_SET_ERR_MSG(info, "invalid link ID for MLO group key");
4425 return -EINVAL;
4426 }
4427 } else if (link_id != -1) {
4428 GENL_SET_ERR_MSG(info, "link ID not allowed for non-MLO group key");
4429 return -EINVAL;
4430 }
4431
4432 return 0;
4433 }
4434
4435 struct get_key_cookie {
4436 struct sk_buff *msg;
4437 int error;
4438 int idx;
4439 };
4440
get_key_callback(void * c,struct key_params * params)4441 static void get_key_callback(void *c, struct key_params *params)
4442 {
4443 struct nlattr *key;
4444 struct get_key_cookie *cookie = c;
4445
4446 if ((params->key &&
4447 nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
4448 params->key_len, params->key)) ||
4449 (params->seq &&
4450 nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
4451 params->seq_len, params->seq)) ||
4452 (params->cipher &&
4453 nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
4454 params->cipher)))
4455 goto nla_put_failure;
4456
4457 key = nla_nest_start_noflag(cookie->msg, NL80211_ATTR_KEY);
4458 if (!key)
4459 goto nla_put_failure;
4460
4461 if ((params->key &&
4462 nla_put(cookie->msg, NL80211_KEY_DATA,
4463 params->key_len, params->key)) ||
4464 (params->seq &&
4465 nla_put(cookie->msg, NL80211_KEY_SEQ,
4466 params->seq_len, params->seq)) ||
4467 (params->cipher &&
4468 nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
4469 params->cipher)))
4470 goto nla_put_failure;
4471
4472 if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx))
4473 goto nla_put_failure;
4474
4475 nla_nest_end(cookie->msg, key);
4476
4477 return;
4478 nla_put_failure:
4479 cookie->error = 1;
4480 }
4481
nl80211_get_key(struct sk_buff * skb,struct genl_info * info)4482 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
4483 {
4484 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4485 int err;
4486 struct net_device *dev = info->user_ptr[1];
4487 u8 key_idx = 0;
4488 const u8 *mac_addr = NULL;
4489 bool pairwise;
4490 struct get_key_cookie cookie = {
4491 .error = 0,
4492 };
4493 void *hdr;
4494 struct sk_buff *msg;
4495 bool bigtk_support = false;
4496 int link_id = nl80211_link_id_or_invalid(info->attrs);
4497 struct wireless_dev *wdev = dev->ieee80211_ptr;
4498
4499 if (wiphy_ext_feature_isset(&rdev->wiphy,
4500 NL80211_EXT_FEATURE_BEACON_PROTECTION))
4501 bigtk_support = true;
4502
4503 if ((wdev->iftype == NL80211_IFTYPE_STATION ||
4504 wdev->iftype == NL80211_IFTYPE_P2P_CLIENT) &&
4505 wiphy_ext_feature_isset(&rdev->wiphy,
4506 NL80211_EXT_FEATURE_BEACON_PROTECTION_CLIENT))
4507 bigtk_support = true;
4508
4509 if (info->attrs[NL80211_ATTR_KEY_IDX]) {
4510 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
4511
4512 if (key_idx >= 6 && key_idx <= 7 && !bigtk_support) {
4513 GENL_SET_ERR_MSG(info, "BIGTK not supported");
4514 return -EINVAL;
4515 }
4516 }
4517
4518 if (info->attrs[NL80211_ATTR_MAC])
4519 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4520
4521 pairwise = !!mac_addr;
4522 if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
4523 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
4524
4525 if (kt != NL80211_KEYTYPE_GROUP &&
4526 kt != NL80211_KEYTYPE_PAIRWISE)
4527 return -EINVAL;
4528 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
4529 }
4530
4531 if (!rdev->ops->get_key)
4532 return -EOPNOTSUPP;
4533
4534 if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4535 return -ENOENT;
4536
4537 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4538 if (!msg)
4539 return -ENOMEM;
4540
4541 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4542 NL80211_CMD_NEW_KEY);
4543 if (!hdr)
4544 goto nla_put_failure;
4545
4546 cookie.msg = msg;
4547 cookie.idx = key_idx;
4548
4549 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4550 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
4551 goto nla_put_failure;
4552 if (mac_addr &&
4553 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
4554 goto nla_put_failure;
4555
4556 err = nl80211_validate_key_link_id(info, wdev, link_id, pairwise);
4557 if (err)
4558 goto free_msg;
4559
4560 err = rdev_get_key(rdev, dev, link_id, key_idx, pairwise, mac_addr,
4561 &cookie, get_key_callback);
4562
4563 if (err)
4564 goto free_msg;
4565
4566 if (cookie.error)
4567 goto nla_put_failure;
4568
4569 genlmsg_end(msg, hdr);
4570 return genlmsg_reply(msg, info);
4571
4572 nla_put_failure:
4573 err = -ENOBUFS;
4574 free_msg:
4575 nlmsg_free(msg);
4576 return err;
4577 }
4578
nl80211_set_key(struct sk_buff * skb,struct genl_info * info)4579 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
4580 {
4581 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4582 struct key_parse key;
4583 int err;
4584 struct net_device *dev = info->user_ptr[1];
4585 int link_id = nl80211_link_id_or_invalid(info->attrs);
4586 struct wireless_dev *wdev = dev->ieee80211_ptr;
4587
4588 err = nl80211_parse_key(info, &key);
4589 if (err)
4590 return err;
4591
4592 if (key.idx < 0)
4593 return -EINVAL;
4594
4595 /* Only support setting default key and
4596 * Extended Key ID action NL80211_KEY_SET_TX.
4597 */
4598 if (!key.def && !key.defmgmt && !key.defbeacon &&
4599 !(key.p.mode == NL80211_KEY_SET_TX))
4600 return -EINVAL;
4601
4602 wdev_lock(wdev);
4603
4604 if (key.def) {
4605 if (!rdev->ops->set_default_key) {
4606 err = -EOPNOTSUPP;
4607 goto out;
4608 }
4609
4610 err = nl80211_key_allowed(wdev);
4611 if (err)
4612 goto out;
4613
4614 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
4615 if (err)
4616 goto out;
4617
4618 err = rdev_set_default_key(rdev, dev, link_id, key.idx,
4619 key.def_uni, key.def_multi);
4620
4621 if (err)
4622 goto out;
4623
4624 #ifdef CONFIG_CFG80211_WEXT
4625 wdev->wext.default_key = key.idx;
4626 #endif
4627 } else if (key.defmgmt) {
4628 if (key.def_uni || !key.def_multi) {
4629 err = -EINVAL;
4630 goto out;
4631 }
4632
4633 if (!rdev->ops->set_default_mgmt_key) {
4634 err = -EOPNOTSUPP;
4635 goto out;
4636 }
4637
4638 err = nl80211_key_allowed(wdev);
4639 if (err)
4640 goto out;
4641
4642 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
4643 if (err)
4644 goto out;
4645
4646 err = rdev_set_default_mgmt_key(rdev, dev, link_id, key.idx);
4647 if (err)
4648 goto out;
4649
4650 #ifdef CONFIG_CFG80211_WEXT
4651 wdev->wext.default_mgmt_key = key.idx;
4652 #endif
4653 } else if (key.defbeacon) {
4654 if (key.def_uni || !key.def_multi) {
4655 err = -EINVAL;
4656 goto out;
4657 }
4658
4659 if (!rdev->ops->set_default_beacon_key) {
4660 err = -EOPNOTSUPP;
4661 goto out;
4662 }
4663
4664 err = nl80211_key_allowed(wdev);
4665 if (err)
4666 goto out;
4667
4668 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
4669 if (err)
4670 goto out;
4671
4672 err = rdev_set_default_beacon_key(rdev, dev, link_id, key.idx);
4673 if (err)
4674 goto out;
4675 } else if (key.p.mode == NL80211_KEY_SET_TX &&
4676 wiphy_ext_feature_isset(&rdev->wiphy,
4677 NL80211_EXT_FEATURE_EXT_KEY_ID)) {
4678 u8 *mac_addr = NULL;
4679
4680 if (info->attrs[NL80211_ATTR_MAC])
4681 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4682
4683 if (!mac_addr || key.idx < 0 || key.idx > 1) {
4684 err = -EINVAL;
4685 goto out;
4686 }
4687
4688 err = nl80211_validate_key_link_id(info, wdev, link_id, true);
4689 if (err)
4690 goto out;
4691
4692 err = rdev_add_key(rdev, dev, link_id, key.idx,
4693 NL80211_KEYTYPE_PAIRWISE,
4694 mac_addr, &key.p);
4695 } else {
4696 err = -EINVAL;
4697 }
4698 out:
4699 wdev_unlock(wdev);
4700
4701 return err;
4702 }
4703
nl80211_new_key(struct sk_buff * skb,struct genl_info * info)4704 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
4705 {
4706 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4707 int err;
4708 struct net_device *dev = info->user_ptr[1];
4709 struct key_parse key;
4710 const u8 *mac_addr = NULL;
4711 int link_id = nl80211_link_id_or_invalid(info->attrs);
4712 struct wireless_dev *wdev = dev->ieee80211_ptr;
4713
4714 err = nl80211_parse_key(info, &key);
4715 if (err)
4716 return err;
4717
4718 if (!key.p.key) {
4719 GENL_SET_ERR_MSG(info, "no key");
4720 return -EINVAL;
4721 }
4722
4723 if (info->attrs[NL80211_ATTR_MAC])
4724 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4725
4726 if (key.type == -1) {
4727 if (mac_addr)
4728 key.type = NL80211_KEYTYPE_PAIRWISE;
4729 else
4730 key.type = NL80211_KEYTYPE_GROUP;
4731 }
4732
4733 /* for now */
4734 if (key.type != NL80211_KEYTYPE_PAIRWISE &&
4735 key.type != NL80211_KEYTYPE_GROUP) {
4736 GENL_SET_ERR_MSG(info, "key type not pairwise or group");
4737 return -EINVAL;
4738 }
4739
4740 if (key.type == NL80211_KEYTYPE_GROUP &&
4741 info->attrs[NL80211_ATTR_VLAN_ID])
4742 key.p.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
4743
4744 if (!rdev->ops->add_key)
4745 return -EOPNOTSUPP;
4746
4747 if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
4748 key.type == NL80211_KEYTYPE_PAIRWISE,
4749 mac_addr)) {
4750 GENL_SET_ERR_MSG(info, "key setting validation failed");
4751 return -EINVAL;
4752 }
4753
4754 wdev_lock(wdev);
4755 err = nl80211_key_allowed(wdev);
4756 if (err)
4757 GENL_SET_ERR_MSG(info, "key not allowed");
4758
4759 if (!err)
4760 err = nl80211_validate_key_link_id(info, wdev, link_id,
4761 key.type == NL80211_KEYTYPE_PAIRWISE);
4762
4763 if (!err) {
4764 err = rdev_add_key(rdev, dev, link_id, key.idx,
4765 key.type == NL80211_KEYTYPE_PAIRWISE,
4766 mac_addr, &key.p);
4767 if (err)
4768 GENL_SET_ERR_MSG(info, "key addition failed");
4769 }
4770 wdev_unlock(wdev);
4771
4772 return err;
4773 }
4774
nl80211_del_key(struct sk_buff * skb,struct genl_info * info)4775 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
4776 {
4777 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4778 int err;
4779 struct net_device *dev = info->user_ptr[1];
4780 u8 *mac_addr = NULL;
4781 struct key_parse key;
4782 int link_id = nl80211_link_id_or_invalid(info->attrs);
4783 struct wireless_dev *wdev = dev->ieee80211_ptr;
4784
4785 err = nl80211_parse_key(info, &key);
4786 if (err)
4787 return err;
4788
4789 if (info->attrs[NL80211_ATTR_MAC])
4790 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4791
4792 if (key.type == -1) {
4793 if (mac_addr)
4794 key.type = NL80211_KEYTYPE_PAIRWISE;
4795 else
4796 key.type = NL80211_KEYTYPE_GROUP;
4797 }
4798
4799 /* for now */
4800 if (key.type != NL80211_KEYTYPE_PAIRWISE &&
4801 key.type != NL80211_KEYTYPE_GROUP)
4802 return -EINVAL;
4803
4804 if (!cfg80211_valid_key_idx(rdev, key.idx,
4805 key.type == NL80211_KEYTYPE_PAIRWISE))
4806 return -EINVAL;
4807
4808 if (!rdev->ops->del_key)
4809 return -EOPNOTSUPP;
4810
4811 wdev_lock(wdev);
4812 err = nl80211_key_allowed(wdev);
4813
4814 if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
4815 !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4816 err = -ENOENT;
4817
4818 if (!err)
4819 err = nl80211_validate_key_link_id(info, wdev, link_id,
4820 key.type == NL80211_KEYTYPE_PAIRWISE);
4821
4822 if (!err)
4823 err = rdev_del_key(rdev, dev, link_id, key.idx,
4824 key.type == NL80211_KEYTYPE_PAIRWISE,
4825 mac_addr);
4826
4827 #ifdef CONFIG_CFG80211_WEXT
4828 if (!err) {
4829 if (key.idx == wdev->wext.default_key)
4830 wdev->wext.default_key = -1;
4831 else if (key.idx == wdev->wext.default_mgmt_key)
4832 wdev->wext.default_mgmt_key = -1;
4833 }
4834 #endif
4835 wdev_unlock(wdev);
4836
4837 return err;
4838 }
4839
4840 /* This function returns an error or the number of nested attributes */
validate_acl_mac_addrs(struct nlattr * nl_attr)4841 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
4842 {
4843 struct nlattr *attr;
4844 int n_entries = 0, tmp;
4845
4846 nla_for_each_nested(attr, nl_attr, tmp) {
4847 if (nla_len(attr) != ETH_ALEN)
4848 return -EINVAL;
4849
4850 n_entries++;
4851 }
4852
4853 return n_entries;
4854 }
4855
4856 /*
4857 * This function parses ACL information and allocates memory for ACL data.
4858 * On successful return, the calling function is responsible to free the
4859 * ACL buffer returned by this function.
4860 */
parse_acl_data(struct wiphy * wiphy,struct genl_info * info)4861 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
4862 struct genl_info *info)
4863 {
4864 enum nl80211_acl_policy acl_policy;
4865 struct nlattr *attr;
4866 struct cfg80211_acl_data *acl;
4867 int i = 0, n_entries, tmp;
4868
4869 if (!wiphy->max_acl_mac_addrs)
4870 return ERR_PTR(-EOPNOTSUPP);
4871
4872 if (!info->attrs[NL80211_ATTR_ACL_POLICY])
4873 return ERR_PTR(-EINVAL);
4874
4875 acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
4876 if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
4877 acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
4878 return ERR_PTR(-EINVAL);
4879
4880 if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
4881 return ERR_PTR(-EINVAL);
4882
4883 n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
4884 if (n_entries < 0)
4885 return ERR_PTR(n_entries);
4886
4887 if (n_entries > wiphy->max_acl_mac_addrs)
4888 return ERR_PTR(-ENOTSUPP);
4889
4890 acl = kzalloc(struct_size(acl, mac_addrs, n_entries), GFP_KERNEL);
4891 if (!acl)
4892 return ERR_PTR(-ENOMEM);
4893 acl->n_acl_entries = n_entries;
4894
4895 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
4896 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
4897 i++;
4898 }
4899 acl->acl_policy = acl_policy;
4900
4901 return acl;
4902 }
4903
nl80211_set_mac_acl(struct sk_buff * skb,struct genl_info * info)4904 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
4905 {
4906 struct cfg80211_registered_device *rdev = info->user_ptr[0];
4907 struct net_device *dev = info->user_ptr[1];
4908 struct cfg80211_acl_data *acl;
4909 int err;
4910
4911 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4912 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4913 return -EOPNOTSUPP;
4914
4915 if (!dev->ieee80211_ptr->links[0].ap.beacon_interval)
4916 return -EINVAL;
4917
4918 acl = parse_acl_data(&rdev->wiphy, info);
4919 if (IS_ERR(acl))
4920 return PTR_ERR(acl);
4921
4922 err = rdev_set_mac_acl(rdev, dev, acl);
4923
4924 kfree(acl);
4925
4926 return err;
4927 }
4928
rateset_to_mask(struct ieee80211_supported_band * sband,u8 * rates,u8 rates_len)4929 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
4930 u8 *rates, u8 rates_len)
4931 {
4932 u8 i;
4933 u32 mask = 0;
4934
4935 for (i = 0; i < rates_len; i++) {
4936 int rate = (rates[i] & 0x7f) * 5;
4937 int ridx;
4938
4939 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
4940 struct ieee80211_rate *srate =
4941 &sband->bitrates[ridx];
4942 if (rate == srate->bitrate) {
4943 mask |= 1 << ridx;
4944 break;
4945 }
4946 }
4947 if (ridx == sband->n_bitrates)
4948 return 0; /* rate not found */
4949 }
4950
4951 return mask;
4952 }
4953
ht_rateset_to_mask(struct ieee80211_supported_band * sband,u8 * rates,u8 rates_len,u8 mcs[IEEE80211_HT_MCS_MASK_LEN])4954 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
4955 u8 *rates, u8 rates_len,
4956 u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
4957 {
4958 u8 i;
4959
4960 memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
4961
4962 for (i = 0; i < rates_len; i++) {
4963 int ridx, rbit;
4964
4965 ridx = rates[i] / 8;
4966 rbit = BIT(rates[i] % 8);
4967
4968 /* check validity */
4969 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
4970 return false;
4971
4972 /* check availability */
4973 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
4974 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
4975 mcs[ridx] |= rbit;
4976 else
4977 return false;
4978 }
4979
4980 return true;
4981 }
4982
vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)4983 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
4984 {
4985 u16 mcs_mask = 0;
4986
4987 switch (vht_mcs_map) {
4988 case IEEE80211_VHT_MCS_NOT_SUPPORTED:
4989 break;
4990 case IEEE80211_VHT_MCS_SUPPORT_0_7:
4991 mcs_mask = 0x00FF;
4992 break;
4993 case IEEE80211_VHT_MCS_SUPPORT_0_8:
4994 mcs_mask = 0x01FF;
4995 break;
4996 case IEEE80211_VHT_MCS_SUPPORT_0_9:
4997 mcs_mask = 0x03FF;
4998 break;
4999 default:
5000 break;
5001 }
5002
5003 return mcs_mask;
5004 }
5005
vht_build_mcs_mask(u16 vht_mcs_map,u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])5006 static void vht_build_mcs_mask(u16 vht_mcs_map,
5007 u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
5008 {
5009 u8 nss;
5010
5011 for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
5012 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
5013 vht_mcs_map >>= 2;
5014 }
5015 }
5016
vht_set_mcs_mask(struct ieee80211_supported_band * sband,struct nl80211_txrate_vht * txrate,u16 mcs[NL80211_VHT_NSS_MAX])5017 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
5018 struct nl80211_txrate_vht *txrate,
5019 u16 mcs[NL80211_VHT_NSS_MAX])
5020 {
5021 u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
5022 u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
5023 u8 i;
5024
5025 if (!sband->vht_cap.vht_supported)
5026 return false;
5027
5028 memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
5029
5030 /* Build vht_mcs_mask from VHT capabilities */
5031 vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
5032
5033 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
5034 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
5035 mcs[i] = txrate->mcs[i];
5036 else
5037 return false;
5038 }
5039
5040 return true;
5041 }
5042
he_mcs_map_to_mcs_mask(u8 he_mcs_map)5043 static u16 he_mcs_map_to_mcs_mask(u8 he_mcs_map)
5044 {
5045 switch (he_mcs_map) {
5046 case IEEE80211_HE_MCS_NOT_SUPPORTED:
5047 return 0;
5048 case IEEE80211_HE_MCS_SUPPORT_0_7:
5049 return 0x00FF;
5050 case IEEE80211_HE_MCS_SUPPORT_0_9:
5051 return 0x03FF;
5052 case IEEE80211_HE_MCS_SUPPORT_0_11:
5053 return 0xFFF;
5054 default:
5055 break;
5056 }
5057 return 0;
5058 }
5059
he_build_mcs_mask(u16 he_mcs_map,u16 he_mcs_mask[NL80211_HE_NSS_MAX])5060 static void he_build_mcs_mask(u16 he_mcs_map,
5061 u16 he_mcs_mask[NL80211_HE_NSS_MAX])
5062 {
5063 u8 nss;
5064
5065 for (nss = 0; nss < NL80211_HE_NSS_MAX; nss++) {
5066 he_mcs_mask[nss] = he_mcs_map_to_mcs_mask(he_mcs_map & 0x03);
5067 he_mcs_map >>= 2;
5068 }
5069 }
5070
he_get_txmcsmap(struct genl_info * info,unsigned int link_id,const struct ieee80211_sta_he_cap * he_cap)5071 static u16 he_get_txmcsmap(struct genl_info *info, unsigned int link_id,
5072 const struct ieee80211_sta_he_cap *he_cap)
5073 {
5074 struct net_device *dev = info->user_ptr[1];
5075 struct wireless_dev *wdev = dev->ieee80211_ptr;
5076 struct cfg80211_chan_def *chandef;
5077 __le16 tx_mcs;
5078
5079 chandef = wdev_chandef(wdev, link_id);
5080 if (!chandef) {
5081 /*
5082 * This is probably broken, but we never maintained
5083 * a chandef in these cases, so it always was.
5084 */
5085 return le16_to_cpu(he_cap->he_mcs_nss_supp.tx_mcs_80);
5086 }
5087
5088 switch (chandef->width) {
5089 case NL80211_CHAN_WIDTH_80P80:
5090 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80p80;
5091 break;
5092 case NL80211_CHAN_WIDTH_160:
5093 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_160;
5094 break;
5095 default:
5096 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80;
5097 break;
5098 }
5099
5100 return le16_to_cpu(tx_mcs);
5101 }
5102
he_set_mcs_mask(struct genl_info * info,struct wireless_dev * wdev,struct ieee80211_supported_band * sband,struct nl80211_txrate_he * txrate,u16 mcs[NL80211_HE_NSS_MAX],unsigned int link_id)5103 static bool he_set_mcs_mask(struct genl_info *info,
5104 struct wireless_dev *wdev,
5105 struct ieee80211_supported_band *sband,
5106 struct nl80211_txrate_he *txrate,
5107 u16 mcs[NL80211_HE_NSS_MAX],
5108 unsigned int link_id)
5109 {
5110 const struct ieee80211_sta_he_cap *he_cap;
5111 u16 tx_mcs_mask[NL80211_HE_NSS_MAX] = {};
5112 u16 tx_mcs_map = 0;
5113 u8 i;
5114
5115 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
5116 if (!he_cap)
5117 return false;
5118
5119 memset(mcs, 0, sizeof(u16) * NL80211_HE_NSS_MAX);
5120
5121 tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap);
5122
5123 /* Build he_mcs_mask from HE capabilities */
5124 he_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
5125
5126 for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
5127 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
5128 mcs[i] = txrate->mcs[i];
5129 else
5130 return false;
5131 }
5132
5133 return true;
5134 }
5135
nl80211_parse_tx_bitrate_mask(struct genl_info * info,struct nlattr * attrs[],enum nl80211_attrs attr,struct cfg80211_bitrate_mask * mask,struct net_device * dev,bool default_all_enabled,unsigned int link_id)5136 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
5137 struct nlattr *attrs[],
5138 enum nl80211_attrs attr,
5139 struct cfg80211_bitrate_mask *mask,
5140 struct net_device *dev,
5141 bool default_all_enabled,
5142 unsigned int link_id)
5143 {
5144 struct nlattr *tb[NL80211_TXRATE_MAX + 1];
5145 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5146 struct wireless_dev *wdev = dev->ieee80211_ptr;
5147 int rem, i;
5148 struct nlattr *tx_rates;
5149 struct ieee80211_supported_band *sband;
5150 u16 vht_tx_mcs_map, he_tx_mcs_map;
5151
5152 memset(mask, 0, sizeof(*mask));
5153 /* Default to all rates enabled */
5154 for (i = 0; i < NUM_NL80211_BANDS; i++) {
5155 const struct ieee80211_sta_he_cap *he_cap;
5156
5157 if (!default_all_enabled)
5158 break;
5159
5160 sband = rdev->wiphy.bands[i];
5161
5162 if (!sband)
5163 continue;
5164
5165 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
5166 memcpy(mask->control[i].ht_mcs,
5167 sband->ht_cap.mcs.rx_mask,
5168 sizeof(mask->control[i].ht_mcs));
5169
5170 if (sband->vht_cap.vht_supported) {
5171 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
5172 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
5173 }
5174
5175 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
5176 if (!he_cap)
5177 continue;
5178
5179 he_tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap);
5180 he_build_mcs_mask(he_tx_mcs_map, mask->control[i].he_mcs);
5181
5182 mask->control[i].he_gi = 0xFF;
5183 mask->control[i].he_ltf = 0xFF;
5184 }
5185
5186 /* if no rates are given set it back to the defaults */
5187 if (!attrs[attr])
5188 goto out;
5189
5190 /* The nested attribute uses enum nl80211_band as the index. This maps
5191 * directly to the enum nl80211_band values used in cfg80211.
5192 */
5193 BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
5194 nla_for_each_nested(tx_rates, attrs[attr], rem) {
5195 enum nl80211_band band = nla_type(tx_rates);
5196 int err;
5197
5198 if (band < 0 || band >= NUM_NL80211_BANDS)
5199 return -EINVAL;
5200 sband = rdev->wiphy.bands[band];
5201 if (sband == NULL)
5202 return -EINVAL;
5203 err = nla_parse_nested_deprecated(tb, NL80211_TXRATE_MAX,
5204 tx_rates,
5205 nl80211_txattr_policy,
5206 info->extack);
5207 if (err)
5208 return err;
5209 if (tb[NL80211_TXRATE_LEGACY]) {
5210 mask->control[band].legacy = rateset_to_mask(
5211 sband,
5212 nla_data(tb[NL80211_TXRATE_LEGACY]),
5213 nla_len(tb[NL80211_TXRATE_LEGACY]));
5214 if ((mask->control[band].legacy == 0) &&
5215 nla_len(tb[NL80211_TXRATE_LEGACY]))
5216 return -EINVAL;
5217 }
5218 if (tb[NL80211_TXRATE_HT]) {
5219 if (!ht_rateset_to_mask(
5220 sband,
5221 nla_data(tb[NL80211_TXRATE_HT]),
5222 nla_len(tb[NL80211_TXRATE_HT]),
5223 mask->control[band].ht_mcs))
5224 return -EINVAL;
5225 }
5226
5227 if (tb[NL80211_TXRATE_VHT]) {
5228 if (!vht_set_mcs_mask(
5229 sband,
5230 nla_data(tb[NL80211_TXRATE_VHT]),
5231 mask->control[band].vht_mcs))
5232 return -EINVAL;
5233 }
5234
5235 if (tb[NL80211_TXRATE_GI]) {
5236 mask->control[band].gi =
5237 nla_get_u8(tb[NL80211_TXRATE_GI]);
5238 if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
5239 return -EINVAL;
5240 }
5241 if (tb[NL80211_TXRATE_HE] &&
5242 !he_set_mcs_mask(info, wdev, sband,
5243 nla_data(tb[NL80211_TXRATE_HE]),
5244 mask->control[band].he_mcs,
5245 link_id))
5246 return -EINVAL;
5247
5248 if (tb[NL80211_TXRATE_HE_GI])
5249 mask->control[band].he_gi =
5250 nla_get_u8(tb[NL80211_TXRATE_HE_GI]);
5251 if (tb[NL80211_TXRATE_HE_LTF])
5252 mask->control[band].he_ltf =
5253 nla_get_u8(tb[NL80211_TXRATE_HE_LTF]);
5254
5255 if (mask->control[band].legacy == 0) {
5256 /* don't allow empty legacy rates if HT, VHT or HE
5257 * are not even supported.
5258 */
5259 if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
5260 rdev->wiphy.bands[band]->vht_cap.vht_supported ||
5261 ieee80211_get_he_iftype_cap(sband, wdev->iftype)))
5262 return -EINVAL;
5263
5264 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
5265 if (mask->control[band].ht_mcs[i])
5266 goto out;
5267
5268 for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
5269 if (mask->control[band].vht_mcs[i])
5270 goto out;
5271
5272 for (i = 0; i < NL80211_HE_NSS_MAX; i++)
5273 if (mask->control[band].he_mcs[i])
5274 goto out;
5275
5276 /* legacy and mcs rates may not be both empty */
5277 return -EINVAL;
5278 }
5279 }
5280
5281 out:
5282 return 0;
5283 }
5284
validate_beacon_tx_rate(struct cfg80211_registered_device * rdev,enum nl80211_band band,struct cfg80211_bitrate_mask * beacon_rate)5285 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
5286 enum nl80211_band band,
5287 struct cfg80211_bitrate_mask *beacon_rate)
5288 {
5289 u32 count_ht, count_vht, count_he, i;
5290 u32 rate = beacon_rate->control[band].legacy;
5291
5292 /* Allow only one rate */
5293 if (hweight32(rate) > 1)
5294 return -EINVAL;
5295
5296 count_ht = 0;
5297 for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
5298 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
5299 return -EINVAL;
5300 } else if (beacon_rate->control[band].ht_mcs[i]) {
5301 count_ht++;
5302 if (count_ht > 1)
5303 return -EINVAL;
5304 }
5305 if (count_ht && rate)
5306 return -EINVAL;
5307 }
5308
5309 count_vht = 0;
5310 for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
5311 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
5312 return -EINVAL;
5313 } else if (beacon_rate->control[band].vht_mcs[i]) {
5314 count_vht++;
5315 if (count_vht > 1)
5316 return -EINVAL;
5317 }
5318 if (count_vht && rate)
5319 return -EINVAL;
5320 }
5321
5322 count_he = 0;
5323 for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
5324 if (hweight16(beacon_rate->control[band].he_mcs[i]) > 1) {
5325 return -EINVAL;
5326 } else if (beacon_rate->control[band].he_mcs[i]) {
5327 count_he++;
5328 if (count_he > 1)
5329 return -EINVAL;
5330 }
5331 if (count_he && rate)
5332 return -EINVAL;
5333 }
5334
5335 if ((count_ht && count_vht && count_he) ||
5336 (!rate && !count_ht && !count_vht && !count_he))
5337 return -EINVAL;
5338
5339 if (rate &&
5340 !wiphy_ext_feature_isset(&rdev->wiphy,
5341 NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
5342 return -EINVAL;
5343 if (count_ht &&
5344 !wiphy_ext_feature_isset(&rdev->wiphy,
5345 NL80211_EXT_FEATURE_BEACON_RATE_HT))
5346 return -EINVAL;
5347 if (count_vht &&
5348 !wiphy_ext_feature_isset(&rdev->wiphy,
5349 NL80211_EXT_FEATURE_BEACON_RATE_VHT))
5350 return -EINVAL;
5351 if (count_he &&
5352 !wiphy_ext_feature_isset(&rdev->wiphy,
5353 NL80211_EXT_FEATURE_BEACON_RATE_HE))
5354 return -EINVAL;
5355
5356 return 0;
5357 }
5358
nl80211_parse_mbssid_config(struct wiphy * wiphy,struct net_device * dev,struct nlattr * attrs,struct cfg80211_mbssid_config * config,u8 num_elems)5359 static int nl80211_parse_mbssid_config(struct wiphy *wiphy,
5360 struct net_device *dev,
5361 struct nlattr *attrs,
5362 struct cfg80211_mbssid_config *config,
5363 u8 num_elems)
5364 {
5365 struct nlattr *tb[NL80211_MBSSID_CONFIG_ATTR_MAX + 1];
5366
5367 if (!wiphy->mbssid_max_interfaces)
5368 return -EOPNOTSUPP;
5369
5370 if (nla_parse_nested(tb, NL80211_MBSSID_CONFIG_ATTR_MAX, attrs, NULL,
5371 NULL) ||
5372 !tb[NL80211_MBSSID_CONFIG_ATTR_INDEX])
5373 return -EINVAL;
5374
5375 config->ema = nla_get_flag(tb[NL80211_MBSSID_CONFIG_ATTR_EMA]);
5376 if (config->ema) {
5377 if (!wiphy->ema_max_profile_periodicity)
5378 return -EOPNOTSUPP;
5379
5380 if (num_elems > wiphy->ema_max_profile_periodicity)
5381 return -EINVAL;
5382 }
5383
5384 config->index = nla_get_u8(tb[NL80211_MBSSID_CONFIG_ATTR_INDEX]);
5385 if (config->index >= wiphy->mbssid_max_interfaces ||
5386 (!config->index && !num_elems))
5387 return -EINVAL;
5388
5389 if (tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]) {
5390 u32 tx_ifindex =
5391 nla_get_u32(tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]);
5392
5393 if ((!config->index && tx_ifindex != dev->ifindex) ||
5394 (config->index && tx_ifindex == dev->ifindex))
5395 return -EINVAL;
5396
5397 if (tx_ifindex != dev->ifindex) {
5398 struct net_device *tx_netdev =
5399 dev_get_by_index(wiphy_net(wiphy), tx_ifindex);
5400
5401 if (!tx_netdev || !tx_netdev->ieee80211_ptr ||
5402 tx_netdev->ieee80211_ptr->wiphy != wiphy ||
5403 tx_netdev->ieee80211_ptr->iftype !=
5404 NL80211_IFTYPE_AP) {
5405 dev_put(tx_netdev);
5406 return -EINVAL;
5407 }
5408
5409 config->tx_wdev = tx_netdev->ieee80211_ptr;
5410 } else {
5411 config->tx_wdev = dev->ieee80211_ptr;
5412 }
5413 } else if (!config->index) {
5414 config->tx_wdev = dev->ieee80211_ptr;
5415 } else {
5416 return -EINVAL;
5417 }
5418
5419 return 0;
5420 }
5421
5422 static struct cfg80211_mbssid_elems *
nl80211_parse_mbssid_elems(struct wiphy * wiphy,struct nlattr * attrs)5423 nl80211_parse_mbssid_elems(struct wiphy *wiphy, struct nlattr *attrs)
5424 {
5425 struct nlattr *nl_elems;
5426 struct cfg80211_mbssid_elems *elems;
5427 int rem_elems;
5428 u8 i = 0, num_elems = 0;
5429
5430 if (!wiphy->mbssid_max_interfaces)
5431 return ERR_PTR(-EINVAL);
5432
5433 nla_for_each_nested(nl_elems, attrs, rem_elems) {
5434 if (num_elems >= 255)
5435 return ERR_PTR(-EINVAL);
5436 num_elems++;
5437 }
5438
5439 elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL);
5440 if (!elems)
5441 return ERR_PTR(-ENOMEM);
5442 elems->cnt = num_elems;
5443
5444 nla_for_each_nested(nl_elems, attrs, rem_elems) {
5445 elems->elem[i].data = nla_data(nl_elems);
5446 elems->elem[i].len = nla_len(nl_elems);
5447 i++;
5448 }
5449 return elems;
5450 }
5451
5452 static struct cfg80211_rnr_elems *
nl80211_parse_rnr_elems(struct wiphy * wiphy,struct nlattr * attrs,struct netlink_ext_ack * extack)5453 nl80211_parse_rnr_elems(struct wiphy *wiphy, struct nlattr *attrs,
5454 struct netlink_ext_ack *extack)
5455 {
5456 struct nlattr *nl_elems;
5457 struct cfg80211_rnr_elems *elems;
5458 int rem_elems;
5459 u8 i = 0, num_elems = 0;
5460
5461 nla_for_each_nested(nl_elems, attrs, rem_elems) {
5462 int ret;
5463
5464 ret = validate_ie_attr(nl_elems, extack);
5465 if (ret)
5466 return ERR_PTR(ret);
5467
5468 num_elems++;
5469 }
5470
5471 elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL);
5472 if (!elems)
5473 return ERR_PTR(-ENOMEM);
5474 elems->cnt = num_elems;
5475
5476 nla_for_each_nested(nl_elems, attrs, rem_elems) {
5477 elems->elem[i].data = nla_data(nl_elems);
5478 elems->elem[i].len = nla_len(nl_elems);
5479 i++;
5480 }
5481 return elems;
5482 }
5483
nl80211_parse_he_bss_color(struct nlattr * attrs,struct cfg80211_he_bss_color * he_bss_color)5484 static int nl80211_parse_he_bss_color(struct nlattr *attrs,
5485 struct cfg80211_he_bss_color *he_bss_color)
5486 {
5487 struct nlattr *tb[NL80211_HE_BSS_COLOR_ATTR_MAX + 1];
5488 int err;
5489
5490 err = nla_parse_nested(tb, NL80211_HE_BSS_COLOR_ATTR_MAX, attrs,
5491 he_bss_color_policy, NULL);
5492 if (err)
5493 return err;
5494
5495 if (!tb[NL80211_HE_BSS_COLOR_ATTR_COLOR])
5496 return -EINVAL;
5497
5498 he_bss_color->color =
5499 nla_get_u8(tb[NL80211_HE_BSS_COLOR_ATTR_COLOR]);
5500 he_bss_color->enabled =
5501 !nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_DISABLED]);
5502 he_bss_color->partial =
5503 nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_PARTIAL]);
5504
5505 return 0;
5506 }
5507
nl80211_parse_beacon(struct cfg80211_registered_device * rdev,struct nlattr * attrs[],struct cfg80211_beacon_data * bcn,struct netlink_ext_ack * extack)5508 static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
5509 struct nlattr *attrs[],
5510 struct cfg80211_beacon_data *bcn,
5511 struct netlink_ext_ack *extack)
5512 {
5513 bool haveinfo = false;
5514 int err;
5515
5516 memset(bcn, 0, sizeof(*bcn));
5517
5518 bcn->link_id = nl80211_link_id(attrs);
5519
5520 if (attrs[NL80211_ATTR_BEACON_HEAD]) {
5521 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
5522 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
5523 if (!bcn->head_len)
5524 return -EINVAL;
5525 haveinfo = true;
5526 }
5527
5528 if (attrs[NL80211_ATTR_BEACON_TAIL]) {
5529 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
5530 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
5531 haveinfo = true;
5532 }
5533
5534 if (!haveinfo)
5535 return -EINVAL;
5536
5537 if (attrs[NL80211_ATTR_IE]) {
5538 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
5539 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
5540 }
5541
5542 if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
5543 bcn->proberesp_ies =
5544 nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
5545 bcn->proberesp_ies_len =
5546 nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
5547 }
5548
5549 if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
5550 bcn->assocresp_ies =
5551 nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
5552 bcn->assocresp_ies_len =
5553 nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
5554 }
5555
5556 if (attrs[NL80211_ATTR_PROBE_RESP]) {
5557 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
5558 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
5559 }
5560
5561 if (attrs[NL80211_ATTR_FTM_RESPONDER]) {
5562 struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1];
5563
5564 err = nla_parse_nested_deprecated(tb,
5565 NL80211_FTM_RESP_ATTR_MAX,
5566 attrs[NL80211_ATTR_FTM_RESPONDER],
5567 NULL, NULL);
5568 if (err)
5569 return err;
5570
5571 if (tb[NL80211_FTM_RESP_ATTR_ENABLED] &&
5572 wiphy_ext_feature_isset(&rdev->wiphy,
5573 NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER))
5574 bcn->ftm_responder = 1;
5575 else
5576 return -EOPNOTSUPP;
5577
5578 if (tb[NL80211_FTM_RESP_ATTR_LCI]) {
5579 bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]);
5580 bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]);
5581 }
5582
5583 if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) {
5584 bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
5585 bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
5586 }
5587 } else {
5588 bcn->ftm_responder = -1;
5589 }
5590
5591 if (attrs[NL80211_ATTR_HE_BSS_COLOR]) {
5592 err = nl80211_parse_he_bss_color(attrs[NL80211_ATTR_HE_BSS_COLOR],
5593 &bcn->he_bss_color);
5594 if (err)
5595 return err;
5596 bcn->he_bss_color_valid = true;
5597 }
5598
5599 if (attrs[NL80211_ATTR_MBSSID_ELEMS]) {
5600 struct cfg80211_mbssid_elems *mbssid =
5601 nl80211_parse_mbssid_elems(&rdev->wiphy,
5602 attrs[NL80211_ATTR_MBSSID_ELEMS]);
5603
5604 if (IS_ERR(mbssid))
5605 return PTR_ERR(mbssid);
5606
5607 bcn->mbssid_ies = mbssid;
5608
5609 if (bcn->mbssid_ies && attrs[NL80211_ATTR_EMA_RNR_ELEMS]) {
5610 struct cfg80211_rnr_elems *rnr =
5611 nl80211_parse_rnr_elems(&rdev->wiphy,
5612 attrs[NL80211_ATTR_EMA_RNR_ELEMS],
5613 extack);
5614
5615 if (IS_ERR(rnr))
5616 return PTR_ERR(rnr);
5617
5618 if (rnr && rnr->cnt < bcn->mbssid_ies->cnt)
5619 return -EINVAL;
5620
5621 bcn->rnr_ies = rnr;
5622 }
5623 }
5624
5625 return 0;
5626 }
5627
nl80211_parse_he_obss_pd(struct nlattr * attrs,struct ieee80211_he_obss_pd * he_obss_pd)5628 static int nl80211_parse_he_obss_pd(struct nlattr *attrs,
5629 struct ieee80211_he_obss_pd *he_obss_pd)
5630 {
5631 struct nlattr *tb[NL80211_HE_OBSS_PD_ATTR_MAX + 1];
5632 int err;
5633
5634 err = nla_parse_nested(tb, NL80211_HE_OBSS_PD_ATTR_MAX, attrs,
5635 he_obss_pd_policy, NULL);
5636 if (err)
5637 return err;
5638
5639 if (!tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL])
5640 return -EINVAL;
5641
5642 he_obss_pd->sr_ctrl = nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL]);
5643
5644 if (tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET])
5645 he_obss_pd->min_offset =
5646 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]);
5647 if (tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET])
5648 he_obss_pd->max_offset =
5649 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]);
5650 if (tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET])
5651 he_obss_pd->non_srg_max_offset =
5652 nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET]);
5653
5654 if (he_obss_pd->min_offset > he_obss_pd->max_offset)
5655 return -EINVAL;
5656
5657 if (tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP])
5658 memcpy(he_obss_pd->bss_color_bitmap,
5659 nla_data(tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP]),
5660 sizeof(he_obss_pd->bss_color_bitmap));
5661
5662 if (tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP])
5663 memcpy(he_obss_pd->partial_bssid_bitmap,
5664 nla_data(tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP]),
5665 sizeof(he_obss_pd->partial_bssid_bitmap));
5666
5667 he_obss_pd->enable = true;
5668
5669 return 0;
5670 }
5671
nl80211_parse_fils_discovery(struct cfg80211_registered_device * rdev,struct nlattr * attrs,struct cfg80211_ap_settings * params)5672 static int nl80211_parse_fils_discovery(struct cfg80211_registered_device *rdev,
5673 struct nlattr *attrs,
5674 struct cfg80211_ap_settings *params)
5675 {
5676 struct nlattr *tb[NL80211_FILS_DISCOVERY_ATTR_MAX + 1];
5677 int ret;
5678 struct cfg80211_fils_discovery *fd = ¶ms->fils_discovery;
5679
5680 if (!wiphy_ext_feature_isset(&rdev->wiphy,
5681 NL80211_EXT_FEATURE_FILS_DISCOVERY))
5682 return -EINVAL;
5683
5684 ret = nla_parse_nested(tb, NL80211_FILS_DISCOVERY_ATTR_MAX, attrs,
5685 NULL, NULL);
5686 if (ret)
5687 return ret;
5688
5689 if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] ||
5690 !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] ||
5691 !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL])
5692 return -EINVAL;
5693
5694 fd->tmpl_len = nla_len(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
5695 fd->tmpl = nla_data(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
5696 fd->min_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN]);
5697 fd->max_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX]);
5698
5699 return 0;
5700 }
5701
5702 static int
nl80211_parse_unsol_bcast_probe_resp(struct cfg80211_registered_device * rdev,struct nlattr * attrs,struct cfg80211_ap_settings * params)5703 nl80211_parse_unsol_bcast_probe_resp(struct cfg80211_registered_device *rdev,
5704 struct nlattr *attrs,
5705 struct cfg80211_ap_settings *params)
5706 {
5707 struct nlattr *tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1];
5708 int ret;
5709 struct cfg80211_unsol_bcast_probe_resp *presp =
5710 ¶ms->unsol_bcast_probe_resp;
5711
5712 if (!wiphy_ext_feature_isset(&rdev->wiphy,
5713 NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP))
5714 return -EINVAL;
5715
5716 ret = nla_parse_nested(tb, NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX,
5717 attrs, NULL, NULL);
5718 if (ret)
5719 return ret;
5720
5721 if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] ||
5722 !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL])
5723 return -EINVAL;
5724
5725 presp->tmpl = nla_data(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
5726 presp->tmpl_len = nla_len(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
5727 presp->interval = nla_get_u32(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT]);
5728 return 0;
5729 }
5730
nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings * params,const struct element * rates)5731 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
5732 const struct element *rates)
5733 {
5734 int i;
5735
5736 if (!rates)
5737 return;
5738
5739 for (i = 0; i < rates->datalen; i++) {
5740 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
5741 params->ht_required = true;
5742 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
5743 params->vht_required = true;
5744 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HE_PHY)
5745 params->he_required = true;
5746 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_SAE_H2E)
5747 params->sae_h2e_required = true;
5748 }
5749 }
5750
5751 /*
5752 * Since the nl80211 API didn't include, from the beginning, attributes about
5753 * HT/VHT requirements/capabilities, we parse them out of the IEs for the
5754 * benefit of drivers that rebuild IEs in the firmware.
5755 */
nl80211_calculate_ap_params(struct cfg80211_ap_settings * params)5756 static int nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
5757 {
5758 const struct cfg80211_beacon_data *bcn = ¶ms->beacon;
5759 size_t ies_len = bcn->tail_len;
5760 const u8 *ies = bcn->tail;
5761 const struct element *rates;
5762 const struct element *cap;
5763
5764 rates = cfg80211_find_elem(WLAN_EID_SUPP_RATES, ies, ies_len);
5765 nl80211_check_ap_rate_selectors(params, rates);
5766
5767 rates = cfg80211_find_elem(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
5768 nl80211_check_ap_rate_selectors(params, rates);
5769
5770 cap = cfg80211_find_elem(WLAN_EID_HT_CAPABILITY, ies, ies_len);
5771 if (cap && cap->datalen >= sizeof(*params->ht_cap))
5772 params->ht_cap = (void *)cap->data;
5773 cap = cfg80211_find_elem(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
5774 if (cap && cap->datalen >= sizeof(*params->vht_cap))
5775 params->vht_cap = (void *)cap->data;
5776 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len);
5777 if (cap && cap->datalen >= sizeof(*params->he_cap) + 1)
5778 params->he_cap = (void *)(cap->data + 1);
5779 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ies, ies_len);
5780 if (cap && cap->datalen >= sizeof(*params->he_oper) + 1)
5781 params->he_oper = (void *)(cap->data + 1);
5782 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_CAPABILITY, ies, ies_len);
5783 if (cap) {
5784 if (!cap->datalen)
5785 return -EINVAL;
5786 params->eht_cap = (void *)(cap->data + 1);
5787 if (!ieee80211_eht_capa_size_ok((const u8 *)params->he_cap,
5788 (const u8 *)params->eht_cap,
5789 cap->datalen - 1, true))
5790 return -EINVAL;
5791 }
5792 cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_OPERATION, ies, ies_len);
5793 if (cap) {
5794 if (!cap->datalen)
5795 return -EINVAL;
5796 params->eht_oper = (void *)(cap->data + 1);
5797 if (!ieee80211_eht_oper_size_ok((const u8 *)params->eht_oper,
5798 cap->datalen - 1))
5799 return -EINVAL;
5800 }
5801 return 0;
5802 }
5803
nl80211_get_ap_channel(struct cfg80211_registered_device * rdev,struct cfg80211_ap_settings * params)5804 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
5805 struct cfg80211_ap_settings *params)
5806 {
5807 struct wireless_dev *wdev;
5808
5809 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
5810 if (wdev->iftype != NL80211_IFTYPE_AP &&
5811 wdev->iftype != NL80211_IFTYPE_P2P_GO)
5812 continue;
5813
5814 if (!wdev->u.ap.preset_chandef.chan)
5815 continue;
5816
5817 params->chandef = wdev->u.ap.preset_chandef;
5818 return true;
5819 }
5820
5821 return false;
5822 }
5823
nl80211_valid_auth_type(struct cfg80211_registered_device * rdev,enum nl80211_auth_type auth_type,enum nl80211_commands cmd)5824 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
5825 enum nl80211_auth_type auth_type,
5826 enum nl80211_commands cmd)
5827 {
5828 if (auth_type > NL80211_AUTHTYPE_MAX)
5829 return false;
5830
5831 switch (cmd) {
5832 case NL80211_CMD_AUTHENTICATE:
5833 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
5834 auth_type == NL80211_AUTHTYPE_SAE)
5835 return false;
5836 if (!wiphy_ext_feature_isset(&rdev->wiphy,
5837 NL80211_EXT_FEATURE_FILS_STA) &&
5838 (auth_type == NL80211_AUTHTYPE_FILS_SK ||
5839 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5840 auth_type == NL80211_AUTHTYPE_FILS_PK))
5841 return false;
5842 return true;
5843 case NL80211_CMD_CONNECT:
5844 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
5845 !wiphy_ext_feature_isset(&rdev->wiphy,
5846 NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
5847 auth_type == NL80211_AUTHTYPE_SAE)
5848 return false;
5849
5850 /* FILS with SK PFS or PK not supported yet */
5851 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5852 auth_type == NL80211_AUTHTYPE_FILS_PK)
5853 return false;
5854 if (!wiphy_ext_feature_isset(
5855 &rdev->wiphy,
5856 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
5857 auth_type == NL80211_AUTHTYPE_FILS_SK)
5858 return false;
5859 return true;
5860 case NL80211_CMD_START_AP:
5861 if (!wiphy_ext_feature_isset(&rdev->wiphy,
5862 NL80211_EXT_FEATURE_SAE_OFFLOAD_AP) &&
5863 auth_type == NL80211_AUTHTYPE_SAE)
5864 return false;
5865 /* FILS not supported yet */
5866 if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
5867 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5868 auth_type == NL80211_AUTHTYPE_FILS_PK)
5869 return false;
5870 return true;
5871 default:
5872 return false;
5873 }
5874 }
5875
nl80211_send_ap_started(struct wireless_dev * wdev,unsigned int link_id)5876 static void nl80211_send_ap_started(struct wireless_dev *wdev,
5877 unsigned int link_id)
5878 {
5879 struct wiphy *wiphy = wdev->wiphy;
5880 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
5881 struct sk_buff *msg;
5882 void *hdr;
5883
5884 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5885 if (!msg)
5886 return;
5887
5888 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_START_AP);
5889 if (!hdr)
5890 goto out;
5891
5892 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
5893 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
5894 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
5895 NL80211_ATTR_PAD) ||
5896 (wdev->u.ap.ssid_len &&
5897 nla_put(msg, NL80211_ATTR_SSID, wdev->u.ap.ssid_len,
5898 wdev->u.ap.ssid)) ||
5899 (wdev->valid_links &&
5900 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)))
5901 goto out;
5902
5903 genlmsg_end(msg, hdr);
5904
5905 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
5906 NL80211_MCGRP_MLME, GFP_KERNEL);
5907 return;
5908 out:
5909 nlmsg_free(msg);
5910 }
5911
nl80211_validate_ap_phy_operation(struct cfg80211_ap_settings * params)5912 static int nl80211_validate_ap_phy_operation(struct cfg80211_ap_settings *params)
5913 {
5914 struct ieee80211_channel *channel = params->chandef.chan;
5915
5916 if ((params->he_cap || params->he_oper) &&
5917 (channel->flags & IEEE80211_CHAN_NO_HE))
5918 return -EOPNOTSUPP;
5919
5920 if ((params->eht_cap || params->eht_oper) &&
5921 (channel->flags & IEEE80211_CHAN_NO_EHT))
5922 return -EOPNOTSUPP;
5923
5924 return 0;
5925 }
5926
nl80211_start_ap(struct sk_buff * skb,struct genl_info * info)5927 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
5928 {
5929 struct cfg80211_registered_device *rdev = info->user_ptr[0];
5930 unsigned int link_id = nl80211_link_id(info->attrs);
5931 struct net_device *dev = info->user_ptr[1];
5932 struct wireless_dev *wdev = dev->ieee80211_ptr;
5933 struct cfg80211_ap_settings *params;
5934 int err;
5935
5936 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5937 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5938 return -EOPNOTSUPP;
5939
5940 if (!rdev->ops->start_ap)
5941 return -EOPNOTSUPP;
5942
5943 if (wdev->links[link_id].ap.beacon_interval)
5944 return -EALREADY;
5945
5946 /* these are required for START_AP */
5947 if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
5948 !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
5949 !info->attrs[NL80211_ATTR_BEACON_HEAD])
5950 return -EINVAL;
5951
5952 params = kzalloc(sizeof(*params), GFP_KERNEL);
5953 if (!params)
5954 return -ENOMEM;
5955
5956 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms->beacon,
5957 info->extack);
5958 if (err)
5959 goto out;
5960
5961 params->beacon_interval =
5962 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
5963 params->dtim_period =
5964 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
5965
5966 err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
5967 params->beacon_interval);
5968 if (err)
5969 goto out;
5970
5971 /*
5972 * In theory, some of these attributes should be required here
5973 * but since they were not used when the command was originally
5974 * added, keep them optional for old user space programs to let
5975 * them continue to work with drivers that do not need the
5976 * additional information -- drivers must check!
5977 */
5978 if (info->attrs[NL80211_ATTR_SSID]) {
5979 params->ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5980 params->ssid_len =
5981 nla_len(info->attrs[NL80211_ATTR_SSID]);
5982 if (params->ssid_len == 0) {
5983 err = -EINVAL;
5984 goto out;
5985 }
5986
5987 if (wdev->u.ap.ssid_len &&
5988 (wdev->u.ap.ssid_len != params->ssid_len ||
5989 memcmp(wdev->u.ap.ssid, params->ssid, params->ssid_len))) {
5990 /* require identical SSID for MLO */
5991 err = -EINVAL;
5992 goto out;
5993 }
5994 } else if (wdev->valid_links) {
5995 /* require SSID for MLO */
5996 err = -EINVAL;
5997 goto out;
5998 }
5999
6000 if (info->attrs[NL80211_ATTR_HIDDEN_SSID])
6001 params->hidden_ssid = nla_get_u32(
6002 info->attrs[NL80211_ATTR_HIDDEN_SSID]);
6003
6004 params->privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
6005
6006 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
6007 params->auth_type = nla_get_u32(
6008 info->attrs[NL80211_ATTR_AUTH_TYPE]);
6009 if (!nl80211_valid_auth_type(rdev, params->auth_type,
6010 NL80211_CMD_START_AP)) {
6011 err = -EINVAL;
6012 goto out;
6013 }
6014 } else
6015 params->auth_type = NL80211_AUTHTYPE_AUTOMATIC;
6016
6017 err = nl80211_crypto_settings(rdev, info, ¶ms->crypto,
6018 NL80211_MAX_NR_CIPHER_SUITES);
6019 if (err)
6020 goto out;
6021
6022 if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
6023 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER)) {
6024 err = -EOPNOTSUPP;
6025 goto out;
6026 }
6027 params->inactivity_timeout = nla_get_u16(
6028 info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
6029 }
6030
6031 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
6032 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
6033 err = -EINVAL;
6034 goto out;
6035 }
6036 params->p2p_ctwindow =
6037 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
6038 if (params->p2p_ctwindow != 0 &&
6039 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) {
6040 err = -EINVAL;
6041 goto out;
6042 }
6043 }
6044
6045 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
6046 u8 tmp;
6047
6048 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
6049 err = -EINVAL;
6050 goto out;
6051 }
6052 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
6053 params->p2p_opp_ps = tmp;
6054 if (params->p2p_opp_ps != 0 &&
6055 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) {
6056 err = -EINVAL;
6057 goto out;
6058 }
6059 }
6060
6061 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
6062 err = nl80211_parse_chandef(rdev, info, ¶ms->chandef);
6063 if (err)
6064 goto out;
6065 } else if (wdev->valid_links) {
6066 /* with MLD need to specify the channel configuration */
6067 err = -EINVAL;
6068 goto out;
6069 } else if (wdev->u.ap.preset_chandef.chan) {
6070 params->chandef = wdev->u.ap.preset_chandef;
6071 } else if (!nl80211_get_ap_channel(rdev, params)) {
6072 err = -EINVAL;
6073 goto out;
6074 }
6075
6076 if (info->attrs[NL80211_ATTR_PUNCT_BITMAP]) {
6077 err = nl80211_parse_punct_bitmap(rdev, info,
6078 ¶ms->chandef,
6079 ¶ms->punct_bitmap);
6080 if (err)
6081 goto out;
6082 }
6083
6084 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms->chandef,
6085 wdev->iftype)) {
6086 err = -EINVAL;
6087 goto out;
6088 }
6089
6090 wdev_lock(wdev);
6091
6092 if (info->attrs[NL80211_ATTR_TX_RATES]) {
6093 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
6094 NL80211_ATTR_TX_RATES,
6095 ¶ms->beacon_rate,
6096 dev, false, link_id);
6097 if (err)
6098 goto out_unlock;
6099
6100 err = validate_beacon_tx_rate(rdev, params->chandef.chan->band,
6101 ¶ms->beacon_rate);
6102 if (err)
6103 goto out_unlock;
6104 }
6105
6106 if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
6107 params->smps_mode =
6108 nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
6109 switch (params->smps_mode) {
6110 case NL80211_SMPS_OFF:
6111 break;
6112 case NL80211_SMPS_STATIC:
6113 if (!(rdev->wiphy.features &
6114 NL80211_FEATURE_STATIC_SMPS)) {
6115 err = -EINVAL;
6116 goto out_unlock;
6117 }
6118 break;
6119 case NL80211_SMPS_DYNAMIC:
6120 if (!(rdev->wiphy.features &
6121 NL80211_FEATURE_DYNAMIC_SMPS)) {
6122 err = -EINVAL;
6123 goto out_unlock;
6124 }
6125 break;
6126 default:
6127 err = -EINVAL;
6128 goto out_unlock;
6129 }
6130 } else {
6131 params->smps_mode = NL80211_SMPS_OFF;
6132 }
6133
6134 params->pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
6135 if (params->pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
6136 err = -EOPNOTSUPP;
6137 goto out_unlock;
6138 }
6139
6140 if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
6141 params->acl = parse_acl_data(&rdev->wiphy, info);
6142 if (IS_ERR(params->acl)) {
6143 err = PTR_ERR(params->acl);
6144 params->acl = NULL;
6145 goto out_unlock;
6146 }
6147 }
6148
6149 params->twt_responder =
6150 nla_get_flag(info->attrs[NL80211_ATTR_TWT_RESPONDER]);
6151
6152 if (info->attrs[NL80211_ATTR_HE_OBSS_PD]) {
6153 err = nl80211_parse_he_obss_pd(
6154 info->attrs[NL80211_ATTR_HE_OBSS_PD],
6155 ¶ms->he_obss_pd);
6156 if (err)
6157 goto out_unlock;
6158 }
6159
6160 if (info->attrs[NL80211_ATTR_FILS_DISCOVERY]) {
6161 err = nl80211_parse_fils_discovery(rdev,
6162 info->attrs[NL80211_ATTR_FILS_DISCOVERY],
6163 params);
6164 if (err)
6165 goto out_unlock;
6166 }
6167
6168 if (info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) {
6169 err = nl80211_parse_unsol_bcast_probe_resp(
6170 rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP],
6171 params);
6172 if (err)
6173 goto out_unlock;
6174 }
6175
6176 if (info->attrs[NL80211_ATTR_MBSSID_CONFIG]) {
6177 err = nl80211_parse_mbssid_config(&rdev->wiphy, dev,
6178 info->attrs[NL80211_ATTR_MBSSID_CONFIG],
6179 ¶ms->mbssid_config,
6180 params->beacon.mbssid_ies ?
6181 params->beacon.mbssid_ies->cnt :
6182 0);
6183 if (err)
6184 goto out_unlock;
6185 }
6186
6187 if (!params->mbssid_config.ema && params->beacon.rnr_ies) {
6188 err = -EINVAL;
6189 goto out_unlock;
6190 }
6191
6192 err = nl80211_calculate_ap_params(params);
6193 if (err)
6194 goto out_unlock;
6195
6196 err = nl80211_validate_ap_phy_operation(params);
6197 if (err)
6198 goto out_unlock;
6199
6200 if (info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS])
6201 params->flags = nla_get_u32(
6202 info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS]);
6203 else if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])
6204 params->flags |= NL80211_AP_SETTINGS_EXTERNAL_AUTH_SUPPORT;
6205
6206 if (wdev->conn_owner_nlportid &&
6207 info->attrs[NL80211_ATTR_SOCKET_OWNER] &&
6208 wdev->conn_owner_nlportid != info->snd_portid) {
6209 err = -EINVAL;
6210 goto out_unlock;
6211 }
6212
6213 /* FIXME: validate MLO/link-id against driver capabilities */
6214
6215 err = rdev_start_ap(rdev, dev, params);
6216 if (!err) {
6217 wdev->links[link_id].ap.beacon_interval = params->beacon_interval;
6218 wdev->links[link_id].ap.chandef = params->chandef;
6219 wdev->u.ap.ssid_len = params->ssid_len;
6220 memcpy(wdev->u.ap.ssid, params->ssid,
6221 params->ssid_len);
6222
6223 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
6224 wdev->conn_owner_nlportid = info->snd_portid;
6225
6226 nl80211_send_ap_started(wdev, link_id);
6227 }
6228 out_unlock:
6229 wdev_unlock(wdev);
6230 out:
6231 kfree(params->acl);
6232 kfree(params->beacon.mbssid_ies);
6233 if (params->mbssid_config.tx_wdev &&
6234 params->mbssid_config.tx_wdev->netdev &&
6235 params->mbssid_config.tx_wdev->netdev != dev)
6236 dev_put(params->mbssid_config.tx_wdev->netdev);
6237 kfree(params->beacon.rnr_ies);
6238 kfree(params);
6239
6240 return err;
6241 }
6242
nl80211_set_beacon(struct sk_buff * skb,struct genl_info * info)6243 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
6244 {
6245 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6246 unsigned int link_id = nl80211_link_id(info->attrs);
6247 struct net_device *dev = info->user_ptr[1];
6248 struct wireless_dev *wdev = dev->ieee80211_ptr;
6249 struct cfg80211_beacon_data params;
6250 int err;
6251
6252 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6253 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6254 return -EOPNOTSUPP;
6255
6256 if (!rdev->ops->change_beacon)
6257 return -EOPNOTSUPP;
6258
6259 if (!wdev->links[link_id].ap.beacon_interval)
6260 return -EINVAL;
6261
6262 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms, info->extack);
6263 if (err)
6264 goto out;
6265
6266 wdev_lock(wdev);
6267 err = rdev_change_beacon(rdev, dev, ¶ms);
6268 wdev_unlock(wdev);
6269
6270 out:
6271 kfree(params.mbssid_ies);
6272 kfree(params.rnr_ies);
6273 return err;
6274 }
6275
nl80211_stop_ap(struct sk_buff * skb,struct genl_info * info)6276 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
6277 {
6278 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6279 unsigned int link_id = nl80211_link_id(info->attrs);
6280 struct net_device *dev = info->user_ptr[1];
6281
6282 return cfg80211_stop_ap(rdev, dev, link_id, false);
6283 }
6284
6285 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
6286 [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
6287 [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
6288 [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
6289 [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
6290 [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
6291 [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
6292 };
6293
parse_station_flags(struct genl_info * info,enum nl80211_iftype iftype,struct station_parameters * params)6294 static int parse_station_flags(struct genl_info *info,
6295 enum nl80211_iftype iftype,
6296 struct station_parameters *params)
6297 {
6298 struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
6299 struct nlattr *nla;
6300 int flag;
6301
6302 /*
6303 * Try parsing the new attribute first so userspace
6304 * can specify both for older kernels.
6305 */
6306 nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
6307 if (nla) {
6308 struct nl80211_sta_flag_update *sta_flags;
6309
6310 sta_flags = nla_data(nla);
6311 params->sta_flags_mask = sta_flags->mask;
6312 params->sta_flags_set = sta_flags->set;
6313 params->sta_flags_set &= params->sta_flags_mask;
6314 if ((params->sta_flags_mask |
6315 params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
6316 return -EINVAL;
6317 return 0;
6318 }
6319
6320 /* if present, parse the old attribute */
6321
6322 nla = info->attrs[NL80211_ATTR_STA_FLAGS];
6323 if (!nla)
6324 return 0;
6325
6326 if (nla_parse_nested_deprecated(flags, NL80211_STA_FLAG_MAX, nla, sta_flags_policy, info->extack))
6327 return -EINVAL;
6328
6329 /*
6330 * Only allow certain flags for interface types so that
6331 * other attributes are silently ignored. Remember that
6332 * this is backward compatibility code with old userspace
6333 * and shouldn't be hit in other cases anyway.
6334 */
6335 switch (iftype) {
6336 case NL80211_IFTYPE_AP:
6337 case NL80211_IFTYPE_AP_VLAN:
6338 case NL80211_IFTYPE_P2P_GO:
6339 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
6340 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
6341 BIT(NL80211_STA_FLAG_WME) |
6342 BIT(NL80211_STA_FLAG_MFP);
6343 break;
6344 case NL80211_IFTYPE_P2P_CLIENT:
6345 case NL80211_IFTYPE_STATION:
6346 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
6347 BIT(NL80211_STA_FLAG_TDLS_PEER);
6348 break;
6349 case NL80211_IFTYPE_MESH_POINT:
6350 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6351 BIT(NL80211_STA_FLAG_MFP) |
6352 BIT(NL80211_STA_FLAG_AUTHORIZED);
6353 break;
6354 default:
6355 return -EINVAL;
6356 }
6357
6358 for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
6359 if (flags[flag]) {
6360 params->sta_flags_set |= (1<<flag);
6361
6362 /* no longer support new API additions in old API */
6363 if (flag > NL80211_STA_FLAG_MAX_OLD_API)
6364 return -EINVAL;
6365 }
6366 }
6367
6368 return 0;
6369 }
6370
nl80211_put_sta_rate(struct sk_buff * msg,struct rate_info * info,int attr)6371 bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, int attr)
6372 {
6373 struct nlattr *rate;
6374 u32 bitrate;
6375 u16 bitrate_compat;
6376 enum nl80211_rate_info rate_flg;
6377
6378 rate = nla_nest_start_noflag(msg, attr);
6379 if (!rate)
6380 return false;
6381
6382 /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
6383 bitrate = cfg80211_calculate_bitrate(info);
6384 /* report 16-bit bitrate only if we can */
6385 bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
6386 if (bitrate > 0 &&
6387 nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
6388 return false;
6389 if (bitrate_compat > 0 &&
6390 nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
6391 return false;
6392
6393 switch (info->bw) {
6394 case RATE_INFO_BW_1:
6395 rate_flg = NL80211_RATE_INFO_1_MHZ_WIDTH;
6396 break;
6397 case RATE_INFO_BW_2:
6398 rate_flg = NL80211_RATE_INFO_2_MHZ_WIDTH;
6399 break;
6400 case RATE_INFO_BW_4:
6401 rate_flg = NL80211_RATE_INFO_4_MHZ_WIDTH;
6402 break;
6403 case RATE_INFO_BW_5:
6404 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
6405 break;
6406 case RATE_INFO_BW_8:
6407 rate_flg = NL80211_RATE_INFO_8_MHZ_WIDTH;
6408 break;
6409 case RATE_INFO_BW_10:
6410 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
6411 break;
6412 case RATE_INFO_BW_16:
6413 rate_flg = NL80211_RATE_INFO_16_MHZ_WIDTH;
6414 break;
6415 default:
6416 WARN_ON(1);
6417 fallthrough;
6418 case RATE_INFO_BW_20:
6419 rate_flg = 0;
6420 break;
6421 case RATE_INFO_BW_40:
6422 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
6423 break;
6424 case RATE_INFO_BW_80:
6425 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
6426 break;
6427 case RATE_INFO_BW_160:
6428 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
6429 break;
6430 case RATE_INFO_BW_HE_RU:
6431 rate_flg = 0;
6432 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS));
6433 break;
6434 case RATE_INFO_BW_320:
6435 rate_flg = NL80211_RATE_INFO_320_MHZ_WIDTH;
6436 break;
6437 case RATE_INFO_BW_EHT_RU:
6438 rate_flg = 0;
6439 WARN_ON(!(info->flags & RATE_INFO_FLAGS_EHT_MCS));
6440 break;
6441 }
6442
6443 if (rate_flg && nla_put_flag(msg, rate_flg))
6444 return false;
6445
6446 if (info->flags & RATE_INFO_FLAGS_MCS) {
6447 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
6448 return false;
6449 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
6450 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
6451 return false;
6452 } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
6453 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
6454 return false;
6455 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
6456 return false;
6457 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
6458 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
6459 return false;
6460 } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) {
6461 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs))
6462 return false;
6463 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss))
6464 return false;
6465 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi))
6466 return false;
6467 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm))
6468 return false;
6469 if (info->bw == RATE_INFO_BW_HE_RU &&
6470 nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC,
6471 info->he_ru_alloc))
6472 return false;
6473 } else if (info->flags & RATE_INFO_FLAGS_S1G_MCS) {
6474 if (nla_put_u8(msg, NL80211_RATE_INFO_S1G_MCS, info->mcs))
6475 return false;
6476 if (nla_put_u8(msg, NL80211_RATE_INFO_S1G_NSS, info->nss))
6477 return false;
6478 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
6479 nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
6480 return false;
6481 } else if (info->flags & RATE_INFO_FLAGS_EHT_MCS) {
6482 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_MCS, info->mcs))
6483 return false;
6484 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_NSS, info->nss))
6485 return false;
6486 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_GI, info->eht_gi))
6487 return false;
6488 if (info->bw == RATE_INFO_BW_EHT_RU &&
6489 nla_put_u8(msg, NL80211_RATE_INFO_EHT_RU_ALLOC,
6490 info->eht_ru_alloc))
6491 return false;
6492 }
6493
6494 nla_nest_end(msg, rate);
6495 return true;
6496 }
6497
nl80211_put_signal(struct sk_buff * msg,u8 mask,s8 * signal,int id)6498 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
6499 int id)
6500 {
6501 void *attr;
6502 int i = 0;
6503
6504 if (!mask)
6505 return true;
6506
6507 attr = nla_nest_start_noflag(msg, id);
6508 if (!attr)
6509 return false;
6510
6511 for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
6512 if (!(mask & BIT(i)))
6513 continue;
6514
6515 if (nla_put_u8(msg, i, signal[i]))
6516 return false;
6517 }
6518
6519 nla_nest_end(msg, attr);
6520
6521 return true;
6522 }
6523
nl80211_send_station(struct sk_buff * msg,u32 cmd,u32 portid,u32 seq,int flags,struct cfg80211_registered_device * rdev,struct net_device * dev,const u8 * mac_addr,struct station_info * sinfo)6524 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
6525 u32 seq, int flags,
6526 struct cfg80211_registered_device *rdev,
6527 struct net_device *dev,
6528 const u8 *mac_addr, struct station_info *sinfo)
6529 {
6530 void *hdr;
6531 struct nlattr *sinfoattr, *bss_param;
6532
6533 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
6534 if (!hdr) {
6535 cfg80211_sinfo_release_content(sinfo);
6536 return -1;
6537 }
6538
6539 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
6540 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
6541 nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
6542 goto nla_put_failure;
6543
6544 sinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_STA_INFO);
6545 if (!sinfoattr)
6546 goto nla_put_failure;
6547
6548 #define PUT_SINFO(attr, memb, type) do { \
6549 BUILD_BUG_ON(sizeof(type) == sizeof(u64)); \
6550 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \
6551 nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr, \
6552 sinfo->memb)) \
6553 goto nla_put_failure; \
6554 } while (0)
6555 #define PUT_SINFO_U64(attr, memb) do { \
6556 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) && \
6557 nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr, \
6558 sinfo->memb, NL80211_STA_INFO_PAD)) \
6559 goto nla_put_failure; \
6560 } while (0)
6561
6562 PUT_SINFO(CONNECTED_TIME, connected_time, u32);
6563 PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
6564 PUT_SINFO_U64(ASSOC_AT_BOOTTIME, assoc_at);
6565
6566 if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
6567 BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
6568 nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
6569 (u32)sinfo->rx_bytes))
6570 goto nla_put_failure;
6571
6572 if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
6573 BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
6574 nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
6575 (u32)sinfo->tx_bytes))
6576 goto nla_put_failure;
6577
6578 PUT_SINFO_U64(RX_BYTES64, rx_bytes);
6579 PUT_SINFO_U64(TX_BYTES64, tx_bytes);
6580 PUT_SINFO(LLID, llid, u16);
6581 PUT_SINFO(PLID, plid, u16);
6582 PUT_SINFO(PLINK_STATE, plink_state, u8);
6583 PUT_SINFO_U64(RX_DURATION, rx_duration);
6584 PUT_SINFO_U64(TX_DURATION, tx_duration);
6585
6586 if (wiphy_ext_feature_isset(&rdev->wiphy,
6587 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
6588 PUT_SINFO(AIRTIME_WEIGHT, airtime_weight, u16);
6589
6590 switch (rdev->wiphy.signal_type) {
6591 case CFG80211_SIGNAL_TYPE_MBM:
6592 PUT_SINFO(SIGNAL, signal, u8);
6593 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
6594 break;
6595 default:
6596 break;
6597 }
6598 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
6599 if (!nl80211_put_signal(msg, sinfo->chains,
6600 sinfo->chain_signal,
6601 NL80211_STA_INFO_CHAIN_SIGNAL))
6602 goto nla_put_failure;
6603 }
6604 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
6605 if (!nl80211_put_signal(msg, sinfo->chains,
6606 sinfo->chain_signal_avg,
6607 NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
6608 goto nla_put_failure;
6609 }
6610 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
6611 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
6612 NL80211_STA_INFO_TX_BITRATE))
6613 goto nla_put_failure;
6614 }
6615 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
6616 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
6617 NL80211_STA_INFO_RX_BITRATE))
6618 goto nla_put_failure;
6619 }
6620
6621 PUT_SINFO(RX_PACKETS, rx_packets, u32);
6622 PUT_SINFO(TX_PACKETS, tx_packets, u32);
6623 PUT_SINFO(TX_RETRIES, tx_retries, u32);
6624 PUT_SINFO(TX_FAILED, tx_failed, u32);
6625 PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
6626 PUT_SINFO(AIRTIME_LINK_METRIC, airtime_link_metric, u32);
6627 PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
6628 PUT_SINFO(LOCAL_PM, local_pm, u32);
6629 PUT_SINFO(PEER_PM, peer_pm, u32);
6630 PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
6631 PUT_SINFO(CONNECTED_TO_GATE, connected_to_gate, u8);
6632 PUT_SINFO(CONNECTED_TO_AS, connected_to_as, u8);
6633
6634 if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
6635 bss_param = nla_nest_start_noflag(msg,
6636 NL80211_STA_INFO_BSS_PARAM);
6637 if (!bss_param)
6638 goto nla_put_failure;
6639
6640 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
6641 nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
6642 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
6643 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
6644 ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
6645 nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
6646 nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
6647 sinfo->bss_param.dtim_period) ||
6648 nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
6649 sinfo->bss_param.beacon_interval))
6650 goto nla_put_failure;
6651
6652 nla_nest_end(msg, bss_param);
6653 }
6654 if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) &&
6655 nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
6656 sizeof(struct nl80211_sta_flag_update),
6657 &sinfo->sta_flags))
6658 goto nla_put_failure;
6659
6660 PUT_SINFO_U64(T_OFFSET, t_offset);
6661 PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
6662 PUT_SINFO_U64(BEACON_RX, rx_beacon);
6663 PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
6664 PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32);
6665 PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32);
6666 if (wiphy_ext_feature_isset(&rdev->wiphy,
6667 NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) {
6668 PUT_SINFO(ACK_SIGNAL, ack_signal, u8);
6669 PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8);
6670 }
6671
6672 #undef PUT_SINFO
6673 #undef PUT_SINFO_U64
6674
6675 if (sinfo->pertid) {
6676 struct nlattr *tidsattr;
6677 int tid;
6678
6679 tidsattr = nla_nest_start_noflag(msg,
6680 NL80211_STA_INFO_TID_STATS);
6681 if (!tidsattr)
6682 goto nla_put_failure;
6683
6684 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
6685 struct cfg80211_tid_stats *tidstats;
6686 struct nlattr *tidattr;
6687
6688 tidstats = &sinfo->pertid[tid];
6689
6690 if (!tidstats->filled)
6691 continue;
6692
6693 tidattr = nla_nest_start_noflag(msg, tid + 1);
6694 if (!tidattr)
6695 goto nla_put_failure;
6696
6697 #define PUT_TIDVAL_U64(attr, memb) do { \
6698 if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) && \
6699 nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr, \
6700 tidstats->memb, NL80211_TID_STATS_PAD)) \
6701 goto nla_put_failure; \
6702 } while (0)
6703
6704 PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
6705 PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
6706 PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
6707 PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
6708
6709 #undef PUT_TIDVAL_U64
6710 if ((tidstats->filled &
6711 BIT(NL80211_TID_STATS_TXQ_STATS)) &&
6712 !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
6713 NL80211_TID_STATS_TXQ_STATS))
6714 goto nla_put_failure;
6715
6716 nla_nest_end(msg, tidattr);
6717 }
6718
6719 nla_nest_end(msg, tidsattr);
6720 }
6721
6722 nla_nest_end(msg, sinfoattr);
6723
6724 if (sinfo->assoc_req_ies_len &&
6725 nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
6726 sinfo->assoc_req_ies))
6727 goto nla_put_failure;
6728
6729 if (sinfo->assoc_resp_ies_len &&
6730 nla_put(msg, NL80211_ATTR_RESP_IE, sinfo->assoc_resp_ies_len,
6731 sinfo->assoc_resp_ies))
6732 goto nla_put_failure;
6733
6734 if (sinfo->mlo_params_valid) {
6735 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID,
6736 sinfo->assoc_link_id))
6737 goto nla_put_failure;
6738
6739 if (!is_zero_ether_addr(sinfo->mld_addr) &&
6740 nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN,
6741 sinfo->mld_addr))
6742 goto nla_put_failure;
6743 }
6744
6745 cfg80211_sinfo_release_content(sinfo);
6746 genlmsg_end(msg, hdr);
6747 return 0;
6748
6749 nla_put_failure:
6750 cfg80211_sinfo_release_content(sinfo);
6751 genlmsg_cancel(msg, hdr);
6752 return -EMSGSIZE;
6753 }
6754
nl80211_dump_station(struct sk_buff * skb,struct netlink_callback * cb)6755 static int nl80211_dump_station(struct sk_buff *skb,
6756 struct netlink_callback *cb)
6757 {
6758 struct station_info sinfo;
6759 struct cfg80211_registered_device *rdev;
6760 struct wireless_dev *wdev;
6761 u8 mac_addr[ETH_ALEN];
6762 int sta_idx = cb->args[2];
6763 int err;
6764
6765 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
6766 if (err)
6767 return err;
6768 /* nl80211_prepare_wdev_dump acquired it in the successful case */
6769 __acquire(&rdev->wiphy.mtx);
6770
6771 if (!wdev->netdev) {
6772 err = -EINVAL;
6773 goto out_err;
6774 }
6775
6776 if (!rdev->ops->dump_station) {
6777 err = -EOPNOTSUPP;
6778 goto out_err;
6779 }
6780
6781 while (1) {
6782 memset(&sinfo, 0, sizeof(sinfo));
6783 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
6784 mac_addr, &sinfo);
6785 if (err == -ENOENT)
6786 break;
6787 if (err)
6788 goto out_err;
6789
6790 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
6791 NETLINK_CB(cb->skb).portid,
6792 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6793 rdev, wdev->netdev, mac_addr,
6794 &sinfo) < 0)
6795 goto out;
6796
6797 sta_idx++;
6798 }
6799
6800 out:
6801 cb->args[2] = sta_idx;
6802 err = skb->len;
6803 out_err:
6804 wiphy_unlock(&rdev->wiphy);
6805
6806 return err;
6807 }
6808
nl80211_get_station(struct sk_buff * skb,struct genl_info * info)6809 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
6810 {
6811 struct cfg80211_registered_device *rdev = info->user_ptr[0];
6812 struct net_device *dev = info->user_ptr[1];
6813 struct station_info sinfo;
6814 struct sk_buff *msg;
6815 u8 *mac_addr = NULL;
6816 int err;
6817
6818 memset(&sinfo, 0, sizeof(sinfo));
6819
6820 if (!info->attrs[NL80211_ATTR_MAC])
6821 return -EINVAL;
6822
6823 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
6824
6825 if (!rdev->ops->get_station)
6826 return -EOPNOTSUPP;
6827
6828 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
6829 if (err)
6830 return err;
6831
6832 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6833 if (!msg) {
6834 cfg80211_sinfo_release_content(&sinfo);
6835 return -ENOMEM;
6836 }
6837
6838 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
6839 info->snd_portid, info->snd_seq, 0,
6840 rdev, dev, mac_addr, &sinfo) < 0) {
6841 nlmsg_free(msg);
6842 return -ENOBUFS;
6843 }
6844
6845 return genlmsg_reply(msg, info);
6846 }
6847
cfg80211_check_station_change(struct wiphy * wiphy,struct station_parameters * params,enum cfg80211_station_type statype)6848 int cfg80211_check_station_change(struct wiphy *wiphy,
6849 struct station_parameters *params,
6850 enum cfg80211_station_type statype)
6851 {
6852 if (params->listen_interval != -1 &&
6853 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
6854 return -EINVAL;
6855
6856 if (params->support_p2p_ps != -1 &&
6857 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
6858 return -EINVAL;
6859
6860 if (params->aid &&
6861 !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
6862 statype != CFG80211_STA_AP_CLIENT_UNASSOC)
6863 return -EINVAL;
6864
6865 /* When you run into this, adjust the code below for the new flag */
6866 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
6867
6868 switch (statype) {
6869 case CFG80211_STA_MESH_PEER_KERNEL:
6870 case CFG80211_STA_MESH_PEER_USER:
6871 /*
6872 * No ignoring the TDLS flag here -- the userspace mesh
6873 * code doesn't have the bug of including TDLS in the
6874 * mask everywhere.
6875 */
6876 if (params->sta_flags_mask &
6877 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6878 BIT(NL80211_STA_FLAG_MFP) |
6879 BIT(NL80211_STA_FLAG_AUTHORIZED)))
6880 return -EINVAL;
6881 break;
6882 case CFG80211_STA_TDLS_PEER_SETUP:
6883 case CFG80211_STA_TDLS_PEER_ACTIVE:
6884 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
6885 return -EINVAL;
6886 /* ignore since it can't change */
6887 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
6888 break;
6889 default:
6890 /* disallow mesh-specific things */
6891 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
6892 return -EINVAL;
6893 if (params->local_pm)
6894 return -EINVAL;
6895 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
6896 return -EINVAL;
6897 }
6898
6899 if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
6900 statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
6901 /* TDLS can't be set, ... */
6902 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
6903 return -EINVAL;
6904 /*
6905 * ... but don't bother the driver with it. This works around
6906 * a hostapd/wpa_supplicant issue -- it always includes the
6907 * TLDS_PEER flag in the mask even for AP mode.
6908 */
6909 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
6910 }
6911
6912 if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
6913 statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
6914 /* reject other things that can't change */
6915 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
6916 return -EINVAL;
6917 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
6918 return -EINVAL;
6919 if (params->link_sta_params.supported_rates)
6920 return -EINVAL;
6921 if (params->ext_capab || params->link_sta_params.ht_capa ||
6922 params->link_sta_params.vht_capa ||
6923 params->link_sta_params.he_capa ||
6924 params->link_sta_params.eht_capa)
6925 return -EINVAL;
6926 }
6927
6928 if (statype != CFG80211_STA_AP_CLIENT &&
6929 statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
6930 if (params->vlan)
6931 return -EINVAL;
6932 }
6933
6934 switch (statype) {
6935 case CFG80211_STA_AP_MLME_CLIENT:
6936 /* Use this only for authorizing/unauthorizing a station */
6937 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
6938 return -EOPNOTSUPP;
6939 break;
6940 case CFG80211_STA_AP_CLIENT:
6941 case CFG80211_STA_AP_CLIENT_UNASSOC:
6942 /* accept only the listed bits */
6943 if (params->sta_flags_mask &
6944 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
6945 BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6946 BIT(NL80211_STA_FLAG_ASSOCIATED) |
6947 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
6948 BIT(NL80211_STA_FLAG_WME) |
6949 BIT(NL80211_STA_FLAG_MFP)))
6950 return -EINVAL;
6951
6952 /* but authenticated/associated only if driver handles it */
6953 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
6954 params->sta_flags_mask &
6955 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6956 BIT(NL80211_STA_FLAG_ASSOCIATED)))
6957 return -EINVAL;
6958 break;
6959 case CFG80211_STA_IBSS:
6960 case CFG80211_STA_AP_STA:
6961 /* reject any changes other than AUTHORIZED */
6962 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
6963 return -EINVAL;
6964 break;
6965 case CFG80211_STA_TDLS_PEER_SETUP:
6966 /* reject any changes other than AUTHORIZED or WME */
6967 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
6968 BIT(NL80211_STA_FLAG_WME)))
6969 return -EINVAL;
6970 /* force (at least) rates when authorizing */
6971 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
6972 !params->link_sta_params.supported_rates)
6973 return -EINVAL;
6974 break;
6975 case CFG80211_STA_TDLS_PEER_ACTIVE:
6976 /* reject any changes */
6977 return -EINVAL;
6978 case CFG80211_STA_MESH_PEER_KERNEL:
6979 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
6980 return -EINVAL;
6981 break;
6982 case CFG80211_STA_MESH_PEER_USER:
6983 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
6984 params->plink_action != NL80211_PLINK_ACTION_BLOCK)
6985 return -EINVAL;
6986 break;
6987 }
6988
6989 /*
6990 * Older kernel versions ignored this attribute entirely, so don't
6991 * reject attempts to update it but mark it as unused instead so the
6992 * driver won't look at the data.
6993 */
6994 if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
6995 statype != CFG80211_STA_TDLS_PEER_SETUP)
6996 params->link_sta_params.opmode_notif_used = false;
6997
6998 return 0;
6999 }
7000 EXPORT_SYMBOL(cfg80211_check_station_change);
7001
7002 /*
7003 * Get vlan interface making sure it is running and on the right wiphy.
7004 */
get_vlan(struct genl_info * info,struct cfg80211_registered_device * rdev)7005 static struct net_device *get_vlan(struct genl_info *info,
7006 struct cfg80211_registered_device *rdev)
7007 {
7008 struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
7009 struct net_device *v;
7010 int ret;
7011
7012 if (!vlanattr)
7013 return NULL;
7014
7015 v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
7016 if (!v)
7017 return ERR_PTR(-ENODEV);
7018
7019 if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
7020 ret = -EINVAL;
7021 goto error;
7022 }
7023
7024 if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
7025 v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
7026 v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
7027 ret = -EINVAL;
7028 goto error;
7029 }
7030
7031 if (!netif_running(v)) {
7032 ret = -ENETDOWN;
7033 goto error;
7034 }
7035
7036 return v;
7037 error:
7038 dev_put(v);
7039 return ERR_PTR(ret);
7040 }
7041
nl80211_parse_sta_wme(struct genl_info * info,struct station_parameters * params)7042 static int nl80211_parse_sta_wme(struct genl_info *info,
7043 struct station_parameters *params)
7044 {
7045 struct nlattr *tb[NL80211_STA_WME_MAX + 1];
7046 struct nlattr *nla;
7047 int err;
7048
7049 /* parse WME attributes if present */
7050 if (!info->attrs[NL80211_ATTR_STA_WME])
7051 return 0;
7052
7053 nla = info->attrs[NL80211_ATTR_STA_WME];
7054 err = nla_parse_nested_deprecated(tb, NL80211_STA_WME_MAX, nla,
7055 nl80211_sta_wme_policy,
7056 info->extack);
7057 if (err)
7058 return err;
7059
7060 if (tb[NL80211_STA_WME_UAPSD_QUEUES])
7061 params->uapsd_queues = nla_get_u8(
7062 tb[NL80211_STA_WME_UAPSD_QUEUES]);
7063 if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
7064 return -EINVAL;
7065
7066 if (tb[NL80211_STA_WME_MAX_SP])
7067 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
7068
7069 if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
7070 return -EINVAL;
7071
7072 params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
7073
7074 return 0;
7075 }
7076
nl80211_parse_sta_channel_info(struct genl_info * info,struct station_parameters * params)7077 static int nl80211_parse_sta_channel_info(struct genl_info *info,
7078 struct station_parameters *params)
7079 {
7080 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
7081 params->supported_channels =
7082 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
7083 params->supported_channels_len =
7084 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
7085 /*
7086 * Need to include at least one (first channel, number of
7087 * channels) tuple for each subband (checked in policy),
7088 * and must have proper tuples for the rest of the data as well.
7089 */
7090 if (params->supported_channels_len % 2)
7091 return -EINVAL;
7092 }
7093
7094 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
7095 params->supported_oper_classes =
7096 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
7097 params->supported_oper_classes_len =
7098 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
7099 }
7100 return 0;
7101 }
7102
nl80211_set_station_tdls(struct genl_info * info,struct station_parameters * params)7103 static int nl80211_set_station_tdls(struct genl_info *info,
7104 struct station_parameters *params)
7105 {
7106 int err;
7107 /* Dummy STA entry gets updated once the peer capabilities are known */
7108 if (info->attrs[NL80211_ATTR_PEER_AID])
7109 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
7110 if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
7111 params->link_sta_params.ht_capa =
7112 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
7113 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
7114 params->link_sta_params.vht_capa =
7115 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
7116 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
7117 params->link_sta_params.he_capa =
7118 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7119 params->link_sta_params.he_capa_len =
7120 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7121
7122 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
7123 params->link_sta_params.eht_capa =
7124 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7125 params->link_sta_params.eht_capa_len =
7126 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7127
7128 if (!ieee80211_eht_capa_size_ok((const u8 *)params->link_sta_params.he_capa,
7129 (const u8 *)params->link_sta_params.eht_capa,
7130 params->link_sta_params.eht_capa_len,
7131 false))
7132 return -EINVAL;
7133 }
7134 }
7135
7136 err = nl80211_parse_sta_channel_info(info, params);
7137 if (err)
7138 return err;
7139
7140 return nl80211_parse_sta_wme(info, params);
7141 }
7142
nl80211_parse_sta_txpower_setting(struct genl_info * info,struct sta_txpwr * txpwr,bool * txpwr_set)7143 static int nl80211_parse_sta_txpower_setting(struct genl_info *info,
7144 struct sta_txpwr *txpwr,
7145 bool *txpwr_set)
7146 {
7147 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7148 int idx;
7149
7150 if (info->attrs[NL80211_ATTR_STA_TX_POWER_SETTING]) {
7151 if (!rdev->ops->set_tx_power ||
7152 !wiphy_ext_feature_isset(&rdev->wiphy,
7153 NL80211_EXT_FEATURE_STA_TX_PWR))
7154 return -EOPNOTSUPP;
7155
7156 idx = NL80211_ATTR_STA_TX_POWER_SETTING;
7157 txpwr->type = nla_get_u8(info->attrs[idx]);
7158
7159 if (txpwr->type == NL80211_TX_POWER_LIMITED) {
7160 idx = NL80211_ATTR_STA_TX_POWER;
7161
7162 if (info->attrs[idx])
7163 txpwr->power = nla_get_s16(info->attrs[idx]);
7164 else
7165 return -EINVAL;
7166 }
7167
7168 *txpwr_set = true;
7169 } else {
7170 *txpwr_set = false;
7171 }
7172
7173 return 0;
7174 }
7175
nl80211_set_station(struct sk_buff * skb,struct genl_info * info)7176 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
7177 {
7178 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7179 struct net_device *dev = info->user_ptr[1];
7180 struct station_parameters params;
7181 u8 *mac_addr;
7182 int err;
7183
7184 memset(¶ms, 0, sizeof(params));
7185
7186 if (!rdev->ops->change_station)
7187 return -EOPNOTSUPP;
7188
7189 /*
7190 * AID and listen_interval properties can be set only for unassociated
7191 * station. Include these parameters here and will check them in
7192 * cfg80211_check_station_change().
7193 */
7194 if (info->attrs[NL80211_ATTR_STA_AID])
7195 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
7196
7197 if (info->attrs[NL80211_ATTR_VLAN_ID])
7198 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
7199
7200 if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
7201 params.listen_interval =
7202 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
7203 else
7204 params.listen_interval = -1;
7205
7206 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS])
7207 params.support_p2p_ps =
7208 nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
7209 else
7210 params.support_p2p_ps = -1;
7211
7212 if (!info->attrs[NL80211_ATTR_MAC])
7213 return -EINVAL;
7214
7215 params.link_sta_params.link_id =
7216 nl80211_link_id_or_invalid(info->attrs);
7217
7218 if (info->attrs[NL80211_ATTR_MLD_ADDR]) {
7219 /* If MLD_ADDR attribute is set then this is an MLD station
7220 * and the MLD_ADDR attribute holds the MLD address and the
7221 * MAC attribute holds for the LINK address.
7222 * In that case, the link_id is also expected to be valid.
7223 */
7224 if (params.link_sta_params.link_id < 0)
7225 return -EINVAL;
7226
7227 mac_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
7228 params.link_sta_params.mld_mac = mac_addr;
7229 params.link_sta_params.link_mac =
7230 nla_data(info->attrs[NL80211_ATTR_MAC]);
7231 if (!is_valid_ether_addr(params.link_sta_params.link_mac))
7232 return -EINVAL;
7233 } else {
7234 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
7235 }
7236
7237
7238 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
7239 params.link_sta_params.supported_rates =
7240 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7241 params.link_sta_params.supported_rates_len =
7242 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7243 }
7244
7245 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
7246 params.capability =
7247 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
7248 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
7249 }
7250
7251 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
7252 params.ext_capab =
7253 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7254 params.ext_capab_len =
7255 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7256 }
7257
7258 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms))
7259 return -EINVAL;
7260
7261 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
7262 params.plink_action =
7263 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
7264
7265 if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
7266 params.plink_state =
7267 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
7268 if (info->attrs[NL80211_ATTR_MESH_PEER_AID])
7269 params.peer_aid = nla_get_u16(
7270 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
7271 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
7272 }
7273
7274 if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE])
7275 params.local_pm = nla_get_u32(
7276 info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
7277
7278 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
7279 params.link_sta_params.opmode_notif_used = true;
7280 params.link_sta_params.opmode_notif =
7281 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
7282 }
7283
7284 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
7285 params.link_sta_params.he_6ghz_capa =
7286 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
7287
7288 if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
7289 params.airtime_weight =
7290 nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
7291
7292 if (params.airtime_weight &&
7293 !wiphy_ext_feature_isset(&rdev->wiphy,
7294 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
7295 return -EOPNOTSUPP;
7296
7297 err = nl80211_parse_sta_txpower_setting(info,
7298 ¶ms.link_sta_params.txpwr,
7299 ¶ms.link_sta_params.txpwr_set);
7300 if (err)
7301 return err;
7302
7303 /* Include parameters for TDLS peer (will check later) */
7304 err = nl80211_set_station_tdls(info, ¶ms);
7305 if (err)
7306 return err;
7307
7308 params.vlan = get_vlan(info, rdev);
7309 if (IS_ERR(params.vlan))
7310 return PTR_ERR(params.vlan);
7311
7312 switch (dev->ieee80211_ptr->iftype) {
7313 case NL80211_IFTYPE_AP:
7314 case NL80211_IFTYPE_AP_VLAN:
7315 case NL80211_IFTYPE_P2P_GO:
7316 case NL80211_IFTYPE_P2P_CLIENT:
7317 case NL80211_IFTYPE_STATION:
7318 case NL80211_IFTYPE_ADHOC:
7319 case NL80211_IFTYPE_MESH_POINT:
7320 break;
7321 default:
7322 err = -EOPNOTSUPP;
7323 goto out_put_vlan;
7324 }
7325
7326 /* driver will call cfg80211_check_station_change() */
7327 wdev_lock(dev->ieee80211_ptr);
7328 err = rdev_change_station(rdev, dev, mac_addr, ¶ms);
7329 wdev_unlock(dev->ieee80211_ptr);
7330
7331 out_put_vlan:
7332 dev_put(params.vlan);
7333
7334 return err;
7335 }
7336
nl80211_new_station(struct sk_buff * skb,struct genl_info * info)7337 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
7338 {
7339 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7340 int err;
7341 struct net_device *dev = info->user_ptr[1];
7342 struct wireless_dev *wdev = dev->ieee80211_ptr;
7343 struct station_parameters params;
7344 u8 *mac_addr = NULL;
7345 u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
7346 BIT(NL80211_STA_FLAG_ASSOCIATED);
7347
7348 memset(¶ms, 0, sizeof(params));
7349
7350 if (!rdev->ops->add_station)
7351 return -EOPNOTSUPP;
7352
7353 if (!info->attrs[NL80211_ATTR_MAC])
7354 return -EINVAL;
7355
7356 if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
7357 return -EINVAL;
7358
7359 if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
7360 return -EINVAL;
7361
7362 if (!info->attrs[NL80211_ATTR_STA_AID] &&
7363 !info->attrs[NL80211_ATTR_PEER_AID])
7364 return -EINVAL;
7365
7366 params.link_sta_params.link_id =
7367 nl80211_link_id_or_invalid(info->attrs);
7368
7369 if (info->attrs[NL80211_ATTR_MLD_ADDR]) {
7370 mac_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
7371 params.link_sta_params.mld_mac = mac_addr;
7372 params.link_sta_params.link_mac =
7373 nla_data(info->attrs[NL80211_ATTR_MAC]);
7374 if (!is_valid_ether_addr(params.link_sta_params.link_mac))
7375 return -EINVAL;
7376 } else {
7377 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
7378 }
7379
7380 params.link_sta_params.supported_rates =
7381 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7382 params.link_sta_params.supported_rates_len =
7383 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7384 params.listen_interval =
7385 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
7386
7387 if (info->attrs[NL80211_ATTR_VLAN_ID])
7388 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
7389
7390 if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
7391 params.support_p2p_ps =
7392 nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
7393 } else {
7394 /*
7395 * if not specified, assume it's supported for P2P GO interface,
7396 * and is NOT supported for AP interface
7397 */
7398 params.support_p2p_ps =
7399 dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
7400 }
7401
7402 if (info->attrs[NL80211_ATTR_PEER_AID])
7403 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
7404 else
7405 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
7406
7407 if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
7408 params.capability =
7409 nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
7410 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
7411 }
7412
7413 if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
7414 params.ext_capab =
7415 nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7416 params.ext_capab_len =
7417 nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7418 }
7419
7420 if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
7421 params.link_sta_params.ht_capa =
7422 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
7423
7424 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
7425 params.link_sta_params.vht_capa =
7426 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
7427
7428 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
7429 params.link_sta_params.he_capa =
7430 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7431 params.link_sta_params.he_capa_len =
7432 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7433
7434 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
7435 params.link_sta_params.eht_capa =
7436 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7437 params.link_sta_params.eht_capa_len =
7438 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7439
7440 if (!ieee80211_eht_capa_size_ok((const u8 *)params.link_sta_params.he_capa,
7441 (const u8 *)params.link_sta_params.eht_capa,
7442 params.link_sta_params.eht_capa_len,
7443 false))
7444 return -EINVAL;
7445 }
7446 }
7447
7448 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
7449 params.link_sta_params.he_6ghz_capa =
7450 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
7451
7452 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
7453 params.link_sta_params.opmode_notif_used = true;
7454 params.link_sta_params.opmode_notif =
7455 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
7456 }
7457
7458 if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
7459 params.plink_action =
7460 nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
7461
7462 if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
7463 params.airtime_weight =
7464 nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
7465
7466 if (params.airtime_weight &&
7467 !wiphy_ext_feature_isset(&rdev->wiphy,
7468 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
7469 return -EOPNOTSUPP;
7470
7471 err = nl80211_parse_sta_txpower_setting(info,
7472 ¶ms.link_sta_params.txpwr,
7473 ¶ms.link_sta_params.txpwr_set);
7474 if (err)
7475 return err;
7476
7477 err = nl80211_parse_sta_channel_info(info, ¶ms);
7478 if (err)
7479 return err;
7480
7481 err = nl80211_parse_sta_wme(info, ¶ms);
7482 if (err)
7483 return err;
7484
7485 if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms))
7486 return -EINVAL;
7487
7488 /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
7489 * as userspace might just pass through the capabilities from the IEs
7490 * directly, rather than enforcing this restriction and returning an
7491 * error in this case.
7492 */
7493 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
7494 params.link_sta_params.ht_capa = NULL;
7495 params.link_sta_params.vht_capa = NULL;
7496
7497 /* HE and EHT require WME */
7498 if (params.link_sta_params.he_capa_len ||
7499 params.link_sta_params.he_6ghz_capa ||
7500 params.link_sta_params.eht_capa_len)
7501 return -EINVAL;
7502 }
7503
7504 /* Ensure that HT/VHT capabilities are not set for 6 GHz HE STA */
7505 if (params.link_sta_params.he_6ghz_capa &&
7506 (params.link_sta_params.ht_capa || params.link_sta_params.vht_capa))
7507 return -EINVAL;
7508
7509 /* When you run into this, adjust the code below for the new flag */
7510 BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
7511
7512 switch (dev->ieee80211_ptr->iftype) {
7513 case NL80211_IFTYPE_AP:
7514 case NL80211_IFTYPE_AP_VLAN:
7515 case NL80211_IFTYPE_P2P_GO:
7516 /* ignore WME attributes if iface/sta is not capable */
7517 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
7518 !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
7519 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
7520
7521 /* TDLS peers cannot be added */
7522 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
7523 info->attrs[NL80211_ATTR_PEER_AID])
7524 return -EINVAL;
7525 /* but don't bother the driver with it */
7526 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
7527
7528 /* allow authenticated/associated only if driver handles it */
7529 if (!(rdev->wiphy.features &
7530 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
7531 params.sta_flags_mask & auth_assoc)
7532 return -EINVAL;
7533
7534 /* Older userspace, or userspace wanting to be compatible with
7535 * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
7536 * and assoc flags in the mask, but assumes the station will be
7537 * added as associated anyway since this was the required driver
7538 * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
7539 * introduced.
7540 * In order to not bother drivers with this quirk in the API
7541 * set the flags in both the mask and set for new stations in
7542 * this case.
7543 */
7544 if (!(params.sta_flags_mask & auth_assoc)) {
7545 params.sta_flags_mask |= auth_assoc;
7546 params.sta_flags_set |= auth_assoc;
7547 }
7548
7549 /* must be last in here for error handling */
7550 params.vlan = get_vlan(info, rdev);
7551 if (IS_ERR(params.vlan))
7552 return PTR_ERR(params.vlan);
7553 break;
7554 case NL80211_IFTYPE_MESH_POINT:
7555 /* ignore uAPSD data */
7556 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
7557
7558 /* associated is disallowed */
7559 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
7560 return -EINVAL;
7561 /* TDLS peers cannot be added */
7562 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
7563 info->attrs[NL80211_ATTR_PEER_AID])
7564 return -EINVAL;
7565 break;
7566 case NL80211_IFTYPE_STATION:
7567 case NL80211_IFTYPE_P2P_CLIENT:
7568 /* ignore uAPSD data */
7569 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
7570
7571 /* these are disallowed */
7572 if (params.sta_flags_mask &
7573 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
7574 BIT(NL80211_STA_FLAG_AUTHENTICATED)))
7575 return -EINVAL;
7576 /* Only TDLS peers can be added */
7577 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
7578 return -EINVAL;
7579 /* Can only add if TDLS ... */
7580 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
7581 return -EOPNOTSUPP;
7582 /* ... with external setup is supported */
7583 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
7584 return -EOPNOTSUPP;
7585 /*
7586 * Older wpa_supplicant versions always mark the TDLS peer
7587 * as authorized, but it shouldn't yet be.
7588 */
7589 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
7590 break;
7591 default:
7592 return -EOPNOTSUPP;
7593 }
7594
7595 /* be aware of params.vlan when changing code here */
7596
7597 wdev_lock(dev->ieee80211_ptr);
7598 if (wdev->valid_links) {
7599 if (params.link_sta_params.link_id < 0) {
7600 err = -EINVAL;
7601 goto out;
7602 }
7603 if (!(wdev->valid_links & BIT(params.link_sta_params.link_id))) {
7604 err = -ENOLINK;
7605 goto out;
7606 }
7607 } else {
7608 if (params.link_sta_params.link_id >= 0) {
7609 err = -EINVAL;
7610 goto out;
7611 }
7612 }
7613 err = rdev_add_station(rdev, dev, mac_addr, ¶ms);
7614 out:
7615 wdev_unlock(dev->ieee80211_ptr);
7616 dev_put(params.vlan);
7617 return err;
7618 }
7619
nl80211_del_station(struct sk_buff * skb,struct genl_info * info)7620 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
7621 {
7622 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7623 struct net_device *dev = info->user_ptr[1];
7624 struct station_del_parameters params;
7625 int ret;
7626
7627 memset(¶ms, 0, sizeof(params));
7628
7629 if (info->attrs[NL80211_ATTR_MAC])
7630 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
7631
7632 switch (dev->ieee80211_ptr->iftype) {
7633 case NL80211_IFTYPE_AP:
7634 case NL80211_IFTYPE_AP_VLAN:
7635 case NL80211_IFTYPE_MESH_POINT:
7636 case NL80211_IFTYPE_P2P_GO:
7637 /* always accept these */
7638 break;
7639 case NL80211_IFTYPE_ADHOC:
7640 /* conditionally accept */
7641 if (wiphy_ext_feature_isset(&rdev->wiphy,
7642 NL80211_EXT_FEATURE_DEL_IBSS_STA))
7643 break;
7644 return -EINVAL;
7645 default:
7646 return -EINVAL;
7647 }
7648
7649 if (!rdev->ops->del_station)
7650 return -EOPNOTSUPP;
7651
7652 if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
7653 params.subtype =
7654 nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
7655 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
7656 params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
7657 return -EINVAL;
7658 } else {
7659 /* Default to Deauthentication frame */
7660 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
7661 }
7662
7663 if (info->attrs[NL80211_ATTR_REASON_CODE]) {
7664 params.reason_code =
7665 nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7666 if (params.reason_code == 0)
7667 return -EINVAL; /* 0 is reserved */
7668 } else {
7669 /* Default to reason code 2 */
7670 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
7671 }
7672
7673 wdev_lock(dev->ieee80211_ptr);
7674 ret = rdev_del_station(rdev, dev, ¶ms);
7675 wdev_unlock(dev->ieee80211_ptr);
7676
7677 return ret;
7678 }
7679
nl80211_send_mpath(struct sk_buff * msg,u32 portid,u32 seq,int flags,struct net_device * dev,u8 * dst,u8 * next_hop,struct mpath_info * pinfo)7680 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
7681 int flags, struct net_device *dev,
7682 u8 *dst, u8 *next_hop,
7683 struct mpath_info *pinfo)
7684 {
7685 void *hdr;
7686 struct nlattr *pinfoattr;
7687
7688 hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
7689 if (!hdr)
7690 return -1;
7691
7692 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
7693 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
7694 nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
7695 nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
7696 goto nla_put_failure;
7697
7698 pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MPATH_INFO);
7699 if (!pinfoattr)
7700 goto nla_put_failure;
7701 if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
7702 nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
7703 pinfo->frame_qlen))
7704 goto nla_put_failure;
7705 if (((pinfo->filled & MPATH_INFO_SN) &&
7706 nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
7707 ((pinfo->filled & MPATH_INFO_METRIC) &&
7708 nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
7709 pinfo->metric)) ||
7710 ((pinfo->filled & MPATH_INFO_EXPTIME) &&
7711 nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
7712 pinfo->exptime)) ||
7713 ((pinfo->filled & MPATH_INFO_FLAGS) &&
7714 nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
7715 pinfo->flags)) ||
7716 ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
7717 nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
7718 pinfo->discovery_timeout)) ||
7719 ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
7720 nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
7721 pinfo->discovery_retries)) ||
7722 ((pinfo->filled & MPATH_INFO_HOP_COUNT) &&
7723 nla_put_u8(msg, NL80211_MPATH_INFO_HOP_COUNT,
7724 pinfo->hop_count)) ||
7725 ((pinfo->filled & MPATH_INFO_PATH_CHANGE) &&
7726 nla_put_u32(msg, NL80211_MPATH_INFO_PATH_CHANGE,
7727 pinfo->path_change_count)))
7728 goto nla_put_failure;
7729
7730 nla_nest_end(msg, pinfoattr);
7731
7732 genlmsg_end(msg, hdr);
7733 return 0;
7734
7735 nla_put_failure:
7736 genlmsg_cancel(msg, hdr);
7737 return -EMSGSIZE;
7738 }
7739
nl80211_dump_mpath(struct sk_buff * skb,struct netlink_callback * cb)7740 static int nl80211_dump_mpath(struct sk_buff *skb,
7741 struct netlink_callback *cb)
7742 {
7743 struct mpath_info pinfo;
7744 struct cfg80211_registered_device *rdev;
7745 struct wireless_dev *wdev;
7746 u8 dst[ETH_ALEN];
7747 u8 next_hop[ETH_ALEN];
7748 int path_idx = cb->args[2];
7749 int err;
7750
7751 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
7752 if (err)
7753 return err;
7754 /* nl80211_prepare_wdev_dump acquired it in the successful case */
7755 __acquire(&rdev->wiphy.mtx);
7756
7757 if (!rdev->ops->dump_mpath) {
7758 err = -EOPNOTSUPP;
7759 goto out_err;
7760 }
7761
7762 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
7763 err = -EOPNOTSUPP;
7764 goto out_err;
7765 }
7766
7767 while (1) {
7768 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
7769 next_hop, &pinfo);
7770 if (err == -ENOENT)
7771 break;
7772 if (err)
7773 goto out_err;
7774
7775 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
7776 cb->nlh->nlmsg_seq, NLM_F_MULTI,
7777 wdev->netdev, dst, next_hop,
7778 &pinfo) < 0)
7779 goto out;
7780
7781 path_idx++;
7782 }
7783
7784 out:
7785 cb->args[2] = path_idx;
7786 err = skb->len;
7787 out_err:
7788 wiphy_unlock(&rdev->wiphy);
7789 return err;
7790 }
7791
nl80211_get_mpath(struct sk_buff * skb,struct genl_info * info)7792 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
7793 {
7794 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7795 int err;
7796 struct net_device *dev = info->user_ptr[1];
7797 struct mpath_info pinfo;
7798 struct sk_buff *msg;
7799 u8 *dst = NULL;
7800 u8 next_hop[ETH_ALEN];
7801
7802 memset(&pinfo, 0, sizeof(pinfo));
7803
7804 if (!info->attrs[NL80211_ATTR_MAC])
7805 return -EINVAL;
7806
7807 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7808
7809 if (!rdev->ops->get_mpath)
7810 return -EOPNOTSUPP;
7811
7812 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7813 return -EOPNOTSUPP;
7814
7815 err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
7816 if (err)
7817 return err;
7818
7819 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7820 if (!msg)
7821 return -ENOMEM;
7822
7823 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
7824 dev, dst, next_hop, &pinfo) < 0) {
7825 nlmsg_free(msg);
7826 return -ENOBUFS;
7827 }
7828
7829 return genlmsg_reply(msg, info);
7830 }
7831
nl80211_set_mpath(struct sk_buff * skb,struct genl_info * info)7832 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
7833 {
7834 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7835 struct net_device *dev = info->user_ptr[1];
7836 u8 *dst = NULL;
7837 u8 *next_hop = NULL;
7838
7839 if (!info->attrs[NL80211_ATTR_MAC])
7840 return -EINVAL;
7841
7842 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
7843 return -EINVAL;
7844
7845 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7846 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
7847
7848 if (!rdev->ops->change_mpath)
7849 return -EOPNOTSUPP;
7850
7851 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7852 return -EOPNOTSUPP;
7853
7854 return rdev_change_mpath(rdev, dev, dst, next_hop);
7855 }
7856
nl80211_new_mpath(struct sk_buff * skb,struct genl_info * info)7857 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
7858 {
7859 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7860 struct net_device *dev = info->user_ptr[1];
7861 u8 *dst = NULL;
7862 u8 *next_hop = NULL;
7863
7864 if (!info->attrs[NL80211_ATTR_MAC])
7865 return -EINVAL;
7866
7867 if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
7868 return -EINVAL;
7869
7870 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7871 next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
7872
7873 if (!rdev->ops->add_mpath)
7874 return -EOPNOTSUPP;
7875
7876 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7877 return -EOPNOTSUPP;
7878
7879 return rdev_add_mpath(rdev, dev, dst, next_hop);
7880 }
7881
nl80211_del_mpath(struct sk_buff * skb,struct genl_info * info)7882 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
7883 {
7884 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7885 struct net_device *dev = info->user_ptr[1];
7886 u8 *dst = NULL;
7887
7888 if (info->attrs[NL80211_ATTR_MAC])
7889 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7890
7891 if (!rdev->ops->del_mpath)
7892 return -EOPNOTSUPP;
7893
7894 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7895 return -EOPNOTSUPP;
7896
7897 return rdev_del_mpath(rdev, dev, dst);
7898 }
7899
nl80211_get_mpp(struct sk_buff * skb,struct genl_info * info)7900 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
7901 {
7902 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7903 int err;
7904 struct net_device *dev = info->user_ptr[1];
7905 struct mpath_info pinfo;
7906 struct sk_buff *msg;
7907 u8 *dst = NULL;
7908 u8 mpp[ETH_ALEN];
7909
7910 memset(&pinfo, 0, sizeof(pinfo));
7911
7912 if (!info->attrs[NL80211_ATTR_MAC])
7913 return -EINVAL;
7914
7915 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7916
7917 if (!rdev->ops->get_mpp)
7918 return -EOPNOTSUPP;
7919
7920 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7921 return -EOPNOTSUPP;
7922
7923 err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
7924 if (err)
7925 return err;
7926
7927 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7928 if (!msg)
7929 return -ENOMEM;
7930
7931 if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
7932 dev, dst, mpp, &pinfo) < 0) {
7933 nlmsg_free(msg);
7934 return -ENOBUFS;
7935 }
7936
7937 return genlmsg_reply(msg, info);
7938 }
7939
nl80211_dump_mpp(struct sk_buff * skb,struct netlink_callback * cb)7940 static int nl80211_dump_mpp(struct sk_buff *skb,
7941 struct netlink_callback *cb)
7942 {
7943 struct mpath_info pinfo;
7944 struct cfg80211_registered_device *rdev;
7945 struct wireless_dev *wdev;
7946 u8 dst[ETH_ALEN];
7947 u8 mpp[ETH_ALEN];
7948 int path_idx = cb->args[2];
7949 int err;
7950
7951 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
7952 if (err)
7953 return err;
7954 /* nl80211_prepare_wdev_dump acquired it in the successful case */
7955 __acquire(&rdev->wiphy.mtx);
7956
7957 if (!rdev->ops->dump_mpp) {
7958 err = -EOPNOTSUPP;
7959 goto out_err;
7960 }
7961
7962 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
7963 err = -EOPNOTSUPP;
7964 goto out_err;
7965 }
7966
7967 while (1) {
7968 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
7969 mpp, &pinfo);
7970 if (err == -ENOENT)
7971 break;
7972 if (err)
7973 goto out_err;
7974
7975 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
7976 cb->nlh->nlmsg_seq, NLM_F_MULTI,
7977 wdev->netdev, dst, mpp,
7978 &pinfo) < 0)
7979 goto out;
7980
7981 path_idx++;
7982 }
7983
7984 out:
7985 cb->args[2] = path_idx;
7986 err = skb->len;
7987 out_err:
7988 wiphy_unlock(&rdev->wiphy);
7989 return err;
7990 }
7991
nl80211_set_bss(struct sk_buff * skb,struct genl_info * info)7992 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
7993 {
7994 struct cfg80211_registered_device *rdev = info->user_ptr[0];
7995 struct net_device *dev = info->user_ptr[1];
7996 struct wireless_dev *wdev = dev->ieee80211_ptr;
7997 struct bss_parameters params;
7998 int err;
7999
8000 memset(¶ms, 0, sizeof(params));
8001 params.link_id = nl80211_link_id_or_invalid(info->attrs);
8002 /* default to not changing parameters */
8003 params.use_cts_prot = -1;
8004 params.use_short_preamble = -1;
8005 params.use_short_slot_time = -1;
8006 params.ap_isolate = -1;
8007 params.ht_opmode = -1;
8008 params.p2p_ctwindow = -1;
8009 params.p2p_opp_ps = -1;
8010
8011 if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
8012 params.use_cts_prot =
8013 nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
8014 if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
8015 params.use_short_preamble =
8016 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
8017 if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
8018 params.use_short_slot_time =
8019 nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
8020 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
8021 params.basic_rates =
8022 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8023 params.basic_rates_len =
8024 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8025 }
8026 if (info->attrs[NL80211_ATTR_AP_ISOLATE])
8027 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
8028 if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
8029 params.ht_opmode =
8030 nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
8031
8032 if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
8033 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
8034 return -EINVAL;
8035 params.p2p_ctwindow =
8036 nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
8037 if (params.p2p_ctwindow != 0 &&
8038 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
8039 return -EINVAL;
8040 }
8041
8042 if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
8043 u8 tmp;
8044
8045 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
8046 return -EINVAL;
8047 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
8048 params.p2p_opp_ps = tmp;
8049 if (params.p2p_opp_ps &&
8050 !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
8051 return -EINVAL;
8052 }
8053
8054 if (!rdev->ops->change_bss)
8055 return -EOPNOTSUPP;
8056
8057 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
8058 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
8059 return -EOPNOTSUPP;
8060
8061 wdev_lock(wdev);
8062 err = rdev_change_bss(rdev, dev, ¶ms);
8063 wdev_unlock(wdev);
8064
8065 return err;
8066 }
8067
nl80211_req_set_reg(struct sk_buff * skb,struct genl_info * info)8068 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
8069 {
8070 char *data = NULL;
8071 bool is_indoor;
8072 enum nl80211_user_reg_hint_type user_reg_hint_type;
8073 u32 owner_nlportid;
8074
8075 /*
8076 * You should only get this when cfg80211 hasn't yet initialized
8077 * completely when built-in to the kernel right between the time
8078 * window between nl80211_init() and regulatory_init(), if that is
8079 * even possible.
8080 */
8081 if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
8082 return -EINPROGRESS;
8083
8084 if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
8085 user_reg_hint_type =
8086 nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
8087 else
8088 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
8089
8090 switch (user_reg_hint_type) {
8091 case NL80211_USER_REG_HINT_USER:
8092 case NL80211_USER_REG_HINT_CELL_BASE:
8093 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
8094 return -EINVAL;
8095
8096 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
8097 return regulatory_hint_user(data, user_reg_hint_type);
8098 case NL80211_USER_REG_HINT_INDOOR:
8099 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8100 owner_nlportid = info->snd_portid;
8101 is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
8102 } else {
8103 owner_nlportid = 0;
8104 is_indoor = true;
8105 }
8106
8107 return regulatory_hint_indoor(is_indoor, owner_nlportid);
8108 default:
8109 return -EINVAL;
8110 }
8111 }
8112
nl80211_reload_regdb(struct sk_buff * skb,struct genl_info * info)8113 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
8114 {
8115 return reg_reload_regdb();
8116 }
8117
nl80211_get_mesh_config(struct sk_buff * skb,struct genl_info * info)8118 static int nl80211_get_mesh_config(struct sk_buff *skb,
8119 struct genl_info *info)
8120 {
8121 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8122 struct net_device *dev = info->user_ptr[1];
8123 struct wireless_dev *wdev = dev->ieee80211_ptr;
8124 struct mesh_config cur_params;
8125 int err = 0;
8126 void *hdr;
8127 struct nlattr *pinfoattr;
8128 struct sk_buff *msg;
8129
8130 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
8131 return -EOPNOTSUPP;
8132
8133 if (!rdev->ops->get_mesh_config)
8134 return -EOPNOTSUPP;
8135
8136 wdev_lock(wdev);
8137 /* If not connected, get default parameters */
8138 if (!wdev->u.mesh.id_len)
8139 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
8140 else
8141 err = rdev_get_mesh_config(rdev, dev, &cur_params);
8142 wdev_unlock(wdev);
8143
8144 if (err)
8145 return err;
8146
8147 /* Draw up a netlink message to send back */
8148 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8149 if (!msg)
8150 return -ENOMEM;
8151 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8152 NL80211_CMD_GET_MESH_CONFIG);
8153 if (!hdr)
8154 goto out;
8155 pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MESH_CONFIG);
8156 if (!pinfoattr)
8157 goto nla_put_failure;
8158 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8159 nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
8160 cur_params.dot11MeshRetryTimeout) ||
8161 nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
8162 cur_params.dot11MeshConfirmTimeout) ||
8163 nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
8164 cur_params.dot11MeshHoldingTimeout) ||
8165 nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
8166 cur_params.dot11MeshMaxPeerLinks) ||
8167 nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
8168 cur_params.dot11MeshMaxRetries) ||
8169 nla_put_u8(msg, NL80211_MESHCONF_TTL,
8170 cur_params.dot11MeshTTL) ||
8171 nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
8172 cur_params.element_ttl) ||
8173 nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
8174 cur_params.auto_open_plinks) ||
8175 nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
8176 cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
8177 nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
8178 cur_params.dot11MeshHWMPmaxPREQretries) ||
8179 nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
8180 cur_params.path_refresh_time) ||
8181 nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
8182 cur_params.min_discovery_timeout) ||
8183 nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
8184 cur_params.dot11MeshHWMPactivePathTimeout) ||
8185 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
8186 cur_params.dot11MeshHWMPpreqMinInterval) ||
8187 nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
8188 cur_params.dot11MeshHWMPperrMinInterval) ||
8189 nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
8190 cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
8191 nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
8192 cur_params.dot11MeshHWMPRootMode) ||
8193 nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
8194 cur_params.dot11MeshHWMPRannInterval) ||
8195 nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
8196 cur_params.dot11MeshGateAnnouncementProtocol) ||
8197 nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
8198 cur_params.dot11MeshForwarding) ||
8199 nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
8200 cur_params.rssi_threshold) ||
8201 nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
8202 cur_params.ht_opmode) ||
8203 nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
8204 cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
8205 nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
8206 cur_params.dot11MeshHWMProotInterval) ||
8207 nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
8208 cur_params.dot11MeshHWMPconfirmationInterval) ||
8209 nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
8210 cur_params.power_mode) ||
8211 nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
8212 cur_params.dot11MeshAwakeWindowDuration) ||
8213 nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
8214 cur_params.plink_timeout) ||
8215 nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_GATE,
8216 cur_params.dot11MeshConnectedToMeshGate) ||
8217 nla_put_u8(msg, NL80211_MESHCONF_NOLEARN,
8218 cur_params.dot11MeshNolearn) ||
8219 nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_AS,
8220 cur_params.dot11MeshConnectedToAuthServer))
8221 goto nla_put_failure;
8222 nla_nest_end(msg, pinfoattr);
8223 genlmsg_end(msg, hdr);
8224 return genlmsg_reply(msg, info);
8225
8226 nla_put_failure:
8227 out:
8228 nlmsg_free(msg);
8229 return -ENOBUFS;
8230 }
8231
8232 static const struct nla_policy
8233 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
8234 [NL80211_MESHCONF_RETRY_TIMEOUT] =
8235 NLA_POLICY_RANGE(NLA_U16, 1, 255),
8236 [NL80211_MESHCONF_CONFIRM_TIMEOUT] =
8237 NLA_POLICY_RANGE(NLA_U16, 1, 255),
8238 [NL80211_MESHCONF_HOLDING_TIMEOUT] =
8239 NLA_POLICY_RANGE(NLA_U16, 1, 255),
8240 [NL80211_MESHCONF_MAX_PEER_LINKS] =
8241 NLA_POLICY_RANGE(NLA_U16, 0, 255),
8242 [NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16),
8243 [NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
8244 [NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
8245 [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1),
8246 [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] =
8247 NLA_POLICY_RANGE(NLA_U32, 1, 255),
8248 [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
8249 [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
8250 [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1),
8251 [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
8252 [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] =
8253 NLA_POLICY_MIN(NLA_U16, 1),
8254 [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] =
8255 NLA_POLICY_MIN(NLA_U16, 1),
8256 [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] =
8257 NLA_POLICY_MIN(NLA_U16, 1),
8258 [NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4),
8259 [NL80211_MESHCONF_HWMP_RANN_INTERVAL] =
8260 NLA_POLICY_MIN(NLA_U16, 1),
8261 [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1),
8262 [NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1),
8263 [NL80211_MESHCONF_RSSI_THRESHOLD] =
8264 NLA_POLICY_RANGE(NLA_S32, -255, 0),
8265 [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
8266 [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
8267 [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] =
8268 NLA_POLICY_MIN(NLA_U16, 1),
8269 [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] =
8270 NLA_POLICY_MIN(NLA_U16, 1),
8271 [NL80211_MESHCONF_POWER_MODE] =
8272 NLA_POLICY_RANGE(NLA_U32,
8273 NL80211_MESH_POWER_ACTIVE,
8274 NL80211_MESH_POWER_MAX),
8275 [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
8276 [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
8277 [NL80211_MESHCONF_CONNECTED_TO_GATE] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
8278 [NL80211_MESHCONF_NOLEARN] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
8279 [NL80211_MESHCONF_CONNECTED_TO_AS] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
8280 };
8281
8282 static const struct nla_policy
8283 nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
8284 [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
8285 [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
8286 [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
8287 [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
8288 [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
8289 [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
8290 [NL80211_MESH_SETUP_IE] =
8291 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
8292 IEEE80211_MAX_DATA_LEN),
8293 [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
8294 };
8295
nl80211_parse_mesh_config(struct genl_info * info,struct mesh_config * cfg,u32 * mask_out)8296 static int nl80211_parse_mesh_config(struct genl_info *info,
8297 struct mesh_config *cfg,
8298 u32 *mask_out)
8299 {
8300 struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
8301 u32 mask = 0;
8302 u16 ht_opmode;
8303
8304 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn) \
8305 do { \
8306 if (tb[attr]) { \
8307 cfg->param = fn(tb[attr]); \
8308 mask |= BIT((attr) - 1); \
8309 } \
8310 } while (0)
8311
8312 if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
8313 return -EINVAL;
8314 if (nla_parse_nested_deprecated(tb, NL80211_MESHCONF_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_CONFIG], nl80211_meshconf_params_policy, info->extack))
8315 return -EINVAL;
8316
8317 /* This makes sure that there aren't more than 32 mesh config
8318 * parameters (otherwise our bitfield scheme would not work.) */
8319 BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
8320
8321 /* Fill in the params struct */
8322 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask,
8323 NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
8324 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask,
8325 NL80211_MESHCONF_CONFIRM_TIMEOUT,
8326 nla_get_u16);
8327 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask,
8328 NL80211_MESHCONF_HOLDING_TIMEOUT,
8329 nla_get_u16);
8330 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask,
8331 NL80211_MESHCONF_MAX_PEER_LINKS,
8332 nla_get_u16);
8333 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask,
8334 NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
8335 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask,
8336 NL80211_MESHCONF_TTL, nla_get_u8);
8337 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask,
8338 NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
8339 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask,
8340 NL80211_MESHCONF_AUTO_OPEN_PLINKS,
8341 nla_get_u8);
8342 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
8343 mask,
8344 NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
8345 nla_get_u32);
8346 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask,
8347 NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
8348 nla_get_u8);
8349 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask,
8350 NL80211_MESHCONF_PATH_REFRESH_TIME,
8351 nla_get_u32);
8352 if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) &&
8353 (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535))
8354 return -EINVAL;
8355 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask,
8356 NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
8357 nla_get_u16);
8358 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
8359 mask,
8360 NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
8361 nla_get_u32);
8362 if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) &&
8363 (cfg->dot11MeshHWMPactivePathTimeout < 1 ||
8364 cfg->dot11MeshHWMPactivePathTimeout > 65535))
8365 return -EINVAL;
8366 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask,
8367 NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
8368 nla_get_u16);
8369 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask,
8370 NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
8371 nla_get_u16);
8372 FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
8373 dot11MeshHWMPnetDiameterTraversalTime, mask,
8374 NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
8375 nla_get_u16);
8376 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
8377 NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
8378 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
8379 NL80211_MESHCONF_HWMP_RANN_INTERVAL,
8380 nla_get_u16);
8381 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol,
8382 mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
8383 nla_get_u8);
8384 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask,
8385 NL80211_MESHCONF_FORWARDING, nla_get_u8);
8386 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask,
8387 NL80211_MESHCONF_RSSI_THRESHOLD,
8388 nla_get_s32);
8389 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToMeshGate, mask,
8390 NL80211_MESHCONF_CONNECTED_TO_GATE,
8391 nla_get_u8);
8392 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToAuthServer, mask,
8393 NL80211_MESHCONF_CONNECTED_TO_AS,
8394 nla_get_u8);
8395 /*
8396 * Check HT operation mode based on
8397 * IEEE 802.11-2016 9.4.2.57 HT Operation element.
8398 */
8399 if (tb[NL80211_MESHCONF_HT_OPMODE]) {
8400 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
8401
8402 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
8403 IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
8404 IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
8405 return -EINVAL;
8406
8407 /* NON_HT_STA bit is reserved, but some programs set it */
8408 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
8409
8410 cfg->ht_opmode = ht_opmode;
8411 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
8412 }
8413 FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
8414 dot11MeshHWMPactivePathToRootTimeout, mask,
8415 NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
8416 nla_get_u32);
8417 if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) &&
8418 (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 ||
8419 cfg->dot11MeshHWMPactivePathToRootTimeout > 65535))
8420 return -EINVAL;
8421 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask,
8422 NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
8423 nla_get_u16);
8424 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval,
8425 mask,
8426 NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
8427 nla_get_u16);
8428 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask,
8429 NL80211_MESHCONF_POWER_MODE, nla_get_u32);
8430 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask,
8431 NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
8432 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask,
8433 NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32);
8434 FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNolearn, mask,
8435 NL80211_MESHCONF_NOLEARN, nla_get_u8);
8436 if (mask_out)
8437 *mask_out = mask;
8438
8439 return 0;
8440
8441 #undef FILL_IN_MESH_PARAM_IF_SET
8442 }
8443
nl80211_parse_mesh_setup(struct genl_info * info,struct mesh_setup * setup)8444 static int nl80211_parse_mesh_setup(struct genl_info *info,
8445 struct mesh_setup *setup)
8446 {
8447 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8448 struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
8449
8450 if (!info->attrs[NL80211_ATTR_MESH_SETUP])
8451 return -EINVAL;
8452 if (nla_parse_nested_deprecated(tb, NL80211_MESH_SETUP_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_SETUP], nl80211_mesh_setup_params_policy, info->extack))
8453 return -EINVAL;
8454
8455 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
8456 setup->sync_method =
8457 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
8458 IEEE80211_SYNC_METHOD_VENDOR :
8459 IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
8460
8461 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
8462 setup->path_sel_proto =
8463 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
8464 IEEE80211_PATH_PROTOCOL_VENDOR :
8465 IEEE80211_PATH_PROTOCOL_HWMP;
8466
8467 if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
8468 setup->path_metric =
8469 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
8470 IEEE80211_PATH_METRIC_VENDOR :
8471 IEEE80211_PATH_METRIC_AIRTIME;
8472
8473 if (tb[NL80211_MESH_SETUP_IE]) {
8474 struct nlattr *ieattr =
8475 tb[NL80211_MESH_SETUP_IE];
8476 setup->ie = nla_data(ieattr);
8477 setup->ie_len = nla_len(ieattr);
8478 }
8479 if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
8480 !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
8481 return -EINVAL;
8482 setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
8483 setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
8484 setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
8485 if (setup->is_secure)
8486 setup->user_mpm = true;
8487
8488 if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
8489 if (!setup->user_mpm)
8490 return -EINVAL;
8491 setup->auth_id =
8492 nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
8493 }
8494
8495 return 0;
8496 }
8497
nl80211_update_mesh_config(struct sk_buff * skb,struct genl_info * info)8498 static int nl80211_update_mesh_config(struct sk_buff *skb,
8499 struct genl_info *info)
8500 {
8501 struct cfg80211_registered_device *rdev = info->user_ptr[0];
8502 struct net_device *dev = info->user_ptr[1];
8503 struct wireless_dev *wdev = dev->ieee80211_ptr;
8504 struct mesh_config cfg = {};
8505 u32 mask;
8506 int err;
8507
8508 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
8509 return -EOPNOTSUPP;
8510
8511 if (!rdev->ops->update_mesh_config)
8512 return -EOPNOTSUPP;
8513
8514 err = nl80211_parse_mesh_config(info, &cfg, &mask);
8515 if (err)
8516 return err;
8517
8518 wdev_lock(wdev);
8519 if (!wdev->u.mesh.id_len)
8520 err = -ENOLINK;
8521
8522 if (!err)
8523 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
8524
8525 wdev_unlock(wdev);
8526
8527 return err;
8528 }
8529
nl80211_put_regdom(const struct ieee80211_regdomain * regdom,struct sk_buff * msg)8530 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
8531 struct sk_buff *msg)
8532 {
8533 struct nlattr *nl_reg_rules;
8534 unsigned int i;
8535
8536 if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
8537 (regdom->dfs_region &&
8538 nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
8539 goto nla_put_failure;
8540
8541 nl_reg_rules = nla_nest_start_noflag(msg, NL80211_ATTR_REG_RULES);
8542 if (!nl_reg_rules)
8543 goto nla_put_failure;
8544
8545 for (i = 0; i < regdom->n_reg_rules; i++) {
8546 struct nlattr *nl_reg_rule;
8547 const struct ieee80211_reg_rule *reg_rule;
8548 const struct ieee80211_freq_range *freq_range;
8549 const struct ieee80211_power_rule *power_rule;
8550 unsigned int max_bandwidth_khz;
8551
8552 reg_rule = ®dom->reg_rules[i];
8553 freq_range = ®_rule->freq_range;
8554 power_rule = ®_rule->power_rule;
8555
8556 nl_reg_rule = nla_nest_start_noflag(msg, i);
8557 if (!nl_reg_rule)
8558 goto nla_put_failure;
8559
8560 max_bandwidth_khz = freq_range->max_bandwidth_khz;
8561 if (!max_bandwidth_khz)
8562 max_bandwidth_khz = reg_get_max_bandwidth(regdom,
8563 reg_rule);
8564
8565 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
8566 reg_rule->flags) ||
8567 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
8568 freq_range->start_freq_khz) ||
8569 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
8570 freq_range->end_freq_khz) ||
8571 nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
8572 max_bandwidth_khz) ||
8573 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
8574 power_rule->max_antenna_gain) ||
8575 nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
8576 power_rule->max_eirp) ||
8577 nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
8578 reg_rule->dfs_cac_ms))
8579 goto nla_put_failure;
8580
8581 nla_nest_end(msg, nl_reg_rule);
8582 }
8583
8584 nla_nest_end(msg, nl_reg_rules);
8585 return 0;
8586
8587 nla_put_failure:
8588 return -EMSGSIZE;
8589 }
8590
nl80211_get_reg_do(struct sk_buff * skb,struct genl_info * info)8591 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
8592 {
8593 const struct ieee80211_regdomain *regdom = NULL;
8594 struct cfg80211_registered_device *rdev;
8595 struct wiphy *wiphy = NULL;
8596 struct sk_buff *msg;
8597 int err = -EMSGSIZE;
8598 void *hdr;
8599
8600 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8601 if (!msg)
8602 return -ENOBUFS;
8603
8604 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8605 NL80211_CMD_GET_REG);
8606 if (!hdr)
8607 goto put_failure;
8608
8609 rtnl_lock();
8610
8611 if (info->attrs[NL80211_ATTR_WIPHY]) {
8612 bool self_managed;
8613
8614 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
8615 if (IS_ERR(rdev)) {
8616 err = PTR_ERR(rdev);
8617 goto nla_put_failure;
8618 }
8619
8620 wiphy = &rdev->wiphy;
8621 self_managed = wiphy->regulatory_flags &
8622 REGULATORY_WIPHY_SELF_MANAGED;
8623
8624 rcu_read_lock();
8625
8626 regdom = get_wiphy_regdom(wiphy);
8627
8628 /* a self-managed-reg device must have a private regdom */
8629 if (WARN_ON(!regdom && self_managed)) {
8630 err = -EINVAL;
8631 goto nla_put_failure_rcu;
8632 }
8633
8634 if (regdom &&
8635 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
8636 goto nla_put_failure_rcu;
8637 } else {
8638 rcu_read_lock();
8639 }
8640
8641 if (!wiphy && reg_last_request_cell_base() &&
8642 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
8643 NL80211_USER_REG_HINT_CELL_BASE))
8644 goto nla_put_failure_rcu;
8645
8646 if (!regdom)
8647 regdom = rcu_dereference(cfg80211_regdomain);
8648
8649 if (nl80211_put_regdom(regdom, msg))
8650 goto nla_put_failure_rcu;
8651
8652 rcu_read_unlock();
8653
8654 genlmsg_end(msg, hdr);
8655 rtnl_unlock();
8656 return genlmsg_reply(msg, info);
8657
8658 nla_put_failure_rcu:
8659 rcu_read_unlock();
8660 nla_put_failure:
8661 rtnl_unlock();
8662 put_failure:
8663 nlmsg_free(msg);
8664 return err;
8665 }
8666
nl80211_send_regdom(struct sk_buff * msg,struct netlink_callback * cb,u32 seq,int flags,struct wiphy * wiphy,const struct ieee80211_regdomain * regdom)8667 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
8668 u32 seq, int flags, struct wiphy *wiphy,
8669 const struct ieee80211_regdomain *regdom)
8670 {
8671 void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
8672 NL80211_CMD_GET_REG);
8673
8674 if (!hdr)
8675 return -1;
8676
8677 genl_dump_check_consistent(cb, hdr);
8678
8679 if (nl80211_put_regdom(regdom, msg))
8680 goto nla_put_failure;
8681
8682 if (!wiphy && reg_last_request_cell_base() &&
8683 nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
8684 NL80211_USER_REG_HINT_CELL_BASE))
8685 goto nla_put_failure;
8686
8687 if (wiphy &&
8688 nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
8689 goto nla_put_failure;
8690
8691 if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
8692 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
8693 goto nla_put_failure;
8694
8695 genlmsg_end(msg, hdr);
8696 return 0;
8697
8698 nla_put_failure:
8699 genlmsg_cancel(msg, hdr);
8700 return -EMSGSIZE;
8701 }
8702
nl80211_get_reg_dump(struct sk_buff * skb,struct netlink_callback * cb)8703 static int nl80211_get_reg_dump(struct sk_buff *skb,
8704 struct netlink_callback *cb)
8705 {
8706 const struct ieee80211_regdomain *regdom = NULL;
8707 struct cfg80211_registered_device *rdev;
8708 int err, reg_idx, start = cb->args[2];
8709
8710 rcu_read_lock();
8711
8712 if (cfg80211_regdomain && start == 0) {
8713 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
8714 NLM_F_MULTI, NULL,
8715 rcu_dereference(cfg80211_regdomain));
8716 if (err < 0)
8717 goto out_err;
8718 }
8719
8720 /* the global regdom is idx 0 */
8721 reg_idx = 1;
8722 list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
8723 regdom = get_wiphy_regdom(&rdev->wiphy);
8724 if (!regdom)
8725 continue;
8726
8727 if (++reg_idx <= start)
8728 continue;
8729
8730 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
8731 NLM_F_MULTI, &rdev->wiphy, regdom);
8732 if (err < 0) {
8733 reg_idx--;
8734 break;
8735 }
8736 }
8737
8738 cb->args[2] = reg_idx;
8739 err = skb->len;
8740 out_err:
8741 rcu_read_unlock();
8742 return err;
8743 }
8744
8745 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
8746 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
8747 [NL80211_ATTR_REG_RULE_FLAGS] = { .type = NLA_U32 },
8748 [NL80211_ATTR_FREQ_RANGE_START] = { .type = NLA_U32 },
8749 [NL80211_ATTR_FREQ_RANGE_END] = { .type = NLA_U32 },
8750 [NL80211_ATTR_FREQ_RANGE_MAX_BW] = { .type = NLA_U32 },
8751 [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN] = { .type = NLA_U32 },
8752 [NL80211_ATTR_POWER_RULE_MAX_EIRP] = { .type = NLA_U32 },
8753 [NL80211_ATTR_DFS_CAC_TIME] = { .type = NLA_U32 },
8754 };
8755
parse_reg_rule(struct nlattr * tb[],struct ieee80211_reg_rule * reg_rule)8756 static int parse_reg_rule(struct nlattr *tb[],
8757 struct ieee80211_reg_rule *reg_rule)
8758 {
8759 struct ieee80211_freq_range *freq_range = ®_rule->freq_range;
8760 struct ieee80211_power_rule *power_rule = ®_rule->power_rule;
8761
8762 if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
8763 return -EINVAL;
8764 if (!tb[NL80211_ATTR_FREQ_RANGE_START])
8765 return -EINVAL;
8766 if (!tb[NL80211_ATTR_FREQ_RANGE_END])
8767 return -EINVAL;
8768 if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
8769 return -EINVAL;
8770 if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
8771 return -EINVAL;
8772
8773 reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
8774
8775 freq_range->start_freq_khz =
8776 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
8777 freq_range->end_freq_khz =
8778 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
8779 freq_range->max_bandwidth_khz =
8780 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
8781
8782 power_rule->max_eirp =
8783 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
8784
8785 if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
8786 power_rule->max_antenna_gain =
8787 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
8788
8789 if (tb[NL80211_ATTR_DFS_CAC_TIME])
8790 reg_rule->dfs_cac_ms =
8791 nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
8792
8793 return 0;
8794 }
8795
nl80211_set_reg(struct sk_buff * skb,struct genl_info * info)8796 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
8797 {
8798 struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
8799 struct nlattr *nl_reg_rule;
8800 char *alpha2;
8801 int rem_reg_rules, r;
8802 u32 num_rules = 0, rule_idx = 0;
8803 enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
8804 struct ieee80211_regdomain *rd;
8805
8806 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
8807 return -EINVAL;
8808
8809 if (!info->attrs[NL80211_ATTR_REG_RULES])
8810 return -EINVAL;
8811
8812 alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
8813
8814 if (info->attrs[NL80211_ATTR_DFS_REGION])
8815 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
8816
8817 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
8818 rem_reg_rules) {
8819 num_rules++;
8820 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
8821 return -EINVAL;
8822 }
8823
8824 rtnl_lock();
8825 if (!reg_is_valid_request(alpha2)) {
8826 r = -EINVAL;
8827 goto out;
8828 }
8829
8830 rd = kzalloc(struct_size(rd, reg_rules, num_rules), GFP_KERNEL);
8831 if (!rd) {
8832 r = -ENOMEM;
8833 goto out;
8834 }
8835
8836 rd->n_reg_rules = num_rules;
8837 rd->alpha2[0] = alpha2[0];
8838 rd->alpha2[1] = alpha2[1];
8839
8840 /*
8841 * Disable DFS master mode if the DFS region was
8842 * not supported or known on this kernel.
8843 */
8844 if (reg_supported_dfs_region(dfs_region))
8845 rd->dfs_region = dfs_region;
8846
8847 nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
8848 rem_reg_rules) {
8849 r = nla_parse_nested_deprecated(tb, NL80211_REG_RULE_ATTR_MAX,
8850 nl_reg_rule, reg_rule_policy,
8851 info->extack);
8852 if (r)
8853 goto bad_reg;
8854 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
8855 if (r)
8856 goto bad_reg;
8857
8858 rule_idx++;
8859
8860 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
8861 r = -EINVAL;
8862 goto bad_reg;
8863 }
8864 }
8865
8866 r = set_regdom(rd, REGD_SOURCE_CRDA);
8867 /* set_regdom takes ownership of rd */
8868 rd = NULL;
8869 bad_reg:
8870 kfree(rd);
8871 out:
8872 rtnl_unlock();
8873 return r;
8874 }
8875 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
8876
validate_scan_freqs(struct nlattr * freqs)8877 static int validate_scan_freqs(struct nlattr *freqs)
8878 {
8879 struct nlattr *attr1, *attr2;
8880 int n_channels = 0, tmp1, tmp2;
8881
8882 nla_for_each_nested(attr1, freqs, tmp1)
8883 if (nla_len(attr1) != sizeof(u32))
8884 return 0;
8885
8886 nla_for_each_nested(attr1, freqs, tmp1) {
8887 n_channels++;
8888 /*
8889 * Some hardware has a limited channel list for
8890 * scanning, and it is pretty much nonsensical
8891 * to scan for a channel twice, so disallow that
8892 * and don't require drivers to check that the
8893 * channel list they get isn't longer than what
8894 * they can scan, as long as they can scan all
8895 * the channels they registered at once.
8896 */
8897 nla_for_each_nested(attr2, freqs, tmp2)
8898 if (attr1 != attr2 &&
8899 nla_get_u32(attr1) == nla_get_u32(attr2))
8900 return 0;
8901 }
8902
8903 return n_channels;
8904 }
8905
is_band_valid(struct wiphy * wiphy,enum nl80211_band b)8906 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
8907 {
8908 return b < NUM_NL80211_BANDS && wiphy->bands[b];
8909 }
8910
parse_bss_select(struct nlattr * nla,struct wiphy * wiphy,struct cfg80211_bss_selection * bss_select)8911 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
8912 struct cfg80211_bss_selection *bss_select)
8913 {
8914 struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
8915 struct nlattr *nest;
8916 int err;
8917 bool found = false;
8918 int i;
8919
8920 /* only process one nested attribute */
8921 nest = nla_data(nla);
8922 if (!nla_ok(nest, nla_len(nest)))
8923 return -EINVAL;
8924
8925 err = nla_parse_nested_deprecated(attr, NL80211_BSS_SELECT_ATTR_MAX,
8926 nest, nl80211_bss_select_policy,
8927 NULL);
8928 if (err)
8929 return err;
8930
8931 /* only one attribute may be given */
8932 for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
8933 if (attr[i]) {
8934 if (found)
8935 return -EINVAL;
8936 found = true;
8937 }
8938 }
8939
8940 bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
8941
8942 if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
8943 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
8944
8945 if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
8946 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
8947 bss_select->param.band_pref =
8948 nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
8949 if (!is_band_valid(wiphy, bss_select->param.band_pref))
8950 return -EINVAL;
8951 }
8952
8953 if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
8954 struct nl80211_bss_select_rssi_adjust *adj_param;
8955
8956 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
8957 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
8958 bss_select->param.adjust.band = adj_param->band;
8959 bss_select->param.adjust.delta = adj_param->delta;
8960 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
8961 return -EINVAL;
8962 }
8963
8964 /* user-space did not provide behaviour attribute */
8965 if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
8966 return -EINVAL;
8967
8968 if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
8969 return -EINVAL;
8970
8971 return 0;
8972 }
8973
nl80211_parse_random_mac(struct nlattr ** attrs,u8 * mac_addr,u8 * mac_addr_mask)8974 int nl80211_parse_random_mac(struct nlattr **attrs,
8975 u8 *mac_addr, u8 *mac_addr_mask)
8976 {
8977 int i;
8978
8979 if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
8980 eth_zero_addr(mac_addr);
8981 eth_zero_addr(mac_addr_mask);
8982 mac_addr[0] = 0x2;
8983 mac_addr_mask[0] = 0x3;
8984
8985 return 0;
8986 }
8987
8988 /* need both or none */
8989 if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
8990 return -EINVAL;
8991
8992 memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
8993 memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
8994
8995 /* don't allow or configure an mcast address */
8996 if (!is_multicast_ether_addr(mac_addr_mask) ||
8997 is_multicast_ether_addr(mac_addr))
8998 return -EINVAL;
8999
9000 /*
9001 * allow users to pass a MAC address that has bits set outside
9002 * of the mask, but don't bother drivers with having to deal
9003 * with such bits
9004 */
9005 for (i = 0; i < ETH_ALEN; i++)
9006 mac_addr[i] &= mac_addr_mask[i];
9007
9008 return 0;
9009 }
9010
cfg80211_off_channel_oper_allowed(struct wireless_dev * wdev,struct ieee80211_channel * chan)9011 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev,
9012 struct ieee80211_channel *chan)
9013 {
9014 unsigned int link_id;
9015 bool all_ok = true;
9016
9017 ASSERT_WDEV_LOCK(wdev);
9018
9019 if (!cfg80211_beaconing_iface_active(wdev))
9020 return true;
9021
9022 /*
9023 * FIXME: check if we have a free HW resource/link for chan
9024 *
9025 * This, as well as the FIXME below, requires knowing the link
9026 * capabilities of the hardware.
9027 */
9028
9029 /* we cannot leave radar channels */
9030 for_each_valid_link(wdev, link_id) {
9031 struct cfg80211_chan_def *chandef;
9032
9033 chandef = wdev_chandef(wdev, link_id);
9034 if (!chandef || !chandef->chan)
9035 continue;
9036
9037 /*
9038 * FIXME: don't require all_ok, but rather check only the
9039 * correct HW resource/link onto which 'chan' falls,
9040 * as only that link leaves the channel for doing
9041 * the off-channel operation.
9042 */
9043
9044 if (chandef->chan->flags & IEEE80211_CHAN_RADAR)
9045 all_ok = false;
9046 }
9047
9048 if (all_ok)
9049 return true;
9050
9051 return regulatory_pre_cac_allowed(wdev->wiphy);
9052 }
9053
nl80211_check_scan_feat(struct wiphy * wiphy,u32 flags,u32 flag,enum nl80211_ext_feature_index feat)9054 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag,
9055 enum nl80211_ext_feature_index feat)
9056 {
9057 if (!(flags & flag))
9058 return true;
9059 if (wiphy_ext_feature_isset(wiphy, feat))
9060 return true;
9061 return false;
9062 }
9063
9064 static int
nl80211_check_scan_flags(struct wiphy * wiphy,struct wireless_dev * wdev,void * request,struct nlattr ** attrs,bool is_sched_scan)9065 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
9066 void *request, struct nlattr **attrs,
9067 bool is_sched_scan)
9068 {
9069 u8 *mac_addr, *mac_addr_mask;
9070 u32 *flags;
9071 enum nl80211_feature_flags randomness_flag;
9072
9073 if (!attrs[NL80211_ATTR_SCAN_FLAGS])
9074 return 0;
9075
9076 if (is_sched_scan) {
9077 struct cfg80211_sched_scan_request *req = request;
9078
9079 randomness_flag = wdev ?
9080 NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
9081 NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
9082 flags = &req->flags;
9083 mac_addr = req->mac_addr;
9084 mac_addr_mask = req->mac_addr_mask;
9085 } else {
9086 struct cfg80211_scan_request *req = request;
9087
9088 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
9089 flags = &req->flags;
9090 mac_addr = req->mac_addr;
9091 mac_addr_mask = req->mac_addr_mask;
9092 }
9093
9094 *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
9095
9096 if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
9097 !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
9098 !nl80211_check_scan_feat(wiphy, *flags,
9099 NL80211_SCAN_FLAG_LOW_SPAN,
9100 NL80211_EXT_FEATURE_LOW_SPAN_SCAN) ||
9101 !nl80211_check_scan_feat(wiphy, *flags,
9102 NL80211_SCAN_FLAG_LOW_POWER,
9103 NL80211_EXT_FEATURE_LOW_POWER_SCAN) ||
9104 !nl80211_check_scan_feat(wiphy, *flags,
9105 NL80211_SCAN_FLAG_HIGH_ACCURACY,
9106 NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) ||
9107 !nl80211_check_scan_feat(wiphy, *flags,
9108 NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME,
9109 NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) ||
9110 !nl80211_check_scan_feat(wiphy, *flags,
9111 NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP,
9112 NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) ||
9113 !nl80211_check_scan_feat(wiphy, *flags,
9114 NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION,
9115 NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) ||
9116 !nl80211_check_scan_feat(wiphy, *flags,
9117 NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE,
9118 NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) ||
9119 !nl80211_check_scan_feat(wiphy, *flags,
9120 NL80211_SCAN_FLAG_RANDOM_SN,
9121 NL80211_EXT_FEATURE_SCAN_RANDOM_SN) ||
9122 !nl80211_check_scan_feat(wiphy, *flags,
9123 NL80211_SCAN_FLAG_MIN_PREQ_CONTENT,
9124 NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT))
9125 return -EOPNOTSUPP;
9126
9127 if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
9128 int err;
9129
9130 if (!(wiphy->features & randomness_flag) ||
9131 (wdev && wdev->connected))
9132 return -EOPNOTSUPP;
9133
9134 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
9135 if (err)
9136 return err;
9137 }
9138
9139 return 0;
9140 }
9141
nl80211_trigger_scan(struct sk_buff * skb,struct genl_info * info)9142 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
9143 {
9144 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9145 struct wireless_dev *wdev = info->user_ptr[1];
9146 struct cfg80211_scan_request *request;
9147 struct nlattr *scan_freqs = NULL;
9148 bool scan_freqs_khz = false;
9149 struct nlattr *attr;
9150 struct wiphy *wiphy;
9151 int err, tmp, n_ssids = 0, n_channels, i;
9152 size_t ie_len, size;
9153
9154 wiphy = &rdev->wiphy;
9155
9156 if (wdev->iftype == NL80211_IFTYPE_NAN)
9157 return -EOPNOTSUPP;
9158
9159 if (!rdev->ops->scan)
9160 return -EOPNOTSUPP;
9161
9162 if (rdev->scan_req || rdev->scan_msg)
9163 return -EBUSY;
9164
9165 if (info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ]) {
9166 if (!wiphy_ext_feature_isset(wiphy,
9167 NL80211_EXT_FEATURE_SCAN_FREQ_KHZ))
9168 return -EOPNOTSUPP;
9169 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ];
9170 scan_freqs_khz = true;
9171 } else if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES])
9172 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQUENCIES];
9173
9174 if (scan_freqs) {
9175 n_channels = validate_scan_freqs(scan_freqs);
9176 if (!n_channels)
9177 return -EINVAL;
9178 } else {
9179 n_channels = ieee80211_get_num_supported_channels(wiphy);
9180 }
9181
9182 if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
9183 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
9184 n_ssids++;
9185
9186 if (n_ssids > wiphy->max_scan_ssids)
9187 return -EINVAL;
9188
9189 if (info->attrs[NL80211_ATTR_IE])
9190 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9191 else
9192 ie_len = 0;
9193
9194 if (ie_len > wiphy->max_scan_ie_len)
9195 return -EINVAL;
9196
9197 size = struct_size(request, channels, n_channels);
9198 size = size_add(size, array_size(sizeof(*request->ssids), n_ssids));
9199 size = size_add(size, ie_len);
9200 request = kzalloc(size, GFP_KERNEL);
9201 if (!request)
9202 return -ENOMEM;
9203
9204 if (n_ssids)
9205 request->ssids = (void *)&request->channels[n_channels];
9206 request->n_ssids = n_ssids;
9207 if (ie_len) {
9208 if (n_ssids)
9209 request->ie = (void *)(request->ssids + n_ssids);
9210 else
9211 request->ie = (void *)(request->channels + n_channels);
9212 }
9213
9214 i = 0;
9215 if (scan_freqs) {
9216 /* user specified, bail out if channel not found */
9217 nla_for_each_nested(attr, scan_freqs, tmp) {
9218 struct ieee80211_channel *chan;
9219 int freq = nla_get_u32(attr);
9220
9221 if (!scan_freqs_khz)
9222 freq = MHZ_TO_KHZ(freq);
9223
9224 chan = ieee80211_get_channel_khz(wiphy, freq);
9225 if (!chan) {
9226 err = -EINVAL;
9227 goto out_free;
9228 }
9229
9230 /* ignore disabled channels */
9231 if (chan->flags & IEEE80211_CHAN_DISABLED)
9232 continue;
9233
9234 request->channels[i] = chan;
9235 i++;
9236 }
9237 } else {
9238 enum nl80211_band band;
9239
9240 /* all channels */
9241 for (band = 0; band < NUM_NL80211_BANDS; band++) {
9242 int j;
9243
9244 if (!wiphy->bands[band])
9245 continue;
9246 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
9247 struct ieee80211_channel *chan;
9248
9249 chan = &wiphy->bands[band]->channels[j];
9250
9251 if (chan->flags & IEEE80211_CHAN_DISABLED)
9252 continue;
9253
9254 request->channels[i] = chan;
9255 i++;
9256 }
9257 }
9258 }
9259
9260 if (!i) {
9261 err = -EINVAL;
9262 goto out_free;
9263 }
9264
9265 request->n_channels = i;
9266
9267 wdev_lock(wdev);
9268 for (i = 0; i < request->n_channels; i++) {
9269 struct ieee80211_channel *chan = request->channels[i];
9270
9271 /* if we can go off-channel to the target channel we're good */
9272 if (cfg80211_off_channel_oper_allowed(wdev, chan))
9273 continue;
9274
9275 if (!cfg80211_wdev_on_sub_chan(wdev, chan, true)) {
9276 wdev_unlock(wdev);
9277 err = -EBUSY;
9278 goto out_free;
9279 }
9280 }
9281 wdev_unlock(wdev);
9282
9283 i = 0;
9284 if (n_ssids) {
9285 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
9286 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
9287 err = -EINVAL;
9288 goto out_free;
9289 }
9290 request->ssids[i].ssid_len = nla_len(attr);
9291 memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
9292 i++;
9293 }
9294 }
9295
9296 if (info->attrs[NL80211_ATTR_IE]) {
9297 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9298 memcpy((void *)request->ie,
9299 nla_data(info->attrs[NL80211_ATTR_IE]),
9300 request->ie_len);
9301 }
9302
9303 for (i = 0; i < NUM_NL80211_BANDS; i++)
9304 if (wiphy->bands[i])
9305 request->rates[i] =
9306 (1 << wiphy->bands[i]->n_bitrates) - 1;
9307
9308 if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
9309 nla_for_each_nested(attr,
9310 info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
9311 tmp) {
9312 enum nl80211_band band = nla_type(attr);
9313
9314 if (band < 0 || band >= NUM_NL80211_BANDS) {
9315 err = -EINVAL;
9316 goto out_free;
9317 }
9318
9319 if (!wiphy->bands[band])
9320 continue;
9321
9322 err = ieee80211_get_ratemask(wiphy->bands[band],
9323 nla_data(attr),
9324 nla_len(attr),
9325 &request->rates[band]);
9326 if (err)
9327 goto out_free;
9328 }
9329 }
9330
9331 if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
9332 request->duration =
9333 nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
9334 request->duration_mandatory =
9335 nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
9336 }
9337
9338 err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs,
9339 false);
9340 if (err)
9341 goto out_free;
9342
9343 request->no_cck =
9344 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
9345
9346 /* Initial implementation used NL80211_ATTR_MAC to set the specific
9347 * BSSID to scan for. This was problematic because that same attribute
9348 * was already used for another purpose (local random MAC address). The
9349 * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
9350 * compatibility with older userspace components, also use the
9351 * NL80211_ATTR_MAC value here if it can be determined to be used for
9352 * the specific BSSID use case instead of the random MAC address
9353 * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
9354 */
9355 if (info->attrs[NL80211_ATTR_BSSID])
9356 memcpy(request->bssid,
9357 nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
9358 else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
9359 info->attrs[NL80211_ATTR_MAC])
9360 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
9361 ETH_ALEN);
9362 else
9363 eth_broadcast_addr(request->bssid);
9364
9365 request->wdev = wdev;
9366 request->wiphy = &rdev->wiphy;
9367 request->scan_start = jiffies;
9368
9369 rdev->scan_req = request;
9370 err = cfg80211_scan(rdev);
9371
9372 if (err)
9373 goto out_free;
9374
9375 nl80211_send_scan_start(rdev, wdev);
9376 dev_hold(wdev->netdev);
9377
9378 return 0;
9379
9380 out_free:
9381 rdev->scan_req = NULL;
9382 kfree(request);
9383
9384 return err;
9385 }
9386
nl80211_abort_scan(struct sk_buff * skb,struct genl_info * info)9387 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
9388 {
9389 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9390 struct wireless_dev *wdev = info->user_ptr[1];
9391
9392 if (!rdev->ops->abort_scan)
9393 return -EOPNOTSUPP;
9394
9395 if (rdev->scan_msg)
9396 return 0;
9397
9398 if (!rdev->scan_req)
9399 return -ENOENT;
9400
9401 rdev_abort_scan(rdev, wdev);
9402 return 0;
9403 }
9404
9405 static int
nl80211_parse_sched_scan_plans(struct wiphy * wiphy,int n_plans,struct cfg80211_sched_scan_request * request,struct nlattr ** attrs)9406 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
9407 struct cfg80211_sched_scan_request *request,
9408 struct nlattr **attrs)
9409 {
9410 int tmp, err, i = 0;
9411 struct nlattr *attr;
9412
9413 if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
9414 u32 interval;
9415
9416 /*
9417 * If scan plans are not specified,
9418 * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
9419 * case one scan plan will be set with the specified scan
9420 * interval and infinite number of iterations.
9421 */
9422 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
9423 if (!interval)
9424 return -EINVAL;
9425
9426 request->scan_plans[0].interval =
9427 DIV_ROUND_UP(interval, MSEC_PER_SEC);
9428 if (!request->scan_plans[0].interval)
9429 return -EINVAL;
9430
9431 if (request->scan_plans[0].interval >
9432 wiphy->max_sched_scan_plan_interval)
9433 request->scan_plans[0].interval =
9434 wiphy->max_sched_scan_plan_interval;
9435
9436 return 0;
9437 }
9438
9439 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
9440 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
9441
9442 if (WARN_ON(i >= n_plans))
9443 return -EINVAL;
9444
9445 err = nla_parse_nested_deprecated(plan,
9446 NL80211_SCHED_SCAN_PLAN_MAX,
9447 attr, nl80211_plan_policy,
9448 NULL);
9449 if (err)
9450 return err;
9451
9452 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
9453 return -EINVAL;
9454
9455 request->scan_plans[i].interval =
9456 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
9457 if (!request->scan_plans[i].interval ||
9458 request->scan_plans[i].interval >
9459 wiphy->max_sched_scan_plan_interval)
9460 return -EINVAL;
9461
9462 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
9463 request->scan_plans[i].iterations =
9464 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
9465 if (!request->scan_plans[i].iterations ||
9466 (request->scan_plans[i].iterations >
9467 wiphy->max_sched_scan_plan_iterations))
9468 return -EINVAL;
9469 } else if (i < n_plans - 1) {
9470 /*
9471 * All scan plans but the last one must specify
9472 * a finite number of iterations
9473 */
9474 return -EINVAL;
9475 }
9476
9477 i++;
9478 }
9479
9480 /*
9481 * The last scan plan must not specify the number of
9482 * iterations, it is supposed to run infinitely
9483 */
9484 if (request->scan_plans[n_plans - 1].iterations)
9485 return -EINVAL;
9486
9487 return 0;
9488 }
9489
9490 static int
nl80211_parse_sched_scan_per_band_rssi(struct wiphy * wiphy,struct cfg80211_match_set * match_sets,struct nlattr * tb_band_rssi,s32 rssi_thold)9491 nl80211_parse_sched_scan_per_band_rssi(struct wiphy *wiphy,
9492 struct cfg80211_match_set *match_sets,
9493 struct nlattr *tb_band_rssi,
9494 s32 rssi_thold)
9495 {
9496 struct nlattr *attr;
9497 int i, tmp, ret = 0;
9498
9499 if (!wiphy_ext_feature_isset(wiphy,
9500 NL80211_EXT_FEATURE_SCHED_SCAN_BAND_SPECIFIC_RSSI_THOLD)) {
9501 if (tb_band_rssi)
9502 ret = -EOPNOTSUPP;
9503 else
9504 for (i = 0; i < NUM_NL80211_BANDS; i++)
9505 match_sets->per_band_rssi_thold[i] =
9506 NL80211_SCAN_RSSI_THOLD_OFF;
9507 return ret;
9508 }
9509
9510 for (i = 0; i < NUM_NL80211_BANDS; i++)
9511 match_sets->per_band_rssi_thold[i] = rssi_thold;
9512
9513 nla_for_each_nested(attr, tb_band_rssi, tmp) {
9514 enum nl80211_band band = nla_type(attr);
9515
9516 if (band < 0 || band >= NUM_NL80211_BANDS)
9517 return -EINVAL;
9518
9519 match_sets->per_band_rssi_thold[band] = nla_get_s32(attr);
9520 }
9521
9522 return 0;
9523 }
9524
9525 static struct cfg80211_sched_scan_request *
nl80211_parse_sched_scan(struct wiphy * wiphy,struct wireless_dev * wdev,struct nlattr ** attrs,int max_match_sets)9526 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
9527 struct nlattr **attrs, int max_match_sets)
9528 {
9529 struct cfg80211_sched_scan_request *request;
9530 struct nlattr *attr;
9531 int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
9532 enum nl80211_band band;
9533 size_t ie_len, size;
9534 struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
9535 s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
9536
9537 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
9538 n_channels = validate_scan_freqs(
9539 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
9540 if (!n_channels)
9541 return ERR_PTR(-EINVAL);
9542 } else {
9543 n_channels = ieee80211_get_num_supported_channels(wiphy);
9544 }
9545
9546 if (attrs[NL80211_ATTR_SCAN_SSIDS])
9547 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
9548 tmp)
9549 n_ssids++;
9550
9551 if (n_ssids > wiphy->max_sched_scan_ssids)
9552 return ERR_PTR(-EINVAL);
9553
9554 /*
9555 * First, count the number of 'real' matchsets. Due to an issue with
9556 * the old implementation, matchsets containing only the RSSI attribute
9557 * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
9558 * RSSI for all matchsets, rather than their own matchset for reporting
9559 * all APs with a strong RSSI. This is needed to be compatible with
9560 * older userspace that treated a matchset with only the RSSI as the
9561 * global RSSI for all other matchsets - if there are other matchsets.
9562 */
9563 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
9564 nla_for_each_nested(attr,
9565 attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
9566 tmp) {
9567 struct nlattr *rssi;
9568
9569 err = nla_parse_nested_deprecated(tb,
9570 NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
9571 attr,
9572 nl80211_match_policy,
9573 NULL);
9574 if (err)
9575 return ERR_PTR(err);
9576
9577 /* SSID and BSSID are mutually exclusive */
9578 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
9579 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
9580 return ERR_PTR(-EINVAL);
9581
9582 /* add other standalone attributes here */
9583 if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
9584 tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
9585 n_match_sets++;
9586 continue;
9587 }
9588 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
9589 if (rssi)
9590 default_match_rssi = nla_get_s32(rssi);
9591 }
9592 }
9593
9594 /* However, if there's no other matchset, add the RSSI one */
9595 if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
9596 n_match_sets = 1;
9597
9598 if (n_match_sets > max_match_sets)
9599 return ERR_PTR(-EINVAL);
9600
9601 if (attrs[NL80211_ATTR_IE])
9602 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
9603 else
9604 ie_len = 0;
9605
9606 if (ie_len > wiphy->max_sched_scan_ie_len)
9607 return ERR_PTR(-EINVAL);
9608
9609 if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
9610 /*
9611 * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
9612 * each scan plan already specifies its own interval
9613 */
9614 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
9615 return ERR_PTR(-EINVAL);
9616
9617 nla_for_each_nested(attr,
9618 attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
9619 n_plans++;
9620 } else {
9621 /*
9622 * The scan interval attribute is kept for backward
9623 * compatibility. If no scan plans are specified and sched scan
9624 * interval is specified, one scan plan will be set with this
9625 * scan interval and infinite number of iterations.
9626 */
9627 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
9628 return ERR_PTR(-EINVAL);
9629
9630 n_plans = 1;
9631 }
9632
9633 if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
9634 return ERR_PTR(-EINVAL);
9635
9636 if (!wiphy_ext_feature_isset(
9637 wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
9638 (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
9639 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
9640 return ERR_PTR(-EINVAL);
9641
9642 size = struct_size(request, channels, n_channels);
9643 size = size_add(size, array_size(sizeof(*request->ssids), n_ssids));
9644 size = size_add(size, array_size(sizeof(*request->match_sets),
9645 n_match_sets));
9646 size = size_add(size, array_size(sizeof(*request->scan_plans),
9647 n_plans));
9648 size = size_add(size, ie_len);
9649 request = kzalloc(size, GFP_KERNEL);
9650 if (!request)
9651 return ERR_PTR(-ENOMEM);
9652
9653 if (n_ssids)
9654 request->ssids = (void *)&request->channels[n_channels];
9655 request->n_ssids = n_ssids;
9656 if (ie_len) {
9657 if (n_ssids)
9658 request->ie = (void *)(request->ssids + n_ssids);
9659 else
9660 request->ie = (void *)(request->channels + n_channels);
9661 }
9662
9663 if (n_match_sets) {
9664 if (request->ie)
9665 request->match_sets = (void *)(request->ie + ie_len);
9666 else if (n_ssids)
9667 request->match_sets =
9668 (void *)(request->ssids + n_ssids);
9669 else
9670 request->match_sets =
9671 (void *)(request->channels + n_channels);
9672 }
9673 request->n_match_sets = n_match_sets;
9674
9675 if (n_match_sets)
9676 request->scan_plans = (void *)(request->match_sets +
9677 n_match_sets);
9678 else if (request->ie)
9679 request->scan_plans = (void *)(request->ie + ie_len);
9680 else if (n_ssids)
9681 request->scan_plans = (void *)(request->ssids + n_ssids);
9682 else
9683 request->scan_plans = (void *)(request->channels + n_channels);
9684
9685 request->n_scan_plans = n_plans;
9686
9687 i = 0;
9688 if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
9689 /* user specified, bail out if channel not found */
9690 nla_for_each_nested(attr,
9691 attrs[NL80211_ATTR_SCAN_FREQUENCIES],
9692 tmp) {
9693 struct ieee80211_channel *chan;
9694
9695 chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
9696
9697 if (!chan) {
9698 err = -EINVAL;
9699 goto out_free;
9700 }
9701
9702 /* ignore disabled channels */
9703 if (chan->flags & IEEE80211_CHAN_DISABLED)
9704 continue;
9705
9706 request->channels[i] = chan;
9707 i++;
9708 }
9709 } else {
9710 /* all channels */
9711 for (band = 0; band < NUM_NL80211_BANDS; band++) {
9712 int j;
9713
9714 if (!wiphy->bands[band])
9715 continue;
9716 for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
9717 struct ieee80211_channel *chan;
9718
9719 chan = &wiphy->bands[band]->channels[j];
9720
9721 if (chan->flags & IEEE80211_CHAN_DISABLED)
9722 continue;
9723
9724 request->channels[i] = chan;
9725 i++;
9726 }
9727 }
9728 }
9729
9730 if (!i) {
9731 err = -EINVAL;
9732 goto out_free;
9733 }
9734
9735 request->n_channels = i;
9736
9737 i = 0;
9738 if (n_ssids) {
9739 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
9740 tmp) {
9741 if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
9742 err = -EINVAL;
9743 goto out_free;
9744 }
9745 request->ssids[i].ssid_len = nla_len(attr);
9746 memcpy(request->ssids[i].ssid, nla_data(attr),
9747 nla_len(attr));
9748 i++;
9749 }
9750 }
9751
9752 i = 0;
9753 if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
9754 nla_for_each_nested(attr,
9755 attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
9756 tmp) {
9757 struct nlattr *ssid, *bssid, *rssi;
9758
9759 err = nla_parse_nested_deprecated(tb,
9760 NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
9761 attr,
9762 nl80211_match_policy,
9763 NULL);
9764 if (err)
9765 goto out_free;
9766 ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
9767 bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
9768
9769 if (!ssid && !bssid) {
9770 i++;
9771 continue;
9772 }
9773
9774 if (WARN_ON(i >= n_match_sets)) {
9775 /* this indicates a programming error,
9776 * the loop above should have verified
9777 * things properly
9778 */
9779 err = -EINVAL;
9780 goto out_free;
9781 }
9782
9783 if (ssid) {
9784 memcpy(request->match_sets[i].ssid.ssid,
9785 nla_data(ssid), nla_len(ssid));
9786 request->match_sets[i].ssid.ssid_len =
9787 nla_len(ssid);
9788 }
9789 if (bssid)
9790 memcpy(request->match_sets[i].bssid,
9791 nla_data(bssid), ETH_ALEN);
9792
9793 /* special attribute - old implementation w/a */
9794 request->match_sets[i].rssi_thold = default_match_rssi;
9795 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
9796 if (rssi)
9797 request->match_sets[i].rssi_thold =
9798 nla_get_s32(rssi);
9799
9800 /* Parse per band RSSI attribute */
9801 err = nl80211_parse_sched_scan_per_band_rssi(wiphy,
9802 &request->match_sets[i],
9803 tb[NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI],
9804 request->match_sets[i].rssi_thold);
9805 if (err)
9806 goto out_free;
9807
9808 i++;
9809 }
9810
9811 /* there was no other matchset, so the RSSI one is alone */
9812 if (i == 0 && n_match_sets)
9813 request->match_sets[0].rssi_thold = default_match_rssi;
9814
9815 request->min_rssi_thold = INT_MAX;
9816 for (i = 0; i < n_match_sets; i++)
9817 request->min_rssi_thold =
9818 min(request->match_sets[i].rssi_thold,
9819 request->min_rssi_thold);
9820 } else {
9821 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
9822 }
9823
9824 if (ie_len) {
9825 request->ie_len = ie_len;
9826 memcpy((void *)request->ie,
9827 nla_data(attrs[NL80211_ATTR_IE]),
9828 request->ie_len);
9829 }
9830
9831 err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true);
9832 if (err)
9833 goto out_free;
9834
9835 if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
9836 request->delay =
9837 nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
9838
9839 if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
9840 request->relative_rssi = nla_get_s8(
9841 attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
9842 request->relative_rssi_set = true;
9843 }
9844
9845 if (request->relative_rssi_set &&
9846 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
9847 struct nl80211_bss_select_rssi_adjust *rssi_adjust;
9848
9849 rssi_adjust = nla_data(
9850 attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
9851 request->rssi_adjust.band = rssi_adjust->band;
9852 request->rssi_adjust.delta = rssi_adjust->delta;
9853 if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
9854 err = -EINVAL;
9855 goto out_free;
9856 }
9857 }
9858
9859 err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
9860 if (err)
9861 goto out_free;
9862
9863 request->scan_start = jiffies;
9864
9865 return request;
9866
9867 out_free:
9868 kfree(request);
9869 return ERR_PTR(err);
9870 }
9871
nl80211_start_sched_scan(struct sk_buff * skb,struct genl_info * info)9872 static int nl80211_start_sched_scan(struct sk_buff *skb,
9873 struct genl_info *info)
9874 {
9875 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9876 struct net_device *dev = info->user_ptr[1];
9877 struct wireless_dev *wdev = dev->ieee80211_ptr;
9878 struct cfg80211_sched_scan_request *sched_scan_req;
9879 bool want_multi;
9880 int err;
9881
9882 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
9883 return -EOPNOTSUPP;
9884
9885 want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
9886 err = cfg80211_sched_scan_req_possible(rdev, want_multi);
9887 if (err)
9888 return err;
9889
9890 sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
9891 info->attrs,
9892 rdev->wiphy.max_match_sets);
9893
9894 err = PTR_ERR_OR_ZERO(sched_scan_req);
9895 if (err)
9896 goto out_err;
9897
9898 /* leave request id zero for legacy request
9899 * or if driver does not support multi-scheduled scan
9900 */
9901 if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1)
9902 sched_scan_req->reqid = cfg80211_assign_cookie(rdev);
9903
9904 err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
9905 if (err)
9906 goto out_free;
9907
9908 sched_scan_req->dev = dev;
9909 sched_scan_req->wiphy = &rdev->wiphy;
9910
9911 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
9912 sched_scan_req->owner_nlportid = info->snd_portid;
9913
9914 cfg80211_add_sched_scan_req(rdev, sched_scan_req);
9915
9916 nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
9917 return 0;
9918
9919 out_free:
9920 kfree(sched_scan_req);
9921 out_err:
9922 return err;
9923 }
9924
nl80211_stop_sched_scan(struct sk_buff * skb,struct genl_info * info)9925 static int nl80211_stop_sched_scan(struct sk_buff *skb,
9926 struct genl_info *info)
9927 {
9928 struct cfg80211_sched_scan_request *req;
9929 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9930 u64 cookie;
9931
9932 if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
9933 return -EOPNOTSUPP;
9934
9935 if (info->attrs[NL80211_ATTR_COOKIE]) {
9936 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
9937 return __cfg80211_stop_sched_scan(rdev, cookie, false);
9938 }
9939
9940 req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
9941 struct cfg80211_sched_scan_request,
9942 list);
9943 if (!req || req->reqid ||
9944 (req->owner_nlportid &&
9945 req->owner_nlportid != info->snd_portid))
9946 return -ENOENT;
9947
9948 return cfg80211_stop_sched_scan_req(rdev, req, false);
9949 }
9950
nl80211_start_radar_detection(struct sk_buff * skb,struct genl_info * info)9951 static int nl80211_start_radar_detection(struct sk_buff *skb,
9952 struct genl_info *info)
9953 {
9954 struct cfg80211_registered_device *rdev = info->user_ptr[0];
9955 struct net_device *dev = info->user_ptr[1];
9956 struct wireless_dev *wdev = dev->ieee80211_ptr;
9957 struct wiphy *wiphy = wdev->wiphy;
9958 struct cfg80211_chan_def chandef;
9959 enum nl80211_dfs_regions dfs_region;
9960 unsigned int cac_time_ms;
9961 int err = -EINVAL;
9962
9963 flush_delayed_work(&rdev->dfs_update_channels_wk);
9964
9965 wiphy_lock(wiphy);
9966
9967 dfs_region = reg_get_dfs_region(wiphy);
9968 if (dfs_region == NL80211_DFS_UNSET)
9969 goto unlock;
9970
9971 err = nl80211_parse_chandef(rdev, info, &chandef);
9972 if (err)
9973 goto unlock;
9974
9975 err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
9976 if (err < 0)
9977 goto unlock;
9978
9979 if (err == 0) {
9980 err = -EINVAL;
9981 goto unlock;
9982 }
9983
9984 if (!cfg80211_chandef_dfs_usable(wiphy, &chandef)) {
9985 err = -EINVAL;
9986 goto unlock;
9987 }
9988
9989 if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_BACKGROUND])) {
9990 err = cfg80211_start_background_radar_detection(rdev, wdev,
9991 &chandef);
9992 goto unlock;
9993 }
9994
9995 if (netif_carrier_ok(dev)) {
9996 err = -EBUSY;
9997 goto unlock;
9998 }
9999
10000 if (wdev->cac_started) {
10001 err = -EBUSY;
10002 goto unlock;
10003 }
10004
10005 /* CAC start is offloaded to HW and can't be started manually */
10006 if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD)) {
10007 err = -EOPNOTSUPP;
10008 goto unlock;
10009 }
10010
10011 if (!rdev->ops->start_radar_detection) {
10012 err = -EOPNOTSUPP;
10013 goto unlock;
10014 }
10015
10016 cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
10017 if (WARN_ON(!cac_time_ms))
10018 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
10019
10020 err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
10021 if (!err) {
10022 wdev->links[0].ap.chandef = chandef;
10023 wdev->cac_started = true;
10024 wdev->cac_start_time = jiffies;
10025 wdev->cac_time_ms = cac_time_ms;
10026 }
10027 unlock:
10028 wiphy_unlock(wiphy);
10029
10030 return err;
10031 }
10032
nl80211_notify_radar_detection(struct sk_buff * skb,struct genl_info * info)10033 static int nl80211_notify_radar_detection(struct sk_buff *skb,
10034 struct genl_info *info)
10035 {
10036 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10037 struct net_device *dev = info->user_ptr[1];
10038 struct wireless_dev *wdev = dev->ieee80211_ptr;
10039 struct wiphy *wiphy = wdev->wiphy;
10040 struct cfg80211_chan_def chandef;
10041 enum nl80211_dfs_regions dfs_region;
10042 int err;
10043
10044 dfs_region = reg_get_dfs_region(wiphy);
10045 if (dfs_region == NL80211_DFS_UNSET) {
10046 GENL_SET_ERR_MSG(info,
10047 "DFS Region is not set. Unexpected Radar indication");
10048 return -EINVAL;
10049 }
10050
10051 err = nl80211_parse_chandef(rdev, info, &chandef);
10052 if (err) {
10053 GENL_SET_ERR_MSG(info, "Unable to extract chandef info");
10054 return err;
10055 }
10056
10057 err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
10058 if (err < 0) {
10059 GENL_SET_ERR_MSG(info, "chandef is invalid");
10060 return err;
10061 }
10062
10063 if (err == 0) {
10064 GENL_SET_ERR_MSG(info,
10065 "Unexpected Radar indication for chandef/iftype");
10066 return -EINVAL;
10067 }
10068
10069 /* Do not process this notification if radar is already detected
10070 * by kernel on this channel, and return success.
10071 */
10072 if (chandef.chan->dfs_state == NL80211_DFS_UNAVAILABLE)
10073 return 0;
10074
10075 cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_UNAVAILABLE);
10076
10077 cfg80211_sched_dfs_chan_update(rdev);
10078
10079 rdev->radar_chandef = chandef;
10080
10081 /* Propagate this notification to other radios as well */
10082 queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
10083
10084 return 0;
10085 }
10086
nl80211_channel_switch(struct sk_buff * skb,struct genl_info * info)10087 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
10088 {
10089 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10090 unsigned int link_id = nl80211_link_id(info->attrs);
10091 struct net_device *dev = info->user_ptr[1];
10092 struct wireless_dev *wdev = dev->ieee80211_ptr;
10093 struct cfg80211_csa_settings params;
10094 struct nlattr **csa_attrs = NULL;
10095 int err;
10096 bool need_new_beacon = false;
10097 bool need_handle_dfs_flag = true;
10098 int len, i;
10099 u32 cs_count;
10100
10101 if (!rdev->ops->channel_switch ||
10102 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
10103 return -EOPNOTSUPP;
10104
10105 switch (dev->ieee80211_ptr->iftype) {
10106 case NL80211_IFTYPE_AP:
10107 case NL80211_IFTYPE_P2P_GO:
10108 need_new_beacon = true;
10109 /* For all modes except AP the handle_dfs flag needs to be
10110 * supplied to tell the kernel that userspace will handle radar
10111 * events when they happen. Otherwise a switch to a channel
10112 * requiring DFS will be rejected.
10113 */
10114 need_handle_dfs_flag = false;
10115
10116 /* useless if AP is not running */
10117 if (!wdev->links[link_id].ap.beacon_interval)
10118 return -ENOTCONN;
10119 break;
10120 case NL80211_IFTYPE_ADHOC:
10121 if (!wdev->u.ibss.ssid_len)
10122 return -ENOTCONN;
10123 break;
10124 case NL80211_IFTYPE_MESH_POINT:
10125 if (!wdev->u.mesh.id_len)
10126 return -ENOTCONN;
10127 break;
10128 default:
10129 return -EOPNOTSUPP;
10130 }
10131
10132 memset(¶ms, 0, sizeof(params));
10133 params.beacon_csa.ftm_responder = -1;
10134
10135 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
10136 !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
10137 return -EINVAL;
10138
10139 /* only important for AP, IBSS and mesh create IEs internally */
10140 if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
10141 return -EINVAL;
10142
10143 /* Even though the attribute is u32, the specification says
10144 * u8, so let's make sure we don't overflow.
10145 */
10146 cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
10147 if (cs_count > 255)
10148 return -EINVAL;
10149
10150 params.count = cs_count;
10151
10152 if (!need_new_beacon)
10153 goto skip_beacons;
10154
10155 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms.beacon_after,
10156 info->extack);
10157 if (err)
10158 goto free;
10159
10160 csa_attrs = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*csa_attrs),
10161 GFP_KERNEL);
10162 if (!csa_attrs) {
10163 err = -ENOMEM;
10164 goto free;
10165 }
10166
10167 err = nla_parse_nested_deprecated(csa_attrs, NL80211_ATTR_MAX,
10168 info->attrs[NL80211_ATTR_CSA_IES],
10169 nl80211_policy, info->extack);
10170 if (err)
10171 goto free;
10172
10173 err = nl80211_parse_beacon(rdev, csa_attrs, ¶ms.beacon_csa,
10174 info->extack);
10175 if (err)
10176 goto free;
10177
10178 if (!csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
10179 err = -EINVAL;
10180 goto free;
10181 }
10182
10183 len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
10184 if (!len || (len % sizeof(u16))) {
10185 err = -EINVAL;
10186 goto free;
10187 }
10188
10189 params.n_counter_offsets_beacon = len / sizeof(u16);
10190 if (rdev->wiphy.max_num_csa_counters &&
10191 (params.n_counter_offsets_beacon >
10192 rdev->wiphy.max_num_csa_counters)) {
10193 err = -EINVAL;
10194 goto free;
10195 }
10196
10197 params.counter_offsets_beacon =
10198 nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
10199
10200 /* sanity checks - counters should fit and be the same */
10201 for (i = 0; i < params.n_counter_offsets_beacon; i++) {
10202 u16 offset = params.counter_offsets_beacon[i];
10203
10204 if (offset >= params.beacon_csa.tail_len) {
10205 err = -EINVAL;
10206 goto free;
10207 }
10208
10209 if (params.beacon_csa.tail[offset] != params.count) {
10210 err = -EINVAL;
10211 goto free;
10212 }
10213 }
10214
10215 if (csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]) {
10216 len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
10217 if (!len || (len % sizeof(u16))) {
10218 err = -EINVAL;
10219 goto free;
10220 }
10221
10222 params.n_counter_offsets_presp = len / sizeof(u16);
10223 if (rdev->wiphy.max_num_csa_counters &&
10224 (params.n_counter_offsets_presp >
10225 rdev->wiphy.max_num_csa_counters)) {
10226 err = -EINVAL;
10227 goto free;
10228 }
10229
10230 params.counter_offsets_presp =
10231 nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
10232
10233 /* sanity checks - counters should fit and be the same */
10234 for (i = 0; i < params.n_counter_offsets_presp; i++) {
10235 u16 offset = params.counter_offsets_presp[i];
10236
10237 if (offset >= params.beacon_csa.probe_resp_len) {
10238 err = -EINVAL;
10239 goto free;
10240 }
10241
10242 if (params.beacon_csa.probe_resp[offset] !=
10243 params.count) {
10244 err = -EINVAL;
10245 goto free;
10246 }
10247 }
10248 }
10249
10250 skip_beacons:
10251 err = nl80211_parse_chandef(rdev, info, ¶ms.chandef);
10252 if (err)
10253 goto free;
10254
10255 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, ¶ms.chandef,
10256 wdev->iftype)) {
10257 err = -EINVAL;
10258 goto free;
10259 }
10260
10261 err = cfg80211_chandef_dfs_required(wdev->wiphy,
10262 ¶ms.chandef,
10263 wdev->iftype);
10264 if (err < 0)
10265 goto free;
10266
10267 if (err > 0) {
10268 params.radar_required = true;
10269 if (need_handle_dfs_flag &&
10270 !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
10271 err = -EINVAL;
10272 goto free;
10273 }
10274 }
10275
10276 if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
10277 params.block_tx = true;
10278
10279 if (info->attrs[NL80211_ATTR_PUNCT_BITMAP]) {
10280 err = nl80211_parse_punct_bitmap(rdev, info,
10281 ¶ms.chandef,
10282 ¶ms.punct_bitmap);
10283 if (err)
10284 goto free;
10285 }
10286
10287 wdev_lock(wdev);
10288 err = rdev_channel_switch(rdev, dev, ¶ms);
10289 wdev_unlock(wdev);
10290
10291 free:
10292 kfree(params.beacon_after.mbssid_ies);
10293 kfree(params.beacon_csa.mbssid_ies);
10294 kfree(params.beacon_after.rnr_ies);
10295 kfree(params.beacon_csa.rnr_ies);
10296 kfree(csa_attrs);
10297 return err;
10298 }
10299
nl80211_send_bss(struct sk_buff * msg,struct netlink_callback * cb,u32 seq,int flags,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,struct cfg80211_internal_bss * intbss)10300 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
10301 u32 seq, int flags,
10302 struct cfg80211_registered_device *rdev,
10303 struct wireless_dev *wdev,
10304 struct cfg80211_internal_bss *intbss)
10305 {
10306 struct cfg80211_bss *res = &intbss->pub;
10307 const struct cfg80211_bss_ies *ies;
10308 unsigned int link_id;
10309 void *hdr;
10310 struct nlattr *bss;
10311
10312 ASSERT_WDEV_LOCK(wdev);
10313
10314 hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
10315 NL80211_CMD_NEW_SCAN_RESULTS);
10316 if (!hdr)
10317 return -1;
10318
10319 genl_dump_check_consistent(cb, hdr);
10320
10321 if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
10322 goto nla_put_failure;
10323 if (wdev->netdev &&
10324 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
10325 goto nla_put_failure;
10326 if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
10327 NL80211_ATTR_PAD))
10328 goto nla_put_failure;
10329
10330 bss = nla_nest_start_noflag(msg, NL80211_ATTR_BSS);
10331 if (!bss)
10332 goto nla_put_failure;
10333 if ((!is_zero_ether_addr(res->bssid) &&
10334 nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
10335 goto nla_put_failure;
10336
10337 rcu_read_lock();
10338 /* indicate whether we have probe response data or not */
10339 if (rcu_access_pointer(res->proberesp_ies) &&
10340 nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
10341 goto fail_unlock_rcu;
10342
10343 /* this pointer prefers to be pointed to probe response data
10344 * but is always valid
10345 */
10346 ies = rcu_dereference(res->ies);
10347 if (ies) {
10348 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
10349 NL80211_BSS_PAD))
10350 goto fail_unlock_rcu;
10351 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
10352 ies->len, ies->data))
10353 goto fail_unlock_rcu;
10354 }
10355
10356 /* and this pointer is always (unless driver didn't know) beacon data */
10357 ies = rcu_dereference(res->beacon_ies);
10358 if (ies && ies->from_beacon) {
10359 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
10360 NL80211_BSS_PAD))
10361 goto fail_unlock_rcu;
10362 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
10363 ies->len, ies->data))
10364 goto fail_unlock_rcu;
10365 }
10366 rcu_read_unlock();
10367
10368 if (res->beacon_interval &&
10369 nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
10370 goto nla_put_failure;
10371 if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
10372 nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
10373 nla_put_u32(msg, NL80211_BSS_FREQUENCY_OFFSET,
10374 res->channel->freq_offset) ||
10375 nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
10376 nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
10377 jiffies_to_msecs(jiffies - intbss->ts)))
10378 goto nla_put_failure;
10379
10380 if (intbss->parent_tsf &&
10381 (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
10382 intbss->parent_tsf, NL80211_BSS_PAD) ||
10383 nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
10384 intbss->parent_bssid)))
10385 goto nla_put_failure;
10386
10387 if (intbss->ts_boottime &&
10388 nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
10389 intbss->ts_boottime, NL80211_BSS_PAD))
10390 goto nla_put_failure;
10391
10392 if (!nl80211_put_signal(msg, intbss->pub.chains,
10393 intbss->pub.chain_signal,
10394 NL80211_BSS_CHAIN_SIGNAL))
10395 goto nla_put_failure;
10396
10397 switch (rdev->wiphy.signal_type) {
10398 case CFG80211_SIGNAL_TYPE_MBM:
10399 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
10400 goto nla_put_failure;
10401 break;
10402 case CFG80211_SIGNAL_TYPE_UNSPEC:
10403 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
10404 goto nla_put_failure;
10405 break;
10406 default:
10407 break;
10408 }
10409
10410 switch (wdev->iftype) {
10411 case NL80211_IFTYPE_P2P_CLIENT:
10412 case NL80211_IFTYPE_STATION:
10413 for_each_valid_link(wdev, link_id) {
10414 if (intbss == wdev->links[link_id].client.current_bss &&
10415 (nla_put_u32(msg, NL80211_BSS_STATUS,
10416 NL80211_BSS_STATUS_ASSOCIATED) ||
10417 (wdev->valid_links &&
10418 (nla_put_u8(msg, NL80211_BSS_MLO_LINK_ID,
10419 link_id) ||
10420 nla_put(msg, NL80211_BSS_MLD_ADDR, ETH_ALEN,
10421 wdev->u.client.connected_addr)))))
10422 goto nla_put_failure;
10423 }
10424 break;
10425 case NL80211_IFTYPE_ADHOC:
10426 if (intbss == wdev->u.ibss.current_bss &&
10427 nla_put_u32(msg, NL80211_BSS_STATUS,
10428 NL80211_BSS_STATUS_IBSS_JOINED))
10429 goto nla_put_failure;
10430 break;
10431 default:
10432 break;
10433 }
10434
10435 nla_nest_end(msg, bss);
10436
10437 genlmsg_end(msg, hdr);
10438 return 0;
10439
10440 fail_unlock_rcu:
10441 rcu_read_unlock();
10442 nla_put_failure:
10443 genlmsg_cancel(msg, hdr);
10444 return -EMSGSIZE;
10445 }
10446
nl80211_dump_scan(struct sk_buff * skb,struct netlink_callback * cb)10447 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
10448 {
10449 struct cfg80211_registered_device *rdev;
10450 struct cfg80211_internal_bss *scan;
10451 struct wireless_dev *wdev;
10452 int start = cb->args[2], idx = 0;
10453 int err;
10454
10455 err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
10456 if (err)
10457 return err;
10458 /* nl80211_prepare_wdev_dump acquired it in the successful case */
10459 __acquire(&rdev->wiphy.mtx);
10460
10461 wdev_lock(wdev);
10462 spin_lock_bh(&rdev->bss_lock);
10463
10464 /*
10465 * dump_scan will be called multiple times to break up the scan results
10466 * into multiple messages. It is unlikely that any more bss-es will be
10467 * expired after the first call, so only call only call this on the
10468 * first dump_scan invocation.
10469 */
10470 if (start == 0)
10471 cfg80211_bss_expire(rdev);
10472
10473 cb->seq = rdev->bss_generation;
10474
10475 list_for_each_entry(scan, &rdev->bss_list, list) {
10476 if (++idx <= start)
10477 continue;
10478 if (nl80211_send_bss(skb, cb,
10479 cb->nlh->nlmsg_seq, NLM_F_MULTI,
10480 rdev, wdev, scan) < 0) {
10481 idx--;
10482 break;
10483 }
10484 }
10485
10486 spin_unlock_bh(&rdev->bss_lock);
10487 wdev_unlock(wdev);
10488
10489 cb->args[2] = idx;
10490 wiphy_unlock(&rdev->wiphy);
10491
10492 return skb->len;
10493 }
10494
nl80211_send_survey(struct sk_buff * msg,u32 portid,u32 seq,int flags,struct net_device * dev,bool allow_radio_stats,struct survey_info * survey)10495 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
10496 int flags, struct net_device *dev,
10497 bool allow_radio_stats,
10498 struct survey_info *survey)
10499 {
10500 void *hdr;
10501 struct nlattr *infoattr;
10502
10503 /* skip radio stats if userspace didn't request them */
10504 if (!survey->channel && !allow_radio_stats)
10505 return 0;
10506
10507 hdr = nl80211hdr_put(msg, portid, seq, flags,
10508 NL80211_CMD_NEW_SURVEY_RESULTS);
10509 if (!hdr)
10510 return -ENOMEM;
10511
10512 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
10513 goto nla_put_failure;
10514
10515 infoattr = nla_nest_start_noflag(msg, NL80211_ATTR_SURVEY_INFO);
10516 if (!infoattr)
10517 goto nla_put_failure;
10518
10519 if (survey->channel &&
10520 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
10521 survey->channel->center_freq))
10522 goto nla_put_failure;
10523
10524 if (survey->channel && survey->channel->freq_offset &&
10525 nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY_OFFSET,
10526 survey->channel->freq_offset))
10527 goto nla_put_failure;
10528
10529 if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
10530 nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
10531 goto nla_put_failure;
10532 if ((survey->filled & SURVEY_INFO_IN_USE) &&
10533 nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
10534 goto nla_put_failure;
10535 if ((survey->filled & SURVEY_INFO_TIME) &&
10536 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
10537 survey->time, NL80211_SURVEY_INFO_PAD))
10538 goto nla_put_failure;
10539 if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
10540 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
10541 survey->time_busy, NL80211_SURVEY_INFO_PAD))
10542 goto nla_put_failure;
10543 if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
10544 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
10545 survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
10546 goto nla_put_failure;
10547 if ((survey->filled & SURVEY_INFO_TIME_RX) &&
10548 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
10549 survey->time_rx, NL80211_SURVEY_INFO_PAD))
10550 goto nla_put_failure;
10551 if ((survey->filled & SURVEY_INFO_TIME_TX) &&
10552 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
10553 survey->time_tx, NL80211_SURVEY_INFO_PAD))
10554 goto nla_put_failure;
10555 if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
10556 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
10557 survey->time_scan, NL80211_SURVEY_INFO_PAD))
10558 goto nla_put_failure;
10559 if ((survey->filled & SURVEY_INFO_TIME_BSS_RX) &&
10560 nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BSS_RX,
10561 survey->time_bss_rx, NL80211_SURVEY_INFO_PAD))
10562 goto nla_put_failure;
10563
10564 nla_nest_end(msg, infoattr);
10565
10566 genlmsg_end(msg, hdr);
10567 return 0;
10568
10569 nla_put_failure:
10570 genlmsg_cancel(msg, hdr);
10571 return -EMSGSIZE;
10572 }
10573
nl80211_dump_survey(struct sk_buff * skb,struct netlink_callback * cb)10574 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
10575 {
10576 struct nlattr **attrbuf;
10577 struct survey_info survey;
10578 struct cfg80211_registered_device *rdev;
10579 struct wireless_dev *wdev;
10580 int survey_idx = cb->args[2];
10581 int res;
10582 bool radio_stats;
10583
10584 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
10585 if (!attrbuf)
10586 return -ENOMEM;
10587
10588 res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, attrbuf);
10589 if (res) {
10590 kfree(attrbuf);
10591 return res;
10592 }
10593 /* nl80211_prepare_wdev_dump acquired it in the successful case */
10594 __acquire(&rdev->wiphy.mtx);
10595
10596 /* prepare_wdev_dump parsed the attributes */
10597 radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
10598
10599 if (!wdev->netdev) {
10600 res = -EINVAL;
10601 goto out_err;
10602 }
10603
10604 if (!rdev->ops->dump_survey) {
10605 res = -EOPNOTSUPP;
10606 goto out_err;
10607 }
10608
10609 while (1) {
10610 wdev_lock(wdev);
10611 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
10612 wdev_unlock(wdev);
10613 if (res == -ENOENT)
10614 break;
10615 if (res)
10616 goto out_err;
10617
10618 /* don't send disabled channels, but do send non-channel data */
10619 if (survey.channel &&
10620 survey.channel->flags & IEEE80211_CHAN_DISABLED) {
10621 survey_idx++;
10622 continue;
10623 }
10624
10625 if (nl80211_send_survey(skb,
10626 NETLINK_CB(cb->skb).portid,
10627 cb->nlh->nlmsg_seq, NLM_F_MULTI,
10628 wdev->netdev, radio_stats, &survey) < 0)
10629 goto out;
10630 survey_idx++;
10631 }
10632
10633 out:
10634 cb->args[2] = survey_idx;
10635 res = skb->len;
10636 out_err:
10637 kfree(attrbuf);
10638 wiphy_unlock(&rdev->wiphy);
10639 return res;
10640 }
10641
nl80211_valid_wpa_versions(u32 wpa_versions)10642 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
10643 {
10644 return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
10645 NL80211_WPA_VERSION_2 |
10646 NL80211_WPA_VERSION_3));
10647 }
10648
nl80211_authenticate(struct sk_buff * skb,struct genl_info * info)10649 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
10650 {
10651 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10652 struct net_device *dev = info->user_ptr[1];
10653 struct ieee80211_channel *chan;
10654 const u8 *bssid, *ssid;
10655 int err, ssid_len;
10656 enum nl80211_auth_type auth_type;
10657 struct key_parse key;
10658 bool local_state_change;
10659 struct cfg80211_auth_request req = {};
10660 u32 freq;
10661
10662 if (!info->attrs[NL80211_ATTR_MAC])
10663 return -EINVAL;
10664
10665 if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
10666 return -EINVAL;
10667
10668 if (!info->attrs[NL80211_ATTR_SSID])
10669 return -EINVAL;
10670
10671 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
10672 return -EINVAL;
10673
10674 err = nl80211_parse_key(info, &key);
10675 if (err)
10676 return err;
10677
10678 if (key.idx >= 0) {
10679 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
10680 return -EINVAL;
10681 if (!key.p.key || !key.p.key_len)
10682 return -EINVAL;
10683 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
10684 key.p.key_len != WLAN_KEY_LEN_WEP40) &&
10685 (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
10686 key.p.key_len != WLAN_KEY_LEN_WEP104))
10687 return -EINVAL;
10688 if (key.idx > 3)
10689 return -EINVAL;
10690 } else {
10691 key.p.key_len = 0;
10692 key.p.key = NULL;
10693 }
10694
10695 if (key.idx >= 0) {
10696 int i;
10697 bool ok = false;
10698
10699 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
10700 if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
10701 ok = true;
10702 break;
10703 }
10704 }
10705 if (!ok)
10706 return -EINVAL;
10707 }
10708
10709 if (!rdev->ops->auth)
10710 return -EOPNOTSUPP;
10711
10712 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10713 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10714 return -EOPNOTSUPP;
10715
10716 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10717 freq = MHZ_TO_KHZ(nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
10718 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
10719 freq +=
10720 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
10721
10722 chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
10723 if (!chan)
10724 return -EINVAL;
10725
10726 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10727 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10728
10729 if (info->attrs[NL80211_ATTR_IE]) {
10730 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10731 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10732 }
10733
10734 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
10735 if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
10736 return -EINVAL;
10737
10738 if ((auth_type == NL80211_AUTHTYPE_SAE ||
10739 auth_type == NL80211_AUTHTYPE_FILS_SK ||
10740 auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
10741 auth_type == NL80211_AUTHTYPE_FILS_PK) &&
10742 !info->attrs[NL80211_ATTR_AUTH_DATA])
10743 return -EINVAL;
10744
10745 if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
10746 if (auth_type != NL80211_AUTHTYPE_SAE &&
10747 auth_type != NL80211_AUTHTYPE_FILS_SK &&
10748 auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
10749 auth_type != NL80211_AUTHTYPE_FILS_PK)
10750 return -EINVAL;
10751 req.auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
10752 req.auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
10753 }
10754
10755 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
10756
10757 /*
10758 * Since we no longer track auth state, ignore
10759 * requests to only change local state.
10760 */
10761 if (local_state_change)
10762 return 0;
10763
10764 req.auth_type = auth_type;
10765 req.key = key.p.key;
10766 req.key_len = key.p.key_len;
10767 req.key_idx = key.idx;
10768 req.link_id = nl80211_link_id_or_invalid(info->attrs);
10769 if (req.link_id >= 0) {
10770 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO))
10771 return -EINVAL;
10772 if (!info->attrs[NL80211_ATTR_MLD_ADDR])
10773 return -EINVAL;
10774 req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
10775 if (!is_valid_ether_addr(req.ap_mld_addr))
10776 return -EINVAL;
10777 }
10778
10779 req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
10780 IEEE80211_BSS_TYPE_ESS,
10781 IEEE80211_PRIVACY_ANY);
10782 if (!req.bss)
10783 return -ENOENT;
10784
10785 wdev_lock(dev->ieee80211_ptr);
10786 err = cfg80211_mlme_auth(rdev, dev, &req);
10787 wdev_unlock(dev->ieee80211_ptr);
10788
10789 cfg80211_put_bss(&rdev->wiphy, req.bss);
10790
10791 return err;
10792 }
10793
validate_pae_over_nl80211(struct cfg80211_registered_device * rdev,struct genl_info * info)10794 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev,
10795 struct genl_info *info)
10796 {
10797 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
10798 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set");
10799 return -EINVAL;
10800 }
10801
10802 if (!rdev->ops->tx_control_port ||
10803 !wiphy_ext_feature_isset(&rdev->wiphy,
10804 NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
10805 return -EOPNOTSUPP;
10806
10807 return 0;
10808 }
10809
nl80211_crypto_settings(struct cfg80211_registered_device * rdev,struct genl_info * info,struct cfg80211_crypto_settings * settings,int cipher_limit)10810 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
10811 struct genl_info *info,
10812 struct cfg80211_crypto_settings *settings,
10813 int cipher_limit)
10814 {
10815 memset(settings, 0, sizeof(*settings));
10816
10817 settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
10818
10819 if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
10820 u16 proto;
10821
10822 proto = nla_get_u16(
10823 info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
10824 settings->control_port_ethertype = cpu_to_be16(proto);
10825 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
10826 proto != ETH_P_PAE)
10827 return -EINVAL;
10828 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
10829 settings->control_port_no_encrypt = true;
10830 } else
10831 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
10832
10833 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
10834 int r = validate_pae_over_nl80211(rdev, info);
10835
10836 if (r < 0)
10837 return r;
10838
10839 settings->control_port_over_nl80211 = true;
10840
10841 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_PREAUTH])
10842 settings->control_port_no_preauth = true;
10843 }
10844
10845 if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
10846 void *data;
10847 int len, i;
10848
10849 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
10850 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
10851 settings->n_ciphers_pairwise = len / sizeof(u32);
10852
10853 if (len % sizeof(u32))
10854 return -EINVAL;
10855
10856 if (settings->n_ciphers_pairwise > cipher_limit)
10857 return -EINVAL;
10858
10859 memcpy(settings->ciphers_pairwise, data, len);
10860
10861 for (i = 0; i < settings->n_ciphers_pairwise; i++)
10862 if (!cfg80211_supported_cipher_suite(
10863 &rdev->wiphy,
10864 settings->ciphers_pairwise[i]))
10865 return -EINVAL;
10866 }
10867
10868 if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
10869 settings->cipher_group =
10870 nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
10871 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
10872 settings->cipher_group))
10873 return -EINVAL;
10874 }
10875
10876 if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
10877 settings->wpa_versions =
10878 nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
10879 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
10880 return -EINVAL;
10881 }
10882
10883 if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
10884 void *data;
10885 int len;
10886
10887 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
10888 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
10889 settings->n_akm_suites = len / sizeof(u32);
10890
10891 if (len % sizeof(u32))
10892 return -EINVAL;
10893
10894 if (settings->n_akm_suites > rdev->wiphy.max_num_akm_suites)
10895 return -EINVAL;
10896
10897 memcpy(settings->akm_suites, data, len);
10898 }
10899
10900 if (info->attrs[NL80211_ATTR_PMK]) {
10901 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
10902 return -EINVAL;
10903 if (!wiphy_ext_feature_isset(&rdev->wiphy,
10904 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK) &&
10905 !wiphy_ext_feature_isset(&rdev->wiphy,
10906 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK))
10907 return -EINVAL;
10908 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
10909 }
10910
10911 if (info->attrs[NL80211_ATTR_SAE_PASSWORD]) {
10912 if (!wiphy_ext_feature_isset(&rdev->wiphy,
10913 NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
10914 !wiphy_ext_feature_isset(&rdev->wiphy,
10915 NL80211_EXT_FEATURE_SAE_OFFLOAD_AP))
10916 return -EINVAL;
10917 settings->sae_pwd =
10918 nla_data(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
10919 settings->sae_pwd_len =
10920 nla_len(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
10921 }
10922
10923 if (info->attrs[NL80211_ATTR_SAE_PWE])
10924 settings->sae_pwe =
10925 nla_get_u8(info->attrs[NL80211_ATTR_SAE_PWE]);
10926 else
10927 settings->sae_pwe = NL80211_SAE_PWE_UNSPECIFIED;
10928
10929 return 0;
10930 }
10931
nl80211_assoc_bss(struct cfg80211_registered_device * rdev,const u8 * ssid,int ssid_len,struct nlattr ** attrs)10932 static struct cfg80211_bss *nl80211_assoc_bss(struct cfg80211_registered_device *rdev,
10933 const u8 *ssid, int ssid_len,
10934 struct nlattr **attrs)
10935 {
10936 struct ieee80211_channel *chan;
10937 struct cfg80211_bss *bss;
10938 const u8 *bssid;
10939 u32 freq;
10940
10941 if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_WIPHY_FREQ])
10942 return ERR_PTR(-EINVAL);
10943
10944 bssid = nla_data(attrs[NL80211_ATTR_MAC]);
10945
10946 freq = MHZ_TO_KHZ(nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ]));
10947 if (attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
10948 freq += nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
10949
10950 chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
10951 if (!chan)
10952 return ERR_PTR(-EINVAL);
10953
10954 bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid,
10955 ssid, ssid_len,
10956 IEEE80211_BSS_TYPE_ESS,
10957 IEEE80211_PRIVACY_ANY);
10958 if (!bss)
10959 return ERR_PTR(-ENOENT);
10960
10961 return bss;
10962 }
10963
nl80211_associate(struct sk_buff * skb,struct genl_info * info)10964 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
10965 {
10966 struct cfg80211_registered_device *rdev = info->user_ptr[0];
10967 struct net_device *dev = info->user_ptr[1];
10968 struct cfg80211_assoc_request req = {};
10969 struct nlattr **attrs = NULL;
10970 const u8 *ap_addr, *ssid;
10971 unsigned int link_id;
10972 int err, ssid_len;
10973
10974 if (dev->ieee80211_ptr->conn_owner_nlportid &&
10975 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
10976 return -EPERM;
10977
10978 if (!info->attrs[NL80211_ATTR_SSID])
10979 return -EINVAL;
10980
10981 if (!rdev->ops->assoc)
10982 return -EOPNOTSUPP;
10983
10984 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10985 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10986 return -EOPNOTSUPP;
10987
10988 ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10989 ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10990
10991 if (info->attrs[NL80211_ATTR_IE]) {
10992 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10993 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10994
10995 if (cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
10996 req.ie, req.ie_len)) {
10997 GENL_SET_ERR_MSG(info,
10998 "non-inheritance makes no sense");
10999 return -EINVAL;
11000 }
11001 }
11002
11003 if (info->attrs[NL80211_ATTR_USE_MFP]) {
11004 enum nl80211_mfp mfp =
11005 nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
11006 if (mfp == NL80211_MFP_REQUIRED)
11007 req.use_mfp = true;
11008 else if (mfp != NL80211_MFP_NO)
11009 return -EINVAL;
11010 }
11011
11012 if (info->attrs[NL80211_ATTR_PREV_BSSID])
11013 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
11014
11015 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
11016 req.flags |= ASSOC_REQ_DISABLE_HT;
11017
11018 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11019 memcpy(&req.ht_capa_mask,
11020 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
11021 sizeof(req.ht_capa_mask));
11022
11023 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
11024 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11025 return -EINVAL;
11026 memcpy(&req.ht_capa,
11027 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
11028 sizeof(req.ht_capa));
11029 }
11030
11031 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
11032 req.flags |= ASSOC_REQ_DISABLE_VHT;
11033
11034 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
11035 req.flags |= ASSOC_REQ_DISABLE_HE;
11036
11037 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT]))
11038 req.flags |= ASSOC_REQ_DISABLE_EHT;
11039
11040 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
11041 memcpy(&req.vht_capa_mask,
11042 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
11043 sizeof(req.vht_capa_mask));
11044
11045 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
11046 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
11047 return -EINVAL;
11048 memcpy(&req.vht_capa,
11049 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
11050 sizeof(req.vht_capa));
11051 }
11052
11053 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
11054 if (!((rdev->wiphy.features &
11055 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
11056 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
11057 !wiphy_ext_feature_isset(&rdev->wiphy,
11058 NL80211_EXT_FEATURE_RRM))
11059 return -EINVAL;
11060 req.flags |= ASSOC_REQ_USE_RRM;
11061 }
11062
11063 if (info->attrs[NL80211_ATTR_FILS_KEK]) {
11064 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
11065 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
11066 if (!info->attrs[NL80211_ATTR_FILS_NONCES])
11067 return -EINVAL;
11068 req.fils_nonces =
11069 nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
11070 }
11071
11072 if (info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]) {
11073 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY])
11074 return -EINVAL;
11075 memcpy(&req.s1g_capa_mask,
11076 nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]),
11077 sizeof(req.s1g_capa_mask));
11078 }
11079
11080 if (info->attrs[NL80211_ATTR_S1G_CAPABILITY]) {
11081 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK])
11082 return -EINVAL;
11083 memcpy(&req.s1g_capa,
11084 nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY]),
11085 sizeof(req.s1g_capa));
11086 }
11087
11088 req.link_id = nl80211_link_id_or_invalid(info->attrs);
11089
11090 if (info->attrs[NL80211_ATTR_MLO_LINKS]) {
11091 unsigned int attrsize = NUM_NL80211_ATTR * sizeof(*attrs);
11092 struct nlattr *link;
11093 int rem = 0;
11094
11095 if (req.link_id < 0)
11096 return -EINVAL;
11097
11098 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO))
11099 return -EINVAL;
11100
11101 if (info->attrs[NL80211_ATTR_MAC] ||
11102 info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
11103 !info->attrs[NL80211_ATTR_MLD_ADDR])
11104 return -EINVAL;
11105
11106 req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
11107 ap_addr = req.ap_mld_addr;
11108
11109 attrs = kzalloc(attrsize, GFP_KERNEL);
11110 if (!attrs)
11111 return -ENOMEM;
11112
11113 nla_for_each_nested(link,
11114 info->attrs[NL80211_ATTR_MLO_LINKS],
11115 rem) {
11116 memset(attrs, 0, attrsize);
11117
11118 nla_parse_nested(attrs, NL80211_ATTR_MAX,
11119 link, NULL, NULL);
11120
11121 if (!attrs[NL80211_ATTR_MLO_LINK_ID]) {
11122 err = -EINVAL;
11123 goto free;
11124 }
11125
11126 link_id = nla_get_u8(attrs[NL80211_ATTR_MLO_LINK_ID]);
11127 /* cannot use the same link ID again */
11128 if (req.links[link_id].bss) {
11129 err = -EINVAL;
11130 goto free;
11131 }
11132 req.links[link_id].bss =
11133 nl80211_assoc_bss(rdev, ssid, ssid_len, attrs);
11134 if (IS_ERR(req.links[link_id].bss)) {
11135 err = PTR_ERR(req.links[link_id].bss);
11136 req.links[link_id].bss = NULL;
11137 goto free;
11138 }
11139
11140 if (attrs[NL80211_ATTR_IE]) {
11141 req.links[link_id].elems =
11142 nla_data(attrs[NL80211_ATTR_IE]);
11143 req.links[link_id].elems_len =
11144 nla_len(attrs[NL80211_ATTR_IE]);
11145
11146 if (cfg80211_find_elem(WLAN_EID_FRAGMENT,
11147 req.links[link_id].elems,
11148 req.links[link_id].elems_len)) {
11149 GENL_SET_ERR_MSG(info,
11150 "cannot deal with fragmentation");
11151 err = -EINVAL;
11152 goto free;
11153 }
11154
11155 if (cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
11156 req.links[link_id].elems,
11157 req.links[link_id].elems_len)) {
11158 GENL_SET_ERR_MSG(info,
11159 "cannot deal with non-inheritance");
11160 err = -EINVAL;
11161 goto free;
11162 }
11163 }
11164
11165 req.links[link_id].disabled =
11166 nla_get_flag(attrs[NL80211_ATTR_MLO_LINK_DISABLED]);
11167 }
11168
11169 if (!req.links[req.link_id].bss) {
11170 err = -EINVAL;
11171 goto free;
11172 }
11173
11174 if (req.links[req.link_id].elems_len) {
11175 GENL_SET_ERR_MSG(info,
11176 "cannot have per-link elems on assoc link");
11177 err = -EINVAL;
11178 goto free;
11179 }
11180
11181 if (req.links[req.link_id].disabled) {
11182 GENL_SET_ERR_MSG(info,
11183 "cannot have assoc link disabled");
11184 err = -EINVAL;
11185 goto free;
11186 }
11187
11188 kfree(attrs);
11189 attrs = NULL;
11190 } else {
11191 if (req.link_id >= 0)
11192 return -EINVAL;
11193
11194 req.bss = nl80211_assoc_bss(rdev, ssid, ssid_len, info->attrs);
11195 if (IS_ERR(req.bss))
11196 return PTR_ERR(req.bss);
11197 ap_addr = req.bss->bssid;
11198 }
11199
11200 err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
11201 if (!err) {
11202 wdev_lock(dev->ieee80211_ptr);
11203
11204 err = cfg80211_mlme_assoc(rdev, dev, &req);
11205
11206 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
11207 dev->ieee80211_ptr->conn_owner_nlportid =
11208 info->snd_portid;
11209 memcpy(dev->ieee80211_ptr->disconnect_bssid,
11210 ap_addr, ETH_ALEN);
11211 }
11212
11213 wdev_unlock(dev->ieee80211_ptr);
11214 }
11215
11216 free:
11217 for (link_id = 0; link_id < ARRAY_SIZE(req.links); link_id++)
11218 cfg80211_put_bss(&rdev->wiphy, req.links[link_id].bss);
11219 cfg80211_put_bss(&rdev->wiphy, req.bss);
11220 kfree(attrs);
11221
11222 return err;
11223 }
11224
nl80211_deauthenticate(struct sk_buff * skb,struct genl_info * info)11225 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
11226 {
11227 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11228 struct net_device *dev = info->user_ptr[1];
11229 const u8 *ie = NULL, *bssid;
11230 int ie_len = 0, err;
11231 u16 reason_code;
11232 bool local_state_change;
11233
11234 if (dev->ieee80211_ptr->conn_owner_nlportid &&
11235 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
11236 return -EPERM;
11237
11238 if (!info->attrs[NL80211_ATTR_MAC])
11239 return -EINVAL;
11240
11241 if (!info->attrs[NL80211_ATTR_REASON_CODE])
11242 return -EINVAL;
11243
11244 if (!rdev->ops->deauth)
11245 return -EOPNOTSUPP;
11246
11247 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11248 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11249 return -EOPNOTSUPP;
11250
11251 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11252
11253 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
11254 if (reason_code == 0) {
11255 /* Reason Code 0 is reserved */
11256 return -EINVAL;
11257 }
11258
11259 if (info->attrs[NL80211_ATTR_IE]) {
11260 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11261 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11262 }
11263
11264 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
11265
11266 wdev_lock(dev->ieee80211_ptr);
11267 err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
11268 local_state_change);
11269 wdev_unlock(dev->ieee80211_ptr);
11270 return err;
11271 }
11272
nl80211_disassociate(struct sk_buff * skb,struct genl_info * info)11273 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
11274 {
11275 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11276 struct net_device *dev = info->user_ptr[1];
11277 const u8 *ie = NULL, *bssid;
11278 int ie_len = 0, err;
11279 u16 reason_code;
11280 bool local_state_change;
11281
11282 if (dev->ieee80211_ptr->conn_owner_nlportid &&
11283 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
11284 return -EPERM;
11285
11286 if (!info->attrs[NL80211_ATTR_MAC])
11287 return -EINVAL;
11288
11289 if (!info->attrs[NL80211_ATTR_REASON_CODE])
11290 return -EINVAL;
11291
11292 if (!rdev->ops->disassoc)
11293 return -EOPNOTSUPP;
11294
11295 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11296 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11297 return -EOPNOTSUPP;
11298
11299 bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11300
11301 reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
11302 if (reason_code == 0) {
11303 /* Reason Code 0 is reserved */
11304 return -EINVAL;
11305 }
11306
11307 if (info->attrs[NL80211_ATTR_IE]) {
11308 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11309 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11310 }
11311
11312 local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
11313
11314 wdev_lock(dev->ieee80211_ptr);
11315 err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
11316 local_state_change);
11317 wdev_unlock(dev->ieee80211_ptr);
11318 return err;
11319 }
11320
11321 static bool
nl80211_parse_mcast_rate(struct cfg80211_registered_device * rdev,int mcast_rate[NUM_NL80211_BANDS],int rateval)11322 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
11323 int mcast_rate[NUM_NL80211_BANDS],
11324 int rateval)
11325 {
11326 struct wiphy *wiphy = &rdev->wiphy;
11327 bool found = false;
11328 int band, i;
11329
11330 for (band = 0; band < NUM_NL80211_BANDS; band++) {
11331 struct ieee80211_supported_band *sband;
11332
11333 sband = wiphy->bands[band];
11334 if (!sband)
11335 continue;
11336
11337 for (i = 0; i < sband->n_bitrates; i++) {
11338 if (sband->bitrates[i].bitrate == rateval) {
11339 mcast_rate[band] = i + 1;
11340 found = true;
11341 break;
11342 }
11343 }
11344 }
11345
11346 return found;
11347 }
11348
nl80211_join_ibss(struct sk_buff * skb,struct genl_info * info)11349 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
11350 {
11351 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11352 struct net_device *dev = info->user_ptr[1];
11353 struct cfg80211_ibss_params ibss;
11354 struct wiphy *wiphy;
11355 struct cfg80211_cached_keys *connkeys = NULL;
11356 int err;
11357
11358 memset(&ibss, 0, sizeof(ibss));
11359
11360 if (!info->attrs[NL80211_ATTR_SSID] ||
11361 !nla_len(info->attrs[NL80211_ATTR_SSID]))
11362 return -EINVAL;
11363
11364 ibss.beacon_interval = 100;
11365
11366 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
11367 ibss.beacon_interval =
11368 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
11369
11370 err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
11371 ibss.beacon_interval);
11372 if (err)
11373 return err;
11374
11375 if (!rdev->ops->join_ibss)
11376 return -EOPNOTSUPP;
11377
11378 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
11379 return -EOPNOTSUPP;
11380
11381 wiphy = &rdev->wiphy;
11382
11383 if (info->attrs[NL80211_ATTR_MAC]) {
11384 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11385
11386 if (!is_valid_ether_addr(ibss.bssid))
11387 return -EINVAL;
11388 }
11389 ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
11390 ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
11391
11392 if (info->attrs[NL80211_ATTR_IE]) {
11393 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11394 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11395 }
11396
11397 err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
11398 if (err)
11399 return err;
11400
11401 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
11402 NL80211_IFTYPE_ADHOC))
11403 return -EINVAL;
11404
11405 switch (ibss.chandef.width) {
11406 case NL80211_CHAN_WIDTH_5:
11407 case NL80211_CHAN_WIDTH_10:
11408 case NL80211_CHAN_WIDTH_20_NOHT:
11409 break;
11410 case NL80211_CHAN_WIDTH_20:
11411 case NL80211_CHAN_WIDTH_40:
11412 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
11413 return -EINVAL;
11414 break;
11415 case NL80211_CHAN_WIDTH_80:
11416 case NL80211_CHAN_WIDTH_80P80:
11417 case NL80211_CHAN_WIDTH_160:
11418 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
11419 return -EINVAL;
11420 if (!wiphy_ext_feature_isset(&rdev->wiphy,
11421 NL80211_EXT_FEATURE_VHT_IBSS))
11422 return -EINVAL;
11423 break;
11424 case NL80211_CHAN_WIDTH_320:
11425 return -EINVAL;
11426 default:
11427 return -EINVAL;
11428 }
11429
11430 ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
11431 ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
11432
11433 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
11434 u8 *rates =
11435 nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
11436 int n_rates =
11437 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
11438 struct ieee80211_supported_band *sband =
11439 wiphy->bands[ibss.chandef.chan->band];
11440
11441 err = ieee80211_get_ratemask(sband, rates, n_rates,
11442 &ibss.basic_rates);
11443 if (err)
11444 return err;
11445 }
11446
11447 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11448 memcpy(&ibss.ht_capa_mask,
11449 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
11450 sizeof(ibss.ht_capa_mask));
11451
11452 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
11453 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11454 return -EINVAL;
11455 memcpy(&ibss.ht_capa,
11456 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
11457 sizeof(ibss.ht_capa));
11458 }
11459
11460 if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
11461 !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
11462 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
11463 return -EINVAL;
11464
11465 if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
11466 bool no_ht = false;
11467
11468 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht);
11469 if (IS_ERR(connkeys))
11470 return PTR_ERR(connkeys);
11471
11472 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
11473 no_ht) {
11474 kfree_sensitive(connkeys);
11475 return -EINVAL;
11476 }
11477 }
11478
11479 ibss.control_port =
11480 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
11481
11482 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
11483 int r = validate_pae_over_nl80211(rdev, info);
11484
11485 if (r < 0) {
11486 kfree_sensitive(connkeys);
11487 return r;
11488 }
11489
11490 ibss.control_port_over_nl80211 = true;
11491 }
11492
11493 ibss.userspace_handles_dfs =
11494 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
11495
11496 wdev_lock(dev->ieee80211_ptr);
11497 err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
11498 if (err)
11499 kfree_sensitive(connkeys);
11500 else if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
11501 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
11502 wdev_unlock(dev->ieee80211_ptr);
11503
11504 return err;
11505 }
11506
nl80211_leave_ibss(struct sk_buff * skb,struct genl_info * info)11507 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
11508 {
11509 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11510 struct net_device *dev = info->user_ptr[1];
11511
11512 if (!rdev->ops->leave_ibss)
11513 return -EOPNOTSUPP;
11514
11515 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
11516 return -EOPNOTSUPP;
11517
11518 return cfg80211_leave_ibss(rdev, dev, false);
11519 }
11520
nl80211_set_mcast_rate(struct sk_buff * skb,struct genl_info * info)11521 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
11522 {
11523 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11524 struct net_device *dev = info->user_ptr[1];
11525 int mcast_rate[NUM_NL80211_BANDS];
11526 u32 nla_rate;
11527
11528 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
11529 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
11530 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
11531 return -EOPNOTSUPP;
11532
11533 if (!rdev->ops->set_mcast_rate)
11534 return -EOPNOTSUPP;
11535
11536 memset(mcast_rate, 0, sizeof(mcast_rate));
11537
11538 if (!info->attrs[NL80211_ATTR_MCAST_RATE])
11539 return -EINVAL;
11540
11541 nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
11542 if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
11543 return -EINVAL;
11544
11545 return rdev_set_mcast_rate(rdev, dev, mcast_rate);
11546 }
11547
11548 static struct sk_buff *
__cfg80211_alloc_vendor_skb(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,int approxlen,u32 portid,u32 seq,enum nl80211_commands cmd,enum nl80211_attrs attr,const struct nl80211_vendor_cmd_info * info,gfp_t gfp)11549 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
11550 struct wireless_dev *wdev, int approxlen,
11551 u32 portid, u32 seq, enum nl80211_commands cmd,
11552 enum nl80211_attrs attr,
11553 const struct nl80211_vendor_cmd_info *info,
11554 gfp_t gfp)
11555 {
11556 struct sk_buff *skb;
11557 void *hdr;
11558 struct nlattr *data;
11559
11560 skb = nlmsg_new(approxlen + 100, gfp);
11561 if (!skb)
11562 return NULL;
11563
11564 hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
11565 if (!hdr) {
11566 kfree_skb(skb);
11567 return NULL;
11568 }
11569
11570 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
11571 goto nla_put_failure;
11572
11573 if (info) {
11574 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
11575 info->vendor_id))
11576 goto nla_put_failure;
11577 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
11578 info->subcmd))
11579 goto nla_put_failure;
11580 }
11581
11582 if (wdev) {
11583 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
11584 wdev_id(wdev), NL80211_ATTR_PAD))
11585 goto nla_put_failure;
11586 if (wdev->netdev &&
11587 nla_put_u32(skb, NL80211_ATTR_IFINDEX,
11588 wdev->netdev->ifindex))
11589 goto nla_put_failure;
11590 }
11591
11592 data = nla_nest_start_noflag(skb, attr);
11593 if (!data)
11594 goto nla_put_failure;
11595
11596 ((void **)skb->cb)[0] = rdev;
11597 ((void **)skb->cb)[1] = hdr;
11598 ((void **)skb->cb)[2] = data;
11599
11600 return skb;
11601
11602 nla_put_failure:
11603 kfree_skb(skb);
11604 return NULL;
11605 }
11606
__cfg80211_alloc_event_skb(struct wiphy * wiphy,struct wireless_dev * wdev,enum nl80211_commands cmd,enum nl80211_attrs attr,unsigned int portid,int vendor_event_idx,int approxlen,gfp_t gfp)11607 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
11608 struct wireless_dev *wdev,
11609 enum nl80211_commands cmd,
11610 enum nl80211_attrs attr,
11611 unsigned int portid,
11612 int vendor_event_idx,
11613 int approxlen, gfp_t gfp)
11614 {
11615 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11616 const struct nl80211_vendor_cmd_info *info;
11617
11618 switch (cmd) {
11619 case NL80211_CMD_TESTMODE:
11620 if (WARN_ON(vendor_event_idx != -1))
11621 return NULL;
11622 info = NULL;
11623 break;
11624 case NL80211_CMD_VENDOR:
11625 if (WARN_ON(vendor_event_idx < 0 ||
11626 vendor_event_idx >= wiphy->n_vendor_events))
11627 return NULL;
11628 info = &wiphy->vendor_events[vendor_event_idx];
11629 break;
11630 default:
11631 WARN_ON(1);
11632 return NULL;
11633 }
11634
11635 return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, portid, 0,
11636 cmd, attr, info, gfp);
11637 }
11638 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
11639
__cfg80211_send_event_skb(struct sk_buff * skb,gfp_t gfp)11640 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
11641 {
11642 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
11643 void *hdr = ((void **)skb->cb)[1];
11644 struct nlmsghdr *nlhdr = nlmsg_hdr(skb);
11645 struct nlattr *data = ((void **)skb->cb)[2];
11646 enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
11647
11648 /* clear CB data for netlink core to own from now on */
11649 memset(skb->cb, 0, sizeof(skb->cb));
11650
11651 nla_nest_end(skb, data);
11652 genlmsg_end(skb, hdr);
11653
11654 if (nlhdr->nlmsg_pid) {
11655 genlmsg_unicast(wiphy_net(&rdev->wiphy), skb,
11656 nlhdr->nlmsg_pid);
11657 } else {
11658 if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
11659 mcgrp = NL80211_MCGRP_VENDOR;
11660
11661 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
11662 skb, 0, mcgrp, gfp);
11663 }
11664 }
11665 EXPORT_SYMBOL(__cfg80211_send_event_skb);
11666
11667 #ifdef CONFIG_NL80211_TESTMODE
nl80211_testmode_do(struct sk_buff * skb,struct genl_info * info)11668 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
11669 {
11670 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11671 struct wireless_dev *wdev;
11672 int err;
11673
11674 lockdep_assert_held(&rdev->wiphy.mtx);
11675
11676 wdev = __cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
11677 info->attrs);
11678
11679 if (!rdev->ops->testmode_cmd)
11680 return -EOPNOTSUPP;
11681
11682 if (IS_ERR(wdev)) {
11683 err = PTR_ERR(wdev);
11684 if (err != -EINVAL)
11685 return err;
11686 wdev = NULL;
11687 } else if (wdev->wiphy != &rdev->wiphy) {
11688 return -EINVAL;
11689 }
11690
11691 if (!info->attrs[NL80211_ATTR_TESTDATA])
11692 return -EINVAL;
11693
11694 rdev->cur_cmd_info = info;
11695 err = rdev_testmode_cmd(rdev, wdev,
11696 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
11697 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
11698 rdev->cur_cmd_info = NULL;
11699
11700 return err;
11701 }
11702
nl80211_testmode_dump(struct sk_buff * skb,struct netlink_callback * cb)11703 static int nl80211_testmode_dump(struct sk_buff *skb,
11704 struct netlink_callback *cb)
11705 {
11706 struct cfg80211_registered_device *rdev;
11707 struct nlattr **attrbuf = NULL;
11708 int err;
11709 long phy_idx;
11710 void *data = NULL;
11711 int data_len = 0;
11712
11713 rtnl_lock();
11714
11715 if (cb->args[0]) {
11716 /*
11717 * 0 is a valid index, but not valid for args[0],
11718 * so we need to offset by 1.
11719 */
11720 phy_idx = cb->args[0] - 1;
11721
11722 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
11723 if (!rdev) {
11724 err = -ENOENT;
11725 goto out_err;
11726 }
11727 } else {
11728 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
11729 GFP_KERNEL);
11730 if (!attrbuf) {
11731 err = -ENOMEM;
11732 goto out_err;
11733 }
11734
11735 err = nlmsg_parse_deprecated(cb->nlh,
11736 GENL_HDRLEN + nl80211_fam.hdrsize,
11737 attrbuf, nl80211_fam.maxattr,
11738 nl80211_policy, NULL);
11739 if (err)
11740 goto out_err;
11741
11742 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
11743 if (IS_ERR(rdev)) {
11744 err = PTR_ERR(rdev);
11745 goto out_err;
11746 }
11747 phy_idx = rdev->wiphy_idx;
11748
11749 if (attrbuf[NL80211_ATTR_TESTDATA])
11750 cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
11751 }
11752
11753 if (cb->args[1]) {
11754 data = nla_data((void *)cb->args[1]);
11755 data_len = nla_len((void *)cb->args[1]);
11756 }
11757
11758 if (!rdev->ops->testmode_dump) {
11759 err = -EOPNOTSUPP;
11760 goto out_err;
11761 }
11762
11763 while (1) {
11764 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
11765 cb->nlh->nlmsg_seq, NLM_F_MULTI,
11766 NL80211_CMD_TESTMODE);
11767 struct nlattr *tmdata;
11768
11769 if (!hdr)
11770 break;
11771
11772 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
11773 genlmsg_cancel(skb, hdr);
11774 break;
11775 }
11776
11777 tmdata = nla_nest_start_noflag(skb, NL80211_ATTR_TESTDATA);
11778 if (!tmdata) {
11779 genlmsg_cancel(skb, hdr);
11780 break;
11781 }
11782 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
11783 nla_nest_end(skb, tmdata);
11784
11785 if (err == -ENOBUFS || err == -ENOENT) {
11786 genlmsg_cancel(skb, hdr);
11787 break;
11788 } else if (err) {
11789 genlmsg_cancel(skb, hdr);
11790 goto out_err;
11791 }
11792
11793 genlmsg_end(skb, hdr);
11794 }
11795
11796 err = skb->len;
11797 /* see above */
11798 cb->args[0] = phy_idx + 1;
11799 out_err:
11800 kfree(attrbuf);
11801 rtnl_unlock();
11802 return err;
11803 }
11804 #endif
11805
nl80211_connect(struct sk_buff * skb,struct genl_info * info)11806 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
11807 {
11808 struct cfg80211_registered_device *rdev = info->user_ptr[0];
11809 struct net_device *dev = info->user_ptr[1];
11810 struct cfg80211_connect_params connect;
11811 struct wiphy *wiphy;
11812 struct cfg80211_cached_keys *connkeys = NULL;
11813 u32 freq = 0;
11814 int err;
11815
11816 memset(&connect, 0, sizeof(connect));
11817
11818 if (!info->attrs[NL80211_ATTR_SSID] ||
11819 !nla_len(info->attrs[NL80211_ATTR_SSID]))
11820 return -EINVAL;
11821
11822 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
11823 connect.auth_type =
11824 nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
11825 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
11826 NL80211_CMD_CONNECT))
11827 return -EINVAL;
11828 } else
11829 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
11830
11831 connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
11832
11833 if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
11834 !wiphy_ext_feature_isset(&rdev->wiphy,
11835 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
11836 return -EINVAL;
11837 connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
11838
11839 err = nl80211_crypto_settings(rdev, info, &connect.crypto,
11840 NL80211_MAX_NR_CIPHER_SUITES);
11841 if (err)
11842 return err;
11843
11844 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11845 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11846 return -EOPNOTSUPP;
11847
11848 wiphy = &rdev->wiphy;
11849
11850 connect.bg_scan_period = -1;
11851 if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
11852 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
11853 connect.bg_scan_period =
11854 nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
11855 }
11856
11857 if (info->attrs[NL80211_ATTR_MAC])
11858 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11859 else if (info->attrs[NL80211_ATTR_MAC_HINT])
11860 connect.bssid_hint =
11861 nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
11862 connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
11863 connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
11864
11865 if (info->attrs[NL80211_ATTR_IE]) {
11866 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11867 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11868 }
11869
11870 if (info->attrs[NL80211_ATTR_USE_MFP]) {
11871 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
11872 if (connect.mfp == NL80211_MFP_OPTIONAL &&
11873 !wiphy_ext_feature_isset(&rdev->wiphy,
11874 NL80211_EXT_FEATURE_MFP_OPTIONAL))
11875 return -EOPNOTSUPP;
11876 } else {
11877 connect.mfp = NL80211_MFP_NO;
11878 }
11879
11880 if (info->attrs[NL80211_ATTR_PREV_BSSID])
11881 connect.prev_bssid =
11882 nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
11883
11884 if (info->attrs[NL80211_ATTR_WIPHY_FREQ])
11885 freq = MHZ_TO_KHZ(nla_get_u32(
11886 info->attrs[NL80211_ATTR_WIPHY_FREQ]));
11887 if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
11888 freq +=
11889 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
11890
11891 if (freq) {
11892 connect.channel = nl80211_get_valid_chan(wiphy, freq);
11893 if (!connect.channel)
11894 return -EINVAL;
11895 } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
11896 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
11897 freq = MHZ_TO_KHZ(freq);
11898 connect.channel_hint = nl80211_get_valid_chan(wiphy, freq);
11899 if (!connect.channel_hint)
11900 return -EINVAL;
11901 }
11902
11903 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
11904 connect.edmg.channels =
11905 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
11906
11907 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
11908 connect.edmg.bw_config =
11909 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
11910 }
11911
11912 if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
11913 connkeys = nl80211_parse_connkeys(rdev, info, NULL);
11914 if (IS_ERR(connkeys))
11915 return PTR_ERR(connkeys);
11916 }
11917
11918 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
11919 connect.flags |= ASSOC_REQ_DISABLE_HT;
11920
11921 if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11922 memcpy(&connect.ht_capa_mask,
11923 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
11924 sizeof(connect.ht_capa_mask));
11925
11926 if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
11927 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
11928 kfree_sensitive(connkeys);
11929 return -EINVAL;
11930 }
11931 memcpy(&connect.ht_capa,
11932 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
11933 sizeof(connect.ht_capa));
11934 }
11935
11936 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
11937 connect.flags |= ASSOC_REQ_DISABLE_VHT;
11938
11939 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
11940 connect.flags |= ASSOC_REQ_DISABLE_HE;
11941
11942 if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT]))
11943 connect.flags |= ASSOC_REQ_DISABLE_EHT;
11944
11945 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
11946 memcpy(&connect.vht_capa_mask,
11947 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
11948 sizeof(connect.vht_capa_mask));
11949
11950 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
11951 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
11952 kfree_sensitive(connkeys);
11953 return -EINVAL;
11954 }
11955 memcpy(&connect.vht_capa,
11956 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
11957 sizeof(connect.vht_capa));
11958 }
11959
11960 if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
11961 if (!((rdev->wiphy.features &
11962 NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
11963 (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
11964 !wiphy_ext_feature_isset(&rdev->wiphy,
11965 NL80211_EXT_FEATURE_RRM)) {
11966 kfree_sensitive(connkeys);
11967 return -EINVAL;
11968 }
11969 connect.flags |= ASSOC_REQ_USE_RRM;
11970 }
11971
11972 connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
11973 if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
11974 kfree_sensitive(connkeys);
11975 return -EOPNOTSUPP;
11976 }
11977
11978 if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
11979 /* bss selection makes no sense if bssid is set */
11980 if (connect.bssid) {
11981 kfree_sensitive(connkeys);
11982 return -EINVAL;
11983 }
11984
11985 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
11986 wiphy, &connect.bss_select);
11987 if (err) {
11988 kfree_sensitive(connkeys);
11989 return err;
11990 }
11991 }
11992
11993 if (wiphy_ext_feature_isset(&rdev->wiphy,
11994 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
11995 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
11996 info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
11997 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
11998 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
11999 connect.fils_erp_username =
12000 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
12001 connect.fils_erp_username_len =
12002 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
12003 connect.fils_erp_realm =
12004 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
12005 connect.fils_erp_realm_len =
12006 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
12007 connect.fils_erp_next_seq_num =
12008 nla_get_u16(
12009 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
12010 connect.fils_erp_rrk =
12011 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
12012 connect.fils_erp_rrk_len =
12013 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
12014 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
12015 info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
12016 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
12017 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
12018 kfree_sensitive(connkeys);
12019 return -EINVAL;
12020 }
12021
12022 if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
12023 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
12024 kfree_sensitive(connkeys);
12025 GENL_SET_ERR_MSG(info,
12026 "external auth requires connection ownership");
12027 return -EINVAL;
12028 }
12029 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT;
12030 }
12031
12032 if (nla_get_flag(info->attrs[NL80211_ATTR_MLO_SUPPORT]))
12033 connect.flags |= CONNECT_REQ_MLO_SUPPORT;
12034
12035 wdev_lock(dev->ieee80211_ptr);
12036
12037 err = cfg80211_connect(rdev, dev, &connect, connkeys,
12038 connect.prev_bssid);
12039 if (err)
12040 kfree_sensitive(connkeys);
12041
12042 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
12043 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
12044 if (connect.bssid)
12045 memcpy(dev->ieee80211_ptr->disconnect_bssid,
12046 connect.bssid, ETH_ALEN);
12047 else
12048 eth_zero_addr(dev->ieee80211_ptr->disconnect_bssid);
12049 }
12050
12051 wdev_unlock(dev->ieee80211_ptr);
12052
12053 return err;
12054 }
12055
nl80211_update_connect_params(struct sk_buff * skb,struct genl_info * info)12056 static int nl80211_update_connect_params(struct sk_buff *skb,
12057 struct genl_info *info)
12058 {
12059 struct cfg80211_connect_params connect = {};
12060 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12061 struct net_device *dev = info->user_ptr[1];
12062 struct wireless_dev *wdev = dev->ieee80211_ptr;
12063 bool fils_sk_offload;
12064 u32 auth_type;
12065 u32 changed = 0;
12066 int ret;
12067
12068 if (!rdev->ops->update_connect_params)
12069 return -EOPNOTSUPP;
12070
12071 if (info->attrs[NL80211_ATTR_IE]) {
12072 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12073 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12074 changed |= UPDATE_ASSOC_IES;
12075 }
12076
12077 fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy,
12078 NL80211_EXT_FEATURE_FILS_SK_OFFLOAD);
12079
12080 /*
12081 * when driver supports fils-sk offload all attributes must be
12082 * provided. So the else covers "fils-sk-not-all" and
12083 * "no-fils-sk-any".
12084 */
12085 if (fils_sk_offload &&
12086 info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
12087 info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
12088 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
12089 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
12090 connect.fils_erp_username =
12091 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
12092 connect.fils_erp_username_len =
12093 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
12094 connect.fils_erp_realm =
12095 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
12096 connect.fils_erp_realm_len =
12097 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
12098 connect.fils_erp_next_seq_num =
12099 nla_get_u16(
12100 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
12101 connect.fils_erp_rrk =
12102 nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
12103 connect.fils_erp_rrk_len =
12104 nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
12105 changed |= UPDATE_FILS_ERP_INFO;
12106 } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
12107 info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
12108 info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
12109 info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
12110 return -EINVAL;
12111 }
12112
12113 if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
12114 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
12115 if (!nl80211_valid_auth_type(rdev, auth_type,
12116 NL80211_CMD_CONNECT))
12117 return -EINVAL;
12118
12119 if (auth_type == NL80211_AUTHTYPE_FILS_SK &&
12120 fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO))
12121 return -EINVAL;
12122
12123 connect.auth_type = auth_type;
12124 changed |= UPDATE_AUTH_TYPE;
12125 }
12126
12127 wdev_lock(dev->ieee80211_ptr);
12128 if (!wdev->connected)
12129 ret = -ENOLINK;
12130 else
12131 ret = rdev_update_connect_params(rdev, dev, &connect, changed);
12132 wdev_unlock(dev->ieee80211_ptr);
12133
12134 return ret;
12135 }
12136
nl80211_disconnect(struct sk_buff * skb,struct genl_info * info)12137 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
12138 {
12139 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12140 struct net_device *dev = info->user_ptr[1];
12141 u16 reason;
12142 int ret;
12143
12144 if (dev->ieee80211_ptr->conn_owner_nlportid &&
12145 dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
12146 return -EPERM;
12147
12148 if (!info->attrs[NL80211_ATTR_REASON_CODE])
12149 reason = WLAN_REASON_DEAUTH_LEAVING;
12150 else
12151 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
12152
12153 if (reason == 0)
12154 return -EINVAL;
12155
12156 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12157 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12158 return -EOPNOTSUPP;
12159
12160 wdev_lock(dev->ieee80211_ptr);
12161 ret = cfg80211_disconnect(rdev, dev, reason, true);
12162 wdev_unlock(dev->ieee80211_ptr);
12163 return ret;
12164 }
12165
nl80211_wiphy_netns(struct sk_buff * skb,struct genl_info * info)12166 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
12167 {
12168 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12169 struct net *net;
12170 int err;
12171
12172 if (info->attrs[NL80211_ATTR_PID]) {
12173 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
12174
12175 net = get_net_ns_by_pid(pid);
12176 } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
12177 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
12178
12179 net = get_net_ns_by_fd(fd);
12180 } else {
12181 return -EINVAL;
12182 }
12183
12184 if (IS_ERR(net))
12185 return PTR_ERR(net);
12186
12187 err = 0;
12188
12189 /* check if anything to do */
12190 if (!net_eq(wiphy_net(&rdev->wiphy), net))
12191 err = cfg80211_switch_netns(rdev, net);
12192
12193 put_net(net);
12194 return err;
12195 }
12196
nl80211_setdel_pmksa(struct sk_buff * skb,struct genl_info * info)12197 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
12198 {
12199 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12200 int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
12201 struct cfg80211_pmksa *pmksa) = NULL;
12202 struct net_device *dev = info->user_ptr[1];
12203 struct cfg80211_pmksa pmksa;
12204
12205 memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
12206
12207 if (!info->attrs[NL80211_ATTR_PMKID])
12208 return -EINVAL;
12209
12210 pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
12211
12212 if (info->attrs[NL80211_ATTR_MAC]) {
12213 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
12214 } else if (info->attrs[NL80211_ATTR_SSID] &&
12215 info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
12216 (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA ||
12217 info->attrs[NL80211_ATTR_PMK])) {
12218 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
12219 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
12220 pmksa.cache_id =
12221 nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
12222 } else {
12223 return -EINVAL;
12224 }
12225 if (info->attrs[NL80211_ATTR_PMK]) {
12226 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
12227 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
12228 }
12229
12230 if (info->attrs[NL80211_ATTR_PMK_LIFETIME])
12231 pmksa.pmk_lifetime =
12232 nla_get_u32(info->attrs[NL80211_ATTR_PMK_LIFETIME]);
12233
12234 if (info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD])
12235 pmksa.pmk_reauth_threshold =
12236 nla_get_u8(
12237 info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD]);
12238
12239 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12240 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
12241 !(dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP &&
12242 wiphy_ext_feature_isset(&rdev->wiphy,
12243 NL80211_EXT_FEATURE_AP_PMKSA_CACHING)))
12244 return -EOPNOTSUPP;
12245
12246 switch (info->genlhdr->cmd) {
12247 case NL80211_CMD_SET_PMKSA:
12248 rdev_ops = rdev->ops->set_pmksa;
12249 break;
12250 case NL80211_CMD_DEL_PMKSA:
12251 rdev_ops = rdev->ops->del_pmksa;
12252 break;
12253 default:
12254 WARN_ON(1);
12255 break;
12256 }
12257
12258 if (!rdev_ops)
12259 return -EOPNOTSUPP;
12260
12261 return rdev_ops(&rdev->wiphy, dev, &pmksa);
12262 }
12263
nl80211_flush_pmksa(struct sk_buff * skb,struct genl_info * info)12264 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
12265 {
12266 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12267 struct net_device *dev = info->user_ptr[1];
12268
12269 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12270 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12271 return -EOPNOTSUPP;
12272
12273 if (!rdev->ops->flush_pmksa)
12274 return -EOPNOTSUPP;
12275
12276 return rdev_flush_pmksa(rdev, dev);
12277 }
12278
nl80211_tdls_mgmt(struct sk_buff * skb,struct genl_info * info)12279 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
12280 {
12281 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12282 struct net_device *dev = info->user_ptr[1];
12283 u8 action_code, dialog_token;
12284 u32 peer_capability = 0;
12285 u16 status_code;
12286 u8 *peer;
12287 int link_id;
12288 bool initiator;
12289
12290 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
12291 !rdev->ops->tdls_mgmt)
12292 return -EOPNOTSUPP;
12293
12294 if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
12295 !info->attrs[NL80211_ATTR_STATUS_CODE] ||
12296 !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
12297 !info->attrs[NL80211_ATTR_IE] ||
12298 !info->attrs[NL80211_ATTR_MAC])
12299 return -EINVAL;
12300
12301 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12302 action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
12303 status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
12304 dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
12305 initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
12306 if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
12307 peer_capability =
12308 nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
12309 link_id = nl80211_link_id_or_invalid(info->attrs);
12310
12311 return rdev_tdls_mgmt(rdev, dev, peer, link_id, action_code,
12312 dialog_token, status_code, peer_capability,
12313 initiator,
12314 nla_data(info->attrs[NL80211_ATTR_IE]),
12315 nla_len(info->attrs[NL80211_ATTR_IE]));
12316 }
12317
nl80211_tdls_oper(struct sk_buff * skb,struct genl_info * info)12318 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
12319 {
12320 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12321 struct net_device *dev = info->user_ptr[1];
12322 enum nl80211_tdls_operation operation;
12323 u8 *peer;
12324
12325 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
12326 !rdev->ops->tdls_oper)
12327 return -EOPNOTSUPP;
12328
12329 if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
12330 !info->attrs[NL80211_ATTR_MAC])
12331 return -EINVAL;
12332
12333 operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
12334 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12335
12336 return rdev_tdls_oper(rdev, dev, peer, operation);
12337 }
12338
nl80211_remain_on_channel(struct sk_buff * skb,struct genl_info * info)12339 static int nl80211_remain_on_channel(struct sk_buff *skb,
12340 struct genl_info *info)
12341 {
12342 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12343 unsigned int link_id = nl80211_link_id(info->attrs);
12344 struct wireless_dev *wdev = info->user_ptr[1];
12345 struct cfg80211_chan_def chandef;
12346 struct sk_buff *msg;
12347 void *hdr;
12348 u64 cookie;
12349 u32 duration;
12350 int err;
12351
12352 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
12353 !info->attrs[NL80211_ATTR_DURATION])
12354 return -EINVAL;
12355
12356 duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
12357
12358 if (!rdev->ops->remain_on_channel ||
12359 !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
12360 return -EOPNOTSUPP;
12361
12362 /*
12363 * We should be on that channel for at least a minimum amount of
12364 * time (10ms) but no longer than the driver supports.
12365 */
12366 if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
12367 duration > rdev->wiphy.max_remain_on_channel_duration)
12368 return -EINVAL;
12369
12370 err = nl80211_parse_chandef(rdev, info, &chandef);
12371 if (err)
12372 return err;
12373
12374 wdev_lock(wdev);
12375 if (!cfg80211_off_channel_oper_allowed(wdev, chandef.chan)) {
12376 const struct cfg80211_chan_def *oper_chandef, *compat_chandef;
12377
12378 oper_chandef = wdev_chandef(wdev, link_id);
12379
12380 if (WARN_ON(!oper_chandef)) {
12381 /* cannot happen since we must beacon to get here */
12382 WARN_ON(1);
12383 wdev_unlock(wdev);
12384 return -EBUSY;
12385 }
12386
12387 /* note: returns first one if identical chandefs */
12388 compat_chandef = cfg80211_chandef_compatible(&chandef,
12389 oper_chandef);
12390
12391 if (compat_chandef != &chandef) {
12392 wdev_unlock(wdev);
12393 return -EBUSY;
12394 }
12395 }
12396 wdev_unlock(wdev);
12397
12398 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12399 if (!msg)
12400 return -ENOMEM;
12401
12402 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12403 NL80211_CMD_REMAIN_ON_CHANNEL);
12404 if (!hdr) {
12405 err = -ENOBUFS;
12406 goto free_msg;
12407 }
12408
12409 err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
12410 duration, &cookie);
12411
12412 if (err)
12413 goto free_msg;
12414
12415 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12416 NL80211_ATTR_PAD))
12417 goto nla_put_failure;
12418
12419 genlmsg_end(msg, hdr);
12420
12421 return genlmsg_reply(msg, info);
12422
12423 nla_put_failure:
12424 err = -ENOBUFS;
12425 free_msg:
12426 nlmsg_free(msg);
12427 return err;
12428 }
12429
nl80211_cancel_remain_on_channel(struct sk_buff * skb,struct genl_info * info)12430 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
12431 struct genl_info *info)
12432 {
12433 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12434 struct wireless_dev *wdev = info->user_ptr[1];
12435 u64 cookie;
12436
12437 if (!info->attrs[NL80211_ATTR_COOKIE])
12438 return -EINVAL;
12439
12440 if (!rdev->ops->cancel_remain_on_channel)
12441 return -EOPNOTSUPP;
12442
12443 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
12444
12445 return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
12446 }
12447
nl80211_set_tx_bitrate_mask(struct sk_buff * skb,struct genl_info * info)12448 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
12449 struct genl_info *info)
12450 {
12451 struct cfg80211_bitrate_mask mask;
12452 unsigned int link_id = nl80211_link_id(info->attrs);
12453 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12454 struct net_device *dev = info->user_ptr[1];
12455 struct wireless_dev *wdev = dev->ieee80211_ptr;
12456 int err;
12457
12458 if (!rdev->ops->set_bitrate_mask)
12459 return -EOPNOTSUPP;
12460
12461 wdev_lock(wdev);
12462 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
12463 NL80211_ATTR_TX_RATES, &mask,
12464 dev, true, link_id);
12465 if (err)
12466 goto out;
12467
12468 err = rdev_set_bitrate_mask(rdev, dev, link_id, NULL, &mask);
12469 out:
12470 wdev_unlock(wdev);
12471 return err;
12472 }
12473
nl80211_register_mgmt(struct sk_buff * skb,struct genl_info * info)12474 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
12475 {
12476 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12477 struct wireless_dev *wdev = info->user_ptr[1];
12478 u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
12479
12480 if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
12481 return -EINVAL;
12482
12483 if (info->attrs[NL80211_ATTR_FRAME_TYPE])
12484 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
12485
12486 switch (wdev->iftype) {
12487 case NL80211_IFTYPE_STATION:
12488 case NL80211_IFTYPE_ADHOC:
12489 case NL80211_IFTYPE_P2P_CLIENT:
12490 case NL80211_IFTYPE_AP:
12491 case NL80211_IFTYPE_AP_VLAN:
12492 case NL80211_IFTYPE_MESH_POINT:
12493 case NL80211_IFTYPE_P2P_GO:
12494 case NL80211_IFTYPE_P2P_DEVICE:
12495 break;
12496 case NL80211_IFTYPE_NAN:
12497 if (!wiphy_ext_feature_isset(wdev->wiphy,
12498 NL80211_EXT_FEATURE_SECURE_NAN))
12499 return -EOPNOTSUPP;
12500 break;
12501 default:
12502 return -EOPNOTSUPP;
12503 }
12504
12505 /* not much point in registering if we can't reply */
12506 if (!rdev->ops->mgmt_tx)
12507 return -EOPNOTSUPP;
12508
12509 if (info->attrs[NL80211_ATTR_RECEIVE_MULTICAST] &&
12510 !wiphy_ext_feature_isset(&rdev->wiphy,
12511 NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS)) {
12512 GENL_SET_ERR_MSG(info,
12513 "multicast RX registrations are not supported");
12514 return -EOPNOTSUPP;
12515 }
12516
12517 return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
12518 nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
12519 nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]),
12520 info->attrs[NL80211_ATTR_RECEIVE_MULTICAST],
12521 info->extack);
12522 }
12523
nl80211_tx_mgmt(struct sk_buff * skb,struct genl_info * info)12524 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
12525 {
12526 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12527 struct wireless_dev *wdev = info->user_ptr[1];
12528 struct cfg80211_chan_def chandef;
12529 int err;
12530 void *hdr = NULL;
12531 u64 cookie;
12532 struct sk_buff *msg = NULL;
12533 struct cfg80211_mgmt_tx_params params = {
12534 .dont_wait_for_ack =
12535 info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
12536 };
12537
12538 if (!info->attrs[NL80211_ATTR_FRAME])
12539 return -EINVAL;
12540
12541 if (!rdev->ops->mgmt_tx)
12542 return -EOPNOTSUPP;
12543
12544 switch (wdev->iftype) {
12545 case NL80211_IFTYPE_P2P_DEVICE:
12546 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
12547 return -EINVAL;
12548 break;
12549 case NL80211_IFTYPE_STATION:
12550 case NL80211_IFTYPE_ADHOC:
12551 case NL80211_IFTYPE_P2P_CLIENT:
12552 case NL80211_IFTYPE_AP:
12553 case NL80211_IFTYPE_AP_VLAN:
12554 case NL80211_IFTYPE_MESH_POINT:
12555 case NL80211_IFTYPE_P2P_GO:
12556 break;
12557 case NL80211_IFTYPE_NAN:
12558 if (!wiphy_ext_feature_isset(wdev->wiphy,
12559 NL80211_EXT_FEATURE_SECURE_NAN))
12560 return -EOPNOTSUPP;
12561 break;
12562 default:
12563 return -EOPNOTSUPP;
12564 }
12565
12566 if (info->attrs[NL80211_ATTR_DURATION]) {
12567 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
12568 return -EINVAL;
12569 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
12570
12571 /*
12572 * We should wait on the channel for at least a minimum amount
12573 * of time (10ms) but no longer than the driver supports.
12574 */
12575 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
12576 params.wait > rdev->wiphy.max_remain_on_channel_duration)
12577 return -EINVAL;
12578 }
12579
12580 params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
12581
12582 if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
12583 return -EINVAL;
12584
12585 params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
12586
12587 /* get the channel if any has been specified, otherwise pass NULL to
12588 * the driver. The latter will use the current one
12589 */
12590 chandef.chan = NULL;
12591 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
12592 err = nl80211_parse_chandef(rdev, info, &chandef);
12593 if (err)
12594 return err;
12595 }
12596
12597 if (!chandef.chan && params.offchan)
12598 return -EINVAL;
12599
12600 wdev_lock(wdev);
12601 if (params.offchan &&
12602 !cfg80211_off_channel_oper_allowed(wdev, chandef.chan)) {
12603 wdev_unlock(wdev);
12604 return -EBUSY;
12605 }
12606
12607 params.link_id = nl80211_link_id_or_invalid(info->attrs);
12608 /*
12609 * This now races due to the unlock, but we cannot check
12610 * the valid links for the _station_ anyway, so that's up
12611 * to the driver.
12612 */
12613 if (params.link_id >= 0 &&
12614 !(wdev->valid_links & BIT(params.link_id))) {
12615 wdev_unlock(wdev);
12616 return -EINVAL;
12617 }
12618 wdev_unlock(wdev);
12619
12620 params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
12621 params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
12622
12623 if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
12624 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
12625 int i;
12626
12627 if (len % sizeof(u16))
12628 return -EINVAL;
12629
12630 params.n_csa_offsets = len / sizeof(u16);
12631 params.csa_offsets =
12632 nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
12633
12634 /* check that all the offsets fit the frame */
12635 for (i = 0; i < params.n_csa_offsets; i++) {
12636 if (params.csa_offsets[i] >= params.len)
12637 return -EINVAL;
12638 }
12639 }
12640
12641 if (!params.dont_wait_for_ack) {
12642 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12643 if (!msg)
12644 return -ENOMEM;
12645
12646 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12647 NL80211_CMD_FRAME);
12648 if (!hdr) {
12649 err = -ENOBUFS;
12650 goto free_msg;
12651 }
12652 }
12653
12654 params.chan = chandef.chan;
12655 err = cfg80211_mlme_mgmt_tx(rdev, wdev, ¶ms, &cookie);
12656 if (err)
12657 goto free_msg;
12658
12659 if (msg) {
12660 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12661 NL80211_ATTR_PAD))
12662 goto nla_put_failure;
12663
12664 genlmsg_end(msg, hdr);
12665 return genlmsg_reply(msg, info);
12666 }
12667
12668 return 0;
12669
12670 nla_put_failure:
12671 err = -ENOBUFS;
12672 free_msg:
12673 nlmsg_free(msg);
12674 return err;
12675 }
12676
nl80211_tx_mgmt_cancel_wait(struct sk_buff * skb,struct genl_info * info)12677 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
12678 {
12679 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12680 struct wireless_dev *wdev = info->user_ptr[1];
12681 u64 cookie;
12682
12683 if (!info->attrs[NL80211_ATTR_COOKIE])
12684 return -EINVAL;
12685
12686 if (!rdev->ops->mgmt_tx_cancel_wait)
12687 return -EOPNOTSUPP;
12688
12689 switch (wdev->iftype) {
12690 case NL80211_IFTYPE_STATION:
12691 case NL80211_IFTYPE_ADHOC:
12692 case NL80211_IFTYPE_P2P_CLIENT:
12693 case NL80211_IFTYPE_AP:
12694 case NL80211_IFTYPE_AP_VLAN:
12695 case NL80211_IFTYPE_P2P_GO:
12696 case NL80211_IFTYPE_P2P_DEVICE:
12697 break;
12698 case NL80211_IFTYPE_NAN:
12699 if (!wiphy_ext_feature_isset(wdev->wiphy,
12700 NL80211_EXT_FEATURE_SECURE_NAN))
12701 return -EOPNOTSUPP;
12702 break;
12703 default:
12704 return -EOPNOTSUPP;
12705 }
12706
12707 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
12708
12709 return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
12710 }
12711
nl80211_set_power_save(struct sk_buff * skb,struct genl_info * info)12712 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
12713 {
12714 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12715 struct wireless_dev *wdev;
12716 struct net_device *dev = info->user_ptr[1];
12717 u8 ps_state;
12718 bool state;
12719 int err;
12720
12721 if (!info->attrs[NL80211_ATTR_PS_STATE])
12722 return -EINVAL;
12723
12724 ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
12725
12726 wdev = dev->ieee80211_ptr;
12727
12728 if (!rdev->ops->set_power_mgmt)
12729 return -EOPNOTSUPP;
12730
12731 state = (ps_state == NL80211_PS_ENABLED) ? true : false;
12732
12733 if (state == wdev->ps)
12734 return 0;
12735
12736 err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
12737 if (!err)
12738 wdev->ps = state;
12739 return err;
12740 }
12741
nl80211_get_power_save(struct sk_buff * skb,struct genl_info * info)12742 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
12743 {
12744 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12745 enum nl80211_ps_state ps_state;
12746 struct wireless_dev *wdev;
12747 struct net_device *dev = info->user_ptr[1];
12748 struct sk_buff *msg;
12749 void *hdr;
12750 int err;
12751
12752 wdev = dev->ieee80211_ptr;
12753
12754 if (!rdev->ops->set_power_mgmt)
12755 return -EOPNOTSUPP;
12756
12757 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12758 if (!msg)
12759 return -ENOMEM;
12760
12761 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12762 NL80211_CMD_GET_POWER_SAVE);
12763 if (!hdr) {
12764 err = -ENOBUFS;
12765 goto free_msg;
12766 }
12767
12768 if (wdev->ps)
12769 ps_state = NL80211_PS_ENABLED;
12770 else
12771 ps_state = NL80211_PS_DISABLED;
12772
12773 if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
12774 goto nla_put_failure;
12775
12776 genlmsg_end(msg, hdr);
12777 return genlmsg_reply(msg, info);
12778
12779 nla_put_failure:
12780 err = -ENOBUFS;
12781 free_msg:
12782 nlmsg_free(msg);
12783 return err;
12784 }
12785
12786 static const struct nla_policy
12787 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
12788 [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
12789 [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
12790 [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
12791 [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
12792 [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
12793 [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
12794 [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
12795 };
12796
nl80211_set_cqm_txe(struct genl_info * info,u32 rate,u32 pkts,u32 intvl)12797 static int nl80211_set_cqm_txe(struct genl_info *info,
12798 u32 rate, u32 pkts, u32 intvl)
12799 {
12800 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12801 struct net_device *dev = info->user_ptr[1];
12802 struct wireless_dev *wdev = dev->ieee80211_ptr;
12803
12804 if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
12805 return -EINVAL;
12806
12807 if (!rdev->ops->set_cqm_txe_config)
12808 return -EOPNOTSUPP;
12809
12810 if (wdev->iftype != NL80211_IFTYPE_STATION &&
12811 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12812 return -EOPNOTSUPP;
12813
12814 return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
12815 }
12816
cfg80211_cqm_rssi_update(struct cfg80211_registered_device * rdev,struct net_device * dev,struct cfg80211_cqm_config * cqm_config)12817 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
12818 struct net_device *dev,
12819 struct cfg80211_cqm_config *cqm_config)
12820 {
12821 struct wireless_dev *wdev = dev->ieee80211_ptr;
12822 s32 last, low, high;
12823 u32 hyst;
12824 int i, n, low_index;
12825 int err;
12826
12827 /* RSSI reporting disabled? */
12828 if (!cqm_config)
12829 return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
12830
12831 /*
12832 * Obtain current RSSI value if possible, if not and no RSSI threshold
12833 * event has been received yet, we should receive an event after a
12834 * connection is established and enough beacons received to calculate
12835 * the average.
12836 */
12837 if (!cqm_config->last_rssi_event_value &&
12838 wdev->links[0].client.current_bss &&
12839 rdev->ops->get_station) {
12840 struct station_info sinfo = {};
12841 u8 *mac_addr;
12842
12843 mac_addr = wdev->links[0].client.current_bss->pub.bssid;
12844
12845 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
12846 if (err)
12847 return err;
12848
12849 cfg80211_sinfo_release_content(&sinfo);
12850 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
12851 cqm_config->last_rssi_event_value =
12852 (s8) sinfo.rx_beacon_signal_avg;
12853 }
12854
12855 last = cqm_config->last_rssi_event_value;
12856 hyst = cqm_config->rssi_hyst;
12857 n = cqm_config->n_rssi_thresholds;
12858
12859 for (i = 0; i < n; i++) {
12860 i = array_index_nospec(i, n);
12861 if (last < cqm_config->rssi_thresholds[i])
12862 break;
12863 }
12864
12865 low_index = i - 1;
12866 if (low_index >= 0) {
12867 low_index = array_index_nospec(low_index, n);
12868 low = cqm_config->rssi_thresholds[low_index] - hyst;
12869 } else {
12870 low = S32_MIN;
12871 }
12872 if (i < n) {
12873 i = array_index_nospec(i, n);
12874 high = cqm_config->rssi_thresholds[i] + hyst - 1;
12875 } else {
12876 high = S32_MAX;
12877 }
12878
12879 return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
12880 }
12881
nl80211_set_cqm_rssi(struct genl_info * info,const s32 * thresholds,int n_thresholds,u32 hysteresis)12882 static int nl80211_set_cqm_rssi(struct genl_info *info,
12883 const s32 *thresholds, int n_thresholds,
12884 u32 hysteresis)
12885 {
12886 struct cfg80211_registered_device *rdev = info->user_ptr[0];
12887 struct cfg80211_cqm_config *cqm_config = NULL, *old;
12888 struct net_device *dev = info->user_ptr[1];
12889 struct wireless_dev *wdev = dev->ieee80211_ptr;
12890 int i, err;
12891 s32 prev = S32_MIN;
12892
12893 /* Check all values negative and sorted */
12894 for (i = 0; i < n_thresholds; i++) {
12895 if (thresholds[i] > 0 || thresholds[i] <= prev)
12896 return -EINVAL;
12897
12898 prev = thresholds[i];
12899 }
12900
12901 if (wdev->iftype != NL80211_IFTYPE_STATION &&
12902 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12903 return -EOPNOTSUPP;
12904
12905 if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) {
12906 if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */
12907 return rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
12908
12909 return rdev_set_cqm_rssi_config(rdev, dev,
12910 thresholds[0], hysteresis);
12911 }
12912
12913 if (!wiphy_ext_feature_isset(&rdev->wiphy,
12914 NL80211_EXT_FEATURE_CQM_RSSI_LIST))
12915 return -EOPNOTSUPP;
12916
12917 if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
12918 n_thresholds = 0;
12919
12920 wdev_lock(wdev);
12921 old = rcu_dereference_protected(wdev->cqm_config,
12922 lockdep_is_held(&wdev->mtx));
12923
12924 if (n_thresholds) {
12925 cqm_config = kzalloc(struct_size(cqm_config, rssi_thresholds,
12926 n_thresholds),
12927 GFP_KERNEL);
12928 if (!cqm_config) {
12929 err = -ENOMEM;
12930 goto unlock;
12931 }
12932
12933 cqm_config->rssi_hyst = hysteresis;
12934 cqm_config->n_rssi_thresholds = n_thresholds;
12935 memcpy(cqm_config->rssi_thresholds, thresholds,
12936 flex_array_size(cqm_config, rssi_thresholds,
12937 n_thresholds));
12938
12939 rcu_assign_pointer(wdev->cqm_config, cqm_config);
12940 } else {
12941 RCU_INIT_POINTER(wdev->cqm_config, NULL);
12942 }
12943
12944 err = cfg80211_cqm_rssi_update(rdev, dev, cqm_config);
12945 if (err) {
12946 rcu_assign_pointer(wdev->cqm_config, old);
12947 kfree_rcu(cqm_config, rcu_head);
12948 } else {
12949 kfree_rcu(old, rcu_head);
12950 }
12951 unlock:
12952 wdev_unlock(wdev);
12953
12954 return err;
12955 }
12956
nl80211_set_cqm(struct sk_buff * skb,struct genl_info * info)12957 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
12958 {
12959 struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
12960 struct nlattr *cqm;
12961 int err;
12962
12963 cqm = info->attrs[NL80211_ATTR_CQM];
12964 if (!cqm)
12965 return -EINVAL;
12966
12967 err = nla_parse_nested_deprecated(attrs, NL80211_ATTR_CQM_MAX, cqm,
12968 nl80211_attr_cqm_policy,
12969 info->extack);
12970 if (err)
12971 return err;
12972
12973 if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
12974 attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
12975 const s32 *thresholds =
12976 nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
12977 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
12978 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
12979
12980 if (len % 4)
12981 return -EINVAL;
12982
12983 return nl80211_set_cqm_rssi(info, thresholds, len / 4,
12984 hysteresis);
12985 }
12986
12987 if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
12988 attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
12989 attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
12990 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
12991 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
12992 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
12993
12994 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
12995 }
12996
12997 return -EINVAL;
12998 }
12999
nl80211_join_ocb(struct sk_buff * skb,struct genl_info * info)13000 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
13001 {
13002 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13003 struct net_device *dev = info->user_ptr[1];
13004 struct ocb_setup setup = {};
13005 int err;
13006
13007 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
13008 if (err)
13009 return err;
13010
13011 return cfg80211_join_ocb(rdev, dev, &setup);
13012 }
13013
nl80211_leave_ocb(struct sk_buff * skb,struct genl_info * info)13014 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
13015 {
13016 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13017 struct net_device *dev = info->user_ptr[1];
13018
13019 return cfg80211_leave_ocb(rdev, dev);
13020 }
13021
nl80211_join_mesh(struct sk_buff * skb,struct genl_info * info)13022 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
13023 {
13024 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13025 struct net_device *dev = info->user_ptr[1];
13026 struct mesh_config cfg;
13027 struct mesh_setup setup;
13028 int err;
13029
13030 /* start with default */
13031 memcpy(&cfg, &default_mesh_config, sizeof(cfg));
13032 memcpy(&setup, &default_mesh_setup, sizeof(setup));
13033
13034 if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
13035 /* and parse parameters if given */
13036 err = nl80211_parse_mesh_config(info, &cfg, NULL);
13037 if (err)
13038 return err;
13039 }
13040
13041 if (!info->attrs[NL80211_ATTR_MESH_ID] ||
13042 !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
13043 return -EINVAL;
13044
13045 setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
13046 setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
13047
13048 if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
13049 !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
13050 nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
13051 return -EINVAL;
13052
13053 if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
13054 setup.beacon_interval =
13055 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
13056
13057 err = cfg80211_validate_beacon_int(rdev,
13058 NL80211_IFTYPE_MESH_POINT,
13059 setup.beacon_interval);
13060 if (err)
13061 return err;
13062 }
13063
13064 if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
13065 setup.dtim_period =
13066 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
13067 if (setup.dtim_period < 1 || setup.dtim_period > 100)
13068 return -EINVAL;
13069 }
13070
13071 if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
13072 /* parse additional setup parameters if given */
13073 err = nl80211_parse_mesh_setup(info, &setup);
13074 if (err)
13075 return err;
13076 }
13077
13078 if (setup.user_mpm)
13079 cfg.auto_open_plinks = false;
13080
13081 if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
13082 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
13083 if (err)
13084 return err;
13085 } else {
13086 /* __cfg80211_join_mesh() will sort it out */
13087 setup.chandef.chan = NULL;
13088 }
13089
13090 if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
13091 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
13092 int n_rates =
13093 nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
13094 struct ieee80211_supported_band *sband;
13095
13096 if (!setup.chandef.chan)
13097 return -EINVAL;
13098
13099 sband = rdev->wiphy.bands[setup.chandef.chan->band];
13100
13101 err = ieee80211_get_ratemask(sband, rates, n_rates,
13102 &setup.basic_rates);
13103 if (err)
13104 return err;
13105 }
13106
13107 if (info->attrs[NL80211_ATTR_TX_RATES]) {
13108 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
13109 NL80211_ATTR_TX_RATES,
13110 &setup.beacon_rate,
13111 dev, false, 0);
13112 if (err)
13113 return err;
13114
13115 if (!setup.chandef.chan)
13116 return -EINVAL;
13117
13118 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
13119 &setup.beacon_rate);
13120 if (err)
13121 return err;
13122 }
13123
13124 setup.userspace_handles_dfs =
13125 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
13126
13127 if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
13128 int r = validate_pae_over_nl80211(rdev, info);
13129
13130 if (r < 0)
13131 return r;
13132
13133 setup.control_port_over_nl80211 = true;
13134 }
13135
13136 wdev_lock(dev->ieee80211_ptr);
13137 err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg);
13138 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER])
13139 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
13140 wdev_unlock(dev->ieee80211_ptr);
13141
13142 return err;
13143 }
13144
nl80211_leave_mesh(struct sk_buff * skb,struct genl_info * info)13145 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
13146 {
13147 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13148 struct net_device *dev = info->user_ptr[1];
13149
13150 return cfg80211_leave_mesh(rdev, dev);
13151 }
13152
13153 #ifdef CONFIG_PM
nl80211_send_wowlan_patterns(struct sk_buff * msg,struct cfg80211_registered_device * rdev)13154 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
13155 struct cfg80211_registered_device *rdev)
13156 {
13157 struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
13158 struct nlattr *nl_pats, *nl_pat;
13159 int i, pat_len;
13160
13161 if (!wowlan->n_patterns)
13162 return 0;
13163
13164 nl_pats = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
13165 if (!nl_pats)
13166 return -ENOBUFS;
13167
13168 for (i = 0; i < wowlan->n_patterns; i++) {
13169 nl_pat = nla_nest_start_noflag(msg, i + 1);
13170 if (!nl_pat)
13171 return -ENOBUFS;
13172 pat_len = wowlan->patterns[i].pattern_len;
13173 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
13174 wowlan->patterns[i].mask) ||
13175 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
13176 wowlan->patterns[i].pattern) ||
13177 nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
13178 wowlan->patterns[i].pkt_offset))
13179 return -ENOBUFS;
13180 nla_nest_end(msg, nl_pat);
13181 }
13182 nla_nest_end(msg, nl_pats);
13183
13184 return 0;
13185 }
13186
nl80211_send_wowlan_tcp(struct sk_buff * msg,struct cfg80211_wowlan_tcp * tcp)13187 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
13188 struct cfg80211_wowlan_tcp *tcp)
13189 {
13190 struct nlattr *nl_tcp;
13191
13192 if (!tcp)
13193 return 0;
13194
13195 nl_tcp = nla_nest_start_noflag(msg,
13196 NL80211_WOWLAN_TRIG_TCP_CONNECTION);
13197 if (!nl_tcp)
13198 return -ENOBUFS;
13199
13200 if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
13201 nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
13202 nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
13203 nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
13204 nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
13205 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
13206 tcp->payload_len, tcp->payload) ||
13207 nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
13208 tcp->data_interval) ||
13209 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
13210 tcp->wake_len, tcp->wake_data) ||
13211 nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
13212 DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
13213 return -ENOBUFS;
13214
13215 if (tcp->payload_seq.len &&
13216 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
13217 sizeof(tcp->payload_seq), &tcp->payload_seq))
13218 return -ENOBUFS;
13219
13220 if (tcp->payload_tok.len &&
13221 nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
13222 sizeof(tcp->payload_tok) + tcp->tokens_size,
13223 &tcp->payload_tok))
13224 return -ENOBUFS;
13225
13226 nla_nest_end(msg, nl_tcp);
13227
13228 return 0;
13229 }
13230
nl80211_send_wowlan_nd(struct sk_buff * msg,struct cfg80211_sched_scan_request * req)13231 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
13232 struct cfg80211_sched_scan_request *req)
13233 {
13234 struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
13235 int i;
13236
13237 if (!req)
13238 return 0;
13239
13240 nd = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
13241 if (!nd)
13242 return -ENOBUFS;
13243
13244 if (req->n_scan_plans == 1 &&
13245 nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
13246 req->scan_plans[0].interval * 1000))
13247 return -ENOBUFS;
13248
13249 if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
13250 return -ENOBUFS;
13251
13252 if (req->relative_rssi_set) {
13253 struct nl80211_bss_select_rssi_adjust rssi_adjust;
13254
13255 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
13256 req->relative_rssi))
13257 return -ENOBUFS;
13258
13259 rssi_adjust.band = req->rssi_adjust.band;
13260 rssi_adjust.delta = req->rssi_adjust.delta;
13261 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
13262 sizeof(rssi_adjust), &rssi_adjust))
13263 return -ENOBUFS;
13264 }
13265
13266 freqs = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_FREQUENCIES);
13267 if (!freqs)
13268 return -ENOBUFS;
13269
13270 for (i = 0; i < req->n_channels; i++) {
13271 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
13272 return -ENOBUFS;
13273 }
13274
13275 nla_nest_end(msg, freqs);
13276
13277 if (req->n_match_sets) {
13278 matches = nla_nest_start_noflag(msg,
13279 NL80211_ATTR_SCHED_SCAN_MATCH);
13280 if (!matches)
13281 return -ENOBUFS;
13282
13283 for (i = 0; i < req->n_match_sets; i++) {
13284 match = nla_nest_start_noflag(msg, i);
13285 if (!match)
13286 return -ENOBUFS;
13287
13288 if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
13289 req->match_sets[i].ssid.ssid_len,
13290 req->match_sets[i].ssid.ssid))
13291 return -ENOBUFS;
13292 nla_nest_end(msg, match);
13293 }
13294 nla_nest_end(msg, matches);
13295 }
13296
13297 scan_plans = nla_nest_start_noflag(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
13298 if (!scan_plans)
13299 return -ENOBUFS;
13300
13301 for (i = 0; i < req->n_scan_plans; i++) {
13302 scan_plan = nla_nest_start_noflag(msg, i + 1);
13303 if (!scan_plan)
13304 return -ENOBUFS;
13305
13306 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
13307 req->scan_plans[i].interval) ||
13308 (req->scan_plans[i].iterations &&
13309 nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
13310 req->scan_plans[i].iterations)))
13311 return -ENOBUFS;
13312 nla_nest_end(msg, scan_plan);
13313 }
13314 nla_nest_end(msg, scan_plans);
13315
13316 nla_nest_end(msg, nd);
13317
13318 return 0;
13319 }
13320
nl80211_get_wowlan(struct sk_buff * skb,struct genl_info * info)13321 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
13322 {
13323 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13324 struct sk_buff *msg;
13325 void *hdr;
13326 u32 size = NLMSG_DEFAULT_SIZE;
13327
13328 if (!rdev->wiphy.wowlan)
13329 return -EOPNOTSUPP;
13330
13331 if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
13332 /* adjust size to have room for all the data */
13333 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
13334 rdev->wiphy.wowlan_config->tcp->payload_len +
13335 rdev->wiphy.wowlan_config->tcp->wake_len +
13336 rdev->wiphy.wowlan_config->tcp->wake_len / 8;
13337 }
13338
13339 msg = nlmsg_new(size, GFP_KERNEL);
13340 if (!msg)
13341 return -ENOMEM;
13342
13343 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13344 NL80211_CMD_GET_WOWLAN);
13345 if (!hdr)
13346 goto nla_put_failure;
13347
13348 if (rdev->wiphy.wowlan_config) {
13349 struct nlattr *nl_wowlan;
13350
13351 nl_wowlan = nla_nest_start_noflag(msg,
13352 NL80211_ATTR_WOWLAN_TRIGGERS);
13353 if (!nl_wowlan)
13354 goto nla_put_failure;
13355
13356 if ((rdev->wiphy.wowlan_config->any &&
13357 nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
13358 (rdev->wiphy.wowlan_config->disconnect &&
13359 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
13360 (rdev->wiphy.wowlan_config->magic_pkt &&
13361 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
13362 (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
13363 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
13364 (rdev->wiphy.wowlan_config->eap_identity_req &&
13365 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
13366 (rdev->wiphy.wowlan_config->four_way_handshake &&
13367 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
13368 (rdev->wiphy.wowlan_config->rfkill_release &&
13369 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
13370 goto nla_put_failure;
13371
13372 if (nl80211_send_wowlan_patterns(msg, rdev))
13373 goto nla_put_failure;
13374
13375 if (nl80211_send_wowlan_tcp(msg,
13376 rdev->wiphy.wowlan_config->tcp))
13377 goto nla_put_failure;
13378
13379 if (nl80211_send_wowlan_nd(
13380 msg,
13381 rdev->wiphy.wowlan_config->nd_config))
13382 goto nla_put_failure;
13383
13384 nla_nest_end(msg, nl_wowlan);
13385 }
13386
13387 genlmsg_end(msg, hdr);
13388 return genlmsg_reply(msg, info);
13389
13390 nla_put_failure:
13391 nlmsg_free(msg);
13392 return -ENOBUFS;
13393 }
13394
nl80211_parse_wowlan_tcp(struct cfg80211_registered_device * rdev,struct nlattr * attr,struct cfg80211_wowlan * trig)13395 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
13396 struct nlattr *attr,
13397 struct cfg80211_wowlan *trig)
13398 {
13399 struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
13400 struct cfg80211_wowlan_tcp *cfg;
13401 struct nl80211_wowlan_tcp_data_token *tok = NULL;
13402 struct nl80211_wowlan_tcp_data_seq *seq = NULL;
13403 u32 size;
13404 u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
13405 int err, port;
13406
13407 if (!rdev->wiphy.wowlan->tcp)
13408 return -EINVAL;
13409
13410 err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TCP, attr,
13411 nl80211_wowlan_tcp_policy, NULL);
13412 if (err)
13413 return err;
13414
13415 if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
13416 !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
13417 !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
13418 !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
13419 !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
13420 !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
13421 !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
13422 !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
13423 return -EINVAL;
13424
13425 data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
13426 if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
13427 return -EINVAL;
13428
13429 if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
13430 rdev->wiphy.wowlan->tcp->data_interval_max ||
13431 nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
13432 return -EINVAL;
13433
13434 wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
13435 if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
13436 return -EINVAL;
13437
13438 wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
13439 if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
13440 return -EINVAL;
13441
13442 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
13443 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
13444
13445 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
13446 tokens_size = tokln - sizeof(*tok);
13447
13448 if (!tok->len || tokens_size % tok->len)
13449 return -EINVAL;
13450 if (!rdev->wiphy.wowlan->tcp->tok)
13451 return -EINVAL;
13452 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
13453 return -EINVAL;
13454 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
13455 return -EINVAL;
13456 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
13457 return -EINVAL;
13458 if (tok->offset + tok->len > data_size)
13459 return -EINVAL;
13460 }
13461
13462 if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
13463 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
13464 if (!rdev->wiphy.wowlan->tcp->seq)
13465 return -EINVAL;
13466 if (seq->len == 0 || seq->len > 4)
13467 return -EINVAL;
13468 if (seq->len + seq->offset > data_size)
13469 return -EINVAL;
13470 }
13471
13472 size = sizeof(*cfg);
13473 size += data_size;
13474 size += wake_size + wake_mask_size;
13475 size += tokens_size;
13476
13477 cfg = kzalloc(size, GFP_KERNEL);
13478 if (!cfg)
13479 return -ENOMEM;
13480 cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
13481 cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
13482 memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
13483 ETH_ALEN);
13484 if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
13485 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
13486 else
13487 port = 0;
13488 #ifdef CONFIG_INET
13489 /* allocate a socket and port for it and use it */
13490 err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
13491 IPPROTO_TCP, &cfg->sock, 1);
13492 if (err) {
13493 kfree(cfg);
13494 return err;
13495 }
13496 if (inet_csk_get_port(cfg->sock->sk, port)) {
13497 sock_release(cfg->sock);
13498 kfree(cfg);
13499 return -EADDRINUSE;
13500 }
13501 cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
13502 #else
13503 if (!port) {
13504 kfree(cfg);
13505 return -EINVAL;
13506 }
13507 cfg->src_port = port;
13508 #endif
13509
13510 cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
13511 cfg->payload_len = data_size;
13512 cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
13513 memcpy((void *)cfg->payload,
13514 nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
13515 data_size);
13516 if (seq)
13517 cfg->payload_seq = *seq;
13518 cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
13519 cfg->wake_len = wake_size;
13520 cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
13521 memcpy((void *)cfg->wake_data,
13522 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
13523 wake_size);
13524 cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
13525 data_size + wake_size;
13526 memcpy((void *)cfg->wake_mask,
13527 nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
13528 wake_mask_size);
13529 if (tok) {
13530 cfg->tokens_size = tokens_size;
13531 cfg->payload_tok = *tok;
13532 memcpy(cfg->payload_tok.token_stream, tok->token_stream,
13533 tokens_size);
13534 }
13535
13536 trig->tcp = cfg;
13537
13538 return 0;
13539 }
13540
nl80211_parse_wowlan_nd(struct cfg80211_registered_device * rdev,const struct wiphy_wowlan_support * wowlan,struct nlattr * attr,struct cfg80211_wowlan * trig)13541 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
13542 const struct wiphy_wowlan_support *wowlan,
13543 struct nlattr *attr,
13544 struct cfg80211_wowlan *trig)
13545 {
13546 struct nlattr **tb;
13547 int err;
13548
13549 tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
13550 if (!tb)
13551 return -ENOMEM;
13552
13553 if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
13554 err = -EOPNOTSUPP;
13555 goto out;
13556 }
13557
13558 err = nla_parse_nested_deprecated(tb, NL80211_ATTR_MAX, attr,
13559 nl80211_policy, NULL);
13560 if (err)
13561 goto out;
13562
13563 trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
13564 wowlan->max_nd_match_sets);
13565 err = PTR_ERR_OR_ZERO(trig->nd_config);
13566 if (err)
13567 trig->nd_config = NULL;
13568
13569 out:
13570 kfree(tb);
13571 return err;
13572 }
13573
nl80211_set_wowlan(struct sk_buff * skb,struct genl_info * info)13574 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
13575 {
13576 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13577 struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
13578 struct cfg80211_wowlan new_triggers = {};
13579 struct cfg80211_wowlan *ntrig;
13580 const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
13581 int err, i;
13582 bool prev_enabled = rdev->wiphy.wowlan_config;
13583 bool regular = false;
13584
13585 if (!wowlan)
13586 return -EOPNOTSUPP;
13587
13588 if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
13589 cfg80211_rdev_free_wowlan(rdev);
13590 rdev->wiphy.wowlan_config = NULL;
13591 goto set_wakeup;
13592 }
13593
13594 err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TRIG,
13595 info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
13596 nl80211_wowlan_policy, info->extack);
13597 if (err)
13598 return err;
13599
13600 if (tb[NL80211_WOWLAN_TRIG_ANY]) {
13601 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
13602 return -EINVAL;
13603 new_triggers.any = true;
13604 }
13605
13606 if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
13607 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
13608 return -EINVAL;
13609 new_triggers.disconnect = true;
13610 regular = true;
13611 }
13612
13613 if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
13614 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
13615 return -EINVAL;
13616 new_triggers.magic_pkt = true;
13617 regular = true;
13618 }
13619
13620 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
13621 return -EINVAL;
13622
13623 if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
13624 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
13625 return -EINVAL;
13626 new_triggers.gtk_rekey_failure = true;
13627 regular = true;
13628 }
13629
13630 if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
13631 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
13632 return -EINVAL;
13633 new_triggers.eap_identity_req = true;
13634 regular = true;
13635 }
13636
13637 if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
13638 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
13639 return -EINVAL;
13640 new_triggers.four_way_handshake = true;
13641 regular = true;
13642 }
13643
13644 if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
13645 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
13646 return -EINVAL;
13647 new_triggers.rfkill_release = true;
13648 regular = true;
13649 }
13650
13651 if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
13652 struct nlattr *pat;
13653 int n_patterns = 0;
13654 int rem, pat_len, mask_len, pkt_offset;
13655 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
13656
13657 regular = true;
13658
13659 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
13660 rem)
13661 n_patterns++;
13662 if (n_patterns > wowlan->n_patterns)
13663 return -EINVAL;
13664
13665 new_triggers.patterns = kcalloc(n_patterns,
13666 sizeof(new_triggers.patterns[0]),
13667 GFP_KERNEL);
13668 if (!new_triggers.patterns)
13669 return -ENOMEM;
13670
13671 new_triggers.n_patterns = n_patterns;
13672 i = 0;
13673
13674 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
13675 rem) {
13676 u8 *mask_pat;
13677
13678 err = nla_parse_nested_deprecated(pat_tb,
13679 MAX_NL80211_PKTPAT,
13680 pat,
13681 nl80211_packet_pattern_policy,
13682 info->extack);
13683 if (err)
13684 goto error;
13685
13686 err = -EINVAL;
13687 if (!pat_tb[NL80211_PKTPAT_MASK] ||
13688 !pat_tb[NL80211_PKTPAT_PATTERN])
13689 goto error;
13690 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
13691 mask_len = DIV_ROUND_UP(pat_len, 8);
13692 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
13693 goto error;
13694 if (pat_len > wowlan->pattern_max_len ||
13695 pat_len < wowlan->pattern_min_len)
13696 goto error;
13697
13698 if (!pat_tb[NL80211_PKTPAT_OFFSET])
13699 pkt_offset = 0;
13700 else
13701 pkt_offset = nla_get_u32(
13702 pat_tb[NL80211_PKTPAT_OFFSET]);
13703 if (pkt_offset > wowlan->max_pkt_offset)
13704 goto error;
13705 new_triggers.patterns[i].pkt_offset = pkt_offset;
13706
13707 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
13708 if (!mask_pat) {
13709 err = -ENOMEM;
13710 goto error;
13711 }
13712 new_triggers.patterns[i].mask = mask_pat;
13713 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
13714 mask_len);
13715 mask_pat += mask_len;
13716 new_triggers.patterns[i].pattern = mask_pat;
13717 new_triggers.patterns[i].pattern_len = pat_len;
13718 memcpy(mask_pat,
13719 nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
13720 pat_len);
13721 i++;
13722 }
13723 }
13724
13725 if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
13726 regular = true;
13727 err = nl80211_parse_wowlan_tcp(
13728 rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
13729 &new_triggers);
13730 if (err)
13731 goto error;
13732 }
13733
13734 if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
13735 regular = true;
13736 err = nl80211_parse_wowlan_nd(
13737 rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
13738 &new_triggers);
13739 if (err)
13740 goto error;
13741 }
13742
13743 /* The 'any' trigger means the device continues operating more or less
13744 * as in its normal operation mode and wakes up the host on most of the
13745 * normal interrupts (like packet RX, ...)
13746 * It therefore makes little sense to combine with the more constrained
13747 * wakeup trigger modes.
13748 */
13749 if (new_triggers.any && regular) {
13750 err = -EINVAL;
13751 goto error;
13752 }
13753
13754 ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
13755 if (!ntrig) {
13756 err = -ENOMEM;
13757 goto error;
13758 }
13759 cfg80211_rdev_free_wowlan(rdev);
13760 rdev->wiphy.wowlan_config = ntrig;
13761
13762 set_wakeup:
13763 if (rdev->ops->set_wakeup &&
13764 prev_enabled != !!rdev->wiphy.wowlan_config)
13765 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
13766
13767 return 0;
13768 error:
13769 for (i = 0; i < new_triggers.n_patterns; i++)
13770 kfree(new_triggers.patterns[i].mask);
13771 kfree(new_triggers.patterns);
13772 if (new_triggers.tcp && new_triggers.tcp->sock)
13773 sock_release(new_triggers.tcp->sock);
13774 kfree(new_triggers.tcp);
13775 kfree(new_triggers.nd_config);
13776 return err;
13777 }
13778 #endif
13779
nl80211_send_coalesce_rules(struct sk_buff * msg,struct cfg80211_registered_device * rdev)13780 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
13781 struct cfg80211_registered_device *rdev)
13782 {
13783 struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
13784 int i, j, pat_len;
13785 struct cfg80211_coalesce_rules *rule;
13786
13787 if (!rdev->coalesce->n_rules)
13788 return 0;
13789
13790 nl_rules = nla_nest_start_noflag(msg, NL80211_ATTR_COALESCE_RULE);
13791 if (!nl_rules)
13792 return -ENOBUFS;
13793
13794 for (i = 0; i < rdev->coalesce->n_rules; i++) {
13795 nl_rule = nla_nest_start_noflag(msg, i + 1);
13796 if (!nl_rule)
13797 return -ENOBUFS;
13798
13799 rule = &rdev->coalesce->rules[i];
13800 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
13801 rule->delay))
13802 return -ENOBUFS;
13803
13804 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
13805 rule->condition))
13806 return -ENOBUFS;
13807
13808 nl_pats = nla_nest_start_noflag(msg,
13809 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
13810 if (!nl_pats)
13811 return -ENOBUFS;
13812
13813 for (j = 0; j < rule->n_patterns; j++) {
13814 nl_pat = nla_nest_start_noflag(msg, j + 1);
13815 if (!nl_pat)
13816 return -ENOBUFS;
13817 pat_len = rule->patterns[j].pattern_len;
13818 if (nla_put(msg, NL80211_PKTPAT_MASK,
13819 DIV_ROUND_UP(pat_len, 8),
13820 rule->patterns[j].mask) ||
13821 nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
13822 rule->patterns[j].pattern) ||
13823 nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
13824 rule->patterns[j].pkt_offset))
13825 return -ENOBUFS;
13826 nla_nest_end(msg, nl_pat);
13827 }
13828 nla_nest_end(msg, nl_pats);
13829 nla_nest_end(msg, nl_rule);
13830 }
13831 nla_nest_end(msg, nl_rules);
13832
13833 return 0;
13834 }
13835
nl80211_get_coalesce(struct sk_buff * skb,struct genl_info * info)13836 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
13837 {
13838 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13839 struct sk_buff *msg;
13840 void *hdr;
13841
13842 if (!rdev->wiphy.coalesce)
13843 return -EOPNOTSUPP;
13844
13845 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13846 if (!msg)
13847 return -ENOMEM;
13848
13849 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13850 NL80211_CMD_GET_COALESCE);
13851 if (!hdr)
13852 goto nla_put_failure;
13853
13854 if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
13855 goto nla_put_failure;
13856
13857 genlmsg_end(msg, hdr);
13858 return genlmsg_reply(msg, info);
13859
13860 nla_put_failure:
13861 nlmsg_free(msg);
13862 return -ENOBUFS;
13863 }
13864
cfg80211_rdev_free_coalesce(struct cfg80211_registered_device * rdev)13865 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
13866 {
13867 struct cfg80211_coalesce *coalesce = rdev->coalesce;
13868 int i, j;
13869 struct cfg80211_coalesce_rules *rule;
13870
13871 if (!coalesce)
13872 return;
13873
13874 for (i = 0; i < coalesce->n_rules; i++) {
13875 rule = &coalesce->rules[i];
13876 for (j = 0; j < rule->n_patterns; j++)
13877 kfree(rule->patterns[j].mask);
13878 kfree(rule->patterns);
13879 }
13880 kfree(coalesce->rules);
13881 kfree(coalesce);
13882 rdev->coalesce = NULL;
13883 }
13884
nl80211_parse_coalesce_rule(struct cfg80211_registered_device * rdev,struct nlattr * rule,struct cfg80211_coalesce_rules * new_rule)13885 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
13886 struct nlattr *rule,
13887 struct cfg80211_coalesce_rules *new_rule)
13888 {
13889 int err, i;
13890 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
13891 struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
13892 int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
13893 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
13894
13895 err = nla_parse_nested_deprecated(tb, NL80211_ATTR_COALESCE_RULE_MAX,
13896 rule, nl80211_coalesce_policy, NULL);
13897 if (err)
13898 return err;
13899
13900 if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
13901 new_rule->delay =
13902 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
13903 if (new_rule->delay > coalesce->max_delay)
13904 return -EINVAL;
13905
13906 if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
13907 new_rule->condition =
13908 nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
13909
13910 if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
13911 return -EINVAL;
13912
13913 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
13914 rem)
13915 n_patterns++;
13916 if (n_patterns > coalesce->n_patterns)
13917 return -EINVAL;
13918
13919 new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
13920 GFP_KERNEL);
13921 if (!new_rule->patterns)
13922 return -ENOMEM;
13923
13924 new_rule->n_patterns = n_patterns;
13925 i = 0;
13926
13927 nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
13928 rem) {
13929 u8 *mask_pat;
13930
13931 err = nla_parse_nested_deprecated(pat_tb, MAX_NL80211_PKTPAT,
13932 pat,
13933 nl80211_packet_pattern_policy,
13934 NULL);
13935 if (err)
13936 return err;
13937
13938 if (!pat_tb[NL80211_PKTPAT_MASK] ||
13939 !pat_tb[NL80211_PKTPAT_PATTERN])
13940 return -EINVAL;
13941 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
13942 mask_len = DIV_ROUND_UP(pat_len, 8);
13943 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
13944 return -EINVAL;
13945 if (pat_len > coalesce->pattern_max_len ||
13946 pat_len < coalesce->pattern_min_len)
13947 return -EINVAL;
13948
13949 if (!pat_tb[NL80211_PKTPAT_OFFSET])
13950 pkt_offset = 0;
13951 else
13952 pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
13953 if (pkt_offset > coalesce->max_pkt_offset)
13954 return -EINVAL;
13955 new_rule->patterns[i].pkt_offset = pkt_offset;
13956
13957 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
13958 if (!mask_pat)
13959 return -ENOMEM;
13960
13961 new_rule->patterns[i].mask = mask_pat;
13962 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
13963 mask_len);
13964
13965 mask_pat += mask_len;
13966 new_rule->patterns[i].pattern = mask_pat;
13967 new_rule->patterns[i].pattern_len = pat_len;
13968 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
13969 pat_len);
13970 i++;
13971 }
13972
13973 return 0;
13974 }
13975
nl80211_set_coalesce(struct sk_buff * skb,struct genl_info * info)13976 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
13977 {
13978 struct cfg80211_registered_device *rdev = info->user_ptr[0];
13979 const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
13980 struct cfg80211_coalesce new_coalesce = {};
13981 struct cfg80211_coalesce *n_coalesce;
13982 int err, rem_rule, n_rules = 0, i, j;
13983 struct nlattr *rule;
13984 struct cfg80211_coalesce_rules *tmp_rule;
13985
13986 if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
13987 return -EOPNOTSUPP;
13988
13989 if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
13990 cfg80211_rdev_free_coalesce(rdev);
13991 rdev_set_coalesce(rdev, NULL);
13992 return 0;
13993 }
13994
13995 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
13996 rem_rule)
13997 n_rules++;
13998 if (n_rules > coalesce->n_rules)
13999 return -EINVAL;
14000
14001 new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
14002 GFP_KERNEL);
14003 if (!new_coalesce.rules)
14004 return -ENOMEM;
14005
14006 new_coalesce.n_rules = n_rules;
14007 i = 0;
14008
14009 nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
14010 rem_rule) {
14011 err = nl80211_parse_coalesce_rule(rdev, rule,
14012 &new_coalesce.rules[i]);
14013 if (err)
14014 goto error;
14015
14016 i++;
14017 }
14018
14019 err = rdev_set_coalesce(rdev, &new_coalesce);
14020 if (err)
14021 goto error;
14022
14023 n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
14024 if (!n_coalesce) {
14025 err = -ENOMEM;
14026 goto error;
14027 }
14028 cfg80211_rdev_free_coalesce(rdev);
14029 rdev->coalesce = n_coalesce;
14030
14031 return 0;
14032 error:
14033 for (i = 0; i < new_coalesce.n_rules; i++) {
14034 tmp_rule = &new_coalesce.rules[i];
14035 for (j = 0; j < tmp_rule->n_patterns; j++)
14036 kfree(tmp_rule->patterns[j].mask);
14037 kfree(tmp_rule->patterns);
14038 }
14039 kfree(new_coalesce.rules);
14040
14041 return err;
14042 }
14043
nl80211_set_rekey_data(struct sk_buff * skb,struct genl_info * info)14044 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
14045 {
14046 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14047 struct net_device *dev = info->user_ptr[1];
14048 struct wireless_dev *wdev = dev->ieee80211_ptr;
14049 struct nlattr *tb[NUM_NL80211_REKEY_DATA];
14050 struct cfg80211_gtk_rekey_data rekey_data = {};
14051 int err;
14052
14053 if (!info->attrs[NL80211_ATTR_REKEY_DATA])
14054 return -EINVAL;
14055
14056 err = nla_parse_nested_deprecated(tb, MAX_NL80211_REKEY_DATA,
14057 info->attrs[NL80211_ATTR_REKEY_DATA],
14058 nl80211_rekey_policy, info->extack);
14059 if (err)
14060 return err;
14061
14062 if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
14063 !tb[NL80211_REKEY_DATA_KCK])
14064 return -EINVAL;
14065 if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN &&
14066 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
14067 nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KEK_EXT_LEN))
14068 return -ERANGE;
14069 if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN &&
14070 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
14071 nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN) &&
14072 !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KCK_32 &&
14073 nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN_32))
14074 return -ERANGE;
14075
14076 rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
14077 rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
14078 rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
14079 rekey_data.kek_len = nla_len(tb[NL80211_REKEY_DATA_KEK]);
14080 rekey_data.kck_len = nla_len(tb[NL80211_REKEY_DATA_KCK]);
14081 if (tb[NL80211_REKEY_DATA_AKM])
14082 rekey_data.akm = nla_get_u32(tb[NL80211_REKEY_DATA_AKM]);
14083
14084 wdev_lock(wdev);
14085 if (!wdev->connected) {
14086 err = -ENOTCONN;
14087 goto out;
14088 }
14089
14090 if (!rdev->ops->set_rekey_data) {
14091 err = -EOPNOTSUPP;
14092 goto out;
14093 }
14094
14095 err = rdev_set_rekey_data(rdev, dev, &rekey_data);
14096 out:
14097 wdev_unlock(wdev);
14098 return err;
14099 }
14100
nl80211_register_unexpected_frame(struct sk_buff * skb,struct genl_info * info)14101 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
14102 struct genl_info *info)
14103 {
14104 struct net_device *dev = info->user_ptr[1];
14105 struct wireless_dev *wdev = dev->ieee80211_ptr;
14106
14107 if (wdev->iftype != NL80211_IFTYPE_AP &&
14108 wdev->iftype != NL80211_IFTYPE_P2P_GO)
14109 return -EINVAL;
14110
14111 if (wdev->ap_unexpected_nlportid)
14112 return -EBUSY;
14113
14114 wdev->ap_unexpected_nlportid = info->snd_portid;
14115 return 0;
14116 }
14117
nl80211_probe_client(struct sk_buff * skb,struct genl_info * info)14118 static int nl80211_probe_client(struct sk_buff *skb,
14119 struct genl_info *info)
14120 {
14121 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14122 struct net_device *dev = info->user_ptr[1];
14123 struct wireless_dev *wdev = dev->ieee80211_ptr;
14124 struct sk_buff *msg;
14125 void *hdr;
14126 const u8 *addr;
14127 u64 cookie;
14128 int err;
14129
14130 if (wdev->iftype != NL80211_IFTYPE_AP &&
14131 wdev->iftype != NL80211_IFTYPE_P2P_GO)
14132 return -EOPNOTSUPP;
14133
14134 if (!info->attrs[NL80211_ATTR_MAC])
14135 return -EINVAL;
14136
14137 if (!rdev->ops->probe_client)
14138 return -EOPNOTSUPP;
14139
14140 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14141 if (!msg)
14142 return -ENOMEM;
14143
14144 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14145 NL80211_CMD_PROBE_CLIENT);
14146 if (!hdr) {
14147 err = -ENOBUFS;
14148 goto free_msg;
14149 }
14150
14151 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
14152
14153 err = rdev_probe_client(rdev, dev, addr, &cookie);
14154 if (err)
14155 goto free_msg;
14156
14157 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14158 NL80211_ATTR_PAD))
14159 goto nla_put_failure;
14160
14161 genlmsg_end(msg, hdr);
14162
14163 return genlmsg_reply(msg, info);
14164
14165 nla_put_failure:
14166 err = -ENOBUFS;
14167 free_msg:
14168 nlmsg_free(msg);
14169 return err;
14170 }
14171
nl80211_register_beacons(struct sk_buff * skb,struct genl_info * info)14172 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
14173 {
14174 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14175 struct cfg80211_beacon_registration *reg, *nreg;
14176 int rv;
14177
14178 if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
14179 return -EOPNOTSUPP;
14180
14181 nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
14182 if (!nreg)
14183 return -ENOMEM;
14184
14185 /* First, check if already registered. */
14186 spin_lock_bh(&rdev->beacon_registrations_lock);
14187 list_for_each_entry(reg, &rdev->beacon_registrations, list) {
14188 if (reg->nlportid == info->snd_portid) {
14189 rv = -EALREADY;
14190 goto out_err;
14191 }
14192 }
14193 /* Add it to the list */
14194 nreg->nlportid = info->snd_portid;
14195 list_add(&nreg->list, &rdev->beacon_registrations);
14196
14197 spin_unlock_bh(&rdev->beacon_registrations_lock);
14198
14199 return 0;
14200 out_err:
14201 spin_unlock_bh(&rdev->beacon_registrations_lock);
14202 kfree(nreg);
14203 return rv;
14204 }
14205
nl80211_start_p2p_device(struct sk_buff * skb,struct genl_info * info)14206 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
14207 {
14208 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14209 struct wireless_dev *wdev = info->user_ptr[1];
14210 int err;
14211
14212 if (!rdev->ops->start_p2p_device)
14213 return -EOPNOTSUPP;
14214
14215 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
14216 return -EOPNOTSUPP;
14217
14218 if (wdev_running(wdev))
14219 return 0;
14220
14221 if (rfkill_blocked(rdev->wiphy.rfkill))
14222 return -ERFKILL;
14223
14224 err = rdev_start_p2p_device(rdev, wdev);
14225 if (err)
14226 return err;
14227
14228 wdev->is_running = true;
14229 rdev->opencount++;
14230
14231 return 0;
14232 }
14233
nl80211_stop_p2p_device(struct sk_buff * skb,struct genl_info * info)14234 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
14235 {
14236 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14237 struct wireless_dev *wdev = info->user_ptr[1];
14238
14239 if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
14240 return -EOPNOTSUPP;
14241
14242 if (!rdev->ops->stop_p2p_device)
14243 return -EOPNOTSUPP;
14244
14245 cfg80211_stop_p2p_device(rdev, wdev);
14246
14247 return 0;
14248 }
14249
nl80211_start_nan(struct sk_buff * skb,struct genl_info * info)14250 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
14251 {
14252 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14253 struct wireless_dev *wdev = info->user_ptr[1];
14254 struct cfg80211_nan_conf conf = {};
14255 int err;
14256
14257 if (wdev->iftype != NL80211_IFTYPE_NAN)
14258 return -EOPNOTSUPP;
14259
14260 if (wdev_running(wdev))
14261 return -EEXIST;
14262
14263 if (rfkill_blocked(rdev->wiphy.rfkill))
14264 return -ERFKILL;
14265
14266 if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
14267 return -EINVAL;
14268
14269 conf.master_pref =
14270 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
14271
14272 if (info->attrs[NL80211_ATTR_BANDS]) {
14273 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
14274
14275 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
14276 return -EOPNOTSUPP;
14277
14278 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
14279 return -EINVAL;
14280
14281 conf.bands = bands;
14282 }
14283
14284 err = rdev_start_nan(rdev, wdev, &conf);
14285 if (err)
14286 return err;
14287
14288 wdev->is_running = true;
14289 rdev->opencount++;
14290
14291 return 0;
14292 }
14293
nl80211_stop_nan(struct sk_buff * skb,struct genl_info * info)14294 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
14295 {
14296 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14297 struct wireless_dev *wdev = info->user_ptr[1];
14298
14299 if (wdev->iftype != NL80211_IFTYPE_NAN)
14300 return -EOPNOTSUPP;
14301
14302 cfg80211_stop_nan(rdev, wdev);
14303
14304 return 0;
14305 }
14306
validate_nan_filter(struct nlattr * filter_attr)14307 static int validate_nan_filter(struct nlattr *filter_attr)
14308 {
14309 struct nlattr *attr;
14310 int len = 0, n_entries = 0, rem;
14311
14312 nla_for_each_nested(attr, filter_attr, rem) {
14313 len += nla_len(attr);
14314 n_entries++;
14315 }
14316
14317 if (len >= U8_MAX)
14318 return -EINVAL;
14319
14320 return n_entries;
14321 }
14322
handle_nan_filter(struct nlattr * attr_filter,struct cfg80211_nan_func * func,bool tx)14323 static int handle_nan_filter(struct nlattr *attr_filter,
14324 struct cfg80211_nan_func *func,
14325 bool tx)
14326 {
14327 struct nlattr *attr;
14328 int n_entries, rem, i;
14329 struct cfg80211_nan_func_filter *filter;
14330
14331 n_entries = validate_nan_filter(attr_filter);
14332 if (n_entries < 0)
14333 return n_entries;
14334
14335 BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
14336
14337 filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
14338 if (!filter)
14339 return -ENOMEM;
14340
14341 i = 0;
14342 nla_for_each_nested(attr, attr_filter, rem) {
14343 filter[i].filter = nla_memdup(attr, GFP_KERNEL);
14344 if (!filter[i].filter)
14345 goto err;
14346
14347 filter[i].len = nla_len(attr);
14348 i++;
14349 }
14350 if (tx) {
14351 func->num_tx_filters = n_entries;
14352 func->tx_filters = filter;
14353 } else {
14354 func->num_rx_filters = n_entries;
14355 func->rx_filters = filter;
14356 }
14357
14358 return 0;
14359
14360 err:
14361 i = 0;
14362 nla_for_each_nested(attr, attr_filter, rem) {
14363 kfree(filter[i].filter);
14364 i++;
14365 }
14366 kfree(filter);
14367 return -ENOMEM;
14368 }
14369
nl80211_nan_add_func(struct sk_buff * skb,struct genl_info * info)14370 static int nl80211_nan_add_func(struct sk_buff *skb,
14371 struct genl_info *info)
14372 {
14373 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14374 struct wireless_dev *wdev = info->user_ptr[1];
14375 struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
14376 struct cfg80211_nan_func *func;
14377 struct sk_buff *msg = NULL;
14378 void *hdr = NULL;
14379 int err = 0;
14380
14381 if (wdev->iftype != NL80211_IFTYPE_NAN)
14382 return -EOPNOTSUPP;
14383
14384 if (!wdev_running(wdev))
14385 return -ENOTCONN;
14386
14387 if (!info->attrs[NL80211_ATTR_NAN_FUNC])
14388 return -EINVAL;
14389
14390 err = nla_parse_nested_deprecated(tb, NL80211_NAN_FUNC_ATTR_MAX,
14391 info->attrs[NL80211_ATTR_NAN_FUNC],
14392 nl80211_nan_func_policy,
14393 info->extack);
14394 if (err)
14395 return err;
14396
14397 func = kzalloc(sizeof(*func), GFP_KERNEL);
14398 if (!func)
14399 return -ENOMEM;
14400
14401 func->cookie = cfg80211_assign_cookie(rdev);
14402
14403 if (!tb[NL80211_NAN_FUNC_TYPE]) {
14404 err = -EINVAL;
14405 goto out;
14406 }
14407
14408
14409 func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
14410
14411 if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
14412 err = -EINVAL;
14413 goto out;
14414 }
14415
14416 memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
14417 sizeof(func->service_id));
14418
14419 func->close_range =
14420 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
14421
14422 if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
14423 func->serv_spec_info_len =
14424 nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
14425 func->serv_spec_info =
14426 kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
14427 func->serv_spec_info_len,
14428 GFP_KERNEL);
14429 if (!func->serv_spec_info) {
14430 err = -ENOMEM;
14431 goto out;
14432 }
14433 }
14434
14435 if (tb[NL80211_NAN_FUNC_TTL])
14436 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
14437
14438 switch (func->type) {
14439 case NL80211_NAN_FUNC_PUBLISH:
14440 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
14441 err = -EINVAL;
14442 goto out;
14443 }
14444
14445 func->publish_type =
14446 nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
14447 func->publish_bcast =
14448 nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
14449
14450 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
14451 func->publish_bcast) {
14452 err = -EINVAL;
14453 goto out;
14454 }
14455 break;
14456 case NL80211_NAN_FUNC_SUBSCRIBE:
14457 func->subscribe_active =
14458 nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
14459 break;
14460 case NL80211_NAN_FUNC_FOLLOW_UP:
14461 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
14462 !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
14463 !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
14464 err = -EINVAL;
14465 goto out;
14466 }
14467
14468 func->followup_id =
14469 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
14470 func->followup_reqid =
14471 nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
14472 memcpy(func->followup_dest.addr,
14473 nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
14474 sizeof(func->followup_dest.addr));
14475 if (func->ttl) {
14476 err = -EINVAL;
14477 goto out;
14478 }
14479 break;
14480 default:
14481 err = -EINVAL;
14482 goto out;
14483 }
14484
14485 if (tb[NL80211_NAN_FUNC_SRF]) {
14486 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
14487
14488 err = nla_parse_nested_deprecated(srf_tb,
14489 NL80211_NAN_SRF_ATTR_MAX,
14490 tb[NL80211_NAN_FUNC_SRF],
14491 nl80211_nan_srf_policy,
14492 info->extack);
14493 if (err)
14494 goto out;
14495
14496 func->srf_include =
14497 nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
14498
14499 if (srf_tb[NL80211_NAN_SRF_BF]) {
14500 if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
14501 !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
14502 err = -EINVAL;
14503 goto out;
14504 }
14505
14506 func->srf_bf_len =
14507 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
14508 func->srf_bf =
14509 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
14510 func->srf_bf_len, GFP_KERNEL);
14511 if (!func->srf_bf) {
14512 err = -ENOMEM;
14513 goto out;
14514 }
14515
14516 func->srf_bf_idx =
14517 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
14518 } else {
14519 struct nlattr *attr, *mac_attr =
14520 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
14521 int n_entries, rem, i = 0;
14522
14523 if (!mac_attr) {
14524 err = -EINVAL;
14525 goto out;
14526 }
14527
14528 n_entries = validate_acl_mac_addrs(mac_attr);
14529 if (n_entries <= 0) {
14530 err = -EINVAL;
14531 goto out;
14532 }
14533
14534 func->srf_num_macs = n_entries;
14535 func->srf_macs =
14536 kcalloc(n_entries, sizeof(*func->srf_macs),
14537 GFP_KERNEL);
14538 if (!func->srf_macs) {
14539 err = -ENOMEM;
14540 goto out;
14541 }
14542
14543 nla_for_each_nested(attr, mac_attr, rem)
14544 memcpy(func->srf_macs[i++].addr, nla_data(attr),
14545 sizeof(*func->srf_macs));
14546 }
14547 }
14548
14549 if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
14550 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
14551 func, true);
14552 if (err)
14553 goto out;
14554 }
14555
14556 if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
14557 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
14558 func, false);
14559 if (err)
14560 goto out;
14561 }
14562
14563 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14564 if (!msg) {
14565 err = -ENOMEM;
14566 goto out;
14567 }
14568
14569 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14570 NL80211_CMD_ADD_NAN_FUNCTION);
14571 /* This can't really happen - we just allocated 4KB */
14572 if (WARN_ON(!hdr)) {
14573 err = -ENOMEM;
14574 goto out;
14575 }
14576
14577 err = rdev_add_nan_func(rdev, wdev, func);
14578 out:
14579 if (err < 0) {
14580 cfg80211_free_nan_func(func);
14581 nlmsg_free(msg);
14582 return err;
14583 }
14584
14585 /* propagate the instance id and cookie to userspace */
14586 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
14587 NL80211_ATTR_PAD))
14588 goto nla_put_failure;
14589
14590 func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
14591 if (!func_attr)
14592 goto nla_put_failure;
14593
14594 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
14595 func->instance_id))
14596 goto nla_put_failure;
14597
14598 nla_nest_end(msg, func_attr);
14599
14600 genlmsg_end(msg, hdr);
14601 return genlmsg_reply(msg, info);
14602
14603 nla_put_failure:
14604 nlmsg_free(msg);
14605 return -ENOBUFS;
14606 }
14607
nl80211_nan_del_func(struct sk_buff * skb,struct genl_info * info)14608 static int nl80211_nan_del_func(struct sk_buff *skb,
14609 struct genl_info *info)
14610 {
14611 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14612 struct wireless_dev *wdev = info->user_ptr[1];
14613 u64 cookie;
14614
14615 if (wdev->iftype != NL80211_IFTYPE_NAN)
14616 return -EOPNOTSUPP;
14617
14618 if (!wdev_running(wdev))
14619 return -ENOTCONN;
14620
14621 if (!info->attrs[NL80211_ATTR_COOKIE])
14622 return -EINVAL;
14623
14624 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
14625
14626 rdev_del_nan_func(rdev, wdev, cookie);
14627
14628 return 0;
14629 }
14630
nl80211_nan_change_config(struct sk_buff * skb,struct genl_info * info)14631 static int nl80211_nan_change_config(struct sk_buff *skb,
14632 struct genl_info *info)
14633 {
14634 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14635 struct wireless_dev *wdev = info->user_ptr[1];
14636 struct cfg80211_nan_conf conf = {};
14637 u32 changed = 0;
14638
14639 if (wdev->iftype != NL80211_IFTYPE_NAN)
14640 return -EOPNOTSUPP;
14641
14642 if (!wdev_running(wdev))
14643 return -ENOTCONN;
14644
14645 if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
14646 conf.master_pref =
14647 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
14648 if (conf.master_pref <= 1 || conf.master_pref == 255)
14649 return -EINVAL;
14650
14651 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
14652 }
14653
14654 if (info->attrs[NL80211_ATTR_BANDS]) {
14655 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
14656
14657 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
14658 return -EOPNOTSUPP;
14659
14660 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
14661 return -EINVAL;
14662
14663 conf.bands = bands;
14664 changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
14665 }
14666
14667 if (!changed)
14668 return -EINVAL;
14669
14670 return rdev_nan_change_conf(rdev, wdev, &conf, changed);
14671 }
14672
cfg80211_nan_match(struct wireless_dev * wdev,struct cfg80211_nan_match_params * match,gfp_t gfp)14673 void cfg80211_nan_match(struct wireless_dev *wdev,
14674 struct cfg80211_nan_match_params *match, gfp_t gfp)
14675 {
14676 struct wiphy *wiphy = wdev->wiphy;
14677 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14678 struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
14679 struct sk_buff *msg;
14680 void *hdr;
14681
14682 if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
14683 return;
14684
14685 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14686 if (!msg)
14687 return;
14688
14689 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
14690 if (!hdr) {
14691 nlmsg_free(msg);
14692 return;
14693 }
14694
14695 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14696 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14697 wdev->netdev->ifindex)) ||
14698 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14699 NL80211_ATTR_PAD))
14700 goto nla_put_failure;
14701
14702 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
14703 NL80211_ATTR_PAD) ||
14704 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
14705 goto nla_put_failure;
14706
14707 match_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_MATCH);
14708 if (!match_attr)
14709 goto nla_put_failure;
14710
14711 local_func_attr = nla_nest_start_noflag(msg,
14712 NL80211_NAN_MATCH_FUNC_LOCAL);
14713 if (!local_func_attr)
14714 goto nla_put_failure;
14715
14716 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
14717 goto nla_put_failure;
14718
14719 nla_nest_end(msg, local_func_attr);
14720
14721 peer_func_attr = nla_nest_start_noflag(msg,
14722 NL80211_NAN_MATCH_FUNC_PEER);
14723 if (!peer_func_attr)
14724 goto nla_put_failure;
14725
14726 if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
14727 nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
14728 goto nla_put_failure;
14729
14730 if (match->info && match->info_len &&
14731 nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
14732 match->info))
14733 goto nla_put_failure;
14734
14735 nla_nest_end(msg, peer_func_attr);
14736 nla_nest_end(msg, match_attr);
14737 genlmsg_end(msg, hdr);
14738
14739 if (!wdev->owner_nlportid)
14740 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
14741 msg, 0, NL80211_MCGRP_NAN, gfp);
14742 else
14743 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
14744 wdev->owner_nlportid);
14745
14746 return;
14747
14748 nla_put_failure:
14749 nlmsg_free(msg);
14750 }
14751 EXPORT_SYMBOL(cfg80211_nan_match);
14752
cfg80211_nan_func_terminated(struct wireless_dev * wdev,u8 inst_id,enum nl80211_nan_func_term_reason reason,u64 cookie,gfp_t gfp)14753 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
14754 u8 inst_id,
14755 enum nl80211_nan_func_term_reason reason,
14756 u64 cookie, gfp_t gfp)
14757 {
14758 struct wiphy *wiphy = wdev->wiphy;
14759 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14760 struct sk_buff *msg;
14761 struct nlattr *func_attr;
14762 void *hdr;
14763
14764 if (WARN_ON(!inst_id))
14765 return;
14766
14767 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14768 if (!msg)
14769 return;
14770
14771 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
14772 if (!hdr) {
14773 nlmsg_free(msg);
14774 return;
14775 }
14776
14777 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14778 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14779 wdev->netdev->ifindex)) ||
14780 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14781 NL80211_ATTR_PAD))
14782 goto nla_put_failure;
14783
14784 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14785 NL80211_ATTR_PAD))
14786 goto nla_put_failure;
14787
14788 func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
14789 if (!func_attr)
14790 goto nla_put_failure;
14791
14792 if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
14793 nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
14794 goto nla_put_failure;
14795
14796 nla_nest_end(msg, func_attr);
14797 genlmsg_end(msg, hdr);
14798
14799 if (!wdev->owner_nlportid)
14800 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
14801 msg, 0, NL80211_MCGRP_NAN, gfp);
14802 else
14803 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
14804 wdev->owner_nlportid);
14805
14806 return;
14807
14808 nla_put_failure:
14809 nlmsg_free(msg);
14810 }
14811 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
14812
nl80211_get_protocol_features(struct sk_buff * skb,struct genl_info * info)14813 static int nl80211_get_protocol_features(struct sk_buff *skb,
14814 struct genl_info *info)
14815 {
14816 void *hdr;
14817 struct sk_buff *msg;
14818
14819 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14820 if (!msg)
14821 return -ENOMEM;
14822
14823 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14824 NL80211_CMD_GET_PROTOCOL_FEATURES);
14825 if (!hdr)
14826 goto nla_put_failure;
14827
14828 if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
14829 NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
14830 goto nla_put_failure;
14831
14832 genlmsg_end(msg, hdr);
14833 return genlmsg_reply(msg, info);
14834
14835 nla_put_failure:
14836 kfree_skb(msg);
14837 return -ENOBUFS;
14838 }
14839
nl80211_update_ft_ies(struct sk_buff * skb,struct genl_info * info)14840 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
14841 {
14842 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14843 struct cfg80211_update_ft_ies_params ft_params;
14844 struct net_device *dev = info->user_ptr[1];
14845
14846 if (!rdev->ops->update_ft_ies)
14847 return -EOPNOTSUPP;
14848
14849 if (!info->attrs[NL80211_ATTR_MDID] ||
14850 !info->attrs[NL80211_ATTR_IE])
14851 return -EINVAL;
14852
14853 memset(&ft_params, 0, sizeof(ft_params));
14854 ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
14855 ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
14856 ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
14857
14858 return rdev_update_ft_ies(rdev, dev, &ft_params);
14859 }
14860
nl80211_crit_protocol_start(struct sk_buff * skb,struct genl_info * info)14861 static int nl80211_crit_protocol_start(struct sk_buff *skb,
14862 struct genl_info *info)
14863 {
14864 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14865 struct wireless_dev *wdev = info->user_ptr[1];
14866 enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
14867 u16 duration;
14868 int ret;
14869
14870 if (!rdev->ops->crit_proto_start)
14871 return -EOPNOTSUPP;
14872
14873 if (WARN_ON(!rdev->ops->crit_proto_stop))
14874 return -EINVAL;
14875
14876 if (rdev->crit_proto_nlportid)
14877 return -EBUSY;
14878
14879 /* determine protocol if provided */
14880 if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
14881 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
14882
14883 if (proto >= NUM_NL80211_CRIT_PROTO)
14884 return -EINVAL;
14885
14886 /* timeout must be provided */
14887 if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
14888 return -EINVAL;
14889
14890 duration =
14891 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
14892
14893 ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
14894 if (!ret)
14895 rdev->crit_proto_nlportid = info->snd_portid;
14896
14897 return ret;
14898 }
14899
nl80211_crit_protocol_stop(struct sk_buff * skb,struct genl_info * info)14900 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
14901 struct genl_info *info)
14902 {
14903 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14904 struct wireless_dev *wdev = info->user_ptr[1];
14905
14906 if (!rdev->ops->crit_proto_stop)
14907 return -EOPNOTSUPP;
14908
14909 if (rdev->crit_proto_nlportid) {
14910 rdev->crit_proto_nlportid = 0;
14911 rdev_crit_proto_stop(rdev, wdev);
14912 }
14913 return 0;
14914 }
14915
nl80211_vendor_check_policy(const struct wiphy_vendor_command * vcmd,struct nlattr * attr,struct netlink_ext_ack * extack)14916 static int nl80211_vendor_check_policy(const struct wiphy_vendor_command *vcmd,
14917 struct nlattr *attr,
14918 struct netlink_ext_ack *extack)
14919 {
14920 if (vcmd->policy == VENDOR_CMD_RAW_DATA) {
14921 if (attr->nla_type & NLA_F_NESTED) {
14922 NL_SET_ERR_MSG_ATTR(extack, attr,
14923 "unexpected nested data");
14924 return -EINVAL;
14925 }
14926
14927 return 0;
14928 }
14929
14930 if (!(attr->nla_type & NLA_F_NESTED)) {
14931 NL_SET_ERR_MSG_ATTR(extack, attr, "expected nested data");
14932 return -EINVAL;
14933 }
14934
14935 return nla_validate_nested(attr, vcmd->maxattr, vcmd->policy, extack);
14936 }
14937
nl80211_vendor_cmd(struct sk_buff * skb,struct genl_info * info)14938 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
14939 {
14940 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14941 struct wireless_dev *wdev =
14942 __cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
14943 info->attrs);
14944 int i, err;
14945 u32 vid, subcmd;
14946
14947 if (!rdev->wiphy.vendor_commands)
14948 return -EOPNOTSUPP;
14949
14950 if (IS_ERR(wdev)) {
14951 err = PTR_ERR(wdev);
14952 if (err != -EINVAL)
14953 return err;
14954 wdev = NULL;
14955 } else if (wdev->wiphy != &rdev->wiphy) {
14956 return -EINVAL;
14957 }
14958
14959 if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
14960 !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
14961 return -EINVAL;
14962
14963 vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
14964 subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
14965 for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
14966 const struct wiphy_vendor_command *vcmd;
14967 void *data = NULL;
14968 int len = 0;
14969
14970 vcmd = &rdev->wiphy.vendor_commands[i];
14971
14972 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
14973 continue;
14974
14975 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
14976 WIPHY_VENDOR_CMD_NEED_NETDEV)) {
14977 if (!wdev)
14978 return -EINVAL;
14979 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
14980 !wdev->netdev)
14981 return -EINVAL;
14982
14983 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
14984 if (!wdev_running(wdev))
14985 return -ENETDOWN;
14986 }
14987 } else {
14988 wdev = NULL;
14989 }
14990
14991 if (!vcmd->doit)
14992 return -EOPNOTSUPP;
14993
14994 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
14995 data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
14996 len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
14997
14998 err = nl80211_vendor_check_policy(vcmd,
14999 info->attrs[NL80211_ATTR_VENDOR_DATA],
15000 info->extack);
15001 if (err)
15002 return err;
15003 }
15004
15005 rdev->cur_cmd_info = info;
15006 err = vcmd->doit(&rdev->wiphy, wdev, data, len);
15007 rdev->cur_cmd_info = NULL;
15008 return err;
15009 }
15010
15011 return -EOPNOTSUPP;
15012 }
15013
nl80211_prepare_vendor_dump(struct sk_buff * skb,struct netlink_callback * cb,struct cfg80211_registered_device ** rdev,struct wireless_dev ** wdev)15014 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
15015 struct netlink_callback *cb,
15016 struct cfg80211_registered_device **rdev,
15017 struct wireless_dev **wdev)
15018 {
15019 struct nlattr **attrbuf;
15020 u32 vid, subcmd;
15021 unsigned int i;
15022 int vcmd_idx = -1;
15023 int err;
15024 void *data = NULL;
15025 unsigned int data_len = 0;
15026
15027 if (cb->args[0]) {
15028 /* subtract the 1 again here */
15029 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
15030 struct wireless_dev *tmp;
15031
15032 if (!wiphy)
15033 return -ENODEV;
15034 *rdev = wiphy_to_rdev(wiphy);
15035 *wdev = NULL;
15036
15037 if (cb->args[1]) {
15038 list_for_each_entry(tmp, &wiphy->wdev_list, list) {
15039 if (tmp->identifier == cb->args[1] - 1) {
15040 *wdev = tmp;
15041 break;
15042 }
15043 }
15044 }
15045
15046 /* keep rtnl locked in successful case */
15047 return 0;
15048 }
15049
15050 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
15051 if (!attrbuf)
15052 return -ENOMEM;
15053
15054 err = nlmsg_parse_deprecated(cb->nlh,
15055 GENL_HDRLEN + nl80211_fam.hdrsize,
15056 attrbuf, nl80211_fam.maxattr,
15057 nl80211_policy, NULL);
15058 if (err)
15059 goto out;
15060
15061 if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
15062 !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) {
15063 err = -EINVAL;
15064 goto out;
15065 }
15066
15067 *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(skb->sk), attrbuf);
15068 if (IS_ERR(*wdev))
15069 *wdev = NULL;
15070
15071 *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
15072 if (IS_ERR(*rdev)) {
15073 err = PTR_ERR(*rdev);
15074 goto out;
15075 }
15076
15077 vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
15078 subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
15079
15080 for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
15081 const struct wiphy_vendor_command *vcmd;
15082
15083 vcmd = &(*rdev)->wiphy.vendor_commands[i];
15084
15085 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
15086 continue;
15087
15088 if (!vcmd->dumpit) {
15089 err = -EOPNOTSUPP;
15090 goto out;
15091 }
15092
15093 vcmd_idx = i;
15094 break;
15095 }
15096
15097 if (vcmd_idx < 0) {
15098 err = -EOPNOTSUPP;
15099 goto out;
15100 }
15101
15102 if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
15103 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
15104 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
15105
15106 err = nl80211_vendor_check_policy(
15107 &(*rdev)->wiphy.vendor_commands[vcmd_idx],
15108 attrbuf[NL80211_ATTR_VENDOR_DATA],
15109 cb->extack);
15110 if (err)
15111 goto out;
15112 }
15113
15114 /* 0 is the first index - add 1 to parse only once */
15115 cb->args[0] = (*rdev)->wiphy_idx + 1;
15116 /* add 1 to know if it was NULL */
15117 cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
15118 cb->args[2] = vcmd_idx;
15119 cb->args[3] = (unsigned long)data;
15120 cb->args[4] = data_len;
15121
15122 /* keep rtnl locked in successful case */
15123 err = 0;
15124 out:
15125 kfree(attrbuf);
15126 return err;
15127 }
15128
nl80211_vendor_cmd_dump(struct sk_buff * skb,struct netlink_callback * cb)15129 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
15130 struct netlink_callback *cb)
15131 {
15132 struct cfg80211_registered_device *rdev;
15133 struct wireless_dev *wdev;
15134 unsigned int vcmd_idx;
15135 const struct wiphy_vendor_command *vcmd;
15136 void *data;
15137 int data_len;
15138 int err;
15139 struct nlattr *vendor_data;
15140
15141 rtnl_lock();
15142 err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
15143 if (err)
15144 goto out;
15145
15146 vcmd_idx = cb->args[2];
15147 data = (void *)cb->args[3];
15148 data_len = cb->args[4];
15149 vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
15150
15151 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
15152 WIPHY_VENDOR_CMD_NEED_NETDEV)) {
15153 if (!wdev) {
15154 err = -EINVAL;
15155 goto out;
15156 }
15157 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
15158 !wdev->netdev) {
15159 err = -EINVAL;
15160 goto out;
15161 }
15162
15163 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
15164 if (!wdev_running(wdev)) {
15165 err = -ENETDOWN;
15166 goto out;
15167 }
15168 }
15169 }
15170
15171 while (1) {
15172 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
15173 cb->nlh->nlmsg_seq, NLM_F_MULTI,
15174 NL80211_CMD_VENDOR);
15175 if (!hdr)
15176 break;
15177
15178 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15179 (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
15180 wdev_id(wdev),
15181 NL80211_ATTR_PAD))) {
15182 genlmsg_cancel(skb, hdr);
15183 break;
15184 }
15185
15186 vendor_data = nla_nest_start_noflag(skb,
15187 NL80211_ATTR_VENDOR_DATA);
15188 if (!vendor_data) {
15189 genlmsg_cancel(skb, hdr);
15190 break;
15191 }
15192
15193 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
15194 (unsigned long *)&cb->args[5]);
15195 nla_nest_end(skb, vendor_data);
15196
15197 if (err == -ENOBUFS || err == -ENOENT) {
15198 genlmsg_cancel(skb, hdr);
15199 break;
15200 } else if (err <= 0) {
15201 genlmsg_cancel(skb, hdr);
15202 goto out;
15203 }
15204
15205 genlmsg_end(skb, hdr);
15206 }
15207
15208 err = skb->len;
15209 out:
15210 rtnl_unlock();
15211 return err;
15212 }
15213
__cfg80211_alloc_reply_skb(struct wiphy * wiphy,enum nl80211_commands cmd,enum nl80211_attrs attr,int approxlen)15214 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
15215 enum nl80211_commands cmd,
15216 enum nl80211_attrs attr,
15217 int approxlen)
15218 {
15219 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15220
15221 if (WARN_ON(!rdev->cur_cmd_info))
15222 return NULL;
15223
15224 return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
15225 rdev->cur_cmd_info->snd_portid,
15226 rdev->cur_cmd_info->snd_seq,
15227 cmd, attr, NULL, GFP_KERNEL);
15228 }
15229 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
15230
cfg80211_vendor_cmd_reply(struct sk_buff * skb)15231 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
15232 {
15233 struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
15234 void *hdr = ((void **)skb->cb)[1];
15235 struct nlattr *data = ((void **)skb->cb)[2];
15236
15237 /* clear CB data for netlink core to own from now on */
15238 memset(skb->cb, 0, sizeof(skb->cb));
15239
15240 if (WARN_ON(!rdev->cur_cmd_info)) {
15241 kfree_skb(skb);
15242 return -EINVAL;
15243 }
15244
15245 nla_nest_end(skb, data);
15246 genlmsg_end(skb, hdr);
15247 return genlmsg_reply(skb, rdev->cur_cmd_info);
15248 }
15249 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
15250
cfg80211_vendor_cmd_get_sender(struct wiphy * wiphy)15251 unsigned int cfg80211_vendor_cmd_get_sender(struct wiphy *wiphy)
15252 {
15253 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15254
15255 if (WARN_ON(!rdev->cur_cmd_info))
15256 return 0;
15257
15258 return rdev->cur_cmd_info->snd_portid;
15259 }
15260 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_get_sender);
15261
nl80211_set_qos_map(struct sk_buff * skb,struct genl_info * info)15262 static int nl80211_set_qos_map(struct sk_buff *skb,
15263 struct genl_info *info)
15264 {
15265 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15266 struct cfg80211_qos_map *qos_map = NULL;
15267 struct net_device *dev = info->user_ptr[1];
15268 u8 *pos, len, num_des, des_len, des;
15269 int ret;
15270
15271 if (!rdev->ops->set_qos_map)
15272 return -EOPNOTSUPP;
15273
15274 if (info->attrs[NL80211_ATTR_QOS_MAP]) {
15275 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
15276 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
15277
15278 if (len % 2)
15279 return -EINVAL;
15280
15281 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
15282 if (!qos_map)
15283 return -ENOMEM;
15284
15285 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
15286 if (num_des) {
15287 des_len = num_des *
15288 sizeof(struct cfg80211_dscp_exception);
15289 memcpy(qos_map->dscp_exception, pos, des_len);
15290 qos_map->num_des = num_des;
15291 for (des = 0; des < num_des; des++) {
15292 if (qos_map->dscp_exception[des].up > 7) {
15293 kfree(qos_map);
15294 return -EINVAL;
15295 }
15296 }
15297 pos += des_len;
15298 }
15299 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
15300 }
15301
15302 wdev_lock(dev->ieee80211_ptr);
15303 ret = nl80211_key_allowed(dev->ieee80211_ptr);
15304 if (!ret)
15305 ret = rdev_set_qos_map(rdev, dev, qos_map);
15306 wdev_unlock(dev->ieee80211_ptr);
15307
15308 kfree(qos_map);
15309 return ret;
15310 }
15311
nl80211_add_tx_ts(struct sk_buff * skb,struct genl_info * info)15312 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
15313 {
15314 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15315 struct net_device *dev = info->user_ptr[1];
15316 struct wireless_dev *wdev = dev->ieee80211_ptr;
15317 const u8 *peer;
15318 u8 tsid, up;
15319 u16 admitted_time = 0;
15320 int err;
15321
15322 if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
15323 return -EOPNOTSUPP;
15324
15325 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
15326 !info->attrs[NL80211_ATTR_USER_PRIO])
15327 return -EINVAL;
15328
15329 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
15330 up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
15331
15332 /* WMM uses TIDs 0-7 even for TSPEC */
15333 if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
15334 /* TODO: handle 802.11 TSPEC/admission control
15335 * need more attributes for that (e.g. BA session requirement);
15336 * change the WMM adminssion test above to allow both then
15337 */
15338 return -EINVAL;
15339 }
15340
15341 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
15342
15343 if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
15344 admitted_time =
15345 nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
15346 if (!admitted_time)
15347 return -EINVAL;
15348 }
15349
15350 wdev_lock(wdev);
15351 switch (wdev->iftype) {
15352 case NL80211_IFTYPE_STATION:
15353 case NL80211_IFTYPE_P2P_CLIENT:
15354 if (wdev->connected)
15355 break;
15356 err = -ENOTCONN;
15357 goto out;
15358 default:
15359 err = -EOPNOTSUPP;
15360 goto out;
15361 }
15362
15363 err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
15364
15365 out:
15366 wdev_unlock(wdev);
15367 return err;
15368 }
15369
nl80211_del_tx_ts(struct sk_buff * skb,struct genl_info * info)15370 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
15371 {
15372 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15373 struct net_device *dev = info->user_ptr[1];
15374 struct wireless_dev *wdev = dev->ieee80211_ptr;
15375 const u8 *peer;
15376 u8 tsid;
15377 int err;
15378
15379 if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
15380 return -EINVAL;
15381
15382 tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
15383 peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
15384
15385 wdev_lock(wdev);
15386 err = rdev_del_tx_ts(rdev, dev, tsid, peer);
15387 wdev_unlock(wdev);
15388
15389 return err;
15390 }
15391
nl80211_tdls_channel_switch(struct sk_buff * skb,struct genl_info * info)15392 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
15393 struct genl_info *info)
15394 {
15395 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15396 struct net_device *dev = info->user_ptr[1];
15397 struct wireless_dev *wdev = dev->ieee80211_ptr;
15398 struct cfg80211_chan_def chandef = {};
15399 const u8 *addr;
15400 u8 oper_class;
15401 int err;
15402
15403 if (!rdev->ops->tdls_channel_switch ||
15404 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
15405 return -EOPNOTSUPP;
15406
15407 switch (dev->ieee80211_ptr->iftype) {
15408 case NL80211_IFTYPE_STATION:
15409 case NL80211_IFTYPE_P2P_CLIENT:
15410 break;
15411 default:
15412 return -EOPNOTSUPP;
15413 }
15414
15415 if (!info->attrs[NL80211_ATTR_MAC] ||
15416 !info->attrs[NL80211_ATTR_OPER_CLASS])
15417 return -EINVAL;
15418
15419 err = nl80211_parse_chandef(rdev, info, &chandef);
15420 if (err)
15421 return err;
15422
15423 /*
15424 * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
15425 * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
15426 * specification is not defined for them.
15427 */
15428 if (chandef.chan->band == NL80211_BAND_2GHZ &&
15429 chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
15430 chandef.width != NL80211_CHAN_WIDTH_20)
15431 return -EINVAL;
15432
15433 /* we will be active on the TDLS link */
15434 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
15435 wdev->iftype))
15436 return -EINVAL;
15437
15438 /* don't allow switching to DFS channels */
15439 if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
15440 return -EINVAL;
15441
15442 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
15443 oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
15444
15445 wdev_lock(wdev);
15446 err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
15447 wdev_unlock(wdev);
15448
15449 return err;
15450 }
15451
nl80211_tdls_cancel_channel_switch(struct sk_buff * skb,struct genl_info * info)15452 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
15453 struct genl_info *info)
15454 {
15455 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15456 struct net_device *dev = info->user_ptr[1];
15457 struct wireless_dev *wdev = dev->ieee80211_ptr;
15458 const u8 *addr;
15459
15460 if (!rdev->ops->tdls_channel_switch ||
15461 !rdev->ops->tdls_cancel_channel_switch ||
15462 !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
15463 return -EOPNOTSUPP;
15464
15465 switch (dev->ieee80211_ptr->iftype) {
15466 case NL80211_IFTYPE_STATION:
15467 case NL80211_IFTYPE_P2P_CLIENT:
15468 break;
15469 default:
15470 return -EOPNOTSUPP;
15471 }
15472
15473 if (!info->attrs[NL80211_ATTR_MAC])
15474 return -EINVAL;
15475
15476 addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
15477
15478 wdev_lock(wdev);
15479 rdev_tdls_cancel_channel_switch(rdev, dev, addr);
15480 wdev_unlock(wdev);
15481
15482 return 0;
15483 }
15484
nl80211_set_multicast_to_unicast(struct sk_buff * skb,struct genl_info * info)15485 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
15486 struct genl_info *info)
15487 {
15488 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15489 struct net_device *dev = info->user_ptr[1];
15490 struct wireless_dev *wdev = dev->ieee80211_ptr;
15491 const struct nlattr *nla;
15492 bool enabled;
15493
15494 if (!rdev->ops->set_multicast_to_unicast)
15495 return -EOPNOTSUPP;
15496
15497 if (wdev->iftype != NL80211_IFTYPE_AP &&
15498 wdev->iftype != NL80211_IFTYPE_P2P_GO)
15499 return -EOPNOTSUPP;
15500
15501 nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
15502 enabled = nla_get_flag(nla);
15503
15504 return rdev_set_multicast_to_unicast(rdev, dev, enabled);
15505 }
15506
nl80211_set_pmk(struct sk_buff * skb,struct genl_info * info)15507 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
15508 {
15509 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15510 struct net_device *dev = info->user_ptr[1];
15511 struct wireless_dev *wdev = dev->ieee80211_ptr;
15512 struct cfg80211_pmk_conf pmk_conf = {};
15513 int ret;
15514
15515 if (wdev->iftype != NL80211_IFTYPE_STATION &&
15516 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
15517 return -EOPNOTSUPP;
15518
15519 if (!wiphy_ext_feature_isset(&rdev->wiphy,
15520 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
15521 return -EOPNOTSUPP;
15522
15523 if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
15524 return -EINVAL;
15525
15526 wdev_lock(wdev);
15527 if (!wdev->connected) {
15528 ret = -ENOTCONN;
15529 goto out;
15530 }
15531
15532 pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
15533 if (memcmp(pmk_conf.aa, wdev->u.client.connected_addr, ETH_ALEN)) {
15534 ret = -EINVAL;
15535 goto out;
15536 }
15537
15538 pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
15539 pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
15540 if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
15541 pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) {
15542 ret = -EINVAL;
15543 goto out;
15544 }
15545
15546 if (info->attrs[NL80211_ATTR_PMKR0_NAME])
15547 pmk_conf.pmk_r0_name =
15548 nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
15549
15550 ret = rdev_set_pmk(rdev, dev, &pmk_conf);
15551 out:
15552 wdev_unlock(wdev);
15553 return ret;
15554 }
15555
nl80211_del_pmk(struct sk_buff * skb,struct genl_info * info)15556 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
15557 {
15558 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15559 struct net_device *dev = info->user_ptr[1];
15560 struct wireless_dev *wdev = dev->ieee80211_ptr;
15561 const u8 *aa;
15562 int ret;
15563
15564 if (wdev->iftype != NL80211_IFTYPE_STATION &&
15565 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
15566 return -EOPNOTSUPP;
15567
15568 if (!wiphy_ext_feature_isset(&rdev->wiphy,
15569 NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
15570 return -EOPNOTSUPP;
15571
15572 if (!info->attrs[NL80211_ATTR_MAC])
15573 return -EINVAL;
15574
15575 wdev_lock(wdev);
15576 aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
15577 ret = rdev_del_pmk(rdev, dev, aa);
15578 wdev_unlock(wdev);
15579
15580 return ret;
15581 }
15582
nl80211_external_auth(struct sk_buff * skb,struct genl_info * info)15583 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)
15584 {
15585 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15586 struct net_device *dev = info->user_ptr[1];
15587 struct cfg80211_external_auth_params params;
15588
15589 if (!rdev->ops->external_auth)
15590 return -EOPNOTSUPP;
15591
15592 if (!info->attrs[NL80211_ATTR_SSID] &&
15593 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
15594 dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
15595 return -EINVAL;
15596
15597 if (!info->attrs[NL80211_ATTR_BSSID])
15598 return -EINVAL;
15599
15600 if (!info->attrs[NL80211_ATTR_STATUS_CODE])
15601 return -EINVAL;
15602
15603 memset(¶ms, 0, sizeof(params));
15604
15605 if (info->attrs[NL80211_ATTR_SSID]) {
15606 params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
15607 if (params.ssid.ssid_len == 0)
15608 return -EINVAL;
15609 memcpy(params.ssid.ssid,
15610 nla_data(info->attrs[NL80211_ATTR_SSID]),
15611 params.ssid.ssid_len);
15612 }
15613
15614 memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]),
15615 ETH_ALEN);
15616
15617 params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
15618
15619 if (info->attrs[NL80211_ATTR_PMKID])
15620 params.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
15621
15622 return rdev_external_auth(rdev, dev, ¶ms);
15623 }
15624
nl80211_tx_control_port(struct sk_buff * skb,struct genl_info * info)15625 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)
15626 {
15627 bool dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
15628 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15629 struct net_device *dev = info->user_ptr[1];
15630 struct wireless_dev *wdev = dev->ieee80211_ptr;
15631 const u8 *buf;
15632 size_t len;
15633 u8 *dest;
15634 u16 proto;
15635 bool noencrypt;
15636 u64 cookie = 0;
15637 int link_id;
15638 int err;
15639
15640 if (!wiphy_ext_feature_isset(&rdev->wiphy,
15641 NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
15642 return -EOPNOTSUPP;
15643
15644 if (!rdev->ops->tx_control_port)
15645 return -EOPNOTSUPP;
15646
15647 if (!info->attrs[NL80211_ATTR_FRAME] ||
15648 !info->attrs[NL80211_ATTR_MAC] ||
15649 !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
15650 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing");
15651 return -EINVAL;
15652 }
15653
15654 wdev_lock(wdev);
15655
15656 switch (wdev->iftype) {
15657 case NL80211_IFTYPE_AP:
15658 case NL80211_IFTYPE_P2P_GO:
15659 case NL80211_IFTYPE_MESH_POINT:
15660 break;
15661 case NL80211_IFTYPE_ADHOC:
15662 if (wdev->u.ibss.current_bss)
15663 break;
15664 err = -ENOTCONN;
15665 goto out;
15666 case NL80211_IFTYPE_STATION:
15667 case NL80211_IFTYPE_P2P_CLIENT:
15668 if (wdev->connected)
15669 break;
15670 err = -ENOTCONN;
15671 goto out;
15672 default:
15673 err = -EOPNOTSUPP;
15674 goto out;
15675 }
15676
15677 wdev_unlock(wdev);
15678
15679 buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
15680 len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
15681 dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
15682 proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
15683 noencrypt =
15684 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]);
15685
15686 link_id = nl80211_link_id_or_invalid(info->attrs);
15687
15688 err = rdev_tx_control_port(rdev, dev, buf, len,
15689 dest, cpu_to_be16(proto), noencrypt, link_id,
15690 dont_wait_for_ack ? NULL : &cookie);
15691 if (!err && !dont_wait_for_ack)
15692 nl_set_extack_cookie_u64(info->extack, cookie);
15693 return err;
15694 out:
15695 wdev_unlock(wdev);
15696 return err;
15697 }
15698
nl80211_get_ftm_responder_stats(struct sk_buff * skb,struct genl_info * info)15699 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb,
15700 struct genl_info *info)
15701 {
15702 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15703 struct net_device *dev = info->user_ptr[1];
15704 struct wireless_dev *wdev = dev->ieee80211_ptr;
15705 struct cfg80211_ftm_responder_stats ftm_stats = {};
15706 unsigned int link_id = nl80211_link_id(info->attrs);
15707 struct sk_buff *msg;
15708 void *hdr;
15709 struct nlattr *ftm_stats_attr;
15710 int err;
15711
15712 if (wdev->iftype != NL80211_IFTYPE_AP ||
15713 !wdev->links[link_id].ap.beacon_interval)
15714 return -EOPNOTSUPP;
15715
15716 err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats);
15717 if (err)
15718 return err;
15719
15720 if (!ftm_stats.filled)
15721 return -ENODATA;
15722
15723 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15724 if (!msg)
15725 return -ENOMEM;
15726
15727 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
15728 NL80211_CMD_GET_FTM_RESPONDER_STATS);
15729 if (!hdr)
15730 goto nla_put_failure;
15731
15732 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
15733 goto nla_put_failure;
15734
15735 ftm_stats_attr = nla_nest_start_noflag(msg,
15736 NL80211_ATTR_FTM_RESPONDER_STATS);
15737 if (!ftm_stats_attr)
15738 goto nla_put_failure;
15739
15740 #define SET_FTM(field, name, type) \
15741 do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
15742 nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name, \
15743 ftm_stats.field)) \
15744 goto nla_put_failure; } while (0)
15745 #define SET_FTM_U64(field, name) \
15746 do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
15747 nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name, \
15748 ftm_stats.field, NL80211_FTM_STATS_PAD)) \
15749 goto nla_put_failure; } while (0)
15750
15751 SET_FTM(success_num, SUCCESS_NUM, u32);
15752 SET_FTM(partial_num, PARTIAL_NUM, u32);
15753 SET_FTM(failed_num, FAILED_NUM, u32);
15754 SET_FTM(asap_num, ASAP_NUM, u32);
15755 SET_FTM(non_asap_num, NON_ASAP_NUM, u32);
15756 SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC);
15757 SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32);
15758 SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32);
15759 SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32);
15760 #undef SET_FTM
15761
15762 nla_nest_end(msg, ftm_stats_attr);
15763
15764 genlmsg_end(msg, hdr);
15765 return genlmsg_reply(msg, info);
15766
15767 nla_put_failure:
15768 nlmsg_free(msg);
15769 return -ENOBUFS;
15770 }
15771
nl80211_update_owe_info(struct sk_buff * skb,struct genl_info * info)15772 static int nl80211_update_owe_info(struct sk_buff *skb, struct genl_info *info)
15773 {
15774 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15775 struct cfg80211_update_owe_info owe_info;
15776 struct net_device *dev = info->user_ptr[1];
15777
15778 if (!rdev->ops->update_owe_info)
15779 return -EOPNOTSUPP;
15780
15781 if (!info->attrs[NL80211_ATTR_STATUS_CODE] ||
15782 !info->attrs[NL80211_ATTR_MAC])
15783 return -EINVAL;
15784
15785 memset(&owe_info, 0, sizeof(owe_info));
15786 owe_info.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
15787 nla_memcpy(owe_info.peer, info->attrs[NL80211_ATTR_MAC], ETH_ALEN);
15788
15789 if (info->attrs[NL80211_ATTR_IE]) {
15790 owe_info.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
15791 owe_info.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
15792 }
15793
15794 return rdev_update_owe_info(rdev, dev, &owe_info);
15795 }
15796
nl80211_probe_mesh_link(struct sk_buff * skb,struct genl_info * info)15797 static int nl80211_probe_mesh_link(struct sk_buff *skb, struct genl_info *info)
15798 {
15799 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15800 struct net_device *dev = info->user_ptr[1];
15801 struct wireless_dev *wdev = dev->ieee80211_ptr;
15802 struct station_info sinfo = {};
15803 const u8 *buf;
15804 size_t len;
15805 u8 *dest;
15806 int err;
15807
15808 if (!rdev->ops->probe_mesh_link || !rdev->ops->get_station)
15809 return -EOPNOTSUPP;
15810
15811 if (!info->attrs[NL80211_ATTR_MAC] ||
15812 !info->attrs[NL80211_ATTR_FRAME]) {
15813 GENL_SET_ERR_MSG(info, "Frame or MAC missing");
15814 return -EINVAL;
15815 }
15816
15817 if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
15818 return -EOPNOTSUPP;
15819
15820 dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
15821 buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
15822 len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
15823
15824 if (len < sizeof(struct ethhdr))
15825 return -EINVAL;
15826
15827 if (!ether_addr_equal(buf, dest) || is_multicast_ether_addr(buf) ||
15828 !ether_addr_equal(buf + ETH_ALEN, dev->dev_addr))
15829 return -EINVAL;
15830
15831 err = rdev_get_station(rdev, dev, dest, &sinfo);
15832 if (err)
15833 return err;
15834
15835 cfg80211_sinfo_release_content(&sinfo);
15836
15837 return rdev_probe_mesh_link(rdev, dev, dest, buf, len);
15838 }
15839
parse_tid_conf(struct cfg80211_registered_device * rdev,struct nlattr * attrs[],struct net_device * dev,struct cfg80211_tid_cfg * tid_conf,struct genl_info * info,const u8 * peer,unsigned int link_id)15840 static int parse_tid_conf(struct cfg80211_registered_device *rdev,
15841 struct nlattr *attrs[], struct net_device *dev,
15842 struct cfg80211_tid_cfg *tid_conf,
15843 struct genl_info *info, const u8 *peer,
15844 unsigned int link_id)
15845 {
15846 struct netlink_ext_ack *extack = info->extack;
15847 u64 mask;
15848 int err;
15849
15850 if (!attrs[NL80211_TID_CONFIG_ATTR_TIDS])
15851 return -EINVAL;
15852
15853 tid_conf->config_override =
15854 nla_get_flag(attrs[NL80211_TID_CONFIG_ATTR_OVERRIDE]);
15855 tid_conf->tids = nla_get_u16(attrs[NL80211_TID_CONFIG_ATTR_TIDS]);
15856
15857 if (tid_conf->config_override) {
15858 if (rdev->ops->reset_tid_config) {
15859 err = rdev_reset_tid_config(rdev, dev, peer,
15860 tid_conf->tids);
15861 if (err)
15862 return err;
15863 } else {
15864 return -EINVAL;
15865 }
15866 }
15867
15868 if (attrs[NL80211_TID_CONFIG_ATTR_NOACK]) {
15869 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_NOACK);
15870 tid_conf->noack =
15871 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_NOACK]);
15872 }
15873
15874 if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]) {
15875 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_SHORT);
15876 tid_conf->retry_short =
15877 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]);
15878
15879 if (tid_conf->retry_short > rdev->wiphy.max_data_retry_count)
15880 return -EINVAL;
15881 }
15882
15883 if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]) {
15884 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_LONG);
15885 tid_conf->retry_long =
15886 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]);
15887
15888 if (tid_conf->retry_long > rdev->wiphy.max_data_retry_count)
15889 return -EINVAL;
15890 }
15891
15892 if (attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]) {
15893 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL);
15894 tid_conf->ampdu =
15895 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]);
15896 }
15897
15898 if (attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]) {
15899 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL);
15900 tid_conf->rtscts =
15901 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]);
15902 }
15903
15904 if (attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]) {
15905 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMSDU_CTRL);
15906 tid_conf->amsdu =
15907 nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]);
15908 }
15909
15910 if (attrs[NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE]) {
15911 u32 idx = NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE, attr;
15912
15913 tid_conf->txrate_type = nla_get_u8(attrs[idx]);
15914
15915 if (tid_conf->txrate_type != NL80211_TX_RATE_AUTOMATIC) {
15916 attr = NL80211_TID_CONFIG_ATTR_TX_RATE;
15917 err = nl80211_parse_tx_bitrate_mask(info, attrs, attr,
15918 &tid_conf->txrate_mask, dev,
15919 true, link_id);
15920 if (err)
15921 return err;
15922
15923 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE);
15924 }
15925 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE);
15926 }
15927
15928 if (peer)
15929 mask = rdev->wiphy.tid_config_support.peer;
15930 else
15931 mask = rdev->wiphy.tid_config_support.vif;
15932
15933 if (tid_conf->mask & ~mask) {
15934 NL_SET_ERR_MSG(extack, "unsupported TID configuration");
15935 return -ENOTSUPP;
15936 }
15937
15938 return 0;
15939 }
15940
nl80211_set_tid_config(struct sk_buff * skb,struct genl_info * info)15941 static int nl80211_set_tid_config(struct sk_buff *skb,
15942 struct genl_info *info)
15943 {
15944 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15945 struct nlattr *attrs[NL80211_TID_CONFIG_ATTR_MAX + 1];
15946 unsigned int link_id = nl80211_link_id(info->attrs);
15947 struct net_device *dev = info->user_ptr[1];
15948 struct cfg80211_tid_config *tid_config;
15949 struct nlattr *tid;
15950 int conf_idx = 0, rem_conf;
15951 int ret = -EINVAL;
15952 u32 num_conf = 0;
15953
15954 if (!info->attrs[NL80211_ATTR_TID_CONFIG])
15955 return -EINVAL;
15956
15957 if (!rdev->ops->set_tid_config)
15958 return -EOPNOTSUPP;
15959
15960 nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
15961 rem_conf)
15962 num_conf++;
15963
15964 tid_config = kzalloc(struct_size(tid_config, tid_conf, num_conf),
15965 GFP_KERNEL);
15966 if (!tid_config)
15967 return -ENOMEM;
15968
15969 tid_config->n_tid_conf = num_conf;
15970
15971 if (info->attrs[NL80211_ATTR_MAC])
15972 tid_config->peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
15973
15974 wdev_lock(dev->ieee80211_ptr);
15975
15976 nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
15977 rem_conf) {
15978 ret = nla_parse_nested(attrs, NL80211_TID_CONFIG_ATTR_MAX,
15979 tid, NULL, NULL);
15980
15981 if (ret)
15982 goto bad_tid_conf;
15983
15984 ret = parse_tid_conf(rdev, attrs, dev,
15985 &tid_config->tid_conf[conf_idx],
15986 info, tid_config->peer, link_id);
15987 if (ret)
15988 goto bad_tid_conf;
15989
15990 conf_idx++;
15991 }
15992
15993 ret = rdev_set_tid_config(rdev, dev, tid_config);
15994
15995 bad_tid_conf:
15996 kfree(tid_config);
15997 wdev_unlock(dev->ieee80211_ptr);
15998 return ret;
15999 }
16000
nl80211_color_change(struct sk_buff * skb,struct genl_info * info)16001 static int nl80211_color_change(struct sk_buff *skb, struct genl_info *info)
16002 {
16003 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16004 struct cfg80211_color_change_settings params = {};
16005 struct net_device *dev = info->user_ptr[1];
16006 struct wireless_dev *wdev = dev->ieee80211_ptr;
16007 struct nlattr **tb;
16008 u16 offset;
16009 int err;
16010
16011 if (!rdev->ops->color_change)
16012 return -EOPNOTSUPP;
16013
16014 if (!wiphy_ext_feature_isset(&rdev->wiphy,
16015 NL80211_EXT_FEATURE_BSS_COLOR))
16016 return -EOPNOTSUPP;
16017
16018 if (wdev->iftype != NL80211_IFTYPE_AP)
16019 return -EOPNOTSUPP;
16020
16021 if (!info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT] ||
16022 !info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR] ||
16023 !info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS])
16024 return -EINVAL;
16025
16026 params.count = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT]);
16027 params.color = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR]);
16028
16029 err = nl80211_parse_beacon(rdev, info->attrs, ¶ms.beacon_next,
16030 info->extack);
16031 if (err)
16032 return err;
16033
16034 tb = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*tb), GFP_KERNEL);
16035 if (!tb)
16036 return -ENOMEM;
16037
16038 err = nla_parse_nested(tb, NL80211_ATTR_MAX,
16039 info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS],
16040 nl80211_policy, info->extack);
16041 if (err)
16042 goto out;
16043
16044 err = nl80211_parse_beacon(rdev, tb, ¶ms.beacon_color_change,
16045 info->extack);
16046 if (err)
16047 goto out;
16048
16049 if (!tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
16050 err = -EINVAL;
16051 goto out;
16052 }
16053
16054 if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) != sizeof(u16)) {
16055 err = -EINVAL;
16056 goto out;
16057 }
16058
16059 offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
16060 if (offset >= params.beacon_color_change.tail_len) {
16061 err = -EINVAL;
16062 goto out;
16063 }
16064
16065 if (params.beacon_color_change.tail[offset] != params.count) {
16066 err = -EINVAL;
16067 goto out;
16068 }
16069
16070 params.counter_offset_beacon = offset;
16071
16072 if (tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) {
16073 if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) !=
16074 sizeof(u16)) {
16075 err = -EINVAL;
16076 goto out;
16077 }
16078
16079 offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
16080 if (offset >= params.beacon_color_change.probe_resp_len) {
16081 err = -EINVAL;
16082 goto out;
16083 }
16084
16085 if (params.beacon_color_change.probe_resp[offset] !=
16086 params.count) {
16087 err = -EINVAL;
16088 goto out;
16089 }
16090
16091 params.counter_offset_presp = offset;
16092 }
16093
16094 wdev_lock(wdev);
16095 err = rdev_color_change(rdev, dev, ¶ms);
16096 wdev_unlock(wdev);
16097
16098 out:
16099 kfree(params.beacon_next.mbssid_ies);
16100 kfree(params.beacon_color_change.mbssid_ies);
16101 kfree(params.beacon_next.rnr_ies);
16102 kfree(params.beacon_color_change.rnr_ies);
16103 kfree(tb);
16104 return err;
16105 }
16106
nl80211_set_fils_aad(struct sk_buff * skb,struct genl_info * info)16107 static int nl80211_set_fils_aad(struct sk_buff *skb,
16108 struct genl_info *info)
16109 {
16110 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16111 struct net_device *dev = info->user_ptr[1];
16112 struct cfg80211_fils_aad fils_aad = {};
16113 u8 *nonces;
16114
16115 if (!info->attrs[NL80211_ATTR_MAC] ||
16116 !info->attrs[NL80211_ATTR_FILS_KEK] ||
16117 !info->attrs[NL80211_ATTR_FILS_NONCES])
16118 return -EINVAL;
16119
16120 fils_aad.macaddr = nla_data(info->attrs[NL80211_ATTR_MAC]);
16121 fils_aad.kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
16122 fils_aad.kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
16123 nonces = nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
16124 fils_aad.snonce = nonces;
16125 fils_aad.anonce = nonces + FILS_NONCE_LEN;
16126
16127 return rdev_set_fils_aad(rdev, dev, &fils_aad);
16128 }
16129
nl80211_add_link(struct sk_buff * skb,struct genl_info * info)16130 static int nl80211_add_link(struct sk_buff *skb, struct genl_info *info)
16131 {
16132 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16133 unsigned int link_id = nl80211_link_id(info->attrs);
16134 struct net_device *dev = info->user_ptr[1];
16135 struct wireless_dev *wdev = dev->ieee80211_ptr;
16136 int ret;
16137
16138 if (!(wdev->wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO))
16139 return -EINVAL;
16140
16141 switch (wdev->iftype) {
16142 case NL80211_IFTYPE_AP:
16143 break;
16144 default:
16145 return -EINVAL;
16146 }
16147
16148 if (!info->attrs[NL80211_ATTR_MAC] ||
16149 !is_valid_ether_addr(nla_data(info->attrs[NL80211_ATTR_MAC])))
16150 return -EINVAL;
16151
16152 wdev_lock(wdev);
16153 wdev->valid_links |= BIT(link_id);
16154 ether_addr_copy(wdev->links[link_id].addr,
16155 nla_data(info->attrs[NL80211_ATTR_MAC]));
16156
16157 ret = rdev_add_intf_link(rdev, wdev, link_id);
16158 if (ret) {
16159 wdev->valid_links &= ~BIT(link_id);
16160 eth_zero_addr(wdev->links[link_id].addr);
16161 }
16162 wdev_unlock(wdev);
16163
16164 return ret;
16165 }
16166
nl80211_remove_link(struct sk_buff * skb,struct genl_info * info)16167 static int nl80211_remove_link(struct sk_buff *skb, struct genl_info *info)
16168 {
16169 unsigned int link_id = nl80211_link_id(info->attrs);
16170 struct net_device *dev = info->user_ptr[1];
16171 struct wireless_dev *wdev = dev->ieee80211_ptr;
16172
16173 /* cannot remove if there's no link */
16174 if (!info->attrs[NL80211_ATTR_MLO_LINK_ID])
16175 return -EINVAL;
16176
16177 switch (wdev->iftype) {
16178 case NL80211_IFTYPE_AP:
16179 break;
16180 default:
16181 return -EINVAL;
16182 }
16183
16184 wdev_lock(wdev);
16185 cfg80211_remove_link(wdev, link_id);
16186 wdev_unlock(wdev);
16187
16188 return 0;
16189 }
16190
16191 static int
nl80211_add_mod_link_station(struct sk_buff * skb,struct genl_info * info,bool add)16192 nl80211_add_mod_link_station(struct sk_buff *skb, struct genl_info *info,
16193 bool add)
16194 {
16195 struct link_station_parameters params = {};
16196 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16197 struct net_device *dev = info->user_ptr[1];
16198 int err;
16199
16200 if ((add && !rdev->ops->add_link_station) ||
16201 (!add && !rdev->ops->mod_link_station))
16202 return -EOPNOTSUPP;
16203
16204 if (add && !info->attrs[NL80211_ATTR_MAC])
16205 return -EINVAL;
16206
16207 if (!info->attrs[NL80211_ATTR_MLD_ADDR])
16208 return -EINVAL;
16209
16210 if (add && !info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
16211 return -EINVAL;
16212
16213 params.mld_mac = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
16214
16215 if (info->attrs[NL80211_ATTR_MAC]) {
16216 params.link_mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
16217 if (!is_valid_ether_addr(params.link_mac))
16218 return -EINVAL;
16219 }
16220
16221 if (!info->attrs[NL80211_ATTR_MLO_LINK_ID])
16222 return -EINVAL;
16223
16224 params.link_id = nla_get_u8(info->attrs[NL80211_ATTR_MLO_LINK_ID]);
16225
16226 if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
16227 params.supported_rates =
16228 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
16229 params.supported_rates_len =
16230 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
16231 }
16232
16233 if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
16234 params.ht_capa =
16235 nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
16236
16237 if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
16238 params.vht_capa =
16239 nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
16240
16241 if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
16242 params.he_capa =
16243 nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
16244 params.he_capa_len =
16245 nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
16246
16247 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
16248 params.eht_capa =
16249 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
16250 params.eht_capa_len =
16251 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
16252
16253 if (!ieee80211_eht_capa_size_ok((const u8 *)params.he_capa,
16254 (const u8 *)params.eht_capa,
16255 params.eht_capa_len,
16256 false))
16257 return -EINVAL;
16258 }
16259 }
16260
16261 if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
16262 params.he_6ghz_capa =
16263 nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
16264
16265 if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
16266 params.opmode_notif_used = true;
16267 params.opmode_notif =
16268 nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
16269 }
16270
16271 err = nl80211_parse_sta_txpower_setting(info, ¶ms.txpwr,
16272 ¶ms.txpwr_set);
16273 if (err)
16274 return err;
16275
16276 wdev_lock(dev->ieee80211_ptr);
16277 if (add)
16278 err = rdev_add_link_station(rdev, dev, ¶ms);
16279 else
16280 err = rdev_mod_link_station(rdev, dev, ¶ms);
16281 wdev_unlock(dev->ieee80211_ptr);
16282
16283 return err;
16284 }
16285
16286 static int
nl80211_add_link_station(struct sk_buff * skb,struct genl_info * info)16287 nl80211_add_link_station(struct sk_buff *skb, struct genl_info *info)
16288 {
16289 return nl80211_add_mod_link_station(skb, info, true);
16290 }
16291
16292 static int
nl80211_modify_link_station(struct sk_buff * skb,struct genl_info * info)16293 nl80211_modify_link_station(struct sk_buff *skb, struct genl_info *info)
16294 {
16295 return nl80211_add_mod_link_station(skb, info, false);
16296 }
16297
16298 static int
nl80211_remove_link_station(struct sk_buff * skb,struct genl_info * info)16299 nl80211_remove_link_station(struct sk_buff *skb, struct genl_info *info)
16300 {
16301 struct link_station_del_parameters params = {};
16302 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16303 struct net_device *dev = info->user_ptr[1];
16304 int ret;
16305
16306 if (!rdev->ops->del_link_station)
16307 return -EOPNOTSUPP;
16308
16309 if (!info->attrs[NL80211_ATTR_MLD_ADDR] ||
16310 !info->attrs[NL80211_ATTR_MLO_LINK_ID])
16311 return -EINVAL;
16312
16313 params.mld_mac = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
16314 params.link_id = nla_get_u8(info->attrs[NL80211_ATTR_MLO_LINK_ID]);
16315
16316 wdev_lock(dev->ieee80211_ptr);
16317 ret = rdev_del_link_station(rdev, dev, ¶ms);
16318 wdev_unlock(dev->ieee80211_ptr);
16319
16320 return ret;
16321 }
16322
nl80211_set_hw_timestamp(struct sk_buff * skb,struct genl_info * info)16323 static int nl80211_set_hw_timestamp(struct sk_buff *skb,
16324 struct genl_info *info)
16325 {
16326 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16327 struct net_device *dev = info->user_ptr[1];
16328 struct cfg80211_set_hw_timestamp hwts = {};
16329
16330 if (!rdev->wiphy.hw_timestamp_max_peers)
16331 return -EOPNOTSUPP;
16332
16333 if (!info->attrs[NL80211_ATTR_MAC] &&
16334 rdev->wiphy.hw_timestamp_max_peers != CFG80211_HW_TIMESTAMP_ALL_PEERS)
16335 return -EOPNOTSUPP;
16336
16337 if (info->attrs[NL80211_ATTR_MAC])
16338 hwts.macaddr = nla_data(info->attrs[NL80211_ATTR_MAC]);
16339
16340 hwts.enable =
16341 nla_get_flag(info->attrs[NL80211_ATTR_HW_TIMESTAMP_ENABLED]);
16342
16343 return rdev_set_hw_timestamp(rdev, dev, &hwts);
16344 }
16345
16346 #define NL80211_FLAG_NEED_WIPHY 0x01
16347 #define NL80211_FLAG_NEED_NETDEV 0x02
16348 #define NL80211_FLAG_NEED_RTNL 0x04
16349 #define NL80211_FLAG_CHECK_NETDEV_UP 0x08
16350 #define NL80211_FLAG_NEED_NETDEV_UP (NL80211_FLAG_NEED_NETDEV |\
16351 NL80211_FLAG_CHECK_NETDEV_UP)
16352 #define NL80211_FLAG_NEED_WDEV 0x10
16353 /* If a netdev is associated, it must be UP, P2P must be started */
16354 #define NL80211_FLAG_NEED_WDEV_UP (NL80211_FLAG_NEED_WDEV |\
16355 NL80211_FLAG_CHECK_NETDEV_UP)
16356 #define NL80211_FLAG_CLEAR_SKB 0x20
16357 #define NL80211_FLAG_NO_WIPHY_MTX 0x40
16358 #define NL80211_FLAG_MLO_VALID_LINK_ID 0x80
16359 #define NL80211_FLAG_MLO_UNSUPPORTED 0x100
16360
16361 #define INTERNAL_FLAG_SELECTORS(__sel) \
16362 SELECTOR(__sel, NONE, 0) /* must be first */ \
16363 SELECTOR(__sel, WIPHY, \
16364 NL80211_FLAG_NEED_WIPHY) \
16365 SELECTOR(__sel, WDEV, \
16366 NL80211_FLAG_NEED_WDEV) \
16367 SELECTOR(__sel, NETDEV, \
16368 NL80211_FLAG_NEED_NETDEV) \
16369 SELECTOR(__sel, NETDEV_LINK, \
16370 NL80211_FLAG_NEED_NETDEV | \
16371 NL80211_FLAG_MLO_VALID_LINK_ID) \
16372 SELECTOR(__sel, NETDEV_NO_MLO, \
16373 NL80211_FLAG_NEED_NETDEV | \
16374 NL80211_FLAG_MLO_UNSUPPORTED) \
16375 SELECTOR(__sel, WIPHY_RTNL, \
16376 NL80211_FLAG_NEED_WIPHY | \
16377 NL80211_FLAG_NEED_RTNL) \
16378 SELECTOR(__sel, WIPHY_RTNL_NOMTX, \
16379 NL80211_FLAG_NEED_WIPHY | \
16380 NL80211_FLAG_NEED_RTNL | \
16381 NL80211_FLAG_NO_WIPHY_MTX) \
16382 SELECTOR(__sel, WDEV_RTNL, \
16383 NL80211_FLAG_NEED_WDEV | \
16384 NL80211_FLAG_NEED_RTNL) \
16385 SELECTOR(__sel, NETDEV_RTNL, \
16386 NL80211_FLAG_NEED_NETDEV | \
16387 NL80211_FLAG_NEED_RTNL) \
16388 SELECTOR(__sel, NETDEV_UP, \
16389 NL80211_FLAG_NEED_NETDEV_UP) \
16390 SELECTOR(__sel, NETDEV_UP_LINK, \
16391 NL80211_FLAG_NEED_NETDEV_UP | \
16392 NL80211_FLAG_MLO_VALID_LINK_ID) \
16393 SELECTOR(__sel, NETDEV_UP_NO_MLO, \
16394 NL80211_FLAG_NEED_NETDEV_UP | \
16395 NL80211_FLAG_MLO_UNSUPPORTED) \
16396 SELECTOR(__sel, NETDEV_UP_NO_MLO_CLEAR, \
16397 NL80211_FLAG_NEED_NETDEV_UP | \
16398 NL80211_FLAG_CLEAR_SKB | \
16399 NL80211_FLAG_MLO_UNSUPPORTED) \
16400 SELECTOR(__sel, NETDEV_UP_NOTMX, \
16401 NL80211_FLAG_NEED_NETDEV_UP | \
16402 NL80211_FLAG_NO_WIPHY_MTX) \
16403 SELECTOR(__sel, NETDEV_UP_NOTMX_NOMLO, \
16404 NL80211_FLAG_NEED_NETDEV_UP | \
16405 NL80211_FLAG_NO_WIPHY_MTX | \
16406 NL80211_FLAG_MLO_UNSUPPORTED) \
16407 SELECTOR(__sel, NETDEV_UP_CLEAR, \
16408 NL80211_FLAG_NEED_NETDEV_UP | \
16409 NL80211_FLAG_CLEAR_SKB) \
16410 SELECTOR(__sel, WDEV_UP, \
16411 NL80211_FLAG_NEED_WDEV_UP) \
16412 SELECTOR(__sel, WDEV_UP_LINK, \
16413 NL80211_FLAG_NEED_WDEV_UP | \
16414 NL80211_FLAG_MLO_VALID_LINK_ID) \
16415 SELECTOR(__sel, WDEV_UP_RTNL, \
16416 NL80211_FLAG_NEED_WDEV_UP | \
16417 NL80211_FLAG_NEED_RTNL) \
16418 SELECTOR(__sel, WIPHY_CLEAR, \
16419 NL80211_FLAG_NEED_WIPHY | \
16420 NL80211_FLAG_CLEAR_SKB)
16421
16422 enum nl80211_internal_flags_selector {
16423 #define SELECTOR(_, name, value) NL80211_IFL_SEL_##name,
16424 INTERNAL_FLAG_SELECTORS(_)
16425 #undef SELECTOR
16426 };
16427
16428 static u32 nl80211_internal_flags[] = {
16429 #define SELECTOR(_, name, value) [NL80211_IFL_SEL_##name] = value,
16430 INTERNAL_FLAG_SELECTORS(_)
16431 #undef SELECTOR
16432 };
16433
nl80211_pre_doit(const struct genl_split_ops * ops,struct sk_buff * skb,struct genl_info * info)16434 static int nl80211_pre_doit(const struct genl_split_ops *ops,
16435 struct sk_buff *skb,
16436 struct genl_info *info)
16437 {
16438 struct cfg80211_registered_device *rdev = NULL;
16439 struct wireless_dev *wdev = NULL;
16440 struct net_device *dev = NULL;
16441 u32 internal_flags;
16442 int err;
16443
16444 if (WARN_ON(ops->internal_flags >= ARRAY_SIZE(nl80211_internal_flags)))
16445 return -EINVAL;
16446
16447 internal_flags = nl80211_internal_flags[ops->internal_flags];
16448
16449 rtnl_lock();
16450 if (internal_flags & NL80211_FLAG_NEED_WIPHY) {
16451 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
16452 if (IS_ERR(rdev)) {
16453 err = PTR_ERR(rdev);
16454 goto out_unlock;
16455 }
16456 info->user_ptr[0] = rdev;
16457 } else if (internal_flags & NL80211_FLAG_NEED_NETDEV ||
16458 internal_flags & NL80211_FLAG_NEED_WDEV) {
16459 wdev = __cfg80211_wdev_from_attrs(NULL, genl_info_net(info),
16460 info->attrs);
16461 if (IS_ERR(wdev)) {
16462 err = PTR_ERR(wdev);
16463 goto out_unlock;
16464 }
16465
16466 dev = wdev->netdev;
16467 dev_hold(dev);
16468 rdev = wiphy_to_rdev(wdev->wiphy);
16469
16470 if (internal_flags & NL80211_FLAG_NEED_NETDEV) {
16471 if (!dev) {
16472 err = -EINVAL;
16473 goto out_unlock;
16474 }
16475
16476 info->user_ptr[1] = dev;
16477 } else {
16478 info->user_ptr[1] = wdev;
16479 }
16480
16481 if (internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
16482 !wdev_running(wdev)) {
16483 err = -ENETDOWN;
16484 goto out_unlock;
16485 }
16486
16487 info->user_ptr[0] = rdev;
16488 }
16489
16490 if (internal_flags & NL80211_FLAG_MLO_VALID_LINK_ID) {
16491 struct nlattr *link_id = info->attrs[NL80211_ATTR_MLO_LINK_ID];
16492
16493 if (!wdev) {
16494 err = -EINVAL;
16495 goto out_unlock;
16496 }
16497
16498 /* MLO -> require valid link ID */
16499 if (wdev->valid_links &&
16500 (!link_id ||
16501 !(wdev->valid_links & BIT(nla_get_u8(link_id))))) {
16502 err = -EINVAL;
16503 goto out_unlock;
16504 }
16505
16506 /* non-MLO -> no link ID attribute accepted */
16507 if (!wdev->valid_links && link_id) {
16508 err = -EINVAL;
16509 goto out_unlock;
16510 }
16511 }
16512
16513 if (internal_flags & NL80211_FLAG_MLO_UNSUPPORTED) {
16514 if (info->attrs[NL80211_ATTR_MLO_LINK_ID] ||
16515 (wdev && wdev->valid_links)) {
16516 err = -EINVAL;
16517 goto out_unlock;
16518 }
16519 }
16520
16521 if (rdev && !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
16522 wiphy_lock(&rdev->wiphy);
16523 /* we keep the mutex locked until post_doit */
16524 __release(&rdev->wiphy.mtx);
16525 }
16526 if (!(internal_flags & NL80211_FLAG_NEED_RTNL))
16527 rtnl_unlock();
16528
16529 return 0;
16530 out_unlock:
16531 rtnl_unlock();
16532 dev_put(dev);
16533 return err;
16534 }
16535
nl80211_post_doit(const struct genl_split_ops * ops,struct sk_buff * skb,struct genl_info * info)16536 static void nl80211_post_doit(const struct genl_split_ops *ops,
16537 struct sk_buff *skb,
16538 struct genl_info *info)
16539 {
16540 u32 internal_flags = nl80211_internal_flags[ops->internal_flags];
16541
16542 if (info->user_ptr[1]) {
16543 if (internal_flags & NL80211_FLAG_NEED_WDEV) {
16544 struct wireless_dev *wdev = info->user_ptr[1];
16545
16546 dev_put(wdev->netdev);
16547 } else {
16548 dev_put(info->user_ptr[1]);
16549 }
16550 }
16551
16552 if (info->user_ptr[0] &&
16553 !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
16554 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16555
16556 /* we kept the mutex locked since pre_doit */
16557 __acquire(&rdev->wiphy.mtx);
16558 wiphy_unlock(&rdev->wiphy);
16559 }
16560
16561 if (internal_flags & NL80211_FLAG_NEED_RTNL)
16562 rtnl_unlock();
16563
16564 /* If needed, clear the netlink message payload from the SKB
16565 * as it might contain key data that shouldn't stick around on
16566 * the heap after the SKB is freed. The netlink message header
16567 * is still needed for further processing, so leave it intact.
16568 */
16569 if (internal_flags & NL80211_FLAG_CLEAR_SKB) {
16570 struct nlmsghdr *nlh = nlmsg_hdr(skb);
16571
16572 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
16573 }
16574 }
16575
nl80211_set_sar_sub_specs(struct cfg80211_registered_device * rdev,struct cfg80211_sar_specs * sar_specs,struct nlattr * spec[],int index)16576 static int nl80211_set_sar_sub_specs(struct cfg80211_registered_device *rdev,
16577 struct cfg80211_sar_specs *sar_specs,
16578 struct nlattr *spec[], int index)
16579 {
16580 u32 range_index, i;
16581
16582 if (!sar_specs || !spec)
16583 return -EINVAL;
16584
16585 if (!spec[NL80211_SAR_ATTR_SPECS_POWER] ||
16586 !spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX])
16587 return -EINVAL;
16588
16589 range_index = nla_get_u32(spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX]);
16590
16591 /* check if range_index exceeds num_freq_ranges */
16592 if (range_index >= rdev->wiphy.sar_capa->num_freq_ranges)
16593 return -EINVAL;
16594
16595 /* check if range_index duplicates */
16596 for (i = 0; i < index; i++) {
16597 if (sar_specs->sub_specs[i].freq_range_index == range_index)
16598 return -EINVAL;
16599 }
16600
16601 sar_specs->sub_specs[index].power =
16602 nla_get_s32(spec[NL80211_SAR_ATTR_SPECS_POWER]);
16603
16604 sar_specs->sub_specs[index].freq_range_index = range_index;
16605
16606 return 0;
16607 }
16608
nl80211_set_sar_specs(struct sk_buff * skb,struct genl_info * info)16609 static int nl80211_set_sar_specs(struct sk_buff *skb, struct genl_info *info)
16610 {
16611 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16612 struct nlattr *spec[NL80211_SAR_ATTR_SPECS_MAX + 1];
16613 struct nlattr *tb[NL80211_SAR_ATTR_MAX + 1];
16614 struct cfg80211_sar_specs *sar_spec;
16615 enum nl80211_sar_type type;
16616 struct nlattr *spec_list;
16617 u32 specs;
16618 int rem, err;
16619
16620 if (!rdev->wiphy.sar_capa || !rdev->ops->set_sar_specs)
16621 return -EOPNOTSUPP;
16622
16623 if (!info->attrs[NL80211_ATTR_SAR_SPEC])
16624 return -EINVAL;
16625
16626 nla_parse_nested(tb, NL80211_SAR_ATTR_MAX,
16627 info->attrs[NL80211_ATTR_SAR_SPEC],
16628 NULL, NULL);
16629
16630 if (!tb[NL80211_SAR_ATTR_TYPE] || !tb[NL80211_SAR_ATTR_SPECS])
16631 return -EINVAL;
16632
16633 type = nla_get_u32(tb[NL80211_SAR_ATTR_TYPE]);
16634 if (type != rdev->wiphy.sar_capa->type)
16635 return -EINVAL;
16636
16637 specs = 0;
16638 nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem)
16639 specs++;
16640
16641 if (specs > rdev->wiphy.sar_capa->num_freq_ranges)
16642 return -EINVAL;
16643
16644 sar_spec = kzalloc(struct_size(sar_spec, sub_specs, specs), GFP_KERNEL);
16645 if (!sar_spec)
16646 return -ENOMEM;
16647
16648 sar_spec->type = type;
16649 specs = 0;
16650 nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem) {
16651 nla_parse_nested(spec, NL80211_SAR_ATTR_SPECS_MAX,
16652 spec_list, NULL, NULL);
16653
16654 switch (type) {
16655 case NL80211_SAR_TYPE_POWER:
16656 if (nl80211_set_sar_sub_specs(rdev, sar_spec,
16657 spec, specs)) {
16658 err = -EINVAL;
16659 goto error;
16660 }
16661 break;
16662 default:
16663 err = -EINVAL;
16664 goto error;
16665 }
16666 specs++;
16667 }
16668
16669 sar_spec->num_sub_specs = specs;
16670
16671 rdev->cur_cmd_info = info;
16672 err = rdev_set_sar_specs(rdev, sar_spec);
16673 rdev->cur_cmd_info = NULL;
16674 error:
16675 kfree(sar_spec);
16676 return err;
16677 }
16678
16679 #define SELECTOR(__sel, name, value) \
16680 ((__sel) == (value)) ? NL80211_IFL_SEL_##name :
16681 int __missing_selector(void);
16682 #define IFLAGS(__val) INTERNAL_FLAG_SELECTORS(__val) __missing_selector()
16683
16684 static const struct genl_ops nl80211_ops[] = {
16685 {
16686 .cmd = NL80211_CMD_GET_WIPHY,
16687 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16688 .doit = nl80211_get_wiphy,
16689 .dumpit = nl80211_dump_wiphy,
16690 .done = nl80211_dump_wiphy_done,
16691 /* can be retrieved by unprivileged users */
16692 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
16693 },
16694 };
16695
16696 static const struct genl_small_ops nl80211_small_ops[] = {
16697 {
16698 .cmd = NL80211_CMD_SET_WIPHY,
16699 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16700 .doit = nl80211_set_wiphy,
16701 .flags = GENL_UNS_ADMIN_PERM,
16702 },
16703 {
16704 .cmd = NL80211_CMD_GET_INTERFACE,
16705 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16706 .doit = nl80211_get_interface,
16707 .dumpit = nl80211_dump_interface,
16708 /* can be retrieved by unprivileged users */
16709 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV),
16710 },
16711 {
16712 .cmd = NL80211_CMD_SET_INTERFACE,
16713 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16714 .doit = nl80211_set_interface,
16715 .flags = GENL_UNS_ADMIN_PERM,
16716 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
16717 NL80211_FLAG_NEED_RTNL),
16718 },
16719 {
16720 .cmd = NL80211_CMD_NEW_INTERFACE,
16721 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16722 .doit = nl80211_new_interface,
16723 .flags = GENL_UNS_ADMIN_PERM,
16724 .internal_flags =
16725 IFLAGS(NL80211_FLAG_NEED_WIPHY |
16726 NL80211_FLAG_NEED_RTNL |
16727 /* we take the wiphy mutex later ourselves */
16728 NL80211_FLAG_NO_WIPHY_MTX),
16729 },
16730 {
16731 .cmd = NL80211_CMD_DEL_INTERFACE,
16732 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16733 .doit = nl80211_del_interface,
16734 .flags = GENL_UNS_ADMIN_PERM,
16735 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
16736 NL80211_FLAG_NEED_RTNL),
16737 },
16738 {
16739 .cmd = NL80211_CMD_GET_KEY,
16740 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16741 .doit = nl80211_get_key,
16742 .flags = GENL_UNS_ADMIN_PERM,
16743 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16744 },
16745 {
16746 .cmd = NL80211_CMD_SET_KEY,
16747 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16748 .doit = nl80211_set_key,
16749 .flags = GENL_UNS_ADMIN_PERM,
16750 /* cannot use NL80211_FLAG_MLO_VALID_LINK_ID, depends on key */
16751 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16752 NL80211_FLAG_CLEAR_SKB),
16753 },
16754 {
16755 .cmd = NL80211_CMD_NEW_KEY,
16756 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16757 .doit = nl80211_new_key,
16758 .flags = GENL_UNS_ADMIN_PERM,
16759 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16760 NL80211_FLAG_CLEAR_SKB),
16761 },
16762 {
16763 .cmd = NL80211_CMD_DEL_KEY,
16764 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16765 .doit = nl80211_del_key,
16766 .flags = GENL_UNS_ADMIN_PERM,
16767 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16768 },
16769 {
16770 .cmd = NL80211_CMD_SET_BEACON,
16771 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16772 .flags = GENL_UNS_ADMIN_PERM,
16773 .doit = nl80211_set_beacon,
16774 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16775 NL80211_FLAG_MLO_VALID_LINK_ID),
16776 },
16777 {
16778 .cmd = NL80211_CMD_START_AP,
16779 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16780 .flags = GENL_UNS_ADMIN_PERM,
16781 .doit = nl80211_start_ap,
16782 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16783 NL80211_FLAG_MLO_VALID_LINK_ID),
16784 },
16785 {
16786 .cmd = NL80211_CMD_STOP_AP,
16787 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16788 .flags = GENL_UNS_ADMIN_PERM,
16789 .doit = nl80211_stop_ap,
16790 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16791 NL80211_FLAG_MLO_VALID_LINK_ID),
16792 },
16793 {
16794 .cmd = NL80211_CMD_GET_STATION,
16795 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16796 .doit = nl80211_get_station,
16797 .dumpit = nl80211_dump_station,
16798 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
16799 },
16800 {
16801 .cmd = NL80211_CMD_SET_STATION,
16802 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16803 .doit = nl80211_set_station,
16804 .flags = GENL_UNS_ADMIN_PERM,
16805 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16806 },
16807 {
16808 .cmd = NL80211_CMD_NEW_STATION,
16809 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16810 .doit = nl80211_new_station,
16811 .flags = GENL_UNS_ADMIN_PERM,
16812 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16813 },
16814 {
16815 .cmd = NL80211_CMD_DEL_STATION,
16816 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16817 .doit = nl80211_del_station,
16818 .flags = GENL_UNS_ADMIN_PERM,
16819 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16820 },
16821 {
16822 .cmd = NL80211_CMD_GET_MPATH,
16823 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16824 .doit = nl80211_get_mpath,
16825 .dumpit = nl80211_dump_mpath,
16826 .flags = GENL_UNS_ADMIN_PERM,
16827 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16828 },
16829 {
16830 .cmd = NL80211_CMD_GET_MPP,
16831 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16832 .doit = nl80211_get_mpp,
16833 .dumpit = nl80211_dump_mpp,
16834 .flags = GENL_UNS_ADMIN_PERM,
16835 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16836 },
16837 {
16838 .cmd = NL80211_CMD_SET_MPATH,
16839 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16840 .doit = nl80211_set_mpath,
16841 .flags = GENL_UNS_ADMIN_PERM,
16842 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16843 },
16844 {
16845 .cmd = NL80211_CMD_NEW_MPATH,
16846 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16847 .doit = nl80211_new_mpath,
16848 .flags = GENL_UNS_ADMIN_PERM,
16849 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16850 },
16851 {
16852 .cmd = NL80211_CMD_DEL_MPATH,
16853 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16854 .doit = nl80211_del_mpath,
16855 .flags = GENL_UNS_ADMIN_PERM,
16856 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16857 },
16858 {
16859 .cmd = NL80211_CMD_SET_BSS,
16860 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16861 .doit = nl80211_set_bss,
16862 .flags = GENL_UNS_ADMIN_PERM,
16863 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16864 NL80211_FLAG_MLO_VALID_LINK_ID),
16865 },
16866 {
16867 .cmd = NL80211_CMD_GET_REG,
16868 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16869 .doit = nl80211_get_reg_do,
16870 .dumpit = nl80211_get_reg_dump,
16871 /* can be retrieved by unprivileged users */
16872 },
16873 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
16874 {
16875 .cmd = NL80211_CMD_SET_REG,
16876 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16877 .doit = nl80211_set_reg,
16878 .flags = GENL_ADMIN_PERM,
16879 },
16880 #endif
16881 {
16882 .cmd = NL80211_CMD_REQ_SET_REG,
16883 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16884 .doit = nl80211_req_set_reg,
16885 .flags = GENL_ADMIN_PERM,
16886 },
16887 {
16888 .cmd = NL80211_CMD_RELOAD_REGDB,
16889 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16890 .doit = nl80211_reload_regdb,
16891 .flags = GENL_ADMIN_PERM,
16892 },
16893 {
16894 .cmd = NL80211_CMD_GET_MESH_CONFIG,
16895 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16896 .doit = nl80211_get_mesh_config,
16897 /* can be retrieved by unprivileged users */
16898 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16899 },
16900 {
16901 .cmd = NL80211_CMD_SET_MESH_CONFIG,
16902 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16903 .doit = nl80211_update_mesh_config,
16904 .flags = GENL_UNS_ADMIN_PERM,
16905 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16906 },
16907 {
16908 .cmd = NL80211_CMD_TRIGGER_SCAN,
16909 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16910 .doit = nl80211_trigger_scan,
16911 .flags = GENL_UNS_ADMIN_PERM,
16912 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
16913 },
16914 {
16915 .cmd = NL80211_CMD_ABORT_SCAN,
16916 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16917 .doit = nl80211_abort_scan,
16918 .flags = GENL_UNS_ADMIN_PERM,
16919 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
16920 },
16921 {
16922 .cmd = NL80211_CMD_GET_SCAN,
16923 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16924 .dumpit = nl80211_dump_scan,
16925 },
16926 {
16927 .cmd = NL80211_CMD_START_SCHED_SCAN,
16928 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16929 .doit = nl80211_start_sched_scan,
16930 .flags = GENL_UNS_ADMIN_PERM,
16931 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16932 },
16933 {
16934 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
16935 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16936 .doit = nl80211_stop_sched_scan,
16937 .flags = GENL_UNS_ADMIN_PERM,
16938 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16939 },
16940 {
16941 .cmd = NL80211_CMD_AUTHENTICATE,
16942 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16943 .doit = nl80211_authenticate,
16944 .flags = GENL_UNS_ADMIN_PERM,
16945 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16946 NL80211_FLAG_CLEAR_SKB),
16947 },
16948 {
16949 .cmd = NL80211_CMD_ASSOCIATE,
16950 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16951 .doit = nl80211_associate,
16952 .flags = GENL_UNS_ADMIN_PERM,
16953 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16954 NL80211_FLAG_CLEAR_SKB),
16955 },
16956 {
16957 .cmd = NL80211_CMD_DEAUTHENTICATE,
16958 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16959 .doit = nl80211_deauthenticate,
16960 .flags = GENL_UNS_ADMIN_PERM,
16961 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16962 },
16963 {
16964 .cmd = NL80211_CMD_DISASSOCIATE,
16965 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16966 .doit = nl80211_disassociate,
16967 .flags = GENL_UNS_ADMIN_PERM,
16968 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16969 },
16970 {
16971 .cmd = NL80211_CMD_JOIN_IBSS,
16972 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16973 .doit = nl80211_join_ibss,
16974 .flags = GENL_UNS_ADMIN_PERM,
16975 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16976 },
16977 {
16978 .cmd = NL80211_CMD_LEAVE_IBSS,
16979 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16980 .doit = nl80211_leave_ibss,
16981 .flags = GENL_UNS_ADMIN_PERM,
16982 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16983 },
16984 #ifdef CONFIG_NL80211_TESTMODE
16985 {
16986 .cmd = NL80211_CMD_TESTMODE,
16987 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16988 .doit = nl80211_testmode_do,
16989 .dumpit = nl80211_testmode_dump,
16990 .flags = GENL_UNS_ADMIN_PERM,
16991 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
16992 },
16993 #endif
16994 {
16995 .cmd = NL80211_CMD_CONNECT,
16996 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16997 .doit = nl80211_connect,
16998 .flags = GENL_UNS_ADMIN_PERM,
16999 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17000 NL80211_FLAG_CLEAR_SKB),
17001 },
17002 {
17003 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
17004 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17005 .doit = nl80211_update_connect_params,
17006 .flags = GENL_ADMIN_PERM,
17007 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17008 NL80211_FLAG_CLEAR_SKB),
17009 },
17010 {
17011 .cmd = NL80211_CMD_DISCONNECT,
17012 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17013 .doit = nl80211_disconnect,
17014 .flags = GENL_UNS_ADMIN_PERM,
17015 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17016 },
17017 {
17018 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
17019 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17020 .doit = nl80211_wiphy_netns,
17021 .flags = GENL_UNS_ADMIN_PERM,
17022 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
17023 NL80211_FLAG_NEED_RTNL |
17024 NL80211_FLAG_NO_WIPHY_MTX),
17025 },
17026 {
17027 .cmd = NL80211_CMD_GET_SURVEY,
17028 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17029 .dumpit = nl80211_dump_survey,
17030 },
17031 {
17032 .cmd = NL80211_CMD_SET_PMKSA,
17033 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17034 .doit = nl80211_setdel_pmksa,
17035 .flags = GENL_UNS_ADMIN_PERM,
17036 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17037 NL80211_FLAG_CLEAR_SKB),
17038 },
17039 {
17040 .cmd = NL80211_CMD_DEL_PMKSA,
17041 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17042 .doit = nl80211_setdel_pmksa,
17043 .flags = GENL_UNS_ADMIN_PERM,
17044 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17045 },
17046 {
17047 .cmd = NL80211_CMD_FLUSH_PMKSA,
17048 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17049 .doit = nl80211_flush_pmksa,
17050 .flags = GENL_UNS_ADMIN_PERM,
17051 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17052 },
17053 {
17054 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
17055 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17056 .doit = nl80211_remain_on_channel,
17057 .flags = GENL_UNS_ADMIN_PERM,
17058 /* FIXME: requiring a link ID here is probably not good */
17059 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
17060 NL80211_FLAG_MLO_VALID_LINK_ID),
17061 },
17062 {
17063 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
17064 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17065 .doit = nl80211_cancel_remain_on_channel,
17066 .flags = GENL_UNS_ADMIN_PERM,
17067 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17068 },
17069 {
17070 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
17071 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17072 .doit = nl80211_set_tx_bitrate_mask,
17073 .flags = GENL_UNS_ADMIN_PERM,
17074 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17075 NL80211_FLAG_MLO_VALID_LINK_ID),
17076 },
17077 {
17078 .cmd = NL80211_CMD_REGISTER_FRAME,
17079 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17080 .doit = nl80211_register_mgmt,
17081 .flags = GENL_UNS_ADMIN_PERM,
17082 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV),
17083 },
17084 {
17085 .cmd = NL80211_CMD_FRAME,
17086 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17087 .doit = nl80211_tx_mgmt,
17088 .flags = GENL_UNS_ADMIN_PERM,
17089 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17090 },
17091 {
17092 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
17093 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17094 .doit = nl80211_tx_mgmt_cancel_wait,
17095 .flags = GENL_UNS_ADMIN_PERM,
17096 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17097 },
17098 {
17099 .cmd = NL80211_CMD_SET_POWER_SAVE,
17100 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17101 .doit = nl80211_set_power_save,
17102 .flags = GENL_UNS_ADMIN_PERM,
17103 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17104 },
17105 {
17106 .cmd = NL80211_CMD_GET_POWER_SAVE,
17107 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17108 .doit = nl80211_get_power_save,
17109 /* can be retrieved by unprivileged users */
17110 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17111 },
17112 {
17113 .cmd = NL80211_CMD_SET_CQM,
17114 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17115 .doit = nl80211_set_cqm,
17116 .flags = GENL_UNS_ADMIN_PERM,
17117 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17118 },
17119 {
17120 .cmd = NL80211_CMD_SET_CHANNEL,
17121 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17122 .doit = nl80211_set_channel,
17123 .flags = GENL_UNS_ADMIN_PERM,
17124 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17125 NL80211_FLAG_MLO_VALID_LINK_ID),
17126 },
17127 {
17128 .cmd = NL80211_CMD_JOIN_MESH,
17129 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17130 .doit = nl80211_join_mesh,
17131 .flags = GENL_UNS_ADMIN_PERM,
17132 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17133 },
17134 {
17135 .cmd = NL80211_CMD_LEAVE_MESH,
17136 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17137 .doit = nl80211_leave_mesh,
17138 .flags = GENL_UNS_ADMIN_PERM,
17139 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17140 },
17141 {
17142 .cmd = NL80211_CMD_JOIN_OCB,
17143 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17144 .doit = nl80211_join_ocb,
17145 .flags = GENL_UNS_ADMIN_PERM,
17146 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17147 },
17148 {
17149 .cmd = NL80211_CMD_LEAVE_OCB,
17150 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17151 .doit = nl80211_leave_ocb,
17152 .flags = GENL_UNS_ADMIN_PERM,
17153 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17154 },
17155 #ifdef CONFIG_PM
17156 {
17157 .cmd = NL80211_CMD_GET_WOWLAN,
17158 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17159 .doit = nl80211_get_wowlan,
17160 /* can be retrieved by unprivileged users */
17161 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17162 },
17163 {
17164 .cmd = NL80211_CMD_SET_WOWLAN,
17165 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17166 .doit = nl80211_set_wowlan,
17167 .flags = GENL_UNS_ADMIN_PERM,
17168 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17169 },
17170 #endif
17171 {
17172 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
17173 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17174 .doit = nl80211_set_rekey_data,
17175 .flags = GENL_UNS_ADMIN_PERM,
17176 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17177 NL80211_FLAG_CLEAR_SKB),
17178 },
17179 {
17180 .cmd = NL80211_CMD_TDLS_MGMT,
17181 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17182 .doit = nl80211_tdls_mgmt,
17183 .flags = GENL_UNS_ADMIN_PERM,
17184 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17185 NL80211_FLAG_MLO_VALID_LINK_ID),
17186 },
17187 {
17188 .cmd = NL80211_CMD_TDLS_OPER,
17189 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17190 .doit = nl80211_tdls_oper,
17191 .flags = GENL_UNS_ADMIN_PERM,
17192 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17193 },
17194 {
17195 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
17196 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17197 .doit = nl80211_register_unexpected_frame,
17198 .flags = GENL_UNS_ADMIN_PERM,
17199 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17200 },
17201 {
17202 .cmd = NL80211_CMD_PROBE_CLIENT,
17203 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17204 .doit = nl80211_probe_client,
17205 .flags = GENL_UNS_ADMIN_PERM,
17206 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17207 },
17208 {
17209 .cmd = NL80211_CMD_REGISTER_BEACONS,
17210 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17211 .doit = nl80211_register_beacons,
17212 .flags = GENL_UNS_ADMIN_PERM,
17213 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17214 },
17215 {
17216 .cmd = NL80211_CMD_SET_NOACK_MAP,
17217 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17218 .doit = nl80211_set_noack_map,
17219 .flags = GENL_UNS_ADMIN_PERM,
17220 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17221 },
17222 {
17223 .cmd = NL80211_CMD_START_P2P_DEVICE,
17224 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17225 .doit = nl80211_start_p2p_device,
17226 .flags = GENL_UNS_ADMIN_PERM,
17227 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
17228 NL80211_FLAG_NEED_RTNL),
17229 },
17230 {
17231 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
17232 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17233 .doit = nl80211_stop_p2p_device,
17234 .flags = GENL_UNS_ADMIN_PERM,
17235 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
17236 NL80211_FLAG_NEED_RTNL),
17237 },
17238 {
17239 .cmd = NL80211_CMD_START_NAN,
17240 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17241 .doit = nl80211_start_nan,
17242 .flags = GENL_ADMIN_PERM,
17243 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
17244 NL80211_FLAG_NEED_RTNL),
17245 },
17246 {
17247 .cmd = NL80211_CMD_STOP_NAN,
17248 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17249 .doit = nl80211_stop_nan,
17250 .flags = GENL_ADMIN_PERM,
17251 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
17252 NL80211_FLAG_NEED_RTNL),
17253 },
17254 {
17255 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
17256 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17257 .doit = nl80211_nan_add_func,
17258 .flags = GENL_ADMIN_PERM,
17259 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17260 },
17261 {
17262 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
17263 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17264 .doit = nl80211_nan_del_func,
17265 .flags = GENL_ADMIN_PERM,
17266 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17267 },
17268 {
17269 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
17270 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17271 .doit = nl80211_nan_change_config,
17272 .flags = GENL_ADMIN_PERM,
17273 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17274 },
17275 {
17276 .cmd = NL80211_CMD_SET_MCAST_RATE,
17277 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17278 .doit = nl80211_set_mcast_rate,
17279 .flags = GENL_UNS_ADMIN_PERM,
17280 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17281 },
17282 {
17283 .cmd = NL80211_CMD_SET_MAC_ACL,
17284 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17285 .doit = nl80211_set_mac_acl,
17286 .flags = GENL_UNS_ADMIN_PERM,
17287 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17288 NL80211_FLAG_MLO_UNSUPPORTED),
17289 },
17290 {
17291 .cmd = NL80211_CMD_RADAR_DETECT,
17292 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17293 .doit = nl80211_start_radar_detection,
17294 .flags = GENL_UNS_ADMIN_PERM,
17295 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17296 NL80211_FLAG_NO_WIPHY_MTX |
17297 NL80211_FLAG_MLO_UNSUPPORTED),
17298 },
17299 {
17300 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
17301 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17302 .doit = nl80211_get_protocol_features,
17303 },
17304 {
17305 .cmd = NL80211_CMD_UPDATE_FT_IES,
17306 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17307 .doit = nl80211_update_ft_ies,
17308 .flags = GENL_UNS_ADMIN_PERM,
17309 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17310 },
17311 {
17312 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
17313 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17314 .doit = nl80211_crit_protocol_start,
17315 .flags = GENL_UNS_ADMIN_PERM,
17316 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17317 },
17318 {
17319 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
17320 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17321 .doit = nl80211_crit_protocol_stop,
17322 .flags = GENL_UNS_ADMIN_PERM,
17323 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17324 },
17325 {
17326 .cmd = NL80211_CMD_GET_COALESCE,
17327 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17328 .doit = nl80211_get_coalesce,
17329 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17330 },
17331 {
17332 .cmd = NL80211_CMD_SET_COALESCE,
17333 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17334 .doit = nl80211_set_coalesce,
17335 .flags = GENL_UNS_ADMIN_PERM,
17336 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17337 },
17338 {
17339 .cmd = NL80211_CMD_CHANNEL_SWITCH,
17340 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17341 .doit = nl80211_channel_switch,
17342 .flags = GENL_UNS_ADMIN_PERM,
17343 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17344 NL80211_FLAG_MLO_VALID_LINK_ID),
17345 },
17346 {
17347 .cmd = NL80211_CMD_VENDOR,
17348 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17349 .doit = nl80211_vendor_cmd,
17350 .dumpit = nl80211_vendor_cmd_dump,
17351 .flags = GENL_UNS_ADMIN_PERM,
17352 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
17353 NL80211_FLAG_CLEAR_SKB),
17354 },
17355 {
17356 .cmd = NL80211_CMD_SET_QOS_MAP,
17357 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17358 .doit = nl80211_set_qos_map,
17359 .flags = GENL_UNS_ADMIN_PERM,
17360 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17361 },
17362 {
17363 .cmd = NL80211_CMD_ADD_TX_TS,
17364 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17365 .doit = nl80211_add_tx_ts,
17366 .flags = GENL_UNS_ADMIN_PERM,
17367 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17368 NL80211_FLAG_MLO_UNSUPPORTED),
17369 },
17370 {
17371 .cmd = NL80211_CMD_DEL_TX_TS,
17372 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17373 .doit = nl80211_del_tx_ts,
17374 .flags = GENL_UNS_ADMIN_PERM,
17375 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17376 },
17377 {
17378 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
17379 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17380 .doit = nl80211_tdls_channel_switch,
17381 .flags = GENL_UNS_ADMIN_PERM,
17382 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17383 },
17384 {
17385 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
17386 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17387 .doit = nl80211_tdls_cancel_channel_switch,
17388 .flags = GENL_UNS_ADMIN_PERM,
17389 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17390 },
17391 {
17392 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
17393 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17394 .doit = nl80211_set_multicast_to_unicast,
17395 .flags = GENL_UNS_ADMIN_PERM,
17396 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17397 },
17398 {
17399 .cmd = NL80211_CMD_SET_PMK,
17400 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17401 .doit = nl80211_set_pmk,
17402 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17403 NL80211_FLAG_CLEAR_SKB),
17404 },
17405 {
17406 .cmd = NL80211_CMD_DEL_PMK,
17407 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17408 .doit = nl80211_del_pmk,
17409 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17410 },
17411 {
17412 .cmd = NL80211_CMD_EXTERNAL_AUTH,
17413 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17414 .doit = nl80211_external_auth,
17415 .flags = GENL_ADMIN_PERM,
17416 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17417 },
17418 {
17419 .cmd = NL80211_CMD_CONTROL_PORT_FRAME,
17420 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17421 .doit = nl80211_tx_control_port,
17422 .flags = GENL_UNS_ADMIN_PERM,
17423 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17424 },
17425 {
17426 .cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS,
17427 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17428 .doit = nl80211_get_ftm_responder_stats,
17429 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17430 NL80211_FLAG_MLO_VALID_LINK_ID),
17431 },
17432 {
17433 .cmd = NL80211_CMD_PEER_MEASUREMENT_START,
17434 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17435 .doit = nl80211_pmsr_start,
17436 .flags = GENL_UNS_ADMIN_PERM,
17437 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17438 },
17439 {
17440 .cmd = NL80211_CMD_NOTIFY_RADAR,
17441 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17442 .doit = nl80211_notify_radar_detection,
17443 .flags = GENL_UNS_ADMIN_PERM,
17444 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17445 },
17446 {
17447 .cmd = NL80211_CMD_UPDATE_OWE_INFO,
17448 .doit = nl80211_update_owe_info,
17449 .flags = GENL_ADMIN_PERM,
17450 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17451 },
17452 {
17453 .cmd = NL80211_CMD_PROBE_MESH_LINK,
17454 .doit = nl80211_probe_mesh_link,
17455 .flags = GENL_UNS_ADMIN_PERM,
17456 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17457 },
17458 {
17459 .cmd = NL80211_CMD_SET_TID_CONFIG,
17460 .doit = nl80211_set_tid_config,
17461 .flags = GENL_UNS_ADMIN_PERM,
17462 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17463 NL80211_FLAG_MLO_VALID_LINK_ID),
17464 },
17465 {
17466 .cmd = NL80211_CMD_SET_SAR_SPECS,
17467 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17468 .doit = nl80211_set_sar_specs,
17469 .flags = GENL_UNS_ADMIN_PERM,
17470 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
17471 NL80211_FLAG_NEED_RTNL),
17472 },
17473 {
17474 .cmd = NL80211_CMD_COLOR_CHANGE_REQUEST,
17475 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17476 .doit = nl80211_color_change,
17477 .flags = GENL_UNS_ADMIN_PERM,
17478 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17479 },
17480 {
17481 .cmd = NL80211_CMD_SET_FILS_AAD,
17482 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17483 .doit = nl80211_set_fils_aad,
17484 .flags = GENL_UNS_ADMIN_PERM,
17485 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17486 },
17487 {
17488 .cmd = NL80211_CMD_ADD_LINK,
17489 .doit = nl80211_add_link,
17490 .flags = GENL_UNS_ADMIN_PERM,
17491 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17492 },
17493 {
17494 .cmd = NL80211_CMD_REMOVE_LINK,
17495 .doit = nl80211_remove_link,
17496 .flags = GENL_UNS_ADMIN_PERM,
17497 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17498 NL80211_FLAG_MLO_VALID_LINK_ID),
17499 },
17500 {
17501 .cmd = NL80211_CMD_ADD_LINK_STA,
17502 .doit = nl80211_add_link_station,
17503 .flags = GENL_UNS_ADMIN_PERM,
17504 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17505 NL80211_FLAG_MLO_VALID_LINK_ID),
17506 },
17507 {
17508 .cmd = NL80211_CMD_MODIFY_LINK_STA,
17509 .doit = nl80211_modify_link_station,
17510 .flags = GENL_UNS_ADMIN_PERM,
17511 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17512 NL80211_FLAG_MLO_VALID_LINK_ID),
17513 },
17514 {
17515 .cmd = NL80211_CMD_REMOVE_LINK_STA,
17516 .doit = nl80211_remove_link_station,
17517 .flags = GENL_UNS_ADMIN_PERM,
17518 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17519 NL80211_FLAG_MLO_VALID_LINK_ID),
17520 },
17521 {
17522 .cmd = NL80211_CMD_SET_HW_TIMESTAMP,
17523 .doit = nl80211_set_hw_timestamp,
17524 .flags = GENL_UNS_ADMIN_PERM,
17525 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17526 },
17527 };
17528
17529 static struct genl_family nl80211_fam __ro_after_init = {
17530 .name = NL80211_GENL_NAME, /* have users key off the name instead */
17531 .hdrsize = 0, /* no private header */
17532 .version = 1, /* no particular meaning now */
17533 .maxattr = NL80211_ATTR_MAX,
17534 .policy = nl80211_policy,
17535 .netnsok = true,
17536 .pre_doit = nl80211_pre_doit,
17537 .post_doit = nl80211_post_doit,
17538 .module = THIS_MODULE,
17539 .ops = nl80211_ops,
17540 .n_ops = ARRAY_SIZE(nl80211_ops),
17541 .small_ops = nl80211_small_ops,
17542 .n_small_ops = ARRAY_SIZE(nl80211_small_ops),
17543 .resv_start_op = NL80211_CMD_REMOVE_LINK_STA + 1,
17544 .mcgrps = nl80211_mcgrps,
17545 .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
17546 .parallel_ops = true,
17547 };
17548
17549 /* notification functions */
17550
nl80211_notify_wiphy(struct cfg80211_registered_device * rdev,enum nl80211_commands cmd)17551 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
17552 enum nl80211_commands cmd)
17553 {
17554 struct sk_buff *msg;
17555 struct nl80211_dump_wiphy_state state = {};
17556
17557 WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
17558 cmd != NL80211_CMD_DEL_WIPHY);
17559
17560 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17561 if (!msg)
17562 return;
17563
17564 if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
17565 nlmsg_free(msg);
17566 return;
17567 }
17568
17569 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17570 NL80211_MCGRP_CONFIG, GFP_KERNEL);
17571 }
17572
nl80211_notify_iface(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,enum nl80211_commands cmd)17573 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
17574 struct wireless_dev *wdev,
17575 enum nl80211_commands cmd)
17576 {
17577 struct sk_buff *msg;
17578
17579 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17580 if (!msg)
17581 return;
17582
17583 if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, cmd) < 0) {
17584 nlmsg_free(msg);
17585 return;
17586 }
17587
17588 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17589 NL80211_MCGRP_CONFIG, GFP_KERNEL);
17590 }
17591
nl80211_add_scan_req(struct sk_buff * msg,struct cfg80211_registered_device * rdev)17592 static int nl80211_add_scan_req(struct sk_buff *msg,
17593 struct cfg80211_registered_device *rdev)
17594 {
17595 struct cfg80211_scan_request *req = rdev->scan_req;
17596 struct nlattr *nest;
17597 int i;
17598 struct cfg80211_scan_info *info;
17599
17600 if (WARN_ON(!req))
17601 return 0;
17602
17603 nest = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_SSIDS);
17604 if (!nest)
17605 goto nla_put_failure;
17606 for (i = 0; i < req->n_ssids; i++) {
17607 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
17608 goto nla_put_failure;
17609 }
17610 nla_nest_end(msg, nest);
17611
17612 if (req->flags & NL80211_SCAN_FLAG_FREQ_KHZ) {
17613 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQ_KHZ);
17614 if (!nest)
17615 goto nla_put_failure;
17616 for (i = 0; i < req->n_channels; i++) {
17617 if (nla_put_u32(msg, i,
17618 ieee80211_channel_to_khz(req->channels[i])))
17619 goto nla_put_failure;
17620 }
17621 nla_nest_end(msg, nest);
17622 } else {
17623 nest = nla_nest_start_noflag(msg,
17624 NL80211_ATTR_SCAN_FREQUENCIES);
17625 if (!nest)
17626 goto nla_put_failure;
17627 for (i = 0; i < req->n_channels; i++) {
17628 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
17629 goto nla_put_failure;
17630 }
17631 nla_nest_end(msg, nest);
17632 }
17633
17634 if (req->ie &&
17635 nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
17636 goto nla_put_failure;
17637
17638 if (req->flags &&
17639 nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
17640 goto nla_put_failure;
17641
17642 info = rdev->int_scan_req ? &rdev->int_scan_req->info :
17643 &rdev->scan_req->info;
17644 if (info->scan_start_tsf &&
17645 (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
17646 info->scan_start_tsf, NL80211_BSS_PAD) ||
17647 nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
17648 info->tsf_bssid)))
17649 goto nla_put_failure;
17650
17651 return 0;
17652 nla_put_failure:
17653 return -ENOBUFS;
17654 }
17655
nl80211_prep_scan_msg(struct sk_buff * msg,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,u32 portid,u32 seq,int flags,u32 cmd)17656 static int nl80211_prep_scan_msg(struct sk_buff *msg,
17657 struct cfg80211_registered_device *rdev,
17658 struct wireless_dev *wdev,
17659 u32 portid, u32 seq, int flags,
17660 u32 cmd)
17661 {
17662 void *hdr;
17663
17664 hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
17665 if (!hdr)
17666 return -1;
17667
17668 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17669 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
17670 wdev->netdev->ifindex)) ||
17671 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17672 NL80211_ATTR_PAD))
17673 goto nla_put_failure;
17674
17675 /* ignore errors and send incomplete event anyway */
17676 nl80211_add_scan_req(msg, rdev);
17677
17678 genlmsg_end(msg, hdr);
17679 return 0;
17680
17681 nla_put_failure:
17682 genlmsg_cancel(msg, hdr);
17683 return -EMSGSIZE;
17684 }
17685
17686 static int
nl80211_prep_sched_scan_msg(struct sk_buff * msg,struct cfg80211_sched_scan_request * req,u32 cmd)17687 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
17688 struct cfg80211_sched_scan_request *req, u32 cmd)
17689 {
17690 void *hdr;
17691
17692 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
17693 if (!hdr)
17694 return -1;
17695
17696 if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
17697 wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
17698 nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
17699 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
17700 NL80211_ATTR_PAD))
17701 goto nla_put_failure;
17702
17703 genlmsg_end(msg, hdr);
17704 return 0;
17705
17706 nla_put_failure:
17707 genlmsg_cancel(msg, hdr);
17708 return -EMSGSIZE;
17709 }
17710
nl80211_send_scan_start(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev)17711 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
17712 struct wireless_dev *wdev)
17713 {
17714 struct sk_buff *msg;
17715
17716 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17717 if (!msg)
17718 return;
17719
17720 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
17721 NL80211_CMD_TRIGGER_SCAN) < 0) {
17722 nlmsg_free(msg);
17723 return;
17724 }
17725
17726 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17727 NL80211_MCGRP_SCAN, GFP_KERNEL);
17728 }
17729
nl80211_build_scan_msg(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,bool aborted)17730 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
17731 struct wireless_dev *wdev, bool aborted)
17732 {
17733 struct sk_buff *msg;
17734
17735 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17736 if (!msg)
17737 return NULL;
17738
17739 if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
17740 aborted ? NL80211_CMD_SCAN_ABORTED :
17741 NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
17742 nlmsg_free(msg);
17743 return NULL;
17744 }
17745
17746 return msg;
17747 }
17748
17749 /* send message created by nl80211_build_scan_msg() */
nl80211_send_scan_msg(struct cfg80211_registered_device * rdev,struct sk_buff * msg)17750 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
17751 struct sk_buff *msg)
17752 {
17753 if (!msg)
17754 return;
17755
17756 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17757 NL80211_MCGRP_SCAN, GFP_KERNEL);
17758 }
17759
nl80211_send_sched_scan(struct cfg80211_sched_scan_request * req,u32 cmd)17760 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
17761 {
17762 struct sk_buff *msg;
17763
17764 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17765 if (!msg)
17766 return;
17767
17768 if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
17769 nlmsg_free(msg);
17770 return;
17771 }
17772
17773 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
17774 NL80211_MCGRP_SCAN, GFP_KERNEL);
17775 }
17776
nl80211_reg_change_event_fill(struct sk_buff * msg,struct regulatory_request * request)17777 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
17778 struct regulatory_request *request)
17779 {
17780 /* Userspace can always count this one always being set */
17781 if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
17782 goto nla_put_failure;
17783
17784 if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
17785 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
17786 NL80211_REGDOM_TYPE_WORLD))
17787 goto nla_put_failure;
17788 } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
17789 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
17790 NL80211_REGDOM_TYPE_CUSTOM_WORLD))
17791 goto nla_put_failure;
17792 } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
17793 request->intersect) {
17794 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
17795 NL80211_REGDOM_TYPE_INTERSECTION))
17796 goto nla_put_failure;
17797 } else {
17798 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
17799 NL80211_REGDOM_TYPE_COUNTRY) ||
17800 nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
17801 request->alpha2))
17802 goto nla_put_failure;
17803 }
17804
17805 if (request->wiphy_idx != WIPHY_IDX_INVALID) {
17806 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
17807
17808 if (wiphy &&
17809 nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
17810 goto nla_put_failure;
17811
17812 if (wiphy &&
17813 wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
17814 nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
17815 goto nla_put_failure;
17816 }
17817
17818 return true;
17819
17820 nla_put_failure:
17821 return false;
17822 }
17823
17824 /*
17825 * This can happen on global regulatory changes or device specific settings
17826 * based on custom regulatory domains.
17827 */
nl80211_common_reg_change_event(enum nl80211_commands cmd_id,struct regulatory_request * request)17828 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
17829 struct regulatory_request *request)
17830 {
17831 struct sk_buff *msg;
17832 void *hdr;
17833
17834 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17835 if (!msg)
17836 return;
17837
17838 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
17839 if (!hdr)
17840 goto nla_put_failure;
17841
17842 if (!nl80211_reg_change_event_fill(msg, request))
17843 goto nla_put_failure;
17844
17845 genlmsg_end(msg, hdr);
17846
17847 rcu_read_lock();
17848 genlmsg_multicast_allns(&nl80211_fam, msg, 0,
17849 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
17850 rcu_read_unlock();
17851
17852 return;
17853
17854 nla_put_failure:
17855 nlmsg_free(msg);
17856 }
17857
nl80211_send_mlme_event(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,enum nl80211_commands cmd,gfp_t gfp,int uapsd_queues,const u8 * req_ies,size_t req_ies_len,bool reconnect)17858 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
17859 struct net_device *netdev,
17860 const u8 *buf, size_t len,
17861 enum nl80211_commands cmd, gfp_t gfp,
17862 int uapsd_queues, const u8 *req_ies,
17863 size_t req_ies_len, bool reconnect)
17864 {
17865 struct sk_buff *msg;
17866 void *hdr;
17867
17868 msg = nlmsg_new(100 + len + req_ies_len, gfp);
17869 if (!msg)
17870 return;
17871
17872 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
17873 if (!hdr) {
17874 nlmsg_free(msg);
17875 return;
17876 }
17877
17878 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17879 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17880 nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
17881 (req_ies &&
17882 nla_put(msg, NL80211_ATTR_REQ_IE, req_ies_len, req_ies)))
17883 goto nla_put_failure;
17884
17885 if (reconnect && nla_put_flag(msg, NL80211_ATTR_RECONNECT_REQUESTED))
17886 goto nla_put_failure;
17887
17888 if (uapsd_queues >= 0) {
17889 struct nlattr *nla_wmm =
17890 nla_nest_start_noflag(msg, NL80211_ATTR_STA_WME);
17891 if (!nla_wmm)
17892 goto nla_put_failure;
17893
17894 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
17895 uapsd_queues))
17896 goto nla_put_failure;
17897
17898 nla_nest_end(msg, nla_wmm);
17899 }
17900
17901 genlmsg_end(msg, hdr);
17902
17903 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17904 NL80211_MCGRP_MLME, gfp);
17905 return;
17906
17907 nla_put_failure:
17908 nlmsg_free(msg);
17909 }
17910
nl80211_send_rx_auth(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,gfp_t gfp)17911 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
17912 struct net_device *netdev, const u8 *buf,
17913 size_t len, gfp_t gfp)
17914 {
17915 nl80211_send_mlme_event(rdev, netdev, buf, len,
17916 NL80211_CMD_AUTHENTICATE, gfp, -1, NULL, 0,
17917 false);
17918 }
17919
nl80211_send_rx_assoc(struct cfg80211_registered_device * rdev,struct net_device * netdev,struct cfg80211_rx_assoc_resp * data)17920 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
17921 struct net_device *netdev,
17922 struct cfg80211_rx_assoc_resp *data)
17923 {
17924 nl80211_send_mlme_event(rdev, netdev, data->buf, data->len,
17925 NL80211_CMD_ASSOCIATE, GFP_KERNEL,
17926 data->uapsd_queues,
17927 data->req_ies, data->req_ies_len, false);
17928 }
17929
nl80211_send_deauth(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,bool reconnect,gfp_t gfp)17930 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
17931 struct net_device *netdev, const u8 *buf,
17932 size_t len, bool reconnect, gfp_t gfp)
17933 {
17934 nl80211_send_mlme_event(rdev, netdev, buf, len,
17935 NL80211_CMD_DEAUTHENTICATE, gfp, -1, NULL, 0,
17936 reconnect);
17937 }
17938
nl80211_send_disassoc(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * buf,size_t len,bool reconnect,gfp_t gfp)17939 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
17940 struct net_device *netdev, const u8 *buf,
17941 size_t len, bool reconnect, gfp_t gfp)
17942 {
17943 nl80211_send_mlme_event(rdev, netdev, buf, len,
17944 NL80211_CMD_DISASSOCIATE, gfp, -1, NULL, 0,
17945 reconnect);
17946 }
17947
cfg80211_rx_unprot_mlme_mgmt(struct net_device * dev,const u8 * buf,size_t len)17948 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
17949 size_t len)
17950 {
17951 struct wireless_dev *wdev = dev->ieee80211_ptr;
17952 struct wiphy *wiphy = wdev->wiphy;
17953 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17954 const struct ieee80211_mgmt *mgmt = (void *)buf;
17955 u32 cmd;
17956
17957 if (WARN_ON(len < 2))
17958 return;
17959
17960 if (ieee80211_is_deauth(mgmt->frame_control)) {
17961 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
17962 } else if (ieee80211_is_disassoc(mgmt->frame_control)) {
17963 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
17964 } else if (ieee80211_is_beacon(mgmt->frame_control)) {
17965 if (wdev->unprot_beacon_reported &&
17966 elapsed_jiffies_msecs(wdev->unprot_beacon_reported) < 10000)
17967 return;
17968 cmd = NL80211_CMD_UNPROT_BEACON;
17969 wdev->unprot_beacon_reported = jiffies;
17970 } else {
17971 return;
17972 }
17973
17974 trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
17975 nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1,
17976 NULL, 0, false);
17977 }
17978 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
17979
nl80211_send_mlme_timeout(struct cfg80211_registered_device * rdev,struct net_device * netdev,int cmd,const u8 * addr,gfp_t gfp)17980 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
17981 struct net_device *netdev, int cmd,
17982 const u8 *addr, gfp_t gfp)
17983 {
17984 struct sk_buff *msg;
17985 void *hdr;
17986
17987 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17988 if (!msg)
17989 return;
17990
17991 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
17992 if (!hdr) {
17993 nlmsg_free(msg);
17994 return;
17995 }
17996
17997 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17998 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17999 nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
18000 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
18001 goto nla_put_failure;
18002
18003 genlmsg_end(msg, hdr);
18004
18005 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18006 NL80211_MCGRP_MLME, gfp);
18007 return;
18008
18009 nla_put_failure:
18010 nlmsg_free(msg);
18011 }
18012
nl80211_send_auth_timeout(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * addr,gfp_t gfp)18013 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
18014 struct net_device *netdev, const u8 *addr,
18015 gfp_t gfp)
18016 {
18017 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
18018 addr, gfp);
18019 }
18020
nl80211_send_assoc_timeout(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * addr,gfp_t gfp)18021 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
18022 struct net_device *netdev, const u8 *addr,
18023 gfp_t gfp)
18024 {
18025 nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
18026 addr, gfp);
18027 }
18028
nl80211_send_connect_result(struct cfg80211_registered_device * rdev,struct net_device * netdev,struct cfg80211_connect_resp_params * cr,gfp_t gfp)18029 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
18030 struct net_device *netdev,
18031 struct cfg80211_connect_resp_params *cr,
18032 gfp_t gfp)
18033 {
18034 struct sk_buff *msg;
18035 void *hdr;
18036 unsigned int link;
18037 size_t link_info_size = 0;
18038 const u8 *connected_addr = cr->valid_links ?
18039 cr->ap_mld_addr : cr->links[0].bssid;
18040
18041 if (cr->valid_links) {
18042 for_each_valid_link(cr, link) {
18043 /* Nested attribute header */
18044 link_info_size += NLA_HDRLEN;
18045 /* Link ID */
18046 link_info_size += nla_total_size(sizeof(u8));
18047 link_info_size += cr->links[link].addr ?
18048 nla_total_size(ETH_ALEN) : 0;
18049 link_info_size += (cr->links[link].bssid ||
18050 cr->links[link].bss) ?
18051 nla_total_size(ETH_ALEN) : 0;
18052 link_info_size += nla_total_size(sizeof(u16));
18053 }
18054 }
18055
18056 msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
18057 cr->fils.kek_len + cr->fils.pmk_len +
18058 (cr->fils.pmkid ? WLAN_PMKID_LEN : 0) + link_info_size,
18059 gfp);
18060 if (!msg)
18061 return;
18062
18063 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
18064 if (!hdr) {
18065 nlmsg_free(msg);
18066 return;
18067 }
18068
18069 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18070 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18071 (connected_addr &&
18072 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, connected_addr)) ||
18073 nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
18074 cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
18075 cr->status) ||
18076 (cr->status < 0 &&
18077 (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
18078 nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
18079 cr->timeout_reason))) ||
18080 (cr->req_ie &&
18081 nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
18082 (cr->resp_ie &&
18083 nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
18084 cr->resp_ie)) ||
18085 (cr->fils.update_erp_next_seq_num &&
18086 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
18087 cr->fils.erp_next_seq_num)) ||
18088 (cr->status == WLAN_STATUS_SUCCESS &&
18089 ((cr->fils.kek &&
18090 nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len,
18091 cr->fils.kek)) ||
18092 (cr->fils.pmk &&
18093 nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) ||
18094 (cr->fils.pmkid &&
18095 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid)))))
18096 goto nla_put_failure;
18097
18098 if (cr->valid_links) {
18099 int i = 1;
18100 struct nlattr *nested;
18101
18102 nested = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
18103 if (!nested)
18104 goto nla_put_failure;
18105
18106 for_each_valid_link(cr, link) {
18107 struct nlattr *nested_mlo_links;
18108 const u8 *bssid = cr->links[link].bss ?
18109 cr->links[link].bss->bssid :
18110 cr->links[link].bssid;
18111
18112 nested_mlo_links = nla_nest_start(msg, i);
18113 if (!nested_mlo_links)
18114 goto nla_put_failure;
18115
18116 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link) ||
18117 (bssid &&
18118 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, bssid)) ||
18119 (cr->links[link].addr &&
18120 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
18121 cr->links[link].addr)) ||
18122 nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
18123 cr->links[link].status))
18124 goto nla_put_failure;
18125
18126 nla_nest_end(msg, nested_mlo_links);
18127 i++;
18128 }
18129 nla_nest_end(msg, nested);
18130 }
18131
18132 genlmsg_end(msg, hdr);
18133
18134 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18135 NL80211_MCGRP_MLME, gfp);
18136 return;
18137
18138 nla_put_failure:
18139 nlmsg_free(msg);
18140 }
18141
nl80211_send_roamed(struct cfg80211_registered_device * rdev,struct net_device * netdev,struct cfg80211_roam_info * info,gfp_t gfp)18142 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
18143 struct net_device *netdev,
18144 struct cfg80211_roam_info *info, gfp_t gfp)
18145 {
18146 struct sk_buff *msg;
18147 void *hdr;
18148 size_t link_info_size = 0;
18149 unsigned int link;
18150 const u8 *connected_addr = info->ap_mld_addr ?
18151 info->ap_mld_addr :
18152 (info->links[0].bss ?
18153 info->links[0].bss->bssid :
18154 info->links[0].bssid);
18155
18156 if (info->valid_links) {
18157 for_each_valid_link(info, link) {
18158 /* Nested attribute header */
18159 link_info_size += NLA_HDRLEN;
18160 /* Link ID */
18161 link_info_size += nla_total_size(sizeof(u8));
18162 link_info_size += info->links[link].addr ?
18163 nla_total_size(ETH_ALEN) : 0;
18164 link_info_size += (info->links[link].bssid ||
18165 info->links[link].bss) ?
18166 nla_total_size(ETH_ALEN) : 0;
18167 }
18168 }
18169
18170 msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len +
18171 info->fils.kek_len + info->fils.pmk_len +
18172 (info->fils.pmkid ? WLAN_PMKID_LEN : 0) +
18173 link_info_size, gfp);
18174 if (!msg)
18175 return;
18176
18177 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
18178 if (!hdr) {
18179 nlmsg_free(msg);
18180 return;
18181 }
18182
18183 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18184 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18185 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, connected_addr) ||
18186 (info->req_ie &&
18187 nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
18188 info->req_ie)) ||
18189 (info->resp_ie &&
18190 nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
18191 info->resp_ie)) ||
18192 (info->fils.update_erp_next_seq_num &&
18193 nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
18194 info->fils.erp_next_seq_num)) ||
18195 (info->fils.kek &&
18196 nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len,
18197 info->fils.kek)) ||
18198 (info->fils.pmk &&
18199 nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) ||
18200 (info->fils.pmkid &&
18201 nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid)))
18202 goto nla_put_failure;
18203
18204 if (info->valid_links) {
18205 int i = 1;
18206 struct nlattr *nested;
18207
18208 nested = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
18209 if (!nested)
18210 goto nla_put_failure;
18211
18212 for_each_valid_link(info, link) {
18213 struct nlattr *nested_mlo_links;
18214 const u8 *bssid = info->links[link].bss ?
18215 info->links[link].bss->bssid :
18216 info->links[link].bssid;
18217
18218 nested_mlo_links = nla_nest_start(msg, i);
18219 if (!nested_mlo_links)
18220 goto nla_put_failure;
18221
18222 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link) ||
18223 (bssid &&
18224 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, bssid)) ||
18225 (info->links[link].addr &&
18226 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
18227 info->links[link].addr)))
18228 goto nla_put_failure;
18229
18230 nla_nest_end(msg, nested_mlo_links);
18231 i++;
18232 }
18233 nla_nest_end(msg, nested);
18234 }
18235
18236 genlmsg_end(msg, hdr);
18237
18238 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18239 NL80211_MCGRP_MLME, gfp);
18240 return;
18241
18242 nla_put_failure:
18243 nlmsg_free(msg);
18244 }
18245
nl80211_send_port_authorized(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * bssid,const u8 * td_bitmap,u8 td_bitmap_len)18246 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
18247 struct net_device *netdev, const u8 *bssid,
18248 const u8 *td_bitmap, u8 td_bitmap_len)
18249 {
18250 struct sk_buff *msg;
18251 void *hdr;
18252
18253 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18254 if (!msg)
18255 return;
18256
18257 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
18258 if (!hdr) {
18259 nlmsg_free(msg);
18260 return;
18261 }
18262
18263 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18264 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18265 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
18266 goto nla_put_failure;
18267
18268 if ((td_bitmap_len > 0) && td_bitmap)
18269 if (nla_put(msg, NL80211_ATTR_TD_BITMAP,
18270 td_bitmap_len, td_bitmap))
18271 goto nla_put_failure;
18272
18273 genlmsg_end(msg, hdr);
18274
18275 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18276 NL80211_MCGRP_MLME, GFP_KERNEL);
18277 return;
18278
18279 nla_put_failure:
18280 nlmsg_free(msg);
18281 }
18282
nl80211_send_disconnected(struct cfg80211_registered_device * rdev,struct net_device * netdev,u16 reason,const u8 * ie,size_t ie_len,bool from_ap)18283 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
18284 struct net_device *netdev, u16 reason,
18285 const u8 *ie, size_t ie_len, bool from_ap)
18286 {
18287 struct sk_buff *msg;
18288 void *hdr;
18289
18290 msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
18291 if (!msg)
18292 return;
18293
18294 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
18295 if (!hdr) {
18296 nlmsg_free(msg);
18297 return;
18298 }
18299
18300 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18301 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18302 (reason &&
18303 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
18304 (from_ap &&
18305 nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
18306 (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
18307 goto nla_put_failure;
18308
18309 genlmsg_end(msg, hdr);
18310
18311 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18312 NL80211_MCGRP_MLME, GFP_KERNEL);
18313 return;
18314
18315 nla_put_failure:
18316 nlmsg_free(msg);
18317 }
18318
cfg80211_links_removed(struct net_device * dev,u16 link_mask)18319 void cfg80211_links_removed(struct net_device *dev, u16 link_mask)
18320 {
18321 struct wireless_dev *wdev = dev->ieee80211_ptr;
18322 struct wiphy *wiphy = wdev->wiphy;
18323 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18324 struct sk_buff *msg;
18325 struct nlattr *links;
18326 void *hdr;
18327
18328 ASSERT_WDEV_LOCK(wdev);
18329 trace_cfg80211_links_removed(dev, link_mask);
18330
18331 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION &&
18332 wdev->iftype != NL80211_IFTYPE_P2P_CLIENT))
18333 return;
18334
18335 if (WARN_ON(!wdev->valid_links || !link_mask ||
18336 (wdev->valid_links & link_mask) != link_mask ||
18337 wdev->valid_links == link_mask))
18338 return;
18339
18340 cfg80211_wdev_release_link_bsses(wdev, link_mask);
18341 wdev->valid_links &= ~link_mask;
18342
18343 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18344 if (!msg)
18345 return;
18346
18347 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_LINKS_REMOVED);
18348 if (!hdr) {
18349 nlmsg_free(msg);
18350 return;
18351 }
18352
18353 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18354 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
18355 goto nla_put_failure;
18356
18357 links = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
18358 if (!links)
18359 goto nla_put_failure;
18360
18361 while (link_mask) {
18362 struct nlattr *link;
18363 int link_id = __ffs(link_mask);
18364
18365 link = nla_nest_start(msg, link_id + 1);
18366 if (!link)
18367 goto nla_put_failure;
18368
18369 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
18370 goto nla_put_failure;
18371
18372 nla_nest_end(msg, link);
18373 link_mask &= ~(1 << link_id);
18374 }
18375
18376 nla_nest_end(msg, links);
18377
18378 genlmsg_end(msg, hdr);
18379
18380 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18381 NL80211_MCGRP_MLME, GFP_KERNEL);
18382 return;
18383
18384 nla_put_failure:
18385 nlmsg_free(msg);
18386 }
18387 EXPORT_SYMBOL(cfg80211_links_removed);
18388
nl80211_send_ibss_bssid(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * bssid,gfp_t gfp)18389 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
18390 struct net_device *netdev, const u8 *bssid,
18391 gfp_t gfp)
18392 {
18393 struct sk_buff *msg;
18394 void *hdr;
18395
18396 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18397 if (!msg)
18398 return;
18399
18400 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
18401 if (!hdr) {
18402 nlmsg_free(msg);
18403 return;
18404 }
18405
18406 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18407 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18408 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
18409 goto nla_put_failure;
18410
18411 genlmsg_end(msg, hdr);
18412
18413 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18414 NL80211_MCGRP_MLME, gfp);
18415 return;
18416
18417 nla_put_failure:
18418 nlmsg_free(msg);
18419 }
18420
cfg80211_notify_new_peer_candidate(struct net_device * dev,const u8 * addr,const u8 * ie,u8 ie_len,int sig_dbm,gfp_t gfp)18421 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
18422 const u8 *ie, u8 ie_len,
18423 int sig_dbm, gfp_t gfp)
18424 {
18425 struct wireless_dev *wdev = dev->ieee80211_ptr;
18426 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18427 struct sk_buff *msg;
18428 void *hdr;
18429
18430 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
18431 return;
18432
18433 trace_cfg80211_notify_new_peer_candidate(dev, addr);
18434
18435 msg = nlmsg_new(100 + ie_len, gfp);
18436 if (!msg)
18437 return;
18438
18439 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
18440 if (!hdr) {
18441 nlmsg_free(msg);
18442 return;
18443 }
18444
18445 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18446 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18447 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
18448 (ie_len && ie &&
18449 nla_put(msg, NL80211_ATTR_IE, ie_len, ie)) ||
18450 (sig_dbm &&
18451 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)))
18452 goto nla_put_failure;
18453
18454 genlmsg_end(msg, hdr);
18455
18456 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18457 NL80211_MCGRP_MLME, gfp);
18458 return;
18459
18460 nla_put_failure:
18461 nlmsg_free(msg);
18462 }
18463 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
18464
nl80211_michael_mic_failure(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * addr,enum nl80211_key_type key_type,int key_id,const u8 * tsc,gfp_t gfp)18465 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
18466 struct net_device *netdev, const u8 *addr,
18467 enum nl80211_key_type key_type, int key_id,
18468 const u8 *tsc, gfp_t gfp)
18469 {
18470 struct sk_buff *msg;
18471 void *hdr;
18472
18473 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18474 if (!msg)
18475 return;
18476
18477 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
18478 if (!hdr) {
18479 nlmsg_free(msg);
18480 return;
18481 }
18482
18483 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18484 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18485 (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
18486 nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
18487 (key_id != -1 &&
18488 nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
18489 (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
18490 goto nla_put_failure;
18491
18492 genlmsg_end(msg, hdr);
18493
18494 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18495 NL80211_MCGRP_MLME, gfp);
18496 return;
18497
18498 nla_put_failure:
18499 nlmsg_free(msg);
18500 }
18501
nl80211_send_beacon_hint_event(struct wiphy * wiphy,struct ieee80211_channel * channel_before,struct ieee80211_channel * channel_after)18502 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
18503 struct ieee80211_channel *channel_before,
18504 struct ieee80211_channel *channel_after)
18505 {
18506 struct sk_buff *msg;
18507 void *hdr;
18508 struct nlattr *nl_freq;
18509
18510 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
18511 if (!msg)
18512 return;
18513
18514 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
18515 if (!hdr) {
18516 nlmsg_free(msg);
18517 return;
18518 }
18519
18520 /*
18521 * Since we are applying the beacon hint to a wiphy we know its
18522 * wiphy_idx is valid
18523 */
18524 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
18525 goto nla_put_failure;
18526
18527 /* Before */
18528 nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_BEFORE);
18529 if (!nl_freq)
18530 goto nla_put_failure;
18531
18532 if (nl80211_msg_put_channel(msg, wiphy, channel_before, false))
18533 goto nla_put_failure;
18534 nla_nest_end(msg, nl_freq);
18535
18536 /* After */
18537 nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_AFTER);
18538 if (!nl_freq)
18539 goto nla_put_failure;
18540
18541 if (nl80211_msg_put_channel(msg, wiphy, channel_after, false))
18542 goto nla_put_failure;
18543 nla_nest_end(msg, nl_freq);
18544
18545 genlmsg_end(msg, hdr);
18546
18547 rcu_read_lock();
18548 genlmsg_multicast_allns(&nl80211_fam, msg, 0,
18549 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
18550 rcu_read_unlock();
18551
18552 return;
18553
18554 nla_put_failure:
18555 nlmsg_free(msg);
18556 }
18557
nl80211_send_remain_on_chan_event(int cmd,struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,unsigned int duration,gfp_t gfp)18558 static void nl80211_send_remain_on_chan_event(
18559 int cmd, struct cfg80211_registered_device *rdev,
18560 struct wireless_dev *wdev, u64 cookie,
18561 struct ieee80211_channel *chan,
18562 unsigned int duration, gfp_t gfp)
18563 {
18564 struct sk_buff *msg;
18565 void *hdr;
18566
18567 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18568 if (!msg)
18569 return;
18570
18571 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
18572 if (!hdr) {
18573 nlmsg_free(msg);
18574 return;
18575 }
18576
18577 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18578 (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
18579 wdev->netdev->ifindex)) ||
18580 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18581 NL80211_ATTR_PAD) ||
18582 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
18583 nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
18584 NL80211_CHAN_NO_HT) ||
18585 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
18586 NL80211_ATTR_PAD))
18587 goto nla_put_failure;
18588
18589 if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
18590 nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
18591 goto nla_put_failure;
18592
18593 genlmsg_end(msg, hdr);
18594
18595 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18596 NL80211_MCGRP_MLME, gfp);
18597 return;
18598
18599 nla_put_failure:
18600 nlmsg_free(msg);
18601 }
18602
cfg80211_assoc_comeback(struct net_device * netdev,const u8 * ap_addr,u32 timeout)18603 void cfg80211_assoc_comeback(struct net_device *netdev,
18604 const u8 *ap_addr, u32 timeout)
18605 {
18606 struct wireless_dev *wdev = netdev->ieee80211_ptr;
18607 struct wiphy *wiphy = wdev->wiphy;
18608 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18609 struct sk_buff *msg;
18610 void *hdr;
18611
18612 trace_cfg80211_assoc_comeback(wdev, ap_addr, timeout);
18613
18614 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18615 if (!msg)
18616 return;
18617
18618 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ASSOC_COMEBACK);
18619 if (!hdr) {
18620 nlmsg_free(msg);
18621 return;
18622 }
18623
18624 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18625 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18626 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ap_addr) ||
18627 nla_put_u32(msg, NL80211_ATTR_TIMEOUT, timeout))
18628 goto nla_put_failure;
18629
18630 genlmsg_end(msg, hdr);
18631
18632 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18633 NL80211_MCGRP_MLME, GFP_KERNEL);
18634 return;
18635
18636 nla_put_failure:
18637 nlmsg_free(msg);
18638 }
18639 EXPORT_SYMBOL(cfg80211_assoc_comeback);
18640
cfg80211_ready_on_channel(struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,unsigned int duration,gfp_t gfp)18641 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
18642 struct ieee80211_channel *chan,
18643 unsigned int duration, gfp_t gfp)
18644 {
18645 struct wiphy *wiphy = wdev->wiphy;
18646 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18647
18648 trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
18649 nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
18650 rdev, wdev, cookie, chan,
18651 duration, gfp);
18652 }
18653 EXPORT_SYMBOL(cfg80211_ready_on_channel);
18654
cfg80211_remain_on_channel_expired(struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,gfp_t gfp)18655 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
18656 struct ieee80211_channel *chan,
18657 gfp_t gfp)
18658 {
18659 struct wiphy *wiphy = wdev->wiphy;
18660 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18661
18662 trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
18663 nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
18664 rdev, wdev, cookie, chan, 0, gfp);
18665 }
18666 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
18667
cfg80211_tx_mgmt_expired(struct wireless_dev * wdev,u64 cookie,struct ieee80211_channel * chan,gfp_t gfp)18668 void cfg80211_tx_mgmt_expired(struct wireless_dev *wdev, u64 cookie,
18669 struct ieee80211_channel *chan,
18670 gfp_t gfp)
18671 {
18672 struct wiphy *wiphy = wdev->wiphy;
18673 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18674
18675 trace_cfg80211_tx_mgmt_expired(wdev, cookie, chan);
18676 nl80211_send_remain_on_chan_event(NL80211_CMD_FRAME_WAIT_CANCEL,
18677 rdev, wdev, cookie, chan, 0, gfp);
18678 }
18679 EXPORT_SYMBOL(cfg80211_tx_mgmt_expired);
18680
cfg80211_new_sta(struct net_device * dev,const u8 * mac_addr,struct station_info * sinfo,gfp_t gfp)18681 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
18682 struct station_info *sinfo, gfp_t gfp)
18683 {
18684 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
18685 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18686 struct sk_buff *msg;
18687
18688 trace_cfg80211_new_sta(dev, mac_addr, sinfo);
18689
18690 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18691 if (!msg)
18692 return;
18693
18694 if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
18695 rdev, dev, mac_addr, sinfo) < 0) {
18696 nlmsg_free(msg);
18697 return;
18698 }
18699
18700 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18701 NL80211_MCGRP_MLME, gfp);
18702 }
18703 EXPORT_SYMBOL(cfg80211_new_sta);
18704
cfg80211_del_sta_sinfo(struct net_device * dev,const u8 * mac_addr,struct station_info * sinfo,gfp_t gfp)18705 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
18706 struct station_info *sinfo, gfp_t gfp)
18707 {
18708 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
18709 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18710 struct sk_buff *msg;
18711 struct station_info empty_sinfo = {};
18712
18713 if (!sinfo)
18714 sinfo = &empty_sinfo;
18715
18716 trace_cfg80211_del_sta(dev, mac_addr);
18717
18718 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18719 if (!msg) {
18720 cfg80211_sinfo_release_content(sinfo);
18721 return;
18722 }
18723
18724 if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
18725 rdev, dev, mac_addr, sinfo) < 0) {
18726 nlmsg_free(msg);
18727 return;
18728 }
18729
18730 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18731 NL80211_MCGRP_MLME, gfp);
18732 }
18733 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
18734
cfg80211_conn_failed(struct net_device * dev,const u8 * mac_addr,enum nl80211_connect_failed_reason reason,gfp_t gfp)18735 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
18736 enum nl80211_connect_failed_reason reason,
18737 gfp_t gfp)
18738 {
18739 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
18740 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18741 struct sk_buff *msg;
18742 void *hdr;
18743
18744 msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
18745 if (!msg)
18746 return;
18747
18748 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
18749 if (!hdr) {
18750 nlmsg_free(msg);
18751 return;
18752 }
18753
18754 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18755 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
18756 nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
18757 goto nla_put_failure;
18758
18759 genlmsg_end(msg, hdr);
18760
18761 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18762 NL80211_MCGRP_MLME, gfp);
18763 return;
18764
18765 nla_put_failure:
18766 nlmsg_free(msg);
18767 }
18768 EXPORT_SYMBOL(cfg80211_conn_failed);
18769
__nl80211_unexpected_frame(struct net_device * dev,u8 cmd,const u8 * addr,gfp_t gfp)18770 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
18771 const u8 *addr, gfp_t gfp)
18772 {
18773 struct wireless_dev *wdev = dev->ieee80211_ptr;
18774 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18775 struct sk_buff *msg;
18776 void *hdr;
18777 u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid);
18778
18779 if (!nlportid)
18780 return false;
18781
18782 msg = nlmsg_new(100, gfp);
18783 if (!msg)
18784 return true;
18785
18786 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
18787 if (!hdr) {
18788 nlmsg_free(msg);
18789 return true;
18790 }
18791
18792 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18793 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18794 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
18795 goto nla_put_failure;
18796
18797 genlmsg_end(msg, hdr);
18798 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
18799 return true;
18800
18801 nla_put_failure:
18802 nlmsg_free(msg);
18803 return true;
18804 }
18805
cfg80211_rx_spurious_frame(struct net_device * dev,const u8 * addr,gfp_t gfp)18806 bool cfg80211_rx_spurious_frame(struct net_device *dev,
18807 const u8 *addr, gfp_t gfp)
18808 {
18809 struct wireless_dev *wdev = dev->ieee80211_ptr;
18810 bool ret;
18811
18812 trace_cfg80211_rx_spurious_frame(dev, addr);
18813
18814 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
18815 wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
18816 trace_cfg80211_return_bool(false);
18817 return false;
18818 }
18819 ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
18820 addr, gfp);
18821 trace_cfg80211_return_bool(ret);
18822 return ret;
18823 }
18824 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
18825
cfg80211_rx_unexpected_4addr_frame(struct net_device * dev,const u8 * addr,gfp_t gfp)18826 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
18827 const u8 *addr, gfp_t gfp)
18828 {
18829 struct wireless_dev *wdev = dev->ieee80211_ptr;
18830 bool ret;
18831
18832 trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
18833
18834 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
18835 wdev->iftype != NL80211_IFTYPE_P2P_GO &&
18836 wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
18837 trace_cfg80211_return_bool(false);
18838 return false;
18839 }
18840 ret = __nl80211_unexpected_frame(dev,
18841 NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
18842 addr, gfp);
18843 trace_cfg80211_return_bool(ret);
18844 return ret;
18845 }
18846 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
18847
nl80211_send_mgmt(struct cfg80211_registered_device * rdev,struct wireless_dev * wdev,u32 nlportid,struct cfg80211_rx_info * info,gfp_t gfp)18848 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
18849 struct wireless_dev *wdev, u32 nlportid,
18850 struct cfg80211_rx_info *info, gfp_t gfp)
18851 {
18852 struct net_device *netdev = wdev->netdev;
18853 struct sk_buff *msg;
18854 void *hdr;
18855
18856 msg = nlmsg_new(100 + info->len, gfp);
18857 if (!msg)
18858 return -ENOMEM;
18859
18860 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
18861 if (!hdr) {
18862 nlmsg_free(msg);
18863 return -ENOMEM;
18864 }
18865
18866 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18867 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
18868 netdev->ifindex)) ||
18869 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18870 NL80211_ATTR_PAD) ||
18871 (info->have_link_id &&
18872 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, info->link_id)) ||
18873 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, KHZ_TO_MHZ(info->freq)) ||
18874 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, info->freq % 1000) ||
18875 (info->sig_dbm &&
18876 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, info->sig_dbm)) ||
18877 nla_put(msg, NL80211_ATTR_FRAME, info->len, info->buf) ||
18878 (info->flags &&
18879 nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, info->flags)) ||
18880 (info->rx_tstamp && nla_put_u64_64bit(msg,
18881 NL80211_ATTR_RX_HW_TIMESTAMP,
18882 info->rx_tstamp,
18883 NL80211_ATTR_PAD)) ||
18884 (info->ack_tstamp && nla_put_u64_64bit(msg,
18885 NL80211_ATTR_TX_HW_TIMESTAMP,
18886 info->ack_tstamp,
18887 NL80211_ATTR_PAD)))
18888 goto nla_put_failure;
18889
18890 genlmsg_end(msg, hdr);
18891
18892 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
18893
18894 nla_put_failure:
18895 nlmsg_free(msg);
18896 return -ENOBUFS;
18897 }
18898
nl80211_frame_tx_status(struct wireless_dev * wdev,struct cfg80211_tx_status * status,gfp_t gfp,enum nl80211_commands command)18899 static void nl80211_frame_tx_status(struct wireless_dev *wdev,
18900 struct cfg80211_tx_status *status,
18901 gfp_t gfp, enum nl80211_commands command)
18902 {
18903 struct wiphy *wiphy = wdev->wiphy;
18904 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18905 struct net_device *netdev = wdev->netdev;
18906 struct sk_buff *msg;
18907 void *hdr;
18908
18909 if (command == NL80211_CMD_FRAME_TX_STATUS)
18910 trace_cfg80211_mgmt_tx_status(wdev, status->cookie,
18911 status->ack);
18912 else
18913 trace_cfg80211_control_port_tx_status(wdev, status->cookie,
18914 status->ack);
18915
18916 msg = nlmsg_new(100 + status->len, gfp);
18917 if (!msg)
18918 return;
18919
18920 hdr = nl80211hdr_put(msg, 0, 0, 0, command);
18921 if (!hdr) {
18922 nlmsg_free(msg);
18923 return;
18924 }
18925
18926 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18927 (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
18928 netdev->ifindex)) ||
18929 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18930 NL80211_ATTR_PAD) ||
18931 nla_put(msg, NL80211_ATTR_FRAME, status->len, status->buf) ||
18932 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, status->cookie,
18933 NL80211_ATTR_PAD) ||
18934 (status->ack && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
18935 (status->tx_tstamp &&
18936 nla_put_u64_64bit(msg, NL80211_ATTR_TX_HW_TIMESTAMP,
18937 status->tx_tstamp, NL80211_ATTR_PAD)) ||
18938 (status->ack_tstamp &&
18939 nla_put_u64_64bit(msg, NL80211_ATTR_RX_HW_TIMESTAMP,
18940 status->ack_tstamp, NL80211_ATTR_PAD)))
18941 goto nla_put_failure;
18942
18943 genlmsg_end(msg, hdr);
18944
18945 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18946 NL80211_MCGRP_MLME, gfp);
18947 return;
18948
18949 nla_put_failure:
18950 nlmsg_free(msg);
18951 }
18952
cfg80211_control_port_tx_status(struct wireless_dev * wdev,u64 cookie,const u8 * buf,size_t len,bool ack,gfp_t gfp)18953 void cfg80211_control_port_tx_status(struct wireless_dev *wdev, u64 cookie,
18954 const u8 *buf, size_t len, bool ack,
18955 gfp_t gfp)
18956 {
18957 struct cfg80211_tx_status status = {
18958 .cookie = cookie,
18959 .buf = buf,
18960 .len = len,
18961 .ack = ack
18962 };
18963
18964 nl80211_frame_tx_status(wdev, &status, gfp,
18965 NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS);
18966 }
18967 EXPORT_SYMBOL(cfg80211_control_port_tx_status);
18968
cfg80211_mgmt_tx_status_ext(struct wireless_dev * wdev,struct cfg80211_tx_status * status,gfp_t gfp)18969 void cfg80211_mgmt_tx_status_ext(struct wireless_dev *wdev,
18970 struct cfg80211_tx_status *status, gfp_t gfp)
18971 {
18972 nl80211_frame_tx_status(wdev, status, gfp, NL80211_CMD_FRAME_TX_STATUS);
18973 }
18974 EXPORT_SYMBOL(cfg80211_mgmt_tx_status_ext);
18975
__nl80211_rx_control_port(struct net_device * dev,struct sk_buff * skb,bool unencrypted,int link_id,gfp_t gfp)18976 static int __nl80211_rx_control_port(struct net_device *dev,
18977 struct sk_buff *skb,
18978 bool unencrypted,
18979 int link_id,
18980 gfp_t gfp)
18981 {
18982 struct wireless_dev *wdev = dev->ieee80211_ptr;
18983 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18984 struct ethhdr *ehdr = eth_hdr(skb);
18985 const u8 *addr = ehdr->h_source;
18986 u16 proto = be16_to_cpu(skb->protocol);
18987 struct sk_buff *msg;
18988 void *hdr;
18989 struct nlattr *frame;
18990
18991 u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid);
18992
18993 if (!nlportid)
18994 return -ENOENT;
18995
18996 msg = nlmsg_new(100 + skb->len, gfp);
18997 if (!msg)
18998 return -ENOMEM;
18999
19000 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME);
19001 if (!hdr) {
19002 nlmsg_free(msg);
19003 return -ENOBUFS;
19004 }
19005
19006 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19007 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
19008 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19009 NL80211_ATTR_PAD) ||
19010 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
19011 nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
19012 (link_id >= 0 &&
19013 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)) ||
19014 (unencrypted && nla_put_flag(msg,
19015 NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
19016 goto nla_put_failure;
19017
19018 frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len);
19019 if (!frame)
19020 goto nla_put_failure;
19021
19022 skb_copy_bits(skb, 0, nla_data(frame), skb->len);
19023 genlmsg_end(msg, hdr);
19024
19025 return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
19026
19027 nla_put_failure:
19028 nlmsg_free(msg);
19029 return -ENOBUFS;
19030 }
19031
cfg80211_rx_control_port(struct net_device * dev,struct sk_buff * skb,bool unencrypted,int link_id)19032 bool cfg80211_rx_control_port(struct net_device *dev, struct sk_buff *skb,
19033 bool unencrypted, int link_id)
19034 {
19035 int ret;
19036
19037 trace_cfg80211_rx_control_port(dev, skb, unencrypted, link_id);
19038 ret = __nl80211_rx_control_port(dev, skb, unencrypted, link_id,
19039 GFP_ATOMIC);
19040 trace_cfg80211_return_bool(ret == 0);
19041 return ret == 0;
19042 }
19043 EXPORT_SYMBOL(cfg80211_rx_control_port);
19044
cfg80211_prepare_cqm(struct net_device * dev,const char * mac,gfp_t gfp)19045 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
19046 const char *mac, gfp_t gfp)
19047 {
19048 struct wireless_dev *wdev = dev->ieee80211_ptr;
19049 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19050 struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19051 void **cb;
19052
19053 if (!msg)
19054 return NULL;
19055
19056 cb = (void **)msg->cb;
19057
19058 cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
19059 if (!cb[0]) {
19060 nlmsg_free(msg);
19061 return NULL;
19062 }
19063
19064 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19065 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
19066 goto nla_put_failure;
19067
19068 if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
19069 goto nla_put_failure;
19070
19071 cb[1] = nla_nest_start_noflag(msg, NL80211_ATTR_CQM);
19072 if (!cb[1])
19073 goto nla_put_failure;
19074
19075 cb[2] = rdev;
19076
19077 return msg;
19078 nla_put_failure:
19079 nlmsg_free(msg);
19080 return NULL;
19081 }
19082
cfg80211_send_cqm(struct sk_buff * msg,gfp_t gfp)19083 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
19084 {
19085 void **cb = (void **)msg->cb;
19086 struct cfg80211_registered_device *rdev = cb[2];
19087
19088 nla_nest_end(msg, cb[1]);
19089 genlmsg_end(msg, cb[0]);
19090
19091 memset(msg->cb, 0, sizeof(msg->cb));
19092
19093 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19094 NL80211_MCGRP_MLME, gfp);
19095 }
19096
cfg80211_cqm_rssi_notify(struct net_device * dev,enum nl80211_cqm_rssi_threshold_event rssi_event,s32 rssi_level,gfp_t gfp)19097 void cfg80211_cqm_rssi_notify(struct net_device *dev,
19098 enum nl80211_cqm_rssi_threshold_event rssi_event,
19099 s32 rssi_level, gfp_t gfp)
19100 {
19101 struct wireless_dev *wdev = dev->ieee80211_ptr;
19102 struct cfg80211_cqm_config *cqm_config;
19103
19104 trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
19105
19106 if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
19107 rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
19108 return;
19109
19110 rcu_read_lock();
19111 cqm_config = rcu_dereference(wdev->cqm_config);
19112 if (cqm_config) {
19113 cqm_config->last_rssi_event_value = rssi_level;
19114 cqm_config->last_rssi_event_type = rssi_event;
19115 wiphy_work_queue(wdev->wiphy, &wdev->cqm_rssi_work);
19116 }
19117 rcu_read_unlock();
19118 }
19119 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
19120
cfg80211_cqm_rssi_notify_work(struct wiphy * wiphy,struct wiphy_work * work)19121 void cfg80211_cqm_rssi_notify_work(struct wiphy *wiphy, struct wiphy_work *work)
19122 {
19123 struct wireless_dev *wdev = container_of(work, struct wireless_dev,
19124 cqm_rssi_work);
19125 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19126 enum nl80211_cqm_rssi_threshold_event rssi_event;
19127 struct cfg80211_cqm_config *cqm_config;
19128 struct sk_buff *msg;
19129 s32 rssi_level;
19130
19131 wdev_lock(wdev);
19132 cqm_config = rcu_dereference_protected(wdev->cqm_config,
19133 lockdep_is_held(&wdev->mtx));
19134 if (!wdev->cqm_config)
19135 goto unlock;
19136
19137 cfg80211_cqm_rssi_update(rdev, wdev->netdev, cqm_config);
19138
19139 rssi_level = cqm_config->last_rssi_event_value;
19140 rssi_event = cqm_config->last_rssi_event_type;
19141
19142 msg = cfg80211_prepare_cqm(wdev->netdev, NULL, GFP_KERNEL);
19143 if (!msg)
19144 goto unlock;
19145
19146 if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
19147 rssi_event))
19148 goto nla_put_failure;
19149
19150 if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
19151 rssi_level))
19152 goto nla_put_failure;
19153
19154 cfg80211_send_cqm(msg, GFP_KERNEL);
19155
19156 goto unlock;
19157
19158 nla_put_failure:
19159 nlmsg_free(msg);
19160 unlock:
19161 wdev_unlock(wdev);
19162 }
19163
cfg80211_cqm_txe_notify(struct net_device * dev,const u8 * peer,u32 num_packets,u32 rate,u32 intvl,gfp_t gfp)19164 void cfg80211_cqm_txe_notify(struct net_device *dev,
19165 const u8 *peer, u32 num_packets,
19166 u32 rate, u32 intvl, gfp_t gfp)
19167 {
19168 struct sk_buff *msg;
19169
19170 msg = cfg80211_prepare_cqm(dev, peer, gfp);
19171 if (!msg)
19172 return;
19173
19174 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
19175 goto nla_put_failure;
19176
19177 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
19178 goto nla_put_failure;
19179
19180 if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
19181 goto nla_put_failure;
19182
19183 cfg80211_send_cqm(msg, gfp);
19184 return;
19185
19186 nla_put_failure:
19187 nlmsg_free(msg);
19188 }
19189 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
19190
cfg80211_cqm_pktloss_notify(struct net_device * dev,const u8 * peer,u32 num_packets,gfp_t gfp)19191 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
19192 const u8 *peer, u32 num_packets, gfp_t gfp)
19193 {
19194 struct sk_buff *msg;
19195
19196 trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
19197
19198 msg = cfg80211_prepare_cqm(dev, peer, gfp);
19199 if (!msg)
19200 return;
19201
19202 if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
19203 goto nla_put_failure;
19204
19205 cfg80211_send_cqm(msg, gfp);
19206 return;
19207
19208 nla_put_failure:
19209 nlmsg_free(msg);
19210 }
19211 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
19212
cfg80211_cqm_beacon_loss_notify(struct net_device * dev,gfp_t gfp)19213 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
19214 {
19215 struct sk_buff *msg;
19216
19217 msg = cfg80211_prepare_cqm(dev, NULL, gfp);
19218 if (!msg)
19219 return;
19220
19221 if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
19222 goto nla_put_failure;
19223
19224 cfg80211_send_cqm(msg, gfp);
19225 return;
19226
19227 nla_put_failure:
19228 nlmsg_free(msg);
19229 }
19230 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
19231
nl80211_gtk_rekey_notify(struct cfg80211_registered_device * rdev,struct net_device * netdev,const u8 * bssid,const u8 * replay_ctr,gfp_t gfp)19232 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
19233 struct net_device *netdev, const u8 *bssid,
19234 const u8 *replay_ctr, gfp_t gfp)
19235 {
19236 struct sk_buff *msg;
19237 struct nlattr *rekey_attr;
19238 void *hdr;
19239
19240 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19241 if (!msg)
19242 return;
19243
19244 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
19245 if (!hdr) {
19246 nlmsg_free(msg);
19247 return;
19248 }
19249
19250 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19251 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19252 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
19253 goto nla_put_failure;
19254
19255 rekey_attr = nla_nest_start_noflag(msg, NL80211_ATTR_REKEY_DATA);
19256 if (!rekey_attr)
19257 goto nla_put_failure;
19258
19259 if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
19260 NL80211_REPLAY_CTR_LEN, replay_ctr))
19261 goto nla_put_failure;
19262
19263 nla_nest_end(msg, rekey_attr);
19264
19265 genlmsg_end(msg, hdr);
19266
19267 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19268 NL80211_MCGRP_MLME, gfp);
19269 return;
19270
19271 nla_put_failure:
19272 nlmsg_free(msg);
19273 }
19274
cfg80211_gtk_rekey_notify(struct net_device * dev,const u8 * bssid,const u8 * replay_ctr,gfp_t gfp)19275 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
19276 const u8 *replay_ctr, gfp_t gfp)
19277 {
19278 struct wireless_dev *wdev = dev->ieee80211_ptr;
19279 struct wiphy *wiphy = wdev->wiphy;
19280 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19281
19282 trace_cfg80211_gtk_rekey_notify(dev, bssid);
19283 nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
19284 }
19285 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
19286
19287 static void
nl80211_pmksa_candidate_notify(struct cfg80211_registered_device * rdev,struct net_device * netdev,int index,const u8 * bssid,bool preauth,gfp_t gfp)19288 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
19289 struct net_device *netdev, int index,
19290 const u8 *bssid, bool preauth, gfp_t gfp)
19291 {
19292 struct sk_buff *msg;
19293 struct nlattr *attr;
19294 void *hdr;
19295
19296 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19297 if (!msg)
19298 return;
19299
19300 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
19301 if (!hdr) {
19302 nlmsg_free(msg);
19303 return;
19304 }
19305
19306 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19307 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
19308 goto nla_put_failure;
19309
19310 attr = nla_nest_start_noflag(msg, NL80211_ATTR_PMKSA_CANDIDATE);
19311 if (!attr)
19312 goto nla_put_failure;
19313
19314 if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
19315 nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
19316 (preauth &&
19317 nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
19318 goto nla_put_failure;
19319
19320 nla_nest_end(msg, attr);
19321
19322 genlmsg_end(msg, hdr);
19323
19324 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19325 NL80211_MCGRP_MLME, gfp);
19326 return;
19327
19328 nla_put_failure:
19329 nlmsg_free(msg);
19330 }
19331
cfg80211_pmksa_candidate_notify(struct net_device * dev,int index,const u8 * bssid,bool preauth,gfp_t gfp)19332 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
19333 const u8 *bssid, bool preauth, gfp_t gfp)
19334 {
19335 struct wireless_dev *wdev = dev->ieee80211_ptr;
19336 struct wiphy *wiphy = wdev->wiphy;
19337 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19338
19339 trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
19340 nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
19341 }
19342 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
19343
nl80211_ch_switch_notify(struct cfg80211_registered_device * rdev,struct net_device * netdev,unsigned int link_id,struct cfg80211_chan_def * chandef,gfp_t gfp,enum nl80211_commands notif,u8 count,bool quiet,u16 punct_bitmap)19344 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
19345 struct net_device *netdev,
19346 unsigned int link_id,
19347 struct cfg80211_chan_def *chandef,
19348 gfp_t gfp,
19349 enum nl80211_commands notif,
19350 u8 count, bool quiet, u16 punct_bitmap)
19351 {
19352 struct wireless_dev *wdev = netdev->ieee80211_ptr;
19353 struct sk_buff *msg;
19354 void *hdr;
19355
19356 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19357 if (!msg)
19358 return;
19359
19360 hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
19361 if (!hdr) {
19362 nlmsg_free(msg);
19363 return;
19364 }
19365
19366 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
19367 goto nla_put_failure;
19368
19369 if (wdev->valid_links &&
19370 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
19371 goto nla_put_failure;
19372
19373 if (nl80211_send_chandef(msg, chandef))
19374 goto nla_put_failure;
19375
19376 if (notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) {
19377 if (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count))
19378 goto nla_put_failure;
19379 if (quiet &&
19380 nla_put_flag(msg, NL80211_ATTR_CH_SWITCH_BLOCK_TX))
19381 goto nla_put_failure;
19382 }
19383
19384 if (nla_put_u32(msg, NL80211_ATTR_PUNCT_BITMAP, punct_bitmap))
19385 goto nla_put_failure;
19386
19387 genlmsg_end(msg, hdr);
19388
19389 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19390 NL80211_MCGRP_MLME, gfp);
19391 return;
19392
19393 nla_put_failure:
19394 nlmsg_free(msg);
19395 }
19396
cfg80211_ch_switch_notify(struct net_device * dev,struct cfg80211_chan_def * chandef,unsigned int link_id,u16 punct_bitmap)19397 void cfg80211_ch_switch_notify(struct net_device *dev,
19398 struct cfg80211_chan_def *chandef,
19399 unsigned int link_id, u16 punct_bitmap)
19400 {
19401 struct wireless_dev *wdev = dev->ieee80211_ptr;
19402 struct wiphy *wiphy = wdev->wiphy;
19403 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19404
19405 ASSERT_WDEV_LOCK(wdev);
19406 WARN_INVALID_LINK_ID(wdev, link_id);
19407
19408 trace_cfg80211_ch_switch_notify(dev, chandef, link_id, punct_bitmap);
19409
19410 switch (wdev->iftype) {
19411 case NL80211_IFTYPE_STATION:
19412 case NL80211_IFTYPE_P2P_CLIENT:
19413 if (!WARN_ON(!wdev->links[link_id].client.current_bss))
19414 cfg80211_update_assoc_bss_entry(wdev, link_id,
19415 chandef->chan);
19416 break;
19417 case NL80211_IFTYPE_MESH_POINT:
19418 wdev->u.mesh.chandef = *chandef;
19419 wdev->u.mesh.preset_chandef = *chandef;
19420 break;
19421 case NL80211_IFTYPE_AP:
19422 case NL80211_IFTYPE_P2P_GO:
19423 wdev->links[link_id].ap.chandef = *chandef;
19424 break;
19425 case NL80211_IFTYPE_ADHOC:
19426 wdev->u.ibss.chandef = *chandef;
19427 break;
19428 default:
19429 WARN_ON(1);
19430 break;
19431 }
19432
19433 cfg80211_sched_dfs_chan_update(rdev);
19434
19435 nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL,
19436 NL80211_CMD_CH_SWITCH_NOTIFY, 0, false,
19437 punct_bitmap);
19438 }
19439 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
19440
cfg80211_ch_switch_started_notify(struct net_device * dev,struct cfg80211_chan_def * chandef,unsigned int link_id,u8 count,bool quiet,u16 punct_bitmap)19441 void cfg80211_ch_switch_started_notify(struct net_device *dev,
19442 struct cfg80211_chan_def *chandef,
19443 unsigned int link_id, u8 count,
19444 bool quiet, u16 punct_bitmap)
19445 {
19446 struct wireless_dev *wdev = dev->ieee80211_ptr;
19447 struct wiphy *wiphy = wdev->wiphy;
19448 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19449
19450 ASSERT_WDEV_LOCK(wdev);
19451 WARN_INVALID_LINK_ID(wdev, link_id);
19452
19453 trace_cfg80211_ch_switch_started_notify(dev, chandef, link_id,
19454 punct_bitmap);
19455
19456
19457 nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL,
19458 NL80211_CMD_CH_SWITCH_STARTED_NOTIFY,
19459 count, quiet, punct_bitmap);
19460 }
19461 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
19462
cfg80211_bss_color_notify(struct net_device * dev,enum nl80211_commands cmd,u8 count,u64 color_bitmap)19463 int cfg80211_bss_color_notify(struct net_device *dev,
19464 enum nl80211_commands cmd, u8 count,
19465 u64 color_bitmap)
19466 {
19467 struct wireless_dev *wdev = dev->ieee80211_ptr;
19468 struct wiphy *wiphy = wdev->wiphy;
19469 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19470 struct sk_buff *msg;
19471 void *hdr;
19472
19473 ASSERT_WDEV_LOCK(wdev);
19474
19475 trace_cfg80211_bss_color_notify(dev, cmd, count, color_bitmap);
19476
19477 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19478 if (!msg)
19479 return -ENOMEM;
19480
19481 hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
19482 if (!hdr)
19483 goto nla_put_failure;
19484
19485 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
19486 goto nla_put_failure;
19487
19488 if (cmd == NL80211_CMD_COLOR_CHANGE_STARTED &&
19489 nla_put_u32(msg, NL80211_ATTR_COLOR_CHANGE_COUNT, count))
19490 goto nla_put_failure;
19491
19492 if (cmd == NL80211_CMD_OBSS_COLOR_COLLISION &&
19493 nla_put_u64_64bit(msg, NL80211_ATTR_OBSS_COLOR_BITMAP,
19494 color_bitmap, NL80211_ATTR_PAD))
19495 goto nla_put_failure;
19496
19497 genlmsg_end(msg, hdr);
19498
19499 return genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
19500 msg, 0, NL80211_MCGRP_MLME, GFP_KERNEL);
19501
19502 nla_put_failure:
19503 nlmsg_free(msg);
19504 return -EINVAL;
19505 }
19506 EXPORT_SYMBOL(cfg80211_bss_color_notify);
19507
19508 void
nl80211_radar_notify(struct cfg80211_registered_device * rdev,const struct cfg80211_chan_def * chandef,enum nl80211_radar_event event,struct net_device * netdev,gfp_t gfp)19509 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
19510 const struct cfg80211_chan_def *chandef,
19511 enum nl80211_radar_event event,
19512 struct net_device *netdev, gfp_t gfp)
19513 {
19514 struct sk_buff *msg;
19515 void *hdr;
19516
19517 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19518 if (!msg)
19519 return;
19520
19521 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
19522 if (!hdr) {
19523 nlmsg_free(msg);
19524 return;
19525 }
19526
19527 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
19528 goto nla_put_failure;
19529
19530 /* NOP and radar events don't need a netdev parameter */
19531 if (netdev) {
19532 struct wireless_dev *wdev = netdev->ieee80211_ptr;
19533
19534 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19535 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19536 NL80211_ATTR_PAD))
19537 goto nla_put_failure;
19538 }
19539
19540 if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
19541 goto nla_put_failure;
19542
19543 if (nl80211_send_chandef(msg, chandef))
19544 goto nla_put_failure;
19545
19546 genlmsg_end(msg, hdr);
19547
19548 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19549 NL80211_MCGRP_MLME, gfp);
19550 return;
19551
19552 nla_put_failure:
19553 nlmsg_free(msg);
19554 }
19555
cfg80211_sta_opmode_change_notify(struct net_device * dev,const u8 * mac,struct sta_opmode_info * sta_opmode,gfp_t gfp)19556 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
19557 struct sta_opmode_info *sta_opmode,
19558 gfp_t gfp)
19559 {
19560 struct sk_buff *msg;
19561 struct wireless_dev *wdev = dev->ieee80211_ptr;
19562 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19563 void *hdr;
19564
19565 if (WARN_ON(!mac))
19566 return;
19567
19568 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19569 if (!msg)
19570 return;
19571
19572 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED);
19573 if (!hdr) {
19574 nlmsg_free(msg);
19575 return;
19576 }
19577
19578 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
19579 goto nla_put_failure;
19580
19581 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
19582 goto nla_put_failure;
19583
19584 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
19585 goto nla_put_failure;
19586
19587 if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) &&
19588 nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode))
19589 goto nla_put_failure;
19590
19591 if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
19592 nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
19593 goto nla_put_failure;
19594
19595 if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
19596 nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss))
19597 goto nla_put_failure;
19598
19599 genlmsg_end(msg, hdr);
19600
19601 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19602 NL80211_MCGRP_MLME, gfp);
19603
19604 return;
19605
19606 nla_put_failure:
19607 nlmsg_free(msg);
19608 }
19609 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify);
19610
cfg80211_probe_status(struct net_device * dev,const u8 * addr,u64 cookie,bool acked,s32 ack_signal,bool is_valid_ack_signal,gfp_t gfp)19611 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
19612 u64 cookie, bool acked, s32 ack_signal,
19613 bool is_valid_ack_signal, gfp_t gfp)
19614 {
19615 struct wireless_dev *wdev = dev->ieee80211_ptr;
19616 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19617 struct sk_buff *msg;
19618 void *hdr;
19619
19620 trace_cfg80211_probe_status(dev, addr, cookie, acked);
19621
19622 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19623
19624 if (!msg)
19625 return;
19626
19627 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
19628 if (!hdr) {
19629 nlmsg_free(msg);
19630 return;
19631 }
19632
19633 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19634 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
19635 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
19636 nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
19637 NL80211_ATTR_PAD) ||
19638 (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
19639 (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL,
19640 ack_signal)))
19641 goto nla_put_failure;
19642
19643 genlmsg_end(msg, hdr);
19644
19645 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19646 NL80211_MCGRP_MLME, gfp);
19647 return;
19648
19649 nla_put_failure:
19650 nlmsg_free(msg);
19651 }
19652 EXPORT_SYMBOL(cfg80211_probe_status);
19653
cfg80211_report_obss_beacon_khz(struct wiphy * wiphy,const u8 * frame,size_t len,int freq,int sig_dbm)19654 void cfg80211_report_obss_beacon_khz(struct wiphy *wiphy, const u8 *frame,
19655 size_t len, int freq, int sig_dbm)
19656 {
19657 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19658 struct sk_buff *msg;
19659 void *hdr;
19660 struct cfg80211_beacon_registration *reg;
19661
19662 trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
19663
19664 spin_lock_bh(&rdev->beacon_registrations_lock);
19665 list_for_each_entry(reg, &rdev->beacon_registrations, list) {
19666 msg = nlmsg_new(len + 100, GFP_ATOMIC);
19667 if (!msg) {
19668 spin_unlock_bh(&rdev->beacon_registrations_lock);
19669 return;
19670 }
19671
19672 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
19673 if (!hdr)
19674 goto nla_put_failure;
19675
19676 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19677 (freq &&
19678 (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
19679 KHZ_TO_MHZ(freq)) ||
19680 nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
19681 freq % 1000))) ||
19682 (sig_dbm &&
19683 nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
19684 nla_put(msg, NL80211_ATTR_FRAME, len, frame))
19685 goto nla_put_failure;
19686
19687 genlmsg_end(msg, hdr);
19688
19689 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
19690 }
19691 spin_unlock_bh(&rdev->beacon_registrations_lock);
19692 return;
19693
19694 nla_put_failure:
19695 spin_unlock_bh(&rdev->beacon_registrations_lock);
19696 nlmsg_free(msg);
19697 }
19698 EXPORT_SYMBOL(cfg80211_report_obss_beacon_khz);
19699
19700 #ifdef CONFIG_PM
cfg80211_net_detect_results(struct sk_buff * msg,struct cfg80211_wowlan_wakeup * wakeup)19701 static int cfg80211_net_detect_results(struct sk_buff *msg,
19702 struct cfg80211_wowlan_wakeup *wakeup)
19703 {
19704 struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
19705 struct nlattr *nl_results, *nl_match, *nl_freqs;
19706 int i, j;
19707
19708 nl_results = nla_nest_start_noflag(msg,
19709 NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
19710 if (!nl_results)
19711 return -EMSGSIZE;
19712
19713 for (i = 0; i < nd->n_matches; i++) {
19714 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
19715
19716 nl_match = nla_nest_start_noflag(msg, i);
19717 if (!nl_match)
19718 break;
19719
19720 /* The SSID attribute is optional in nl80211, but for
19721 * simplicity reasons it's always present in the
19722 * cfg80211 structure. If a driver can't pass the
19723 * SSID, that needs to be changed. A zero length SSID
19724 * is still a valid SSID (wildcard), so it cannot be
19725 * used for this purpose.
19726 */
19727 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
19728 match->ssid.ssid)) {
19729 nla_nest_cancel(msg, nl_match);
19730 goto out;
19731 }
19732
19733 if (match->n_channels) {
19734 nl_freqs = nla_nest_start_noflag(msg,
19735 NL80211_ATTR_SCAN_FREQUENCIES);
19736 if (!nl_freqs) {
19737 nla_nest_cancel(msg, nl_match);
19738 goto out;
19739 }
19740
19741 for (j = 0; j < match->n_channels; j++) {
19742 if (nla_put_u32(msg, j, match->channels[j])) {
19743 nla_nest_cancel(msg, nl_freqs);
19744 nla_nest_cancel(msg, nl_match);
19745 goto out;
19746 }
19747 }
19748
19749 nla_nest_end(msg, nl_freqs);
19750 }
19751
19752 nla_nest_end(msg, nl_match);
19753 }
19754
19755 out:
19756 nla_nest_end(msg, nl_results);
19757 return 0;
19758 }
19759
cfg80211_report_wowlan_wakeup(struct wireless_dev * wdev,struct cfg80211_wowlan_wakeup * wakeup,gfp_t gfp)19760 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
19761 struct cfg80211_wowlan_wakeup *wakeup,
19762 gfp_t gfp)
19763 {
19764 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19765 struct sk_buff *msg;
19766 void *hdr;
19767 int size = 200;
19768
19769 trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
19770
19771 if (wakeup)
19772 size += wakeup->packet_present_len;
19773
19774 msg = nlmsg_new(size, gfp);
19775 if (!msg)
19776 return;
19777
19778 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
19779 if (!hdr)
19780 goto free_msg;
19781
19782 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19783 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19784 NL80211_ATTR_PAD))
19785 goto free_msg;
19786
19787 if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
19788 wdev->netdev->ifindex))
19789 goto free_msg;
19790
19791 if (wakeup) {
19792 struct nlattr *reasons;
19793
19794 reasons = nla_nest_start_noflag(msg,
19795 NL80211_ATTR_WOWLAN_TRIGGERS);
19796 if (!reasons)
19797 goto free_msg;
19798
19799 if (wakeup->disconnect &&
19800 nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
19801 goto free_msg;
19802 if (wakeup->magic_pkt &&
19803 nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
19804 goto free_msg;
19805 if (wakeup->gtk_rekey_failure &&
19806 nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
19807 goto free_msg;
19808 if (wakeup->eap_identity_req &&
19809 nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
19810 goto free_msg;
19811 if (wakeup->four_way_handshake &&
19812 nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
19813 goto free_msg;
19814 if (wakeup->rfkill_release &&
19815 nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
19816 goto free_msg;
19817
19818 if (wakeup->pattern_idx >= 0 &&
19819 nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
19820 wakeup->pattern_idx))
19821 goto free_msg;
19822
19823 if (wakeup->tcp_match &&
19824 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
19825 goto free_msg;
19826
19827 if (wakeup->tcp_connlost &&
19828 nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
19829 goto free_msg;
19830
19831 if (wakeup->tcp_nomoretokens &&
19832 nla_put_flag(msg,
19833 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
19834 goto free_msg;
19835
19836 if (wakeup->packet) {
19837 u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
19838 u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
19839
19840 if (!wakeup->packet_80211) {
19841 pkt_attr =
19842 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
19843 len_attr =
19844 NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
19845 }
19846
19847 if (wakeup->packet_len &&
19848 nla_put_u32(msg, len_attr, wakeup->packet_len))
19849 goto free_msg;
19850
19851 if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
19852 wakeup->packet))
19853 goto free_msg;
19854 }
19855
19856 if (wakeup->net_detect &&
19857 cfg80211_net_detect_results(msg, wakeup))
19858 goto free_msg;
19859
19860 nla_nest_end(msg, reasons);
19861 }
19862
19863 genlmsg_end(msg, hdr);
19864
19865 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19866 NL80211_MCGRP_MLME, gfp);
19867 return;
19868
19869 free_msg:
19870 nlmsg_free(msg);
19871 }
19872 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
19873 #endif
19874
cfg80211_tdls_oper_request(struct net_device * dev,const u8 * peer,enum nl80211_tdls_operation oper,u16 reason_code,gfp_t gfp)19875 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
19876 enum nl80211_tdls_operation oper,
19877 u16 reason_code, gfp_t gfp)
19878 {
19879 struct wireless_dev *wdev = dev->ieee80211_ptr;
19880 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19881 struct sk_buff *msg;
19882 void *hdr;
19883
19884 trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
19885 reason_code);
19886
19887 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19888 if (!msg)
19889 return;
19890
19891 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
19892 if (!hdr) {
19893 nlmsg_free(msg);
19894 return;
19895 }
19896
19897 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19898 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
19899 nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
19900 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
19901 (reason_code > 0 &&
19902 nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
19903 goto nla_put_failure;
19904
19905 genlmsg_end(msg, hdr);
19906
19907 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19908 NL80211_MCGRP_MLME, gfp);
19909 return;
19910
19911 nla_put_failure:
19912 nlmsg_free(msg);
19913 }
19914 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
19915
nl80211_netlink_notify(struct notifier_block * nb,unsigned long state,void * _notify)19916 static int nl80211_netlink_notify(struct notifier_block * nb,
19917 unsigned long state,
19918 void *_notify)
19919 {
19920 struct netlink_notify *notify = _notify;
19921 struct cfg80211_registered_device *rdev;
19922 struct wireless_dev *wdev;
19923 struct cfg80211_beacon_registration *reg, *tmp;
19924
19925 if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
19926 return NOTIFY_DONE;
19927
19928 rcu_read_lock();
19929
19930 list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
19931 struct cfg80211_sched_scan_request *sched_scan_req;
19932
19933 list_for_each_entry_rcu(sched_scan_req,
19934 &rdev->sched_scan_req_list,
19935 list) {
19936 if (sched_scan_req->owner_nlportid == notify->portid) {
19937 sched_scan_req->nl_owner_dead = true;
19938 wiphy_work_queue(&rdev->wiphy,
19939 &rdev->sched_scan_stop_wk);
19940 }
19941 }
19942
19943 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
19944 cfg80211_mlme_unregister_socket(wdev, notify->portid);
19945
19946 if (wdev->owner_nlportid == notify->portid) {
19947 wdev->nl_owner_dead = true;
19948 schedule_work(&rdev->destroy_work);
19949 } else if (wdev->conn_owner_nlportid == notify->portid) {
19950 schedule_work(&wdev->disconnect_wk);
19951 }
19952
19953 cfg80211_release_pmsr(wdev, notify->portid);
19954 }
19955
19956 spin_lock_bh(&rdev->beacon_registrations_lock);
19957 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
19958 list) {
19959 if (reg->nlportid == notify->portid) {
19960 list_del(®->list);
19961 kfree(reg);
19962 break;
19963 }
19964 }
19965 spin_unlock_bh(&rdev->beacon_registrations_lock);
19966 }
19967
19968 rcu_read_unlock();
19969
19970 /*
19971 * It is possible that the user space process that is controlling the
19972 * indoor setting disappeared, so notify the regulatory core.
19973 */
19974 regulatory_netlink_notify(notify->portid);
19975 return NOTIFY_OK;
19976 }
19977
19978 static struct notifier_block nl80211_netlink_notifier = {
19979 .notifier_call = nl80211_netlink_notify,
19980 };
19981
cfg80211_ft_event(struct net_device * netdev,struct cfg80211_ft_event_params * ft_event)19982 void cfg80211_ft_event(struct net_device *netdev,
19983 struct cfg80211_ft_event_params *ft_event)
19984 {
19985 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
19986 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19987 struct sk_buff *msg;
19988 void *hdr;
19989
19990 trace_cfg80211_ft_event(wiphy, netdev, ft_event);
19991
19992 if (!ft_event->target_ap)
19993 return;
19994
19995 msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
19996 GFP_KERNEL);
19997 if (!msg)
19998 return;
19999
20000 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
20001 if (!hdr)
20002 goto out;
20003
20004 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20005 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
20006 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
20007 goto out;
20008
20009 if (ft_event->ies &&
20010 nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
20011 goto out;
20012 if (ft_event->ric_ies &&
20013 nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
20014 ft_event->ric_ies))
20015 goto out;
20016
20017 genlmsg_end(msg, hdr);
20018
20019 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20020 NL80211_MCGRP_MLME, GFP_KERNEL);
20021 return;
20022 out:
20023 nlmsg_free(msg);
20024 }
20025 EXPORT_SYMBOL(cfg80211_ft_event);
20026
cfg80211_crit_proto_stopped(struct wireless_dev * wdev,gfp_t gfp)20027 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
20028 {
20029 struct cfg80211_registered_device *rdev;
20030 struct sk_buff *msg;
20031 void *hdr;
20032 u32 nlportid;
20033
20034 rdev = wiphy_to_rdev(wdev->wiphy);
20035 if (!rdev->crit_proto_nlportid)
20036 return;
20037
20038 nlportid = rdev->crit_proto_nlportid;
20039 rdev->crit_proto_nlportid = 0;
20040
20041 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20042 if (!msg)
20043 return;
20044
20045 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
20046 if (!hdr)
20047 goto nla_put_failure;
20048
20049 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20050 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
20051 NL80211_ATTR_PAD))
20052 goto nla_put_failure;
20053
20054 genlmsg_end(msg, hdr);
20055
20056 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
20057 return;
20058
20059 nla_put_failure:
20060 nlmsg_free(msg);
20061 }
20062 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
20063
nl80211_send_ap_stopped(struct wireless_dev * wdev,unsigned int link_id)20064 void nl80211_send_ap_stopped(struct wireless_dev *wdev, unsigned int link_id)
20065 {
20066 struct wiphy *wiphy = wdev->wiphy;
20067 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20068 struct sk_buff *msg;
20069 void *hdr;
20070
20071 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
20072 if (!msg)
20073 return;
20074
20075 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
20076 if (!hdr)
20077 goto out;
20078
20079 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20080 nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
20081 nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
20082 NL80211_ATTR_PAD) ||
20083 (wdev->valid_links &&
20084 nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)))
20085 goto out;
20086
20087 genlmsg_end(msg, hdr);
20088
20089 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
20090 NL80211_MCGRP_MLME, GFP_KERNEL);
20091 return;
20092 out:
20093 nlmsg_free(msg);
20094 }
20095
cfg80211_external_auth_request(struct net_device * dev,struct cfg80211_external_auth_params * params,gfp_t gfp)20096 int cfg80211_external_auth_request(struct net_device *dev,
20097 struct cfg80211_external_auth_params *params,
20098 gfp_t gfp)
20099 {
20100 struct wireless_dev *wdev = dev->ieee80211_ptr;
20101 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
20102 struct sk_buff *msg;
20103 void *hdr;
20104
20105 if (!wdev->conn_owner_nlportid)
20106 return -EINVAL;
20107
20108 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20109 if (!msg)
20110 return -ENOMEM;
20111
20112 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH);
20113 if (!hdr)
20114 goto nla_put_failure;
20115
20116 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20117 nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
20118 nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, params->key_mgmt_suite) ||
20119 nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION,
20120 params->action) ||
20121 nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) ||
20122 nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len,
20123 params->ssid.ssid) ||
20124 (!is_zero_ether_addr(params->mld_addr) &&
20125 nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN, params->mld_addr)))
20126 goto nla_put_failure;
20127
20128 genlmsg_end(msg, hdr);
20129 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
20130 wdev->conn_owner_nlportid);
20131 return 0;
20132
20133 nla_put_failure:
20134 nlmsg_free(msg);
20135 return -ENOBUFS;
20136 }
20137 EXPORT_SYMBOL(cfg80211_external_auth_request);
20138
cfg80211_update_owe_info_event(struct net_device * netdev,struct cfg80211_update_owe_info * owe_info,gfp_t gfp)20139 void cfg80211_update_owe_info_event(struct net_device *netdev,
20140 struct cfg80211_update_owe_info *owe_info,
20141 gfp_t gfp)
20142 {
20143 struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
20144 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20145 struct sk_buff *msg;
20146 void *hdr;
20147
20148 trace_cfg80211_update_owe_info_event(wiphy, netdev, owe_info);
20149
20150 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20151 if (!msg)
20152 return;
20153
20154 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_UPDATE_OWE_INFO);
20155 if (!hdr)
20156 goto nla_put_failure;
20157
20158 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20159 nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
20160 nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, owe_info->peer))
20161 goto nla_put_failure;
20162
20163 if (!owe_info->ie_len ||
20164 nla_put(msg, NL80211_ATTR_IE, owe_info->ie_len, owe_info->ie))
20165 goto nla_put_failure;
20166
20167 if (owe_info->assoc_link_id != -1) {
20168 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID,
20169 owe_info->assoc_link_id))
20170 goto nla_put_failure;
20171
20172 if (!is_zero_ether_addr(owe_info->peer_mld_addr) &&
20173 nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN,
20174 owe_info->peer_mld_addr))
20175 goto nla_put_failure;
20176 }
20177
20178 genlmsg_end(msg, hdr);
20179
20180 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20181 NL80211_MCGRP_MLME, gfp);
20182 return;
20183
20184 nla_put_failure:
20185 genlmsg_cancel(msg, hdr);
20186 nlmsg_free(msg);
20187 }
20188 EXPORT_SYMBOL(cfg80211_update_owe_info_event);
20189
20190 /* initialisation/exit functions */
20191
nl80211_init(void)20192 int __init nl80211_init(void)
20193 {
20194 int err;
20195
20196 err = genl_register_family(&nl80211_fam);
20197 if (err)
20198 return err;
20199
20200 err = netlink_register_notifier(&nl80211_netlink_notifier);
20201 if (err)
20202 goto err_out;
20203
20204 return 0;
20205 err_out:
20206 genl_unregister_family(&nl80211_fam);
20207 return err;
20208 }
20209
nl80211_exit(void)20210 void nl80211_exit(void)
20211 {
20212 netlink_unregister_notifier(&nl80211_netlink_notifier);
20213 genl_unregister_family(&nl80211_fam);
20214 }
20215
